1246982c1SJohn Baldwin /* $OpenBSD: xform.c,v 1.16 2001/08/28 12:20:43 ben Exp $ */
2246982c1SJohn Baldwin /*-
3246982c1SJohn Baldwin * The authors of this code are John Ioannidis (ji@tla.org),
4246982c1SJohn Baldwin * Angelos D. Keromytis (kermit@csd.uch.gr),
5246982c1SJohn Baldwin * Niels Provos (provos@physnet.uni-hamburg.de) and
6246982c1SJohn Baldwin * Damien Miller (djm@mindrot.org).
7246982c1SJohn Baldwin *
8246982c1SJohn Baldwin * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9246982c1SJohn Baldwin * in November 1995.
10246982c1SJohn Baldwin *
11246982c1SJohn Baldwin * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12246982c1SJohn Baldwin * by Angelos D. Keromytis.
13246982c1SJohn Baldwin *
14246982c1SJohn Baldwin * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15246982c1SJohn Baldwin * and Niels Provos.
16246982c1SJohn Baldwin *
17246982c1SJohn Baldwin * Additional features in 1999 by Angelos D. Keromytis.
18246982c1SJohn Baldwin *
19246982c1SJohn Baldwin * AES XTS implementation in 2008 by Damien Miller
20246982c1SJohn Baldwin *
21246982c1SJohn Baldwin * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
22246982c1SJohn Baldwin * Angelos D. Keromytis and Niels Provos.
23246982c1SJohn Baldwin *
24246982c1SJohn Baldwin * Copyright (C) 2001, Angelos D. Keromytis.
25246982c1SJohn Baldwin *
26246982c1SJohn Baldwin * Copyright (C) 2008, Damien Miller
27246982c1SJohn Baldwin * Copyright (c) 2014 The FreeBSD Foundation
28246982c1SJohn Baldwin * All rights reserved.
29246982c1SJohn Baldwin *
30246982c1SJohn Baldwin * Portions of this software were developed by John-Mark Gurney
31246982c1SJohn Baldwin * under sponsorship of the FreeBSD Foundation and
32246982c1SJohn Baldwin * Rubicon Communications, LLC (Netgate).
33246982c1SJohn Baldwin *
34246982c1SJohn Baldwin * Permission to use, copy, and modify this software with or without fee
35246982c1SJohn Baldwin * is hereby granted, provided that this entire notice is included in
36246982c1SJohn Baldwin * all copies of any software which is or includes a copy or
37246982c1SJohn Baldwin * modification of this software.
38246982c1SJohn Baldwin * You may use this code under the GNU public license if you so wish. Please
39246982c1SJohn Baldwin * contribute changes back to the authors under this freer than GPL license
40246982c1SJohn Baldwin * so that we may further the use of strong encryption without limitations to
41246982c1SJohn Baldwin * all.
42246982c1SJohn Baldwin *
43246982c1SJohn Baldwin * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
44246982c1SJohn Baldwin * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
45246982c1SJohn Baldwin * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
46246982c1SJohn Baldwin * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
47246982c1SJohn Baldwin * PURPOSE.
