2 * HEH: Hash-Encrypt-Hash mode
4 * Copyright (c) 2016 Google Inc.
7 * Alex Cope <alexcope@google.com>
8 * Eric Biggers <ebiggers@google.com>
12 * Hash-Encrypt-Hash (HEH) is a proposed block cipher mode of operation which
13 * extends the strong pseudo-random permutation (SPRP) property of block ciphers
14 * (e.g. AES) to arbitrary length input strings. It uses two keyed invertible
15 * hash functions with a layer of ECB encryption applied in-between. The
16 * algorithm is specified by the following Internet Draft:
18 * https://tools.ietf.org/html/draft-cope-heh-01
20 * Although HEH can be used as either a regular symmetric cipher or as an AEAD,
21 * currently this module only provides it as a symmetric cipher. Additionally,
22 * only 16-byte nonces are supported.
25 #include <crypto/gf128mul.h>
26 #include <crypto/internal/hash.h>
27 #include <crypto/internal/skcipher.h>
28 #include <crypto/scatterwalk.h>
29 #include <crypto/skcipher.h>
33 * The block size is the size of GF(2^128) elements and also the required block
34 * size of the underlying block cipher.
36 #define HEH_BLOCK_SIZE 16
38 struct heh_instance_ctx {
39 struct crypto_shash_spawn cmac;
40 struct crypto_shash_spawn poly_hash;
41 struct crypto_skcipher_spawn ecb;
45 struct crypto_shash *cmac;
46 struct crypto_shash *poly_hash; /* keyed with tau_key */
47 struct crypto_ablkcipher *ecb;
50 struct heh_cmac_data {
51 u8 nonce[HEH_BLOCK_SIZE];
54 __le32 message_length;
58 struct heh_req_ctx { /* aligned to alignmask */
63 struct heh_cmac_data data;
64 struct shash_desc desc;
65 /* + crypto_shash_descsize(cmac) */
68 struct shash_desc desc;
69 /* + crypto_shash_descsize(poly_hash) */
72 u8 keystream[HEH_BLOCK_SIZE];
73 u8 tmp[HEH_BLOCK_SIZE];
74 struct scatterlist tmp_sgl[2];
75 struct ablkcipher_request req;
76 /* + crypto_ablkcipher_reqsize(ecb) */
82 * Get the offset in bytes to the last full block, or equivalently the length of
83 * all full blocks excluding the last
85 static inline unsigned int get_tail_offset(unsigned int len)
87 len -= len % HEH_BLOCK_SIZE;
88 return len - HEH_BLOCK_SIZE;
91 static inline struct heh_req_ctx *heh_req_ctx(struct ablkcipher_request *req)
93 unsigned int alignmask = crypto_ablkcipher_alignmask(
94 crypto_ablkcipher_reqtfm(req));
96 return (void *)PTR_ALIGN((u8 *)ablkcipher_request_ctx(req),
100 static inline void async_done(struct crypto_async_request *areq, int err,
101 int (*next_step)(struct ablkcipher_request *,
104 struct ablkcipher_request *req = areq->data;
109 err = next_step(req, req->base.flags & ~CRYPTO_TFM_REQ_MAY_SLEEP);
110 if (err == -EINPROGRESS ||
111 (err == -EBUSY && (req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)))
114 ablkcipher_request_complete(req, err);
118 * Generate the per-message "beta" keys used by the hashing layers of HEH. The
119 * first beta key is the CMAC of the nonce, the additional authenticated data
120 * (AAD), and the lengths in bytes of the nonce, AAD, and message. The nonce
121 * and AAD are each zero-padded to the next 16-byte block boundary, and the
122 * lengths are serialized as 4-byte little endian integers and zero-padded to
123 * the next 16-byte block boundary.
124 * The second beta key is the first one interpreted as an element in GF(2^128)
125 * and multiplied by x.
127 * Note that because the nonce and AAD may, in general, be variable-length, the
128 * key generation must be done by a pseudo-random function (PRF) on
129 * variable-length inputs. CBC-MAC does not satisfy this, as it is only a PRF
130 * on fixed-length inputs. CMAC remedies this flaw. Including the lengths of
131 * the nonce, AAD, and message is also critical to avoid collisions.
133 * That being said, this implementation does not yet operate as an AEAD and
134 * therefore there is never any AAD, nor are variable-length nonces supported.
