crypto/adiantum.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Adiantum length-preserving encryption mode
   4  *
   5  * Copyright 2018 Google LLC
   6  */
   7
   8 /*
   9  * Adiantum is a tweakable, length-preserving encryption mode designed for fast
  10  * and secure disk encryption, especially on CPUs without dedicated crypto
  11  * instructions.  Adiantum encrypts each sector using the XChaCha12 stream
  12  * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on
  13  * NH and Poly1305, and an invocation of the AES-256 block cipher on a single
  14  * 16-byte block.  See the paper for details:
  15  *
  16  *      Adiantum: length-preserving encryption for entry-level processors
  17  *      (https://eprint.iacr.org/2018/720.pdf)
  18  *
  19  * For flexibility, this implementation also allows other ciphers:
  20  *
  21  *      - Stream cipher: XChaCha12 or XChaCha20
  22  *      - Block cipher: any with a 128-bit block size and 256-bit key
  23  *
  24  * This implementation doesn't currently allow other ε-∆U hash functions, i.e.
  25  * HPolyC is not supported.  This is because Adiantum is ~20% faster than HPolyC
  26  * but still provably as secure, and also the ε-∆U hash function of HBSH is
  27  * formally defined to take two inputs (tweak, message) which makes it difficult
  28  * to wrap with the crypto_shash API.  Rather, some details need to be handled
  29  * here.  Nevertheless, if needed in the future, support for other ε-∆U hash
  30  * functions could be added here.
  31  */
  32
  33 #include <crypto/b128ops.h>
  34 #include <crypto/chacha.h>
  35 #include <crypto/internal/hash.h>
  36 #include <crypto/internal/poly1305.h>
  37 #include <crypto/internal/skcipher.h>
  38 #include <crypto/nhpoly1305.h>
  39 #include <crypto/scatterwalk.h>
  40 #include <linux/module.h>
  41
  42 #include "internal.h"
  43
  44 /*
  45  * Size of right-hand part of input data, in bytes; also the size of the block
  46  * cipher's block size and the hash function's output.
  47  */
  48 #define BLOCKCIPHER_BLOCK_SIZE          16
  49
  50 /* Size of the block cipher key (K_E) in bytes */
  51 #define BLOCKCIPHER_KEY_SIZE            32
  52
  53 /* Size of the hash key (K_H) in bytes */
  54 #define HASH_KEY_SIZE           (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE)
  55
  56 /*
  57  * The specification allows variable-length tweaks, but Linux's crypto API
  58  * currently only allows algorithms to support a single length.  The "natural"
  59  * tweak length for Adiantum is 16, since that fits into one Poly1305 block for
  60  * the best performance.  But longer tweaks are useful for fscrypt, to avoid
  61  * needing to derive per-file keys.  So instead we use two blocks, or 32 bytes.
  62  */
  63 #define TWEAK_SIZE              32
  64
  65 struct adiantum_instance_ctx {
  66         struct crypto_skcipher_spawn streamcipher_spawn;
  67         struct crypto_spawn blockcipher_spawn;
  68         struct crypto_shash_spawn hash_spawn;
  69 };
  70
  71 struct adiantum_tfm_ctx {
  72         struct crypto_skcipher *streamcipher;
  73         struct crypto_cipher *blockcipher;
  74         struct crypto_shash *hash;
  75         struct poly1305_key header_hash_key;
  76 };
  77
  78 struct adiantum_request_ctx {
  79
  80         /*
  81          * Buffer for right-hand part of data, i.e.
  82          *
  83          *    P_L => P_M => C_M => C_R when encrypting, or
  84          *    C_R => C_M => P_M => P_L when decrypting.
  85          *
  86          * Also used to build the IV for the stream cipher.
