opencrypto - Add AES GCM/GMAC support
[dragonfly.git] / sys / opencrypto / xform.c
CommitLineData
42ee1e6b 1/* $FreeBSD: src/sys/opencrypto/xform.c,v 1.10 2008/10/23 15:53:51 des Exp $ */
984263bc 2/* $OpenBSD: xform.c,v 1.16 2001/08/28 12:20:43 ben Exp $ */
42ee1e6b 3/*-
984263bc
MD
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9 * in November 1995.
10 *
11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12 * by Angelos D. Keromytis.
13 *
14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15 * and Niels Provos.
16 *
17 * Additional features in 1999 by Angelos D. Keromytis.
18 *
19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20 * Angelos D. Keromytis and Niels Provos.
21 *
22 * Copyright (C) 2001, Angelos D. Keromytis.
23 *
24 * Permission to use, copy, and modify this software with or without fee
25 * is hereby granted, provided that this entire notice is included in
26 * all copies of any software which is or includes a copy or
27 * modification of this software.
28 * You may use this code under the GNU public license if you so wish. Please
29 * contribute changes back to the authors under this freer than GPL license
30 * so that we may further the use of strong encryption without limitations to
31 * all.
32 *
33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
37 * PURPOSE.
38 */
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/malloc.h>
43#include <sys/sysctl.h>
44#include <sys/errno.h>
45#include <sys/time.h>
46#include <sys/kernel.h>
47#include <machine/cpu.h>
48
49#include <crypto/blowfish/blowfish.h>
50#include <crypto/des/des.h>
42ee1e6b
SW
51#include <crypto/rijndael/rijndael.h>
52#include <crypto/camellia/camellia.h>
984263bc
MD
53#include <crypto/sha1.h>
54
55#include <opencrypto/cast.h>
56#include <opencrypto/deflate.h>
984263bc
MD
57#include <opencrypto/rmd160.h>
58#include <opencrypto/skipjack.h>
aface142 59#include <opencrypto/gmac.h>
984263bc
MD
60
61#include <sys/md5.h>
62
63#include <opencrypto/cryptodev.h>
64#include <opencrypto/xform.h>
65
400158c1
AH
66static void null_encrypt(caddr_t, u_int8_t *, u_int8_t *);
67static void null_decrypt(caddr_t, u_int8_t *, u_int8_t *);
984263bc
MD
68static int null_setkey(u_int8_t **, u_int8_t *, int);
69static void null_zerokey(u_int8_t **);
70
71static int des1_setkey(u_int8_t **, u_int8_t *, int);
72static int des3_setkey(u_int8_t **, u_int8_t *, int);
73static int blf_setkey(u_int8_t **, u_int8_t *, int);
74static int cast5_setkey(u_int8_t **, u_int8_t *, int);
75static int skipjack_setkey(u_int8_t **, u_int8_t *, int);
76static int rijndael128_setkey(u_int8_t **, u_int8_t *, int);
da41e4e5
AH
77static int aes_xts_setkey(u_int8_t **, u_int8_t *, int);
78static int aes_ctr_setkey(u_int8_t **, u_int8_t *, int);
42ee1e6b 79static int cml_setkey(u_int8_t **, u_int8_t *, int);
400158c1
AH
80static void des1_encrypt(caddr_t, u_int8_t *, u_int8_t *);
81static void des3_encrypt(caddr_t, u_int8_t *, u_int8_t *);
82static void blf_encrypt(caddr_t, u_int8_t *, u_int8_t *);
83static void cast5_encrypt(caddr_t, u_int8_t *, u_int8_t *);
84static void skipjack_encrypt(caddr_t, u_int8_t *, u_int8_t *);
85static void rijndael128_encrypt(caddr_t, u_int8_t *, u_int8_t *);
86static void aes_xts_encrypt(caddr_t, u_int8_t *, u_int8_t *);
