cts.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410
  1. /*
  2. * CTS: Cipher Text Stealing mode
  3. *
  4. * COPYRIGHT (c) 2008
  5. * The Regents of the University of Michigan
  6. * ALL RIGHTS RESERVED
  7. *
  8. * Permission is granted to use, copy, create derivative works
  9. * and redistribute this software and such derivative works
  10. * for any purpose, so long as the name of The University of
  11. * Michigan is not used in any advertising or publicity
  12. * pertaining to the use of distribution of this software
  13. * without specific, written prior authorization. If the
  14. * above copyright notice or any other identification of the
  15. * University of Michigan is included in any copy of any
  16. * portion of this software, then the disclaimer below must
  17. * also be included.
  18. *
  19. * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
  20. * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
  21. * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
  22. * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
  23. * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
  24. * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
  25. * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
  26. * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
  27. * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
  28. * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
  29. * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
  30. * SUCH DAMAGES.
  31. */
  32. /* Derived from various:
  33. * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
  34. */
  35. /*
  36. * This is the Cipher Text Stealing mode as described by
  37. * Section 8 of rfc2040 and referenced by rfc3962.
  38. * rfc3962 includes errata information in its Appendix A.
  39. */
  40. #include <crypto/algapi.h>
  41. #include <crypto/internal/skcipher.h>
  42. #include <linux/err.h>
  43. #include <linux/init.h>
  44. #include <linux/kernel.h>
  45. #include <linux/log2.h>
  46. #include <linux/module.h>
  47. #include <linux/scatterlist.h>
  48. #include <crypto/scatterwalk.h>
  49. #include <linux/slab.h>
  50. #include <linux/compiler.h>
  51. struct crypto_cts_ctx {
  52. struct crypto_skcipher *child;
  53. };
  54. struct crypto_cts_reqctx {
  55. struct scatterlist sg[2];
  56. unsigned offset;
  57. struct skcipher_request subreq;
  58. };
  59. static inline u8 *crypto_cts_reqctx_space(struct skcipher_request *req)
  60. {
  61. struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
  62. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  63. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
  64. struct crypto_skcipher *child = ctx->child;
  65. return PTR_ALIGN((u8 *)(rctx + 1) + crypto_skcipher_reqsize(child),
  66. crypto_skcipher_alignmask(tfm) + 1);
  67. }
  68. static int crypto_cts_setkey(struct crypto_skcipher *parent, const u8 *key,
  69. unsigned int keylen)
  70. {
  71. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(parent);
  72. struct crypto_skcipher *child = ctx->child;
  73. crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  74. crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) &
  75. CRYPTO_TFM_REQ_MASK);
  76. return crypto_skcipher_setkey(child, key, keylen);
  77. }
  78. static void cts_cbc_crypt_done(struct crypto_async_request *areq, int err)
  79. {
  80. struct skcipher_request *req = areq->data;
  81. if (err == -EINPROGRESS)
  82. return;
  83. skcipher_request_complete(req, err);
  84. }
  85. static int cts_cbc_encrypt(struct skcipher_request *req)
  86. {
  87. struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
  88. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  89. struct skcipher_request *subreq = &rctx->subreq;
  90. int bsize = crypto_skcipher_blocksize(tfm);
  91. u8 d[MAX_CIPHER_BLOCKSIZE * 2] __aligned(__alignof__(u32));
  92. struct scatterlist *sg;
  93. unsigned int offset;
  94. int lastn;
  95. offset = rctx->offset;
  96. lastn = req->cryptlen - offset;
  97. sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize);
  98. scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0);
  99. memset(d, 0, bsize);
  100. scatterwalk_map_and_copy(d, req->src, offset, lastn, 0);
  101. scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1);
  102. memzero_explicit(d, sizeof(d));
  103. skcipher_request_set_callback(subreq, req->base.flags &
  104. CRYPTO_TFM_REQ_MAY_BACKLOG,
