lib/crypto/aesgcm.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Minimal library implementation of GCM
   4  *
   5  * Copyright 2022 Google LLC
   6  */
   7
   8 #include <linux/module.h>
   9
  10 #include <crypto/algapi.h>
  11 #include <crypto/gcm.h>
  12 #include <crypto/ghash.h>
  13
  14 #include <asm/irqflags.h>
  15
  16 static void aesgcm_encrypt_block(const struct crypto_aes_ctx *ctx, void *dst,
  17                                  const void *src)
  18 {
  19         unsigned long flags;
  20
  21         /*
  22          * In AES-GCM, both the GHASH key derivation and the CTR mode
  23          * encryption operate on known plaintext, making them susceptible to
  24          * timing attacks on the encryption key. The AES library already
  25          * mitigates this risk to some extent by pulling the entire S-box into
  26          * the caches before doing any substitutions, but this strategy is more
  27          * effective when running with interrupts disabled.
  28          */
  29         local_irq_save(flags);
  30         aes_encrypt(ctx, dst, src);
  31         local_irq_restore(flags);
  32 }
  33
  34 /**
  35  * aesgcm_expandkey - Expands the AES and GHASH keys for the AES-GCM key
  36  *                    schedule
  37  *
  38  * @ctx:        The data structure that will hold the AES-GCM key schedule
  39  * @key:        The AES encryption input key
  40  * @keysize:    The length in bytes of the input key
  41  * @authsize:   The size in bytes of the GCM authentication tag
  42  *
  43  * Returns: 0 on success, or -EINVAL if @keysize or @authsize contain values
  44  * that are not permitted by the GCM specification.
  45  */
  46 int aesgcm_expandkey(struct aesgcm_ctx *ctx, const u8 *key,
  47                      unsigned int keysize, unsigned int authsize)
  48 {
  49         u8 kin[AES_BLOCK_SIZE] = {};
  50         int ret;
  51
  52         ret = crypto_gcm_check_authsize(authsize) ?:
  53               aes_expandkey(&ctx->aes_ctx, key, keysize);
  54         if (ret)
  55                 return ret;
  56
  57         ctx->authsize = authsize;
  58         aesgcm_encrypt_block(&ctx->aes_ctx, &ctx->ghash_key, kin);
  59
  60         return 0;
  61 }
  62 EXPORT_SYMBOL(aesgcm_expandkey);
  63
  64 static void aesgcm_ghash(be128 *ghash, const be128 *key, const void *src,
  65                          int len)
  66 {
  67         while (len > 0) {
  68                 crypto_xor((u8 *)ghash, src, min(len, GHASH_BLOCK_SIZE));
  69                 gf128mul_lle(ghash, key);
  70
  71                 src += GHASH_BLOCK_SIZE;
  72                 len -= GHASH_BLOCK_SIZE;
  73         }
  74 }
  75
  76 /**
  77  * aesgcm_mac - Generates the authentication tag using AES-GCM algorithm.
  78  * @ctx: The data structure that will hold the AES-GCM key schedule
  79  * @src: The input source data.
  80  * @src_len: Length of the source data.
  81  * @assoc: Points to the associated data.
  82  * @assoc_len: Length of the associated data values.
  83  * @ctr: Points to the counter value.
  84  * @authtag: The output buffer for the authentication tag.
  85  *
  86  * It takes in the AES-GCM context, source data, associated data, counter value,
  87  * and an output buffer for the authentication tag.
  88  */
  89 static void aesgcm_mac(const struct aesgcm_ctx *ctx, const u8 *src, int src_len,
  90                        const u8 *assoc, int assoc_len, __be32 *ctr, u8 *authtag)
  91 {
  92         be128 tail = { cpu_to_be64(assoc_len * 8), cpu_to_be64(src_len * 8) };
  93         u8 buf[AES_BLOCK_SIZE];
  94         be128 ghash = {};
  95
  96         aesgcm_ghash(&ghash, &ctx->ghash_key, assoc, assoc_len);
  97         aesgcm_ghash(&ghash, &ctx->ghash_key, src, src_len);
  98         aesgcm_ghash(&ghash, &ctx->ghash_key, &tail, sizeof(tail));
  99
 100         ctr[3] = cpu_to_be32(1);
 101         aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr);
 102         crypto_xor_cpy(authtag, buf, (u8 *)&ghash, ctx->authsize);
 103
 104         memzero_explicit(&ghash, sizeof(ghash));
 105         memzero_explicit(buf, sizeof(buf));
 106 }
 107
 108 static void aesgcm_crypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src,
 109                          int len, __be32 *ctr)
 110 {
 111         u8 buf[AES_BLOCK_SIZE];
 112         unsigned int n = 2;
 113
 114         while (len > 0) {
 115                 /*
 116                  * The counter increment below must not result in overflow or
 117                  * carry into the next 32-bit word, as this could result in
 118                  * inadvertent IV reuse, which must be avoided at all cost for
 119                  * stream ciphers such as AES-CTR. Given the range of 'int
 120                  * len', this cannot happen, so no explicit test is necessary.
