crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #ifdef CONFIG_QEMU_PRIVATE_XTS
  23 #include "crypto/xts.h"
  24 #endif
  25 #include "cipherpriv.h"
  26
  27 #include <nettle/nettle-types.h>
  28 #include <nettle/aes.h>
  29 #include <nettle/des.h>
  30 #include <nettle/cbc.h>
  31 #include <nettle/cast128.h>
  32 #include <nettle/serpent.h>
  33 #include <nettle/twofish.h>
  34 #include <nettle/ctr.h>
  35 #ifndef CONFIG_QEMU_PRIVATE_XTS
  36 #include <nettle/xts.h>
  37 #endif
  38
  39 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  40                                                size_t length,
  41                                                uint8_t *dst,
  42                                                const uint8_t *src);
  43
  44 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  45 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  46 typedef void *       cipher_ctx_t;
  47 typedef unsigned     cipher_length_t;
  48
  49 #define cast5_set_key cast128_set_key
  50
  51 #define aes128_ctx aes_ctx
  52 #define aes192_ctx aes_ctx
  53 #define aes256_ctx aes_ctx
  54 #define aes128_set_encrypt_key(c, k) \
  55     aes_set_encrypt_key(c, 16, k)
  56 #define aes192_set_encrypt_key(c, k) \
  57     aes_set_encrypt_key(c, 24, k)
  58 #define aes256_set_encrypt_key(c, k) \
  59     aes_set_encrypt_key(c, 32, k)
  60 #define aes128_set_decrypt_key(c, k) \
  61     aes_set_decrypt_key(c, 16, k)
  62 #define aes192_set_decrypt_key(c, k) \
  63     aes_set_decrypt_key(c, 24, k)
  64 #define aes256_set_decrypt_key(c, k) \
  65     aes_set_decrypt_key(c, 32, k)
  66 #define aes128_encrypt aes_encrypt
  67 #define aes192_encrypt aes_encrypt
  68 #define aes256_encrypt aes_encrypt
  69 #define aes128_decrypt aes_decrypt
  70 #define aes192_decrypt aes_decrypt
  71 #define aes256_decrypt aes_decrypt
  72 #else
  73 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  74 typedef const void * cipher_ctx_t;
  75 typedef size_t       cipher_length_t;
  76 #endif
  77
  78 typedef struct QCryptoNettleAES128 {
  79     struct aes128_ctx enc;
  80     struct aes128_ctx dec;
  81 } QCryptoNettleAES128;
  82
  83 typedef struct QCryptoNettleAES192 {
  84     struct aes192_ctx enc;
  85     struct aes192_ctx dec;
  86 } QCryptoNettleAES192;
  87
  88 typedef struct QCryptoNettleAES256 {
  89     struct aes256_ctx enc;
  90     struct aes256_ctx dec;
  91 } QCryptoNettleAES256;
  92
  93 static void aes128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  94                                   uint8_t *dst, const uint8_t *src)
  95 {
  96     const QCryptoNettleAES128 *aesctx = ctx;
  97     aes128_encrypt(&aesctx->enc, length, dst, src);
  98 }
  99
 100 static void aes128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 101                                   uint8_t *dst, const uint8_t *src)
 102 {
 103     const QCryptoNettleAES128 *aesctx = ctx;
 104     aes128_decrypt(&aesctx->dec, length, dst, src);
 105 }
 106
 107 static void aes192_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 108                                uint8_t *dst, const uint8_t *src)
 109 {
 110     const QCryptoNettleAES192 *aesctx = ctx;
 111     aes192_encrypt(&aesctx->enc, length, dst, src);
 112 }
 113
 114 static void aes192_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 115                                uint8_t *dst, const uint8_t *src)
 116 {
 117     const QCryptoNettleAES192 *aesctx = ctx;
 118     aes192_decrypt(&aesctx->dec, length, dst, src);
 119 }
 120
 121 static void aes256_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 122                                uint8_t *dst, const uint8_t *src)
 123 {
 124     const QCryptoNettleAES256 *aesctx = ctx;
 125     aes256_encrypt(&aesctx->enc, length, dst, src);
 126 }
 127
 128 static void aes256_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 129                                uint8_t *dst, const uint8_t *src)
 130 {
 131     const QCryptoNettleAES256 *aesctx = ctx;
 132     aes256_decrypt(&aesctx->dec, length, dst, src);
 133 }
 134
 135 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 136                                uint8_t *dst, const uint8_t *src)
 137 {
 138     des_encrypt(ctx, length, dst, src);
 139 }
 140
 141 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 142                                uint8_t *dst, const uint8_t *src)
