^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * The AEGIS-128 Authenticated-Encryption Algorithm
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <crypto/algapi.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <crypto/internal/aead.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <crypto/internal/simd.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <crypto/internal/skcipher.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <crypto/scatterwalk.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/jump_label.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/scatterlist.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <asm/simd.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include "aegis.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #define AEGIS128_NONCE_SIZE 16
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #define AEGIS128_STATE_BLOCKS 5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #define AEGIS128_KEY_SIZE 16
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #define AEGIS128_MIN_AUTH_SIZE 8
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #define AEGIS128_MAX_AUTH_SIZE 16
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) struct aegis_state {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) union aegis_block blocks[AEGIS128_STATE_BLOCKS];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) struct aegis_ctx {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) union aegis_block key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_simd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) static const union aegis_block crypto_aegis_const[2] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) { .words64 = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) cpu_to_le64(U64_C(0x0d08050302010100)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) cpu_to_le64(U64_C(0x6279e99059372215)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) } },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) { .words64 = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) cpu_to_le64(U64_C(0xf12fc26d55183ddb)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) cpu_to_le64(U64_C(0xdd28b57342311120)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) } },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) static bool aegis128_do_simd(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) #ifdef CONFIG_CRYPTO_AEGIS128_SIMD
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) if (static_branch_likely(&have_simd))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) return crypto_simd_usable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) bool crypto_aegis128_have_simd(void);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) void crypto_aegis128_init_simd(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) const union aegis_block *key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) const u8 *iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) const u8 *src, unsigned int size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) const u8 *src, unsigned int size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) void crypto_aegis128_final_simd(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) union aegis_block *tag_xor,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) u64 assoclen, u64 cryptlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) static void crypto_aegis128_update(struct aegis_state *state)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) union aegis_block tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) unsigned int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) tmp = state->blocks[AEGIS128_STATE_BLOCKS - 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) for (i = AEGIS128_STATE_BLOCKS - 1; i > 0; i--)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) crypto_aegis_aesenc(&state->blocks[i], &state->blocks[i - 1],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) &state->blocks[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) crypto_aegis_aesenc(&state->blocks[0], &tmp, &state->blocks[0]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) static void crypto_aegis128_update_a(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) const union aegis_block *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) if (aegis128_do_simd()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) crypto_aegis128_update_simd(state, msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) crypto_aegis128_update(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) crypto_aegis_block_xor(&state->blocks[0], msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) static void crypto_aegis128_update_u(struct aegis_state *state, const void *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) if (aegis128_do_simd()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) crypto_aegis128_update_simd(state, msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) crypto_aegis128_update(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) crypto_xor(state->blocks[0].bytes, msg, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) static void crypto_aegis128_init(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) const union aegis_block *key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) const u8 *iv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) union aegis_block key_iv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) unsigned int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) key_iv = *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) crypto_xor(key_iv.bytes, iv, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) state->blocks[0] = key_iv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) state->blocks[1] = crypto_aegis_const[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) state->blocks[2] = crypto_aegis_const[0];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) state->blocks[3] = *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) state->blocks[4] = *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) crypto_aegis_block_xor(&state->blocks[3], &crypto_aegis_const[0]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) crypto_aegis_block_xor(&state->blocks[4], &crypto_aegis_const[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) for (i = 0; i < 5; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) crypto_aegis128_update_a(state, key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) crypto_aegis128_update_a(state, &key_iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) static void crypto_aegis128_ad(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) const u8 *src, unsigned int size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) if (AEGIS_ALIGNED(src)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) const union aegis_block *src_blk =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) (const union aegis_block *)src;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) crypto_aegis128_update_a(state, src_blk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) src_blk++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) crypto_aegis128_update_u(state, src);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) src += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) static void crypto_aegis128_encrypt_chunk(struct aegis_state *state, u8 *dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) const u8 *src, unsigned int size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) union aegis_block tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) union aegis_block *dst_blk =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) (union aegis_block *)dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) const