 121                  */
 122                 ctr[3] = cpu_to_be32(n++);
 123                 aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr);
 124                 crypto_xor_cpy(dst, src, buf, min(len, AES_BLOCK_SIZE));
 125
 126                 dst += AES_BLOCK_SIZE;
 127                 src += AES_BLOCK_SIZE;
 128                 len -= AES_BLOCK_SIZE;
 129         }
 130         memzero_explicit(buf, sizeof(buf));
 131 }
 132
 133 /**
 134  * aesgcm_encrypt - Perform AES-GCM encryption on a block of data
 135  *
 136  * @ctx:        The AES-GCM key schedule
 137  * @dst:        Pointer to the ciphertext output buffer
 138  * @src:        Pointer the plaintext (may equal @dst for encryption in place)
 139  * @crypt_len:  The size in bytes of the plaintext and ciphertext.
 140  * @assoc:      Pointer to the associated data,
 141  * @assoc_len:  The size in bytes of the associated data
 142  * @iv:         The initialization vector (IV) to use for this block of data
 143  *              (must be 12 bytes in size as per the GCM spec recommendation)
 144  * @authtag:    The address of the buffer in memory where the authentication
 145  *              tag should be stored. The buffer is assumed to have space for
 146  *              @ctx->authsize bytes.
 147  */
 148 void aesgcm_encrypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src,
 149                     int crypt_len, const u8 *assoc, int assoc_len,
 150                     const u8 iv[GCM_AES_IV_SIZE], u8 *authtag)
 151 {
 152         __be32 ctr[4];
 153
 154         memcpy(ctr, iv, GCM_AES_IV_SIZE);
 155
 156         aesgcm_crypt(ctx, dst, src, crypt_len, ctr);
 157         aesgcm_mac(ctx, dst, crypt_len, assoc, assoc_len, ctr, authtag);
 158 }
 159 EXPORT_SYMBOL(aesgcm_encrypt);
 160
 161 /**
 162  * aesgcm_decrypt - Perform AES-GCM decryption on a block of data
 163  *
 164  * @ctx:        The AES-GCM key schedule
 165  * @dst:        Pointer to the plaintext output buffer
 166  * @src:        Pointer the ciphertext (may equal @dst for decryption in place)
 167  * @crypt_len:  The size in bytes of the plaintext and ciphertext.
 168  * @assoc:      Pointer to the associated data,
 169  * @assoc_len:  The size in bytes of the associated data
 170  * @iv:         The initialization vector (IV) to use for this block of data
 171  *              (must be 12 bytes in size as per the GCM spec recommendation)
 172  * @authtag:    The address of the buffer in memory where the authentication
 173  *              tag is stored.
 174  *
 175  * Returns: true on success, or false if the ciphertext failed authentication.
 176  * On failure, no plaintext will be returned.
 177  */
 178 bool __must_check aesgcm_decrypt(const struct aesgcm_ctx *ctx, u8 *dst,
 179                                  const u8 *src, int crypt_len, const u8 *assoc,
 180                                  int assoc_len, const u8 iv[GCM_AES_IV_SIZE],
 181                                  const u8 *authtag)
 182 {
 183         u8 tagbuf[AES_BLOCK_SIZE];
 184         __be32 ctr[4];
 185
 186         memcpy(ctr, iv, GCM_AES_IV_SIZE);
 187
 188         aesgcm_mac(ctx, src, crypt_len, assoc, assoc_len, ctr, tagbuf);
 189         if (crypto_memneq(authtag, tagbuf, ctx->authsize)) {
 190                 memzero_explicit(tagbuf, sizeof(tagbuf));
 191                 return false;
 192         }
 193         aesgcm_crypt(ctx, dst, src, crypt_len, ctr);
 194         return true;
 195 }
 196 EXPORT_SYMBOL(aesgcm_decrypt);
 197
 198 MODULE_DESCRIPTION("Generic AES-GCM library");
 199 MODULE_AUTHOR("Ard Biesheuvel <ardb@kernel.org>");
 200 MODULE_LICENSE("GPL");
 201
 202 #ifndef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
 203
 204 /*
 205  * Test code below. Vectors taken from crypto/testmgr.h
 206  */
 207
 208 static const u8 __initconst ctext0[16] =
 209         "\x58\xe2\xfc\xce\xfa\x7e\x30\x61"
 210         "\x36\x7f\x1d\x57\xa4\xe7\x45\x5a";
 211
 212 static const u8 __initconst ptext1[16];
 213
 214 static const u8 __initconst ctext1[32] =
 215         "\x03\x88\xda\xce\x60\xb6\xa3\x92"
 216         "\xf3\x28\xc2\xb9\x71\xb2\xfe\x78"
 217         "\xab\x6e\x47\xd4\x2c\xec\x13\xbd"
 218         "\xf5\x3a\x67\xb2\x12\x57\xbd\xdf";
 219
