]>
Commit | Line | Data |
---|---|---|
059c2a4d EB |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* | |
3 | * Adiantum length-preserving encryption mode | |
4 | * | |
5 | * Copyright 2018 Google LLC | |
6 | */ | |
7 | ||
8 | /* | |
9 | * Adiantum is a tweakable, length-preserving encryption mode designed for fast | |
10 | * and secure disk encryption, especially on CPUs without dedicated crypto | |
11 | * instructions. Adiantum encrypts each sector using the XChaCha12 stream | |
c6018e1a | 12 | * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on |
059c2a4d EB |
13 | * NH and Poly1305, and an invocation of the AES-256 block cipher on a single |
14 | * 16-byte block. See the paper for details: | |
15 | * | |
16 | * Adiantum: length-preserving encryption for entry-level processors | |
17 | * (https://eprint.iacr.org/2018/720.pdf) | |
18 | * | |
19 | * For flexibility, this implementation also allows other ciphers: | |
20 | * | |
21 | * - Stream cipher: XChaCha12 or XChaCha20 | |
22 | * - Block cipher: any with a 128-bit block size and 256-bit key | |
23 | * | |
c6018e1a | 24 | * This implementation doesn't currently allow other ε-∆U hash functions, i.e. |
059c2a4d | 25 | * HPolyC is not supported. This is because Adiantum is ~20% faster than HPolyC |
c6018e1a | 26 | * but still provably as secure, and also the ε-∆U hash function of HBSH is |
059c2a4d EB |
27 | * formally defined to take two inputs (tweak, message) which makes it difficult |
28 | * to wrap with the crypto_shash API. Rather, some details need to be handled | |
c6018e1a | 29 | * here. Nevertheless, if needed in the future, support for other ε-∆U hash |
059c2a4d EB |
30 | * functions could be added here. |
31 | */ | |
32 | ||
33 | #include <crypto/b128ops.h> | |
34 | #include <crypto/chacha.h> | |
35 | #include <crypto/internal/hash.h> | |
36 | #include <crypto/internal/skcipher.h> | |
37 | #include <crypto/nhpoly1305.h> | |
38 | #include <crypto/scatterwalk.h> | |
39 | #include <linux/module.h> | |
40 | ||
41 | #include "internal.h" | |
42 | ||
43 | /* | |
c6018e1a | 44 | * Size of right-hand part of input data, in bytes; also the size of the block |
059c2a4d EB |
45 | * cipher's block size and the hash function's output. |
46 | */ | |
47 | #define BLOCKCIPHER_BLOCK_SIZE 16 | |
48 | ||
49 | /* Size of the block cipher key (K_E) in bytes */ | |
50 | #define BLOCKCIPHER_KEY_SIZE 32 | |
51 | ||
52 | /* Size of the hash key (K_H) in bytes */ | |
53 | #define HASH_KEY_SIZE (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE) | |
54 | ||
55 | /* | |
56 | * The specification allows variable-length tweaks, but Linux's crypto API | |
57 | * currently only allows algorithms to support a single length. The "natural" | |
58 | * tweak length for Adiantum is 16, since that fits into one Poly1305 block for | |
59 | * the best performance. But longer tweaks are useful for fscrypt, to avoid | |
60 | * needing to derive per-file keys. So instead we use two blocks, or 32 bytes. | |
61 | */ | |
62 | #define TWEAK_SIZE 32 | |
63 | ||
64 | struct adiantum_instance_ctx { | |
65 | struct crypto_skcipher_spawn streamcipher_spawn; | |
66 | struct crypto_spawn blockcipher_spawn; | |
67 | struct crypto_shash_spawn hash_spawn; | |
68 | }; | |
69 | ||
70 | struct adiantum_tfm_ctx { | |
71 | struct crypto_skcipher *streamcipher; | |
72 | struct crypto_cipher *blockcipher; | |
73 | struct crypto_shash *hash; | |
74 | struct poly1305_key header_hash_key; | |
75 | }; | |
76 | ||
77 | struct adiantum_request_ctx { | |
78 | ||
79 | /* | |
c6018e1a | 80 | * Buffer for right-hand part of data, i.e. |
059c2a4d EB |
81 | * |
82 | * P_L => P_M => C_M => C_R when encrypting, or | |
83 | * C_R => C_M => P_M => P_L when decrypting. | |
84 | * | |
85 | * Also used to build the IV for the stream cipher. | |
