ccm.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * CCM: Counter with CBC-MAC
  4. *
  5. * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
  6. */
  7. #include <crypto/internal/aead.h>
  8. #include <crypto/internal/cipher.h>
  9. #include <crypto/internal/hash.h>
  10. #include <crypto/internal/skcipher.h>
  11. #include <crypto/scatterwalk.h>
  12. #include <linux/err.h>
  13. #include <linux/init.h>
  14. #include <linux/kernel.h>
  15. #include <linux/module.h>
  16. #include <linux/slab.h>
  17. struct ccm_instance_ctx {
  18. struct crypto_skcipher_spawn ctr;
  19. struct crypto_ahash_spawn mac;
  20. };
  21. struct crypto_ccm_ctx {
  22. struct crypto_ahash *mac;
  23. struct crypto_skcipher *ctr;
  24. };
  25. struct crypto_rfc4309_ctx {
  26. struct crypto_aead *child;
  27. u8 nonce[3];
  28. };
  29. struct crypto_rfc4309_req_ctx {
  30. struct scatterlist src[3];
  31. struct scatterlist dst[3];
  32. struct aead_request subreq;
  33. };
  34. struct crypto_ccm_req_priv_ctx {
  35. u8 odata[16];
  36. u8 idata[16];
  37. u8 auth_tag[16];
  38. u32 flags;
  39. struct scatterlist src[3];
  40. struct scatterlist dst[3];
  41. union {
  42. struct ahash_request ahreq;
  43. struct skcipher_request skreq;
  44. };
  45. };
  46. struct cbcmac_tfm_ctx {
  47. struct crypto_cipher *child;
  48. };
  49. struct cbcmac_desc_ctx {
  50. unsigned int len;
  51. };
  52. static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx(
  53. struct aead_request *req)
  54. {
  55. unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req));
  56. return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1);
  57. }
  58. static int set_msg_len(u8 *block, unsigned int msglen, int csize)
  59. {
  60. __be32 data;
  61. memset(block, 0, csize);
  62. block += csize;
  63. if (csize >= 4)
  64. csize = 4;
  65. else if (msglen > (1 << (8 * csize)))
  66. return -EOVERFLOW;
  67. data = cpu_to_be32(msglen);
  68. memcpy(block - csize, (u8 *)&data + 4 - csize, csize);
  69. return 0;
  70. }
  71. static int crypto_ccm_setkey(struct crypto_aead *aead, const u8 *key,
  72. unsigned int keylen)
  73. {
  74. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
  75. struct crypto_skcipher *ctr = ctx->ctr;
  76. struct crypto_ahash *mac = ctx->mac;
  77. int err;
  78. crypto_skcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
  79. crypto_skcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
  80. CRYPTO_TFM_REQ_MASK);
  81. err = crypto_skcipher_setkey(ctr, key, keylen);
  82. if (err)
  83. return err;
  84. crypto_ahash_clear_flags(mac, CRYPTO_TFM_REQ_MASK);
  85. crypto_ahash_set_flags(mac, crypto_aead_get_flags(aead) &
  86. CRYPTO_TFM_REQ_MASK);
  87. return crypto_ahash_setkey(mac, key, keylen);
  88. }
  89. static int crypto_ccm_setauthsize(struct crypto_aead *tfm,
  90. unsigned int authsize)
  91. {
  92. switch (authsize) {
  93. case 4:
  94. case 6:
  95. case 8:
  96. case 10:
  97. case 12:
  98. case 14:
  99. case 16:
  100. break;
  101. default:
  102. return -EINVAL;
  103. }
  104. return 0;
  105. }
  106. static int format_input(u8 *info, struct aead_request *req,
  107. unsigned int cryptlen)
  108. {
  109. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  110. unsigned int lp = req->iv[0];
  111. unsigned int l = lp + 1;
  112. unsigned int m;
  113. m = crypto_aead_authsize(aead);
  114. memcpy(info, req->iv, 16);
  115. /* format control info per RFC 3610 and
  116. * NIST Special Publication 800-38C
