1 /* 2 * Cryptographic API. 3 * 4 * s390 implementation of the DES Cipher Algorithm. 5 * 6 * Copyright (c) 2003 IBM Deutschland Entwicklung GmbH, IBM Corporation 7 * Author(s): Thomas Spatzier (tspat@de.ibm.com) 8 * 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 */ 16 #include <linux/init.h> 17 #include <linux/module.h> 18 #include <linux/crypto.h> 19 20 #include "crypt_s390.h" 21 #include "crypto_des.h" 22 23 #define DES_BLOCK_SIZE 8 24 #define DES_KEY_SIZE 8 25 26 #define DES3_128_KEY_SIZE (2 * DES_KEY_SIZE) 27 #define DES3_128_BLOCK_SIZE DES_BLOCK_SIZE 28 29 #define DES3_192_KEY_SIZE (3 * DES_KEY_SIZE) 30 #define DES3_192_BLOCK_SIZE DES_BLOCK_SIZE 31 32 struct crypt_s390_des_ctx { 33 u8 iv[DES_BLOCK_SIZE]; 34 u8 key[DES_KEY_SIZE]; 35 }; 36 37 struct crypt_s390_des3_128_ctx { 38 u8 iv[DES_BLOCK_SIZE]; 39 u8 key[DES3_128_KEY_SIZE]; 40 }; 41 42 struct crypt_s390_des3_192_ctx { 43 u8 iv[DES_BLOCK_SIZE]; 44 u8 key[DES3_192_KEY_SIZE]; 45 }; 46 47 static int des_setkey(struct crypto_tfm *tfm, const u8 *key, 48 unsigned int keylen, u32 *flags) 49 { 50 struct crypt_s390_des_ctx *dctx = crypto_tfm_ctx(tfm); 51 int ret; 52 53 /* test if key is valid (not a weak key) */ 54 ret = crypto_des_check_key(key, keylen, flags); 55 if (ret == 0) 56 memcpy(dctx->key, key, keylen); 57 return ret; 58 } 59 60 static void des_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 61 { 62 struct crypt_s390_des_ctx *dctx = crypto_tfm_ctx(tfm); 63 64 crypt_s390_km(KM_DEA_ENCRYPT, dctx->key, out, in, DES_BLOCK_SIZE); 65 } 66 67 static void des_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) 68 { 69 struct crypt_s390_des_ctx *dctx = crypto_tfm_ctx(tfm); 70 71 crypt_s390_km(KM_DEA_DECRYPT, dctx->key, out, in, DES_BLOCK_SIZE); 72 } 73 74 static unsigned int des_encrypt_ecb(const struct cipher_desc *desc, u8 *out, 75 const u8 *in, unsigned int nbytes) 76 { 77 struct crypt_s390_des_ctx *sctx = crypto_tfm_ctx(desc->tfm); 78 int ret; 79 80 /* only use complete blocks */ 81 nbytes &= ~(DES_BLOCK_SIZE - 1); 82 ret = crypt_s390_km(KM_DEA_ENCRYPT, sctx->key, out, in, nbytes); 83 BUG_ON((ret < 0) || (ret != nbytes)); 84 85 return nbytes; 86 } 87 88 static unsigned int des_decrypt_ecb(const struct cipher_desc *desc, u8 *out, 89 const u8 *in, unsigned int nbytes) 90 { 91 struct crypt_s390_des_ctx *sctx = crypto_tfm_ctx(desc->tfm); 92 int ret; 93 94 /* only use complete blocks */ 95 nbytes &= ~(DES_BLOCK_SIZE - 1); 96 ret = crypt_s390_km(KM_DEA_DECRYPT, sctx->key, out, in, nbytes); 97 BUG_ON((ret < 0) || (ret != nbytes)); 98 99 return nbytes; 100 } 101 102 static unsigned int des_encrypt_cbc(const struct cipher_desc *desc, u8 *out, 103 const u8 *in, unsigned int nbytes) 104 { 105 struct crypt_s390_des_ctx *sctx = crypto_tfm_ctx(desc->tfm); 