1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Common values for AES algorithms 4 */ 5 6 #ifndef _CRYPTO_AES_H 7 #define _CRYPTO_AES_H 8 9 #include <linux/types.h> 10 #include <linux/crypto.h> 11 12 #define AES_MIN_KEY_SIZE 16 13 #define AES_MAX_KEY_SIZE 32 14 #define AES_KEYSIZE_128 16 15 #define AES_KEYSIZE_192 24 16 #define AES_KEYSIZE_256 32 17 #define AES_BLOCK_SIZE 16 18 #define AES_MAX_KEYLENGTH (15 * 16) 19 #define AES_MAX_KEYLENGTH_U32 (AES_MAX_KEYLENGTH / sizeof(u32)) 20 21 /* 22 * The POWER8 VSX optimized AES assembly code is borrowed from OpenSSL and 23 * inherits OpenSSL's AES_KEY format, which stores the number of rounds after 24 * the round keys. That assembly code is difficult to change. So for 25 * compatibility purposes we reserve space for the extra nrounds field on PPC64. 26 * 27 * Note: when prepared for decryption, the round keys are just the reversed 28 * standard round keys, not the round keys for the Equivalent Inverse Cipher. 29 */ 30 struct p8_aes_key { 31 u32 rndkeys[AES_MAX_KEYLENGTH_U32]; 32 int nrounds; 33 }; 34 35 union aes_enckey_arch { 36 u32 rndkeys[AES_MAX_KEYLENGTH_U32]; 37 #ifdef CONFIG_CRYPTO_LIB_AES_ARCH 38 #if defined(CONFIG_PPC) && defined(CONFIG_SPE) 39 /* Used unconditionally (when SPE AES code is enabled in kconfig) */ 40 u32 spe_enc_key[AES_MAX_KEYLENGTH_U32] __aligned(8); 41 #elif defined(CONFIG_PPC) 42 /* 43 * Kernels that include the POWER8 VSX optimized AES code use this field 44 * when that code is usable at key preparation time. Otherwise they 45 * fall back to rndkeys. In the latter case, p8.nrounds (which doesn't 46 * overlap rndkeys) is set to 0 to differentiate the two formats. 47 */ 48 struct p8_aes_key p8; 49 #elif defined(CONFIG_S390) 50 /* Used when the CPU supports CPACF AES for this key's length */ 51 u8 raw_key[AES_MAX_KEY_SIZE]; 52 #elif defined(CONFIG_SPARC64) 53 /* Used when the CPU supports the SPARC64 AES opcodes */ 54 u64 sparc_rndkeys[AES_MAX_KEYLENGTH / sizeof(u64)]; 55 #endif 56 #endif /* CONFIG_CRYPTO_LIB_AES_ARCH */ 57 }; 58 59 union aes_invkey_arch { 60 u32 inv_rndkeys[AES_MAX_KEYLENGTH_U32]; 61 #ifdef CONFIG_CRYPTO_LIB_AES_ARCH 62 #if defined(CONFIG_PPC) && defined(CONFIG_SPE) 63 /* Used unconditionally (when SPE AES code is enabled in kconfig) */ 64 u32 spe_dec_key[AES_MAX_KEYLENGTH_U32] __aligned(8); 65 #elif defined(CONFIG_PPC) 66 /* Used conditionally, analogous to aes_enckey_arch::p8 */ 67 struct p8_aes_key p8; 68 #endif 69 #endif /* CONFIG_CRYPTO_LIB_AES_ARCH */ 70 }; 71 72 /** 73 * struct aes_enckey - An AES key prepared for encryption 74 * @len: Key length in bytes: 16 for AES-128, 24 for AES-192, 32 for AES-256. 75 * @nrounds: Number of rounds: 10 for AES-128, 12 for AES-192, 14 for AES-256. 76 * This is '6 + @len / 4' and is cached so that AES implementations 77 * that need it don't have to recompute it for each en/decryption. 78 * @padding: Padding to make offsetof(@k) be a multiple of 16, so that aligning 79 * this struct to a 16-byte boundary results in @k also being 16-byte 80 * aligned. Users aren't required to align this struct to 16 bytes, 81 * but it may slightly improve performance. 82 * @k: This typically contains the AES round keys as an array of '@nrounds + 1' 83 * groups of four u32 words. However, architecture-specific implementations 84 * of AES may store something else here, e.g. just the raw key if it's all 85 * they need. 86 * 87 * Note that this struct is about half the size of struct aes_key. This is 88 * separate from struct aes_key so that modes that need only AES encryption 89 * (e.g. AES-GCM, AES-CTR, AES-CMAC, tweak key in AES-XTS) don't incur the time 90 * and space overhead of computing and caching the decryption round keys. 91 * 92 * Note that there's no decryption-only equivalent (i.e. "struct aes_deckey"), 93 * since (a) it's rare that modes need decryption-only, and (b) some AES 94 * implementations use the same @k for both encryption and decryption, either 95 * always or conditionally; in the latter case both @k and @inv_k are needed. 