136 static int generate_betas(struct ablkcipher_request *req,
137 be128 *beta1_key, be128 *beta2_key)
139 struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
140 struct heh_tfm_ctx *ctx = crypto_ablkcipher_ctx(tfm);
141 struct heh_req_ctx *rctx = heh_req_ctx(req);
142 struct heh_cmac_data *data = &rctx->u.cmac.data;
143 struct shash_desc *desc = &rctx->u.cmac.desc;
146 BUILD_BUG_ON(sizeof(*data) != 2 * HEH_BLOCK_SIZE);
147 memcpy(data->nonce, req->info, HEH_BLOCK_SIZE);
148 data->nonce_length = cpu_to_le32(HEH_BLOCK_SIZE);
149 data->aad_length = cpu_to_le32(0);
150 data->message_length = cpu_to_le32(req->nbytes);
151 data->padding = cpu_to_le32(0);
153 desc->tfm = ctx->cmac;
154 desc->flags = req->base.flags;
156 err = crypto_shash_digest(desc, (const u8 *)data, sizeof(*data),
161 gf128mul_x_ble(beta2_key, beta1_key);
165 /*****************************************************************************/
168 * This is the generic version of poly_hash. It does the GF(2^128)
169 * multiplication by 'tau_key' using a precomputed table, without using any
170 * special CPU instructions. On some platforms, an accelerated version (with
171 * higher cra_priority) may be used instead.
174 struct poly_hash_tfm_ctx {
175 struct gf128mul_4k *tau_key;
178 struct poly_hash_desc_ctx {
183 static int poly_hash_setkey(struct crypto_shash *tfm,
184 const u8 *key, unsigned int keylen)
186 struct poly_hash_tfm_ctx *tctx = crypto_shash_ctx(tfm);
189 if (keylen != HEH_BLOCK_SIZE) {
190 crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
195 gf128mul_free_4k(tctx->tau_key);
196 memcpy(&key128, key, HEH_BLOCK_SIZE);
197 tctx->tau_key = gf128mul_init_4k_ble(&key128);
203 static int poly_hash_init(struct shash_desc *desc)
205 struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
207 ctx->digest = (be128) { 0 };
212 static int poly_hash_update(struct shash_desc *desc, const u8 *src,
215 struct poly_hash_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
216 struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
217 unsigned int partial = ctx->count % HEH_BLOCK_SIZE;
218 u8 *dst = (u8 *)&ctx->digest + partial;
222 /* Finishing at least one block? */
223 if (partial + len >= HEH_BLOCK_SIZE) {
226 /* Finish the pending block. */
227 unsigned int n = HEH_BLOCK_SIZE - partial;
234 gf128mul_4k_ble(&ctx->digest, tctx->tau_key);
237 /* Process zero or more full blocks. */
238 while (len >= HEH_BLOCK_SIZE) {
241 memcpy(&coeff, src, HEH_BLOCK_SIZE);
242 be128_xor(&ctx->digest, &ctx->digest, &coeff);
243 src += HEH_BLOCK_SIZE;
244 len -= HEH_BLOCK_SIZE;
245 gf128mul_4k_ble(&ctx->digest, tctx->tau_key);
247 dst = (u8 *)&ctx->digest;
250 /* Continue adding the next block to 'digest'. */
256 static int poly_hash_final(struct shash_desc *desc, u8 *out)
258 struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
260 /* Finish the last block if needed. */
261 if (ctx->count % HEH_BLOCK_SIZE) {
262 struct poly_hash_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
264 gf128mul_4k_ble(&ctx->digest, tctx->tau_key);
267 memcpy(out, &ctx->digest, HEH_BLOCK_SIZE);
271 static void poly_hash_exit(struct crypto_tfm *tfm)
273 struct poly_hash_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
275 gf128mul_free_4k(tctx->tau_key);
278 static struct shash_alg poly_hash_alg = {
279 .digestsize = HEH_BLOCK_SIZE,
280 .init = poly_hash_init,
281 .update = poly_hash_update,
282 .final = poly_hash_final,
283 .setkey = poly_hash_setkey,
284 .descsize = sizeof(struct poly_hash_desc_ctx),
286 .cra_name = "poly_hash",
287 .cra_driver_name = "poly_hash-generic",
289 .cra_ctxsize = sizeof(struct poly_hash_tfm_ctx),
290 .cra_exit = poly_hash_exit,
291 .cra_module = THIS_MODULE,
295 /*****************************************************************************/
298 * Split the message into 16 byte blocks, padding out the last block, and use
299 * the blocks as coefficients in the evaluation of a polynomial over GF(2^128)
300 * at the secret point 'tau_key'. For ease of implementing the higher-level
301 * heh_hash_inv() function, the constant and degree-1 coefficients are swapped
302 * if there is a partial block.