  87          */
  88         union {
  89                 u8 bytes[XCHACHA_IV_SIZE];
  90                 __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)];
  91                 le128 bignum;   /* interpret as element of Z/(2^{128}Z) */
  92         } rbuf;
  93
  94         bool enc; /* true if encrypting, false if decrypting */
  95
  96         /*
  97          * The result of the Poly1305 ε-∆U hash function applied to
  98          * (bulk length, tweak)
  99          */
 100         le128 header_hash;
 101
 102         /* Sub-requests, must be last */
 103         union {
 104                 struct shash_desc hash_desc;
 105                 struct skcipher_request streamcipher_req;
 106         } u;
 107 };
 108
 109 /*
 110  * Given the XChaCha stream key K_S, derive the block cipher key K_E and the
 111  * hash key K_H as follows:
 112  *
 113  *     K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191)
 114  *
 115  * Note that this denotes using bits from the XChaCha keystream, which here we
 116  * get indirectly by encrypting a buffer containing all 0's.
 117  */
 118 static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key,
 119                            unsigned int keylen)
 120 {
 121         struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 122         struct {
 123                 u8 iv[XCHACHA_IV_SIZE];
 124                 u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE];
 125                 struct scatterlist sg;
 126                 struct crypto_wait wait;
 127                 struct skcipher_request req; /* must be last */
 128         } *data;
 129         u8 *keyp;
 130         int err;
 131
 132         /* Set the stream cipher key (K_S) */
 133         crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK);
 134         crypto_skcipher_set_flags(tctx->streamcipher,
 135                                   crypto_skcipher_get_flags(tfm) &
 136                                   CRYPTO_TFM_REQ_MASK);
 137         err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen);
 138         crypto_skcipher_set_flags(tfm,
 139                                 crypto_skcipher_get_flags(tctx->streamcipher) &
 140                                 CRYPTO_TFM_RES_MASK);
 141         if (err)
 142                 return err;
 143
 144         /* Derive the subkeys */
 145         data = kzalloc(sizeof(*data) +
 146                        crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL);
 147         if (!data)
 148                 return -ENOMEM;
 149         data->iv[0] = 1;
 150         sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys));
 151         crypto_init_wait(&data->wait);
 152         skcipher_request_set_tfm(&data->req, tctx->streamcipher);
 153         skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP |
 154                                                   CRYPTO_TFM_REQ_MAY_BACKLOG,
 155                                       crypto_req_done, &data->wait);
 156         skcipher_request_set_crypt(&data->req, &data->sg, &data->sg,
 157                                    sizeof(data->derived_keys), data->iv);
 158         err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait);
 159         if (err)
 160                 goto out;
 161         keyp = data->derived_keys;
 162
 163         /* Set the block cipher key (K_E) */
 164         crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK);
 165         crypto_cipher_set_flags(tctx->blockcipher,
 166                                 crypto_skcipher_get_flags(tfm) &
 167                                 CRYPTO_TFM_REQ_MASK);
 168         err = crypto_cipher_setkey(tctx->blockcipher, keyp,
 169                                    BLOCKCIPHER_KEY_SIZE);
 170         crypto_skcipher_set_flags(tfm,
 171                                   crypto_cipher_get_flags(tctx->blockcipher) &
 172                                   CRYPTO_TFM_RES_MASK);
 173         if (err)
 174                 goto out;
 175         keyp += BLOCKCIPHER_KEY_SIZE;
 176
 177         /* Set the hash key (K_H) */
 178         poly1305_core_setkey(&tctx->header_hash_key, keyp);
 179         keyp += POLY1305_BLOCK_SIZE;
 180
 181         crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK);
 182         crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) &
 183                                            CRYPTO_TFM_REQ_MASK);
 184         err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE);
 185         crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) &
 186                                        CRYPTO_TFM_RES_MASK);
 187         keyp += NHPOLY1305_KEY_SIZE;
 188         WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]);
 189 out:
 190         kzfree(data);
 191         return err;
 192 }
 193
 194 /* Addition in Z/(2^{128}Z) */
 195 static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2)
 196 {
 197         u64 x = le64_to_cpu(v1->b);
 198         u64 y = le64_to_cpu(v2->b);
 199
 200         r->b = cpu_to_le64(x + y);
 201         r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) +
 202                            (x + y < x));
 203 }
 204
 205 /* Subtraction in Z/(2^{128}Z) */
 206 static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2)
 207 {
 208         u64 x = le64_to_cpu(v1->b);
 209         u64 y = le64_to_cpu(v2->b);
 210
 211         r->b = cpu_to_le64(x - y);
 212         r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) -
 213                            (x - y > x));
 214 }
 215
 216 /*
 217  * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the
 218  * result to rctx->header_hash.  This is the calculation
 219  *
 220  *      H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T)
 221  *
 222  * from the procedure in section 6.4 of the Adiantum paper.  The resulting value
 223  * is reused in both the first and second hash steps.  Specifically, it's added
 224  * to the result of an independently keyed ε-∆U hash function (for equal length
 225  * inputs only) taken over the left-hand part (the "bulk") of the message, to
 226  * give the overall Adiantum hash of the (tweak, left-hand part) pair.
