Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Adiantum length-preserving encryption mode
4 *
5 * Copyright 2018 Google LLC
6 */
7
8/*
9 * Adiantum is a tweakable, length-preserving encryption mode designed for fast
10 * and secure disk encryption, especially on CPUs without dedicated crypto
11 * instructions. Adiantum encrypts each sector using the XChaCha12 stream
12 * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on
13 * NH and Poly1305, and an invocation of the AES-256 block cipher on a single
14 * 16-byte block. See the paper for details:
15 *
16 * Adiantum: length-preserving encryption for entry-level processors
17 * (https://eprint.iacr.org/2018/720.pdf)
18 *
19 * For flexibility, this implementation also allows other ciphers:
20 *
21 * - Stream cipher: XChaCha12 or XChaCha20
22 * - Block cipher: any with a 128-bit block size and 256-bit key
23 *
24 * This implementation doesn't currently allow other ε-∆U hash functions, i.e.
25 * HPolyC is not supported. This is because Adiantum is ~20% faster than HPolyC
26 * but still provably as secure, and also the ε-∆U hash function of HBSH is
27 * formally defined to take two inputs (tweak, message) which makes it difficult
28 * to wrap with the crypto_shash API. Rather, some details need to be handled
29 * here. Nevertheless, if needed in the future, support for other ε-∆U hash
30 * functions could be added here.
31 */
32
33#include <crypto/b128ops.h>
34#include <crypto/chacha.h>
35#include <crypto/internal/cipher.h>
36#include <crypto/internal/hash.h>
37#include <crypto/internal/poly1305.h>
38#include <crypto/internal/skcipher.h>
39#include <crypto/nhpoly1305.h>
40#include <crypto/scatterwalk.h>
41#include <linux/module.h>
42
43/*
44 * Size of right-hand part of input data, in bytes; also the size of the block
45 * cipher's block size and the hash function's output.
46 */
47#define BLOCKCIPHER_BLOCK_SIZE 16
48
49/* Size of the block cipher key (K_E) in bytes */
50#define BLOCKCIPHER_KEY_SIZE 32
51
52/* Size of the hash key (K_H) in bytes */
53#define HASH_KEY_SIZE (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE)
54
55/*
56 * The specification allows variable-length tweaks, but Linux's crypto API
57 * currently only allows algorithms to support a single length. The "natural"
58 * tweak length for Adiantum is 16, since that fits into one Poly1305 block for
59 * the best performance. But longer tweaks are useful for fscrypt, to avoid
60 * needing to derive per-file keys. So instead we use two blocks, or 32 bytes.
61 */
62#define TWEAK_SIZE 32
63
64struct adiantum_instance_ctx {
65 struct crypto_skcipher_spawn streamcipher_spawn;
66 struct crypto_cipher_spawn blockcipher_spawn;
67 struct crypto_shash_spawn hash_spawn;
68};
69
70struct adiantum_tfm_ctx {
71 struct crypto_skcipher *streamcipher;
72 struct crypto_cipher *blockcipher;
73 struct crypto_shash *hash;
74 struct poly1305_core_key header_hash_key;
75};
76
77struct adiantum_request_ctx {
78
79 /*
80 * Buffer for right-hand part of data, i.e.
81 *
82 * P_L => P_M => C_M => C_R when encrypting, or
83 * C_R => C_M => P_M => P_L when decrypting.
84 *
85 * Also used to build the IV for the stream cipher.
86 */
87 union {
88 u8 bytes[XCHACHA_IV_SIZE];
89 __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)];
90 le128 bignum; /* interpret as element of Z/(2^{128}Z) */
91 } rbuf;
92
93 bool enc; /* true if encrypting, false if decrypting */
94
95 /*
96 * The result of the Poly1305 ε-∆U hash function applied to
97 * (bulk length, tweak)
98 */
99 le128 header_hash;
100
101 /* Sub-requests, must be last */
102 union {
103 struct shash_desc hash_desc;
104 struct skcipher_request streamcipher_req;
105 } u;
106};
107
108/*
109 * Given the XChaCha stream key K_S, derive the block cipher key K_E and the
110 * hash key K_H as follows:
111 *
112 * K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191)
113 *
114 * Note that this denotes using bits from the XChaCha keystream, which here we
115 * get indirectly by encrypting a buffer containing all 0's.