  117. */
  118. *info |= (8 * ((m - 2) / 2));
  119. if (req->assoclen)
  120. *info |= 64;
  121. return set_msg_len(info + 16 - l, cryptlen, l);
  122. }
  123. static int format_adata(u8 *adata, unsigned int a)
  124. {
  125. int len = 0;
  126. /* add control info for associated data
  127. * RFC 3610 and NIST Special Publication 800-38C
  128. */
  129. if (a < 65280) {
  130. *(__be16 *)adata = cpu_to_be16(a);
  131. len = 2;
  132. } else {
  133. *(__be16 *)adata = cpu_to_be16(0xfffe);
  134. *(__be32 *)&adata[2] = cpu_to_be32(a);
  135. len = 6;
  136. }
  137. return len;
  138. }
  139. static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
  140. unsigned int cryptlen)
  141. {
  142. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  143. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  144. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
  145. struct ahash_request *ahreq = &pctx->ahreq;
  146. unsigned int assoclen = req->assoclen;
  147. struct scatterlist sg[3];
  148. u8 *odata = pctx->odata;
  149. u8 *idata = pctx->idata;
  150. int ilen, err;
  151. /* format control data for input */
  152. err = format_input(odata, req, cryptlen);
  153. if (err)
  154. goto out;
  155. sg_init_table(sg, 3);
  156. sg_set_buf(&sg[0], odata, 16);
  157. /* format associated data and compute into mac */
  158. if (assoclen) {
  159. ilen = format_adata(idata, assoclen);
  160. sg_set_buf(&sg[1], idata, ilen);
  161. sg_chain(sg, 3, req->src);
  162. } else {
  163. ilen = 0;
  164. sg_chain(sg, 2, req->src);
  165. }
  166. ahash_request_set_tfm(ahreq, ctx->mac);
  167. ahash_request_set_callback(ahreq, pctx->flags, NULL, NULL);
  168. ahash_request_set_crypt(ahreq, sg, NULL, assoclen + ilen + 16);
  169. err = crypto_ahash_init(ahreq);
  170. if (err)
  171. goto out;
  172. err = crypto_ahash_update(ahreq);
  173. if (err)
  174. goto out;
  175. /* we need to pad the MAC input to a round multiple of the block size */
  176. ilen = 16 - (assoclen + ilen) % 16;
  177. if (ilen < 16) {
  178. memset(idata, 0, ilen);
  179. sg_init_table(sg, 2);
  180. sg_set_buf(&sg[0], idata, ilen);
  181. if (plain)
  182. sg_chain(sg, 2, plain);
  183. plain = sg;
  184. cryptlen += ilen;
  185. }
  186. ahash_request_set_crypt(ahreq, plain, pctx->odata, cryptlen);
  187. err = crypto_ahash_finup(ahreq);
  188. out:
  189. return err;
  190. }
  191. static void crypto_ccm_encrypt_done(struct crypto_async_request *areq, int err)
  192. {
  193. struct aead_request *req = areq->data;
  194. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  195. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  196. u8 *odata = pctx->odata;
  197. if (!err)
  198. scatterwalk_map_and_copy(odata, req->dst,
  199. req->assoclen + req->cryptlen,
  200. crypto_aead_authsize(aead), 1);
  201. aead_request_complete(req, err);
  202. }
  203. static inline int crypto_ccm_check_iv(const u8 *iv)
  204. {
  205. /* 2 <= L <= 8, so 1 <= L' <= 7. */
  206. if (1 > iv[0] || iv[0] > 7)
  207. return -EINVAL;
  208. return 0;
  209. }
  210. static int crypto_ccm_init_crypt(struct aead_request *req, u8 *tag)
  211. {
  212. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  213. struct scatterlist *sg;
  214. u8 *iv = req->iv;
  215. int err;
  216. err = crypto_ccm_check_iv(iv);
  217. if (err)
  218. return err;
  219. pctx->flags = aead_request_flags(req);
  220. /* Note: rfc 3610 and NIST 800-38C require counter of
  221. * zero to encrypt auth tag.