86 | */ | |
87 | union { | |
88 | u8 bytes[XCHACHA_IV_SIZE]; | |
89 | __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)]; | |
90 | le128 bignum; /* interpret as element of Z/(2^{128}Z) */ | |
91 | } rbuf; | |
92 | ||
93 | bool enc; /* true if encrypting, false if decrypting */ | |
94 | ||
95 | /* | |
c6018e1a EB |
96 | * The result of the Poly1305 ε-∆U hash function applied to |
97 | * (bulk length, tweak) | |
059c2a4d EB |
98 | */ |
99 | le128 header_hash; | |
100 | ||
101 | /* Sub-requests, must be last */ | |
102 | union { | |
103 | struct shash_desc hash_desc; | |
104 | struct skcipher_request streamcipher_req; | |
105 | } u; | |
106 | }; | |
107 | ||
108 | /* | |
109 | * Given the XChaCha stream key K_S, derive the block cipher key K_E and the | |
110 | * hash key K_H as follows: | |
111 | * | |
112 | * K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191) | |
113 | * | |
114 | * Note that this denotes using bits from the XChaCha keystream, which here we | |
115 | * get indirectly by encrypting a buffer containing all 0's. | |
116 | */ | |
117 | static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key, | |
118 | unsigned int keylen) | |
119 | { | |
120 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
121 | struct { | |
122 | u8 iv[XCHACHA_IV_SIZE]; | |
123 | u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE]; | |
124 | struct scatterlist sg; | |
125 | struct crypto_wait wait; | |
126 | struct skcipher_request req; /* must be last */ | |
127 | } *data; | |
128 | u8 *keyp; | |
129 | int err; | |
130 | ||
131 | /* Set the stream cipher key (K_S) */ | |
132 | crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK); | |
133 | crypto_skcipher_set_flags(tctx->streamcipher, | |
134 | crypto_skcipher_get_flags(tfm) & | |
135 | CRYPTO_TFM_REQ_MASK); | |
136 | err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen); | |
137 | crypto_skcipher_set_flags(tfm, | |
138 | crypto_skcipher_get_flags(tctx->streamcipher) & | |
139 | CRYPTO_TFM_RES_MASK); | |
140 | if (err) | |
141 | return err; | |
142 | ||
143 | /* Derive the subkeys */ | |
144 | data = kzalloc(sizeof(*data) + | |
145 | crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL); | |
146 | if (!data) | |
147 | return -ENOMEM; | |
148 | data->iv[0] = 1; | |
149 | sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys)); | |
150 | crypto_init_wait(&data->wait); | |
151 | skcipher_request_set_tfm(&data->req, tctx->streamcipher); | |
152 | skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP | | |
153 | CRYPTO_TFM_REQ_MAY_BACKLOG, | |
154 | crypto_req_done, &data->wait); | |
155 | skcipher_request_set_crypt(&data->req, &data->sg, &data->sg, | |
156 | sizeof(data->derived_keys), data->iv); | |
157 | err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait); | |
158 | if (err) | |
159 | goto out; | |
160 | keyp = data->derived_keys; | |
161 | ||
162 | /* Set the block cipher key (K_E) */ | |
163 | crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK); | |
164 | crypto_cipher_set_flags(tctx->blockcipher, | |
165 | crypto_skcipher_get_flags(tfm) & | |
166 | CRYPTO_TFM_REQ_MASK); | |
167 | err = crypto_cipher_setkey(tctx->blockcipher, keyp, | |
168 | BLOCKCIPHER_KEY_SIZE); | |
169 | crypto_skcipher_set_flags(tfm, | |
170 | crypto_cipher_get_flags(tctx->blockcipher) & | |
171 | CRYPTO_TFM_RES_MASK); | |
172 | if (err) | |
173 | goto out; | |
174 | keyp += BLOCKCIPHER_KEY_SIZE; | |
175 | ||
176 | /* Set the hash key (K_H) */ | |
177 | poly1305_core_setkey(&tctx->header_hash_key, keyp); | |
178 | keyp += POLY1305_BLOCK_SIZE; | |
179 | ||
180 | crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK); | |
181 | crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) & | |
182 | CRYPTO_TFM_REQ_MASK); | |
183 | err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE); | |