48246982c1SJohn Baldwin */
49246982c1SJohn Baldwin
50faf470ffSJohn Baldwin #include <sys/types.h>
51246982c1SJohn Baldwin #include <crypto/rijndael/rijndael.h>
52246982c1SJohn Baldwin #include <opencrypto/xform_enc.h>
53246982c1SJohn Baldwin
54d55df8dcSJohn Baldwin struct aes_cbc_ctx {
55d55df8dcSJohn Baldwin rijndael_ctx key;
56d55df8dcSJohn Baldwin char iv[AES_BLOCK_LEN];
57d55df8dcSJohn Baldwin };
58d55df8dcSJohn Baldwin
59246982c1SJohn Baldwin static int aes_cbc_setkey(void *, const uint8_t *, int);
60246982c1SJohn Baldwin static void aes_cbc_encrypt(void *, const uint8_t *, uint8_t *);
61246982c1SJohn Baldwin static void aes_cbc_decrypt(void *, const uint8_t *, uint8_t *);
62d7f0b3ceSJohn Baldwin static void aes_cbc_encrypt_multi(void *, const uint8_t *, uint8_t *, size_t);
63d7f0b3ceSJohn Baldwin static void aes_cbc_decrypt_multi(void *, const uint8_t *, uint8_t *, size_t);
64d55df8dcSJohn Baldwin static void aes_cbc_reinit(void *, const uint8_t *, size_t);
65246982c1SJohn Baldwin
66246982c1SJohn Baldwin /* Encryption instances */
67246982c1SJohn Baldwin const struct enc_xform enc_xform_aes_cbc = {
68246982c1SJohn Baldwin .type = CRYPTO_AES_CBC,
69246982c1SJohn Baldwin .name = "AES-CBC",
70d55df8dcSJohn Baldwin .ctxsize = sizeof(struct aes_cbc_ctx),
71246982c1SJohn Baldwin .blocksize = AES_BLOCK_LEN,
72246982c1SJohn Baldwin .ivsize = AES_BLOCK_LEN,
73246982c1SJohn Baldwin .minkey = AES_MIN_KEY,
74246982c1SJohn Baldwin .maxkey = AES_MAX_KEY,
75246982c1SJohn Baldwin .setkey = aes_cbc_setkey,
76d55df8dcSJohn Baldwin .reinit = aes_cbc_reinit,
77d7f0b3ceSJohn Baldwin .encrypt = aes_cbc_encrypt,
78d7f0b3ceSJohn Baldwin .decrypt = aes_cbc_decrypt,
79d7f0b3ceSJohn Baldwin .encrypt_multi = aes_cbc_encrypt_multi,
80d7f0b3ceSJohn Baldwin .decrypt_multi = aes_cbc_decrypt_multi,
81246982c1SJohn Baldwin };
82246982c1SJohn Baldwin
83246982c1SJohn Baldwin /*
84246982c1SJohn Baldwin * Encryption wrapper routines.
85246982c1SJohn Baldwin */
86246982c1SJohn Baldwin static void
aes_cbc_encrypt(void * vctx,const uint8_t * in,uint8_t * out)87d55df8dcSJohn Baldwin aes_cbc_encrypt(void *vctx, const uint8_t *in, uint8_t *out)
88246982c1SJohn Baldwin {
89d55df8dcSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
90d55df8dcSJohn Baldwin
91d55df8dcSJohn Baldwin for (u_int i = 0; i < AES_BLOCK_LEN; i++)
92d55df8dcSJohn Baldwin out[i] = in[i] ^ ctx->iv[i];
93d55df8dcSJohn Baldwin rijndael_encrypt(&ctx->key, out, out);
94d55df8dcSJohn Baldwin memcpy(ctx->iv, out, AES_BLOCK_LEN);
95246982c1SJohn Baldwin }
96246982c1SJohn Baldwin
97246982c1SJohn Baldwin static void
aes_cbc_decrypt(void * vctx,const uint8_t * in,uint8_t * out)98d55df8dcSJohn Baldwin aes_cbc_decrypt(void *vctx, const uint8_t *in, uint8_t *out)
99246982c1SJohn Baldwin {
100d55df8dcSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
101d55df8dcSJohn Baldwin char block[AES_BLOCK_LEN];
102d55df8dcSJohn Baldwin
103d55df8dcSJohn Baldwin memcpy(block, in, AES_BLOCK_LEN);
104d55df8dcSJohn Baldwin rijndael_decrypt(&ctx->key, in, out);
105d55df8dcSJohn Baldwin for (u_int i = 0; i < AES_BLOCK_LEN; i++)
106d55df8dcSJohn Baldwin out[i] ^= ctx->iv[i];
107d55df8dcSJohn Baldwin memcpy(ctx->iv, block, AES_BLOCK_LEN);