116 */
117static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key,
118 unsigned int keylen)
119{
120 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
121 struct {
122 u8 iv[XCHACHA_IV_SIZE];
123 u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE];
124 struct scatterlist sg;
125 struct crypto_wait wait;
126 struct skcipher_request req; /* must be last */
127 } *data;
128 u8 *keyp;
129 int err;
130
131 /* Set the stream cipher key (K_S) */
132 crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK);
133 crypto_skcipher_set_flags(tctx->streamcipher,
134 crypto_skcipher_get_flags(tfm) &
135 CRYPTO_TFM_REQ_MASK);
136 err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen);
137 if (err)
138 return err;
139
140 /* Derive the subkeys */
141 data = kzalloc(sizeof(*data) +
142 crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL);
143 if (!data)
144 return -ENOMEM;
145 data->iv[0] = 1;
146 sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys));
147 crypto_init_wait(&data->wait);
148 skcipher_request_set_tfm(&data->req, tctx->streamcipher);
149 skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP |
150 CRYPTO_TFM_REQ_MAY_BACKLOG,
151 crypto_req_done, &data->wait);
152 skcipher_request_set_crypt(&data->req, &data->sg, &data->sg,
153 sizeof(data->derived_keys), data->iv);
154 err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait);
155 if (err)
156 goto out;
157 keyp = data->derived_keys;
158
159 /* Set the block cipher key (K_E) */
160 crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK);
161 crypto_cipher_set_flags(tctx->blockcipher,
162 crypto_skcipher_get_flags(tfm) &
163 CRYPTO_TFM_REQ_MASK);
164 err = crypto_cipher_setkey(tctx->blockcipher, keyp,
165 BLOCKCIPHER_KEY_SIZE);
166 if (err)
167 goto out;
168 keyp += BLOCKCIPHER_KEY_SIZE;
169
170 /* Set the hash key (K_H) */
171 poly1305_core_setkey(&tctx->header_hash_key, keyp);
172 keyp += POLY1305_BLOCK_SIZE;
173
174 crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK);
175 crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) &
176 CRYPTO_TFM_REQ_MASK);
177 err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE);
178 keyp += NHPOLY1305_KEY_SIZE;
179 WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]);
180out:
181 kfree_sensitive(data);
182 return err;
183}
184
185/* Addition in Z/(2^{128}Z) */
186static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2)
187{
188 u64 x = le64_to_cpu(v1->b);
189 u64 y = le64_to_cpu(v2->b);
190
191 r->b = cpu_to_le64(x + y);
192 r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) +
193 (x + y < x));
194}
195
196/* Subtraction in Z/(2^{128}Z) */
197static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2)
198{
199 u64 x = le64_to_cpu(v1->b);
200 u64 y = le64_to_cpu(v2->b);
201
202 r->b = cpu_to_le64(x - y);
203 r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) -
204 (x - y > x));
205}
206
207/*
208 * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the
209 * result to rctx->header_hash. This is the calculation
210 *
211 * H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T)
212 *
213 * from the procedure in section 6.4 of the Adiantum paper. The resulting value
214 * is reused in both the first and second hash steps. Specifically, it's added
215 * to the result of an independently keyed ε-∆U hash function (for equal length
216 * inputs only) taken over the left-hand part (the "bulk") of the message, to
217 * give the overall Adiantum hash of the (tweak, left-hand part) pair.
218 */
219static void adiantum_hash_header(struct skcipher_request *req)
220{
221 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
222 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
223 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
224 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
225 struct {
226 __le64 message_bits;
227 __le64 padding;
228 } header = {
229 .message_bits = cpu_to_le64((u64)bulk_len * 8)
230 };
231 struct poly1305_state state;
232
233 poly1305_core_init(&state);
234
235 BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0);
236 poly1305_core_blocks(&state, &tctx->header_hash_key,
237 &header, sizeof(header) / POLY1305_BLOCK_SIZE, 1);
238
239 BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0);
240 poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv,
241 TWEAK_SIZE / POLY1305_BLOCK_SIZE, 1);
242
243 poly1305_core_emit(&state, NULL, &rctx->header_hash);
244}
245
246/* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */
247static int adiantum_hash_message(struct skcipher_request *req,
248 struct scatterlist *sgl, unsigned int nents,
249 le128 *digest)
250{
251 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
252 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
253 struct shash_desc *hash_desc = &rctx->u.hash_desc;
254 struct sg_mapping_iter miter;
255 unsigned int i, n;
256 int err;
257
258 err = crypto_shash_init(hash_desc);
259 if (err)
260 return err;
261
262 sg_miter_start(&miter, sgl, nents, SG_MITER_FROM_SG | SG_MITER_ATOMIC);
263 for (i = 0; i < bulk_len; i += n) {
264 sg_miter_next(&miter);
265 n = min_t(unsigned int, miter.length, bulk_len - i);
266 err = crypto_shash_update(hash_desc, miter.addr, n);
267 if (err)
268 break;
269 }
270 sg_miter_stop(&miter);
271 if (err)
272 return err;
273
274 return crypto_shash_final(hash_desc, (u8 *)digest);
275}
276
277/* Continue Adiantum encryption/decryption after the stream cipher step */
278static int adiantum_finish(struct skcipher_request *req)
279{
280 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
281 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
282 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
283 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
284 struct scatterlist *dst = req->dst;
285 const unsigned int dst_nents = sg_nents(dst);
286 le128 digest;
287 int err;
288
289 /* If decrypting, decrypt C_M with the block cipher to get P_M */
290 if (!rctx->enc)
291 crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
292 rctx->rbuf.bytes);
293
294 /*
295 * Second hash step
296 * enc: C_R = C_M - H_{K_H}(T, C_L)
297 * dec: P_R = P_M - H_{K_H}(T, P_L)
298 */
299 rctx->u.hash_desc.tfm = tctx->hash;
300 le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &rctx->header_hash);
301 if (dst_nents == 1 && dst->offset + req->cryptlen <= PAGE_SIZE) {
302 /* Fast path for single-page destination */
303 struct page *page = sg_page(dst);