  105. cts_cbc_crypt_done, req);
  106. skcipher_request_set_crypt(subreq, sg, sg, bsize, req->iv);
  107. return crypto_skcipher_encrypt(subreq);
  108. }
  109. static void crypto_cts_encrypt_done(struct crypto_async_request *areq, int err)
  110. {
  111. struct skcipher_request *req = areq->data;
  112. if (err)
  113. goto out;
  114. err = cts_cbc_encrypt(req);
  115. if (err == -EINPROGRESS || err == -EBUSY)
  116. return;
  117. out:
  118. skcipher_request_complete(req, err);
  119. }
  120. static int crypto_cts_encrypt(struct skcipher_request *req)
  121. {
  122. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  123. struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
  124. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
  125. struct skcipher_request *subreq = &rctx->subreq;
  126. int bsize = crypto_skcipher_blocksize(tfm);
  127. unsigned int nbytes = req->cryptlen;
  128. unsigned int offset;
  129. skcipher_request_set_tfm(subreq, ctx->child);
  130. if (nbytes < bsize)
  131. return -EINVAL;
  132. if (nbytes == bsize) {
  133. skcipher_request_set_callback(subreq, req->base.flags,
  134. req->base.complete,
  135. req->base.data);
  136. skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes,
  137. req->iv);
  138. return crypto_skcipher_encrypt(subreq);
  139. }
  140. offset = rounddown(nbytes - 1, bsize);
  141. rctx->offset = offset;
  142. skcipher_request_set_callback(subreq, req->base.flags,
  143. crypto_cts_encrypt_done, req);
  144. skcipher_request_set_crypt(subreq, req->src, req->dst,
  145. offset, req->iv);
  146. return crypto_skcipher_encrypt(subreq) ?:
  147. cts_cbc_encrypt(req);
  148. }
  149. static int cts_cbc_decrypt(struct skcipher_request *req)
  150. {
  151. struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
  152. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  153. struct skcipher_request *subreq = &rctx->subreq;
  154. int bsize = crypto_skcipher_blocksize(tfm);
  155. u8 d[MAX_CIPHER_BLOCKSIZE * 2] __aligned(__alignof__(u32));
  156. struct scatterlist *sg;
  157. unsigned int offset;
  158. u8 *space;
  159. int lastn;
  160. offset = rctx->offset;
  161. lastn = req->cryptlen - offset;
  162. sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize);
  163. /* 1. Decrypt Cn-1 (s) to create Dn */
  164. scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0);
  165. space = crypto_cts_reqctx_space(req);
  166. crypto_xor(d + bsize, space, bsize);
  167. /* 2. Pad Cn with zeros at the end to create C of length BB */
  168. memset(d, 0, bsize);
  169. scatterwalk_map_and_copy(d, req->src, offset, lastn, 0);
  170. /* 3. Exclusive-or Dn with C to create Xn */
  171. /* 4. Select the first Ln bytes of Xn to create Pn */
  172. crypto_xor(d + bsize, d, lastn);
  173. /* 5. Append the tail (BB - Ln) bytes of Xn to Cn to create En */
  174. memcpy(d + lastn, d + bsize + lastn, bsize - lastn);
  175. /* 6. Decrypt En to create Pn-1 */
  176. scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1);
  177. memzero_explicit(d, sizeof(d));
  178. skcipher_request_set_callback(subreq, req->base.flags &
  179. CRYPTO_TFM_REQ_MAY_BACKLOG,
  180. cts_cbc_crypt_done, req);
  181. skcipher_request_set_crypt(subreq, sg, sg, bsize, space);
  182. return crypto_skcipher_decrypt(subreq);
  183. }
  184. static void crypto_cts_decrypt_done(struct crypto_async_request *areq, int err)
  185. {
  186. struct skcipher_request *req = areq->data;
  187. if (err)
  188. goto out;
  189. err = cts_cbc_decrypt(req);
  190. if (err == -EINPROGRESS || err == -EBUSY)
  191. return;
  192. out:
  193. skcipher_request_complete(req, err);
  194. }
  195. static int crypto_cts_decrypt(struct skcipher_request *req)
  196. {
  197. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  198. struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
  199. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
  200. struct skcipher_request *subreq = &rctx->subreq;
  201. int bsize = crypto_skcipher_blocksize(tfm);
  202. unsigned int nbytes = req->cryptlen;
  203. unsigned int offset;
  204. u8 *space;
  205. skcipher_request_set_tfm(subreq, ctx->child);
  206. if (nbytes < bsize)
  207. return -EINVAL;
  208. if (nbytes == bsize) {
  209. skcipher_request_set_callback(subreq, req->base.flags,
  210. req->base.complete,
  211. req->base.data);
  212. skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes,
  213. req->iv);
