mirror of https://github.com/Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
318 lines
9.5 KiB
318 lines
9.5 KiB
/* |
|
* Key Wrapping: RFC3394 / NIST SP800-38F |
|
* |
|
* Copyright (C) 2015, Stephan Mueller <[email protected]> |
|
* |
|
* Redistribution and use in source and binary forms, with or without |
|
* modification, are permitted provided that the following conditions |
|
* are met: |
|
* 1. Redistributions of source code must retain the above copyright |
|
* notice, and the entire permission notice in its entirety, |
|
* including the disclaimer of warranties. |
|
* 2. Redistributions in binary form must reproduce the above copyright |
|
* notice, this list of conditions and the following disclaimer in the |
|
* documentation and/or other materials provided with the distribution. |
|
* 3. The name of the author may not be used to endorse or promote |
|
* products derived from this software without specific prior |
|
* written permission. |
|
* |
|
* ALTERNATIVELY, this product may be distributed under the terms of |
|
* the GNU General Public License, in which case the provisions of the GPL2 |
|
* are required INSTEAD OF the above restrictions. (This clause is |
|
* necessary due to a potential bad interaction between the GPL and |
|
* the restrictions contained in a BSD-style copyright.) |
|
* |
|
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED |
|
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF |
|
* WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE |
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT |
|
* OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
|
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
|
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE |
|
* USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH |
|
* DAMAGE. |
|
*/ |
|
|
|
/* |
|
* Note for using key wrapping: |
|
* |
|
* * The result of the encryption operation is the ciphertext starting |
|
* with the 2nd semiblock. The first semiblock is provided as the IV. |
|
* The IV used to start the encryption operation is the default IV. |
|
* |
|
* * The input for the decryption is the first semiblock handed in as an |
|
* IV. The ciphertext is the data starting with the 2nd semiblock. The |
|
* return code of the decryption operation will be EBADMSG in case an |
|
* integrity error occurs. |
|
* |
|
* To obtain the full result of an encryption as expected by SP800-38F, the |
|
* caller must allocate a buffer of plaintext + 8 bytes: |
|
* |
|
* unsigned int datalen = ptlen + crypto_skcipher_ivsize(tfm); |
|
* u8 data[datalen]; |
|
* u8 *iv = data; |
|
* u8 *pt = data + crypto_skcipher_ivsize(tfm); |
|
* <ensure that pt contains the plaintext of size ptlen> |
|
* sg_init_one(&sg, pt, ptlen); |
|
* skcipher_request_set_crypt(req, &sg, &sg, ptlen, iv); |
|
* |
|
* ==> After encryption, data now contains full KW result as per SP800-38F. |
|
* |
|
* In case of decryption, ciphertext now already has the expected length |
|
* and must be segmented appropriately: |
|
* |
|
* unsigned int datalen = CTLEN; |
|
* u8 data[datalen]; |
|
* <ensure that data contains full ciphertext> |
|
* u8 *iv = data; |
|
* u8 *ct = data + crypto_skcipher_ivsize(tfm); |
|
* unsigned int ctlen = datalen - crypto_skcipher_ivsize(tfm); |
|
* sg_init_one(&sg, ct, ctlen); |
|
* skcipher_request_set_crypt(req, &sg, &sg, ctlen, iv); |
|
* |
|