  222. */
  223. memset(iv + 15 - iv[0], 0, iv[0] + 1);
  224. sg_init_table(pctx->src, 3);
  225. sg_set_buf(pctx->src, tag, 16);
  226. sg = scatterwalk_ffwd(pctx->src + 1, req->src, req->assoclen);
  227. if (sg != pctx->src + 1)
  228. sg_chain(pctx->src, 2, sg);
  229. if (req->src != req->dst) {
  230. sg_init_table(pctx->dst, 3);
  231. sg_set_buf(pctx->dst, tag, 16);
  232. sg = scatterwalk_ffwd(pctx->dst + 1, req->dst, req->assoclen);
  233. if (sg != pctx->dst + 1)
  234. sg_chain(pctx->dst, 2, sg);
  235. }
  236. return 0;
  237. }
  238. static int crypto_ccm_encrypt(struct aead_request *req)
  239. {
  240. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  241. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
  242. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  243. struct skcipher_request *skreq = &pctx->skreq;
  244. struct scatterlist *dst;
  245. unsigned int cryptlen = req->cryptlen;
  246. u8 *odata = pctx->odata;
  247. u8 *iv = req->iv;
  248. int err;
  249. err = crypto_ccm_init_crypt(req, odata);
  250. if (err)
  251. return err;
  252. err = crypto_ccm_auth(req, sg_next(pctx->src), cryptlen);
  253. if (err)
  254. return err;
  255. dst = pctx->src;
  256. if (req->src != req->dst)
  257. dst = pctx->dst;
  258. skcipher_request_set_tfm(skreq, ctx->ctr);
  259. skcipher_request_set_callback(skreq, pctx->flags,
  260. crypto_ccm_encrypt_done, req);
  261. skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv);
  262. err = crypto_skcipher_encrypt(skreq);
  263. if (err)
  264. return err;
  265. /* copy authtag to end of dst */
  266. scatterwalk_map_and_copy(odata, sg_next(dst), cryptlen,
  267. crypto_aead_authsize(aead), 1);
  268. return err;
  269. }
  270. static void crypto_ccm_decrypt_done(struct crypto_async_request *areq,
  271. int err)
  272. {
  273. struct aead_request *req = areq->data;
  274. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  275. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  276. unsigned int authsize = crypto_aead_authsize(aead);
  277. unsigned int cryptlen = req->cryptlen - authsize;
  278. struct scatterlist *dst;
  279. pctx->flags = 0;
  280. dst = sg_next(req->src == req->dst ? pctx->src : pctx->dst);
  281. if (!err) {
  282. err = crypto_ccm_auth(req, dst, cryptlen);
  283. if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize))
  284. err = -EBADMSG;
  285. }
  286. aead_request_complete(req, err);
  287. }
  288. static int crypto_ccm_decrypt(struct aead_request *req)
  289. {
  290. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  291. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
  292. struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
  293. struct skcipher_request *skreq = &pctx->skreq;
  294. struct scatterlist *dst;
  295. unsigned int authsize = crypto_aead_authsize(aead);
  296. unsigned int cryptlen = req->cryptlen;
  297. u8 *authtag = pctx->auth_tag;
  298. u8 *odata = pctx->odata;
  299. u8 *iv = pctx->idata;
  300. int err;
  301. cryptlen -= authsize;
  302. err = crypto_ccm_init_crypt(req, authtag);
  303. if (err)
  304. return err;
  305. scatterwalk_map_and_copy(authtag, sg_next(pctx->src), cryptlen,
  306. authsize, 0);
  307. dst = pctx->src;
  308. if (req->src != req->dst)
  309. dst = pctx->dst;
  310. memcpy(iv, req->iv, 16);
  311. skcipher_request_set_tfm(skreq, ctx->ctr);
  312. skcipher_request_set_callback(skreq, pctx->flags,
  313. crypto_ccm_decrypt_done, req);
