xref: /linux/lib/crypto/aesgcm.c (revision 06d07429858317ded2db7986113a9e0129cd599b)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Minimal library implementation of GCM
4  *
5  * Copyright 2022 Google LLC
6  */
7 
8 #include <linux/module.h>
9 
10 #include <crypto/algapi.h>
11 #include <crypto/gcm.h>
12 #include <crypto/ghash.h>
13 
14 #include <asm/irqflags.h>
15 
aesgcm_encrypt_block(const struct crypto_aes_ctx * ctx,void * dst,const void * src)16 static void aesgcm_encrypt_block(const struct crypto_aes_ctx *ctx, void *dst,
17 				 const void *src)
18 {
19 	unsigned long flags;
20 
21 	/*
22 	 * In AES-GCM, both the GHASH key derivation and the CTR mode
23 	 * encryption operate on known plaintext, making them susceptible to
24 	 * timing attacks on the encryption key. The AES library already
25 	 * mitigates this risk to some extent by pulling the entire S-box into
26 	 * the caches before doing any substitutions, but this strategy is more
27 	 * effective when running with interrupts disabled.
28 	 */
29 	local_irq_save(flags);
30 	aes_encrypt(ctx, dst, src);
31 	local_irq_restore(flags);
32 }
33 
34 /**
35  * aesgcm_expandkey - Expands the AES and GHASH keys for the AES-GCM key
36  *		      schedule
37  *
38  * @ctx:	The data structure that will hold the AES-GCM key schedule
39  * @key:	The AES encryption input key
40  * @keysize:	The length in bytes of the input key
41  * @authsize:	The size in bytes of the GCM authentication tag
42  *
43  * Returns: 0 on success, or -EINVAL if @keysize or @authsize contain values
44  * that are not permitted by the GCM specification.
45  */
aesgcm_expandkey(struct aesgcm_ctx * ctx,const u8 * key,unsigned int keysize,unsigned int authsize)46 int aesgcm_expandkey(struct aesgcm_ctx *ctx, const u8 *key,
47 		     unsigned int keysize, unsigned int authsize)
48 {
49 	u8 kin[AES_BLOCK_SIZE] = {};
50 	int ret;
51 
52 	ret = crypto_gcm_check_authsize(authsize) ?:
53 	      aes_expandkey(&ctx->aes_ctx, key, keysize);
54 	if (ret)
55 		return ret;
56 
57 	ctx->authsize = authsize;
58 	aesgcm_encrypt_block(&ctx->aes_ctx, &ctx->ghash_key, kin);
59 
60 	return 0;
61 }
62 EXPORT_SYMBOL(aesgcm_expandkey);
63 
aesgcm_ghash(be128 * ghash,const be128 * key,const void * src,int len)64 static void aesgcm_ghash(be128 *ghash, const be128 *key, const void *src,
65 			 int len)
66 {
67 	while (len > 0) {
68 		crypto_xor((u8 *)ghash, src, min(len, GHASH_BLOCK_SIZE));
69 		gf128mul_lle(ghash, key);
70 
71 		src += GHASH_BLOCK_SIZE;
72 		len -= GHASH_BLOCK_SIZE;
73 	}
74 }
75 
76 /**
77  * aesgcm_mac - Generates the authentication tag using AES-GCM algorithm.
78  * @ctx: The data structure that will hold the AES-GCM key schedule
79  * @src: The input source data.
80  * @src_len: Length of the source data.
81  * @assoc: Points to the associated data.
82  * @assoc_len: Length of the associated data values.
83  * @ctr: Points to the counter value.
84  * @authtag: The output buffer for the authentication tag.
85  *
86  * It takes in the AES-GCM context, source data, associated data, counter value,
87  * and an output buffer for the authentication tag.
88  */
aesgcm_mac(const struct aesgcm_ctx * ctx,const u8 * src,int src_len,const u8 * assoc,int assoc_len,__be32 * ctr,u8 * authtag)89 static void aesgcm_mac(const struct aesgcm_ctx *ctx, const u8 *src, int src_len,
90 		       const u8 *assoc, int assoc_len, __be32 *ctr, u8 *authtag)
91 {
92 	be128 tail = { cpu_to_be64(assoc_len * 8), cpu_to_be64(src_len * 8) };
93 	u8 buf[AES_BLOCK_SIZE];
94 	be128 ghash = {};
95 
96 	aesgcm_ghash(&ghash, &ctx->ghash_key, assoc, assoc_len);
97 	aesgcm_ghash(&ghash, &ctx->ghash_key, src, src_len);
98 	aesgcm_ghash(&ghash, &ctx->ghash_key, &tail, sizeof(tail));
99 
100 	ctr[3] = cpu_to_be32(1);
101 	aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr);
102 	crypto_xor_cpy(authtag, buf, (u8 *)&ghash, ctx->authsize);
103 
104 	memzero_explicit(&ghash, sizeof(ghash));
105 	memzero_explicit(buf, sizeof(buf));
106 }
107 
aesgcm_crypt(const struct aesgcm_ctx * ctx,u8 * dst,const u8 * src,int len,__be32 * ctr)108 static void aesgcm_crypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src,
109 			 int len, __be32 *ctr)
110 {
111 	u8 buf[AES_BLOCK_SIZE];
112 	unsigned int n = 2;
113 
114 	while (len > 0) {
115 		/*
116 		 * The counter increment below must not result in overflow or
117 		 * carry into the next 32-bit word, as this could result in
118 		 * inadvertent IV reuse, which must be avoided at all cost for
119 		 * stream ciphers such as AES-CTR. Given the range of 'int
120 		 * len', this cannot happen, so no explicit test is necessary.
