blob: 5564e73266a6abb5ba91da29422ac86ba0ac153c
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * Adiantum length-preserving encryption mode |
4 | * |
5 | * Copyright 2018 Google LLC |
6 | */ |
7 | |
8 | /* |
9 | * Adiantum is a tweakable, length-preserving encryption mode designed for fast |
10 | * and secure disk encryption, especially on CPUs without dedicated crypto |
11 | * instructions. Adiantum encrypts each sector using the XChaCha12 stream |
12 | * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on |
13 | * NH and Poly1305, and an invocation of the AES-256 block cipher on a single |
14 | * 16-byte block. See the paper for details: |
15 | * |
16 | * Adiantum: length-preserving encryption for entry-level processors |
17 | * (https://eprint.iacr.org/2018/720.pdf) |
18 | * |
19 | * For flexibility, this implementation also allows other ciphers: |
20 | * |
21 | * - Stream cipher: XChaCha12 or XChaCha20 |
22 | * - Block cipher: any with a 128-bit block size and 256-bit key |
23 | * |
24 | * This implementation doesn't currently allow other ε-∆U hash functions, i.e. |
25 | * HPolyC is not supported. This is because Adiantum is ~20% faster than HPolyC |
26 | * but still provably as secure, and also the ε-∆U hash function of HBSH is |
27 | * formally defined to take two inputs (tweak, message) which makes it difficult |
28 | * to wrap with the crypto_shash API. Rather, some details need to be handled |
29 | * here. Nevertheless, if needed in the future, support for other ε-∆U hash |
30 | * functions could be added here. |
31 | */ |
32 | |
33 | #include <crypto/b128ops.h> |
34 | #include <crypto/chacha.h> |
35 | #include <crypto/internal/hash.h> |
36 | #include <crypto/internal/skcipher.h> |
37 | #include <crypto/nhpoly1305.h> |
38 | #include <crypto/scatterwalk.h> |
39 | #include <linux/module.h> |
40 | |
41 | #include "internal.h" |
42 | |
43 | /* |
44 | * Size of right-hand part of input data, in bytes; also the size of the block |
45 | * cipher's block size and the hash function's output. |
46 | */ |
47 | #define BLOCKCIPHER_BLOCK_SIZE 16 |
48 | |
49 | /* Size of the block cipher key (K_E) in bytes */ |
50 | #define BLOCKCIPHER_KEY_SIZE 32 |
51 | |
52 | /* Size of the hash key (K_H) in bytes */ |
53 | #define HASH_KEY_SIZE (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE) |
54 | |
55 | /* |
56 | * The specification allows variable-length tweaks, but Linux's crypto API |
57 | * currently only allows algorithms to support a single length. The "natural" |
58 | * tweak length for Adiantum is 16, since that fits into one Poly1305 block for |
59 | * the best performance. But longer tweaks are useful for fscrypt, to avoid |
60 | * needing to derive per-file keys. So instead we use two blocks, or 32 bytes. |
61 | */ |
62 | #define TWEAK_SIZE 32 |
63 | |
64 | struct adiantum_instance_ctx { |
65 | struct crypto_skcipher_spawn streamcipher_spawn; |
66 | struct crypto_spawn blockcipher_spawn; |
67 | struct crypto_shash_spawn hash_spawn; |
68 | }; |
69 | |
70 | struct adiantum_tfm_ctx { |
71 | struct crypto_skcipher *streamcipher; |
72 | struct crypto_cipher *blockcipher; |
73 | struct crypto_shash *hash; |
74 | struct poly1305_key header_hash_key; |
75 | }; |
76 | |
77 | struct adiantum_request_ctx { |
78 | |
79 | /* |
80 | * Buffer for right-hand part of data, i.e. |
81 | * |
82 | * P_L => P_M => C_M => C_R when encrypting, or |
83 | * C_R => C_M => P_M => P_L when decrypting. |
84 | * |
85 | * Also used to build the IV for the stream cipher. |
86 | */ |
87 | union { |
88 | u8 bytes[XCHACHA_IV_SIZE]; |
89 | __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)]; |
90 | le128 bignum; /* interpret as element of Z/(2^{128}Z) */ |
91 | } rbuf; |
92 | |
93 | bool enc; /* true if encrypting, false if decrypting */ |
94 | |
95 | /* |
96 | * The result of the Poly1305 ε-∆U hash function applied to |
97 | * (bulk length, tweak) |
98 | */ |
99 | le128 header_hash; |
100 | |
101 | /* Sub-requests, must be last */ |
102 | union { |
103 | struct shash_desc hash_desc; |
104 | struct skcipher_request streamcipher_req; |
105 | } u; |
106 | }; |
107 | |
108 | /* |
109 | * Given the XChaCha stream key K_S, derive the block cipher key K_E and the |
