1 /* 2 * QEMU Crypto XTS cipher mode 3 * 4 * Copyright (c) 2015-2016 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 * This code is originally derived from public domain / WTFPL code in 20 * LibTomCrypt crytographic library http://libtom.org. The XTS code 21 * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com) 22 * to the LibTom Projects 23 * 24 */ 25 26 #include "qemu/osdep.h" 27 #include "crypto/xts.h" 28 29 static void xts_mult_x(uint8_t *I) 30 { 31 int x; 32 uint8_t t, tt; 33 34 for (x = t = 0; x < 16; x++) { 35 tt = I[x] >> 7; 36 I[x] = ((I[x] << 1) | t) & 0xFF; 37 t = tt; 38 } 39 if (tt) { 40 I[0] ^= 0x87; 41 } 42 } 43 44 45 /** 46 * xts_tweak_encdec: 47 * @param ctxt: the cipher context 48 * @param func: the cipher function 49 * @src: buffer providing the input text of XTS_BLOCK_SIZE bytes 50 * @dst: buffer to output the output text of XTS_BLOCK_SIZE bytes 51 * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes 52 * 53 * Encrypt/decrypt data with a tweak 54 */ 55 static void xts_tweak_encdec(const void *ctx, 56 xts_cipher_func *func, 57 const uint8_t *src, 58 uint8_t *dst, 59 uint8_t *iv) 60 { 61 unsigned long x; 62 63 /* tweak encrypt block i */ 64 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 65 dst[x] = src[x] ^ iv[x]; 66 } 67 68 func(ctx, XTS_BLOCK_SIZE, dst, dst); 69 70 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 71 dst[x] = dst[x] ^ iv[x]; 72 } 73 74 /* LFSR the tweak */ 75 xts_mult_x(iv); 76 } 77 78 79 void xts_decrypt(const void *datactx, 80 const void *tweakctx, 81 xts_cipher_func *encfunc, 82 xts_cipher_func *decfunc, 83 uint8_t *iv, 84 size_t length, 85 uint8_t *dst, 86 const uint8_t *src) 87 { 88 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE]; 89 unsigned long i, m, mo, lim; 90 91 /* get number of blocks */ 92 m = length >> 4; 93 mo = length & 15; 94 95 /* must have at least one full block */ 96 g_assert(m != 0); 97 98 if (mo == 0) { 99 lim = m; 100 } else { 101 lim = m - 1; 102 } 103 104 /* encrypt the iv */ 105 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv); 106 107 for (i = 0; i < lim; i++) { 108 xts_tweak_encdec(datactx, decfunc, src, dst, T); 109 110 src += XTS_BLOCK_SIZE; 111 dst += XTS_BLOCK_SIZE; 112 } 113 114 /* if length is not a multiple of XTS_BLOCK_SIZE then */ 115 if (mo > 0) { 116 memcpy(CC, T, XTS_BLOCK_SIZE); 117 xts_mult_x(CC); 118 119 /* PP = tweak decrypt block m-1 */ 120 xts_tweak_encdec(datactx, decfunc, src, PP, CC); 121 122 /* Pm = first length % XTS_BLOCK_SIZE bytes of PP */ 123 for (i = 0; i < mo; i++) { 124 CC[i] = src[XTS_BLOCK_SIZE + i]; 125 dst[XTS_BLOCK_SIZE + i] = PP[i]; 126 } 127 for (; i < XTS_BLOCK_SIZE; i++) { 128 CC[i] = PP[i]; 129 } 130 131 /* Pm-1 = Tweak uncrypt CC */ 132 xts_tweak_encdec(datactx, decfunc, CC, dst, T); 133 } 134 135 /* Decrypt the iv back */ 136 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T); 137 } 138 139 140 void xts_encrypt(const void *datactx, 141 const void *tweakctx, 142 xts_cipher_func *encfunc, 143 xts_cipher_func *decfunc, 144 uint8_t *iv, 145 size_t length, 146 uint8_t *dst, 147 const uint8_t *src) 148 { 149 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE]; 150 unsigned long i, m, mo, lim; 151 152 /* get number of blocks */ 153 m = length >> 4; 154 mo = length & 15; 155 156 /* must have at least one full block */ 157 g_assert(m != 0); 158 159 if (mo == 0) { 160 lim = m; 161 } else { 162 lim = m - 1; 163 } 164 165 /* encrypt the iv */ 166 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv); 167 168 for (i = 0; i < lim; i++) { 169 xts_tweak_encdec(datactx, encfunc, src, dst, T); 170 171 dst += XTS_BLOCK_SIZE; 172 src += XTS_BLOCK_SIZE; 173 } 174 175 /* if length is not a multiple of XTS_BLOCK_SIZE then */ 176 if (mo > 0) { 177 /* CC = tweak encrypt block m-1 */ 178 xts_tweak_encdec(datactx, encfunc, src, CC, T); 179 180 /* Cm = first length % XTS_BLOCK_SIZE bytes of CC */ 181 for (i = 0; i < mo; i++) { 182 PP[i] = src[XTS_BLOCK_SIZE + i]; 183 dst[XTS_BLOCK_SIZE + i] = CC[i]; 184 } 185 186 for (; i < XTS_BLOCK_SIZE; i++) { 187 PP[i] = CC[i]; 188 } 189 190 /* Cm-1 = Tweak encrypt PP */ 191 xts_tweak_encdec(datactx, encfunc, PP, dst, T); 192 } 193 194 /* Decrypt the iv back */ 195 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T); 196 } 197