crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/xts.h"
  23
  24 #include <nettle/nettle-types.h>
  25 #include <nettle/aes.h>
  26 #include <nettle/des.h>
  27 #include <nettle/cbc.h>
  28 #include <nettle/cast128.h>
  29 #include <nettle/serpent.h>
  30 #include <nettle/twofish.h>
  31
  32 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  33                                                size_t length,
  34                                                uint8_t *dst,
  35                                                const uint8_t *src);
  36
  37 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  38 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  39 typedef void *       cipher_ctx_t;
  40 typedef unsigned     cipher_length_t;
  41
  42 #define cast5_set_key cast128_set_key
  43 #else
  44 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  45 typedef const void * cipher_ctx_t;
  46 typedef size_t       cipher_length_t;
  47 #endif
  48
  49 typedef struct QCryptoNettleAES {
  50     struct aes_ctx enc;
  51     struct aes_ctx dec;
  52 } QCryptoNettleAES;
  53
  54 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  55                                uint8_t *dst, const uint8_t *src)
  56 {
  57     const QCryptoNettleAES *aesctx = ctx;
  58     aes_encrypt(&aesctx->enc, length, dst, src);
  59 }
  60
  61 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  62                                uint8_t *dst, const uint8_t *src)
  63 {
  64     const QCryptoNettleAES *aesctx = ctx;
  65     aes_decrypt(&aesctx->dec, length, dst, src);
  66 }
  67
  68 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  69                                uint8_t *dst, const uint8_t *src)
  70 {
  71     des_encrypt(ctx, length, dst, src);
  72 }
  73
  74 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  75                                uint8_t *dst, const uint8_t *src)
  76 {
  77     des_decrypt(ctx, length, dst, src);
  78 }
  79
  80 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  81                                    uint8_t *dst, const uint8_t *src)
  82 {
  83     cast128_encrypt(ctx, length, dst, src);
  84 }
  85
  86 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  87                                    uint8_t *dst, const uint8_t *src)
  88 {
  89     cast128_decrypt(ctx, length, dst, src);
  90 }
  91
  92 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  93                                    uint8_t *dst, const uint8_t *src)
  94 {
  95     serpent_encrypt(ctx, length, dst, src);
  96 }
  97
  98 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  99                                    uint8_t *dst, const uint8_t *src)
 100 {
 101     serpent_decrypt(ctx, length, dst, src);
 102 }
 103
 104 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 105                                    uint8_t *dst, const uint8_t *src)
 106 {
 107     twofish_encrypt(ctx, length, dst, src);
 108 }
 109
 110 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 111                                    uint8_t *dst, const uint8_t *src)
 112 {
 113     twofish_decrypt(ctx, length, dst, src);
 114 }
 115
 116 static void aes_encrypt_wrapper(const void *ctx, size_t length,
 117                                 uint8_t *dst, const uint8_t *src)
 118 {
 119     const QCryptoNettleAES *aesctx = ctx;
 120     aes_encrypt(&aesctx->enc, length, dst, src);
 121 }
 122
 123 static void aes_decrypt_wrapper(const void *ctx, size_t length,
 124                                 uint8_t *dst, const uint8_t *src)
 125 {
 126     const QCryptoNettleAES *aesctx = ctx;
 127     aes_decrypt(&aesctx->dec, length, dst, src);
 128 }
 129
 130 static void des_encrypt_wrapper(const void *ctx, size_t length,
 131                                 uint8_t *dst, const uint8_t *src)
 132 {
 133     des_encrypt(ctx, length, dst, src);
 134 }
 135
 136 static void des_decrypt_wrapper(const void *ctx, size_t length,
 137                                 uint8_t *dst, const uint8_t *src)
 138 {
 139     des_decrypt(ctx, length, dst, src);
 140 }
 141
 142 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 143                                     uint8_t *dst, const uint8_t *src)
 144 {
 145     cast128_encrypt(ctx, length, dst, src);
 146 }
 147
 148 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 149                                     uint8_t *dst, const uint8_t *src)
 150 {
 151     cast128_decrypt(ctx, length, dst, src);
 152 }
 153
 154 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 155                                     uint8_t *dst, const uint8_t *src)
 156 {
 157     serpent_encrypt(ctx, length, dst, src);
 158 }
 159
 160 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 161                                     uint8_t *dst, const uint8_t *src)
 162 {
 163     serpent_decrypt(ctx, length, dst, src);
 164 }
 165
 166 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 167                                     uint8_t *dst, const uint8_t *src)
 168 {
 169     twofish_encrypt(ctx, length, dst, src);
 170 }
 171
 172 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 173                                     uint8_t *dst, const uint8_t *src)
 174 {
 175     twofish_decrypt(ctx, length, dst, src);
 176 }
 177
 178 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 179 struct QCryptoCipherNettle {
 180     /* Primary cipher context for all modes */
 181     void *ctx;
 182     /* Second cipher context for XTS mode only */
 183     void *ctx_tweak;
 184     /* Cipher callbacks for both contexts */
 185     QCryptoCipherNettleFuncNative alg_encrypt_native;