* ==> After decryption (which hopefully does not return EBADMSG), the ct |
|
* pointer now points to the plaintext of size ctlen. |
|
* |
|
* Note 2: KWP is not implemented as this would defy in-place operation. |
|
* If somebody wants to wrap non-aligned data, he should simply pad |
|
* the input with zeros to fill it up to the 8 byte boundary. |
|
*/ |
|
|
|
#include <linux/module.h> |
|
#include <linux/crypto.h> |
|
#include <linux/scatterlist.h> |
|
#include <crypto/scatterwalk.h> |
|
#include <crypto/internal/skcipher.h> |
|
|
|
struct crypto_kw_block { |
|
#define SEMIBSIZE 8 |
|
__be64 A; |
|
__be64 R; |
|
}; |
|
|
|
/* |
|
* Fast forward the SGL to the "end" length minus SEMIBSIZE. |
|
* The start in the SGL defined by the fast-forward is returned with |
|
* the walk variable |
|
*/ |
|
static void crypto_kw_scatterlist_ff(struct scatter_walk *walk, |
|
struct scatterlist *sg, |
|
unsigned int end) |
|
{ |
|
unsigned int skip = 0; |
|
|
|
/* The caller should only operate on full SEMIBLOCKs. */ |
|
BUG_ON(end < SEMIBSIZE); |
|
|
|
skip = end - SEMIBSIZE; |
|
while (sg) { |
|
if (sg->length > skip) { |
|
scatterwalk_start(walk, sg); |
|
scatterwalk_advance(walk, skip); |
|
break; |
|
} else |
|
skip -= sg->length; |
|
|
|
sg = sg_next(sg); |
|
} |
|
} |
|
|
|
static int crypto_kw_decrypt(struct skcipher_request *req) |
|
{ |
|
struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
|
struct crypto_cipher *cipher = skcipher_cipher_simple(tfm); |
|
struct crypto_kw_block block; |
|
struct scatterlist *src, *dst; |
|
u64 t = 6 * ((req->cryptlen) >> 3); |
|
unsigned int i; |
|
int ret = 0; |
|
|
|
/* |
|
* Require at least 2 semiblocks (note, the 3rd semiblock that is |
|
* required by SP800-38F is the IV. |
|
*/ |
|
if (req->cryptlen < (2 * SEMIBSIZE) || req->cryptlen % SEMIBSIZE) |
|
return -EINVAL; |
|
|
|
/* Place the IV into block A */ |
|
memcpy(&block.A, req->iv, SEMIBSIZE); |
|
|
|
/* |
|
* src scatterlist is read-only. dst scatterlist is r/w. During the |
|
* first loop, src points to req->src and dst to req->dst. For any |
|
* subsequent round, the code operates on req->dst only. |
|
*/ |
|
src = req->src; |
|
dst = req->dst; |
|
|
|
for (i = 0; i < 6; i++) { |
|
struct scatter_walk src_walk, dst_walk; |
|
unsigned int nbytes = req->cryptlen; |
|
|
|
while (nbytes) { |
|
/* move pointer by nbytes in the SGL */ |
|
crypto_kw_scatterlist_ff(&src_walk, src, nbytes); |
|
/* get the source block */ |
|
scatterwalk_copychunks(&block.R, &src_walk, SEMIBSIZE, |
|
false); |
|
|
|
/* perform KW operation: modify IV with counter */ |
|
block.A ^= cpu_to_be64(t); |
|
t--; |
|
/* perform KW operation: decrypt block */ |
|
crypto_cipher_decrypt_one(cipher, (u8 *)&block, |
|
(u8 *)&block); |
|
|
|
/* move pointer by nbytes in the SGL */ |
|
crypto_kw_scatterlist_ff(&dst_walk, dst, nbytes); |
|
/* Copy block->R into place */ |
|
scatterwalk_copychunks(&block.R, &dst_walk, SEMIBSIZE, |
|
true); |
|
|
|
nbytes -= SEMIBSIZE; |
|
} |
|
|
|
/* we now start to operate on the dst SGL only */ |
|
src = req->dst; |
|
dst = req->dst; |
|
} |
|
|
|
/* Perform authentication check */ |
|
if (block.A != cpu_to_be64(0xa6a6a6a6a6a6a6a6ULL)) |
|
ret = -EBADMSG; |
|
|
|
memzero_explicit(&block, sizeof(struct crypto_kw_block)); |
|
|
|
return ret; |
|
} |
|
|
|
static int crypto_kw_encrypt(struct skcipher_request *req) |
|
{ |
|
struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
|
struct crypto_cipher *cipher = skcipher_cipher_simple(tfm); |