121 		 */
122 		ctr[3] = cpu_to_be32(n++);
123 		aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr);
124 		crypto_xor_cpy(dst, src, buf, min(len, AES_BLOCK_SIZE));
125 
126 		dst += AES_BLOCK_SIZE;
127 		src += AES_BLOCK_SIZE;
128 		len -= AES_BLOCK_SIZE;
129 	}
130 	memzero_explicit(buf, sizeof(buf));
131 }
132 
133 /**
134  * aesgcm_encrypt - Perform AES-GCM encryption on a block of data
135  *
136  * @ctx:	The AES-GCM key schedule
137  * @dst:	Pointer to the ciphertext output buffer
138  * @src:	Pointer the plaintext (may equal @dst for encryption in place)
139  * @crypt_len:	The size in bytes of the plaintext and ciphertext.
140  * @assoc:	Pointer to the associated data,
141  * @assoc_len:	The size in bytes of the associated data
142  * @iv:		The initialization vector (IV) to use for this block of data
143  *		(must be 12 bytes in size as per the GCM spec recommendation)
144  * @authtag:	The address of the buffer in memory where the authentication
145  *		tag should be stored. The buffer is assumed to have space for
146  *		@ctx->authsize bytes.
147  */
aesgcm_encrypt(const struct aesgcm_ctx * ctx,u8 * dst,const u8 * src,int crypt_len,const u8 * assoc,int assoc_len,const u8 iv[GCM_AES_IV_SIZE],u8 * authtag)148 void aesgcm_encrypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src,
149 		    int crypt_len, const u8 *assoc, int assoc_len,
150 		    const u8 iv[GCM_AES_IV_SIZE], u8 *authtag)
151 {
152 	__be32 ctr[4];
153 
154 	memcpy(ctr, iv, GCM_AES_IV_SIZE);
155 
156 	aesgcm_crypt(ctx, dst, src, crypt_len, ctr);
157 	aesgcm_mac(ctx, dst, crypt_len, assoc, assoc_len, ctr, authtag);
158 }
159 EXPORT_SYMBOL(aesgcm_encrypt);
160 
161 /**
162  * aesgcm_decrypt - Perform AES-GCM decryption on a block of data
163  *
164  * @ctx:	The AES-GCM key schedule
165  * @dst:	Pointer to the plaintext output buffer
166  * @src:	Pointer the ciphertext (may equal @dst for decryption in place)
167  * @crypt_len:	The size in bytes of the plaintext and ciphertext.
168  * @assoc:	Pointer to the associated data,
169  * @assoc_len:	The size in bytes of the associated data
170  * @iv:		The initialization vector (IV) to use for this block of data
171  *		(must be 12 bytes in size as per the GCM spec recommendation)
172  * @authtag:	The address of the buffer in memory where the authentication
173  *		tag is stored.
174  *
175  * Returns: true on success, or false if the ciphertext failed authentication.
176  * On failure, no plaintext will be returned.
