chacha20poly1305.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * ChaCha20-Poly1305 AEAD, RFC7539
  4. *
  5. * Copyright (C) 2015 Martin Willi
  6. */
  7. #include <crypto/internal/aead.h>
  8. #include <crypto/internal/hash.h>
  9. #include <crypto/internal/skcipher.h>
  10. #include <crypto/scatterwalk.h>
  11. #include <crypto/chacha.h>
  12. #include <crypto/poly1305.h>
  13. #include <linux/err.h>
  14. #include <linux/init.h>
  15. #include <linux/kernel.h>
  16. #include <linux/module.h>
  17. struct chachapoly_instance_ctx {
  18. struct crypto_skcipher_spawn chacha;
  19. struct crypto_ahash_spawn poly;
  20. unsigned int saltlen;
  21. };
  22. struct chachapoly_ctx {
  23. struct crypto_skcipher *chacha;
  24. struct crypto_ahash *poly;
  25. /* key bytes we use for the ChaCha20 IV */
  26. unsigned int saltlen;
  27. u8 salt[];
  28. };
  29. struct poly_req {
  30. /* zero byte padding for AD/ciphertext, as needed */
  31. u8 pad[POLY1305_BLOCK_SIZE];
  32. /* tail data with AD/ciphertext lengths */
  33. struct {
  34. __le64 assoclen;
  35. __le64 cryptlen;
  36. } tail;
  37. struct scatterlist src[1];
  38. struct ahash_request req; /* must be last member */
  39. };
  40. struct chacha_req {
  41. u8 iv[CHACHA_IV_SIZE];
  42. struct scatterlist src[1];
  43. struct skcipher_request req; /* must be last member */
  44. };
  45. struct chachapoly_req_ctx {
  46. struct scatterlist src[2];
  47. struct scatterlist dst[2];
  48. /* the key we generate for Poly1305 using Chacha20 */
  49. u8 key[POLY1305_KEY_SIZE];
  50. /* calculated Poly1305 tag */
  51. u8 tag[POLY1305_DIGEST_SIZE];
  52. /* length of data to en/decrypt, without ICV */
  53. unsigned int cryptlen;
  54. /* Actual AD, excluding IV */
  55. unsigned int assoclen;
  56. /* request flags, with MAY_SLEEP cleared if needed */
  57. u32 flags;
  58. union {
  59. struct poly_req poly;
  60. struct chacha_req chacha;
  61. } u;
  62. };
  63. static inline void async_done_continue(struct aead_request *req, int err,
  64. int (*cont)(struct aead_request *))
  65. {
  66. if (!err) {
  67. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  68. rctx->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
  69. err = cont(req);
  70. }
  71. if (err != -EINPROGRESS && err != -EBUSY)
  72. aead_request_complete(req, err);
  73. }
  74. static void chacha_iv(u8 *iv, struct aead_request *req, u32 icb)
  75. {
  76. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  77. __le32 leicb = cpu_to_le32(icb);
  78. memcpy(iv, &leicb, sizeof(leicb));
  79. memcpy(iv + sizeof(leicb), ctx->salt, ctx->saltlen);
  80. memcpy(iv + sizeof(leicb) + ctx->saltlen, req->iv,
  81. CHACHA_IV_SIZE - sizeof(leicb) - ctx->saltlen);
  82. }
  83. static int poly_verify_tag(struct aead_request *req)
  84. {
  85. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  86. u8 tag[sizeof(rctx->tag)];
  87. scatterwalk_map_and_copy(tag, req->src,
  88. req->assoclen + rctx->cryptlen,
  89. sizeof(tag), 0);
  90. if (crypto_memneq(tag, rctx->tag, sizeof(tag)))
  91. return -EBADMSG;
  92. return 0;
  93. }
  94. static int poly_copy_tag(struct aead_request *req)
  95. {
  96. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  97. scatterwalk_map_and_copy(rctx->tag, req->dst,
  98. req->assoclen + rctx->cryptlen,
  99. sizeof(rctx->tag), 1);
  100. return 0;
  101. }
  102. static void chacha_decrypt_done(struct crypto_async_request *areq, int err)
