1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * CCM: Counter with CBC-MAC 4 * 5 * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com> 6 */ 7 8 #include <crypto/internal/aead.h> 9 #include <crypto/internal/cipher.h> 10 #include <crypto/internal/hash.h> 11 #include <crypto/internal/skcipher.h> 12 #include <crypto/scatterwalk.h> 13 #include <linux/err.h> 14 #include <linux/init.h> 15 #include <linux/kernel.h> 16 #include <linux/module.h> 17 #include <linux/slab.h> 18 19 struct ccm_instance_ctx { 20 struct crypto_skcipher_spawn ctr; 21 struct crypto_ahash_spawn mac; 22 }; 23 24 struct crypto_ccm_ctx { 25 struct crypto_ahash *mac; 26 struct crypto_skcipher *ctr; 27 }; 28 29 struct crypto_rfc4309_ctx { 30 struct crypto_aead *child; 31 u8 nonce[3]; 32 }; 33 34 struct crypto_rfc4309_req_ctx { 35 struct scatterlist src[3]; 36 struct scatterlist dst[3]; 37 struct aead_request subreq; 38 }; 39 40 struct crypto_ccm_req_priv_ctx { 41 u8 odata[16]; 42 u8 idata[16]; 43 u8 auth_tag[16]; 44 u32 flags; 45 struct scatterlist src[3]; 46 struct scatterlist dst[3]; 47 union { 48 struct ahash_request ahreq; 49 struct skcipher_request skreq; 50 }; 51 }; 52 53 struct cbcmac_tfm_ctx { 54 struct crypto_cipher *child; 55 }; 56 57 struct cbcmac_desc_ctx { 58 unsigned int len; 59 }; 60 61 static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx( 62 struct aead_request *req) 63 { 64 unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req)); 65 66 return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1); 67 } 68 69 static int set_msg_len(u8 *block, unsigned int msglen, int csize) 70 { 71 __be32 data; 72 73 memset(block, 0, csize); 74 block += csize; 75 76 if (csize >= 4) 77 csize = 4; 78 else if (msglen > (1 << (8 * csize))) 79 return -EOVERFLOW; 80 81 data = cpu_to_be32(msglen); 82 memcpy(block - csize, (u8 *)&data + 4 - csize, csize); 83 84 return 0; 85 } 86 87 static int crypto_ccm_setkey(struct crypto_aead *aead, const u8 *key, 88 unsigned int keylen) 89 { 90 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 91 struct crypto_skcipher *ctr = ctx->ctr; 92 struct crypto_ahash *mac = ctx->mac; 93 int err; 94 95 crypto_skcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK); 96 crypto_skcipher_set_flags(ctr, crypto_aead_get_flags(aead) & 97 CRYPTO_TFM_REQ_MASK); 98 err = crypto_skcipher_setkey(ctr, key, keylen); 99 if (err) 100 return err; 101 102 crypto_ahash_clear_flags(mac, CRYPTO_TFM_REQ_MASK); 103 crypto_ahash_set_flags(mac, crypto_aead_get_flags(aead) & 104 CRYPTO_TFM_REQ_MASK); 105 return crypto_ahash_setkey(mac, key, keylen); 106 } 107 108 static int crypto_ccm_setauthsize(struct crypto_aead *tfm, 109 unsigned int authsize) 110 { 111 switch (authsize) { 112 case 4: 113 case 6: 114 case 8: 115 case 10: 116 case 12: 117 case 14: 118 case 16: 119 break; 120 default: 121 return -EINVAL; 122 } 123 124 return 0; 125 } 126 127 static int format_input(u8 *info, struct aead_request *req, 128 unsigned int cryptlen) 129 { 130 struct crypto_aead *aead = crypto_aead_reqtfm(req); 131 unsigned int lp = req->iv[0]; 132 unsigned int l = lp + 1; 133 unsigned int m; 134 135 m = crypto_aead_authsize(aead); 136 137 memcpy(info, req->iv, 16); 138 139 /* format control info per RFC 3610 and 140 * NIST Special Publication 800-38C 141 */ 142 *info |= (8 * ((m - 2) / 2)); 143 if (req->assoclen) 144 *info |= 64; 145 146 return set_msg_len(info + 16 - l, cryptlen, l); 147 } 148 149 static int format_adata(u8 *adata, unsigned int a) 150 { 151 int len = 0; 152 153 /* add control info for associated data 154 * RFC 3610 and NIST Special Publication 800-38C 155 */ 156 if (a < 65280) { 157 *(__be16 *)adata = cpu_to_be16(a); 158 len = 2; 159 } else { 160 *(__be16 *)adata = cpu_to_be16(0xfffe); 161 *(__be32 *)&adata[2] = cpu_to_be32(a); 162 len = 6; 163 } 164 165 return len; 166 } 167 168 static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain, 169 unsigned int cryptlen) 170 { 171 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 172 struct crypto_aead *aead = crypto_aead_reqtfm(req); 173 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 174 struct ahash_request *ahreq = &pctx->ahreq; 175 unsigned int assoclen = req->assoclen; 176 struct scatterlist sg[3]; 177 u8 *odata = pctx->odata; 178 u8 *idata = pctx->idata; 179 int ilen, err; 180 181 /* format control data for input */ 182 err = format_input(odata, req, cryptlen); 183 if (err) 184 goto out; 185 186 sg_init_table(sg, 3); 187 sg_set_buf(&sg[0], odata, 16); 188 189 /* format associated data and compute into mac */ 190 if (assoclen) { 191 ilen = format_adata(idata, assoclen); 192 sg_set_buf(&sg[1], idata, ilen); 193 sg_chain(sg, 3, req->src); 194 } else { 195 ilen = 0; 196 sg_chain(sg, 2, req->src); 197 } 198 199 ahash_request_set_tfm(ahreq, ctx->mac); 200 ahash_request_set_callback(ahreq, pctx->flags, NULL, NULL); 201 ahash_request_set_crypt(ahreq, sg, NULL, assoclen + ilen + 16); 202 err = crypto_ahash_init(ahreq); 203 if (err) 204 goto out; 205 err = crypto_ahash_update(ahreq); 206 if (err) 207 goto out; 208 209 /* we need to pad the MAC input to a round multiple of the block size */ 210 ilen = 16 - (assoclen + ilen) % 16; 211 if (ilen < 16) { 212 memset(idata, 0, ilen); 213 sg_init_table(sg, 2); 214 sg_set_buf(&sg[0], idata, ilen); 215 if (plain) 216 sg_chain(sg, 2, plain); 217 plain = sg; 218 cryptlen += ilen; 219 } 220 221 ahash_request_set_crypt(ahreq, plain, odata, cryptlen); 222 err = crypto_ahash_finup(ahreq); 223 out: 224 return err; 225 } 226 227 static void crypto_ccm_encrypt_done(void *data, int err) 228 { 229 struct aead_request *req = data; 230 struct crypto_aead *aead = crypto_aead_reqtfm(req); 231 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 232 u8 *odata = pctx->odata; 233 234 if (!err) 235 scatterwalk_map_and_copy(odata, req->dst, 236 req->assoclen + req->cryptlen, 237 crypto_aead_authsize(aead), 1); 238 aead_request_complete(req, err); 239 } 240 241 static inline int crypto_ccm_check_iv(const u8 *iv) 242 { 243 /* 2 <= L <= 8, so 1 <= L' <= 7. */ 244 if (1 > iv[0] || iv[0] > 7) 245 return -EINVAL; 246 247 return 0; 248 } 249 250 static int crypto_ccm_init_crypt(struct aead_request *req, u8 *tag) 251 { 252 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 253 struct scatterlist *sg; 254 u8 *iv = req->iv; 255 int err; 256 257 err = crypto_ccm_check_iv(iv); 258 if (err) 259 return err; 260 261 pctx->flags = aead_request_flags(req); 262 263 /* Note: rfc 3610 and NIST 800-38C require counter of 264 * zero to encrypt auth tag. 265 */ 266 memset(iv + 15 - iv[0], 0, iv[0] + 1); 267 268 