304 * Mathematically, compute:
305 * if (no partial block)
306 * k^{N-1} * m_0 + ... + k * m_{N-2} + m_{N-1}
307 * else if (partial block)
308 * k^N * m_0 + ... + k^2 * m_{N-2} + k * m_N + m_{N-1}
312 * N is the number of full blocks in the message
313 * m_i is the i-th full block in the message for i = 0 to N-1 inclusive
314 * m_N is the partial block of the message zero-padded up to 16 bytes
316 * Note that most of this is now separated out into its own keyed hash
317 * algorithm, to allow optimized implementations. However, we still handle the
318 * swapping of the last two coefficients here in the HEH template because this
319 * simplifies the poly_hash algorithms: they don't have to buffer an extra
320 * block, don't have to duplicate as much code, and are more similar to GHASH.
322 static int poly_hash(struct ablkcipher_request *req, struct scatterlist *sgl,
325 struct heh_req_ctx *rctx = heh_req_ctx(req);
326 struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
327 struct heh_tfm_ctx *ctx = crypto_ablkcipher_ctx(tfm);
328 struct shash_desc *desc = &rctx->u.poly_hash.desc;
329 unsigned int tail_offset = get_tail_offset(req->nbytes);
330 unsigned int tail_len = req->nbytes - tail_offset;
333 struct sg_mapping_iter miter;
336 desc->tfm = ctx->poly_hash;
337 desc->flags = req->base.flags;
339 /* Handle all full blocks except the last */
340 err = crypto_shash_init(desc);
341 sg_miter_start(&miter, sgl, sg_nents(sgl),
342 SG_MITER_FROM_SG | SG_MITER_ATOMIC);
343 for (i = 0; i < tail_offset && !err; i += n) {
344 sg_miter_next(&miter);
345 n = min_t(unsigned int, miter.length, tail_offset - i);
346 err = crypto_shash_update(desc, miter.addr, n);
348 sg_miter_stop(&miter);
352 /* Handle the last full block and the partial block */
353 scatterwalk_map_and_copy(tail, sgl, tail_offset, tail_len, 0);
355 if (tail_len != HEH_BLOCK_SIZE) {
356 /* handle the partial block */
357 memset((u8 *)tail + tail_len, 0, sizeof(tail) - tail_len);
358 err = crypto_shash_update(desc, (u8 *)&tail[1], HEH_BLOCK_SIZE);
362 err = crypto_shash_final(desc, (u8 *)hash);
365 be128_xor(hash, hash, &tail[0]);
370 * Transform all full blocks except the last.
371 * This is used by both the hash and inverse hash phases.
373 static int heh_tfm_blocks(struct ablkcipher_request *req,
374 struct scatterlist *src_sgl,
375 struct scatterlist *dst_sgl, unsigned int len,
376 const be128 *hash, const be128 *beta_key)
378 struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
379 struct blkcipher_desc desc = { .flags = req->base.flags };
380 struct blkcipher_walk walk;
385 blkcipher_walk_init(&walk, dst_sgl, src_sgl, len);
387 err = blkcipher_ablkcipher_walk_virt(&desc, &walk, tfm);
389 while ((nbytes = walk.nbytes)) {
390 const be128 *src = (be128 *)walk.src.virt.addr;
391 be128 *dst = (be128 *)walk.dst.virt.addr;
394 gf128mul_x_ble(&e, &e);
395 be128_xor(dst, src, hash);
396 be128_xor(dst, dst, &e);
399 } while ((nbytes -= HEH_BLOCK_SIZE) >= HEH_BLOCK_SIZE);
400 err = blkcipher_walk_done(&desc, &walk, nbytes);
406 * The hash phase of HEH. Given a message, compute:
408 * (m_0 + H, ..., m_{N-2} + H, H, m_N) + (xb, x^2b, ..., x^{N-1}b, b, 0)
411 * N is the number of full blocks in the message
412 * m_i is the i-th full block in the message for i = 0 to N-1 inclusive
413 * m_N is the unpadded partial block, possibly empty
414 * H is the poly_hash() of the message, keyed by tau_key
416 * x is the element x in our representation of GF(2^128)
418 * Note that the partial block remains unchanged, but it does affect the result
419 * of poly_hash() and therefore the transformation of all the full blocks.
