1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * ESSIV skcipher and aead template for block encryption 4 * 5 * This template encapsulates the ESSIV IV generation algorithm used by 6 * dm-crypt and fscrypt, which converts the initial vector for the skcipher 7 * used for block encryption, by encrypting it using the hash of the 8 * skcipher key as encryption key. Usually, the input IV is a 64-bit sector 9 * number in LE representation zero-padded to the size of the IV, but this 10 * is not assumed by this driver. 11 * 12 * The typical use of this template is to instantiate the skcipher 13 * 'essiv(cbc(aes),sha256)', which is the only instantiation used by 14 * fscrypt, and the most relevant one for dm-crypt. However, dm-crypt 15 * also permits ESSIV to be used in combination with the authenc template, 16 * e.g., 'essiv(authenc(hmac(sha256),cbc(aes)),sha256)', in which case 17 * we need to instantiate an aead that accepts the same special key format 18 * as the authenc template, and deals with the way the encrypted IV is 19 * embedded into the AAD area of the aead request. This means the AEAD 20 * flavor produced by this template is tightly coupled to the way dm-crypt 21 * happens to use it. 22 * 23 * Copyright (c) 2019 Linaro, Ltd. <ard.biesheuvel@linaro.org> 24 * 25 * Heavily based on: 26 * adiantum length-preserving encryption mode 27 * 28 * Copyright 2018 Google LLC 29 */ 30 31 #include <crypto/authenc.h> 32 #include <crypto/internal/aead.h> 33 #include <crypto/internal/hash.h> 34 #include <crypto/internal/skcipher.h> 35 #include <crypto/scatterwalk.h> 36 #include <linux/module.h> 37 38 #include "internal.h" 39 40 struct essiv_instance_ctx { 41 union { 42 struct crypto_skcipher_spawn skcipher_spawn; 43 struct crypto_aead_spawn aead_spawn; 44 } u; 45 char essiv_cipher_name[CRYPTO_MAX_ALG_NAME]; 46 char shash_driver_name[CRYPTO_MAX_ALG_NAME]; 47 }; 48 49 struct essiv_tfm_ctx { 50 union { 51 struct crypto_skcipher *skcipher; 52 struct crypto_aead *aead; 53 } u; 54 struct crypto_cipher *essiv_cipher; 55 struct crypto_shash *hash; 56 int ivoffset; 57 }; 58 59 struct essiv_aead_request_ctx { 60 struct scatterlist sg[4]; 61 u8 *assoc; 62 struct aead_request aead_req; 63 }; 64 65 static int essiv_skcipher_setkey(struct crypto_skcipher *tfm, 66 const u8 *key, unsigned int keylen) 67 { 68 struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 69 SHASH_DESC_ON_STACK(desc, tctx->hash); 70 u8 salt[HASH_MAX_DIGESTSIZE]; 71 int err; 72 73 crypto_skcipher_clear_flags(tctx->u.skcipher, CRYPTO_TFM_REQ_MASK); 74 crypto_skcipher_set_flags(tctx->u.skcipher, 75 crypto_skcipher_get_flags(tfm) & 76 CRYPTO_TFM_REQ_MASK); 77 err = crypto_skcipher_setkey(tctx->u.skcipher, key, keylen); 78 crypto_skcipher_set_flags(tfm, 79 crypto_skcipher_get_flags(tctx->u.skcipher) & 80 CRYPTO_TFM_RES_MASK); 81 if (err) 82 return err; 83 84 desc->tfm = tctx->hash; 85 err = crypto_shash_digest(desc, key, keylen, salt); 86 if (err) 87 return err; 88 89 crypto_cipher_clear_flags(tctx->essiv_cipher, CRYPTO_TFM_REQ_MASK); 90 crypto_cipher_set_flags(tctx->essiv_cipher, 91 crypto_skcipher_get_flags(tfm) & 92 CRYPTO_TFM_REQ_MASK); 93 err = crypto_cipher_setkey(tctx->essiv_cipher, salt, 94 crypto_shash_digestsize(tctx->hash)); 95 crypto_skcipher_set_flags(tfm, 96 crypto_cipher_get_flags(tctx->essiv_cipher) & 97 CRYPTO_TFM_RES_MASK); 98 99 return err; 100 } 101 102 