1.\" Copyright (c) 2014 The FreeBSD Foundation 2.\" All rights reserved. 3.\" 4.\" This documentation was written by John-Mark Gurney under 5.\" the sponsorship of the FreeBSD Foundation and 6.\" Rubicon Communications, LLC (Netgate). 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" $FreeBSD$ 29.\" 30.Dd January 2, 2015 31.Dt CRYPTO 7 32.Os 33.Sh NAME 34.Nm crypto 35.Nd OpenCrypto algorithms 36.Sh SYNOPSIS 37In the kernel configuration file: 38.Cd "device crypto" 39.Pp 40Or load the crypto.ko module. 41.Sh DESCRIPTION 42The following cryptographic algorithms that are part of the OpenCrypto 43framework have the following requirements. 44.Pp 45Cipher algorithms: 46.Bl -tag -width ".Dv CRYPTO_AES_CBC" 47.It Dv CRYPTO_AES_CBC 48.Bl -tag -width "Block size :" -compact -offset indent 49.It IV size : 5016 51.It Block size : 5216 53.It Key size : 5416, 24 or 32 55.El 56.Pp 57This algorithm implements Cipher-block chaining. 58.It Dv CRYPTO_AES_NIST_GCM_16 59.Bl -tag -width "Block size :" -compact -offset indent 60.It IV size : 6112 62.It Block size : 631 64.It Key size : 6516, 24 or 32 66.It Digest size : 6716 68.El 69.Pp 70This algorithm implements Galois/Counter Mode. 71This is the cipher part of an AEAD 72.Pq Authenticated Encryption with Associated Data 73mode. 74This requires use of the use of a proper authentication mode, one of 75.Dv CRYPTO_AES_128_NIST_GMAC , 76.Dv CRYPTO_AES_192_NIST_GMAC 77or 78.Dv CRYPTO_AES_256_NIST_GMAC , 79that corresponds with the number of bits in the key that you are using. 80.Pp 81The associated data (if any) must be provided by the authentication mode op. 82The authentication tag will be read/written from/to the offset crd_inject 83specified in the descriptor for the authentication mode. 84.Pp 85Note: You must provide an IV on every call. 86.It Dv CRYPTO_AES_ICM 87.Bl -tag -width "Block size :" -compact -offset indent 88.It IV size : 8916 90.It Block size : 911 (aesni), 16 (software) 92.It Key size : 9316, 24 or 32 94.El 95.Pp 96This algorithm implements Integer Counter Mode. 97This is similar to what most people call counter mode, but instead of the 98counter being split into a nonce and a counter part, then entire nonce is 99used as the initial counter. 100This does mean that if a counter is required that rolls over at 32 bits, 101the transaction need to be split into two parts where the counter rolls over. 102The counter incremented as a 128-bit big endian number. 103.Pp 104Note: You must provide an IV on every call. 105.It Dv CRYPTO_AES_XTS 106.Bl -tag -width "Block size :" -compact -offset indent 107.It IV size : 1088 109.It Block size : 11016 111.It Key size : 11232 or 64 113.El 114.Pp 115This algorithm implements XEX Tweakable Block Cipher with Ciphertext Stealing 116as defined in NIST SP 800-38E. 117.Pp 118NOTE: The ciphertext stealing part is not implemented which is why this cipher 119is listed as having a block size of 16 instead of 1. 120.El 121.Pp 122Authentication algorithms: 123.Bl -tag -width ".Dv CRYPTO_AES_256_NIST_GMAC" 124.It CRYPTO_AES_128_NIST_GMAC 125See 126.Dv CRYPTO_AES_NIST_GCM_16 127in the cipher mode section. 128.It CRYPTO_AES_192_NIST_GMAC 129See 130.Dv CRYPTO_AES_NIST_GCM_16 131in the cipher mode section. 132.It CRYPTO_AES_256_NIST_GMAC 133See 134.Dv CRYPTO_AES_NIST_GCM_16 135in the cipher mode section. 136.El 137.Sh SEE ALSO 138.Xr crypto 4 , 139.Xr crypto 9 140.Sh BUGS 141Not all the implemented algorithms are listed. 142