1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * authencesn.c - AEAD wrapper for IPsec with extended sequence numbers,
4 * derived from authenc.c
6 * Copyright (C) 2010 secunet Security Networks AG
7 * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
8 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
11 #include <crypto/internal/aead.h>
12 #include <crypto/internal/hash.h>
13 #include <crypto/internal/skcipher.h>
14 #include <crypto/authenc.h>
15 #include <crypto/null.h>
16 #include <crypto/scatterwalk.h>
17 #include <linux/err.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/rtnetlink.h>
22 #include <linux/slab.h>
23 #include <linux/spinlock.h>
25 struct authenc_esn_instance_ctx {
26 struct crypto_ahash_spawn auth;
27 struct crypto_skcipher_spawn enc;
30 struct crypto_authenc_esn_ctx {
32 struct crypto_ahash *auth;
33 struct crypto_skcipher *enc;
34 struct crypto_sync_skcipher *null;
37 struct authenc_esn_request_ctx {
38 struct scatterlist src[2];
39 struct scatterlist dst[2];
43 static void authenc_esn_request_complete(struct aead_request *req, int err)
45 if (err != -EINPROGRESS)
46 aead_request_complete(req, err);
49 static int crypto_authenc_esn_setauthsize(struct crypto_aead *authenc_esn,
50 unsigned int authsize)
52 if (authsize > 0 && authsize < 4)
58 static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 *key,
61 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
62 struct crypto_ahash *auth = ctx->auth;
63 struct crypto_skcipher *enc = ctx->enc;
64 struct crypto_authenc_keys keys;
67 if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
70 crypto_ahash_clear_flags(auth, CRYPTO_TFM_REQ_MASK);
71 crypto_ahash_set_flags(auth, crypto_aead_get_flags(authenc_esn) &
73 err = crypto_ahash_setkey(auth, keys.authkey, keys.authkeylen);
74 crypto_aead_set_flags(authenc_esn, crypto_ahash_get_flags(auth) &
80 crypto_skcipher_clear_flags(enc, CRYPTO_TFM_REQ_MASK);
81 crypto_skcipher_set_flags(enc, crypto_aead_get_flags(authenc_esn) &
83 err = crypto_skcipher_setkey(enc, keys.enckey, keys.enckeylen);
84 crypto_aead_set_flags(authenc_esn, crypto_skcipher_get_flags(enc) &
88 memzero_explicit(&keys, sizeof(keys));
92 static int crypto_authenc_esn_genicv_tail(struct aead_request *req,
95 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
96 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
97 struct authenc_esn_request_ctx *areq_ctx = aead_request_ctx(req);
98 struct crypto_ahash *auth = ctx->auth;
99 u8 *hash = PTR_ALIGN((u8 *)areq_ctx->tail,
100 crypto_ahash_alignmask(auth) + 1);
101 unsigned int authsize = crypto_aead_authsize(authenc_esn);
102 unsigned int assoclen = req->assoclen;
103 unsigned int cryptlen = req->cryptlen;
104 struct scatterlist *dst = req->dst;
107 /* Move high-order bits of sequence number back. */
108 scatterwalk_map_and_copy(tmp, dst, 4, 4, 0);
109 scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0);
110 scatterwalk_map_and_copy(tmp, dst, 0, 8, 1);
112 scatterwalk_map_and_copy(hash, dst, assoclen + cryptlen, authsize, 1);
116 static void authenc_esn_geniv_ahash_done(struct crypto_async_request *areq,
119 struct aead_request *req = areq->data;
121 err = err ?: crypto_authenc_esn_genicv_tail(req, 0);
122 aead_request_complete(req, err);
125 static int crypto_authenc_esn_genicv(struct aead_request *req,
128 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
129 struct authenc_esn_request_ctx *areq_ctx = aead_request_ctx(req);
130 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
