1 /* 2 * ChaCha and XChaCha stream ciphers, including ChaCha20 (RFC7539) 3 * 4 * Copyright (C) 2015 Martin Willi 5 * Copyright (C) 2018 Google LLC 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 */ 12 13 #include <asm/unaligned.h> 14 #include <crypto/algapi.h> 15 #include <crypto/chacha.h> 16 #include <crypto/internal/skcipher.h> 17 #include <linux/module.h> 18 19 static void chacha_docrypt(u32 *state, u8 *dst, const u8 *src, 20 unsigned int bytes, int nrounds) 21 { 22 /* aligned to potentially speed up crypto_xor() */ 23 u8 stream[CHACHA_BLOCK_SIZE] __aligned(sizeof(long)); 24 25 while (bytes >= CHACHA_BLOCK_SIZE) { 26 chacha_block(state, stream, nrounds); 27 crypto_xor_cpy(dst, src, stream, CHACHA_BLOCK_SIZE); 28 bytes -= CHACHA_BLOCK_SIZE; 29 dst += CHACHA_BLOCK_SIZE; 30 src += CHACHA_BLOCK_SIZE; 31 } 32 if (bytes) { 33 chacha_block(state, stream, nrounds); 34 crypto_xor_cpy(dst, src, stream, bytes); 35 } 36 } 37 38 static int chacha_stream_xor(struct skcipher_request *req, 39 struct chacha_ctx *ctx, u8 *iv) 40 { 41 struct skcipher_walk walk; 42 u32 state[16]; 43 int err; 44 45 err = skcipher_walk_virt(&walk, req, false); 46 47 crypto_chacha_init(state, ctx, iv); 48 49 while (walk.nbytes > 0) { 50 unsigned int nbytes = walk.nbytes; 51 52 if (nbytes < walk.total) 53 nbytes = round_down(nbytes, CHACHA_BLOCK_SIZE); 54 55 chacha_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr, 56 nbytes, ctx->nrounds); 57 err = skcipher_walk_done(&walk, walk.nbytes - nbytes); 58 } 59 60 return err; 61 } 62 63 void crypto_chacha_init(u32 *state, struct chacha_ctx *ctx, u8 *iv) 64 { 65 state[0] = 0x61707865; /* "expa" */ 66 state[1] = 0x3320646e; /* "nd 3" */ 67 state[2] = 0x79622d32; /* "2-by" */ 68 state[3] = 0x6b206574; /* "te k" */ 69 state[4] = ctx->key[0]; 70 state[5] = ctx->key[1]; 71 state[6] = ctx->key[2]; 72 state[7] = ctx->key[3]; 73 state[8] = ctx->key[4]; 74 state[9] = ctx->key[5]; 75 state[10] = ctx->key[6]; 76 state[11] = ctx->key[7]; 77 state[12] = get_unaligned_le32(iv + 0); 78 state[13] = get_unaligned_le32(iv + 4); 79 state[14] = get_unaligned_le32(iv + 8); 80 state[15] = get_unaligned_le32(iv + 12); 81 } 82 EXPORT_SYMBOL_GPL(crypto_chacha_init); 83 84 static int chacha_setkey(struct crypto_skcipher *tfm, const u8 *key, 85 unsigned int keysize, int nrounds) 86 { 87 struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm); 88 int i; 89 90 if (keysize != CHACHA_KEY_SIZE) 91 return -EINVAL; 92 93 for (i = 0; i < ARRAY_SIZE(ctx->key); i++) 94 ctx->key[i] = get_unaligned_le32(key + i * sizeof(u32)); 95 96 ctx->nrounds = nrounds; 97 return 0; 98 } 99 100 int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key, 101 unsigned int keysize) 102 { 103 return chacha_setkey(tfm, key, keysize, 20); 104 } 105 EXPORT_SYMBOL_GPL(crypto_chacha20_setkey); 106 107 int crypto_chacha12_setkey(struct crypto_skcipher *tfm, const u8 *key, 108 unsigned int keysize) 109 { 110 return chacha_setkey(tfm, key, keysize, 12); 111 } 112 EXPORT_SYMBOL_GPL(crypto_chacha12_setkey); 113 114 int crypto_chacha_crypt(struct skcipher_request *req) 115 { 116 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 117 struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm); 