xref: /openbmc/linux/crypto/xts.c (revision cb1aaebe) 
1 /* XTS: as defined in IEEE1619/D16
2  *	http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
3  *	(sector sizes which are not a multiple of 16 bytes are,
4  *	however currently unsupported)
5  *
6  * Copyright (c) 2007 Rik Snel <rsnel@cube.dyndns.org>
7  *
8  * Based on ecb.c
9  * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
10  *
11  * This program is free software; you can redistribute it and/or modify it
12  * under the terms of the GNU General Public License as published by the Free
13  * Software Foundation; either version 2 of the License, or (at your option)
14  * any later version.
15  */
16 #include <crypto/internal/skcipher.h>
17 #include <crypto/scatterwalk.h>
18 #include <linux/err.h>
19 #include <linux/init.h>
20 #include <linux/kernel.h>
21 #include <linux/module.h>
22 #include <linux/scatterlist.h>
23 #include <linux/slab.h>
24 
25 #include <crypto/xts.h>
26 #include <crypto/b128ops.h>
27 #include <crypto/gf128mul.h>
28 
29 struct priv {
30 	struct crypto_skcipher *child;
31 	struct crypto_cipher *tweak;
32 };
33 
34 struct xts_instance_ctx {
35 	struct crypto_skcipher_spawn spawn;
36 	char name[CRYPTO_MAX_ALG_NAME];
37 };
38 
39 struct rctx {
40 	le128 t;
41 	struct skcipher_request subreq;
42 };
43 
44 static int setkey(struct crypto_skcipher *parent, const u8 *key,
45 		  unsigned int keylen)
46 {
47 	struct priv *ctx = crypto_skcipher_ctx(parent);
48 	struct crypto_skcipher *child;
49 	struct crypto_cipher *tweak;
50 	int err;
51 
52 	err = xts_verify_key(parent, key, keylen);
53 	if (err)
54 		return err;
55 
56 	keylen /= 2;
57 
58 	/* we need two cipher instances: one to compute the initial 'tweak'
59 	 * by encrypting the IV (usually the 'plain' iv) and the other
60 	 * one to encrypt and decrypt the data */
61 
62 	/* tweak cipher, uses Key2 i.e. the second half of *key */
63 	tweak = ctx->tweak;
64 	crypto_cipher_clear_flags(tweak, CRYPTO_TFM_REQ_MASK);
65 	crypto_cipher_set_flags(tweak, crypto_skcipher_get_flags(parent) &
66 				       CRYPTO_TFM_REQ_MASK);
67 	err = crypto_cipher_setkey(tweak, key + keylen, keylen);
68 	crypto_skcipher_set_flags(parent, crypto_cipher_get_flags(tweak) &
69 					  CRYPTO_TFM_RES_MASK);
70 	if (err)
71 		return err;
72 
73 	/* data cipher, uses Key1 i.e. the first half of *key */
74 	child = ctx->child;
75 	crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
76 	crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) &
77 					 CRYPTO_TFM_REQ_MASK);
78 	err = crypto_skcipher_setkey(child, key, keylen);
79 	crypto_skcipher_set_flags(parent, crypto_skcipher_get_flags(child) &
80 					  CRYPTO_TFM_RES_MASK);
81 
82 	return err;
83 }
84 
85 /*
86  * We compute the tweak masks twice (both before and after the ECB encryption or
87  * decryption) to avoid having to allocate a temporary buffer and/or make
88  * mutliple calls to the 'ecb(..)' instance, which usually would be slower than
89  * just doing the gf128mul_x_ble() calls again.