421 static int heh_hash(struct ablkcipher_request *req, const be128 *beta_key)
424 unsigned int tail_offset = get_tail_offset(req->nbytes);
425 unsigned int partial_len = req->nbytes % HEH_BLOCK_SIZE;
428 /* poly_hash() the full message including the partial block */
429 err = poly_hash(req, req->src, &hash);
433 /* Transform all full blocks except the last */
434 err = heh_tfm_blocks(req, req->src, req->dst, tail_offset, &hash,
439 /* Set the last full block to hash XOR beta_key */
440 be128_xor(&hash, &hash, beta_key);
441 scatterwalk_map_and_copy(&hash, req->dst, tail_offset, HEH_BLOCK_SIZE,
444 /* Copy the partial block if needed */
445 if (partial_len != 0 && req->src != req->dst) {
446 unsigned int offs = tail_offset + HEH_BLOCK_SIZE;
448 scatterwalk_map_and_copy(&hash, req->src, offs, partial_len, 0);
449 scatterwalk_map_and_copy(&hash, req->dst, offs, partial_len, 1);
455 * The inverse hash phase of HEH. This undoes the result of heh_hash().
457 static int heh_hash_inv(struct ablkcipher_request *req, const be128 *beta_key)
461 struct scatterlist tmp_sgl[2];
462 struct scatterlist *tail_sgl;
463 unsigned int tail_offset = get_tail_offset(req->nbytes);
464 struct scatterlist *sgl = req->dst;
468 * The last full block was computed as hash XOR beta_key, so XOR it with
469 * beta_key to recover hash.
471 tail_sgl = scatterwalk_ffwd(tmp_sgl, sgl, tail_offset);
472 scatterwalk_map_and_copy(&hash, tail_sgl, 0, HEH_BLOCK_SIZE, 0);
473 be128_xor(&hash, &hash, beta_key);
475 /* Transform all full blocks except the last */
476 err = heh_tfm_blocks(req, sgl, sgl, tail_offset, &hash, beta_key);
481 * Recover the last full block. We know 'hash', i.e. the poly_hash() of
482 * the the original message. The last full block was the constant term
483 * of the polynomial. To recover the last full block, temporarily zero
484 * it, compute the poly_hash(), and take the difference from 'hash'.
486 memset(&tmp, 0, sizeof(tmp));
487 scatterwalk_map_and_copy(&tmp, tail_sgl, 0, HEH_BLOCK_SIZE, 1);
488 err = poly_hash(req, sgl, &tmp);
491 be128_xor(&tmp, &tmp, &hash);
492 scatterwalk_map_and_copy(&tmp, tail_sgl, 0, HEH_BLOCK_SIZE, 1);
496 static int heh_hash_inv_step(struct ablkcipher_request *req, u32 flags)
498 struct heh_req_ctx *rctx = heh_req_ctx(req);
500 return heh_hash_inv(req, &rctx->beta2_key);
503 static int heh_ecb_step_3(struct ablkcipher_request *req, u32 flags)
505 struct heh_req_ctx *rctx = heh_req_ctx(req);
506 u8 partial_block[HEH_BLOCK_SIZE] __aligned(__alignof__(u32));
507 unsigned int tail_offset = get_tail_offset(req->nbytes);
508 unsigned int partial_offset = tail_offset + HEH_BLOCK_SIZE;
509 unsigned int partial_len = req->nbytes - partial_offset;
512 * Extract the pad in req->dst at tail_offset, and xor the partial block
513 * with it to create encrypted partial block
515 scatterwalk_map_and_copy(rctx->u.ecb.keystream, req->dst, tail_offset,
517 scatterwalk_map_and_copy(partial_block, req->dst, partial_offset,
519 crypto_xor(partial_block, rctx->u.ecb.keystream, partial_len);
522 * Store the encrypted final block and partial block back in dst_sg
524 scatterwalk_map_and_copy(&rctx->u.ecb.tmp, req->dst, tail_offset,
526 scatterwalk_map_and_copy(partial_block, req->dst, partial_offset,
529 return heh_hash_inv_step(req, flags);
532 static void heh_ecb_step_2_done(struct crypto_async_request *areq, int err)
534 return async_done(areq, err, heh_ecb_step_3);
537 static int heh_ecb_step_2(struct ablkcipher_request *req, u32 flags)
539 struct heh_req_ctx *rctx = heh_req_ctx(req);
540 unsigned int partial_len = req->nbytes % HEH_BLOCK_SIZE;
541 struct scatterlist *tmp_sgl;
543 unsigned int tail_offset = get_tail_offset(req->nbytes);
545 if (partial_len == 0)
546 return heh_hash_inv_step(req, flags);
549 * Extract the final full block, store it in tmp, and then xor that with
550 * the value saved in u.ecb.keystream
552 scatterwalk_map_and_copy(rctx->u.ecb.tmp, req->dst, tail_offset,
554 crypto_xor(rctx->u.ecb.keystream, rctx->u.ecb.tmp, HEH_BLOCK_SIZE);
557 * Encrypt the value in rctx->u.ecb.keystream to create the pad for the
559 * We cannot encrypt stack buffers, so re-use the dst_sg to do this
560 * encryption to avoid a malloc. The value at tail_offset is stored in
561 * tmp, and will be restored later.
