crypto/ctr.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * CTR: Counter mode
   4  *
   5  * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
   6  */
   7
   8 #include <crypto/algapi.h>
   9 #include <crypto/ctr.h>
  10 #include <crypto/internal/skcipher.h>
  11 #include <linux/err.h>
  12 #include <linux/init.h>
  13 #include <linux/kernel.h>
  14 #include <linux/module.h>
  15 #include <linux/slab.h>
  16
  17 struct crypto_rfc3686_ctx {
  18         struct crypto_skcipher *child;
  19         u8 nonce[CTR_RFC3686_NONCE_SIZE];
  20 };
  21
  22 struct crypto_rfc3686_req_ctx {
  23         u8 iv[CTR_RFC3686_BLOCK_SIZE];
  24         struct skcipher_request subreq CRYPTO_MINALIGN_ATTR;
  25 };
  26
  27 static void crypto_ctr_crypt_final(struct skcipher_walk *walk,
  28                                    struct crypto_cipher *tfm)
  29 {
  30         unsigned int bsize = crypto_cipher_blocksize(tfm);
  31         unsigned long alignmask = crypto_cipher_alignmask(tfm);
  32         u8 *ctrblk = walk->iv;
  33         u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK];
  34         u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1);
  35         u8 *src = walk->src.virt.addr;
  36         u8 *dst = walk->dst.virt.addr;
  37         unsigned int nbytes = walk->nbytes;
  38
  39         crypto_cipher_encrypt_one(tfm, keystream, ctrblk);
  40         crypto_xor_cpy(dst, keystream, src, nbytes);
  41
  42         crypto_inc(ctrblk, bsize);
  43 }
  44
  45 static int crypto_ctr_crypt_segment(struct skcipher_walk *walk,
  46                                     struct crypto_cipher *tfm)
  47 {
  48         void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
  49                    crypto_cipher_alg(tfm)->cia_encrypt;
  50         unsigned int bsize = crypto_cipher_blocksize(tfm);
  51         u8 *ctrblk = walk->iv;
  52         u8 *src = walk->src.virt.addr;
  53         u8 *dst = walk->dst.virt.addr;
  54         unsigned int nbytes = walk->nbytes;
  55
  56         do {
  57                 /* create keystream */
  58                 fn(crypto_cipher_tfm(tfm), dst, ctrblk);
  59                 crypto_xor(dst, src, bsize);
  60
  61                 /* increment counter in counterblock */
  62                 crypto_inc(ctrblk, bsize);
  63
  64                 src += bsize;
  65                 dst += bsize;
  66         } while ((nbytes -= bsize) >= bsize);
  67
  68         return nbytes;
  69 }
  70
  71 static int crypto_ctr_crypt_inplace(struct skcipher_walk *walk,
  72                                     struct crypto_cipher *tfm)
  73 {
  74         void (*fn)(struct crypto_tfm *, u8 *, const u8 *) =
  75                    crypto_cipher_alg(tfm)->cia_encrypt;
  76         unsigned int bsize = crypto_cipher_blocksize(tfm);
  77         unsigned long alignmask = crypto_cipher_alignmask(tfm);
  78         unsigned int nbytes = walk->nbytes;
  79         u8 *ctrblk = walk->iv;
  80         u8 *src = walk->src.virt.addr;
  81         u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK];
  82         u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1);
  83
  84         do {
  85                 /* create keystream */
  86                 fn(crypto_cipher_tfm(tfm), keystream, ctrblk);
  87                 crypto_xor(src, keystream, bsize);
  88
  89                 /* increment counter in counterblock */
  90                 crypto_inc(ctrblk, bsize);
  91
  92                 src += bsize;
  93         } while ((nbytes -= bsize) >= bsize);
  94
  95         return nbytes;
  96 }
  97
  98 static int crypto_ctr_crypt(struct skcipher_request *req)
  99 {
 100         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 101         struct crypto_cipher *cipher = skcipher_cipher_simple(tfm);
 102         const unsigned int bsize = crypto_cipher_blocksize(cipher);
 103         struct skcipher_walk walk;
 104         unsigned int nbytes;
 105         int err;
 106
 107         err = skcipher_walk_virt(&walk, req, false);
 108
 109         while (walk.nbytes >= bsize) {
 110                 if (walk.src.virt.addr == walk.dst.virt.addr)
 111                         nbytes = crypto_ctr_crypt_inplace(&walk, cipher);
 112                 else
 113                         nbytes = crypto_ctr_crypt_segment(&walk, cipher);
 114
 115                 err = skcipher_walk_done(&walk, nbytes);
 116         }
 117
 118         if (walk.nbytes) {
 119                 crypto_ctr_crypt_final(&walk, cipher);
 120                 err = skcipher_walk_done(&walk, 0);
 121         }
 122
 123         return err;
 124 }
 125
 126 static int crypto_ctr_create(struct crypto_template *tmpl, struct rtattr **tb)
 127 {
 128         struct skcipher_instance *inst;
 129         struct crypto_alg *alg;
 130         int err;
 131
 132         inst = skcipher_alloc_instance_simple(tmpl, tb);
 133         if (IS_ERR(inst))
 134                 return PTR_ERR(inst);
 135
 136         alg = skcipher_ialg_simple(inst);
 137
 138         /* Block size must be >= 4 bytes. */
 139         err = -EINVAL;
 140         if (alg->cra_blocksize < 4)
 141                 goto out_free_inst;
 142
 143         /* If this is false we'd fail the alignment of crypto_inc. */
 144         if (alg->cra_blocksize % 4)
 145                 goto out_free_inst;
 146
 147         /* CTR mode is a stream cipher. */
 148         inst->alg.base.cra_blocksize = 1;
 149
 150         /*
 151          * To simplify the implementation, configure the skcipher walk to only
 152          * give a partial block at the very end, never earlier.