 220 static const u8 __initconst ptext2[64] =
 221         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 222         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 223         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 224         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 225         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 226         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 227         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 228         "\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
 229
 230 static const u8 __initconst ctext2[80] =
 231         "\x42\x83\x1e\xc2\x21\x77\x74\x24"
 232         "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
 233         "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
 234         "\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
 235         "\x21\xd5\x14\xb2\x54\x66\x93\x1c"
 236         "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
 237         "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
 238         "\x3d\x58\xe0\x91\x47\x3f\x59\x85"
 239         "\x4d\x5c\x2a\xf3\x27\xcd\x64\xa6"
 240         "\x2c\xf3\x5a\xbd\x2b\xa6\xfa\xb4";
 241
 242 static const u8 __initconst ptext3[60] =
 243         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 244         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 245         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 246         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 247         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 248         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 249         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 250         "\xba\x63\x7b\x39";
 251
 252 static const u8 __initconst ctext3[76] =
 253         "\x42\x83\x1e\xc2\x21\x77\x74\x24"
 254         "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
 255         "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
 256         "\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
 257         "\x21\xd5\x14\xb2\x54\x66\x93\x1c"
 258         "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
 259         "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
 260         "\x3d\x58\xe0\x91"
 261         "\x5b\xc9\x4f\xbc\x32\x21\xa5\xdb"
 262         "\x94\xfa\xe9\x5a\xe7\x12\x1a\x47";
 263
 264 static const u8 __initconst ctext4[16] =
 265         "\xcd\x33\xb2\x8a\xc7\x73\xf7\x4b"
 266         "\xa0\x0e\xd1\xf3\x12\x57\x24\x35";
 267
 268 static const u8 __initconst ctext5[32] =
 269         "\x98\xe7\x24\x7c\x07\xf0\xfe\x41"
 270         "\x1c\x26\x7e\x43\x84\xb0\xf6\x00"
 271         "\x2f\xf5\x8d\x80\x03\x39\x27\xab"
 272         "\x8e\xf4\xd4\x58\x75\x14\xf0\xfb";
 273
 274 static const u8 __initconst ptext6[64] =
 275         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 276         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 277         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 278         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 279         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 280         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 281         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 282         "\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
 283
 284 static const u8 __initconst ctext6[80] =
 285         "\x39\x80\xca\x0b\x3c\x00\xe8\x41"
 286         "\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
 287         "\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
 288         "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
 289         "\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
 290         "\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
 291         "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
 292         "\xcc\xda\x27\x10\xac\xad\xe2\x56"
 293         "\x99\x24\xa7\xc8\x58\x73\x36\xbf"
 294         "\xb1\x18\x02\x4d\xb8\x67\x4a\x14";
 295
 296 static const u8 __initconst ctext7[16] =
 297         "\x53\x0f\x8a\xfb\xc7\x45\x36\xb9"
 298         "\xa9\x63\xb4\xf1\xc4\xcb\x73\x8b";
 299
 300 static const u8 __initconst ctext8[32] =
 301         "\xce\xa7\x40\x3d\x4d\x60\x6b\x6e"
