1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Minimal library implementation of GCM 4 * 5 * Copyright 2022 Google LLC 6 */ 7 8 #include <linux/module.h> 9 10 #include <crypto/algapi.h> 11 #include <crypto/gcm.h> 12 #include <crypto/ghash.h> 13 14 #include <asm/irqflags.h> 15 16 static void aesgcm_encrypt_block(const struct crypto_aes_ctx *ctx, void *dst, 17 const void *src) 18 { 19 unsigned long flags; 20 21 /* 22 * In AES-GCM, both the GHASH key derivation and the CTR mode 23 * encryption operate on known plaintext, making them susceptible to 24 * timing attacks on the encryption key. The AES library already 25 * mitigates this risk to some extent by pulling the entire S-box into 26 * the caches before doing any substitutions, but this strategy is more 27 * effective when running with interrupts disabled. 28 */ 29 local_irq_save(flags); 30 aes_encrypt(ctx, dst, src); 31 local_irq_restore(flags); 32 } 33 34 /** 35 * aesgcm_expandkey - Expands the AES and GHASH keys for the AES-GCM key 36 * schedule 37 * 38 * @ctx: The data structure that will hold the AES-GCM key schedule 39 * @key: The AES encryption input key 40 * @keysize: The length in bytes of the input key 41 * @authsize: The size in bytes of the GCM authentication tag 42 * 43 * Returns: 0 on success, or -EINVAL if @keysize or @authsize contain values 44 * that are not permitted by the GCM specification. 45 */ 46 int aesgcm_expandkey(struct aesgcm_ctx *ctx, const u8 *key, 47 unsigned int keysize, unsigned int authsize) 48 { 49 u8 kin[AES_BLOCK_SIZE] = {}; 50 int ret; 51 52 ret = crypto_gcm_check_authsize(authsize) ?: 53 aes_expandkey(&ctx->aes_ctx, key, keysize); 54 if (ret) 55 return ret; 56 57 ctx->authsize = authsize; 58 aesgcm_encrypt_block(&ctx->aes_ctx, &ctx->ghash_key, kin); 59 60 return 0; 61 } 62 EXPORT_SYMBOL(aesgcm_expandkey); 63 64 static void aesgcm_ghash(be128 *ghash, const be128 *key, const void *src, 65 int len) 66 { 67 while (len > 0) { 68 crypto_xor((u8 *)ghash, src, min(len, GHASH_BLOCK_SIZE)); 69 gf128mul_lle(ghash, key); 70 71 src += GHASH_BLOCK_SIZE; 72 len -= GHASH_BLOCK_SIZE; 73 } 74 } 75 76 /** 77 * aesgcm_mac - Generates the authentication tag using AES-GCM algorithm. 78 * @ctx: The data structure that will hold the AES-GCM key schedule 79 * @src: The input source data. 80 * @src_len: Length of the source data. 81 * @assoc: Points to the associated data. 82 * @assoc_len: Length of the associated data values. 83 * @ctr: Points to the counter value. 84 * @authtag: The output buffer for the authentication tag. 85 * 86 * It takes in the AES-GCM context, source data, associated data, counter value, 87 * and an output buffer for the authentication tag. 88 */ 89 static void aesgcm_mac(const struct aesgcm_ctx *ctx, const u8 *src, int src_len, 90 const u8 *assoc, int assoc_len, __be32 *ctr, u8 *authtag) 91 { 92 be128 tail = { cpu_to_be64(assoc_len * 8), cpu_to_be64(src_len * 8) }; 93 u8 buf[AES_BLOCK_SIZE]; 94 be128 ghash = {}; 95 96 aesgcm_ghash(&ghash, &ctx->ghash_key, assoc, assoc_len); 97 aesgcm_ghash(&ghash, &ctx->ghash_key, src, src_len); 98 aesgcm_ghash(&ghash, &ctx->ghash_key, &tail, sizeof(tail)); 99 100 ctr[3] = cpu_to_be32(1); 101 aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr); 102 crypto_xor_cpy(authtag, buf, (u8 *)&ghash, ctx->authsize); 103 104 memzero_explicit(&ghash, sizeof(ghash)); 105 memzero_explicit(buf, sizeof(buf)); 106 } 107 108 static void aesgcm_crypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src, 109 int len, __be32 *ctr) 110 { 111 u8 buf[AES_BLOCK_SIZE]; 112 unsigned int n = 2; 113 114 while (len > 0) { 115 /* 116 * The counter increment below must not result in overflow or 117 * carry into the next 32-bit word, as this could result in 118 * inadvertent IV reuse, which must be avoided at all cost for 119 * stream ciphers such as AES-CTR. Given the range of 'int 120 * len', this cannot happen, so no explicit test is necessary. 121 */ 122 ctr[3] = cpu_to_be32(n++); 123 aesgcm_encrypt_block(&ctx->aes_ctx, buf, ctr); 124 crypto_xor_cpy(dst, src, buf, min(len, AES_BLOCK_SIZE)); 125 126 dst += AES_BLOCK_SIZE; 127 src += AES_BLOCK_SIZE; 128 len -= AES_BLOCK_SIZE; 129 } 130 memzero_explicit(buf, sizeof(buf)); 131 } 132 133 /** 134 * aesgcm_encrypt - Perform AES-GCM encryption on a block of data 135 * 136 * @ctx: The AES-GCM key schedule 137 * @dst: Pointer to the ciphertext output buffer 138 * @src: Pointer the plaintext (may equal @dst for encryption in place) 139 * @crypt_len: The size in bytes of the plaintext and ciphertext. 140 * @assoc: Pointer to the associated data, 141 * @assoc_len: The size in bytes of the associated data 142 * @iv: The initialization vector (IV) to use for this block of data 143 * (must be 12 bytes in size as per the GCM spec recommendation) 144 * @authtag: The address of the buffer in memory where the authentication 145 * tag should be stored. The buffer is assumed to have space for 146 * @ctx->authsize bytes. 147 */ 148 void aesgcm_encrypt(const struct aesgcm_ctx *ctx, u8 *dst, const u8 *src, 149 int crypt_len, const u8 *assoc, int assoc_len, 150 const u8 iv[GCM_AES_IV_SIZE], u8 *authtag) 151 { 152 __be32 ctr[4]; 153 154 memcpy(ctr, iv, GCM_AES_IV_SIZE); 155 156 aesgcm_crypt(ctx, dst, src, crypt_len, ctr); 157 aesgcm_mac(ctx, dst, crypt_len, assoc, assoc_len, ctr, authtag); 158 } 159 EXPORT_SYMBOL(aesgcm_encrypt); 160 161 /** 162 * aesgcm_decrypt - Perform AES-GCM decryption on a block of data 163 * 164 * @ctx: The AES-GCM key schedule 165 * @dst: Pointer to the plaintext output buffer 166 * @src: Pointer the ciphertext (may equal @dst for decryption in place) 167 * @crypt_len: The size in bytes of the plaintext and ciphertext. 168 * @assoc: Pointer to the associated data, 169 * @assoc_len: The size in bytes of the associated data 170 * @iv: The initialization vector (IV) to use for this block of data 171 * (must be 12 bytes in size as per the GCM spec recommendation) 172 * @authtag: The address of the buffer in memory where the authentication 173 * tag is stored. 174 * 175 * Returns: true on success, or false if the ciphertext failed authentication. 176 * On failure, no plaintext will be returned. 177 */ 178 bool __must_check aesgcm_decrypt(const struct aesgcm_ctx *ctx, u8 *dst, 179 const u8 *src, int crypt_len, const u8 *assoc, 180 int assoc_len, const u8 iv[GCM_AES_IV_SIZE], 181 const u8 *authtag) 182 { 183 u8 tagbuf[AES_BLOCK_SIZE]; 184 __be32 ctr[4]; 185 186 memcpy(ctr, iv, GCM_AES_IV_SIZE); 187 188 aesgcm_mac(ctx, src, crypt_len, assoc, assoc_len, ctr, tagbuf); 189 if (crypto_memneq(authtag, tagbuf, ctx->authsize)) { 190 memzero_explicit(tagbuf, sizeof(tagbuf)); 191 return false; 192 } 193 aesgcm_crypt(ctx, dst, src, crypt_len, ctr); 194 return true; 195 } 196 EXPORT_SYMBOL(aesgcm_decrypt); 197 198 MODULE_DESCRIPTION("Generic AES-GCM library"); 199 MODULE_AUTHOR("Ard Biesheuvel <ardb@kernel.org>"); 200 MODULE_LICENSE("GPL"); 201 202 #ifndef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS 203 204 /* 205 * Test code below. Vectors taken from crypto/testmgr.h 206 */ 207 208 static const u8 __initconst ctext0[16] = 209 "\x58\xe2\xfc\xce\xfa\x7e\x30\x61" 210 "\x36\x7f\x1d\x57\xa4\xe7\x45\x5a"; 211 212 static const u8 __initconst ptext1[16]; 213 214 static const u8 __initconst ctext1[32] = 215 "\x03\x88\xda\xce\x60\xb6\xa3\x92" 216 "\xf3\x28\xc2\xb9\x71\xb2\xfe\x78" 217 "\xab\x6e\x47\xd4\x2c\xec\x13\xbd" 218 "\xf5\x3a\x67\xb2\x12\x57\xbd\xdf"; 219 220 static const u8 __initconst ptext2[64] = 221 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 222 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 223 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 224 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 225 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 226 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 227 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 228 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55"; 229 230 static const u8 __initconst ctext2[80] = 231 "\x42\x83\x1e\xc2\x21\x77\x74\x24" 232 "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c" 233 "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0" 234 "\x35\xc1\x7e\x23\x29\xac\xa1\x2e" 235 "\x21\xd5\x14\xb2\x54\x66\x93\x1c" 236 "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05" 237 "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97" 238 "\x3d\x58\xe0\x91\x47\x3f\x59\x85" 239 "\x4d\x5c\x2a\xf3\x27\xcd\x64\xa6" 240 "\x2c\xf3\x5a\xbd\x2b\xa6\xfa\xb4"; 241 242 static const u8 __initconst ptext3[60] = 243 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 244 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 245 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 246 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 247 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 248 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 249 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 250 "\xba\x63\x7b\x39"; 251 252 static const u8 __initconst ctext3[76] = 253 "\x42\x83\x1e\xc2\x21\x77\x74\x24" 254 "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c" 255 "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0" 256 "\x35\xc1\x7e\x23\x29\xac\xa1\x2e" 257 "\x21\xd5\x14\xb2\x54\x66\x93\x1c" 258 "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05" 259 "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97" 260 "\x3d\x58\xe0\x91" 261 "\x5b\xc9\x4f\xbc\x32\x21\xa5\xdb" 262 "\x94\xfa\xe9\x5a\xe7\x12\x1a\x47"; 263 264 static const u8 __initconst ctext4[16] = 265 "\xcd\x33\xb2\x8a\xc7\x73\xf7\x4b" 266 "\xa0\x0e\xd1\xf3\x12\x57\x24\x35"; 267 268 static const u8 __initconst ctext5[32] = 269 "\x98\xe7\x24\x7c\x07\xf0\xfe\x41" 270 "\x1c\x26\x7e\x43\x84\xb0\xf6\x00" 271 "\x2f\xf5\x8d\x80\x03\x39\x27\xab" 272 "\x8e\xf4\xd4\x58\x75\x14\xf0\xfb"; 273 274 static const u8 __initconst ptext6[64] = 275 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 276 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 277 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 278 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 279 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 280 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 281 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 282 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55"; 283 284 static const u8 __initconst ctext6[80] = 285 "\x39\x80\xca\x0b\x3c\x00\xe8\x41" 286 "\xeb\x06\xfa\xc4\x87\x2a\x27\x57" 287 "\x85\x9e\x1c\xea\xa6\xef\xd9\x84" 288 "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c" 289 "\x7d\x77\x3d\x00\xc1\x44\xc5\x25" 290 "\xac\x61\x9d\x18\xc8\x4a\x3f\x47" 291 "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9" 292 "\xcc\xda\x27\x10\xac\xad\xe2\x56" 293 "\x99\x24\xa7\xc8\x58\x73\x36\xbf" 294 "\xb1\x18\x02\x4d\xb8\x67\x4a\x14"; 295 296 static const u8 __initconst ctext7[16] = 297 "\x53\x0f\x8a\xfb\xc7\x45\x36\xb9" 298 "\xa9\x63\xb4\xf1\xc4\xcb\x73\x8b"; 299 300 static const u8 __initconst ctext8[32] = 301 "\xce\xa7\x40\x3d\x4d\x60\x6b\x6e" 302 "\x07\x4e\xc5\xd3\xba\xf3\x9d\x18" 303 "\xd0\xd1\xc8\xa7\x99\x99\x6b\xf0" 304 "\x26\x5b\x98\xb5\xd4\x8a\xb9\x19"; 305 306 static const u8 __initconst ptext9[64] = 307 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 308 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 309 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 310 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 311 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 312 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 313 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 314 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55"; 315 316 static const u8 __initconst ctext9[80] = 317 "\x52\x2d\xc1\xf0\x99\x56\x7d\x07" 318 "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d" 319 "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9" 320 "\x75\x98\xa2\xbd\x25\x55\xd1\xaa" 321 "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d" 322 "\xa7\xb0\x8b\x10\x56\x82\x88\x38" 323 "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a" 324 "\xbc\xc9\xf6\x62\x89\x80\x15\xad" 325 "\xb0\x94\xda\xc5\xd9\x34\x71\xbd" 326 "\xec\x1a\x50\x22\x70\xe3\xcc\x6c"; 327 328 static const u8 __initconst ptext10[60] = 329 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 330 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 331 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 332 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 333 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 334 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 335 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 336 "\xba\x63\x7b\x39"; 337 338 static const u8 __initconst ctext10[76] = 339 "\x52\x2d\xc1\xf0\x99\x56\x7d\x07" 340 "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d" 341 "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9" 342 "\x75\x98\xa2\xbd\x25\x55\xd1\xaa" 343 "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d" 344 "\xa7\xb0\x8b\x10\x56\x82\x88\x38" 345 "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a" 346 "\xbc\xc9\xf6\x62" 347 "\x76\xfc\x6e\xce\x0f\x4e\x17\x68" 348 "\xcd\xdf\x88\x53\xbb\x2d\x55\x1b"; 349 350 static const u8 __initconst ptext11[60] = 351 "\xd9\x31\x32\x25\xf8\x84\x06\xe5" 352 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a" 353 "\x86\xa7\xa9\x53\x15\x34\xf7\xda" 354 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72" 355 "\x1c\x3c\x0c\x95\x95\x68\x09\x53" 356 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25" 357 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57" 358 "\xba\x63\x7b\x39"; 359 360 static const u8 __initconst ctext11[76] = 361 "\x39\x80\xca\x0b\x3c\x00\xe8\x41" 362 "\xeb\x06\xfa\xc4\x87\x2a\x27\x57" 363 "\x85\x9e\x1c\xea\xa6\xef\xd9\x84" 364 "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c" 365 "\x7d\x77\x3d\x00\xc1\x44\xc5\x25" 366 "\xac\x61\x9d\x18\xc8\x4a\x3f\x47" 367 "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9" 368 "\xcc\xda\x27\x10" 369 "\x25\x19\x49\x8e\x80\xf1\x47\x8f" 370 "\x37\xba\x55\xbd\x6d\x27\x61\x8c"; 371 372 static const u8 __initconst ptext12[719] = 373 "\x42\xc1\xcc\x08\x48\x6f\x41\x3f" 374 "\x2f\x11\x66\x8b\x2a\x16\xf0\xe0" 375 "\x58\x83\xf0\xc3\x70\x14\xc0\x5b" 376 "\x3f\xec\x1d\x25\x3c\x51\xd2\x03" 377 "\xcf\x59\x74\x1f\xb2\x85\xb4\x07" 378 "\xc6\x6a\x63\x39\x8a\x5b\xde\xcb" 379 "\xaf\x08\x44\xbd\x6f\x91\x15\xe1" 380 "\xf5\x7a\x6e\x18\xbd\xdd\x61\x50" 381 "\x59\xa9\x97\xab\xbb\x0e\x74\x5c" 382 "\x00\xa4\x43\x54\x04\x54\x9b\x3b" 383 "\x77\xec\xfd\x5c\xa6\xe8\x7b\x08" 384 "\xae\xe6\x10\x3f\x32\x65\xd1\xfc" 385 "\xa4\x1d\x2c\x31\xfb\x33\x7a\xb3" 386 "\x35\x23\xf4\x20\x41\xd4\xad\x82" 387 "\x8b\xa4\xad\x96\x1c\x20\x53\xbe" 388 "\x0e\xa6\xf4\xdc\x78\x49\x3e\x72" 389 "\xb1\xa9\xb5\x83\xcb\x08\x54\xb7" 390 "\xad\x49\x3a\xae\x98\xce\xa6\x66" 391 "\x10\x30\x90\x8c\x55\x83\xd7\x7c" 392 "\x8b\xe6\x53\xde\xd2\x6e\x18\x21" 393 "\x01\x52\xd1\x9f\x9d\xbb\x9c\x73" 394 "\x57\xcc\x89\x09\x75\x9b\x78\x70" 395 "\xed\x26\x97\x4d\xb4\xe4\x0c\xa5" 396 "\xfa\x70\x04\x70\xc6\x96\x1c\x7d" 397 "\x54\x41\x77\xa8\xe3\xb0\x7e\x96" 398 "\x82\xd9\xec\xa2\x87\x68\x55\xf9" 399 "\x8f\x9e\x73\x43\x47\x6a\x08\x36" 400 "\x93\x67\xa8\x2d\xde\xac\x41\xa9" 401 "\x5c\x4d\x73\x97\x0f\x70\x68\xfa" 402 "\x56\x4d\x00\xc2\x3b\x1f\xc8\xb9" 403 "\x78\x1f\x51\x07\xe3\x9a\x13\x4e" 404 "\xed\x2b\x2e\xa3\xf7\x44\xb2\xe7" 405 "\xab\x19\x37\xd9\xba\x76\x5e\xd2" 406 "\xf2\x53\x15\x17\x4c\x6b\x16\x9f" 407 "\x02\x66\x49\xca\x7c\x91\x05\xf2" 408 "\x45\x36\x1e\xf5\x77\xad\x1f\x46" 409 "\xa8\x13\xfb\x63\xb6\x08\x99\x63" 410 "\x82\xa2\xed\xb3\xac\xdf\x43\x19" 411 "\x45\xea\x78\x73\xd9\xb7\x39\x11" 412 "\xa3\x13\x7c\xf8\x3f\xf7\xad\x81" 413 "\x48\x2f\xa9\x5c\x5f\xa0\xf0\x79" 414 "\xa4\x47\x7d\x80\x20\x26\xfd\x63" 415 "\x0a\xc7\x7e\x6d\x75\x47\xff\x76" 416 "\x66\x2e\x8a\x6c\x81\x35\xaf\x0b" 417 "\x2e\x6a\x49\x60\xc1\x10\xe1\xe1" 418 "\x54\x03\xa4\x09\x0c\x37\x7a\x15" 419 "\x23\x27\x5b\x8b\x4b\xa5\x64\x97" 420 "\xae\x4a\x50\x73\x1f\x66\x1c\x5c" 421 "\x03\x25\x3c\x8d\x48\x58\x71\x34" 422 "\x0e\xec\x4e\x55\x1a\x03\x6a\xe5" 423 "\xb6\x19\x2b\x84\x2a\x20\xd1\xea" 424 "\x80\x6f\x96\x0e\x05\x62\xc7\x78" 425 "\x87\x79\x60\x38\x46\xb4\x25\x57" 426 "\x6e\x16\x63\xf8\xad\x6e\xd7\x42" 427 "\x69\xe1\x88\xef\x6e\xd5\xb4\x9a" 428 "\x3c\x78\x6c\x3b\xe5\xa0\x1d\x22" 429 "\x86\x5c\x74\x3a\xeb\x24\x26\xc7" 430 "\x09\xfc\x91\x96\x47\x87\x4f\x1a" 431 "\xd6\x6b\x2c\x18\x47\xc0\xb8\x24" 432 "\xa8\x5a\x4a\x9e\xcb\x03\xe7\x2a" 433 "\x09\xe6\x4d\x9c\x6d\x86\x60\xf5" 434 "\x2f\x48\x69\x37\x9f\xf2\xd2\xcb" 435 "\x0e\x5a\xdd\x6e\x8a\xfb\x6a\xfe" 436 "\x0b\x63\xde\x87\x42\x79\x8a\x68" 437 "\x51\x28\x9b\x7a\xeb\xaf\xb8\x2f" 438 "\x9d\xd1\xc7\x45\x90\x08\xc9\x83" 439 "\xe9\x83\x84\xcb\x28\x69\x09\x69" 440 "\xce\x99\x46\x00\x54\xcb\xd8\x38" 441 "\xf9\x53\x4a\xbf\x31\xce\x57\x15" 442 "\x33\xfa\x96\x04\x33\x42\xe3\xc0" 443 "\xb7\x54\x4a\x65\x7a\x7c\x02\xe6" 444 "\x19\x95\xd0\x0e\x82\x07\x63\xf9" 445 "\xe1\x2b\x2a\xfc\x55\x92\x52\xc9" 446 "\xb5\x9f\x23\x28\x60\xe7\x20\x51" 447 "\x10\xd3\xed\x6d\x9b\xab\xb8\xe2" 448 "\x5d\x9a\x34\xb3\xbe\x9c\x64\xcb" 449 "\x78\xc6\x91\x22\x40\x91\x80\xbe" 450 "\xd7\x78\x5c\x0e\x0a\xdc\x08\xe9" 451 "\x67\x10\xa4\x83\x98\x79\x23\xe7" 452 "\x92\xda\xa9\x22\x16\xb1\xe7\x78" 453 "\xa3\x1c\x6c\x8f\x35\x7c\x4d\x37" 454 "\x2f\x6e\x0b\x50\x5c\x34\xb9\xf9" 455 "\xe6\x3d\x91\x0d\x32\x95\xaa\x3d" 456 "\x48\x11\x06\xbb\x2d\xf2\x63\x88" 457 "\x3f\x73\x09\xe2\x45\x56\x31\x51" 458 "\xfa\x5e\x4e\x62\xf7\x90\xf9\xa9" 459 "\x7d\x7b\x1b\xb1\xc8\x26\x6e\x66" 460 "\xf6\x90\x9a\x7f\xf2\x57\xcc\x23" 461 "\x59\xfa\xfa\xaa\x44\x04\x01\xa7" 462 "\xa4\x78\xdb\x74\x3d\x8b\xb5"; 463 464 static const u8 __initconst ctext12[735] = 465 "\x84\x0b\xdb\xd5\xb7\xa8\xfe\x20" 466 "\xbb\xb1\x12\x7f\x41\xea\xb3\xc0" 467 "\xa2\xb4\x37\x19\x11\x58\xb6\x0b" 468 "\x4c\x1d\x38\x05\x54\xd1\x16\x73" 469 "\x8e\x1c\x20\x90\xa2\x9a\xb7\x74" 470 "\x47\xe6\xd8\xfc\x18\x3a\xb4\xea" 471 "\xd5\x16\x5a\x2c\x53\x01\x46\xb3" 472 "\x18\x33\x74\x6c\x50\xf2\xe8\xc0" 473 "\x73\xda\x60\x22\xeb\xe3\xe5\x9b" 474 "\x20\x93\x6c\x4b\x37\x99\xb8\x23" 475 "\x3b\x4e\xac\xe8\x5b\xe8\x0f\xb7" 476 "\xc3\x8f\xfb\x4a\x37\xd9\x39\x95" 477 "\x34\xf1\xdb\x8f\x71\xd9\xc7\x0b" 478 "\x02\xf1\x63\xfc\x9b\xfc\xc5\xab" 479 "\xb9\x14\x13\x21\xdf\xce\xaa\x88" 480 "\x44\x30\x1e\xce\x26\x01\x92\xf8" 481 "\x9f\x00\x4b\x0c\x4b\xf7\x5f\xe0" 482 "\x89\xca\x94\x66\x11\x21\x97\xca" 483 "\x3e\x83\x74\x2d\xdb\x4d\x11\xeb" 484 "\x97\xc2\x14\xff\x9e\x1e\xa0\x6b" 485 "\x08\xb4\x31\x2b\x85\xc6\x85\x6c" 486 "\x90\xec\x39\xc0\xec\xb3\xb5\x4e" 487 "\xf3\x9c\xe7\x83\x3a\x77\x0a\xf4" 488 "\x56\xfe\xce\x18\x33\x6d\x0b\x2d" 489 "\x33\xda\xc8\x05\x5c\xb4\x09\x2a" 490 "\xde\x6b\x52\x98\x01\xef\x36\x3d" 491 "\xbd\xf9\x8f\xa8\x3e\xaa\xcd\xd1" 492 "\x01\x2d\x42\x49\xc3\xb6\x84\xbb" 493 "\x48\x96\xe0\x90\x93\x6c\x48\x64" 494 "\xd4\xfa\x7f\x93\x2c\xa6\x21\xc8" 495 "\x7a\x23\x7b\xaa\x20\x56\x12\xae" 496 "\x16\x9d\x94\x0f\x54\xa1\xec\xca" 497 "\x51\x4e\xf2\x39\xf4\xf8\x5f\x04" 498 "\x5a\x0d\xbf\xf5\x83\xa1\x15\xe1" 499 "\xf5\x3c\xd8\x62\xa3\xed\x47\x89" 500 "\x85\x4c\xe5\xdb\xac\x9e\x17\x1d" 501 "\x0c\x09\xe3\x3e\x39\x5b\x4d\x74" 502 "\x0e\xf5\x34\xee\x70\x11\x4c\xfd" 503 "\xdb\x34\xb1\xb5\x10\x3f\x73\xb7" 504 "\xf5\xfa\xed\xb0\x1f\xa5\xcd\x3c" 505 "\x8d\x35\x83\xd4\x11\x44\x6e\x6c" 506 "\x5b\xe0\x0e\x69\xa5\x39\xe5\xbb" 507 "\xa9\x57\x24\x37\xe6\x1f\xdd\xcf" 508 "\x16\x2a\x13\xf9\x6a\x2d\x90\xa0" 509 "\x03\x60\x7a\xed\x69\xd5\x00\x8b" 510 "\x7e\x4f\xcb\xb9\xfa\x91\xb9\x37" 511 "\xc1\x26\xce\x90\x97\x22\x64\x64" 512 "\xc1\x72\x43\x1b\xf6\xac\xc1\x54" 513 "\x8a\x10\x9c\xdd\x8d\xd5\x8e\xb2" 514 "\xe4\x85\xda\xe0\x20\x5f\xf4\xb4" 515 "\x15\xb5\xa0\x8d\x12\x74\x49\x23" 516 "\x3a\xdf\x4a\xd3\xf0\x3b\x89\xeb" 517 "\xf8\xcc\x62\x7b\xfb\x93\x07\x41" 518 "\x61\x26\x94\x58\x70\xa6\x3c\xe4" 519 "\xff\x58\xc4\x13\x3d\xcb\x36\x6b" 520 "\x32\xe5\xb2\x6d\x03\x74\x6f\x76" 521 "\x93\x77\xde\x48\xc4\xfa\x30\x4a" 522 "\xda\x49\x80\x77\x0f\x1c\xbe\x11" 523 "\xc8\x48\xb1\xe5\xbb\xf2\x8a\xe1" 524 "\x96\x2f\x9f\xd1\x8e\x8a\x5c\xe2" 525 "\xf7\xd7\xd8\x54\xf3\x3f\xc4\x91" 526 "\xb8\xfb\x86\xdc\x46\x24\x91\x60" 527 "\x6c\x2f\xc9\x41\x37\x51\x49\x54" 528 "\x09\x81\x21\xf3\x03\x9f\x2b\xe3" 529 "\x1f\x39\x63\xaf\xf4\xd7\x53\x60" 530 "\xa7\xc7\x54\xf9\xee\xb1\xb1\x7d" 531 "\x75\x54\x65\x93\xfe\xb1\x68\x6b" 532 "\x57\x02\xf9\xbb\x0e\xf9\xf8\xbf" 533 "\x01\x12\x27\xb4\xfe\xe4\x79\x7a" 534 "\x40\x5b\x51\x4b\xdf\x38\xec\xb1" 535 "\x6a\x56\xff\x35\x4d\x42\x33\xaa" 536 "\x6f\x1b\xe4\xdc\xe0\xdb\x85\x35" 537 "\x62\x10\xd4\xec\xeb\xc5\x7e\x45" 538 "\x1c\x6f\x17\xca\x3b\x8e\x2d\x66" 539 "\x4f\x4b\x36\x56\xcd\x1b\x59\xaa" 540 "\xd2\x9b\x17\xb9\x58\xdf\x7b\x64" 541 "\x8a\xff\x3b\x9c\xa6\xb5\x48\x9e" 542 "\xaa\xe2\x5d\x09\x71\x32\x5f\xb6" 543 "\x29\xbe\xe7\xc7\x52\x7e\x91\x82" 544 "\x6b\x6d\x33\xe1\x34\x06\x36\x21" 545 "\x5e\xbe\x1e\x2f\x3e\xc1\xfb\xea" 546 "\x49\x2c\xb5\xca\xf7\xb0\x37\xea" 547 "\x1f\xed\x10\x04\xd9\x48\x0d\x1a" 548 "\x1c\xfb\xe7\x84\x0e\x83\x53\x74" 549 "\xc7\x65\xe2\x5c\xe5\xba\x73\x4c" 550 "\x0e\xe1\xb5\x11\x45\x61\x43\x46" 551 "\xaa\x25\x8f\xbd\x85\x08\xfa\x4c" 552 "\x15\xc1\xc0\xd8\xf5\xdc\x16\xbb" 553 "\x7b\x1d\xe3\x87\x57\xa7\x2a\x1d" 554 "\x38\x58\x9e\x8a\x43\xdc\x57" 555 "\xd1\x81\x7d\x2b\xe9\xff\x99\x3a" 556 "\x4b\x24\x52\x58\x55\xe1\x49\x14"; 557 558 static struct { 559 const u8 *ptext; 560 const u8 *ctext; 561 562 u8 key[AES_MAX_KEY_SIZE]; 563 u8 iv[GCM_AES_IV_SIZE]; 564 u8 assoc[20]; 565 566 int klen; 567 int clen; 568 int plen; 569 int alen; 570 } const aesgcm_tv[] __initconst = { 571 { /* From McGrew & Viega - http://citeseer.ist.psu.edu/656989.html */ 572 .klen = 16, 573 .ctext = ctext0, 574 .clen = sizeof(ctext0), 575 }, { 576 .klen = 16, 577 .ptext = ptext1, 578 .plen = sizeof(ptext1), 579 .ctext = ctext1, 580 .clen = sizeof(ctext1), 581 }, { 582 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 583 "\x6d\x6a\x8f\x94\x67\x30\x83\x08", 584 .klen = 16, 585 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 586 "\xde\xca\xf8\x88", 587 .ptext = ptext2, 588 .plen = sizeof(ptext2), 589 .ctext = ctext2, 590 .clen = sizeof(ctext2), 591 }, { 592 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 593 "\x6d\x6a\x8f\x94\x67\x30\x83\x08", 594 .klen = 16, 595 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 596 "\xde\xca\xf8\x88", 597 .ptext = ptext3, 598 .plen = sizeof(ptext3), 599 .assoc = "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 600 "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 601 "\xab\xad\xda\xd2", 602 .alen = 20, 603 .ctext = ctext3, 604 .clen = sizeof(ctext3), 605 }, { 606 .klen = 24, 607 .ctext = ctext4, 608 .clen = sizeof(ctext4), 609 }, { 610 .klen = 24, 611 .ptext = ptext1, 612 .plen = sizeof(ptext1), 613 .ctext = ctext5, 614 .clen = sizeof(ctext5), 615 }, { 616 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 617 "\x6d\x6a\x8f\x94\x67\x30\x83\x08" 618 "\xfe\xff\xe9\x92\x86\x65\x73\x1c", 619 .klen = 24, 620 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 621 "\xde\xca\xf8\x88", 622 .ptext = ptext6, 623 .plen = sizeof(ptext6), 624 .ctext = ctext6, 625 .clen = sizeof(ctext6), 626 }, { 627 .klen = 32, 628 .ctext = ctext7, 629 .clen = sizeof(ctext7), 630 }, { 631 .klen = 32, 632 .ptext = ptext1, 633 .plen = sizeof(ptext1), 634 .ctext = ctext8, 635 .clen = sizeof(ctext8), 636 }, { 637 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 638 "\x6d\x6a\x8f\x94\x67\x30\x83\x08" 639 "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 640 "\x6d\x6a\x8f\x94\x67\x30\x83\x08", 641 .klen = 32, 642 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 643 "\xde\xca\xf8\x88", 644 .ptext = ptext9, 645 .plen = sizeof(ptext9), 646 .ctext = ctext9, 647 .clen = sizeof(ctext9), 648 }, { 649 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 650 "\x6d\x6a\x8f\x94\x67\x30\x83\x08" 651 "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 652 "\x6d\x6a\x8f\x94\x67\x30\x83\x08", 653 .klen = 32, 654 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 655 "\xde\xca\xf8\x88", 656 .ptext = ptext10, 657 .plen = sizeof(ptext10), 658 .assoc = "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 659 "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 660 "\xab\xad\xda\xd2", 661 .alen = 20, 662 .ctext = ctext10, 663 .clen = sizeof(ctext10), 664 }, { 665 .key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c" 666 "\x6d\x6a\x8f\x94\x67\x30\x83\x08" 667 "\xfe\xff\xe9\x92\x86\x65\x73\x1c", 668 .klen = 24, 669 .iv = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad" 670 "\xde\xca\xf8\x88", 671 .ptext = ptext11, 672 .plen = sizeof(ptext11), 673 .assoc = "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 674 "\xfe\xed\xfa\xce\xde\xad\xbe\xef" 675 "\xab\xad\xda\xd2", 676 .alen = 20, 677 .ctext = ctext11, 678 .clen = sizeof(ctext11), 679 }, { 680 .key = "\x62\x35\xf8\x95\xfc\xa5\xeb\xf6" 681 "\x0e\x92\x12\x04\xd3\xa1\x3f\x2e" 682 "\x8b\x32\xcf\xe7\x44\xed\x13\x59" 683 "\x04\x38\x77\xb0\xb9\xad\xb4\x38", 684 .klen = 32, 685 .iv = "\x00\xff\xff\xff\xff\x00\x00\xff" 686 "\xff\xff\x00\xff", 687 .ptext = ptext12, 688 .plen = sizeof(ptext12), 689 .ctext = ctext12, 690 .clen = sizeof(ctext12), 691 } 692 }; 693 694 static int __init libaesgcm_init(void) 695 { 696 for (int i = 0; i < ARRAY_SIZE(aesgcm_tv); i++) { 697 u8 tagbuf[AES_BLOCK_SIZE]; 698 int plen = aesgcm_tv[i].plen; 699 struct aesgcm_ctx ctx; 700 u8 buf[sizeof(ptext12)]; 701 702 if (aesgcm_expandkey(&ctx, aesgcm_tv[i].key, aesgcm_tv[i].klen, 703 aesgcm_tv[i].clen - plen)) { 704 pr_err("aesgcm_expandkey() failed on vector %d\n", i); 705 return -ENODEV; 706 } 707 708 if (!aesgcm_decrypt(&ctx, buf, aesgcm_tv[i].ctext, plen, 709 aesgcm_tv[i].assoc, aesgcm_tv[i].alen, 710 aesgcm_tv[i].iv, aesgcm_tv[i].ctext + plen) 711 || memcmp(buf, aesgcm_tv[i].ptext, plen)) { 712 pr_err("aesgcm_decrypt() #1 failed on vector %d\n", i); 713 return -ENODEV; 714 } 715 716 /* encrypt in place */ 717 aesgcm_encrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc, 718 aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf); 719 if (memcmp(buf, aesgcm_tv[i].ctext, plen)) { 720 pr_err("aesgcm_encrypt() failed on vector %d\n", i); 721 return -ENODEV; 722 } 723 724 /* decrypt in place */ 725 if (!aesgcm_decrypt(&ctx, buf, buf, plen, aesgcm_tv[i].assoc, 726 aesgcm_tv[i].alen, aesgcm_tv[i].iv, tagbuf) 727 || memcmp(buf, aesgcm_tv[i].ptext, plen)) { 728 pr_err("aesgcm_decrypt() #2 failed on vector %d\n", i); 729 return -ENODEV; 730 } 731 } 732 return 0; 733 } 734 module_init(libaesgcm_init); 735 736 static void __exit libaesgcm_exit(void) 737 { 738 } 739 module_exit(libaesgcm_exit); 740 #endif 741