1 /* $FreeBSD: src/sys/opencrypto/xform.c,v 1.10 2008/10/23 15:53:51 des Exp $ */
2 /* $OpenBSD: xform.c,v 1.16 2001/08/28 12:20:43 ben Exp $ */
3 /*-
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
7 *
8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9 * in November 1995.
10 *
11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12 * by Angelos D. Keromytis.
13 *
14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15 * and Niels Provos.
16 *
17 * Additional features in 1999 by Angelos D. Keromytis.
18 *
19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20 * Angelos D. Keromytis and Niels Provos.
21 *
22 * Copyright (C) 2001, Angelos D. Keromytis.
23 *
24 * Permission to use, copy, and modify this software with or without fee
25 * is hereby granted, provided that this entire notice is included in
26 * all copies of any software which is or includes a copy or
27 * modification of this software.
28 * You may use this code under the GNU public license if you so wish. Please
29 * contribute changes back to the authors under this freer than GPL license
30 * so that we may further the use of strong encryption without limitations to
31 * all.
32 *
33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
37 * PURPOSE.
38 */
39
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/malloc.h>
43 #include <sys/sysctl.h>
44 #include <sys/errno.h>
45 #include <sys/time.h>
46 #include <sys/kernel.h>
47 #include <machine/cpu.h>
48
49 #include <crypto/blowfish/blowfish.h>
50 #include <crypto/camellia/camellia.h>
51 #include <crypto/des/des.h>
52 #include <crypto/rijndael/rijndael.h>
53 #include <crypto/serpent/serpent.h>
54 #include <crypto/sha1.h>
55 #include <crypto/twofish/twofish.h>
56
57 #include <opencrypto/cast.h>
58 #include <opencrypto/deflate.h>
59 #include <opencrypto/gmac.h>
60 #include <opencrypto/rmd160.h>
61 #include <opencrypto/skipjack.h>
62
63 #include <sys/md5.h>
64
65 #include <opencrypto/cryptodev.h>
66 #include <opencrypto/xform.h>
67
68 static void null_encrypt(caddr_t, u_int8_t *, u_int8_t *);
69 static void null_decrypt(caddr_t, u_int8_t *, u_int8_t *);
70 static int null_setkey(void *, u_int8_t *, int);
71
72 static int des1_setkey(void *, u_int8_t *, int);
73 static int des3_setkey(void *, u_int8_t *, int);
74 static int blf_setkey(void *, u_int8_t *, int);
75 static int cast5_setkey(void *, u_int8_t *, int);
76 static int skipjack_setkey(void *, u_int8_t *, int);
77 static int rijndael128_setkey(void *, u_int8_t *, int);
78 static int aes_xts_setkey(void *, u_int8_t *, int);
79 static int aes_ctr_setkey(void *, u_int8_t *, int);
80 static int cml_setkey(void *, u_int8_t *, int);
81 static int twofish128_setkey(void *, u_int8_t *, int);
82 static int serpent128_setkey(void *, u_int8_t *, int);
83 static int twofish_xts_setkey(void *, u_int8_t *, int);
84 static int serpent_xts_setkey(void *, u_int8_t *, int);
85
86 static void des1_encrypt(caddr_t, u_int8_t *, u_int8_t *);
87 static void des3_encrypt(caddr_t, u_int8_t *, u_int8_t *);
88 static void blf_encrypt(caddr_t, u_int8_t *, u_int8_t *);
89 static void cast5_encrypt(caddr_t, u_int8_t *, u_int8_t *);
90 static void skipjack_encrypt(caddr_t, u_int8_t *, u_int8_t *);
91 static void rijndael128_encrypt(caddr_t, u_int8_t *, u_int8_t *);
92 static void aes_xts_encrypt(caddr_t, u_int8_t *, u_int8_t *);
93 static void cml_encrypt(caddr_t, u_int8_t *, u_int8_t *);
94 static void twofish128_encrypt(caddr_t, u_int8_t *, u_int8_t *);
95 static void serpent128_encrypt(caddr_t, u_int8_t *, u_int8_t *);
96 static void twofish_xts_encrypt(caddr_t, u_int8_t *, u_int8_t *);
97 static void serpent_xts_encrypt(caddr_t, u_int8_t *, u_int8_t *);
98
99 static void des1_decrypt(caddr_t, u_int8_t *, u_int8_t *);
100 static void des3_decrypt(caddr_t, u_int8_t *, u_int8_t *);
101 static void blf_decrypt(caddr_t, u_int8_t *, u_int8_t *);
102 static void cast5_decrypt(caddr_t, u_int8_t *, u_int8_t *);
103 static void skipjack_decrypt(caddr_t, u_int8_t *, u_int8_t *);
104 static void rijndael128_decrypt(caddr_t, u_int8_t *, u_int8_t *);
105 static void aes_xts_decrypt(caddr_t, u_int8_t *, u_int8_t *);
106 static void cml_decrypt(caddr_t, u_int8_t *, u_int8_t *);
107 static void twofish128_decrypt(caddr_t, u_int8_t *, u_int8_t *);
108 static void serpent128_decrypt(caddr_t, u_int8_t *, u_int8_t *);
109 static void twofish_xts_decrypt(caddr_t, u_int8_t *, u_int8_t *);
110 static void serpent_xts_decrypt(caddr_t, u_int8_t *, u_int8_t *);
111
112 static void aes_ctr_crypt(caddr_t, u_int8_t *, u_int8_t *);
113
114 static void aes_ctr_reinit(caddr_t, u_int8_t *);
115 static void aes_xts_reinit(caddr_t, u_int8_t *);
116 static void aes_gcm_reinit(caddr_t, u_int8_t *);
117 static void twofish_xts_reinit(caddr_t, u_int8_t *);
118 static void serpent_xts_reinit(caddr_t, u_int8_t *);
119
120 static void null_init(void *);
121 static int null_update(void *, u_int8_t *, u_int16_t);
122 static void null_final(u_int8_t *, void *);
123 static int MD5Update_int(void *, u_int8_t *, u_int16_t);
124 static void SHA1Init_int(void *);
125 static int SHA1Update_int(void *, u_int8_t *, u_int16_t);
126 static void SHA1Final_int(u_int8_t *, void *);
127 static int RMD160Update_int(void *, u_int8_t *, u_int16_t);
128 static int SHA256Update_int(void *, u_int8_t *, u_int16_t);
129 static int SHA384Update_int(void *, u_int8_t *, u_int16_t);
130 static int SHA512Update_int(void *, u_int8_t *, u_int16_t);
131
132 static u_int32_t deflate_compress(u_int8_t *, u_int32_t, u_int8_t **);
133 static u_int32_t deflate_decompress(u_int8_t *, u_int32_t, u_int8_t **);
134
135 #define AES_XTS_ALPHA 0x87 /* GF(2^128) generator polynomial */
136 #define AESCTR_NONCESIZE 4
137
138 struct aes_xts_ctx {
139 rijndael_ctx key1;
140 rijndael_ctx key2;
141 };
142
143 struct aes_ctr_ctx {
144 u_int32_t ac_ek[4*(14 + 1)];
145 u_int8_t ac_block[AESCTR_BLOCK_LEN];
146 int ac_nr;
147 };
148
149 struct twofish_xts_ctx {
150 twofish_ctx key1;
151 twofish_ctx key2;
152 };
153
154 struct serpent_xts_ctx {
155 serpent_ctx key1;
156 serpent_ctx key2;
157 };
158
159 /* Helper */
160 static void aes_xts_crypt(struct aes_xts_ctx *, u_int8_t *, u_int8_t *, u_int);
161 static void twofish_xts_crypt(struct twofish_xts_ctx *, u_int8_t *, u_int8_t *,
162 u_int);
163 static void serpent_xts_crypt(struct serpent_xts_ctx *, u_int8_t *, u_int8_t *,
164 u_int);
165
166 MALLOC_DEFINE(M_XDATA, "xform", "xform data buffers");
167
168 /* Encryption instances */
169 struct enc_xform enc_xform_null = {
170 CRYPTO_NULL_CBC, "NULL",
171 /* NB: blocksize of 4 is to generate a properly aligned ESP header */
172 NULL_BLOCK_LEN, NULL_BLOCK_LEN, 0, 256, /* 2048 bits, max key */
173 sizeof(int), /* NB: context isn't used */
174 null_encrypt,
175 null_decrypt,
176 null_setkey,
177 NULL,
178 };
179
180 struct enc_xform enc_xform_des = {
181 CRYPTO_DES_CBC, "DES",
182 DES_BLOCK_LEN, DES_BLOCK_LEN, 8, 8,
183 sizeof(des_key_schedule),
184 des1_encrypt,
185 des1_decrypt,
186 des1_setkey,
187 NULL,
188 };
189
190 struct enc_xform enc_xform_3des = {
191 CRYPTO_3DES_CBC, "3DES",
192 DES3_BLOCK_LEN, DES3_BLOCK_LEN, 24, 24,
193 3 * sizeof(des_key_schedule),
194 des3_encrypt,
195 des3_decrypt,
196 des3_setkey,
197 NULL,
198 };
199
200 struct enc_xform enc_xform_blf = {
201 CRYPTO_BLF_CBC, "Blowfish",
202 BLOWFISH_BLOCK_LEN, BLOWFISH_BLOCK_LEN, 5, 56 /* 448 bits, max key */,
203 sizeof(BF_KEY),
204 blf_encrypt,
205 blf_decrypt,
206 blf_setkey,
207 NULL,
208 };
209
210 struct enc_xform enc_xform_cast5 = {
211 CRYPTO_CAST_CBC, "CAST-128",
212 CAST128_BLOCK_LEN, CAST128_BLOCK_LEN, 5, 16,
213 sizeof(cast_key),
214 cast5_encrypt,
215 cast5_decrypt,
216 cast5_setkey,
217 NULL,
218 };
219
220 struct enc_xform enc_xform_skipjack = {
221 CRYPTO_SKIPJACK_CBC, "Skipjack",
222 SKIPJACK_BLOCK_LEN, SKIPJACK_BLOCK_LEN, 10, 10,
223 10 * (sizeof(u_int8_t *) + 0x100), /* NB: all needed memory */
224 skipjack_encrypt,
225 skipjack_decrypt,
226 skipjack_setkey,
227 NULL,
228 };
229
230 struct enc_xform enc_xform_rijndael128 = {
231 CRYPTO_RIJNDAEL128_CBC, "Rijndael-128/AES",
232 RIJNDAEL128_BLOCK_LEN, RIJNDAEL128_BLOCK_LEN, 8, 32,
233 sizeof(rijndael_ctx),
234 rijndael128_encrypt,
235 rijndael128_decrypt,
236 rijndael128_setkey,
237 NULL,
238 };
239
240 struct enc_xform enc_xform_aes_xts = {
241 CRYPTO_AES_XTS, "AES-XTS",
242 AES_XTS_BLOCK_LEN, AES_XTS_IV_LEN, 32, 64,
243 sizeof(struct aes_xts_ctx),
244 aes_xts_encrypt,
245 aes_xts_decrypt,
246 aes_xts_setkey,
247 aes_xts_reinit,
248 };
249
250 struct enc_xform enc_xform_aes_ctr = {
251 CRYPTO_AES_CTR, "AES-CTR",
252 AESCTR_BLOCK_LEN, AESCTR_IV_LEN, 16+4, 32+4,
253 sizeof(struct aes_ctr_ctx),
254 aes_ctr_crypt,
255 aes_ctr_crypt,
256 aes_ctr_setkey,
257 aes_ctr_reinit,
258 };
259
260 struct enc_xform enc_xform_aes_gcm = {
261 CRYPTO_AES_GCM_16, "AES-GCM",
262 AESGCM_BLOCK_LEN, AESGCM_IV_LEN, 16+4, 32+4,
263 sizeof(struct aes_ctr_ctx),
264 aes_ctr_crypt,
265 aes_ctr_crypt,
266 aes_ctr_setkey,
267 aes_gcm_reinit,
268 };
269
270 struct enc_xform enc_xform_aes_gmac = {
271 CRYPTO_AES_GMAC, "AES-GMAC",
272 AESGMAC_BLOCK_LEN, AESGMAC_IV_LEN, 16+4, 32+4,
273 0, /* NB: no context */
274 NULL,
275 NULL,
276 NULL,
277 NULL,
278 };
279
280 struct enc_xform enc_xform_arc4 = {
281 CRYPTO_ARC4, "ARC4",
282 1, 1, 1, 32,
283 0, /* NB: no context */
284 NULL,
285 NULL,
286 NULL,
287 NULL,
288 };
289
290 struct enc_xform enc_xform_camellia = {
291 CRYPTO_CAMELLIA_CBC, "Camellia",
292 CAMELLIA_BLOCK_LEN, CAMELLIA_BLOCK_LEN, 8, 32,
293 sizeof(camellia_ctx),
294 cml_encrypt,
295 cml_decrypt,
296 cml_setkey,
297 NULL,
298 };
299
300 struct enc_xform enc_xform_twofish = {
301 CRYPTO_TWOFISH_CBC, "Twofish",
302 TWOFISH_BLOCK_LEN, TWOFISH_BLOCK_LEN, 8, 32,
303 sizeof(twofish_ctx),
304 twofish128_encrypt,
305 twofish128_decrypt,
306 twofish128_setkey,
307 NULL,
308 };
309
310 struct enc_xform enc_xform_serpent = {
311 CRYPTO_SERPENT_CBC, "Serpent",
312 SERPENT_BLOCK_LEN, SERPENT_BLOCK_LEN, 8, 32,
313 sizeof(serpent_ctx),
314 serpent128_encrypt,
315 serpent128_decrypt,
316 serpent128_setkey,
317 NULL,
318 };
319
320 struct enc_xform enc_xform_twofish_xts = {
321 CRYPTO_TWOFISH_XTS, "TWOFISH-XTS",
322 TWOFISH_XTS_BLOCK_LEN, TWOFISH_XTS_IV_LEN, 32, 64,
323 sizeof(struct twofish_xts_ctx),
324 twofish_xts_encrypt,
325 twofish_xts_decrypt,
326 twofish_xts_setkey,
327 twofish_xts_reinit,
328 };
329
330 struct enc_xform enc_xform_serpent_xts = {
331 CRYPTO_SERPENT_XTS, "SERPENT-XTS",
332 SERPENT_XTS_BLOCK_LEN, SERPENT_XTS_IV_LEN, 32, 64,
333 sizeof(struct serpent_xts_ctx),
334 serpent_xts_encrypt,
335 serpent_xts_decrypt,
336 serpent_xts_setkey,
337 serpent_xts_reinit,
338 };
339
340
341 /* Authentication instances */
342 struct auth_hash auth_hash_null = {
343 CRYPTO_NULL_HMAC, "NULL-HMAC",
344 0, NULL_HASH_LEN, NULL_HMAC_BLOCK_LEN,
345 sizeof(int), /* NB: context isn't used */
346 null_init, NULL, NULL, null_update, null_final
347 };
348
349 struct auth_hash auth_hash_hmac_md5 = {
350 CRYPTO_MD5_HMAC, "HMAC-MD5",
351 16, MD5_HASH_LEN, MD5_HMAC_BLOCK_LEN, sizeof(MD5_CTX),
352 (void (*) (void *)) MD5Init, NULL, NULL,
353 MD5Update_int,
354 (void (*) (u_int8_t *, void *)) MD5Final
355 };
356
357 struct auth_hash auth_hash_hmac_sha1 = {
358 CRYPTO_SHA1_HMAC, "HMAC-SHA1",
359 20, SHA1_HASH_LEN, SHA1_HMAC_BLOCK_LEN, sizeof(SHA1_CTX),
360 SHA1Init_int, NULL, NULL,
361 SHA1Update_int, SHA1Final_int
362 };
363
364 struct auth_hash auth_hash_hmac_ripemd_160 = {
365 CRYPTO_RIPEMD160_HMAC, "HMAC-RIPEMD-160",
366 20, RIPEMD160_HASH_LEN, RIPEMD160_HMAC_BLOCK_LEN, sizeof(RMD160_CTX),
367 (void (*)(void *)) RMD160Init, NULL, NULL,
368 RMD160Update_int,
369 (void (*)(u_int8_t *, void *)) RMD160Final
370 };
371
372 struct auth_hash auth_hash_key_md5 = {
373 CRYPTO_MD5_KPDK, "Keyed MD5",
374 0, MD5_KPDK_HASH_LEN, 0, sizeof(MD5_CTX),
375 (void (*)(void *)) MD5Init, NULL, NULL,
376 MD5Update_int,
377 (void (*)(u_int8_t *, void *)) MD5Final
378 };
379
380 struct auth_hash auth_hash_key_sha1 = {
381 CRYPTO_SHA1_KPDK, "Keyed SHA1",
382 0, SHA1_KPDK_HASH_LEN, 0, sizeof(SHA1_CTX),
383 SHA1Init_int, NULL, NULL,
384 SHA1Update_int, SHA1Final_int
385 };
386
387 struct auth_hash auth_hash_hmac_sha2_256 = {
388 CRYPTO_SHA2_256_HMAC, "HMAC-SHA2-256",
389 32, SHA2_256_HASH_LEN, SHA2_256_HMAC_BLOCK_LEN, sizeof(SHA256_CTX),
390 (void (*)(void *)) SHA256_Init, NULL, NULL,
391 SHA256Update_int,
392 (void (*)(u_int8_t *, void *)) SHA256_Final
393 };
394
395 struct auth_hash auth_hash_hmac_sha2_384 = {
396 CRYPTO_SHA2_384_HMAC, "HMAC-SHA2-384",
397 48, SHA2_384_HASH_LEN, SHA2_384_HMAC_BLOCK_LEN, sizeof(SHA384_CTX),
398 (void (*)(void *)) SHA384_Init, NULL, NULL,
399 SHA384Update_int,
400 (void (*)(u_int8_t *, void *)) SHA384_Final
401 };
402
403 struct auth_hash auth_hash_hmac_sha2_512 = {
404 CRYPTO_SHA2_512_HMAC, "HMAC-SHA2-512",
405 64, SHA2_512_HASH_LEN, SHA2_512_HMAC_BLOCK_LEN, sizeof(SHA512_CTX),
406 (void (*)(void *)) SHA512_Init, NULL, NULL,
407 SHA512Update_int,
408 (void (*)(u_int8_t *, void *)) SHA512_Final
409 };
410
411 struct auth_hash auth_hash_gmac_aes_128 = {
412 CRYPTO_AES_128_GMAC, "GMAC-AES-128",
413 16+4, 16, 16, sizeof(AES_GMAC_CTX),
414 (void (*)(void *)) AES_GMAC_Init,
415 (int (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
416 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
417 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
418 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
419 };
420
421 struct auth_hash auth_hash_gmac_aes_192 = {
422 CRYPTO_AES_192_GMAC, "GMAC-AES-192",
423 24+4, 16, 16, sizeof(AES_GMAC_CTX),
424 (void (*)(void *)) AES_GMAC_Init,
425 (int (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
426 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
427 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
428 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
429 };
430
431 struct auth_hash auth_hash_gmac_aes_256 = {
432 CRYPTO_AES_256_GMAC, "GMAC-AES-256",
433 32+4, 16, 16, sizeof(AES_GMAC_CTX),
434 (void (*)(void *)) AES_GMAC_Init,
435 (int (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Setkey,
436 (void (*)(void *, const u_int8_t *, u_int16_t)) AES_GMAC_Reinit,
437 (int (*)(void *, u_int8_t *, u_int16_t)) AES_GMAC_Update,
438 (void (*)(u_int8_t *, void *)) AES_GMAC_Final
439 };
440
441 /* Compression instance */
442 struct comp_algo comp_algo_deflate = {
443 CRYPTO_DEFLATE_COMP, "Deflate",
444 90, deflate_compress,
445 deflate_decompress
446 };
447
448 /*
449 * Encryption wrapper routines.
450 */
451
452 static void
null_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)453 null_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
454 {
455 }
456
457 static void
null_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)458 null_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
459 {
460 }
461
462 static int
null_setkey(void * sched,u_int8_t * key,int len)463 null_setkey(void *sched, u_int8_t *key, int len)
464 {
465 return 0;
466 }
467
468 static void
des1_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)469 des1_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
470 {
471 des_cblock *cb = (des_cblock *) blk;
472 des_key_schedule *p = (des_key_schedule *) key;
473
474 des_ecb_encrypt(cb, cb, p[0], DES_ENCRYPT);
475 }
476
477 static void
des1_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)478 des1_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
479 {
480 des_cblock *cb = (des_cblock *) blk;
481 des_key_schedule *p = (des_key_schedule *) key;
482
483 des_ecb_encrypt(cb, cb, p[0], DES_DECRYPT);
484 }
485
486 static int
des1_setkey(void * sched,u_int8_t * key,int len)487 des1_setkey(void *sched, u_int8_t *key, int len)
488 {
489 return des_set_key((des_cblock *)key, sched);
490 }
491
492 static void
des3_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)493 des3_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
494 {
495 des_cblock *cb = (des_cblock *) blk;
496 des_key_schedule *p = (des_key_schedule *) key;
497
498 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_ENCRYPT);
499 }
500
501 static void
des3_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)502 des3_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
503 {
504 des_cblock *cb = (des_cblock *) blk;
505 des_key_schedule *p = (des_key_schedule *) key;
506
507 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_DECRYPT);
508 }
509
510 static int
des3_setkey(void * sched,u_int8_t * key,int len)511 des3_setkey(void *sched, u_int8_t *key, int len)
512 {
513 des_key_schedule *p;
514
515 p = sched;
516 if (des_set_key((des_cblock *)(key + 0), p[0]) < 0 ||
517 des_set_key((des_cblock *)(key + 8), p[1]) < 0 ||
518 des_set_key((des_cblock *)(key + 16), p[2]) < 0)
519 return -1;
520
521 return 0;
522 }
523
524 static void
blf_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)525 blf_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
526 {
527 BF_LONG t[2];
528
529 memcpy(t, blk, sizeof (t));
530 t[0] = ntohl(t[0]);
531 t[1] = ntohl(t[1]);
532 /* NB: BF_encrypt expects the block in host order! */
533 BF_encrypt(t, (BF_KEY *) key);
534 t[0] = htonl(t[0]);
535 t[1] = htonl(t[1]);
536 memcpy(blk, t, sizeof (t));
537 }
538
539 static void
blf_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)540 blf_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
541 {
542 BF_LONG t[2];
543
544 memcpy(t, blk, sizeof (t));
545 t[0] = ntohl(t[0]);
546 t[1] = ntohl(t[1]);
547 /* NB: BF_decrypt expects the block in host order! */
548 BF_decrypt(t, (BF_KEY *) key);
549 t[0] = htonl(t[0]);
550 t[1] = htonl(t[1]);
551 memcpy(blk, t, sizeof (t));
552 }
553
554 static int
blf_setkey(void * sched,u_int8_t * key,int len)555 blf_setkey(void *sched, u_int8_t *key, int len)
556 {
557 BF_set_key(sched, len, key);
558 return 0;
559 }
560
561 static void
cast5_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)562 cast5_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
563 {
564 cast_encrypt((cast_key *) key, blk, blk);
565 }
566
567 static void
cast5_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)568 cast5_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
569 {
570 cast_decrypt((cast_key *) key, blk, blk);
571 }
572
573 static int
cast5_setkey(void * sched,u_int8_t * key,int len)574 cast5_setkey(void *sched, u_int8_t *key, int len)
575 {
576 cast_setkey(sched, key, len);
577 return 0;
578 }
579
580 static void
skipjack_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)581 skipjack_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
582 {
583 skipjack_forwards(blk, blk, (u_int8_t **) key);
584 }
585
586 static void
skipjack_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)587 skipjack_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
588 {
589 skipjack_backwards(blk, blk, (u_int8_t **) key);
590 }
591
592 static int
skipjack_setkey(void * sched,u_int8_t * key,int len)593 skipjack_setkey(void *sched, u_int8_t *key, int len)
594 {
595 u_int8_t **key_tables = sched;
596 u_int8_t *table = (u_int8_t *)&key_tables[10];
597 int k;
598
599 for (k = 0; k < 10; k++) {
600 key_tables[k] = table;
601 table += 0x100;
602 }
603 subkey_table_gen(key, sched);
604
605 return 0;
606 }
607
608 static void
rijndael128_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)609 rijndael128_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
610 {
611 rijndael_encrypt((rijndael_ctx *) key, (u_char *) blk, (u_char *) blk);
612 }
613
614 static void
rijndael128_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)615 rijndael128_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
616 {
617 rijndael_decrypt(((rijndael_ctx *) key), (u_char *) blk,
618 (u_char *) blk);
619 }
620
621 static int
rijndael128_setkey(void * sched,u_int8_t * key,int len)622 rijndael128_setkey(void *sched, u_int8_t *key, int len)
623 {
624 if (len != 16 && len != 24 && len != 32)
625 return (EINVAL);
626
627 rijndael_set_key(sched, (u_char *) key, len * 8);
628
629 return 0;
630 }
631
632 void
aes_xts_reinit(caddr_t key,u_int8_t * iv)633 aes_xts_reinit(caddr_t key, u_int8_t *iv)
634 {
635 struct aes_xts_ctx *ctx = (struct aes_xts_ctx *)key;
636 #if 0
637 u_int64_t blocknum;
638 u_int i;
639 #endif
640
641 #if 0
642 /*
643 * Prepare tweak as E_k2(IV). IV is specified as LE representation
644 * of a 64-bit block number which we allow to be passed in directly.
645 */
646 /* XXX: possibly use htole64? */
647 #endif
648 /* Last 64 bits of IV are always zero */
649 bzero(iv + AES_XTS_IV_LEN, AES_XTS_IV_LEN);
650
651 rijndael_encrypt(&ctx->key2, iv, iv);
652 }
653
654 void
aes_xts_crypt(struct aes_xts_ctx * ctx,u_int8_t * data,u_int8_t * iv,u_int do_encrypt)655 aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int8_t *iv,
656 u_int do_encrypt)
657 {
658 u_int8_t block[AES_XTS_BLOCK_LEN];
659 u_int i, carry_in, carry_out;
660
661 for (i = 0; i < AES_XTS_BLOCK_LEN; i++)
662 block[i] = data[i] ^ iv[i];
663
664 if (do_encrypt)
665 rijndael_encrypt(&ctx->key1, block, data);
666 else
667 rijndael_decrypt(&ctx->key1, block, data);
668
669 for (i = 0; i < AES_XTS_BLOCK_LEN; i++)
670 data[i] ^= iv[i];
671
672 /* Exponentiate tweak */
673 carry_in = 0;
674 for (i = 0; i < AES_XTS_BLOCK_LEN; i++) {
675 carry_out = iv[i] & 0x80;
676 iv[i] = (iv[i] << 1) | (carry_in ? 1 : 0);
677 carry_in = carry_out;
678 }
679 if (carry_in)
680 iv[0] ^= AES_XTS_ALPHA;
681 bzero(block, sizeof(block));
682 }
683
684 void
aes_xts_encrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)685 aes_xts_encrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
686 {
687 aes_xts_crypt((struct aes_xts_ctx *)key, data, iv, 1);
688 }
689
690 void
aes_xts_decrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)691 aes_xts_decrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
692 {
693 aes_xts_crypt((struct aes_xts_ctx *)key, data, iv, 0);
694 }
695
696 int
aes_xts_setkey(void * sched,u_int8_t * key,int len)697 aes_xts_setkey(void *sched, u_int8_t *key, int len)
698 {
699 struct aes_xts_ctx *ctx;
700
701 if (len != 32 && len != 64)
702 return -1;
703
704 ctx = sched;
705 rijndael_set_key(&ctx->key1, key, len * 4);
706 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4);
707
708 return 0;
709 }
710
711 void
aes_ctr_reinit(caddr_t key,u_int8_t * iv)712 aes_ctr_reinit(caddr_t key, u_int8_t *iv)
713 {
714 struct aes_ctr_ctx *ctx;
715
716 ctx = (struct aes_ctr_ctx *)key;
717 bcopy(iv, iv + AESCTR_NONCESIZE, AESCTR_IV_LEN);
718 bcopy(ctx->ac_block, iv, AESCTR_NONCESIZE);
719
720 /* reset counter */
721 bzero(iv + AESCTR_NONCESIZE + AESCTR_IV_LEN, 4);
722 }
723
724 void
aes_ctr_crypt(caddr_t key,u_int8_t * data,u_int8_t * iv)725 aes_ctr_crypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
726 {
727 struct aes_ctr_ctx *ctx;
728 u_int8_t keystream[AESCTR_BLOCK_LEN];
729 int i;
730
731 ctx = (struct aes_ctr_ctx *)key;
732 /* increment counter */
733 for (i = AESCTR_BLOCK_LEN - 1;
734 i >= AESCTR_NONCESIZE + AESCTR_IV_LEN; i--)
735 if (++iv[i]) /* continue on overflow */
736 break;
737 rijndaelEncrypt(ctx->ac_ek, ctx->ac_nr, iv, keystream);
738 for (i = 0; i < AESCTR_BLOCK_LEN; i++)
739 data[i] ^= keystream[i];
740 bzero(keystream, sizeof(keystream));
741 }
742
743 int
aes_ctr_setkey(void * sched,u_int8_t * key,int len)744 aes_ctr_setkey(void *sched, u_int8_t *key, int len)
745 {
746 struct aes_ctr_ctx *ctx;
747
748 len -= AESCTR_NONCESIZE;
749 if (len < 0)
750 return -1;
751 if (!(len == 16 || len == 24 || len == 32))
752 return -1; /* invalid key bits */
753
754 ctx = sched;
755 ctx->ac_nr = rijndaelKeySetupEnc(ctx->ac_ek, key, len * 8);
756 if (ctx->ac_nr == 0) {
757 bzero(ctx, sizeof(struct aes_ctr_ctx));
758 return -1;
759 }
760
761 bcopy(key + len, ctx->ac_block, AESCTR_NONCESIZE);
762
763 return 0;
764 }
765
766 static void
aes_gcm_reinit(caddr_t key,u_int8_t * iv)767 aes_gcm_reinit(caddr_t key, u_int8_t *iv)
768 {
769 struct aes_ctr_ctx *ctx;
770
771 ctx = (struct aes_ctr_ctx *)key;
772 bcopy(iv, ctx->ac_block + AESCTR_NONCESIZE, AESCTR_IV_LEN);
773
774 /* reset counter */
775 bzero(ctx->ac_block + AESCTR_NONCESIZE + AESCTR_IV_LEN, 4);
776 ctx->ac_block[AESCTR_BLOCK_LEN - 1] = 1; /* GCM starts with 1 */
777 }
778
779 static void
cml_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)780 cml_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
781 {
782 camellia_encrypt((camellia_ctx *) key, (u_char *) blk, (u_char *) blk);
783 }
784
785 static void
cml_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)786 cml_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
787 {
788 camellia_decrypt(((camellia_ctx *) key), (u_char *) blk,
789 (u_char *) blk);
790 }
791
792 static int
cml_setkey(void * sched,u_int8_t * key,int len)793 cml_setkey(void *sched, u_int8_t *key, int len)
794 {
795 if (len != 16 && len != 24 && len != 32)
796 return (EINVAL);
797
798 camellia_set_key(sched, key, len * 8);
799
800 return 0;
801 }
802
803 static void
twofish128_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)804 twofish128_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
805 {
806 twofish_encrypt((twofish_ctx *) key, blk, blk);
807 }
808
809 static void
twofish128_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)810 twofish128_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
811 {
812 twofish_decrypt(((twofish_ctx *) key), blk, blk);
813 }
814
815 static int
twofish128_setkey(void * sched,u_int8_t * key,int len)816 twofish128_setkey(void *sched, u_int8_t *key, int len)
817 {
818 if (len != 16 && len != 24 && len != 32)
819 return (EINVAL);
820
821 twofish_set_key(sched, key, len * 8);
822
823 return 0;
824 }
825
826 static void
serpent128_encrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)827 serpent128_encrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
828 {
829 serpent_encrypt((serpent_ctx *) key, blk, blk);
830 }
831
832 static void
serpent128_decrypt(caddr_t key,u_int8_t * blk,u_int8_t * iv)833 serpent128_decrypt(caddr_t key, u_int8_t *blk, u_int8_t *iv)
834 {
835 serpent_decrypt(((serpent_ctx *) key), blk, blk);
836 }
837
838 static int
serpent128_setkey(void * sched,u_int8_t * key,int len)839 serpent128_setkey(void *sched, u_int8_t *key, int len)
840 {
841 if (len != 16 && len != 24 && len != 32)
842 return (EINVAL);
843
844 serpent_set_key(sched, key, len * 8);
845
846 return 0;
847 }
848
849
850 void
twofish_xts_reinit(caddr_t key,u_int8_t * iv)851 twofish_xts_reinit(caddr_t key, u_int8_t *iv)
852 {
853 struct twofish_xts_ctx *ctx = (struct twofish_xts_ctx *)key;
854 #if 0
855 u_int64_t blocknum;
856 #endif
857
858 #if 0
859 /*
860 * Prepare tweak as E_k2(IV). IV is specified as LE representation
861 * of a 64-bit block number which we allow to be passed in directly.
862 */
863 /* XXX: possibly use htole64? */
864 #endif
865 /* Last 64 bits of IV are always zero */
866 bzero(iv + TWOFISH_XTS_IV_LEN, TWOFISH_XTS_IV_LEN);
867
868 twofish_encrypt(&ctx->key2, iv, iv);
869 }
870
871 void
twofish_xts_crypt(struct twofish_xts_ctx * ctx,u_int8_t * data,u_int8_t * iv,u_int do_encrypt)872 twofish_xts_crypt(struct twofish_xts_ctx *ctx, u_int8_t *data, u_int8_t *iv,
873 u_int do_encrypt)
874 {
875 u_int8_t block[TWOFISH_XTS_BLOCK_LEN];
876 u_int i, carry_in, carry_out;
877
878 for (i = 0; i < TWOFISH_XTS_BLOCK_LEN; i++)
879 block[i] = data[i] ^ iv[i];
880
881 if (do_encrypt)
882 twofish_encrypt(&ctx->key1, block, data);
883 else
884 twofish_decrypt(&ctx->key1, block, data);
885
886 for (i = 0; i < TWOFISH_XTS_BLOCK_LEN; i++)
887 data[i] ^= iv[i];
888
889 /* Exponentiate tweak */
890 carry_in = 0;
891 for (i = 0; i < TWOFISH_XTS_BLOCK_LEN; i++) {
892 carry_out = iv[i] & 0x80;
893 iv[i] = (iv[i] << 1) | (carry_in ? 1 : 0);
894 carry_in = carry_out;
895 }
896 if (carry_in)
897 iv[0] ^= AES_XTS_ALPHA;
898 bzero(block, sizeof(block));
899 }
900
901 void
twofish_xts_encrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)902 twofish_xts_encrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
903 {
904 twofish_xts_crypt((struct twofish_xts_ctx *)key, data, iv, 1);
905 }
906
907 void
twofish_xts_decrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)908 twofish_xts_decrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
909 {
910 twofish_xts_crypt((struct twofish_xts_ctx *)key, data, iv, 0);
911 }
912
913 int
twofish_xts_setkey(void * sched,u_int8_t * key,int len)914 twofish_xts_setkey(void *sched, u_int8_t *key, int len)
915 {
916 struct twofish_xts_ctx *ctx;
917
918 if (len != 32 && len != 64)
919 return -1;
920
921 ctx = sched;
922 twofish_set_key(&ctx->key1, key, len * 4);
923 twofish_set_key(&ctx->key2, key + (len / 2), len * 4);
924
925 return 0;
926 }
927
928
929 void
serpent_xts_reinit(caddr_t key,u_int8_t * iv)930 serpent_xts_reinit(caddr_t key, u_int8_t *iv)
931 {
932 struct serpent_xts_ctx *ctx = (struct serpent_xts_ctx *)key;
933 #if 0
934 u_int64_t blocknum;
935 u_int i;
936 #endif
937
938 #if 0
939 /*
940 * Prepare tweak as E_k2(IV). IV is specified as LE representation
941 * of a 64-bit block number which we allow to be passed in directly.
942 */
943 /* XXX: possibly use htole64? */
944 #endif
945 /* Last 64 bits of IV are always zero */
946 bzero(iv + SERPENT_XTS_IV_LEN, SERPENT_XTS_IV_LEN);
947
948 serpent_encrypt(&ctx->key2, iv, iv);
949 }
950
951 void
serpent_xts_crypt(struct serpent_xts_ctx * ctx,u_int8_t * data,u_int8_t * iv,u_int do_encrypt)952 serpent_xts_crypt(struct serpent_xts_ctx *ctx, u_int8_t *data, u_int8_t *iv,
953 u_int do_encrypt)
954 {
955 u_int8_t block[SERPENT_XTS_BLOCK_LEN];
956 u_int i, carry_in, carry_out;
957
958 for (i = 0; i < SERPENT_XTS_BLOCK_LEN; i++)
959 block[i] = data[i] ^ iv[i];
960
961 if (do_encrypt)
962 serpent_encrypt(&ctx->key1, block, data);
963 else
964 serpent_decrypt(&ctx->key1, block, data);
965
966 for (i = 0; i < SERPENT_XTS_BLOCK_LEN; i++)
967 data[i] ^= iv[i];
968
969 /* Exponentiate tweak */
970 carry_in = 0;
971 for (i = 0; i < SERPENT_XTS_BLOCK_LEN; i++) {
972 carry_out = iv[i] & 0x80;
973 iv[i] = (iv[i] << 1) | (carry_in ? 1 : 0);
974 carry_in = carry_out;
975 }
976 if (carry_in)
977 iv[0] ^= AES_XTS_ALPHA;
978 bzero(block, sizeof(block));
979 }
980
981 void
serpent_xts_encrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)982 serpent_xts_encrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
983 {
984 serpent_xts_crypt((struct serpent_xts_ctx *)key, data, iv, 1);
985 }
986
987 void
serpent_xts_decrypt(caddr_t key,u_int8_t * data,u_int8_t * iv)988 serpent_xts_decrypt(caddr_t key, u_int8_t *data, u_int8_t *iv)
989 {
990 serpent_xts_crypt((struct serpent_xts_ctx *)key, data, iv, 0);
991 }
992
993 int
serpent_xts_setkey(void * sched,u_int8_t * key,int len)994 serpent_xts_setkey(void *sched, u_int8_t *key, int len)
995 {
996 struct serpent_xts_ctx *ctx;
997
998 if (len != 32 && len != 64)
999 return -1;
1000
1001 ctx = sched;
1002 serpent_set_key(&ctx->key1, key, len * 4);
1003 serpent_set_key(&ctx->key2, key + (len / 2), len * 4);
1004
1005 return 0;
1006 }
1007
1008
1009 /*
1010 * And now for auth.
1011 */
1012
1013 static void
null_init(void * ctx)1014 null_init(void *ctx)
1015 {
1016 }
1017
1018 static int
null_update(void * ctx,u_int8_t * buf,u_int16_t len)1019 null_update(void *ctx, u_int8_t *buf, u_int16_t len)
1020 {
1021 return 0;
1022 }
1023
1024 static void
null_final(u_int8_t * buf,void * ctx)1025 null_final(u_int8_t *buf, void *ctx)
1026 {
1027 if (buf != NULL)
1028 bzero(buf, 12);
1029 }
1030
1031 static int
RMD160Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1032 RMD160Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1033 {
1034 RMD160Update(ctx, buf, len);
1035 return 0;
1036 }
1037
1038 static int
MD5Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1039 MD5Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1040 {
1041 MD5Update(ctx, buf, len);
1042 return 0;
1043 }
1044
1045 static void
SHA1Init_int(void * ctx)1046 SHA1Init_int(void *ctx)
1047 {
1048 SHA1Init(ctx);
1049 }
1050
1051 static int
SHA1Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1052 SHA1Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1053 {
1054 SHA1Update(ctx, buf, len);
1055 return 0;
1056 }
1057
1058 static void
SHA1Final_int(u_int8_t * blk,void * ctx)1059 SHA1Final_int(u_int8_t *blk, void *ctx)
1060 {
1061 SHA1Final(blk, ctx);
1062 }
1063
1064 static int
SHA256Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1065 SHA256Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1066 {
1067 SHA256_Update(ctx, buf, len);
1068 return 0;
1069 }
1070
1071 static int
SHA384Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1072 SHA384Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1073 {
1074 SHA384_Update(ctx, buf, len);
1075 return 0;
1076 }
1077
1078 static int
SHA512Update_int(void * ctx,u_int8_t * buf,u_int16_t len)1079 SHA512Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
1080 {
1081 SHA512_Update(ctx, buf, len);
1082 return 0;
1083 }
1084
1085 /*
1086 * And compression
1087 */
1088
1089 static u_int32_t
deflate_compress(u_int8_t * data,u_int32_t size,u_int8_t ** out)1090 deflate_compress(u_int8_t *data, u_int32_t size, u_int8_t **out)
1091 {
1092 return deflate_global(data, size, 0, out);
1093 }
1094
1095 static u_int32_t
deflate_decompress(u_int8_t * data,u_int32_t size,u_int8_t ** out)1096 deflate_decompress(u_int8_t *data, u_int32_t size, u_int8_t **out)
1097 {
1098 return deflate_global(data, size, 1, out);
1099 }
1100