184 | crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) & | |
185 | CRYPTO_TFM_RES_MASK); | |
186 | keyp += NHPOLY1305_KEY_SIZE; | |
187 | WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]); | |
188 | out: | |
189 | kzfree(data); | |
190 | return err; | |
191 | } | |
192 | ||
193 | /* Addition in Z/(2^{128}Z) */ | |
194 | static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2) | |
195 | { | |
196 | u64 x = le64_to_cpu(v1->b); | |
197 | u64 y = le64_to_cpu(v2->b); | |
198 | ||
199 | r->b = cpu_to_le64(x + y); | |
200 | r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) + | |
201 | (x + y < x)); | |
202 | } | |
203 | ||
204 | /* Subtraction in Z/(2^{128}Z) */ | |
205 | static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2) | |
206 | { | |
207 | u64 x = le64_to_cpu(v1->b); | |
208 | u64 y = le64_to_cpu(v2->b); | |
209 | ||
210 | r->b = cpu_to_le64(x - y); | |
211 | r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) - | |
212 | (x - y > x)); | |
213 | } | |
214 | ||
215 | /* | |
c6018e1a EB |
216 | * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the |
217 | * result to rctx->header_hash. This is the calculation | |
059c2a4d | 218 | * |
c6018e1a EB |
219 | * H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T) |
220 | * | |
221 | * from the procedure in section 6.4 of the Adiantum paper. The resulting value | |
222 | * is reused in both the first and second hash steps. Specifically, it's added | |
223 | * to the result of an independently keyed ε-∆U hash function (for equal length | |
224 | * inputs only) taken over the left-hand part (the "bulk") of the message, to | |
225 | * give the overall Adiantum hash of the (tweak, left-hand part) pair. | |
059c2a4d EB |
226 | */ |
227 | static void adiantum_hash_header(struct skcipher_request *req) | |
228 | { | |
229 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
230 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
231 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); | |
232 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; | |
233 | struct { | |
234 | __le64 message_bits; | |
235 | __le64 padding; | |
236 | } header = { | |
237 | .message_bits = cpu_to_le64((u64)bulk_len * 8) | |
238 | }; | |
239 | struct poly1305_state state; | |
240 | ||
241 | poly1305_core_init(&state); | |
242 | ||
243 | BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0); | |
244 | poly1305_core_blocks(&state, &tctx->header_hash_key, | |
245 | &header, sizeof(header) / POLY1305_BLOCK_SIZE); | |
246 | ||
247 | BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0); | |
248 | poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv, | |
249 | TWEAK_SIZE / POLY1305_BLOCK_SIZE); | |
250 | ||
251 | poly1305_core_emit(&state, &rctx->header_hash); | |
252 | } | |
253 | ||
c6018e1a | 254 | /* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */ |
059c2a4d EB |
255 | static int adiantum_hash_message(struct skcipher_request *req, |
256 | struct scatterlist *sgl, le128 *digest) | |
257 | { | |
258 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
259 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
260 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); | |
261 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; | |
262 | struct shash_desc *hash_desc = &rctx->u.hash_desc; | |
263 | struct sg_mapping_iter miter; | |
264 | unsigned int i, n; | |
265 | int err; | |
266 | ||
267 | hash_desc->tfm = tctx->hash; | |
059c2a4d EB |
268 | |
269 | err = crypto_shash_init(hash_desc); | |
270 | if (err) | |
271 | return err; | |
272 | ||
273 | sg_miter_start(&miter, sgl, sg_nents(sgl), | |
274 | SG_MITER_FROM_SG | SG_MITER_ATOMIC); | |
275 | for (i = 0; i < bulk_len; i += n) { | |
276 | sg_miter_next(&miter); | |
