4 * s390 implementation of the DES Cipher Algorithm.
6 * Copyright IBM Corp. 2003, 2011
7 * Author(s): Thomas Spatzier
8 * Jan Glauber (jan.glauber@de.ibm.com)
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
17 #include <linux/init.h>
18 #include <linux/module.h>
19 #include <linux/cpufeature.h>
20 #include <linux/crypto.h>
21 #include <crypto/algapi.h>
22 #include <crypto/des.h>
24 #include "crypt_s390.h"
26 #define DES3_KEY_SIZE (3 * DES_KEY_SIZE)
29 static DEFINE_SPINLOCK(ctrblk_lock
);
32 u8 iv
[DES_BLOCK_SIZE
];
33 u8 key
[DES3_KEY_SIZE
];
36 static int des_setkey(struct crypto_tfm
*tfm
, const u8
*key
,
39 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
40 u32
*flags
= &tfm
->crt_flags
;
41 u32 tmp
[DES_EXPKEY_WORDS
];
43 /* check for weak keys */
44 if (!des_ekey(tmp
, key
) && (*flags
& CRYPTO_TFM_REQ_WEAK_KEY
)) {
45 *flags
|= CRYPTO_TFM_RES_WEAK_KEY
;
49 memcpy(ctx
->key
, key
, key_len
);
53 static void des_encrypt(struct crypto_tfm
*tfm
, u8
*out
, const u8
*in
)
55 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
57 crypt_s390_km(KM_DEA_ENCRYPT
, ctx
->key
, out
, in
, DES_BLOCK_SIZE
);
60 static void des_decrypt(struct crypto_tfm
*tfm
, u8
*out
, const u8
*in
)
62 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
64 crypt_s390_km(KM_DEA_DECRYPT
, ctx
->key
, out
, in
, DES_BLOCK_SIZE
);
67 static struct crypto_alg des_alg
= {
69 .cra_driver_name
= "des-s390",
70 .cra_priority
= CRYPT_S390_PRIORITY
,
71 .cra_flags
= CRYPTO_ALG_TYPE_CIPHER
,
72 .cra_blocksize
= DES_BLOCK_SIZE
,
73 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
74 .cra_module
= THIS_MODULE
,
77 .cia_min_keysize
= DES_KEY_SIZE
,
78 .cia_max_keysize
= DES_KEY_SIZE
,
79 .cia_setkey
= des_setkey
,
80 .cia_encrypt
= des_encrypt
,
81 .cia_decrypt
= des_decrypt
,
86 static int ecb_desall_crypt(struct blkcipher_desc
*desc
, long func
,
87 u8
*key
, struct blkcipher_walk
*walk
)
89 int ret
= blkcipher_walk_virt(desc
, walk
);
92 while ((nbytes
= walk
->nbytes
)) {
93 /* only use complete blocks */
94 unsigned int n
= nbytes
& ~(DES_BLOCK_SIZE
- 1);
95 u8
*out
= walk
->dst
.virt
.addr
;
96 u8
*in
= walk
->src
.virt
.addr
;
98 ret
= crypt_s390_km(func
, key
, out
, in
, n
);
99 if (ret
< 0 || ret
!= n
)
102 nbytes
&= DES_BLOCK_SIZE
- 1;
103 ret
= blkcipher_walk_done(desc
, walk
, nbytes
);
109 static int cbc_desall_crypt(struct blkcipher_desc
*desc
, long func
,
110 struct blkcipher_walk
*walk
)
112 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
113 int ret
= blkcipher_walk_virt(desc
, walk
);
114 unsigned int nbytes
= walk
->nbytes
;
116 u8 iv
[DES_BLOCK_SIZE
];
117 u8 key
[DES3_KEY_SIZE
];
123 memcpy(param
.iv
, walk
->iv
, DES_BLOCK_SIZE
);
124 memcpy(param
.key
, ctx
->key
, DES3_KEY_SIZE
);
126 /* only use complete blocks */
127 unsigned int n
= nbytes
& ~(DES_BLOCK_SIZE
- 1);
128 u8
*out
= walk
->dst
.virt
.addr
;
129 u8
*in
= walk
->src
.virt
.addr
;
131 ret
= crypt_s390_kmc(func
, ¶m
, out
, in
, n
);
132 if (ret
< 0 || ret
!= n
)
135 nbytes
&= DES_BLOCK_SIZE
- 1;
136 ret
= blkcipher_walk_done(desc
, walk
, nbytes
);
137 } while ((nbytes
= walk
->nbytes
));
138 memcpy(walk
->iv
, param
.iv
, DES_BLOCK_SIZE
);