 186     QCryptoCipherNettleFuncNative alg_decrypt_native;
 187     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 188     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 189
 190     uint8_t *iv;
 191     size_t blocksize;
 192 };
 193
 194 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
 195                              QCryptoCipherMode mode)
 196 {
 197     switch (alg) {
 198     case QCRYPTO_CIPHER_ALG_DES_RFB:
 199     case QCRYPTO_CIPHER_ALG_AES_128:
 200     case QCRYPTO_CIPHER_ALG_AES_192:
 201     case QCRYPTO_CIPHER_ALG_AES_256:
 202     case QCRYPTO_CIPHER_ALG_CAST5_128:
 203     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 204     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 205     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 206     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 207     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 208     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 209         break;
 210     default:
 211         return false;
 212     }
 213
 214     switch (mode) {
 215     case QCRYPTO_CIPHER_MODE_ECB:
 216     case QCRYPTO_CIPHER_MODE_CBC:
 217     case QCRYPTO_CIPHER_MODE_XTS:
 218     case QCRYPTO_CIPHER_MODE_CTR:
 219         return true;
 220     default:
 221         return false;
 222     }
 223 }
 224
 225
 226 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
 227                                   QCryptoCipherMode mode,
 228                                   const uint8_t *key, size_t nkey,
 229                                   Error **errp)
 230 {
 231     QCryptoCipher *cipher;
 232     QCryptoCipherNettle *ctx;
 233     uint8_t *rfbkey;
 234
 235     switch (mode) {
 236     case QCRYPTO_CIPHER_MODE_ECB:
 237     case QCRYPTO_CIPHER_MODE_CBC:
 238     case QCRYPTO_CIPHER_MODE_XTS:
 239         break;
 240     default:
 241         error_setg(errp, "Unsupported cipher mode %s",
 242                    QCryptoCipherMode_lookup[mode]);
 243         return NULL;
 244     }
 245
 246     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 247         return NULL;
 248     }
 249
 250     cipher = g_new0(QCryptoCipher, 1);
 251     cipher->alg = alg;
 252     cipher->mode = mode;
 253
 254     ctx = g_new0(QCryptoCipherNettle, 1);
 255
 256     switch (alg) {
 257     case QCRYPTO_CIPHER_ALG_DES_RFB:
 258         ctx->ctx = g_new0(struct des_ctx, 1);
 259         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 260         des_set_key(ctx->ctx, rfbkey);
 261         g_free(rfbkey);
 262
 263         ctx->alg_encrypt_native = des_encrypt_native;
 264         ctx->alg_decrypt_native = des_decrypt_native;
 265         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 266         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 267
 268         ctx->blocksize = DES_BLOCK_SIZE;
 269         break;
 270
 271     case QCRYPTO_CIPHER_ALG_AES_128:
 272     case QCRYPTO_CIPHER_ALG_AES_192:
 273     case QCRYPTO_CIPHER_ALG_AES_256:
 274         ctx->ctx = g_new0(QCryptoNettleAES, 1);
 275
 276         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 277             ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
 278
 279             nkey /= 2;
 280             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 281                                 nkey, key);
 282             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 283                                 nkey, key);
 284
 285             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
 286                                 nkey, key + nkey);
 287             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
 288                                 nkey, key + nkey);
 289         } else {
 290             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 291                                 nkey, key);
 292             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 293                                 nkey, key);
 294         }
 295
 296         ctx->alg_encrypt_native = aes_encrypt_native;
 297         ctx->alg_decrypt_native = aes_decrypt_native;
 298         ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
 299         ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
 300
 301         ctx->blocksize = AES_BLOCK_SIZE;
 302         break;
 303
 304     case QCRYPTO_CIPHER_ALG_CAST5_128:
 305         ctx->ctx = g_new0(struct cast128_ctx, 1);
 306
 307         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 308             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 309
 310             nkey /= 2;
 311             cast5_set_key(ctx->ctx, nkey, key);
 312             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 313         } else {
 314             cast5_set_key(ctx->ctx, nkey, key);
 315         }
 316
 317         ctx->alg_encrypt_native = cast128_encrypt_native;
 318         ctx->alg_decrypt_native = cast128_decrypt_native;
 319         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 320         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 321
 322         ctx->blocksize = CAST128_BLOCK_SIZE;
 323         break;
 324
 325     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 326     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 327     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 328         ctx->ctx = g_new0(struct serpent_ctx, 1);
 329
 330         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 331             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 332
 333             nkey /= 2;
 334             serpent_set_key(ctx->ctx, nkey, key);