277 | n = min_t(unsigned int, miter.length, bulk_len - i); | |
278 | err = crypto_shash_update(hash_desc, miter.addr, n); | |
279 | if (err) | |
280 | break; | |
281 | } | |
282 | sg_miter_stop(&miter); | |
283 | if (err) | |
284 | return err; | |
285 | ||
286 | return crypto_shash_final(hash_desc, (u8 *)digest); | |
287 | } | |
288 | ||
289 | /* Continue Adiantum encryption/decryption after the stream cipher step */ | |
290 | static int adiantum_finish(struct skcipher_request *req) | |
291 | { | |
292 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
293 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
294 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); | |
295 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; | |
296 | le128 digest; | |
297 | int err; | |
298 | ||
299 | /* If decrypting, decrypt C_M with the block cipher to get P_M */ | |
300 | if (!rctx->enc) | |
301 | crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes, | |
302 | rctx->rbuf.bytes); | |
303 | ||
304 | /* | |
305 | * Second hash step | |
306 | * enc: C_R = C_M - H_{K_H}(T, C_L) | |
307 | * dec: P_R = P_M - H_{K_H}(T, P_L) | |
308 | */ | |
309 | err = adiantum_hash_message(req, req->dst, &digest); | |
310 | if (err) | |
311 | return err; | |
312 | le128_add(&digest, &digest, &rctx->header_hash); | |
313 | le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); | |
314 | scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst, | |
315 | bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1); | |
316 | return 0; | |
317 | } | |
318 | ||
319 | static void adiantum_streamcipher_done(struct crypto_async_request *areq, | |
320 | int err) | |
321 | { | |
322 | struct skcipher_request *req = areq->data; | |
323 | ||
324 | if (!err) | |
325 | err = adiantum_finish(req); | |
326 | ||
327 | skcipher_request_complete(req, err); | |
328 | } | |
329 | ||
330 | static int adiantum_crypt(struct skcipher_request *req, bool enc) | |
331 | { | |
332 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
333 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
334 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); | |
335 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; | |
336 | unsigned int stream_len; | |
337 | le128 digest; | |
338 | int err; | |
339 | ||
340 | if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE) | |
341 | return -EINVAL; | |
342 | ||
343 | rctx->enc = enc; | |
344 | ||
345 | /* | |
346 | * First hash step | |
347 | * enc: P_M = P_R + H_{K_H}(T, P_L) | |
348 | * dec: C_M = C_R + H_{K_H}(T, C_L) | |
349 | */ | |
350 | adiantum_hash_header(req); | |
351 | err = adiantum_hash_message(req, req->src, &digest); | |
352 | if (err) | |
353 | return err; | |
354 | le128_add(&digest, &digest, &rctx->header_hash); | |
355 | scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src, | |
356 | bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0); | |
357 | le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); | |
358 | ||
359 | /* If encrypting, encrypt P_M with the block cipher to get C_M */ | |
360 | if (enc) | |
361 | crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes, | |
362 | rctx->rbuf.bytes); | |
363 | ||
364 | /* Initialize the rest of the XChaCha IV (first part is C_M) */ | |
365 | BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16); | |
366 | BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); /* nonce || stream position */ | |
367 | rctx->rbuf.words[4] = cpu_to_le32(1); | |
368 | rctx->rbuf.words[5] = 0; | |
369 | rctx->rbuf.words[6] = 0; | |
370 | rctx->rbuf.words[7] = 0; | |
371 | ||
372 | /* | |
373 | * XChaCha needs to be done on all the data except the last 16 bytes; | |
374 | * for disk encryption that usually means 4080 or 496 bytes. But ChaCha | |
375 | * implementations tend to be most efficient when passed a whole number | |
376 | * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes. | |
377 | * And here it doesn't matter whether the last 16 bytes are written to, | |
378 | * as the second hash step will overwrite them. Thus, round the XChaCha | |
379 | * length up to the next 64-byte boundary if possible. | |
380 | */ | |
381 | stream_len = bulk_len; | |
382 | if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen) | |
383 | stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE); | |
384 | ||
385 | skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher); | |
386 | skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src, | |
387 | req->dst, stream_len, &rctx->rbuf); | |
388 | skcipher_request_set_callback(&rctx->u.streamcipher_req, | |
389 | req->base.flags, | |
390 | adiantum_streamcipher_done, req); | |
391 | return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?: | |
392 | adiantum_finish(req); | |
393 | } | |
394 | ||
395 | static int adiantum_encrypt(struct skcipher_request *req) | |
396 | { | |
397 | return adiantum_crypt(req, true); | |
398 | } | |
399 | ||
400 | static int adiantum_decrypt(struct skcipher_request *req) | |
401 | { | |
402 | return adiantum_crypt(req, false); | |
403 | } | |
404 | ||
405 | static int adiantum_init_tfm(struct crypto_skcipher *tfm) | |
406 | { | |
407 | struct skcipher_instance *inst = skcipher_alg_instance(tfm); | |
408 | struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); | |
409 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
410 | struct crypto_skcipher *streamcipher; | |
411 | struct crypto_cipher *blockcipher; | |
412 | struct crypto_shash *hash; | |
413 | unsigned int subreq_size; | |
414 | int err; | |
415 | ||
416 | streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn); | |
417 | if (IS_ERR(streamcipher)) | |
418 | return PTR_ERR(streamcipher); | |
419 | ||
420 | blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn); | |
421 | if (IS_ERR(blockcipher)) { | |
422 | err = PTR_ERR(blockcipher); | |
423 | goto err_free_streamcipher; | |
424 | } | |
425 | ||
426 | hash = crypto_spawn_shash(&ictx->hash_spawn); | |
427 | if (IS_ERR(hash)) { | |
428 | err = PTR_ERR(hash); | |
429 | goto err_free_blockcipher; | |
430 | } | |
431 | ||
432 | tctx->streamcipher = streamcipher; | |
433 | tctx->blockcipher = blockcipher; | |
434 | tctx->hash = hash; | |
435 | ||
436 | BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) != | |
437 | sizeof(struct adiantum_request_ctx)); | |
438 | subreq_size = max(FIELD_SIZEOF(struct adiantum_request_ctx, | |
439 | u.hash_desc) + | |
440 | crypto_shash_descsize(hash), | |
441 | FIELD_SIZEOF(struct adiantum_request_ctx, | |
442 | u.streamcipher_req) + | |
443 | crypto_skcipher_reqsize(streamcipher)); | |
444 | ||
445 | crypto_skcipher_set_reqsize(tfm, | |
446 | offsetof(struct adiantum_request_ctx, u) + | |
447 | subreq_size); | |
448 | return 0; | |
449 | ||
450 | err_free_blockcipher: | |
451 | crypto_free_cipher(blockcipher); | |
452 | err_free_streamcipher: | |
453 | crypto_free_skcipher(streamcipher); | |
454 | return err; | |
455 | } | |
456 | ||
457 | static void adiantum_exit_tfm(struct crypto_skcipher *tfm) | |
458 | { | |
459 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); | |
460 | ||
461 | crypto_free_skcipher(tctx->streamcipher); | |
462 | crypto_free_cipher(tctx->blockcipher); | |
463 | crypto_free_shash(tctx->hash); | |
464 | } | |
465 | ||
466 | static void adiantum_free_instance(struct skcipher_instance *inst) | |
467 | { | |
468 | struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); | |
469 | ||
470 | crypto_drop_skcipher(&ictx->streamcipher_spawn); | |
471 | crypto_drop_spawn(&ictx->blockcipher_spawn); | |
472 | crypto_drop_shash(&ictx->hash_spawn); | |
473 | kfree(inst); | |
474 | } | |
475 | ||
476 | /* | |