 302         "\x07\x4e\xc5\xd3\xba\xf3\x9d\x18"
 303         "\xd0\xd1\xc8\xa7\x99\x99\x6b\xf0"
 304         "\x26\x5b\x98\xb5\xd4\x8a\xb9\x19";
 305
 306 static const u8 __initconst ptext9[64] =
 307         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 308         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 309         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 310         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 311         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 312         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 313         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 314         "\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
 315
 316 static const u8 __initconst ctext9[80] =
 317         "\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
 318         "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
 319         "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
 320         "\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
 321         "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
 322         "\xa7\xb0\x8b\x10\x56\x82\x88\x38"
 323         "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
 324         "\xbc\xc9\xf6\x62\x89\x80\x15\xad"
 325         "\xb0\x94\xda\xc5\xd9\x34\x71\xbd"
 326         "\xec\x1a\x50\x22\x70\xe3\xcc\x6c";
 327
 328 static const u8 __initconst ptext10[60] =
 329         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 330         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 331         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 332         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 333         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 334         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 335         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 336         "\xba\x63\x7b\x39";
 337
 338 static const u8 __initconst ctext10[76] =
 339         "\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
 340         "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
 341         "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
 342         "\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
 343         "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
 344         "\xa7\xb0\x8b\x10\x56\x82\x88\x38"
 345         "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
 346         "\xbc\xc9\xf6\x62"
 347         "\x76\xfc\x6e\xce\x0f\x4e\x17\x68"
 348         "\xcd\xdf\x88\x53\xbb\x2d\x55\x1b";
 349
 350 static const u8 __initconst ptext11[60] =
 351         "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
 352         "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
 353         "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
 354         "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
 355         "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
 356         "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
 357         "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
 358         "\xba\x63\x7b\x39";
 359
 360 static const u8 __initconst ctext11[76] =
 361         "\x39\x80\xca\x0b\x3c\x00\xe8\x41"
 362         "\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
 363         "\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
 364         "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
 365         "\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
 366         "\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
 367         "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
 368         "\xcc\xda\x27\x10"
 369         "\x25\x19\x49\x8e\x80\xf1\x47\x8f"
 370         "\x37\xba\x55\xbd\x6d\x27\x61\x8c";
 371
 372 static const u8 __initconst ptext12[719] =
 373         "\x42\xc1\xcc\x08\x48\x6f\x41\x3f"
 374         "\x2f\x11\x66\x8b\x2a\x16\xf0\xe0"
 375         "\x58\x83\xf0\xc3\x70\x14\xc0\x5b"
 376         "\x3f\xec\x1d\x25\x3c\x51\xd2\x03"
 377         "\xcf\x59\x74\x1f\xb2\x85\xb4\x07"
 378         "\xc6\x6a\x63\x39\x8a\x5b\xde\xcb"
 379         "\xaf\x08\x44\xbd\x6f\x91\x15\xe1"
 380         "\xf5\x7a\x6e\x18\xbd\xdd\x61\x50"
 381         "\x59\xa9\x97\xab\xbb\x0e\x74\x5c"
