crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/xts.h"
  23 #include "cipherpriv.h"
  24
  25 #include <nettle/nettle-types.h>
  26 #include <nettle/aes.h>
  27 #include <nettle/des.h>
  28 #include <nettle/cbc.h>
  29 #include <nettle/cast128.h>
  30 #include <nettle/serpent.h>
  31 #include <nettle/twofish.h>
  32 #include <nettle/ctr.h>
  33
  34 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  35                                                size_t length,
  36                                                uint8_t *dst,
  37                                                const uint8_t *src);
  38
  39 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  40 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  41 typedef void *       cipher_ctx_t;
  42 typedef unsigned     cipher_length_t;
  43
  44 #define cast5_set_key cast128_set_key
  45
  46 #define aes128_ctx aes_ctx
  47 #define aes192_ctx aes_ctx
  48 #define aes256_ctx aes_ctx
  49 #define aes128_set_encrypt_key(c, k) \
  50     aes_set_encrypt_key(c, 16, k)
  51 #define aes192_set_encrypt_key(c, k) \
  52     aes_set_encrypt_key(c, 24, k)
  53 #define aes256_set_encrypt_key(c, k) \
  54     aes_set_encrypt_key(c, 32, k)
  55 #define aes128_set_decrypt_key(c, k) \
  56     aes_set_decrypt_key(c, 16, k)
  57 #define aes192_set_decrypt_key(c, k) \
  58     aes_set_decrypt_key(c, 24, k)
  59 #define aes256_set_decrypt_key(c, k) \
  60     aes_set_decrypt_key(c, 32, k)
  61 #define aes128_encrypt aes_encrypt
  62 #define aes192_encrypt aes_encrypt
  63 #define aes256_encrypt aes_encrypt
  64 #define aes128_decrypt aes_decrypt
  65 #define aes192_decrypt aes_decrypt
  66 #define aes256_decrypt aes_decrypt
  67 #else
  68 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  69 typedef const void * cipher_ctx_t;
  70 typedef size_t       cipher_length_t;
  71 #endif
  72
  73 typedef struct QCryptoNettleAES128 {
  74     struct aes128_ctx enc;
  75     struct aes128_ctx dec;
  76 } QCryptoNettleAES128;
  77
  78 typedef struct QCryptoNettleAES192 {
  79     struct aes192_ctx enc;
  80     struct aes192_ctx dec;
  81 } QCryptoNettleAES192;
  82
  83 typedef struct QCryptoNettleAES256 {
  84     struct aes256_ctx enc;
  85     struct aes256_ctx dec;
  86 } QCryptoNettleAES256;
  87
  88 static void aes128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  89                                   uint8_t *dst, const uint8_t *src)
  90 {
  91     const QCryptoNettleAES128 *aesctx = ctx;
  92     aes128_encrypt(&aesctx->enc, length, dst, src);
  93 }
  94
  95 static void aes128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  96                                   uint8_t *dst, const uint8_t *src)
  97 {
  98     const QCryptoNettleAES128 *aesctx = ctx;
  99     aes128_decrypt(&aesctx->dec, length, dst, src);
 100 }
 101
 102 static void aes192_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 103                                uint8_t *dst, const uint8_t *src)
 104 {
 105     const QCryptoNettleAES192 *aesctx = ctx;
 106     aes192_encrypt(&aesctx->enc, length, dst, src);
 107 }
 108
 109 static void aes192_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 110                                uint8_t *dst, const uint8_t *src)
 111 {
 112     const QCryptoNettleAES192 *aesctx = ctx;
 113     aes192_decrypt(&aesctx->dec, length, dst, src);
 114 }
 115
 116 static void aes256_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 117                                uint8_t *dst, const uint8_t *src)
 118 {
 119     const QCryptoNettleAES256 *aesctx = ctx;
 120     aes256_encrypt(&aesctx->enc, length, dst, src);
 121 }
 122
 123 static void aes256_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 124                                uint8_t *dst, const uint8_t *src)
 125 {
 126     const QCryptoNettleAES256 *aesctx = ctx;
 127     aes256_decrypt(&aesctx->dec, length, dst, src);
 128 }
 129
 130 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 131                                uint8_t *dst, const uint8_t *src)
 132 {
 133     des_encrypt(ctx, length, dst, src);
 134 }
 135
 136 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 137                                uint8_t *dst, const uint8_t *src)
 138 {
 139     des_decrypt(ctx, length, dst, src);
 140 }
 141
 142 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 143                                 uint8_t *dst, const uint8_t *src)
 144 {
 145     des3_encrypt(ctx, length, dst, src);
 146 }
 147
 148 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 149                                 uint8_t *dst, const uint8_t *src)
 150 {
 151     des3_decrypt(ctx, length, dst, src);
 152 }
 153
 154 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 155                                    uint8_t *dst, const uint8_t *src)
 156 {
 157     cast128_encrypt(ctx, length, dst, src);
 158 }
 159
 160 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 161                                    uint8_t *dst, const uint8_t *src)
 162 {
 163     cast128_decrypt(ctx, length, dst, src);
 164 }
 165
 166 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 167                                    uint8_t *dst, const uint8_t *src)
 168 {
 169     serpent_encrypt(ctx, length, dst, src);
 170 }
 171
 172 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 173                                    uint8_t *dst, const uint8_t *src)
 174 {
 175     serpent_decrypt(ctx, length, dst, src);
 176 }
 177
 178 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 179                                    uint8_t *dst, const uint8_t *src)
 180 {
 181     twofish_encrypt(ctx, length, dst, src);
 182 }
 183
 184 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 185                                    uint8_t *dst, const uint8_t *src)
 186 {
 187     twofish_decrypt(ctx, length, dst, src);
 188 }
 189
 190 static void aes128_encrypt_wrapper(const void *ctx, size_t length,
 191                                 uint8_t *dst, const uint8_t *src)
 192 {
 193     const QCryptoNettleAES128 *aesctx = ctx;
 194     aes128_encrypt(&aesctx->enc, length, dst, src);
 195 }
 196
 197 static void aes128_decrypt_wrapper(const void *ctx, size_t length,
 198                                 uint8_t *dst, const uint8_t *src)
 199 {
 200     const QCryptoNettleAES128 *aesctx = ctx;
 201     aes128_decrypt(&aesctx->dec, length, dst, src);
 202 }
 203
 204 static void aes192_encrypt_wrapper(const void *ctx, size_t length,
 205                                 uint8_t *dst, const uint8_t *src)
 206 {
 207     const QCryptoNettleAES192 *aesctx = ctx;
 208     aes192_encrypt(&aesctx->enc, length, dst, src);
 209 }
 210
 211 static void aes192_decrypt_wrapper(const void *ctx, size_t length,
 212                                 uint8_t *dst, const uint8_t *src)
 213 {
 214     const QCryptoNettleAES192 *aesctx = ctx;
 215     aes192_decrypt(&aesctx->dec, length, dst, src);
 216 }
 217
 218 static void aes256_encrypt_wrapper(const void *ctx, size_t length,
 219                                 uint8_t *dst, const uint8_t *src)
 220 {
 221     const QCryptoNettleAES256 *aesctx = ctx;
 222     aes256_encrypt(&aesctx->enc, length, dst, src);
 223 }
 224
 225 static void aes256_decrypt_wrapper(const void *ctx, size_t length,
 226                                 uint8_t *dst, const uint8_t *src)
 227 {
 228     const QCryptoNettleAES256 *aesctx = ctx;
 229     aes256_decrypt(&aesctx->dec, length, dst, src);
 230 }
 231
 232 static void des_encrypt_wrapper(const void *ctx, size_t length,
 233                                 uint8_t *dst, const uint8_t *src)
 234 {
 235     des_encrypt(ctx, length, dst, src);
 236 }
 237
 238 static void des_decrypt_wrapper(const void *ctx, size_t length,
 239                                 uint8_t *dst, const uint8_t *src)
 240 {
 241     des_decrypt(ctx, length, dst, src);
 242 }
 243
 244 static void des3_encrypt_wrapper(const void *ctx, size_t length,
 245                                 uint8_t *dst, const uint8_t *src)
 246 {
 247     des3_encrypt(ctx, length, dst, src);
 248 }
 249
 250 static void des3_decrypt_wrapper(const void *ctx, size_t length,
 251                                 uint8_t *dst, const uint8_t *src)
 252 {
 253     des3_decrypt(ctx, length, dst, src);
 254 }
 255
 256 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 257                                     uint8_t *dst, const uint8_t *src)
 258 {
 259     cast128_encrypt(ctx, length, dst, src);
 260 }
 261
 262 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 263                                     uint8_t *dst, const uint8_t *src)
 264 {
 265     cast128_decrypt(ctx, length, dst, src);
 266 }
 267
 268 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 269                                     uint8_t *dst, const uint8_t *src)
 270 {
 271     serpent_encrypt(ctx, length, dst, src);
 272 }
 273
 274 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 275                                     uint8_t *dst, const uint8_t *src)
 276 {
 277     serpent_decrypt(ctx, length, dst, src);
 278 }
 279
 280 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 281                                     uint8_t *dst, const uint8_t *src)
 282 {
 283     twofish_encrypt(ctx, length, dst, src);
 284 }
 285
 286 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 287                                     uint8_t *dst, const uint8_t *src)
 288 {
 289     twofish_decrypt(ctx, length, dst, src);
 290 }
 291
 292 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 293 struct QCryptoCipherNettle {
 294     /* Primary cipher context for all modes */
 295     void *ctx;
 296     /* Second cipher context for XTS mode only */
 297     void *ctx_tweak;
 298     /* Cipher callbacks for both contexts */
 299     QCryptoCipherNettleFuncNative alg_encrypt_native;
 300     QCryptoCipherNettleFuncNative alg_decrypt_native;
 301     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 302     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 303     /* Initialization vector or Counter */
 304     uint8_t *iv;
 305     size_t blocksize;
 306 };
 307
 308 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
 309                              QCryptoCipherMode mode)
 310 {
 311     switch (alg) {
 312     case QCRYPTO_CIPHER_ALG_DES_RFB:
 313     case QCRYPTO_CIPHER_ALG_3DES:
 314     case QCRYPTO_CIPHER_ALG_AES_128:
 315     case QCRYPTO_CIPHER_ALG_AES_192:
 316     case QCRYPTO_CIPHER_ALG_AES_256:
 317     case QCRYPTO_CIPHER_ALG_CAST5_128:
 318     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 319     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 320     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 321     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 322     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 323     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 324         break;
 325     default:
 326         return false;
 327     }
 328
 329     switch (mode) {
 330     case QCRYPTO_CIPHER_MODE_ECB:
 331     case QCRYPTO_CIPHER_MODE_CBC:
 332     case QCRYPTO_CIPHER_MODE_XTS:
 333     case QCRYPTO_CIPHER_MODE_CTR:
 334         return true;
 335     default:
 336         return false;
 337     }
 338 }
 339
 340
 341 static void
 342 qcrypto_nettle_cipher_free_ctx(QCryptoCipherNettle *ctx)
 343 {
 344     if (!ctx) {
 345         return;
 346     }
 347
 348     g_free(ctx->iv);
 349     g_free(ctx->ctx);
 350     g_free(ctx->ctx_tweak);
 351     g_free(ctx);
 352 }
 353
 354
 355 static QCryptoCipherNettle *qcrypto_cipher_ctx_new(QCryptoCipherAlgorithm alg,
 356                                                    QCryptoCipherMode mode,
 357                                                    const uint8_t *key,
 358                                                    size_t nkey,
 359                                                    Error **errp)
 360 {
 361     QCryptoCipherNettle *ctx;
 362     uint8_t *rfbkey;
 363
 364     switch (mode) {
 365     case QCRYPTO_CIPHER_MODE_ECB:
 366     case QCRYPTO_CIPHER_MODE_CBC:
 367     case QCRYPTO_CIPHER_MODE_XTS:
 368     case QCRYPTO_CIPHER_MODE_CTR:
 369         break;
 370     default:
 371         error_setg(errp, "Unsupported cipher mode %s",
 372                    QCryptoCipherMode_str(mode));
 373         return NULL;
 374     }
 375
 376     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 377         return NULL;
 378     }
 379
 380     ctx = g_new0(QCryptoCipherNettle, 1);
 381
 382     switch (alg) {
 383     case QCRYPTO_CIPHER_ALG_DES_RFB:
 384         ctx->ctx = g_new0(struct des_ctx, 1);
 385         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 386         des_set_key(ctx->ctx, rfbkey);
 387         g_free(rfbkey);
 388
 389         ctx->alg_encrypt_native = des_encrypt_native;
 390         ctx->alg_decrypt_native = des_decrypt_native;
 391         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 392         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 393
 394         ctx->blocksize = DES_BLOCK_SIZE;
 395         break;
 396
 397     case QCRYPTO_CIPHER_ALG_3DES:
 398         ctx->ctx = g_new0(struct des3_ctx, 1);
 399         des3_set_key(ctx->ctx, key);
 400
 401         ctx->alg_encrypt_native = des3_encrypt_native;
 402         ctx->alg_decrypt_native = des3_decrypt_native;
 403         ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
 404         ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
 405
 406         ctx->blocksize = DES3_BLOCK_SIZE;
 407         break;
 408
 409     case QCRYPTO_CIPHER_ALG_AES_128:
 410         ctx->ctx = g_new0(QCryptoNettleAES128, 1);
 411
 412         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 413             ctx->ctx_tweak = g_new0(QCryptoNettleAES128, 1);
 414
 415             nkey /= 2;
 416             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
 417                                    key);
 418             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
 419                                    key);
 420
 421             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
 422                                    enc, key + nkey);
 423             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
 424                                    dec, key + nkey);
 425         } else {
 426             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
 427                                    key);
 428             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
 429                                    key);
 430         }
 431
 432         ctx->alg_encrypt_native = aes128_encrypt_native;
 433         ctx->alg_decrypt_native = aes128_decrypt_native;
 434         ctx->alg_encrypt_wrapper = aes128_encrypt_wrapper;
 435         ctx->alg_decrypt_wrapper = aes128_decrypt_wrapper;
 436
 437         ctx->blocksize = AES_BLOCK_SIZE;
 438         break;
 439
 440     case QCRYPTO_CIPHER_ALG_AES_192:
 441         ctx->ctx = g_new0(QCryptoNettleAES192, 1);
 442
 443         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 444             ctx->ctx_tweak = g_new0(QCryptoNettleAES192, 1);
 445
 446             nkey /= 2;
 447             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
 448                                    key);
 449             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
 450                                    key);
 451
 452             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
 453                                    enc, key + nkey);
 454             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
 455                                    dec, key + nkey);
 456         } else {
 457             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
 458                                    key);
 459             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
 460                                    key);
 461         }
 462
 463         ctx->alg_encrypt_native = aes192_encrypt_native;
 464         ctx->alg_decrypt_native = aes192_decrypt_native;
 465         ctx->alg_encrypt_wrapper = aes192_encrypt_wrapper;
 466         ctx->alg_decrypt_wrapper = aes192_decrypt_wrapper;
 467
 468         ctx->blocksize = AES_BLOCK_SIZE;
 469         break;
 470
 471     case QCRYPTO_CIPHER_ALG_AES_256:
 472         ctx->ctx = g_new0(QCryptoNettleAES256, 1);
 473
 474         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 475             ctx->ctx_tweak = g_new0(QCryptoNettleAES256, 1);
 476
 477             nkey /= 2;
 478             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
 479                                    key);
 480             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
 481                                    key);
 482
 483             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
 484                                    enc, key + nkey);
 485             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
 486                                    dec, key + nkey);
 487         } else {
 488             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
 489                                    key);
 490             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
 491                                    key);
 492         }
 493
 494         ctx->alg_encrypt_native = aes256_encrypt_native;
 495         ctx->alg_decrypt_native = aes256_decrypt_native;
 496         ctx->alg_encrypt_wrapper = aes256_encrypt_wrapper;
 497         ctx->alg_decrypt_wrapper = aes256_decrypt_wrapper;
 498
 499         ctx->blocksize = AES_BLOCK_SIZE;
 500         break;
 501
 502     case QCRYPTO_CIPHER_ALG_CAST5_128:
 503         ctx->ctx = g_new0(struct cast128_ctx, 1);
 504
 505         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 506             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 507
 508             nkey /= 2;
 509             cast5_set_key(ctx->ctx, nkey, key);
 510             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 511         } else {
 512             cast5_set_key(ctx->ctx, nkey, key);
 513         }
 514
 515         ctx->alg_encrypt_native = cast128_encrypt_native;
 516         ctx->alg_decrypt_native = cast128_decrypt_native;
 517         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 518         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 519
 520         ctx->blocksize = CAST128_BLOCK_SIZE;
 521         break;
 522
 523     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 524     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 525     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 526         ctx->ctx = g_new0(struct serpent_ctx, 1);
 527
 528         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 529             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 530
 531             nkey /= 2;
 532             serpent_set_key(ctx->ctx, nkey, key);
 533             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 534         } else {
 535             serpent_set_key(ctx->ctx, nkey, key);
 536         }
 537
 538         ctx->alg_encrypt_native = serpent_encrypt_native;
 539         ctx->alg_decrypt_native = serpent_decrypt_native;
 540         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 541         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 542
 543         ctx->blocksize = SERPENT_BLOCK_SIZE;
 544         break;
 545
 546     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 547     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 548     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 549         ctx->ctx = g_new0(struct twofish_ctx, 1);
 550
 551         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 552             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 553
 554             nkey /= 2;
 555             twofish_set_key(ctx->ctx, nkey, key);
 556             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 557         } else {
 558             twofish_set_key(ctx->ctx, nkey, key);
 559         }
 560
 561         ctx->alg_encrypt_native = twofish_encrypt_native;
 562         ctx->alg_decrypt_native = twofish_decrypt_native;
 563         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 564         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 565
 566         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 567         break;
 568
 569     default:
 570         error_setg(errp, "Unsupported cipher algorithm %s",
 571                    QCryptoCipherAlgorithm_str(alg));
 572         goto error;
 573     }
 574
 575     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 576         ctx->blocksize != XTS_BLOCK_SIZE) {
 577         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 578                    ctx->blocksize, XTS_BLOCK_SIZE);
 579         goto error;
 580     }
 581
 582     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 583
 584     return ctx;
 585
 586  error:
 587     qcrypto_nettle_cipher_free_ctx(ctx);
 588     return NULL;
 589 }
 590
 591
 592 static void
 593 qcrypto_nettle_cipher_ctx_free(QCryptoCipher *cipher)
 594 {
 595     QCryptoCipherNettle *ctx;
 596
 597     ctx = cipher->opaque;
 598     qcrypto_nettle_cipher_free_ctx(ctx);
 599 }
 600
 601
 602 static int
 603 qcrypto_nettle_cipher_encrypt(QCryptoCipher *cipher,
 604                               const void *in,
 605                               void *out,
 606                               size_t len,
 607                               Error **errp)
 608 {
 609     QCryptoCipherNettle *ctx = cipher->opaque;
 610
 611     if (len % ctx->blocksize) {
 612         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 613                    len, ctx->blocksize);
 614         return -1;
 615     }
 616
 617     switch (cipher->mode) {
 618     case QCRYPTO_CIPHER_MODE_ECB:
 619         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 620         break;
 621
 622     case QCRYPTO_CIPHER_MODE_CBC:
 623         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 624                     ctx->blocksize, ctx->iv,
 625                     len, out, in);
 626         break;
 627
 628     case QCRYPTO_CIPHER_MODE_XTS:
 629         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 630                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 631                     ctx->iv, len, out, in);
 632         break;
 633
 634     case QCRYPTO_CIPHER_MODE_CTR:
 635         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 636                     ctx->blocksize, ctx->iv,
 637                     len, out, in);
 638         break;
 639
 640     default:
 641         error_setg(errp, "Unsupported cipher mode %s",
 642                    QCryptoCipherMode_str(cipher->mode));
 643         return -1;
 644     }
 645     return 0;
 646 }
 647
 648
 649 static int
 650 qcrypto_nettle_cipher_decrypt(QCryptoCipher *cipher,
 651                               const void *in,
 652                               void *out,
 653                               size_t len,
 654                               Error **errp)
 655 {
 656     QCryptoCipherNettle *ctx = cipher->opaque;
 657
 658     if (len % ctx->blocksize) {
 659         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 660                    len, ctx->blocksize);
 661         return -1;
 662     }
 663
 664     switch (cipher->mode) {
 665     case QCRYPTO_CIPHER_MODE_ECB:
 666         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 667         break;
 668
 669     case QCRYPTO_CIPHER_MODE_CBC:
 670         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 671                     ctx->blocksize, ctx->iv,
 672                     len, out, in);
 673         break;
 674
 675     case QCRYPTO_CIPHER_MODE_XTS:
 676         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 677                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 678                     ctx->iv, len, out, in);
 679         break;
 680     case QCRYPTO_CIPHER_MODE_CTR:
 681         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 682                     ctx->blocksize, ctx->iv,
 683                     len, out, in);
 684         break;
 685
 686     default:
 687         error_setg(errp, "Unsupported cipher mode %s",
 688                    QCryptoCipherMode_str(cipher->mode));
 689         return -1;
 690     }
 691     return 0;
 692 }
 693
 694 static int
 695 qcrypto_nettle_cipher_setiv(QCryptoCipher *cipher,
 696                             const uint8_t *iv, size_t niv,
 697                             Error **errp)
 698 {
 699     QCryptoCipherNettle *ctx = cipher->opaque;
 700     if (niv != ctx->blocksize) {
 701         error_setg(errp, "Expected IV size %zu not %zu",
 702                    ctx->blocksize, niv);
 703         return -1;
 704     }
 705     memcpy(ctx->iv, iv, niv);
 706     return 0;
 707 }
 708
 709
 710 static struct QCryptoCipherDriver qcrypto_cipher_lib_driver = {
 711     .cipher_encrypt = qcrypto_nettle_cipher_encrypt,
 712     .cipher_decrypt = qcrypto_nettle_cipher_decrypt,
 713     .cipher_setiv = qcrypto_nettle_cipher_setiv,
 714     .cipher_free = qcrypto_nettle_cipher_ctx_free,
 715 };