144 static int ecb_des_encrypt(struct blkcipher_desc
*desc
,
145 struct scatterlist
*dst
, struct scatterlist
*src
,
148 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
149 struct blkcipher_walk walk
;
151 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
152 return ecb_desall_crypt(desc
, KM_DEA_ENCRYPT
, ctx
->key
, &walk
);
155 static int ecb_des_decrypt(struct blkcipher_desc
*desc
,
156 struct scatterlist
*dst
, struct scatterlist
*src
,
159 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
160 struct blkcipher_walk walk
;
162 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
163 return ecb_desall_crypt(desc
, KM_DEA_DECRYPT
, ctx
->key
, &walk
);
166 static struct crypto_alg ecb_des_alg
= {
167 .cra_name
= "ecb(des)",
168 .cra_driver_name
= "ecb-des-s390",
169 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
170 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
171 .cra_blocksize
= DES_BLOCK_SIZE
,
172 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
173 .cra_type
= &crypto_blkcipher_type
,
174 .cra_module
= THIS_MODULE
,
177 .min_keysize
= DES_KEY_SIZE
,
178 .max_keysize
= DES_KEY_SIZE
,
179 .setkey
= des_setkey
,
180 .encrypt
= ecb_des_encrypt
,
181 .decrypt
= ecb_des_decrypt
,
186 static int cbc_des_encrypt(struct blkcipher_desc
*desc
,
187 struct scatterlist
*dst
, struct scatterlist
*src
,
190 struct blkcipher_walk walk
;
192 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
193 return cbc_desall_crypt(desc
, KMC_DEA_ENCRYPT
, &walk
);
196 static int cbc_des_decrypt(struct blkcipher_desc
*desc
,
197 struct scatterlist
*dst
, struct scatterlist
*src
,
200 struct blkcipher_walk walk
;
202 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
203 return cbc_desall_crypt(desc
, KMC_DEA_DECRYPT
, &walk
);
206 static struct crypto_alg cbc_des_alg
= {
207 .cra_name
= "cbc(des)",
208 .cra_driver_name
= "cbc-des-s390",
209 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
210 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
211 .cra_blocksize
= DES_BLOCK_SIZE
,
212 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
213 .cra_type
= &crypto_blkcipher_type
,
214 .cra_module
= THIS_MODULE
,
217 .min_keysize
= DES_KEY_SIZE
,
218 .max_keysize
= DES_KEY_SIZE
,
219 .ivsize
= DES_BLOCK_SIZE
,
220 .setkey
= des_setkey
,
221 .encrypt
= cbc_des_encrypt
,
222 .decrypt
= cbc_des_decrypt
,
230 * For DES-EDE3, there is no known need to reject weak or
231 * complementation keys. Any weakness is obviated by the use of
234 * However, if the first two or last two independent 64-bit keys are
235 * equal (k1 == k2 or k2 == k3), then the DES3 operation is simply the
236 * same as DES. Implementers MUST reject keys that exhibit this
240 static int des3_setkey(struct crypto_tfm
*tfm
, const u8
*key
,
241 unsigned int key_len
)
243 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
244 u32
*flags
= &tfm
->crt_flags
;
246 if (!(crypto_memneq(key
, &key
[DES_KEY_SIZE
], DES_KEY_SIZE
) &&
247 crypto_memneq(&key
[DES_KEY_SIZE
], &key
[DES_KEY_SIZE
* 2],
249 (*flags
& CRYPTO_TFM_REQ_WEAK_KEY
)) {
250 *flags
|= CRYPTO_TFM_RES_WEAK_KEY
;
253 memcpy(ctx
->key
, key
, key_len
);
257 static void des3_encrypt(struct crypto_tfm
