xts.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365
  1. /* XTS: as defined in IEEE1619/D16
  2. * http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
  3. * (sector sizes which are not a multiple of 16 bytes are,
  4. * however currently unsupported)
  5. *
  6. * Copyright (c) 2007 Rik Snel <rsnel@cube.dyndns.org>
  7. *
  8. * Based om ecb.c
  9. * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
  10. *
  11. * This program is free software; you can redistribute it and/or modify it
  12. * under the terms of the GNU General Public License as published by the Free
  13. * Software Foundation; either version 2 of the License, or (at your option)
  14. * any later version.
  15. */
  16. #include <crypto/algapi.h>
  17. #include <linux/err.h>
  18. #include <linux/init.h>
  19. #include <linux/kernel.h>
  20. #include <linux/module.h>
  21. #include <linux/scatterlist.h>
  22. #include <linux/slab.h>
  23. #include <crypto/xts.h>
  24. #include <crypto/b128ops.h>
  25. #include <crypto/gf128mul.h>
  26. struct priv {
  27. struct crypto_cipher *child;
  28. struct crypto_cipher *tweak;
  29. };
  30. static int setkey(struct crypto_tfm *parent, const u8 *key,
  31. unsigned int keylen)
  32. {
  33. struct priv *ctx = crypto_tfm_ctx(parent);
  34. struct crypto_cipher *child = ctx->tweak;
  35. u32 *flags = &parent->crt_flags;
  36. int err;
  37. /* key consists of keys of equal size concatenated, therefore
  38. * the length must be even */
  39. if (keylen % 2) {
  40. /* tell the user why there was an error */
  41. *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
  42. return -EINVAL;
  43. }
  44. /* we need two cipher instances: one to compute the initial 'tweak'
  45. * by encrypting the IV (usually the 'plain' iv) and the other
  46. * one to encrypt and decrypt the data */
  47. /* tweak cipher, uses Key2 i.e. the second half of *key */
  48. crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  49. crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) &
  50. CRYPTO_TFM_REQ_MASK);
  51. err = crypto_cipher_setkey(child, key + keylen/2, keylen/2);
  52. if (err)
  53. return err;
  54. crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) &
  55. CRYPTO_TFM_RES_MASK);
  56. child = ctx->child;
  57. /* data cipher, uses Key1 i.e. the first half of *key */
  58. crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  59. crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) &
  60. CRYPTO_TFM_REQ_MASK);
  61. err = crypto_cipher_setkey(child, key, keylen/2);
  62. if (err)
  63. return err;
  64. crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) &
  65. CRYPTO_TFM_RES_MASK);
  66. return 0;
  67. }
  68. struct sinfo {
  69. be128 *t;
  70. struct crypto_tfm *tfm;
  71. void (*fn)(struct crypto_tfm *, u8 *, const u8 *);
  72. };
  73. static inline void xts_round(struct sinfo *s, void *dst, const void *src)
  74. {
  75. be128_xor(dst, s->t, src); /* PP <- T xor P */
  76. s->fn(s->tfm, dst, dst); /* CC <- E(Key1,PP) */
  77. be128_xor(dst, dst, s->t); /* C <- T xor CC */
  78. }
  79. static int crypt(struct blkcipher_desc *d,
  80. struct blkcipher_walk *w, struct priv *ctx,
  81. void (*tw)(struct crypto_tfm *, u8 *, const u8 *),
  82. void (*fn)(struct crypto_tfm *, u8 *, const u8 *))
  83. {
  84. int err;
  85. unsigned int avail;
  86. const int bs = XTS_BLOCK_SIZE;
  87. struct sinfo s = {
  88. .tfm = crypto_cipher_tfm(ctx->child),
  89. .fn = fn
  90. };
