1 /* XTS: as defined in IEEE1619/D16
2 * http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
3 * (sector sizes which are not a multiple of 16 bytes are,
4 * however currently unsupported)
6 * Copyright (c) 2007 Rik Snel <rsnel@cube.dyndns.org>
9 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
11 * This program is free software; you can redistribute it and/or modify it
12 * under the terms of the GNU General Public License as published by the Free
13 * Software Foundation; either version 2 of the License, or (at your option)
16 #include <crypto/algapi.h>
17 #include <linux/err.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/scatterlist.h>
22 #include <linux/slab.h>
24 #include <crypto/b128ops.h>
25 #include <crypto/gf128mul.h>
27 #define XTS_BLOCK_SIZE 16
30 struct crypto_cipher
*child
;
31 struct crypto_cipher
*tweak
;
34 static int setkey(struct crypto_tfm
*parent
, const u8
*key
,
37 struct priv
*ctx
= crypto_tfm_ctx(parent
);
38 struct crypto_cipher
*child
= ctx
->tweak
;
39 u32
*flags
= &parent
->crt_flags
;
42 /* key consists of keys of equal size concatenated, therefore
43 * the length must be even */
45 /* tell the user why there was an error */
46 *flags
|= CRYPTO_TFM_RES_BAD_KEY_LEN
;
50 /* we need two cipher instances: one to compute the initial 'tweak'
51 * by encrypting the IV (usually the 'plain' iv) and the other
52 * one to encrypt and decrypt the data */
54 /* tweak cipher, uses Key2 i.e. the second half of *key */
55 crypto_cipher_clear_flags(child
, CRYPTO_TFM_REQ_MASK
);
56 crypto_cipher_set_flags(child
, crypto_tfm_get_flags(parent
) &
58 err
= crypto_cipher_setkey(child
, key
+ keylen
/2, keylen
/2);
62 crypto_tfm_set_flags(parent
, crypto_cipher_get_flags(child
) &
67 /* data cipher, uses Key1 i.e. the first half of *key */
68 crypto_cipher_clear_flags(child
, CRYPTO_TFM_REQ_MASK
);
69 crypto_cipher_set_flags(child
, crypto_tfm_get_flags(parent
) &
71 err
= crypto_cipher_setkey(child
, key
, keylen
/2);
75 crypto_tfm_set_flags(parent
, crypto_cipher_get_flags(child
) &
83 struct crypto_tfm
*tfm
;
84 void (*fn
)(struct crypto_tfm
*, u8
*, const u8
*);
87 static inline void xts_round(struct sinfo
*s
, void *dst
, const void *src
)
89 be128_xor(dst
, s
->t
, src
); /* PP <- T xor P */
90 s
->fn(s
->tfm
, dst
, dst
); /* CC <- E(Key1,PP) */
91 be128_xor(dst
, dst
, s
->t
); /* C <- T xor CC */
94 static int crypt(struct blkcipher_desc
*d
,
95 struct blkcipher_walk
*w
, struct priv
*ctx
,
96 void (*tw
)(struct crypto_tfm
*, u8
*, const u8
*),
97 void (*fn
)(struct crypto_tfm
*, u8
*, const u8
*))
101 const int bs
= XTS_BLOCK_SIZE
;
103 .tfm
= crypto_cipher_tfm(ctx
->child
),
109 err
= blkcipher_walk_virt(d
, w
);
113 s
.t
= (be128
*)w
->iv
;
116 wsrc
= w
->src
.virt
.addr
;
117 wdst
= w
->dst
.virt
.addr
;
119 /* calculate first value of T */
120 tw(crypto_cipher_tfm(ctx
->tweak
), w
->iv
, w
->iv
);
126 gf128mul_x_ble(s
.t
, s
.t
);
129 xts_round(&s
, wdst
, wsrc
);
133 } while ((avail
-= bs
) >= bs
);
135 err
= blkcipher_walk_done(d
, w
, avail
);
141 wsrc
= w
->src
.virt
.addr
;
142 wdst
= w
->dst
.virt
.addr
;
148 static int encrypt(struct blkcipher_desc
*desc
, struct scatterlist
*dst
,
149 struct scatterlist
*src
, unsigned int nbytes
)
151 struct priv
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
152 struct blkcipher_walk w
;
154 blkcipher_walk_init(&w
, dst