 382         "\x00\xa4\x43\x54\x04\x54\x9b\x3b"
 383         "\x77\xec\xfd\x5c\xa6\xe8\x7b\x08"
 384         "\xae\xe6\x10\x3f\x32\x65\xd1\xfc"
 385         "\xa4\x1d\x2c\x31\xfb\x33\x7a\xb3"
 386         "\x35\x23\xf4\x20\x41\xd4\xad\x82"
 387         "\x8b\xa4\xad\x96\x1c\x20\x53\xbe"
 388         "\x0e\xa6\xf4\xdc\x78\x49\x3e\x72"
 389         "\xb1\xa9\xb5\x83\xcb\x08\x54\xb7"
 390         "\xad\x49\x3a\xae\x98\xce\xa6\x66"
 391         "\x10\x30\x90\x8c\x55\x83\xd7\x7c"
 392         "\x8b\xe6\x53\xde\xd2\x6e\x18\x21"
 393         "\x01\x52\xd1\x9f\x9d\xbb\x9c\x73"
 394         "\x57\xcc\x89\x09\x75\x9b\x78\x70"
 395         "\xed\x26\x97\x4d\xb4\xe4\x0c\xa5"
 396         "\xfa\x70\x04\x70\xc6\x96\x1c\x7d"
 397         "\x54\x41\x77\xa8\xe3\xb0\x7e\x96"
 398         "\x82\xd9\xec\xa2\x87\x68\x55\xf9"
 399         "\x8f\x9e\x73\x43\x47\x6a\x08\x36"
 400         "\x93\x67\xa8\x2d\xde\xac\x41\xa9"
 401         "\x5c\x4d\x73\x97\x0f\x70\x68\xfa"
 402         "\x56\x4d\x00\xc2\x3b\x1f\xc8\xb9"
 403         "\x78\x1f\x51\x07\xe3\x9a\x13\x4e"
 404         "\xed\x2b\x2e\xa3\xf7\x44\xb2\xe7"
 405         "\xab\x19\x37\xd9\xba\x76\x5e\xd2"
 406         "\xf2\x53\x15\x17\x4c\x6b\x16\x9f"
 407         "\x02\x66\x49\xca\x7c\x91\x05\xf2"
 408         "\x45\x36\x1e\xf5\x77\xad\x1f\x46"
 409         "\xa8\x13\xfb\x63\xb6\x08\x99\x63"
 410         "\x82\xa2\xed\xb3\xac\xdf\x43\x19"
 411         "\x45\xea\x78\x73\xd9\xb7\x39\x11"
 412         "\xa3\x13\x7c\xf8\x3f\xf7\xad\x81"
 413         "\x48\x2f\xa9\x5c\x5f\xa0\xf0\x79"
 414         "\xa4\x47\x7d\x80\x20\x26\xfd\x63"
 415         "\x0a\xc7\x7e\x6d\x75\x47\xff\x76"
 416         "\x66\x2e\x8a\x6c\x81\x35\xaf\x0b"
 417         "\x2e\x6a\x49\x60\xc1\x10\xe1\xe1"
 418         "\x54\x03\xa4\x09\x0c\x37\x7a\x15"
 419         "\x23\x27\x5b\x8b\x4b\xa5\x64\x97"
 420         "\xae\x4a\x50\x73\x1f\x66\x1c\x5c"
 421         "\x03\x25\x3c\x8d\x48\x58\x71\x34"
 422         "\x0e\xec\x4e\x55\x1a\x03\x6a\xe5"
 423         "\xb6\x19\x2b\x84\x2a\x20\xd1\xea"
 424         "\x80\x6f\x96\x0e\x05\x62\xc7\x78"
 425         "\x87\x79\x60\x38\x46\xb4\x25\x57"
 426         "\x6e\x16\x63\xf8\xad\x6e\xd7\x42"
 427         "\x69\xe1\x88\xef\x6e\xd5\xb4\x9a"
 428         "\x3c\x78\x6c\x3b\xe5\xa0\x1d\x22"
 429         "\x86\x5c\x74\x3a\xeb\x24\x26\xc7"
 430         "\x09\xfc\x91\x96\x47\x87\x4f\x1a"
 431         "\xd6\x6b\x2c\x18\x47\xc0\xb8\x24"
 432         "\xa8\x5a\x4a\x9e\xcb\x03\xe7\x2a"
 433         "\x09\xe6\x4d\x9c\x6d\x86\x60\xf5"
 434         "\x2f\x48\x69\x37\x9f\xf2\xd2\xcb"
 435         "\x0e\x5a\xdd\x6e\x8a\xfb\x6a\xfe"
 436         "\x0b\x63\xde\x87\x42\x79\x8a\x68"
 437         "\x51\x28\x9b\x7a\xeb\xaf\xb8\x2f"
 438         "\x9d\xd1\xc7\x45\x90\x08\xc9\x83"
 439         "\xe9\x83\x84\xcb\x28\x69\x09\x69"
 440         "\xce\x99\x46\x00\x54\xcb\xd8\x38"
 441         "\xf9\x53\x4a\xbf\x31\xce\x57\x15"
 442         "\x33\xfa\x96\x04\x33\x42\xe3\xc0"
 443         "\xb7\x54\x4a\x65\x7a\x7c\x02\xe6"
 444         "\x19\x95\xd0\x0e\x82\x07\x63\xf9"
 445         "\xe1\x2b\x2a\xfc\x55\x92\x52\xc9"
 446         "\xb5\x9f\x23\x28\x60\xe7\x20\x51"
 447         "\x10\xd3\xed\x6d\x9b\xab\xb8\xe2"
 448         "\x5d\x9a\x34\xb3\xbe\x9c\x64\xcb"
 449         "\x78\xc6\x91\x22\x40\x91\x80\xbe"
 450         "\xd7\x78\x5c\x0e\x0a\xdc\x08\xe9"
 451         "\x67\x10\xa4\x83\x98\x79\x23\xe7"
 452         "\x92\xda\xa9\x22\x16\xb1\xe7\x78"
 453         "\xa3\x1c\x6c\x8f\x35\x7c\x4d\x37"
 454         "\x2f\x6e\x0b\x50\x5c\x34\xb9\xf9"
 455         "\xe6\x3d\x91\x0d\x32\x95\xaa\x3d"
 456         "\x48\x11\x06\xbb\x2d\xf2\x63\x88"
 457         "\x3f\x73\x09\xe2\x45\x56\x31\x51"
 458         "\xfa\x5e\x4e\x62\xf7\x90\xf9\xa9"
 459         "\x7d\x7b\x1b\xb1\xc8\x26\x6e\x66"
 460         "\xf6\x90\x9a\x7f\xf2\x57\xcc\x23"
 461         "\x59\xfa\xfa\xaa\x44\x04\x01\xa7"
 462         "\xa4\x78\xdb\x74\x3d\x8b\xb5";
 463
 464 static const u8 __initconst ctext12[735] =
 465         "\x84\x0b\xdb\xd5\xb7\xa8\xfe\x20"
 466         "\xbb\xb1\x12\x7f\x41\xea\xb3\xc0"
 467         "\xa2\xb4\x37\x19\x11\x58\xb6\x0b"
 468         "\x4c\x1d\x38\x05\x54\xd1\x16\x73"
 469         "\x8e\x1c\x20\x90\xa2\x9a\xb7\x74"
 470         "\x47\xe6\xd8\xfc\x18\x3a\xb4\xea"
 471         "\xd5\x16\x5a\x2c\x53\x01\x46\xb3"