110 | * hash key K_H as follows: |
111 | * |
112 | * K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191) |
113 | * |
114 | * Note that this denotes using bits from the XChaCha keystream, which here we |
115 | * get indirectly by encrypting a buffer containing all 0's. |
116 | */ |
117 | static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key, |
118 | unsigned int keylen) |
119 | { |
120 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
121 | struct { |
122 | u8 iv[XCHACHA_IV_SIZE]; |
123 | u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE]; |
124 | struct scatterlist sg; |
125 | struct crypto_wait wait; |
126 | struct skcipher_request req; /* must be last */ |
127 | } *data; |
128 | u8 *keyp; |
129 | int err; |
130 | |
131 | /* Set the stream cipher key (K_S) */ |
132 | crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK); |
133 | crypto_skcipher_set_flags(tctx->streamcipher, |
134 | crypto_skcipher_get_flags(tfm) & |
135 | CRYPTO_TFM_REQ_MASK); |
136 | err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen); |
137 | crypto_skcipher_set_flags(tfm, |
138 | crypto_skcipher_get_flags(tctx->streamcipher) & |
139 | CRYPTO_TFM_RES_MASK); |
140 | if (err) |
141 | return err; |
142 | |
143 | /* Derive the subkeys */ |
144 | data = kzalloc(sizeof(*data) + |
145 | crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL); |
146 | if (!data) |
147 | return -ENOMEM; |
148 | data->iv[0] = 1; |
149 | sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys)); |
150 | crypto_init_wait(&data->wait); |
151 | skcipher_request_set_tfm(&data->req, tctx->streamcipher); |
152 | skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP | |
153 | CRYPTO_TFM_REQ_MAY_BACKLOG, |
154 | crypto_req_done, &data->wait); |
155 | skcipher_request_set_crypt(&data->req, &data->sg, &data->sg, |
156 | sizeof(data->derived_keys), data->iv); |
157 | err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait); |
158 | if (err) |
159 | goto out; |
160 | keyp = data->derived_keys; |
161 | |
162 | /* Set the block cipher key (K_E) */ |
163 | crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK); |
164 | crypto_cipher_set_flags(tctx->blockcipher, |
165 | crypto_skcipher_get_flags(tfm) & |
166 | CRYPTO_TFM_REQ_MASK); |
167 | err = crypto_cipher_setkey(tctx->blockcipher, keyp, |
168 | BLOCKCIPHER_KEY_SIZE); |
169 | crypto_skcipher_set_flags(tfm, |
170 | crypto_cipher_get_flags(tctx->blockcipher) & |
171 | CRYPTO_TFM_RES_MASK); |
172 | if (err) |
173 | goto out; |
174 | keyp += BLOCKCIPHER_KEY_SIZE; |
175 | |
176 | /* Set the hash key (K_H) */ |
177 | poly1305_core_setkey(&tctx->header_hash_key, keyp); |
178 | keyp += POLY1305_BLOCK_SIZE; |
179 | |
180 | crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK); |
181 | crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) & |
182 | CRYPTO_TFM_REQ_MASK); |
183 | err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE); |
184 | crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) & |
185 | CRYPTO_TFM_RES_MASK); |
186 | keyp += NHPOLY1305_KEY_SIZE; |
187 | WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]); |
188 | out: |
189 | kzfree(data); |
190 | return err; |
191 | } |
192 | |
193 | /* Addition in Z/(2^{128}Z) */ |
194 | static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2) |
195 | { |
196 | u64 x = le64_to_cpu(v1->b); |
197 | u64 y = le64_to_cpu(v2->b); |
198 | |
199 | r->b = cpu_to_le64(x + y); |
200 | r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) + |
201 | (x + y < x)); |
202 | } |
203 | |
204 | /* Subtraction in Z/(2^{128}Z) */ |
205 | static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2) |
206 | { |
207 | u64 x = le64_to_cpu(v1->b); |
208 | u64 y = le64_to_cpu(v2->b); |
209 | |
210 | r->b = cpu_to_le64(x - y); |
211 | r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) - |
212 | (x - y > x)); |
213 | } |
214 | |
215 | /* |
216 | * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the |
217 | * result to rctx->header_hash. This is the calculation |
218 | * |
219 | * H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T) |
220 | * |
