crypto/cipher-nettle.c

   1 /*
   2  * QEMU Crypto cipher nettle algorithms
   3  *
   4  * Copyright (c) 2015 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/xts.h"
  23
  24 #include <nettle/nettle-types.h>
  25 #include <nettle/aes.h>
  26 #include <nettle/des.h>
  27 #include <nettle/cbc.h>
  28 #include <nettle/cast128.h>
  29 #include <nettle/serpent.h>
  30 #include <nettle/twofish.h>
  31 #include <nettle/ctr.h>
  32
  33 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
  34                                                size_t length,
  35                                                uint8_t *dst,
  36                                                const uint8_t *src);
  37
  38 #if CONFIG_NETTLE_VERSION_MAJOR < 3
  39 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
  40 typedef void *       cipher_ctx_t;
  41 typedef unsigned     cipher_length_t;
  42
  43 #define cast5_set_key cast128_set_key
  44 #else
  45 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
  46 typedef const void * cipher_ctx_t;
  47 typedef size_t       cipher_length_t;
  48 #endif
  49
  50 typedef struct QCryptoNettleAES {
  51     struct aes_ctx enc;
  52     struct aes_ctx dec;
  53 } QCryptoNettleAES;
  54
  55 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  56                                uint8_t *dst, const uint8_t *src)
  57 {
  58     const QCryptoNettleAES *aesctx = ctx;
  59     aes_encrypt(&aesctx->enc, length, dst, src);
  60 }
  61
  62 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  63                                uint8_t *dst, const uint8_t *src)
  64 {
  65     const QCryptoNettleAES *aesctx = ctx;
  66     aes_decrypt(&aesctx->dec, length, dst, src);
  67 }
  68
  69 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  70                                uint8_t *dst, const uint8_t *src)
  71 {
  72     des_encrypt(ctx, length, dst, src);
  73 }
  74
  75 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  76                                uint8_t *dst, const uint8_t *src)
  77 {
  78     des_decrypt(ctx, length, dst, src);
  79 }
  80
  81 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  82                                 uint8_t *dst, const uint8_t *src)
  83 {
  84     des3_encrypt(ctx, length, dst, src);
  85 }
  86
  87 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  88                                 uint8_t *dst, const uint8_t *src)
  89 {
  90     des3_decrypt(ctx, length, dst, src);
  91 }
  92
  93 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
  94                                    uint8_t *dst, const uint8_t *src)
  95 {
  96     cast128_encrypt(ctx, length, dst, src);
  97 }
  98
  99 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 100                                    uint8_t *dst, const uint8_t *src)
 101 {
 102     cast128_decrypt(ctx, length, dst, src);
 103 }
 104
 105 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 106                                    uint8_t *dst, const uint8_t *src)
 107 {
 108     serpent_encrypt(ctx, length, dst, src);
 109 }
 110
 111 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 112                                    uint8_t *dst, const uint8_t *src)
 113 {
 114     serpent_decrypt(ctx, length, dst, src);
 115 }
 116
 117 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 118                                    uint8_t *dst, const uint8_t *src)
 119 {
 120     twofish_encrypt(ctx, length, dst, src);
 121 }
 122
 123 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
 124                                    uint8_t *dst, const uint8_t *src)
 125 {
 126     twofish_decrypt(ctx, length, dst, src);
 127 }
 128
 129 static void aes_encrypt_wrapper(const void *ctx, size_t length,
 130                                 uint8_t *dst, const uint8_t *src)
 131 {
 132     const QCryptoNettleAES *aesctx = ctx;
 133     aes_encrypt(&aesctx->enc, length, dst, src);
 134 }
 135
 136 static void aes_decrypt_wrapper(const void *ctx, size_t length,
 137                                 uint8_t *dst, const uint8_t *src)
 138 {
 139     const QCryptoNettleAES *aesctx = ctx;
 140     aes_decrypt(&aesctx->dec, length, dst, src);
 141 }
 142
 143 static void des_encrypt_wrapper(const void *ctx, size_t length,
 144                                 uint8_t *dst, const uint8_t *src)
 145 {
 146     des_encrypt(ctx, length, dst, src);
 147 }
 148
 149 static void des_decrypt_wrapper(const void *ctx, size_t length,
 150                                 uint8_t *dst, const uint8_t *src)
 151 {
 152     des_decrypt(ctx, length, dst, src);
 153 }
 154
 155 static void des3_encrypt_wrapper(const void *ctx, size_t length,
 156                                 uint8_t *dst, const uint8_t *src)
