/* $NetBSD: cgd_crypto.c,v 1.27 2020/07/25 22:14:35 riastradh Exp $ */

/*-
* Copyright (c) 2002 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Roland C. Dowdeswell.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

/*
*  Crypto Framework For cgd.c
*
*      This framework is temporary and awaits a more complete
*      kernel wide crypto implementation.
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: cgd_crypto.c,v 1.27 2020/07/25 22:14:35 riastradh Exp $");

#include <sys/param.h>
#include <sys/kmem.h>
#include <sys/systm.h>

#include <dev/cgd_crypto.h>

#include <crypto/adiantum/adiantum.h>
#include <crypto/aes/aes.h>
#include <crypto/aes/aes_cbc.h>
#include <crypto/aes/aes_xts.h>
#include <crypto/blowfish/blowfish.h>
#include <crypto/des/des.h>

/*
* The general framework provides only one generic function.
* It takes the name of an algorithm and returns a struct cryptfuncs *
* for it.  It is up to the initialisation routines of the algorithm
* to check key size and block size.
*/

static cfunc_init               cgd_cipher_aes_cbc_init;
static cfunc_destroy            cgd_cipher_aes_cbc_destroy;
static cfunc_cipher             cgd_cipher_aes_cbc;

static cfunc_init               cgd_cipher_aes_xts_init;
static cfunc_destroy            cgd_cipher_aes_xts_destroy;
static cfunc_cipher             cgd_cipher_aes_xts;

static cfunc_init               cgd_cipher_3des_init;
static cfunc_destroy            cgd_cipher_3des_destroy;
static cfunc_cipher             cgd_cipher_3des_cbc;

static cfunc_init               cgd_cipher_bf_init;
static cfunc_destroy            cgd_cipher_bf_destroy;
static cfunc_cipher             cgd_cipher_bf_cbc;

static cfunc_init               cgd_cipher_adiantum_init;
static cfunc_destroy            cgd_cipher_adiantum_destroy;
static cfunc_cipher             cgd_cipher_adiantum_crypt;

static const struct cryptfuncs cf[] = {
       {
               .cf_name        = "aes-xts",
               .cf_init        = cgd_cipher_aes_xts_init,
               .cf_destroy     = cgd_cipher_aes_xts_destroy,
               .cf_cipher      = cgd_cipher_aes_xts,
       },
       {
               .cf_name        = "aes-cbc",
               .cf_init        = cgd_cipher_aes_cbc_init,
               .cf_destroy     = cgd_cipher_aes_cbc_destroy,
               .cf_cipher      = cgd_cipher_aes_cbc,
       },
       {
               .cf_name        = "3des-cbc",
               .cf_init        = cgd_cipher_3des_init,
               .cf_destroy     = cgd_cipher_3des_destroy,
               .cf_cipher      = cgd_cipher_3des_cbc,
       },
       {
               .cf_name        = "blowfish-cbc",
               .cf_init        = cgd_cipher_bf_init,
               .cf_destroy     = cgd_cipher_bf_destroy,
               .cf_cipher      = cgd_cipher_bf_cbc,
       },
       {
               .cf_name        = "adiantum",
               .cf_init        = cgd_cipher_adiantum_init,
               .cf_destroy     = cgd_cipher_adiantum_destroy,
               .cf_cipher      = cgd_cipher_adiantum_crypt,
       },
};
const struct cryptfuncs *
cryptfuncs_find(const char *alg)
{

       for (size_t i = 0; i < __arraycount(cf); i++)
               if (strcmp(cf[i].cf_name, alg) == 0)
                       return &cf[i];

       return NULL;
}

/*
*  AES Framework
*/

struct aes_privdata {
       struct aesenc   ap_enckey;
       struct aesdec   ap_deckey;
       uint32_t        ap_nrounds;
};

static void *
cgd_cipher_aes_cbc_init(size_t keylen, const void *key, size_t *blocksize)
{
       struct  aes_privdata *ap;

       if (!blocksize)
               return NULL;
       if (keylen != 128 && keylen != 192 && keylen != 256)
               return NULL;
       if (*blocksize == (size_t)-1)
               *blocksize = 128;
       if (*blocksize != 128)
               return NULL;
       ap = kmem_zalloc(sizeof(*ap), KM_SLEEP);
       switch (keylen) {
       case 128:
               aes_setenckey128(&ap->ap_enckey, key);
               aes_setdeckey128(&ap->ap_deckey, key);
               ap->ap_nrounds = AES_128_NROUNDS;
               break;
       case 192:
               aes_setenckey192(&ap->ap_enckey, key);
               aes_setdeckey192(&ap->ap_deckey, key);
               ap->ap_nrounds = AES_192_NROUNDS;
               break;
       case 256:
               aes_setenckey256(&ap->ap_enckey, key);
               aes_setdeckey256(&ap->ap_deckey, key);
               ap->ap_nrounds = AES_256_NROUNDS;
               break;
       }
       return ap;
}

static void
cgd_cipher_aes_cbc_destroy(void *data)
{
       struct aes_privdata *apd = data;

       explicit_memset(apd, 0, sizeof(*apd));
       kmem_free(apd, sizeof(*apd));
}

static void
cgd_cipher_aes_cbc(void *privdata, void *dst, const void *src, size_t nbytes,
   const void *blkno, int dir)
{
       struct aes_privdata     *apd = privdata;
       uint8_t iv[CGD_AES_BLOCK_SIZE] __aligned(CGD_AES_BLOCK_SIZE) = {0};

       /* Compute the CBC IV as AES_k(blkno).  */
       aes_enc(&apd->ap_enckey, blkno, iv, apd->ap_nrounds);

       switch (dir) {
       case CGD_CIPHER_ENCRYPT:
               aes_cbc_enc(&apd->ap_enckey, src, dst, nbytes, iv,
                   apd->ap_nrounds);
               break;
       case CGD_CIPHER_DECRYPT:
               aes_cbc_dec(&apd->ap_deckey, src, dst, nbytes, iv,
                   apd->ap_nrounds);
               break;
       default:
               panic("%s: unrecognised direction %d", __func__, dir);
       }
}

/*
* AES-XTS
*/

struct aesxts {
       struct aesenc   ax_enckey;
       struct aesdec   ax_deckey;
       struct aesenc   ax_tweakkey;
       uint32_t        ax_nrounds;
};

static void *
cgd_cipher_aes_xts_init(size_t keylen, const void *xtskey, size_t *blocksize)
{
       struct aesxts *ax;
       const char *key, *key2; /* XTS key is made of two AES keys. */

       if (!blocksize)
               return NULL;
       if (keylen != 256 && keylen != 512)
               return NULL;
       if (*blocksize == (size_t)-1)
               *blocksize = 128;
       if (*blocksize != 128)
               return NULL;

       ax = kmem_zalloc(sizeof(*ax), KM_SLEEP);
       keylen /= 2;
       key = xtskey;
       key2 = key + keylen / CHAR_BIT;

       switch (keylen) {
       case 128:
               aes_setenckey128(&ax->ax_enckey, key);
               aes_setdeckey128(&ax->ax_deckey, key);
               aes_setenckey128(&ax->ax_tweakkey, key2);
               ax->ax_nrounds = AES_128_NROUNDS;
               break;
       case 256:
               aes_setenckey256(&ax->ax_enckey, key);
               aes_setdeckey256(&ax->ax_deckey, key);
               aes_setenckey256(&ax->ax_tweakkey, key2);
               ax->ax_nrounds = AES_256_NROUNDS;
               break;
       }

       return ax;
}

static void
cgd_cipher_aes_xts_destroy(void *cookie)
{
       struct aesxts *ax = cookie;

       explicit_memset(ax, 0, sizeof(*ax));
       kmem_free(ax, sizeof(*ax));
}

static void
cgd_cipher_aes_xts(void *cookie, void *dst, const void *src, size_t nbytes,
   const void *blkno, int dir)
{
       struct aesxts *ax = cookie;
       uint8_t tweak[CGD_AES_BLOCK_SIZE];

       /* Compute the initial tweak as AES_k(blkno).  */
       aes_enc(&ax->ax_tweakkey, blkno, tweak, ax->ax_nrounds);

       switch (dir) {
       case CGD_CIPHER_ENCRYPT:
               aes_xts_enc(&ax->ax_enckey, src, dst, nbytes, tweak,
                   ax->ax_nrounds);
               break;
       case CGD_CIPHER_DECRYPT:
               aes_xts_dec(&ax->ax_deckey, src, dst, nbytes, tweak,
                   ax->ax_nrounds);
               break;
       default:
               panic("%s: unrecognised direction %d", __func__, dir);
       }
}

/*
* 3DES Framework
*/

struct c3des_privdata {
       des_key_schedule        cp_key1;
       des_key_schedule        cp_key2;
       des_key_schedule        cp_key3;
};

static void *
cgd_cipher_3des_init(size_t keylen, const void *key, size_t *blocksize)
{
       struct  c3des_privdata *cp;
       int     error = 0;
       des_cblock *block;

       if (!blocksize)
               return NULL;
       if (*blocksize == (size_t)-1)
               *blocksize = 64;
       if (keylen != (DES_KEY_SZ * 3 * 8) || *blocksize != 64)
               return NULL;
       cp = kmem_zalloc(sizeof(*cp), KM_SLEEP);
       block = __UNCONST(key);
       error  = des_key_sched(block, cp->cp_key1);
       error |= des_key_sched(block + 1, cp->cp_key2);
       error |= des_key_sched(block + 2, cp->cp_key3);
       if (error) {
               explicit_memset(cp, 0, sizeof(*cp));
               kmem_free(cp, sizeof(*cp));
               return NULL;
       }
       return cp;
}

static void
cgd_cipher_3des_destroy(void *data)
{
       struct c3des_privdata *cp = data;

       explicit_memset(cp, 0, sizeof(*cp));
       kmem_free(cp, sizeof(*cp));
}

static void
cgd_cipher_3des_cbc(void *privdata, void *dst, const void *src, size_t nbytes,
   const void *blkno, int dir)
{
       struct  c3des_privdata *cp = privdata;
       des_cblock zero;
       uint8_t iv[CGD_3DES_BLOCK_SIZE];