177  */
aesgcm_decrypt(const struct aesgcm_ctx * ctx,u8 * dst,const u8 * src,int crypt_len,const u8 * assoc,int assoc_len,const u8 iv[GCM_AES_IV_SIZE],const u8 * authtag)178 bool __must_check aesgcm_decrypt(const struct aesgcm_ctx *ctx, u8 *dst,
179 				 const u8 *src, int crypt_len, const u8 *assoc,
180 				 int assoc_len, const u8 iv[GCM_AES_IV_SIZE],
181 				 const u8 *authtag)
182 {
183 	u8 tagbuf[AES_BLOCK_SIZE];
184 	__be32 ctr[4];
185 
186 	memcpy(ctr, iv, GCM_AES_IV_SIZE);
187 
188 	aesgcm_mac(ctx, src, crypt_len, assoc, assoc_len, ctr, tagbuf);
189 	if (crypto_memneq(authtag, tagbuf, ctx->authsize)) {
190 		memzero_explicit(tagbuf, sizeof(tagbuf));
191 		return false;
192 	}
193 	aesgcm_crypt(ctx, dst, src, crypt_len, ctr);
194 	return true;
195 }
196 EXPORT_SYMBOL(aesgcm_decrypt);
197 
198 MODULE_DESCRIPTION("Generic AES-GCM library");
199 MODULE_AUTHOR("Ard Biesheuvel <ardb@kernel.org>");
200 MODULE_LICENSE("GPL");
201 
202 #ifndef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
203 
204 /*
205  * Test code below. Vectors taken from crypto/testmgr.h
206  */
207 
208 static const u8 __initconst ctext0[16] =
209 	"\x58\xe2\xfc\xce\xfa\x7e\x30\x61"
210 	"\x36\x7f\x1d\x57\xa4\xe7\x45\x5a";
211 
212 static const u8 __initconst ptext1[16];
213 
214 static const u8 __initconst ctext1[32] =
215 	"\x03\x88\xda\xce\x60\xb6\xa3\x92"
216 	"\xf3\x28\xc2\xb9\x71\xb2\xfe\x78"
217 	"\xab\x6e\x47\xd4\x2c\xec\x13\xbd"
218 	"\xf5\x3a\x67\xb2\x12\x57\xbd\xdf";
219 
220 static const u8 __initconst ptext2[64] =
221 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
222 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
223 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
224 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
225 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
226 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
227 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
228 	"\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
229 
230 static const u8 __initconst ctext2[80] =
231 	"\x42\x83\x1e\xc2\x21\x77\x74\x24"
232 	"\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
233 	"\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
234 	"\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
235 	"\x21\xd5\x14\xb2\x54\x66\x93\x1c"
236 	"\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
237 	"\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
238 	"\x3d\x58\xe0\x91\x47\x3f\x59\x85"
239 	"\x4d\x5c\x2a\xf3\x27\xcd\x64\xa6"
240 	"\x2c\xf3\x5a\xbd\x2b\xa6\xfa\xb4";
241 
242 static const u8 __initconst ptext3[60] =
243 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
244 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
245 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
246 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
247 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
248 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
249 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
250 	"\xba\x63\x7b\x39";
251 
252 static const u8 __initconst ctext3[76] =
253 	"\x42\x83\x1e\xc2\x21\x77\x74\x24"
254 	"\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
255 	"\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
256 	"\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
257 	"\x21\xd5\x14\xb2\x54\x66\x93\x1c"
258 	"\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
259 	"\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
260 	"\x3d\x58\xe0\x91"
261 	"\x5b\xc9\x4f\xbc\x32\x21\xa5\xdb"
262 	"\x94\xfa\xe9\x5a\xe7\x12\x1a\x47";
263 
264 static const u8 __initconst ctext4[16] =