90  */
91 static int xor_tweak(struct skcipher_request *req, bool second_pass)
92 {
93 	struct rctx *rctx = skcipher_request_ctx(req);
94 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
95 	const int bs = XTS_BLOCK_SIZE;
96 	struct skcipher_walk w;
97 	le128 t = rctx->t;
98 	int err;
99 
100 	if (second_pass) {
101 		req = &rctx->subreq;
102 		/* set to our TFM to enforce correct alignment: */
103 		skcipher_request_set_tfm(req, tfm);
104 	}
105 	err = skcipher_walk_virt(&w, req, false);
106 
107 	while (w.nbytes) {
108 		unsigned int avail = w.nbytes;
109 		le128 *wsrc;
110 		le128 *wdst;
111 
112 		wsrc = w.src.virt.addr;
113 		wdst = w.dst.virt.addr;
114 
115 		do {
116 			le128_xor(wdst++, &t, wsrc++);
117 			gf128mul_x_ble(&t, &t);
118 		} while ((avail -= bs) >= bs);
119 
120 		err = skcipher_walk_done(&w, avail);
121 	}
122 
123 	return err;
124 }
125 
126 static int xor_tweak_pre(struct skcipher_request *req)
127 {
128 	return xor_tweak(req, false);
129 }
130 
131 static int xor_tweak_post(struct skcipher_request *req)
132 {
133 	return xor_tweak(req, true);
134 }
135 
136 static void crypt_done(struct crypto_async_request *areq, int err)
137 {
138 	struct skcipher_request *req = areq->data;
139 
140 	if (!err) {
141 		struct rctx *rctx = skcipher_request_ctx(req);
142 
143 		rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
144 		err = xor_tweak_post(req);
145 	}
146 
147 	skcipher_request_complete(req, err);
148 }
149 
150 static void init_crypt(struct skcipher_request *req)
151 {
152 	struct priv *ctx = crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
153 	struct rctx *rctx = skcipher_request_ctx(req);
154 	struct skcipher_request *subreq = &rctx->subreq;
155 
156 	skcipher_request_set_tfm(subreq, ctx->child);
157 	skcipher_request_set_callback(subreq, req->base.flags, crypt_done, req);
158 	skcipher_request_set_crypt(subreq, req->dst, req->dst,
159 				   req->cryptlen, NULL);
160 
161 	/* calculate first value of T */
162 	crypto_cipher_encrypt_one(ctx->tweak, (u8 *)&rctx->t, req->iv);
163 }
164 
165 static int encrypt(struct skcipher_request *req)
166 {
167 	struct rctx *rctx = skcipher_request_ctx(req);
168 	struct skcipher_request *subreq = &rctx->subreq;
169 
170 	init_crypt(req);
171 	return xor_tweak_pre(req) ?:
172 		crypto_skcipher_encrypt(subreq) ?:
173 		xor_tweak_post(req);
174 }
175 
176 static int decrypt(struct skcipher_request *req)
177 {
178 	struct rctx *rctx = skcipher_request_ctx(req);
179 	struct skcipher_request *subreq = &rctx->subreq;
180 
181 	init_crypt(req);
182 	return xor_tweak_pre(req) ?:
183 		crypto_skcipher_decrypt(subreq) ?:
184 		xor_tweak_post(req);
185 }
186 
187 static int init_tfm(struct crypto_skcipher *tfm)
188 {
189 	struct skcipher_instance *inst = skcipher_alg_instance(tfm);
190 	struct xts_instance_ctx *ictx = skcipher_instance_ctx(inst);
191 	struct priv *ctx = crypto_skcipher_ctx(tfm);
192 	struct crypto_skcipher *child;
193 	struct crypto_cipher *tweak;
194 
195 	child = crypto_spawn_skcipher(&ictx->spawn);
196 	if (IS_ERR(child))
197 		return PTR_ERR(child);
198 
199 	ctx->child = child;
200 
201 	tweak = crypto_alloc_cipher(ictx->name, 0, 0);
202 	if (IS_ERR(tweak)) {
203 		crypto_free_skcipher(ctx->child);
204 		return PTR_ERR(tweak);
205 	}
206 
207 	ctx->tweak = tweak;
208 
209 	crypto_skcipher_set_reqsize(tfm, crypto_skcipher_reqsize(child) +
210 					 sizeof(struct rctx));
211 
212 	return 0;
213 }
214 
215 static void exit_tfm(struct crypto_skcipher *tfm)
216 {
217 	struct priv *ctx = crypto_skcipher_ctx(tfm);
218 
219 	crypto_free_skcipher(ctx->child);
220 	crypto_free_cipher(ctx->tweak);
221 }
222 
223 static void free(struct skcipher_instance *inst)
224 {
225 	crypto_drop_skcipher(skcipher_instance_ctx(inst));
226 	kfree(inst);
227 }
228 
229 static int create(struct crypto_template *tmpl, struct rtattr **tb)
230 {