87static void cml_encrypt(caddr_t, u_int8_t *, u_int8_t *);
88static void des1_decrypt(caddr_t, u_int8_t *, u_int8_t *);
89static void des3_decrypt(caddr_t, u_int8_t *, u_int8_t *);
90static void blf_decrypt(caddr_t, u_int8_t *, u_int8_t *);
91static void cast5_decrypt(caddr_t, u_int8_t *, u_int8_t *);
92static void skipjack_decrypt(caddr_t, u_int8_t *, u_int8_t *);
93static void rijndael128_decrypt(caddr_t, u_int8_t *, u_int8_t *);
94static void aes_xts_decrypt(caddr_t, u_int8_t *, u_int8_t *);
95static void cml_decrypt(caddr_t, u_int8_t *, u_int8_t *);
984263bc
MD
96static void des1_zerokey(u_int8_t **);
97static void des3_zerokey(u_int8_t **);
98static void blf_zerokey(u_int8_t **);
99static void cast5_zerokey(u_int8_t **);
100static void skipjack_zerokey(u_int8_t **);
101static void rijndael128_zerokey(u_int8_t **);
da41e4e5
AH
102static void aes_xts_zerokey(u_int8_t **);
103static void aes_ctr_zerokey(u_int8_t **);
42ee1e6b 104static void cml_zerokey(u_int8_t **);
984263bc 105
400158c1 106static void aes_ctr_crypt(caddr_t, u_int8_t *, u_int8_t *);
da41e4e5
AH
107
108static void aes_ctr_reinit(caddr_t, u_int8_t *);
109static void aes_xts_reinit(caddr_t, u_int8_t *);
aface142 110static void aes_gcm_reinit(caddr_t, u_int8_t *);
da41e4e5 111
984263bc
MD
112static void null_init(void *);
113static int null_update(void *, u_int8_t *, u_int16_t);
114static void null_final(u_int8_t *, void *);
115static int MD5Update_int(void *, u_int8_t *, u_int16_t);
116static void SHA1Init_int(void *);
117static int SHA1Update_int(void *, u_int8_t *, u_int16_t);
118static void SHA1Final_int(u_int8_t *, void *);
119static int RMD160Update_int(void *, u_int8_t *, u_int16_t);
120static int SHA256Update_int(void *, u_int8_t *, u_int16_t);
121static int SHA384Update_int(void *, u_int8_t *, u_int16_t);
122static int SHA512Update_int(void *, u_int8_t *, u_int16_t);
123
124static u_int32_t deflate_compress(u_int8_t *, u_int32_t, u_int8_t **);
125static u_int32_t deflate_decompress(u_int8_t *, u_int32_t, u_int8_t **);
126
da41e4e5
AH
127/* Helper */
128struct aes_xts_ctx;
400158c1 129static void aes_xts_crypt(struct aes_xts_ctx *, u_int8_t *, u_int8_t *, u_int);
da41e4e5 130
984263bc
MD
131MALLOC_DEFINE(M_XDATA, "xform", "xform data buffers");
132
133/* Encryption instances */
134struct enc_xform enc_xform_null = {
135 CRYPTO_NULL_CBC, "NULL",
136 /* NB: blocksize of 4 is to generate a properly aligned ESP header */
da41e4e5 137 NULL_BLOCK_LEN, NULL_BLOCK_LEN, 0, 256, /* 2048 bits, max key */
984263bc
MD
138 null_encrypt,
139 null_decrypt,
140 null_setkey,
141 null_zerokey,
da41e4e5 142 NULL
984263bc
MD
143};
144
145struct enc_xform enc_xform_des = {
146 CRYPTO_DES_CBC, "DES",
da41e4e5 147 DES_BLOCK_LEN, DES_BLOCK_LEN, 8, 8,
984263bc
MD
148 des1_encrypt,
149 des1_decrypt,
150 des1_setkey,
151 des1_zerokey,
da41e4e5 152 NULL
984263bc
MD
153};
154
155struct enc_xform enc_xform_3des = {
156 CRYPTO_3DES_CBC, "3DES",
da41e4e5 157 DES3_BLOCK_LEN, DES3_BLOCK_LEN, 24, 24,
984263bc
MD
158 des3_encrypt,
159 des3_decrypt,
160 des3_setkey,
da41e4e5
AH
161 des3_zerokey,
162 NULL
984263bc
MD
163};
164
165struct enc_xform enc_xform_blf = {
166 CRYPTO_BLF_CBC, "Blowfish",
da41e4e5 167 BLOWFISH_BLOCK_LEN, BLOWFISH_BLOCK_LEN, 5, 56 /* 448 bits, max key */,