static int essiv_aead_setkey(struct crypto_aead *tfm, const u8 *key, 103 unsigned int keylen) 104 { 105 struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); 106 SHASH_DESC_ON_STACK(desc, tctx->hash); 107 struct crypto_authenc_keys keys; 108 u8 salt[HASH_MAX_DIGESTSIZE]; 109 int err; 110 111 crypto_aead_clear_flags(tctx->u.aead, CRYPTO_TFM_REQ_MASK); 112 crypto_aead_set_flags(tctx->u.aead, crypto_aead_get_flags(tfm) & 113 CRYPTO_TFM_REQ_MASK); 114 err = crypto_aead_setkey(tctx->u.aead, key, keylen); 115 crypto_aead_set_flags(tfm, crypto_aead_get_flags(tctx->u.aead) & 116 CRYPTO_TFM_RES_MASK); 117 if (err) 118 return err; 119 120 if (crypto_authenc_extractkeys(&keys, key, keylen) != 0) { 121 crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); 122 return -EINVAL; 123 } 124 125 desc->tfm = tctx->hash; 126 err = crypto_shash_init(desc) ?: 127 crypto_shash_update(desc, keys.enckey, keys.enckeylen) ?: 128 crypto_shash_finup(desc, keys.authkey, keys.authkeylen, salt); 129 if (err) 130 return err; 131 132 crypto_cipher_clear_flags(tctx->essiv_cipher, CRYPTO_TFM_REQ_MASK); 133 crypto_cipher_set_flags(tctx->essiv_cipher, crypto_aead_get_flags(tfm) & 134 CRYPTO_TFM_REQ_MASK); 135 err = crypto_cipher_setkey(tctx->essiv_cipher, salt, 136 crypto_shash_digestsize(tctx->hash)); 137 crypto_aead_set_flags(tfm, crypto_cipher_get_flags(tctx->essiv_cipher) & 138 CRYPTO_TFM_RES_MASK); 139 140 return err; 141 } 142 143 static int essiv_aead_setauthsize(struct crypto_aead *tfm, 144 unsigned int authsize) 145 { 146 struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); 147 148 return crypto_aead_setauthsize(tctx->u.aead, authsize); 149 } 150 151 static void essiv_skcipher_done(struct crypto_async_request *areq, int err) 152 { 153 struct skcipher_request *req = areq->data; 154 155 skcipher_request_complete(req, err); 156 } 157 158 static int essiv_skcipher_crypt(struct skcipher_request *req, bool enc) 159 { 160 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 161 const struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 162 struct skcipher_request *subreq = skcipher_request_ctx(req); 163 164 crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); 165 166 skcipher_request_set_tfm(subreq, tctx->u.skcipher); 167 skcipher_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, 168 req->iv); 169 skcipher_request_set_callback(subreq, skcipher_request_flags(req), 170 essiv_skcipher_done, req); 171 172 return enc ? crypto_skcipher_encrypt(subreq) : 173 crypto_skcipher_decrypt(subreq); 174 } 175 176 static int essiv_skcipher_encrypt(struct skcipher_request *req) 177 { 178 return essiv_skcipher_crypt(req, true); 179 } 180 181 static int essiv_skcipher_decrypt(struct skcipher_request *req) 182 { 183 return essiv_skcipher_crypt(req, false); 184 } 185 186 static void essiv_aead_done(struct crypto_async_request *areq, int err) 187 { 188 struct aead_request *req = areq->data; 189 struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); 190 191 kfree(rctx->assoc); 192 aead_request_complete(req, err); 193 } 194 195 static int essiv_aead_crypt(struct aead_request *req, bool enc) 196 { 197 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 198 const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); 199 struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); 200 struct aead_request *subreq = &rctx->aead_req; 201 struct scatterlist *src = req->src; 202 int err; 203 204 crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); 205 206 /* 207 * dm-crypt embeds the sector number and the IV in the AAD region, so 208 * we have to copy the converted IV into the right scatterlist before 209 * we pass it on. 210 */ 211 rctx->assoc = NULL; 212 if (req->src == req->dst || !enc) { 213 scatterwalk_map_and_copy(req->iv, req->dst, 214 req->assoclen - crypto_aead_ivsize(tfm), 215 crypto_aead_ivsize(tfm), 1); 216 } else { 217 u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; 218 int ivsize = crypto_aead_ivsize(tfm); 219 int ssize = req->assoclen - ivsize; 220 struct scatterlist *sg; 221 int nents; 222 223 if (ssize < 0) 224 return -EINVAL; 225 226 nents = sg_nents_for_len(req->src, ssize); 227 if (nents < 0) 228 return -EINVAL; 229 230 memcpy(iv, req->iv, ivsize); 231 sg_init_table(rctx->sg, 4); 232 233 if (unlikely(nents > 1)) { 234 /* 235 * This is a case that rarely occurs in practice, but 236 * for correctness, we have to deal with it nonetheless. 237 */ 238 rctx->assoc = kmalloc(ssize, GFP_ATOMIC); 239 if (!rctx->assoc) 240 return -ENOMEM; 241 242 scatterwalk_map_and_copy(rctx->assoc, req->src, 0, 243 ssize, 0); 244 sg_set_buf(rctx->sg, rctx->assoc, ssize); 245 } else { 246 sg_set_page(rctx->sg, sg_page(req->src), ssize, 247 req->src->offset); 248 } 249 250 sg_set_buf(rctx->sg + 1, iv, ivsize); 251 sg = scatterwalk_ffwd(rctx->sg + 2, req->src, req->assoclen); 252 if (sg != rctx->sg + 2) 253 sg_chain(rctx->sg, 3, sg); 254 255 src = rctx->sg; 256 } 257 258 aead_request_set_tfm(subreq, tctx->u.aead); 259 aead_request_set_ad(subreq, req->assoclen); 260 aead_request_set_callback(subreq, aead_request_flags(req), 261 essiv_aead_done, req); 262 aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv); 263 264 err = enc ? crypto_aead_encrypt(subreq) : 265 crypto_aead_decrypt(subreq); 266 267 if (rctx->assoc && err != -EINPROGRESS) 268 kfree(rctx->assoc); 269 return err; 270 } 271 272 static int essiv_aead_encrypt(struct aead_request *req) 273 { 274 return essiv_aead_crypt(req, true); 275 } 276 277 static int essiv_aead_decrypt(struct aead_request *req) 278 { 279 return essiv_aead_crypt(req, false); 280 } 281 282 static int essiv_init_tfm(struct essiv_instance_ctx *ictx, 283 struct essiv_tfm_ctx *tctx) 284 { 285 struct crypto_cipher *essiv_cipher; 286 struct crypto_shash *hash; 287 int err; 288 289 essiv_cipher = crypto_alloc_cipher(ictx->essiv_cipher_name, 0, 0); 290 if (IS_ERR(essiv_cipher)) 291 return PTR_ERR(essiv_cipher); 292 293 hash = crypto_alloc_shash(ictx->shash_driver_name, 0, 0); 294 if (IS_ERR(hash)) { 295 err = PTR_ERR(hash); 296 goto err_free_essiv_cipher; 297 } 298 299 tctx->essiv_cipher = essiv_cipher; 300 tctx->hash = hash; 301 302 return 0; 303 304 err_free_essiv_cipher: 305 crypto_free_cipher(essiv_cipher); 306 return err; 307 } 308 309 static int essiv_skcipher_init_tfm(struct crypto_skcipher *tfm) 310 { 311 struct skcipher_instance *inst = skcipher_alg_instance(tfm); 312 struct essiv_instance_ctx *ictx = skcipher_instance_ctx(inst); 313 struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 314 struct crypto_skcipher *skcipher; 315 int err; 316 317 skcipher = crypto_spawn_skcipher(&ictx->u.skcipher_spawn); 318 if (IS_ERR(skcipher)) 319 return PTR_ERR(skcipher); 320 321 crypto_skcipher_set_reqsize(tfm, sizeof(struct skcipher_request) + 322 