265 	"\xcd\x33\xb2\x8a\xc7\x73\xf7\x4b"
266 	"\xa0\x0e\xd1\xf3\x12\x57\x24\x35";
267 
268 static const u8 __initconst ctext5[32] =
269 	"\x98\xe7\x24\x7c\x07\xf0\xfe\x41"
270 	"\x1c\x26\x7e\x43\x84\xb0\xf6\x00"
271 	"\x2f\xf5\x8d\x80\x03\x39\x27\xab"
272 	"\x8e\xf4\xd4\x58\x75\x14\xf0\xfb";
273 
274 static const u8 __initconst ptext6[64] =
275 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
276 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
277 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
278 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
279 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
280 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
281 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
282 	"\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
283 
284 static const u8 __initconst ctext6[80] =
285 	"\x39\x80\xca\x0b\x3c\x00\xe8\x41"
286 	"\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
287 	"\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
288 	"\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
289 	"\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
290 	"\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
291 	"\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
292 	"\xcc\xda\x27\x10\xac\xad\xe2\x56"
293 	"\x99\x24\xa7\xc8\x58\x73\x36\xbf"
294 	"\xb1\x18\x02\x4d\xb8\x67\x4a\x14";
295 
296 static const u8 __initconst ctext7[16] =
297 	"\x53\x0f\x8a\xfb\xc7\x45\x36\xb9"
298 	"\xa9\x63\xb4\xf1\xc4\xcb\x73\x8b";
299 
300 static const u8 __initconst ctext8[32] =
301 	"\xce\xa7\x40\x3d\x4d\x60\x6b\x6e"
302 	"\x07\x4e\xc5\xd3\xba\xf3\x9d\x18"
303 	"\xd0\xd1\xc8\xa7\x99\x99\x6b\xf0"
304 	"\x26\x5b\x98\xb5\xd4\x8a\xb9\x19";
305 
306 static const u8 __initconst ptext9[64] =
307 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
308 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
309 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
310 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
311 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
312 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
313 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
314 	"\xba\x63\x7b\x39\x1a\xaf\xd2\x55";
315 
316 static const u8 __initconst ctext9[80] =
317 	"\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
318 	"\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
319 	"\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
320 	"\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
321 	"\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
322 	"\xa7\xb0\x8b\x10\x56\x82\x88\x38"
323 	"\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
324 	"\xbc\xc9\xf6\x62\x89\x80\x15\xad"
325 	"\xb0\x94\xda\xc5\xd9\x34\x71\xbd"
326 	"\xec\x1a\x50\x22\x70\xe3\xcc\x6c";
327 
328 static const u8 __initconst ptext10[60] =
329 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
330 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
331 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
332 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
333 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
334 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
335 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
336 	"\xba\x63\x7b\x39";
337 
338 static const u8 __initconst ctext10[76] =
339 	"\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
340 	"\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
341 	"\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
342 	"\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
343 	"\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