221 | * from the procedure in section 6.4 of the Adiantum paper. The resulting value |
222 | * is reused in both the first and second hash steps. Specifically, it's added |
223 | * to the result of an independently keyed ε-∆U hash function (for equal length |
224 | * inputs only) taken over the left-hand part (the "bulk") of the message, to |
225 | * give the overall Adiantum hash of the (tweak, left-hand part) pair. |
226 | */ |
227 | static void adiantum_hash_header(struct skcipher_request *req) |
228 | { |
229 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
230 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
231 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); |
232 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; |
233 | struct { |
234 | __le64 message_bits; |
235 | __le64 padding; |
236 | } header = { |
237 | .message_bits = cpu_to_le64((u64)bulk_len * 8) |
238 | }; |
239 | struct poly1305_state state; |
240 | |
241 | poly1305_core_init(&state); |
242 | |
243 | BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0); |
244 | poly1305_core_blocks(&state, &tctx->header_hash_key, |
245 | &header, sizeof(header) / POLY1305_BLOCK_SIZE); |
246 | |
247 | BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0); |
248 | poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv, |
249 | TWEAK_SIZE / POLY1305_BLOCK_SIZE); |
250 | |
251 | poly1305_core_emit(&state, &rctx->header_hash); |
252 | } |
253 | |
254 | /* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */ |
255 | static int adiantum_hash_message(struct skcipher_request *req, |
256 | struct scatterlist *sgl, le128 *digest) |
257 | { |
258 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
259 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
260 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); |
261 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; |
262 | struct shash_desc *hash_desc = &rctx->u.hash_desc; |
263 | struct sg_mapping_iter miter; |
264 | unsigned int i, n; |
265 | int err; |
266 | |
267 | hash_desc->tfm = tctx->hash; |
268 | hash_desc->flags = 0; |
269 | |
270 | err = crypto_shash_init(hash_desc); |
271 | if (err) |
272 | return err; |
273 | |
274 | sg_miter_start(&miter, sgl, sg_nents(sgl), |
275 | SG_MITER_FROM_SG | SG_MITER_ATOMIC); |
276 | for (i = 0; i < bulk_len; i += n) { |
277 | sg_miter_next(&miter); |
278 | n = min_t(unsigned int, miter.length, bulk_len - i); |
279 | err = crypto_shash_update(hash_desc, miter.addr, n); |
280 | if (err) |
281 | break; |
282 | } |
283 | sg_miter_stop(&miter); |
284 | if (err) |
285 | return err; |
286 | |
287 | return crypto_shash_final(hash_desc, (u8 *)digest); |
288 | } |
289 | |
290 | /* Continue Adiantum encryption/decryption after the stream cipher step */ |
291 | static int adiantum_finish(struct skcipher_request *req) |
292 | { |
293 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
294 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
295 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); |
296 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; |
297 | le128 digest; |
298 | int err; |
299 | |
300 | /* If decrypting, decrypt C_M with the block cipher to get P_M */ |
301 | if (!rctx->enc) |
302 | crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes, |
303 | rctx->rbuf.bytes); |
304 | |
305 | /* |
306 | * Second hash step |
307 | * enc: C_R = C_M - H_{K_H}(T, C_L) |
308 | * dec: P_R = P_M - H_{K_H}(T, P_L) |
309 | */ |
310 | err = adiantum_hash_message(req, req->dst, &digest); |
311 | if (err) |
312 | return err; |
313 | le128_add(&digest, &digest, &rctx->header_hash); |
314 | le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); |
315 | scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst, |
316 | bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1); |
317 | return 0; |
318 | } |
319 | |
320 | static void adiantum_streamcipher_done(struct crypto_async_request *areq, |
321 | int err) |
322 | { |
323 | struct skcipher_request *req = areq->data; |
324 | |
325 | if (!err) |
326 | err = adiantum_finish(req); |
327 | |
328 | skcipher_request_complete(req, err); |
329 | } |
330 | |
331 | static int adiantum_crypt(struct skcipher_request *req, bool enc) |
