1 /* 2 * Poly1305 authenticator algorithm, RFC7539 3 * 4 * Copyright (C) 2015 Martin Willi 5 * 6 * Based on public domain code by Andrew Moon and Daniel J. Bernstein. 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 */ 13 14 #include <crypto/algapi.h> 15 #include <crypto/internal/hash.h> 16 #include <crypto/internal/poly1305.h> 17 #include <linux/crypto.h> 18 #include <linux/kernel.h> 19 #include <linux/module.h> 20 #include <asm/unaligned.h> 21 22 static int crypto_poly1305_init(struct shash_desc *desc) 23 { 24 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 25 26 poly1305_core_init(&dctx->h); 27 dctx->buflen = 0; 28 dctx->rset = 0; 29 dctx->sset = false; 30 31 return 0; 32 } 33 34 static unsigned int crypto_poly1305_setdesckey(struct poly1305_desc_ctx *dctx, 35 const u8 *src, unsigned int srclen) 36 { 37 if (!dctx->sset) { 38 if (!dctx->rset && srclen >= POLY1305_BLOCK_SIZE) { 39 poly1305_core_setkey(&dctx->core_r, src); 40 src += POLY1305_BLOCK_SIZE; 41 srclen -= POLY1305_BLOCK_SIZE; 42 dctx->rset = 2; 43 } 44 if (srclen >= POLY1305_BLOCK_SIZE) { 45 dctx->s[0] = get_unaligned_le32(src + 0); 46 dctx->s[1] = get_unaligned_le32(src + 4); 47 dctx->s[2] = get_unaligned_le32(src + 8); 48 dctx->s[3] = get_unaligned_le32(src + 12); 49 src += POLY1305_BLOCK_SIZE; 50 srclen -= POLY1305_BLOCK_SIZE; 51 dctx->sset = true; 52 } 53 } 54 return srclen; 55 } 56 57 static void poly1305_blocks(struct poly1305_desc_ctx *dctx, const u8 *src, 58 unsigned int srclen) 59 { 60 unsigned int datalen; 61 62 if (unlikely(!dctx->sset)) { 63 datalen = crypto_poly1305_setdesckey(dctx, src, srclen); 64 src += srclen - datalen; 65 srclen = datalen; 66 } 67 68 poly1305_core_blocks(&dctx->h, &dctx->core_r, src, 69 srclen / POLY1305_BLOCK_SIZE, 1); 70 } 71 72 static int crypto_poly1305_update(struct shash_desc *desc, 73 const u8 *src, unsigned int srclen) 74 { 75 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 76 unsigned int bytes; 77 78 if (unlikely(dctx->buflen)) { 79 bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen); 80 memcpy(dctx->buf + dctx->buflen, src, bytes); 81 src += bytes; 82 srclen -= bytes; 83 dctx->buflen += bytes; 84 85 if (dctx->buflen == POLY1305_BLOCK_SIZE) { 86 poly1305_blocks(dctx, dctx->buf, 87 POLY1305_BLOCK_SIZE); 88 dctx->buflen = 0; 89 } 90 } 91 92 if (likely(srclen >= POLY1305_BLOCK_SIZE)) { 93 poly1305_blocks(dctx, src, srclen); 94 src += srclen - (srclen % POLY1305_BLOCK_SIZE); 95 srclen %= POLY1305_BLOCK_SIZE; 96 } 97 98 if (unlikely(srclen)) { 99 dctx->buflen = srclen; 100 memcpy(dctx->buf, src, srclen); 101 } 102 103 return 0; 104 } 105 106 static int crypto_poly1305_final(struct shash_desc *desc, u8 *dst) 107 { 108 struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc); 109 110 if (unlikely(!dctx->sset)) 111 return -ENOKEY; 112 113 poly1305_final_generic(dctx, dst); 114 return 0; 115 } 116 117 static struct shash_alg poly1305_alg = { 118 .digestsize = POLY1305_DIGEST_SIZE, 119 .init = crypto_poly1305_init, 120 .update = crypto_poly1305_update, 121 .final = crypto_poly1305_final, 122 .descsize = sizeof(struct poly1305_desc_ctx), 123 .base = { 124 .cra_name = "poly1305", 125 .cra_driver_name = "poly1305-generic", 126 .cra_priority = 100, 127 .cra_blocksize = POLY1305_BLOCK_SIZE, 128 .cra_module = THIS_MODULE, 129 }, 130 }; 131 132 static int __init poly1305_mod_init(void) 133 { 134 return crypto_register_shash(&poly1305_alg); 135 } 136 137 static void __exit poly1305_mod_exit(void) 138 { 139 crypto_unregister_shash(&poly1305_alg); 140 } 141 142 subsys_initcall(poly1305_mod_init); 143 module_exit(poly1305_mod_exit); 144 145 MODULE_LICENSE("GPL"); 146 MODULE_AUTHOR("Martin Willi <martin@strongswan.org>"); 147 MODULE_DESCRIPTION("Poly1305 authenticator"); 148 MODULE_ALIAS_CRYPTO("poly1305"); 149 MODULE_ALIAS_CRYPTO("poly1305-generic"); 150