 227  */
 228 static void adiantum_hash_header(struct skcipher_request *req)
 229 {
 230         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 231         const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 232         struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
 233         const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
 234         struct {
 235                 __le64 message_bits;
 236                 __le64 padding;
 237         } header = {
 238                 .message_bits = cpu_to_le64((u64)bulk_len * 8)
 239         };
 240         struct poly1305_state state;
 241
 242         poly1305_core_init(&state);
 243
 244         BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0);
 245         poly1305_core_blocks(&state, &tctx->header_hash_key,
 246                              &header, sizeof(header) / POLY1305_BLOCK_SIZE, 1);
 247
 248         BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0);
 249         poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv,
 250                              TWEAK_SIZE / POLY1305_BLOCK_SIZE, 1);
 251
 252         poly1305_core_emit(&state, &rctx->header_hash);
 253 }
 254
 255 /* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */
 256 static int adiantum_hash_message(struct skcipher_request *req,
 257                                  struct scatterlist *sgl, le128 *digest)
 258 {
 259         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 260         const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 261         struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
 262         const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
 263         struct shash_desc *hash_desc = &rctx->u.hash_desc;
 264         struct sg_mapping_iter miter;
 265         unsigned int i, n;
 266         int err;
 267
 268         hash_desc->tfm = tctx->hash;
 269
 270         err = crypto_shash_init(hash_desc);
 271         if (err)
 272                 return err;
 273
 274         sg_miter_start(&miter, sgl, sg_nents(sgl),
 275                        SG_MITER_FROM_SG | SG_MITER_ATOMIC);
 276         for (i = 0; i < bulk_len; i += n) {
 277                 sg_miter_next(&miter);
 278                 n = min_t(unsigned int, miter.length, bulk_len - i);
 279                 err = crypto_shash_update(hash_desc, miter.addr, n);
 280                 if (err)
 281                         break;
 282         }
 283         sg_miter_stop(&miter);
 284         if (err)
 285                 return err;
 286
 287         return crypto_shash_final(hash_desc, (u8 *)digest);
 288 }
 289
 290 /* Continue Adiantum encryption/decryption after the stream cipher step */
 291 static int adiantum_finish(struct skcipher_request *req)
 292 {
 293         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 294         const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 295         struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
 296         const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
 297         le128 digest;
 298         int err;
 299
 300         /* If decrypting, decrypt C_M with the block cipher to get P_M */
 301         if (!rctx->enc)
 302                 crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
 303                                           rctx->rbuf.bytes);
 304
 305         /*
 306          * Second hash step
 307          *      enc: C_R = C_M - H_{K_H}(T, C_L)
 308          *      dec: P_R = P_M - H_{K_H}(T, P_L)
 309          */
 310         err = adiantum_hash_message(req, req->dst, &digest);
 311         if (err)
 312                 return err;
 313         le128_add(&digest, &digest, &rctx->header_hash);
 314         le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
 315         scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst,
 316                                  bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1);
 317         return 0;
 318 }
 319
 320 static void adiantum_streamcipher_done(struct crypto_async_request *areq,
 321                                        int err)
 322 {
 323         struct skcipher_request *req = areq->data;
 324
 325         if (!err)
 326                 err = adiantum_finish(req);
 327
 328         skcipher_request_complete(req, err);
 329 }
 330
 331 static int adiantum_crypt(struct skcipher_request *req, bool enc)
 332 {
 333         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 334         const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 335         struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
 336         const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
 337         unsigned int stream_len;
 338         le128 digest;
 339         int err;
 340
 341         if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE)
 342                 return -EINVAL;
 343
 344         rctx->enc = enc;
 345
 346         /*
 347          * First hash step
 348          *      enc: P_M = P_R + H_{K_H}(T, P_L)
 349          *      dec: C_M = C_R + H_{K_H}(T, C_L)
 350          */
 351         adiantum_hash_header(req);
 352         err = adiantum_hash_message(req, req->src, &digest);
 353         if (err)
 354                 return err;
 355         le128_add(&digest, &digest, &rctx->header_hash);
 356         scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src,
