crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/xts.h"
  23
  24 #include <nettle/nettle-types.h>
  25 #include <nettle/aes.h>
  26 #include <nettle/des.h>
  27 #include <nettle/cbc.h>
  28 #include <nettle/cast128.h>
  29 #include <nettle/serpent.h>
  30 #include <nettle/twofish.h>
  31
  32 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  33                                                size_t length,
  34                                                uint8_t *dst,
  35                                                const uint8_t *src);
  36
  37 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  38 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  39 typedef void *       cipher_ctx_t;
  40 typedef unsigned     cipher_length_t;
  41
  42 #define cast5_set_key cast128_set_key
  43 #else
  44 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  45 typedef const void * cipher_ctx_t;
  46 typedef size_t       cipher_length_t;
  47 #endif
  48
  49 typedef struct QCryptoNettleAES {
  50     struct aes_ctx enc;
  51     struct aes_ctx dec;
  52 } QCryptoNettleAES;
  53
  54 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  55                                uint8_t *dst, const uint8_t *src)
  56 {
  57     const QCryptoNettleAES *aesctx = ctx;
  58     aes_encrypt(&aesctx->enc, length, dst, src);
  59 }
  60
  61 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  62                                uint8_t *dst, const uint8_t *src)
  63 {
  64     const QCryptoNettleAES *aesctx = ctx;
  65     aes_decrypt(&aesctx->dec, length, dst, src);
  66 }
  67
  68 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  69                                uint8_t *dst, const uint8_t *src)
  70 {
  71     des_encrypt(ctx, length, dst, src);
  72 }
  73
  74 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  75                                uint8_t *dst, const uint8_t *src)
  76 {
  77     des_decrypt(ctx, length, dst, src);
  78 }
  79
  80 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  81                                    uint8_t *dst, const uint8_t *src)
  82 {
  83     cast128_encrypt(ctx, length, dst, src);
  84 }
  85
  86 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  87                                    uint8_t *dst, const uint8_t *src)
  88 {
  89     cast128_decrypt(ctx, length, dst, src);
  90 }
  91
  92 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  93                                    uint8_t *dst, const uint8_t *src)
  94 {
  95     serpent_encrypt(ctx, length, dst, src);
  96 }
  97
  98 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  99                                    uint8_t *dst, const uint8_t *src)
 100 {
 101     serpent_decrypt(ctx, length, dst, src);
 102 }
 103
 104 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 105                                    uint8_t *dst, const uint8_t *src)
 106 {
 107     twofish_encrypt(ctx, length, dst, src);
 108 }
 109
 110 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 111                                    uint8_t *dst, const uint8_t *src)
 112 {
 113     twofish_decrypt(ctx, length, dst, src);
 114 }
 115
 116 static void aes_encrypt_wrapper(const void *ctx, size_t length,
 117                                 uint8_t *dst, const uint8_t *src)
 118 {
 119     const QCryptoNettleAES *aesctx = ctx;
 120     aes_encrypt(&aesctx->enc, length, dst, src);
 121 }
 122
 123 static void aes_decrypt_wrapper(const void *ctx, size_t length,
 124                                 uint8_t *dst, const uint8_t *src)
 125 {
 126     const QCryptoNettleAES *aesctx = ctx;
 127     aes_decrypt(&aesctx->dec, length, dst, src);
 128 }
 129
 130 static void des_encrypt_wrapper(const void *ctx, size_t length,
 131                                 uint8_t *dst, const uint8_t *src)
 132 {
 133     des_encrypt(ctx, length, dst, src);
 134 }
 135
 136 static void des_decrypt_wrapper(const void *ctx, size_t length,
 137                                 uint8_t *dst, const uint8_t *src)
 138 {
 139     des_decrypt(ctx, length, dst, src);
 140 }
 141
 142 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 143                                     uint8_t *dst, const uint8_t *src)
 144 {
 145     cast128_encrypt(ctx, length, dst, src);
 146 }
 147
 148 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 149                                     uint8_t *dst, const uint8_t *src)
 150 {
 151     cast128_decrypt(ctx, length, dst, src);
 152 }
 153
 154 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 155                                     uint8_t *dst, const uint8_t *src)
 156 {
 157     serpent_encrypt(ctx, length, dst, src);
 158 }
 159
 160 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 161                                     uint8_t *dst, const uint8_t *src)
 162 {
 163     serpent_decrypt(ctx, length, dst, src);
 164 }
 165
 166 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 167                                     uint8_t *dst, const uint8_t *src)
 168 {
 169     twofish_encrypt(ctx, length, dst, src);
 170 }
 171
 172 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 173                                     uint8_t *dst, const uint8_t *src)
 174 {
 175     twofish_decrypt(ctx, length, dst, src);
 176 }
 177
 178 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 179 struct QCryptoCipherNettle {
 180     /* Primary cipher context for all modes */
 181     void *ctx;
 182     /* Second cipher context for XTS mode only */
