1 /* $OpenBSD: aes_xts.c,v 1.2 2017/05/31 00:34:33 djm Exp $ */ 2 /* 3 * Copyright (C) 2008, Damien Miller 4 * 5 * Permission to use, copy, and modify this software with or without fee 6 * is hereby granted, provided that this entire notice is included in 7 * all copies of any software which is or includes a copy or 8 * modification of this software. 9 * You may use this code under the GNU public license if you so wish. Please 10 * contribute changes back to the authors under this freer than GPL license 11 * so that we may further the use of strong encryption without limitations to 12 * all. 13 * 14 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 15 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 16 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 17 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 18 * PURPOSE. 19 */ 20 21 #include <lib/libsa/stand.h> 22 23 #include "aes_xts.h" 24 25 void 26 aes_xts_reinit(struct aes_xts_ctx *ctx, u_int8_t *iv) 27 { 28 u_int64_t blocknum; 29 u_int i; 30 31 /* 32 * Prepare tweak as E_k2(IV). IV is specified as LE representation 33 * of a 64-bit block number which we allow to be passed in directly. 34 */ 35 bcopy(iv, &blocknum, AES_XTS_IVSIZE); 36 for (i = 0; i < AES_XTS_IVSIZE; i++) { 37 ctx->tweak[i] = blocknum & 0xff; 38 blocknum >>= 8; 39 } 40 /* Last 64 bits of IV are always zero */ 41 bzero(ctx->tweak + AES_XTS_IVSIZE, AES_XTS_IVSIZE); 42 43 rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); 44 } 45 46 void 47 aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int do_encrypt) 48 { 49 u_int8_t block[AES_XTS_BLOCKSIZE]; 50 u_int i, carry_in, carry_out; 51 52 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 53 block[i] = data[i] ^ ctx->tweak[i]; 54 55 if (do_encrypt) 56 rijndael_encrypt(&ctx->key1, block, data); 57 else 58 rijndael_decrypt(&ctx->key1, block, data); 59 60 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 61 data[i] ^= ctx->tweak[i]; 62 63 /* Exponentiate tweak */ 64 carry_in = 0; 65 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) { 66 carry_out = ctx->tweak[i] & 0x80; 67 ctx->tweak[i] = (ctx->tweak[i] << 1) | carry_in; 68 carry_in = carry_out >> 7; 69 } 70 ctx->tweak[0] ^= (AES_XTS_ALPHA & -carry_in); 71 explicit_bzero(block, sizeof(block)); 72 } 73 74 void 75 aes_xts_encrypt(struct aes_xts_ctx *ctx, u_int8_t *data) 76 { 77 aes_xts_crypt(ctx, data, 1); 78 } 79 80 void 81 aes_xts_decrypt(struct aes_xts_ctx *ctx, u_int8_t *data) 82 { 83 aes_xts_crypt(ctx, data, 0); 84 } 85 86 int 87 aes_xts_setkey(struct aes_xts_ctx *ctx, u_int8_t *key, int len) 88 { 89 if (len != 32 && len != 64) 90 return -1; 91 92 rijndael_set_key(&ctx->key1, key, len * 4); 93 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4); 94 95 return 0; 96 } 97 98 void 99 aes_xts_zerokey(struct aes_xts_ctx *ctx) 100 { 101 explicit_bzero(ctx, sizeof(struct aes_xts_ctx)); 102 } 103