131 struct crypto_ahash *auth = ctx->auth;
132 u8 *hash = PTR_ALIGN((u8 *)areq_ctx->tail,
133 crypto_ahash_alignmask(auth) + 1);
134 struct ahash_request *ahreq = (void *)(areq_ctx->tail + ctx->reqoff);
135 unsigned int authsize = crypto_aead_authsize(authenc_esn);
136 unsigned int assoclen = req->assoclen;
137 unsigned int cryptlen = req->cryptlen;
138 struct scatterlist *dst = req->dst;
144 /* Move high-order bits of sequence number to the end. */
145 scatterwalk_map_and_copy(tmp, dst, 0, 8, 0);
146 scatterwalk_map_and_copy(tmp, dst, 4, 4, 1);
147 scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1);
149 sg_init_table(areq_ctx->dst, 2);
150 dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4);
152 ahash_request_set_tfm(ahreq, auth);
153 ahash_request_set_crypt(ahreq, dst, hash, assoclen + cryptlen);
154 ahash_request_set_callback(ahreq, flags,
155 authenc_esn_geniv_ahash_done, req);
157 return crypto_ahash_digest(ahreq) ?:
158 crypto_authenc_esn_genicv_tail(req, aead_request_flags(req));
162 static void crypto_authenc_esn_encrypt_done(struct crypto_async_request *req,
165 struct aead_request *areq = req->data;
168 err = crypto_authenc_esn_genicv(areq, 0);
170 authenc_esn_request_complete(areq, err);
173 static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len)
175 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
176 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
177 SYNC_SKCIPHER_REQUEST_ON_STACK(skreq, ctx->null);
179 skcipher_request_set_sync_tfm(skreq, ctx->null);
180 skcipher_request_set_callback(skreq, aead_request_flags(req),
182 skcipher_request_set_crypt(skreq, req->src, req->dst, len, NULL);
184 return crypto_skcipher_encrypt(skreq);
187 static int crypto_authenc_esn_encrypt(struct aead_request *req)
189 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
190 struct authenc_esn_request_ctx *areq_ctx = aead_request_ctx(req);
191 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
192 struct skcipher_request *skreq = (void *)(areq_ctx->tail +
194 struct crypto_skcipher *enc = ctx->enc;
195 unsigned int assoclen = req->assoclen;
196 unsigned int cryptlen = req->cryptlen;
197 struct scatterlist *src, *dst;
200 sg_init_table(areq_ctx->src, 2);
201 src = scatterwalk_ffwd(areq_ctx->src, req->src, assoclen);
204 if (req->src != req->dst) {
205 err = crypto_authenc_esn_copy(req, assoclen);
209 sg_init_table(areq_ctx->dst, 2);
210 dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, assoclen);
213 skcipher_request_set_tfm(skreq, enc);
214 skcipher_request_set_callback(skreq, aead_request_flags(req),
215 crypto_authenc_esn_encrypt_done, req);
216 skcipher_request_set_crypt(skreq, src, dst, cryptlen, req->iv);
218 err = crypto_skcipher_encrypt(skreq);
222 return crypto_authenc_esn_genicv(req, aead_request_flags(req));
225 static int crypto_authenc_esn_decrypt_tail(struct aead_request *req,
228 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
229 unsigned int authsize = crypto_aead_authsize(authenc_esn);
230 struct authenc_esn_request_ctx *areq_ctx = aead_request_ctx(req);
231 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
232 struct skcipher_request *skreq = (void *)(areq_ctx->tail +
234 struct crypto_ahash *auth = ctx->auth;
235 u8 *ohash = PTR_ALIGN((u8 *)areq_ctx->tail,
236 crypto_ahash_alignmask(auth) + 1);
237 unsigned int cryptlen = req->cryptlen - authsize;
238 unsigned int assoclen = req->assoclen;
239 struct scatterlist *dst = req->dst;
