xref: /openbmc/linux/crypto/adiantum.c (revision 059c2a4d)
1059c2a4dSEric Biggers // SPDX-License-Identifier: GPL-2.0
2059c2a4dSEric Biggers /*
3059c2a4dSEric Biggers  * Adiantum length-preserving encryption mode
4059c2a4dSEric Biggers  *
5059c2a4dSEric Biggers  * Copyright 2018 Google LLC
6059c2a4dSEric Biggers  */
7059c2a4dSEric Biggers 
8059c2a4dSEric Biggers /*
9059c2a4dSEric Biggers  * Adiantum is a tweakable, length-preserving encryption mode designed for fast
10059c2a4dSEric Biggers  * and secure disk encryption, especially on CPUs without dedicated crypto
11059c2a4dSEric Biggers  * instructions.  Adiantum encrypts each sector using the XChaCha12 stream
12059c2a4dSEric Biggers  * cipher, two passes of an ε-almost-∆-universal (εA∆U) hash function based on
13059c2a4dSEric Biggers  * NH and Poly1305, and an invocation of the AES-256 block cipher on a single
14059c2a4dSEric Biggers  * 16-byte block.  See the paper for details:
15059c2a4dSEric Biggers  *
16059c2a4dSEric Biggers  *	Adiantum: length-preserving encryption for entry-level processors
17059c2a4dSEric Biggers  *      (https://eprint.iacr.org/2018/720.pdf)
18059c2a4dSEric Biggers  *
19059c2a4dSEric Biggers  * For flexibility, this implementation also allows other ciphers:
20059c2a4dSEric Biggers  *
21059c2a4dSEric Biggers  *	- Stream cipher: XChaCha12 or XChaCha20
22059c2a4dSEric Biggers  *	- Block cipher: any with a 128-bit block size and 256-bit key
23059c2a4dSEric Biggers  *
24059c2a4dSEric Biggers  * This implementation doesn't currently allow other εA∆U hash functions, i.e.
25059c2a4dSEric Biggers  * HPolyC is not supported.  This is because Adiantum is ~20% faster than HPolyC
26059c2a4dSEric Biggers  * but still provably as secure, and also the εA∆U hash function of HBSH is
27059c2a4dSEric Biggers  * formally defined to take two inputs (tweak, message) which makes it difficult
28059c2a4dSEric Biggers  * to wrap with the crypto_shash API.  Rather, some details need to be handled
29059c2a4dSEric Biggers  * here.  Nevertheless, if needed in the future, support for other εA∆U hash
30059c2a4dSEric Biggers  * functions could be added here.
31059c2a4dSEric Biggers  */
32059c2a4dSEric Biggers 
33059c2a4dSEric Biggers #include <crypto/b128ops.h>
34059c2a4dSEric Biggers #include <crypto/chacha.h>
35059c2a4dSEric Biggers #include <crypto/internal/hash.h>
36059c2a4dSEric Biggers #include <crypto/internal/skcipher.h>
37059c2a4dSEric Biggers #include <crypto/nhpoly1305.h>
38059c2a4dSEric Biggers #include <crypto/scatterwalk.h>
39059c2a4dSEric Biggers #include <linux/module.h>
40059c2a4dSEric Biggers 
41059c2a4dSEric Biggers #include "internal.h"
42059c2a4dSEric Biggers 
43059c2a4dSEric Biggers /*
44059c2a4dSEric Biggers  * Size of right-hand block of input data, in bytes; also the size of the block
45059c2a4dSEric Biggers  * cipher's block size and the hash function's output.
46059c2a4dSEric Biggers  */
47059c2a4dSEric Biggers #define BLOCKCIPHER_BLOCK_SIZE		16
48059c2a4dSEric Biggers 
49059c2a4dSEric Biggers /* Size of the block cipher key (K_E) in bytes */
50059c2a4dSEric Biggers #define BLOCKCIPHER_KEY_SIZE		32
51059c2a4dSEric Biggers 
52059c2a4dSEric Biggers /* Size of the hash key (K_H) in bytes */
53059c2a4dSEric Biggers #define HASH_KEY_SIZE		(POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE)
54059c2a4dSEric Biggers 
55059c2a4dSEric Biggers /*
56059c2a4dSEric Biggers  * The specification allows variable-length tweaks, but Linux's crypto API
57059c2a4dSEric Biggers  * currently only allows algorithms to support a single length.  The "natural"
58059c2a4dSEric Biggers  * tweak length for Adiantum is 16, since that fits into one Poly1305 block for
59059c2a4dSEric Biggers  * the best performance.  But longer tweaks are useful for fscrypt, to avoid
60059c2a4dSEric Biggers  * needing to derive per-file keys.  So instead we use two blocks, or 32 bytes.
61059c2a4dSEric Biggers  */
62059c2a4dSEric Biggers #define TWEAK_SIZE		32
63059c2a4dSEric Biggers 
64059c2a4dSEric Biggers struct adiantum_instance_ctx {
65059c2a4dSEric Biggers 	struct crypto_skcipher_spawn streamcipher_spawn;
66059c2a4dSEric Biggers 	struct crypto_spawn blockcipher_spawn;
67059c2a4dSEric Biggers 	struct crypto_shash_spawn hash_spawn;
68059c2a4dSEric Biggers };
69059c2a4dSEric Biggers 
70059c2a4dSEric Biggers struct adiantum_tfm_ctx {
71059c2a4dSEric Biggers 	struct crypto_skcipher *streamcipher;
72059c2a4dSEric Biggers 	struct crypto_cipher *blockcipher;
73059c2a4dSEric Biggers 	struct crypto_shash *hash;
74059c2a4dSEric Biggers 	struct poly1305_key header_hash_key;
75059c2a4dSEric Biggers };
76059c2a4dSEric Biggers 
77059c2a4dSEric Biggers struct adiantum_request_ctx {
78059c2a4dSEric Biggers 
79059c2a4dSEric Biggers 	/*
80059c2a4dSEric Biggers 	 * Buffer for right-hand block of data, i.e.