96 */ 97 struct aes_enckey { 98 u32 len; 99 u32 nrounds; 100 u32 padding[2]; 101 union aes_enckey_arch k; 102 }; 103 104 /** 105 * aes_zeroize_enckey() - Zeroize an aes_enckey structure 106 * @key: The aes_enckey to zeroize 107 */ 108 static inline void aes_zeroize_enckey(struct aes_enckey *key) 109 { 110 memzero_explicit(key, sizeof(*key)); 111 } 112 113 /** 114 * struct aes_key - An AES key prepared for encryption and decryption 115 * @aes_enckey: Common fields and the key prepared for encryption 116 * @inv_k: This generally contains the round keys for the AES Equivalent 117 * Inverse Cipher, as an array of '@nrounds + 1' groups of four u32 118 * words. However, architecture-specific implementations of AES may 119 * store something else here. For example, they may leave this field 120 * uninitialized if they use @k for both encryption and decryption. 121 */ 122 struct aes_key { 123 struct aes_enckey; /* Include all fields of aes_enckey. */ 124 union aes_invkey_arch inv_k; 125 }; 126 127 /** 128 * aes_zeroize_key() - Zeroize an aes_key structure 129 * @key: The aes_key to zeroize 130 */ 131 static inline void aes_zeroize_key(struct aes_key *key) 132 { 133 memzero_explicit(key, sizeof(*key)); 134 } 135 136 /* 137 * Please ensure that the first two fields are 16-byte aligned 138 * relative to the start of the structure, i.e., don't move them! 139 */ 140 struct crypto_aes_ctx { 141 u32 key_enc[AES_MAX_KEYLENGTH_U32]; 142 u32 key_dec[AES_MAX_KEYLENGTH_U32]; 143 u32 key_length; 144 }; 145 146 /* 147 * validate key length for AES algorithms 148 */ 149 static inline int aes_check_keylen(size_t keylen) 150 { 151 switch (keylen) { 152 case AES_KEYSIZE_128: 153 case AES_KEYSIZE_192: 154 case AES_KEYSIZE_256: 155 break; 156 default: 157 return -EINVAL; 158 } 159 160 return 0; 161 } 162 163 /** 164 * aes_expandkey - Expands the AES key as described in FIPS-197 165 * @ctx: The location where the computed key will be stored. 166 * @in_key: The supplied key. 167 * @key_len: The length of the supplied key. 168 * 169 * Returns 0 on success. The function fails only if an invalid key size (or 170 * pointer) is supplied. 171 * The expanded key size is 240 bytes (max of 14 rounds with a unique 16 bytes 172 * key schedule plus a 16 bytes key which is used before the first round). 173 * The decryption key is prepared for the "Equivalent Inverse Cipher" as 174 * described in FIPS-197. The first slot (16 bytes) of each key (enc or dec) is 175 * for the initial combination, the second slot for the first round and so on. 176 */ 177 int aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, 178 unsigned int key_len); 179 180 /** 181 * aes_zeroize_ctx - Clear a crypto_aes_ctx structure 182 * @ctx: The location of the context that should be zeroized 183 * 184 * Explicitly fills the crypto_aes_ctx with zeroes. This should be done 185 * once the context is not required anymore to avoid that its contents 186 * are leaked on the stack or heap (if not using kfree_sensitive()). 187 */ 188 static inline void aes_zeroize_ctx(struct crypto_aes_ctx *ctx) 189 { 190 memzero_explicit(ctx, sizeof(*ctx)); 191 } 192 193 /* 194 * The following functions are temporarily exported for use by the AES mode 195 * implementations in arch/$(SRCARCH)/crypto/. These exports will go away when 196 * that code is migrated into lib/crypto/. 