1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _COMMON_CRYPTO_MODES_H 27 #define _COMMON_CRYPTO_MODES_H 28 29 #ifdef __cplusplus 30 extern "C" { 31 #endif 32 33 #include <sys/zfs_context.h> 34 #include <sys/crypto/common.h> 35 #include <sys/crypto/impl.h> 36 37 /* 38 * Does the build chain support all instructions needed for the GCM assembler 39 * routines. AVX support should imply AES-NI and PCLMULQDQ, but make sure 40 * anyhow. 41 */ 42 #if defined(__x86_64__) && defined(HAVE_AVX) && \ 43 defined(HAVE_AES) && defined(HAVE_PCLMULQDQ) 44 #define CAN_USE_GCM_ASM 45 extern boolean_t gcm_avx_can_use_movbe; 46 #endif 47 48 #define ECB_MODE 0x00000002 49 #define CBC_MODE 0x00000004 50 #define CTR_MODE 0x00000008 51 #define CCM_MODE 0x00000010 52 #define GCM_MODE 0x00000020 53 #define GMAC_MODE 0x00000040 54 55 /* 56 * cc_keysched: Pointer to key schedule. 57 * 58 * cc_keysched_len: Length of the key schedule. 59 * 60 * cc_remainder: This is for residual data, i.e. data that can't 61 * be processed because there are too few bytes. 62 * Must wait until more data arrives. 63 * 64 * cc_remainder_len: Number of bytes in cc_remainder. 65 * 66 * cc_iv: Scratch buffer that sometimes contains the IV. 67 * 68 * cc_lastp: Pointer to previous block of ciphertext. 69 * 70 * cc_copy_to: Pointer to where encrypted residual data needs 71 * to be copied. 72 * 73 * cc_flags: PROVIDER_OWNS_KEY_SCHEDULE 74 * When a context is freed, it is necessary 75 * to know whether the key schedule was allocated 76 * by the caller, or internally, e.g. an init routine. 77 * If allocated by the latter, then it needs to be freed. 78 * 79 * ECB_MODE, CBC_MODE, CTR_MODE, or CCM_MODE 80 */ 81 struct common_ctx { 82 void *cc_keysched; 83 size_t cc_keysched_len; 84 uint64_t cc_iv[2]; 85 uint64_t cc_remainder[2]; 86 size_t cc_remainder_len; 87 uint8_t *cc_lastp; 88 uint8_t *cc_copy_to; 89 uint32_t cc_flags; 90 }; 91 92 typedef struct common_ctx common_ctx_t; 93 94 typedef struct ecb_ctx { 95 struct common_ctx ecb_common; 96 uint64_t ecb_lastblock[2]; 97 } ecb_ctx_t; 98 99 #define ecb_keysched ecb_common.cc_keysched 100 #define ecb_keysched_len ecb_common.cc_keysched_len 101 #define ecb_iv ecb_common.cc_iv 102 #define ecb_remainder ecb_common.cc_remainder 103 #define ecb_remainder_len ecb_common.cc_remainder_len 104 #define ecb_lastp ecb_common.cc_lastp 105 #define ecb_copy_to ecb_common.cc_copy_to 106 #define ecb_flags ecb_common.cc_flags 107 108 typedef struct cbc_ctx { 109 struct common_ctx cbc_common; 110 uint64_t cbc_lastblock[2]; 111 } cbc_ctx_t; 112 113 #define cbc_keysched cbc_common.cc_keysched 114 #define cbc_keysched_len cbc_common.cc_keysched_len 115 #define cbc_iv cbc_common.cc_iv 116 #define cbc_remainder cbc_common.cc_remainder 117 #define cbc_remainder_len cbc_common.cc_remainder_len 118 #define cbc_lastp cbc_common.cc_lastp 119 #define cbc_copy_to cbc_common.cc_copy_to 120 #define cbc_flags cbc_common.cc_flags 121 122 /* 123 * ctr_lower_mask Bit-mask for lower 8 bytes of counter block. 124 * ctr_upper_mask Bit-mask for upper 8 bytes of counter block. 125 */ 126 typedef struct ctr_ctx { 127 struct common_ctx ctr_common; 128 uint64_t ctr_lower_mask; 129 uint64_t ctr_upper_mask; 130 uint32_t ctr_tmp[4]; 131 } ctr_ctx_t; 132 133 /* 134 * ctr_cb Counter block. 