 157 {
 158     des3_encrypt(ctx, length, dst, src);
 159 }
 160
 161 static void des3_decrypt_wrapper(const void *ctx, size_t length,
 162                                 uint8_t *dst, const uint8_t *src)
 163 {
 164     des3_decrypt(ctx, length, dst, src);
 165 }
 166
 167 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
 168                                     uint8_t *dst, const uint8_t *src)
 169 {
 170     cast128_encrypt(ctx, length, dst, src);
 171 }
 172
 173 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
 174                                     uint8_t *dst, const uint8_t *src)
 175 {
 176     cast128_decrypt(ctx, length, dst, src);
 177 }
 178
 179 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
 180                                     uint8_t *dst, const uint8_t *src)
 181 {
 182     serpent_encrypt(ctx, length, dst, src);
 183 }
 184
 185 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
 186                                     uint8_t *dst, const uint8_t *src)
 187 {
 188     serpent_decrypt(ctx, length, dst, src);
 189 }
 190
 191 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
 192                                     uint8_t *dst, const uint8_t *src)
 193 {
 194     twofish_encrypt(ctx, length, dst, src);
 195 }
 196
 197 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
 198                                     uint8_t *dst, const uint8_t *src)
 199 {
 200     twofish_decrypt(ctx, length, dst, src);
 201 }
 202
 203 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
 204 struct QCryptoCipherNettle {
 205     /* Primary cipher context for all modes */
 206     void *ctx;
 207     /* Second cipher context for XTS mode only */
 208     void *ctx_tweak;
 209     /* Cipher callbacks for both contexts */
 210     QCryptoCipherNettleFuncNative alg_encrypt_native;
 211     QCryptoCipherNettleFuncNative alg_decrypt_native;
 212     QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
 213     QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
 214     /* Initialization vector or Counter */
 215     uint8_t *iv;
 216     size_t blocksize;
 217 };
 218
 219 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
 220                              QCryptoCipherMode mode)
 221 {
 222     switch (alg) {
 223     case QCRYPTO_CIPHER_ALG_DES_RFB:
 224     case QCRYPTO_CIPHER_ALG_3DES:
 225     case QCRYPTO_CIPHER_ALG_AES_128:
 226     case QCRYPTO_CIPHER_ALG_AES_192:
 227     case QCRYPTO_CIPHER_ALG_AES_256:
 228     case QCRYPTO_CIPHER_ALG_CAST5_128:
 229     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 230     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 231     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 232     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 233     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 234     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 235         break;
 236     default:
 237         return false;
 238     }
 239
 240     switch (mode) {
 241     case QCRYPTO_CIPHER_MODE_ECB:
 242     case QCRYPTO_CIPHER_MODE_CBC:
 243     case QCRYPTO_CIPHER_MODE_XTS:
 244     case QCRYPTO_CIPHER_MODE_CTR:
 245         return true;
 246     default:
 247         return false;
 248     }
 249 }
 250
 251
 252 static void nettle_cipher_free_ctx(QCryptoCipherNettle *ctx)
 253 {
 254     if (!ctx) {
 255         return;
 256     }
 257
 258     g_free(ctx->iv);
 259     g_free(ctx->ctx);
 260     g_free(ctx->ctx_tweak);
 261     g_free(ctx);
 262 }
 263
 264
 265 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
 266                                   QCryptoCipherMode mode,
 267                                   const uint8_t *key, size_t nkey,
 268                                   Error **errp)
 269 {
 270     QCryptoCipher *cipher;
 271     QCryptoCipherNettle *ctx;
 272     uint8_t *rfbkey;
 273
 274     switch (mode) {
 275     case QCRYPTO_CIPHER_MODE_ECB:
 276     case QCRYPTO_CIPHER_MODE_CBC:
 277     case QCRYPTO_CIPHER_MODE_XTS:
 278     case QCRYPTO_CIPHER_MODE_CTR:
 279         break;
 280     default:
 281         error_setg(errp, "Unsupported cipher mode %s",
 282                    QCryptoCipherMode_lookup[mode]);
 283         return NULL;
 284     }
 285
 286     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
 287         return NULL;
 288     }
 289
 290     cipher = g_new0(QCryptoCipher, 1);
 291     cipher->alg = alg;
 292     cipher->mode = mode;
 293
 294     ctx = g_new0(QCryptoCipherNettle, 1);
 295     cipher->opaque = ctx;
 296
 297     switch (alg) {
 298     case QCRYPTO_CIPHER_ALG_DES_RFB:
 299         ctx->ctx = g_new0(struct des_ctx, 1);
 300         rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
 301         des_set_key(ctx->ctx, rfbkey);