*tfm
, u8
*dst
, const u8
*src
)
259 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
261 crypt_s390_km(KM_TDEA_192_ENCRYPT
, ctx
->key
, dst
, src
, DES_BLOCK_SIZE
);
264 static void des3_decrypt(struct crypto_tfm
*tfm
, u8
*dst
, const u8
*src
)
266 struct s390_des_ctx
*ctx
= crypto_tfm_ctx(tfm
);
268 crypt_s390_km(KM_TDEA_192_DECRYPT
, ctx
->key
, dst
, src
, DES_BLOCK_SIZE
);
271 static struct crypto_alg des3_alg
= {
272 .cra_name
= "des3_ede",
273 .cra_driver_name
= "des3_ede-s390",
274 .cra_priority
= CRYPT_S390_PRIORITY
,
275 .cra_flags
= CRYPTO_ALG_TYPE_CIPHER
,
276 .cra_blocksize
= DES_BLOCK_SIZE
,
277 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
278 .cra_module
= THIS_MODULE
,
281 .cia_min_keysize
= DES3_KEY_SIZE
,
282 .cia_max_keysize
= DES3_KEY_SIZE
,
283 .cia_setkey
= des3_setkey
,
284 .cia_encrypt
= des3_encrypt
,
285 .cia_decrypt
= des3_decrypt
,
290 static int ecb_des3_encrypt(struct blkcipher_desc
*desc
,
291 struct scatterlist
*dst
, struct scatterlist
*src
,
294 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
295 struct blkcipher_walk walk
;
297 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
298 return ecb_desall_crypt(desc
, KM_TDEA_192_ENCRYPT
, ctx
->key
, &walk
);
301 static int ecb_des3_decrypt(struct blkcipher_desc
*desc
,
302 struct scatterlist
*dst
, struct scatterlist
*src
,
305 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
306 struct blkcipher_walk walk
;
308 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
309 return ecb_desall_crypt(desc
, KM_TDEA_192_DECRYPT
, ctx
->key
, &walk
);
312 static struct crypto_alg ecb_des3_alg
= {
313 .cra_name
= "ecb(des3_ede)",
314 .cra_driver_name
= "ecb-des3_ede-s390",
315 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
316 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
317 .cra_blocksize
= DES_BLOCK_SIZE
,
318 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
319 .cra_type
= &crypto_blkcipher_type
,
320 .cra_module
= THIS_MODULE
,
323 .min_keysize
= DES3_KEY_SIZE
,
324 .max_keysize
= DES3_KEY_SIZE
,
325 .setkey
= des3_setkey
,
326 .encrypt
= ecb_des3_encrypt
,
327 .decrypt
= ecb_des3_decrypt
,
332 static int cbc_des3_encrypt(struct blkcipher_desc
*desc
,
333 struct scatterlist
*dst
, struct scatterlist
*src
,
336 struct blkcipher_walk walk
;
338 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
339 return cbc_desall_crypt(desc
, KMC_TDEA_192_ENCRYPT
, &walk
);
342 static int cbc_des3_decrypt(struct blkcipher_desc
*desc
,
343 struct scatterlist
*dst
, struct scatterlist
*src
,
346 struct blkcipher_walk walk
;
348 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
349 return cbc_desall_crypt(desc
, KMC_TDEA_192_DECRYPT
, &walk
);
352 static struct crypto_alg cbc_des3_alg
= {
353 .cra_name
= "cbc(des3_ede)",
354 .cra_driver_name
= "cbc-des3_ede-s390",
355 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
356 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
357 .cra_blocksize
= DES_BLOCK_SIZE
,
358 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
359 .cra_type
= &crypto_blkcipher_type
,
360 .cra_module
= THIS_MODULE
,
363 .min_keysize
= DES3_KEY_SIZE
,
364 .max_keysize
= DES3_KEY_SIZE
,
365 .ivsize