135 */ 136 #define ctr_keysched ctr_common.cc_keysched 137 #define ctr_keysched_len ctr_common.cc_keysched_len 138 #define ctr_cb ctr_common.cc_iv 139 #define ctr_remainder ctr_common.cc_remainder 140 #define ctr_remainder_len ctr_common.cc_remainder_len 141 #define ctr_lastp ctr_common.cc_lastp 142 #define ctr_copy_to ctr_common.cc_copy_to 143 #define ctr_flags ctr_common.cc_flags 144 145 /* 146 * 147 * ccm_mac_len: Stores length of the MAC in CCM mode. 148 * ccm_mac_buf: Stores the intermediate value for MAC in CCM encrypt. 149 * In CCM decrypt, stores the input MAC value. 150 * ccm_data_len: Length of the plaintext for CCM mode encrypt, or 151 * length of the ciphertext for CCM mode decrypt. 152 * ccm_processed_data_len: 153 * Length of processed plaintext in CCM mode encrypt, 154 * or length of processed ciphertext for CCM mode decrypt. 155 * ccm_processed_mac_len: 156 * Length of MAC data accumulated in CCM mode decrypt. 157 * 158 * ccm_pt_buf: Only used in CCM mode decrypt. It stores the 159 * decrypted plaintext to be returned when 160 * MAC verification succeeds in decrypt_final. 161 * Memory for this should be allocated in the AES module. 162 * 163 */ 164 typedef struct ccm_ctx { 165 struct common_ctx ccm_common; 166 uint32_t ccm_tmp[4]; 167 size_t ccm_mac_len; 168 uint64_t ccm_mac_buf[2]; 169 size_t ccm_data_len; 170 size_t ccm_processed_data_len; 171 size_t ccm_processed_mac_len; 172 uint8_t *ccm_pt_buf; 173 uint64_t ccm_mac_input_buf[2]; 174 uint64_t ccm_counter_mask; 175 } ccm_ctx_t; 176 177 #define ccm_keysched ccm_common.cc_keysched 178 #define ccm_keysched_len ccm_common.cc_keysched_len 179 #define ccm_cb ccm_common.cc_iv 180 #define ccm_remainder ccm_common.cc_remainder 181 #define ccm_remainder_len ccm_common.cc_remainder_len 182 #define ccm_lastp ccm_common.cc_lastp 183 #define ccm_copy_to ccm_common.cc_copy_to 184 #define ccm_flags ccm_common.cc_flags 185 186 /* 187 * gcm_tag_len: Length of authentication tag. 188 * 189 * gcm_ghash: Stores output from the GHASH function. 190 * 191 * gcm_processed_data_len: 192 * Length of processed plaintext (encrypt) or 193 * length of processed ciphertext (decrypt). 194 * 195 * gcm_pt_buf: Stores the decrypted plaintext returned by 196 * decrypt_final when the computed authentication 197 * tag matches the user supplied tag. 198 * 199 * gcm_pt_buf_len: Length of the plaintext buffer. 200 * 201 * gcm_H: Subkey. 202 * 203 * gcm_Htable: Pre-computed and pre-shifted H, H^2, ... H^6 for the 204 * Karatsuba Algorithm in host byte order. 205 * 206 * gcm_J0: Pre-counter block generated from the IV. 207 * 208 * gcm_len_a_len_c: 64-bit representations of the bit lengths of 209 * AAD and ciphertext. 210 * 211 * gcm_kmflag: Current value of kmflag. Used for allocating 212 * the plaintext buffer during decryption and a 213 * gcm_avx_chunk_size'd buffer for avx enabled encryption. 214 */ 215 typedef struct gcm_ctx { 216 struct common_ctx gcm_common; 217 size_t gcm_tag_len; 218 size_t gcm_processed_data_len; 219 size_t gcm_pt_buf_len; 220 uint32_t gcm_tmp[4]; 221 /* 222 * The offset of gcm_Htable relative to gcm_ghash, (32), is hard coded 223 * in aesni-gcm-x86_64.S, so please don't change (or adjust there). 