984263bc
MD
168 blf_encrypt,
169 blf_decrypt,
170 blf_setkey,
da41e4e5
AH
171 blf_zerokey,
172 NULL
984263bc
MD
173};
174
175struct enc_xform enc_xform_cast5 = {
176 CRYPTO_CAST_CBC, "CAST-128",
da41e4e5 177 CAST128_BLOCK_LEN, CAST128_BLOCK_LEN, 5, 16,
984263bc
MD
178 cast5_encrypt,
179 cast5_decrypt,
180 cast5_setkey,
da41e4e5
AH
181 cast5_zerokey,
182 NULL
984263bc
MD
183};
184
185struct enc_xform enc_xform_skipjack = {
186 CRYPTO_SKIPJACK_CBC, "Skipjack",
da41e4e5 187 SKIPJACK_BLOCK_LEN, SKIPJACK_BLOCK_LEN, 10, 10,
984263bc
MD
188 skipjack_encrypt,
189 skipjack_decrypt,
190 skipjack_setkey,
da41e4e5
AH
191 skipjack_zerokey,
192 NULL
984263bc
MD
193};
194
195struct enc_xform enc_xform_rijndael128 = {
196 CRYPTO_RIJNDAEL128_CBC, "Rijndael-128/AES",
da41e4e5 197 RIJNDAEL128_BLOCK_LEN, RIJNDAEL128_BLOCK_LEN, 8, 32,
984263bc
MD
198 rijndael128_encrypt,
199 rijndael128_decrypt,
200 rijndael128_setkey,
201 rijndael128_zerokey,
da41e4e5
AH
202 NULL
203};
204
205struct enc_xform enc_xform_aes_xts = {
206 CRYPTO_AES_XTS, "AES-XTS",
207 AES_XTS_BLOCK_LEN, AES_XTS_IV_LEN, 32, 64,
208 aes_xts_encrypt,
209 aes_xts_decrypt,
210 aes_xts_setkey,
211 aes_xts_zerokey,
212 aes_xts_reinit
213};
214
215struct enc_xform enc_xform_aes_ctr = {
216 CRYPTO_AES_CTR, "AES-CTR",
217 AESCTR_BLOCK_LEN, AESCTR_IV_LEN, 16+4, 32+4,
218 aes_ctr_crypt,
219 aes_ctr_crypt,
220 aes_ctr_setkey,
221 aes_ctr_zerokey,
222 aes_ctr_reinit
984263bc
MD
223};
224
aface142
AH
225struct enc_xform enc_xform_aes_gcm = {
226 CRYPTO_AES_GCM_16, "AES-GCM",
227 AESGCM_BLOCK_LEN, AESGCM_IV_LEN, 16+4, 32+4,
228 aes_ctr_crypt,
229 aes_ctr_crypt,
230 aes_ctr_setkey,
231 aes_ctr_zerokey,
232 aes_gcm_reinit
233};
234
235struct enc_xform enc_xform_aes_gmac = {
236 CRYPTO_AES_GMAC, "AES-GMAC",
237 AESGMAC_BLOCK_LEN, AESGMAC_IV_LEN, 16+4, 32+4,
238 NULL,
239 NULL,
240 NULL,
241 NULL,
242 NULL
243};
244
984263bc
MD
245struct enc_xform enc_xform_arc4 = {
246 CRYPTO_ARC4, "ARC4",
da41e4e5 247 1, 1, 1, 32,
984263bc
MD
248 NULL,
249 NULL,
250 NULL,
251 NULL,
da41e4e5 252 NULL
984263bc
MD
253};
254
42ee1e6b
SW
255struct enc_xform enc_xform_camellia = {
256 CRYPTO_CAMELLIA_CBC, "Camellia",
da41e4e5 257 CAMELLIA_BLOCK_LEN, CAMELLIA_BLOCK_LEN, 8, 32,
42ee1e6b
SW
258 cml_encrypt,
259 cml_decrypt,
260 cml_setkey,
261 cml_zerokey,
da41e4e5 262 NULL
42ee1e6b
SW
263};
264
984263bc
MD
265/* Authentication instances */
266struct auth_hash auth_hash_null = {
267 CRYPTO_NULL_HMAC, "NULL-HMAC",
42ee1e6b 268 0, NULL_HASH_LEN, NULL_HMAC_BLOCK_LEN, sizeof(int), /* NB: context isn't used */
aface142 269 null_init, NULL, NULL, null_update, null_final
984263bc
MD
270};
271
42ee1e6b 272struct auth_hash auth_hash_hmac_md5 = {
984263bc 273 CRYPTO_MD5_HMAC, "HMAC-MD5",
42ee1e6b 274 16, MD5_HASH_LEN, MD5_HMAC_BLOCK_LEN, sizeof(MD5_CTX),
aface142
AH
275 (void (*) (void *)) MD5Init, NULL, NULL,
276 MD5Update_int,
984263bc
MD
277 (void (*) (u_int8_t *, void *)) MD5Final
278};
279
42ee1e6b 280struct auth_hash auth_hash_hmac_sha1 = {
984263bc 281 CRYPTO_SHA1_HMAC, "HMAC-SHA1",
42ee1e6b 282 20, SHA1_HASH_LEN, SHA1_HMAC_BLOCK_LEN, sizeof(SHA1_CTX),
aface142
AH
283 SHA1Init_int, NULL, NULL,
284 SHA1Update_int, SHA1Final_int
984263bc
MD
285};
286
42ee1e6b 287struct auth_hash auth_hash_hmac_ripemd_160 = {