81059c2a4dSEric Biggers 	 *
82059c2a4dSEric Biggers 	 *    P_L => P_M => C_M => C_R when encrypting, or
83059c2a4dSEric Biggers 	 *    C_R => C_M => P_M => P_L when decrypting.
84059c2a4dSEric Biggers 	 *
85059c2a4dSEric Biggers 	 * Also used to build the IV for the stream cipher.
86059c2a4dSEric Biggers 	 */
87059c2a4dSEric Biggers 	union {
88059c2a4dSEric Biggers 		u8 bytes[XCHACHA_IV_SIZE];
89059c2a4dSEric Biggers 		__le32 words[XCHACHA_IV_SIZE / sizeof(__le32)];
90059c2a4dSEric Biggers 		le128 bignum;	/* interpret as element of Z/(2^{128}Z) */
91059c2a4dSEric Biggers 	} rbuf;
92059c2a4dSEric Biggers 
93059c2a4dSEric Biggers 	bool enc; /* true if encrypting, false if decrypting */
94059c2a4dSEric Biggers 
95059c2a4dSEric Biggers 	/*
96059c2a4dSEric Biggers 	 * The result of the Poly1305 εA∆U hash function applied to
97059c2a4dSEric Biggers 	 * (message length, tweak).
98059c2a4dSEric Biggers 	 */
99059c2a4dSEric Biggers 	le128 header_hash;
100059c2a4dSEric Biggers 
101059c2a4dSEric Biggers 	/* Sub-requests, must be last */
102059c2a4dSEric Biggers 	union {
103059c2a4dSEric Biggers 		struct shash_desc hash_desc;
104059c2a4dSEric Biggers 		struct skcipher_request streamcipher_req;
105059c2a4dSEric Biggers 	} u;
106059c2a4dSEric Biggers };
107059c2a4dSEric Biggers 
108059c2a4dSEric Biggers /*
109059c2a4dSEric Biggers  * Given the XChaCha stream key K_S, derive the block cipher key K_E and the
110059c2a4dSEric Biggers  * hash key K_H as follows:
111059c2a4dSEric Biggers  *
112059c2a4dSEric Biggers  *     K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191)
113059c2a4dSEric Biggers  *
114059c2a4dSEric Biggers  * Note that this denotes using bits from the XChaCha keystream, which here we
115059c2a4dSEric Biggers  * get indirectly by encrypting a buffer containing all 0's.
116059c2a4dSEric Biggers  */
117059c2a4dSEric Biggers static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key,
118059c2a4dSEric Biggers 			   unsigned int keylen)
119059c2a4dSEric Biggers {
120059c2a4dSEric Biggers 	struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
121059c2a4dSEric Biggers 	struct {
122059c2a4dSEric Biggers 		u8 iv[XCHACHA_IV_SIZE];
123059c2a4dSEric Biggers 		u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE];
124059c2a4dSEric Biggers 		struct scatterlist sg;
125059c2a4dSEric Biggers 		struct crypto_wait wait;
126059c2a4dSEric Biggers 		struct skcipher_request req; /* must be last */
127059c2a4dSEric Biggers 	} *data;
128059c2a4dSEric Biggers 	u8 *keyp;
129059c2a4dSEric Biggers 	int err;
130059c2a4dSEric Biggers 
131059c2a4dSEric Biggers 	/* Set the stream cipher key (K_S) */
132059c2a4dSEric Biggers 	crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK);
133059c2a4dSEric Biggers 	crypto_skcipher_set_flags(tctx->streamcipher,
134059c2a4dSEric Biggers 				  crypto_skcipher_get_flags(tfm) &
135059c2a4dSEric Biggers 				  CRYPTO_TFM_REQ_MASK);
136059c2a4dSEric Biggers 	err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen);
137059c2a4dSEric Biggers 	crypto_skcipher_set_flags(tfm,
138059c2a4dSEric Biggers 				crypto_skcipher_get_flags(tctx->streamcipher) &
139059c2a4dSEric Biggers 				CRYPTO_TFM_RES_MASK);
140059c2a4dSEric Biggers 	if (err)
141059c2a4dSEric Biggers 		return err;
142059c2a4dSEric Biggers 
143059c2a4dSEric Biggers 	/* Derive the subkeys */
144059c2a4dSEric Biggers 	data = kzalloc(sizeof(*data) +
145059c2a4dSEric Biggers 		       crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL);
146059c2a4dSEric Biggers 	if (!data)
147059c2a4dSEric Biggers 		return -ENOMEM;
148059c2a4dSEric Biggers 	data->iv[0] = 1;
149059c2a4dSEric Biggers 	sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys));
150059c2a4dSEric Biggers 	crypto_init_wait(&data->wait);
151059c2a4dSEric Biggers 	skcipher_request_set_tfm(&data->req, tctx->streamcipher);
152059c2a4dSEric Biggers 	skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP |
153059c2a4dSEric Biggers 						  CRYPTO_TFM_REQ_MAY_BACKLOG,