 143 {
 144     des_decrypt(ctx, length, dst, src);
 145 }
 146
 147 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 148                                 uint8_t *dst, const uint8_t *src)
 149 {
 150     des3_encrypt(ctx, length, dst, src);
 151 }
 152
 153 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 154                                 uint8_t *dst, const uint8_t *src)
 155 {
 156     des3_decrypt(ctx, length, dst, src);
 157 }
 158
 159 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 160                                    uint8_t *dst, const uint8_t *src)
 161 {
 162     cast128_encrypt(ctx, length, dst, src);
 163 }
 164
 165 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 166                                    uint8_t *dst, const uint8_t *src)
 167 {
 168     cast128_decrypt(ctx, length, dst, src);
 169 }
 170
 171 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 172                                    uint8_t *dst, const uint8_t *src)
 173 {
 174     serpent_encrypt(ctx, length, dst, src);
 175 }
 176
 177 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 178                                    uint8_t *dst, const uint8_t *src)
 179 {
 180     serpent_decrypt(ctx, length, dst, src);
 181 }
 182
 183 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 184                                    uint8_t *dst, const uint8_t *src)
 185 {
 186     twofish_encrypt(ctx, length, dst, src);
 187 }
 188
 189 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 190                                    uint8_t *dst, const uint8_t *src)
 191 {
 192     twofish_decrypt(ctx, length, dst, src);
 193 }
 194
 195 static void aes128_encrypt_wrapper(const void *ctx, size_t length,
 196                                 uint8_t *dst, const uint8_t *src)
 197 {
 198     const QCryptoNettleAES128 *aesctx = ctx;
 199     aes128_encrypt(&aesctx->enc, length, dst, src);
 200 }
 201
 202 static void aes128_decrypt_wrapper(const void *ctx, size_t length,
 203                                 uint8_t *dst, const uint8_t *src)
 204 {
 205     const QCryptoNettleAES128 *aesctx = ctx;
 206     aes128_decrypt(&aesctx->dec, length, dst, src);
 207 }
 208
 209 static void aes192_encrypt_wrapper(const void *ctx, size_t length,
 210                                 uint8_t *dst, const uint8_t *src)
 211 {
 212     const QCryptoNettleAES192 *aesctx = ctx;
 213     aes192_encrypt(&aesctx->enc, length, dst, src);
 214 }
 215
 216 static void aes192_decrypt_wrapper(const void *ctx, size_t length,
 217                                 uint8_t *dst, const uint8_t *src)
 218 {
 219     const QCryptoNettleAES192 *aesctx = ctx;
 220     aes192_decrypt(&aesctx->dec, length, dst, src);
 221 }
 222
 223 static void aes256_encrypt_wrapper(const void *ctx, size_t length,
 224                                 uint8_t *dst, const uint8_t *src)
 225 {
 226     const QCryptoNettleAES256 *aesctx = ctx;
 227     aes256_encrypt(&aesctx->enc, length, dst, src);
 228 }
 229
 230 static void aes256_decrypt_wrapper(const void *ctx, size_t length,
 231                                 uint8_t *dst, const uint8_t *src)
 232 {
 233     const QCryptoNettleAES256 *aesctx = ctx;
 234     aes256_decrypt(&aesctx->dec, length, dst, src);
 235 }
 236
 237 static void des_encrypt_wrapper(const void *ctx, size_t length,
 238                                 uint8_t *dst, const uint8_t *src)
 239 {
 240     des_encrypt(ctx, length, dst, src);
 241 }
 242
 243 static void des_decrypt_wrapper(const void *ctx, size_t length,
 244                                 uint8_t *dst, const uint8_t *src)
 245 {
 246     des_decrypt(ctx, length, dst, src);
 247 }
 248
 249 static void des3_encrypt_wrapper(const void *ctx, size_t length,
 250                                 uint8_t *dst, const uint8_t *src)
 251 {
 252     des3_encrypt(ctx, length, dst, src);
 253 }
 254
 255 static void des3_decrypt_wrapper(const void *ctx, size_t length,
 256                                 uint8_t *dst, const uint8_t *src)
 257 {
 258     des3_decrypt(ctx, length, dst, src);
 259 }
 260
 261 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 262                                     uint8_t *dst, const uint8_t *src)
 263 {
 264     cast128_encrypt(ctx, length, dst, src);
 265 }
 266
 267 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 268                                     uint8_t *dst, const uint8_t *src)
 269 {
 270     cast128_decrypt(ctx, length, dst, src);
 271 }
 272
 273 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 274                                     uint8_t *dst, const uint8_t *src)
 275 {
 276     serpent_encrypt(ctx, length, dst, src);
 277 }
 278
 279 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 280                                     uint8_t *dst, const uint8_t *src)
 281 {
 282     serpent_decrypt(ctx, length, dst, src);
 283 }
 284
 285 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 286                                     uint8_t *dst, const uint8_t *src)
 287 {
 288     twofish_encrypt(ctx, length, dst, src);
 289 }
 290
 291 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 292                                     uint8_t *dst, const uint8_t *src)
 293 {
 294     twofish_decrypt(ctx, length, dst, src);
 295 }
 296
 297 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 298 struct QCryptoCipherNettle {
 299     /* Primary cipher context for all modes */
 300     void *ctx;
 301     /* Second cipher context for XTS mode only */
 302     void *ctx_tweak;
 303     /* Cipher callbacks for both contexts */
 304     QCryptoCipherNettleFuncNative alg_encrypt_native;
 305     QCryptoCipherNettleFuncNative alg_decrypt_native;
 306     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 307     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 308     /* Initialization vector or Counter */
 309     uint8_t *iv;
 310     size_t blocksize;
 311 };
 312
 313 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
 314                              QCryptoCipherMode mode)
 315 {
 316     switch (alg) {
 317     case QCRYPTO_CIPHER_ALG_DES_RFB:
 318     case QCRYPTO_CIPHER_ALG_3DES:
 319     case QCRYPTO_CIPHER_ALG_AES_128:
 320     case QCRYPTO_CIPHER_ALG_AES_192:
 321     case QCRYPTO_CIPHER_ALG_AES_256:
 322     case QCRYPTO_CIPHER_ALG_CAST5_128:
 323     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 324     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 325     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 326     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 327     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 328     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 329         break;
 330     default:
 331         return false;
 332     }
 333
 334     switch (mode) {
 335     case QCRYPTO_CIPHER_MODE_ECB:
 336     case QCRYPTO_CIPHER_MODE_CBC:
 337     case QCRYPTO_CIPHER_MODE_XTS:
 338     case QCRYPTO_CIPHER_MODE_CTR:
 339         return true;
 340     default:
 341         return false;
 342     }
 343 }
 344
 345
 346 static void
 347 qcrypto_nettle_cipher_free_ctx(QCryptoCipherNettle *ctx)
 348 {
 349     if (!ctx) {
 350         return;
 351     }
 352
 353     g_free(ctx->iv);
 354     g_free(ctx->ctx);
 355     g_free(ctx->ctx_tweak);
 356     g_free(ctx);
 357 }
 358
 359
 360 static QCryptoCipherNettle *qcrypto_cipher_ctx_new(QCryptoCipherAlgorithm alg,
 361                                                    QCryptoCipherMode mode,
 362                                                    const uint8_t *key,
 363                                                    size_t nkey,
 364                                                    Error **errp)
 365 {
 366     QCryptoCipherNettle *ctx;
 367     uint8_t *rfbkey;
 368
 369     switch (mode) {
 370     case QCRYPTO_CIPHER_MODE_ECB:
 371     case QCRYPTO_CIPHER_MODE_CBC:
 372     case QCRYPTO_CIPHER_MODE_XTS:
 373     case QCRYPTO_CIPHER_MODE_CTR:
 374         break;
 375     default:
 376         error_setg(errp, "Unsupported cipher mode %s",
 377                    QCryptoCipherMode_str(mode));
 378         return NULL;
 379     }
 380
 381     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 382         return NULL;
 383     }
 384
 385     ctx = g_new0(QCryptoCipherNettle, 1);
 386
 387     switch (alg) {
 388     case QCRYPTO_CIPHER_ALG_DES_RFB:
 389         ctx->ctx = g_new0(struct des_ctx, 1);
 390         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 391         des_set_key(ctx->ctx, rfbkey);
 392         g_free(rfbkey);
 393
 394         ctx->alg_encrypt_native = des_encrypt_native;
 395         ctx->alg_decrypt_native = des_decrypt_native;
 396         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 397         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 398
 399         ctx->blocksize = DES_BLOCK_SIZE;
 400         break;
 401
 402     case QCRYPTO_CIPHER_ALG_3DES:
 403         ctx->ctx = g_new0(struct des3_ctx, 1);
 404         des3_set_key(ctx->ctx, key);
 405
 406         ctx->alg_encrypt_native = des3_encrypt_native;
 407         ctx->alg_decrypt_native = des3_decrypt_native;
 408         ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
 409         ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
 410
 411         ctx->blocksize = DES3_BLOCK_SIZE;
 412         break;
 413
 414     case QCRYPTO_CIPHER_ALG_AES_128:
 415         ctx->ctx = g_new0(QCryptoNettleAES128, 1);
 416
 417         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 418             ctx->ctx_tweak = g_new0(QCryptoNettleAES128, 1);
 419
 420             nkey /= 2;
 421             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
 422                                    key);
 423             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
 424                                    key);
 425
 426             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
 427                                    enc, key + nkey);
 428             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx_tweak)->
 429                                    dec, key + nkey);
 430         } else {
 431             aes128_set_encrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->enc,
 432                                    key);
 433             aes128_set_decrypt_key(&((QCryptoNettleAES128 *)ctx->ctx)->dec,
 434                                    key);
 435         }
 436
 437         ctx->alg_encrypt_native = aes128_encrypt_native;
 438         ctx->alg_decrypt_native = aes128_decrypt_native;
 439         ctx->alg_encrypt_wrapper = aes128_encrypt_wrapper;
 440         ctx->alg_decrypt_wrapper = aes128_decrypt_wrapper;
 441
 442         ctx->blocksize = AES_BLOCK_SIZE;
 443         break;
 444
 445     case QCRYPTO_CIPHER_ALG_AES_192:
 446         ctx->ctx = g_new0(QCryptoNettleAES192, 1);
 447
 448         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 449             ctx->ctx_tweak = g_new0(QCryptoNettleAES192, 1);
 450
 451             nkey /= 2;
 452             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
 453                                    key);
 454             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
 455                                    key);
 456
 457             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
 458                                    enc, key + nkey);
 459             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx_tweak)->
 460                                    dec, key + nkey);
 461         } else {
 462             aes192_set_encrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->enc,
 463                                    key);
 464             aes192_set_decrypt_key(&((QCryptoNettleAES192 *)ctx->ctx)->dec,
 465                                    key);
 466         }
 467
 468         ctx->alg_encrypt_native = aes192_encrypt_native;
 469         ctx->alg_decrypt_native = aes192_decrypt_native;
 470         ctx->alg_encrypt_wrapper = aes192_encrypt_wrapper;
 471         ctx->alg_decrypt_wrapper = aes192_decrypt_wrapper;
 472
 473         ctx->blocksize = AES_BLOCK_SIZE;
 474         break;
 475
 476     case QCRYPTO_CIPHER_ALG_AES_256:
 477         ctx->ctx = g_new0(QCryptoNettleAES256, 1);
 478
 479         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 480             ctx->ctx_tweak = g_new0(QCryptoNettleAES256, 1);
 481
 482             nkey /= 2;
 483             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
 484                                    key);
 485             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
 486                                    key);
 487
 488             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
 489                                    enc, key + nkey);
 490             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx_tweak)->
 491                                    dec, key + nkey);
 492         } else {
 493             aes256_set_encrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->enc,
 494                                    key);
 495             aes256_set_decrypt_key(&((QCryptoNettleAES256 *)ctx->ctx)->dec,
 496                                    key);
 497         }
 498
 499         ctx->alg_encrypt_native = aes256_encrypt_native;
 500         ctx->alg_decrypt_native = aes256_decrypt_native;
 501         ctx->alg_encrypt_wrapper = aes256_encrypt_wrapper;
 502         ctx->alg_decrypt_wrapper = aes256_decrypt_wrapper;
 503
 504         ctx->blocksize = AES_BLOCK_SIZE;
 505         break;
 506
 507     case QCRYPTO_CIPHER_ALG_CAST5_128:
 508         ctx->ctx = g_new0(struct cast128_ctx, 1);
 509
 510         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 511             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 512
 513             nkey /= 2;
 514             cast5_set_key(ctx->ctx, nkey, key);
 515             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 516         } else {
 517             cast5_set_key(ctx->ctx, nkey, key);
 518         }
 519
 520         ctx->alg_encrypt_native = cast128_encrypt_native;
 521         ctx->alg_decrypt_native = cast128_decrypt_native;
 522         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 523         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 524
 525         ctx->blocksize = CAST128_BLOCK_SIZE;
 526         break;
 527
 528     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 529     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 530     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 531         ctx->ctx = g_new0(struct serpent_ctx, 1);
 532
 533         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 534             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 535
 536             nkey /= 2;
 537             serpent_set_key(ctx->ctx, nkey, key);
 538             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 539         } else {
 540             serpent_set_key(ctx->ctx, nkey, key);
 541         }
 542
 543         ctx->alg_encrypt_native = serpent_encrypt_native;
 544         ctx->alg_decrypt_native = serpent_decrypt_native;
 545         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 546         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 547
 548         ctx->blocksize = SERPENT_BLOCK_SIZE;
 549         break;
 550
 551     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 552     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 553     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 554         ctx->ctx = g_new0(struct twofish_ctx, 1);
 555
 556         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 557             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 558
 559             nkey /= 2;
 560             twofish_set_key(ctx->ctx, nkey, key);
 561             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 562         } else {
 563             twofish_set_key(ctx->ctx, nkey, key);
 564         }
 565
 566         ctx->alg_encrypt_native = twofish_encrypt_native;
 567         ctx->alg_decrypt_native = twofish_decrypt_native;
 568         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 569         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 570
 571         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 572         break;
 573
 574     default:
 575         error_setg(errp, "Unsupported cipher algorithm %s",
 576                    QCryptoCipherAlgorithm_str(alg));
 577         goto error;
 578     }
 579
 580     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 581         ctx->blocksize != XTS_BLOCK_SIZE) {
 582         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 583                    ctx->blocksize, XTS_BLOCK_SIZE);
 584         goto error;
 585     }
 586
 587     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 588
 589     return ctx;
 590
 591  error:
 592     qcrypto_nettle_cipher_free_ctx(ctx);
 593     return NULL;
 594 }
 595
 596
 597 static void
 598 qcrypto_nettle_cipher_ctx_free(QCryptoCipher *cipher)
 599 {
 600     QCryptoCipherNettle *ctx;
 601
 602     ctx = cipher->opaque;
 603     qcrypto_nettle_cipher_free_ctx(ctx);
 604 }
 605
 606
 607 static int
 608 qcrypto_nettle_cipher_encrypt(QCryptoCipher *cipher,
 609                               const void *in,
 610                               void *out,
 611                               size_t len,
 612                               Error **errp)
 613 {
 614     QCryptoCipherNettle *ctx = cipher->opaque;
 615
 616     if (len % ctx->blocksize) {
 617         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 618                    len, ctx->blocksize);
 619         return -1;
 620     }
 621
 622     switch (cipher->mode) {
 623     case QCRYPTO_CIPHER_MODE_ECB:
 624         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 625         break;
 626
 627     case QCRYPTO_CIPHER_MODE_CBC:
 628         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 629                     ctx->blocksize, ctx->iv,
 630                     len, out, in);
 631         break;
 632
 633     case QCRYPTO_CIPHER_MODE_XTS:
 634 #ifdef CONFIG_QEMU_PRIVATE_XTS
 635         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 636                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 637                     ctx->iv, len, out, in);
 638 #else
 639         xts_encrypt_message(ctx->ctx, ctx->ctx_tweak,
 640                             ctx->alg_encrypt_native,
 641                             ctx->iv, len, out, in);
 642 #endif
 643         break;
 644
 645     case QCRYPTO_CIPHER_MODE_CTR:
 646         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 647                     ctx->blocksize, ctx->iv,
 648                     len, out, in);
 649         break;
 650
 651     default:
 652         error_setg(errp, "Unsupported cipher mode %s",
 653                    QCryptoCipherMode_str(cipher->mode));
 654         return -1;
 655     }
 656     return 0;
 657 }
 658
 659
 660 static int
 661 qcrypto_nettle_cipher_decrypt(QCryptoCipher *cipher,
 662                               const void *in,
 663                               void *out,
 664                               size_t len,
 665                               Error **errp)
 666 {
 667     QCryptoCipherNettle *ctx = cipher->opaque;
 668
 669     if (len % ctx->blocksize) {
 670         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 671                    len, ctx->blocksize);
 672         return -1;
 673     }
 674
 675     switch (cipher->mode) {
 676     case QCRYPTO_CIPHER_MODE_ECB:
 677         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 678         break;
 679
 680     case QCRYPTO_CIPHER_MODE_CBC:
 681         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 682                     ctx->blocksize, ctx->iv,
 683                     len, out, in);
 684         break;
 685
 686     case QCRYPTO_CIPHER_MODE_XTS:
 687 #ifdef CONFIG_QEMU_PRIVATE_XTS
 688         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 689                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 690                     ctx->iv, len, out, in);
 691 #else
 692         xts_decrypt_message(ctx->ctx, ctx->ctx_tweak,
 693                             ctx->alg_decrypt_native,
 694                             ctx->alg_encrypt_native,
 695                             ctx->iv, len, out, in);
 696 #endif
 697         break;
 698     case QCRYPTO_CIPHER_MODE_CTR:
 699         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 700                     ctx->blocksize, ctx->iv,
 701                     len, out, in);
 702         break;
 703
 704     default:
 705         error_setg(errp, "Unsupported cipher mode %s",
 706                    QCryptoCipherMode_str(cipher->mode));
 707         return -1;
 708     }
 709     return 0;
 710 }
 711
 712 static int
 713 qcrypto_nettle_cipher_setiv(QCryptoCipher *cipher,
 714                             const uint8_t *iv, size_t niv,
 715                             Error **errp)
 716 {
 717     QCryptoCipherNettle *ctx = cipher->opaque;
 718     if (niv != ctx->blocksize) {
 719         error_setg(errp, "Expected IV size %zu not %zu",
 720                    ctx->blocksize, niv);
 721         return -1;
 722     }
 723     memcpy(ctx->iv, iv, niv);
 724     return 0;
 725 }
 726
 727
 728 static struct QCryptoCipherDriver qcrypto_cipher_lib_driver = {
 729     .cipher_encrypt = qcrypto_nettle_cipher_encrypt,
 730     .cipher_decrypt = qcrypto_nettle_cipher_decrypt,
 731     .cipher_setiv = qcrypto_nettle_cipher_setiv,
 732     .cipher_free = qcrypto_nettle_cipher_ctx_free,
 733 };