304 void *virt = kmap_local_page(page) + dst->offset;
305
306 err = crypto_shash_digest(&rctx->u.hash_desc, virt, bulk_len,
307 (u8 *)&digest);
308 if (err) {
309 kunmap_local(virt);
310 return err;
311 }
312 le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
313 memcpy(virt + bulk_len, &rctx->rbuf.bignum, sizeof(le128));
314 flush_dcache_page(page);
315 kunmap_local(virt);
316 } else {
317 /* Slow path that works for any destination scatterlist */
318 err = adiantum_hash_message(req, dst, dst_nents, &digest);
319 if (err)
320 return err;
321 le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
322 scatterwalk_map_and_copy(&rctx->rbuf.bignum, dst,
323 bulk_len, sizeof(le128), 1);
324 }
325 return 0;
326}
327
328static void adiantum_streamcipher_done(void *data, int err)
329{
330 struct skcipher_request *req = data;
331
332 if (!err)
333 err = adiantum_finish(req);
334
335 skcipher_request_complete(req, err);
336}
337
338static int adiantum_crypt(struct skcipher_request *req, bool enc)
339{
340 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
341 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
342 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
343 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
344 struct scatterlist *src = req->src;
345 const unsigned int src_nents = sg_nents(src);
346 unsigned int stream_len;
347 le128 digest;
348 int err;
349
350 if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE)
351 return -EINVAL;
352
353 rctx->enc = enc;
354
355 /*
356 * First hash step
357 * enc: P_M = P_R + H_{K_H}(T, P_L)
358 * dec: C_M = C_R + H_{K_H}(T, C_L)
359 */
360 adiantum_hash_header(req);
361 rctx->u.hash_desc.tfm = tctx->hash;
362 if (src_nents == 1 && src->offset + req->cryptlen <= PAGE_SIZE) {
363 /* Fast path for single-page source */
364 void *virt = kmap_local_page(sg_page(src)) + src->offset;
365
366 err = crypto_shash_digest(&rctx->u.hash_desc, virt, bulk_len,
367 (u8 *)&digest);
368 memcpy(&rctx->rbuf.bignum, virt + bulk_len, sizeof(le128));
369 kunmap_local(virt);
370 } else {
371 /* Slow path that works for any source scatterlist */
372 err = adiantum_hash_message(req, src, src_nents, &digest);
373 scatterwalk_map_and_copy(&rctx->rbuf.bignum, src,
374 bulk_len, sizeof(le128), 0);
375 }
376 if (err)
377 return err;
378 le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &rctx->header_hash);
379 le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
380
381 /* If encrypting, encrypt P_M with the block cipher to get C_M */
382 if (enc)
383 crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
384 rctx->rbuf.bytes);
385
386 /* Initialize the rest of the XChaCha IV (first part is C_M) */
387 BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16);
388 BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); /* nonce || stream position */
389 rctx->rbuf.words[4] = cpu_to_le32(1);
390 rctx->rbuf.words[5] = 0;
391 rctx->rbuf.words[6] = 0;
392 rctx->rbuf.words[7] = 0;
393
394 /*
395 * XChaCha needs to be done on all the data except the last 16 bytes;
396 * for disk encryption that usually means 4080 or 496 bytes. But ChaCha
397 * implementations tend to be most efficient when passed a whole number
398 * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes.
399 * And here it doesn't matter whether the last 16 bytes are written to,
400 * as the second hash step will overwrite them. Thus, round the XChaCha
401 * length up to the next 64-byte boundary if possible.
402 */
403 stream_len = bulk_len;
404 if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen)
405 stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE);
406
407 skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher);
408 skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src,
409 req->dst, stream_len, &rctx->rbuf);
410 skcipher_request_set_callback(&rctx->u.streamcipher_req,
411 req->base.flags,
412 adiantum_streamcipher_done, req);
413 return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?:
414 adiantum_finish(req);
415}
416
417static int adiantum_encrypt(struct skcipher_request *req)
418{
419 return adiantum_crypt(req, true);
420}
421
422static int adiantum_decrypt(struct skcipher_request *req)
423{
424 return adiantum_crypt(req, false);
425}
426
427static int adiantum_init_tfm(struct crypto_skcipher *tfm)
428{
429 struct skcipher_instance *inst = skcipher_alg_instance(tfm);
430 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
431 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
432 struct crypto_skcipher *streamcipher;
433 struct crypto_cipher *blockcipher;
434 struct crypto_shash *hash;
435 unsigned int subreq_size;
436 int err;
437
438 streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn);
439 if (IS_ERR(streamcipher))
440 return PTR_ERR(streamcipher);
441
442 blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn);
443 if (IS_ERR(blockcipher)) {
444 err = PTR_ERR(blockcipher);
445 goto err_free_streamcipher;
446 }
447
448 hash = crypto_spawn_shash(&ictx->hash_spawn);
449 if (IS_ERR(hash)) {
450 err = PTR_ERR(hash);
451 goto err_free_blockcipher;
452 }
453
454 tctx->streamcipher = streamcipher;
455 tctx->blockcipher = blockcipher;
456 tctx->hash = hash;
457
458 BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) !=
459 sizeof(struct adiantum_request_ctx));
460 subreq_size = max(sizeof_field(struct adiantum_request_ctx,
461 u.hash_desc) +
462 crypto_shash_descsize(hash),
463 sizeof_field(struct adiantum_request_ctx,
464 u.streamcipher_req) +
465 crypto_skcipher_reqsize(streamcipher));
466
467 crypto_skcipher_set_reqsize(tfm,
468 offsetof(struct adiantum_request_ctx, u) +
469 subreq_size);
470 return 0;
471
472err_free_blockcipher:
473 crypto_free_cipher(blockcipher);
474err_free_streamcipher:
475 crypto_free_skcipher(streamcipher);
476 return err;
477}
478
479static void adiantum_exit_tfm(struct crypto_skcipher *tfm)
480{
481 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
482
483 crypto_free_skcipher(tctx->streamcipher);
484 crypto_free_cipher(tctx->blockcipher);
485 crypto_free_shash(tctx->hash);
486}
487
488static void adiantum_free_instance(struct skcipher_instance *inst)
489{
490 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
491
492 crypto_drop_skcipher(&ictx->streamcipher_spawn);
493 crypto_drop_cipher(&ictx->blockcipher_spawn);
494 crypto_drop_shash(&ictx->hash_spawn);
495 kfree(inst);
496}
497
498/*
499 * Check for a supported set of inner algorithms.
500 * See the comment at the beginning of this file.
501 */
502static bool adiantum_supported_algorithms(struct skcipher_alg_common *streamcipher_alg,
503 struct crypto_alg *blockcipher_alg,
504 struct shash_alg *hash_alg)
505{
506 if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 &&
507 strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0)
508 return false;
509
510 if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE ||
511 blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE)
512 return false;
513 if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE)
514 return false;
515
516 if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0)
517 return false;
518
519 return true;
520}
521
522static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
523{
524 u32 mask;
525 const char *nhpoly1305_name;
526 struct skcipher_instance *inst;
527 struct adiantum_instance_ctx *ictx;
528 struct skcipher_alg_common *streamcipher_alg;
529 struct crypto_alg *blockcipher_alg;
530 struct shash_alg *hash_alg;
531 int err;
532
533 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SKCIPHER, &mask);
534 if (err)
535 return err;
536
537 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
538 if (!inst)
539 return -ENOMEM;
540 ictx = skcipher_instance_ctx(inst);
541
542 /* Stream cipher, e.g. "xchacha12" */
543 err = crypto_grab_skcipher(&ictx->streamcipher_spawn,
544 skcipher_crypto_instance(inst),
545 crypto_attr_alg_name(tb[1]), 0, mask);
546 if (err)
547 goto err_free_inst;
548 streamcipher_alg = crypto_spawn_skcipher_alg_common(&ictx->streamcipher_spawn);
549
550 /* Block cipher, e.g. "aes" */
551 err = crypto_grab_cipher(&ictx->blockcipher_spawn,
552 skcipher_crypto_instance(inst),
553 crypto_attr_alg_name(tb[2]), 0, mask);
554 if (err)
555 goto err_free_inst;
556 blockcipher_alg = crypto_spawn_cipher_alg(&ictx->blockcipher_spawn);
557
558 /* NHPoly1305 ε-∆U hash function */
559 nhpoly1305_name = crypto_attr_alg_name(tb[3]);
560 if (nhpoly1305_name == ERR_PTR(-ENOENT))
561 nhpoly1305_name = "nhpoly1305";
562 err = crypto_grab_shash(&ictx->hash_spawn,
563 skcipher_crypto_instance(inst),
564 nhpoly1305_name, 0, mask);
565 if (err)
566 goto err_free_inst;
567 hash_alg = crypto_spawn_shash_alg(&ictx->hash_spawn);
568
569 /* Check the set of algorithms */
570 if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg,
571 hash_alg)) {
572 pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n",
573 streamcipher_alg->base.cra_name,
574 blockcipher_alg->cra_name, hash_alg->base.cra_name);
575 err = -EINVAL;
576 goto err_free_inst;
577 }
578
579 /* Instance fields */
580
581 err = -ENAMETOOLONG;
582 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
583 "adiantum(%s,%s)", streamcipher_alg->base.cra_name,
584 blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME)
585 goto err_free_inst;
586 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
587 "adiantum(%s,%s,%s)",
588 streamcipher_alg->base.cra_driver_name,
589 blockcipher_alg->cra_driver_name,
590 hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
591 goto err_free_inst;
592
593 inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE;
594 inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx);
595 inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask;
596 /*
597 * The block cipher is only invoked once per message, so for long
598 * messages (e.g. sectors for disk encryption) its performance doesn't
599 * matter as much as that of the stream cipher and hash function. Thus,
600 * weigh the block cipher's ->cra_priority less.
601 */
602 inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority +
603 2 * hash_alg->base.cra_priority +
604 blockcipher_alg->cra_priority) / 7;
605
606 inst->alg.setkey = adiantum_setkey;
607 inst->alg.encrypt = adiantum_encrypt;
608 inst->alg.decrypt = adiantum_decrypt;
609 inst->alg.init = adiantum_init_tfm;
610 inst->alg.exit = adiantum_exit_tfm;
611 inst->alg.min_keysize = streamcipher_alg->min_keysize;
612 inst->alg.max_keysize = streamcipher_alg->max_keysize;
613 inst->alg.ivsize = TWEAK_SIZE;
614
615 inst->free = adiantum_free_instance;
616
617 err = skcipher_register_instance(tmpl, inst);
618 if (err) {
619err_free_inst:
620 adiantum_free_instance(inst);
621 }
622 return err;
623}
624
625/* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */
626static struct crypto_template adiantum_tmpl = {
627 .name = "adiantum",
628 .create = adiantum_create,
629 .module = THIS_MODULE,
630};
631
632static int __init adiantum_module_init(void)
633{
634 return crypto_register_template(&adiantum_tmpl);
635}
636
637static void __exit adiantum_module_exit(void)
638{
639 crypto_unregister_template(&adiantum_tmpl);
640}
641
642subsys_initcall(adiantum_module_init);
643module_exit(adiantum_module_exit);
644
645MODULE_DESCRIPTION("Adiantum length-preserving encryption mode");
646MODULE_LICENSE("GPL v2");
647MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
648MODULE_ALIAS_CRYPTO("adiantum");
649MODULE_IMPORT_NS(CRYPTO_INTERNAL);
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Adiantum length-preserving encryption mode
4 *
5 * Copyright 2018 Google LLC
6 */
7
8/*
9 * Adiantum is a tweakable, length-preserving encryption mode designed for fast
10 * and secure disk encryption, especially on CPUs without dedicated crypto
11 * instructions. Adiantum encrypts each sector using the XChaCha12 stream
12 * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on
13 * NH and Poly1305, and an invocation of the AES-256 block cipher on a single
14 * 16-byte block. See the paper for details:
15 *
16 * Adiantum: length-preserving encryption for entry-level processors
17 * (https://eprint.iacr.org/2018/720.pdf)
18 *
19 * For flexibility, this implementation also allows other ciphers:
20 *
21 * - Stream cipher: XChaCha12 or XChaCha20
22 * - Block cipher: any with a 128-bit block size and 256-bit key
23 *
24 * This implementation doesn't currently allow other ε-∆U hash functions, i.e.