118 119 return chacha_stream_xor(req, ctx, req->iv); 120 } 121 EXPORT_SYMBOL_GPL(crypto_chacha_crypt); 122 123 int crypto_xchacha_crypt(struct skcipher_request *req) 124 { 125 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 126 struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm); 127 struct chacha_ctx subctx; 128 u32 state[16]; 129 u8 real_iv[16]; 130 131 /* Compute the subkey given the original key and first 128 nonce bits */ 132 crypto_chacha_init(state, ctx, req->iv); 133 hchacha_block(state, subctx.key, ctx->nrounds); 134 subctx.nrounds = ctx->nrounds; 135 136 /* Build the real IV */ 137 memcpy(&real_iv[0], req->iv + 24, 8); /* stream position */ 138 memcpy(&real_iv[8], req->iv + 16, 8); /* remaining 64 nonce bits */ 139 140 /* Generate the stream and XOR it with the data */ 141 return chacha_stream_xor(req, &subctx, real_iv); 142 } 143 EXPORT_SYMBOL_GPL(crypto_xchacha_crypt); 144 145 static struct skcipher_alg algs[] = { 146 { 147 .base.cra_name = "chacha20", 148 .base.cra_driver_name = "chacha20-generic", 149 .base.cra_priority = 100, 150 .base.cra_blocksize = 1, 151 .base.cra_ctxsize = sizeof(struct chacha_ctx), 152 .base.cra_module = THIS_MODULE, 153 154 .min_keysize = CHACHA_KEY_SIZE, 155 .max_keysize = CHACHA_KEY_SIZE, 156 .ivsize = CHACHA_IV_SIZE, 157 .chunksize = CHACHA_BLOCK_SIZE, 158 .setkey = crypto_chacha20_setkey, 159 .encrypt = crypto_chacha_crypt, 160 .decrypt = crypto_chacha_crypt, 161 }, { 162 .base.cra_name = "xchacha20", 163 .base.cra_driver_name = "xchacha20-generic", 164 .base.cra_priority = 100, 165 .base.cra_blocksize = 1, 166 .base.cra_ctxsize = sizeof(struct chacha_ctx), 167 .base.cra_module = THIS_MODULE, 168 169 .min_keysize = CHACHA_KEY_SIZE, 170 .max_keysize = CHACHA_KEY_SIZE, 171 .ivsize = XCHACHA_IV_SIZE, 172 .chunksize = CHACHA_BLOCK_SIZE, 173 .setkey = crypto_chacha20_setkey, 174 .encrypt = crypto_xchacha_crypt, 175 .decrypt = crypto_xchacha_crypt, 176 }, { 177 .base.cra_name = "xchacha12", 178 .base.cra_driver_name = "xchacha12-generic", 179 .base.cra_priority = 100, 180 .base.cra_blocksize = 1, 181 .base.cra_ctxsize = sizeof(struct chacha_ctx), 182 .base.cra_module = THIS_MODULE, 183 184 .min_keysize = CHACHA_KEY_SIZE, 185 .max_keysize = CHACHA_KEY_SIZE, 186 .ivsize = XCHACHA_IV_SIZE, 187 .chunksize = CHACHA_BLOCK_SIZE, 188 .setkey = crypto_chacha12_setkey, 189 .encrypt = crypto_xchacha_crypt, 190 .decrypt = crypto_xchacha_crypt, 191 } 192 }; 193 194 static int __init chacha_generic_mod_init(void) 195 { 196 return crypto_register_skciphers(algs, ARRAY_SIZE(algs)); 197 } 198 199 static void __exit chacha_generic_mod_fini(void) 200 { 201 crypto_unregister_skciphers(algs, ARRAY_SIZE(algs)); 202 } 203 204 subsys_initcall(chacha_generic_mod_init); 205 module_exit(chacha_generic_mod_fini); 206 207 MODULE_LICENSE("GPL"); 208 MODULE_AUTHOR("Martin Willi <martin@strongswan.org>"); 209 MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (generic)"); 210 MODULE_ALIAS_CRYPTO("chacha20"); 211 MODULE_ALIAS_CRYPTO("chacha20-generic"); 212 MODULE_ALIAS_CRYPTO("xchacha20"); 213 MODULE_ALIAS_CRYPTO("xchacha20-generic"); 214 MODULE_ALIAS_CRYPTO("xchacha12"); 215 MODULE_ALIAS_CRYPTO("xchacha12-generic"); 216