154059c2a4dSEric Biggers 				      crypto_req_done, &data->wait);
155059c2a4dSEric Biggers 	skcipher_request_set_crypt(&data->req, &data->sg, &data->sg,
156059c2a4dSEric Biggers 				   sizeof(data->derived_keys), data->iv);
157059c2a4dSEric Biggers 	err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait);
158059c2a4dSEric Biggers 	if (err)
159059c2a4dSEric Biggers 		goto out;
160059c2a4dSEric Biggers 	keyp = data->derived_keys;
161059c2a4dSEric Biggers 
162059c2a4dSEric Biggers 	/* Set the block cipher key (K_E) */
163059c2a4dSEric Biggers 	crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK);
164059c2a4dSEric Biggers 	crypto_cipher_set_flags(tctx->blockcipher,
165059c2a4dSEric Biggers 				crypto_skcipher_get_flags(tfm) &
166059c2a4dSEric Biggers 				CRYPTO_TFM_REQ_MASK);
167059c2a4dSEric Biggers 	err = crypto_cipher_setkey(tctx->blockcipher, keyp,
168059c2a4dSEric Biggers 				   BLOCKCIPHER_KEY_SIZE);
169059c2a4dSEric Biggers 	crypto_skcipher_set_flags(tfm,
170059c2a4dSEric Biggers 				  crypto_cipher_get_flags(tctx->blockcipher) &
171059c2a4dSEric Biggers 				  CRYPTO_TFM_RES_MASK);
172059c2a4dSEric Biggers 	if (err)
173059c2a4dSEric Biggers 		goto out;
174059c2a4dSEric Biggers 	keyp += BLOCKCIPHER_KEY_SIZE;
175059c2a4dSEric Biggers 
176059c2a4dSEric Biggers 	/* Set the hash key (K_H) */
177059c2a4dSEric Biggers 	poly1305_core_setkey(&tctx->header_hash_key, keyp);
178059c2a4dSEric Biggers 	keyp += POLY1305_BLOCK_SIZE;
179059c2a4dSEric Biggers 
180059c2a4dSEric Biggers 	crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK);
181059c2a4dSEric Biggers 	crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) &
182059c2a4dSEric Biggers 					   CRYPTO_TFM_REQ_MASK);
183059c2a4dSEric Biggers 	err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE);
184059c2a4dSEric Biggers 	crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) &
185059c2a4dSEric Biggers 				       CRYPTO_TFM_RES_MASK);
186059c2a4dSEric Biggers 	keyp += NHPOLY1305_KEY_SIZE;
187059c2a4dSEric Biggers 	WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]);
188059c2a4dSEric Biggers out:
189059c2a4dSEric Biggers 	kzfree(data);
190059c2a4dSEric Biggers 	return err;
191059c2a4dSEric Biggers }
192059c2a4dSEric Biggers 
193059c2a4dSEric Biggers /* Addition in Z/(2^{128}Z) */
194059c2a4dSEric Biggers static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2)
195059c2a4dSEric Biggers {
196059c2a4dSEric Biggers 	u64 x = le64_to_cpu(v1->b);
197059c2a4dSEric Biggers 	u64 y = le64_to_cpu(v2->b);
198059c2a4dSEric Biggers 
199059c2a4dSEric Biggers 	r->b = cpu_to_le64(x + y);
200059c2a4dSEric Biggers 	r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) +
201059c2a4dSEric Biggers 			   (x + y < x));
202059c2a4dSEric Biggers }
203059c2a4dSEric Biggers 
204059c2a4dSEric Biggers /* Subtraction in Z/(2^{128}Z) */
205059c2a4dSEric Biggers static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2)
206059c2a4dSEric Biggers {
207059c2a4dSEric Biggers 	u64 x = le64_to_cpu(v1->b);
208059c2a4dSEric Biggers 	u64 y = le64_to_cpu(v2->b);
209059c2a4dSEric Biggers 
210059c2a4dSEric Biggers 	r->b = cpu_to_le64(x - y);
211059c2a4dSEric Biggers 	r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) -
212059c2a4dSEric Biggers 			   (x - y > x));
213059c2a4dSEric Biggers }
214059c2a4dSEric Biggers 
215059c2a4dSEric Biggers /*
216059c2a4dSEric Biggers  * Apply the Poly1305 εA∆U hash function to (message length, tweak) and save the
217059c2a4dSEric Biggers  * result to rctx->header_hash.
218059c2a4dSEric Biggers  *
219059c2a4dSEric Biggers  * This value is reused in both the first and second hash steps.  Specifically,
220059c2a4dSEric Biggers  * it's added to the result of an independently keyed εA∆U hash function (for
221059c2a4dSEric Biggers  * equal length inputs only) taken over the message.  This gives the overall
222059c2a4dSEric Biggers  * Adiantum hash of the (tweak, message) pair.