  103. {
  104. async_done_continue(areq->data, err, poly_verify_tag);
  105. }
  106. static int chacha_decrypt(struct aead_request *req)
  107. {
  108. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  109. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  110. struct chacha_req *creq = &rctx->u.chacha;
  111. struct scatterlist *src, *dst;
  112. int err;
  113. if (rctx->cryptlen == 0)
  114. goto skip;
  115. chacha_iv(creq->iv, req, 1);
  116. src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen);
  117. dst = src;
  118. if (req->src != req->dst)
  119. dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
  120. skcipher_request_set_callback(&creq->req, rctx->flags,
  121. chacha_decrypt_done, req);
  122. skcipher_request_set_tfm(&creq->req, ctx->chacha);
  123. skcipher_request_set_crypt(&creq->req, src, dst,
  124. rctx->cryptlen, creq->iv);
  125. err = crypto_skcipher_decrypt(&creq->req);
  126. if (err)
  127. return err;
  128. skip:
  129. return poly_verify_tag(req);
  130. }
  131. static int poly_tail_continue(struct aead_request *req)
  132. {
  133. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  134. if (rctx->cryptlen == req->cryptlen) /* encrypting */
  135. return poly_copy_tag(req);
  136. return chacha_decrypt(req);
  137. }
  138. static void poly_tail_done(struct crypto_async_request *areq, int err)
  139. {
  140. async_done_continue(areq->data, err, poly_tail_continue);
  141. }
  142. static int poly_tail(struct aead_request *req)
  143. {
  144. struct crypto_aead *tfm = crypto_aead_reqtfm(req);
  145. struct chachapoly_ctx *ctx = crypto_aead_ctx(tfm);
  146. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  147. struct poly_req *preq = &rctx->u.poly;
  148. int err;
  149. preq->tail.assoclen = cpu_to_le64(rctx->assoclen);
  150. preq->tail.cryptlen = cpu_to_le64(rctx->cryptlen);
  151. sg_init_one(preq->src, &preq->tail, sizeof(preq->tail));
  152. ahash_request_set_callback(&preq->req, rctx->flags,
  153. poly_tail_done, req);
  154. ahash_request_set_tfm(&preq->req, ctx->poly);
  155. ahash_request_set_crypt(&preq->req, preq->src,
  156. rctx->tag, sizeof(preq->tail));
  157. err = crypto_ahash_finup(&preq->req);
  158. if (err)
  159. return err;
  160. return poly_tail_continue(req);
  161. }
  162. static void poly_cipherpad_done(struct crypto_async_request *areq, int err)
  163. {
  164. async_done_continue(areq->data, err, poly_tail);
  165. }
  166. static int poly_cipherpad(struct aead_request *req)
  167. {
  168. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  169. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  170. struct poly_req *preq = &rctx->u.poly;
  171. unsigned int padlen;
  172. int err;
  173. padlen = -rctx->cryptlen % POLY1305_BLOCK_SIZE;
  174. memset(preq->pad, 0, sizeof(preq->pad));
  175. sg_init_one(preq->src, preq->pad, padlen);
  176. ahash_request_set_callback(&preq->req, rctx->flags,
  177. poly_cipherpad_done, req);
  178. ahash_request_set_tfm(&preq->req, ctx->poly);
  179. ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
  180. err = crypto_ahash_update(&preq->req);
  181. if (err)
  182. return err;
  183. return poly_tail(req);
  184. }
  185. static void poly_cipher_done(struct crypto_async_request *areq, int err)
  186. {
  187. async_done_continue(areq->data, err, poly_cipherpad);
  188. }
  189. static int poly_cipher(struct aead_request *req)
  190. {
