1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Common values for AES algorithms 4 */ 5 6 #ifndef _CRYPTO_AES_H 7 #define _CRYPTO_AES_H 8 9 #include <linux/types.h> 10 #include <linux/crypto.h> 11 12 #define AES_MIN_KEY_SIZE 16 13 #define AES_MAX_KEY_SIZE 32 14 #define AES_KEYSIZE_128 16 15 #define AES_KEYSIZE_192 24 16 #define AES_KEYSIZE_256 32 17 #define AES_BLOCK_SIZE 16 18 #define AES_MAX_KEYLENGTH (15 * 16) 19 #define AES_MAX_KEYLENGTH_U32 (AES_MAX_KEYLENGTH / sizeof(u32)) 20 21 union aes_enckey_arch { 22 u32 rndkeys[AES_MAX_KEYLENGTH_U32]; 23 #ifdef CONFIG_CRYPTO_LIB_AES_ARCH 24 #if defined(CONFIG_PPC) && defined(CONFIG_SPE) 25 /* Used unconditionally (when SPE AES code is enabled in kconfig) */ 26 u32 spe_enc_key[AES_MAX_KEYLENGTH_U32] __aligned(8); 27 #endif 28 #endif /* CONFIG_CRYPTO_LIB_AES_ARCH */ 29 }; 30 31 union aes_invkey_arch { 32 u32 inv_rndkeys[AES_MAX_KEYLENGTH_U32]; 33 #ifdef CONFIG_CRYPTO_LIB_AES_ARCH 34 #if defined(CONFIG_PPC) && defined(CONFIG_SPE) 35 /* Used unconditionally (when SPE AES code is enabled in kconfig) */ 36 u32 spe_dec_key[AES_MAX_KEYLENGTH_U32] __aligned(8); 37 #endif 38 #endif /* CONFIG_CRYPTO_LIB_AES_ARCH */ 39 }; 40 41 /** 42 * struct aes_enckey - An AES key prepared for encryption 43 * @len: Key length in bytes: 16 for AES-128, 24 for AES-192, 32 for AES-256. 44 * @nrounds: Number of rounds: 10 for AES-128, 12 for AES-192, 14 for AES-256. 45 * This is '6 + @len / 4' and is cached so that AES implementations 46 * that need it don't have to recompute it for each en/decryption. 47 * @padding: Padding to make offsetof(@k) be a multiple of 16, so that aligning 48 * this struct to a 16-byte boundary results in @k also being 16-byte 49 * aligned. Users aren't required to align this struct to 16 bytes, 50 * but it may slightly improve performance. 51 * @k: This typically contains the AES round keys as an array of '@nrounds + 1' 52 * groups of four u32 words. However, architecture-specific implementations 53 * of AES may store something else here, e.g. just the raw key if it's all 54 * they need. 55 * 56 * Note that this struct is about half the size of struct aes_key. This is 57 * separate from struct aes_key so that modes that need only AES encryption 58 * (e.g. AES-GCM, AES-CTR, AES-CMAC, tweak key in AES-XTS) don't incur the time 59 * and space overhead of computing and caching the decryption round keys. 60 * 61 * Note that there's no decryption-only equivalent (i.e. "struct aes_deckey"), 62 * since (a) it's rare that modes need decryption-only, and (b) some AES 63 * implementations use the same @k for both encryption and decryption, either 64 * always or conditionally; in the latter case both @k and @inv_k are needed. 65 */ 66 struct aes_enckey { 67 u32 len; 68 u32 nrounds; 69 u32 padding[2]; 70 union aes_enckey_arch k; 71 }; 72 73 /** 74 * struct aes_key - An AES key prepared for encryption and decryption 75 * @aes_enckey: Common fields and the key prepared for encryption 76 * @inv_k: This generally contains the round keys for the AES Equivalent 77 * Inverse Cipher, as an array of '@nrounds + 1' groups of four u32 78 * words. However, architecture-specific implementations of AES may 79 * store something else here. For example, they may leave this field 80 * uninitialized if they use @k for both encryption and decryption. 81 */ 82 struct aes_key { 83 struct aes_enckey; /* Include all fields of aes_enckey. */ 84 union aes_invkey_arch inv_k; 85 }; 86 87 /* 88 * Please ensure that the first two fields are 16-byte aligned 89 * relative to the start of the structure, i.e., don't move them! 90 */ 91 struct crypto_aes_ctx { 92 u32 key_enc[AES_MAX_KEYLENGTH_U32]; 93 u32 key_dec[AES_MAX_KEYLENGTH_U32]; 94 u32 key_length; 95 }; 96 97 /* 98 * validate key length for AES algorithms 99 */ 100 static inline int aes_check_keylen(size_t keylen) 101 { 102 switch (keylen) { 103 case AES_KEYSIZE_128: 104 case AES_KEYSIZE_192: 105 case AES_KEYSIZE_256: 106 break; 107 default: 108 return -EINVAL; 109 } 110 111 return 0; 112 } 113 114 /** 115 * aes_expandkey - Expands the AES key as described in FIPS-197 116 * @ctx: The location where the computed key will be stored. 