1 /* LRW: as defined by Cyril Guyot in
2 * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf
4 * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org>
7 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the Free
11 * Software Foundation; either version 2 of the License, or (at your option)
14 /* This implementation is checked against the test vectors in the above
15 * document and by a test vector provided by Ken Buchanan at
16 * http://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html
18 * The test vectors are included in the testing module tcrypt.[ch] */
20 #include <crypto/internal/skcipher.h>
21 #include <crypto/scatterwalk.h>
22 #include <linux/err.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/module.h>
26 #include <linux/scatterlist.h>
27 #include <linux/slab.h>
29 #include <crypto/b128ops.h>
30 #include <crypto/gf128mul.h>
31 #include <crypto/lrw.h>
33 #define LRW_BUFFER_SIZE 128u
36 struct crypto_skcipher
*child
;
37 struct lrw_table_ctx table
;
41 be128 buf
[LRW_BUFFER_SIZE
/ sizeof(be128
)];
47 struct scatterlist srcbuf
[2];
48 struct scatterlist dstbuf
[2];
49 struct scatterlist
*src
;
50 struct scatterlist
*dst
;
54 struct skcipher_request subreq
;
57 static inline void setbit128_bbe(void *b
, int bit
)
59 __set_bit(bit
^ (0x80 -
68 int lrw_init_table(struct lrw_table_ctx
*ctx
, const u8
*tweak
)
74 gf128mul_free_64k(ctx
->table
);
76 /* initialize multiplication table for Key2 */
77 ctx
->table
= gf128mul_init_64k_bbe((be128
*)tweak
);
81 /* initialize optimization table */
82 for (i
= 0; i
< 128; i
++) {
83 setbit128_bbe(&tmp
, i
);
85 gf128mul_64k_bbe(&ctx
->mulinc
[i
], ctx
->table
);
90 EXPORT_SYMBOL_GPL(lrw_init_table
);
92 void lrw_free_table(struct lrw_table_ctx
*ctx
)
95 gf128mul_free_64k(ctx
->table
);
97 EXPORT_SYMBOL_GPL(lrw_free_table
);
99 static int setkey(struct crypto_skcipher
*parent
, const u8
*key
,
102 struct priv
*ctx
= crypto_skcipher_ctx(parent
);
103 struct crypto_skcipher
*child
= ctx
->child
;
104 int err
, bsize
= LRW_BLOCK_SIZE
;
105 const u8
*tweak
= key
+ keylen
- bsize
;
107 crypto_skcipher_clear_flags(child
, CRYPTO_TFM_REQ_MASK
);
108 crypto_skcipher_set_flags(child
, crypto_skcipher_get_flags(parent
) &
109 CRYPTO_TFM_REQ_MASK
);
110 err
= crypto_skcipher_setkey(child
, key
, keylen
- bsize
);
111 crypto_skcipher_set_flags(parent
, crypto_skcipher_get_flags(child
) &
112 CRYPTO_TFM_RES_MASK
);
116 return lrw_init_table(&ctx
->table
, tweak
);
119 static inline void inc(be128
*iv
)
121 be64_add_cpu(&iv
->b
, 1);
123 be64_add_cpu(&iv
->a
, 1);
126 /* this returns the number of consequative 1 bits starting
127 * from the right, get_index128(00 00 00 00 00 00 ... 00 00 10 FB) = 2 */
128 static inline int get_index128(be128
*block
)
131 __be32
*p
= (__be32
*) block
;
133 for (p
+= 3, x
= 0; x
< 128; p
--, x
+= 32) {
134 u32 val
= be32_to_cpup(p
);
143 * If we get here, then x == 128 and we are incrementing the counter
144 * from all ones to all zeros. This means we must return index 127, i.e.
145 * the one corresponding to key2*{ 1,...,1 }.