106 int ret; 107 108 /* only use complete blocks */ 109 nbytes &= ~(DES_BLOCK_SIZE - 1); 110 111 memcpy(sctx->iv, desc->info, DES_BLOCK_SIZE); 112 ret = crypt_s390_kmc(KMC_DEA_ENCRYPT, &sctx->iv, out, in, nbytes); 113 BUG_ON((ret < 0) || (ret != nbytes)); 114 115 memcpy(desc->info, sctx->iv, DES_BLOCK_SIZE); 116 return nbytes; 117 } 118 119 static unsigned int des_decrypt_cbc(const struct cipher_desc *desc, u8 *out, 120 const u8 *in, unsigned int nbytes) 121 { 122 struct crypt_s390_des_ctx *sctx = crypto_tfm_ctx(desc->tfm); 123 int ret; 124 125 /* only use complete blocks */ 126 nbytes &= ~(DES_BLOCK_SIZE - 1); 127 128 memcpy(&sctx->iv, desc->info, DES_BLOCK_SIZE); 129 ret = crypt_s390_kmc(KMC_DEA_DECRYPT, &sctx->iv, out, in, nbytes); 130 BUG_ON((ret < 0) || (ret != nbytes)); 131 132 return nbytes; 133 } 134 135 static struct crypto_alg des_alg = { 136 .cra_name = "des", 137 .cra_flags = CRYPTO_ALG_TYPE_CIPHER, 138 .cra_blocksize = DES_BLOCK_SIZE, 139 .cra_ctxsize = sizeof(struct crypt_s390_des_ctx), 140 .cra_module = THIS_MODULE, 141 .cra_list = LIST_HEAD_INIT(des_alg.cra_list), 142 .cra_u = { 143 .cipher = { 144 .cia_min_keysize = DES_KEY_SIZE, 145 .cia_max_keysize = DES_KEY_SIZE, 146 .cia_setkey = des_setkey, 147 .cia_encrypt = des_encrypt, 148 .cia_decrypt = des_decrypt, 149 .cia_encrypt_ecb = des_encrypt_ecb, 150 .cia_decrypt_ecb = des_decrypt_ecb, 151 .cia_encrypt_cbc = des_encrypt_cbc, 152 .cia_decrypt_cbc = des_decrypt_cbc, 153 } 154 } 155 }; 156 157 /* 158 * RFC2451: 159 * 160 * For DES-EDE3, there is no known need to reject weak or 161 * complementation keys. Any weakness is obviated by the use of 162 * multiple keys. 163 * 164 * However, if the two independent 64-bit keys are equal, 165 * then the DES3 operation is simply the same as DES. 166 * Implementers MUST reject keys that exhibit this property. 167 * 168 */ 169 static int des3_128_setkey(struct crypto_tfm *tfm, const u8 *key, 170 unsigned int keylen, u32 *flags) 171 { 172 int i, ret; 173 struct crypt_s390_des3_128_ctx *dctx = crypto_tfm_ctx(tfm); 174 const u8* temp_key = key; 175 176 if (!(memcmp(key, &key[DES_KEY_SIZE], DES_KEY_SIZE))) { 177 *flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED; 178 return -EINVAL; 179 } 180 for (i = 0; i < 2; i++, temp_key += DES_KEY_SIZE) { 181 ret = crypto_des_check_key(temp_key, DES_KEY_SIZE, flags); 182 if (ret < 0) 183 return ret; 184 } 185 memcpy(dctx->key, key, keylen); 186 return 0; 187 } 188 189 static void des3_128_encrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src) 190 { 191 struct crypt_s390_des3_128_ctx *dctx = crypto_tfm_ctx(tfm); 192 193 crypt_s390_km(KM_TDEA_128_ENCRYPT, dctx->key, dst, (void*)src, 194 DES3_128_BLOCK_SIZE); 195 } 196 197 static void