crypto_skcipher_reqsize(skcipher)); 323 324 err = essiv_init_tfm(ictx, tctx); 325 if (err) { 326 crypto_free_skcipher(skcipher); 327 return err; 328 } 329 330 tctx->u.skcipher = skcipher; 331 return 0; 332 } 333 334 static int essiv_aead_init_tfm(struct crypto_aead *tfm) 335 { 336 struct aead_instance *inst = aead_alg_instance(tfm); 337 struct essiv_instance_ctx *ictx = aead_instance_ctx(inst); 338 struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); 339 struct crypto_aead *aead; 340 unsigned int subreq_size; 341 int err; 342 343 BUILD_BUG_ON(offsetofend(struct essiv_aead_request_ctx, aead_req) != 344 sizeof(struct essiv_aead_request_ctx)); 345 346 aead = crypto_spawn_aead(&ictx->u.aead_spawn); 347 if (IS_ERR(aead)) 348 return PTR_ERR(aead); 349 350 subreq_size = FIELD_SIZEOF(struct essiv_aead_request_ctx, aead_req) + 351 crypto_aead_reqsize(aead); 352 353 tctx->ivoffset = offsetof(struct essiv_aead_request_ctx, aead_req) + 354 subreq_size; 355 crypto_aead_set_reqsize(tfm, tctx->ivoffset + crypto_aead_ivsize(aead)); 356 357 err = essiv_init_tfm(ictx, tctx); 358 if (err) { 359 crypto_free_aead(aead); 360 return err; 361 } 362 363 tctx->u.aead = aead; 364 return 0; 365 } 366 367 static void essiv_skcipher_exit_tfm(struct crypto_skcipher *tfm) 368 { 369 struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 370 371 crypto_free_skcipher(tctx->u.skcipher); 372 crypto_free_cipher(tctx->essiv_cipher); 373 crypto_free_shash(tctx->hash); 374 } 375 376 static void essiv_aead_exit_tfm(struct crypto_aead *tfm) 377 { 378 struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); 379 380 crypto_free_aead(tctx->u.aead); 381 crypto_free_cipher(tctx->essiv_cipher); 382 crypto_free_shash(tctx->hash); 383 } 384 385 static void essiv_skcipher_free_instance(struct skcipher_instance *inst) 386 { 387 struct essiv_instance_ctx *ictx = skcipher_instance_ctx(inst); 388 389 crypto_drop_skcipher(&ictx->u.skcipher_spawn); 390 kfree(inst); 391 } 392 393 static void essiv_aead_free_instance(struct aead_instance *inst) 394 { 395 struct essiv_instance_ctx *ictx = aead_instance_ctx(inst); 396 397 crypto_drop_aead(&ictx->u.aead_spawn); 398 kfree(inst); 399 } 400 401 static bool parse_cipher_name(char *essiv_cipher_name, const char *cra_name) 402 { 403 const char *p, *q; 404 int len; 405 406 /* find the last opening parens */ 407 p = strrchr(cra_name, '('); 408 if (!p++) 409 return false; 410 411 /* find the first closing parens in the tail of the string */ 412 q = strchr(p, ')'); 413 if (!q) 414 return false; 415 416 len = q - p; 417 if (len >= CRYPTO_MAX_ALG_NAME) 418 return false; 419 420 memcpy(essiv_cipher_name, p, len); 421 essiv_cipher_name[len] = '\0'; 422 return true; 423 } 424 425 static bool essiv_supported_algorithms(const char *essiv_cipher_name, 426 struct shash_alg *hash_alg, 427 int ivsize) 428 { 429 struct crypto_alg *alg; 430 bool ret = false; 431 432 alg = crypto_alg_mod_lookup(essiv_cipher_name, 433 CRYPTO_ALG_TYPE_CIPHER, 434 CRYPTO_ALG_TYPE_MASK); 435 if (IS_ERR(alg)) 436 return false; 437 438 if (hash_alg->digestsize < alg->cra_cipher.cia_min_keysize || 439 hash_alg->digestsize > alg->cra_cipher.cia_max_keysize) 440 goto out; 441 442 if (ivsize != alg->cra_blocksize) 443 goto out; 444 445 if (crypto_shash_alg_has_setkey(hash_alg)) 446 goto out; 447 448 ret = true; 449 450 out: 451 crypto_mod_put(alg); 452 return ret; 453 } 454 455 