150 static int post_crypt(struct skcipher_request
*req
)
152 struct rctx
*rctx
= skcipher_request_ctx(req
);
153 be128
*buf
= rctx
->ext
?: rctx
->buf
;
154 struct skcipher_request
*subreq
;
155 const int bs
= LRW_BLOCK_SIZE
;
156 struct skcipher_walk w
;
157 struct scatterlist
*sg
;
161 subreq
= &rctx
->subreq
;
162 err
= skcipher_walk_virt(&w
, subreq
, false);
165 unsigned int avail
= w
.nbytes
;
168 wdst
= w
.dst
.virt
.addr
;
171 be128_xor(wdst
, buf
++, wdst
);
173 } while ((avail
-= bs
) >= bs
);
175 err
= skcipher_walk_done(&w
, avail
);
178 rctx
->left
-= subreq
->cryptlen
;
180 if (err
|| !rctx
->left
)
183 rctx
->dst
= rctx
->dstbuf
;
185 scatterwalk_done(&w
.out
, 0, 1);
187 offset
= w
.out
.offset
;
189 if (rctx
->dst
!= sg
) {
191 sg_unmark_end(rctx
->dst
);
192 scatterwalk_crypto_chain(rctx
->dst
, sg_next(sg
), 0, 2);
194 rctx
->dst
[0].length
-= offset
- sg
->offset
;
195 rctx
->dst
[0].offset
= offset
;
201 static int pre_crypt(struct skcipher_request
*req
)
203 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
204 struct rctx
*rctx
= skcipher_request_ctx(req
);
205 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
206 be128
*buf
= rctx
->ext
?: rctx
->buf
;
207 struct skcipher_request
*subreq
;
208 const int bs
= LRW_BLOCK_SIZE
;
209 struct skcipher_walk w
;
210 struct scatterlist
*sg
;
217 subreq
= &rctx
->subreq
;
218 skcipher_request_set_tfm(subreq
, tfm
);
220 cryptlen
= subreq
->cryptlen
;
221 more
= rctx
->left
> cryptlen
;
223 cryptlen
= rctx
->left
;
225 skcipher_request_set_crypt(subreq
, rctx
->src
, rctx
->dst
,
228 err
= skcipher_walk_virt(&w
, subreq
, false);
232 unsigned int avail
= w
.nbytes
;
236 wsrc
= w
.src
.virt
.addr
;
237 wdst
= w
.dst
.virt
.addr
;
241 be128_xor(wdst
++, &rctx
->t
, wsrc
++);
243 /* T <- I*Key2, using the optimization
244 * discussed in the specification */
245 be128_xor(&rctx
->t
, &rctx
->t
,
246 &ctx
->table
.mulinc
[get_index128(iv
)]);
248 } while ((avail
-= bs
) >= bs
);
250 err
= skcipher_walk_done(&w
, avail
);
253 skcipher_request_set_tfm(subreq
, ctx
->child
);
254 skcipher_request_set_crypt(subreq
, rctx
->dst
, rctx
->dst
,
260 rctx
->src
= rctx
->srcbuf
;
262 scatterwalk_done(&w
.in
, 0, 1);
264 offset
= w
.in
.offset
;
266 if (rctx
->src
!= sg
) {
268 sg_unmark_end(rctx
->src
);
269 scatterwalk_crypto_chain(rctx
->src
, sg_next(sg
), 0, 2);
271 rctx
->src
[0].length
-= offset
- sg
->offset
;
272 rctx
->src
[0].offset
= offset
;
278 static int init_crypt(struct skcipher_request
*req
, crypto_completion_t done
)
280 struct priv
*ctx
= crypto_skcipher_ctx(crypto_skcipher_reqtfm(req
));
281 struct rctx
*rctx
= skcipher_request_ctx(req
);
282 struct skcipher_request
*subreq
;
285 subreq
= &rctx
->subreq
;
286 skcipher_request_set_callback(subreq
, req
->base
.flags
, done
, req
);
288 gfp
= req
->base
.flags
& CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
292 subreq
->cryptlen
= LRW_BUFFER_SIZE
;
293 if (req
->cryptlen
> LRW_BUFFER_SIZE
) {
294 unsigned int n
= min(req
->cryptlen
, (unsigned int)PAGE_SIZE
);
296 rctx
->ext
= kmalloc(n
, gfp
);
298 subreq
->cryptlen
= n
;
301 rctx
->src
= req
->src
;
302 rctx
->dst
= req
->dst
;
303 rctx
->left
= req
->cryptlen
;
305 /* calculate first value of T */
306 memcpy(&rctx
->t
, req
->iv
, sizeof(rctx
->t
));
309 gf128mul_64k_bbe(&rctx
->t
, ctx
->table
.table
);
314 static void exit_crypt(struct skcipher_request
*req
)
316 struct rctx
*rctx
= skcipher_request_ctx(req
);
324 static int do_encrypt(struct skcipher_request
*req
, int err