25 * HPolyC is not supported. This is because Adiantum is ~20% faster than HPolyC
26 * but still provably as secure, and also the ε-∆U hash function of HBSH is
27 * formally defined to take two inputs (tweak, message) which makes it difficult
28 * to wrap with the crypto_shash API. Rather, some details need to be handled
29 * here. Nevertheless, if needed in the future, support for other ε-∆U hash
30 * functions could be added here.
31 */
32
33#include <crypto/b128ops.h>
34#include <crypto/chacha.h>
35#include <crypto/internal/hash.h>
36#include <crypto/internal/skcipher.h>
37#include <crypto/nhpoly1305.h>
38#include <crypto/scatterwalk.h>
39#include <linux/module.h>
40
41#include "internal.h"
42
43/*
44 * Size of right-hand part of input data, in bytes; also the size of the block
45 * cipher's block size and the hash function's output.
46 */
47#define BLOCKCIPHER_BLOCK_SIZE 16
48
49/* Size of the block cipher key (K_E) in bytes */
50#define BLOCKCIPHER_KEY_SIZE 32
51
52/* Size of the hash key (K_H) in bytes */
53#define HASH_KEY_SIZE (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE)
54
55/*
56 * The specification allows variable-length tweaks, but Linux's crypto API
57 * currently only allows algorithms to support a single length. The "natural"
58 * tweak length for Adiantum is 16, since that fits into one Poly1305 block for
59 * the best performance. But longer tweaks are useful for fscrypt, to avoid
60 * needing to derive per-file keys. So instead we use two blocks, or 32 bytes.
61 */
62#define TWEAK_SIZE 32
63
64struct adiantum_instance_ctx {
65 struct crypto_skcipher_spawn streamcipher_spawn;
66 struct crypto_spawn blockcipher_spawn;
67 struct crypto_shash_spawn hash_spawn;
68};
69
70struct adiantum_tfm_ctx {
71 struct crypto_skcipher *streamcipher;
72 struct crypto_cipher *blockcipher;
73 struct crypto_shash *hash;
74 struct poly1305_key header_hash_key;
75};
76
77struct adiantum_request_ctx {
78
79 /*
80 * Buffer for right-hand part of data, i.e.
81 *
82 * P_L => P_M => C_M => C_R when encrypting, or
83 * C_R => C_M => P_M => P_L when decrypting.
84 *
85 * Also used to build the IV for the stream cipher.
86 */
87 union {
88 u8 bytes[XCHACHA_IV_SIZE];
89 __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)];
90 le128 bignum; /* interpret as element of Z/(2^{128}Z) */
91 } rbuf;
92
93 bool enc; /* true if encrypting, false if decrypting */
94
95 /*
96 * The result of the Poly1305 ε-∆U hash function applied to
97 * (bulk length, tweak)
98 */
99 le128 header_hash;
100
101 /* Sub-requests, must be last */
102 union {
103 struct shash_desc hash_desc;
104 struct skcipher_request streamcipher_req;
105 } u;
106};
107
108/*
109 * Given the XChaCha stream key K_S, derive the block cipher key K_E and the
110 * hash key K_H as follows:
111 *
112 * K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191)
113 *
114 * Note that this denotes using bits from the XChaCha keystream, which here we
115 * get indirectly by encrypting a buffer containing all 0's.
