aes.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456
  1. /*
  2. * Cryptographic API.
  3. *
  4. * AES Cipher Algorithm.
  5. *
  6. * Based on Brian Gladman's code.
  7. *
  8. * Linux developers:
  9. * Alexander Kjeldaas <astor@fast.no>
  10. * Herbert Valerio Riedel <hvr@hvrlab.org>
  11. * Kyle McMartin <kyle@debian.org>
  12. * Adam J. Richter <adam@yggdrasil.com> (conversion to 2.5 API).
  13. *
  14. * This program is free software; you can redistribute it and/or modify
  15. * it under the terms of the GNU General Public License as published by
  16. * the Free Software Foundation; either version 2 of the License, or
  17. * (at your option) any later version.
  18. *
  19. * ---------------------------------------------------------------------------
  20. * Copyright (c) 2002, Dr Brian Gladman <brg@gladman.me.uk>, Worcester, UK.
  21. * All rights reserved.
  22. *
  23. * LICENSE TERMS
  24. *
  25. * The free distribution and use of this software in both source and binary
  26. * form is allowed (with or without changes) provided that:
  27. *
  28. * 1. distributions of this source code include the above copyright
  29. * notice, this list of conditions and the following disclaimer;
  30. *
  31. * 2. distributions in binary form include the above copyright
  32. * notice, this list of conditions and the following disclaimer
  33. * in the documentation and/or other associated materials;
  34. *
  35. * 3. the copyright holder's name is not used to endorse products
  36. * built using this software without specific written permission.
  37. *
  38. * ALTERNATIVELY, provided that this notice is retained in full, this product
  39. * may be distributed under the terms of the GNU General Public License (GPL),
  40. * in which case the provisions of the GPL apply INSTEAD OF those given above.
  41. *
  42. * DISCLAIMER
  43. *
  44. * This software is provided 'as is' with no explicit or implied warranties
  45. * in respect of its properties, including, but not limited to, correctness
  46. * and/or fitness for purpose.
  47. * ---------------------------------------------------------------------------
  48. */
  49. /* Some changes from the Gladman version:
  50. s/RIJNDAEL(e_key)/E_KEY/g
  51. s/RIJNDAEL(d_key)/D_KEY/g
  52. */
  53. #include <linux/module.h>
  54. #include <linux/init.h>
  55. #include <linux/types.h>
  56. #include <linux/errno.h>
  57. #include <linux/crypto.h>
  58. #include <asm/byteorder.h>
  59. #define AES_MIN_KEY_SIZE 16
  60. #define AES_MAX_KEY_SIZE 32
  61. #define AES_BLOCK_SIZE 16
  62. /*
  63. * #define byte(x, nr) ((unsigned char)((x) >> (nr*8)))
  64. */
  65. static inline u8
  66. byte(const u32 x, const unsigned n)
  67. {
  68. return x >> (n << 3);
  69. }
  70. struct aes_ctx {
  71. int key_length;
  72. u32 buf[120];
  73. };
  74. #define E_KEY (&ctx->buf[0])
  75. #define D_KEY (&ctx->buf[60])
  76. static u8 pow_tab[256] __initdata;
  77. static u8 log_tab[256] __initdata;
  78. static u8 sbx_tab[256] __initdata;
  79. static u8 isb_tab[256] __initdata;
  80. static u32 rco_tab[10];
  81. static u32 ft_tab[4][256];
  82. static u32 it_tab[4][256];
  83. static u32 fl_tab[4][256];
  84. static u32 il_tab[4][256];
  85. static inline u8 __init
  86. f_mult (u8 a, u8 b)
  87. {
  88. u8 aa = log_tab[a], cc = aa + log_tab[b];
  89. return pow_tab[cc + (cc < aa ? 1 : 0)];
  90. }
  91. #define ff_mult(a,b) (a && b ? f_mult(a, b) : 0)
  92. #define f_rn(bo, bi, n, k) \
  93. bo[n] = ft_tab[0][byte(bi[n],0)] ^ \
  94. ft_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
  95. ft_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
  96. ft_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
  97. #define i_rn(bo, bi, n, k) \
  98. bo[n] = it_tab[0][byte(bi[n],0)] ^ \
  99. it_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
  100. it_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
  101. it_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
  102. #define ls_box(x) \
  103. ( fl_tab[0][byte(x, 0)] ^ \
  104. fl_tab[1][byte(x, 1)] ^ \
  105. fl_tab[2][byte(x, 2)] ^ \
  106. fl_tab[3][byte(x, 3)] )
  107. #define f_rl(bo, bi, n, k) \
  108. bo[n] = fl_tab[0][byte(bi[n],0)] ^ \
  109. fl_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
  110. fl_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
  111. fl_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
  112. #define i_rl(bo, bi, n, k) \
  113. bo[n] = il_tab[0][byte(bi[n],0)] ^ \
  114. il_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
  115. il_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
  116. il_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
  117. static void __init
  118. gen_tabs (void)
  119. {
  120. u32 i, t;
  121. u8 p, q;
  122. /* log and power tables for GF(2**8) finite field with
  123. 0x011b as modular polynomial - the simplest primitive
  124. root is 0x03, used here to generate the tables */
  125. for (i = 0, p = 1; i < 256; ++i) {
  126. pow_tab[i] = (u8) p;
  127. log_tab[p] = (u8) i;
  128. p ^= (p << 1) ^ (p & 0x80 ? 0x01b : 0);
  129. }
  130. log_tab[1] = 0;
  131. for (i = 0, p = 1; i < 10; ++i) {
  132. rco_tab[i] = p;
  133. p = (p << 1) ^ (p & 0x80 ? 0x01b : 0);
  134. }
  135. for (i = 0; i < 256; ++i) {
  136. p = (i ? pow_tab[255 - log_tab[i]] : 0);
  137. q = ((p >> 7) | (p << 1)) ^ ((p >> 6) | (p << 2));
  138. p ^= 0x63 ^ q ^ ((q >> 6) | (q << 2));
  139. sbx_tab[i] = p;
  140. isb_tab[p] = (u8) i;
  141. }
  142. for (i = 0; i < 256; ++i) {
  143. p = sbx_tab[i];
  144. t = p;
  145. fl_tab[0][i] = t;
  146. fl_tab[1][i] = rol32(t, 8);
  147. fl_tab[2][i] = rol32(t, 16);
  148. fl_tab[3][i] = rol32(t, 24);
  149. t = ((u32) ff_mult (2, p)) |
  150. ((u32) p << 8) |
  151. ((u32) p << 16) | ((u32) ff_mult (3, p) << 24);
  152. ft_tab[0][i] = t;
  153. ft_tab[1][i] = rol32(t, 8);
  154. ft_tab[2][i] = rol32(t, 16);
  155. ft_tab[3][i] = rol32(t, 24);
  156. p = isb_tab[i];
  157. t = p;
  158. il_tab[0][i] = t;
  159. il_tab[1][i] = rol32(t, 8);
  160. il_tab[2][i] = rol32(t, 16);
  161. il_tab[3][i] = rol32(t, 24);
  162. t = ((u32) ff_mult (14, p)) |
  163. ((u32) ff_mult (9, p) << 8) |
  164. ((u32) ff_mult (13, p) << 16) |
  165. ((u32) ff_mult (11, p) << 24);
  166. it_tab[0][i] = t;
  167. it_tab[1][i] = rol32(t, 8);
  168. it_tab[2][i] = rol32(t, 16);
  169. it_tab[3][i] = rol32(t, 24);
  170. }
  171. }
  172. #define star_x(x) (((x) & 0x7f7f7f7f) << 1) ^ ((((x) & 0x80808080) >> 7) * 0x1b)
  173. #define imix_col(y,x) \
  174. u = star_x(x); \
  175. v = star_x(u); \
  176. w = star_x(v); \
  177. t = w ^ (x); \
  178. (y) = u ^ v ^ w; \
  179. (y) ^= ror32(u ^ t, 8) ^ \
  180. ror32(v ^ t, 16) ^ \
  181. ror32(t,24)
  182. /* initialise the key schedule from the user supplied key */
  183. #define loop4(i) \
  184. { t = ror32(t, 8); t = ls_box(t) ^ rco_tab[i]; \
  185. t ^= E_KEY[4 * i]; E_KEY[4 * i + 4] = t; \
  186. t ^= E_KEY[4 * i + 1]; E_KEY[4 * i + 5] = t; \
  187. t ^= E_KEY[4 * i + 2]; E_KEY[4 * i + 6] = t; \
  188. t ^= E_KEY[4 * i + 3]; E_KEY[4 * i + 7] = t; \
  189. }
  190. #define loop6(i) \
  191. { t = ror32(t, 8); t = ls_box(t) ^ rco_tab[i]; \
  192. t ^= E_KEY[6 * i]; E_KEY[6 * i + 6] = t; \
  193. t ^= E_KEY[6 * i + 1]; E_KEY[6 * i + 7] = t; \
  194. t ^= E_KEY[6 * i + 2]; E_KEY[6 * i + 8] = t; \
  195. t ^= E_KEY[6 * i + 3]; E_KEY[6 * i + 9] = t; \
  196. t ^= E_KEY[6 * i + 4]; E_KEY[6 * i + 10] = t; \
  197. t ^= E_KEY[6 * i + 5]; E_KEY[6 * i + 11] = t; \
  198. }
  199. #define loop8(i) \
  200. { t = ror32(t, 8); ; t = ls_box(t) ^ rco_tab[i]; \
  201. t ^= E_KEY[8 * i]; E_KEY[8 * i + 8] = t; \
  202. t ^= E_KEY[8 * i + 1]; E_KEY[8 * i + 9] = t; \
  203. t ^= E_KEY[8 * i + 2]; E_KEY[8 * i + 10] = t; \
  204. t ^= E_KEY[8 * i + 3]; E_KEY[8 * i + 11] = t; \
  205. t = E_KEY[8 * i + 4] ^ ls_box(t); \
  206. E_KEY[8 * i + 12] = t; \
  207. t ^= E_KEY[8 * i + 5]; E_KEY[8 * i + 13] = t; \
  208. t ^= E_KEY[8 * i + 6]; E_KEY[8 * i + 14] = t; \
  209. t ^= E_KEY[8 * i + 7]; E_KEY[8 * i + 15] = t; \
  210. }
  211. static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
  212. unsigned int key_len)
  213. {
  214. struct aes_ctx *ctx = crypto_tfm_ctx(tfm);
  215. const __le32 *key = (const __le32 *)in_key;
  216. u32 *flags = &tfm->crt_flags;
  217. u32 i, t, u, v, w;
  218. if (key_len % 8) {
  219. *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
  220. return -EINVAL;
  221. }
  222. ctx->key_length = key_len;
  223. E_KEY[0] = le32_to_cpu(key[0]);
  224. E_KEY[1] = le32_to_cpu(key[1]);
  225. E_KEY[2] = le32_to_cpu(key[2]);
  226. E_KEY[3] = le32_to_cpu(key[3]);
  227. switch (key_len) {
  228. case 16:
  229. t = E_KEY[3];
  230. for (i = 0; i < 10; ++i)
  231. loop4 (i);
  232. break;
  233. case 24:
  234. E_KEY[4] = le32_to_cpu(key[4]);
  235. t = E_KEY[5] = le32_to_cpu(key[5]);
  236. for (i = 0; i < 8; ++i)
  237. loop6 (i);
  238. break;
  239. case 32:
  240. E_KEY[4] = le32_to_cpu(key[4]);
  241. E_KEY[5] = le32_to_cpu(key[5]);
  242. E_KEY[6] = le32_to_cpu(key[6]);
  243. t = E_KEY[7] = le32_to_cpu(key[7]);
  244. for (i = 0; i < 7; ++i)
  245. loop8 (i);
  246. break;
  247. }
  248. D_KEY[0] = E_KEY[0];
  249. D_KEY[1] = E_KEY[1];
  250. D_KEY[2] = E_KEY[2];
  251. D_KEY[3] = E_KEY[3];
  252. for (i = 4; i < key_len + 24; ++i) {
  253. imix_col (D_KEY[i], E_KEY[i]);
  254. }
  255. return 0;
  256. }
  257. /* encrypt a block of text */
  258. #define f_nround(bo, bi, k) \
  259. f_rn(bo, bi, 0, k); \
  260. f_rn(bo, bi, 1, k); \
  261. f_rn(bo, bi, 2, k); \
  262. f_rn(bo, bi, 3, k); \
  263. k += 4
  264. #define f_lround(bo, bi, k) \
  265. f_rl(bo, bi, 0, k); \
  266. f_rl(bo, bi, 1, k); \
  267. f_rl(bo, bi, 2, k); \
  268. f_rl(bo, bi, 3, k)
  269. static void aes_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
  270. {
  271. const struct aes_ctx *ctx = crypto_tfm_ctx(tfm);
  272. const __le32 *src = (const __le32 *)in;
  273. __le32 *dst = (__le32 *)out;
  274. u32 b0[4], b1[4];
  275. const u32 *kp = E_KEY + 4;
  276. b0[0] = le32_to_cpu(src[0]) ^ E_KEY[0];
  277. b0[1] = le32_to_cpu(src[1]) ^ E_KEY[1];