des3_128_decrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src) 198 { 199 struct crypt_s390_des3_128_ctx *dctx = crypto_tfm_ctx(tfm); 200 201 crypt_s390_km(KM_TDEA_128_DECRYPT, dctx->key, dst, (void*)src, 202 DES3_128_BLOCK_SIZE); 203 } 204 205 static unsigned int des3_128_encrypt_ecb(const struct cipher_desc *desc, 206 u8 *out, const u8 *in, 207 unsigned int nbytes) 208 { 209 struct crypt_s390_des3_128_ctx *sctx = crypto_tfm_ctx(desc->tfm); 210 int ret; 211 212 /* only use complete blocks */ 213 nbytes &= ~(DES3_128_BLOCK_SIZE - 1); 214 ret = crypt_s390_km(KM_TDEA_128_ENCRYPT, sctx->key, out, in, nbytes); 215 BUG_ON((ret < 0) || (ret != nbytes)); 216 217 return nbytes; 218 } 219 220 static unsigned int des3_128_decrypt_ecb(const struct cipher_desc *desc, 221 u8 *out, const u8 *in, 222 unsigned int nbytes) 223 { 224 struct crypt_s390_des3_128_ctx *sctx = crypto_tfm_ctx(desc->tfm); 225 int ret; 226 227 /* only use complete blocks */ 228 nbytes &= ~(DES3_128_BLOCK_SIZE - 1); 229 ret = crypt_s390_km(KM_TDEA_128_DECRYPT, sctx->key, out, in, nbytes); 230 BUG_ON((ret < 0) || (ret != nbytes)); 231 232 return nbytes; 233 } 234 235 static unsigned int des3_128_encrypt_cbc(const struct cipher_desc *desc, 236 u8 *out, const u8 *in, 237 unsigned int nbytes) 238 { 239 struct crypt_s390_des3_128_ctx *sctx = crypto_tfm_ctx(desc->tfm); 240 int ret; 241 242 /* only use complete blocks */ 243 nbytes &= ~(DES3_128_BLOCK_SIZE - 1); 244 245 memcpy(sctx->iv, desc->info, DES3_128_BLOCK_SIZE); 246 ret = crypt_s390_kmc(KMC_TDEA_128_ENCRYPT, &sctx->iv, out, in, nbytes); 247 BUG_ON((ret < 0) || (ret != nbytes)); 248 249 memcpy(desc->info, sctx->iv, DES3_128_BLOCK_SIZE); 250 return nbytes; 251 } 252 253 static unsigned int des3_128_decrypt_cbc(const struct cipher_desc *desc, 254 u8 *out, const u8 *in, 255 unsigned int nbytes) 256 { 257 struct crypt_s390_des3_128_ctx *sctx = crypto_tfm_ctx(desc->tfm); 258 int ret; 259 260 /* only use complete blocks */ 261 nbytes &= ~(DES3_128_BLOCK_SIZE - 1); 262 263 memcpy(&sctx->iv, desc->info, DES3_128_BLOCK_SIZE); 264 ret = crypt_s390_kmc(KMC_TDEA_128_DECRYPT, &sctx->iv, out, in, nbytes); 265 BUG_ON((ret < 0) || (ret != nbytes)); 266 267 return nbytes; 268 } 269 270 static struct crypto_alg des3_128_alg = { 271 .cra_name = "des3_ede128", 272 .cra_flags = CRYPTO_ALG_TYPE_CIPHER, 273 .cra_blocksize = DES3_128_BLOCK_SIZE, 274 .cra_ctxsize = sizeof(struct crypt_s390_des3_128_ctx), 275 .cra_module = THIS_MODULE, 276 .cra_list = LIST_HEAD_INIT(des3_128_alg.cra_list), 277 .cra_u = { 278 .cipher = { 279 .cia_min_keysize = DES3_128_KEY_SIZE, 280 .cia_max_keysize = DES3_128_KEY_SIZE, 281 .cia_setkey = des3_128_setkey, 282 .cia_encrypt = des3_128_encrypt, 283 .cia_decrypt = des3_128_decrypt, 284 .cia_encrypt_ecb = des3_128_encrypt_ecb, 285 .cia_decrypt_ecb = des3_128_decrypt_ecb, 286 .cia_encrypt_cbc = des3_128_encrypt_cbc, 287 .cia_decrypt_cbc = des3_128_decrypt_cbc, 288 } 289 } 290 }; 291 292 /* 293 * RFC2451: 294 * 295 * For DES-EDE3, there is no known need to reject weak or 296 * complementation keys. Any weakness is obviated by the use of 297 * multiple keys. 298 * 299 * However, if the first two or last two independent 64-bit keys are 300 * equal (k1 == k2 or k2 == k3), then the DES3 operation is simply the 301 * same as DES. Implementers MUST reject keys that exhibit this 302 * property. 303 * 304 */ 305 static int des3_192_setkey(struct crypto_tfm *tfm, const u8 *key, 306 unsigned int keylen, u32 *flags) 307 { 308 int i, ret; 309 struct crypt_s390_des3_192_ctx *dctx = crypto_tfm_ctx(tfm); 310 const u8* temp_key = key; 311 312 if (!(memcmp(key, &key[DES_KEY_SIZE], DES_KEY_SIZE) && 313 memcmp(&key[DES_KEY_SIZE], &key[DES_KEY_SIZE * 2], 314 DES_KEY_SIZE))) { 315 316 *flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED; 317 return -EINVAL; 318 } 319 for (i = 0; i < 3; i++, temp_key += DES_KEY_SIZE) { 320 ret = crypto_des_check_key(temp_key, DES_KEY_SIZE, flags); 321 if (ret < 0) 322 return ret; 323 } 324 memcpy(dctx->key, key, keylen); 325 return 0; 326 } 327 328 static void des3_192_encrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src) 329 { 330 struct crypt_s390_des3_192_ctx *dctx = crypto_tfm_ctx(tfm); 331 332 crypt_s390_km(KM_TDEA_192_ENCRYPT, dctx->key, dst, (void*)src, 333 DES3_192_BLOCK_SIZE); 334 } 335 336 static void des3_192_decrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src) 337 { 338 struct crypt_s390_des3_192_ctx *dctx = crypto_tfm_ctx(tfm); 339 340 crypt_s390_km(KM_TDEA_192_DECRYPT, dctx->key, dst, (void*)src, 341 DES3_192_BLOCK_SIZE); 342 } 343 344 static unsigned int des3_192_encrypt_ecb(const struct cipher_desc *desc, 345 u8 *out, const u8 *in, 346 unsigned int nbytes) 347 { 348 struct crypt_s390_des3_192_ctx *sctx = crypto_tfm_ctx(desc->tfm); 349 int ret; 350 351 /* only use complete blocks */ 352 nbytes &= ~(DES3_192_BLOCK_SIZE - 1); 353 ret = crypt_s390_km(KM_TDEA_192_ENCRYPT, sctx->key, out, in, nbytes); 354 BUG_ON((ret < 0) || (ret != nbytes)); 355 356 return nbytes; 357 } 358 359 static unsigned int des3_192_decrypt_ecb(const struct cipher_desc *desc, 360 u8 *out, const u8 *in, 361 unsigned int nbytes) 362 { 363 struct crypt_s390_des3_192_ctx *sctx = crypto_tfm_ctx(desc->tfm); 364 int ret; 365 366 /* only use complete blocks */ 367 nbytes &= ~(DES3_192_BLOCK_SIZE - 1); 368 ret = crypt_s390_km(KM_TDEA_192_DECRYPT, sctx->key, out, in, nbytes); 369 BUG_ON((ret < 0) || (ret != nbytes)); 370 371 return nbytes; 372 } 373 374 static unsigned int des3_192_encrypt_cbc(const struct cipher_desc *desc, 375 u8 *out, const u8 *in, 376 unsigned int nbytes) 377 { 378 struct crypt_s390_des3_192_ctx *sctx = crypto_tfm_ctx(desc->tfm); 379 int ret; 380 381 /* only use complete blocks */ 382 nbytes &= ~(DES3_192_BLOCK_SIZE - 1); 383 384 memcpy(sctx->iv, desc->info, DES3_192_BLOCK_SIZE); 385 ret = crypt_s390_kmc(KMC_TDEA_192_ENCRYPT, &sctx->iv, out, in, nbytes); 386 BUG_ON((ret < 0) || (ret != nbytes)); 387 388 memcpy(desc->info, sctx->iv, DES3_192_BLOCK_SIZE); 389 return nbytes; 390 } 391 392 static unsigned int des3_192_decrypt_cbc(const struct cipher_desc *desc, 393 u8 *out, const u8 *in, 394 unsigned int nbytes) 395 { 396 struct crypt_s390_des3_192_ctx *sctx = crypto_tfm_ctx(desc->tfm); 397 int ret; 398 399 /* only use complete blocks */ 400 nbytes &= ~(DES3_192_BLOCK_SIZE - 1); 401 402 memcpy(&sctx->iv, desc->info, DES3_192_BLOCK_SIZE); 403 ret = crypt_s390_kmc(KMC_TDEA_192_DECRYPT, &sctx->iv, out, in, nbytes); 404 BUG_ON((ret < 0) || (ret != nbytes)); 405 406 return nbytes; 407 } 408 409 static struct crypto_alg des3_192_alg = { 410 .cra_name = "des3_ede", 411 .cra_flags = CRYPTO_ALG_TYPE_CIPHER, 412 .cra_blocksize = DES3_192_BLOCK_SIZE, 413 .cra_ctxsize = sizeof(struct crypt_s390_des3_192_ctx), 414 .cra_module = THIS_MODULE, 415 .cra_list = LIST_HEAD_INIT(des3_192_alg.cra_list), 416 .cra_u = { 417 .cipher = { 418 .cia_min_keysize = DES3_192_KEY_SIZE, 419 .cia_max_keysize = DES3_192_KEY_SIZE, 420 .cia_setkey = des3_192_setkey, 421 .cia_encrypt = des3_192_encrypt, 422 .cia_decrypt = des3_192_decrypt, 423 .cia_encrypt_ecb = des3_192_encrypt_ecb, 424 .cia_decrypt_ecb = des3_192_decrypt_ecb, 425 .cia_encrypt_cbc = des3_192_encrypt_cbc, 426 .cia_decrypt_cbc = des3_192_decrypt_cbc, 427 } 428 } 429 }; 430 431 static int init(void) 432 { 433 int ret = 0; 434 435 if (!crypt_s390_func_available(KM_DEA_ENCRYPT) || 436 !crypt_s390_func_available(KM_TDEA_128_ENCRYPT) || 437 !crypt_s390_func_available(KM_TDEA_192_ENCRYPT)) 438 return -ENOSYS; 439 440 ret |= (crypto_register_alg(&des_alg) == 0) ? 0:1; 441 ret |= (crypto_register_alg(&des3_128_alg) == 0) ? 0:2; 442 ret |= (crypto_register_alg(&des3_192_alg) == 0) ? 0:4; 443 if (ret) { 444 crypto_unregister_alg(&des3_192_alg); 445 crypto_unregister_alg(&des3_128_alg); 446 crypto_unregister_alg(&des_alg); 447 return -EEXIST; 448 } 449 return 0; 450 } 451 452 static void __exit fini(void) 453 { 454 crypto_unregister_alg(&des3_192_alg); 455 crypto_unregister_alg(&des3_128_alg); 456 crypto_unregister_alg(&des_alg); 457 } 458 459 module_init(init); 460 module_exit(fini); 461 462 MODULE_ALIAS("des"); 463 MODULE_ALIAS("des3_ede"); 464 465 MODULE_LICENSE("GPL"); 466 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms"); 467