xref: /freebsd/sys/kgssapi/krb5/kcrypto_aes.c (revision fdafd315)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
5  * Authors: Doug Rabson <dfr@rabson.org>
6  * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/param.h>
31 #include <sys/lock.h>
32 #include <sys/malloc.h>
33 #include <sys/mutex.h>
34 #include <sys/kobj.h>
35 #include <sys/mbuf.h>
36 #include <opencrypto/cryptodev.h>
37 
38 #include <kgssapi/gssapi.h>
39 #include <kgssapi/gssapi_impl.h>
40 
41 #include "kcrypto.h"
42 
43 struct aes_state {
44 	struct mtx	as_lock;
45 	crypto_session_t as_session_aes;
46 	crypto_session_t as_session_sha1;
47 };
48 
49 static void
aes_init(struct krb5_key_state * ks)50 aes_init(struct krb5_key_state *ks)
51 {
52 	struct aes_state *as;
53 
54 	as = malloc(sizeof(struct aes_state), M_GSSAPI, M_WAITOK|M_ZERO);
55 	mtx_init(&as->as_lock, "gss aes lock", NULL, MTX_DEF);
56 	ks->ks_priv = as;
57 }
58 
59 static void
aes_destroy(struct krb5_key_state * ks)60 aes_destroy(struct krb5_key_state *ks)
61 {
62 	struct aes_state *as = ks->ks_priv;
63 
64 	if (as->as_session_aes != 0)
65 		crypto_freesession(as->as_session_aes);
66 	if (as->as_session_sha1 != 0)
67 		crypto_freesession(as->as_session_sha1);
68 	mtx_destroy(&as->as_lock);
69 	free(ks->ks_priv, M_GSSAPI);
70 }
71 
72 static void
aes_set_key(struct krb5_key_state * ks,const void * in)73 aes_set_key(struct krb5_key_state *ks, const void *in)
74 {
75 	void *kp = ks->ks_key;
76 	struct aes_state *as = ks->ks_priv;
77 	struct crypto_session_params csp;
78 
79 	if (kp != in)
80 		bcopy(in, kp, ks->ks_class->ec_keylen);
81 
82 	if (as->as_session_aes != 0)
83 		crypto_freesession(as->as_session_aes);
84 	if (as->as_session_sha1 != 0)
85 		crypto_freesession(as->as_session_sha1);
86 
87 	/*
88 	 * We only want the first 96 bits of the HMAC.
89 	 */
90 	memset(&csp, 0, sizeof(csp));
91 	csp.csp_mode = CSP_MODE_DIGEST;
92 	csp.csp_auth_alg = CRYPTO_SHA1_HMAC;
93 	csp.csp_auth_klen = ks->ks_class->ec_keybits / 8;
94 	csp.csp_auth_mlen = 12;
95 	csp.csp_auth_key = ks->ks_key;
96 	crypto_newsession(&as->as_session_sha1, &csp,
97 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
98 
99 	memset(&csp, 0, sizeof(csp));
100 	csp.csp_mode = CSP_MODE_CIPHER;
101 	csp.csp_cipher_alg = CRYPTO_AES_CBC;
102 	csp.csp_cipher_klen = ks->ks_class->ec_keybits / 8;
103 	csp.csp_cipher_key = ks->ks_key;
104 	csp.csp_ivlen = 16;
105 	crypto_newsession(&as->as_session_aes, &csp,
106 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
107 }
108 
109 static void
aes_random_to_key(struct krb5_key_state * ks,const void * in)110 aes_random_to_key(struct krb5_key_state *ks, const void *in)
111 {
112 
113 	aes_set_key(ks, in);
114 }
115 
116 static int
aes_crypto_cb(struct cryptop * crp)117 aes_crypto_cb(struct cryptop *crp)
118 {
119 	int error;
120 	struct aes_state *as = (struct aes_state *) crp->crp_opaque;
121 
122 	if (CRYPTO_SESS_SYNC(crp->crp_session))
123 		return (0);
124 
125 	error = crp->crp_etype;
126 	if (error == EAGAIN)
127 		error = crypto_dispatch(crp);
128 	mtx_lock(&as->as_lock);
129 	if (error || (crp->crp_flags & CRYPTO_F_DONE))
130 		wakeup(crp);
131 	mtx_unlock(&as->as_lock);
132 
133 	return (0);
134 }
135 
136 static void
aes_encrypt_1(const struct krb5_key_state * ks,int buftype,void * buf,size_t skip,size_t len,void * ivec,bool encrypt)137 aes_encrypt_1(const struct krb5_key_state *ks, int buftype, void *buf,
138     size_t skip, size_t len, void *ivec, bool encrypt)
139 {
140 	struct aes_state *as = ks->ks_priv;
141 	struct cryptop *crp;
142 	int error;
143 
144 	crp = crypto_getreq(as->as_session_aes, M_WAITOK);
145 
146 	crp->crp_payload_start = skip;
147 	crp->crp_payload_length = len;
148 	crp->crp_op = encrypt ? CRYPTO_OP_ENCRYPT : CRYPTO_OP_DECRYPT;
149 	crp->crp_flags = CRYPTO_F_CBIFSYNC | CRYPTO_F_IV_SEPARATE;
150 	if (ivec) {
151 		memcpy(crp->crp_iv, ivec, 16);
152 	} else {
153 		memset(crp->crp_iv, 0, 16);
154 	}
