Blame view
crypto/aegis128-core.c
13.1 KB
bb4ce8258 crypto: aegis - C... |
1 |
// SPDX-License-Identifier: GPL-2.0-or-later |
f606a88e5 crypto: aegis - A... |
2 3 4 5 6 |
/* * The AEGIS-128 Authenticated-Encryption Algorithm * * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com> * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved. |
f606a88e5 crypto: aegis - A... |
7 8 9 10 |
*/ #include <crypto/algapi.h> #include <crypto/internal/aead.h> |
cf3d41adc crypto: aegis128 ... |
11 |
#include <crypto/internal/simd.h> |
f606a88e5 crypto: aegis - A... |
12 13 14 15 |
#include <crypto/internal/skcipher.h> #include <crypto/scatterwalk.h> #include <linux/err.h> #include <linux/init.h> |
2698bce1f crypto: aegis128 ... |
16 |
#include <linux/jump_label.h> |
f606a88e5 crypto: aegis - A... |
17 18 19 |
#include <linux/kernel.h> #include <linux/module.h> #include <linux/scatterlist.h> |
cf3d41adc crypto: aegis128 ... |
20 |
#include <asm/simd.h> |
f606a88e5 crypto: aegis - A... |
21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
#include "aegis.h" #define AEGIS128_NONCE_SIZE 16 #define AEGIS128_STATE_BLOCKS 5 #define AEGIS128_KEY_SIZE 16 #define AEGIS128_MIN_AUTH_SIZE 8 #define AEGIS128_MAX_AUTH_SIZE 16 struct aegis_state { union aegis_block blocks[AEGIS128_STATE_BLOCKS]; }; struct aegis_ctx { union aegis_block key; }; |
2698bce1f crypto: aegis128 ... |
36 |
static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_simd); |
cf3d41adc crypto: aegis128 ... |
37 |
|
f1d087b91 crypto: aegis128 ... |
38 39 40 41 42 43 44 45 46 47 |
static const union aegis_block crypto_aegis_const[2] = { { .words64 = { cpu_to_le64(U64_C(0x0d08050302010100)), cpu_to_le64(U64_C(0x6279e99059372215)), } }, { .words64 = { cpu_to_le64(U64_C(0xf12fc26d55183ddb)), cpu_to_le64(U64_C(0xdd28b57342311120)), } }, }; |
cf3d41adc crypto: aegis128 ... |
48 49 50 |
static bool aegis128_do_simd(void) { #ifdef CONFIG_CRYPTO_AEGIS128_SIMD |
2698bce1f crypto: aegis128 ... |
51 |
if (static_branch_likely(&have_simd)) |
cf3d41adc crypto: aegis128 ... |
52 53 54 55 56 57 58 |
return crypto_simd_usable(); #endif return false; } bool crypto_aegis128_have_simd(void); void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg); |
528282630 crypto: aegis128 ... |
59 60 61 |
void crypto_aegis128_init_simd(struct aegis_state *state, const union aegis_block *key, const u8 *iv); |
cf3d41adc crypto: aegis128 ... |
62 63 64 65 |
void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst, const u8 *src, unsigned int size); void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst, const u8 *src, unsigned int size); |
528282630 crypto: aegis128 ... |
66 67 68 |
void crypto_aegis128_final_simd(struct aegis_state *state, union aegis_block *tag_xor, u64 assoclen, u64 cryptlen); |
cf3d41adc crypto: aegis128 ... |
69 |
|
f606a88e5 crypto: aegis - A... |
70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
static void crypto_aegis128_update(struct aegis_state *state) { union aegis_block tmp; unsigned int i; tmp = state->blocks[AEGIS128_STATE_BLOCKS - 1]; for (i = AEGIS128_STATE_BLOCKS - 1; i > 0; i--) crypto_aegis_aesenc(&state->blocks[i], &state->blocks[i - 1], &state->blocks[i]); crypto_aegis_aesenc(&state->blocks[0], &tmp, &state->blocks[0]); } static void crypto_aegis128_update_a(struct aegis_state *state, const union aegis_block *msg) { |
cf3d41adc crypto: aegis128 ... |
85 86 87 88 |
if (aegis128_do_simd()) { crypto_aegis128_update_simd(state, msg); return; } |
f606a88e5 crypto: aegis - A... |
89 90 91 92 93 94 |
crypto_aegis128_update(state); crypto_aegis_block_xor(&state->blocks[0], msg); } static void crypto_aegis128_update_u(struct aegis_state *state, const void *msg) { |
cf3d41adc crypto: aegis128 ... |
95 96 97 98 |
if (aegis128_do_simd()) { crypto_aegis128_update_simd(state, msg); return; } |
f606a88e5 crypto: aegis - A... |
99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 |
crypto_aegis128_update(state); crypto_xor(state->blocks[0].bytes, msg, AEGIS_BLOCK_SIZE); } static void crypto_aegis128_init(struct aegis_state *state, const union aegis_block *key, const u8 *iv) { union aegis_block key_iv; unsigned int i; key_iv = *key; crypto_xor(key_iv.bytes, iv, AEGIS_BLOCK_SIZE); state->blocks[0] = key_iv; state->blocks[1] = crypto_aegis_const[1]; state->blocks[2] = crypto_aegis_const[0]; state->blocks[3] = *key; state->blocks[4] = *key; crypto_aegis_block_xor(&state->blocks[3], &crypto_aegis_const[0]); crypto_aegis_block_xor(&state->blocks[4], &crypto_aegis_const[1]); for (i = 0; i < 5; i++) { crypto_aegis128_update_a(state, key); crypto_aegis128_update_a(state, &key_iv); } } static void crypto_aegis128_ad(struct aegis_state *state, const u8 *src, unsigned int size) { if (AEGIS_ALIGNED(src)) { const union aegis_block *src_blk = (const union aegis_block *)src; while (size >= AEGIS_BLOCK_SIZE) { crypto_aegis128_update_a(state, src_blk); size -= AEGIS_BLOCK_SIZE; src_blk++; } } else { while (size >= AEGIS_BLOCK_SIZE) { crypto_aegis128_update_u(state, src); size -= AEGIS_BLOCK_SIZE; src += AEGIS_BLOCK_SIZE; } } } static void crypto_aegis128_encrypt_chunk(struct aegis_state *state, u8 *dst, const u8 *src, unsigned int size) { union aegis_block tmp; if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) { while (size >= AEGIS_BLOCK_SIZE) { union aegis_block *dst_blk = (union aegis_block *)dst; const union aegis_block *src_blk = (const union aegis_block *)src; tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_aegis_block_xor(&tmp, src_blk); crypto_aegis128_update_a(state, src_blk); *dst_blk = tmp; size -= AEGIS_BLOCK_SIZE; src += AEGIS_BLOCK_SIZE; dst += AEGIS_BLOCK_SIZE; } } else { while (size >= AEGIS_BLOCK_SIZE) { tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE); crypto_aegis128_update_u(state, src); memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE); size -= AEGIS_BLOCK_SIZE; src += AEGIS_BLOCK_SIZE; dst += AEGIS_BLOCK_SIZE; } } if (size > 0) { union aegis_block msg = {}; memcpy(msg.bytes, src, size); tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_aegis128_update_a(state, &msg); crypto_aegis_block_xor(&msg, &tmp); memcpy(dst, msg.bytes, size); } } static void crypto_aegis128_decrypt_chunk(struct aegis_state *state, u8 *dst, const u8 *src, unsigned int size) { union aegis_block tmp; if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) { while (size >= AEGIS_BLOCK_SIZE) { union aegis_block *dst_blk = (union aegis_block *)dst; const union aegis_block *src_blk = (const union aegis_block *)src; tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_aegis_block_xor(&tmp, src_blk); crypto_aegis128_update_a(state, &tmp); *dst_blk = tmp; size -= AEGIS_BLOCK_SIZE; src += AEGIS_BLOCK_SIZE; dst += AEGIS_BLOCK_SIZE; } } else { while (size >= AEGIS_BLOCK_SIZE) { tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE); crypto_aegis128_update_a(state, &tmp); memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE); size -= AEGIS_BLOCK_SIZE; src += AEGIS_BLOCK_SIZE; dst += AEGIS_BLOCK_SIZE; } } if (size > 0) { union aegis_block msg = {}; memcpy(msg.bytes, src, size); tmp = state->blocks[2]; crypto_aegis_block_and(&tmp, &state->blocks[3]); crypto_aegis_block_xor(&tmp, &state->blocks[4]); crypto_aegis_block_xor(&tmp, &state->blocks[1]); crypto_aegis_block_xor(&msg, &tmp); memset(msg.bytes + size, 0, AEGIS_BLOCK_SIZE - size); crypto_aegis128_update_a(state, &msg); memcpy(dst, msg.bytes, size); } } static void crypto_aegis128_process_ad(struct aegis_state *state, struct scatterlist *sg_src, unsigned int assoclen) { struct scatter_walk walk; union aegis_block buf; unsigned int pos = 0; scatterwalk_start(&walk, sg_src); while (assoclen != 0) { unsigned int size = scatterwalk_clamp(&walk, assoclen); unsigned int left = size; void *mapped = scatterwalk_map(&walk); const u8 *src = (const u8 *)mapped; if (pos + size >= AEGIS_BLOCK_SIZE) { if (pos > 0) { unsigned int fill = AEGIS_BLOCK_SIZE - pos; memcpy(buf.bytes + pos, src, fill); crypto_aegis128_update_a(state, &buf); pos = 0; left -= fill; src += fill; } crypto_aegis128_ad(state, src, left); src += left & ~(AEGIS_BLOCK_SIZE - 1); left &= AEGIS_BLOCK_SIZE - 1; } memcpy(buf.bytes + pos, src, left); pos += left; assoclen -= size; scatterwalk_unmap(mapped); scatterwalk_advance(&walk, size); scatterwalk_done(&walk, 0, assoclen); } if (pos > 0) { memset(buf.bytes + pos, 0, AEGIS_BLOCK_SIZE - pos); crypto_aegis128_update_a(state, &buf); } } |
2698bce1f crypto: aegis128 ... |
318 319 320 321 322 323 324 |
static __always_inline int crypto_aegis128_process_crypt(struct aegis_state *state, struct aead_request *req, struct skcipher_walk *walk, void (*crypt)(struct aegis_state *state, u8 *dst, const u8 *src, unsigned int size)) |
f606a88e5 crypto: aegis - A... |
325 |
{ |
2698bce1f crypto: aegis128 ... |
326 |
int err = 0; |
f606a88e5 crypto: aegis - A... |
327 |
|
2698bce1f crypto: aegis128 ... |
328 329 |
while (walk->nbytes) { unsigned int nbytes = walk->nbytes; |
f606a88e5 crypto: aegis - A... |
330 |
|
2698bce1f crypto: aegis128 ... |
331 332 |
if (nbytes < walk->total) nbytes = round_down(nbytes, walk->stride); |
f606a88e5 crypto: aegis - A... |
333 |
|
2698bce1f crypto: aegis128 ... |
334 |
crypt(state, walk->dst.virt.addr, walk->src.virt.addr, nbytes); |
f606a88e5 crypto: aegis - A... |
335 |
|
2698bce1f crypto: aegis128 ... |
336 |
err = skcipher_walk_done(walk, walk->nbytes - nbytes); |
f606a88e5 crypto: aegis - A... |
337 |
} |
2698bce1f crypto: aegis128 ... |
338 |
return err; |
f606a88e5 crypto: aegis - A... |
339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 |
} static void crypto_aegis128_final(struct aegis_state *state, union aegis_block *tag_xor, u64 assoclen, u64 cryptlen) { u64 assocbits = assoclen * 8; u64 cryptbits = cryptlen * 8; union aegis_block tmp; unsigned int i; tmp.words64[0] = cpu_to_le64(assocbits); tmp.words64[1] = cpu_to_le64(cryptbits); crypto_aegis_block_xor(&tmp, &state->blocks[3]); for (i = 0; i < 7; i++) crypto_aegis128_update_a(state, &tmp); for (i = 0; i < AEGIS128_STATE_BLOCKS; i++) crypto_aegis_block_xor(tag_xor, &state->blocks[i]); } static int crypto_aegis128_setkey(struct crypto_aead *aead, const u8 *key, unsigned int keylen) { struct aegis_ctx *ctx = crypto_aead_ctx(aead); |
674f368a9 crypto: remove CR... |
367 |
if (keylen != AEGIS128_KEY_SIZE) |
f606a88e5 crypto: aegis - A... |
368 |
return -EINVAL; |
f606a88e5 crypto: aegis - A... |
369 370 371 372 373 374 375 376 377 378 379 380 381 382 |
memcpy(ctx->key.bytes, key, AEGIS128_KEY_SIZE); return 0; } static int crypto_aegis128_setauthsize(struct crypto_aead *tfm, unsigned int authsize) { if (authsize > AEGIS128_MAX_AUTH_SIZE) return -EINVAL; if (authsize < AEGIS128_MIN_AUTH_SIZE) return -EINVAL; return 0; } |
2698bce1f crypto: aegis128 ... |
383 |
static int crypto_aegis128_encrypt(struct aead_request *req) |
f606a88e5 crypto: aegis - A... |
384 385 |
{ struct crypto_aead *tfm = crypto_aead_reqtfm(req); |
2698bce1f crypto: aegis128 ... |
386 387 |
union aegis_block tag = {}; unsigned int authsize = crypto_aead_authsize(tfm); |
f606a88e5 crypto: aegis - A... |
388 |
struct aegis_ctx *ctx = crypto_aead_ctx(tfm); |
2698bce1f crypto: aegis128 ... |
389 390 |
unsigned int cryptlen = req->cryptlen; struct skcipher_walk walk; |
f606a88e5 crypto: aegis - A... |
391 |
struct aegis_state state; |
2698bce1f crypto: aegis128 ... |
392 |
skcipher_walk_aead_encrypt(&walk, req, false); |
528282630 crypto: aegis128 ... |
393 394 395 |
if (aegis128_do_simd()) { crypto_aegis128_init_simd(&state, &ctx->key, req->iv); crypto_aegis128_process_ad(&state, req->src, req->assoclen); |
2698bce1f crypto: aegis128 ... |
396 397 |
crypto_aegis128_process_crypt(&state, req, &walk, crypto_aegis128_encrypt_chunk_simd); |
528282630 crypto: aegis128 ... |
398 399 400 401 402 |
crypto_aegis128_final_simd(&state, &tag, req->assoclen, cryptlen); } else { crypto_aegis128_init(&state, &ctx->key, req->iv); crypto_aegis128_process_ad(&state, req->src, req->assoclen); |
2698bce1f crypto: aegis128 ... |
403 404 |
crypto_aegis128_process_crypt(&state, req, &walk, crypto_aegis128_encrypt_chunk); |
528282630 crypto: aegis128 ... |
405 406 |
crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen); } |
f606a88e5 crypto: aegis - A... |
407 408 409 410 411 412 413 414 |
scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen, authsize, 1); return 0; } static int crypto_aegis128_decrypt(struct aead_request *req) { |
f606a88e5 crypto: aegis - A... |
415 |
static const u8 zeros[AEGIS128_MAX_AUTH_SIZE] = {}; |
f606a88e5 crypto: aegis - A... |
416 417 418 419 |
struct crypto_aead *tfm = crypto_aead_reqtfm(req); union aegis_block tag; unsigned int authsize = crypto_aead_authsize(tfm); unsigned int cryptlen = req->cryptlen - authsize; |
2698bce1f crypto: aegis128 ... |
420 421 422 |
struct aegis_ctx *ctx = crypto_aead_ctx(tfm); struct skcipher_walk walk; struct aegis_state state; |
f606a88e5 crypto: aegis - A... |
423 424 425 |
scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen, authsize, 0); |
2698bce1f crypto: aegis128 ... |
426 |
skcipher_walk_aead_decrypt(&walk, req, false); |
528282630 crypto: aegis128 ... |
427 428 429 |
if (aegis128_do_simd()) { crypto_aegis128_init_simd(&state, &ctx->key, req->iv); crypto_aegis128_process_ad(&state, req->src, req->assoclen); |
2698bce1f crypto: aegis128 ... |
430 431 |
crypto_aegis128_process_crypt(&state, req, &walk, crypto_aegis128_decrypt_chunk_simd); |
528282630 crypto: aegis128 ... |
432 433 434 435 436 |
crypto_aegis128_final_simd(&state, &tag, req->assoclen, cryptlen); } else { crypto_aegis128_init(&state, &ctx->key, req->iv); crypto_aegis128_process_ad(&state, req->src, req->assoclen); |
2698bce1f crypto: aegis128 ... |
437 438 |
crypto_aegis128_process_crypt(&state, req, &walk, crypto_aegis128_decrypt_chunk); |
528282630 crypto: aegis128 ... |
439 440 |
crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen); } |
f606a88e5 crypto: aegis - A... |
441 442 443 |
return crypto_memneq(tag.bytes, zeros, authsize) ? -EBADMSG : 0; } |
f606a88e5 crypto: aegis - A... |
444 445 446 447 448 |
static struct aead_alg crypto_aegis128_alg = { .setkey = crypto_aegis128_setkey, .setauthsize = crypto_aegis128_setauthsize, .encrypt = crypto_aegis128_encrypt, .decrypt = crypto_aegis128_decrypt, |
f606a88e5 crypto: aegis - A... |
449 450 451 452 453 454 |
.ivsize = AEGIS128_NONCE_SIZE, .maxauthsize = AEGIS128_MAX_AUTH_SIZE, .chunksize = AEGIS_BLOCK_SIZE, .base = { |
f606a88e5 crypto: aegis - A... |
455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 |
.cra_blocksize = 1, .cra_ctxsize = sizeof(struct aegis_ctx), .cra_alignmask = 0, .cra_priority = 100, .cra_name = "aegis128", .cra_driver_name = "aegis128-generic", .cra_module = THIS_MODULE, } }; static int __init crypto_aegis128_module_init(void) { |
2698bce1f crypto: aegis128 ... |
470 471 472 |
if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) && crypto_aegis128_have_simd()) static_branch_enable(&have_simd); |
cf3d41adc crypto: aegis128 ... |
473 |
|
f606a88e5 crypto: aegis - A... |
474 475 476 477 478 479 480 |
return crypto_register_aead(&crypto_aegis128_alg); } static void __exit crypto_aegis128_module_exit(void) { crypto_unregister_aead(&crypto_aegis128_alg); } |
c4741b230 crypto: run initc... |
481 |
subsys_initcall(crypto_aegis128_module_init); |
f606a88e5 crypto: aegis - A... |
482 483 484 485 486 487 488 |
module_exit(crypto_aegis128_module_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Ondrej Mosnacek <omosnacek@gmail.com>"); MODULE_DESCRIPTION("AEGIS-128 AEAD algorithm"); MODULE_ALIAS_CRYPTO("aegis128"); MODULE_ALIAS_CRYPTO("aegis128-generic"); |