  314. skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv);
  315. err = crypto_skcipher_decrypt(skreq);
  316. if (err)
  317. return err;
  318. err = crypto_ccm_auth(req, sg_next(dst), cryptlen);
  319. if (err)
  320. return err;
  321. /* verify */
  322. if (crypto_memneq(authtag, odata, authsize))
  323. return -EBADMSG;
  324. return err;
  325. }
  326. static int crypto_ccm_init_tfm(struct crypto_aead *tfm)
  327. {
  328. struct aead_instance *inst = aead_alg_instance(tfm);
  329. struct ccm_instance_ctx *ictx = aead_instance_ctx(inst);
  330. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm);
  331. struct crypto_ahash *mac;
  332. struct crypto_skcipher *ctr;
  333. unsigned long align;
  334. int err;
  335. mac = crypto_spawn_ahash(&ictx->mac);
  336. if (IS_ERR(mac))
  337. return PTR_ERR(mac);
  338. ctr = crypto_spawn_skcipher(&ictx->ctr);
  339. err = PTR_ERR(ctr);
  340. if (IS_ERR(ctr))
  341. goto err_free_mac;
  342. ctx->mac = mac;
  343. ctx->ctr = ctr;
  344. align = crypto_aead_alignmask(tfm);
  345. align &= ~(crypto_tfm_ctx_alignment() - 1);
  346. crypto_aead_set_reqsize(
  347. tfm,
  348. align + sizeof(struct crypto_ccm_req_priv_ctx) +
  349. max(crypto_ahash_reqsize(mac), crypto_skcipher_reqsize(ctr)));
  350. return 0;
  351. err_free_mac:
  352. crypto_free_ahash(mac);
  353. return err;
  354. }
  355. static void crypto_ccm_exit_tfm(struct crypto_aead *tfm)
  356. {
  357. struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm);
  358. crypto_free_ahash(ctx->mac);
  359. crypto_free_skcipher(ctx->ctr);
  360. }
  361. static void crypto_ccm_free(struct aead_instance *inst)
  362. {
  363. struct ccm_instance_ctx *ctx = aead_instance_ctx(inst);
  364. crypto_drop_ahash(&ctx->mac);
  365. crypto_drop_skcipher(&ctx->ctr);
  366. kfree(inst);
  367. }
  368. static int crypto_ccm_create_common(struct crypto_template *tmpl,
  369. struct rtattr **tb,
  370. const char *ctr_name,
  371. const char *mac_name)
  372. {
  373. u32 mask;
  374. struct aead_instance *inst;
  375. struct ccm_instance_ctx *ictx;
  376. struct skcipher_alg *ctr;
  377. struct hash_alg_common *mac;
  378. int err;
  379. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask);
  380. if (err)
  381. return err;
  382. inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
  383. if (!inst)
  384. return -ENOMEM;
  385. ictx = aead_instance_ctx(inst);
  386. err = crypto_grab_ahash(&ictx->mac, aead_crypto_instance(inst),
  387. mac_name, 0, mask | CRYPTO_ALG_ASYNC);
  388. if (err)
  389. goto err_free_inst;
  390. mac = crypto_spawn_ahash_alg(&ictx->mac);
  391. err = -EINVAL;
  392. if (strncmp(mac->base.cra_name, "cbcmac(", 7) != 0 ||
  393. mac->digestsize != 16)
  394. goto err_free_inst;
  395. err = crypto_grab_skcipher(&ictx->ctr, aead_crypto_instance(inst),
  396. ctr_name, 0, mask);
  397. if (err)
  398. goto err_free_inst;
  399. ctr = crypto_spawn_skcipher_alg(&ictx->ctr);
  400. /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */
  401. err = -EINVAL;
  402. if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 ||
  403. crypto_skcipher_alg_ivsize(ctr) != 16 ||
  404. ctr->base.cra_blocksize != 1)
  405. goto err_free_inst;
  406. /* ctr and cbcmac must use the same underlying block cipher. */
  407. if (strcmp(ctr->base.cra_name + 4, mac->base.cra_name + 7) != 0)
  408. goto err_free_inst;
  409. err = -ENAMETOOLONG;
  410. if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
  411. "ccm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME)