197 */ 198 #ifdef CONFIG_ARM64 199 int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, 200 unsigned int key_len); 201 asmlinkage void neon_aes_ecb_encrypt(u8 out[], u8 const in[], u32 const rk[], 202 int rounds, int blocks); 203 asmlinkage void neon_aes_ecb_decrypt(u8 out[], u8 const in[], u32 const rk[], 204 int rounds, int blocks); 205 asmlinkage void neon_aes_cbc_encrypt(u8 out[], u8 const in[], u32 const rk[], 206 int rounds, int blocks, u8 iv[]); 207 asmlinkage void neon_aes_cbc_decrypt(u8 out[], u8 const in[], u32 const rk[], 208 int rounds, int blocks, u8 iv[]); 209 asmlinkage void neon_aes_cbc_cts_encrypt(u8 out[], u8 const in[], 210 u32 const rk[], int rounds, int bytes, 211 u8 const iv[]); 212 asmlinkage void neon_aes_cbc_cts_decrypt(u8 out[], u8 const in[], 213 u32 const rk[], int rounds, int bytes, 214 u8 const iv[]); 215 asmlinkage void neon_aes_ctr_encrypt(u8 out[], u8 const in[], u32 const rk[], 216 int rounds, int bytes, u8 ctr[]); 217 asmlinkage void neon_aes_xctr_encrypt(u8 out[], u8 const in[], u32 const rk[], 218 int rounds, int bytes, u8 ctr[], 219 int byte_ctr); 220 asmlinkage void neon_aes_xts_encrypt(u8 out[], u8 const in[], u32 const rk1[], 221 int rounds, int bytes, u32 const rk2[], 222 u8 iv[], int first); 223 asmlinkage void neon_aes_xts_decrypt(u8 out[], u8 const in[], u32 const rk1[], 224 int rounds, int bytes, u32 const rk2[], 225 u8 iv[], int first); 226 asmlinkage void neon_aes_essiv_cbc_encrypt(u8 out[], u8 const in[], 227 u32 const rk1[], int rounds, 228 int blocks, u8 iv[], 229 u32 const rk2[]); 230 asmlinkage void neon_aes_essiv_cbc_decrypt(u8 out[], u8 const in[], 231 u32 const rk1[], int rounds, 232 int blocks, u8 iv[], 233 u32 const rk2[]); 234 235 asmlinkage void ce_aes_ecb_encrypt(u8 out[], u8 const in[], u32 const rk[], 236 int rounds, int blocks); 237 asmlinkage void ce_aes_ecb_decrypt(u8 out[], u8 const in[], u32 const rk[], 238 int rounds, int blocks); 239 asmlinkage void ce_aes_cbc_encrypt(u8 out[], u8 const in[], u32 const rk[], 240 int rounds, int blocks, u8 iv[]); 241 asmlinkage void ce_aes_cbc_decrypt(u8 out[], u8 const in[], u32 const rk[], 242 int rounds, int blocks, u8 iv[]); 243 asmlinkage void ce_aes_cbc_cts_encrypt(u8 out[], u8 const in[], u32 const rk[], 244 int rounds, int bytes, u8 const iv[]); 245 asmlinkage void ce_aes_cbc_cts_decrypt(u8 out[], u8 const in[], u32 const rk[], 246 int rounds, int bytes, u8 const iv[]); 247 asmlinkage void ce_aes_ctr_encrypt(u8 out[], u8 const in[], u32 const rk[], 248 int rounds, int bytes, u8 ctr[]); 249 asmlinkage void ce_aes_xctr_encrypt(u8 out[], u8 const in[], u32 const rk[], 250 int rounds, int bytes, u8 ctr[], 251 int byte_ctr); 252 asmlinkage void ce_aes_xts_encrypt(u8 out[], u8 const in[], u32 const rk1[], 253 int rounds, int bytes, u32 const rk2[], 254 u8 iv[], int first); 255 asmlinkage void ce_aes_xts_decrypt(u8 out[], u8 const in[], u32 const rk1[], 256 int rounds, int bytes, u32 const rk2[], 257 u8 iv[], int first); 258 asmlinkage void ce_aes_essiv_cbc_encrypt(u8 out[], u8 const in[], 259 u32 const rk1[], int rounds, 260 int blocks, u8 iv[], u32 const rk2[]); 261 asmlinkage void ce_aes_essiv_cbc_decrypt(u8 out[], u8 const in[], 262 u32 const rk1[], int rounds, 263 int blocks, u8 iv[], u32 const rk2[]); 264 asmlinkage void ce_aes_mac_update(u8 const in[], u32 const rk[], int rounds, 265 size_t blocks, u8 dg[], int enc_before, 266 int enc_after); 267 #elif defined(CONFIG_PPC) 268 void ppc_expand_key_128(u32 *key_enc, const u8 *key); 269 void ppc_expand_key_192(u32 *key_enc, const u8 *key); 270 void ppc_expand_key_256(u32 *key_enc, const u8 *key); 271 void ppc_generate_decrypt_key(u32 *key_dec, u32 *key_enc, unsigned int key_len); 272 void ppc_encrypt_ecb(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, 273 u32 bytes); 274 void ppc_decrypt_ecb(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, 275 u32 bytes); 276 void ppc_encrypt_cbc(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 277 u8 *iv); 278 void ppc_decrypt_cbc(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes, 279 u8 *iv); 280 void ppc_crypt_ctr(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 281 u8 *iv); 282 void ppc_encrypt_xts(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes, 283 u8 *iv, u32 *key_twk); 284 void ppc_decrypt_xts(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes, 285 u8 *iv, u32 *key_twk); 286 int aes_p8_set_encrypt_key(const u8 *userKey, const int bits, 287 struct p8_aes_key *key); 288 int aes_p8_set_decrypt_key(const u8 *userKey, const int bits, 289 struct p8_aes_key *key); 290 void aes_p8_encrypt(const u8 *in, u8 *out, const struct p8_aes_key *key); 291 void aes_p8_decrypt(const u8 *in, u8 *out, const struct p8_aes_key *key); 292 void aes_p8_cbc_encrypt(const u8 *in, u8 *out, size_t len, 293 const struct p8_aes_key *key, u8 *iv, bool enc); 294 void aes_p8_ctr32_encrypt_blocks(const u8 *in, u8 *out, size_t len, 295 const struct p8_aes_key *key, const u8 *iv); 296 void aes_p8_xts_encrypt(const u8 *in, u8 *out, size_t len, 297 const struct p8_aes_key *key1, 298 const struct p8_aes_key *key2, u8 *iv); 299 void aes_p8_xts_decrypt(const u8 *in, u8 *out, size_t len, 300 const struct p8_aes_key *key1, 301 const struct p8_aes_key *key2, u8 *iv); 302 #elif defined(CONFIG_SPARC64) 303 void aes_sparc64_key_expand(const u32 *in_key, u64 *output_key, 304 unsigned int key_len); 305 void aes_sparc64_load_encrypt_keys_128(const u64 *key); 306 void aes_sparc64_load_encrypt_keys_192(const u64 *key); 307 void aes_sparc64_load_encrypt_keys_256(const u64 *key); 308 void aes_sparc64_load_decrypt_keys_128(const u64 *key); 309 void aes_sparc64_load_decrypt_keys_192(const u64 *key); 310 void aes_sparc64_load_decrypt_keys_256(const u64 *key); 311 void aes_sparc64_ecb_encrypt_128(const u64 *key, const u64 *input, u64 *output, 312 unsigned int len); 313 void aes_sparc64_ecb_encrypt_192(const u64 *key, const u64 *input, u64 *output, 314 unsigned int len); 315 void aes_sparc64_ecb_encrypt_256(const u64 *key, const u64 *input, u64 *output, 316 unsigned int len); 317 void aes_sparc64_ecb_decrypt_128(const u64 *key, const u64 *input, u64 *output, 318 unsigned int len); 319 void aes_sparc64_ecb_decrypt_192(const u64 *key, const u64 *input, u64 *output, 320 unsigned int len); 321 void aes_sparc64_ecb_decrypt_256(const u64 *key, const u64 *input, u64 *output, 322 unsigned int len); 323 void aes_sparc64_cbc_encrypt_128(const u64 *key, const u64 *input, u64 *output, 324 unsigned int len, u64 *iv); 325 void aes_sparc64_cbc_encrypt_192(const u64 *key, const u64 *input, u64 *output, 326 unsigned int len, u64 *iv); 327 void aes_sparc64_cbc_encrypt_256(const u64 *key, const u64 *input, u64 *output, 328 unsigned int len, u64 *iv); 329 void aes_sparc64_cbc_decrypt_128(const u64 *key, const u64 *input, u64 *output, 330 unsigned int len, u64 *iv); 331 void aes_sparc64_cbc_decrypt_192(const u64 *key, const u64 *input, u64 *output, 332 unsigned int len, u64 *iv); 333 void aes_sparc64_cbc_decrypt_256(const u64 *key, const u64 *input, u64 *output, 334 unsigned int len, u64 *iv); 335 void aes_sparc64_ctr_crypt_128(const u64 *key, const u64 *input, u64 *output, 336 unsigned int len, u64 *iv); 337 void aes_sparc64_ctr_crypt_192(const u64 *key, const u64 *input, u64 *output, 338 unsigned int len, u64 *iv); 339 void aes_sparc64_ctr_crypt_256(const u64 *key, const u64 *input, u64 *output, 340 unsigned int len, u64 *iv); 341 #endif 342 343 /** 344 * aes_preparekey() - Prepare an AES key for encryption and decryption 345 * @key: (output) The key structure to initialize 346 * @in_key: The raw AES key 347 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128, 348 * AES_KEYSIZE_192, or AES_KEYSIZE_256. 349 * 350 * This prepares an AES key for both the encryption and decryption directions of 351 * the block cipher. Typically this involves expanding the raw key into both 352 * the standard round keys and the Equivalent Inverse Cipher round keys, but 353 * some architecture-specific implementations don't do the full expansion here. 354 * 355 * The caller is responsible for zeroizing both the struct aes_key and the raw 356 * key once they are no longer needed. 357 * 358 * If you don't need decryption support, use aes_prepareenckey() instead. 359 * 360 * Return: 0 on success or -EINVAL if the given key length is invalid. No other 361 * errors are possible, so callers that always pass a valid key length 362 * don't need to check for errors. 363 * 364 * Context: Any context. 365 */ 366 int aes_preparekey(struct aes_key *key, const u8 *in_key, size_t key_len); 367 368 /** 369 * aes_prepareenckey() - Prepare an AES key for encryption-only 370 * @key: (output) The key structure to initialize 371 * @in_key: The raw AES key 372 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128, 373 * AES_KEYSIZE_192, or AES_KEYSIZE_256. 374 * 375 * This prepares an AES key for only the encryption direction of the block 376 * cipher. Typically this involves expanding the raw key into only the standard 377 * round keys, resulting in a struct about half the size of struct aes_key. 378 * 379 * The caller is responsible for zeroizing both the struct aes_enckey and the 380 * raw key once they are no longer needed. 381 * 382 * Note that while the resulting prepared key supports only AES encryption, it 383 * can still be used for decrypting in a mode of operation that uses AES in only 384 * the encryption (forward) direction, for example counter mode. 385 * 386 * Return: 0 on success or -EINVAL if the given key length is invalid. No other 387 * errors are possible, so callers that always pass a valid key length 388 * don't need to check for errors. 389 * 390 * Context: Any context. 391 */ 392 int aes_prepareenckey(struct aes_enckey *key, const u8 *in_key, size_t key_len); 393 394 typedef union { 395 const struct aes_enckey *enc_key; 396 const struct aes_key *full_key; 397 } aes_encrypt_arg __attribute__ ((__transparent_union__)); 398 399 /** 400 * aes_encrypt() - Encrypt a single AES block 401 * @key: The AES key, as a pointer to either an encryption-only key 402 * (struct aes_enckey) or a full, bidirectional key (struct aes_key). 403 * @out: Buffer to store the ciphertext block 404 * @in: Buffer containing the plaintext block 405 * 406 * Context: Any context. 407 */ 408 void aes_encrypt(aes_encrypt_arg key, u8 out[at_least AES_BLOCK_SIZE], 409 const u8 in[at_least AES_BLOCK_SIZE]); 410 411 /** 412 * aes_decrypt() - Decrypt a single AES block 413 * @key: The AES key, previously initialized by aes_preparekey() 414 * @out: Buffer to store the plaintext block 415 * @in: Buffer containing the ciphertext block 416 * 417 * Context: Any context. 418 */ 419 void aes_decrypt(const struct aes_key *key, u8 out[at_least AES_BLOCK_SIZE], 420 const u8 in[at_least AES_BLOCK_SIZE]); 421 422 extern const u8 crypto_aes_sbox[]; 423 extern const u8 crypto_aes_inv_sbox[]; 424 extern const u32 aes_enc_tab[256]; 425 extern const u32 aes_dec_tab[256]; 426 427 void aescfb_encrypt(const struct aes_enckey *key, u8 *dst, const u8 *src, 428 int len, const u8 iv[AES_BLOCK_SIZE]); 429 void aescfb_decrypt(const struct aes_enckey *key, u8 *dst, const u8 *src, 430 int len, const u8 iv[AES_BLOCK_SIZE]); 431 432 #endif 433