  191. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  192. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  193. struct poly_req *preq = &rctx->u.poly;
  194. struct scatterlist *crypt = req->src;
  195. int err;
  196. if (rctx->cryptlen == req->cryptlen) /* encrypting */
  197. crypt = req->dst;
  198. crypt = scatterwalk_ffwd(rctx->src, crypt, req->assoclen);
  199. ahash_request_set_callback(&preq->req, rctx->flags,
  200. poly_cipher_done, req);
  201. ahash_request_set_tfm(&preq->req, ctx->poly);
  202. ahash_request_set_crypt(&preq->req, crypt, NULL, rctx->cryptlen);
  203. err = crypto_ahash_update(&preq->req);
  204. if (err)
  205. return err;
  206. return poly_cipherpad(req);
  207. }
  208. static void poly_adpad_done(struct crypto_async_request *areq, int err)
  209. {
  210. async_done_continue(areq->data, err, poly_cipher);
  211. }
  212. static int poly_adpad(struct aead_request *req)
  213. {
  214. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  215. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  216. struct poly_req *preq = &rctx->u.poly;
  217. unsigned int padlen;
  218. int err;
  219. padlen = -rctx->assoclen % POLY1305_BLOCK_SIZE;
  220. memset(preq->pad, 0, sizeof(preq->pad));
  221. sg_init_one(preq->src, preq->pad, padlen);
  222. ahash_request_set_callback(&preq->req, rctx->flags,
  223. poly_adpad_done, req);
  224. ahash_request_set_tfm(&preq->req, ctx->poly);
  225. ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
  226. err = crypto_ahash_update(&preq->req);
  227. if (err)
  228. return err;
  229. return poly_cipher(req);
  230. }
  231. static void poly_ad_done(struct crypto_async_request *areq, int err)
  232. {
  233. async_done_continue(areq->data, err, poly_adpad);
  234. }
  235. static int poly_ad(struct aead_request *req)
  236. {
  237. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  238. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  239. struct poly_req *preq = &rctx->u.poly;
  240. int err;
  241. ahash_request_set_callback(&preq->req, rctx->flags,
  242. poly_ad_done, req);
  243. ahash_request_set_tfm(&preq->req, ctx->poly);
  244. ahash_request_set_crypt(&preq->req, req->src, NULL, rctx->assoclen);
  245. err = crypto_ahash_update(&preq->req);
  246. if (err)
  247. return err;
  248. return poly_adpad(req);
  249. }
  250. static void poly_setkey_done(struct crypto_async_request *areq, int err)
  251. {
  252. async_done_continue(areq->data, err, poly_ad);
  253. }
  254. static int poly_setkey(struct aead_request *req)
  255. {
  256. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  257. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  258. struct poly_req *preq = &rctx->u.poly;
  259. int err;
  260. sg_init_one(preq->src, rctx->key, sizeof(rctx->key));
  261. ahash_request_set_callback(&preq->req, rctx->flags,
  262. poly_setkey_done, req);
  263. ahash_request_set_tfm(&preq->req, ctx->poly);
  264. ahash_request_set_crypt(&preq->req, preq->src, NULL, sizeof(rctx->key));
  265. err = crypto_ahash_update(&preq->req);
  266. if (err)
  267. return err;
  268. return poly_ad(req);
  269. }
  270. static void poly_init_done(struct crypto_async_request *areq, int err)
  271. {
  272. async_done_continue(areq->data, err, poly_setkey);
  273. }
  274. static int poly_init(struct aead_request *req)
  275. {
  276. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  277. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  278. struct poly_req *preq = &rctx->u.poly;