344 	"\xa7\xb0\x8b\x10\x56\x82\x88\x38"
345 	"\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
346 	"\xbc\xc9\xf6\x62"
347 	"\x76\xfc\x6e\xce\x0f\x4e\x17\x68"
348 	"\xcd\xdf\x88\x53\xbb\x2d\x55\x1b";
349 
350 static const u8 __initconst ptext11[60] =
351 	"\xd9\x31\x32\x25\xf8\x84\x06\xe5"
352 	"\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
353 	"\x86\xa7\xa9\x53\x15\x34\xf7\xda"
354 	"\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
355 	"\x1c\x3c\x0c\x95\x95\x68\x09\x53"
356 	"\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
357 	"\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
358 	"\xba\x63\x7b\x39";
359 
360 static const u8 __initconst ctext11[76] =
361 	"\x39\x80\xca\x0b\x3c\x00\xe8\x41"
362 	"\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
363 	"\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
364 	"\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
365 	"\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
366 	"\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
367 	"\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
368 	"\xcc\xda\x27\x10"
369 	"\x25\x19\x49\x8e\x80\xf1\x47\x8f"
370 	"\x37\xba\x55\xbd\x6d\x27\x61\x8c";
371 
372 static const u8 __initconst ptext12[719] =
373 	"\x42\xc1\xcc\x08\x48\x6f\x41\x3f"
374 	"\x2f\x11\x66\x8b\x2a\x16\xf0\xe0"
375 	"\x58\x83\xf0\xc3\x70\x14\xc0\x5b"
376 	"\x3f\xec\x1d\x25\x3c\x51\xd2\x03"
377 	"\xcf\x59\x74\x1f\xb2\x85\xb4\x07"
378 	"\xc6\x6a\x63\x39\x8a\x5b\xde\xcb"
379 	"\xaf\x08\x44\xbd\x6f\x91\x15\xe1"
380 	"\xf5\x7a\x6e\x18\xbd\xdd\x61\x50"
381 	"\x59\xa9\x97\xab\xbb\x0e\x74\x5c"
382 	"\x00\xa4\x43\x54\x04\x54\x9b\x3b"
383 	"\x77\xec\xfd\x5c\xa6\xe8\x7b\x08"
384 	"\xae\xe6\x10\x3f\x32\x65\xd1\xfc"
385 	"\xa4\x1d\x2c\x31\xfb\x33\x7a\xb3"
386 	"\x35\x23\xf4\x20\x41\xd4\xad\x82"
387 	"\x8b\xa4\xad\x96\x1c\x20\x53\xbe"
388 	"\x0e\xa6\xf4\xdc\x78\x49\x3e\x72"
389 	"\xb1\xa9\xb5\x83\xcb\x08\x54\xb7"
390 	"\xad\x49\x3a\xae\x98\xce\xa6\x66"
391 	"\x10\x30\x90\x8c\x55\x83\xd7\x7c"
392 	"\x8b\xe6\x53\xde\xd2\x6e\x18\x21"
393 	"\x01\x52\xd1\x9f\x9d\xbb\x9c\x73"
394 	"\x57\xcc\x89\x09\x75\x9b\x78\x70"
395 	"\xed\x26\x97\x4d\xb4\xe4\x0c\xa5"
396 	"\xfa\x70\x04\x70\xc6\x96\x1c\x7d"
397 	"\x54\x41\x77\xa8\xe3\xb0\x7e\x96"
398 	"\x82\xd9\xec\xa2\x87\x68\x55\xf9"
399 	"\x8f\x9e\x73\x43\x47\x6a\x08\x36"
400 	"\x93\x67\xa8\x2d\xde\xac\x41\xa9"
401 	"\x5c\x4d\x73\x97\x0f\x70\x68\xfa"
402 	"\x56\x4d\x00\xc2\x3b\x1f\xc8\xb9"
403 	"\x78\x1f\x51\x07\xe3\x9a\x13\x4e"
404 	"\xed\x2b\x2e\xa3\xf7\x44\xb2\xe7"
405 	"\xab\x19\x37\xd9\xba\x76\x5e\xd2"
406 	"\xf2\x53\x15\x17\x4c\x6b\x16\x9f"
407 	"\x02\x66\x49\xca\x7c\x91\x05\xf2"
408 	"\x45\x36\x1e\xf5\x77\xad\x1f\x46"
409 	"\xa8\x13\xfb\x63\xb6\x08\x99\x63"
410 	"\x82\xa2\xed\xb3\xac\xdf\x43\x19"
411 	"\x45\xea\x78\x73\xd9\xb7\x39\x11"
412 	"\xa3\x13\x7c\xf8\x3f\xf7\xad\x81"
413 	"\x48\x2f\xa9\x5c\x5f\xa0\xf0\x79"
414 	"\xa4\x47\x7d\x80\x20\x26\xfd\x63"
415 	"\x0a\xc7\x7e\x6d\x75\x47\xff\x76"
416 	"\x66\x2e\x8a\x6c\x81\x35\xaf\x0b"
417 	"\x2e\x6a\x49\x60\xc1\x10\xe1\xe1"
418 	"\x54\x03\xa4\x09\x0c\x37\x7a\x15"
419 	"\x23\x27\x5b\x8b\x4b\xa5\x64\x97"
420 	"\xae\x4a\x50\x73\x1f\x66\x1c\x5c"
421 	"\x03\x25\x3c\x8d\x48\x58\x71\x34"
422 	"\x0e\xec\x4e\x55\x1a\x03\x6a\xe5"
423 	"\xb6\x19\x2b\x84\x2a\x20\xd1\xea"
424 	"\x80\x6f\x96\x0e\x05\x62\xc7\x78"
425 	"\x87\x79\x60\x38\x46\xb4\x25\x57"
426 	"\x6e\x16\x63\xf8\xad\x6e\xd7\x42"
427 	"\x69\xe1\x88\xef\x6e\xd5\xb4\x9a"
428 	"\x3c\x78\x6c\x3b\xe5\xa0\x1d\x22"
429 	"\x86\x5c\x74\x3a\xeb\x24\x26\xc7"
430 	"\x09\xfc\x91\x96\x47\x87\x4f\x1a"
431 	"\xd6\x6b\x2c\x18\x47\xc0\xb8\x24"
432 	"\xa8\x5a\x4a\x9e\xcb\x03\xe7\x2a"