224 */ 225 uint64_t gcm_ghash[2]; 226 uint64_t gcm_H[2]; 227 #ifdef CAN_USE_GCM_ASM 228 uint64_t *gcm_Htable; 229 size_t gcm_htab_len; 230 #endif 231 uint64_t gcm_J0[2]; 232 uint64_t gcm_len_a_len_c[2]; 233 uint8_t *gcm_pt_buf; 234 int gcm_kmflag; 235 #ifdef CAN_USE_GCM_ASM 236 boolean_t gcm_use_avx; 237 #endif 238 } gcm_ctx_t; 239 240 #define gcm_keysched gcm_common.cc_keysched 241 #define gcm_keysched_len gcm_common.cc_keysched_len 242 #define gcm_cb gcm_common.cc_iv 243 #define gcm_remainder gcm_common.cc_remainder 244 #define gcm_remainder_len gcm_common.cc_remainder_len 245 #define gcm_lastp gcm_common.cc_lastp 246 #define gcm_copy_to gcm_common.cc_copy_to 247 #define gcm_flags gcm_common.cc_flags 248 249 #define AES_GMAC_IV_LEN 12 250 #define AES_GMAC_TAG_BITS 128 251 252 typedef struct aes_ctx { 253 union { 254 ecb_ctx_t acu_ecb; 255 cbc_ctx_t acu_cbc; 256 ctr_ctx_t acu_ctr; 257 ccm_ctx_t acu_ccm; 258 gcm_ctx_t acu_gcm; 259 } acu; 260 } aes_ctx_t; 261 262 #define ac_flags acu.acu_ecb.ecb_common.cc_flags 263 #define ac_remainder_len acu.acu_ecb.ecb_common.cc_remainder_len 264 #define ac_keysched acu.acu_ecb.ecb_common.cc_keysched 265 #define ac_keysched_len acu.acu_ecb.ecb_common.cc_keysched_len 266 #define ac_iv acu.acu_ecb.ecb_common.cc_iv 267 #define ac_lastp acu.acu_ecb.ecb_common.cc_lastp 268 #define ac_pt_buf acu.acu_ccm.ccm_pt_buf 269 #define ac_mac_len acu.acu_ccm.ccm_mac_len 270 #define ac_data_len acu.acu_ccm.ccm_data_len 271 #define ac_processed_mac_len acu.acu_ccm.ccm_processed_mac_len 272 #define ac_processed_data_len acu.acu_ccm.ccm_processed_data_len 273 #define ac_tag_len acu.acu_gcm.gcm_tag_len 274 275 typedef struct blowfish_ctx { 276 union { 277 ecb_ctx_t bcu_ecb; 278 cbc_ctx_t bcu_cbc; 279 } bcu; 280 } blowfish_ctx_t; 281 282 #define bc_flags bcu.bcu_ecb.ecb_common.cc_flags 283 #define bc_remainder_len bcu.bcu_ecb.ecb_common.cc_remainder_len 284 #define bc_keysched bcu.bcu_ecb.ecb_common.cc_keysched 285 #define bc_keysched_len bcu.bcu_ecb.ecb_common.cc_keysched_len 286 #define bc_iv bcu.bcu_ecb.ecb_common.cc_iv 287 #define bc_lastp bcu.bcu_ecb.ecb_common.cc_lastp 288 289 typedef struct des_ctx { 290 union { 291 ecb_ctx_t dcu_ecb; 292 cbc_ctx_t dcu_cbc; 293 } dcu; 294 } des_ctx_t; 295 296 #define dc_flags dcu.dcu_ecb.ecb_common.cc_flags 297 #define dc_remainder_len dcu.dcu_ecb.ecb_common.cc_remainder_len 298 #define dc_keysched dcu.dcu_ecb.ecb_common.cc_keysched 299 #define dc_keysched_len dcu.dcu_ecb.ecb_common.cc_keysched_len 300 #define dc_iv dcu.dcu_ecb.ecb_common.cc_iv 301 #define dc_lastp dcu.dcu_ecb.ecb_common.cc_lastp 302 303 extern int ecb_cipher_contiguous_blocks(ecb_ctx_t *, char *, size_t, 304 crypto_data_t *, size_t, int (*cipher)(const void *, const uint8_t *, 305 uint8_t *)); 306 307 extern int cbc_encrypt_contiguous_blocks(cbc_ctx_t *, char *, size_t, 308 crypto_data_t *, size_t, 309 int (*encrypt)(const void *, const uint8_t *, uint8_t *), 310 void (*copy_block)(uint8_t *, uint8_t *), 311 void (*xor_block)(uint8_t *, uint8_t *)); 312 313 extern int cbc_decrypt_contiguous_blocks(cbc_ctx_t *, char *, size_t, 314 crypto_data_t *, size_t, 315 int (*decrypt)(const void *, const uint8_t *, uint8_t *), 316 void (*copy_block)(uint8_t *, uint8_t *), 317 void (*xor_block)(uint8_t *, uint8_t *)); 318 319 extern int ctr_mode_contiguous_blocks(ctr_ctx_t *, char *, size_t, 320 crypto_data_t *, size_t, 321 int (*cipher)(const void *, const uint8_t *, uint8_t *), 322 void (*xor_block)(uint8_t *, uint8_t *)); 323 324 extern int ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *, char *, size_t, 325 crypto_data_t *, size_t, 326 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 327 void (*copy_block)(uint8_t *, uint8_t *), 328 void (*xor_block)(uint8_t *, uint8_t *)); 329 330 extern int ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *, char *, size_t, 331 crypto_data_t *, size_t, 332 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 333 void (*copy_block)(uint8_t *, uint8_t *), 334 void (*xor_block)(uint8_t *, uint8_t *)); 335 336 extern int gcm_mode_encrypt_contiguous_blocks(gcm_ctx_t *, char *, size_t, 337 crypto_data_t *, size_t, 338 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 339 void (*copy_block)(uint8_t *, uint8_t *), 340 void (*xor_block)(uint8_t *, uint8_t *)); 341 342 extern int gcm_mode_decrypt_contiguous_blocks(gcm_ctx_t *, char *, size_t, 343 crypto_data_t *, size_t, 344 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 345 void (*copy_block)(uint8_t *, uint8_t *), 346 void (*xor_block)(uint8_t *, uint8_t *)); 347 348 int ccm_encrypt_final(ccm_ctx_t *, crypto_data_t *, size_t, 349 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 350 void (*xor_block)(uint8_t *, uint8_t *)); 351 352 int gcm_encrypt_final(gcm_ctx_t *, crypto_data_t *, size_t, 353 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 354 void (*copy_block)(uint8_t *, uint8_t *), 355 void (*xor_block)(uint8_t *, uint8_t *)); 356 357 extern int ccm_decrypt_final(ccm_ctx_t *, crypto_data_t *, size_t, 358 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 359 void (*copy_block)(uint8_t *, uint8_t *), 360 void (*xor_block)(uint8_t *, uint8_t *)); 361 362 extern int gcm_decrypt_final(gcm_ctx_t *, crypto_data_t *, size_t, 363 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 364 void (*xor_block)(uint8_t *, uint8_t *)); 365 366 extern int ctr_mode_final(ctr_ctx_t *, crypto_data_t *, 367 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *)); 368 369 extern int cbc_init_ctx(cbc_ctx_t *, char *, size_t, size_t, 370 void (*copy_block)(uint8_t *, uint64_t *)); 371 372 extern int ctr_init_ctx(ctr_ctx_t *, ulong_t, uint8_t *, 373 void (*copy_block)(uint8_t *, uint8_t *)); 374 375 extern int ccm_init_ctx(ccm_ctx_t *, char *, int, boolean_t, size_t, 376 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 377 void (*xor_block)(uint8_t *, uint8_t *)); 378 379 extern int gcm_init_ctx(gcm_ctx_t *, char *, size_t, 380 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 381 void (*copy_block)(uint8_t *, uint8_t *), 382 void (*xor_block)(uint8_t *, uint8_t *)); 383 384 extern int gmac_init_ctx(gcm_ctx_t *, char *, size_t, 385 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *), 386 void (*copy_block)(uint8_t *, uint8_t *), 387 void (*xor_block)(uint8_t *, uint8_t *)); 388 389 extern void calculate_ccm_mac(ccm_ctx_t *, uint8_t *, 390 int (*encrypt_block)(const void *, const uint8_t *, uint8_t *)); 391 392 extern void gcm_mul(uint64_t *, uint64_t *, uint64_t *); 393 394 extern void crypto_init_ptrs(crypto_data_t *, void **, offset_t *); 395 extern void crypto_get_ptrs(crypto_data_t *, void **, offset_t *, 396 uint8_t **, size_t *, uint8_t **, size_t); 397 398 extern void *ecb_alloc_ctx(int); 399 extern void *cbc_alloc_ctx(int); 400 extern void *ctr_alloc_ctx(int); 401 extern void *ccm_alloc_ctx(int); 402 extern void *gcm_alloc_ctx(int); 403 extern void *gmac_alloc_ctx(int); 404 extern void crypto_free_mode_ctx(void *); 405 extern void gcm_set_kmflag(gcm_ctx_t *, int); 406 407 #ifdef __cplusplus 408 } 409 #endif 410 411 #endif /* _COMMON_CRYPTO_MODES_H */ 412