 183     void *ctx_tweak;
 184     /* Cipher callbacks for both contexts */
 185     QCryptoCipherNettleFuncNative alg_encrypt_native;
 186     QCryptoCipherNettleFuncNative alg_decrypt_native;
 187     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 188     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 189
 190     uint8_t *iv;
 191     size_t blocksize;
 192 };
 193
 194 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
 195 {
 196     switch (alg) {
 197     case QCRYPTO_CIPHER_ALG_DES_RFB:
 198     case QCRYPTO_CIPHER_ALG_AES_128:
 199     case QCRYPTO_CIPHER_ALG_AES_192:
 200     case QCRYPTO_CIPHER_ALG_AES_256:
 201     case QCRYPTO_CIPHER_ALG_CAST5_128:
 202     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 203     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 204     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 205     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 206     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 207     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 208         return true;
 209     default:
 210         return false;
 211     }
 212 }
 213
 214
 215 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
 216                                   QCryptoCipherMode mode,
 217                                   const uint8_t *key, size_t nkey,
 218                                   Error **errp)
 219 {
 220     QCryptoCipher *cipher;
 221     QCryptoCipherNettle *ctx;
 222     uint8_t *rfbkey;
 223
 224     switch (mode) {
 225     case QCRYPTO_CIPHER_MODE_ECB:
 226     case QCRYPTO_CIPHER_MODE_CBC:
 227     case QCRYPTO_CIPHER_MODE_XTS:
 228         break;
 229     default:
 230         error_setg(errp, "Unsupported cipher mode %s",
 231                    QCryptoCipherMode_lookup[mode]);
 232         return NULL;
 233     }
 234
 235     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 236         return NULL;
 237     }
 238
 239     cipher = g_new0(QCryptoCipher, 1);
 240     cipher->alg = alg;
 241     cipher->mode = mode;
 242
 243     ctx = g_new0(QCryptoCipherNettle, 1);
 244
 245     switch (alg) {
 246     case QCRYPTO_CIPHER_ALG_DES_RFB:
 247         ctx->ctx = g_new0(struct des_ctx, 1);
 248         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 249         des_set_key(ctx->ctx, rfbkey);
 250         g_free(rfbkey);
 251
 252         ctx->alg_encrypt_native = des_encrypt_native;
 253         ctx->alg_decrypt_native = des_decrypt_native;
 254         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 255         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 256
 257         ctx->blocksize = DES_BLOCK_SIZE;
 258         break;
 259
 260     case QCRYPTO_CIPHER_ALG_AES_128:
 261     case QCRYPTO_CIPHER_ALG_AES_192:
 262     case QCRYPTO_CIPHER_ALG_AES_256:
 263         ctx->ctx = g_new0(QCryptoNettleAES, 1);
 264
 265         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 266             ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
 267
 268             nkey /= 2;
 269             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 270                                 nkey, key);
 271             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 272                                 nkey, key);
 273
 274             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
 275                                 nkey, key + nkey);
 276             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
 277                                 nkey, key + nkey);
 278         } else {
 279             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 280                                 nkey, key);
 281             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 282                                 nkey, key);
 283         }
 284
 285         ctx->alg_encrypt_native = aes_encrypt_native;
 286         ctx->alg_decrypt_native = aes_decrypt_native;
 287         ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
 288         ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
 289
 290         ctx->blocksize = AES_BLOCK_SIZE;
 291         break;
 292
 293     case QCRYPTO_CIPHER_ALG_CAST5_128:
 294         ctx->ctx = g_new0(struct cast128_ctx, 1);
 295
 296         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 297             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 298
 299             nkey /= 2;
 300             cast5_set_key(ctx->ctx, nkey, key);
 301             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 302         } else {
 303             cast5_set_key(ctx->ctx, nkey, key);
 304         }
 305
 306         ctx->alg_encrypt_native = cast128_encrypt_native;
 307         ctx->alg_decrypt_native = cast128_decrypt_native;
 308         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 309         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 310
 311         ctx->blocksize = CAST128_BLOCK_SIZE;
 312         break;
 313
 314     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 315     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 316     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 317         ctx->ctx = g_new0(struct serpent_ctx, 1);
 318
 319         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 320             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 321
 322             nkey /= 2;
 323             serpent_set_key(ctx->ctx, nkey, key);
 324             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 325         } else {