433 	"\x09\xe6\x4d\x9c\x6d\x86\x60\xf5"
434 	"\x2f\x48\x69\x37\x9f\xf2\xd2\xcb"
435 	"\x0e\x5a\xdd\x6e\x8a\xfb\x6a\xfe"
436 	"\x0b\x63\xde\x87\x42\x79\x8a\x68"
437 	"\x51\x28\x9b\x7a\xeb\xaf\xb8\x2f"
438 	"\x9d\xd1\xc7\x45\x90\x08\xc9\x83"
439 	"\xe9\x83\x84\xcb\x28\x69\x09\x69"
440 	"\xce\x99\x46\x00\x54\xcb\xd8\x38"
441 	"\xf9\x53\x4a\xbf\x31\xce\x57\x15"
442 	"\x33\xfa\x96\x04\x33\x42\xe3\xc0"
443 	"\xb7\x54\x4a\x65\x7a\x7c\x02\xe6"
444 	"\x19\x95\xd0\x0e\x82\x07\x63\xf9"
445 	"\xe1\x2b\x2a\xfc\x55\x92\x52\xc9"
446 	"\xb5\x9f\x23\x28\x60\xe7\x20\x51"
447 	"\x10\xd3\xed\x6d\x9b\xab\xb8\xe2"
448 	"\x5d\x9a\x34\xb3\xbe\x9c\x64\xcb"
449 	"\x78\xc6\x91\x22\x40\x91\x80\xbe"
450 	"\xd7\x78\x5c\x0e\x0a\xdc\x08\xe9"
451 	"\x67\x10\xa4\x83\x98\x79\x23\xe7"
452 	"\x92\xda\xa9\x22\x16\xb1\xe7\x78"
453 	"\xa3\x1c\x6c\x8f\x35\x7c\x4d\x37"
454 	"\x2f\x6e\x0b\x50\x5c\x34\xb9\xf9"
455 	"\xe6\x3d\x91\x0d\x32\x95\xaa\x3d"
456 	"\x48\x11\x06\xbb\x2d\xf2\x63\x88"
457 	"\x3f\x73\x09\xe2\x45\x56\x31\x51"
458 	"\xfa\x5e\x4e\x62\xf7\x90\xf9\xa9"
459 	"\x7d\x7b\x1b\xb1\xc8\x26\x6e\x66"
460 	"\xf6\x90\x9a\x7f\xf2\x57\xcc\x23"
461 	"\x59\xfa\xfa\xaa\x44\x04\x01\xa7"
462 	"\xa4\x78\xdb\x74\x3d\x8b\xb5";
463 
464 static const u8 __initconst ctext12[735] =
465 	"\x84\x0b\xdb\xd5\xb7\xa8\xfe\x20"
466 	"\xbb\xb1\x12\x7f\x41\xea\xb3\xc0"
467 	"\xa2\xb4\x37\x19\x11\x58\xb6\x0b"
468 	"\x4c\x1d\x38\x05\x54\xd1\x16\x73"
469 	"\x8e\x1c\x20\x90\xa2\x9a\xb7\x74"
470 	"\x47\xe6\xd8\xfc\x18\x3a\xb4\xea"
471 	"\xd5\x16\x5a\x2c\x53\x01\x46\xb3"
472 	"\x18\x33\x74\x6c\x50\xf2\xe8\xc0"
473 	"\x73\xda\x60\x22\xeb\xe3\xe5\x9b"
474 	"\x20\x93\x6c\x4b\x37\x99\xb8\x23"
475 	"\x3b\x4e\xac\xe8\x5b\xe8\x0f\xb7"
476 	"\xc3\x8f\xfb\x4a\x37\xd9\x39\x95"
477 	"\x34\xf1\xdb\x8f\x71\xd9\xc7\x0b"
478 	"\x02\xf1\x63\xfc\x9b\xfc\xc5\xab"
479 	"\xb9\x14\x13\x21\xdf\xce\xaa\x88"
480 	"\x44\x30\x1e\xce\x26\x01\x92\xf8"
481 	"\x9f\x00\x4b\x0c\x4b\xf7\x5f\xe0"
482 	"\x89\xca\x94\x66\x11\x21\x97\xca"
483 	"\x3e\x83\x74\x2d\xdb\x4d\x11\xeb"
484 	"\x97\xc2\x14\xff\x9e\x1e\xa0\x6b"
485 	"\x08\xb4\x31\x2b\x85\xc6\x85\x6c"
486 	"\x90\xec\x39\xc0\xec\xb3\xb5\x4e"
487 	"\xf3\x9c\xe7\x83\x3a\x77\x0a\xf4"
488 	"\x56\xfe\xce\x18\x33\x6d\x0b\x2d"
489 	"\x33\xda\xc8\x05\x5c\xb4\x09\x2a"
490 	"\xde\x6b\x52\x98\x01\xef\x36\x3d"
491 	"\xbd\xf9\x8f\xa8\x3e\xaa\xcd\xd1"
492 	"\x01\x2d\x42\x49\xc3\xb6\x84\xbb"
493 	"\x48\x96\xe0\x90\x93\x6c\x48\x64"
494 	"\xd4\xfa\x7f\x93\x2c\xa6\x21\xc8"
495 	"\x7a\x23\x7b\xaa\x20\x56\x12\xae"
496 	"\x16\x9d\x94\x0f\x54\xa1\xec\xca"
497 	"\x51\x4e\xf2\x39\xf4\xf8\x5f\x04"
498 	"\x5a\x0d\xbf\xf5\x83\xa1\x15\xe1"
499 	"\xf5\x3c\xd8\x62\xa3\xed\x47\x89"
500 	"\x85\x4c\xe5\xdb\xac\x9e\x17\x1d"
501 	"\x0c\x09\xe3\x3e\x39\x5b\x4d\x74"
502 	"\x0e\xf5\x34\xee\x70\x11\x4c\xfd"
503 	"\xdb\x34\xb1\xb5\x10\x3f\x73\xb7"
504 	"\xf5\xfa\xed\xb0\x1f\xa5\xcd\x3c"
505 	"\x8d\x35\x83\xd4\x11\x44\x6e\x6c"
506 	"\x5b\xe0\x0e\x69\xa5\x39\xe5\xbb"
507 	"\xa9\x57\x24\x37\xe6\x1f\xdd\xcf"
508 	"\x16\x2a\x13\xf9\x6a\x2d\x90\xa0"
509 	"\x03\x60\x7a\xed\x69\xd5\x00\x8b"
510 	"\x7e\x4f\xcb\xb9\xfa\x91\xb9\x37"
511 	"\xc1\x26\xce\x90\x97\x22\x64\x64"
512 	"\xc1\x72\x43\x1b\xf6\xac\xc1\x54"
513 	"\x8a\x10\x9c\xdd\x8d\xd5\x8e\xb2"
514 	"\xe4\x85\xda\xe0\x20\x5f\xf4\xb4"
515 	"\x15\xb5\xa0\x8d\x12\x74\x49\x23"
516 	"\x3a\xdf\x4a\xd3\xf0\x3b\x89\xeb"
517 	"\xf8\xcc\x62\x7b\xfb\x93\x07\x41"
518 	"\x61\x26\x94\x58\x70\xa6\x3c\xe4"
519 	"\xff\x58\xc4\x13\x3d\xcb\x36\x6b"
520 	"\x32\xe5\xb2\x6d\x03\x74\x6f\x76"
521 	"\x93\x77\xde\x48\xc4\xfa\x30\x4a"
522 	"\xda\x49\x80\x77\x0f\x1c\xbe\x11"
523 	"\xc8\x48\xb1\xe5\xbb\xf2\x8a\xe1"
524 	"\x96\x2f\x9f\xd1\x8e\x8a\x5c\xe2"
