lrw.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* LRW: as defined by Cyril Guyot in
  3. * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf
  4. *
  5. * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org>
  6. *
  7. * Based on ecb.c
  8. * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
  9. */
  10. /* This implementation is checked against the test vectors in the above
  11. * document and by a test vector provided by Ken Buchanan at
  12. * https://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html
  13. *
  14. * The test vectors are included in the testing module tcrypt.[ch] */
  15. #include <crypto/internal/skcipher.h>
  16. #include <crypto/scatterwalk.h>
  17. #include <linux/err.h>
  18. #include <linux/init.h>
  19. #include <linux/kernel.h>
  20. #include <linux/module.h>
  21. #include <linux/scatterlist.h>
  22. #include <linux/slab.h>
  23. #include <crypto/b128ops.h>
  24. #include <crypto/gf128mul.h>
  25. #define LRW_BLOCK_SIZE 16
  26. struct lrw_tfm_ctx {
  27. struct crypto_skcipher *child;
  28. /*
  29. * optimizes multiplying a random (non incrementing, as at the
  30. * start of a new sector) value with key2, we could also have
  31. * used 4k optimization tables or no optimization at all. In the
  32. * latter case we would have to store key2 here
  33. */
  34. struct gf128mul_64k *table;
  35. /*
  36. * stores:
  37. * key2*{ 0,0,...0,0,0,0,1 }, key2*{ 0,0,...0,0,0,1,1 },
  38. * key2*{ 0,0,...0,0,1,1,1 }, key2*{ 0,0,...0,1,1,1,1 }
  39. * key2*{ 0,0,...1,1,1,1,1 }, etc
  40. * needed for optimized multiplication of incrementing values
  41. * with key2
  42. */
  43. be128 mulinc[128];
  44. };
  45. struct lrw_request_ctx {
  46. be128 t;
  47. struct skcipher_request subreq;
  48. };
  49. static inline void lrw_setbit128_bbe(void *b, int bit)
  50. {
  51. __set_bit(bit ^ (0x80 -
  52. #ifdef __BIG_ENDIAN
  53. BITS_PER_LONG
  54. #else
  55. BITS_PER_BYTE
  56. #endif
  57. ), b);
  58. }
  59. static int lrw_setkey(struct crypto_skcipher *parent, const u8 *key,
  60. unsigned int keylen)
  61. {
  62. struct lrw_tfm_ctx *ctx = crypto_skcipher_ctx(parent);
  63. struct crypto_skcipher *child = ctx->child;
  64. int err, bsize = LRW_BLOCK_SIZE;
  65. const u8 *tweak = key + keylen - bsize;
  66. be128 tmp = { 0 };
  67. int i;
  68. crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  69. crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) &
  70. CRYPTO_TFM_REQ_MASK);
  71. err = crypto_skcipher_setkey(child, key, keylen - bsize);
  72. if (err)
  73. return err;
  74. if (ctx->table)
  75. gf128mul_free_64k(ctx->table);
  76. /* initialize multiplication table for Key2 */
  77. ctx->table = gf128mul_init_64k_bbe((be128 *)tweak);
  78. if (!ctx->table)
  79. return -ENOMEM;
  80. /* initialize optimization table */
  81. for (i = 0; i < 128; i++) {
  82. lrw_setbit128_bbe(&tmp, i);
  83. ctx->mulinc[i] = tmp;
  84. gf128mul_64k_bbe(&ctx->mulinc[i], ctx->table);
  85. }
  86. return 0;
  87. }
  88. /*
  89. * Returns the number of trailing '1' bits in the words of the counter, which is
  90. * represented by 4 32-bit words, arranged from least to most significant.
  91. * At the same time, increments the counter by one.
  92. *
  93. * For example:
  94. *
  95. * u32 counter[4] = { 0xFFFFFFFF, 0x1, 0x0, 0x0 };
  96. * int i = lrw_next_index(&counter);
  97. * // i == 33, counter == { 0x0, 0x2, 0x0, 0x0 }
  98. */
  99. static int lrw_next_index(u32 *counter)
  100. {
  101. int i, res = 0;
  102. for (i = 0; i < 4; i++) {
  103. if (counter[i] + 1 != 0)
  104. return res + ffz(counter[i]++);
  105. counter[i] = 0;
  106. res += 32;
  107. }
  108. /*
  109. * If we get here, then x == 128 and we are incrementing the counter
  110. * from all ones to all zeros. This means we must return index 127, i.e.
  111. * the one corresponding to key2*{ 1,...,1 }.
  112. */
  113. return 127;
  114. }
  115. /*
  116. * We compute the tweak masks twice (both before and after the ECB encryption or
  117. * decryption) to avoid having to allocate a temporary buffer and/or make
  118. * mutliple calls to the 'ecb(..)' instance, which usually would be slower than
  119. * just doing the lrw_next_index() calls again.
