/* * Key Wrapping: RFC3394 / NIST SP800-38F * * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de> * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, and the entire permission notice in its entirety, * including the disclaimer of warranties. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote * products derived from this software without specific prior * written permission. * * ALTERNATIVELY, this product may be distributed under the terms of * the GNU General Public License, in which case the provisions of the GPL2 * are required INSTEAD OF the above restrictions. (This clause is * necessary due to a potential bad interaction between the GPL and * the restrictions contained in a BSD-style copyright.) * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH * DAMAGE. */ /* * Note for using key wrapping: * * * The result of the encryption operation is the ciphertext starting * with the 2nd semiblock. The first semiblock is provided as the IV. * The IV used to start the encryption operation is the default IV. * * * The input for the decryption is the first semiblock handed in as an * IV. The ciphertext is the data starting with the 2nd semiblock. The * return code of the decryption operation will be EBADMSG in case an * integrity error occurs. * * To obtain the full result of an encryption as expected by SP800-38F, the * caller must allocate a buffer of plaintext + 8 bytes: * * unsigned int datalen = ptlen + crypto_skcipher_ivsize(tfm); * u8 data[datalen]; * u8 *iv = data; * u8 *pt = data + crypto_skcipher_ivsize(tfm); * <ensure that pt contains the plaintext of size ptlen> * sg_init_one(&sg, pt, ptlen); * skcipher_request_set_crypt(req, &sg, &sg, ptlen, iv); * * ==> After encryption, data now contains full KW result as per SP800-38F. * * In case of decryption, ciphertext now already has the expected length * and must be segmented appropriately: * * unsigned int datalen = CTLEN; * u8 data[datalen]; * <ensure that data contains full ciphertext> * u8 *iv = data; * u8 *ct = data + crypto_skcipher_ivsize(tfm); * unsigned int ctlen = datalen - crypto_skcipher_ivsize(tfm); * sg_init_one(&sg, ct, ctlen); * skcipher_request_set_crypt(req, &sg, &sg, ctlen, iv); * * ==> After decryption (which hopefully does not return EBADMSG), the ct * pointer now points to the plaintext of size ctlen. * * Note 2: KWP is not implemented as this would defy in-place operation. * If somebody wants to wrap non-aligned data, he should simply pad * the input with zeros to fill it up to the 8 byte boundary. */ #include <linux/module.h> #include <linux/crypto.h> #include <linux/scatterlist.h> #include <crypto/scatterwalk.h> #include <crypto/internal/cipher.h> #include <crypto/internal/skcipher.h> struct crypto_kw_block { #define SEMIBSIZE 8 __be64 A; __be64 R; }; /* * Fast forward the SGL to the "end" length minus SEMIBSIZE. * The start in the SGL defined by the fast-forward is returned with * the walk variable */ static void crypto_kw_scatterlist_ff(struct scatter_walk *walk, struct scatterlist *sg, unsigned int end) { unsigned int skip = 0; /* The caller should only operate on full SEMIBLOCKs. */ BUG_ON(end < SEMIBSIZE); skip = end - SEMIBSIZE; while (sg) { if (sg->length > skip) { scatterwalk_start(walk, sg); scatterwalk_advance(walk, skip); break; } skip -= sg->length; sg = sg_next(sg); } } static int crypto_kw_decrypt(struct skcipher_request *req) { struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); struct crypto_cipher *cipher = skcipher_cipher_simple(tfm); struct crypto_kw_block block; struct scatterlist *src, *dst; u64 t = 6 * ((req->cryptlen) >> 3); unsigned int i; int ret = 0; /* * Require at least 2 semiblocks (note, the 3rd semiblock that is * required by SP800-38F is the IV. */ if (req->cryptlen < (2 * SEMIBSIZE) || req->cryptlen % SEMIBSIZE) return -EINVAL; /* Place the IV into block A */ memcpy(&block.A, req->iv, SEMIBSIZE); /* * src scatterlist is read-only. dst scatterlist is r/w. During the * first loop, src points to req->src and dst to req->dst. For any * subsequent round, the code operates on req->dst only. */ src = req->src; dst = req->dst; for (i = 0; i < 6; i++) { struct scatter_walk src_walk, dst_walk; unsigned int nbytes = req->cryptlen; while (nbytes) { /* move pointer by nbytes in the SGL */ crypto_kw_scatterlist_ff(&src_walk, src, nbytes); /* get the source block */ scatterwalk_copychunks(&block.R, &src_walk, SEMIBSIZE, false); /* perform KW operation: modify IV with counter */ block.A ^= cpu_to_be64(t); t--; /* perform KW operation: decrypt block */ crypto_cipher_decrypt_one(cipher, (u8 *)&block, (u8 *)&block); /* move pointer by nbytes in the SGL */ crypto_kw_scatterlist_ff(&dst_walk, dst, nbytes); /* Copy block->R into place */ scatterwalk_copychunks(&block.R, &dst_walk, SEMIBSIZE, true); nbytes -= SEMIBSIZE; } /* we now start to operate on the dst SGL only */ src = req->dst; dst = req->dst; } /* Perform authentication check */ if (block.A != cpu_to_be64(0xa6a6a6a6a6a6a6a6ULL)) ret = -EBADMSG; memzero_explicit(&block, sizeof(struct crypto_kw_block)); return ret; } static int crypto_kw_encrypt(struct skcipher_request *req) { struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); struct crypto_cipher *cipher = skcipher_cipher_simple(tfm); struct crypto_kw_block block; struct scatterlist *src, *dst; u64 t = 1; unsigned int i; /* * Require at least 2 semiblocks (note, the 3rd semiblock that is * required by SP800-38F is the IV that occupies the first semiblock. * This means that the dst memory must be one semiblock larger than src. * Also ensure that the given data is aligned to semiblock. */ if (req->cryptlen < (2 * SEMIBSIZE) || req->cryptlen % SEMIBSIZE) return -EINVAL; /* * Place the predefined IV into block A -- for encrypt, the caller * does not need to provide an IV, but he needs to fetch the final IV. */ block.A = cpu_to_be64(0xa6a6a6a6a6a6a6a6ULL); /* * src scatterlist is read-only. dst scatterlist is r/w. During the * first loop, src points to req->src and dst to req->dst. For any * subsequent round, the code operates on req->dst only. */ src = req->src; dst = req->dst; for (i = 0; i < 6; i++) { struct scatter_walk src_walk, dst_walk; unsigned int nbytes = req->cryptlen; scatterwalk_start(&src_walk, src); scatterwalk_start(&dst_walk, dst); while (nbytes) { /* get the source block */ scatterwalk_copychunks(&block.R, &src_walk, SEMIBSIZE, false); /* perform KW operation: encrypt block */ crypto_cipher_encrypt_one(cipher, (u8 *)&block, (u8 *)&block); /* perform KW operation: modify IV with counter */ block.A ^= cpu_to_be64(t); t++; /* Copy block->R into place */ scatterwalk_copychunks(&block.R, &dst_walk, SEMIBSIZE, true); nbytes -= SEMIBSIZE; } /* we now start to operate on the dst SGL only */ src = req->dst; dst = req->dst; } /* establish the IV for the caller to pick up */ memcpy(req->iv, &block.A, SEMIBSIZE); memzero_explicit(&block, sizeof(struct crypto_kw_block)); return 0; } static int crypto_kw_create(struct crypto_template *tmpl, struct rtattr **tb) { struct skcipher_instance *inst; struct crypto_alg *alg; int err; inst = skcipher_alloc_instance_simple(tmpl, tb); if (IS_ERR(inst)) return PTR_ERR(inst); alg = skcipher_ialg_simple(inst); err = -EINVAL; /* Section 5.1 requirement for KW */ if (alg->cra_blocksize != sizeof(struct crypto_kw_block)) goto out_free_inst; inst->alg.base.cra_blocksize = SEMIBSIZE; inst->alg.base.cra_alignmask = 0; inst->alg.ivsize = SEMIBSIZE; inst->alg.encrypt = crypto_kw_encrypt; inst->alg.decrypt = crypto_kw_decrypt; err = skcipher_register_instance(tmpl, inst); if (err) { out_free_inst: inst->free(inst); } return err; } static struct crypto_template crypto_kw_tmpl = { .name = "kw", .create = crypto_kw_create, .module = THIS_MODULE, }; static int __init crypto_kw_init(void) { return crypto_register_template(&crypto_kw_tmpl); } static void __exit crypto_kw_exit(void) { crypto_unregister_template(&crypto_kw_tmpl); } subsys_initcall(crypto_kw_init); module_exit(crypto_kw_exit); MODULE_LICENSE("Dual BSD/GPL"); MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); MODULE_DESCRIPTION("Key Wrapping (RFC3394 / NIST SP800-38F)"); MODULE_ALIAS_CRYPTO("kw"); MODULE_IMPORT_NS(CRYPTO_INTERNAL);