  279. int err;
  280. ahash_request_set_callback(&preq->req, rctx->flags,
  281. poly_init_done, req);
  282. ahash_request_set_tfm(&preq->req, ctx->poly);
  283. err = crypto_ahash_init(&preq->req);
  284. if (err)
  285. return err;
  286. return poly_setkey(req);
  287. }
  288. static void poly_genkey_done(struct crypto_async_request *areq, int err)
  289. {
  290. async_done_continue(areq->data, err, poly_init);
  291. }
  292. static int poly_genkey(struct aead_request *req)
  293. {
  294. struct crypto_aead *tfm = crypto_aead_reqtfm(req);
  295. struct chachapoly_ctx *ctx = crypto_aead_ctx(tfm);
  296. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  297. struct chacha_req *creq = &rctx->u.chacha;
  298. int err;
  299. rctx->assoclen = req->assoclen;
  300. if (crypto_aead_ivsize(tfm) == 8) {
  301. if (rctx->assoclen < 8)
  302. return -EINVAL;
  303. rctx->assoclen -= 8;
  304. }
  305. memset(rctx->key, 0, sizeof(rctx->key));
  306. sg_init_one(creq->src, rctx->key, sizeof(rctx->key));
  307. chacha_iv(creq->iv, req, 0);
  308. skcipher_request_set_callback(&creq->req, rctx->flags,
  309. poly_genkey_done, req);
  310. skcipher_request_set_tfm(&creq->req, ctx->chacha);
  311. skcipher_request_set_crypt(&creq->req, creq->src, creq->src,
  312. POLY1305_KEY_SIZE, creq->iv);
  313. err = crypto_skcipher_decrypt(&creq->req);
  314. if (err)
  315. return err;
  316. return poly_init(req);
  317. }
  318. static void chacha_encrypt_done(struct crypto_async_request *areq, int err)
  319. {
  320. async_done_continue(areq->data, err, poly_genkey);
  321. }
  322. static int chacha_encrypt(struct aead_request *req)
  323. {
  324. struct chachapoly_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req));
  325. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  326. struct chacha_req *creq = &rctx->u.chacha;
  327. struct scatterlist *src, *dst;
  328. int err;
  329. if (req->cryptlen == 0)
  330. goto skip;
  331. chacha_iv(creq->iv, req, 1);
  332. src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen);
  333. dst = src;
  334. if (req->src != req->dst)
  335. dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
  336. skcipher_request_set_callback(&creq->req, rctx->flags,
  337. chacha_encrypt_done, req);
  338. skcipher_request_set_tfm(&creq->req, ctx->chacha);
  339. skcipher_request_set_crypt(&creq->req, src, dst,
  340. req->cryptlen, creq->iv);
  341. err = crypto_skcipher_encrypt(&creq->req);
  342. if (err)
  343. return err;
  344. skip:
  345. return poly_genkey(req);
  346. }
  347. static int chachapoly_encrypt(struct aead_request *req)
  348. {
  349. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  350. rctx->cryptlen = req->cryptlen;
  351. rctx->flags = aead_request_flags(req);
  352. /* encrypt call chain:
  353. * - chacha_encrypt/done()
  354. * - poly_genkey/done()
  355. * - poly_init/done()
  356. * - poly_setkey/done()
  357. * - poly_ad/done()
  358. * - poly_adpad/done()
  359. * - poly_cipher/done()
  360. * - poly_cipherpad/done()
  361. * - poly_tail/done/continue()
  362. * - poly_copy_tag()
  363. */
  364. return chacha_encrypt(req);
  365. }
  366. static int chachapoly_decrypt(struct aead_request *req)
  367. {
  368. struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
  369. rctx->cryptlen = req->cryptlen - POLY1305_DIGEST_SIZE;
  370. rctx->flags = aead_request_flags(req);