563 scatterwalk_map_and_copy(rctx->u.ecb.keystream, req->dst, tail_offset,
565 tmp_sgl = scatterwalk_ffwd(rctx->u.ecb.tmp_sgl, req->dst, tail_offset);
566 ablkcipher_request_set_callback(&rctx->u.ecb.req, flags,
567 heh_ecb_step_2_done, req);
568 ablkcipher_request_set_crypt(&rctx->u.ecb.req, tmp_sgl, tmp_sgl,
569 HEH_BLOCK_SIZE, NULL);
570 err = crypto_ablkcipher_encrypt(&rctx->u.ecb.req);
573 return heh_ecb_step_3(req, flags);
576 static void heh_ecb_full_done(struct crypto_async_request *areq, int err)
578 return async_done(areq, err, heh_ecb_step_2);
582 * The encrypt phase of HEH. This uses ECB encryption, with special handling
583 * for the partial block at the end if any. The source data is already in
584 * req->dst, so the encryption happens in-place.
586 * After the encrypt phase we continue on to the inverse hash phase. The
587 * functions calls are chained to support asynchronous ECB algorithms.
589 static int heh_ecb(struct ablkcipher_request *req, bool decrypt)
591 struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
592 struct heh_tfm_ctx *ctx = crypto_ablkcipher_ctx(tfm);
593 struct heh_req_ctx *rctx = heh_req_ctx(req);
594 struct ablkcipher_request *ecb_req = &rctx->u.ecb.req;
595 unsigned int tail_offset = get_tail_offset(req->nbytes);
596 unsigned int full_len = tail_offset + HEH_BLOCK_SIZE;
600 * Save the last full block before it is encrypted/decrypted. This will
601 * be used later to encrypt/decrypt the partial block
603 scatterwalk_map_and_copy(rctx->u.ecb.keystream, req->dst, tail_offset,
606 /* Encrypt/decrypt all full blocks */
607 ablkcipher_request_set_tfm(ecb_req, ctx->ecb);
608 ablkcipher_request_set_callback(ecb_req, req->base.flags,
609 heh_ecb_full_done, req);
610 ablkcipher_request_set_crypt(ecb_req, req->dst, req->dst, full_len,
613 err = crypto_ablkcipher_decrypt(ecb_req);
615 err = crypto_ablkcipher_encrypt(ecb_req);
619 return heh_ecb_step_2(req, req->base.flags);
622 static int heh_crypt(struct ablkcipher_request *req, bool decrypt)
624 struct heh_req_ctx *rctx = heh_req_ctx(req);
627 /* Inputs must be at least one full block */
628 if (req->nbytes < HEH_BLOCK_SIZE)
631 err = generate_betas(req, &rctx->beta1_key, &rctx->beta2_key);
636 swap(rctx->beta1_key, rctx->beta2_key);
638 err = heh_hash(req, &rctx->beta1_key);
642 return heh_ecb(req, decrypt);
645 static int heh_encrypt(struct ablkcipher_request *req)
647 return heh_crypt(req, false);
650 static int heh_decrypt(struct ablkcipher_request *req)
652 return heh_crypt(req, true);
655 static int heh_setkey(struct crypto_ablkcipher *parent, const u8 *key,
658 struct heh_tfm_ctx *ctx = crypto_ablkcipher_ctx(parent);
659 struct crypto_shash *cmac = ctx->cmac;
660 struct crypto_ablkcipher *ecb = ctx->ecb;
661 SHASH_DESC_ON_STACK(desc, cmac);
663 u8 digest[HEH_BLOCK_SIZE];
667 /* set prf_key = key */
668 crypto_shash_clear_flags(cmac, CRYPTO_TFM_REQ_MASK);
669 crypto_shash_set_flags(cmac, crypto_ablkcipher_get_flags(parent) &
670 CRYPTO_TFM_REQ_MASK);
671 err = crypto_shash_setkey(cmac, key, keylen);
672 crypto_ablkcipher_set_flags(parent, crypto_shash_get_flags(cmac) &
673 CRYPTO_TFM_RES_MASK);
678 * Generate tau_key and ecb_key as follows:
679 * tau_key = cmac(prf_key, 0x00...01)
680 * ecb_key = cmac(prf_key, 0x00...02) || cmac(prf_key, 0x00...03) || ...