)
326 struct rctx
*rctx
= skcipher_request_ctx(req
);
327 struct skcipher_request
*subreq
;
329 subreq
= &rctx
->subreq
;
331 while (!err
&& rctx
->left
) {
332 err
= pre_crypt(req
) ?:
333 crypto_skcipher_encrypt(subreq
) ?:
336 if (err
== -EINPROGRESS
|| err
== -EBUSY
)
344 static void encrypt_done(struct crypto_async_request
*areq
, int err
)
346 struct skcipher_request
*req
= areq
->data
;
347 struct skcipher_request
*subreq
;
350 rctx
= skcipher_request_ctx(req
);
352 if (err
== -EINPROGRESS
) {
353 if (rctx
->left
!= req
->cryptlen
)
358 subreq
= &rctx
->subreq
;
359 subreq
->base
.flags
&= CRYPTO_TFM_REQ_MAY_BACKLOG
;
361 err
= do_encrypt(req
, err
?: post_crypt(req
));
366 skcipher_request_complete(req
, err
);
369 static int encrypt(struct skcipher_request
*req
)
371 return do_encrypt(req
, init_crypt(req
, encrypt_done
));
374 static int do_decrypt(struct skcipher_request
*req
, int err
)
376 struct rctx
*rctx
= skcipher_request_ctx(req
);
377 struct skcipher_request
*subreq
;
379 subreq
= &rctx
->subreq
;
381 while (!err
&& rctx
->left
) {
382 err
= pre_crypt(req
) ?:
383 crypto_skcipher_decrypt(subreq
) ?:
386 if (err
== -EINPROGRESS
|| err
== -EBUSY
)
394 static void decrypt_done(struct crypto_async_request
*areq
, int err
)
396 struct skcipher_request
*req
= areq
->data
;
397 struct skcipher_request
*subreq
;
400 rctx
= skcipher_request_ctx(req
);
402 if (err
== -EINPROGRESS
) {
403 if (rctx
->left
!= req
->cryptlen
)
408 subreq
= &rctx
->subreq
;
409 subreq
->base
.flags
&= CRYPTO_TFM_REQ_MAY_BACKLOG
;
411 err
= do_decrypt(req
, err
?: post_crypt(req
));
416 skcipher_request_complete(req
, err
);
419 static int decrypt(struct skcipher_request
*req
)
421 return do_decrypt(req
, init_crypt(req
, decrypt_done
));
424 int lrw_crypt(struct blkcipher_desc
*desc
, struct scatterlist
*sdst
,
425 struct scatterlist
*ssrc
, unsigned int nbytes
,
426 struct lrw_crypt_req
*req
)
428 const unsigned int bsize
= LRW_BLOCK_SIZE
;
429 const unsigned int max_blks
= req
->tbuflen
/ bsize
;
430 struct lrw_table_ctx
*ctx
= req
->table_ctx
;
431 struct blkcipher_walk walk
;
432 unsigned int nblocks
;
433 be128
*iv
, *src
, *dst
, *t
;
434 be128
*t_buf
= req
->tbuf
;
437 BUG_ON(max_blks
< 1);
439 blkcipher_walk_init(&walk
, sdst
, ssrc
, nbytes
);
441 err
= blkcipher_walk_virt(desc
, &walk
);
442 nbytes
= walk
.nbytes
;
446 nblocks
= min(walk
.nbytes
/ bsize
, max_blks
);
447 src
= (be128
*)walk
.src
.virt
.addr
;
448 dst
= (be128
*)walk
.dst
.virt
.addr
;
450 /* calculate first value of T */
451 iv
= (be128
*)walk
.iv
;
455 gf128mul_64k_bbe(&t_buf
[0], ctx
->table
);
462 for (i
= 0; i
< nblocks
; i
++) {
463 /* T <- I*Key2, using the optimization
464 * discussed in the specification */
465 be128_xor(&t_buf
[i
], t
,
466 &ctx
->mulinc
[get_index128(iv
)]);
472 be128_xor(dst
+ i
, t
, src
+ i
);
475 /* CC <- E(Key2,PP) */
476 req
->crypt_fn(req
->crypt_ctx
, (u8
*)dst
,
480 for (i
= 0; i
< nblocks
; i
++)
481 be128_xor(dst
+ i
, dst
+ i
, &t_buf
[i
]);
485 nbytes
-= nblocks
* bsize
;
486 nblocks
= min(nbytes
/ bsize
, max_blks
);
487 } while (nblocks
> 0);
489 err
= blkcipher_walk_done(desc
, &walk
, nbytes
);
490 nbytes
= walk
.nbytes
;
494 nblocks
= min(nbytes
/ bsize
, max_blks
);
495 src
= (be128
*)walk
.src
.virt
.addr
;
496 dst
= (be128
*)walk
.dst
.virt
.addr
;
501 EXPORT_SYMBOL_GPL(lrw_crypt
);
503 static int init_tfm(struct crypto_skcipher
*tfm
)
505 struct skcipher_instance
*inst
= skcipher_alg_instance(tfm
);
506 struct crypto_skcipher_spawn
*spawn