 357                                  bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0);
 358         le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
 359
 360         /* If encrypting, encrypt P_M with the block cipher to get C_M */
 361         if (enc)
 362                 crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
 363                                           rctx->rbuf.bytes);
 364
 365         /* Initialize the rest of the XChaCha IV (first part is C_M) */
 366         BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16);
 367         BUILD_BUG_ON(XCHACHA_IV_SIZE != 32);    /* nonce || stream position */
 368         rctx->rbuf.words[4] = cpu_to_le32(1);
 369         rctx->rbuf.words[5] = 0;
 370         rctx->rbuf.words[6] = 0;
 371         rctx->rbuf.words[7] = 0;
 372
 373         /*
 374          * XChaCha needs to be done on all the data except the last 16 bytes;
 375          * for disk encryption that usually means 4080 or 496 bytes.  But ChaCha
 376          * implementations tend to be most efficient when passed a whole number
 377          * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes.
 378          * And here it doesn't matter whether the last 16 bytes are written to,
 379          * as the second hash step will overwrite them.  Thus, round the XChaCha
 380          * length up to the next 64-byte boundary if possible.
 381          */
 382         stream_len = bulk_len;
 383         if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen)
 384                 stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE);
 385
 386         skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher);
 387         skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src,
 388                                    req->dst, stream_len, &rctx->rbuf);
 389         skcipher_request_set_callback(&rctx->u.streamcipher_req,
 390                                       req->base.flags,
 391                                       adiantum_streamcipher_done, req);
 392         return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?:
 393                 adiantum_finish(req);
 394 }
 395
 396 static int adiantum_encrypt(struct skcipher_request *req)
 397 {
 398         return adiantum_crypt(req, true);
 399 }
 400
 401 static int adiantum_decrypt(struct skcipher_request *req)
 402 {
 403         return adiantum_crypt(req, false);
 404 }
 405
 406 static int adiantum_init_tfm(struct crypto_skcipher *tfm)
 407 {
 408         struct skcipher_instance *inst = skcipher_alg_instance(tfm);
 409         struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
 410         struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 411         struct crypto_skcipher *streamcipher;
 412         struct crypto_cipher *blockcipher;
 413         struct crypto_shash *hash;
 414         unsigned int subreq_size;
 415         int err;
 416
 417         streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn);
 418         if (IS_ERR(streamcipher))
 419                 return PTR_ERR(streamcipher);
 420
 421         blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn);
 422         if (IS_ERR(blockcipher)) {
 423                 err = PTR_ERR(blockcipher);
 424                 goto err_free_streamcipher;
 425         }
 426
 427         hash = crypto_spawn_shash(&ictx->hash_spawn);
 428         if (IS_ERR(hash)) {
 429                 err = PTR_ERR(hash);
 430                 goto err_free_blockcipher;
 431         }
 432
 433         tctx->streamcipher = streamcipher;
 434         tctx->blockcipher = blockcipher;
 435         tctx->hash = hash;
 436
 437         BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) !=
 438                      sizeof(struct adiantum_request_ctx));
 439         subreq_size = max(sizeof_field(struct adiantum_request_ctx,
 440                                        u.hash_desc) +
 441                           crypto_shash_descsize(hash),
 442                           sizeof_field(struct adiantum_request_ctx,
 443                                        u.streamcipher_req) +
 444                           crypto_skcipher_reqsize(streamcipher));
 445
 446         crypto_skcipher_set_reqsize(tfm,
 447                                     offsetof(struct adiantum_request_ctx, u) +
 448                                     subreq_size);
 449         return 0;
 450
 451 err_free_blockcipher:
 452         crypto_free_cipher(blockcipher);
 453 err_free_streamcipher:
 454         crypto_free_skcipher(streamcipher);
 455         return err;
 456 }
 457
 458 static void adiantum_exit_tfm(struct crypto_skcipher *tfm)
 459 {
 460         struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
 461
 462         crypto_free_skcipher(tctx->streamcipher);
 463         crypto_free_cipher(tctx->blockcipher);
 464         crypto_free_shash(tctx->hash);
 465 }
 466
 467 static void adiantum_free_instance(struct skcipher_instance *inst)
 468 {
 469         struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
 470
 471         crypto_drop_skcipher(&ictx->streamcipher_spawn);
 472         crypto_drop_spawn(&ictx->blockcipher_spawn);
 473         crypto_drop_shash(&ictx->hash_spawn);
 474         kfree(inst);
 475 }
 476
 477 /*
 478  * Check for a supported set of inner algorithms.