223059c2a4dSEric Biggers  */
224059c2a4dSEric Biggers static void adiantum_hash_header(struct skcipher_request *req)
225059c2a4dSEric Biggers {
226059c2a4dSEric Biggers 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
227059c2a4dSEric Biggers 	const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
228059c2a4dSEric Biggers 	struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
229059c2a4dSEric Biggers 	const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
230059c2a4dSEric Biggers 	struct {
231059c2a4dSEric Biggers 		__le64 message_bits;
232059c2a4dSEric Biggers 		__le64 padding;
233059c2a4dSEric Biggers 	} header = {
234059c2a4dSEric Biggers 		.message_bits = cpu_to_le64((u64)bulk_len * 8)
235059c2a4dSEric Biggers 	};
236059c2a4dSEric Biggers 	struct poly1305_state state;
237059c2a4dSEric Biggers 
238059c2a4dSEric Biggers 	poly1305_core_init(&state);
239059c2a4dSEric Biggers 
240059c2a4dSEric Biggers 	BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0);
241059c2a4dSEric Biggers 	poly1305_core_blocks(&state, &tctx->header_hash_key,
242059c2a4dSEric Biggers 			     &header, sizeof(header) / POLY1305_BLOCK_SIZE);
243059c2a4dSEric Biggers 
244059c2a4dSEric Biggers 	BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0);
245059c2a4dSEric Biggers 	poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv,
246059c2a4dSEric Biggers 			     TWEAK_SIZE / POLY1305_BLOCK_SIZE);
247059c2a4dSEric Biggers 
248059c2a4dSEric Biggers 	poly1305_core_emit(&state, &rctx->header_hash);
249059c2a4dSEric Biggers }
250059c2a4dSEric Biggers 
251059c2a4dSEric Biggers /* Hash the left-hand block (the "bulk") of the message using NHPoly1305 */
252059c2a4dSEric Biggers static int adiantum_hash_message(struct skcipher_request *req,
253059c2a4dSEric Biggers 				 struct scatterlist *sgl, le128 *digest)
254059c2a4dSEric Biggers {
255059c2a4dSEric Biggers 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
256059c2a4dSEric Biggers 	const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
257059c2a4dSEric Biggers 	struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
258059c2a4dSEric Biggers 	const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
259059c2a4dSEric Biggers 	struct shash_desc *hash_desc = &rctx->u.hash_desc;
260059c2a4dSEric Biggers 	struct sg_mapping_iter miter;
261059c2a4dSEric Biggers 	unsigned int i, n;
262059c2a4dSEric Biggers 	int err;
263059c2a4dSEric Biggers 
264059c2a4dSEric Biggers 	hash_desc->tfm = tctx->hash;
265059c2a4dSEric Biggers 	hash_desc->flags = 0;
266059c2a4dSEric Biggers 
267059c2a4dSEric Biggers 	err = crypto_shash_init(hash_desc);
268059c2a4dSEric Biggers 	if (err)
269059c2a4dSEric Biggers 		return err;
270059c2a4dSEric Biggers 
271059c2a4dSEric Biggers 	sg_miter_start(&miter, sgl, sg_nents(sgl),
272059c2a4dSEric Biggers 		       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
273059c2a4dSEric Biggers 	for (i = 0; i < bulk_len; i += n) {
274059c2a4dSEric Biggers 		sg_miter_next(&miter);
275059c2a4dSEric Biggers 		n = min_t(unsigned int, miter.length, bulk_len - i);
276059c2a4dSEric Biggers 		err = crypto_shash_update(hash_desc, miter.addr, n);
277059c2a4dSEric Biggers 		if (err)
278059c2a4dSEric Biggers 			break;
279059c2a4dSEric Biggers 	}
280059c2a4dSEric Biggers 	sg_miter_stop(&miter);
281059c2a4dSEric Biggers 	if (err)
282059c2a4dSEric Biggers 		return err;
283059c2a4dSEric Biggers 
284059c2a4dSEric Biggers 	return crypto_shash_final(hash_desc, (u8 *)digest);
285059c2a4dSEric Biggers }
286059c2a4dSEric Biggers 
287059c2a4dSEric Biggers /* Continue Adiantum encryption/decryption after the stream cipher step */
288059c2a4dSEric Biggers static int adiantum_finish(struct skcipher_request *req)
289059c2a4dSEric Biggers {
290059c2a4dSEric Biggers 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
291059c2a4dSEric Biggers 	const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
292059c2a4dSEric Biggers 	struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
293059c2a4dSEric Biggers 	const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
294059c2a4dSEric Biggers 	le128 digest;
295059c2a4dSEric Biggers 	int err;
296059c2a4dSEric Biggers 
297059c2a4dSEric Biggers 	/* If decrypting, decrypt C_M with the block cipher to get P_M */
298059c2a4dSEric Biggers 	if (!rctx->enc)
299059c2a4dSEric Biggers 		crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
300059c2a4dSEric Biggers 					  rctx->rbuf.bytes);
301059c2a4dSEric Biggers 
302059c2a4dSEric Biggers 	/*
303059c2a4dSEric Biggers 	 * Second hash step
304059c2a4dSEric Biggers 	 *	enc: C_R = C_M - H_{K_H}(T, C_L)
305059c2a4dSEric Biggers 	 *	dec: P_R = P_M - H_{K_H}(T, P_L)
306059c2a4dSEric Biggers 	 */
307059c2a4dSEric Biggers 	err = adiantum_hash_message(req, req->dst, &digest);
308059c2a4dSEric Biggers 	if (err)
309059c2a4dSEric Biggers 		return err;
310059c2a4dSEric Biggers 	le128_add(&digest, &digest, &rctx->header_hash);
311059c2a4dSEric Biggers 	le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
312059c2a4dSEric Biggers 	scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst,
313059c2a4dSEric Biggers 				 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1);
314059c2a4dSEric Biggers 	return 0;
315059c2a4dSEric Biggers }
316059c2a4dSEric Biggers 
317059c2a4dSEric Biggers static void adiantum_streamcipher_done(struct crypto_async_request *areq,
318059c2a4dSEric Biggers 				       int err)
319059c2a4dSEric Biggers {
320059c2a4dSEric Biggers 	struct skcipher_request *req = areq->data;
321059c2a4dSEric Biggers 
322059c2a4dSEric Biggers 	if (!err)
323059c2a4dSEric Biggers 		err = adiantum_finish(req);
324059c2a4dSEric Biggers 
325059c2a4dSEric Biggers 	skcipher_request_complete(req, err);
326059c2a4dSEric Biggers }
327059c2a4dSEric Biggers 
328059c2a4dSEric Biggers static int adiantum_crypt(struct skcipher_request *req, bool enc)
329059c2a4dSEric Biggers {
330059c2a4dSEric Biggers 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
331059c2a4dSEric Biggers 	const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
332059c2a4dSEric Biggers 	struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
333059c2a4dSEric Biggers 	const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
334059c2a4dSEric Biggers 	unsigned int stream_len;
335059c2a4dSEric Biggers 	le128 digest;
336059c2a4dSEric Biggers 	int err;
337059c2a4dSEric Biggers 
338059c2a4dSEric Biggers 	if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE)
339059c2a4dSEric Biggers 		return -EINVAL;
340059c2a4dSEric Biggers 
341059c2a4dSEric Biggers 	rctx->enc = enc;
342059c2a4dSEric Biggers 
343059c2a4dSEric Biggers 	/*
344059c2a4dSEric Biggers 	 * First hash step
345059c2a4dSEric Biggers 	 *	enc: P_M = P_R + H_{K_H}(T, P_L)
346059c2a4dSEric Biggers 	 *	dec: C_M = C_R + H_{K_H}(T, C_L)
347059c2a4dSEric Biggers 	 */
348059c2a4dSEric Biggers 	adiantum_hash_header(req);
349059c2a4dSEric Biggers 	err = adiantum_hash_message(req, req->src, &digest);
350059c2a4dSEric Biggers 	if (err)
351059c2a4dSEric Biggers 		return err;
352059c2a4dSEric Biggers 	le128_add(&digest, &digest, &rctx->header_hash);
353059c2a4dSEric Biggers 	scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src,
354059c2a4dSEric Biggers 				 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0);
355059c2a4dSEric Biggers 	le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
356059c2a4dSEric Biggers 
357059c2a4dSEric Biggers 	/* If encrypting, encrypt P_M with the block cipher to get C_M */
358059c2a4dSEric Biggers 	if (enc)
359059c2a4dSEric Biggers 		crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
360059c2a4dSEric Biggers 					  rctx->rbuf.bytes);
361059c2a4dSEric Biggers 
362059c2a4dSEric Biggers 	/* Initialize the rest of the XChaCha IV (first part is C_M) */
363059c2a4dSEric Biggers 	BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16);
364059c2a4dSEric Biggers 	BUILD_BUG_ON(XCHACHA_IV_SIZE != 32);	/* nonce || stream position */
365059c2a4dSEric Biggers 	rctx->rbuf.words[4] = cpu_to_le32(1);
366059c2a4dSEric Biggers 	rctx->rbuf.words[5] = 0;
367059c2a4dSEric Biggers 	rctx->rbuf.words[6] = 0;
368059c2a4dSEric Biggers 	rctx->rbuf.words[7] = 0;
369059c2a4dSEric Biggers 
370059c2a4dSEric Biggers 	/*
371059c2a4dSEric Biggers 	 * XChaCha needs to be done on all the data except the last 16 bytes;
372059c2a4dSEric Biggers 	 * for disk encryption that usually means 4080 or 496 bytes.  But ChaCha
373059c2a4dSEric Biggers 	 * implementations tend to be most efficient when passed a whole number
374059c2a4dSEric Biggers 	 * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes.
375059c2a4dSEric Biggers 	 * And here it doesn't matter whether the last 16 bytes are written to,
376059c2a4dSEric Biggers 	 * as the second hash step will overwrite them.  Thus, round the XChaCha
377059c2a4dSEric Biggers 	 * length up to the next 64-byte boundary if possible.
378059c2a4dSEric Biggers 	 */
379059c2a4dSEric Biggers 	stream_len = bulk_len;
380059c2a4dSEric Biggers 	if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen)
381059c2a4dSEric Biggers 		stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE);
382059c2a4dSEric Biggers 
383059c2a4dSEric Biggers 	skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher);
384059c2a4dSEric Biggers 	skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src,
385059c2a4dSEric Biggers 				   req->dst, stream_len, &rctx->rbuf);
386059c2a4dSEric Biggers 	skcipher_request_set_callback(&rctx->u.streamcipher_req,