240 u8 *ihash = ohash + crypto_ahash_digestsize(auth);
246 /* Move high-order bits of sequence number back. */
247 scatterwalk_map_and_copy(tmp, dst, 4, 4, 0);
248 scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0);
249 scatterwalk_map_and_copy(tmp, dst, 0, 8, 1);
251 if (crypto_memneq(ihash, ohash, authsize))
256 sg_init_table(areq_ctx->dst, 2);
257 dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen);
259 skcipher_request_set_tfm(skreq, ctx->enc);
260 skcipher_request_set_callback(skreq, flags,
261 req->base.complete, req->base.data);
262 skcipher_request_set_crypt(skreq, dst, dst, cryptlen, req->iv);
264 return crypto_skcipher_decrypt(skreq);
267 static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq,
270 struct aead_request *req = areq->data;
272 err = err ?: crypto_authenc_esn_decrypt_tail(req, 0);
273 authenc_esn_request_complete(req, err);
276 static int crypto_authenc_esn_decrypt(struct aead_request *req)
278 struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req);
279 struct authenc_esn_request_ctx *areq_ctx = aead_request_ctx(req);
280 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
281 struct ahash_request *ahreq = (void *)(areq_ctx->tail + ctx->reqoff);
282 unsigned int authsize = crypto_aead_authsize(authenc_esn);
283 struct crypto_ahash *auth = ctx->auth;
284 u8 *ohash = PTR_ALIGN((u8 *)areq_ctx->tail,
285 crypto_ahash_alignmask(auth) + 1);
286 unsigned int assoclen = req->assoclen;
287 unsigned int cryptlen = req->cryptlen;
288 u8 *ihash = ohash + crypto_ahash_digestsize(auth);
289 struct scatterlist *dst = req->dst;
293 cryptlen -= authsize;
295 if (req->src != dst) {
296 err = crypto_authenc_esn_copy(req, assoclen + cryptlen);
301 scatterwalk_map_and_copy(ihash, req->src, assoclen + cryptlen,
307 /* Move high-order bits of sequence number to the end. */
308 scatterwalk_map_and_copy(tmp, dst, 0, 8, 0);
309 scatterwalk_map_and_copy(tmp, dst, 4, 4, 1);
310 scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1);
312 sg_init_table(areq_ctx->dst, 2);
313 dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4);
315 ahash_request_set_tfm(ahreq, auth);
316 ahash_request_set_crypt(ahreq, dst, ohash, assoclen + cryptlen);
317 ahash_request_set_callback(ahreq, aead_request_flags(req),
318 authenc_esn_verify_ahash_done, req);
320 err = crypto_ahash_digest(ahreq);
325 return crypto_authenc_esn_decrypt_tail(req, aead_request_flags(req));
328 static int crypto_authenc_esn_init_tfm(struct crypto_aead *tfm)
330 struct aead_instance *inst = aead_alg_instance(tfm);
331 struct authenc_esn_instance_ctx *ictx = aead_instance_ctx(inst);
332 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(tfm);
333 struct crypto_ahash *auth;
334 struct crypto_skcipher *enc;
335 struct crypto_sync_skcipher *null;
338 auth = crypto_spawn_ahash(&ictx->auth);
340 return PTR_ERR(auth);
342 enc = crypto_spawn_skcipher(&ictx->enc);
347 null = crypto_get_default_null_skcipher();
350 goto err_free_skcipher;
356 ctx->reqoff = ALIGN(2 * crypto_ahash_digestsize(auth),
357 crypto_ahash_alignmask(auth) + 1);
359 crypto_aead_set_reqsize(
361 sizeof(struct authenc_esn_request_ctx) +
364 crypto_ahash_reqsize(auth) +
365 sizeof(struct ahash_request),
366 sizeof(struct skcipher_request) +
367 crypto_skcipher_reqsize(enc)));
372 crypto_free_skcipher(enc);
374 crypto_free_ahash(auth);
378 static void crypto_authenc_esn_exit_tfm(struct crypto_aead *tfm)
380 struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(tfm);
382 crypto_free_ahash(ctx->auth);