525 	"\xf7\xd7\xd8\x54\xf3\x3f\xc4\x91"
526 	"\xb8\xfb\x86\xdc\x46\x24\x91\x60"
527 	"\x6c\x2f\xc9\x41\x37\x51\x49\x54"
528 	"\x09\x81\x21\xf3\x03\x9f\x2b\xe3"
529 	"\x1f\x39\x63\xaf\xf4\xd7\x53\x60"
530 	"\xa7\xc7\x54\xf9\xee\xb1\xb1\x7d"
531 	"\x75\x54\x65\x93\xfe\xb1\x68\x6b"
532 	"\x57\x02\xf9\xbb\x0e\xf9\xf8\xbf"
533 	"\x01\x12\x27\xb4\xfe\xe4\x79\x7a"
534 	"\x40\x5b\x51\x4b\xdf\x38\xec\xb1"
535 	"\x6a\x56\xff\x35\x4d\x42\x33\xaa"
536 	"\x6f\x1b\xe4\xdc\xe0\xdb\x85\x35"
537 	"\x62\x10\xd4\xec\xeb\xc5\x7e\x45"
538 	"\x1c\x6f\x17\xca\x3b\x8e\x2d\x66"
539 	"\x4f\x4b\x36\x56\xcd\x1b\x59\xaa"
540 	"\xd2\x9b\x17\xb9\x58\xdf\x7b\x64"
541 	"\x8a\xff\x3b\x9c\xa6\xb5\x48\x9e"
542 	"\xaa\xe2\x5d\x09\x71\x32\x5f\xb6"
543 	"\x29\xbe\xe7\xc7\x52\x7e\x91\x82"
544 	"\x6b\x6d\x33\xe1\x34\x06\x36\x21"
545 	"\x5e\xbe\x1e\x2f\x3e\xc1\xfb\xea"
546 	"\x49\x2c\xb5\xca\xf7\xb0\x37\xea"
547 	"\x1f\xed\x10\x04\xd9\x48\x0d\x1a"
548 	"\x1c\xfb\xe7\x84\x0e\x83\x53\x74"
549 	"\xc7\x65\xe2\x5c\xe5\xba\x73\x4c"
550 	"\x0e\xe1\xb5\x11\x45\x61\x43\x46"
551 	"\xaa\x25\x8f\xbd\x85\x08\xfa\x4c"
552 	"\x15\xc1\xc0\xd8\xf5\xdc\x16\xbb"
553 	"\x7b\x1d\xe3\x87\x57\xa7\x2a\x1d"
554 	"\x38\x58\x9e\x8a\x43\xdc\x57"
555 	"\xd1\x81\x7d\x2b\xe9\xff\x99\x3a"
556 	"\x4b\x24\x52\x58\x55\xe1\x49\x14";
557 
558 static struct {
559 	const u8	*ptext;
560 	const u8	*ctext;
561 
562 	u8		key[AES_MAX_KEY_SIZE];
563 	u8		iv[GCM_AES_IV_SIZE];
564 	u8		assoc[20];
565 
566 	int		klen;
567 	int		clen;
568 	int		plen;
569 	int		alen;
570 } const aesgcm_tv[] __initconst = {
571 	{ /* From McGrew & Viega - http://citeseer.ist.psu.edu/656989.html */
572 		.klen	= 16,
573 		.ctext	= ctext0,
574 		.clen	= sizeof(ctext0),
575 	}, {
576 		.klen	= 16,
577 		.ptext	= ptext1,
578 		.plen	= sizeof(ptext1),
579 		.ctext	= ctext1,
580 		.clen	= sizeof(ctext1),
581 	}, {
582 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
583 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
584 		.klen	= 16,
585 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
586 			  "\xde\xca\xf8\x88",
587 		.ptext	= ptext2,
588 		.plen	= sizeof(ptext2),
589 		.ctext	= ctext2,
590 		.clen	= sizeof(ctext2),
591 	}, {
592 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
593 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
594 		.klen	= 16,
595 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
596 			  "\xde\xca\xf8\x88",
597 		.ptext	= ptext3,
598 		.plen	= sizeof(ptext3),
599 		.assoc	= "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
600 			  "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
601 			  "\xab\xad\xda\xd2",
602 		.alen	= 20,
603 		.ctext	= ctext3,
604 		.clen	= sizeof(ctext3),
605 	}, {
606 		.klen	= 24,
607 		.ctext	= ctext4,
608 		.clen	= sizeof(ctext4),
609 	}, {
610 		.klen	= 24,
611 		.ptext	= ptext1,
612 		.plen	= sizeof(ptext1),
613 		.ctext	= ctext5,
614 		.clen	= sizeof(ctext5),
615 	}, {
616 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
617 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
618 			  "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
619 		.klen	= 24,
620 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
621 			  "\xde\xca\xf8\x88",
622 		.ptext	= ptext6,
623 		.plen	= sizeof(ptext6),
624 		.ctext	= ctext6,
625 		.clen	= sizeof(ctext6),
626 	}, {
627 		.klen	= 32,
628 		.ctext	= ctext7,
629 		.clen	= sizeof(ctext7),
630 	}, {
631 		.klen	= 32,
632 		.ptext	= ptext1,
633 		.plen	= sizeof(ptext1),
634 		.ctext	= ctext8,
635 		.clen	= sizeof(ctext8),
636 	}, {
637 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
638 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