 472         "\x18\x33\x74\x6c\x50\xf2\xe8\xc0"
 473         "\x73\xda\x60\x22\xeb\xe3\xe5\x9b"
 474         "\x20\x93\x6c\x4b\x37\x99\xb8\x23"
 475         "\x3b\x4e\xac\xe8\x5b\xe8\x0f\xb7"
 476         "\xc3\x8f\xfb\x4a\x37\xd9\x39\x95"
 477         "\x34\xf1\xdb\x8f\x71\xd9\xc7\x0b"
 478         "\x02\xf1\x63\xfc\x9b\xfc\xc5\xab"
 479         "\xb9\x14\x13\x21\xdf\xce\xaa\x88"
 480         "\x44\x30\x1e\xce\x26\x01\x92\xf8"
 481         "\x9f\x00\x4b\x0c\x4b\xf7\x5f\xe0"
 482         "\x89\xca\x94\x66\x11\x21\x97\xca"
 483         "\x3e\x83\x74\x2d\xdb\x4d\x11\xeb"
 484         "\x97\xc2\x14\xff\x9e\x1e\xa0\x6b"
 485         "\x08\xb4\x31\x2b\x85\xc6\x85\x6c"
 486         "\x90\xec\x39\xc0\xec\xb3\xb5\x4e"
 487         "\xf3\x9c\xe7\x83\x3a\x77\x0a\xf4"
 488         "\x56\xfe\xce\x18\x33\x6d\x0b\x2d"
 489         "\x33\xda\xc8\x05\x5c\xb4\x09\x2a"
 490         "\xde\x6b\x52\x98\x01\xef\x36\x3d"
 491         "\xbd\xf9\x8f\xa8\x3e\xaa\xcd\xd1"
 492         "\x01\x2d\x42\x49\xc3\xb6\x84\xbb"
 493         "\x48\x96\xe0\x90\x93\x6c\x48\x64"
 494         "\xd4\xfa\x7f\x93\x2c\xa6\x21\xc8"
 495         "\x7a\x23\x7b\xaa\x20\x56\x12\xae"
 496         "\x16\x9d\x94\x0f\x54\xa1\xec\xca"
 497         "\x51\x4e\xf2\x39\xf4\xf8\x5f\x04"
 498         "\x5a\x0d\xbf\xf5\x83\xa1\x15\xe1"
 499         "\xf5\x3c\xd8\x62\xa3\xed\x47\x89"
 500         "\x85\x4c\xe5\xdb\xac\x9e\x17\x1d"
 501         "\x0c\x09\xe3\x3e\x39\x5b\x4d\x74"
 502         "\x0e\xf5\x34\xee\x70\x11\x4c\xfd"
 503         "\xdb\x34\xb1\xb5\x10\x3f\x73\xb7"
 504         "\xf5\xfa\xed\xb0\x1f\xa5\xcd\x3c"
 505         "\x8d\x35\x83\xd4\x11\x44\x6e\x6c"
 506         "\x5b\xe0\x0e\x69\xa5\x39\xe5\xbb"
 507         "\xa9\x57\x24\x37\xe6\x1f\xdd\xcf"
 508         "\x16\x2a\x13\xf9\x6a\x2d\x90\xa0"
 509         "\x03\x60\x7a\xed\x69\xd5\x00\x8b"
 510         "\x7e\x4f\xcb\xb9\xfa\x91\xb9\x37"
 511         "\xc1\x26\xce\x90\x97\x22\x64\x64"
 512         "\xc1\x72\x43\x1b\xf6\xac\xc1\x54"
 513         "\x8a\x10\x9c\xdd\x8d\xd5\x8e\xb2"
 514         "\xe4\x85\xda\xe0\x20\x5f\xf4\xb4"
 515         "\x15\xb5\xa0\x8d\x12\x74\x49\x23"
 516         "\x3a\xdf\x4a\xd3\xf0\x3b\x89\xeb"
 517         "\xf8\xcc\x62\x7b\xfb\x93\x07\x41"
 518         "\x61\x26\x94\x58\x70\xa6\x3c\xe4"
 519         "\xff\x58\xc4\x13\x3d\xcb\x36\x6b"
 520         "\x32\xe5\xb2\x6d\x03\x74\x6f\x76"
 521         "\x93\x77\xde\x48\xc4\xfa\x30\x4a"
 522         "\xda\x49\x80\x77\x0f\x1c\xbe\x11"
 523         "\xc8\x48\xb1\xe5\xbb\xf2\x8a\xe1"
 524         "\x96\x2f\x9f\xd1\x8e\x8a\x5c\xe2"
 525         "\xf7\xd7\xd8\x54\xf3\x3f\xc4\x91"
 526         "\xb8\xfb\x86\xdc\x46\x24\x91\x60"
 527         "\x6c\x2f\xc9\x41\x37\x51\x49\x54"
 528         "\x09\x81\x21\xf3\x03\x9f\x2b\xe3"
 529         "\x1f\x39\x63\xaf\xf4\xd7\x53\x60"
 530         "\xa7\xc7\x54\xf9\xee\xb1\xb1\x7d"
 531         "\x75\x54\x65\x93\xfe\xb1\x68\x6b"
 532         "\x57\x02\xf9\xbb\x0e\xf9\xf8\xbf"
 533         "\x01\x12\x27\xb4\xfe\xe4\x79\x7a"
 534         "\x40\x5b\x51\x4b\xdf\x38\xec\xb1"
 535         "\x6a\x56\xff\x35\x4d\x42\x33\xaa"
 536         "\x6f\x1b\xe4\xdc\xe0\xdb\x85\x35"
 537         "\x62\x10\xd4\xec\xeb\xc5\x7e\x45"
 538         "\x1c\x6f\x17\xca\x3b\x8e\x2d\x66"
 539         "\x4f\x4b\x36\x56\xcd\x1b\x59\xaa"
 540         "\xd2\x9b\x17\xb9\x58\xdf\x7b\x64"
 541         "\x8a\xff\x3b\x9c\xa6\xb5\x48\x9e"
 542         "\xaa\xe2\x5d\x09\x71\x32\x5f\xb6"
 543         "\x29\xbe\xe7\xc7\x52\x7e\x91\x82"
 544         "\x6b\x6d\x33\xe1\x34\x06\x36\x21"
 545         "\x5e\xbe\x1e\x2f\x3e\xc1\xfb\xea"
 546         "\x49\x2c\xb5\xca\xf7\xb0\x37\xea"
 547         "\x1f\xed\x10\x04\xd9\x48\x0d\x1a"
 548         "\x1c\xfb\xe7\x84\x0e\x83\x53\x74"
 549         "\xc7\x65\xe2\x5c\xe5\xba\x73\x4c"
 550         "\x0e\xe1\xb5\x11\x45\x61\x43\x46"
 551         "\xaa\x25\x8f\xbd\x85\x08\xfa\x4c"
 552         "\x15\xc1\xc0\xd8\xf5\xdc\x16\xbb"
 553         "\x7b\x1d\xe3\x87\x57\xa7\x2a\x1d"
 554         "\x38\x58\x9e\x8a\x43\xdc\x57"
 555         "\xd1\x81\x7d\x2b\xe9\xff\x99\x3a"
 556         "\x4b\x24\x52\x58\x55\xe1\x49\x14";
 557
 558 static struct {
 559         const u8        *ptext;
 560         const u8        *ctext;
 561
 562         u8              key[AES_MAX_KEY_SIZE];
