1 /* LRW: as defined by Cyril Guyot in
2 * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf
4 * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org>
7 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the Free
11 * Software Foundation; either version 2 of the License, or (at your option)
14 /* This implementation is checked against the test vectors in the above
15 * document and by a test vector provided by Ken Buchanan at
16 * http://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html
18 * The test vectors are included in the testing module tcrypt.[ch] */
20 #include <crypto/internal/skcipher.h>
21 #include <crypto/scatterwalk.h>
22 #include <linux/err.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/module.h>
26 #include <linux/scatterlist.h>
27 #include <linux/slab.h>
29 #include <crypto/b128ops.h>
30 #include <crypto/gf128mul.h>
31 #include <crypto/lrw.h>
33 #define LRW_BUFFER_SIZE 128u
36 struct crypto_skcipher
*child
;
37 struct lrw_table_ctx table
;
41 be128 buf
[LRW_BUFFER_SIZE
/ sizeof(be128
)];
47 struct scatterlist srcbuf
[2];
48 struct scatterlist dstbuf
[2];
49 struct scatterlist
*src
;
50 struct scatterlist
*dst
;
54 struct skcipher_request subreq
;
57 static inline void setbit128_bbe(void *b
, int bit
)
59 __set_bit(bit
^ (0x80 -
68 int lrw_init_table(struct lrw_table_ctx
*ctx
, const u8
*tweak
)
74 gf128mul_free_64k(ctx
->table
);
76 /* initialize multiplication table for Key2 */
77 ctx
->table
= gf128mul_init_64k_bbe((be128
*)tweak
);
81 /* initialize optimization table */
82 for (i
= 0; i
< 128; i
++) {
83 setbit128_bbe(&tmp
, i
);
85 gf128mul_64k_bbe(&ctx
->mulinc
[i
], ctx
->table
);
90 EXPORT_SYMBOL_GPL(lrw_init_table
);
92 void lrw_free_table(struct lrw_table_ctx
*ctx
)
95 gf128mul_free_64k(ctx
->table
);
97 EXPORT_SYMBOL_GPL(lrw_free_table
);
99 static int setkey(struct crypto_skcipher
*parent
, const u8
*key
,
102 struct priv
*ctx
= crypto_skcipher_ctx(parent
);
103 struct crypto_skcipher
*child
= ctx
->child
;
104 int err
, bsize
= LRW_BLOCK_SIZE
;
105 const u8
*tweak
= key
+ keylen
- bsize
;
107 crypto_skcipher_clear_flags(child
, CRYPTO_TFM_REQ_MASK
);
108 crypto_skcipher_set_flags(child
, crypto_skcipher_get_flags(parent
) &
109 CRYPTO_TFM_REQ_MASK
);
110 err
= crypto_skcipher_setkey(child
, key
, keylen
- bsize
);
111 crypto_skcipher_set_flags(parent
, crypto_skcipher_get_flags(child
) &
112 CRYPTO_TFM_RES_MASK
);
116 return lrw_init_table(&ctx
->table
, tweak
);
119 static inline void inc(be128
*iv
)
121 be64_add_cpu(&iv
->b
, 1);
123 be64_add_cpu(&iv
->a
, 1);
126 /* this returns the number of consequative 1 bits starting
127 * from the right, get_index128(00 00 00 00 00 00 ... 00 00 10 FB) = 2 */
128 static inline int get_index128(be128
*block
)
131 __be32
*p
= (__be32
*) block
;
133 for (p
+= 3, x
= 0; x
< 128; p
--, x
+= 32) {
134 u32 val
= be32_to_cpup(p
);
143 * If we get here, then x == 128 and we are incrementing the counter
144 * from all ones to all zeros. This means we must return index 127, i.e.
145 * the one corresponding to key2*{ 1,...,1 }.