  214. return crypto_skcipher_decrypt(subreq);
  215. }
  216. skcipher_request_set_callback(subreq, req->base.flags,
  217. crypto_cts_decrypt_done, req);
  218. space = crypto_cts_reqctx_space(req);
  219. offset = rounddown(nbytes - 1, bsize);
  220. rctx->offset = offset;
  221. if (offset <= bsize)
  222. memcpy(space, req->iv, bsize);
  223. else
  224. scatterwalk_map_and_copy(space, req->src, offset - 2 * bsize,
  225. bsize, 0);
  226. skcipher_request_set_crypt(subreq, req->src, req->dst,
  227. offset, req->iv);
  228. return crypto_skcipher_decrypt(subreq) ?:
  229. cts_cbc_decrypt(req);
  230. }
  231. static int crypto_cts_init_tfm(struct crypto_skcipher *tfm)
  232. {
  233. struct skcipher_instance *inst = skcipher_alg_instance(tfm);
  234. struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst);
  235. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
  236. struct crypto_skcipher *cipher;
  237. unsigned reqsize;
  238. unsigned bsize;
  239. unsigned align;
  240. cipher = crypto_spawn_skcipher(spawn);
  241. if (IS_ERR(cipher))
  242. return PTR_ERR(cipher);
  243. ctx->child = cipher;
  244. align = crypto_skcipher_alignmask(tfm);
  245. bsize = crypto_skcipher_blocksize(cipher);
  246. reqsize = ALIGN(sizeof(struct crypto_cts_reqctx) +
  247. crypto_skcipher_reqsize(cipher),
  248. crypto_tfm_ctx_alignment()) +
  249. (align & ~(crypto_tfm_ctx_alignment() - 1)) + bsize;
  250. crypto_skcipher_set_reqsize(tfm, reqsize);
  251. return 0;
  252. }
  253. static void crypto_cts_exit_tfm(struct crypto_skcipher *tfm)
  254. {
  255. struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
  256. crypto_free_skcipher(ctx->child);
  257. }
  258. static void crypto_cts_free(struct skcipher_instance *inst)
  259. {
  260. crypto_drop_skcipher(skcipher_instance_ctx(inst));
  261. kfree(inst);
  262. }
  263. static int crypto_cts_create(struct crypto_template *tmpl, struct rtattr **tb)
  264. {
  265. struct crypto_skcipher_spawn *spawn;
  266. struct skcipher_instance *inst;
  267. struct skcipher_alg *alg;
  268. u32 mask;
  269. int err;
  270. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SKCIPHER, &mask);
  271. if (err)
  272. return err;
  273. inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
  274. if (!inst)
  275. return -ENOMEM;
  276. spawn = skcipher_instance_ctx(inst);
  277. err = crypto_grab_skcipher(spawn, skcipher_crypto_instance(inst),
  278. crypto_attr_alg_name(tb[1]), 0, mask);
  279. if (err)
  280. goto err_free_inst;
  281. alg = crypto_spawn_skcipher_alg(spawn);
  282. err = -EINVAL;
  283. if (crypto_skcipher_alg_ivsize(alg) != alg->base.cra_blocksize)
  284. goto err_free_inst;
  285. if (strncmp(alg->base.cra_name, "cbc(", 4))
  286. goto err_free_inst;
  287. err = crypto_inst_setname(skcipher_crypto_instance(inst), "cts",
  288. &alg->base);
  289. if (err)
  290. goto err_free_inst;
  291. inst->alg.base.cra_priority = alg->base.cra_priority;
  292. inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
  293. inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
  294. inst->alg.ivsize = alg->base.cra_blocksize;
  295. inst->alg.chunksize = crypto_skcipher_alg_chunksize(alg);
  296. inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg);
  297. inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg);
  298. inst->alg.base.cra_ctxsize = sizeof(struct crypto_cts_ctx);
  299. inst->alg.init = crypto_cts_init_tfm;
  300. inst->alg.exit = crypto_cts_exit_tfm;
  301. inst->alg.setkey = crypto_cts_setkey;
  302. inst->alg.encrypt = crypto_cts_encrypt;
  303. inst->alg.decrypt = crypto_cts_decrypt;
  304. inst->free = crypto_cts_free;
  305. err = skcipher_register_instance(tmpl, inst);
  306. if (err) {
  307. err_free_inst:
  308. crypto_cts_free(inst);
  309. }
  310. return err;
  311. }
  312. static struct crypto_template crypto_cts_tmpl = {
  313. .name = "cts",
  314. .create = crypto_cts_create,
  315. .module = THIS_MODULE,
  316. };
  317. static int __init crypto_cts_module_init(void)
  318. {
  319. return crypto_register_template(&crypto_cts_tmpl);
  320. }
  321. static void __exit crypto_cts_module_exit(void)
  322. {
  323. crypto_unregister_template(&crypto_cts_tmpl);
  324. }
  325. subsys_initcall(crypto_cts_module_init);
  326. module_exit(crypto_cts_module_exit);
  327. MODULE_LICENSE("Dual BSD/GPL");
  328. MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC");
  329. MODULE_ALIAS_CRYPTO("cts");