984263bc 288 CRYPTO_RIPEMD160_HMAC, "HMAC-RIPEMD-160",
42ee1e6b 289 20, RIPEMD160_HASH_LEN, RIPEMD160_HMAC_BLOCK_LEN, sizeof(RMD160_CTX),
aface142
AH
290 (void (*)(void *)) RMD160Init, NULL, NULL,
291 RMD160Update_int,
984263bc
MD
292 (void (*)(u_int8_t *, void *)) RMD160Final
293};
294
295struct auth_hash auth_hash_key_md5 = {
296 CRYPTO_MD5_KPDK, "Keyed MD5",
42ee1e6b 297 0, MD5_KPDK_HASH_LEN, 0, sizeof(MD5_CTX),
aface142
AH
298 (void (*)(void *)) MD5Init, NULL, NULL,
299 MD5Update_int,
984263bc
MD
300 (void (*)(u_int8_t *, void *)) MD5Final
301};
302
303struct auth_hash auth_hash_key_sha1 = {
304 CRYPTO_SHA1_KPDK, "Keyed SHA1",
42ee1e6b 305 0, SHA1_KPDK_HASH_LEN, 0, sizeof(SHA1_CTX),
aface142
AH
306 SHA1Init_int, NULL, NULL,
307 SHA1Update_int, SHA1Final_int
984263bc
MD
308};
309
310struct auth_hash auth_hash_hmac_sha2_256 = {
42ee1e6b
SW
311 CRYPTO_SHA2_256_HMAC, "HMAC-SHA2-256",
312 32, SHA2_256_HASH_LEN, SHA2_256_HMAC_BLOCK_LEN, sizeof(SHA256_CTX),
aface142
AH
313 (void (*)(void *)) SHA256_Init, NULL, NULL,
314 SHA256Update_int,
984263bc
MD
315 (void (*)(u_int8_t *, void *)) SHA256_Final
316};
317
318struct auth_hash auth_hash_hmac_sha2_384 = {
42ee1e6b
SW
319 CRYPTO_SHA2_384_HMAC, "HMAC-SHA2-384",
320 48, SHA2_384_HASH_LEN, SHA2_384_HMAC_BLOCK_LEN, sizeof(SHA384_CTX),
aface142
AH
321 (void (*)(void *)) SHA384_Init, NULL, NULL,
322 SHA384Update_int,
984263bc
MD
323 (void (*)(u_int8_t *, void *)) SHA384_Final
324};
325
326struct auth_hash auth_hash_hmac_sha2_512 = {
42ee1e6b
SW
327 CRYPTO_SHA2_512_HMAC, "HMAC-SHA2-512",
328 64, SHA2_512_HASH_LEN, SHA2_512_HMAC_BLOCK_LEN, sizeof(SHA512_CTX),
aface142
AH
329 (void (*)(void *)) SHA512_Init, NULL, NULL,
330 SHA512Update_int,
984263bc
MD
331 (void (*)(u_int8_t *, void *)) SHA512_Final
332};
333
aface142
AH
334struct auth_hash auth_hash_gmac_aes_128 = {
335 CRYPTO_AES_128_GMAC, "GMAC-AES-128",
336 16+4, 16, 16, sizeof(AES_GMAC_CTX),
337 (void (*)(void *)) AES_GMAC_Init,
338 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
339 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
340 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
341 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
342};
343
344struct auth_hash auth_hash_gmac_aes_192 = {
345 CRYPTO_AES_192_GMAC, "GMAC-AES-192",
346 24+4, 16, 16, sizeof(AES_GMAC_CTX),
347 (void (*)(void *)) AES_GMAC_Init,
348 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
349 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
350 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
351 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
352};
353
354struct auth_hash auth_hash_gmac_aes_256 = {
355 CRYPTO_AES_256_GMAC, "GMAC-AES-256",
356 32+4, 16, 16, sizeof(AES_GMAC_CTX),
357 (void (*)(void *)) AES_GMAC_Init,
358 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
359 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
360 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
361 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
362};
363
984263bc
MD
364/* Compression instance */
365struct comp_algo comp_algo_deflate = {
366 CRYPTO_DEFLATE_COMP, "Deflate",
367 90, deflate_compress,
368 deflate_decompress
369};
370
371/*
372 * Encryption wrapper routines.