  120. */
  121. static int lrw_xor_tweak(struct skcipher_request *req, bool second_pass)
  122. {
  123. const int bs = LRW_BLOCK_SIZE;
  124. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  125. const struct lrw_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
  126. struct lrw_request_ctx *rctx = skcipher_request_ctx(req);
  127. be128 t = rctx->t;
  128. struct skcipher_walk w;
  129. __be32 *iv;
  130. u32 counter[4];
  131. int err;
  132. if (second_pass) {
  133. req = &rctx->subreq;
  134. /* set to our TFM to enforce correct alignment: */
  135. skcipher_request_set_tfm(req, tfm);
  136. }
  137. err = skcipher_walk_virt(&w, req, false);
  138. if (err)
  139. return err;
  140. iv = (__be32 *)w.iv;
  141. counter[0] = be32_to_cpu(iv[3]);
  142. counter[1] = be32_to_cpu(iv[2]);
  143. counter[2] = be32_to_cpu(iv[1]);
  144. counter[3] = be32_to_cpu(iv[0]);
  145. while (w.nbytes) {
  146. unsigned int avail = w.nbytes;
  147. be128 *wsrc;
  148. be128 *wdst;
  149. wsrc = w.src.virt.addr;
  150. wdst = w.dst.virt.addr;
  151. do {
  152. be128_xor(wdst++, &t, wsrc++);
  153. /* T <- I*Key2, using the optimization
  154. * discussed in the specification */
  155. be128_xor(&t, &t,
  156. &ctx->mulinc[lrw_next_index(counter)]);
  157. } while ((avail -= bs) >= bs);
  158. if (second_pass && w.nbytes == w.total) {
  159. iv[0] = cpu_to_be32(counter[3]);
  160. iv[1] = cpu_to_be32(counter[2]);
  161. iv[2] = cpu_to_be32(counter[1]);
  162. iv[3] = cpu_to_be32(counter[0]);
  163. }
  164. err = skcipher_walk_done(&w, avail);
  165. }
  166. return err;
  167. }
  168. static int lrw_xor_tweak_pre(struct skcipher_request *req)
  169. {
  170. return lrw_xor_tweak(req, false);
  171. }
  172. static int lrw_xor_tweak_post(struct skcipher_request *req)
  173. {
  174. return lrw_xor_tweak(req, true);
  175. }
  176. static void lrw_crypt_done(struct crypto_async_request *areq, int err)
  177. {
  178. struct skcipher_request *req = areq->data;
  179. if (!err) {
  180. struct lrw_request_ctx *rctx = skcipher_request_ctx(req);
  181. rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
  182. err = lrw_xor_tweak_post(req);
  183. }
  184. skcipher_request_complete(req, err);
  185. }
  186. static void lrw_init_crypt(struct skcipher_request *req)
  187. {
  188. const struct lrw_tfm_ctx *ctx =
  189. crypto_skcipher_ctx(crypto_skcipher_reqtfm(req));
  190. struct lrw_request_ctx *rctx = skcipher_request_ctx(req);
  191. struct skcipher_request *subreq = &rctx->subreq;
  192. skcipher_request_set_tfm(subreq, ctx->child);
  193. skcipher_request_set_callback(subreq, req->base.flags, lrw_crypt_done,
  194. req);
  195. /* pass req->iv as IV (will be used by xor_tweak, ECB will ignore it) */
  196. skcipher_request_set_crypt(subreq, req->dst, req->dst,
  197. req->cryptlen, req->iv);
  198. /* calculate first value of T */
  199. memcpy(&rctx->t, req->iv, sizeof(rctx->t));
  200. /* T <- I*Key2 */
  201. gf128mul_64k_bbe(&rctx->t, ctx->table);
  202. }
  203. static int lrw_encrypt(struct skcipher_request *req)
  204. {
  205. struct lrw_request_ctx *rctx = skcipher_request_ctx(req);
  206. struct skcipher_request *subreq = &rctx->subreq;
  207. lrw_init_crypt(req);
  208. return lrw_xor_tweak_pre(req) ?:
  209. crypto_skcipher_encrypt(subreq) ?:
  210. lrw_xor_tweak_post(req);
  211. }
  212. static int lrw_decrypt(struct skcipher_request *req)
  213. {
  214. struct lrw_request_ctx *rctx = skcipher_request_ctx(req);
  215. struct skcipher_request *subreq = &rctx->subreq;
  216. lrw_init_crypt(req);
  217. return lrw_xor_tweak_pre(req) ?:
  218. crypto_skcipher_decrypt(subreq) ?:
  219. lrw_xor_tweak_post(req);
  220. }
  221. static int lrw_init_tfm(struct crypto_skcipher *tfm)
  222. {
  223. struct skcipher_instance *inst = skcipher_alg_instance(tfm);
  224. struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst);
  225. struct lrw_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
  226. struct crypto_skcipher *cipher;
  227. cipher = crypto_spawn_skcipher(spawn);
  228. if (IS_ERR(cipher))
  229. return PTR_ERR(cipher);
  230. ctx->child = cipher;
