echainiv.c 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * echainiv: Encrypted Chain IV Generator
  4. *
  5. * This generator generates an IV based on a sequence number by multiplying
  6. * it with a salt and then encrypting it with the same key as used to encrypt
  7. * the plain text. This algorithm requires that the block size be equal
  8. * to the IV size. It is mainly useful for CBC.
  9. *
  10. * This generator can only be used by algorithms where authentication
  11. * is performed after encryption (i.e., authenc).
  12. *
  13. * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
  14. */
  15. #include <crypto/internal/geniv.h>
  16. #include <crypto/scatterwalk.h>
  17. #include <crypto/skcipher.h>
  18. #include <linux/err.h>
  19. #include <linux/init.h>
  20. #include <linux/kernel.h>
  21. #include <linux/module.h>
  22. #include <linux/slab.h>
  23. #include <linux/string.h>
  24. static int echainiv_encrypt(struct aead_request *req)
  25. {
  26. struct crypto_aead *geniv = crypto_aead_reqtfm(req);
  27. struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
  28. struct aead_request *subreq = aead_request_ctx(req);
  29. __be64 nseqno;
  30. u64 seqno;
  31. u8 *info;
  32. unsigned int ivsize = crypto_aead_ivsize(geniv);
  33. int err;
  34. if (req->cryptlen < ivsize)
  35. return -EINVAL;
  36. aead_request_set_tfm(subreq, ctx->child);
  37. info = req->iv;
  38. if (req->src != req->dst) {
  39. SYNC_SKCIPHER_REQUEST_ON_STACK(nreq, ctx->sknull);
  40. skcipher_request_set_sync_tfm(nreq, ctx->sknull);
  41. skcipher_request_set_callback(nreq, req->base.flags,
  42. NULL, NULL);
  43. skcipher_request_set_crypt(nreq, req->src, req->dst,
  44. req->assoclen + req->cryptlen,
  45. NULL);
  46. err = crypto_skcipher_encrypt(nreq);
  47. if (err)
  48. return err;
  49. }
  50. aead_request_set_callback(subreq, req->base.flags,
  51. req->base.complete, req->base.data);
  52. aead_request_set_crypt(subreq, req->dst, req->dst,
  53. req->cryptlen, info);
  54. aead_request_set_ad(subreq, req->assoclen);
  55. memcpy(&nseqno, info + ivsize - 8, 8);
  56. seqno = be64_to_cpu(nseqno);
  57. memset(info, 0, ivsize);
  58. scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
  59. do {
  60. u64 a;
  61. memcpy(&a, ctx->salt + ivsize - 8, 8);
  62. a |= 1;
  63. a *= seqno;
  64. memcpy(info + ivsize - 8, &a, 8);
  65. } while ((ivsize -= 8));
  66. return crypto_aead_encrypt(subreq);
  67. }
  68. static int echainiv_decrypt(struct aead_request *req)
  69. {
  70. struct crypto_aead *geniv = crypto_aead_reqtfm(req);
  71. struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
  72. struct aead_request *subreq = aead_request_ctx(req);
  73. crypto_completion_t compl;
  74. void *data;
  75. unsigned int ivsize = crypto_aead_ivsize(geniv);
  76. if (req->cryptlen < ivsize)
  77. return -EINVAL;
  78. aead_request_set_tfm(subreq, ctx->child);
  79. compl = req->base.complete;
  80. data = req->base.data;
  81. aead_request_set_callback(subreq, req->base.flags, compl, data);
  82. aead_request_set_crypt(subreq, req->src, req->dst,
  83. req->cryptlen - ivsize, req->iv);
  84. aead_request_set_ad(subreq, req->assoclen + ivsize);
  85. scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
  86. return crypto_aead_decrypt(subreq);
  87. }
  88. static int echainiv_aead_create(struct crypto_template *tmpl,
  89. struct rtattr **tb)
  90. {
  91. struct aead_instance *inst;
  92. int err;
  93. inst = aead_geniv_alloc(tmpl, tb);
  94. if (IS_ERR(inst))
  95. return PTR_ERR(inst);
  96. err = -EINVAL;
  97. if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize)
  98. goto free_inst;
  99. inst->alg.encrypt = echainiv_encrypt;
  100. inst->alg.decrypt = echainiv_decrypt;
  101. inst->alg.init = aead_init_geniv;
  102. inst->alg.exit = aead_exit_geniv;
  103. inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
  104. inst->alg.base.cra_ctxsize += inst->alg.ivsize;
  105. err = aead_register_instance(tmpl, inst);
  106. if (err) {
  107. free_inst:
  108. inst->free(inst);
  109. }
  110. return err;
  111. }
  112. static struct crypto_template echainiv_tmpl = {
  113. .name = "echainiv",
  114. .create = echainiv_aead_create,
  115. .module = THIS_MODULE,
  116. };
  117. static int __init echainiv_module_init(void)
  118. {
  119. return crypto_register_template(&echainiv_tmpl);
  120. }
  121. static void __exit echainiv_module_exit(void)
  122. {
  123. crypto_unregister_template(&echainiv_tmpl);
  124. }
  125. subsys_initcall(echainiv_module_init);
  126. module_exit(echainiv_module_exit);
  127. MODULE_LICENSE("GPL");
  128. MODULE_DESCRIPTION("Encrypted Chain IV Generator");
  129. MODULE_ALIAS_CRYPTO("echainiv");