sg_init_table(pctx->src, 3); 269 sg_set_buf(pctx->src, tag, 16); 270 sg = scatterwalk_ffwd(pctx->src + 1, req->src, req->assoclen); 271 if (sg != pctx->src + 1) 272 sg_chain(pctx->src, 2, sg); 273 274 if (req->src != req->dst) { 275 sg_init_table(pctx->dst, 3); 276 sg_set_buf(pctx->dst, tag, 16); 277 sg = scatterwalk_ffwd(pctx->dst + 1, req->dst, req->assoclen); 278 if (sg != pctx->dst + 1) 279 sg_chain(pctx->dst, 2, sg); 280 } 281 282 return 0; 283 } 284 285 static int crypto_ccm_encrypt(struct aead_request *req) 286 { 287 struct crypto_aead *aead = crypto_aead_reqtfm(req); 288 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 289 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 290 struct skcipher_request *skreq = &pctx->skreq; 291 struct scatterlist *dst; 292 unsigned int cryptlen = req->cryptlen; 293 u8 *odata = pctx->odata; 294 u8 *iv = req->iv; 295 int err; 296 297 err = crypto_ccm_init_crypt(req, odata); 298 if (err) 299 return err; 300 301 err = crypto_ccm_auth(req, sg_next(pctx->src), cryptlen); 302 if (err) 303 return err; 304 305 dst = pctx->src; 306 if (req->src != req->dst) 307 dst = pctx->dst; 308 309 skcipher_request_set_tfm(skreq, ctx->ctr); 310 skcipher_request_set_callback(skreq, pctx->flags, 311 crypto_ccm_encrypt_done, req); 312 skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv); 313 err = crypto_skcipher_encrypt(skreq); 314 if (err) 315 return err; 316 317 /* copy authtag to end of dst */ 318 scatterwalk_map_and_copy(odata, sg_next(dst), cryptlen, 319 crypto_aead_authsize(aead), 1); 320 return err; 321 } 322 323 static void crypto_ccm_decrypt_done(void *data, int err) 324 { 325 struct aead_request *req = data; 326 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 327 struct crypto_aead *aead = crypto_aead_reqtfm(req); 328 unsigned int authsize = crypto_aead_authsize(aead); 329 unsigned int cryptlen = req->cryptlen - authsize; 330 struct scatterlist *dst; 331 332 pctx->flags = 0; 333 334 dst = sg_next(req->src == req->dst ? pctx->src : pctx->dst); 335 336 if (!err) { 337 err = crypto_ccm_auth(req, dst, cryptlen); 338 if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize)) 339 err = -EBADMSG; 340 } 341 aead_request_complete(req, err); 342 } 343 344 static int crypto_ccm_decrypt(struct aead_request *req) 345 { 346 struct crypto_aead *aead = crypto_aead_reqtfm(req); 347 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 348 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 349 struct skcipher_request *skreq = &pctx->skreq; 350 struct scatterlist *dst; 351 unsigned int authsize = crypto_aead_authsize(aead); 352 unsigned int cryptlen = req->cryptlen; 353 u8 *authtag = pctx->auth_tag; 354 u8 *odata = pctx->odata; 355 u8 *iv = pctx->idata; 356 int err; 357 358 cryptlen -= authsize; 359 360 err = crypto_ccm_init_crypt(req, authtag); 361 if (err) 362 return err; 363 364 scatterwalk_map_and_copy(authtag, sg_next(pctx->src), cryptlen, 365 authsize, 0); 366 367 dst = pctx->src; 368 if (req->src != req->dst) 369 dst = pctx->dst; 370 371 memcpy(iv, req->iv, 16); 372 373 skcipher_request_set_tfm(skreq, ctx->ctr); 374 skcipher_request_set_callback(skreq, pctx->flags, 375 crypto_ccm_decrypt_done, req); 376 skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv); 377 err = crypto_skcipher_decrypt(skreq); 