1 /* $FreeBSD: src/sys/opencrypto/xform.c,v 1.10 2008/10/23 15:53:51 des Exp $ */
2 /* $OpenBSD: xform.c,v 1.16 2001/08/28 12:20:43 ben Exp $ */
4 * The authors of this code are John Ioannidis (ji@tla.org),
5 * Angelos D. Keromytis (kermit@csd.uch.gr) and
6 * Niels Provos (provos@physnet.uni-hamburg.de).
8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12 * by Angelos D. Keromytis.
14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
17 * Additional features in 1999 by Angelos D. Keromytis.
19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20 * Angelos D. Keromytis and Niels Provos.
22 * Copyright (C) 2001, Angelos D. Keromytis.
24 * Permission to use, copy, and modify this software with or without fee
25 * is hereby granted, provided that this entire notice is included in
26 * all copies of any software which is or includes a copy or
27 * modification of this software.
28 * You may use this code under the GNU public license if you so wish. Please
29 * contribute changes back to the authors under this freer than GPL license
30 * so that we may further the use of strong encryption without limitations to
33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/malloc.h>
43 #include <sys/sysctl.h>
44 #include <sys/errno.h>
46 #include <sys/kernel.h>
47 #include <machine/cpu.h>
49 #include <crypto/blowfish/blowfish.h>
50 #include <crypto/des/des.h>
51 #include <crypto/rijndael/rijndael.h>
52 #include <crypto/camellia/camellia.h>
53 #include <crypto/twofish/twofish.h>
54 #include <crypto/serpent/serpent.h>
55 #include <crypto/sha1.h>
57 #include <opencrypto/cast.h>
58 #include <opencrypto/deflate.h>
59 #include <opencrypto/rmd160.h>
60 #include <opencrypto/skipjack.h>
61 #include <opencrypto/gmac.h>
65 #include <opencrypto/cryptodev.h>
66 #include <opencrypto/xform.h>
68 static void null_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
69 static void null_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
70 static int null_setkey(u_int8_t
**, u_int8_t
*, int);
71 static void null_zerokey(u_int8_t
**);
73 static int des1_setkey(u_int8_t
**, u_int8_t
*, int);
74 static int des3_setkey(u_int8_t
**, u_int8_t
*, int);
75 static int blf_setkey(u_int8_t
**, u_int8_t
*, int);
76 static int cast5_setkey(u_int8_t
**, u_int8_t
*, int);
77 static int skipjack_setkey(u_int8_t
**, u_int8_t
*, int);
78 static int rijndael128_setkey(u_int8_t
**, u_int8_t
*, int);
79 static int aes_xts_setkey(u_int8_t
**, u_int8_t
*, int);
80 static int aes_ctr_setkey(u_int8_t
**, u_int8_t
*, int);
81 static int cml_setkey(u_int8_t
**, u_int8_t
*, int);
82 static int twofish128_setkey(u_int8_t
**, u_int8_t
*, int);
83 static int serpent128_setkey(u_int8_t
**, u_int8_t
*, int);
84 static int twofish_xts_setkey(u_int8_t
**, u_int8_t
*, int);
85 static int serpent_xts_setkey(u_int8_t
**, u_int8_t
*, int);
86 static void des1_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
87 static void des3_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
88 static void blf_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
89 static void cast5_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
90 static void skipjack_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
91 static void rijndael128_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
92 static void aes_xts_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
93 static void cml_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
94 static void twofish128_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
95 static void serpent128_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
96 static void twofish_xts_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
97 static void serpent_xts_encrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
98 static void des1_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
99 static void des3_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
100 static void blf_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
101 static void cast5_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
102 static void skipjack_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
103 static void rijndael128_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
104 static void aes_xts_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
105 static void cml_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
106 static void twofish128_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
107 static void serpent128_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
108 static void twofish_xts_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
109 static void serpent_xts_decrypt(caddr_t
, u_int8_t
*, u_int8_t
*);
110 static void des1_zerokey(u_int8_t
**);
111 static void des3_zerokey(u_int8_t
**);
112 static void blf_zerokey(u_int8_t
**);
113 static void cast5_zerokey(u_int8_t
**);
114 static void skipjack_zerokey(u_int8_t
**);
115 static void rijndael128_zerokey(u_int8_t
**);
116 static void aes_xts_zerokey(u_int8_t
**);
117 static void aes_ctr_zerokey(u_int8_t
**);
118 static void cml_zerokey(u_int8_t
**);
119 static void twofish128_zerokey(u_int8_t
**);
120 static void serpent128_zerokey(u_int8_t
**);
121 static void twofish_xts_zerokey(u_int8_t
**);
122 static void serpent_xts_zerokey(u_int8_t
**);
124 static void aes_ctr_crypt(caddr_t
, u_int8_t
*, u_int8_t
*);
126 static void aes_ctr_reinit(caddr_t
, u_int8_t
*);
127 static void aes_xts_reinit(caddr_t
, u_int8_t
*);
128 static void aes_gcm_reinit(caddr_t
, u_int8_t
*);
129 static void twofish_xts_reinit(caddr_t
, u_int8_t
*);
130 static void serpent_xts_reinit(caddr_t
, u_int8_t
*);
132 static void null_init(void *);
133 static int null_update(void *, u_int8_t
*, u_int16_t
);
134 static void null_final(u_int8_t
*, void *);
135 static int MD5Update_int(void *, u_int8_t
*, u_int16_t
);
136 static void SHA1Init_int(void *);
137 static int SHA1Update_int(void *, u_int8_t
*, u_int16_t
);
138 static void SHA1Final_int(u_int8_t
*, void *);
139 static int RMD160Update_int(void *, u_int8_t
*, u_int16_t
);
140 static int SHA256Update_int(void *, u_int8_t
*, u_int16_t
);
141 static int SHA384Update_int(void *, u_int8_t
*, u_int16_t
);
142 static int SHA512Update_int(void *, u_int8_t
*, u_int16_t
);
144 static u_int32_t
deflate_compress(u_int8_t
*, u_int32_t
, u_int8_t
**);
145 static u_int32_t
deflate_decompress(u_int8_t
*, u_int32_t
, u_int8_t
**);
149 struct twofish_xts_ctx
;
150 struct serpent_xts_ctx
;
151 static void aes_xts_crypt(struct aes_xts_ctx
*, u_int8_t
*, u_int8_t
*, u_int
);
152 static void twofish_xts_crypt(struct twofish_xts_ctx
*, u_int8_t
*, u_int8_t
*,
154 static void serpent_xts_crypt(struct serpent_xts_ctx
*, u_int8_t
*, u_int8_t
*,
157 MALLOC_DEFINE(M_XDATA
, "xform", "xform data buffers");
159 /* Encryption instances */
160 struct enc_xform enc_xform_null
= {
161 CRYPTO_NULL_CBC
, "NULL",
162 /* NB: blocksize of 4 is to generate a properly aligned ESP header */
163 NULL_BLOCK_LEN
, NULL_BLOCK_LEN
, 0, 256, /* 2048 bits, max key */
171 struct enc_xform enc_xform_des
= {
172 CRYPTO_DES_CBC
, "DES",
173 DES_BLOCK_LEN
, DES_BLOCK_LEN
, 8, 8,
181 struct enc_xform enc_xform_3des
= {
182 CRYPTO_3DES_CBC
, "3DES",
183 DES3_BLOCK_LEN
, DES3_BLOCK_LEN
, 24, 24,
191 struct enc_xform enc_xform_blf
= {
192 CRYPTO_BLF_CBC
, "Blowfish",
193 BLOWFISH_BLOCK_LEN
, BLOWFISH_BLOCK_LEN
, 5, 56 /* 448 bits, max key */,
201 struct enc_xform enc_xform_cast5
= {
202 CRYPTO_CAST_CBC
, "CAST-128",
203 CAST128_BLOCK_LEN
, CAST128_BLOCK_LEN
, 5, 16,
211 struct enc_xform enc_xform_skipjack
= {
212 CRYPTO_SKIPJACK_CBC
, "Skipjack",
213 SKIPJACK_BLOCK_LEN
, SKIPJACK_BLOCK_LEN
, 10, 10,
221 struct enc_xform enc_xform_rijndael128
= {
222 CRYPTO_RIJNDAEL128_CBC
, "Rijndael-128/AES",
223 RIJNDAEL128_BLOCK_LEN
, RIJNDAEL128_BLOCK_LEN
, 8, 32,
231 struct enc_xform enc_xform_aes_xts
= {
232 CRYPTO_AES_XTS
, "AES-XTS",
233 AES_XTS_BLOCK_LEN
, AES_XTS_IV_LEN
, 32, 64,
241 struct enc_xform enc_xform_aes_ctr
= {
242 CRYPTO_AES_CTR
, "AES-CTR",
243 AESCTR_BLOCK_LEN
, AESCTR_IV_LEN
, 16+4, 32+4,
251 struct enc_xform enc_xform_aes_gcm
= {
252 CRYPTO_AES_GCM_16
, "AES-GCM",
253 AESGCM_BLOCK_LEN
, AESGCM_IV_LEN
, 16+4, 32+4,
261 struct enc_xform enc_xform_aes_gmac
= {
262 CRYPTO_AES_GMAC
, "AES-GMAC",
263 AESGMAC_BLOCK_LEN
, AESGMAC_IV_LEN
, 16+4, 32+4,
271 struct enc_xform enc_xform_arc4
= {
281 struct enc_xform enc_xform_camellia
= {
282 CRYPTO_CAMELLIA_CBC
, "Camellia",
283 CAMELLIA_BLOCK_LEN
, CAMELLIA_BLOCK_LEN
, 8, 32,
291 struct enc_xform enc_xform_twofish
= {
292 CRYPTO_TWOFISH_CBC
, "Twofish",
293 TWOFISH_BLOCK_LEN
, TWOFISH_BLOCK_LEN
, 8, 32,
301 struct enc_xform enc_xform_serpent
= {
302 CRYPTO_SERPENT_CBC
, "Serpent",
303 SERPENT_BLOCK_LEN
, SERPENT_BLOCK_LEN
, 8, 32,
311 struct enc_xform enc_xform_twofish_xts
= {
312 CRYPTO_TWOFISH_XTS
, "TWOFISH-XTS",
313 TWOFISH_XTS_BLOCK_LEN
, TWOFISH_XTS_IV_LEN
, 32, 64,
321 struct enc_xform enc_xform_serpent_xts
= {
322 CRYPTO_SERPENT_XTS
, "SERPENT-XTS",
323 SERPENT_XTS_BLOCK_LEN
, SERPENT_XTS_IV_LEN
, 32, 64,
332 /* Authentication instances */
333 struct auth_hash auth_hash_null
= {
334 CRYPTO_NULL_HMAC
, "NULL-HMAC",
335 0, NULL_HASH_LEN
, NULL_HMAC_BLOCK_LEN
, sizeof(int), /* NB: context isn't used */
336 null_init
, NULL
, NULL
, null_update
, null_final
339 struct auth_hash auth_hash_hmac_md5
= {
340 CRYPTO_MD5_HMAC
, "HMAC-MD5",
341 16, MD5_HASH_LEN
, MD5_HMAC_BLOCK_LEN
, sizeof(MD5_CTX
),
342 (void (*) (void *)) MD5Init
, NULL
, NULL
,
344 (void (*) (u_int8_t
*, void *)) MD5Final
347 struct auth_hash auth_hash_hmac_sha1
= {
348 CRYPTO_SHA1_HMAC
, "HMAC-SHA1",
349 20, SHA1_HASH_LEN
, SHA1_HMAC_BLOCK_LEN
, sizeof(SHA1_CTX
),
350 SHA1Init_int
, NULL
, NULL
,
351 SHA1Update_int
, SHA1Final_int
354 struct auth_hash auth_hash_hmac_ripemd_160
= {
355 CRYPTO_RIPEMD160_HMAC
, "HMAC-RIPEMD-160",
356 20, RIPEMD160_HASH_LEN
, RIPEMD160_HMAC_BLOCK_LEN
, sizeof(RMD160_CTX
),
357 (void (*)(void *)) RMD160Init
, NULL
, NULL
,
359 (void (*)(u_int8_t
*, void *)) RMD160Final
362 struct auth_hash auth_hash_key_md5
= {
363 CRYPTO_MD5_KPDK
, "Keyed MD5",
364 0, MD5_KPDK_HASH_LEN
, 0, sizeof(MD5_CTX
),
365 (void (*)(void *)) MD5Init
, NULL
, NULL
,
367 (void (*)(u_int8_t
*, void *)) MD5Final
370 struct auth_hash auth_hash_key_sha1
= {
371 CRYPTO_SHA1_KPDK
, "Keyed SHA1",
372 0, SHA1_KPDK_HASH_LEN
, 0, sizeof(SHA1_CTX
),
373 SHA1Init_int
, NULL
, NULL
,
374 SHA1Update_int
, SHA1Final_int
377 struct auth_hash auth_hash_hmac_sha2_256
= {
378 CRYPTO_SHA2_256_HMAC
, "HMAC-SHA2-256",
379 32, SHA2_256_HASH_LEN
, SHA2_256_HMAC_BLOCK_LEN
, sizeof(SHA256_CTX
),
380 (void (*)(void *)) SHA256_Init
, NULL
, NULL
,
382 (void (*)(u_int8_t
*, void *)) SHA256_Final
385 struct auth_hash auth_hash_hmac_sha2_384
= {
386 CRYPTO_SHA2_384_HMAC
, "HMAC-SHA2-384",
387 48, SHA2_384_HASH_LEN
, SHA2_384_HMAC_BLOCK_LEN
, sizeof(SHA384_CTX
),
388 (void (*)(void *)) SHA384_Init
, NULL
, NULL
,
390 (void (*)(u_int8_t
*, void *)) SHA384_Final
393 struct auth_hash auth_hash_hmac_sha2_512
= {
394 CRYPTO_SHA2_512_HMAC
, "HMAC-SHA2-512",
395 64, SHA2_512_HASH_LEN
, SHA2_512_HMAC_BLOCK_LEN
, sizeof(SHA512_CTX
),
396 (void (*)(void *)) SHA512_Init
, NULL
, NULL
,
398 (void (*)(u_int8_t
*, void *)) SHA512_Final
401 struct auth_hash auth_hash_gmac_aes_128
= {
402 CRYPTO_AES_128_GMAC
, "GMAC-AES-128",
403 16+4, 16, 16, sizeof(AES_GMAC_CTX
),
404 (void (*)(void *)) AES_GMAC_Init
,
405 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Setkey
,
406 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Reinit
,
407 (int (*)(void *, u_int8_t
*, u_int16_t
)) AES_GMAC_Update
,
408 (void (*)(u_int8_t
*, void *)) AES_GMAC_Final
411 struct auth_hash auth_hash_gmac_aes_192
= {
412 CRYPTO_AES_192_GMAC
, "GMAC-AES-192",
413 24+4, 16, 16, sizeof(AES_GMAC_CTX
),
414 (void (*)(void *)) AES_GMAC_Init
,
415 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Setkey
,
416 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Reinit
,
417 (int (*)(void *, u_int8_t
*, u_int16_t
)) AES_GMAC_Update
,
418 (void (*)(u_int8_t
*, void *)) AES_GMAC_Final
421 struct auth_hash auth_hash_gmac_aes_256
= {
422 CRYPTO_AES_256_GMAC
, "GMAC-AES-256",
423 32+4, 16, 16, sizeof(AES_GMAC_CTX
),
424 (void (*)(void *)) AES_GMAC_Init
,
425 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Setkey
,
426 (void (*)(void *, const u_int8_t
*, u_int16_t
)) AES_GMAC_Reinit
,
427 (int (*)(void *, u_int8_t
*, u_int16_t
)) AES_GMAC_Update
,
428 (void (*)(u_int8_t
*, void *)) AES_GMAC_Final
431 /* Compression instance */
432 struct comp_algo comp_algo_deflate
= {
433 CRYPTO_DEFLATE_COMP
, "Deflate",
434 90, deflate_compress
,
439 * Encryption wrapper routines.
442 null_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
446 null_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
450 null_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
456 null_zerokey(u_int8_t
**sched
)
462 des1_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
464 des_cblock
*cb
= (des_cblock
*) blk
;
465 des_key_schedule
*p
= (des_key_schedule
*) key
;
467 des_ecb_encrypt(cb
, cb
, p
[0], DES_ENCRYPT
);
471 des1_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
473 des_cblock
*cb
= (des_cblock
*) blk
;
474 des_key_schedule
*p
= (des_key_schedule
*) key
;
476 des_ecb_encrypt(cb
, cb
, p
[0], DES_DECRYPT
);
480 des1_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
485 p
= kmalloc(sizeof (des_key_schedule
),
486 M_CRYPTO_DATA
, M_INTWAIT
| M_ZERO
);
488 des_set_key((des_cblock
*) key
, p
[0]);
492 *sched
= (u_int8_t
*) p
;
497 des1_zerokey(u_int8_t
**sched
)
499 bzero(*sched
, sizeof (des_key_schedule
));
500 kfree(*sched
, M_CRYPTO_DATA
);
505 des3_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
507 des_cblock
*cb
= (des_cblock
*) blk
;
508 des_key_schedule
*p
= (des_key_schedule
*) key
;
510 des_ecb3_encrypt(cb
, cb
, p
[0], p
[1], p
[2], DES_ENCRYPT
);
514 des3_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
516 des_cblock
*cb
= (des_cblock
*) blk
;
517 des_key_schedule
*p
= (des_key_schedule
*) key
;
519 des_ecb3_encrypt(cb
, cb
, p
[0], p
[1], p
[2], DES_DECRYPT
);
523 des3_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
528 p
= kmalloc(3 * sizeof(des_key_schedule
),
529 M_CRYPTO_DATA
, M_INTWAIT
| M_ZERO
);
531 des_set_key((des_cblock
*)(key
+ 0), p
[0]);
532 des_set_key((des_cblock
*)(key
+ 8), p
[1]);
533 des_set_key((des_cblock
*)(key
+ 16), p
[2]);
537 *sched
= (u_int8_t
*) p
;
542 des3_zerokey(u_int8_t
**sched
)
544 bzero(*sched
, 3*sizeof (des_key_schedule
));
545 kfree(*sched
, M_CRYPTO_DATA
);
550 blf_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
554 memcpy(t
, blk
, sizeof (t
));
557 /* NB: BF_encrypt expects the block in host order! */
558 BF_encrypt(t
, (BF_KEY
*) key
);
561 memcpy(blk
, t
, sizeof (t
));
565 blf_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
569 memcpy(t
, blk
, sizeof (t
));
572 /* NB: BF_decrypt expects the block in host order! */
573 BF_decrypt(t
, (BF_KEY
*) key
);
576 memcpy(blk
, t
, sizeof (t
));
580 blf_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
584 *sched
= kmalloc(sizeof(BF_KEY
), M_CRYPTO_DATA
, M_INTWAIT
| M_ZERO
);
585 if (*sched
!= NULL
) {
586 BF_set_key((BF_KEY
*) *sched
, len
, key
);
594 blf_zerokey(u_int8_t
**sched
)
596 bzero(*sched
, sizeof(BF_KEY
));
597 kfree(*sched
, M_CRYPTO_DATA
);
602 cast5_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
604 cast_encrypt((cast_key
*) key
, blk
, blk
);
608 cast5_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
610 cast_decrypt((cast_key
*) key
, blk
, blk
);
614 cast5_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
618 *sched
= kmalloc(sizeof(cast_key
), M_CRYPTO_DATA
, M_INTWAIT
| M_ZERO
);
619 if (*sched
!= NULL
) {
620 cast_setkey((cast_key
*)*sched
, key
, len
);
628 cast5_zerokey(u_int8_t
**sched
)
630 bzero(*sched
, sizeof(cast_key
));
631 kfree(*sched
, M_CRYPTO_DATA
);
636 skipjack_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
638 skipjack_forwards(blk
, blk
, (u_int8_t
**) key
);
642 skipjack_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
644 skipjack_backwards(blk
, blk
, (u_int8_t
**) key
);
648 skipjack_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
652 /* NB: allocate all the memory that's needed at once */
653 *sched
= kmalloc(10 * (sizeof(u_int8_t
*) + 0x100),
654 M_CRYPTO_DATA
, M_INTWAIT
| M_ZERO
);
655 if (*sched
!= NULL
) {
656 u_int8_t
** key_tables
= (u_int8_t
**) *sched
;
657 u_int8_t
* table
= (u_int8_t
*) &key_tables
[10];
660 for (k
= 0; k
< 10; k
++) {
661 key_tables
[k
] = table
;
664 subkey_table_gen(key
, (u_int8_t
**) *sched
);
672 skipjack_zerokey(u_int8_t
**sched
)
674 bzero(*sched
, 10 * (sizeof(u_int8_t
*) + 0x100));
675 kfree(*sched
, M_CRYPTO_DATA
);
680 rijndael128_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
682 rijndael_encrypt((rijndael_ctx
*) key
, (u_char
*) blk
, (u_char
*) blk
);
686 rijndael128_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
688 rijndael_decrypt(((rijndael_ctx
*) key
), (u_char
*) blk
,
693 rijndael128_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
697 if (len
!= 16 && len
!= 24 && len
!= 32)
699 *sched
= kmalloc(sizeof(rijndael_ctx
), M_CRYPTO_DATA
,
701 if (*sched
!= NULL
) {
702 rijndael_set_key((rijndael_ctx
*) *sched
, (u_char
*) key
,
711 rijndael128_zerokey(u_int8_t
**sched
)
713 bzero(*sched
, sizeof(rijndael_ctx
));
714 kfree(*sched
, M_CRYPTO_DATA
);
718 #define AES_XTS_ALPHA 0x87 /* GF(2^128) generator polynomial */
726 aes_xts_reinit(caddr_t key
, u_int8_t
*iv
)
728 struct aes_xts_ctx
*ctx
= (struct aes_xts_ctx
*)key
;
736 * Prepare tweak as E_k2(IV). IV is specified as LE representation
737 * of a 64-bit block number which we allow to be passed in directly.
739 /* XXX: possibly use htole64? */
741 /* Last 64 bits of IV are always zero */
742 bzero(iv
+ AES_XTS_IV_LEN
, AES_XTS_IV_LEN
);
744 rijndael_encrypt(&ctx
->key2
, iv
, iv
);
748 aes_xts_crypt(struct aes_xts_ctx
*ctx
, u_int8_t
*data
, u_int8_t
*iv
, u_int do_encrypt
)
750 u_int8_t block
[AES_XTS_BLOCK_LEN
];
751 u_int i
, carry_in
, carry_out
;
753 for (i
= 0; i
< AES_XTS_BLOCK_LEN
; i
++)
754 block
[i
] = data
[i
] ^ iv
[i
];
757 rijndael_encrypt(&ctx
->key1
, block
, data
);
759 rijndael_decrypt(&ctx
->key1
, block
, data
);
761 for (i
= 0; i
< AES_XTS_BLOCK_LEN
; i
++)
764 /* Exponentiate tweak */
766 for (i
= 0; i
< AES_XTS_BLOCK_LEN
; i
++) {
767 carry_out
= iv
[i
] & 0x80;
768 iv
[i
] = (iv
[i
] << 1) | (carry_in
? 1 : 0);
769 carry_in
= carry_out
;
772 iv
[0] ^= AES_XTS_ALPHA
;
773 bzero(block
, sizeof(block
));
777 aes_xts_encrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
779 aes_xts_crypt((struct aes_xts_ctx
*)key
, data
, iv
, 1);
783 aes_xts_decrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
785 aes_xts_crypt((struct aes_xts_ctx
*)key
, data
, iv
, 0);
789 aes_xts_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
791 struct aes_xts_ctx
*ctx
;
793 if (len
!= 32 && len
!= 64)
796 *sched
= kmalloc(sizeof(struct aes_xts_ctx
), M_CRYPTO_DATA
,
798 ctx
= (struct aes_xts_ctx
*)*sched
;
800 rijndael_set_key(&ctx
->key1
, key
, len
* 4);
801 rijndael_set_key(&ctx
->key2
, key
+ (len
/ 2), len
* 4);
807 aes_xts_zerokey(u_int8_t
**sched
)
809 bzero(*sched
, sizeof(struct aes_xts_ctx
));
810 kfree(*sched
, M_CRYPTO_DATA
);
814 #define AESCTR_NONCESIZE 4
817 u_int32_t ac_ek
[4*(14 + 1)];
818 u_int8_t ac_block
[AESCTR_BLOCK_LEN
];
823 aes_ctr_reinit(caddr_t key
, u_int8_t
*iv
)
825 struct aes_ctr_ctx
*ctx
;
827 ctx
= (struct aes_ctr_ctx
*)key
;
828 bcopy(iv
, iv
+ AESCTR_NONCESIZE
, AESCTR_IV_LEN
);
829 bcopy(ctx
->ac_block
, iv
, AESCTR_NONCESIZE
);
832 bzero(iv
+ AESCTR_NONCESIZE
+ AESCTR_IV_LEN
, 4);
836 aes_ctr_crypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
838 struct aes_ctr_ctx
*ctx
;
839 u_int8_t keystream
[AESCTR_BLOCK_LEN
];
842 ctx
= (struct aes_ctr_ctx
*)key
;
843 /* increment counter */
844 for (i
= AESCTR_BLOCK_LEN
- 1;
845 i
>= AESCTR_NONCESIZE
+ AESCTR_IV_LEN
; i
--)
846 if (++iv
[i
]) /* continue on overflow */
848 rijndaelEncrypt(ctx
->ac_ek
, ctx
->ac_nr
, iv
, keystream
);
849 for (i
= 0; i
< AESCTR_BLOCK_LEN
; i
++)
850 data
[i
] ^= keystream
[i
];
851 bzero(keystream
, sizeof(keystream
));
855 aes_ctr_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
857 struct aes_ctr_ctx
*ctx
;
859 if (len
< AESCTR_NONCESIZE
)
862 *sched
= kmalloc(sizeof(struct aes_ctr_ctx
), M_CRYPTO_DATA
,
864 ctx
= (struct aes_ctr_ctx
*)*sched
;
865 ctx
->ac_nr
= rijndaelKeySetupEnc(ctx
->ac_ek
, (u_char
*)key
,
866 (len
- AESCTR_NONCESIZE
) * 8);
867 if (ctx
->ac_nr
== 0) {
868 aes_ctr_zerokey(sched
);
871 bcopy(key
+ len
- AESCTR_NONCESIZE
, ctx
->ac_block
, AESCTR_NONCESIZE
);
876 aes_ctr_zerokey(u_int8_t
**sched
)
878 bzero(*sched
, sizeof(struct aes_ctr_ctx
));
879 kfree(*sched
, M_CRYPTO_DATA
);
884 aes_gcm_reinit(caddr_t key
, u_int8_t
*iv
)
886 struct aes_ctr_ctx
*ctx
;
888 ctx
= (struct aes_ctr_ctx
*)key
;
889 bcopy(iv
, ctx
->ac_block
+ AESCTR_NONCESIZE
, AESCTR_IV_LEN
);
892 bzero(ctx
->ac_block
+ AESCTR_NONCESIZE
+ AESCTR_IV_LEN
, 4);
893 ctx
->ac_block
[AESCTR_BLOCK_LEN
- 1] = 1; /* GCM starts with 1 */
897 cml_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
899 camellia_encrypt((camellia_ctx
*) key
, (u_char
*) blk
, (u_char
*) blk
);
903 cml_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
905 camellia_decrypt(((camellia_ctx
*) key
), (u_char
*) blk
,
910 cml_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
914 if (len
!= 16 && len
!= 24 && len
!= 32)
916 *sched
= kmalloc(sizeof(camellia_ctx
), M_CRYPTO_DATA
,
918 if (*sched
!= NULL
) {
919 camellia_set_key((camellia_ctx
*) *sched
, (u_char
*) key
,
928 cml_zerokey(u_int8_t
**sched
)
930 bzero(*sched
, sizeof(camellia_ctx
));
931 kfree(*sched
, M_CRYPTO_DATA
);
936 twofish128_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
938 twofish_encrypt((twofish_ctx
*) key
, blk
, blk
);
942 twofish128_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
944 twofish_decrypt(((twofish_ctx
*) key
), blk
, blk
);
948 twofish128_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
952 if (len
!= 16 && len
!= 24 && len
!= 32)
954 *sched
= kmalloc(sizeof(twofish_ctx
), M_CRYPTO_DATA
,
956 if (*sched
!= NULL
) {
957 twofish_set_key((twofish_ctx
*) *sched
, key
, len
* 8);
965 twofish128_zerokey(u_int8_t
**sched
)
967 bzero(*sched
, sizeof(twofish_ctx
));
968 kfree(*sched
, M_CRYPTO_DATA
);
973 serpent128_encrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
975 serpent_encrypt((serpent_ctx
*) key
, blk
, blk
);
979 serpent128_decrypt(caddr_t key
, u_int8_t
*blk
, u_int8_t
*iv
)
981 serpent_decrypt(((serpent_ctx
*) key
), blk
, blk
);
985 serpent128_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
989 if (len
!= 16 && len
!= 24 && len
!= 32)
991 *sched
= kmalloc(sizeof(serpent_ctx
), M_CRYPTO_DATA
,
993 if (*sched
!= NULL
) {
994 serpent_set_key((serpent_ctx
*) *sched
, key
, len
* 8);
1002 serpent128_zerokey(u_int8_t
**sched
)
1004 bzero(*sched
, sizeof(serpent_ctx
));
1005 kfree(*sched
, M_CRYPTO_DATA
);
1010 struct twofish_xts_ctx
{
1016 twofish_xts_reinit(caddr_t key
, u_int8_t
*iv
)
1018 struct twofish_xts_ctx
*ctx
= (struct twofish_xts_ctx
*)key
;
1025 * Prepare tweak as E_k2(IV). IV is specified as LE representation
1026 * of a 64-bit block number which we allow to be passed in directly.
1028 /* XXX: possibly use htole64? */
1030 /* Last 64 bits of IV are always zero */
1031 bzero(iv
+ TWOFISH_XTS_IV_LEN
, TWOFISH_XTS_IV_LEN
);
1033 twofish_encrypt(&ctx
->key2
, iv
, iv
);
1037 twofish_xts_crypt(struct twofish_xts_ctx
*ctx
, u_int8_t
*data
, u_int8_t
*iv
,
1040 u_int8_t block
[TWOFISH_XTS_BLOCK_LEN
];
1041 u_int i
, carry_in
, carry_out
;
1043 for (i
= 0; i
< TWOFISH_XTS_BLOCK_LEN
; i
++)
1044 block
[i
] = data
[i
] ^ iv
[i
];
1047 twofish_encrypt(&ctx
->key1
, block
, data
);
1049 twofish_decrypt(&ctx
->key1
, block
, data
);
1051 for (i
= 0; i
< TWOFISH_XTS_BLOCK_LEN
; i
++)
1054 /* Exponentiate tweak */
1056 for (i
= 0; i
< TWOFISH_XTS_BLOCK_LEN
; i
++) {
1057 carry_out
= iv
[i
] & 0x80;
1058 iv
[i
] = (iv
[i
] << 1) | (carry_in
? 1 : 0);
1059 carry_in
= carry_out
;
1062 iv
[0] ^= AES_XTS_ALPHA
;
1063 bzero(block
, sizeof(block
));
1067 twofish_xts_encrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
1069 twofish_xts_crypt((struct twofish_xts_ctx
*)key
, data
, iv
, 1);
1073 twofish_xts_decrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
1075 twofish_xts_crypt((struct twofish_xts_ctx
*)key
, data
, iv
, 0);
1079 twofish_xts_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
1081 struct twofish_xts_ctx
*ctx
;
1083 if (len
!= 32 && len
!= 64)
1086 *sched
= kmalloc(sizeof(struct twofish_xts_ctx
), M_CRYPTO_DATA
,
1088 ctx
= (struct twofish_xts_ctx
*)*sched
;
1090 twofish_set_key(&ctx
->key1
, key
, len
* 4);
1091 twofish_set_key(&ctx
->key2
, key
+ (len
/ 2), len
* 4);
1097 twofish_xts_zerokey(u_int8_t
**sched
)
1099 bzero(*sched
, sizeof(struct twofish_xts_ctx
));
1100 kfree(*sched
, M_CRYPTO_DATA
);
1104 struct serpent_xts_ctx
{
1110 serpent_xts_reinit(caddr_t key
, u_int8_t
*iv
)
1112 struct serpent_xts_ctx
*ctx
= (struct serpent_xts_ctx
*)key
;
1120 * Prepare tweak as E_k2(IV). IV is specified as LE representation
1121 * of a 64-bit block number which we allow to be passed in directly.
1123 /* XXX: possibly use htole64? */
1125 /* Last 64 bits of IV are always zero */
1126 bzero(iv
+ SERPENT_XTS_IV_LEN
, SERPENT_XTS_IV_LEN
);
1128 serpent_encrypt(&ctx
->key2
, iv
, iv
);
1132 serpent_xts_crypt(struct serpent_xts_ctx
*ctx
, u_int8_t
*data
, u_int8_t
*iv
,
1135 u_int8_t block
[SERPENT_XTS_BLOCK_LEN
];
1136 u_int i
, carry_in
, carry_out
;
1138 for (i
= 0; i
< SERPENT_XTS_BLOCK_LEN
; i
++)
1139 block
[i
] = data
[i
] ^ iv
[i
];
1142 serpent_encrypt(&ctx
->key1
, block
, data
);
1144 serpent_decrypt(&ctx
->key1
, block
, data
);
1146 for (i
= 0; i
< SERPENT_XTS_BLOCK_LEN
; i
++)
1149 /* Exponentiate tweak */
1151 for (i
= 0; i
< SERPENT_XTS_BLOCK_LEN
; i
++) {
1152 carry_out
= iv
[i
] & 0x80;
1153 iv
[i
] = (iv
[i
] << 1) | (carry_in
? 1 : 0);
1154 carry_in
= carry_out
;
1157 iv
[0] ^= AES_XTS_ALPHA
;
1158 bzero(block
, sizeof(block
));
1162 serpent_xts_encrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
1164 serpent_xts_crypt((struct serpent_xts_ctx
*)key
, data
, iv
, 1);
1168 serpent_xts_decrypt(caddr_t key
, u_int8_t
*data
, u_int8_t
*iv
)
1170 serpent_xts_crypt((struct serpent_xts_ctx
*)key
, data
, iv
, 0);
1174 serpent_xts_setkey(u_int8_t
**sched
, u_int8_t
*key
, int len
)
1176 struct serpent_xts_ctx
*ctx
;
1178 if (len
!= 32 && len
!= 64)
1181 *sched
= kmalloc(sizeof(struct serpent_xts_ctx
), M_CRYPTO_DATA
,
1183 ctx
= (struct serpent_xts_ctx
*)*sched
;
1185 serpent_set_key(&ctx
->key1
, key
, len
* 4);
1186 serpent_set_key(&ctx
->key2
, key
+ (len
/ 2), len
* 4);
1192 serpent_xts_zerokey(u_int8_t
**sched
)
1194 bzero(*sched
, sizeof(struct serpent_xts_ctx
));
1195 kfree(*sched
, M_CRYPTO_DATA
);
1205 null_init(void *ctx
)
1210 null_update(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1216 null_final(u_int8_t
*buf
, void *ctx
)
1223 RMD160Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1225 RMD160Update(ctx
, buf
, len
);
1230 MD5Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1232 MD5Update(ctx
, buf
, len
);
1237 SHA1Init_int(void *ctx
)
1243 SHA1Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1245 SHA1Update(ctx
, buf
, len
);
1250 SHA1Final_int(u_int8_t
*blk
, void *ctx
)
1252 SHA1Final(blk
, ctx
);
1256 SHA256Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1258 SHA256_Update(ctx
, buf
, len
);
1263 SHA384Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1265 SHA384_Update(ctx
, buf
, len
);
1270 SHA512Update_int(void *ctx
, u_int8_t
*buf
, u_int16_t len
)
1272 SHA512_Update(ctx
, buf
, len
);
1281 deflate_compress(u_int8_t
*data
, u_int32_t size
, u_int8_t
**out
)
1283 return deflate_global(data
, size
, 0, out
);
1287 deflate_decompress(u_int8_t
*data
, u_int32_t size
, u_int8_t
**out
)
1289 return deflate_global(data
, size
, 1, out
);