639 			  "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
640 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
641 		.klen	= 32,
642 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
643 			  "\xde\xca\xf8\x88",
644 		.ptext	= ptext9,
645 		.plen	= sizeof(ptext9),
646 		.ctext	= ctext9,
647 		.clen	= sizeof(ctext9),
648 	}, {
649 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
650 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
651 			  "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
652 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
653 		.klen	= 32,
654 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
655 			  "\xde\xca\xf8\x88",
656 		.ptext	= ptext10,
657 		.plen	= sizeof(ptext10),
658 		.assoc	= "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
659 			  "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
660 			  "\xab\xad\xda\xd2",
661 		.alen	= 20,
662 		.ctext	= ctext10,
663 		.clen	= sizeof(ctext10),
664 	}, {
665 		.key	= "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
666 			  "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
667 			  "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
668 		.klen	= 24,
669 		.iv	= "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
670 			  "\xde\xca\xf8\x88",
671 		.ptext	= ptext11,
672 		.plen	= sizeof(ptext11),
673 		.assoc	= "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
674 			  "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
675 			  "\xab\xad\xda\xd2",
676 		.alen	= 20,
677 		.ctext	= ctext11,
678 		.clen	= sizeof(ctext11),
679 	}, {
680 		.key	= "\x62\x35\xf8\x95\xfc\xa5\xeb\xf6"
681 			  "\x0e\x92\x12\x04\xd3\xa1\x3f\x2e"
682 			  "\x8b\x32\xcf\xe7\x44\xed\x13\x59"
683 			  "\x04\x38\x77\xb0\xb9\xad\xb4\x38",
684 		.klen	= 32,
685 		.iv	= "\x00\xff\xff\xff\xff\x00\x00\xff"
686 			  "\xff\xff\x00\xff",
687 		.ptext	= ptext12,
688 		.plen	= sizeof(ptext12),
689 		.ctext	= ctext12,
690 		.clen	= sizeof(ctext12),
691 	}
692 };
693 
libaesgcm_init(void)694 static int __init libaesgcm_init(void)
695 {
696 	for (int i = 0; i < ARRAY_SIZE(aesgcm_tv); i++) {
697 		u8 tagbuf[AES_BLOCK_SIZE];
698 		int plen = aesgcm_tv[i].plen;
699 		struct aesgcm_ctx ctx;
700 		u8 buf[sizeof(ptext12)];
701 
702 		if (aesgcm_expandkey(&ctx, aesgcm_tv[i].key, aesgcm_tv[i].klen,
703 				     aesgcm_tv[i].clen - plen)) {
704 			pr_err("aesgcm_expandkey() failed on vector %d\n", i);
705 			return -ENODEV;
706 		}
707 
708 		if (!aesgcm_decrypt(&ctx, buf, aesgcm_tv[i].ctext, plen,
709 				    aesgcm_tv[i].assoc, aesgcm_tv[i].alen,
710 				    aesgcm_tv[i].iv, aesgcm_tv[i].ctext + plen)
711 		    || memcmp(buf, aesgcm_tv[i].ptext, plen)) {
712 			pr_err("aesgcm_decrypt() #1 failed on vector %d\n", i);
713 			return -ENODEV;
714 		}
715 
716 		/* encrypt in place */
717 		aesgcm_encrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc,
718 			       aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf);
719 		if (memcmp(buf, aesgcm_tv[i].ctext, plen)) {
720 			pr_err("aesgcm_encrypt() failed on vector %d\n", i);
721 			return -ENODEV;
722 		}
723 
724 		/* decrypt in place */
725 		if (!aesgcm_decrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc,
726 				    aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf)
727 		    || memcmp(buf, aesgcm_tv[i].ptext, plen)) {
728 			pr_err("aesgcm_decrypt() #2 failed on vector %d\n", i);
729 			return -ENODEV;
730 		}
731 	}
732 	return 0;
733 }
734 module_init(libaesgcm_init);
735 
libaesgcm_exit(void)736 static void __exit libaesgcm_exit(void)
737 {
738 }
739 module_exit(libaesgcm_exit);
740 #endif
741