crypto: Assume blocksize is a power of 2
[qemu/ar7.git] / crypto / cipher-nettle.c
blob0677fdfd335bf3928c93f6df16f7c1690853d708
1 /*
2 * QEMU Crypto cipher nettle algorithms
4 * Copyright (c) 2015 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #ifdef CONFIG_QEMU_PRIVATE_XTS
23 #include "crypto/xts.h"
24 #endif
25 #include "cipherpriv.h"
27 #include <nettle/nettle-types.h>
28 #include <nettle/aes.h>
29 #include <nettle/des.h>
30 #include <nettle/cbc.h>
31 #include <nettle/cast128.h>
32 #include <nettle/serpent.h>
33 #include <nettle/twofish.h>
34 #include <nettle/ctr.h>
35 #ifndef CONFIG_QEMU_PRIVATE_XTS
36 #include <nettle/xts.h>
37 #endif
39 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
40 size_t length,
41 uint8_t *dst,
42 const uint8_t *src);
44 #if CONFIG_NETTLE_VERSION_MAJOR < 3
45 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
46 typedef void * cipher_ctx_t;
47 typedef unsigned cipher_length_t;
49 #define cast5_set_key cast128_set_key
51 #define aes128_ctx aes_ctx
52 #define aes192_ctx aes_ctx
53 #define aes256_ctx aes_ctx
54 #define aes128_set_encrypt_key(c, k) \
55 aes_set_encrypt_key(c, 16, k)
56 #define aes192_set_encrypt_key(c, k) \
57 aes_set_encrypt_key(c, 24, k)
58 #define aes256_set_encrypt_key(c, k) \
59 aes_set_encrypt_key(c, 32, k)
60 #define aes128_set_decrypt_key(c, k) \
61 aes_set_decrypt_key(c, 16, k)
62 #define aes192_set_decrypt_key(c, k) \
63 aes_set_decrypt_key(c, 24, k)
64 #define aes256_set_decrypt_key(c, k) \
65 aes_set_decrypt_key(c, 32, k)
66 #define aes128_encrypt aes_encrypt
67 #define aes192_encrypt aes_encrypt
68 #define aes256_encrypt aes_encrypt
69 #define aes128_decrypt aes_decrypt
70 #define aes192_decrypt aes_decrypt
71 #define aes256_decrypt aes_decrypt
72 #else
73 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
74 typedef const void * cipher_ctx_t;
75 typedef size_t cipher_length_t;
76 #endif
78 typedef struct QCryptoNettleAES128 {
79 struct aes128_ctx enc;
80 struct aes128_ctx dec;
81 } QCryptoNettleAES128;
83 typedef struct QCryptoNettleAES192 {
84 struct aes192_ctx enc;
85 struct aes192_ctx dec;
86 } QCryptoNettleAES192;
88 typedef struct QCryptoNettleAES256 {
89 struct aes256_ctx enc;
90 struct aes256_ctx dec;
91 } QCryptoNettleAES256;
93 static void aes128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
94 uint8_t *dst, const uint8_t *src)
96 const QCryptoNettleAES128 *aesctx = ctx;
97 aes128_encrypt(&aesctx->enc, length, dst, src);
100 static void aes128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
101 uint8_t *dst, const uint8_t *src)
103 const QCryptoNettleAES128 *aesctx = ctx;
104 aes128_decrypt(&aesctx->dec, length, dst, src);
107 static void aes192_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
108 uint8_t *dst, const uint8_t *src)
110 const QCryptoNettleAES192 *aesctx = ctx;
111 aes192_encrypt(&aesctx->enc, length, dst, src);
114 static void aes192_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
115 uint8_t *dst, const uint8_t *src)
117 const QCryptoNettleAES192 *aesctx = ctx;
118 aes192_decrypt(&aesctx->dec, length, dst, src);
121 static void aes256_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
122 uint8_t *dst, const uint8_t *src)
124 const QCryptoNettleAES256 *aesctx = ctx;
125 aes256_encrypt(&aesctx->enc, length, dst, src);
128 static void aes256_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
129 uint8_t *dst, const uint8_t *src)
131 const QCryptoNettleAES256 *aesctx = ctx;
132 aes256_decrypt(&aesctx->dec, length, dst, src);
135 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
136 uint8_t *dst, const uint8_t *src)
138 des_encrypt(ctx, length, dst, src);
141 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
142 uint8_t *dst, const uint8_t *src)
144 des_decrypt(ctx, length, dst, src);
147 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
148 uint8_t *dst, const uint8_t *src)
150 des3_encrypt(ctx, length, dst, src);
153 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
154 uint8_t *dst, const uint8_t *src)
156 des3_decrypt(ctx, length, dst, src);
159 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
160 uint8_t *dst, const uint8_t *src)
162 cast128_encrypt(ctx, length, dst, src);
165 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
166 uint8_t *dst, const uint8_t *src)
168 cast128_decrypt(ctx, length, dst, src);
171 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
172 uint8_t *dst, const uint8_t *src)
174 serpent_encrypt(ctx, length, dst, src);
177 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
178 uint8_t *dst, const uint8_t *src)
180 serpent_decrypt(ctx, length, dst, src);
183 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
184 uint8_t *dst, const uint8_t *src)
186 twofish_encrypt(ctx, length, dst, src);
189 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
190 uint8_t *dst, const uint8_t *src)
192 twofish_decrypt(ctx, length, dst, src);
195 static void aes128_encrypt_wrapper(const void *ctx, size_t length,
196 uint8_t *dst, const uint8_t *src)
198 const QCryptoNettleAES128 *aesctx = ctx;
199 aes128_encrypt(&aesctx->enc, length, dst, src);
202 static void aes128_decrypt_wrapper(const void *ctx, size_t length,
203 uint8_t *dst, const uint8_t *src)
205 const QCryptoNettleAES128 *aesctx = ctx;
206 aes128_decrypt(&aesctx->dec, length, dst, src);
209 static void aes192_encrypt_wrapper(const void *ctx, size_t length,
210 uint8_t *dst, const uint8_t *src)
212 const QCryptoNettleAES192 *aesctx = ctx;
213 aes192_encrypt(&aesctx->enc, length, dst, src);
216 static void aes192_decrypt_wrapper(const void *ctx, size_t length,
217 uint8_t *dst, const uint8_t *src)
219 const QCryptoNettleAES192 *aesctx = ctx;
220 aes192_decrypt(&aesctx->dec, length, dst, src);
223 static void aes256_encrypt_wrapper(const void *ctx, size_t length,
224 uint8_t *dst, const uint8_t *src)
226 const QCryptoNettleAES256 *aesctx = ctx;
227 aes256_encrypt(&aesctx->enc, length, dst, src);
230 static void aes256_decrypt_wrapper(const void *ctx, size_t length,
231 uint8_t *dst, const uint8_t *src)
233 const QCryptoNettleAES256 *aesctx = ctx;
234 aes256_decrypt(&aesctx->dec, length, dst, src);
237 static void des_encrypt_wrapper(const void *ctx, size_t length,
238 uint8_t *dst, const uint8_t *src)
240 des_encrypt(ctx, length, dst, src);
243 static void des_decrypt_wrapper(const void *ctx, size_t length,
244 uint8_t *dst, const uint8_t *src)
246 des_decrypt(ctx, length, dst, src);
249 static void des3_encrypt_wrapper(const void *ctx, size_t length,
250 uint8_t *dst, const uint8_t *src)
252 des3_encrypt(ctx, length, dst, src);
255 static void des3_decrypt_wrapper(const void *ctx, size_t length,
256 uint8_t *dst, const uint8_t *src)
258 des3_decrypt(ctx, length, dst, src);
261 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
262 uint8_t *dst, const uint8_t *src)
264 cast128_encrypt(ctx, length, dst, src);
267 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
268 uint8_t *dst, const uint8_t *src)
270 cast128_decrypt(ctx, length, dst, src);
273 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
274 uint8_t *dst, const uint8_t *src)
276 serpent_encrypt(ctx, length, dst, src);
279 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
280 uint8_t *dst, const uint8_t *src)
282 serpent_decrypt(ctx, length, dst, src);
285 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
286 uint8_t *dst, const uint8_t *src)
288 twofish_encrypt(ctx, length, dst, src);
291 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
292 uint8_t *dst, const uint8_t *src)
294 twofish_decrypt(ctx, length, dst, src);
297 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
298 struct QCryptoCipherNettle {
299 /* Primary cipher context for all modes */
300 void *ctx;
301 /* Second cipher context for XTS mode only */
302 void *ctx_tweak;
303 /* Cipher callbacks for both contexts */
304 QCryptoCipherNettleFuncNative alg_encrypt_native;
305 QCryptoCipherNettleFuncNative alg_decrypt_native;
306 QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
307 QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
308 /* Initialization vector or Counter */
309 uint8_t *iv;
310 size_t blocksize;
313 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
314 QCryptoCipherMode mode)
316 switch (alg) {
317 case QCRYPTO_CIPHER_ALG_DES_RFB:
318 case QCRYPTO_CIPHER_ALG_3DES:
319 case QCRYPTO_CIPHER_ALG_AES_128:
320 case QCRYPTO_CIPHER_ALG_AES_192:
321 case QCRYPTO_CIPHER_ALG_AES_256:
322 case QCRYPTO_CIPHER_ALG_CAST5_128:
323 case QCRYPTO_CIPHER_ALG_SERPENT_128:
324 case QCRYPTO_CIPHER_ALG_SERPENT_192:
325 case QCRYPTO_CIPHER_ALG_SERPENT_256:
326 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
327 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
328 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
329 break;
330 default:
331 return false;
334 switch (mode) {
335 case QCRYPTO_CIPHER_MODE_ECB:
336 case QCRYPTO_CIPHER_MODE_CBC:
337 case QCRYPTO_CIPHER_MODE_XTS:
338 case QCRYPTO_CIPHER_MODE_CTR:
339 return true;
340 default:
341 return false;
346 static void
347 qcrypto_nettle_cipher_free_ctx(QCryptoCipherNettle *ctx)
349 if (!ctx) {
350 return;
353 g_free(ctx->iv);
354 g_free(ctx->ctx);
355 g_free(ctx->ctx_tweak);
356 g_free(ctx);
360 static QCryptoCipherNettle *qcrypto_cipher_ctx_new(QCryptoCipherAlgorithm alg,
361 QCryptoCipherMode mode,
362 const uint8_t *key,
363 size_t nkey,
364 Error **errp)
366 QCryptoCipherNettle *ctx;
367 uint8_t *rfbkey;
369 switch (mode) {
370 case QCRYPTO_CIPHER_MODE_ECB:
371 case QCRYPTO_CIPHER_MODE_CBC:
372 case QCRYPTO_CIPHER_MODE_XTS:
373 case QCRYPTO_CIPHER_MODE_CTR:
374 break;
375 default:
376 error_setg(errp, "Unsupported cipher mode %s",
377 QCryptoCipherMode_str(mode));
378 return NULL;
381 if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
382 return NULL;
385 ctx = g_new0(QCryptoCipherNettle, 1);
387 switch (alg) {
388 case QCRYPTO_CIPHER_ALG_DES_RFB:
389 ctx->ctx = g_new0(struct des_ctx, 1);
390 rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
391 des_set_key(ctx->ctx, rfbkey);
392 g_free(rfbkey);
394 ctx->alg_encrypt_native = des_encrypt_native;
395 ctx->alg_decrypt_native = des_decrypt_native;
396 ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
397 ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
399 ctx->blocksize = DES_BLOCK_SIZE;
400 break;
402 case QCRYPTO_CIPHER_ALG_3DES:
403 ctx->ctx = g_new0(struct des3_ctx, 1);
404 des3_set_key(ctx->ctx, key);
406 ctx->alg_encrypt_native = des3_encrypt_native;
407 ctx->alg_decrypt_native = des3_decrypt_native;
408 ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
409 ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
411 ctx->blocksize = DES3_BLOCK_SIZE;
412 break;
414 case QCRYPTO_CIPHER_ALG_AES_128:
415 ctx->ctx = g_new0(QCryptoNettleAES128, 1);
417 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
418 ctx->ctx_tweak = g_new0(QCryptoNettleAES128, 1);
420 nkey /= 2;
421 aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
422 key);
423 aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
424 key);
426 aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
427 enc, key + nkey);
428 aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
429 dec, key + nkey);
430 } else {
431 aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
432 key);
433 aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
434 key);
437 ctx->alg_encrypt_native = aes128_encrypt_native;
438 ctx->alg_decrypt_native = aes128_decrypt_native;
439 ctx->alg_encrypt_wrapper = aes128_encrypt_wrapper;
440 ctx->alg_decrypt_wrapper = aes128_decrypt_wrapper;
442 ctx->blocksize = AES_BLOCK_SIZE;
443 break;
445 case QCRYPTO_CIPHER_ALG_AES_192:
446 ctx->ctx = g_new0(QCryptoNettleAES192, 1);
448 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
449 ctx->ctx_tweak = g_new0(QCryptoNettleAES192, 1);
451 nkey /= 2;
452 aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
453 key);
454 aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
455 key);
457 aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
458 enc, key + nkey);
459 aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
460 dec, key + nkey);
461 } else {
462 aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
463 key);
464 aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
465 key);
468 ctx->alg_encrypt_native = aes192_encrypt_native;
469 ctx->alg_decrypt_native = aes192_decrypt_native;
470 ctx->alg_encrypt_wrapper = aes192_encrypt_wrapper;
471 ctx->alg_decrypt_wrapper = aes192_decrypt_wrapper;
473 ctx->blocksize = AES_BLOCK_SIZE;
474 break;
476 case QCRYPTO_CIPHER_ALG_AES_256:
477 ctx->ctx = g_new0(QCryptoNettleAES256, 1);
479 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
480 ctx->ctx_tweak = g_new0(QCryptoNettleAES256, 1);
482 nkey /= 2;
483 aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
484 key);
485 aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
486 key);
488 aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
489 enc, key + nkey);
490 aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
491 dec, key + nkey);
492 } else {
493 aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
494 key);
495 aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
496 key);
499 ctx->alg_encrypt_native = aes256_encrypt_native;
500 ctx->alg_decrypt_native = aes256_decrypt_native;
501 ctx->alg_encrypt_wrapper = aes256_encrypt_wrapper;
502 ctx->alg_decrypt_wrapper = aes256_decrypt_wrapper;
504 ctx->blocksize = AES_BLOCK_SIZE;
505 break;
507 case QCRYPTO_CIPHER_ALG_CAST5_128:
508 ctx->ctx = g_new0(struct cast128_ctx, 1);
510 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
511 ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
513 nkey /= 2;
514 cast5_set_key(ctx->ctx, nkey, key);
515 cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
516 } else {
517 cast5_set_key(ctx->ctx, nkey, key);
520 ctx->alg_encrypt_native = cast128_encrypt_native;
521 ctx->alg_decrypt_native = cast128_decrypt_native;
522 ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
523 ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
525 ctx->blocksize = CAST128_BLOCK_SIZE;
526 break;
528 case QCRYPTO_CIPHER_ALG_SERPENT_128:
529 case QCRYPTO_CIPHER_ALG_SERPENT_192:
530 case QCRYPTO_CIPHER_ALG_SERPENT_256:
531 ctx->ctx = g_new0(struct serpent_ctx, 1);
533 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
534 ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
536 nkey /= 2;
537 serpent_set_key(ctx->ctx, nkey, key);
538 serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
539 } else {
540 serpent_set_key(ctx->ctx, nkey, key);
543 ctx->alg_encrypt_native = serpent_encrypt_native;
544 ctx->alg_decrypt_native = serpent_decrypt_native;
545 ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
546 ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
548 ctx->blocksize = SERPENT_BLOCK_SIZE;
549 break;
551 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
552 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
553 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
554 ctx->ctx = g_new0(struct twofish_ctx, 1);
556 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
557 ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
559 nkey /= 2;
560 twofish_set_key(ctx->ctx, nkey, key);
561 twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
562 } else {
563 twofish_set_key(ctx->ctx, nkey, key);
566 ctx->alg_encrypt_native = twofish_encrypt_native;
567 ctx->alg_decrypt_native = twofish_decrypt_native;
568 ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
569 ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
571 ctx->blocksize = TWOFISH_BLOCK_SIZE;
572 break;
574 default:
575 error_setg(errp, "Unsupported cipher algorithm %s",
576 QCryptoCipherAlgorithm_str(alg));
577 goto error;
579 g_assert(is_power_of_2(ctx->blocksize));
581 if (mode == QCRYPTO_CIPHER_MODE_XTS &&
582 ctx->blocksize != XTS_BLOCK_SIZE) {
583 error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
584 ctx->blocksize, XTS_BLOCK_SIZE);
585 goto error;
588 ctx->iv = g_new0(uint8_t, ctx->blocksize);
590 return ctx;
592 error:
593 qcrypto_nettle_cipher_free_ctx(ctx);
594 return NULL;
598 static void
599 qcrypto_nettle_cipher_ctx_free(QCryptoCipher *cipher)
601 QCryptoCipherNettle *ctx;
603 ctx = cipher->opaque;
604 qcrypto_nettle_cipher_free_ctx(ctx);
608 static int
609 qcrypto_nettle_cipher_encrypt(QCryptoCipher *cipher,
610 const void *in,
611 void *out,
612 size_t len,
613 Error **errp)
615 QCryptoCipherNettle *ctx = cipher->opaque;
617 if (len & (ctx->blocksize - 1)) {
618 error_setg(errp, "Length %zu must be a multiple of block size %zu",
619 len, ctx->blocksize);
620 return -1;
623 switch (cipher->mode) {
624 case QCRYPTO_CIPHER_MODE_ECB:
625 ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
626 break;
628 case QCRYPTO_CIPHER_MODE_CBC:
629 cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
630 ctx->blocksize, ctx->iv,
631 len, out, in);
632 break;
634 case QCRYPTO_CIPHER_MODE_XTS:
635 #ifdef CONFIG_QEMU_PRIVATE_XTS
636 xts_encrypt(ctx->ctx, ctx->ctx_tweak,
637 ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
638 ctx->iv, len, out, in);
639 #else
640 xts_encrypt_message(ctx->ctx, ctx->ctx_tweak,
641 ctx->alg_encrypt_native,
642 ctx->iv, len, out, in);
643 #endif
644 break;
646 case QCRYPTO_CIPHER_MODE_CTR:
647 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
648 ctx->blocksize, ctx->iv,
649 len, out, in);
650 break;
652 default:
653 error_setg(errp, "Unsupported cipher mode %s",
654 QCryptoCipherMode_str(cipher->mode));
655 return -1;
657 return 0;
661 static int
662 qcrypto_nettle_cipher_decrypt(QCryptoCipher *cipher,
663 const void *in,
664 void *out,
665 size_t len,
666 Error **errp)
668 QCryptoCipherNettle *ctx = cipher->opaque;
670 if (len & (ctx->blocksize - 1)) {
671 error_setg(errp, "Length %zu must be a multiple of block size %zu",
672 len, ctx->blocksize);
673 return -1;
676 switch (cipher->mode) {
677 case QCRYPTO_CIPHER_MODE_ECB:
678 ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
679 break;
681 case QCRYPTO_CIPHER_MODE_CBC:
682 cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
683 ctx->blocksize, ctx->iv,
684 len, out, in);
685 break;
687 case QCRYPTO_CIPHER_MODE_XTS:
688 #ifdef CONFIG_QEMU_PRIVATE_XTS
689 xts_decrypt(ctx->ctx, ctx->ctx_tweak,
690 ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
691 ctx->iv, len, out, in);
692 #else
693 xts_decrypt_message(ctx->ctx, ctx->ctx_tweak,
694 ctx->alg_decrypt_native,
695 ctx->alg_encrypt_native,
696 ctx->iv, len, out, in);
697 #endif
698 break;
699 case QCRYPTO_CIPHER_MODE_CTR:
700 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
701 ctx->blocksize, ctx->iv,
702 len, out, in);
703 break;
705 default:
706 error_setg(errp, "Unsupported cipher mode %s",
707 QCryptoCipherMode_str(cipher->mode));
708 return -1;
710 return 0;
713 static int
714 qcrypto_nettle_cipher_setiv(QCryptoCipher *cipher,
715 const uint8_t *iv, size_t niv,
716 Error **errp)
718 QCryptoCipherNettle *ctx = cipher->opaque;
719 if (niv != ctx->blocksize) {
720 error_setg(errp, "Expected IV size %zu not %zu",
721 ctx->blocksize, niv);
722 return -1;
724 memcpy(ctx->iv, iv, niv);
725 return 0;
729 static struct QCryptoCipherDriver qcrypto_cipher_lib_driver = {
730 .cipher_encrypt = qcrypto_nettle_cipher_encrypt,
731 .cipher_decrypt = qcrypto_nettle_cipher_decrypt,
732 .cipher_setiv = qcrypto_nettle_cipher_setiv,
733 .cipher_free = qcrypto_nettle_cipher_ctx_free,