387059c2a4dSEric Biggers 				      req->base.flags,
388059c2a4dSEric Biggers 				      adiantum_streamcipher_done, req);
389059c2a4dSEric Biggers 	return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?:
390059c2a4dSEric Biggers 		adiantum_finish(req);
391059c2a4dSEric Biggers }
392059c2a4dSEric Biggers 
393059c2a4dSEric Biggers static int adiantum_encrypt(struct skcipher_request *req)
394059c2a4dSEric Biggers {
395059c2a4dSEric Biggers 	return adiantum_crypt(req, true);
396059c2a4dSEric Biggers }
397059c2a4dSEric Biggers 
398059c2a4dSEric Biggers static int adiantum_decrypt(struct skcipher_request *req)
399059c2a4dSEric Biggers {
400059c2a4dSEric Biggers 	return adiantum_crypt(req, false);
401059c2a4dSEric Biggers }
402059c2a4dSEric Biggers 
403059c2a4dSEric Biggers static int adiantum_init_tfm(struct crypto_skcipher *tfm)
404059c2a4dSEric Biggers {
405059c2a4dSEric Biggers 	struct skcipher_instance *inst = skcipher_alg_instance(tfm);
406059c2a4dSEric Biggers 	struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
407059c2a4dSEric Biggers 	struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
408059c2a4dSEric Biggers 	struct crypto_skcipher *streamcipher;
409059c2a4dSEric Biggers 	struct crypto_cipher *blockcipher;
410059c2a4dSEric Biggers 	struct crypto_shash *hash;
411059c2a4dSEric Biggers 	unsigned int subreq_size;
412059c2a4dSEric Biggers 	int err;
413059c2a4dSEric Biggers 
414059c2a4dSEric Biggers 	streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn);
415059c2a4dSEric Biggers 	if (IS_ERR(streamcipher))
416059c2a4dSEric Biggers 		return PTR_ERR(streamcipher);
417059c2a4dSEric Biggers 
418059c2a4dSEric Biggers 	blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn);
419059c2a4dSEric Biggers 	if (IS_ERR(blockcipher)) {
420059c2a4dSEric Biggers 		err = PTR_ERR(blockcipher);
421059c2a4dSEric Biggers 		goto err_free_streamcipher;
422059c2a4dSEric Biggers 	}
423059c2a4dSEric Biggers 
424059c2a4dSEric Biggers 	hash = crypto_spawn_shash(&ictx->hash_spawn);
425059c2a4dSEric Biggers 	if (IS_ERR(hash)) {
426059c2a4dSEric Biggers 		err = PTR_ERR(hash);
427059c2a4dSEric Biggers 		goto err_free_blockcipher;
428059c2a4dSEric Biggers 	}
429059c2a4dSEric Biggers 
430059c2a4dSEric Biggers 	tctx->streamcipher = streamcipher;
431059c2a4dSEric Biggers 	tctx->blockcipher = blockcipher;
432059c2a4dSEric Biggers 	tctx->hash = hash;
433059c2a4dSEric Biggers 
434059c2a4dSEric Biggers 	BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) !=
435059c2a4dSEric Biggers 		     sizeof(struct adiantum_request_ctx));
436059c2a4dSEric Biggers 	subreq_size = max(FIELD_SIZEOF(struct adiantum_request_ctx,
437059c2a4dSEric Biggers 				       u.hash_desc) +
438059c2a4dSEric Biggers 			  crypto_shash_descsize(hash),
439059c2a4dSEric Biggers 			  FIELD_SIZEOF(struct adiantum_request_ctx,
440059c2a4dSEric Biggers 				       u.streamcipher_req) +
441059c2a4dSEric Biggers 			  crypto_skcipher_reqsize(streamcipher));
442059c2a4dSEric Biggers 
443059c2a4dSEric Biggers 	crypto_skcipher_set_reqsize(tfm,
444059c2a4dSEric Biggers 				    offsetof(struct adiantum_request_ctx, u) +
445059c2a4dSEric Biggers 				    subreq_size);
446059c2a4dSEric Biggers 	return 0;
447059c2a4dSEric Biggers 
448059c2a4dSEric Biggers err_free_blockcipher:
449059c2a4dSEric Biggers 	crypto_free_cipher(blockcipher);
450059c2a4dSEric Biggers err_free_streamcipher:
451059c2a4dSEric Biggers 	crypto_free_skcipher(streamcipher);
452059c2a4dSEric Biggers 	return err;
453059c2a4dSEric Biggers }
454059c2a4dSEric Biggers 
455059c2a4dSEric Biggers static void adiantum_exit_tfm(struct crypto_skcipher *tfm)
456059c2a4dSEric Biggers {
457059c2a4dSEric Biggers 	struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
458059c2a4dSEric Biggers 
459059c2a4dSEric Biggers 	crypto_free_skcipher(tctx->streamcipher);
460059c2a4dSEric Biggers 	crypto_free_cipher(tctx->blockcipher);
461059c2a4dSEric Biggers 	crypto_free_shash(tctx->hash);
462059c2a4dSEric Biggers }
463059c2a4dSEric Biggers 
464059c2a4dSEric Biggers static void adiantum_free_instance(struct skcipher_instance *inst)
465059c2a4dSEric Biggers {
466059c2a4dSEric Biggers 	struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
467059c2a4dSEric Biggers 
468059c2a4dSEric Biggers 	crypto_drop_skcipher(&ictx->streamcipher_spawn);
469059c2a4dSEric Biggers 	crypto_drop_spawn(&ictx->blockcipher_spawn);
470059c2a4dSEric Biggers 	crypto_drop_shash(&ictx->hash_spawn);
471059c2a4dSEric Biggers 	kfree(inst);
472059c2a4dSEric Biggers }
473059c2a4dSEric Biggers 
474059c2a4dSEric Biggers /*
475059c2a4dSEric Biggers  * Check for a supported set of inner algorithms.
476059c2a4dSEric Biggers  * See the comment at the beginning of this file.