       /* Compute the CBC IV as 3DES_k(blkno) = 3DES-CBC_k(iv=blkno, 0).  */
       memset(&zero, 0, sizeof(zero));
       des_ede3_cbc_encrypt(blkno, iv, CGD_3DES_BLOCK_SIZE,
           cp->cp_key1, cp->cp_key2, cp->cp_key3, &zero, /*encrypt*/1);

       switch (dir) {
       case CGD_CIPHER_ENCRYPT:
               des_ede3_cbc_encrypt(src, dst, nbytes,
                   cp->cp_key1, cp->cp_key2, cp->cp_key3,
                   (des_cblock *)iv, /*encrypt*/1);
               break;
       case CGD_CIPHER_DECRYPT:
               des_ede3_cbc_encrypt(src, dst, nbytes,
                   cp->cp_key1, cp->cp_key2, cp->cp_key3,
                   (des_cblock *)iv, /*encrypt*/0);
               break;
       default:
               panic("%s: unrecognised direction %d", __func__, dir);
       }
}

/*
* Blowfish Framework
*/

struct bf_privdata {
       BF_KEY  bp_key;
};

struct bf_encdata {
       BF_KEY          *be_key;
       uint8_t          be_iv[CGD_BF_BLOCK_SIZE];
};

static void *
cgd_cipher_bf_init(size_t keylen, const void *key, size_t *blocksize)
{
       struct  bf_privdata *bp;

       if (!blocksize)
               return NULL;
       if (keylen < 40 || keylen > 448 || (keylen % 8 != 0))
               return NULL;
       if (*blocksize == (size_t)-1)
               *blocksize = 64;
       if (*blocksize != 64)
               return NULL;
       bp = kmem_zalloc(sizeof(*bp), KM_SLEEP);
       if (!bp)
               return NULL;
       BF_set_key(&bp->bp_key, keylen / 8, key);
       return bp;
}

static void
cgd_cipher_bf_destroy(void *data)
{
       struct  bf_privdata *bp = data;

       explicit_memset(bp, 0, sizeof(*bp));
       kmem_free(bp, sizeof(*bp));
}

static void
cgd_cipher_bf_cbc(void *privdata, void *dst, const void *src, size_t nbytes,
   const void *blkno, int dir)
{
       struct  bf_privdata *bp = privdata;
       uint8_t zero[CGD_BF_BLOCK_SIZE], iv[CGD_BF_BLOCK_SIZE];

       /* Compute the CBC IV as Blowfish_k(blkno) = BF_CBC_k(blkno, 0).  */
       memset(zero, 0, sizeof(zero));
       BF_cbc_encrypt(blkno, iv, CGD_BF_BLOCK_SIZE, &bp->bp_key, zero,
           /*encrypt*/1);

       switch (dir) {
       case CGD_CIPHER_ENCRYPT:
               BF_cbc_encrypt(src, dst, nbytes, &bp->bp_key, iv,
                   /*encrypt*/1);
               break;
       case CGD_CIPHER_DECRYPT:
               BF_cbc_encrypt(src, dst, nbytes, &bp->bp_key, iv,
                   /*encrypt*/0);
               break;
       default:
               panic("%s: unrecognised direction %d", __func__, dir);
       }
}

/*
* Adiantum
*/

static void *
cgd_cipher_adiantum_init(size_t keylen, const void *key, size_t *blocksize)
{
       struct adiantum *A;

       if (!blocksize)
               return NULL;
       if (keylen != 256)
               return NULL;
       if (*blocksize == (size_t)-1)
               *blocksize = 128;
       if (*blocksize != 128)
               return NULL;

       A = kmem_zalloc(sizeof(*A), KM_SLEEP);
       adiantum_init(A, key);

       return A;
}

static void
cgd_cipher_adiantum_destroy(void *cookie)
{
       struct adiantum *A = cookie;

       explicit_memset(A, 0, sizeof(*A));
       kmem_free(A, sizeof(*A));
}

static void
cgd_cipher_adiantum_crypt(void *cookie, void *dst, const void *src,
   size_t nbytes, const void *blkno, int dir)
{
       /*
        * Treat the block number as a 128-bit block.  This is more
        * than twice as big as the largest number of reasonable
        * blocks, but it doesn't hurt (it would be rounded up to a
        * 128-bit input anyway).
        */
       const unsigned tweaklen = 16;
       struct adiantum *A = cookie;

       switch (dir) {
       case CGD_CIPHER_ENCRYPT:
               adiantum_enc(dst, src, nbytes, blkno, tweaklen, A);
               break;
       case CGD_CIPHER_DECRYPT:
               adiantum_dec(dst, src, nbytes, blkno, tweaklen, A);
               break;
       default:
               panic("%s: unrecognised direction %d", __func__, dir);
       }
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.