231 	struct skcipher_instance *inst;
232 	struct crypto_attr_type *algt;
233 	struct xts_instance_ctx *ctx;
234 	struct skcipher_alg *alg;
235 	const char *cipher_name;
236 	u32 mask;
237 	int err;
238 
239 	algt = crypto_get_attr_type(tb);
240 	if (IS_ERR(algt))
241 		return PTR_ERR(algt);
242 
243 	if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask)
244 		return -EINVAL;
245 
246 	cipher_name = crypto_attr_alg_name(tb[1]);
247 	if (IS_ERR(cipher_name))
248 		return PTR_ERR(cipher_name);
249 
250 	inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
251 	if (!inst)
252 		return -ENOMEM;
253 
254 	ctx = skcipher_instance_ctx(inst);
255 
256 	crypto_set_skcipher_spawn(&ctx->spawn, skcipher_crypto_instance(inst));
257 
258 	mask = crypto_requires_off(algt->type, algt->mask,
259 				   CRYPTO_ALG_NEED_FALLBACK |
260 				   CRYPTO_ALG_ASYNC);
261 
262 	err = crypto_grab_skcipher(&ctx->spawn, cipher_name, 0, mask);
263 	if (err == -ENOENT) {
264 		err = -ENAMETOOLONG;
265 		if (snprintf(ctx->name, CRYPTO_MAX_ALG_NAME, "ecb(%s)",
266 			     cipher_name) >= CRYPTO_MAX_ALG_NAME)
267 			goto err_free_inst;
268 
269 		err = crypto_grab_skcipher(&ctx->spawn, ctx->name, 0, mask);
270 	}
271 
272 	if (err)
273 		goto err_free_inst;
274 
275 	alg = crypto_skcipher_spawn_alg(&ctx->spawn);
276 
277 	err = -EINVAL;
278 	if (alg->base.cra_blocksize != XTS_BLOCK_SIZE)
279 		goto err_drop_spawn;
280 
281 	if (crypto_skcipher_alg_ivsize(alg))
282 		goto err_drop_spawn;
283 
284 	err = crypto_inst_setname(skcipher_crypto_instance(inst), "xts",
285 				  &alg->base);
286 	if (err)
287 		goto err_drop_spawn;
288 
289 	err = -EINVAL;
290 	cipher_name = alg->base.cra_name;
291 
292 	/* Alas we screwed up the naming so we have to mangle the
293 	 * cipher name.
294 	 */
295 	if (!strncmp(cipher_name, "ecb(", 4)) {
296 		unsigned len;
297 
298 		len = strlcpy(ctx->name, cipher_name + 4, sizeof(ctx->name));
299 		if (len < 2 || len >= sizeof(ctx->name))
300 			goto err_drop_spawn;
301 
302 		if (ctx->name[len - 1] != ')')
303 			goto err_drop_spawn;
304 
305 		ctx->name[len - 1] = 0;
306 
307 		if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
308 			     "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME) {
309 			err = -ENAMETOOLONG;
310 			goto err_drop_spawn;
311 		}
312 	} else
313 		goto err_drop_spawn;
314 
315 	inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
316 	inst->alg.base.cra_priority = alg->base.cra_priority;
317 	inst->alg.base.cra_blocksize = XTS_BLOCK_SIZE;
318 	inst->alg.base.cra_alignmask = alg->base.cra_alignmask |
319 				       (__alignof__(u64) - 1);
320 
321 	inst->alg.ivsize = XTS_BLOCK_SIZE;
322 	inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg) * 2;
323 	inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg) * 2;
324 
325 	inst->alg.base.cra_ctxsize = sizeof(struct priv);
326 
327 	inst->alg.init = init_tfm;
328 	inst->alg.exit = exit_tfm;
329 
330 	inst->alg.setkey = setkey;
331 	inst->alg.encrypt = encrypt;
332 	inst->alg.decrypt = decrypt;
333 
334 	inst->free = free;
335 
336 	err = skcipher_register_instance(tmpl, inst);
337 	if (err)
338 		goto err_drop_spawn;
339 
340 out:
341 	return err;
342 
343 err_drop_spawn:
344 	crypto_drop_skcipher(&ctx->spawn);
345 err_free_inst:
346 	kfree(inst);
347 	goto out;
348 }
349 
350 static struct crypto_template crypto_tmpl = {
351 	.name = "xts",
352 	.create = create,
353 	.module = THIS_MODULE,
354 };
355 
356 static int __init crypto_module_init(void)
357 {
358 	return crypto_register_template(&crypto_tmpl);
359 }
360 
361 static void __exit crypto_module_exit(void)
362 {
363 	crypto_unregister_template(&crypto_tmpl);
364 }
365 
366 subsys_initcall(crypto_module_init);
367 module_exit(crypto_module_exit);
368 
369 MODULE_LICENSE("GPL");
370 MODULE_DESCRIPTION("XTS block cipher mode");
371 MODULE_ALIAS_CRYPTO("xts");
372