378 if (err) 379 return err; 380 381 err = crypto_ccm_auth(req, sg_next(dst), cryptlen); 382 if (err) 383 return err; 384 385 /* verify */ 386 if (crypto_memneq(authtag, odata, authsize)) 387 return -EBADMSG; 388 389 return err; 390 } 391 392 static int crypto_ccm_init_tfm(struct crypto_aead *tfm) 393 { 394 struct aead_instance *inst = aead_alg_instance(tfm); 395 struct ccm_instance_ctx *ictx = aead_instance_ctx(inst); 396 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm); 397 struct crypto_ahash *mac; 398 struct crypto_skcipher *ctr; 399 unsigned long align; 400 int err; 401 402 mac = crypto_spawn_ahash(&ictx->mac); 403 if (IS_ERR(mac)) 404 return PTR_ERR(mac); 405 406 ctr = crypto_spawn_skcipher(&ictx->ctr); 407 err = PTR_ERR(ctr); 408 if (IS_ERR(ctr)) 409 goto err_free_mac; 410 411 ctx->mac = mac; 412 ctx->ctr = ctr; 413 414 align = crypto_aead_alignmask(tfm); 415 align &= ~(crypto_tfm_ctx_alignment() - 1); 416 crypto_aead_set_reqsize( 417 tfm, 418 align + sizeof(struct crypto_ccm_req_priv_ctx) + 419 max(crypto_ahash_reqsize(mac), crypto_skcipher_reqsize(ctr))); 420 421 return 0; 422 423 err_free_mac: 424 crypto_free_ahash(mac); 425 return err; 426 } 427 428 static void crypto_ccm_exit_tfm(struct crypto_aead *tfm) 429 { 430 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm); 431 432 crypto_free_ahash(ctx->mac); 433 crypto_free_skcipher(ctx->ctr); 434 } 435 436 static void crypto_ccm_free(struct aead_instance *inst) 437 { 438 struct ccm_instance_ctx *ctx = aead_instance_ctx(inst); 439 440 crypto_drop_ahash(&ctx->mac); 441 crypto_drop_skcipher(&ctx->ctr); 442 kfree(inst); 443 } 444 445 static int crypto_ccm_create_common(struct crypto_template *tmpl, 446 struct rtattr **tb, 447 const char *ctr_name, 448 const char *mac_name) 449 { 450 struct skcipher_alg_common *ctr; 451 u32 mask; 452 struct aead_instance *inst; 453 struct ccm_instance_ctx *ictx; 454 struct hash_alg_common *mac; 455 int err; 456 457 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask); 458 if (err) 459 return err; 460 461 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL); 462 if (!inst) 463 return -ENOMEM; 464 ictx = aead_instance_ctx(inst); 465 466 err = crypto_grab_ahash(&ictx->mac, aead_crypto_instance(inst), 467 mac_name, 0, mask | CRYPTO_ALG_ASYNC); 468 if (err) 469 goto err_free_inst; 470 mac = crypto_spawn_ahash_alg(&ictx->mac); 471 472 err = -EINVAL; 473 if (strncmp(mac->base.cra_name, "cbcmac(", 7) != 0 || 474 mac->digestsize != 16) 475 goto err_free_inst; 476 477 err = crypto_grab_skcipher(&ictx->ctr, aead_crypto_instance(inst), 478 ctr_name, 0, mask); 479 if (err) 480 goto err_free_inst; 481 ctr = crypto_spawn_skcipher_alg_common(&ictx->ctr); 482 483 /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */ 484 err = -EINVAL; 485 if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 || 486 ctr->ivsize != 16 || ctr->base.cra_blocksize != 1) 487 goto err_free_inst; 488 489 /* ctr and cbcmac must use the same underlying block cipher. */ 490 if (strcmp(ctr->base.cra_name + 4, mac->base.cra_name + 7) != 0) 491 goto err_free_inst; 492 493 err = -ENAMETOOLONG; 494 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, 495 "ccm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME) 496 goto err_free_inst; 497 498 