681 * truncated to keylen bytes
683 derived_keys = kzalloc(round_up(HEH_BLOCK_SIZE + keylen,
684 HEH_BLOCK_SIZE), GFP_KERNEL);
688 desc->flags = (crypto_shash_get_flags(cmac) & CRYPTO_TFM_REQ_MASK);
689 for (i = 0; i < keylen + HEH_BLOCK_SIZE; i += HEH_BLOCK_SIZE) {
690 derived_keys[i + HEH_BLOCK_SIZE - 1] =
691 0x01 + i / HEH_BLOCK_SIZE;
692 err = crypto_shash_digest(desc, derived_keys + i,
693 HEH_BLOCK_SIZE, digest);
696 memcpy(derived_keys + i, digest, HEH_BLOCK_SIZE);
699 err = crypto_shash_setkey(ctx->poly_hash, derived_keys, HEH_BLOCK_SIZE);
703 crypto_ablkcipher_clear_flags(ecb, CRYPTO_TFM_REQ_MASK);
704 crypto_ablkcipher_set_flags(ecb, crypto_ablkcipher_get_flags(parent) &
705 CRYPTO_TFM_REQ_MASK);
706 err = crypto_ablkcipher_setkey(ecb, derived_keys + HEH_BLOCK_SIZE,
708 crypto_ablkcipher_set_flags(parent, crypto_ablkcipher_get_flags(ecb) &
709 CRYPTO_TFM_RES_MASK);
711 kzfree(derived_keys);
715 static int heh_init_tfm(struct crypto_tfm *tfm)
717 struct crypto_instance *inst = crypto_tfm_alg_instance(tfm);
718 struct heh_instance_ctx *ictx = crypto_instance_ctx(inst);
719 struct heh_tfm_ctx *ctx = crypto_tfm_ctx(tfm);
720 struct crypto_shash *cmac;
721 struct crypto_shash *poly_hash;
722 struct crypto_ablkcipher *ecb;
723 unsigned int reqsize;
726 cmac = crypto_spawn_shash(&ictx->cmac);
728 return PTR_ERR(cmac);
730 poly_hash = crypto_spawn_shash(&ictx->poly_hash);
731 err = PTR_ERR(poly_hash);
732 if (IS_ERR(poly_hash))
735 ecb = crypto_spawn_skcipher(&ictx->ecb);
738 goto err_free_poly_hash;
741 ctx->poly_hash = poly_hash;
744 reqsize = crypto_tfm_alg_alignmask(tfm) &
745 ~(crypto_tfm_ctx_alignment() - 1);
746 reqsize += max3(offsetof(struct heh_req_ctx, u.cmac.desc) +
747 sizeof(struct shash_desc) +
748 crypto_shash_descsize(cmac),
749 offsetof(struct heh_req_ctx, u.poly_hash.desc) +
750 sizeof(struct shash_desc) +
751 crypto_shash_descsize(poly_hash),
752 offsetof(struct heh_req_ctx, u.ecb.req) +
753 sizeof(struct ablkcipher_request) +
754 crypto_ablkcipher_reqsize(ecb));
755 tfm->crt_ablkcipher.reqsize = reqsize;
760 crypto_free_shash(poly_hash);
762 crypto_free_shash(cmac);
766 static void heh_exit_tfm(struct crypto_tfm *tfm)
768 struct heh_tfm_ctx *ctx = crypto_tfm_ctx(tfm);
770 crypto_free_shash(ctx->cmac);
771 crypto_free_shash(ctx->poly_hash);
772 crypto_free_ablkcipher(ctx->ecb);
775 static void heh_free_instance(struct crypto_instance *inst)
777 struct heh_instance_ctx *ctx = crypto_instance_ctx(inst);
779 crypto_drop_shash(&ctx->cmac);
780 crypto_drop_shash(&ctx->poly_hash);
781 crypto_drop_skcipher(&ctx->ecb);
786 * Create an instance of HEH as a ablkcipher.