373 */
374static void
400158c1 375null_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
376{
377}
378static void
400158c1 379null_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
380{
381}
382static int
383null_setkey(u_int8_t **sched, u_int8_t *key, int len)
384{
385 *sched = NULL;
386 return 0;
387}
388static void
389null_zerokey(u_int8_t **sched)
390{
391 *sched = NULL;
392}
393
394static void
400158c1 395des1_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
396{
397 des_cblock *cb = (des_cblock *) blk;
398 des_key_schedule *p = (des_key_schedule *) key;
399
400 des_ecb_encrypt(cb, cb, p[0], DES_ENCRYPT);
401}
402
403static void
400158c1 404des1_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
405{
406 des_cblock *cb = (des_cblock *) blk;
407 des_key_schedule *p = (des_key_schedule *) key;
408
409 des_ecb_encrypt(cb, cb, p[0], DES_DECRYPT);
410}
411
412static int
413des1_setkey(u_int8_t **sched, u_int8_t *key, int len)
414{
415 des_key_schedule *p;
416 int err;
417
54734da1 418 p = kmalloc(sizeof (des_key_schedule),
a0419b33 419 M_CRYPTO_DATA, M_INTWAIT | M_ZERO);
984263bc
MD
420 if (p != NULL) {
421 des_set_key((des_cblock *) key, p[0]);
422 err = 0;
423 } else
424 err = ENOMEM;
425 *sched = (u_int8_t *) p;
426 return err;
427}
428
429static void
430des1_zerokey(u_int8_t **sched)
431{
432 bzero(*sched, sizeof (des_key_schedule));
42ee1e6b 433 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
434 *sched = NULL;
435}
436
437static void
400158c1 438des3_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
439{
440 des_cblock *cb = (des_cblock *) blk;
441 des_key_schedule *p = (des_key_schedule *) key;
442
443 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_ENCRYPT);
444}
445
446static void
400158c1 447des3_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
448{
449 des_cblock *cb = (des_cblock *) blk;
450 des_key_schedule *p = (des_key_schedule *) key;
451
452 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_DECRYPT);
453}
454
455static int
456des3_setkey(u_int8_t **sched, u_int8_t *key, int len)
457{
458 des_key_schedule *p;
459 int err;
460
a0419b33
MD
461 p = kmalloc(3 * sizeof(des_key_schedule),
462 M_CRYPTO_DATA, M_INTWAIT | M_ZERO);
984263bc
MD
463 if (p != NULL) {
464 des_set_key((des_cblock *)(key + 0), p[0]);
465 des_set_key((des_cblock *)(key + 8), p[1]);
466 des_set_key((des_cblock *)(key + 16), p[2]);
467 err = 0;
468 } else
469 err = ENOMEM;
470 *sched = (u_int8_t *) p;
471 return err;
472}
473
474static void
475des3_zerokey(u_int8_t **sched)
476{
477 bzero(*sched, 3*sizeof (des_key_schedule));
42ee1e6b 478 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
479 *sched = NULL;
480}
481
482static void
400158c1 483blf_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
484{
485 BF_LONG t[2];
486
487 memcpy(t, blk, sizeof (t));
488 t[0] = ntohl(t[0]);
489 t[1] = ntohl(t[1]);
490 /* NB: BF_encrypt expects the block in host order! */
491 BF_encrypt(t, (BF_KEY *) key);
492 t[0] = htonl(t[0]);
493 t[1] = htonl(t[1]);
494 memcpy(blk, t, sizeof (t));
495}
496
497static void
400158c1 498blf_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
499{
500 BF_LONG t[2];
501
502 memcpy(t, blk, sizeof (t));
503 t[0] = ntohl(t[0]);
504 t[1] = ntohl(t[1]);
505 /* NB: BF_decrypt expects the block in host order! */
506 BF_decrypt(t, (BF_KEY *) key);
507 t[0] = htonl(t[0]);
508 t[1] = htonl(t[1]);
509 memcpy(blk, t, sizeof (t));
510}
511
512static int
513blf_setkey(u_int8_t **sched, u_int8_t *key, int len)
514{
515 int err;
516
a0419b33 517 *sched = kmalloc(sizeof(BF_KEY), M_CRYPTO_DATA, M_INTWAIT | M_ZERO);
984263bc
MD
518 if (*sched != NULL) {
519 BF_set_key((BF_KEY *) *sched, len, key);
520 err = 0;
521 } else
522 err = ENOMEM;
523 return err;
524}
525
526static void
527blf_zerokey(u_int8_t **sched)
528{
529 bzero(*sched, sizeof(BF_KEY));