  371. /* decrypt call chain:
  372. * - poly_genkey/done()
  373. * - poly_init/done()
  374. * - poly_setkey/done()
  375. * - poly_ad/done()
  376. * - poly_adpad/done()
  377. * - poly_cipher/done()
  378. * - poly_cipherpad/done()
  379. * - poly_tail/done/continue()
  380. * - chacha_decrypt/done()
  381. * - poly_verify_tag()
  382. */
  383. return poly_genkey(req);
  384. }
  385. static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
  386. unsigned int keylen)
  387. {
  388. struct chachapoly_ctx *ctx = crypto_aead_ctx(aead);
  389. if (keylen != ctx->saltlen + CHACHA_KEY_SIZE)
  390. return -EINVAL;
  391. keylen -= ctx->saltlen;
  392. memcpy(ctx->salt, key + keylen, ctx->saltlen);
  393. crypto_skcipher_clear_flags(ctx->chacha, CRYPTO_TFM_REQ_MASK);
  394. crypto_skcipher_set_flags(ctx->chacha, crypto_aead_get_flags(aead) &
  395. CRYPTO_TFM_REQ_MASK);
  396. return crypto_skcipher_setkey(ctx->chacha, key, keylen);
  397. }
  398. static int chachapoly_setauthsize(struct crypto_aead *tfm,
  399. unsigned int authsize)
  400. {
  401. if (authsize != POLY1305_DIGEST_SIZE)
  402. return -EINVAL;
  403. return 0;
  404. }
  405. static int chachapoly_init(struct crypto_aead *tfm)
  406. {
  407. struct aead_instance *inst = aead_alg_instance(tfm);
  408. struct chachapoly_instance_ctx *ictx = aead_instance_ctx(inst);
  409. struct chachapoly_ctx *ctx = crypto_aead_ctx(tfm);
  410. struct crypto_skcipher *chacha;
  411. struct crypto_ahash *poly;
  412. unsigned long align;
  413. poly = crypto_spawn_ahash(&ictx->poly);
  414. if (IS_ERR(poly))
  415. return PTR_ERR(poly);
  416. chacha = crypto_spawn_skcipher(&ictx->chacha);
  417. if (IS_ERR(chacha)) {
  418. crypto_free_ahash(poly);
  419. return PTR_ERR(chacha);
  420. }
  421. ctx->chacha = chacha;
  422. ctx->poly = poly;
  423. ctx->saltlen = ictx->saltlen;
  424. align = crypto_aead_alignmask(tfm);
  425. align &= ~(crypto_tfm_ctx_alignment() - 1);
  426. crypto_aead_set_reqsize(
  427. tfm,
  428. align + offsetof(struct chachapoly_req_ctx, u) +
  429. max(offsetof(struct chacha_req, req) +
  430. sizeof(struct skcipher_request) +
  431. crypto_skcipher_reqsize(chacha),
  432. offsetof(struct poly_req, req) +
  433. sizeof(struct ahash_request) +
  434. crypto_ahash_reqsize(poly)));
  435. return 0;
  436. }
  437. static void chachapoly_exit(struct crypto_aead *tfm)
  438. {
  439. struct chachapoly_ctx *ctx = crypto_aead_ctx(tfm);
  440. crypto_free_ahash(ctx->poly);
  441. crypto_free_skcipher(ctx->chacha);
  442. }
  443. static void chachapoly_free(struct aead_instance *inst)
  444. {
  445. struct chachapoly_instance_ctx *ctx = aead_instance_ctx(inst);
  446. crypto_drop_skcipher(&ctx->chacha);
  447. crypto_drop_ahash(&ctx->poly);
  448. kfree(inst);
  449. }
  450. static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
  451. const char *name, unsigned int ivsize)
  452. {
  453. u32 mask;
  454. struct aead_instance *inst;
  455. struct chachapoly_instance_ctx *ctx;
  456. struct skcipher_alg *chacha;
  457. struct hash_alg_common *poly;
  458. int err;
  459. if (ivsize > CHACHAPOLY_IV_SIZE)
  460. return -EINVAL;
  461. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask);
  462. if (err)
  463. return err;
  464. inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
  465. if (!inst)
  466. return -ENOMEM;
  467. ctx = aead_instance_ctx(inst);
  468. ctx->saltlen = CHACHAPOLY_IV_SIZE - ivsize;