= DES_BLOCK_SIZE
,
366 .setkey
= des3_setkey
,
367 .encrypt
= cbc_des3_encrypt
,
368 .decrypt
= cbc_des3_decrypt
,
373 static unsigned int __ctrblk_init(u8
*ctrptr
, unsigned int nbytes
)
377 /* align to block size, max. PAGE_SIZE */
378 n
= (nbytes
> PAGE_SIZE
) ? PAGE_SIZE
: nbytes
& ~(DES_BLOCK_SIZE
- 1);
379 for (i
= DES_BLOCK_SIZE
; i
< n
; i
+= DES_BLOCK_SIZE
) {
380 memcpy(ctrptr
+ i
, ctrptr
+ i
- DES_BLOCK_SIZE
, DES_BLOCK_SIZE
);
381 crypto_inc(ctrptr
+ i
, DES_BLOCK_SIZE
);
386 static int ctr_desall_crypt(struct blkcipher_desc
*desc
, long func
,
387 struct s390_des_ctx
*ctx
,
388 struct blkcipher_walk
*walk
)
390 int ret
= blkcipher_walk_virt_block(desc
, walk
, DES_BLOCK_SIZE
);
391 unsigned int n
, nbytes
;
392 u8 buf
[DES_BLOCK_SIZE
], ctrbuf
[DES_BLOCK_SIZE
];
393 u8
*out
, *in
, *ctrptr
= ctrbuf
;
398 if (spin_trylock(&ctrblk_lock
))
401 memcpy(ctrptr
, walk
->iv
, DES_BLOCK_SIZE
);
402 while ((nbytes
= walk
->nbytes
) >= DES_BLOCK_SIZE
) {
403 out
= walk
->dst
.virt
.addr
;
404 in
= walk
->src
.virt
.addr
;
405 while (nbytes
>= DES_BLOCK_SIZE
) {
406 if (ctrptr
== ctrblk
)
407 n
= __ctrblk_init(ctrptr
, nbytes
);
410 ret
= crypt_s390_kmctr(func
, ctx
->key
, out
, in
,
412 if (ret
< 0 || ret
!= n
) {
413 if (ctrptr
== ctrblk
)
414 spin_unlock(&ctrblk_lock
);
417 if (n
> DES_BLOCK_SIZE
)
418 memcpy(ctrptr
, ctrptr
+ n
- DES_BLOCK_SIZE
,
420 crypto_inc(ctrptr
, DES_BLOCK_SIZE
);
425 ret
= blkcipher_walk_done(desc
, walk
, nbytes
);
427 if (ctrptr
== ctrblk
) {
429 memcpy(ctrbuf
, ctrptr
, DES_BLOCK_SIZE
);
431 memcpy(walk
->iv
, ctrptr
, DES_BLOCK_SIZE
);
432 spin_unlock(&ctrblk_lock
);
435 memcpy(walk
->iv
, ctrptr
, DES_BLOCK_SIZE
);
437 /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
439 out
= walk
->dst
.virt
.addr
;
440 in
= walk
->src
.virt
.addr
;
441 ret
= crypt_s390_kmctr(func
, ctx
->key
, buf
, in
,
442 DES_BLOCK_SIZE
, ctrbuf
);
443 if (ret
< 0 || ret
!= DES_BLOCK_SIZE
)
445 memcpy(out
, buf
, nbytes
);
446 crypto_inc(ctrbuf
, DES_BLOCK_SIZE
);
447 ret
= blkcipher_walk_done(desc
, walk
, 0);
448 memcpy(walk
->iv
, ctrbuf
, DES_BLOCK_SIZE
);
453 static int ctr_des_encrypt(struct blkcipher_desc
*desc
,
454 struct scatterlist
*dst
, struct scatterlist
*src
,
457 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
458 struct blkcipher_walk walk
;
460 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
461 return ctr_desall_crypt(desc
, KMCTR_DEA_ENCRYPT
, ctx
, &walk
);
464 static int ctr_des_decrypt(struct blkcipher_desc
*desc
,
465 struct scatterlist
*dst
, struct scatterlist
*src
,
468 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
469 struct blkcipher_walk walk
;
471 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
472 return ctr_desall_crypt(desc
, KMCTR_DEA_DECRYPT
, ctx
, &walk
);
475 static struct crypto_alg ctr_des_alg
= {
476 .cra_name
= "ctr(des)",
477 .cra_driver_name
= "ctr-des-s390",
478 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
479 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
481 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
482 .cra_type
= &crypto_blkcipher_type
,
483 .cra_module
= THIS_MODULE
,
486 .min_keysize
= DES_KEY_SIZE
,