108d55df8dcSJohn Baldwin explicit_bzero(block, sizeof(block));
109246982c1SJohn Baldwin }
110246982c1SJohn Baldwin
111d7f0b3ceSJohn Baldwin static void
aes_cbc_encrypt_multi(void * vctx,const uint8_t * in,uint8_t * out,size_t len)112d7f0b3ceSJohn Baldwin aes_cbc_encrypt_multi(void *vctx, const uint8_t *in, uint8_t *out, size_t len)
113d7f0b3ceSJohn Baldwin {
114d7f0b3ceSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
115d7f0b3ceSJohn Baldwin
116d7f0b3ceSJohn Baldwin KASSERT(len % AES_BLOCK_LEN == 0, ("%s: invalid length", __func__));
117d7f0b3ceSJohn Baldwin while (len > 0) {
118d7f0b3ceSJohn Baldwin for (u_int i = 0; i < AES_BLOCK_LEN; i++)
119d7f0b3ceSJohn Baldwin out[i] = in[i] ^ ctx->iv[i];
120d7f0b3ceSJohn Baldwin rijndael_encrypt(&ctx->key, out, out);
121d7f0b3ceSJohn Baldwin memcpy(ctx->iv, out, AES_BLOCK_LEN);
122d7f0b3ceSJohn Baldwin out += AES_BLOCK_LEN;
123d7f0b3ceSJohn Baldwin in += AES_BLOCK_LEN;
124d7f0b3ceSJohn Baldwin len -= AES_BLOCK_LEN;
125d7f0b3ceSJohn Baldwin }
126d7f0b3ceSJohn Baldwin }
127d7f0b3ceSJohn Baldwin
128d7f0b3ceSJohn Baldwin static void
aes_cbc_decrypt_multi(void * vctx,const uint8_t * in,uint8_t * out,size_t len)129d7f0b3ceSJohn Baldwin aes_cbc_decrypt_multi(void *vctx, const uint8_t *in, uint8_t *out, size_t len)
130d7f0b3ceSJohn Baldwin {
131d7f0b3ceSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
132d7f0b3ceSJohn Baldwin char block[AES_BLOCK_LEN];
133d7f0b3ceSJohn Baldwin
134d7f0b3ceSJohn Baldwin KASSERT(len % AES_BLOCK_LEN == 0, ("%s: invalid length", __func__));
135d7f0b3ceSJohn Baldwin while (len > 0) {
136d7f0b3ceSJohn Baldwin memcpy(block, in, AES_BLOCK_LEN);
137d7f0b3ceSJohn Baldwin rijndael_decrypt(&ctx->key, in, out);
138d7f0b3ceSJohn Baldwin for (u_int i = 0; i < AES_BLOCK_LEN; i++)
139d7f0b3ceSJohn Baldwin out[i] ^= ctx->iv[i];
140d7f0b3ceSJohn Baldwin memcpy(ctx->iv, block, AES_BLOCK_LEN);
141d7f0b3ceSJohn Baldwin out += AES_BLOCK_LEN;
142d7f0b3ceSJohn Baldwin in += AES_BLOCK_LEN;
143d7f0b3ceSJohn Baldwin len -= AES_BLOCK_LEN;
144d7f0b3ceSJohn Baldwin }
145d7f0b3ceSJohn Baldwin explicit_bzero(block, sizeof(block));
146d7f0b3ceSJohn Baldwin }
147d7f0b3ceSJohn Baldwin
148246982c1SJohn Baldwin static int
aes_cbc_setkey(void * vctx,const uint8_t * key,int len)149d55df8dcSJohn Baldwin aes_cbc_setkey(void *vctx, const uint8_t *key, int len)
150246982c1SJohn Baldwin {
151d55df8dcSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
152246982c1SJohn Baldwin
153246982c1SJohn Baldwin if (len != 16 && len != 24 && len != 32)
154246982c1SJohn Baldwin return (EINVAL);
155246982c1SJohn Baldwin
156d55df8dcSJohn Baldwin rijndael_set_key(&ctx->key, key, len * 8);
157246982c1SJohn Baldwin return (0);
158246982c1SJohn Baldwin }
159d55df8dcSJohn Baldwin
160d55df8dcSJohn Baldwin static void
aes_cbc_reinit(void * vctx,const uint8_t * iv,size_t iv_len)161d55df8dcSJohn Baldwin aes_cbc_reinit(void *vctx, const uint8_t *iv, size_t iv_len)
162d55df8dcSJohn Baldwin {
163d55df8dcSJohn Baldwin struct aes_cbc_ctx *ctx = vctx;
164d55df8dcSJohn Baldwin
165d55df8dcSJohn Baldwin KASSERT(iv_len == sizeof(ctx->iv), ("%s: bad IV length", __func__));
166d55df8dcSJohn Baldwin memcpy(ctx->iv, iv, sizeof(ctx->iv));
167d55df8dcSJohn Baldwin }
168