 326             serpent_set_key(ctx->ctx, nkey, key);
 327         }
 328
 329         ctx->alg_encrypt_native = serpent_encrypt_native;
 330         ctx->alg_decrypt_native = serpent_decrypt_native;
 331         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 332         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 333
 334         ctx->blocksize = SERPENT_BLOCK_SIZE;
 335         break;
 336
 337     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 338     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 339     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 340         ctx->ctx = g_new0(struct twofish_ctx, 1);
 341
 342         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 343             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 344
 345             nkey /= 2;
 346             twofish_set_key(ctx->ctx, nkey, key);
 347             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 348         } else {
 349             twofish_set_key(ctx->ctx, nkey, key);
 350         }
 351
 352         ctx->alg_encrypt_native = twofish_encrypt_native;
 353         ctx->alg_decrypt_native = twofish_decrypt_native;
 354         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 355         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 356
 357         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 358         break;
 359
 360     default:
 361         error_setg(errp, "Unsupported cipher algorithm %s",
 362                    QCryptoCipherAlgorithm_lookup[alg]);
 363         goto error;
 364     }
 365
 366     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 367         ctx->blocksize != XTS_BLOCK_SIZE) {
 368         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 369                    ctx->blocksize, XTS_BLOCK_SIZE);
 370         goto error;
 371     }
 372
 373     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 374     cipher->opaque = ctx;
 375
 376     return cipher;
 377
 378  error:
 379     g_free(cipher);
 380     g_free(ctx);
 381     return NULL;
 382 }
 383
 384
 385 void qcrypto_cipher_free(QCryptoCipher *cipher)
 386 {
 387     QCryptoCipherNettle *ctx;
 388
 389     if (!cipher) {
 390         return;
 391     }
 392
 393     ctx = cipher->opaque;
 394     g_free(ctx->iv);
 395     g_free(ctx->ctx);
 396     g_free(ctx->ctx_tweak);
 397     g_free(ctx);
 398     g_free(cipher);
 399 }
 400
 401
 402 int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 403                            const void *in,
 404                            void *out,
 405                            size_t len,
 406                            Error **errp)
 407 {
 408     QCryptoCipherNettle *ctx = cipher->opaque;
 409
 410     if (len % ctx->blocksize) {
 411         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 412                    len, ctx->blocksize);
 413         return -1;
 414     }
 415
 416     switch (cipher->mode) {
 417     case QCRYPTO_CIPHER_MODE_ECB:
 418         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 419         break;
 420
 421     case QCRYPTO_CIPHER_MODE_CBC:
 422         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 423                     ctx->blocksize, ctx->iv,
 424                     len, out, in);
 425         break;
 426
 427     case QCRYPTO_CIPHER_MODE_XTS:
 428         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 429                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 430                     ctx->iv, len, out, in);
 431         break;
 432
 433     default:
 434         error_setg(errp, "Unsupported cipher mode %s",
 435                    QCryptoCipherMode_lookup[cipher->mode]);
 436         return -1;
 437     }
 438     return 0;
 439 }
 440
 441
 442 int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 443                            const void *in,
 444                            void *out,
 445                            size_t len,
 446                            Error **errp)
 447 {
 448     QCryptoCipherNettle *ctx = cipher->opaque;
 449
 450     if (len % ctx->blocksize) {
 451         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 452                    len, ctx->blocksize);
 453         return -1;
 454     }
 455
 456     switch (cipher->mode) {
 457     case QCRYPTO_CIPHER_MODE_ECB:
 458         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 459         break;
 460
 461     case QCRYPTO_CIPHER_MODE_CBC:
 462         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 463                     ctx->blocksize, ctx->iv,
 464                     len, out, in);
 465         break;
 466
 467     case QCRYPTO_CIPHER_MODE_XTS:
 468         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 469                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 470                     ctx->iv, len, out, in);
 471         break;
 472
 473     default:
 474         error_setg(errp, "Unsupported cipher mode %s",
 475                    QCryptoCipherMode_lookup[cipher->mode]);
 476         return -1;
 477     }
 478     return 0;
 479 }
 480
 481 int qcrypto_cipher_setiv(QCryptoCipher *cipher,
 482                          const uint8_t *iv, size_t niv,
 483                          Error **errp)
 484 {
 485     QCryptoCipherNettle *ctx = cipher->opaque;
 486     if (niv != ctx->blocksize) {
 487         error_setg(errp, "Expected IV size %zu not %zu",
 488                    ctx->blocksize, niv);
 489         return -1;
 490     }
 491     memcpy(ctx->iv, iv, niv);
 492     return 0;
 493 }