 563         u8              iv[GCM_AES_IV_SIZE];
 564         u8              assoc[20];
 565
 566         int             klen;
 567         int             clen;
 568         int             plen;
 569         int             alen;
 570 } const aesgcm_tv[] __initconst = {
 571         { /* From McGrew & Viega - http://citeseer.ist.psu.edu/656989.html */
 572                 .klen   = 16,
 573                 .ctext  = ctext0,
 574                 .clen   = sizeof(ctext0),
 575         }, {
 576                 .klen   = 16,
 577                 .ptext  = ptext1,
 578                 .plen   = sizeof(ptext1),
 579                 .ctext  = ctext1,
 580                 .clen   = sizeof(ctext1),
 581         }, {
 582                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 583                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
 584                 .klen   = 16,
 585                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 586                           "\xde\xca\xf8\x88",
 587                 .ptext  = ptext2,
 588                 .plen   = sizeof(ptext2),
 589                 .ctext  = ctext2,
 590                 .clen   = sizeof(ctext2),
 591         }, {
 592                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 593                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
 594                 .klen   = 16,
 595                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 596                           "\xde\xca\xf8\x88",
 597                 .ptext  = ptext3,
 598                 .plen   = sizeof(ptext3),
 599                 .assoc  = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 600                           "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 601                           "\xab\xad\xda\xd2",
 602                 .alen   = 20,
 603                 .ctext  = ctext3,
 604                 .clen   = sizeof(ctext3),
 605         }, {
 606                 .klen   = 24,
 607                 .ctext  = ctext4,
 608                 .clen   = sizeof(ctext4),
 609         }, {
 610                 .klen   = 24,
 611                 .ptext  = ptext1,
 612                 .plen   = sizeof(ptext1),
 613                 .ctext  = ctext5,
 614                 .clen   = sizeof(ctext5),
 615         }, {
 616                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 617                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
 618                           "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
 619                 .klen   = 24,
 620                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 621                           "\xde\xca\xf8\x88",
 622                 .ptext  = ptext6,
 623                 .plen   = sizeof(ptext6),
 624                 .ctext  = ctext6,
 625                 .clen   = sizeof(ctext6),
 626         }, {
 627                 .klen   = 32,
 628                 .ctext  = ctext7,
 629                 .clen   = sizeof(ctext7),
 630         }, {
 631                 .klen   = 32,
 632                 .ptext  = ptext1,
 633                 .plen   = sizeof(ptext1),
 634                 .ctext  = ctext8,
 635                 .clen   = sizeof(ctext8),
 636         }, {
 637                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 638                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
 639                           "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 640                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
 641                 .klen   = 32,
 642                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 643                           "\xde\xca\xf8\x88",
 644                 .ptext  = ptext9,
 645                 .plen   = sizeof(ptext9),
 646                 .ctext  = ctext9,
 647                 .clen   = sizeof(ctext9),
 648         }, {
 649                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 650                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
 651                           "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 652                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
 653                 .klen   = 32,