  412. goto err_free_inst;
  413. if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
  414. "ccm_base(%s,%s)", ctr->base.cra_driver_name,
  415. mac->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
  416. goto err_free_inst;
  417. inst->alg.base.cra_priority = (mac->base.cra_priority +
  418. ctr->base.cra_priority) / 2;
  419. inst->alg.base.cra_blocksize = 1;
  420. inst->alg.base.cra_alignmask = mac->base.cra_alignmask |
  421. ctr->base.cra_alignmask;
  422. inst->alg.ivsize = 16;
  423. inst->alg.chunksize = crypto_skcipher_alg_chunksize(ctr);
  424. inst->alg.maxauthsize = 16;
  425. inst->alg.base.cra_ctxsize = sizeof(struct crypto_ccm_ctx);
  426. inst->alg.init = crypto_ccm_init_tfm;
  427. inst->alg.exit = crypto_ccm_exit_tfm;
  428. inst->alg.setkey = crypto_ccm_setkey;
  429. inst->alg.setauthsize = crypto_ccm_setauthsize;
  430. inst->alg.encrypt = crypto_ccm_encrypt;
  431. inst->alg.decrypt = crypto_ccm_decrypt;
  432. inst->free = crypto_ccm_free;
  433. err = aead_register_instance(tmpl, inst);
  434. if (err) {
  435. err_free_inst:
  436. crypto_ccm_free(inst);
  437. }
  438. return err;
  439. }
  440. static int crypto_ccm_create(struct crypto_template *tmpl, struct rtattr **tb)
  441. {
  442. const char *cipher_name;
  443. char ctr_name[CRYPTO_MAX_ALG_NAME];
  444. char mac_name[CRYPTO_MAX_ALG_NAME];
  445. cipher_name = crypto_attr_alg_name(tb[1]);
  446. if (IS_ERR(cipher_name))
  447. return PTR_ERR(cipher_name);
  448. if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
  449. cipher_name) >= CRYPTO_MAX_ALG_NAME)
  450. return -ENAMETOOLONG;
  451. if (snprintf(mac_name, CRYPTO_MAX_ALG_NAME, "cbcmac(%s)",
  452. cipher_name) >= CRYPTO_MAX_ALG_NAME)
  453. return -ENAMETOOLONG;
  454. return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name);
  455. }
  456. static int crypto_ccm_base_create(struct crypto_template *tmpl,
  457. struct rtattr **tb)
  458. {
  459. const char *ctr_name;
  460. const char *mac_name;
  461. ctr_name = crypto_attr_alg_name(tb[1]);
  462. if (IS_ERR(ctr_name))
  463. return PTR_ERR(ctr_name);
  464. mac_name = crypto_attr_alg_name(tb[2]);
  465. if (IS_ERR(mac_name))
  466. return PTR_ERR(mac_name);
  467. return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name);
  468. }
  469. static int crypto_rfc4309_setkey(struct crypto_aead *parent, const u8 *key,
  470. unsigned int keylen)
  471. {
  472. struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
  473. struct crypto_aead *child = ctx->child;
  474. if (keylen < 3)
  475. return -EINVAL;
  476. keylen -= 3;
  477. memcpy(ctx->nonce, key + keylen, 3);
  478. crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  479. crypto_aead_set_flags(child, crypto_aead_get_flags(parent) &
  480. CRYPTO_TFM_REQ_MASK);
  481. return crypto_aead_setkey(child, key, keylen);
  482. }
  483. static int crypto_rfc4309_setauthsize(struct crypto_aead *parent,
  484. unsigned int authsize)
  485. {
  486. struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
  487. switch (authsize) {
  488. case 8:
  489. case 12:
  490. case 16:
  491. break;
  492. default:
  493. return -EINVAL;
  494. }
  495. return crypto_aead_setauthsize(ctx->child, authsize);
  496. }
  497. static struct aead_request *crypto_rfc4309_crypt(struct aead_request *req)
  498. {
  499. struct crypto_rfc4309_req_ctx *rctx = aead_request_ctx(req);
  500. struct aead_request *subreq = &rctx->subreq;