static int essiv_create(struct crypto_template *tmpl, struct rtattr **tb) 456 { 457 struct crypto_attr_type *algt; 458 const char *inner_cipher_name; 459 const char *shash_name; 460 struct skcipher_instance *skcipher_inst = NULL; 461 struct aead_instance *aead_inst = NULL; 462 struct crypto_instance *inst; 463 struct crypto_alg *base, *block_base; 464 struct essiv_instance_ctx *ictx; 465 struct skcipher_alg *skcipher_alg = NULL; 466 struct aead_alg *aead_alg = NULL; 467 struct crypto_alg *_hash_alg; 468 struct shash_alg *hash_alg; 469 int ivsize; 470 u32 type; 471 int err; 472 473 algt = crypto_get_attr_type(tb); 474 if (IS_ERR(algt)) 475 return PTR_ERR(algt); 476 477 inner_cipher_name = crypto_attr_alg_name(tb[1]); 478 if (IS_ERR(inner_cipher_name)) 479 return PTR_ERR(inner_cipher_name); 480 481 shash_name = crypto_attr_alg_name(tb[2]); 482 if (IS_ERR(shash_name)) 483 return PTR_ERR(shash_name); 484 485 type = algt->type & algt->mask; 486 487 switch (type) { 488 case CRYPTO_ALG_TYPE_SKCIPHER: 489 skcipher_inst = kzalloc(sizeof(*skcipher_inst) + 490 sizeof(*ictx), GFP_KERNEL); 491 if (!skcipher_inst) 492 return -ENOMEM; 493 inst = skcipher_crypto_instance(skcipher_inst); 494 base = &skcipher_inst->alg.base; 495 ictx = crypto_instance_ctx(inst); 496 497 /* Symmetric cipher, e.g., "cbc(aes)" */ 498 crypto_set_skcipher_spawn(&ictx->u.skcipher_spawn, inst); 499 err = crypto_grab_skcipher(&ictx->u.skcipher_spawn, 500 inner_cipher_name, 0, 501 crypto_requires_sync(algt->type, 502 algt->mask)); 503 if (err) 504 goto out_free_inst; 505 skcipher_alg = crypto_spawn_skcipher_alg(&ictx->u.skcipher_spawn); 506 block_base = &skcipher_alg->base; 507 ivsize = crypto_skcipher_alg_ivsize(skcipher_alg); 508 break; 509 510 case CRYPTO_ALG_TYPE_AEAD: 511 aead_inst = kzalloc(sizeof(*aead_inst) + 512 sizeof(*ictx), GFP_KERNEL); 513 if (!aead_inst) 514 return -ENOMEM; 515 inst = aead_crypto_instance(aead_inst); 516 base = &aead_inst->alg.base; 517 ictx = crypto_instance_ctx(inst); 518 519 /* AEAD cipher, e.g., "authenc(hmac(sha256),cbc(aes))" */ 520 crypto_set_aead_spawn(&ictx->u.aead_spawn, inst); 521 err = crypto_grab_aead(&ictx->u.aead_spawn, 522 inner_cipher_name, 0, 523 crypto_requires_sync(algt->type, 524 algt->mask)); 525 if (err) 526 goto out_free_inst; 527 aead_alg = crypto_spawn_aead_alg(&ictx->u.aead_spawn); 528 block_base = &aead_alg->base; 529 if (!strstarts(block_base->cra_name, "authenc(")) { 530 pr_warn("Only authenc() type AEADs are supported by ESSIV\n"); 531 err = -EINVAL; 532 goto out_drop_skcipher; 533 } 534 ivsize = aead_alg->ivsize; 535 break; 536 537 default: 538 return -EINVAL; 539 } 540 541 if (!parse_cipher_name(ictx->essiv_cipher_name, block_base->cra_name)) { 542 pr_warn("Failed to parse ESSIV cipher name from skcipher cra_name\n"); 543 err = -EINVAL; 544 goto out_drop_skcipher; 545 } 546 547 /* Synchronous hash, e.g., "sha256" */ 548 _hash_alg = crypto_alg_mod_lookup(shash_name, 549 CRYPTO_ALG_TYPE_SHASH, 550 CRYPTO_ALG_TYPE_MASK); 551 if (IS_ERR(_hash_alg)) { 552 err = PTR_ERR(_hash_alg); 553 goto out_drop_skcipher; 554 } 555 hash_alg = __crypto_shash_alg(_hash_alg); 556 557 /* Check the set of algorithms */ 558 if (!essiv_supported_algorithms(ictx->essiv_cipher_name, hash_alg, 559 ivsize)) { 560 pr_warn("Unsupported essiv instantiation: essiv(%s,%s)\n", 561 block_base->cra_name, hash_alg->base.cra_name); 562 err = -EINVAL; 