 153          */
 154         inst->alg.chunksize = alg->cra_blocksize;
 155
 156         inst->alg.encrypt = crypto_ctr_crypt;
 157         inst->alg.decrypt = crypto_ctr_crypt;
 158
 159         err = skcipher_register_instance(tmpl, inst);
 160         if (err) {
 161 out_free_inst:
 162                 inst->free(inst);
 163         }
 164
 165         return err;
 166 }
 167
 168 static int crypto_rfc3686_setkey(struct crypto_skcipher *parent,
 169                                  const u8 *key, unsigned int keylen)
 170 {
 171         struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(parent);
 172         struct crypto_skcipher *child = ctx->child;
 173
 174         /* the nonce is stored in bytes at end of key */
 175         if (keylen < CTR_RFC3686_NONCE_SIZE)
 176                 return -EINVAL;
 177
 178         memcpy(ctx->nonce, key + (keylen - CTR_RFC3686_NONCE_SIZE),
 179                CTR_RFC3686_NONCE_SIZE);
 180
 181         keylen -= CTR_RFC3686_NONCE_SIZE;
 182
 183         crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
 184         crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) &
 185                                          CRYPTO_TFM_REQ_MASK);
 186         return crypto_skcipher_setkey(child, key, keylen);
 187 }
 188
 189 static int crypto_rfc3686_crypt(struct skcipher_request *req)
 190 {
 191         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 192         struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm);
 193         struct crypto_skcipher *child = ctx->child;
 194         unsigned long align = crypto_skcipher_alignmask(tfm);
 195         struct crypto_rfc3686_req_ctx *rctx =
 196                 (void *)PTR_ALIGN((u8 *)skcipher_request_ctx(req), align + 1);
 197         struct skcipher_request *subreq = &rctx->subreq;
 198         u8 *iv = rctx->iv;
 199
 200         /* set up counter block */
 201         memcpy(iv, ctx->nonce, CTR_RFC3686_NONCE_SIZE);
 202         memcpy(iv + CTR_RFC3686_NONCE_SIZE, req->iv, CTR_RFC3686_IV_SIZE);
 203
 204         /* initialize counter portion of counter block */
 205         *(__be32 *)(iv + CTR_RFC3686_NONCE_SIZE + CTR_RFC3686_IV_SIZE) =
 206                 cpu_to_be32(1);
 207
 208         skcipher_request_set_tfm(subreq, child);
 209         skcipher_request_set_callback(subreq, req->base.flags,
 210                                       req->base.complete, req->base.data);
 211         skcipher_request_set_crypt(subreq, req->src, req->dst,
 212                                    req->cryptlen, iv);
 213
 214         return crypto_skcipher_encrypt(subreq);
 215 }
 216
 217 static int crypto_rfc3686_init_tfm(struct crypto_skcipher *tfm)
 218 {
 219         struct skcipher_instance *inst = skcipher_alg_instance(tfm);
 220         struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst);
 221         struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm);
 222         struct crypto_skcipher *cipher;
 223         unsigned long align;
 224         unsigned int reqsize;
 225
 226         cipher = crypto_spawn_skcipher(spawn);
 227         if (IS_ERR(cipher))
 228                 return PTR_ERR(cipher);
 229
 230         ctx->child = cipher;
 231
 232         align = crypto_skcipher_alignmask(tfm);
 233         align &= ~(crypto_tfm_ctx_alignment() - 1);
 234         reqsize = align + sizeof(struct crypto_rfc3686_req_ctx) +
 235                   crypto_skcipher_reqsize(cipher);
 236         crypto_skcipher_set_reqsize(tfm, reqsize);
 237
 238         return 0;
 239 }
 240
 241 static void crypto_rfc3686_exit_tfm(struct crypto_skcipher *tfm)
 242 {
 243         struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm);
 244
 245         crypto_free_skcipher(ctx->child);
 246 }
 247
 248 static void crypto_rfc3686_free(struct skcipher_instance *inst)
 249 {
 250         struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst);
 251
 252         crypto_drop_skcipher(spawn);
 253         kfree(inst);
 254 }
 255
 256 static int crypto_rfc3686_create(struct crypto_template *tmpl,
 257                                  struct rtattr **tb)
 258 {
 259         struct crypto_attr_type *algt;
 260         struct skcipher_instance *inst;
 261         struct skcipher_alg *alg;
 262         struct crypto_skcipher_spawn *spawn;
 263         const char *cipher_name;
