crypto/echainiv.c

   1 /*
   2  * echainiv: Encrypted Chain IV Generator
   3  *
   4  * This generator generates an IV based on a sequence number by xoring it
   5  * with a salt and then encrypting it with the same key as used to encrypt
   6  * the plain text.  This algorithm requires that the block size be equal
   7  * to the IV size.  It is mainly useful for CBC.
   8  *
   9  * This generator can only be used by algorithms where authentication
  10  * is performed after encryption (i.e., authenc).
  11  *
  12  * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
  13  *
  14  * This program is free software; you can redistribute it and/or modify it
  15  * under the terms of the GNU General Public License as published by the Free
  16  * Software Foundation; either version 2 of the License, or (at your option)
  17  * any later version.
  18  *
  19  */
  20
  21 #include <crypto/internal/geniv.h>
  22 #include <crypto/null.h>
  23 #include <crypto/rng.h>
  24 #include <crypto/scatterwalk.h>
  25 #include <linux/err.h>
  26 #include <linux/init.h>
  27 #include <linux/kernel.h>
  28 #include <linux/mm.h>
  29 #include <linux/module.h>
  30 #include <linux/percpu.h>
  31 #include <linux/spinlock.h>
  32 #include <linux/string.h>
  33
  34 #define MAX_IV_SIZE 16
  35
  36 struct echainiv_ctx {
  37         /* aead_geniv_ctx must be first the element */
  38         struct aead_geniv_ctx geniv;
  39         struct crypto_blkcipher *null;
  40         u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
  41 };
  42
  43 static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
  44
  45 /* We don't care if we get preempted and read/write IVs from the next CPU. */
  46 static void echainiv_read_iv(u8 *dst, unsigned size)
  47 {
  48         u32 *a = (u32 *)dst;
  49         u32 __percpu *b = echainiv_iv;
  50
  51         for (; size >= 4; size -= 4) {
  52                 *a++ = this_cpu_read(*b);
  53                 b++;
  54         }
  55 }
  56
  57 static void echainiv_write_iv(const u8 *src, unsigned size)
  58 {
  59         const u32 *a = (const u32 *)src;
  60         u32 __percpu *b = echainiv_iv;
  61
  62         for (; size >= 4; size -= 4) {
  63                 this_cpu_write(*b, *a);
  64                 a++;
  65                 b++;
  66         }
  67 }
  68
  69 static void echainiv_encrypt_complete2(struct aead_request *req, int err)
  70 {
  71         struct aead_request *subreq = aead_request_ctx(req);
  72         struct crypto_aead *geniv;
  73         unsigned int ivsize;
  74
  75         if (err == -EINPROGRESS)
  76                 return;
  77
  78         if (err)
  79                 goto out;
  80
  81         geniv = crypto_aead_reqtfm(req);
  82         ivsize = crypto_aead_ivsize(geniv);
  83
  84         echainiv_write_iv(subreq->iv, ivsize);
  85
  86         if (req->iv != subreq->iv)
  87                 memcpy(req->iv, subreq->iv, ivsize);
  88
  89 out:
  90         if (req->iv != subreq->iv)
  91                 kzfree(subreq->iv);
  92 }
  93
  94 static void echainiv_encrypt_complete(struct crypto_async_request *base,
  95                                          int err)
  96 {
  97         struct aead_request *req = base->data;
  98
  99         echainiv_encrypt_complete2(req, err);
 100         aead_request_complete(req, err);
 101 }
 102
 103 static int echainiv_encrypt(struct aead_request *req)
 104 {
 105         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 106         struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
 107         struct aead_request *subreq = aead_request_ctx(req);
 108         crypto_completion_t compl;
 109         void *data;
 110         u8 *info;
 111         unsigned int ivsize = crypto_aead_ivsize(geniv);
 112         int err;
 113
 114         if (req->cryptlen < ivsize)
 115                 return -EINVAL;
 116
 117         aead_request_set_tfm(subreq, ctx->geniv.child);
 118
 119         compl = echainiv_encrypt_complete;
 120         data = req;
 121         info = req->iv;
 122
 123         if (req->src != req->dst) {
 124                 struct blkcipher_desc desc = {
 125                         .tfm = ctx->null,
 126                 };
 127
 128                 err = crypto_blkcipher_encrypt(
 129                         &desc, req->dst, req->src,
 130                         req->assoclen + req->cryptlen);
 131                 if (err)
 132                         return err;
 133         }
 134
 135         if (unlikely(!IS_ALIGNED((unsigned long)info,
 136                                  crypto_aead_alignmask(geniv) + 1))) {
 137                 info = kmalloc(ivsize, req->base.flags &
 138                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 139                                                                   GFP_ATOMIC);
 140                 if (!info)
 141                         return -ENOMEM;
 142
 143                 memcpy(info, req->iv, ivsize);
 144         }
 145
 146         aead_request_set_callback(subreq, req->base.flags, compl, data);
 147         aead_request_set_crypt(subreq, req->dst, req->dst,
 148                                req->cryptlen - ivsize, info);
 149         aead_request_set_ad(subreq, req->assoclen + ivsize);
