1 /* $NetBSD: cryptosoft_xform.c,v 1.32 2026/07/05 15:34:13 riastradh Exp $ */ 2 /* $FreeBSD: src/sys/opencrypto/xform.c,v 1.1.2.1 2002/11/21 23:34:23 sam Exp $ */ 3 /* $OpenBSD: xform.c,v 1.19 2002/08/16 22:47:25 dhartmei Exp $ */ 4 5 /* 6 * The authors of this code are John Ioannidis (ji (at) tla.org), 7 * Angelos D. Keromytis (kermit (at) csd.uch.gr) and 8 * Niels Provos (provos (at) physnet.uni-hamburg.de). 9 * 10 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 11 * in November 1995. 12 * 13 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 14 * by Angelos D. Keromytis. 15 * 16 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 17 * and Niels Provos. 18 * 19 * Additional features in 1999 by Angelos D. Keromytis. 20 * 21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 22 * Angelos D. Keromytis and Niels Provos. 23 * 24 * Copyright (C) 2001, Angelos D. Keromytis. 25 * 26 * Permission to use, copy, and modify this software with or without fee 27 * is hereby granted, provided that this entire notice is included in 28 * all copies of any software which is or includes a copy or 29 * modification of this software. 30 * You may use this code under the GNU public license if you so wish. Please 31 * contribute changes back to the authors under this freer than GPL license 32 * so that we may further the use of strong encryption without limitations to 33 * all. 34 * 35 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 36 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 37 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 38 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 39 * PURPOSE. 40 */ 41 42 #include <sys/cdefs.h> 43 __KERNEL_RCSID(1, "$NetBSD: cryptosoft_xform.c,v 1.32 2026/07/05 15:34:13 riastradh Exp $"); 44 45 #include <sys/cprng.h> 46 #include <sys/kmem.h> 47 #include <sys/md5.h> 48 #include <sys/rmd160.h> 49 #include <sys/sdt.h> 50 #include <sys/sha1.h> 51 #include <sys/sha2.h> 52 53 #include <crypto/aes/aes.h> 54 #include <crypto/blowfish/blowfish.h> 55 #include <crypto/camellia/camellia.h> 56 #include <crypto/cast128/cast128.h> 57 #include <crypto/des/des.h> 58 #include <crypto/skipjack/skipjack.h> 59 60 #include <opencrypto/aesxcbcmac.h> 61 #include <opencrypto/deflate.h> 62 #include <opencrypto/gmac.h> 63 64 struct swcr_auth_hash { 65 const struct auth_hash *auth_hash; 66 int ctxsize; 67 void (*Init)(void *); 68 void (*Setkey)(void *, const uint8_t *, uint16_t); 69 void (*Reinit)(void *, const uint8_t *, uint16_t); 70 int (*Update)(void *, const uint8_t *, uint16_t); 71 void (*Final)(uint8_t *, void *); 72 }; 73 74 struct swcr_enc_xform { 75 const struct enc_xform *enc_xform; 76 void (*encrypt)(void *, uint8_t *); 77 void (*decrypt)(void *, uint8_t *); 78 int (*setkey)(uint8_t **, const uint8_t *, int); 79 void (*zerokey)(uint8_t **); 80 void (*reinit)(void *, const uint8_t *, uint8_t *); 81 }; 82 83 struct swcr_comp_algo { 84 const struct comp_algo *unused_comp_algo; 85 uint32_t (*compress)(uint8_t *, uint32_t, uint8_t **); 86 uint32_t (*decompress)(uint8_t *, uint32_t, uint8_t **, int); 87 }; 88 89 static void null_encrypt(void *, uint8_t *); 90 static void null_decrypt(void *, uint8_t *); 91 static int null_setkey(uint8_t **, const uint8_t *, int); 92 static void null_zerokey(uint8_t **); 93 94 static int des1_setkey(uint8_t **, const uint8_t *, int); 95 static int des3_setkey(uint8_t **, const uint8_t *, int); 96 static int blf_setkey(uint8_t **, const uint8_t *, int); 97 static int cast5_setkey(uint8_t **, const uint8_t *, int); 98 static int skipjack_setkey(uint8_t **, const uint8_t *, int); 99 static int aes_setkey(uint8_t **, const uint8_t *, int); 100 static int cml_setkey(uint8_t **, const uint8_t *, int); 101 static int aes_ctr_setkey(uint8_t **, const uint8_t *, int); 102 static int aes_gmac_setkey(uint8_t **, const uint8_t *, int); 103 static void des1_encrypt(void *, uint8_t *); 104 static void des3_encrypt(void *, uint8_t *); 105 static void blf_encrypt(void *, uint8_t *); 106 static void cast5_encrypt(void *, uint8_t *); 107 static void skipjack_encrypt(void *, uint8_t *); 108 static void aes_encrypt(void *, uint8_t *); 109 static void cml_encrypt(void *, uint8_t *); 110 static void des1_decrypt(void *, uint8_t *); 111 static void des3_decrypt(void *, uint8_t *); 112 static void blf_decrypt(void *, uint8_t *); 113 static void cast5_decrypt(void *, uint8_t *); 114 static void skipjack_decrypt(void *, uint8_t *); 115 static void aes_decrypt(void *, uint8_t *); 116 static void cml_decrypt(void *, uint8_t *); 117 static void aes_ctr_crypt(void *, uint8_t *); 118 static void des1_zerokey(uint8_t **); 119 static void des3_zerokey(uint8_t **); 120 static void blf_zerokey(uint8_t **); 121 static void cast5_zerokey(uint8_t **); 122 static void skipjack_zerokey(uint8_t **); 123 static void aes_zerokey(uint8_t **); 124 static void cml_zerokey(uint8_t **); 125 static void aes_ctr_zerokey(uint8_t **); 126 static void aes_gmac_zerokey(uint8_t **); 127 static void aes_ctr_reinit(void *, const uint8_t *, uint8_t *); 128 static void aes_gcm_reinit(void *, const uint8_t *, uint8_t *); 129 static void aes_gmac_reinit(void *, const uint8_t *, uint8_t *); 130 131 static void null_init(void *); 132 static int null_update(void *, const uint8_t *, uint16_t); 133 static void null_final(uint8_t *, void *); 134 135 static int MD5Update_int(void *, const uint8_t *, uint16_t); 136 static void SHA1Init_int(void *); 137 static int SHA1Update_int(void *, const uint8_t *, uint16_t); 138 static void SHA1Final_int(uint8_t *, void *); 139 140 141 static int RMD160Update_int(void *, const uint8_t *, uint16_t); 142 static int SHA1Update_int(void *, const uint8_t *, uint16_t); 143 static void SHA1Final_int(uint8_t *, void *); 144 static int RMD160Update_int(void *, const uint8_t *, uint16_t); 145 static int SHA256Update_int(void *, const uint8_t *, uint16_t); 146 static int SHA384Update_int(void *, const uint8_t *, uint16_t); 147 static int SHA512Update_int(void *, const uint8_t *, uint16_t); 148 149 static uint32_t deflate_compress(uint8_t *, uint32_t, uint8_t **); 150 static uint32_t deflate_decompress(uint8_t *, uint32_t, uint8_t **, int); 151 static uint32_t gzip_compress(uint8_t *, uint32_t, uint8_t **); 152 static uint32_t gzip_decompress(uint8_t *, uint32_t, uint8_t **, int); 153 154 /* Encryption instances */ 155 static const struct swcr_enc_xform swcr_enc_xform_null = { 156 &enc_xform_null, 157 null_encrypt, 158 null_decrypt, 159 null_setkey, 160 null_zerokey, 161 NULL 162 }; 163 164 static const struct swcr_enc_xform swcr_enc_xform_des = { 165 &enc_xform_des, 166 des1_encrypt, 167 des1_decrypt, 168 des1_setkey, 169 des1_zerokey, 170 NULL 171 }; 172 173 static const struct swcr_enc_xform swcr_enc_xform_3des = { 174 &enc_xform_3des, 175 des3_encrypt, 176 des3_decrypt, 177 des3_setkey, 178 des3_zerokey, 179 NULL 180 }; 181 182 static const struct swcr_enc_xform swcr_enc_xform_blf = { 183 &enc_xform_blf, 184 blf_encrypt, 185 blf_decrypt, 186 blf_setkey, 187 blf_zerokey, 188 NULL 189 }; 190 191 static const struct swcr_enc_xform swcr_enc_xform_cast5 = { 192 &enc_xform_cast5, 193 cast5_encrypt, 194 cast5_decrypt, 195 cast5_setkey, 196 cast5_zerokey, 197 NULL 198 }; 199 200 static const struct swcr_enc_xform swcr_enc_xform_skipjack = { 201 &enc_xform_skipjack, 202 skipjack_encrypt, 203 skipjack_decrypt, 204 skipjack_setkey, 205 skipjack_zerokey, 206 NULL 207 }; 208 209 static const struct swcr_enc_xform swcr_enc_xform_aes = { 210 &enc_xform_aes, 211 aes_encrypt, 212 aes_decrypt, 213 aes_setkey, 214 aes_zerokey, 215 NULL 216 }; 217 218 static const struct swcr_enc_xform swcr_enc_xform_aes_ctr = { 219 &enc_xform_aes_ctr, 220 aes_ctr_crypt, 221 aes_ctr_crypt, 222 aes_ctr_setkey, 223 aes_ctr_zerokey, 224 aes_ctr_reinit 225 }; 226 227 static const struct swcr_enc_xform swcr_enc_xform_aes_gcm = { 228 &enc_xform_aes_gcm, 229 aes_ctr_crypt, 230 aes_ctr_crypt, 231 aes_ctr_setkey, 232 aes_ctr_zerokey, 233 aes_gcm_reinit 234 }; 235 236 static const struct swcr_enc_xform swcr_enc_xform_aes_gmac = { 237 &enc_xform_aes_gmac, 238 NULL, 239 NULL, 240 aes_gmac_setkey, 241 aes_gmac_zerokey, 242 aes_gmac_reinit 243 }; 244 245 static const struct swcr_enc_xform swcr_enc_xform_camellia = { 246 &enc_xform_camellia, 247 cml_encrypt, 248 cml_decrypt, 249 cml_setkey, 250 cml_zerokey, 251 NULL 252 }; 253 254 /* Authentication instances */ 255 static const struct swcr_auth_hash swcr_auth_hash_null = { 256 &auth_hash_null, sizeof(int), /* NB: context isn't used */ 257 null_init, NULL, NULL, null_update, null_final 258 }; 259 260 static const struct swcr_auth_hash swcr_auth_hash_hmac_md5 = { 261 &auth_hash_hmac_md5, sizeof(MD5_CTX), 262 (void (*) (void *)) MD5Init, NULL, NULL, MD5Update_int, 263 (void (*) (uint8_t *, void *)) MD5Final 264 }; 265 266 static const struct swcr_auth_hash swcr_auth_hash_hmac_sha1 = { 267 &auth_hash_hmac_sha1, sizeof(SHA1_CTX), 268 SHA1Init_int, NULL, NULL, SHA1Update_int, SHA1Final_int 269 }; 270 271 static const struct swcr_auth_hash swcr_auth_hash_hmac_ripemd_160 = { 272 &auth_hash_hmac_ripemd_160, sizeof(RMD160_CTX), 273 (void (*)(void *)) RMD160Init, NULL, NULL, RMD160Update_int, 274 (void (*)(uint8_t *, void *)) RMD160Final 275 }; 276 static const struct swcr_auth_hash swcr_auth_hash_hmac_md5_96 = { 277 &auth_hash_hmac_md5_96, sizeof(MD5_CTX), 278 (void (*) (void *)) MD5Init, NULL, NULL, MD5Update_int, 279 (void (*) (uint8_t *, void *)) MD5Final 280 }; 281 282 static const struct swcr_auth_hash swcr_auth_hash_hmac_sha1_96 = { 283 &auth_hash_hmac_sha1_96, sizeof(SHA1_CTX), 284 SHA1Init_int, NULL, NULL, SHA1Update_int, SHA1Final_int 285 }; 286 287 static const struct swcr_auth_hash swcr_auth_hash_hmac_ripemd_160_96 = { 288 &auth_hash_hmac_ripemd_160_96, sizeof(RMD160_CTX), 289 (void (*)(void *)) RMD160Init, NULL, NULL, RMD160Update_int, 290 (void (*)(uint8_t *, void *)) RMD160Final 291 }; 292 293 static const struct swcr_auth_hash swcr_auth_hash_key_md5 = { 294 &auth_hash_key_md5, sizeof(MD5_CTX), 295 (void (*)(void *)) MD5Init, NULL, NULL, MD5Update_int, 296 (void (*)(uint8_t *, void *)) MD5Final 297 }; 298 299 static const struct swcr_auth_hash swcr_auth_hash_key_sha1 = { 300 &auth_hash_key_sha1, sizeof(SHA1_CTX), 301 SHA1Init_int, NULL, NULL, SHA1Update_int, SHA1Final_int 302 }; 303 304 static const struct swcr_auth_hash swcr_auth_hash_md5 = { 305 &auth_hash_md5, sizeof(MD5_CTX), 306 (void (*) (void *)) MD5Init, NULL, NULL, MD5Update_int, 307 (void (*) (uint8_t *, void *)) MD5Final 308 }; 309 310 static const struct swcr_auth_hash swcr_auth_hash_sha1 = { 311 &auth_hash_sha1, sizeof(SHA1_CTX), 312 (void (*)(void *)) SHA1Init, NULL, NULL, SHA1Update_int, 313 (void (*)(uint8_t *, void *)) SHA1Final 314 }; 315 316 static const struct swcr_auth_hash swcr_auth_hash_hmac_sha2_256 = { 317 &auth_hash_hmac_sha2_256, sizeof(SHA256_CTX), 318 (void (*)(void *))(void *)SHA256_Init, NULL, NULL, SHA256Update_int, 319 (void (*)(uint8_t *, void *))(void *)SHA256_Final 320 }; 321 322 static const struct swcr_auth_hash swcr_auth_hash_hmac_sha2_384 = { 323 &auth_hash_hmac_sha2_384, sizeof(SHA384_CTX), 324 (void (*)(void *))(void *)SHA384_Init, NULL, NULL, SHA384Update_int, 325 (void (*)(uint8_t *, void *))(void *)SHA384_Final 326 }; 327 328 static const struct swcr_auth_hash swcr_auth_hash_hmac_sha2_512 = { 329 &auth_hash_hmac_sha2_512, sizeof(SHA512_CTX), 330 (void (*)(void *))(void *)SHA512_Init, NULL, NULL, SHA512Update_int, 331 (void (*)(uint8_t *, void *))(void *)SHA512_Final 332 }; 333 334 static const struct swcr_auth_hash swcr_auth_hash_aes_xcbc_mac = { 335 &auth_hash_aes_xcbc_mac_96, sizeof(aesxcbc_ctx), 336 null_init, 337 (void (*)(void *, const uint8_t *, uint16_t))(void *)aes_xcbc_mac_init, 338 NULL, aes_xcbc_mac_loop, aes_xcbc_mac_result 339 }; 340 341 static const struct swcr_auth_hash