477 | * Check for a supported set of inner algorithms. | |
478 | * See the comment at the beginning of this file. | |
479 | */ | |
480 | static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg, | |
481 | struct crypto_alg *blockcipher_alg, | |
482 | struct shash_alg *hash_alg) | |
483 | { | |
484 | if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 && | |
485 | strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0) | |
486 | return false; | |
487 | ||
488 | if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE || | |
489 | blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE) | |
490 | return false; | |
491 | if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE) | |
492 | return false; | |
493 | ||
494 | if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0) | |
495 | return false; | |
496 | ||
497 | return true; | |
498 | } | |
499 | ||
500 | static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb) | |
501 | { | |
502 | struct crypto_attr_type *algt; | |
503 | const char *streamcipher_name; | |
504 | const char *blockcipher_name; | |
505 | const char *nhpoly1305_name; | |
506 | struct skcipher_instance *inst; | |
507 | struct adiantum_instance_ctx *ictx; | |
508 | struct skcipher_alg *streamcipher_alg; | |
509 | struct crypto_alg *blockcipher_alg; | |
510 | struct crypto_alg *_hash_alg; | |
511 | struct shash_alg *hash_alg; | |
512 | int err; | |
513 | ||
514 | algt = crypto_get_attr_type(tb); | |
515 | if (IS_ERR(algt)) | |
516 | return PTR_ERR(algt); | |
517 | ||
518 | if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask) | |
519 | return -EINVAL; | |
520 | ||
521 | streamcipher_name = crypto_attr_alg_name(tb[1]); | |
522 | if (IS_ERR(streamcipher_name)) | |
523 | return PTR_ERR(streamcipher_name); | |
524 | ||
525 | blockcipher_name = crypto_attr_alg_name(tb[2]); | |
526 | if (IS_ERR(blockcipher_name)) | |
527 | return PTR_ERR(blockcipher_name); | |
528 | ||
529 | nhpoly1305_name = crypto_attr_alg_name(tb[3]); | |
530 | if (nhpoly1305_name == ERR_PTR(-ENOENT)) | |
531 | nhpoly1305_name = "nhpoly1305"; | |
532 | if (IS_ERR(nhpoly1305_name)) | |
533 | return PTR_ERR(nhpoly1305_name); | |
534 | ||
535 | inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL); | |
536 | if (!inst) | |
537 | return -ENOMEM; | |
538 | ictx = skcipher_instance_ctx(inst); | |
539 | ||
540 | /* Stream cipher, e.g. "xchacha12" */ | |
6db43410 EB |
541 | crypto_set_skcipher_spawn(&ictx->streamcipher_spawn, |
542 | skcipher_crypto_instance(inst)); | |
059c2a4d EB |
543 | err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name, |
544 | 0, crypto_requires_sync(algt->type, | |
545 | algt->mask)); | |
546 | if (err) | |
547 | goto out_free_inst; | |
548 | streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn); | |
549 | ||
550 | /* Block cipher, e.g. "aes" */ | |
6db43410 EB |
551 | crypto_set_spawn(&ictx->blockcipher_spawn, |
552 | skcipher_crypto_instance(inst)); | |
059c2a4d EB |
553 | err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name, |
554 | CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK); | |
555 | if (err) | |
556 | goto out_drop_streamcipher; | |
557 | blockcipher_alg = ictx->blockcipher_spawn.alg; | |
558 | ||
c6018e1a | 559 | /* NHPoly1305 ε-∆U hash function */ |
059c2a4d EB |
560 | _hash_alg = crypto_alg_mod_lookup(nhpoly1305_name, |
561 | CRYPTO_ALG_TYPE_SHASH, | |
562 | CRYPTO_ALG_TYPE_MASK); | |
563 | if (IS_ERR(_hash_alg)) { | |
564 | err = PTR_ERR(_hash_alg); | |
565 | goto out_drop_blockcipher; | |
566 | } | |
567 | hash_alg = __crypto_shash_alg(_hash_alg); | |
568 | err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg, | |
569 | skcipher_crypto_instance(inst)); | |
00c9fe37 EB |
570 | if (err) |
571 | goto out_put_hash; | |
059c2a4d EB |
572 | |
573 | /* Check the set of algorithms */ | |