 150
 151         crypto_xor(info, ctx->salt, ivsize);
 152         scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
 153         echainiv_read_iv(info, ivsize);
 154
 155         err = crypto_aead_encrypt(subreq);
 156         echainiv_encrypt_complete2(req, err);
 157         return err;
 158 }
 159
 160 static int echainiv_decrypt(struct aead_request *req)
 161 {
 162         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 163         struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
 164         struct aead_request *subreq = aead_request_ctx(req);
 165         crypto_completion_t compl;
 166         void *data;
 167         unsigned int ivsize = crypto_aead_ivsize(geniv);
 168
 169         if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 170                 return -EINVAL;
 171
 172         aead_request_set_tfm(subreq, ctx->geniv.child);
 173
 174         compl = req->base.complete;
 175         data = req->base.data;
 176
 177         aead_request_set_callback(subreq, req->base.flags, compl, data);
 178         aead_request_set_crypt(subreq, req->src, req->dst,
 179                                req->cryptlen - ivsize, req->iv);
 180         aead_request_set_ad(subreq, req->assoclen + ivsize);
 181
 182         scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
 183         if (req->src != req->dst)
 184                 scatterwalk_map_and_copy(req->iv, req->dst,
 185                                          req->assoclen, ivsize, 1);
 186
 187         return crypto_aead_decrypt(subreq);
 188 }
 189
 190 static int echainiv_init(struct crypto_tfm *tfm)
 191 {
 192         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 193         struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
 194         int err;
 195
 196         spin_lock_init(&ctx->geniv.lock);
 197
 198         crypto_aead_set_reqsize(geniv, sizeof(struct aead_request));
 199
 200         err = crypto_get_default_rng();
 201         if (err)
 202                 goto out;
 203
 204         err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 205                                    crypto_aead_ivsize(geniv));
 206         crypto_put_default_rng();
 207         if (err)
 208                 goto out;
 209
 210         ctx->null = crypto_get_default_null_skcipher();
 211         err = PTR_ERR(ctx->null);
 212         if (IS_ERR(ctx->null))
 213                 goto out;
 214
 215         err = aead_geniv_init(tfm);
 216         if (err)
 217                 goto drop_null;
 218
 219         ctx->geniv.child = geniv->child;
 220         geniv->child = geniv;
 221
 222 out:
 223         return err;
 224
 225 drop_null:
 226         crypto_put_default_null_skcipher();
 227         goto out;
 228 }
 229
 230 static void echainiv_exit(struct crypto_tfm *tfm)
 231 {
 232         struct echainiv_ctx *ctx = crypto_tfm_ctx(tfm);
 233
 234         crypto_free_aead(ctx->geniv.child);
 235         crypto_put_default_null_skcipher();
 236 }
 237
 238 static int echainiv_aead_create(struct crypto_template *tmpl,
 239                                 struct rtattr **tb)
 240 {
 241         struct aead_instance *inst;
 242         struct crypto_aead_spawn *spawn;
 243         struct aead_alg *alg;
 244         int err;
 245
 246         inst = aead_geniv_alloc(tmpl, tb, 0, 0);
 247
 248         if (IS_ERR(inst))
 249                 return PTR_ERR(inst);
 250
 251         spawn = aead_instance_ctx(inst);
 252         alg = crypto_spawn_aead_alg(spawn);
 253
 254         if (alg->base.cra_aead.encrypt)
 255                 goto done;
 256
 257         err = -EINVAL;
 258         if (inst->alg.ivsize & (sizeof(u32) - 1) ||
 259             inst->alg.ivsize > MAX_IV_SIZE)
 260                 goto free_inst;
 261
 262         inst->alg.encrypt = echainiv_encrypt;
 263         inst->alg.decrypt = echainiv_decrypt;
 264
 265         inst->alg.base.cra_init = echainiv_init;
 266         inst->alg.base.cra_exit = echainiv_exit;
 267
 268         inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
 269         inst->alg.base.cra_ctxsize = sizeof(struct echainiv_ctx);
 270         inst->alg.base.cra_ctxsize += inst->alg.ivsize;
 271
 272 done:
 273         err = aead_register_instance(tmpl, inst);
 274         if (err)
 275                 goto free_inst;
 276
 277 out:
 278         return err;
 279
 280 free_inst:
 281         aead_geniv_free(inst);
 282         goto out;
 283 }
 284
 285 static void echainiv_free(struct crypto_instance *inst)
 286 {
 287         aead_geniv_free(aead_instance(inst));
 288 }
 289
 290 static struct crypto_template echainiv_tmpl = {
 291         .name = "echainiv",
 292         .create = echainiv_aead_create,
 293         .free = echainiv_free,
 294         .module = THIS_MODULE,
 295 };
 296
 297 static int __init echainiv_module_init(void)
 298 {
 299         return crypto_register_template(&echainiv_tmpl);
 300 }
 301
 302 static void __exit echainiv_module_exit(void)
 303 {
 304         crypto_unregister_template(&echainiv_tmpl);
 305 }
 306
 307 module_init(echainiv_module_init);
 308 module_exit(echainiv_module_exit);
 309
 310 MODULE_LICENSE("GPL");
 311 MODULE_DESCRIPTION("Encrypted Chain IV Generator");
 312 MODULE_ALIAS_CRYPTO("echainiv");