155 
156 	if (buftype == CRYPTO_BUF_MBUF)
157 		crypto_use_mbuf(crp, buf);
158 	else
159 		crypto_use_buf(crp, buf, skip + len);
160 	crp->crp_opaque = as;
161 	crp->crp_callback = aes_crypto_cb;
162 
163 	error = crypto_dispatch(crp);
164 
165 	if (!CRYPTO_SESS_SYNC(as->as_session_aes)) {
166 		mtx_lock(&as->as_lock);
167 		if (!error && !(crp->crp_flags & CRYPTO_F_DONE))
168 			error = msleep(crp, &as->as_lock, 0, "gssaes", 0);
169 		mtx_unlock(&as->as_lock);
170 	}
171 
172 	crypto_freereq(crp);
173 }
174 
175 static void
aes_encrypt(const struct krb5_key_state * ks,struct mbuf * inout,size_t skip,size_t len,void * ivec,size_t ivlen)176 aes_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
177     size_t skip, size_t len, void *ivec, size_t ivlen)
178 {
179 	size_t blocklen = 16, plen;
180 	struct {
181 		uint8_t cn_1[16], cn[16];
182 	} last2;
183 	int i, off;
184 
185 	/*
186 	 * AES encryption with cyphertext stealing:
187 	 *
188 	 * CTSencrypt(P[0], ..., P[n], IV, K):
189 	 *	len = length(P[n])
190 	 *	(C[0], ..., C[n-2], E[n-1]) =
191 	 *		CBCencrypt(P[0], ..., P[n-1], IV, K)
192 	 *	P = pad(P[n], 0, blocksize)
193 	 *	E[n] = CBCencrypt(P, E[n-1], K);
194 	 *	C[n-1] = E[n]
195 	 *	C[n] = E[n-1]{0..len-1}
196 	 */
197 	plen = len % blocklen;
198 	if (len == blocklen) {
199 		/*
200 		 * Note: caller will ensure len >= blocklen.
201 		 */
202 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
203 		    true);
204 	} else if (plen == 0) {
205 		/*
206 		 * This is equivalent to CBC mode followed by swapping
207 		 * the last two blocks. We assume that neither of the
208 		 * last two blocks cross iov boundaries.
209 		 */
210 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
211 		    true);
212 		off = skip + len - 2 * blocklen;
213 		m_copydata(inout, off, 2 * blocklen, (void*) &last2);
214 		m_copyback(inout, off, blocklen, last2.cn);
215 		m_copyback(inout, off + blocklen, blocklen, last2.cn_1);
216 	} else {
217 		/*
218 		 * This is the difficult case. We encrypt all but the
219 		 * last partial block first. We then create a padded
220 		 * copy of the last block and encrypt that using the
221 		 * second to last encrypted block as IV. Once we have
222 		 * the encrypted versions of the last two blocks, we
223 		 * reshuffle to create the final result.
224 		 */
225 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len - plen,
226 		    ivec, true);
227 
228 		/*
229 		 * Copy out the last two blocks, pad the last block
230 		 * and encrypt it. Rearrange to get the final
231 		 * result. The cyphertext for cn_1 is in cn. The
232 		 * cyphertext for cn is the first plen bytes of what
233 		 * is in cn_1 now.
234 		 */
235 		off = skip + len - blocklen - plen;
236 		m_copydata(inout, off, blocklen + plen, (void*) &last2);
237 		for (i = plen; i < blocklen; i++)
238 			last2.cn[i] = 0;
239 		aes_encrypt_1(ks, CRYPTO_BUF_CONTIG, last2.cn, 0, blocklen,
240 		    last2.cn_1, true);
241 		m_copyback(inout, off, blocklen, last2.cn);
242 		m_copyback(inout, off + blocklen, plen, last2.cn_1);
243 	}
244 }
245 
246 static void
aes_decrypt(const struct krb5_key_state * ks,struct mbuf * inout,size_t skip,size_t len,void * ivec,size_t ivlen)247 aes_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
248     size_t skip, size_t len, void *ivec, size_t ivlen)
249 {
250 	size_t blocklen = 16, plen;
251 	struct {
252 		uint8_t cn_1[16], cn[16];
253 	} last2;
254 	int i, off, t;
255 
256 	/*
257 	 * AES decryption with cyphertext stealing:
258 	 *
259 	 * CTSencrypt(C[0], ..., C[n], IV, K):
260 	 *	len = length(C[n])
261 	 *	E[n] = C[n-1]
262 	 *	X = decrypt(E[n], K)
263 	 *	P[n] = (X ^ C[n]){0..len-1}
264 	 *	E[n-1] = {C[n,0],...,C[n,len-1],X[len],...,X[blocksize-1]}
265 	 *	(P[0],...,P[n-1]) = CBCdecrypt(C[0],...,C[n-2],E[n-1], IV, K)
266 	 */
267 	plen = len % blocklen;
268 	if (len == blocklen) {
269 		/*
270 		 * Note: caller will ensure len >= blocklen.