574 | if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg, | |
575 | hash_alg)) { | |
576 | pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n", | |
577 | streamcipher_alg->base.cra_name, | |
578 | blockcipher_alg->cra_name, hash_alg->base.cra_name); | |
579 | err = -EINVAL; | |
580 | goto out_drop_hash; | |
581 | } | |
582 | ||
583 | /* Instance fields */ | |
584 | ||
585 | err = -ENAMETOOLONG; | |
586 | if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, | |
587 | "adiantum(%s,%s)", streamcipher_alg->base.cra_name, | |
588 | blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME) | |
589 | goto out_drop_hash; | |
590 | if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, | |
591 | "adiantum(%s,%s,%s)", | |
592 | streamcipher_alg->base.cra_driver_name, | |
593 | blockcipher_alg->cra_driver_name, | |
594 | hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) | |
595 | goto out_drop_hash; | |
596 | ||
b299362e EB |
597 | inst->alg.base.cra_flags = streamcipher_alg->base.cra_flags & |
598 | CRYPTO_ALG_ASYNC; | |
059c2a4d EB |
599 | inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE; |
600 | inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx); | |
601 | inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask | | |
602 | hash_alg->base.cra_alignmask; | |
603 | /* | |
604 | * The block cipher is only invoked once per message, so for long | |
605 | * messages (e.g. sectors for disk encryption) its performance doesn't | |
606 | * matter as much as that of the stream cipher and hash function. Thus, | |
607 | * weigh the block cipher's ->cra_priority less. | |
608 | */ | |
609 | inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority + | |
610 | 2 * hash_alg->base.cra_priority + | |
611 | blockcipher_alg->cra_priority) / 7; | |
612 | ||
613 | inst->alg.setkey = adiantum_setkey; | |
614 | inst->alg.encrypt = adiantum_encrypt; | |
615 | inst->alg.decrypt = adiantum_decrypt; | |
616 | inst->alg.init = adiantum_init_tfm; | |
617 | inst->alg.exit = adiantum_exit_tfm; | |
618 | inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg); | |
619 | inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg); | |
620 | inst->alg.ivsize = TWEAK_SIZE; | |
621 | ||
622 | inst->free = adiantum_free_instance; | |
623 | ||
624 | err = skcipher_register_instance(tmpl, inst); | |
625 | if (err) | |
626 | goto out_drop_hash; | |
627 | ||
00c9fe37 | 628 | crypto_mod_put(_hash_alg); |
059c2a4d EB |
629 | return 0; |
630 | ||
631 | out_drop_hash: | |
632 | crypto_drop_shash(&ictx->hash_spawn); | |
00c9fe37 EB |
633 | out_put_hash: |
634 | crypto_mod_put(_hash_alg); | |
059c2a4d EB |
635 | out_drop_blockcipher: |
636 | crypto_drop_spawn(&ictx->blockcipher_spawn); | |
637 | out_drop_streamcipher: | |
638 | crypto_drop_skcipher(&ictx->streamcipher_spawn); | |
639 | out_free_inst: | |
640 | kfree(inst); | |
641 | return err; | |
642 | } | |
643 | ||
644 | /* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */ | |
645 | static struct crypto_template adiantum_tmpl = { | |
646 | .name = "adiantum", | |
647 | .create = adiantum_create, | |
648 | .module = THIS_MODULE, | |
649 | }; | |
650 | ||
651 | static int __init adiantum_module_init(void) | |
652 | { | |
653 | return crypto_register_template(&adiantum_tmpl); | |
654 | } | |
655 | ||
656 | static void __exit adiantum_module_exit(void) | |
657 | { | |
658 | crypto_unregister_template(&adiantum_tmpl); | |
659 | } | |
660 | ||
c4741b23 | 661 | subsys_initcall(adiantum_module_init); |
059c2a4d EB |
662 | module_exit(adiantum_module_exit); |
663 | ||
664 | MODULE_DESCRIPTION("Adiantum length-preserving encryption mode"); | |
665 | MODULE_LICENSE("GPL v2"); | |
666 | MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>"); | |
667 | MODULE_ALIAS_CRYPTO("adiantum"); |