563 goto out_free_hash; 564 } 565 566 /* record the driver name so we can instantiate this exact algo later */ 567 strlcpy(ictx->shash_driver_name, hash_alg->base.cra_driver_name, 568 CRYPTO_MAX_ALG_NAME); 569 570 /* Instance fields */ 571 572 err = -ENAMETOOLONG; 573 if (snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, 574 "essiv(%s,%s)", block_base->cra_name, 575 hash_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME) 576 goto out_free_hash; 577 if (snprintf(base->cra_driver_name, CRYPTO_MAX_ALG_NAME, 578 "essiv(%s,%s)", block_base->cra_driver_name, 579 hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) 580 goto out_free_hash; 581 582 base->cra_flags = block_base->cra_flags & CRYPTO_ALG_ASYNC; 583 base->cra_blocksize = block_base->cra_blocksize; 584 base->cra_ctxsize = sizeof(struct essiv_tfm_ctx); 585 base->cra_alignmask = block_base->cra_alignmask; 586 base->cra_priority = block_base->cra_priority; 587 588 if (type == CRYPTO_ALG_TYPE_SKCIPHER) { 589 skcipher_inst->alg.setkey = essiv_skcipher_setkey; 590 skcipher_inst->alg.encrypt = essiv_skcipher_encrypt; 591 skcipher_inst->alg.decrypt = essiv_skcipher_decrypt; 592 skcipher_inst->alg.init = essiv_skcipher_init_tfm; 593 skcipher_inst->alg.exit = essiv_skcipher_exit_tfm; 594 595 skcipher_inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(skcipher_alg); 596 skcipher_inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(skcipher_alg); 597 skcipher_inst->alg.ivsize = ivsize; 598 skcipher_inst->alg.chunksize = crypto_skcipher_alg_chunksize(skcipher_alg); 599 skcipher_inst->alg.walksize = crypto_skcipher_alg_walksize(skcipher_alg); 600 601 skcipher_inst->free = essiv_skcipher_free_instance; 602 603 err = skcipher_register_instance(tmpl, skcipher_inst); 604 } else { 605 aead_inst->alg.setkey = essiv_aead_setkey; 606 aead_inst->alg.setauthsize = essiv_aead_setauthsize; 607 aead_inst->alg.encrypt = essiv_aead_encrypt; 608 aead_inst->alg.decrypt = essiv_aead_decrypt; 609 aead_inst->alg.init = essiv_aead_init_tfm; 610 aead_inst->alg.exit = essiv_aead_exit_tfm; 611 612 aead_inst->alg.ivsize = ivsize; 613 aead_inst->alg.maxauthsize = crypto_aead_alg_maxauthsize(aead_alg); 614 aead_inst->alg.chunksize = crypto_aead_alg_chunksize(aead_alg); 615 616 aead_inst->free = essiv_aead_free_instance; 617 618 err = aead_register_instance(tmpl, aead_inst); 619 } 620 621 if (err) 622 goto out_free_hash; 623 624 crypto_mod_put(_hash_alg); 625 return 0; 626 627 out_free_hash: 628 crypto_mod_put(_hash_alg); 629 out_drop_skcipher: 630 if (type == CRYPTO_ALG_TYPE_SKCIPHER) 631 crypto_drop_skcipher(&ictx->u.skcipher_spawn); 632 else 633 crypto_drop_aead(&ictx->u.aead_spawn); 634 out_free_inst: 635 kfree(skcipher_inst); 636 kfree(aead_inst); 637 return err; 638 } 639 640 /* essiv(cipher_name, shash_name) */ 641 static struct crypto_template essiv_tmpl = { 642 .name = "essiv", 643 .create = essiv_create, 644 .module = THIS_MODULE, 645 }; 646 647 static int __init essiv_module_init(void) 648 { 649 return crypto_register_template(&essiv_tmpl); 650 } 651 652 static void __exit essiv_module_exit(void) 653 { 654 crypto_unregister_template(&essiv_tmpl); 655 } 656 657 subsys_initcall(essiv_module_init); 658 module_exit(essiv_module_exit); 659 660 MODULE_DESCRIPTION("ESSIV skcipher/aead wrapper for block encryption"); 661 MODULE_LICENSE("GPL v2"); 662 MODULE_ALIAS_CRYPTO("essiv"); 663