 264         u32 mask;
 265
 266         int err;
 267
 268         algt = crypto_get_attr_type(tb);
 269         if (IS_ERR(algt))
 270                 return PTR_ERR(algt);
 271
 272         if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask)
 273                 return -EINVAL;
 274
 275         cipher_name = crypto_attr_alg_name(tb[1]);
 276         if (IS_ERR(cipher_name))
 277                 return PTR_ERR(cipher_name);
 278
 279         inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
 280         if (!inst)
 281                 return -ENOMEM;
 282
 283         mask = crypto_requires_sync(algt->type, algt->mask) |
 284                 crypto_requires_off(algt->type, algt->mask,
 285                                     CRYPTO_ALG_NEED_FALLBACK);
 286
 287         spawn = skcipher_instance_ctx(inst);
 288
 289         err = crypto_grab_skcipher(spawn, skcipher_crypto_instance(inst),
 290                                    cipher_name, 0, mask);
 291         if (err)
 292                 goto err_free_inst;
 293
 294         alg = crypto_spawn_skcipher_alg(spawn);
 295
 296         /* We only support 16-byte blocks. */
 297         err = -EINVAL;
 298         if (crypto_skcipher_alg_ivsize(alg) != CTR_RFC3686_BLOCK_SIZE)
 299                 goto err_drop_spawn;
 300
 301         /* Not a stream cipher? */
 302         if (alg->base.cra_blocksize != 1)
 303                 goto err_drop_spawn;
 304
 305         err = -ENAMETOOLONG;
 306         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 307                      "rfc3686(%s)", alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
 308                 goto err_drop_spawn;
 309         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 310                      "rfc3686(%s)", alg->base.cra_driver_name) >=
 311             CRYPTO_MAX_ALG_NAME)
 312                 goto err_drop_spawn;
 313
 314         inst->alg.base.cra_priority = alg->base.cra_priority;
 315         inst->alg.base.cra_blocksize = 1;
 316         inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 317
 318         inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
 319
 320         inst->alg.ivsize = CTR_RFC3686_IV_SIZE;
 321         inst->alg.chunksize = crypto_skcipher_alg_chunksize(alg);
 322         inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg) +
 323                                 CTR_RFC3686_NONCE_SIZE;
 324         inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg) +
 325                                 CTR_RFC3686_NONCE_SIZE;
 326
 327         inst->alg.setkey = crypto_rfc3686_setkey;
 328         inst->alg.encrypt = crypto_rfc3686_crypt;
 329         inst->alg.decrypt = crypto_rfc3686_crypt;
 330
 331         inst->alg.base.cra_ctxsize = sizeof(struct crypto_rfc3686_ctx);
 332
 333         inst->alg.init = crypto_rfc3686_init_tfm;
 334         inst->alg.exit = crypto_rfc3686_exit_tfm;
 335
 336         inst->free = crypto_rfc3686_free;
 337
 338         err = skcipher_register_instance(tmpl, inst);
 339         if (err)
 340                 goto err_drop_spawn;
 341
 342 out:
 343         return err;
 344
 345 err_drop_spawn:
 346         crypto_drop_skcipher(spawn);
 347 err_free_inst:
 348         kfree(inst);
 349         goto out;
 350 }
 351
 352 static struct crypto_template crypto_ctr_tmpls[] = {
 353         {
 354                 .name = "ctr",
 355                 .create = crypto_ctr_create,
 356                 .module = THIS_MODULE,
 357         }, {
 358                 .name = "rfc3686",
 359                 .create = crypto_rfc3686_create,
 360                 .module = THIS_MODULE,
 361         },
 362 };
 363
 364 static int __init crypto_ctr_module_init(void)
 365 {
 366         return crypto_register_templates(crypto_ctr_tmpls,
 367                                          ARRAY_SIZE(crypto_ctr_tmpls));
 368 }
 369
 370 static void __exit crypto_ctr_module_exit(void)
 371 {
 372         crypto_unregister_templates(crypto_ctr_tmpls,
 373                                     ARRAY_SIZE(crypto_ctr_tmpls));
 374 }
 375
 376 subsys_initcall(crypto_ctr_module_init);
 377 module_exit(crypto_ctr_module_exit);
 378
 379 MODULE_LICENSE("GPL");
 380 MODULE_DESCRIPTION("CTR block cipher mode of operation");
 381 MODULE_ALIAS_CRYPTO("rfc3686");
 382 MODULE_ALIAS_CRYPTO("ctr");