ghash-generic.c 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * GHASH: hash function for GCM (Galois/Counter Mode).
  4. *
  5. * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
  6. * Copyright (c) 2009 Intel Corp.
  7. * Author: Huang Ying <ying.huang@intel.com>
  8. */
  9. /*
  10. * GHASH is a keyed hash function used in GCM authentication tag generation.
  11. *
  12. * The original GCM paper [1] presents GHASH as a function GHASH(H, A, C) which
  13. * takes a 16-byte hash key H, additional authenticated data A, and a ciphertext
  14. * C. It formats A and C into a single byte string X, interprets X as a
  15. * polynomial over GF(2^128), and evaluates this polynomial at the point H.
  16. *
  17. * However, the NIST standard for GCM [2] presents GHASH as GHASH(H, X) where X
  18. * is the already-formatted byte string containing both A and C.
  19. *
  20. * "ghash" in the Linux crypto API uses the 'X' (pre-formatted) convention,
  21. * since the API supports only a single data stream per hash. Thus, the
  22. * formatting of 'A' and 'C' is done in the "gcm" template, not in "ghash".
  23. *
  24. * The reason "ghash" is separate from "gcm" is to allow "gcm" to use an
  25. * accelerated "ghash" when a standalone accelerated "gcm(aes)" is unavailable.
  26. * It is generally inappropriate to use "ghash" for other purposes, since it is
  27. * an "ε-almost-XOR-universal hash function", not a cryptographic hash function.
  28. * It can only be used securely in crypto modes specially designed to use it.
  29. *
  30. * [1] The Galois/Counter Mode of Operation (GCM)
  31. * (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.694.695&rep=rep1&type=pdf)
  32. * [2] Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC
  33. * (https://csrc.nist.gov/publications/detail/sp/800-38d/final)
  34. */
  35. #include <crypto/algapi.h>
  36. #include <crypto/gf128mul.h>
  37. #include <crypto/ghash.h>
  38. #include <crypto/internal/hash.h>
  39. #include <linux/crypto.h>
  40. #include <linux/init.h>
  41. #include <linux/kernel.h>
  42. #include <linux/module.h>
  43. static int ghash_init(struct shash_desc *desc)
  44. {
  45. struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
  46. memset(dctx, 0, sizeof(*dctx));
  47. return 0;
  48. }
  49. static int ghash_setkey(struct crypto_shash *tfm,
  50. const u8 *key, unsigned int keylen)
  51. {
  52. struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
  53. be128 k;
  54. if (keylen != GHASH_BLOCK_SIZE)
  55. return -EINVAL;
  56. if (ctx->gf128)
  57. gf128mul_free_4k(ctx->gf128);
  58. BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
  59. memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
  60. ctx->gf128 = gf128mul_init_4k_lle(&k);
  61. memzero_explicit(&k, GHASH_BLOCK_SIZE);
  62. if (!ctx->gf128)
  63. return -ENOMEM;
  64. return 0;
  65. }
  66. static int ghash_update(struct shash_desc *desc,
  67. const u8 *src, unsigned int srclen)
  68. {
  69. struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
  70. struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
  71. u8 *dst = dctx->buffer;
  72. if (dctx->bytes) {
  73. int n = min(srclen, dctx->bytes);
  74. u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
  75. dctx->bytes -= n;
  76. srclen -= n;
  77. while (n--)
  78. *pos++ ^= *src++;
  79. if (!dctx->bytes)
  80. gf128mul_4k_lle((be128 *)dst, ctx->gf128);
  81. }
  82. while (srclen >= GHASH_BLOCK_SIZE) {
  83. crypto_xor(dst, src, GHASH_BLOCK_SIZE);
  84. gf128mul_4k_lle((be128 *)dst, ctx->gf128);
  85. src += GHASH_BLOCK_SIZE;
  86. srclen -= GHASH_BLOCK_SIZE;
  87. }
  88. if (srclen) {
  89. dctx->bytes = GHASH_BLOCK_SIZE - srclen;
  90. while (srclen--)
  91. *dst++ ^= *src++;
  92. }
  93. return 0;
  94. }
  95. static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
  96. {
  97. u8 *dst = dctx->buffer;
  98. if (dctx->bytes) {
  99. u8 *tmp = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
  100. while (dctx->bytes--)
  101. *tmp++ ^= 0;
  102. gf128mul_4k_lle((be128 *)dst, ctx->gf128);
  103. }
  104. dctx->bytes = 0;
  105. }
  106. static int ghash_final(struct shash_desc *desc, u8 *dst)
  107. {
  108. struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
  109. struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
  110. u8 *buf = dctx->buffer;
  111. ghash_flush(ctx, dctx);
  112. memcpy(dst, buf, GHASH_BLOCK_SIZE);
  113. return 0;
  114. }
  115. static void ghash_exit_tfm(struct crypto_tfm *tfm)
  116. {
  117. struct ghash_ctx *ctx = crypto_tfm_ctx(tfm);
  118. if (ctx->gf128)
  119. gf128mul_free_4k(ctx->gf128);
  120. }
  121. static struct shash_alg ghash_alg = {
  122. .digestsize = GHASH_DIGEST_SIZE,
  123. .init = ghash_init,
  124. .update = ghash_update,
  125. .final = ghash_final,
  126. .setkey = ghash_setkey,
  127. .descsize = sizeof(struct ghash_desc_ctx),
  128. .base = {
  129. .cra_name = "ghash",
  130. .cra_driver_name = "ghash-generic",
  131. .cra_priority = 100,
  132. .cra_blocksize = GHASH_BLOCK_SIZE,
  133. .cra_ctxsize = sizeof(struct ghash_ctx),
  134. .cra_module = THIS_MODULE,
  135. .cra_exit = ghash_exit_tfm,
  136. },
  137. };
  138. static int __init ghash_mod_init(void)
  139. {
  140. return crypto_register_shash(&ghash_alg);
  141. }
  142. static void __exit ghash_mod_exit(void)
  143. {
  144. crypto_unregister_shash(&ghash_alg);
  145. }
  146. subsys_initcall(ghash_mod_init);
  147. module_exit(ghash_mod_exit);
  148. MODULE_LICENSE("GPL");
  149. MODULE_DESCRIPTION("GHASH hash function");
  150. MODULE_ALIAS_CRYPTO("ghash");
  151. MODULE_ALIAS_CRYPTO("ghash-generic");