1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * AES-XTS unauthenticated encryption and decryption 4 * 5 * Copyright 2026 Google LLC 6 */ 7 #ifndef _CRYPTO_AES_XTS_H 8 #define _CRYPTO_AES_XTS_H 9 10 #include <crypto/aes.h> 11 #include <crypto/xts.h> 12 13 /** 14 * struct aes_xts_key - A key prepared for AES-XTS encryption and decryption 15 * 16 * Note that (depending on the architecture) this typically is around 768 bytes, 17 * which makes it a bit too large to allocate on the stack in most cases. 18 */ 19 struct aes_xts_key { 20 /* private: */ 21 struct aes_key main_key; 22 struct aes_enckey tweak_key; 23 }; 24 25 /** 26 * aes_xts_preparekey() - Prepare a key for AES-XTS encryption and decryption 27 * @key: (output) The key structure to initialize 28 * @in_key: The raw AES-XTS key 29 * @key_len: Length of the raw key in bytes 30 * @flags: Optional flag XTS_FORBID_WEAK_KEYS to forbid keys whose two halves 31 * are the same. 32 * 33 * Users should use memzero_explicit() to zeroize the key struct at the end of 34 * its lifetime. (But if this function fails, zeroization is unnecessary.) 35 * 36 * Context: Any context. 37 * Return: 38 * * 0 on success 39 * * -EINVAL if the key is rejected because its length isn't 32, 64, or (when 40 * FIPS mode isn't enabled) 48; or because its two halves are the same and 41 * either XTS_FORBID_WEAK_KEYS is given or FIPS mode is enabled. 42 */ 43 int __must_check aes_xts_preparekey(struct aes_xts_key *key, const u8 *in_key, 44 size_t key_len, int flags); 45 46 /** 47 * aes_xts_encrypt() - Encrypt data using AES-XTS 48 * @dst: The destination buffer. Can be in-place or out-of-place. For other 49 * overlaps the behavior is unspecified. 50 * @src: The source data 51 * @len: Number of bytes to encrypt. On non-final calls it must be a nonzero 52 * multiple of AES_BLOCK_SIZE. On the final call it can be any value >= 53 * AES_BLOCK_SIZE, i.e. ciphertext stealing is supported. 54 * @tweak: The tweak. It is updated with the next value, unless @len isn't a 55 * multiple of AES_BLOCK_SIZE in which case the value is unspecified. 56 * @key: The key, already prepared using aes_xts_preparekey() 57 * @cont: %false to begin encrypting a new message (do the tweak encryption); 58 * %true to continue encrypting a message (skip tweak encryption) 59 * 60 * This supports both one-shot and incremental encryption. On the first call, 61 * pass @cont = %false. On any later calls, pass @cont = %true and the updated 62 * @tweak; all earlier @len must have been multiples of AES_BLOCK_SIZE. 63 * 64 * Context: Any context. 65 */ 66 void aes_xts_encrypt(u8 *dst, const u8 *src, size_t len, 67 u8 tweak[at_least AES_BLOCK_SIZE], 68 const struct aes_xts_key *key, bool cont); 69 70 /** 71 * aes_xts_decrypt() - Decrypt data using AES-XTS 72 * @dst: The destination buffer. Can be in-place or out-of-place. For other 73 * overlaps the behavior is unspecified. 74 * @src: The source data 75 * @len: Number of bytes to decrypt. On non-final calls it must be a nonzero 76 * multiple of AES_BLOCK_SIZE. On the final call it can be any value >= 77 * AES_BLOCK_SIZE, i.e. ciphertext stealing is supported. 78 * @tweak: The tweak. It is updated with the next value, unless @len isn't a 79 * multiple of AES_BLOCK_SIZE in which case the value is unspecified. 80 * @key: The key, already prepared using aes_xts_preparekey() 81 * @cont: %false to begin decrypting a new message (do the tweak encryption); 82 * %true to continue decrypting a message (skip tweak encryption) 83 * 84 * This supports both one-shot and incremental decryption. On the first call, 85 * pass @cont = %false. On any later calls, pass @cont = %true and the updated 86 * @tweak; all earlier @len must have been multiples of AES_BLOCK_SIZE. 87 * 88 * Context: Any context. 89 */ 90 void aes_xts_decrypt(u8 *dst, const u8 *src, size_t len, 91 u8 tweak[at_least AES_BLOCK_SIZE], 92 const struct aes_xts_key *key, bool cont); 93 94 #endif /* _CRYPTO_AES_XTS_H */ 95