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, 499 "ccm_base(%s,%s)", ctr->base.cra_driver_name, 500 mac->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) 501 goto err_free_inst; 502 503 inst->alg.base.cra_priority = (mac->base.cra_priority + 504 ctr->base.cra_priority) / 2; 505 inst->alg.base.cra_blocksize = 1; 506 inst->alg.base.cra_alignmask = mac->base.cra_alignmask | 507 ctr->base.cra_alignmask; 508 inst->alg.ivsize = 16; 509 inst->alg.chunksize = ctr->chunksize; 510 inst->alg.maxauthsize = 16; 511 inst->alg.base.cra_ctxsize = sizeof(struct crypto_ccm_ctx); 512 inst->alg.init = crypto_ccm_init_tfm; 513 inst->alg.exit = crypto_ccm_exit_tfm; 514 inst->alg.setkey = crypto_ccm_setkey; 515 inst->alg.setauthsize = crypto_ccm_setauthsize; 516 inst->alg.encrypt = crypto_ccm_encrypt; 517 inst->alg.decrypt = crypto_ccm_decrypt; 518 519 inst->free = crypto_ccm_free; 520 521 err = aead_register_instance(tmpl, inst); 522 if (err) { 523 err_free_inst: 524 crypto_ccm_free(inst); 525 } 526 return err; 527 } 528 529 static int crypto_ccm_create(struct crypto_template *tmpl, struct rtattr **tb) 530 { 531 const char *cipher_name; 532 char ctr_name[CRYPTO_MAX_ALG_NAME]; 533 char mac_name[CRYPTO_MAX_ALG_NAME]; 534 535 cipher_name = crypto_attr_alg_name(tb[1]); 536 if (IS_ERR(cipher_name)) 537 return PTR_ERR(cipher_name); 538 539 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", 540 cipher_name) >= CRYPTO_MAX_ALG_NAME) 541 return -ENAMETOOLONG; 542 543 if (snprintf(mac_name, CRYPTO_MAX_ALG_NAME, "cbcmac(%s)", 544 cipher_name) >= CRYPTO_MAX_ALG_NAME) 545 return -ENAMETOOLONG; 546 547 return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name); 548 } 549 550 static int crypto_ccm_base_create(struct crypto_template *tmpl, 551 struct rtattr **tb) 552 { 553 const char *ctr_name; 554 const char *mac_name; 555 556 ctr_name = crypto_attr_alg_name(tb[1]); 557 if (IS_ERR(ctr_name)) 558 return PTR_ERR(ctr_name); 559 560 mac_name = crypto_attr_alg_name(tb[2]); 561 if (IS_ERR(mac_name)) 562 return PTR_ERR(mac_name); 563 564 return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name); 565 } 566 567 static int crypto_rfc4309_setkey(struct crypto_aead *parent, const u8 *key, 568 unsigned int keylen) 569 { 570 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent); 571 struct crypto_aead *child = ctx->child; 572 573 if (keylen < 3) 574 return -EINVAL; 575 576 keylen -= 3; 577 memcpy(ctx->nonce, key + keylen, 3); 578 579 crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK); 580 crypto_aead_set_flags(child, crypto_aead_get_flags(parent) & 581 CRYPTO_TFM_REQ_MASK); 582 return crypto_aead_setkey(child, key, keylen); 583 } 584 585 static int crypto_rfc4309_setauthsize(struct crypto_aead *parent, 586 unsigned int authsize) 587 { 588 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent); 589 590 switch (authsize) { 591 case 8: 592 case 12: 593 case 16: 594 break; 595 default: 596 return -EINVAL; 597 } 598 599 return crypto_aead_setauthsize(ctx->child, authsize); 600 } 601 602 static struct aead_request *crypto_rfc4309_crypt(struct aead_request *req) 603 { 604 struct crypto_rfc4309_req_ctx *rctx = aead_request_ctx(req); 605 struct aead_request *subreq = &rctx->subreq; 606 struct crypto_aead *aead = crypto_aead_reqtfm(req); 607 