117 * @in_key: The supplied key. 118 * @key_len: The length of the supplied key. 119 * 120 * Returns 0 on success. The function fails only if an invalid key size (or 121 * pointer) is supplied. 122 * The expanded key size is 240 bytes (max of 14 rounds with a unique 16 bytes 123 * key schedule plus a 16 bytes key which is used before the first round). 124 * The decryption key is prepared for the "Equivalent Inverse Cipher" as 125 * described in FIPS-197. The first slot (16 bytes) of each key (enc or dec) is 126 * for the initial combination, the second slot for the first round and so on. 127 */ 128 int aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, 129 unsigned int key_len); 130 131 /* 132 * The following functions are temporarily exported for use by the AES mode 133 * implementations in arch/$(SRCARCH)/crypto/. These exports will go away when 134 * that code is migrated into lib/crypto/. 135 */ 136 #ifdef CONFIG_ARM64 137 int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, 138 unsigned int key_len); 139 #elif defined(CONFIG_PPC) 140 void ppc_expand_key_128(u32 *key_enc, const u8 *key); 141 void ppc_expand_key_192(u32 *key_enc, const u8 *key); 142 void ppc_expand_key_256(u32 *key_enc, const u8 *key); 143 void ppc_generate_decrypt_key(u32 *key_dec, u32 *key_enc, unsigned int key_len); 144 void ppc_encrypt_ecb(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, 145 u32 bytes); 146 void ppc_decrypt_ecb(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, 147 u32 bytes); 148 void ppc_encrypt_cbc(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 149 u8 *iv); 150 void ppc_decrypt_cbc(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes, 151 u8 *iv); 152 void ppc_crypt_ctr(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 153 u8 *iv); 154 void ppc_encrypt_xts(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 155 u8 *iv, u32 *key_twk); 156 void ppc_decrypt_xts(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes, 157 u8 *iv, u32 *key_twk); 158 #endif 159 160 /** 161 * aes_preparekey() - Prepare an AES key for encryption and decryption 162 * @key: (output) The key structure to initialize 163 * @in_key: The raw AES key 164 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128, 165 * AES_KEYSIZE_192, or AES_KEYSIZE_256. 166 * 167 * This prepares an AES key for both the encryption and decryption directions of 168 * the block cipher. Typically this involves expanding the raw key into both 169 * the standard round keys and the Equivalent Inverse Cipher round keys, but 170 * some architecture-specific implementations don't do the full expansion here. 171 * 172 * The caller is responsible for zeroizing both the struct aes_key and the raw 173 * key once they are no longer needed. 174 * 175 * If you don't need decryption support, use aes_prepareenckey() instead. 176 * 177 * Return: 0 on success or -EINVAL if the given key length is invalid. No other 178 * errors are possible, so callers that always pass a valid key length 179 * don't need to check for errors. 180 * 181 * Context: Any context. 182 */ 183 int aes_preparekey(struct aes_key *key, const u8 *in_key, size_t key_len); 184 185 /** 186 * aes_prepareenckey() - Prepare an AES key for encryption-only 187 * @key: (output) The key structure to initialize 188 * @in_key: The raw AES key 189 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128, 190 * AES_KEYSIZE_192, or AES_KEYSIZE_256. 