42ee1e6b 530 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
531 *sched = NULL;
532}
533
534static void
400158c1 535cast5_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
536{
537 cast_encrypt((cast_key *) key, blk, blk);
538}
539
540static void
400158c1 541cast5_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
542{
543 cast_decrypt((cast_key *) key, blk, blk);
544}
545
546static int
547cast5_setkey(u_int8_t **sched, u_int8_t *key, int len)
548{
549 int err;
550
a0419b33 551 *sched = kmalloc(sizeof(cast_key), M_CRYPTO_DATA, M_INTWAIT | M_ZERO);
984263bc
MD
552 if (*sched != NULL) {
553 cast_setkey((cast_key *)*sched, key, len);
554 err = 0;
555 } else
556 err = ENOMEM;
557 return err;
558}
559
560static void
561cast5_zerokey(u_int8_t **sched)
562{
563 bzero(*sched, sizeof(cast_key));
42ee1e6b 564 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
565 *sched = NULL;
566}
567
568static void
400158c1 569skipjack_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
570{
571 skipjack_forwards(blk, blk, (u_int8_t **) key);
572}
573
574static void
400158c1 575skipjack_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
576{
577 skipjack_backwards(blk, blk, (u_int8_t **) key);
578}
579
580static int
581skipjack_setkey(u_int8_t **sched, u_int8_t *key, int len)
582{
583 int err;
584
585 /* NB: allocate all the memory that's needed at once */
54734da1 586 *sched = kmalloc(10 * (sizeof(u_int8_t *) + 0x100),
a0419b33 587 M_CRYPTO_DATA, M_INTWAIT | M_ZERO);
984263bc
MD
588 if (*sched != NULL) {
589 u_int8_t** key_tables = (u_int8_t**) *sched;
590 u_int8_t* table = (u_int8_t*) &key_tables[10];
591 int k;
592
593 for (k = 0; k < 10; k++) {
594 key_tables[k] = table;
595 table += 0x100;
596 }
597 subkey_table_gen(key, (u_int8_t **) *sched);
598 err = 0;
599 } else
600 err = ENOMEM;
601 return err;
602}
603
604static void
605skipjack_zerokey(u_int8_t **sched)
606{
607 bzero(*sched, 10 * (sizeof(u_int8_t *) + 0x100));
42ee1e6b 608 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
609 *sched = NULL;
610}
611
612static void
400158c1 613rijndael128_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc
MD
614{
615 rijndael_encrypt((rijndael_ctx *) key, (u_char *) blk, (u_char *) blk);
616}
617
618static void
400158c1 619rijndael128_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
984263bc 620{
42ee1e6b 621 rijndael_decrypt(((rijndael_ctx *) key), (u_char *) blk,
984263bc
MD
622 (u_char *) blk);
623}
624
625static int
626rijndael128_setkey(u_int8_t **sched, u_int8_t *key, int len)
627{
628 int err;
629
42ee1e6b
SW
630 if (len != 16 && len != 24 && len != 32)
631 return (EINVAL);
54734da1 632 *sched = kmalloc(sizeof(rijndael_ctx), M_CRYPTO_DATA,
a0419b33 633 M_INTWAIT | M_ZERO);
984263bc 634 if (*sched != NULL) {
42ee1e6b
SW
635 rijndael_set_key((rijndael_ctx *) *sched, (u_char *) key,
636 len * 8);
984263bc
MD
637 err = 0;
638 } else
639 err = ENOMEM;
640 return err;
641}
642
643static void
644rijndael128_zerokey(u_int8_t **sched)
645{
42ee1e6b 646 bzero(*sched, sizeof(rijndael_ctx));
54734da1 647 kfree(*sched, M_CRYPTO_DATA);
42ee1e6b
SW
648 *sched = NULL;
649}
650
da41e4e5
AH
651#define AES_XTS_ALPHA 0x87 /* GF(2^128) generator polynomial */
652
653struct aes_xts_ctx {
654 rijndael_ctx key1;
655 rijndael_ctx key2;
da41e4e5
AH
656};
657
658void
659aes_xts_reinit(caddr_t key, u_int8_t *iv)
660{
661 struct aes_xts_ctx *ctx = (struct aes_xts_ctx *)key;
400158c1 662#if 0
da41e4e5
AH
663 u_int64_t blocknum;
664 u_int i;
400158c1 665#endif
da41e4e5 666
400158c1
AH
667#if 0
668 /*
669 * XXX: I've no idea why OpenBSD chose to make this dance of the moon
670 * around just copying the IV...
671 */
da41e4e5 672 /*
400158c1
AH
673 * Prepare tweak as E_k2(IV). IV is specified as LE representation
674 * of a 64-bit block number which we allow to be passed in directly.