788 * This relies on underlying CMAC and ECB algorithms, usually cmac(aes) and
789 * ecb(aes). For performance reasons we support asynchronous ECB algorithms.
790 * However, we do not yet support asynchronous CMAC algorithms because CMAC is
791 * only used on a small fixed amount of data per request, independent of the
792 * request length. This would change if AEAD or variable-length nonce support
793 * were to be exposed.
795 static int heh_create_common(struct crypto_template *tmpl, struct rtattr **tb,
796 const char *full_name, const char *cmac_name,
797 const char *poly_hash_name, const char *ecb_name)
799 struct crypto_attr_type *algt;
800 struct crypto_instance *inst;
801 struct heh_instance_ctx *ctx;
802 struct shash_alg *cmac;
803 struct shash_alg *poly_hash;
804 struct crypto_alg *ecb;
807 algt = crypto_get_attr_type(tb);
809 return PTR_ERR(algt);
811 /* User must be asking for something compatible with ablkcipher */
812 if ((algt->type ^ CRYPTO_ALG_TYPE_ABLKCIPHER) & algt->mask)
815 /* Allocate the ablkcipher instance */
816 inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
820 ctx = crypto_instance_ctx(inst);
822 /* Set up the cmac spawn */
823 ctx->cmac.base.inst = inst;
824 err = crypto_grab_shash(&ctx->cmac, cmac_name, 0, 0);
827 cmac = crypto_spawn_shash_alg(&ctx->cmac);
829 if (cmac->digestsize != HEH_BLOCK_SIZE)
832 /* Set up the poly_hash spawn */
833 ctx->poly_hash.base.inst = inst;
834 err = crypto_grab_shash(&ctx->poly_hash, poly_hash_name, 0, 0);
837 poly_hash = crypto_spawn_shash_alg(&ctx->poly_hash);
839 if (poly_hash->digestsize != HEH_BLOCK_SIZE)
840 goto err_drop_poly_hash;
842 /* Set up the ecb spawn */
843 ctx->ecb.base.inst = inst;
844 err = crypto_grab_skcipher(&ctx->ecb, ecb_name, 0,
845 crypto_requires_sync(algt->type,
848 goto err_drop_poly_hash;
849 ecb = crypto_skcipher_spawn_alg(&ctx->ecb);
851 /* HEH only supports block ciphers with 16 byte block size */
853 if (ecb->cra_blocksize != HEH_BLOCK_SIZE)
856 /* The underlying "ECB" algorithm must not require an IV */
858 if ((ecb->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_BLKCIPHER) {
859 if (ecb->cra_blkcipher.ivsize != 0)
862 if (ecb->cra_ablkcipher.ivsize != 0)
866 /* Set the instance names */
868 if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
869 "heh_base(%s,%s,%s)", cmac->base.cra_driver_name,
870 poly_hash->base.cra_driver_name,
871 ecb->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
875 if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
876 "%s", full_name) >= CRYPTO_MAX_ALG_NAME)
879 /* Finish initializing the instance */
881 inst->alg.cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
882 (ecb->cra_flags & CRYPTO_ALG_ASYNC);
883 inst->alg.cra_blocksize = HEH_BLOCK_SIZE;
884 inst->alg.cra_ctxsize = sizeof(struct heh_tfm_ctx);
885 inst->alg.cra_alignmask = ecb->cra_alignmask | (__alignof__(be128) - 1);
886 inst->alg.cra_priority = ecb->cra_priority;
887 inst->alg.cra_type = &crypto_ablkcipher_type;
888 inst->alg.cra_init = heh_init_tfm;
889 inst->alg.cra_exit = heh_exit_tfm;
891 inst->alg.cra_ablkcipher.setkey = heh_setkey;
892 inst->alg.cra_ablkcipher.encrypt = heh_encrypt;
893 inst->alg.cra_ablkcipher.decrypt = heh_decrypt;
894 if ((ecb->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_BLKCIPHER) {