191 * 192 * This prepares an AES key for only the encryption direction of the block 193 * cipher. Typically this involves expanding the raw key into only the standard 194 * round keys, resulting in a struct about half the size of struct aes_key. 195 * 196 * The caller is responsible for zeroizing both the struct aes_enckey and the 197 * raw key once they are no longer needed. 198 * 199 * Note that while the resulting prepared key supports only AES encryption, it 200 * can still be used for decrypting in a mode of operation that uses AES in only 201 * the encryption (forward) direction, for example counter mode. 202 * 203 * Return: 0 on success or -EINVAL if the given key length is invalid. No other 204 * errors are possible, so callers that always pass a valid key length 205 * don't need to check for errors. 206 * 207 * Context: Any context. 208 */ 209 int aes_prepareenckey(struct aes_enckey *key, const u8 *in_key, size_t key_len); 210 211 typedef union { 212 const struct aes_enckey *enc_key; 213 const struct aes_key *full_key; 214 } aes_encrypt_arg __attribute__ ((__transparent_union__)); 215 216 /** 217 * aes_encrypt() - Encrypt a single AES block 218 * @key: The AES key, as a pointer to either an encryption-only key 219 * (struct aes_enckey) or a full, bidirectional key (struct aes_key). 220 * @out: Buffer to store the ciphertext block 221 * @in: Buffer containing the plaintext block 222 * 223 * Context: Any context. 224 */ 225 #define aes_encrypt(key, out, in) \ 226 _Generic((key), \ 227 struct crypto_aes_ctx *: aes_encrypt_old((const struct crypto_aes_ctx *)(key), (out), (in)), \ 228 const struct crypto_aes_ctx *: aes_encrypt_old((const struct crypto_aes_ctx *)(key), (out), (in)), \ 229 struct aes_enckey *: aes_encrypt_new((const struct aes_enckey *)(key), (out), (in)), \ 230 const struct aes_enckey *: aes_encrypt_new((const struct aes_enckey *)(key), (out), (in)), \ 231 struct aes_key *: aes_encrypt_new((const struct aes_key *)(key), (out), (in)), \ 232 const struct aes_key *: aes_encrypt_new((const struct aes_key *)(key), (out), (in))) 233 void aes_encrypt_old(const struct crypto_aes_ctx *ctx, u8 *out, const u8 *in); 234 void aes_encrypt_new(aes_encrypt_arg key, u8 out[at_least AES_BLOCK_SIZE], 235 const u8 in[at_least AES_BLOCK_SIZE]); 236 237 /** 238 * aes_decrypt() - Decrypt a single AES block 239 * @key: The AES key, previously initialized by aes_preparekey() 240 * @out: Buffer to store the plaintext block 241 * @in: Buffer containing the ciphertext block 242 * 243 * Context: Any context. 244 */ 245 #define aes_decrypt(key, out, in) \ 246 _Generic((key), \ 247 struct crypto_aes_ctx *: aes_decrypt_old((const struct crypto_aes_ctx *)(key), (out), (in)), \ 248 const struct crypto_aes_ctx *: aes_decrypt_old((const struct crypto_aes_ctx *)(key), (out), (in)), \ 249 struct aes_key *: aes_decrypt_new((const struct aes_key *)(key), (out), (in)), \ 250 const struct aes_key *: aes_decrypt_new((const struct aes_key *)(key), (out), (in))) 251 void aes_decrypt_old(const struct crypto_aes_ctx *ctx, u8 *out, const u8 *in); 252 void aes_decrypt_new(const struct aes_key *key, u8 out[at_least AES_BLOCK_SIZE], 253 const u8 in[at_least AES_BLOCK_SIZE]); 254 255 extern const u8 crypto_aes_sbox[]; 256 extern const u8 crypto_aes_inv_sbox[]; 257 extern const u32 aes_enc_tab[256]; 258 extern const u32 aes_dec_tab[256]; 259 260 void aescfb_encrypt(const struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src, 261 int len, const u8 iv[AES_BLOCK_SIZE]); 262 void aescfb_decrypt(const struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src, 263 int len, const u8 iv[AES_BLOCK_SIZE]); 264 265 #endif 266