332 | { |
333 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
334 | const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
335 | struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); |
336 | const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; |
337 | unsigned int stream_len; |
338 | le128 digest; |
339 | int err; |
340 | |
341 | if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE) |
342 | return -EINVAL; |
343 | |
344 | rctx->enc = enc; |
345 | |
346 | /* |
347 | * First hash step |
348 | * enc: P_M = P_R + H_{K_H}(T, P_L) |
349 | * dec: C_M = C_R + H_{K_H}(T, C_L) |
350 | */ |
351 | adiantum_hash_header(req); |
352 | err = adiantum_hash_message(req, req->src, &digest); |
353 | if (err) |
354 | return err; |
355 | le128_add(&digest, &digest, &rctx->header_hash); |
356 | scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src, |
357 | bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0); |
358 | le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); |
359 | |
360 | /* If encrypting, encrypt P_M with the block cipher to get C_M */ |
361 | if (enc) |
362 | crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes, |
363 | rctx->rbuf.bytes); |
364 | |
365 | /* Initialize the rest of the XChaCha IV (first part is C_M) */ |
366 | BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16); |
367 | BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); /* nonce || stream position */ |
368 | rctx->rbuf.words[4] = cpu_to_le32(1); |
369 | rctx->rbuf.words[5] = 0; |
370 | rctx->rbuf.words[6] = 0; |
371 | rctx->rbuf.words[7] = 0; |
372 | |
373 | /* |
374 | * XChaCha needs to be done on all the data except the last 16 bytes; |
375 | * for disk encryption that usually means 4080 or 496 bytes. But ChaCha |
376 | * implementations tend to be most efficient when passed a whole number |
377 | * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes. |
378 | * And here it doesn't matter whether the last 16 bytes are written to, |
379 | * as the second hash step will overwrite them. Thus, round the XChaCha |
380 | * length up to the next 64-byte boundary if possible. |
381 | */ |
382 | stream_len = bulk_len; |
383 | if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen) |
384 | stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE); |
385 | |
386 | skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher); |
387 | skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src, |
388 | req->dst, stream_len, &rctx->rbuf); |
389 | skcipher_request_set_callback(&rctx->u.streamcipher_req, |
390 | req->base.flags, |
391 | adiantum_streamcipher_done, req); |
392 | return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?: |
393 | adiantum_finish(req); |
394 | } |
395 | |
396 | static int adiantum_encrypt(struct skcipher_request *req) |
397 | { |
398 | return adiantum_crypt(req, true); |
399 | } |
400 | |
401 | static int adiantum_decrypt(struct skcipher_request *req) |
402 | { |
403 | return adiantum_crypt(req, false); |
404 | } |
405 | |
406 | static int adiantum_init_tfm(struct crypto_skcipher *tfm) |
407 | { |
408 | struct skcipher_instance *inst = skcipher_alg_instance(tfm); |
409 | struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); |
410 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
411 | struct crypto_skcipher *streamcipher; |
412 | struct crypto_cipher *blockcipher; |
413 | struct crypto_shash *hash; |
414 | unsigned int subreq_size; |
415 | int err; |
416 | |
417 | streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn); |
418 | if (IS_ERR(streamcipher)) |
419 | return PTR_ERR(streamcipher); |
420 | |
421 | blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn); |
422 | if (IS_ERR(blockcipher)) { |
423 | err = PTR_ERR(blockcipher); |
424 | goto err_free_streamcipher; |
425 | } |
426 | |
427 | hash = crypto_spawn_shash(&ictx->hash_spawn); |
428 | if (IS_ERR(hash)) { |
429 | err = PTR_ERR(hash); |
430 | goto err_free_blockcipher; |
431 | } |
432 | |
433 | tctx->streamcipher = streamcipher; |
434 | tctx->blockcipher = blockcipher; |
435 | tctx->hash = hash; |
436 | |
437 | BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) != |
438 | sizeof(struct adiantum_request_ctx)); |