swcr_auth_hash_gmac_aes_128 = { 342 &auth_hash_gmac_aes_128, sizeof(AES_GMAC_CTX), 343 (void (*)(void *))AES_GMAC_Init, 344 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Setkey, 345 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Reinit, 346 (int (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Update, 347 (void (*)(uint8_t *, void *))AES_GMAC_Final 348 }; 349 350 static const struct swcr_auth_hash swcr_auth_hash_gmac_aes_192 = { 351 &auth_hash_gmac_aes_192, sizeof(AES_GMAC_CTX), 352 (void (*)(void *))AES_GMAC_Init, 353 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Setkey, 354 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Reinit, 355 (int (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Update, 356 (void (*)(uint8_t *, void *))AES_GMAC_Final 357 }; 358 359 static const struct swcr_auth_hash swcr_auth_hash_gmac_aes_256 = { 360 &auth_hash_gmac_aes_256, sizeof(AES_GMAC_CTX), 361 (void (*)(void *))AES_GMAC_Init, 362 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Setkey, 363 (void (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Reinit, 364 (int (*)(void *, const uint8_t *, uint16_t))AES_GMAC_Update, 365 (void (*)(uint8_t *, void *))AES_GMAC_Final 366 }; 367 368 /* Compression instance */ 369 static const struct swcr_comp_algo swcr_comp_algo_deflate = { 370 &comp_algo_deflate, 371 deflate_compress, 372 deflate_decompress 373 }; 374 375 static const struct swcr_comp_algo swcr_comp_algo_deflate_nogrow = { 376 &comp_algo_deflate_nogrow, 377 deflate_compress, 378 deflate_decompress 379 }; 380 381 static const struct swcr_comp_algo swcr_comp_algo_gzip = { 382 &comp_algo_deflate, 383 gzip_compress, 384 gzip_decompress 385 }; 386 387 /* 388 * Encryption wrapper routines. 389 */ 390 static void 391 null_encrypt(void *key, uint8_t *blk) 392 { 393 } 394 static void 395 null_decrypt(void *key, uint8_t *blk) 396 { 397 } 398 static int 399 null_setkey(uint8_t **sched, const uint8_t *key, int len) 400 { 401 *sched = NULL; 402 return 0; 403 } 404 static void 405 null_zerokey(uint8_t **sched) 406 { 407 *sched = NULL; 408 } 409 410 static void 411 des1_encrypt(void *key, uint8_t *blk) 412 { 413 des_cblock *cb = (des_cblock *) blk; 414 des_key_schedule *p = (des_key_schedule *) key; 415 416 des_ecb_encrypt(cb, cb, p[0], DES_ENCRYPT); 417 } 418 419 static void 420 des1_decrypt(void *key, uint8_t *blk) 421 { 422 des_cblock *cb = (des_cblock *) blk; 423 des_key_schedule *p = (des_key_schedule *) key; 424 425 des_ecb_encrypt(cb, cb, p[0], DES_DECRYPT); 426 } 427 428 static int 429 des1_setkey(uint8_t **sched, const uint8_t *key, int len) 430 { 431 des_key_schedule *p; 432 433 p = malloc(sizeof (des_key_schedule), 434 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 435 *sched = (uint8_t *) p; 436 if (p == NULL) 437 return SET_ERROR(ENOMEM); 438 des_set_key((des_cblock *)__UNCONST(key), p[0]); 439 return 0; 440 } 441 442 static void 443 des1_zerokey(uint8_t **sched) 444 { 445 memset(*sched, 