  501. struct crypto_aead *aead = crypto_aead_reqtfm(req);
  502. struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(aead);
  503. struct crypto_aead *child = ctx->child;
  504. struct scatterlist *sg;
  505. u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child),
  506. crypto_aead_alignmask(child) + 1);
  507. /* L' */
  508. iv[0] = 3;
  509. memcpy(iv + 1, ctx->nonce, 3);
  510. memcpy(iv + 4, req->iv, 8);
  511. scatterwalk_map_and_copy(iv + 16, req->src, 0, req->assoclen - 8, 0);
  512. sg_init_table(rctx->src, 3);
  513. sg_set_buf(rctx->src, iv + 16, req->assoclen - 8);
  514. sg = scatterwalk_ffwd(rctx->src + 1, req->src, req->assoclen);
  515. if (sg != rctx->src + 1)
  516. sg_chain(rctx->src, 2, sg);
  517. if (req->src != req->dst) {
  518. sg_init_table(rctx->dst, 3);
  519. sg_set_buf(rctx->dst, iv + 16, req->assoclen - 8);
  520. sg = scatterwalk_ffwd(rctx->dst + 1, req->dst, req->assoclen);
  521. if (sg != rctx->dst + 1)
  522. sg_chain(rctx->dst, 2, sg);
  523. }
  524. aead_request_set_tfm(subreq, child);
  525. aead_request_set_callback(subreq, req->base.flags, req->base.complete,
  526. req->base.data);
  527. aead_request_set_crypt(subreq, rctx->src,
  528. req->src == req->dst ? rctx->src : rctx->dst,
  529. req->cryptlen, iv);
  530. aead_request_set_ad(subreq, req->assoclen - 8);
  531. return subreq;
  532. }
  533. static int crypto_rfc4309_encrypt(struct aead_request *req)
  534. {
  535. if (req->assoclen != 16 && req->assoclen != 20)
  536. return -EINVAL;
  537. req = crypto_rfc4309_crypt(req);
  538. return crypto_aead_encrypt(req);
  539. }
  540. static int crypto_rfc4309_decrypt(struct aead_request *req)
  541. {
  542. if (req->assoclen != 16 && req->assoclen != 20)
  543. return -EINVAL;
  544. req = crypto_rfc4309_crypt(req);
  545. return crypto_aead_decrypt(req);
  546. }
  547. static int crypto_rfc4309_init_tfm(struct crypto_aead *tfm)
  548. {
  549. struct aead_instance *inst = aead_alg_instance(tfm);
  550. struct crypto_aead_spawn *spawn = aead_instance_ctx(inst);
  551. struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm);
  552. struct crypto_aead *aead;
  553. unsigned long align;
  554. aead = crypto_spawn_aead(spawn);
  555. if (IS_ERR(aead))
  556. return PTR_ERR(aead);
  557. ctx->child = aead;
  558. align = crypto_aead_alignmask(aead);
  559. align &= ~(crypto_tfm_ctx_alignment() - 1);
  560. crypto_aead_set_reqsize(
  561. tfm,
  562. sizeof(struct crypto_rfc4309_req_ctx) +
  563. ALIGN(crypto_aead_reqsize(aead), crypto_tfm_ctx_alignment()) +
  564. align + 32);
  565. return 0;
  566. }
  567. static void crypto_rfc4309_exit_tfm(struct crypto_aead *tfm)
  568. {
  569. struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm);
  570. crypto_free_aead(ctx->child);
  571. }
  572. static void crypto_rfc4309_free(struct aead_instance *inst)
  573. {
  574. crypto_drop_aead(aead_instance_ctx(inst));
  575. kfree(inst);
  576. }
  577. static int crypto_rfc4309_create(struct crypto_template *tmpl,
  578. struct rtattr **tb)
  579. {
  580. u32 mask;
  581. struct aead_instance *inst;
  582. struct crypto_aead_spawn *spawn;
  583. struct aead_alg *alg;
  584. int err;
  585. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask);
  586. if (err)
  587. return err;
  588. inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
  589. if (!inst)
  590. return -ENOMEM;
  591. spawn = aead_instance_ctx(inst);
  592. err = crypto_grab_aead(spawn, aead_crypto_instance(inst),