895 inst->alg.cra_ablkcipher.min_keysize = ecb->cra_blkcipher.min_keysize;
896 inst->alg.cra_ablkcipher.max_keysize = ecb->cra_blkcipher.max_keysize;
898 inst->alg.cra_ablkcipher.min_keysize = ecb->cra_ablkcipher.min_keysize;
899 inst->alg.cra_ablkcipher.max_keysize = ecb->cra_ablkcipher.max_keysize;
901 inst->alg.cra_ablkcipher.ivsize = HEH_BLOCK_SIZE;
903 /* Register the instance */
904 err = crypto_register_instance(tmpl, inst);
910 crypto_drop_skcipher(&ctx->ecb);
912 crypto_drop_shash(&ctx->poly_hash);
914 crypto_drop_shash(&ctx->cmac);
920 static int heh_create(struct crypto_template *tmpl, struct rtattr **tb)
922 const char *cipher_name;
923 char full_name[CRYPTO_MAX_ALG_NAME];
924 char cmac_name[CRYPTO_MAX_ALG_NAME];
925 char ecb_name[CRYPTO_MAX_ALG_NAME];
927 /* Get the name of the requested block cipher (e.g. aes) */
928 cipher_name = crypto_attr_alg_name(tb[1]);
929 if (IS_ERR(cipher_name))
930 return PTR_ERR(cipher_name);
932 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "heh(%s)", cipher_name) >=
934 return -ENAMETOOLONG;
936 if (snprintf(cmac_name, CRYPTO_MAX_ALG_NAME, "cmac(%s)", cipher_name) >=
938 return -ENAMETOOLONG;
940 if (snprintf(ecb_name, CRYPTO_MAX_ALG_NAME, "ecb(%s)", cipher_name) >=
942 return -ENAMETOOLONG;
944 return heh_create_common(tmpl, tb, full_name, cmac_name, "poly_hash",
948 static struct crypto_template heh_tmpl = {
950 .create = heh_create,
951 .free = heh_free_instance,
952 .module = THIS_MODULE,
955 static int heh_base_create(struct crypto_template *tmpl, struct rtattr **tb)
957 char full_name[CRYPTO_MAX_ALG_NAME];
958 const char *cmac_name;
959 const char *poly_hash_name;
960 const char *ecb_name;
962 cmac_name = crypto_attr_alg_name(tb[1]);
963 if (IS_ERR(cmac_name))
964 return PTR_ERR(cmac_name);
966 poly_hash_name = crypto_attr_alg_name(tb[2]);
967 if (IS_ERR(poly_hash_name))
968 return PTR_ERR(poly_hash_name);
970 ecb_name = crypto_attr_alg_name(tb[3]);
971 if (IS_ERR(ecb_name))
972 return PTR_ERR(ecb_name);
974 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "heh_base(%s,%s,%s)",
975 cmac_name, poly_hash_name, ecb_name) >=
977 return -ENAMETOOLONG;
979 return heh_create_common(tmpl, tb, full_name, cmac_name, poly_hash_name,
984 * If HEH is instantiated as "heh_base" instead of "heh", then specific
985 * implementations of cmac, poly_hash, and ecb can be specified instead of just
988 static struct crypto_template heh_base_tmpl = {
990 .create = heh_base_create,
991 .free = heh_free_instance,
992 .module = THIS_MODULE,
995 static int __init heh_module_init(void)
999 err = crypto_register_template(&heh_tmpl);
1003 err = crypto_register_template(&heh_base_tmpl);
1007 err = crypto_register_shash(&poly_hash_alg);
1009 goto out_undo_heh_base;
1014 crypto_unregister_template(&heh_base_tmpl);
1016 crypto_unregister_template(&heh_tmpl);
1020 static void __exit heh_module_exit(void)
1022 crypto_unregister_template(&heh_tmpl);
1023 crypto_unregister_template(&heh_base_tmpl);
1024 crypto_unregister_shash(&poly_hash_alg);
1027 module_init(heh_module_init);
1028 module_exit(heh_module_exit);
1030 MODULE_LICENSE("GPL");
1031 MODULE_DESCRIPTION("Hash-Encrypt-Hash block cipher mode");
1032 MODULE_ALIAS_CRYPTO("heh");
1033 MODULE_ALIAS_CRYPTO("heh_base");