383 crypto_free_skcipher(ctx->enc);
384 crypto_put_default_null_skcipher();
387 static void crypto_authenc_esn_free(struct aead_instance *inst)
389 struct authenc_esn_instance_ctx *ctx = aead_instance_ctx(inst);
391 crypto_drop_skcipher(&ctx->enc);
392 crypto_drop_ahash(&ctx->auth);
396 static int crypto_authenc_esn_create(struct crypto_template *tmpl,
399 struct crypto_attr_type *algt;
400 struct aead_instance *inst;
401 struct hash_alg_common *auth;
402 struct crypto_alg *auth_base;
403 struct skcipher_alg *enc;
404 struct authenc_esn_instance_ctx *ctx;
405 const char *enc_name;
408 algt = crypto_get_attr_type(tb);
410 return PTR_ERR(algt);
412 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
415 auth = ahash_attr_alg(tb[1], CRYPTO_ALG_TYPE_HASH,
416 CRYPTO_ALG_TYPE_AHASH_MASK |
417 crypto_requires_sync(algt->type, algt->mask));
419 return PTR_ERR(auth);
421 auth_base = &auth->base;
423 enc_name = crypto_attr_alg_name(tb[2]);
424 err = PTR_ERR(enc_name);
425 if (IS_ERR(enc_name))
428 inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
433 ctx = aead_instance_ctx(inst);
435 err = crypto_init_ahash_spawn(&ctx->auth, auth,
436 aead_crypto_instance(inst));
440 crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst));
441 err = crypto_grab_skcipher(&ctx->enc, enc_name, 0,
442 crypto_requires_sync(algt->type,
447 enc = crypto_spawn_skcipher_alg(&ctx->enc);
450 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
451 "authencesn(%s,%s)", auth_base->cra_name,
452 enc->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
455 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
456 "authencesn(%s,%s)", auth_base->cra_driver_name,
457 enc->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
460 inst->alg.base.cra_flags = (auth_base->cra_flags |
461 enc->base.cra_flags) & CRYPTO_ALG_ASYNC;
462 inst->alg.base.cra_priority = enc->base.cra_priority * 10 +
463 auth_base->cra_priority;
464 inst->alg.base.cra_blocksize = enc->base.cra_blocksize;
465 inst->alg.base.cra_alignmask = auth_base->cra_alignmask |
466 enc->base.cra_alignmask;
467 inst->alg.base.cra_ctxsize = sizeof(struct crypto_authenc_esn_ctx);
469 inst->alg.ivsize = crypto_skcipher_alg_ivsize(enc);
470 inst->alg.chunksize = crypto_skcipher_alg_chunksize(enc);
471 inst->alg.maxauthsize = auth->digestsize;
473 inst->alg.init = crypto_authenc_esn_init_tfm;
474 inst->alg.exit = crypto_authenc_esn_exit_tfm;
476 inst->alg.setkey = crypto_authenc_esn_setkey;
477 inst->alg.setauthsize = crypto_authenc_esn_setauthsize;
478 inst->alg.encrypt = crypto_authenc_esn_encrypt;
479 inst->alg.decrypt = crypto_authenc_esn_decrypt;
481 inst->free = crypto_authenc_esn_free,
483 err = aead_register_instance(tmpl, inst);
488 crypto_mod_put(auth_base);
492 crypto_drop_skcipher(&ctx->enc);
494 crypto_drop_ahash(&ctx->auth);
501 static struct crypto_template crypto_authenc_esn_tmpl = {
502 .name = "authencesn",
503 .create = crypto_authenc_esn_create,
504 .module = THIS_MODULE,
507 static int __init crypto_authenc_esn_module_init(void)
509 return crypto_register_template(&crypto_authenc_esn_tmpl);
512 static void __exit crypto_authenc_esn_module_exit(void)
514 crypto_unregister_template(&crypto_authenc_esn_tmpl);
517 subsys_initcall(crypto_authenc_esn_module_init);
518 module_exit(crypto_authenc_esn_module_exit);
520 MODULE_LICENSE("GPL");
521 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
522 MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
523 MODULE_ALIAS_CRYPTO("authencesn");