  593. crypto_attr_alg_name(tb[1]), 0, mask);
  594. if (err)
  595. goto err_free_inst;
  596. alg = crypto_spawn_aead_alg(spawn);
  597. err = -EINVAL;
  598. /* We only support 16-byte blocks. */
  599. if (crypto_aead_alg_ivsize(alg) != 16)
  600. goto err_free_inst;
  601. /* Not a stream cipher? */
  602. if (alg->base.cra_blocksize != 1)
  603. goto err_free_inst;
  604. err = -ENAMETOOLONG;
  605. if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
  606. "rfc4309(%s)", alg->base.cra_name) >=
  607. CRYPTO_MAX_ALG_NAME ||
  608. snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
  609. "rfc4309(%s)", alg->base.cra_driver_name) >=
  610. CRYPTO_MAX_ALG_NAME)
  611. goto err_free_inst;
  612. inst->alg.base.cra_priority = alg->base.cra_priority;
  613. inst->alg.base.cra_blocksize = 1;
  614. inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
  615. inst->alg.ivsize = 8;
  616. inst->alg.chunksize = crypto_aead_alg_chunksize(alg);
  617. inst->alg.maxauthsize = 16;
  618. inst->alg.base.cra_ctxsize = sizeof(struct crypto_rfc4309_ctx);
  619. inst->alg.init = crypto_rfc4309_init_tfm;
  620. inst->alg.exit = crypto_rfc4309_exit_tfm;
  621. inst->alg.setkey = crypto_rfc4309_setkey;
  622. inst->alg.setauthsize = crypto_rfc4309_setauthsize;
  623. inst->alg.encrypt = crypto_rfc4309_encrypt;
  624. inst->alg.decrypt = crypto_rfc4309_decrypt;
  625. inst->free = crypto_rfc4309_free;
  626. err = aead_register_instance(tmpl, inst);
  627. if (err) {
  628. err_free_inst:
  629. crypto_rfc4309_free(inst);
  630. }
  631. return err;
  632. }
  633. static int crypto_cbcmac_digest_setkey(struct crypto_shash *parent,
  634. const u8 *inkey, unsigned int keylen)
  635. {
  636. struct cbcmac_tfm_ctx *ctx = crypto_shash_ctx(parent);
  637. return crypto_cipher_setkey(ctx->child, inkey, keylen);
  638. }
  639. static int crypto_cbcmac_digest_init(struct shash_desc *pdesc)
  640. {
  641. struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc);
  642. int bs = crypto_shash_digestsize(pdesc->tfm);
  643. u8 *dg = (u8 *)ctx + crypto_shash_descsize(pdesc->tfm) - bs;
  644. ctx->len = 0;
  645. memset(dg, 0, bs);
  646. return 0;
  647. }
  648. static int crypto_cbcmac_digest_update(struct shash_desc *pdesc, const u8 *p,
  649. unsigned int len)
  650. {
  651. struct crypto_shash *parent = pdesc->tfm;
  652. struct cbcmac_tfm_ctx *tctx = crypto_shash_ctx(parent);
  653. struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc);
  654. struct crypto_cipher *tfm = tctx->child;
  655. int bs = crypto_shash_digestsize(parent);
  656. u8 *dg = (u8 *)ctx + crypto_shash_descsize(parent) - bs;
  657. while (len > 0) {
  658. unsigned int l = min(len, bs - ctx->len);
  659. crypto_xor(dg + ctx->len, p, l);
  660. ctx->len +=l;
  661. len -= l;
  662. p += l;
  663. if (ctx->len == bs) {
  664. crypto_cipher_encrypt_one(tfm, dg, dg);
  665. ctx->len = 0;
  666. }
  667. }
  668. return 0;
  669. }
  670. static int crypto_cbcmac_digest_final(struct shash_desc *pdesc, u8 *out)
  671. {
  672. struct crypto_shash *parent = pdesc->tfm;
  673. struct cbcmac_tfm_ctx *tctx = crypto_shash_ctx(parent);
  674. struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc);
  675. struct crypto_cipher *tfm = tctx->child;
  676. int bs = crypto_shash_digestsize(parent);
  677. u8 *dg = (u8 *)ctx + crypto_shash_descsize(parent) - bs;
  678. if (ctx->len)
  679. crypto_cipher_encrypt_one(tfm, dg, dg);
  680. memcpy(out, dg, bs);
  681. return 0;
  682. }