 479  * See the comment at the beginning of this file.
 480  */
 481 static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg,
 482                                           struct crypto_alg *blockcipher_alg,
 483                                           struct shash_alg *hash_alg)
 484 {
 485         if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 &&
 486             strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0)
 487                 return false;
 488
 489         if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE ||
 490             blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE)
 491                 return false;
 492         if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE)
 493                 return false;
 494
 495         if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0)
 496                 return false;
 497
 498         return true;
 499 }
 500
 501 static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
 502 {
 503         struct crypto_attr_type *algt;
 504         const char *streamcipher_name;
 505         const char *blockcipher_name;
 506         const char *nhpoly1305_name;
 507         struct skcipher_instance *inst;
 508         struct adiantum_instance_ctx *ictx;
 509         struct skcipher_alg *streamcipher_alg;
 510         struct crypto_alg *blockcipher_alg;
 511         struct crypto_alg *_hash_alg;
 512         struct shash_alg *hash_alg;
 513         int err;
 514
 515         algt = crypto_get_attr_type(tb);
 516         if (IS_ERR(algt))
 517                 return PTR_ERR(algt);
 518
 519         if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask)
 520                 return -EINVAL;
 521
 522         streamcipher_name = crypto_attr_alg_name(tb[1]);
 523         if (IS_ERR(streamcipher_name))
 524                 return PTR_ERR(streamcipher_name);
 525
 526         blockcipher_name = crypto_attr_alg_name(tb[2]);
 527         if (IS_ERR(blockcipher_name))
 528                 return PTR_ERR(blockcipher_name);
 529
 530         nhpoly1305_name = crypto_attr_alg_name(tb[3]);
 531         if (nhpoly1305_name == ERR_PTR(-ENOENT))
 532                 nhpoly1305_name = "nhpoly1305";
 533         if (IS_ERR(nhpoly1305_name))
 534                 return PTR_ERR(nhpoly1305_name);
 535
 536         inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
 537         if (!inst)
 538                 return -ENOMEM;
 539         ictx = skcipher_instance_ctx(inst);
 540
 541         /* Stream cipher, e.g. "xchacha12" */
 542         crypto_set_skcipher_spawn(&ictx->streamcipher_spawn,
 543                                   skcipher_crypto_instance(inst));
 544         err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name,
 545                                    0, crypto_requires_sync(algt->type,
 546                                                            algt->mask));
 547         if (err)
 548                 goto out_free_inst;
 549         streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn);
 550
 551         /* Block cipher, e.g. "aes" */
 552         crypto_set_spawn(&ictx->blockcipher_spawn,
 553                          skcipher_crypto_instance(inst));
 554         err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name,
 555                                 CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK);
 556         if (err)
 557                 goto out_drop_streamcipher;
 558         blockcipher_alg = ictx->blockcipher_spawn.alg;
 559
 560         /* NHPoly1305 ε-∆U hash function */
 561         _hash_alg = crypto_alg_mod_lookup(nhpoly1305_name,
 562                                           CRYPTO_ALG_TYPE_SHASH,
 563                                           CRYPTO_ALG_TYPE_MASK);
 564         if (IS_ERR(_hash_alg)) {
 565                 err = PTR_ERR(_hash_alg);
 566                 goto out_drop_blockcipher;
 567         }
 568         hash_alg = __crypto_shash_alg(_hash_alg);
 569         err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg,
 570                                       skcipher_crypto_instance(inst));