  278. b0[2] = le32_to_cpu(src[2]) ^ E_KEY[2];
  279. b0[3] = le32_to_cpu(src[3]) ^ E_KEY[3];
  280. if (ctx->key_length > 24) {
  281. f_nround (b1, b0, kp);
  282. f_nround (b0, b1, kp);
  283. }
  284. if (ctx->key_length > 16) {
  285. f_nround (b1, b0, kp);
  286. f_nround (b0, b1, kp);
  287. }
  288. f_nround (b1, b0, kp);
  289. f_nround (b0, b1, kp);
  290. f_nround (b1, b0, kp);
  291. f_nround (b0, b1, kp);
  292. f_nround (b1, b0, kp);
  293. f_nround (b0, b1, kp);
  294. f_nround (b1, b0, kp);
  295. f_nround (b0, b1, kp);
  296. f_nround (b1, b0, kp);
  297. f_lround (b0, b1, kp);
  298. dst[0] = cpu_to_le32(b0[0]);
  299. dst[1] = cpu_to_le32(b0[1]);
  300. dst[2] = cpu_to_le32(b0[2]);
  301. dst[3] = cpu_to_le32(b0[3]);
  302. }
  303. /* decrypt a block of text */
  304. #define i_nround(bo, bi, k) \
  305. i_rn(bo, bi, 0, k); \
  306. i_rn(bo, bi, 1, k); \
  307. i_rn(bo, bi, 2, k); \
  308. i_rn(bo, bi, 3, k); \
  309. k -= 4
  310. #define i_lround(bo, bi, k) \
  311. i_rl(bo, bi, 0, k); \
  312. i_rl(bo, bi, 1, k); \
  313. i_rl(bo, bi, 2, k); \
  314. i_rl(bo, bi, 3, k)
  315. static void aes_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
  316. {
  317. const struct aes_ctx *ctx = crypto_tfm_ctx(tfm);
  318. const __le32 *src = (const __le32 *)in;
  319. __le32 *dst = (__le32 *)out;
  320. u32 b0[4], b1[4];
  321. const int key_len = ctx->key_length;
  322. const u32 *kp = D_KEY + key_len + 20;
  323. b0[0] = le32_to_cpu(src[0]) ^ E_KEY[key_len + 24];
  324. b0[1] = le32_to_cpu(src[1]) ^ E_KEY[key_len + 25];
  325. b0[2] = le32_to_cpu(src[2]) ^ E_KEY[key_len + 26];
  326. b0[3] = le32_to_cpu(src[3]) ^ E_KEY[key_len + 27];
  327. if (key_len > 24) {
  328. i_nround (b1, b0, kp);
  329. i_nround (b0, b1, kp);
  330. }
  331. if (key_len > 16) {
  332. i_nround (b1, b0, kp);
  333. i_nround (b0, b1, kp);
  334. }
  335. i_nround (b1, b0, kp);
  336. i_nround (b0, b1, kp);
  337. i_nround (b1, b0, kp);
  338. i_nround (b0, b1, kp);
  339. i_nround (b1, b0, kp);
  340. i_nround (b0, b1, kp);
  341. i_nround (b1, b0, kp);
  342. i_nround (b0, b1, kp);
  343. i_nround (b1, b0, kp);
  344. i_lround (b0, b1, kp);
  345. dst[0] = cpu_to_le32(b0[0]);
  346. dst[1] = cpu_to_le32(b0[1]);
  347. dst[2] = cpu_to_le32(b0[2]);
  348. dst[3] = cpu_to_le32(b0[3]);
  349. }
  350. static struct crypto_alg aes_alg = {
  351. .cra_name = "aes",
  352. .cra_driver_name = "aes-generic",
  353. .cra_priority = 100,
  354. .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
  355. .cra_blocksize = AES_BLOCK_SIZE,
  356. .cra_ctxsize = sizeof(struct aes_ctx),
  357. .cra_alignmask = 3,
  358. .cra_module = THIS_MODULE,
  359. .cra_list = LIST_HEAD_INIT(aes_alg.cra_list),
  360. .cra_u = {
  361. .cipher = {
  362. .cia_min_keysize = AES_MIN_KEY_SIZE,
  363. .cia_max_keysize = AES_MAX_KEY_SIZE,
  364. .cia_setkey = aes_set_key,
  365. .cia_encrypt = aes_encrypt,
  366. .cia_decrypt = aes_decrypt
  367. }
  368. }
  369. };
  370. static int __init aes_init(void)
  371. {
  372. gen_tabs();
  373. return crypto_register_alg(&aes_alg);
  374. }
  375. static void __exit aes_fini(void)
  376. {
  377. crypto_unregister_alg(&aes_alg);
  378. }
  379. module_init(aes_init);
  380. module_exit(aes_fini);
  381. MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
  382. MODULE_LICENSE("Dual BSD/GPL");