  683. static int cbcmac_init_tfm(struct crypto_tfm *tfm)
  684. {
  685. struct crypto_cipher *cipher;
  686. struct crypto_instance *inst = (void *)tfm->__crt_alg;
  687. struct crypto_cipher_spawn *spawn = crypto_instance_ctx(inst);
  688. struct cbcmac_tfm_ctx *ctx = crypto_tfm_ctx(tfm);
  689. cipher = crypto_spawn_cipher(spawn);
  690. if (IS_ERR(cipher))
  691. return PTR_ERR(cipher);
  692. ctx->child = cipher;
  693. return 0;
  694. };
  695. static void cbcmac_exit_tfm(struct crypto_tfm *tfm)
  696. {
  697. struct cbcmac_tfm_ctx *ctx = crypto_tfm_ctx(tfm);
  698. crypto_free_cipher(ctx->child);
  699. }
  700. static int cbcmac_create(struct crypto_template *tmpl, struct rtattr **tb)
  701. {
  702. struct shash_instance *inst;
  703. struct crypto_cipher_spawn *spawn;
  704. struct crypto_alg *alg;
  705. u32 mask;
  706. int err;
  707. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH, &mask);
  708. if (err)
  709. return err;
  710. inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
  711. if (!inst)
  712. return -ENOMEM;
  713. spawn = shash_instance_ctx(inst);
  714. err = crypto_grab_cipher(spawn, shash_crypto_instance(inst),
  715. crypto_attr_alg_name(tb[1]), 0, mask);
  716. if (err)
  717. goto err_free_inst;
  718. alg = crypto_spawn_cipher_alg(spawn);
  719. err = crypto_inst_setname(shash_crypto_instance(inst), tmpl->name, alg);
  720. if (err)
  721. goto err_free_inst;
  722. inst->alg.base.cra_priority = alg->cra_priority;
  723. inst->alg.base.cra_blocksize = 1;
  724. inst->alg.digestsize = alg->cra_blocksize;
  725. inst->alg.descsize = ALIGN(sizeof(struct cbcmac_desc_ctx),
  726. alg->cra_alignmask + 1) +
  727. alg->cra_blocksize;
  728. inst->alg.base.cra_ctxsize = sizeof(struct cbcmac_tfm_ctx);
  729. inst->alg.base.cra_init = cbcmac_init_tfm;
  730. inst->alg.base.cra_exit = cbcmac_exit_tfm;
  731. inst->alg.init = crypto_cbcmac_digest_init;
  732. inst->alg.update = crypto_cbcmac_digest_update;
  733. inst->alg.final = crypto_cbcmac_digest_final;
  734. inst->alg.setkey = crypto_cbcmac_digest_setkey;
  735. inst->free = shash_free_singlespawn_instance;
  736. err = shash_register_instance(tmpl, inst);
  737. if (err) {
  738. err_free_inst:
  739. shash_free_singlespawn_instance(inst);
  740. }
  741. return err;
  742. }
  743. static struct crypto_template crypto_ccm_tmpls[] = {
  744. {
  745. .name = "cbcmac",
  746. .create = cbcmac_create,
  747. .module = THIS_MODULE,
  748. }, {
  749. .name = "ccm_base",
  750. .create = crypto_ccm_base_create,
  751. .module = THIS_MODULE,
  752. }, {
  753. .name = "ccm",
  754. .create = crypto_ccm_create,
  755. .module = THIS_MODULE,
  756. }, {
  757. .name = "rfc4309",
  758. .create = crypto_rfc4309_create,
  759. .module = THIS_MODULE,
  760. },
  761. };
  762. static int __init crypto_ccm_module_init(void)
  763. {
  764. return crypto_register_templates(crypto_ccm_tmpls,
  765. ARRAY_SIZE(crypto_ccm_tmpls));
  766. }
  767. static void __exit crypto_ccm_module_exit(void)
  768. {
  769. crypto_unregister_templates(crypto_ccm_tmpls,
  770. ARRAY_SIZE(crypto_ccm_tmpls));
  771. }
  772. subsys_initcall(crypto_ccm_module_init);
  773. module_exit(crypto_ccm_module_exit);
  774. MODULE_LICENSE("GPL");
  775. MODULE_DESCRIPTION("Counter with CBC MAC");
  776. MODULE_ALIAS_CRYPTO("ccm_base");
  777. MODULE_ALIAS_CRYPTO("rfc4309");
  778. MODULE_ALIAS_CRYPTO("ccm");
  779. MODULE_ALIAS_CRYPTO("cbcmac");
  780. MODULE_IMPORT_NS(CRYPTO_INTERNAL);