  231. crypto_skcipher_set_reqsize(tfm, crypto_skcipher_reqsize(cipher) +
  232. sizeof(struct lrw_request_ctx));
  233. return 0;
  234. }
  235. static void lrw_exit_tfm(struct crypto_skcipher *tfm)
  236. {
  237. struct lrw_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
  238. if (ctx->table)
  239. gf128mul_free_64k(ctx->table);
  240. crypto_free_skcipher(ctx->child);
  241. }
  242. static void lrw_free_instance(struct skcipher_instance *inst)
  243. {
  244. crypto_drop_skcipher(skcipher_instance_ctx(inst));
  245. kfree(inst);
  246. }
  247. static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb)
  248. {
  249. struct crypto_skcipher_spawn *spawn;
  250. struct skcipher_instance *inst;
  251. struct skcipher_alg *alg;
  252. const char *cipher_name;
  253. char ecb_name[CRYPTO_MAX_ALG_NAME];
  254. u32 mask;
  255. int err;
  256. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SKCIPHER, &mask);
  257. if (err)
  258. return err;
  259. cipher_name = crypto_attr_alg_name(tb[1]);
  260. if (IS_ERR(cipher_name))
  261. return PTR_ERR(cipher_name);
  262. inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
  263. if (!inst)
  264. return -ENOMEM;
  265. spawn = skcipher_instance_ctx(inst);
  266. err = crypto_grab_skcipher(spawn, skcipher_crypto_instance(inst),
  267. cipher_name, 0, mask);
  268. if (err == -ENOENT) {
  269. err = -ENAMETOOLONG;
  270. if (snprintf(ecb_name, CRYPTO_MAX_ALG_NAME, "ecb(%s)",
  271. cipher_name) >= CRYPTO_MAX_ALG_NAME)
  272. goto err_free_inst;
  273. err = crypto_grab_skcipher(spawn,
  274. skcipher_crypto_instance(inst),
  275. ecb_name, 0, mask);
  276. }
  277. if (err)
  278. goto err_free_inst;
  279. alg = crypto_skcipher_spawn_alg(spawn);
  280. err = -EINVAL;
  281. if (alg->base.cra_blocksize != LRW_BLOCK_SIZE)
  282. goto err_free_inst;
  283. if (crypto_skcipher_alg_ivsize(alg))
  284. goto err_free_inst;
  285. err = crypto_inst_setname(skcipher_crypto_instance(inst), "lrw",
  286. &alg->base);
  287. if (err)
  288. goto err_free_inst;
  289. err = -EINVAL;
  290. cipher_name = alg->base.cra_name;
  291. /* Alas we screwed up the naming so we have to mangle the
  292. * cipher name.
  293. */
  294. if (!strncmp(cipher_name, "ecb(", 4)) {
  295. unsigned len;
  296. len = strlcpy(ecb_name, cipher_name + 4, sizeof(ecb_name));
  297. if (len < 2 || len >= sizeof(ecb_name))
  298. goto err_free_inst;
  299. if (ecb_name[len - 1] != ')')
  300. goto err_free_inst;
  301. ecb_name[len - 1] = 0;
  302. if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
  303. "lrw(%s)", ecb_name) >= CRYPTO_MAX_ALG_NAME) {
  304. err = -ENAMETOOLONG;
  305. goto err_free_inst;
  306. }
  307. } else
  308. goto err_free_inst;
  309. inst->alg.base.cra_priority = alg->base.cra_priority;
  310. inst->alg.base.cra_blocksize = LRW_BLOCK_SIZE;
  311. inst->alg.base.cra_alignmask = alg->base.cra_alignmask |
  312. (__alignof__(be128) - 1);
  313. inst->alg.ivsize = LRW_BLOCK_SIZE;
  314. inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg) +
  315. LRW_BLOCK_SIZE;
  316. inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg) +
  317. LRW_BLOCK_SIZE;
  318. inst->alg.base.cra_ctxsize = sizeof(struct lrw_tfm_ctx);
  319. inst->alg.init = lrw_init_tfm;
  320. inst->alg.exit = lrw_exit_tfm;
  321. inst->alg.setkey = lrw_setkey;
  322. inst->alg.encrypt = lrw_encrypt;
  323. inst->alg.decrypt = lrw_decrypt;
  324. inst->free = lrw_free_instance;
  325. err = skcipher_register_instance(tmpl, inst);
  326. if (err) {
  327. err_free_inst:
  328. lrw_free_instance(inst);
  329. }
  330. return err;
  331. }
  332. static struct crypto_template lrw_tmpl = {
  333. .name = "lrw",
  334. .create = lrw_create,
  335. .module = THIS_MODULE,
  336. };
  337. static int __init lrw_module_init(void)
  338. {
  339. return crypto_register_template(&lrw_tmpl);
  340. }
  341. static void __exit lrw_module_exit(void)
  342. {
  343. crypto_unregister_template(&lrw_tmpl);
  344. }
  345. subsys_initcall(lrw_module_init);
  346. module_exit(lrw_module_exit);
  347. MODULE_LICENSE("GPL");
  348. MODULE_DESCRIPTION("LRW block cipher mode");
  349. MODULE_ALIAS_CRYPTO("lrw");