487 .max_keysize
= DES_KEY_SIZE
,
488 .ivsize
= DES_BLOCK_SIZE
,
489 .setkey
= des_setkey
,
490 .encrypt
= ctr_des_encrypt
,
491 .decrypt
= ctr_des_decrypt
,
496 static int ctr_des3_encrypt(struct blkcipher_desc
*desc
,
497 struct scatterlist
*dst
, struct scatterlist
*src
,
500 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
501 struct blkcipher_walk walk
;
503 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
504 return ctr_desall_crypt(desc
, KMCTR_TDEA_192_ENCRYPT
, ctx
, &walk
);
507 static int ctr_des3_decrypt(struct blkcipher_desc
*desc
,
508 struct scatterlist
*dst
, struct scatterlist
*src
,
511 struct s390_des_ctx
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
512 struct blkcipher_walk walk
;
514 blkcipher_walk_init(&walk
, dst
, src
, nbytes
);
515 return ctr_desall_crypt(desc
, KMCTR_TDEA_192_DECRYPT
, ctx
, &walk
);
518 static struct crypto_alg ctr_des3_alg
= {
519 .cra_name
= "ctr(des3_ede)",
520 .cra_driver_name
= "ctr-des3_ede-s390",
521 .cra_priority
= CRYPT_S390_COMPOSITE_PRIORITY
,
522 .cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
,
524 .cra_ctxsize
= sizeof(struct s390_des_ctx
),
525 .cra_type
= &crypto_blkcipher_type
,
526 .cra_module
= THIS_MODULE
,
529 .min_keysize
= DES3_KEY_SIZE
,
530 .max_keysize
= DES3_KEY_SIZE
,
531 .ivsize
= DES_BLOCK_SIZE
,
532 .setkey
= des3_setkey
,
533 .encrypt
= ctr_des3_encrypt
,
534 .decrypt
= ctr_des3_decrypt
,
539 static int __init
des_s390_init(void)
543 if (!crypt_s390_func_available(KM_DEA_ENCRYPT
, CRYPT_S390_MSA
) ||
544 !crypt_s390_func_available(KM_TDEA_192_ENCRYPT
, CRYPT_S390_MSA
))
547 ret
= crypto_register_alg(&des_alg
);
550 ret
= crypto_register_alg(&ecb_des_alg
);
553 ret
= crypto_register_alg(&cbc_des_alg
);
556 ret
= crypto_register_alg(&des3_alg
);
559 ret
= crypto_register_alg(&ecb_des3_alg
);
562 ret
= crypto_register_alg(&cbc_des3_alg
);
566 if (crypt_s390_func_available(KMCTR_DEA_ENCRYPT
,
567 CRYPT_S390_MSA
| CRYPT_S390_MSA4
) &&
568 crypt_s390_func_available(KMCTR_TDEA_192_ENCRYPT
,
569 CRYPT_S390_MSA
| CRYPT_S390_MSA4
)) {
570 ret
= crypto_register_alg(&ctr_des_alg
);
573 ret
= crypto_register_alg(&ctr_des3_alg
);
576 ctrblk
= (u8
*) __get_free_page(GFP_KERNEL
);
586 crypto_unregister_alg(&ctr_des3_alg
);
588 crypto_unregister_alg(&ctr_des_alg
);
590 crypto_unregister_alg(&cbc_des3_alg
);
592 crypto_unregister_alg(&ecb_des3_alg
);
594 crypto_unregister_alg(&des3_alg
);
596 crypto_unregister_alg(&cbc_des_alg
);
598 crypto_unregister_alg(&ecb_des_alg
);
600 crypto_unregister_alg(&des_alg
);
605 static void __exit
des_s390_exit(void)
608 crypto_unregister_alg(&ctr_des_alg
);
609 crypto_unregister_alg(&ctr_des3_alg
);
610 free_page((unsigned long) ctrblk
);
612 crypto_unregister_alg(&cbc_des3_alg
);
613 crypto_unregister_alg(&ecb_des3_alg
);
614 crypto_unregister_alg(&des3_alg
);
615 crypto_unregister_alg(&cbc_des_alg
);
616 crypto_unregister_alg(&ecb_des_alg
);
617 crypto_unregister_alg(&des_alg
);
620 module_cpu_feature_match(MSA
, des_s390_init
);
621 module_exit(des_s390_exit
);
623 MODULE_ALIAS_CRYPTO("des");
624 MODULE_ALIAS_CRYPTO("des3_ede");
626 MODULE_LICENSE("GPL");
627 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");