 654                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 655                           "\xde\xca\xf8\x88",
 656                 .ptext  = ptext10,
 657                 .plen   = sizeof(ptext10),
 658                 .assoc  = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 659                           "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 660                           "\xab\xad\xda\xd2",
 661                 .alen   = 20,
 662                 .ctext  = ctext10,
 663                 .clen   = sizeof(ctext10),
 664         }, {
 665                 .key    = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
 666                           "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
 667                           "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
 668                 .klen   = 24,
 669                 .iv     = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
 670                           "\xde\xca\xf8\x88",
 671                 .ptext  = ptext11,
 672                 .plen   = sizeof(ptext11),
 673                 .assoc  = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 674                           "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
 675                           "\xab\xad\xda\xd2",
 676                 .alen   = 20,
 677                 .ctext  = ctext11,
 678                 .clen   = sizeof(ctext11),
 679         }, {
 680                 .key    = "\x62\x35\xf8\x95\xfc\xa5\xeb\xf6"
 681                           "\x0e\x92\x12\x04\xd3\xa1\x3f\x2e"
 682                           "\x8b\x32\xcf\xe7\x44\xed\x13\x59"
 683                           "\x04\x38\x77\xb0\xb9\xad\xb4\x38",
 684                 .klen   = 32,
 685                 .iv     = "\x00\xff\xff\xff\xff\x00\x00\xff"
 686                           "\xff\xff\x00\xff",
 687                 .ptext  = ptext12,
 688                 .plen   = sizeof(ptext12),
 689                 .ctext  = ctext12,
 690                 .clen   = sizeof(ctext12),
 691         }
 692 };
 693
 694 static int __init libaesgcm_init(void)
 695 {
 696         for (int i = 0; i < ARRAY_SIZE(aesgcm_tv); i++) {
 697                 u8 tagbuf[AES_BLOCK_SIZE];
 698                 int plen = aesgcm_tv[i].plen;
 699                 struct aesgcm_ctx ctx;
 700                 u8 buf[sizeof(ptext12)];
 701
 702                 if (aesgcm_expandkey(&ctx, aesgcm_tv[i].key, aesgcm_tv[i].klen,
 703                                      aesgcm_tv[i].clen - plen)) {
 704                         pr_err("aesgcm_expandkey() failed on vector %d\n", i);
 705                         return -ENODEV;
 706                 }
 707
 708                 if (!aesgcm_decrypt(&ctx, buf, aesgcm_tv[i].ctext, plen,
 709                                     aesgcm_tv[i].assoc, aesgcm_tv[i].alen,
 710                                     aesgcm_tv[i].iv, aesgcm_tv[i].ctext + plen)
 711                     || memcmp(buf, aesgcm_tv[i].ptext, plen)) {
 712                         pr_err("aesgcm_decrypt() #1 failed on vector %d\n", i);
 713                         return -ENODEV;
 714                 }
 715
 716                 /* encrypt in place */
 717                 aesgcm_encrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc,
 718                                aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf);
 719                 if (memcmp(buf, aesgcm_tv[i].ctext, plen)) {
 720                         pr_err("aesgcm_encrypt() failed on vector %d\n", i);
 721                         return -ENODEV;
 722                 }
 723
 724                 /* decrypt in place */
 725                 if (!aesgcm_decrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc,
 726                                     aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf)
 727                     || memcmp(buf, aesgcm_tv[i].ptext, plen)) {
 728                         pr_err("aesgcm_decrypt() #2 failed on vector %d\n", i);
 729                         return -ENODEV;
 730                 }
 731         }
 732         return 0;
 733 }
 734 module_init(libaesgcm_init);
 735
 736 static void __exit libaesgcm_exit(void)
 737 {
 738 }
 739 module_exit(libaesgcm_exit);
 740 #endif