477059c2a4dSEric Biggers  */
478059c2a4dSEric Biggers static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg,
479059c2a4dSEric Biggers 					  struct crypto_alg *blockcipher_alg,
480059c2a4dSEric Biggers 					  struct shash_alg *hash_alg)
481059c2a4dSEric Biggers {
482059c2a4dSEric Biggers 	if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 &&
483059c2a4dSEric Biggers 	    strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0)
484059c2a4dSEric Biggers 		return false;
485059c2a4dSEric Biggers 
486059c2a4dSEric Biggers 	if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE ||
487059c2a4dSEric Biggers 	    blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE)
488059c2a4dSEric Biggers 		return false;
489059c2a4dSEric Biggers 	if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE)
490059c2a4dSEric Biggers 		return false;
491059c2a4dSEric Biggers 
492059c2a4dSEric Biggers 	if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0)
493059c2a4dSEric Biggers 		return false;
494059c2a4dSEric Biggers 
495059c2a4dSEric Biggers 	return true;
496059c2a4dSEric Biggers }
497059c2a4dSEric Biggers 
498059c2a4dSEric Biggers static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
499059c2a4dSEric Biggers {
500059c2a4dSEric Biggers 	struct crypto_attr_type *algt;
501059c2a4dSEric Biggers 	const char *streamcipher_name;
502059c2a4dSEric Biggers 	const char *blockcipher_name;
503059c2a4dSEric Biggers 	const char *nhpoly1305_name;
504059c2a4dSEric Biggers 	struct skcipher_instance *inst;
505059c2a4dSEric Biggers 	struct adiantum_instance_ctx *ictx;
506059c2a4dSEric Biggers 	struct skcipher_alg *streamcipher_alg;
507059c2a4dSEric Biggers 	struct crypto_alg *blockcipher_alg;
508059c2a4dSEric Biggers 	struct crypto_alg *_hash_alg;
509059c2a4dSEric Biggers 	struct shash_alg *hash_alg;
510059c2a4dSEric Biggers 	int err;
511059c2a4dSEric Biggers 
512059c2a4dSEric Biggers 	algt = crypto_get_attr_type(tb);
513059c2a4dSEric Biggers 	if (IS_ERR(algt))
514059c2a4dSEric Biggers 		return PTR_ERR(algt);
515059c2a4dSEric Biggers 
516059c2a4dSEric Biggers 	if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask)
517059c2a4dSEric Biggers 		return -EINVAL;
518059c2a4dSEric Biggers 
519059c2a4dSEric Biggers 	streamcipher_name = crypto_attr_alg_name(tb[1]);
520059c2a4dSEric Biggers 	if (IS_ERR(streamcipher_name))
521059c2a4dSEric Biggers 		return PTR_ERR(streamcipher_name);
522059c2a4dSEric Biggers 
523059c2a4dSEric Biggers 	blockcipher_name = crypto_attr_alg_name(tb[2]);
524059c2a4dSEric Biggers 	if (IS_ERR(blockcipher_name))
525059c2a4dSEric Biggers 		return PTR_ERR(blockcipher_name);
526059c2a4dSEric Biggers 
527059c2a4dSEric Biggers 	nhpoly1305_name = crypto_attr_alg_name(tb[3]);
528059c2a4dSEric Biggers 	if (nhpoly1305_name == ERR_PTR(-ENOENT))
529059c2a4dSEric Biggers 		nhpoly1305_name = "nhpoly1305";
530059c2a4dSEric Biggers 	if (IS_ERR(nhpoly1305_name))
531059c2a4dSEric Biggers 		return PTR_ERR(nhpoly1305_name);
532059c2a4dSEric Biggers 
533059c2a4dSEric Biggers 	inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
534059c2a4dSEric Biggers 	if (!inst)
535059c2a4dSEric Biggers 		return -ENOMEM;
536059c2a4dSEric Biggers 	ictx = skcipher_instance_ctx(inst);
537059c2a4dSEric Biggers 
538059c2a4dSEric Biggers 	/* Stream cipher, e.g. "xchacha12" */
539059c2a4dSEric Biggers 	err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name,
540059c2a4dSEric Biggers 				   0, crypto_requires_sync(algt->type,
541059c2a4dSEric Biggers 							   algt->mask));
542059c2a4dSEric Biggers 	if (err)
543059c2a4dSEric Biggers 		goto out_free_inst;
544059c2a4dSEric Biggers 	streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn);
545059c2a4dSEric Biggers 
546059c2a4dSEric Biggers 	/* Block cipher, e.g. "aes" */
547059c2a4dSEric Biggers 	err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name,
548059c2a4dSEric Biggers 				CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK);
549059c2a4dSEric Biggers 	if (err)
550059c2a4dSEric Biggers 		goto out_drop_streamcipher;
551059c2a4dSEric Biggers 	blockcipher_alg = ictx->blockcipher_spawn.alg;
552059c2a4dSEric Biggers 
553059c2a4dSEric Biggers 	/* NHPoly1305 εA∆U hash function */
554059c2a4dSEric Biggers 	_hash_alg = crypto_alg_mod_lookup(nhpoly1305_name,
555059c2a4dSEric Biggers 					  CRYPTO_ALG_TYPE_SHASH,
556059c2a4dSEric Biggers 					  CRYPTO_ALG_TYPE_MASK);
557059c2a4dSEric Biggers 	if (IS_ERR(_hash_alg)) {
558059c2a4dSEric Biggers 		err = PTR_ERR(_hash_alg);
559059c2a4dSEric Biggers 		goto out_drop_blockcipher;
560059c2a4dSEric Biggers 	}
561059c2a4dSEric Biggers 	hash_alg = __crypto_shash_alg(_hash_alg);
562059c2a4dSEric Biggers 	err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg,
563059c2a4dSEric Biggers 				      skcipher_crypto_instance(inst));
564059c2a4dSEric Biggers 	if (err) {
565059c2a4dSEric Biggers 		crypto_mod_put(_hash_alg);
566059c2a4dSEric Biggers 		goto out_drop_blockcipher;
567059c2a4dSEric Biggers 	}
568059c2a4dSEric Biggers 
569059c2a4dSEric Biggers 	/* Check the set of algorithms */