, src
, nbytes
);
155 return crypt(desc
, &w
, ctx
, crypto_cipher_alg(ctx
->tweak
)->cia_encrypt
,
156 crypto_cipher_alg(ctx
->child
)->cia_encrypt
);
159 static int decrypt(struct blkcipher_desc
*desc
, struct scatterlist
*dst
,
160 struct scatterlist
*src
, unsigned int nbytes
)
162 struct priv
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
163 struct blkcipher_walk w
;
165 blkcipher_walk_init(&w
, dst
, src
, nbytes
);
166 return crypt(desc
, &w
, ctx
, crypto_cipher_alg(ctx
->tweak
)->cia_encrypt
,
167 crypto_cipher_alg(ctx
->child
)->cia_decrypt
);
170 static int init_tfm(struct crypto_tfm
*tfm
)
172 struct crypto_cipher
*cipher
;
173 struct crypto_instance
*inst
= (void *)tfm
->__crt_alg
;
174 struct crypto_spawn
*spawn
= crypto_instance_ctx(inst
);
175 struct priv
*ctx
= crypto_tfm_ctx(tfm
);
176 u32
*flags
= &tfm
->crt_flags
;
178 cipher
= crypto_spawn_cipher(spawn
);
180 return PTR_ERR(cipher
);
182 if (crypto_cipher_blocksize(cipher
) != XTS_BLOCK_SIZE
) {
183 *flags
|= CRYPTO_TFM_RES_BAD_BLOCK_LEN
;
184 crypto_free_cipher(cipher
);
190 cipher
= crypto_spawn_cipher(spawn
);
191 if (IS_ERR(cipher
)) {
192 crypto_free_cipher(ctx
->child
);
193 return PTR_ERR(cipher
);
196 /* this check isn't really needed, leave it here just in case */
197 if (crypto_cipher_blocksize(cipher
) != XTS_BLOCK_SIZE
) {
198 crypto_free_cipher(cipher
);
199 crypto_free_cipher(ctx
->child
);
200 *flags
|= CRYPTO_TFM_RES_BAD_BLOCK_LEN
;
209 static void exit_tfm(struct crypto_tfm
*tfm
)
211 struct priv
*ctx
= crypto_tfm_ctx(tfm
);
212 crypto_free_cipher(ctx
->child
);
213 crypto_free_cipher(ctx
->tweak
);
216 static struct crypto_instance
*alloc(struct rtattr
**tb
)
218 struct crypto_instance
*inst
;
219 struct crypto_alg
*alg
;
222 err
= crypto_check_attr_type(tb
, CRYPTO_ALG_TYPE_BLKCIPHER
);
226 alg
= crypto_get_attr_alg(tb
, CRYPTO_ALG_TYPE_CIPHER
,
227 CRYPTO_ALG_TYPE_MASK
);
229 return ERR_CAST(alg
);
231 inst
= crypto_alloc_instance("xts", alg
);
235 inst
->alg
.cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
;
236 inst
->alg
.cra_priority
= alg
->cra_priority
;
237 inst
->alg
.cra_blocksize
= alg
->cra_blocksize
;
239 if (alg
->cra_alignmask
< 7)
240 inst
->alg
.cra_alignmask
= 7;
242 inst
->alg
.cra_alignmask
= alg
->cra_alignmask
;
244 inst
->alg
.cra_type
= &crypto_blkcipher_type
;
246 inst
->alg
.cra_blkcipher
.ivsize
= alg
->cra_blocksize
;
247 inst
->alg
.cra_blkcipher
.min_keysize
=
248 2 * alg
->cra_cipher
.cia_min_keysize
;
249 inst
->alg
.cra_blkcipher
.max_keysize
=
250 2 * alg
->cra_cipher
.cia_max_keysize
;
252 inst
->alg
.cra_ctxsize
= sizeof(struct priv
);
254 inst
->alg
.cra_init
= init_tfm
;
255 inst
->alg
.cra_exit
= exit_tfm
;
257 inst
->alg
.cra_blkcipher
.setkey
= setkey
;
258 inst
->alg
.cra_blkcipher
.encrypt
= encrypt
;
259 inst
->alg
.cra_blkcipher
.decrypt
= decrypt
;
266 static void free(struct crypto_instance
*inst
)
268 crypto_drop_spawn(crypto_instance_ctx(inst
));
272 static struct crypto_template crypto_tmpl
= {
276 .module
= THIS_MODULE
,
279 static int __init
crypto_module_init(void)
281 return crypto_register_template(&crypto_tmpl
);
284 static void __exit
crypto_module_exit(void)
286 crypto_unregister_template(&crypto_tmpl
);
289 module_init(crypto_module_init
);
290 module_exit(crypto_module_exit
);
292 MODULE_LICENSE("GPL");
293 MODULE_DESCRIPTION("XTS block cipher mode");