150 static int post_crypt(struct skcipher_request
*req
)
152 struct rctx
*rctx
= skcipher_request_ctx(req
);
153 be128
*buf
= rctx
->ext
?: rctx
->buf
;
154 struct skcipher_request
*subreq
;
155 const int bs
= LRW_BLOCK_SIZE
;
156 struct skcipher_walk w
;
157 struct scatterlist
*sg
;
161 subreq
= &rctx
->subreq
;
162 err
= skcipher_walk_virt(&w
, subreq
, false);
165 unsigned int avail
= w
.nbytes
;
168 wdst
= w
.dst
.virt
.addr
;
171 be128_xor(wdst
, buf
++, wdst
);
173 } while ((avail
-= bs
) >= bs
);
175 err
= skcipher_walk_done(&w
, avail
);
178 rctx
->left
-= subreq
->cryptlen
;
180 if (err
|| !rctx
->left
)
183 rctx
->dst
= rctx
->dstbuf
;
185 scatterwalk_done(&w
.out
, 0, 1);
187 offset
= w
.out
.offset
;
189 if (rctx
->dst
!= sg
) {
191 sg_unmark_end(rctx
->dst
);
192 scatterwalk_crypto_chain(rctx
->dst
, sg_next(sg
), 0, 2);
194 rctx
->dst
[0].length
-= offset
- sg
->offset
;
195 rctx
->dst
[0].offset
= offset
;
201 static int pre_crypt(struct skcipher_request
*req
)
203 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
204 struct rctx
*rctx
= skcipher_request_ctx(req
);
205 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
206 be128
*buf
= rctx
->ext
?: rctx
->buf
;
207 struct skcipher_request
*subreq
;
208 const int bs
= LRW_BLOCK_SIZE
;
209 struct skcipher_walk w
;
210 struct scatterlist
*sg
;
217 subreq
= &rctx
->subreq
;
218 skcipher_request_set_tfm(subreq
, tfm
);
220 cryptlen
= subreq
->cryptlen
;
221 more
= rctx
->left
> cryptlen
;
223 cryptlen
= rctx
->left
;
225 skcipher_request_set_crypt(subreq
, rctx
->src
, rctx
->dst
,
228 err
= skcipher_walk_virt(&w
, subreq
, false);
232 unsigned int avail
= w
.nbytes
;
236 wsrc
= w
.src
.virt
.addr
;
237 wdst
= w
.dst
.virt
.addr
;
241 be128_xor(wdst
++, &rctx
->t
, wsrc
++);
243 /* T <- I*Key2, using the optimization
244 * discussed in the specification */
245 be128_xor(&rctx
->t
, &rctx
->t
,
246 &ctx
->table
.mulinc
[get_index128(iv
)]);
248 } while ((avail
-= bs
) >= bs
);
250 err
= skcipher_walk_done(&w
, avail
);
253 skcipher_request_set_tfm(subreq
, ctx
->child
);
254 skcipher_request_set_crypt(subreq
, rctx
->dst
, rctx
->dst
,
260 rctx
->src
= rctx
->srcbuf
;
262 scatterwalk_done(&w
.in
, 0, 1);
264 offset
= w
.in
.offset
;
266 if (rctx
->src
!= sg
) {
268 sg_unmark_end(rctx
->src
);
269 scatterwalk_crypto_chain(rctx
->src
, sg_next(sg
), 0, 2);
271 rctx
->src
[0].length
-= offset
- sg
->offset
;
272 rctx
->src
[0].offset
= offset
;
278 static int init_crypt(struct skcipher_request
*req
, crypto_completion_t done
)
280 struct priv
*ctx
= crypto_skcipher_ctx(crypto_skcipher_reqtfm(req
));
281 struct rctx
*rctx
= skcipher_request_ctx(req
);
282 struct skcipher_request
*subreq
;
285 subreq
= &rctx
->subreq
;
286 skcipher_request_set_callback(subreq
, req
->base
.flags
, done
, req
);
288 gfp
= req
->base
.flags
& CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
292 subreq
->cryptlen
= LRW_BUFFER_SIZE
;
293 if (req
->cryptlen
> LRW_BUFFER_SIZE
) {
294 unsigned int n
= min(req
->cryptlen
, (unsigned int)PAGE_SIZE
);
296 rctx
->ext
= kmalloc(n
, gfp
);
298 subreq
->cryptlen
= n
;
301 rctx
->src
= req
->src
;
302 rctx
->dst
= req
->dst
;
303 rctx
->left
= req
->cryptlen
;
305 /* calculate first value of T */
306 memcpy(&rctx
->t
, req
->iv
, sizeof(rctx
->t
));
309 gf128mul_64k_bbe(&rctx
->t
, ctx
->table
.table
);
314 static void exit_crypt(struct skcipher_request
*req
)
316 struct rctx
*rctx
= skcipher_request_ctx(req
);
324 static int do_encrypt(struct skcipher_request
*req
, int err
)
326 struct rctx