570059c2a4dSEric Biggers 	if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg,
571059c2a4dSEric Biggers 					   hash_alg)) {
572059c2a4dSEric Biggers 		pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n",
573059c2a4dSEric Biggers 			streamcipher_alg->base.cra_name,
574059c2a4dSEric Biggers 			blockcipher_alg->cra_name, hash_alg->base.cra_name);
575059c2a4dSEric Biggers 		err = -EINVAL;
576059c2a4dSEric Biggers 		goto out_drop_hash;
577059c2a4dSEric Biggers 	}
578059c2a4dSEric Biggers 
579059c2a4dSEric Biggers 	/* Instance fields */
580059c2a4dSEric Biggers 
581059c2a4dSEric Biggers 	err = -ENAMETOOLONG;
582059c2a4dSEric Biggers 	if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
583059c2a4dSEric Biggers 		     "adiantum(%s,%s)", streamcipher_alg->base.cra_name,
584059c2a4dSEric Biggers 		     blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME)
585059c2a4dSEric Biggers 		goto out_drop_hash;
586059c2a4dSEric Biggers 	if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
587059c2a4dSEric Biggers 		     "adiantum(%s,%s,%s)",
588059c2a4dSEric Biggers 		     streamcipher_alg->base.cra_driver_name,
589059c2a4dSEric Biggers 		     blockcipher_alg->cra_driver_name,
590059c2a4dSEric Biggers 		     hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
591059c2a4dSEric Biggers 		goto out_drop_hash;
592059c2a4dSEric Biggers 
593059c2a4dSEric Biggers 	inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE;
594059c2a4dSEric Biggers 	inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx);
595059c2a4dSEric Biggers 	inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask |
596059c2a4dSEric Biggers 				       hash_alg->base.cra_alignmask;
597059c2a4dSEric Biggers 	/*
598059c2a4dSEric Biggers 	 * The block cipher is only invoked once per message, so for long
599059c2a4dSEric Biggers 	 * messages (e.g. sectors for disk encryption) its performance doesn't
600059c2a4dSEric Biggers 	 * matter as much as that of the stream cipher and hash function.  Thus,
601059c2a4dSEric Biggers 	 * weigh the block cipher's ->cra_priority less.
602059c2a4dSEric Biggers 	 */
603059c2a4dSEric Biggers 	inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority +
604059c2a4dSEric Biggers 				       2 * hash_alg->base.cra_priority +
605059c2a4dSEric Biggers 				       blockcipher_alg->cra_priority) / 7;
606059c2a4dSEric Biggers 
607059c2a4dSEric Biggers 	inst->alg.setkey = adiantum_setkey;
608059c2a4dSEric Biggers 	inst->alg.encrypt = adiantum_encrypt;
609059c2a4dSEric Biggers 	inst->alg.decrypt = adiantum_decrypt;
610059c2a4dSEric Biggers 	inst->alg.init = adiantum_init_tfm;
611059c2a4dSEric Biggers 	inst->alg.exit = adiantum_exit_tfm;
612059c2a4dSEric Biggers 	inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg);
613059c2a4dSEric Biggers 	inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg);
614059c2a4dSEric Biggers 	inst->alg.ivsize = TWEAK_SIZE;
615059c2a4dSEric Biggers 
616059c2a4dSEric Biggers 	inst->free = adiantum_free_instance;
617059c2a4dSEric Biggers 
618059c2a4dSEric Biggers 	err = skcipher_register_instance(tmpl, inst);
619059c2a4dSEric Biggers 	if (err)
620059c2a4dSEric Biggers 		goto out_drop_hash;
621059c2a4dSEric Biggers 
622059c2a4dSEric Biggers 	return 0;
623059c2a4dSEric Biggers 
624059c2a4dSEric Biggers out_drop_hash:
625059c2a4dSEric Biggers 	crypto_drop_shash(&ictx->hash_spawn);
626059c2a4dSEric Biggers out_drop_blockcipher:
627059c2a4dSEric Biggers 	crypto_drop_spawn(&ictx->blockcipher_spawn);
628059c2a4dSEric Biggers out_drop_streamcipher:
629059c2a4dSEric Biggers 	crypto_drop_skcipher(&ictx->streamcipher_spawn);
630059c2a4dSEric Biggers out_free_inst:
631059c2a4dSEric Biggers 	kfree(inst);
632059c2a4dSEric Biggers 	return err;
633059c2a4dSEric Biggers }
634059c2a4dSEric Biggers 
635059c2a4dSEric Biggers /* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */
636059c2a4dSEric Biggers static struct crypto_template adiantum_tmpl = {
637059c2a4dSEric Biggers 	.name = "adiantum",
638059c2a4dSEric Biggers 	.create = adiantum_create,
639059c2a4dSEric Biggers 	.module = THIS_MODULE,
640059c2a4dSEric Biggers };
641059c2a4dSEric Biggers 
642059c2a4dSEric Biggers static int __init adiantum_module_init(void)
643059c2a4dSEric Biggers {
644059c2a4dSEric Biggers 	return crypto_register_template(&adiantum_tmpl);
645059c2a4dSEric Biggers }
646059c2a4dSEric Biggers 
647059c2a4dSEric Biggers static void __exit adiantum_module_exit(void)
648059c2a4dSEric Biggers {
649059c2a4dSEric Biggers 	crypto_unregister_template(&adiantum_tmpl);
650059c2a4dSEric Biggers }
651059c2a4dSEric Biggers 
652059c2a4dSEric Biggers module_init(adiantum_module_init);
653059c2a4dSEric Biggers module_exit(adiantum_module_exit);
654059c2a4dSEric Biggers 
655059c2a4dSEric Biggers MODULE_DESCRIPTION("Adiantum length-preserving encryption mode");
656059c2a4dSEric Biggers MODULE_LICENSE("GPL v2");
657059c2a4dSEric Biggers MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
658059c2a4dSEric Biggers MODULE_ALIAS_CRYPTO("adiantum");
659