675 */
da41e4e5
AH
676 bcopy(iv, &blocknum, AES_XTS_IV_LEN);
677 for (i = 0; i < AES_XTS_IV_LEN; i++) {
678 ctx->tweak[i] = blocknum & 0xff;
679 blocknum >>= 8;
680 }
400158c1 681#endif
da41e4e5 682 /* Last 64 bits of IV are always zero */
400158c1 683 bzero(iv + AES_XTS_IV_LEN, AES_XTS_IV_LEN);
da41e4e5 684
400158c1 685 rijndael_encrypt(&ctx->key2, iv, iv);
da41e4e5
AH
686}
687
688void
400158c1 689aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int8_t *iv, u_int do_encrypt)
da41e4e5
AH
690{
691 u_int8_t block[AES_XTS_BLOCK_LEN];
692 u_int i, carry_in, carry_out;
693
694 for (i = 0; i < AES_XTS_BLOCK_LEN; i++)
400158c1 695 block[i] = data[i] ^ iv[i];
da41e4e5
AH
696
697 if (do_encrypt)
698 rijndael_encrypt(&ctx->key1, block, data);
699 else
700 rijndael_decrypt(&ctx->key1, block, data);
701
702 for (i = 0; i < AES_XTS_BLOCK_LEN; i++)
400158c1 703 data[i] ^= iv[i];
da41e4e5
AH
704
705 /* Exponentiate tweak */
706 carry_in = 0;
707 for (i = 0; i < AES_XTS_BLOCK_LEN; i++) {
400158c1
AH
708 carry_out = iv[i] & 0x80;
709 iv[i] = (iv[i] << 1) | (carry_in ? 1 : 0);
da41e4e5
AH
710 carry_in = carry_out;
711 }
712 if (carry_in)
400158c1 713 iv[0] ^= AES_XTS_ALPHA;
da41e4e5
AH
714 bzero(block, sizeof(block));
715}
716
717void
400158c1 718aes_xts_encrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
da41e4e5 719{
400158c1 720 aes_xts_crypt((struct aes_xts_ctx *)key, data, iv, 1);
da41e4e5
AH
721}
722
723void
400158c1 724aes_xts_decrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
da41e4e5 725{
400158c1 726 aes_xts_crypt((struct aes_xts_ctx *)key, data, iv, 0);
da41e4e5
AH
727}
728
729int
730aes_xts_setkey(u_int8_t **sched, u_int8_t *key, int len)
731{
732 struct aes_xts_ctx *ctx;
733
734 if (len != 32 && len != 64)
735 return -1;
736
737 *sched = kmalloc(sizeof(struct aes_xts_ctx), M_CRYPTO_DATA,
738 M_WAITOK | M_ZERO);
739 ctx = (struct aes_xts_ctx *)*sched;
740
741 rijndael_set_key(&ctx->key1, key, len * 4);
742 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4);
743
744 return 0;
745}
746
747void
748aes_xts_zerokey(u_int8_t **sched)
749{
750 bzero(*sched, sizeof(struct aes_xts_ctx));
751 kfree(*sched, M_CRYPTO_DATA);
752 *sched = NULL;
753}
754
755#define AESCTR_NONCESIZE 4
756
757struct aes_ctr_ctx {
758 u_int32_t ac_ek[4*(14 + 1)];
759 u_int8_t ac_block[AESCTR_BLOCK_LEN];
760 int ac_nr;
761};
762
763void
764aes_ctr_reinit(caddr_t key, u_int8_t *iv)
765{
766 struct aes_ctr_ctx *ctx;
767
768 ctx = (struct aes_ctr_ctx *)key;
400158c1
AH
769 bcopy(iv, iv + AESCTR_NONCESIZE, AESCTR_IV_LEN);
770 bcopy(ctx->ac_block, iv, AESCTR_NONCESIZE);
da41e4e5
AH
771
772 /* reset counter */
400158c1 773 bzero(iv + AESCTR_NONCESIZE + AESCTR_IV_LEN, 4);
da41e4e5
AH
774}
775
776void
400158c1 777aes_ctr_crypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
da41e4e5
AH
778{
779 struct aes_ctr_ctx *ctx;
780 u_int8_t keystream[AESCTR_BLOCK_LEN];
781 int i;
782
783 ctx = (struct aes_ctr_ctx *)key;
784 /* increment counter */
785 for (i = AESCTR_BLOCK_LEN - 1;
786 i >= AESCTR_NONCESIZE + AESCTR_IV_LEN; i--)
400158c1 787 if (++iv[i]) /* continue on overflow */
da41e4e5 788 break;
400158c1 789 rijndaelEncrypt(ctx->ac_ek, ctx->ac_nr, iv, keystream);
da41e4e5
AH
790 for (i = 0; i < AESCTR_BLOCK_LEN; i++)
791 data[i] ^= keystream[i];
d6715a19 792 bzero(keystream, sizeof(keystream));
da41e4e5
AH
793}
794
795int
796aes_ctr_setkey(u_int8_t **sched, u_int8_t *key, int len)
797{
798 struct aes_ctr_ctx *ctx;
799
800 if (len < AESCTR_NONCESIZE)
801 return -1;
802
803 *sched = kmalloc(sizeof(struct aes_ctr_ctx), M_CRYPTO_DATA,