*rctx
= skcipher_request_ctx(req
);
327 struct skcipher_request
*subreq
;
329 subreq
= &rctx
->subreq
;
331 while (!err
&& rctx
->left
) {
332 err
= pre_crypt(req
) ?:
333 crypto_skcipher_encrypt(subreq
) ?:
336 if (err
== -EINPROGRESS
||
338 req
->base
.flags
& CRYPTO_TFM_REQ_MAY_BACKLOG
))
346 static void encrypt_done(struct crypto_async_request
*areq
, int err
)
348 struct skcipher_request
*req
= areq
->data
;
349 struct skcipher_request
*subreq
;
352 rctx
= skcipher_request_ctx(req
);
354 if (err
== -EINPROGRESS
) {
355 if (rctx
->left
!= req
->cryptlen
)
360 subreq
= &rctx
->subreq
;
361 subreq
->base
.flags
&= CRYPTO_TFM_REQ_MAY_BACKLOG
;
363 err
= do_encrypt(req
, err
?: post_crypt(req
));
368 skcipher_request_complete(req
, err
);
371 static int encrypt(struct skcipher_request
*req
)
373 return do_encrypt(req
, init_crypt(req
, encrypt_done
));
376 static int do_decrypt(struct skcipher_request
*req
, int err
)
378 struct rctx
*rctx
= skcipher_request_ctx(req
);
379 struct skcipher_request
*subreq
;
381 subreq
= &rctx
->subreq
;
383 while (!err
&& rctx
->left
) {
384 err
= pre_crypt(req
) ?:
385 crypto_skcipher_decrypt(subreq
) ?:
388 if (err
== -EINPROGRESS
||
390 req
->base
.flags
& CRYPTO_TFM_REQ_MAY_BACKLOG
))
398 static void decrypt_done(struct crypto_async_request
*areq
, int err
)
400 struct skcipher_request
*req
= areq
->data
;
401 struct skcipher_request
*subreq
;
404 rctx
= skcipher_request_ctx(req
);
406 if (err
== -EINPROGRESS
) {
407 if (rctx
->left
!= req
->cryptlen
)
412 subreq
= &rctx
->subreq
;
413 subreq
->base
.flags
&= CRYPTO_TFM_REQ_MAY_BACKLOG
;
415 err
= do_decrypt(req
, err
?: post_crypt(req
));
420 skcipher_request_complete(req
, err
);
423 static int decrypt(struct skcipher_request
*req
)
425 return do_decrypt(req
, init_crypt(req
, decrypt_done
));
428 int lrw_crypt(struct blkcipher_desc
*desc
, struct scatterlist
*sdst
,
429 struct scatterlist
*ssrc
, unsigned int nbytes
,
430 struct lrw_crypt_req
*req
)
432 const unsigned int bsize
= LRW_BLOCK_SIZE
;
433 const unsigned int max_blks
= req
->tbuflen
/ bsize
;
434 struct lrw_table_ctx
*ctx
= req
->table_ctx
;
435 struct blkcipher_walk walk
;
436 unsigned int nblocks
;
437 be128
*iv
, *src
, *dst
, *t
;
438 be128
*t_buf
= req
->tbuf
;
441 BUG_ON(max_blks
< 1);
443 blkcipher_walk_init(&walk
, sdst
, ssrc
, nbytes
);
445 err
= blkcipher_walk_virt(desc
, &walk
);
446 nbytes
= walk
.nbytes
;
450 nblocks
= min(walk
.nbytes
/ bsize
, max_blks
);
451 src
= (be128
*)walk
.src
.virt
.addr
;
452 dst
= (be128
*)walk
.dst
.virt
.addr
;
454 /* calculate first value of T */
455 iv
= (be128
*)walk
.iv
;
459 gf128mul_64k_bbe(&t_buf
[0], ctx
->table
);
466 for (i
= 0; i
< nblocks
; i
++) {
467 /* T <- I*Key2, using the optimization
468 * discussed in the specification */
469 be128_xor(&t_buf
[i
], t
,
470 &ctx
->mulinc
[get_index128(iv
)]);
476 be128_xor(dst
+ i
, t
, src
+ i
);
479 /* CC <- E(Key2,PP) */
480 req
->crypt_fn(req
->crypt_ctx
, (u8
*)dst
,
484 for (i
= 0; i
< nblocks
; i
++)
485 be128_xor(dst
+ i
, dst
+ i
, &t_buf
[i
]);
489 nbytes
-= nblocks
* bsize
;
490 nblocks
= min(nbytes
/ bsize
, max_blks
);
491 } while (nblocks
> 0);
493 err
= blkcipher_walk_done(desc
, &walk
, nbytes
);
494 nbytes
= walk
.nbytes
;
498 nblocks
= min(nbytes
/ bsize
, max_blks
);
499 src
= (be128
*)walk
.src
.virt
.addr
;
500 dst
= (be128
*)walk
.dst
.virt
.addr
;
505 EXPORT_SYMBOL_GPL(lrw_crypt
);
507 static int init_tfm(struct crypto_skcipher
*tfm
)
509 struct skcipher_instance
*inst
= skcipher_alg_instance(tfm
);
510 struct crypto_skcipher_spawn