439 | subreq_size = max(FIELD_SIZEOF(struct adiantum_request_ctx, |
440 | u.hash_desc) + |
441 | crypto_shash_descsize(hash), |
442 | FIELD_SIZEOF(struct adiantum_request_ctx, |
443 | u.streamcipher_req) + |
444 | crypto_skcipher_reqsize(streamcipher)); |
445 | |
446 | crypto_skcipher_set_reqsize(tfm, |
447 | offsetof(struct adiantum_request_ctx, u) + |
448 | subreq_size); |
449 | return 0; |
450 | |
451 | err_free_blockcipher: |
452 | crypto_free_cipher(blockcipher); |
453 | err_free_streamcipher: |
454 | crypto_free_skcipher(streamcipher); |
455 | return err; |
456 | } |
457 | |
458 | static void adiantum_exit_tfm(struct crypto_skcipher *tfm) |
459 | { |
460 | struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); |
461 | |
462 | crypto_free_skcipher(tctx->streamcipher); |
463 | crypto_free_cipher(tctx->blockcipher); |
464 | crypto_free_shash(tctx->hash); |
465 | } |
466 | |
467 | static void adiantum_free_instance(struct skcipher_instance *inst) |
468 | { |
469 | struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); |
470 | |
471 | crypto_drop_skcipher(&ictx->streamcipher_spawn); |
472 | crypto_drop_spawn(&ictx->blockcipher_spawn); |
473 | crypto_drop_shash(&ictx->hash_spawn); |
474 | kfree(inst); |
475 | } |
476 | |
477 | /* |
478 | * Check for a supported set of inner algorithms. |
479 | * See the comment at the beginning of this file. |
480 | */ |
481 | static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg, |
482 | struct crypto_alg *blockcipher_alg, |
483 | struct shash_alg *hash_alg) |
484 | { |
485 | if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 && |
486 | strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0) |
487 | return false; |
488 | |
489 | if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE || |
490 | blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE) |
491 | return false; |
492 | if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE) |
493 | return false; |
494 | |
495 | if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0) |
496 | return false; |
497 | |
498 | return true; |
499 | } |
500 | |
501 | static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb) |
502 | { |
503 | struct crypto_attr_type *algt; |
504 | const char *streamcipher_name; |
505 | const char *blockcipher_name; |
506 | const char *nhpoly1305_name; |
507 | struct skcipher_instance *inst; |
508 | struct adiantum_instance_ctx *ictx; |
509 | struct skcipher_alg *streamcipher_alg; |
510 | struct crypto_alg *blockcipher_alg; |
511 | struct crypto_alg *_hash_alg; |
512 | struct shash_alg *hash_alg; |
513 | int err; |
514 | |
515 | algt = crypto_get_attr_type(tb); |
516 | if (IS_ERR(algt)) |
517 | return PTR_ERR(algt); |
518 | |
519 | if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask) |
520 | return -EINVAL; |
521 | |
522 | streamcipher_name = crypto_attr_alg_name(tb[1]); |
523 | if (IS_ERR(streamcipher_name)) |
524 | return PTR_ERR(streamcipher_name); |
525 | |
526 | blockcipher_name = crypto_attr_alg_name(tb[2]); |
527 | if (IS_ERR(blockcipher_name)) |
528 | return PTR_ERR(blockcipher_name); |
529 | |
530 | nhpoly1305_name = crypto_attr_alg_name(tb[3]); |
531 | if (nhpoly1305_name == ERR_PTR(-ENOENT)) |
532 | nhpoly1305_name = "nhpoly1305"; |
533 | if (IS_ERR(nhpoly1305_name)) |
534 | return PTR_ERR(nhpoly1305_name); |
535 | |
536 | inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL); |
537 | if (!inst) |
538 | return -ENOMEM; |
539 | ictx = skcipher_instance_ctx(inst); |
540 | |
541 | /* Stream cipher, e.g. "xchacha12" */ |
542 | crypto_set_skcipher_spawn(&ictx->streamcipher_spawn, |
543 | skcipher_crypto_instance(inst)); |
544 | err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name, |
545 | 0, crypto_requires_sync(algt->type, |
546 | algt->mask)); |
547 | if (err) |
548 | goto out_free_inst; |
549 | streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn); |
550 | |
551 | /* Block cipher, e.g. "aes" */ |
552 | crypto_set_spawn(&ictx->blockcipher_spawn, |
553 | skcipher_crypto_instance(inst)); |
554 | err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name, |
555 | CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK); |