271 		 */
272 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
273 		    false);
274 	} else if (plen == 0) {
275 		/*
276 		 * This is equivalent to CBC mode followed by swapping
277 		 * the last two blocks.
278 		 */
279 		off = skip + len - 2 * blocklen;
280 		m_copydata(inout, off, 2 * blocklen, (void*) &last2);
281 		m_copyback(inout, off, blocklen, last2.cn);
282 		m_copyback(inout, off + blocklen, blocklen, last2.cn_1);
283 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
284 		    false);
285 	} else {
286 		/*
287 		 * This is the difficult case. We first decrypt the
288 		 * second to last block with a zero IV to make X. The
289 		 * plaintext for the last block is the XOR of X and
290 		 * the last cyphertext block.
291 		 *
292 		 * We derive a new cypher text for the second to last
293 		 * block by mixing the unused bytes of X with the last
294 		 * cyphertext block. The result of that can be
295 		 * decrypted with the rest in CBC mode.
296 		 */
297 		off = skip + len - plen - blocklen;
298 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, off, blocklen,
299 		    NULL, false);
300 		m_copydata(inout, off, blocklen + plen, (void*) &last2);
301 
302 		for (i = 0; i < plen; i++) {
303 			t = last2.cn[i];
304 			last2.cn[i] ^= last2.cn_1[i];
305 			last2.cn_1[i] = t;
306 		}
307 
308 		m_copyback(inout, off, blocklen + plen, (void*) &last2);
309 		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len - plen,
310 		    ivec, false);
311 	}
312 
313 }
314 
315 static void
aes_checksum(const struct krb5_key_state * ks,int usage,struct mbuf * inout,size_t skip,size_t inlen,size_t outlen)316 aes_checksum(const struct krb5_key_state *ks, int usage,
317     struct mbuf *inout, size_t skip, size_t inlen, size_t outlen)
318 {
319 	struct aes_state *as = ks->ks_priv;
320 	struct cryptop *crp;
321 	int error;
322 
323 	crp = crypto_getreq(as->as_session_sha1, M_WAITOK);
324 
325 	crp->crp_payload_start = skip;
326 	crp->crp_payload_length = inlen;
327 	crp->crp_digest_start = skip + inlen;
328 	crp->crp_flags = CRYPTO_F_CBIFSYNC;
329 	crypto_use_mbuf(crp, inout);
330 	crp->crp_opaque = as;
331 	crp->crp_callback = aes_crypto_cb;
332 
333 	error = crypto_dispatch(crp);
334 
335 	if (!CRYPTO_SESS_SYNC(as->as_session_sha1)) {
336 		mtx_lock(&as->as_lock);
337 		if (!error && !(crp->crp_flags & CRYPTO_F_DONE))
338 			error = msleep(crp, &as->as_lock, 0, "gssaes", 0);
339 		mtx_unlock(&as->as_lock);
340 	}
341 
342 	crypto_freereq(crp);
343 }
344 
345 struct krb5_encryption_class krb5_aes128_encryption_class = {
346 	"aes128-cts-hmac-sha1-96", /* name */
347 	ETYPE_AES128_CTS_HMAC_SHA1_96, /* etype */
348 	EC_DERIVED_KEYS,	/* flags */
349 	16,			/* blocklen */
350 	1,			/* msgblocklen */
351 	12,			/* checksumlen */
352 	128,			/* keybits */
353 	16,			/* keylen */
354 	aes_init,
355 	aes_destroy,
356 	aes_set_key,
357 	aes_random_to_key,
358 	aes_encrypt,
359 	aes_decrypt,
360 	aes_checksum
361 };
362 
363 struct krb5_encryption_class krb5_aes256_encryption_class = {
364 	"aes256-cts-hmac-sha1-96", /* name */
365 	ETYPE_AES256_CTS_HMAC_SHA1_96, /* etype */
366 	EC_DERIVED_KEYS,	/* flags */
367 	16,			/* blocklen */
368 	1,			/* msgblocklen */
369 	12,			/* checksumlen */
370 	256,			/* keybits */
371 	32,			/* keylen */
372 	aes_init,
373 	aes_destroy,
374 	aes_set_key,
375 	aes_random_to_key,
376 	aes_encrypt,
377 	aes_decrypt,
378 	aes_checksum
379 };
380