 571         if (err)
 572                 goto out_put_hash;
 573
 574         /* Check the set of algorithms */
 575         if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg,
 576                                            hash_alg)) {
 577                 pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n",
 578                         streamcipher_alg->base.cra_name,
 579                         blockcipher_alg->cra_name, hash_alg->base.cra_name);
 580                 err = -EINVAL;
 581                 goto out_drop_hash;
 582         }
 583
 584         /* Instance fields */
 585
 586         err = -ENAMETOOLONG;
 587         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 588                      "adiantum(%s,%s)", streamcipher_alg->base.cra_name,
 589                      blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME)
 590                 goto out_drop_hash;
 591         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 592                      "adiantum(%s,%s,%s)",
 593                      streamcipher_alg->base.cra_driver_name,
 594                      blockcipher_alg->cra_driver_name,
 595                      hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
 596                 goto out_drop_hash;
 597
 598         inst->alg.base.cra_flags = streamcipher_alg->base.cra_flags &
 599                                    CRYPTO_ALG_ASYNC;
 600         inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE;
 601         inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx);
 602         inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask |
 603                                        hash_alg->base.cra_alignmask;
 604         /*
 605          * The block cipher is only invoked once per message, so for long
 606          * messages (e.g. sectors for disk encryption) its performance doesn't
 607          * matter as much as that of the stream cipher and hash function.  Thus,
 608          * weigh the block cipher's ->cra_priority less.
 609          */
 610         inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority +
 611                                        2 * hash_alg->base.cra_priority +
 612                                        blockcipher_alg->cra_priority) / 7;
 613
 614         inst->alg.setkey = adiantum_setkey;
 615         inst->alg.encrypt = adiantum_encrypt;
 616         inst->alg.decrypt = adiantum_decrypt;
 617         inst->alg.init = adiantum_init_tfm;
 618         inst->alg.exit = adiantum_exit_tfm;
 619         inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg);
 620         inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg);
 621         inst->alg.ivsize = TWEAK_SIZE;
 622
 623         inst->free = adiantum_free_instance;
 624
 625         err = skcipher_register_instance(tmpl, inst);
 626         if (err)
 627                 goto out_drop_hash;
 628
 629         crypto_mod_put(_hash_alg);
 630         return 0;
 631
 632 out_drop_hash:
 633         crypto_drop_shash(&ictx->hash_spawn);
 634 out_put_hash:
 635         crypto_mod_put(_hash_alg);
 636 out_drop_blockcipher:
 637         crypto_drop_spawn(&ictx->blockcipher_spawn);
 638 out_drop_streamcipher:
 639         crypto_drop_skcipher(&ictx->streamcipher_spawn);
 640 out_free_inst:
 641         kfree(inst);
 642         return err;
 643 }
 644
 645 /* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */
 646 static struct crypto_template adiantum_tmpl = {
 647         .name = "adiantum",
 648         .create = adiantum_create,
 649         .module = THIS_MODULE,
 650 };
 651
 652 static int __init adiantum_module_init(void)
 653 {
 654         return crypto_register_template(&adiantum_tmpl);
 655 }
 656
 657 static void __exit adiantum_module_exit(void)
 658 {
 659         crypto_unregister_template(&adiantum_tmpl);
 660 }
 661
 662 subsys_initcall(adiantum_module_init);
 663 module_exit(adiantum_module_exit);
 664
 665 MODULE_DESCRIPTION("Adiantum length-preserving encryption mode");
 666 MODULE_LICENSE("GPL v2");
 667 MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
 668 MODULE_ALIAS_CRYPTO("adiantum");