556 | if (err) |
557 | goto out_drop_streamcipher; |
558 | blockcipher_alg = ictx->blockcipher_spawn.alg; |
559 | |
560 | /* NHPoly1305 ε-∆U hash function */ |
561 | _hash_alg = crypto_alg_mod_lookup(nhpoly1305_name, |
562 | CRYPTO_ALG_TYPE_SHASH, |
563 | CRYPTO_ALG_TYPE_MASK); |
564 | if (IS_ERR(_hash_alg)) { |
565 | err = PTR_ERR(_hash_alg); |
566 | goto out_drop_blockcipher; |
567 | } |
568 | hash_alg = __crypto_shash_alg(_hash_alg); |
569 | err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg, |
570 | skcipher_crypto_instance(inst)); |
571 | if (err) |
572 | goto out_put_hash; |
573 | |
574 | /* Check the set of algorithms */ |
575 | if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg, |
576 | hash_alg)) { |
577 | pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n", |
578 | streamcipher_alg->base.cra_name, |
579 | blockcipher_alg->cra_name, hash_alg->base.cra_name); |
580 | err = -EINVAL; |
581 | goto out_drop_hash; |
582 | } |
583 | |
584 | /* Instance fields */ |
585 | |
586 | err = -ENAMETOOLONG; |
587 | if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, |
588 | "adiantum(%s,%s)", streamcipher_alg->base.cra_name, |
589 | blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME) |
590 | goto out_drop_hash; |
591 | if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, |
592 | "adiantum(%s,%s,%s)", |
593 | streamcipher_alg->base.cra_driver_name, |
594 | blockcipher_alg->cra_driver_name, |
595 | hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) |
596 | goto out_drop_hash; |
597 | |
598 | inst->alg.base.cra_flags = streamcipher_alg->base.cra_flags & |
599 | CRYPTO_ALG_ASYNC; |
600 | inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE; |
601 | inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx); |
602 | inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask | |
603 | hash_alg->base.cra_alignmask; |
604 | /* |
605 | * The block cipher is only invoked once per message, so for long |
606 | * messages (e.g. sectors for disk encryption) its performance doesn't |
607 | * matter as much as that of the stream cipher and hash function. Thus, |
608 | * weigh the block cipher's ->cra_priority less. |
609 | */ |
610 | inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority + |
611 | 2 * hash_alg->base.cra_priority + |
612 | blockcipher_alg->cra_priority) / 7; |
613 | |
614 | inst->alg.setkey = adiantum_setkey; |
615 | inst->alg.encrypt = adiantum_encrypt; |
616 | inst->alg.decrypt = adiantum_decrypt; |
617 | inst->alg.init = adiantum_init_tfm; |
618 | inst->alg.exit = adiantum_exit_tfm; |
619 | inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg); |
620 | inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg); |
621 | inst->alg.ivsize = TWEAK_SIZE; |
622 | |
623 | inst->free = adiantum_free_instance; |
624 | |
625 | err = skcipher_register_instance(tmpl, inst); |
626 | if (err) |
627 | goto out_drop_hash; |
628 | |
629 | crypto_mod_put(_hash_alg); |
630 | return 0; |
631 | |
632 | out_drop_hash: |
633 | crypto_drop_shash(&ictx->hash_spawn); |
634 | out_put_hash: |
635 | crypto_mod_put(_hash_alg); |
636 | out_drop_blockcipher: |
637 | crypto_drop_spawn(&ictx->blockcipher_spawn); |
638 | out_drop_streamcipher: |
639 | crypto_drop_skcipher(&ictx->streamcipher_spawn); |
640 | out_free_inst: |
641 | kfree(inst); |
642 | return err; |
643 | } |
644 | |
645 | /* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */ |
646 | static struct crypto_template adiantum_tmpl = { |
647 | .name = "adiantum", |
648 | .create = adiantum_create, |
649 | .module = THIS_MODULE, |
650 | }; |
651 | |
652 | static int __init adiantum_module_init(void) |
653 | { |
654 | return crypto_register_template(&adiantum_tmpl); |
655 | } |
656 | |
657 | static void __exit adiantum_module_exit(void) |
658 | { |
659 | crypto_unregister_template(&adiantum_tmpl); |
660 | } |
661 | |
662 | module_init(adiantum_module_init); |
663 | module_exit(adiantum_module_exit); |
664 | |
665 | MODULE_DESCRIPTION("Adiantum length-preserving encryption mode"); |
666 | MODULE_LICENSE("GPL v2"); |
667 | MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>"); |
668 | MODULE_ALIAS_CRYPTO("adiantum"); |
669 |