= skcipher_instance_ctx(inst
);
507 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
508 struct crypto_skcipher
*cipher
;
510 cipher
= crypto_spawn_skcipher(spawn
);
512 return PTR_ERR(cipher
);
516 crypto_skcipher_set_reqsize(tfm
, crypto_skcipher_reqsize(cipher
) +
517 sizeof(struct rctx
));
522 static void exit_tfm(struct crypto_skcipher
*tfm
)
524 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
526 lrw_free_table(&ctx
->table
);
527 crypto_free_skcipher(ctx
->child
);
530 static void free(struct skcipher_instance
*inst
)
532 crypto_drop_skcipher(skcipher_instance_ctx(inst
));
536 static int create(struct crypto_template
*tmpl
, struct rtattr
**tb
)
538 struct crypto_skcipher_spawn
*spawn
;
539 struct skcipher_instance
*inst
;
540 struct crypto_attr_type
*algt
;
541 struct skcipher_alg
*alg
;
542 const char *cipher_name
;
543 char ecb_name
[CRYPTO_MAX_ALG_NAME
];
546 algt
= crypto_get_attr_type(tb
);
548 return PTR_ERR(algt
);
550 if ((algt
->type
^ CRYPTO_ALG_TYPE_SKCIPHER
) & algt
->mask
)
553 cipher_name
= crypto_attr_alg_name(tb
[1]);
554 if (IS_ERR(cipher_name
))
555 return PTR_ERR(cipher_name
);
557 inst
= kzalloc(sizeof(*inst
) + sizeof(*spawn
), GFP_KERNEL
);
561 spawn
= skcipher_instance_ctx(inst
);
563 crypto_set_skcipher_spawn(spawn
, skcipher_crypto_instance(inst
));
564 err
= crypto_grab_skcipher(spawn
, cipher_name
, 0,
565 crypto_requires_sync(algt
->type
,
567 if (err
== -ENOENT
) {
569 if (snprintf(ecb_name
, CRYPTO_MAX_ALG_NAME
, "ecb(%s)",
570 cipher_name
) >= CRYPTO_MAX_ALG_NAME
)
573 err
= crypto_grab_skcipher(spawn
, ecb_name
, 0,
574 crypto_requires_sync(algt
->type
,
581 alg
= crypto_skcipher_spawn_alg(spawn
);
584 if (alg
->base
.cra_blocksize
!= LRW_BLOCK_SIZE
)
587 if (crypto_skcipher_alg_ivsize(alg
))
590 err
= crypto_inst_setname(skcipher_crypto_instance(inst
), "lrw",
596 cipher_name
= alg
->base
.cra_name
;
598 /* Alas we screwed up the naming so we have to mangle the
601 if (!strncmp(cipher_name
, "ecb(", 4)) {
604 len
= strlcpy(ecb_name
, cipher_name
+ 4, sizeof(ecb_name
));
605 if (len
< 2 || len
>= sizeof(ecb_name
))
608 if (ecb_name
[len
- 1] != ')')
611 ecb_name
[len
- 1] = 0;
613 if (snprintf(inst
->alg
.base
.cra_name
, CRYPTO_MAX_ALG_NAME
,
614 "lrw(%s)", ecb_name
) >= CRYPTO_MAX_ALG_NAME
) {
621 inst
->alg
.base
.cra_flags
= alg
->base
.cra_flags
& CRYPTO_ALG_ASYNC
;
622 inst
->alg
.base
.cra_priority
= alg
->base
.cra_priority
;
623 inst
->alg
.base
.cra_blocksize
= LRW_BLOCK_SIZE
;
624 inst
->alg
.base
.cra_alignmask
= alg
->base
.cra_alignmask
|
625 (__alignof__(u64
) - 1);
627 inst
->alg
.ivsize
= LRW_BLOCK_SIZE
;
628 inst
->alg
.min_keysize
= crypto_skcipher_alg_min_keysize(alg
) +
630 inst
->alg
.max_keysize
= crypto_skcipher_alg_max_keysize(alg
) +
633 inst
->alg
.base
.cra_ctxsize
= sizeof(struct priv
);
635 inst
->alg
.init
= init_tfm
;
636 inst
->alg
.exit
= exit_tfm
;
638 inst
->alg
.setkey
= setkey
;
639 inst
->alg
.encrypt
= encrypt
;
640 inst
->alg
.decrypt
= decrypt
;
644 err
= skcipher_register_instance(tmpl
, inst
);
652 crypto_drop_skcipher(spawn
);
658 static struct crypto_template crypto_tmpl
= {
661 .module
= THIS_MODULE
,
664 static int __init
crypto_module_init(void)
666 return crypto_register_template(&crypto_tmpl
);
669 static void __exit
crypto_module_exit(void)
671 crypto_unregister_template(&crypto_tmpl
);
674 module_init(crypto_module_init
);
675 module_exit(crypto_module_exit
);
677 MODULE_LICENSE("GPL");
678 MODULE_DESCRIPTION("LRW block cipher mode");
679 MODULE_ALIAS_CRYPTO("lrw");