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(aead); 608 struct crypto_aead *child = ctx->child; 609 struct scatterlist *sg; 610 u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child), 611 crypto_aead_alignmask(child) + 1); 612 613 /* L' */ 614 iv[0] = 3; 615 616 memcpy(iv + 1, ctx->nonce, 3); 617 memcpy(iv + 4, req->iv, 8); 618 619 scatterwalk_map_and_copy(iv + 16, req->src, 0, req->assoclen - 8, 0); 620 621 sg_init_table(rctx->src, 3); 622 sg_set_buf(rctx->src, iv + 16, req->assoclen - 8); 623 sg = scatterwalk_ffwd(rctx->src + 1, req->src, req->assoclen); 624 if (sg != rctx->src + 1) 625 sg_chain(rctx->src, 2, sg); 626 627 if (req->src != req->dst) { 628 sg_init_table(rctx->dst, 3); 629 sg_set_buf(rctx->dst, iv + 16, req->assoclen - 8); 630 sg = scatterwalk_ffwd(rctx->dst + 1, req->dst, req->assoclen); 631 if (sg != rctx->dst + 1) 632 sg_chain(rctx->dst, 2, sg); 633 } 634 635 aead_request_set_tfm(subreq, child); 636 aead_request_set_callback(subreq, req->base.flags, req->base.complete, 637 req->base.data); 638 aead_request_set_crypt(subreq, rctx->src, 639 req->src == req->dst ? rctx->src : rctx->dst, 640 req->cryptlen, iv); 641 aead_request_set_ad(subreq, req->assoclen - 8); 642 643 return subreq; 644 } 645 646 static int crypto_rfc4309_encrypt(struct aead_request *req) 647 { 648 if (req->assoclen != 16 && req->assoclen != 20) 649 return -EINVAL; 650 651 req = crypto_rfc4309_crypt(req); 652 653 return crypto_aead_encrypt(req); 654 } 655 656 static int crypto_rfc4309_decrypt(struct aead_request *req) 657 { 658 if (req->assoclen != 16 && req->assoclen != 20) 659 return -EINVAL; 660 661 req = crypto_rfc4309_crypt(req); 662 663 return crypto_aead_decrypt(req); 664 } 665 666 static int crypto_rfc4309_init_tfm(struct crypto_aead *tfm) 667 { 668 struct aead_instance *inst = aead_alg_instance(tfm); 669 struct crypto_aead_spawn *spawn = aead_instance_ctx(inst); 670 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm); 671 struct crypto_aead *aead; 672 unsigned long align; 673 674 aead = crypto_spawn_aead(spawn); 675 if (IS_ERR(aead)) 676 return PTR_ERR(aead); 677 678 ctx->child = aead; 679 680 align = crypto_aead_alignmask(aead); 681 align &= ~(crypto_tfm_ctx_alignment() - 1); 682 crypto_aead_set_reqsize( 683 tfm, 684 sizeof(struct crypto_rfc4309_req_ctx) + 685 ALIGN(crypto_aead_reqsize(aead), crypto_tfm_ctx_alignment()) + 686 align + 32); 687 688 return 0; 689 } 690 691 static void crypto_rfc4309_exit_tfm(struct crypto_aead *tfm) 692 { 693 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm); 694 695 crypto_free_aead(ctx->child); 696 } 697 698 static void crypto_rfc4309_free(struct aead_instance *inst) 699 { 700 crypto_drop_aead(aead_instance_ctx(inst)); 701 kfree(inst); 702 } 703 704 static int crypto_rfc4309_create(struct crypto_template *tmpl, 705 struct rtattr **tb) 706 { 707 u32 mask; 708 struct aead_instance *inst; 709 struct crypto_aead_spawn *spawn; 710 struct aead_alg *alg; 711 int err; 712 713 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask); 714 if (err) 715 return err; 716 717 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); 718 if (!inst) 719 return -ENOMEM; 720 721 spawn = aead_instance_ctx(inst); 722 err = crypto_grab_aead(spawn, aead_crypto_instance(inst), 723 crypto_attr_alg_name(tb[1]), 0, mask); 724 