union aegis_block *src_blk =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) (const union aegis_block *)src;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) crypto_aegis_block_xor(&tmp, src_blk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) crypto_aegis128_update_a(state, src_blk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) *dst_blk = tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) src += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) dst += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) crypto_aegis128_update_u(state, src);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) src += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) dst += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) if (size > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) union aegis_block msg = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) memcpy(msg.bytes, src, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) crypto_aegis128_update_a(state, &msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) crypto_aegis_block_xor(&msg, &tmp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) memcpy(dst, msg.bytes, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) static void crypto_aegis128_decrypt_chunk(struct aegis_state *state, u8 *dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) const u8 *src, unsigned int size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) union aegis_block tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) union aegis_block *dst_blk =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) (union aegis_block *)dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) const union aegis_block *src_blk =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) (const union aegis_block *)src;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) crypto_aegis_block_xor(&tmp, src_blk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) crypto_aegis128_update_a(state, &tmp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) *dst_blk = tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) src += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) dst += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) while (size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) crypto_aegis128_update_a(state, &tmp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) size -= AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) src += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) dst += AEGIS_BLOCK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) if (size > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) union aegis_block msg = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) memcpy(msg.bytes, src, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) tmp = state->blocks[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) crypto_aegis_block_and(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) crypto_aegis_block_xor(&tmp, &state->blocks[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) crypto_aegis_block_xor(&tmp, &state->blocks[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) crypto_aegis_block_xor(&msg, &tmp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) memset(msg.bytes + size, 0, AEGIS_BLOCK_SIZE - size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) crypto_aegis128_update_a(state, &msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) memcpy(dst, msg.bytes, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) static void crypto_aegis128_process_ad(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) struct scatterlist *sg_src,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) unsigned int assoclen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) struct scatter_walk walk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) union aegis_block buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) unsigned int pos = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) scatterwalk_start(&walk, sg_src);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) while (assoclen != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) unsigned int size = scatterwalk_clamp(&walk, assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) unsigned int left = size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) void *mapped = scatterwalk_map(&walk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) const u8 *src = (const u8 *)mapped;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) if (pos + size >= AEGIS_BLOCK_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) if (pos > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) unsigned int fill = AEGIS_BLOCK_SIZE - pos;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) memcpy(buf.bytes + pos, src, fill);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) crypto_aegis128_update_a(state, &buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) pos = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) left -= fill;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) src += fill;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) crypto_aegis128_ad(state, src, left);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) src += left & ~(AEGIS_BLOCK_SIZE - 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) left &= AEGIS_BLOCK_SIZE - 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) memcpy(buf.bytes + pos, src, left);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) pos += left;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) assoclen -= size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) scatterwalk_unmap(mapped);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) scatterwalk_advance(&walk, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) scatterwalk_done(&walk, 0, assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) if (pos > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) memset(buf.bytes + pos, 0, AEGIS_BLOCK_SIZE - pos);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) crypto_aegis128_update_a(state, &buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) static __always_inline
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) int crypto_aegis128_process_crypt(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) struct aead_request *req,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) struct skcipher_walk *walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) void (*crypt)(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) u8 *dst, const u8 *src,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) unsigned int size))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) while (walk->nbytes) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) unsigned int nbytes = walk->nbytes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) if (nbytes < walk->total)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) nbytes = round_down(nbytes, walk->stride);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) crypt(state, walk->dst.virt.addr, walk->src.virt.addr, nbytes);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) err = skcipher_walk_done(walk, walk->nbytes - nbytes);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) static void crypto_aegis128_final(struct aegis_state *state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) union aegis_block *tag_xor,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) u64 assoclen, u64 cryptlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) u64 assocbits = assoclen * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) u64 cryptbits = cryptlen * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) union aegis_block tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) unsigned