|
struct crypto_kw_block block; |
|
struct scatterlist *src, *dst; |
|
u64 t = 1; |
|
unsigned int i; |
|
|
|
/* |
|
* Require at least 2 semiblocks (note, the 3rd semiblock that is |
|
* required by SP800-38F is the IV that occupies the first semiblock. |
|
* This means that the dst memory must be one semiblock larger than src. |
|
* Also ensure that the given data is aligned to semiblock. |
|
*/ |
|
if (req->cryptlen < (2 * SEMIBSIZE) || req->cryptlen % SEMIBSIZE) |
|
return -EINVAL; |
|
|
|
/* |
|
* Place the predefined IV into block A -- for encrypt, the caller |
|
* does not need to provide an IV, but he needs to fetch the final IV. |
|
*/ |
|
block.A = cpu_to_be64(0xa6a6a6a6a6a6a6a6ULL); |
|
|
|
/* |
|
* src scatterlist is read-only. dst scatterlist is r/w. During the |
|
* first loop, src points to req->src and dst to req->dst. For any |
|
* subsequent round, the code operates on req->dst only. |
|
*/ |
|
src = req->src; |
|
dst = req->dst; |
|
|
|
for (i = 0; i < 6; i++) { |
|
struct scatter_walk src_walk, dst_walk; |
|
unsigned int nbytes = req->cryptlen; |
|
|
|
scatterwalk_start(&src_walk, src); |
|
scatterwalk_start(&dst_walk, dst); |
|
|
|
while (nbytes) { |
|
/* get the source block */ |
|
scatterwalk_copychunks(&block.R, &src_walk, SEMIBSIZE, |
|
false); |
|
|
|
/* perform KW operation: encrypt block */ |
|
crypto_cipher_encrypt_one(cipher, (u8 *)&block, |
|
(u8 *)&block); |
|
/* perform KW operation: modify IV with counter */ |
|
block.A ^= cpu_to_be64(t); |
|
t++; |
|
|
|
/* Copy block->R into place */ |
|
scatterwalk_copychunks(&block.R, &dst_walk, SEMIBSIZE, |
|
true); |
|
|
|
nbytes -= SEMIBSIZE; |
|
} |
|
|
|
/* we now start to operate on the dst SGL only */ |
|
src = req->dst; |
|
dst = req->dst; |
|
} |
|
|
|
/* establish the IV for the caller to pick up */ |
|
memcpy(req->iv, &block.A, SEMIBSIZE); |
|
|
|
memzero_explicit(&block, sizeof(struct crypto_kw_block)); |
|
|
|
return 0; |
|
} |
|
|
|
static int crypto_kw_create(struct crypto_template *tmpl, struct rtattr **tb) |
|
{ |
|
struct skcipher_instance *inst; |
|
struct crypto_alg *alg; |
|
int err; |
|
|
|
inst = skcipher_alloc_instance_simple(tmpl, tb); |
|
if (IS_ERR(inst)) |
|
return PTR_ERR(inst); |
|
|
|
alg = skcipher_ialg_simple(inst); |
|
|
|
err = -EINVAL; |
|
/* Section 5.1 requirement for KW */ |
|
if (alg->cra_blocksize != sizeof(struct crypto_kw_block)) |
|
goto out_free_inst; |
|
|
|
inst->alg.base.cra_blocksize = SEMIBSIZE; |
|
inst->alg.base.cra_alignmask = 0; |
|
inst->alg.ivsize = SEMIBSIZE; |
|
|
|
inst->alg.encrypt = crypto_kw_encrypt; |
|
inst->alg.decrypt = crypto_kw_decrypt; |
|
|
|
err = skcipher_register_instance(tmpl, inst); |
|
if (err) { |
|
out_free_inst: |
|
inst->free(inst); |
|
} |
|
|
|
return err; |
|
} |
|
|
|
static struct crypto_template crypto_kw_tmpl = { |
|
.name = "kw", |
|
.create = crypto_kw_create, |
|
.module = THIS_MODULE, |
|
}; |
|
|
|
static int __init crypto_kw_init(void) |
|
{ |
|
return crypto_register_template(&crypto_kw_tmpl); |
|
} |
|
|
|
static void __exit crypto_kw_exit(void) |
|
{ |
|
crypto_unregister_template(&crypto_kw_tmpl); |
|
} |
|
|
|
subsys_initcall(crypto_kw_init); |
|
module_exit(crypto_kw_exit); |
|
|
|
MODULE_LICENSE("Dual BSD/GPL"); |
|
MODULE_AUTHOR("Stephan Mueller <[email protected]>"); |
|
MODULE_DESCRIPTION("Key Wrapping (RFC3394 / NIST SP800-38F)"); |
|
MODULE_ALIAS_CRYPTO("kw");
|
|
|