if (err) 725 goto err_free_inst; 726 727 alg = crypto_spawn_aead_alg(spawn); 728 729 err = -EINVAL; 730 731 /* We only support 16-byte blocks. */ 732 if (crypto_aead_alg_ivsize(alg) != 16) 733 goto err_free_inst; 734 735 /* Not a stream cipher? */ 736 if (alg->base.cra_blocksize != 1) 737 goto err_free_inst; 738 739 err = -ENAMETOOLONG; 740 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, 741 "rfc4309(%s)", alg->base.cra_name) >= 742 CRYPTO_MAX_ALG_NAME || 743 snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, 744 "rfc4309(%s)", alg->base.cra_driver_name) >= 745 CRYPTO_MAX_ALG_NAME) 746 goto err_free_inst; 747 748 inst->alg.base.cra_priority = alg->base.cra_priority; 749 inst->alg.base.cra_blocksize = 1; 750 inst->alg.base.cra_alignmask = alg->base.cra_alignmask; 751 752 inst->alg.ivsize = 8; 753 inst->alg.chunksize = crypto_aead_alg_chunksize(alg); 754 inst->alg.maxauthsize = 16; 755 756 inst->alg.base.cra_ctxsize = sizeof(struct crypto_rfc4309_ctx); 757 758 inst->alg.init = crypto_rfc4309_init_tfm; 759 inst->alg.exit = crypto_rfc4309_exit_tfm; 760 761 inst->alg.setkey = crypto_rfc4309_setkey; 762 inst->alg.setauthsize = crypto_rfc4309_setauthsize; 763 inst->alg.encrypt = crypto_rfc4309_encrypt; 764 inst->alg.decrypt = crypto_rfc4309_decrypt; 765 766 inst->free = crypto_rfc4309_free; 767 768 err = aead_register_instance(tmpl, inst); 769 if (err) { 770 err_free_inst: 771 crypto_rfc4309_free(inst); 772 } 773 return err; 774 } 775 776 static int crypto_cbcmac_digest_setkey(struct crypto_shash *parent, 777 const u8 *inkey, unsigned int keylen) 778 { 779 struct cbcmac_tfm_ctx *ctx = crypto_shash_ctx(parent); 780 781 return crypto_cipher_setkey(ctx->child, inkey, keylen); 782 } 783 784 static int crypto_cbcmac_digest_init(struct shash_desc *pdesc) 785 { 786 struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc); 787 int bs = crypto_shash_digestsize(pdesc->tfm); 788 u8 *dg = (u8 *)ctx + crypto_shash_descsize(pdesc->tfm) - bs; 789 790 ctx->len = 0; 791 memset(dg, 0, bs); 792 793 return 0; 794 } 795 796 static int crypto_cbcmac_digest_update(struct shash_desc *pdesc, const u8 *p, 797 unsigned int len) 798 { 799 struct crypto_shash *parent = pdesc->tfm; 800 struct cbcmac_tfm_ctx *tctx = crypto_shash_ctx(parent); 801 struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc); 802 struct crypto_cipher *tfm = tctx->child; 803 int bs = crypto_shash_digestsize(parent); 804 u8 *dg = (u8 *)ctx + crypto_shash_descsize(parent) - bs; 805 806 while (len > 0) { 807 unsigned int l = min(len, bs - ctx->len); 808 809 crypto_xor(dg + ctx->len, p, l); 810 ctx->len +=l; 811 len -= l; 812 p += l; 813 814 if (ctx->len == bs) { 815 crypto_cipher_encrypt_one(tfm, dg, dg); 816 ctx->len = 0; 817 } 818 } 819 820 return 0; 821 } 822 823 static int crypto_cbcmac_digest_final(struct shash_desc *pdesc, u8 *out) 824 { 825 struct crypto_shash *parent = pdesc->tfm; 826 struct cbcmac_tfm_ctx *tctx = crypto_shash_ctx(parent); 827 struct cbcmac_desc_ctx *ctx = shash_desc_ctx(pdesc); 828 struct crypto_cipher *tfm = tctx->child; 829 int bs = crypto_shash_digestsize(parent); 830 u8 *dg = (u8 *)ctx + crypto_shash_descsize(parent) - bs; 831 832 if (ctx->len) 833 crypto_cipher_encrypt_one(tfm, dg, dg); 834 835 memcpy(out, dg, bs); 836 return 0; 837 } 838 839 