 302         g_free(rfbkey);
 303
 304         ctx->alg_encrypt_native = des_encrypt_native;
 305         ctx->alg_decrypt_native = des_decrypt_native;
 306         ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
 307         ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
 308
 309         ctx->blocksize = DES_BLOCK_SIZE;
 310         break;
 311
 312     case QCRYPTO_CIPHER_ALG_3DES:
 313         ctx->ctx = g_new0(struct des3_ctx, 1);
 314         des3_set_key(ctx->ctx, key);
 315
 316         ctx->alg_encrypt_native = des3_encrypt_native;
 317         ctx->alg_decrypt_native = des3_decrypt_native;
 318         ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
 319         ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
 320
 321         ctx->blocksize = DES3_BLOCK_SIZE;
 322         break;
 323
 324     case QCRYPTO_CIPHER_ALG_AES_128:
 325     case QCRYPTO_CIPHER_ALG_AES_192:
 326     case QCRYPTO_CIPHER_ALG_AES_256:
 327         ctx->ctx = g_new0(QCryptoNettleAES, 1);
 328
 329         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 330             ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
 331
 332             nkey /= 2;
 333             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 334                                 nkey, key);
 335             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 336                                 nkey, key);
 337
 338             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
 339                                 nkey, key + nkey);
 340             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
 341                                 nkey, key + nkey);
 342         } else {
 343             aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
 344                                 nkey, key);
 345             aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
 346                                 nkey, key);
 347         }
 348
 349         ctx->alg_encrypt_native = aes_encrypt_native;
 350         ctx->alg_decrypt_native = aes_decrypt_native;
 351         ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
 352         ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
 353
 354         ctx->blocksize = AES_BLOCK_SIZE;
 355         break;
 356
 357     case QCRYPTO_CIPHER_ALG_CAST5_128:
 358         ctx->ctx = g_new0(struct cast128_ctx, 1);
 359
 360         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 361             ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
 362
 363             nkey /= 2;
 364             cast5_set_key(ctx->ctx, nkey, key);
 365             cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
 366         } else {
 367             cast5_set_key(ctx->ctx, nkey, key);
 368         }
 369
 370         ctx->alg_encrypt_native = cast128_encrypt_native;
 371         ctx->alg_decrypt_native = cast128_decrypt_native;
 372         ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
 373         ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
 374
 375         ctx->blocksize = CAST128_BLOCK_SIZE;
 376         break;
 377
 378     case QCRYPTO_CIPHER_ALG_SERPENT_128:
 379     case QCRYPTO_CIPHER_ALG_SERPENT_192:
 380     case QCRYPTO_CIPHER_ALG_SERPENT_256:
 381         ctx->ctx = g_new0(struct serpent_ctx, 1);
 382
 383         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 384             ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
 385
 386             nkey /= 2;
 387             serpent_set_key(ctx->ctx, nkey, key);
 388             serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
 389         } else {
 390             serpent_set_key(ctx->ctx, nkey, key);
 391         }
 392
 393         ctx->alg_encrypt_native = serpent_encrypt_native;
 394         ctx->alg_decrypt_native = serpent_decrypt_native;
 395         ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
 396         ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
 397
 398         ctx->blocksize = SERPENT_BLOCK_SIZE;
 399         break;
 400
 401     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 402     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 403     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 404         ctx->ctx = g_new0(struct twofish_ctx, 1);
 405
 406         if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 407             ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
 408
 409             nkey /= 2;
 410             twofish_set_key(ctx->ctx, nkey, key);
 411             twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
 412         } else {
 413             twofish_set_key(ctx->ctx, nkey, key);
 414         }
 415
 416         ctx->alg_encrypt_native = twofish_encrypt_native;
