^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) * CTS: Cipher Text Stealing mode
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * COPYRIGHT (c) 2008
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * The Regents of the University of Michigan
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * ALL RIGHTS RESERVED
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Permission is granted to use, copy, create derivative works
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * and redistribute this software and such derivative works
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * for any purpose, so long as the name of The University of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * Michigan is not used in any advertising or publicity
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * pertaining to the use of distribution of this software
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * without specific, written prior authorization. If the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * above copyright notice or any other identification of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * University of Michigan is included in any copy of any
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) * portion of this software, then the disclaimer below must
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) * also be included.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * SUCH DAMAGES.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) /* Derived from various:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) * This is the Cipher Text Stealing mode as described by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) * Section 8 of rfc2040 and referenced by rfc3962.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) * rfc3962 includes errata information in its Appendix A.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #include <crypto/algapi.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) #include <crypto/internal/skcipher.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #include <linux/log2.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) #include <linux/scatterlist.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) #include <crypto/scatterwalk.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) #include <linux/compiler.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) struct crypto_cts_ctx {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) struct crypto_skcipher *child;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) struct crypto_cts_reqctx {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) struct scatterlist sg[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) unsigned offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) struct skcipher_request subreq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) static inline u8 *crypto_cts_reqctx_space(struct skcipher_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) struct crypto_skcipher *child = ctx->child;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) return PTR_ALIGN((u8 *)(rctx + 1) + crypto_skcipher_reqsize(child),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) crypto_skcipher_alignmask(tfm) + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) static int crypto_cts_setkey(struct crypto_skcipher *parent, const u8 *key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) unsigned int keylen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) struct crypto_skcipher *child = ctx->child;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) &
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) CRYPTO_TFM_REQ_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) return crypto_skcipher_setkey(child, key, keylen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) static void cts_cbc_crypt_done(struct crypto_async_request *areq, int err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) struct skcipher_request *req = areq->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (err == -EINPROGRESS)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) skcipher_request_complete(req, err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) static int cts_cbc_encrypt(struct skcipher_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) struct skcipher_request *subreq = &rctx->subreq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) int bsize = crypto_skcipher_blocksize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) u8 d[MAX_CIPHER_BLOCKSIZE * 2] __aligned(__alignof__(u32));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) struct scatterlist *sg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) unsigned int offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) int lastn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) offset = rctx->offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) lastn = req->cryptlen - offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) memset(d, 0, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) scatterwalk_map_and_copy(d, req->src, offset, lastn, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) memzero_explicit(d, sizeof(d));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) skcipher_request_set_callback(subreq, req->base.flags &
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) CRYPTO_TFM_REQ_MAY_BACKLOG,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) cts_cbc_crypt_done, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) skcipher_request_set_crypt(subreq, sg, sg, bsize, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) return crypto_skcipher_encrypt(subreq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) static void crypto_cts_encrypt_done(struct crypto_async_request *areq, int err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) struct skcipher_request *req = areq->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) err = cts_cbc_encrypt(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) if (err == -EINPROGRESS || err == -EBUSY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) skcipher_request_complete(req, err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) static int crypto_cts_encrypt(struct skcipher_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) struct skcipher_request *subreq = &rctx->subreq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) int bsize = crypto_skcipher_blocksize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) unsigned int nbytes = req->cryptlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) unsigned int offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) skcipher_request_set_tfm(subreq, ctx->child);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) if (nbytes < bsize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (nbytes == bsize) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) skcipher_request_set_callback(subreq, req->base.flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) req->base.complete,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) req->base.data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) return crypto_skcipher_encrypt(subreq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) offset = rounddown(nbytes - 1, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) rctx->offset = offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) skcipher_request_set_callback(subreq, req->base.flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) crypto_cts_encrypt_done, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) skcipher_request_set_crypt(subreq, req->src, req->dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) offset, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) return crypto_skcipher_encrypt(subreq) ?:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) cts_cbc_encrypt(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) static int cts_cbc_decrypt(struct skcipher_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) struct skcipher_request *subreq = &rctx->subreq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) int bsize = crypto_skcipher_blocksize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) u8 d[MAX_CIPHER_BLOCKSIZE * 2] __aligned(__alignof__(u32));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) struct scatterlist *sg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) unsigned int offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) u8 *space;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) int lastn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) offset = rctx->offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) lastn = req->cryptlen - offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) /* 1. Decrypt Cn-1 (s) to create Dn */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) space = crypto_cts_reqctx_space(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) crypto_xor(d + bsize, space, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) /* 2. Pad Cn with zeros at the end to create C of length BB */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) memset(d, 0, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) scatterwalk_map_and_copy(d, req->src, offset, lastn, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) /* 3. Exclusive-or Dn with C to create Xn */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) /* 4. Select the first Ln bytes of Xn to create Pn */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) crypto_xor(d + bsize, d, lastn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) /* 5. Append the tail (BB - Ln) bytes of Xn to Cn to create En */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) memcpy(d + lastn, d + bsize + lastn, bsize - lastn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) /* 6. Decrypt En to create Pn-1 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) memzero_explicit(d, sizeof(d));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) skcipher_request_set_callback(subreq, req->base.flags &