static int cbcmac_init_tfm(struct crypto_tfm *tfm) 840 { 841 struct crypto_cipher *cipher; 842 struct crypto_instance *inst = (void *)tfm->__crt_alg; 843 struct crypto_cipher_spawn *spawn = crypto_instance_ctx(inst); 844 struct cbcmac_tfm_ctx *ctx = crypto_tfm_ctx(tfm); 845 846 cipher = crypto_spawn_cipher(spawn); 847 if (IS_ERR(cipher)) 848 return PTR_ERR(cipher); 849 850 ctx->child = cipher; 851 852 return 0; 853 }; 854 855 static void cbcmac_exit_tfm(struct crypto_tfm *tfm) 856 { 857 struct cbcmac_tfm_ctx *ctx = crypto_tfm_ctx(tfm); 858 crypto_free_cipher(ctx->child); 859 } 860 861 static int cbcmac_create(struct crypto_template *tmpl, struct rtattr **tb) 862 { 863 struct shash_instance *inst; 864 struct crypto_cipher_spawn *spawn; 865 struct crypto_alg *alg; 866 u32 mask; 867 int err; 868 869 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH, &mask); 870 if (err) 871 return err; 872 873 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); 874 if (!inst) 875 return -ENOMEM; 876 spawn = shash_instance_ctx(inst); 877 878 err = crypto_grab_cipher(spawn, shash_crypto_instance(inst), 879 crypto_attr_alg_name(tb[1]), 0, mask); 880 if (err) 881 goto err_free_inst; 882 alg = crypto_spawn_cipher_alg(spawn); 883 884 err = crypto_inst_setname(shash_crypto_instance(inst), tmpl->name, alg); 885 if (err) 886 goto err_free_inst; 887 888 inst->alg.base.cra_priority = alg->cra_priority; 889 inst->alg.base.cra_blocksize = 1; 890 891 inst->alg.digestsize = alg->cra_blocksize; 892 inst->alg.descsize = ALIGN(sizeof(struct cbcmac_desc_ctx), 893 alg->cra_alignmask + 1) + 894 alg->cra_blocksize; 895 896 inst->alg.base.cra_ctxsize = sizeof(struct cbcmac_tfm_ctx); 897 inst->alg.base.cra_init = cbcmac_init_tfm; 898 inst->alg.base.cra_exit = cbcmac_exit_tfm; 899 900 inst->alg.init = crypto_cbcmac_digest_init; 901 inst->alg.update = crypto_cbcmac_digest_update; 902 inst->alg.final = crypto_cbcmac_digest_final; 903 inst->alg.setkey = crypto_cbcmac_digest_setkey; 904 905 inst->free = shash_free_singlespawn_instance; 906 907 err = shash_register_instance(tmpl, inst); 908 if (err) { 909 err_free_inst: 910 shash_free_singlespawn_instance(inst); 911 } 912 return err; 913 } 914 915 static struct crypto_template crypto_ccm_tmpls[] = { 916 { 917 .name = "cbcmac", 918 .create = cbcmac_create, 919 .module = THIS_MODULE, 920 }, { 921 .name = "ccm_base", 922 .create = crypto_ccm_base_create, 923 .module = THIS_MODULE, 924 }, { 925 .name = "ccm", 926 .create = crypto_ccm_create, 927 .module = THIS_MODULE, 928 }, { 929 .name = "rfc4309", 930 .create = crypto_rfc4309_create, 931 .module = THIS_MODULE, 932 }, 933 }; 934 935 static int __init crypto_ccm_module_init(void) 936 { 937 return crypto_register_templates(crypto_ccm_tmpls, 938 ARRAY_SIZE(crypto_ccm_tmpls)); 939 } 940 941 static void __exit crypto_ccm_module_exit(void) 942 { 943 crypto_unregister_templates(crypto_ccm_tmpls, 944 ARRAY_SIZE(crypto_ccm_tmpls)); 945 } 946 947 subsys_initcall(crypto_ccm_module_init); 948 module_exit(crypto_ccm_module_exit); 949 950 MODULE_LICENSE("GPL"); 951 MODULE_DESCRIPTION("Counter with CBC MAC"); 952 MODULE_ALIAS_CRYPTO("ccm_base"); 953 MODULE_ALIAS_CRYPTO("rfc4309"); 954 MODULE_ALIAS_CRYPTO("ccm"); 955 MODULE_ALIAS_CRYPTO("cbcmac"); 956 MODULE_IMPORT_NS(CRYPTO_INTERNAL); 957