 335             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 336         } else {
 337             serpent_set_key(ctx->ctx, nkey, key);
 338         }
 339
 340         ctx->alg_encrypt_native = serpent_encrypt_native;
 341         ctx->alg_decrypt_native = serpent_decrypt_native;
 342         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 343         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 344
 345         ctx->blocksize = SERPENT_BLOCK_SIZE;
 346         break;
 347
 348     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 349     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 350     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 351         ctx->ctx = g_new0(struct twofish_ctx, 1);
 352
 353         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 354             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 355
 356             nkey /= 2;
 357             twofish_set_key(ctx->ctx, nkey, key);
 358             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 359         } else {
 360             twofish_set_key(ctx->ctx, nkey, key);
 361         }
 362
 363         ctx->alg_encrypt_native = twofish_encrypt_native;
 364         ctx->alg_decrypt_native = twofish_decrypt_native;
 365         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 366         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 367
 368         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 369         break;
 370
 371     default:
 372         error_setg(errp, "Unsupported cipher algorithm %s",
 373                    QCryptoCipherAlgorithm_lookup[alg]);
 374         goto error;
 375     }
 376
 377     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 378         ctx->blocksize != XTS_BLOCK_SIZE) {
 379         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 380                    ctx->blocksize, XTS_BLOCK_SIZE);
 381         goto error;
 382     }
 383
 384     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 385     cipher->opaque = ctx;
 386
 387     return cipher;
 388
 389  error:
 390     g_free(cipher);
 391     g_free(ctx);
 392     return NULL;
 393 }
 394
 395
 396 void qcrypto_cipher_free(QCryptoCipher *cipher)
 397 {
 398     QCryptoCipherNettle *ctx;
 399
 400     if (!cipher) {
 401         return;
 402     }
 403
 404     ctx = cipher->opaque;
 405     g_free(ctx->iv);
 406     g_free(ctx->ctx);
 407     g_free(ctx->ctx_tweak);
 408     g_free(ctx);
 409     g_free(cipher);
 410 }
 411
 412
 413 int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 414                            const void *in,
 415                            void *out,
 416                            size_t len,
 417                            Error **errp)
 418 {
 419     QCryptoCipherNettle *ctx = cipher->opaque;
 420
 421     if (len % ctx->blocksize) {
 422         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 423                    len, ctx->blocksize);
 424         return -1;
 425     }
 426
 427     switch (cipher->mode) {
 428     case QCRYPTO_CIPHER_MODE_ECB:
 429         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 430         break;
 431
 432     case QCRYPTO_CIPHER_MODE_CBC:
 433         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 434                     ctx->blocksize, ctx->iv,
 435                     len, out, in);
 436         break;
 437
 438     case QCRYPTO_CIPHER_MODE_XTS:
 439         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 440                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 441                     ctx->iv, len, out, in);
 442         break;
 443
 444     default:
 445         error_setg(errp, "Unsupported cipher mode %s",
 446                    QCryptoCipherMode_lookup[cipher->mode]);
 447         return -1;
 448     }
 449     return 0;
 450 }
 451
 452
 453 int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 454                            const void *in,
 455                            void *out,
 456                            size_t len,
 457                            Error **errp)
 458 {
 459     QCryptoCipherNettle *ctx = cipher->opaque;
 460
 461     if (len % ctx->blocksize) {
 462         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 463                    len, ctx->blocksize);
 464         return -1;
 465     }
 466
 467     switch (cipher->mode) {
 468     case QCRYPTO_CIPHER_MODE_ECB:
 469         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 470         break;
 471
 472     case QCRYPTO_CIPHER_MODE_CBC:
 473         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 474                     ctx->blocksize, ctx->iv,
 475                     len, out, in);
 476         break;
 477
 478     case QCRYPTO_CIPHER_MODE_XTS:
 479         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 480                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 481                     ctx->iv, len, out, in);
 482         break;
 483
 484     default:
 485         error_setg(errp, "Unsupported cipher mode %s",
 486                    QCryptoCipherMode_lookup[cipher->mode]);
 487         return -1;
 488     }
 489     return 0;
 490 }
 491
 492 int qcrypto_cipher_setiv(QCryptoCipher *cipher,
 493                          const uint8_t *iv, size_t niv,
 494                          Error **errp)
 495 {
 496     QCryptoCipherNettle *ctx = cipher->opaque;
 497     if (niv != ctx->blocksize) {
 498         error_setg(errp, "Expected IV size %zu not %zu",
 499                    ctx->blocksize, niv);
 500         return -1;
 501     }
 502     memcpy(ctx->iv, iv, niv);
 503     return 0;
 504 }