*spawn
= skcipher_instance_ctx(inst
);
511 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
512 struct crypto_skcipher
*cipher
;
514 cipher
= crypto_spawn_skcipher(spawn
);
516 return PTR_ERR(cipher
);
520 crypto_skcipher_set_reqsize(tfm
, crypto_skcipher_reqsize(cipher
) +
521 sizeof(struct rctx
));
526 static void exit_tfm(struct crypto_skcipher
*tfm
)
528 struct priv
*ctx
= crypto_skcipher_ctx(tfm
);
530 lrw_free_table(&ctx
->table
);
531 crypto_free_skcipher(ctx
->child
);
534 static void free(struct skcipher_instance
*inst
)
536 crypto_drop_skcipher(skcipher_instance_ctx(inst
));
540 static int create(struct crypto_template
*tmpl
, struct rtattr
**tb
)
542 struct crypto_skcipher_spawn
*spawn
;
543 struct skcipher_instance
*inst
;
544 struct crypto_attr_type
*algt
;
545 struct skcipher_alg
*alg
;
546 const char *cipher_name
;
547 char ecb_name
[CRYPTO_MAX_ALG_NAME
];
550 algt
= crypto_get_attr_type(tb
);
552 return PTR_ERR(algt
);
554 if ((algt
->type
^ CRYPTO_ALG_TYPE_SKCIPHER
) & algt
->mask
)
557 cipher_name
= crypto_attr_alg_name(tb
[1]);
558 if (IS_ERR(cipher_name
))
559 return PTR_ERR(cipher_name
);
561 inst
= kzalloc(sizeof(*inst
) + sizeof(*spawn
), GFP_KERNEL
);
565 spawn
= skcipher_instance_ctx(inst
);
567 crypto_set_skcipher_spawn(spawn
, skcipher_crypto_instance(inst
));
568 err
= crypto_grab_skcipher(spawn
, cipher_name
, 0,
569 crypto_requires_sync(algt
->type
,
571 if (err
== -ENOENT
) {
573 if (snprintf(ecb_name
, CRYPTO_MAX_ALG_NAME
, "ecb(%s)",
574 cipher_name
) >= CRYPTO_MAX_ALG_NAME
)
577 err
= crypto_grab_skcipher(spawn
, ecb_name
, 0,
578 crypto_requires_sync(algt
->type
,
585 alg
= crypto_skcipher_spawn_alg(spawn
);
588 if (alg
->base
.cra_blocksize
!= LRW_BLOCK_SIZE
)
591 if (crypto_skcipher_alg_ivsize(alg
))
594 err
= crypto_inst_setname(skcipher_crypto_instance(inst
), "lrw",
600 cipher_name
= alg
->base
.cra_name
;
602 /* Alas we screwed up the naming so we have to mangle the
605 if (!strncmp(cipher_name
, "ecb(", 4)) {
608 len
= strlcpy(ecb_name
, cipher_name
+ 4, sizeof(ecb_name
));
609 if (len
< 2 || len
>= sizeof(ecb_name
))
612 if (ecb_name
[len
- 1] != ')')
615 ecb_name
[len
- 1] = 0;
617 if (snprintf(inst
->alg
.base
.cra_name
, CRYPTO_MAX_ALG_NAME
,
618 "lrw(%s)", ecb_name
) >= CRYPTO_MAX_ALG_NAME
) {
624 inst
->alg
.base
.cra_flags
= alg
->base
.cra_flags
& CRYPTO_ALG_ASYNC
;
625 inst
->alg
.base
.cra_priority
= alg
->base
.cra_priority
;
626 inst
->alg
.base
.cra_blocksize
= LRW_BLOCK_SIZE
;
627 inst
->alg
.base
.cra_alignmask
= alg
->base
.cra_alignmask
|
628 (__alignof__(u64
) - 1);
630 inst
->alg
.ivsize
= LRW_BLOCK_SIZE
;
631 inst
->alg
.min_keysize
= crypto_skcipher_alg_min_keysize(alg
) +
633 inst
->alg
.max_keysize
= crypto_skcipher_alg_max_keysize(alg
) +
636 inst
->alg
.base
.cra_ctxsize
= sizeof(struct priv
);
638 inst
->alg
.init
= init_tfm
;
639 inst
->alg
.exit
= exit_tfm
;
641 inst
->alg
.setkey
= setkey
;
642 inst
->alg
.encrypt
= encrypt
;
643 inst
->alg
.decrypt
= decrypt
;
647 err
= skcipher_register_instance(tmpl
, inst
);
655 crypto_drop_skcipher(spawn
);
661 static struct crypto_template crypto_tmpl
= {
664 .module
= THIS_MODULE
,
667 static int __init
crypto_module_init(void)
669 return crypto_register_template(&crypto_tmpl
);
672 static void __exit
crypto_module_exit(void)
674 crypto_unregister_template(&crypto_tmpl
);
677 module_init(crypto_module_init
);
678 module_exit(crypto_module_exit
);
680 MODULE_LICENSE("GPL");
681 MODULE_DESCRIPTION("LRW block cipher mode");
682 MODULE_ALIAS_CRYPTO("lrw");