  469. err = crypto_grab_skcipher(&ctx->chacha, aead_crypto_instance(inst),
  470. crypto_attr_alg_name(tb[1]), 0, mask);
  471. if (err)
  472. goto err_free_inst;
  473. chacha = crypto_spawn_skcipher_alg(&ctx->chacha);
  474. err = crypto_grab_ahash(&ctx->poly, aead_crypto_instance(inst),
  475. crypto_attr_alg_name(tb[2]), 0, mask);
  476. if (err)
  477. goto err_free_inst;
  478. poly = crypto_spawn_ahash_alg(&ctx->poly);
  479. err = -EINVAL;
  480. if (poly->digestsize != POLY1305_DIGEST_SIZE)
  481. goto err_free_inst;
  482. /* Need 16-byte IV size, including Initial Block Counter value */
  483. if (crypto_skcipher_alg_ivsize(chacha) != CHACHA_IV_SIZE)
  484. goto err_free_inst;
  485. /* Not a stream cipher? */
  486. if (chacha->base.cra_blocksize != 1)
  487. goto err_free_inst;
  488. err = -ENAMETOOLONG;
  489. if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
  490. "%s(%s,%s)", name, chacha->base.cra_name,
  491. poly->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
  492. goto err_free_inst;
  493. if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
  494. "%s(%s,%s)", name, chacha->base.cra_driver_name,
  495. poly->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
  496. goto err_free_inst;
  497. inst->alg.base.cra_priority = (chacha->base.cra_priority +
  498. poly->base.cra_priority) / 2;
  499. inst->alg.base.cra_blocksize = 1;
  500. inst->alg.base.cra_alignmask = chacha->base.cra_alignmask |
  501. poly->base.cra_alignmask;
  502. inst->alg.base.cra_ctxsize = sizeof(struct chachapoly_ctx) +
  503. ctx->saltlen;
  504. inst->alg.ivsize = ivsize;
  505. inst->alg.chunksize = crypto_skcipher_alg_chunksize(chacha);
  506. inst->alg.maxauthsize = POLY1305_DIGEST_SIZE;
  507. inst->alg.init = chachapoly_init;
  508. inst->alg.exit = chachapoly_exit;
  509. inst->alg.encrypt = chachapoly_encrypt;
  510. inst->alg.decrypt = chachapoly_decrypt;
  511. inst->alg.setkey = chachapoly_setkey;
  512. inst->alg.setauthsize = chachapoly_setauthsize;
  513. inst->free = chachapoly_free;
  514. err = aead_register_instance(tmpl, inst);
  515. if (err) {
  516. err_free_inst:
  517. chachapoly_free(inst);
  518. }
  519. return err;
  520. }
  521. static int rfc7539_create(struct crypto_template *tmpl, struct rtattr **tb)
  522. {
  523. return chachapoly_create(tmpl, tb, "rfc7539", 12);
  524. }
  525. static int rfc7539esp_create(struct crypto_template *tmpl, struct rtattr **tb)
  526. {
  527. return chachapoly_create(tmpl, tb, "rfc7539esp", 8);
  528. }
  529. static struct crypto_template rfc7539_tmpls[] = {
  530. {
  531. .name = "rfc7539",
  532. .create = rfc7539_create,
  533. .module = THIS_MODULE,
  534. }, {
  535. .name = "rfc7539esp",
  536. .create = rfc7539esp_create,
  537. .module = THIS_MODULE,
  538. },
  539. };
  540. static int __init chacha20poly1305_module_init(void)
  541. {
  542. return crypto_register_templates(rfc7539_tmpls,
  543. ARRAY_SIZE(rfc7539_tmpls));
  544. }
  545. static void __exit chacha20poly1305_module_exit(void)
  546. {
  547. crypto_unregister_templates(rfc7539_tmpls,
  548. ARRAY_SIZE(rfc7539_tmpls));
  549. }
  550. subsys_initcall(chacha20poly1305_module_init);
  551. module_exit(chacha20poly1305_module_exit);
  552. MODULE_LICENSE("GPL");
  553. MODULE_AUTHOR("Martin Willi <martin@strongswan.org>");
  554. MODULE_DESCRIPTION("ChaCha20-Poly1305 AEAD");
  555. MODULE_ALIAS_CRYPTO("rfc7539");
  556. MODULE_ALIAS_CRYPTO("rfc7539esp");