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) CRYPTO_TFM_REQ_MAY_BACKLOG,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) cts_cbc_crypt_done, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) skcipher_request_set_crypt(subreq, sg, sg, bsize, space);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) return crypto_skcipher_decrypt(subreq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) static void crypto_cts_decrypt_done(struct crypto_async_request *areq, int err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) struct skcipher_request *req = areq->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) err = cts_cbc_decrypt(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) if (err == -EINPROGRESS || err == -EBUSY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) skcipher_request_complete(req, err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) static int crypto_cts_decrypt(struct skcipher_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) struct skcipher_request *subreq = &rctx->subreq;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) int bsize = crypto_skcipher_blocksize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) unsigned int nbytes = req->cryptlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) unsigned int offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) u8 *space;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) skcipher_request_set_tfm(subreq, ctx->child);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) if (nbytes < bsize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) if (nbytes == bsize) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) skcipher_request_set_callback(subreq, req->base.flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) req->base.complete,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) req->base.data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) return crypto_skcipher_decrypt(subreq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) skcipher_request_set_callback(subreq, req->base.flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) crypto_cts_decrypt_done, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) space = crypto_cts_reqctx_space(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) offset = rounddown(nbytes - 1, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) rctx->offset = offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) if (offset <= bsize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) memcpy(space, req->iv, bsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) scatterwalk_map_and_copy(space, req->src, offset - 2 * bsize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) bsize, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) skcipher_request_set_crypt(subreq, req->src, req->dst,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) offset, req->iv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) return crypto_skcipher_decrypt(subreq) ?:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) cts_cbc_decrypt(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) static int crypto_cts_init_tfm(struct crypto_skcipher *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) struct skcipher_instance *inst = skcipher_alg_instance(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) struct crypto_skcipher *cipher;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) unsigned reqsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) unsigned bsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) unsigned align;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) cipher = crypto_spawn_skcipher(spawn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) if (IS_ERR(cipher))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) return PTR_ERR(cipher);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) ctx->child = cipher;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) align = crypto_skcipher_alignmask(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) bsize = crypto_skcipher_blocksize(cipher);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) reqsize = ALIGN(sizeof(struct crypto_cts_reqctx) +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) crypto_skcipher_reqsize(cipher),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) crypto_tfm_ctx_alignment()) +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) (align & ~(crypto_tfm_ctx_alignment() - 1)) + bsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) crypto_skcipher_set_reqsize(tfm, reqsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) static void crypto_cts_exit_tfm(struct crypto_skcipher *tfm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) crypto_free_skcipher(ctx->child);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) static void crypto_cts_free(struct skcipher_instance *inst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) crypto_drop_skcipher(skcipher_instance_ctx(inst));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) kfree(inst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) static int crypto_cts_create(struct crypto_template *tmpl, struct rtattr **tb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) struct crypto_skcipher_spawn *spawn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) struct skcipher_instance *inst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) struct skcipher_alg *alg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) u32 mask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SKCIPHER, &mask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) if (!inst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) spawn = skcipher_instance_ctx(inst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) err = crypto_grab_skcipher(spawn, skcipher_crypto_instance(inst),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) crypto_attr_alg_name(tb[1]), 0, mask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) goto err_free_inst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) alg = crypto_spawn_skcipher_alg(spawn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) if (crypto_skcipher_alg_ivsize(alg) != alg->base.cra_blocksize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) goto err_free_inst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) if (strncmp(alg->base.cra_name, "cbc(", 4))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) goto err_free_inst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) err = crypto_inst_setname(skcipher_crypto_instance(inst), "cts",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) &alg->base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) goto err_free_inst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) inst->alg.base.cra_priority = alg->base.cra_priority;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) inst->alg.ivsize = alg->base.cra_blocksize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) inst->alg.chunksize = crypto_skcipher_alg_chunksize(alg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) inst->alg.base.cra_ctxsize = sizeof(struct crypto_cts_ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) inst->alg.init = crypto_cts_init_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) inst->alg.exit = crypto_cts_exit_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) inst->alg.setkey = crypto_cts_setkey;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) inst->alg.encrypt = crypto_cts_encrypt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) inst->alg.decrypt = crypto_cts_decrypt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) inst->free = crypto_cts_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) err = skcipher_register_instance(tmpl, inst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) err_free_inst:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) crypto_cts_free(inst);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) static struct crypto_template crypto_cts_tmpl = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) .name = "cts",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) .create = crypto_cts_create,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) .module = THIS_MODULE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) static int __init crypto_cts_module_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) return crypto_register_template(&crypto_cts_tmpl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) static void __exit crypto_cts_module_exit(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) crypto_unregister_template(&crypto_cts_tmpl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) subsys_initcall(crypto_cts_module_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) module_exit(crypto_cts_module_exit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) MODULE_LICENSE("Dual BSD/GPL");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) MODULE_ALIAS_CRYPTO("cts");
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags