crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/xts.h"
  23
  24 #include <nettle/nettle-types.h>
  25 #include <nettle/aes.h>
  26 #include <nettle/des.h>
  27 #include <nettle/cbc.h>
  28 #include <nettle/cast128.h>
  29 #include <nettle/serpent.h>
  30 #include <nettle/twofish.h>
  31 #include <nettle/ctr.h>
  32
  33 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  34                                                size_t length,
  35                                                uint8_t *dst,
  36                                                const uint8_t *src);
  37
  38 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  39 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  40 typedef void *       cipher_ctx_t;
  41 typedef unsigned     cipher_length_t;
  42
  43 #define cast5_set_key cast128_set_key
  44 #else
  45 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  46 typedef const void * cipher_ctx_t;
  47 typedef size_t       cipher_length_t;
  48 #endif
  49
  50 typedef struct QCryptoNettleAES {
  51     struct aes_ctx enc;
  52     struct aes_ctx dec;
  53 } QCryptoNettleAES;
  54
  55 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  56                                uint8_t *dst, const uint8_t *src)
  57 {
  58     const QCryptoNettleAES *aesctx = ctx;
  59     aes_encrypt(&aesctx->enc, length, dst, src);
  60 }
  61
  62 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  63                                uint8_t *dst, const uint8_t *src)
  64 {
  65     const QCryptoNettleAES *aesctx = ctx;
  66     aes_decrypt(&aesctx->dec, length, dst, src);
  67 }
  68
  69 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  70                                uint8_t *dst, const uint8_t *src)
  71 {
  72     des_encrypt(ctx, length, dst, src);
  73 }
  74
  75 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  76                                uint8_t *dst, const uint8_t *src)
  77 {
  78     des_decrypt(ctx, length, dst, src);
  79 }
  80
  81 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  82                                 uint8_t *dst, const uint8_t *src)
  83 {
  84     des3_encrypt(ctx, length, dst, src);
  85 }
  86
  87 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  88                                 uint8_t *dst, const uint8_t *src)
  89 {
  90     des3_decrypt(ctx, length, dst, src);
  91 }
  92
  93 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  94                                    uint8_t *dst, const uint8_t *src)
  95 {
  96     cast128_encrypt(ctx, length, dst, src);
  97 }
  98
  99 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 100                                    uint8_t *dst, const uint8_t *src)
 101 {
 102     cast128_decrypt(ctx, length, dst, src);
 103 }
 104
 105 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 106                                    uint8_t *dst, const uint8_t *src)
 107 {
 108     serpent_encrypt(ctx, length, dst, src);
 109 }
 110
 111 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 112                                    uint8_t *dst, const uint8_t *src)
 113 {
 114     serpent_decrypt(ctx, length, dst, src);
 115 }
 116
 117 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 118                                    uint8_t *dst, const uint8_t *src)
 119 {
 120     twofish_encrypt(ctx, length, dst, src);
 121 }
 122
 123 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 124                                    uint8_t *dst, const uint8_t *src)
 125 {
 126     twofish_decrypt(ctx, length, dst, src);
 127 }
 128
 129 static void aes_encrypt_wrapper(const void *ctx, size_t length,
 130                                 uint8_t *dst, const uint8_t *src)
 131 {
 132     const QCryptoNettleAES *aesctx = ctx;
 133     aes_encrypt(&aesctx->enc, length, dst, src);
 134 }
 135
 136 static void aes_decrypt_wrapper(const void *ctx, size_t length,
 137                                 uint8_t *dst, const uint8_t *src)
 138 {
 139     const QCryptoNettleAES *aesctx = ctx;
 140     aes_decrypt(&aesctx->dec, length, dst, src);
 141 }
 142
 143 static void des_encrypt_wrapper(const void *ctx, size_t length,
 144                                 uint8_t *dst, const uint8_t *src)
 145 {
 146     des_encrypt(ctx, length, dst, src);
 147 }
 148
 149 static void des_decrypt_wrapper(const void *ctx, size_t length,
 150                                 uint8_t *dst, const uint8_t *src)
 151 {
 152     des_decrypt(ctx, length, dst, src);
 153 }
 154
 155 static void des3_encrypt_wrapper(const void *ctx, size_t length,
 156                                 uint8_t *dst, const uint8_t *src)
 157 {
 158     des3_encrypt(ctx, length, dst, src);
 159 }
 160
 161 static void des3_decrypt_wrapper(const void *ctx, size_t length,
 162                                 uint8_t *dst, const uint8_t *src)
 163 {
 164     des3_decrypt(ctx, length, dst, src);
 165 }
 166
 167 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 168                                     uint8_t *dst, const uint8_t *src)
 169 {
 170     cast128_encrypt(ctx, length, dst, src);
 171 }
 172
 173 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 174                                     uint8_t *dst, const uint8_t *src)
 175 {
 176     cast128_decrypt(ctx, length, dst, src);
 177 }
 178
 179 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 180                                     uint8_t *dst, const uint8_t *src)
 181 {
 182     serpent_encrypt(ctx, length, dst, src);
 183 }
 184
 185 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 186                                     uint8_t *dst, const uint8_t *src)
 187 {
 188     serpent_decrypt(ctx, length, dst, src);
 189 }
 190
 191 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 192                                     uint8_t *dst, const uint8_t *src)
 193 {
 194     twofish_encrypt(ctx, length, dst, src);
 195 }
 196
 197 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 198                                     uint8_t *dst, const uint8_t *src)
 199 {
 200     twofish_decrypt(ctx, length, dst, src);
 201 }
 202
 203 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 204 struct QCryptoCipherNettle {
 205     /* Primary cipher context for all modes */
 206     void *ctx;
 207     /* Second cipher context for XTS mode only */
 208     void *ctx_tweak;
 209     /* Cipher callbacks for both contexts */
 210     QCryptoCipherNettleFuncNative alg_encrypt_native;
 211     QCryptoCipherNettleFuncNative alg_decrypt_native;
 212     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 213     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 214     /* Initialization vector or Counter */
 215     uint8_t *iv;
 216     size_t blocksize;
 217 };
 218
 219 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
 220                              QCryptoCipherMode mode)
 221 {
 222     switch (alg) {
 223     case QCRYPTO_CIPHER_ALG_DES_RFB:
 224     case QCRYPTO_CIPHER_ALG_3DES:
 225     case QCRYPTO_CIPHER_ALG_AES_128:
 226     case QCRYPTO_CIPHER_ALG_AES_192:
 227     case QCRYPTO_CIPHER_ALG_AES_256:
 228     case QCRYPTO_CIPHER_ALG_CAST5_128:
 229     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 230     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 231     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 232     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 233     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 234     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 235         break;
 236     default:
 237         return false;
 238     }
 239
 240     switch (mode) {
 241     case QCRYPTO_CIPHER_MODE_ECB:
 242     case QCRYPTO_CIPHER_MODE_CBC:
 243     case QCRYPTO_CIPHER_MODE_XTS:
 244     case QCRYPTO_CIPHER_MODE_CTR:
 245         return true;
 246     default:
 247         return false;
 248     }
 249 }
 250
 251
 252 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
 253                                   QCryptoCipherMode mode,
 254                                   const uint8_t *key, size_t nkey,
 255                                   Error **errp)
 256 {
 257     QCryptoCipher *cipher;
 258     QCryptoCipherNettle *ctx;
 259     uint8_t *rfbkey;
 260
 261     switch (mode) {
 262     case QCRYPTO_CIPHER_MODE_ECB:
 263     case QCRYPTO_CIPHER_MODE_CBC:
 264     case QCRYPTO_CIPHER_MODE_XTS:
 265     case QCRYPTO_CIPHER_MODE_CTR:
 266         break;
 267     default:
 268         error_setg(errp, "Unsupported cipher mode %s",
 269                    QCryptoCipherMode_lookup[mode]);
 270         return NULL;
 271     }
 272
 273     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 274         return NULL;
 275     }
 276
 277     cipher = g_new0(QCryptoCipher, 1);
 278     cipher->alg = alg;
 279     cipher->mode = mode;
 280
 281     ctx = g_new0(QCryptoCipherNettle, 1);
 282     cipher->opaque = ctx;
 283
 284     switch (alg) {
 285     case QCRYPTO_CIPHER_ALG_DES_RFB:
 286         ctx->ctx = g_new0(struct des_ctx, 1);
 287         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 288         des_set_key(ctx->ctx, rfbkey);
 289         g_free(rfbkey);
 290
 291         ctx->alg_encrypt_native = des_encrypt_native;
 292         ctx->alg_decrypt_native = des_decrypt_native;
 293         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 294         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 295
 296         ctx->blocksize = DES_BLOCK_SIZE;
 297         break;
 298
 299     case QCRYPTO_CIPHER_ALG_3DES:
 300         ctx->ctx = g_new0(struct des3_ctx, 1);
 301         des3_set_key(ctx->ctx, key);
 302
 303         ctx->alg_encrypt_native = des3_encrypt_native;
 304         ctx->alg_decrypt_native = des3_decrypt_native;
 305         ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
 306         ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
 307
 308         ctx->blocksize = DES3_BLOCK_SIZE;
 309         break;
 310
 311     case QCRYPTO_CIPHER_ALG_AES_128:
 312     case QCRYPTO_CIPHER_ALG_AES_192:
 313     case QCRYPTO_CIPHER_ALG_AES_256:
 314         ctx->ctx = g_new0(QCryptoNettleAES, 1);
 315
 316         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 317             ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
 318
 319             nkey /= 2;
 320             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 321                                 nkey, key);
 322             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 323                                 nkey, key);
 324
 325             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
 326                                 nkey, key + nkey);
 327             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
 328                                 nkey, key + nkey);
 329         } else {
 330             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 331                                 nkey, key);
 332             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 333                                 nkey, key);
 334         }
 335
 336         ctx->alg_encrypt_native = aes_encrypt_native;
 337         ctx->alg_decrypt_native = aes_decrypt_native;
 338         ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
 339         ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
 340
 341         ctx->blocksize = AES_BLOCK_SIZE;
 342         break;
 343
 344     case QCRYPTO_CIPHER_ALG_CAST5_128:
 345         ctx->ctx = g_new0(struct cast128_ctx, 1);
 346
 347         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 348             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 349
 350             nkey /= 2;
 351             cast5_set_key(ctx->ctx, nkey, key);
 352             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 353         } else {
 354             cast5_set_key(ctx->ctx, nkey, key);
 355         }
 356
 357         ctx->alg_encrypt_native = cast128_encrypt_native;
 358         ctx->alg_decrypt_native = cast128_decrypt_native;
 359         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 360         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 361
 362         ctx->blocksize = CAST128_BLOCK_SIZE;
 363         break;
 364
 365     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 366     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 367     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 368         ctx->ctx = g_new0(struct serpent_ctx, 1);
 369
 370         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 371             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 372
 373             nkey /= 2;
 374             serpent_set_key(ctx->ctx, nkey, key);
 375             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 376         } else {
 377             serpent_set_key(ctx->ctx, nkey, key);
 378         }
 379
 380         ctx->alg_encrypt_native = serpent_encrypt_native;
 381         ctx->alg_decrypt_native = serpent_decrypt_native;
 382         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 383         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 384
 385         ctx->blocksize = SERPENT_BLOCK_SIZE;
 386         break;
 387
 388     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 389     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 390     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 391         ctx->ctx = g_new0(struct twofish_ctx, 1);
 392
 393         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 394             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 395
 396             nkey /= 2;
 397             twofish_set_key(ctx->ctx, nkey, key);
 398             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 399         } else {
 400             twofish_set_key(ctx->ctx, nkey, key);
 401         }
 402
 403         ctx->alg_encrypt_native = twofish_encrypt_native;
 404         ctx->alg_decrypt_native = twofish_decrypt_native;
 405         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 406         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 407
 408         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 409         break;
 410
 411     default:
 412         error_setg(errp, "Unsupported cipher algorithm %s",
 413                    QCryptoCipherAlgorithm_lookup[alg]);
 414         goto error;
 415     }
 416
 417     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 418         ctx->blocksize != XTS_BLOCK_SIZE) {
 419         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 420                    ctx->blocksize, XTS_BLOCK_SIZE);
 421         goto error;
 422     }
 423
 424     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 425
 426     return cipher;
 427
 428  error:
 429     qcrypto_cipher_free(cipher);
 430     return NULL;
 431 }
 432
 433
 434 void qcrypto_cipher_free(QCryptoCipher *cipher)
 435 {
 436     QCryptoCipherNettle *ctx;
 437
 438     if (!cipher) {
 439         return;
 440     }
 441
 442     ctx = cipher->opaque;
 443     g_free(ctx->iv);
 444     g_free(ctx->ctx);
 445     g_free(ctx->ctx_tweak);
 446     g_free(ctx);
 447     g_free(cipher);
 448 }
 449
 450
 451 int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 452                            const void *in,
 453                            void *out,
 454                            size_t len,
 455                            Error **errp)
 456 {
 457     QCryptoCipherNettle *ctx = cipher->opaque;
 458
 459     if (len % ctx->blocksize) {
 460         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 461                    len, ctx->blocksize);
 462         return -1;
 463     }
 464
 465     switch (cipher->mode) {
 466     case QCRYPTO_CIPHER_MODE_ECB:
 467         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 468         break;
 469
 470     case QCRYPTO_CIPHER_MODE_CBC:
 471         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 472                     ctx->blocksize, ctx->iv,
 473                     len, out, in);
 474         break;
 475
 476     case QCRYPTO_CIPHER_MODE_XTS:
 477         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 478                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 479                     ctx->iv, len, out, in);
 480         break;
 481
 482     case QCRYPTO_CIPHER_MODE_CTR:
 483         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 484                     ctx->blocksize, ctx->iv,
 485                     len, out, in);
 486         break;
 487
 488     default:
 489         error_setg(errp, "Unsupported cipher mode %s",
 490                    QCryptoCipherMode_lookup[cipher->mode]);
 491         return -1;
 492     }
 493     return 0;
 494 }
 495
 496
 497 int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 498                            const void *in,
 499                            void *out,
 500                            size_t len,
 501                            Error **errp)
 502 {
 503     QCryptoCipherNettle *ctx = cipher->opaque;
 504
 505     if (len % ctx->blocksize) {
 506         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 507                    len, ctx->blocksize);
 508         return -1;
 509     }
 510
 511     switch (cipher->mode) {
 512     case QCRYPTO_CIPHER_MODE_ECB:
 513         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 514         break;
 515
 516     case QCRYPTO_CIPHER_MODE_CBC:
 517         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 518                     ctx->blocksize, ctx->iv,
 519                     len, out, in);
 520         break;
 521
 522     case QCRYPTO_CIPHER_MODE_XTS:
 523         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 524                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 525                     ctx->iv, len, out, in);
 526         break;
 527     case QCRYPTO_CIPHER_MODE_CTR:
 528         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 529                     ctx->blocksize, ctx->iv,
 530                     len, out, in);
 531         break;
 532
 533     default:
 534         error_setg(errp, "Unsupported cipher mode %s",
 535                    QCryptoCipherMode_lookup[cipher->mode]);
 536         return -1;
 537     }
 538     return 0;
 539 }
 540
 541 int qcrypto_cipher_setiv(QCryptoCipher *cipher,
 542                          const uint8_t *iv, size_t niv,
 543                          Error **errp)
 544 {
 545     QCryptoCipherNettle *ctx = cipher->opaque;
 546     if (niv != ctx->blocksize) {
 547         error_setg(errp, "Expected IV size %zu not %zu",
 548                    ctx->blocksize, niv);
 549         return -1;
 550     }
 551     memcpy(ctx->iv, iv, niv);
 552     return 0;
 553 }