116 */
117static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key,
118 unsigned int keylen)
119{
120 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
121 struct {
122 u8 iv[XCHACHA_IV_SIZE];
123 u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE];
124 struct scatterlist sg;
125 struct crypto_wait wait;
126 struct skcipher_request req; /* must be last */
127 } *data;
128 u8 *keyp;
129 int err;
130
131 /* Set the stream cipher key (K_S) */
132 crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK);
133 crypto_skcipher_set_flags(tctx->streamcipher,
134 crypto_skcipher_get_flags(tfm) &
135 CRYPTO_TFM_REQ_MASK);
136 err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen);
137 crypto_skcipher_set_flags(tfm,
138 crypto_skcipher_get_flags(tctx->streamcipher) &
139 CRYPTO_TFM_RES_MASK);
140 if (err)
141 return err;
142
143 /* Derive the subkeys */
144 data = kzalloc(sizeof(*data) +
145 crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL);
146 if (!data)
147 return -ENOMEM;
148 data->iv[0] = 1;
149 sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys));
150 crypto_init_wait(&data->wait);
151 skcipher_request_set_tfm(&data->req, tctx->streamcipher);
152 skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP |
153 CRYPTO_TFM_REQ_MAY_BACKLOG,
154 crypto_req_done, &data->wait);
155 skcipher_request_set_crypt(&data->req, &data->sg, &data->sg,
156 sizeof(data->derived_keys), data->iv);
157 err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait);
158 if (err)
159 goto out;
160 keyp = data->derived_keys;
161
162 /* Set the block cipher key (K_E) */
163 crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK);
164 crypto_cipher_set_flags(tctx->blockcipher,
165 crypto_skcipher_get_flags(tfm) &
166 CRYPTO_TFM_REQ_MASK);
167 err = crypto_cipher_setkey(tctx->blockcipher, keyp,
168 BLOCKCIPHER_KEY_SIZE);
169 crypto_skcipher_set_flags(tfm,
170 crypto_cipher_get_flags(tctx->blockcipher) &
171 CRYPTO_TFM_RES_MASK);
172 if (err)
173 goto out;
174 keyp += BLOCKCIPHER_KEY_SIZE;
175
176 /* Set the hash key (K_H) */
177 poly1305_core_setkey(&tctx->header_hash_key, keyp);
178 keyp += POLY1305_BLOCK_SIZE;
179
180 crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK);
181 crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) &
182 CRYPTO_TFM_REQ_MASK);
183 err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE);
184 crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) &
185 CRYPTO_TFM_RES_MASK);
186 keyp += NHPOLY1305_KEY_SIZE;
187 WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]);
188out:
189 kzfree(data);
190 return err;
191}
192
193/* Addition in Z/(2^{128}Z) */
194static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2)
195{
196 u64 x = le64_to_cpu(v1->b);
197 u64 y = le64_to_cpu(v2->b);
198
199 r->b = cpu_to_le64(x + y);
200 r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) +
201 (x + y < x));
202}
203
204/* Subtraction in Z/(2^{128}Z) */
205static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2)
206{
207 u64 x = le64_to_cpu(v1->b);
208 u64 y = le64_to_cpu(v2->b);
209
210 r->b = cpu_to_le64(x - y);
211 r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) -
212 (x - y > x));
213}
214
215/*
216 * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the
217 * result to rctx->header_hash. This is the calculation
218 *
219 * H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T)
220 *
221 * from the procedure in section 6.4 of the Adiantum paper. The resulting value
222 * is reused in both the first and second hash steps. Specifically, it's added
223 * to the result of an independently keyed ε-∆U hash function (for equal length
224 * inputs only) taken over the left-hand part (the "bulk") of the message, to
225 * give the overall Adiantum hash of the (tweak, left-hand part) pair.
226 */
227static void adiantum_hash_header(struct skcipher_request *req)
228{
229 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
230 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
231 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
232 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
233 struct {
234 __le64 message_bits;
235 __le64 padding;
236 } header = {
237 .message_bits = cpu_to_le64((u64)bulk_len * 8)
238 };
239 struct poly1305_state state;
240
241 poly1305_core_init(&state);
242
243 BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0);
244 poly1305_core_blocks(&state, &tctx->header_hash_key,
245 &header, sizeof(header) / POLY1305_BLOCK_SIZE);
246
247 BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0);
248 poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv,
249 TWEAK_SIZE / POLY1305_BLOCK_SIZE);
250
251 poly1305_core_emit(&state, &rctx->header_hash);
252}
253
254/* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */
255static int adiantum_hash_message(struct skcipher_request *req,
256 struct scatterlist *sgl, le128 *digest)
257{
258 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
259 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
260 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
261 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
262 struct shash_desc *hash_desc = &rctx->u.hash_desc;
263 struct sg_mapping_iter miter;
264 unsigned int i, n;
265 int err;
266
267 hash_desc->tfm = tctx->hash;
268
269 err = crypto_shash_init(hash_desc);
270 if (err)
271 return err;
272
273 sg_miter_start(&miter, sgl, sg_nents(sgl),
274 SG_MITER_FROM_SG | SG_MITER_ATOMIC);
275 for (i = 0; i < bulk_len; i += n) {
276 sg_miter_next(&miter);
277 n = min_t(unsigned int, miter.length, bulk_len - i);
278 err = crypto_shash_update(hash_desc, miter.addr, n);
279 if (err)
280 break;
281 }
282 sg_miter_stop(&miter);
283 if (err)
284 return err;
285
286 return crypto_shash_final(hash_desc, (u8 *)digest);
287}
288
289/* Continue Adiantum encryption/decryption after the stream cipher step */
290static int adiantum_finish(struct skcipher_request *req)
291{
292 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
293 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
294 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
295 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
296 le128 digest;
297 int err;
298
299 /* If decrypting, decrypt C_M with the block cipher to get P_M */
300 if (!rctx->enc)
301 crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
302 rctx->rbuf.bytes);
303
304 /*
305 * Second hash step
306 * enc: C_R = C_M - H_{K_H}(T, C_L)
307 * dec: P_R = P_M - H_{K_H}(T, P_L)
308 */
309 err = adiantum_hash_message(req, req->dst, &digest);
310 if (err)
311 return err;
312 le128_add(&digest, &digest, &rctx->header_hash);
313 le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
314 scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst,
315 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1);
316 return 0;
317}
318
319static void adiantum_streamcipher_done(struct crypto_async_request *areq,
320 int err)
321{
322 struct skcipher_request *req = areq->data;
323
324 if (!err)
325 err = adiantum_finish(req);
326
327 skcipher_request_complete(req, err);
328}
329
330static int adiantum_crypt(struct skcipher_request *req, bool enc)
331{
332 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
333 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
334 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req);
335 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE;
336 unsigned int stream_len;
337 le128 digest;
338 int err;
339
340 if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE)
341 return -EINVAL;
342
343 rctx->enc = enc;
344
345 /*
346 * First hash step
347 * enc: P_M = P_R + H_{K_H}(T, P_L)
348 * dec: C_M = C_R + H_{K_H}(T, C_L)
349 */
350 adiantum_hash_header(req);
351 err = adiantum_hash_message(req, req->src, &digest);
352 if (err)
353 return err;
354 le128_add(&digest, &digest, &rctx->header_hash);
355 scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src,
356 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0);
357 le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest);
358
359 /* If encrypting, encrypt P_M with the block cipher to get C_M */
360 if (enc)
361 crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes,
362 rctx->rbuf.bytes);
363
364 /* Initialize the rest of the XChaCha IV (first part is C_M) */
365 BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16);
366 BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); /* nonce || stream position */
367 rctx->rbuf.words[4] = cpu_to_le32(1);
368 rctx->rbuf.words[5] = 0;
369 rctx->rbuf.words[6] = 0;
370 rctx->rbuf.words[7] = 0;
371
372 /*
373 * XChaCha needs to be done on all the data except the last 16 bytes;
374 * for disk encryption that usually means 4080 or 496 bytes. But ChaCha
375 * implementations tend to be most efficient when passed a whole number
376 * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes.
377 * And here it doesn't matter whether the last 16 bytes are written to,
378 * as the second hash step will overwrite them. Thus, round the XChaCha
379 * length up to the next 64-byte boundary if possible.
380 */
381 stream_len = bulk_len;
382 if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen)
383 stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE);
384
385 skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher);
386 skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src,
387 req->dst, stream_len, &rctx->rbuf);
388 skcipher_request_set_callback(&rctx->u.streamcipher_req,
389 req->base.flags,
390 adiantum_streamcipher_done, req);
391 return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?:
392 adiantum_finish(req);
393}
394
395static int adiantum_encrypt(struct skcipher_request *req)
396{
397 return adiantum_crypt(req, true);
398}
399
400static int adiantum_decrypt(struct skcipher_request *req)
401{
402 return adiantum_crypt(req, false);
403}
404
405static int adiantum_init_tfm(struct crypto_skcipher *tfm)
406{
407 struct skcipher_instance *inst = skcipher_alg_instance(tfm);
408 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
409 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
410 struct crypto_skcipher *streamcipher;
411 struct crypto_cipher *blockcipher;
412 struct crypto_shash *hash;
413 unsigned int subreq_size;
414 int err;
415
416 streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn);
417 if (IS_ERR(streamcipher))
418 return PTR_ERR(streamcipher);
419
420 blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn);
421 if (IS_ERR(blockcipher)) {
422 err = PTR_ERR(blockcipher);
423 goto err_free_streamcipher;
424 }
425
426 hash = crypto_spawn_shash(&ictx->hash_spawn);
427 if (IS_ERR(hash)) {
428 err = PTR_ERR(hash);
429 goto err_free_blockcipher;
430 }
431
432 tctx->streamcipher = streamcipher;
433 tctx->blockcipher = blockcipher;
434 tctx->hash = hash;
435
436 BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) !=
437 sizeof(struct adiantum_request_ctx));
438 subreq_size = max(FIELD_SIZEOF(struct adiantum_request_ctx,
439 u.hash_desc) +
440 crypto_shash_descsize(hash),
441 FIELD_SIZEOF(struct adiantum_request_ctx,
442 u.streamcipher_req) +
443 crypto_skcipher_reqsize(streamcipher));
444
445 crypto_skcipher_set_reqsize(tfm,
446 offsetof(struct adiantum_request_ctx, u) +
447 subreq_size);
448 return 0;
449
450err_free_blockcipher:
451 crypto_free_cipher(blockcipher);
452err_free_streamcipher:
453 crypto_free_skcipher(streamcipher);
454 return err;
455}
456
457static void adiantum_exit_tfm(struct crypto_skcipher *tfm)
458{
459 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
460
461 crypto_free_skcipher(tctx->streamcipher);
462 crypto_free_cipher(tctx->blockcipher);
463 crypto_free_shash(tctx->hash);
464}
465
466static void adiantum_free_instance(struct skcipher_instance *inst)
467{
468 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst);
469
470 crypto_drop_skcipher(&ictx->streamcipher_spawn);
471 crypto_drop_spawn(&ictx->blockcipher_spawn);
472 crypto_drop_shash(&ictx->hash_spawn);
473 kfree(inst);
474}
475
476/*
477 * Check for a supported set of inner algorithms.
478 * See the comment at the beginning of this file.
479 */
480static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg,
481 struct crypto_alg *blockcipher_alg,
482 struct shash_alg *hash_alg)
483{
484 if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 &&
485 strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0)
486 return false;
487
488 if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE ||
489 blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE)
490 return false;
491 if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE)
492 return false;
493
494 if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0)
495 return false;
496
497 return true;
498}
499
500static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
501{
502 struct crypto_attr_type *algt;
503 const char *streamcipher_name;
504 const char *blockcipher_name;
505 const char *nhpoly1305_name;
506 struct skcipher_instance *inst;
507 struct adiantum_instance_ctx *ictx;
508 struct skcipher_alg *streamcipher_alg;
509 struct crypto_alg *blockcipher_alg;
510 struct crypto_alg *_hash_alg;
511 struct shash_alg *hash_alg;
512 int err;
513
514 algt = crypto_get_attr_type(tb);
515 if (IS_ERR(algt))
516 return PTR_ERR(algt);
517
518 if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask)
519 return -EINVAL;
520
521 streamcipher_name = crypto_attr_alg_name(tb[1]);
522 if (IS_ERR(streamcipher_name))
523 return PTR_ERR(streamcipher_name);
524
525 blockcipher_name = crypto_attr_alg_name(tb[2]);
526 if (IS_ERR(blockcipher_name))
527 return PTR_ERR(blockcipher_name);
528
529 nhpoly1305_name = crypto_attr_alg_name(tb[3]);
530 if (nhpoly1305_name == ERR_PTR(-ENOENT))
531 nhpoly1305_name = "nhpoly1305";
532 if (IS_ERR(nhpoly1305_name))
533 return PTR_ERR(nhpoly1305_name);
534
535 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
536 if (!inst)
537 return -ENOMEM;
538 ictx = skcipher_instance_ctx(inst);
539
540 /* Stream cipher, e.g. "xchacha12" */
541 crypto_set_skcipher_spawn(&ictx->streamcipher_spawn,
542 skcipher_crypto_instance(inst));
543 err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name,
544 0, crypto_requires_sync(algt->type,
545 algt->mask));
546 if (err)
547 goto out_free_inst;
548 streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn);
549
550 /* Block cipher, e.g. "aes" */
551 crypto_set_spawn(&ictx->blockcipher_spawn,
552 skcipher_crypto_instance(inst));
553 err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name,
554 CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK);
555 if (err)
556 goto out_drop_streamcipher;
557 blockcipher_alg = ictx->blockcipher_spawn.alg;
558
559 /* NHPoly1305 ε-∆U hash function */
560 _hash_alg = crypto_alg_mod_lookup(nhpoly1305_name,
561 CRYPTO_ALG_TYPE_SHASH,
562 CRYPTO_ALG_TYPE_MASK);
563 if (IS_ERR(_hash_alg)) {
564 err = PTR_ERR(_hash_alg);
565 goto out_drop_blockcipher;
566 }
567 hash_alg = __crypto_shash_alg(_hash_alg);
568 err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg,
569 skcipher_crypto_instance(inst));
570 if (err)
571 goto out_put_hash;
572
573 /* Check the set of algorithms */
574 if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg,
575 hash_alg)) {
576 pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n",
577 streamcipher_alg->base.cra_name,
578 blockcipher_alg->cra_name, hash_alg->base.cra_name);
579 err = -EINVAL;
580 goto out_drop_hash;
581 }
582
583 /* Instance fields */
584
585 err = -ENAMETOOLONG;
586 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
587 "adiantum(%s,%s)", streamcipher_alg->base.cra_name,
588 blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME)
589 goto out_drop_hash;
590 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
591 "adiantum(%s,%s,%s)",
592 streamcipher_alg->base.cra_driver_name,
593 blockcipher_alg->cra_driver_name,
594 hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
595 goto out_drop_hash;
596
597 inst->alg.base.cra_flags = streamcipher_alg->base.cra_flags &
598 CRYPTO_ALG_ASYNC;
599 inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE;
600 inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx);
601 inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask |
602 hash_alg->base.cra_alignmask;
603 /*
604 * The block cipher is only invoked once per message, so for long
605 * messages (e.g. sectors for disk encryption) its performance doesn't
606 * matter as much as that of the stream cipher and hash function. Thus,
607 * weigh the block cipher's ->cra_priority less.
608 */
609 inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority +
610 2 * hash_alg->base.cra_priority +
611 blockcipher_alg->cra_priority) / 7;
612
613 inst->alg.setkey = adiantum_setkey;
614 inst->alg.encrypt = adiantum_encrypt;
615 inst->alg.decrypt = adiantum_decrypt;
616 inst->alg.init = adiantum_init_tfm;
617 inst->alg.exit = adiantum_exit_tfm;
618 inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg);
619 inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg);
620 inst->alg.ivsize = TWEAK_SIZE;
621
622 inst->free = adiantum_free_instance;
623
624 err = skcipher_register_instance(tmpl, inst);
625 if (err)
626 goto out_drop_hash;
627
628 crypto_mod_put(_hash_alg);
629 return 0;
630
631out_drop_hash:
632 crypto_drop_shash(&ictx->hash_spawn);
633out_put_hash:
634 crypto_mod_put(_hash_alg);
635out_drop_blockcipher:
636 crypto_drop_spawn(&ictx->blockcipher_spawn);
637out_drop_streamcipher:
638 crypto_drop_skcipher(&ictx->streamcipher_spawn);
639out_free_inst:
640 kfree(inst);
641 return err;
642}
643
644/* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */
645static struct crypto_template adiantum_tmpl = {
646 .name = "adiantum",
647 .create = adiantum_create,
648 .module = THIS_MODULE,
649};
650
651static int __init adiantum_module_init(void)
652{
653 return crypto_register_template(&adiantum_tmpl);
654}
655
656static void __exit adiantum_module_exit(void)
657{
658 crypto_unregister_template(&adiantum_tmpl);
659}
660
661subsys_initcall(adiantum_module_init);
662module_exit(adiantum_module_exit);
663
664MODULE_DESCRIPTION("Adiantum length-preserving encryption mode");
665MODULE_LICENSE("GPL v2");
666MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
667MODULE_ALIAS_CRYPTO("adiantum");