  91. u8 *wsrc;
  92. u8 *wdst;
  93. err = blkcipher_walk_virt(d, w);
  94. if (!w->nbytes)
  95. return err;
  96. s.t = (be128 *)w->iv;
  97. avail = w->nbytes;
  98. wsrc = w->src.virt.addr;
  99. wdst = w->dst.virt.addr;
  100. /* calculate first value of T */
  101. tw(crypto_cipher_tfm(ctx->tweak), w->iv, w->iv);
  102. goto first;
  103. for (;;) {
  104. do {
  105. gf128mul_x_ble(s.t, s.t);
  106. first:
  107. xts_round(&s, wdst, wsrc);
  108. wsrc += bs;
  109. wdst += bs;
  110. } while ((avail -= bs) >= bs);
  111. err = blkcipher_walk_done(d, w, avail);
  112. if (!w->nbytes)
  113. break;
  114. avail = w->nbytes;
  115. wsrc = w->src.virt.addr;
  116. wdst = w->dst.virt.addr;
  117. }
  118. return err;
  119. }
  120. static int encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
  121. struct scatterlist *src, unsigned int nbytes)
  122. {
  123. struct priv *ctx = crypto_blkcipher_ctx(desc->tfm);
  124. struct blkcipher_walk w;
  125. blkcipher_walk_init(&w, dst, src, nbytes);
  126. return crypt(desc, &w, ctx, crypto_cipher_alg(ctx->tweak)->cia_encrypt,
  127. crypto_cipher_alg(ctx->child)->cia_encrypt);
  128. }
  129. static int decrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
  130. struct scatterlist *src, unsigned int nbytes)
  131. {
  132. struct priv *ctx = crypto_blkcipher_ctx(desc->tfm);
  133. struct blkcipher_walk w;
  134. blkcipher_walk_init(&w, dst, src, nbytes);
  135. return crypt(desc, &w, ctx, crypto_cipher_alg(ctx->tweak)->cia_encrypt,
  136. crypto_cipher_alg(ctx->child)->cia_decrypt);
  137. }
  138. int xts_crypt(struct blkcipher_desc *desc, struct scatterlist *sdst,
  139. struct scatterlist *ssrc, unsigned int nbytes,
  140. struct xts_crypt_req *req)
  141. {
  142. const unsigned int bsize = XTS_BLOCK_SIZE;
  143. const unsigned int max_blks = req->tbuflen / bsize;
  144. struct blkcipher_walk walk;
  145. unsigned int nblocks;
  146. be128 *src, *dst, *t;
  147. be128 *t_buf = req->tbuf;
  148. int err, i;
  149. BUG_ON(max_blks < 1);
  150. blkcipher_walk_init(&walk, sdst, ssrc, nbytes);
  151. err = blkcipher_walk_virt(desc, &walk);
  152. nbytes = walk.nbytes;
  153. if (!nbytes)
  154. return err;
  155. nblocks = min(nbytes / bsize, max_blks);
  156. src = (be128 *)walk.src.virt.addr;
  157. dst = (be128 *)walk.dst.virt.addr;
  158. /* calculate first value of T */
  159. req->tweak_fn(req->tweak_ctx, (u8 *)&t_buf[0], walk.iv);
  160. i = 0;
  161. goto first;
  162. for (;;) {
  163. do {
  164. for (i = 0; i < nblocks; i++) {
  165. gf128mul_x_ble(&t_buf[i], t);
  166. first:
  167. t = &t_buf[i];
  168. /* PP <- T xor P */
  169. be128_xor(dst + i, t, src + i);
  170. }
  171. /* CC <- E(Key2,PP) */
  172. req->crypt_fn(req->crypt_ctx, (u8 *)dst,
  173. nblocks * bsize);
  174. /* C <- T xor CC */
  175. for (i = 0; i < nblocks; i++)
  176. be128_xor(dst + i, dst + i, &t_buf[i]);
  177. src += nblocks;
  178. dst += nblocks;
  179. nbytes -= nblocks * bsize;
  180. nblocks = min(nbytes / bsize, max_blks);
  181. } while (nblocks > 0);
  182. *(be128 *)walk.iv = *t;
  183. err = blkcipher_walk_done(desc, &walk, nbytes);
  184. nbytes = walk.nbytes;
  185. if (!nbytes)
  186. break;
  187. nblocks = min(nbytes / bsize, max_blks);
  188. src = (be128 *)walk.src.virt.addr;
  189. dst = (be128 *)walk.dst.virt.addr;
  190. }
  191. return err;
  192. }
  193. EXPORT_SYMBOL_GPL(xts_crypt);
  194. static int init_tfm(struct crypto_tfm *tfm)
  195. {
  196. struct crypto_cipher *cipher;
  197. struct crypto_instance *inst = (void *)tfm->__crt_alg;
  198. struct crypto_spawn *spawn = crypto_instance_ctx(inst);
  199. struct priv *ctx = crypto_tfm_ctx(tfm);
  200. u32 *flags = &tfm->crt_flags;
  201. cipher = crypto_spawn_cipher(spawn);
  202. if (IS_ERR(cipher))
  203. return PTR_ERR(cipher);
  204. if (crypto_cipher_blocksize(cipher) != XTS_BLOCK_SIZE) {
  205. *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN;
  206. crypto_free_cipher(cipher);
  207. return -EINVAL;
  208. }
  209. ctx->child = cipher;
  210. cipher = crypto_spawn_cipher(spawn);
  211. if (IS_ERR(cipher)) {
  212. crypto_free_cipher(ctx->child);
  213. return PTR_ERR(cipher);
  214. }
  215. /* this check isn't really needed, leave it here just in case */
  216. if (crypto_cipher_blocksize(cipher) != XTS_BLOCK_SIZE) {
  217. crypto_free_cipher(cipher);
  218. crypto_free_cipher(ctx->child);
  219. *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN;
  220. return -EINVAL;
  221. }
  222. ctx->tweak = cipher;
  223. return 0;
  224. }
  225. static void exit_tfm(struct crypto_tfm *tfm)
  226. {
  227. struct priv *ctx = crypto_tfm_ctx(tfm);
  228. crypto_free_cipher(ctx->child);
  229. crypto_free_cipher(ctx->tweak);
  230. }
  231. static struct crypto_instance *alloc(struct rtattr **tb)
  232. {
  233. struct crypto_instance *inst;
  234. struct crypto_alg *alg;
  235. int err;
  236. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_BLKCIPHER);
  237. if (err)
  238. return ERR_PTR(err);
  239. alg = crypto_get_attr_alg(tb, CRYPTO_ALG_TYPE_CIPHER,
  240. CRYPTO_ALG_TYPE_MASK);
  241. if (IS_ERR(alg))
  242. return ERR_CAST(alg);
  243. inst = crypto_alloc_instance("xts", alg);
  244. if (IS_ERR(inst))
  245. goto out_put_alg;
  246. inst->alg.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER;
  247. inst->alg.cra_priority = alg->cra_priority;
  248. inst->alg.cra_blocksize = alg->cra_blocksize;
  249. if (alg->cra_alignmask < 7)
  250. inst->alg.cra_alignmask = 7;
  251. else
  252. inst->alg.cra_alignmask = alg->cra_alignmask;
  253. inst->alg.cra_type = &crypto_blkcipher_type;
  254. inst->alg.cra_blkcipher.ivsize = alg->cra_blocksize;
  255. inst->alg.cra_blkcipher.min_keysize =
  256. 2 * alg->cra_cipher.cia_min_keysize;
  257. inst->alg.cra_blkcipher.max_keysize =
  258. 2 * alg->cra_cipher.cia_max_keysize;
  259. inst->alg.cra_ctxsize = sizeof(struct priv);
  260. inst->alg.cra_init = init_tfm;
  261. inst->alg.cra_exit = exit_tfm;
  262. inst->alg.cra_blkcipher.setkey = setkey;
  263. inst->alg.cra_blkcipher.encrypt = encrypt;
  264. inst->alg.cra_blkcipher.decrypt = decrypt;
  265. out_put_alg:
  266. crypto_mod_put(alg);
  267. return inst;
  268. }
  269. static void free(struct crypto_instance *inst)
  270. {
  271. crypto_drop_spawn(crypto_instance_ctx(inst));
  272. kfree(inst);
  273. }
  274. static struct crypto_template crypto_tmpl = {
  275. .name = "xts",
  276. .alloc = alloc,
  277. .free = free,
  278. .module = THIS_MODULE,
  279. };
  280. static int __init crypto_module_init(void)
  281. {
  282. return crypto_register_template(&crypto_tmpl);
  283. }
  284. static void __exit crypto_module_exit(void)
  285. {
  286. crypto_unregister_template(&crypto_tmpl);
  287. }
  288. module_init(crypto_module_init);
  289. module_exit(crypto_module_exit);
  290. MODULE_LICENSE("GPL");
  291. MODULE_DESCRIPTION("XTS block cipher mode");
  292. MODULE_ALIAS_CRYPTO("xts");