1 /* 2 * QEMU Crypto XTS cipher mode 3 * 4 * Copyright (c) 2015-2016 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 * This code is originally derived from public domain / WTFPL code in 20 * LibTomCrypt crytographic library http://libtom.org. The XTS code 21 * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com) 22 * to the LibTom Projects 23 * 24 */ 25 26 #include "qemu/osdep.h" 27 #include "crypto/xts.h" 28 29 static void xts_mult_x(uint8_t *I) 30 { 31 int x; 32 uint8_t t, tt; 33 34 for (x = t = 0; x < 16; x++) { 35 tt = I[x] >> 7; 36 I[x] = ((I[x] << 1) | t) & 0xFF; 37 t = tt; 38 } 39 if (tt) { 40 I[0] ^= 0x87; 41 } 42 } 43 44 45 /** 46 * xts_tweak_uncrypt: 47 * @param ctxt: the cipher context 48 * @param func: the cipher function 49 * @src: buffer providing the cipher text of XTS_BLOCK_SIZE bytes 50 * @dst: buffer to output the plain text of XTS_BLOCK_SIZE bytes 51 * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes 52 * 53 * Decrypt data with a tweak 54 */ 55 static void xts_tweak_decrypt(const void *ctx, 56 xts_cipher_func *func, 57 const uint8_t *src, 58 uint8_t *dst, 59 uint8_t *iv) 60 { 61 unsigned long x; 62 63 /* tweak encrypt block i */ 64 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 65 dst[x] = src[x] ^ iv[x]; 66 } 67 68 func(ctx, XTS_BLOCK_SIZE, dst, dst); 69 70 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 71 dst[x] = dst[x] ^ iv[x]; 72 } 73 74 /* LFSR the tweak */ 75 xts_mult_x(iv); 76 } 77 78 79 void xts_decrypt(const void *datactx, 80 const void *tweakctx, 81 xts_cipher_func *encfunc, 82 xts_cipher_func *decfunc, 83 uint8_t *iv, 84 size_t length, 85 uint8_t *dst, 86 const uint8_t *src) 87 { 88 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE]; 89 unsigned long i, m, mo, lim; 90 91 /* get number of blocks */ 92 m = length >> 4; 93 mo = length & 15; 94 95 /* must have at least one full block */ 96 g_assert(m != 0); 97 98 if (mo == 0) { 99 lim = m; 100 } else { 101 lim = m - 1; 102 } 103 104 /* encrypt the iv */ 105 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv); 106 107 for (i = 0; i < lim; i++) { 108 xts_tweak_decrypt(datactx, decfunc, src, dst, T); 109 110 src += XTS_BLOCK_SIZE; 111 dst += XTS_BLOCK_SIZE; 112 } 113 114 /* if length is not a multiple of XTS_BLOCK_SIZE then */ 115 if (mo > 0) { 116 memcpy(CC, T, XTS_BLOCK_SIZE); 117 xts_mult_x(CC); 118 119 /* PP = tweak decrypt block m-1 */ 120 xts_tweak_decrypt(datactx, decfunc, src, PP, CC); 121 122 /* Pm = first length % XTS_BLOCK_SIZE bytes of PP */ 123 for (i = 0; i < mo; i++) { 124 CC[i] = src[XTS_BLOCK_SIZE + i]; 125 dst[XTS_BLOCK_SIZE + i] = PP[i]; 126 } 127 for (; i < XTS_BLOCK_SIZE; i++) { 128 CC[i] = PP[i]; 129 } 130 131 /* Pm-1 = Tweak uncrypt CC */ 132 xts_tweak_decrypt(datactx, decfunc, CC, dst, T); 133 } 134 135 /* Decrypt the iv back */ 136 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T); 137 } 138 139 140 /** 141 * xts_tweak_crypt: 142 * @param ctxt: the cipher context 143 * @param func: the cipher function 144 * @src: buffer providing the plain text of XTS_BLOCK_SIZE bytes 145 * @dst: buffer to output the cipher text of XTS_BLOCK_SIZE bytes 146 * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes 147 * 148 * Encrypt data with a tweak 149 */ 150 static void xts_tweak_encrypt(const void *ctx, 151 xts_cipher_func *func, 152 const uint8_t *src, 153 uint8_t *dst, 154 uint8_t *iv) 155 { 156 unsigned long x; 157 158 /* tweak encrypt block i */ 159 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 160 dst[x] = src[x] ^ iv[x]; 161 } 162 163 func(ctx, XTS_BLOCK_SIZE, dst, dst); 164 165 for (x = 0; x < XTS_BLOCK_SIZE; x++) { 166 dst[x] = dst[x] ^ iv[x]; 167 } 168 169 /* LFSR the tweak */ 170 xts_mult_x(iv); 171 } 172 173 174 void xts_encrypt(const void *datactx, 175 const void *tweakctx, 176 xts_cipher_func *encfunc, 177 xts_cipher_func *decfunc, 178 uint8_t *iv, 179 size_t length, 180 uint8_t *dst, 181 const uint8_t *src) 182 { 183 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE]; 184 unsigned long i, m, mo, lim; 185 186 /* get number of blocks */ 187 m = length >> 4; 188 mo = length & 15; 189 190 /* must have at least one full block */ 191 g_assert(m != 0); 192 193 if (mo == 0) { 194 lim = m; 195 } else { 196 lim = m - 1; 197 } 198 199 /* encrypt the iv */ 200 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv); 201 202 for (i = 0; i < lim; i++) { 203 xts_tweak_encrypt(datactx, encfunc, src, dst, T); 204 205 dst += XTS_BLOCK_SIZE; 206 src += XTS_BLOCK_SIZE; 207 } 208 209 /* if length is not a multiple of XTS_BLOCK_SIZE then */ 210 if (mo > 0) { 211 /* CC = tweak encrypt block m-1 */ 212 xts_tweak_encrypt(datactx, encfunc, src, CC, T); 213 214 /* Cm = first length % XTS_BLOCK_SIZE bytes of CC */ 215 for (i = 0; i < mo; i++) { 216 PP[i] = src[XTS_BLOCK_SIZE + i]; 217 dst[XTS_BLOCK_SIZE + i] = CC[i]; 218 } 219 220 for (; i < XTS_BLOCK_SIZE; i++) { 221 PP[i] = CC[i]; 222 } 223 224 /* Cm-1 = Tweak encrypt PP */ 225 xts_tweak_encrypt(datactx, encfunc, PP, dst, T); 226 } 227 228 /* Decrypt the iv back */ 229 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T); 230 } 231