804 M_WAITOK | M_ZERO);
805 ctx = (struct aes_ctr_ctx *)*sched;
806 ctx->ac_nr = rijndaelKeySetupEnc(ctx->ac_ek, (u_char *)key,
807 (len - AESCTR_NONCESIZE) * 8);
808 if (ctx->ac_nr == 0) {
809 aes_ctr_zerokey(sched);
810 return -1;
811 }
812 bcopy(key + len - AESCTR_NONCESIZE, ctx->ac_block, AESCTR_NONCESIZE);
813 return 0;
814}
815
816void
817aes_ctr_zerokey(u_int8_t **sched)
818{
819 bzero(*sched, sizeof(struct aes_ctr_ctx));
820 kfree(*sched, M_CRYPTO_DATA);
821 *sched = NULL;
822}
823
42ee1e6b 824static void
aface142
AH
825aes_gcm_reinit(caddr_t key, u_int8_t *iv)
826{
827 struct aes_ctr_ctx *ctx;
828
829 ctx = (struct aes_ctr_ctx *)key;
830 bcopy(iv, ctx->ac_block + AESCTR_NONCESIZE, AESCTR_IV_LEN);
831
832 /* reset counter */
833 bzero(ctx->ac_block + AESCTR_NONCESIZE + AESCTR_IV_LEN, 4);
834 ctx->ac_block[AESCTR_BLOCK_LEN - 1] = 1; /* GCM starts with 1 */
835}
836
837static void
400158c1 838cml_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
42ee1e6b
SW
839{
840 camellia_encrypt((camellia_ctx *) key, (u_char *) blk, (u_char *) blk);
841}
842
843static void
400158c1 844cml_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
42ee1e6b
SW
845{
846 camellia_decrypt(((camellia_ctx *) key), (u_char *) blk,
847 (u_char *) blk);
848}
849
850static int
851cml_setkey(u_int8_t **sched, u_int8_t *key, int len)
852{
853 int err;
854
855 if (len != 16 && len != 24 && len != 32)
856 return (EINVAL);
857 *sched = kmalloc(sizeof(camellia_ctx), M_CRYPTO_DATA,
a0419b33 858 M_INTWAIT | M_ZERO);
42ee1e6b
SW
859 if (*sched != NULL) {
860 camellia_set_key((camellia_ctx *) *sched, (u_char *) key,
861 len * 8);
862 err = 0;
863 } else
864 err = ENOMEM;
865 return err;
866}
867
868static void
869cml_zerokey(u_int8_t **sched)
870{
871 bzero(*sched, sizeof(camellia_ctx));
872 kfree(*sched, M_CRYPTO_DATA);
984263bc
MD
873 *sched = NULL;
874}
875
876/*
877 * And now for auth.
878 */
879
880static void
881null_init(void *ctx)
882{
883}
884
885static int
886null_update(void *ctx, u_int8_t *buf, u_int16_t len)
887{
888 return 0;
889}
890
891static void
892null_final(u_int8_t *buf, void *ctx)
893{
902ec341 894 if (buf != NULL)
984263bc
MD
895 bzero(buf, 12);
896}
897
898static int
899RMD160Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
900{
901 RMD160Update(ctx, buf, len);
902 return 0;
903}
904
905static int
906MD5Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
907{
908 MD5Update(ctx, buf, len);
909 return 0;
910}
911
912static void
913SHA1Init_int(void *ctx)
914{
915 SHA1Init(ctx);
916}
917
918static int
919SHA1Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
920{
921 SHA1Update(ctx, buf, len);
922 return 0;
923}
924
925static void
926SHA1Final_int(u_int8_t *blk, void *ctx)
927{
928 SHA1Final(blk, ctx);
929}
930
931static int
932SHA256Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
933{
934 SHA256_Update(ctx, buf, len);
935 return 0;
936}
937
938static int
939SHA384Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
940{
941 SHA384_Update(ctx, buf, len);
942 return 0;
943}
944
945static int
946SHA512Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
947{
948 SHA512_Update(ctx, buf, len);
949 return 0;
950}
951
952/*
953 * And compression
954 */
955
956static u_int32_t
773330af 957deflate_compress(u_int8_t *data, u_int32_t size, u_int8_t **out)
984263bc
MD
958{
959 return deflate_global(data, size, 0, out);
960}
961
962static u_int32_t
773330af 963deflate_decompress(u_int8_t *data, u_int32_t size, u_int8_t **out)
984263bc
MD
964{
965 return deflate_global(data, size, 1, out);
966}