int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) tmp.words64[0] = cpu_to_le64(assocbits);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) tmp.words64[1] = cpu_to_le64(cryptbits);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) crypto_aegis_block_xor(&tmp, &state->blocks[3]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) for (i = 0; i < 7; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) crypto_aegis128_update_a(state, &tmp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) for (i = 0; i < AEGIS128_STATE_BLOCKS; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) crypto_aegis_block_xor(tag_xor, &state->blocks[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) static int crypto_aegis128_setkey(struct crypto_aead *aead, const u8 *key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) unsigned int keylen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) struct aegis_ctx *ctx = crypto_aead_ctx(aead);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) if (keylen != AEGIS128_KEY_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) memcpy(ctx->key.bytes, key, AEGIS128_KEY_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) static int crypto_aegis128_setauthsize(struct crypto_aead *tfm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) unsigned int authsize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) if (authsize > AEGIS128_MAX_AUTH_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) if (authsize < AEGIS128_MIN_AUTH_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) static int crypto_aegis128_encrypt(struct aead_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) struct crypto_aead *tfm = crypto_aead_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) union aegis_block tag = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) unsigned int authsize = crypto_aead_authsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) unsigned int cryptlen = req->cryptlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) struct skcipher_walk walk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) struct aegis_state state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) skcipher_walk_aead_encrypt(&walk, req, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) if (aegis128_do_simd()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) crypto_aegis128_process_ad(&state, req->src, req->assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) crypto_aegis128_process_crypt(&state, req, &walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) crypto_aegis128_encrypt_chunk_simd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) crypto_aegis128_final_simd(&state, &tag, req->assoclen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) cryptlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) crypto_aegis128_init(&state, &ctx->key, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) crypto_aegis128_process_ad(&state, req->src, req->assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) crypto_aegis128_process_crypt(&state, req, &walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) crypto_aegis128_encrypt_chunk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) authsize, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) static int crypto_aegis128_decrypt(struct aead_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) static const u8 zeros[AEGIS128_MAX_AUTH_SIZE] = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) struct crypto_aead *tfm = crypto_aead_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) union aegis_block tag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) unsigned int authsize = crypto_aead_authsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) unsigned int cryptlen = req->cryptlen - authsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) struct skcipher_walk walk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) struct aegis_state state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) authsize, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) skcipher_walk_aead_decrypt(&walk, req, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) if (aegis128_do_simd()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) crypto_aegis128_process_ad(&state, req->src, req->assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) crypto_aegis128_process_crypt(&state, req, &walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) crypto_aegis128_decrypt_chunk_simd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) crypto_aegis128_final_simd(&state, &tag, req->assoclen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) cryptlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) crypto_aegis128_init(&state, &ctx->key, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) crypto_aegis128_process_ad(&state, req->src, req->assoclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) crypto_aegis128_process_crypt(&state, req, &walk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) crypto_aegis128_decrypt_chunk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) return crypto_memneq(tag.bytes, zeros, authsize) ? -EBADMSG : 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) static struct aead_alg crypto_aegis128_alg = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) .setkey = crypto_aegis128_setkey,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) .setauthsize = crypto_aegis128_setauthsize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) .encrypt = crypto_aegis128_encrypt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) .decrypt = crypto_aegis128_decrypt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) .ivsize = AEGIS128_NONCE_SIZE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) .maxauthsize = AEGIS128_MAX_AUTH_SIZE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) .chunksize = AEGIS_BLOCK_SIZE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) .base = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) .cra_blocksize = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) .cra_ctxsize = sizeof(struct aegis_ctx),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) .cra_alignmask = 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) .cra_priority = 100,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) .cra_name = "aegis128",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) .cra_driver_name = "aegis128-generic",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) .cra_module = THIS_MODULE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) static int __init crypto_aegis128_module_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) crypto_aegis128_have_simd())
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) static_branch_enable(&have_simd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) return crypto_register_aead(&crypto_aegis128_alg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) static void __exit crypto_aegis128_module_exit(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) crypto_unregister_aead(&crypto_aegis128_alg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) subsys_initcall(crypto_aegis128_module_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) module_exit(crypto_aegis128_module_exit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) MODULE_LICENSE("GPL");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) MODULE_AUTHOR("Ondrej Mosnacek <omosnacek@gmail.com>");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) MODULE_DESCRIPTION("AEGIS-128 AEAD algorithm");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) MODULE_ALIAS_CRYPTO("aegis128");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) MODULE_ALIAS_CRYPTO("aegis128-generic");
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags