crypto/ctr.c

   1 /*
   2  * CTR: Counter mode
   3  *
   4  * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the Free
   8  * Software Foundation; either version 2 of the License, or (at your option)
   9  * any later version.
  10  *
  11  */
  12
  13 #include <crypto/algapi.h>
  14 #include <linux/err.h>
  15 #include <linux/init.h>
  16 #include <linux/kernel.h>
  17 #include <linux/module.h>
  18 #include <linux/random.h>
  19 #include <linux/scatterlist.h>
  20 #include <linux/slab.h>
  21
  22 struct ctr_instance_ctx {
  23         struct crypto_spawn alg;
  24         unsigned int noncesize;
  25         unsigned int ivsize;
  26         unsigned int countersize;
  27 };
  28
  29 struct crypto_ctr_ctx {
  30         struct crypto_cipher *child;
  31         u8 *nonce;
  32 };
  33
  34 static inline void __ctr_inc_byte(u8 *a, unsigned int size)
  35 {
  36         u8 *b = (a + size);
  37         u8 c;
  38
  39         for (; size; size--) {
  40                 c = *--b + 1;
  41                 *b = c;
  42                 if (c)
  43                         break;
  44         }
  45 }
  46
  47 static void ctr_inc_quad(u8 *a, unsigned int size)
  48 {
  49         __be32 *b = (__be32 *)(a + size);
  50         u32 c;
  51
  52         for (; size >= 4; size -=4) {
  53                 c = be32_to_cpu(*--b) + 1;
  54                 *b = cpu_to_be32(c);
  55                 if (c)
  56                         return;
  57         }
  58
  59         __ctr_inc_byte(a, size);
  60 }
  61
  62 static void xor_byte(u8 *a, const u8 *b, unsigned int bs)
  63 {
  64         for (; bs; bs--)
  65                 *a++ ^= *b++;
  66 }
  67
  68 static void xor_quad(u8 *dst, const u8 *src, unsigned int bs)
  69 {
  70         u32 *a = (u32 *)dst;
  71         u32 *b = (u32 *)src;
  72
  73         for (; bs >= 4; bs -= 4)
  74                 *a++ ^= *b++;
  75
  76         xor_byte((u8 *)a, (u8 *)b, bs);
  77 }
  78
  79 static int crypto_ctr_setkey(struct crypto_tfm *parent, const u8 *key,
  80                              unsigned int keylen)
  81 {
  82         struct crypto_ctr_ctx *ctx = crypto_tfm_ctx(parent);
  83         struct crypto_cipher *child = ctx->child;
  84         struct ctr_instance_ctx *ictx =
  85                 crypto_instance_ctx(crypto_tfm_alg_instance(parent));
  86         unsigned int noncelen = ictx->noncesize;
  87         int err = 0;
  88
  89         /* the nonce is stored in bytes at end of key */
  90         if (keylen < noncelen)
  91                 return  -EINVAL;
  92
  93         memcpy(ctx->nonce, key + (keylen - noncelen), noncelen);
  94
  95         keylen -=  noncelen;
  96
  97         crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
  98         crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) &
  99                                 CRYPTO_TFM_REQ_MASK);
 100         err = crypto_cipher_setkey(child, key, keylen);
 101         crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) &
 102                              CRYPTO_TFM_RES_MASK);
 103
 104         return err;
 105 }
 106
 107 static int crypto_ctr_crypt_segment(struct blkcipher_walk *walk,
 108                                     struct crypto_cipher *tfm, u8 *ctrblk,
 109                                     unsigned int countersize)
 110 {
 111         void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
 112                    crypto_cipher_alg(tfm)->cia_encrypt;
 113         unsigned int bsize = crypto_cipher_blocksize(tfm);
 114         unsigned long alignmask = crypto_cipher_alignmask(tfm);
 115         u8 ks[bsize + alignmask];
 116         u8 *keystream = (u8 *)ALIGN((unsigned long)ks, alignmask + 1);
 117         u8 *src = walk->src.virt.addr;
 118         u8 *dst = walk->dst.virt.addr;
 119         unsigned int nbytes = walk->nbytes;
 120
 121         do {
 122                 /* create keystream */
 123                 fn(crypto_cipher_tfm(tfm), keystream, ctrblk);
 124                 xor_quad(keystream, src, min(nbytes, bsize));
 125
 126                 /* copy result into dst */
 127                 memcpy(dst, keystream, min(nbytes, bsize));
 128
 129                 /* increment counter in counterblock */
 130                 ctr_inc_quad(ctrblk + (bsize - countersize), countersize);
 131
 132                 if (nbytes < bsize)
 133                         break;
 134
 135                 src += bsize;
 136                 dst += bsize;
 137                 nbytes -= bsize;
 138
 139         } while (nbytes);
 140
 141         return 0;
 142 }
 143
 144 static int crypto_ctr_crypt_inplace(struct blkcipher_walk *walk,
 145                                     struct crypto_cipher *tfm, u8 *ctrblk,
 146                                     unsigned int countersize)
 147 {
 148         void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
 149                    crypto_cipher_alg(tfm)->cia_encrypt;
 150         unsigned int bsize = crypto_cipher_blocksize(tfm);
 151         unsigned long alignmask = crypto_cipher_alignmask(tfm);
 152         unsigned int nbytes = walk->nbytes;
 153         u8 *src = walk->src.virt.addr;
 154         u8 ks[bsize + alignmask];
 155         u8 *keystream = (u8 *)ALIGN((unsigned long)ks, alignmask + 1);
 156
 157         do {
 158                 /* create keystream */
 159                 fn(crypto_cipher_tfm(tfm), keystream, ctrblk);
 160                 xor_quad(src, keystream, min(nbytes, bsize));
 161
 162                 /* increment counter in counterblock */
 163                 ctr_inc_quad(ctrblk + (bsize - countersize), countersize);
 164
 165                 if (nbytes < bsize)
 166                         break;
 167
 168                 src += bsize;
 169                 nbytes -= bsize;
 170
 171         } while (nbytes);
 172
 173         return 0;
 174 }
 175
 176 static int crypto_ctr_crypt(struct blkcipher_desc *desc,
 177                               struct scatterlist *dst, struct scatterlist *src,
 178                               unsigned int nbytes)
 179 {
 180         struct blkcipher_walk walk;
 181         struct crypto_blkcipher *tfm = desc->tfm;
 182         struct crypto_ctr_ctx *ctx = crypto_blkcipher_ctx(tfm);
 183         struct crypto_cipher *child = ctx->child;
 184         unsigned int bsize = crypto_cipher_blocksize(child);
 185         struct ctr_instance_ctx *ictx =
 186                 crypto_instance_ctx(crypto_tfm_alg_instance(&tfm->base));
 187         unsigned long alignmask = crypto_cipher_alignmask(child);
 188         u8 cblk[bsize + alignmask];
 189         u8 *counterblk = (u8 *)ALIGN((unsigned long)cblk, alignmask + 1);
 190         int err;
 191
 192         blkcipher_walk_init(&walk, dst, src, nbytes);
 193         err = blkcipher_walk_virt_block(desc, &walk, bsize);
 194
 195         /* set up counter block */
 196         memset(counterblk, 0 , bsize);
 197         memcpy(counterblk, ctx->nonce, ictx->noncesize);
 198         memcpy(counterblk + ictx->noncesize, walk.iv, ictx->ivsize);
 199
 200         /* initialize counter portion of counter block */
 201         ctr_inc_quad(counterblk + (bsize - ictx->countersize),
 202                      ictx->countersize);
 203
 204         while (walk.nbytes) {
 205                 if (walk.src.virt.addr == walk.dst.virt.addr)
 206                         nbytes = crypto_ctr_crypt_inplace(&walk, child,
 207                                                           counterblk,
 208                                                           ictx->countersize);
 209                 else
 210                         nbytes = crypto_ctr_crypt_segment(&walk, child,
 211                                                           counterblk,
 212                                                           ictx->countersize);
 213
 214                 err = blkcipher_walk_done(desc, &walk, nbytes);
 215         }
 216         return err;
 217 }
 218
 219 static int crypto_ctr_init_tfm(struct crypto_tfm *tfm)
 220 {
 221         struct crypto_instance *inst = (void *)tfm->__crt_alg;
 222         struct ctr_instance_ctx *ictx = crypto_instance_ctx(inst);
 223         struct crypto_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
 224         struct crypto_cipher *cipher;
 225
 226         ctx->nonce = kzalloc(ictx->noncesize, GFP_KERNEL);
 227         if (!ctx->nonce)
 228                 return -ENOMEM;
 229
 230         cipher = crypto_spawn_cipher(&ictx->alg);
 231         if (IS_ERR(cipher))
 232                 return PTR_ERR(cipher);
 233
 234         ctx->child = cipher;
 235
 236         return 0;
 237 }
 238
 239 static void crypto_ctr_exit_tfm(struct crypto_tfm *tfm)
 240 {
 241         struct crypto_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
 242
 243         kfree(ctx->nonce);
 244         crypto_free_cipher(ctx->child);
 245 }
 246
 247 static struct crypto_instance *crypto_ctr_alloc(struct rtattr **tb)
 248 {
 249         struct crypto_instance *inst;
 250         struct crypto_alg *alg;
 251         struct ctr_instance_ctx *ictx;
 252         unsigned int noncesize;
 253         unsigned int ivsize;
 254         unsigned int countersize;
 255         int err;
 256
 257         err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_BLKCIPHER);
 258         if (err)
 259                 return ERR_PTR(err);
 260
 261         alg = crypto_attr_alg(tb[1], CRYPTO_ALG_TYPE_CIPHER,
 262                                   CRYPTO_ALG_TYPE_MASK);
 263         if (IS_ERR(alg))
 264                 return ERR_PTR(PTR_ERR(alg));
 265
 266         err = crypto_attr_u32(tb[2], &noncesize);
 267         if (err)
 268                 goto out_put_alg;
 269
 270         err = crypto_attr_u32(tb[3], &ivsize);
 271         if (err)
 272                 goto out_put_alg;
 273
 274         err = crypto_attr_u32(tb[4], &countersize);
 275         if (err)
 276                 goto out_put_alg;
 277
 278         /* verify size of nonce + iv + counter
 279          * counter must be >= 4 bytes.
 280          */
 281         err = -EINVAL;
 282         if (((noncesize + ivsize + countersize) < alg->cra_blocksize) ||
 283             ((noncesize + ivsize) > alg->cra_blocksize) ||
 284             (countersize > alg->cra_blocksize) || (countersize < 4))
 285                 goto out_put_alg;
 286
 287         inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
 288         err = -ENOMEM;
 289         if (!inst)
 290                 goto out_put_alg;
 291
 292         err = -ENAMETOOLONG;
 293         if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
 294                      "ctr(%s,%u,%u,%u)", alg->cra_name, noncesize,
 295                      ivsize, countersize) >= CRYPTO_MAX_ALG_NAME) {
 296                 goto err_free_inst;
 297         }
 298
 299         if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 300                      "ctr(%s,%u,%u,%u)", alg->cra_driver_name, noncesize,
 301                      ivsize, countersize) >= CRYPTO_MAX_ALG_NAME) {
 302                 goto err_free_inst;
 303         }
 304
 305         ictx = crypto_instance_ctx(inst);
 306         ictx->noncesize = noncesize;
 307         ictx->ivsize = ivsize;
 308         ictx->countersize = countersize;
 309
 310         err = crypto_init_spawn(&ictx->alg, alg, inst,
 311                 CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC);
 312         if (err)
 313                 goto err_free_inst;
 314
 315         err = 0;
 316         inst->alg.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER;
 317         inst->alg.cra_priority = alg->cra_priority;
 318         inst->alg.cra_blocksize = 1;
 319         inst->alg.cra_alignmask = 3;
 320         inst->alg.cra_type = &crypto_blkcipher_type;
 321
 322         inst->alg.cra_blkcipher.ivsize = ivsize;
 323         inst->alg.cra_blkcipher.min_keysize = alg->cra_cipher.cia_min_keysize
 324                                               + noncesize;
 325         inst->alg.cra_blkcipher.max_keysize = alg->cra_cipher.cia_max_keysize
 326                                               + noncesize;
 327
 328         inst->alg.cra_ctxsize = sizeof(struct crypto_ctr_ctx);
 329
 330         inst->alg.cra_init = crypto_ctr_init_tfm;
 331         inst->alg.cra_exit = crypto_ctr_exit_tfm;
 332
 333         inst->alg.cra_blkcipher.setkey = crypto_ctr_setkey;
 334         inst->alg.cra_blkcipher.encrypt = crypto_ctr_crypt;
 335         inst->alg.cra_blkcipher.decrypt = crypto_ctr_crypt;
 336
 337 err_free_inst:
 338         if (err)
 339                 kfree(inst);
 340
 341 out_put_alg:
 342         crypto_mod_put(alg);
 343
 344         if (err)
 345                 inst = ERR_PTR(err);
 346
 347         return inst;
 348 }
 349
 350 static void crypto_ctr_free(struct crypto_instance *inst)
 351 {
 352         struct ctr_instance_ctx *ictx = crypto_instance_ctx(inst);
 353
 354         crypto_drop_spawn(&ictx->alg);
 355         kfree(inst);
 356 }
 357
 358 static struct crypto_template crypto_ctr_tmpl = {
 359         .name = "ctr",
 360         .alloc = crypto_ctr_alloc,
 361         .free = crypto_ctr_free,
 362         .module = THIS_MODULE,
 363 };
 364
 365 static int __init crypto_ctr_module_init(void)
 366 {
 367         return crypto_register_template(&crypto_ctr_tmpl);
 368 }
 369
 370 static void __exit crypto_ctr_module_exit(void)
 371 {
 372         crypto_unregister_template(&crypto_ctr_tmpl);
 373 }
 374
 375 module_init(crypto_ctr_module_init);
 376 module_exit(crypto_ctr_module_exit);
 377
 378 MODULE_LICENSE("GPL");
 379 MODULE_DESCRIPTION("CTR Counter block mode");