 417         ctx->alg_decrypt_native = twofish_decrypt_native;
 418         ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
 419         ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
 420
 421         ctx->blocksize = TWOFISH_BLOCK_SIZE;
 422         break;
 423
 424     default:
 425         error_setg(errp, "Unsupported cipher algorithm %s",
 426                    QCryptoCipherAlgorithm_lookup[alg]);
 427         goto error;
 428     }
 429
 430     if (mode == QCRYPTO_CIPHER_MODE_XTS &&
 431         ctx->blocksize != XTS_BLOCK_SIZE) {
 432         error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
 433                    ctx->blocksize, XTS_BLOCK_SIZE);
 434         goto error;
 435     }
 436
 437     ctx->iv = g_new0(uint8_t, ctx->blocksize);
 438
 439     return cipher;
 440
 441  error:
 442     qcrypto_cipher_free(cipher);
 443     return NULL;
 444 }
 445
 446
 447 void qcrypto_cipher_free(QCryptoCipher *cipher)
 448 {
 449     QCryptoCipherNettle *ctx;
 450
 451     if (!cipher) {
 452         return;
 453     }
 454
 455     ctx = cipher->opaque;
 456     nettle_cipher_free_ctx(ctx);
 457     g_free(cipher);
 458 }
 459
 460
 461 int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
 462                            const void *in,
 463                            void *out,
 464                            size_t len,
 465                            Error **errp)
 466 {
 467     QCryptoCipherNettle *ctx = cipher->opaque;
 468
 469     if (len % ctx->blocksize) {
 470         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 471                    len, ctx->blocksize);
 472         return -1;
 473     }
 474
 475     switch (cipher->mode) {
 476     case QCRYPTO_CIPHER_MODE_ECB:
 477         ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
 478         break;
 479
 480     case QCRYPTO_CIPHER_MODE_CBC:
 481         cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
 482                     ctx->blocksize, ctx->iv,
 483                     len, out, in);
 484         break;
 485
 486     case QCRYPTO_CIPHER_MODE_XTS:
 487         xts_encrypt(ctx->ctx, ctx->ctx_tweak,
 488                     ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
 489                     ctx->iv, len, out, in);
 490         break;
 491
 492     case QCRYPTO_CIPHER_MODE_CTR:
 493         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 494                     ctx->blocksize, ctx->iv,
 495                     len, out, in);
 496         break;
 497
 498     default:
 499         error_setg(errp, "Unsupported cipher mode %s",
 500                    QCryptoCipherMode_lookup[cipher->mode]);
 501         return -1;
 502     }
 503     return 0;
 504 }
 505
 506
 507 int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
 508                            const void *in,
 509                            void *out,
 510                            size_t len,
 511                            Error **errp)
 512 {
 513     QCryptoCipherNettle *ctx = cipher->opaque;
 514
 515     if (len % ctx->blocksize) {
 516         error_setg(errp, "Length %zu must be a multiple of block size %zu",
 517                    len, ctx->blocksize);
 518         return -1;
 519     }
 520
 521     switch (cipher->mode) {
 522     case QCRYPTO_CIPHER_MODE_ECB:
 523         ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
 524         break;
 525
 526     case QCRYPTO_CIPHER_MODE_CBC:
 527         cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
 528                     ctx->blocksize, ctx->iv,
 529                     len, out, in);
 530         break;
 531
 532     case QCRYPTO_CIPHER_MODE_XTS:
 533         xts_decrypt(ctx->ctx, ctx->ctx_tweak,
 534                     ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
 535                     ctx->iv, len, out, in);
 536         break;
 537     case QCRYPTO_CIPHER_MODE_CTR:
 538         ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
 539                     ctx->blocksize, ctx->iv,
 540                     len, out, in);
 541         break;
 542
 543     default:
 544         error_setg(errp, "Unsupported cipher mode %s",
 545                    QCryptoCipherMode_lookup[cipher->mode]);
 546         return -1;
 547     }
 548     return 0;
 549 }
 550
 551 int qcrypto_cipher_setiv(QCryptoCipher *cipher,
 552                          const uint8_t *iv, size_t niv,
 553                          Error **errp)
 554 {
 555     QCryptoCipherNettle *ctx = cipher->opaque;
 556     if (niv != ctx->blocksize) {
 557         error_setg(errp, "Expected IV size %zu not %zu",
 558                    ctx->blocksize, niv);
 559         return -1;
 560     }
 561     memcpy(ctx->iv, iv, niv);
 562     return 0;
 563 }