0, sizeof (des_key_schedule)); 446 free(*sched, M_CRYPTO_DATA); 447 *sched = NULL; 448 } 449 450 static void 451 des3_encrypt(void *key, uint8_t *blk) 452 { 453 des_cblock *cb = (des_cblock *) blk; 454 des_key_schedule *p = (des_key_schedule *) key; 455 456 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_ENCRYPT); 457 } 458 459 static void 460 des3_decrypt(void *key, uint8_t *blk) 461 { 462 des_cblock *cb = (des_cblock *) blk; 463 des_key_schedule *p = (des_key_schedule *) key; 464 465 des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_DECRYPT); 466 } 467 468 static int 469 des3_setkey(uint8_t **sched, const uint8_t *key, int len) 470 { 471 des_key_schedule *p; 472 473 p = malloc(3*sizeof (des_key_schedule), 474 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 475 *sched = (uint8_t *) p; 476 if (p == NULL) 477 return SET_ERROR(ENOMEM); 478 des_set_key((des_cblock *)__UNCONST(key + 0), p[0]); 479 des_set_key((des_cblock *)__UNCONST(key + 8), p[1]); 480 des_set_key((des_cblock *)__UNCONST(key + 16), p[2]); 481 return 0; 482 } 483 484 static void 485 des3_zerokey(uint8_t **sched) 486 { 487 memset(*sched, 0, 3*sizeof (des_key_schedule)); 488 free(*sched, M_CRYPTO_DATA); 489 *sched = NULL; 490 } 491 492 static void 493 blf_encrypt(void *key, uint8_t *blk) 494 { 495 496 BF_ecb_encrypt(blk, blk, (BF_KEY *)key, 1); 497 } 498 499 static void 500 blf_decrypt(void *key, uint8_t *blk) 501 { 502 503 BF_ecb_encrypt(blk, blk, (BF_KEY *)key, 0); 504 } 505 506 static int 507 blf_setkey(uint8_t **sched, const uint8_t *key, int len) 508 { 509 510 *sched = malloc(sizeof(BF_KEY), 511 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 512 if (*sched == NULL) 513 return SET_ERROR(ENOMEM); 514 BF_set_key((BF_KEY *) *sched, len, key); 515 return 0; 516 } 517 518 static void 519 blf_zerokey(uint8_t **sched) 520 { 521 memset(*sched, 0, sizeof(BF_KEY)); 522 free(*sched, M_CRYPTO_DATA); 523 *sched = NULL; 524 } 525 526 static void 527 cast5_encrypt(void *key, uint8_t *blk) 528 { 529 cast128_encrypt((cast128_key *) key, blk, blk); 530 } 531 532 static void 533 cast5_decrypt(void *key, uint8_t *blk) 534 { 535 cast128_decrypt((cast128_key *) key, blk, blk); 536 } 537 538 static int 539 cast5_setkey(uint8_t **sched, const uint8_t *key, int len) 540 { 541 542 *sched = malloc(sizeof(cast128_key), M_CRYPTO_DATA, 543 M_NOWAIT|M_ZERO); 544 if (*sched == NULL) 545 return SET_ERROR(ENOMEM); 546 cast128_setkey((cast128_key *)*sched, key, len); 547 return 0; 548 } 549 550 static void 551 cast5_zerokey(uint8_t **sched) 552 { 553 memset(*sched, 0, sizeof(cast128_key)); 554 free(*sched, M_CRYPTO_DATA); 555 *sched = NULL; 556 } 557 558 static void 559 skipjack_encrypt(void *key, uint8_t *blk) 560 { 561 skipjack_forwards(blk, blk, (uint8_t **) key); 562 } 563 564 static void 565 skipjack_decrypt(void *key, uint8_t *blk) 566 { 567 skipjack_backwards(blk, blk, (uint8_t **) key); 568 } 569 570 static int 571 skipjack_setkey(uint8_t **sched, const uint8_t *key, int len) 572 { 573 574 /* NB: allocate all the memory that's needed at once */ 575 /* XXX assumes bytes are aligned on sizeof(u_char) == 1 boundaries. 576 * Will this break a pdp-10, Cray-1, or GE-645 port? 577 */ 578 *sched = malloc(10 * (sizeof(uint8_t *) + 0x100), 579 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 580 581 if (*sched == NULL) 582 return SET_ERROR(ENOMEM); 583 584 uint8_t** key_tables = (uint8_t**) *sched; 585 uint8_t* table = (uint8_t*) &key_tables[10]; 586 int k; 587 588 for (k = 0; k < 10; k++) { 589 key_tables[k] = table; 590 table += 0x100; 591 } 592 subkey_table_gen(key, (uint8_t **) *sched); 593 return 0; 594 } 595 596 static void 597 skipjack_zerokey(uint8_t **sched) 598 { 599 memset(*sched, 0, 10 * (sizeof(uint8_t *) + 0x100)); 600 free(*sched, M_CRYPTO_DATA); 601 *sched = NULL; 602 } 603 604 struct aes_ctx { 605 struct aesenc enc; 606 struct aesdec dec; 607 uint32_t nr; 608 }; 609 610 static void 611 aes_encrypt(void *key, uint8_t *blk) 612 { 613 struct aes_ctx *ctx = key; 614 615 aes_enc(&ctx->enc, blk, blk, ctx->nr); 616 } 617 618 static void 619 aes_decrypt(void *key, uint8_t *blk) 620 { 621 struct aes_ctx *ctx = key; 622 623 aes_dec(&ctx->dec, blk, blk, ctx->nr); 624 } 625 626 static int 627 aes_setkey(uint8_t **sched, const uint8_t *key, int len) 628 { 629 struct aes_ctx *ctx; 630 631 if (len != 16 && len != 24 && len != 32) 632 return SET_ERROR(EINVAL); 633 ctx = kmem_zalloc(sizeof(*ctx), KM_NOSLEEP); 634 if (ctx == NULL) 635 return SET_ERROR(ENOMEM); 636 637 switch (len) { 638 case 16: 639 aes_setenckey128(&ctx->enc, key); 640 aes_setdeckey128(&ctx->dec, key); 641 ctx->nr = AES_128_NROUNDS; 642 break; 643 case 24: 644 aes_setenckey192(&ctx->enc, key); 645 aes_setdeckey192(&ctx->dec, key); 646 ctx->nr = AES_192_NROUNDS; 647 break; 648 case 32: 649 aes_setenckey256(&ctx->enc, key); 650 aes_setdeckey256(&ctx->dec, key); 651 ctx->nr = AES_256_NROUNDS; 652 break; 653 } 654 655 *sched = (void *)ctx; 656 return 0; 657 } 658 659 static void 660 aes_zerokey(uint8_t **sched) 661 { 662 struct aes_ctx *ctx = (void *)*sched; 663 664 explicit_memset(ctx, 0, sizeof(*ctx)); 665 kmem_free(ctx, sizeof(*ctx)); 666 *sched = NULL; 667 } 668 669 static void 670 cml_encrypt(void *key, uint8_t *blk) 671 { 672 673 camellia_encrypt(key, blk, blk); 674 } 675 676 static void 677 cml_decrypt(void *key, uint8_t *blk) 678 { 679 680 camellia_decrypt(key, blk, blk); 681 } 682 683 static int 684 cml_setkey(uint8_t **sched, const uint8_t *key, int len) 685 { 686 687 if (len != 16 && len != 24 && len != 32) 688 return SET_ERROR(EINVAL); 689 *sched = malloc(sizeof(camellia_ctx), M_CRYPTO_DATA, 690 M_NOWAIT|M_ZERO); 691 if (*sched == NULL) 692 return SET_ERROR(ENOMEM); 693 694 camellia_set_key((camellia_ctx *) *sched, key, len * 8); 695 return 0; 696 } 697 698 static void 699 cml_zerokey(uint8_t **sched) 700 { 701 702 memset(*sched, 0, sizeof(camellia_ctx)); 703 free(*sched, M_CRYPTO_DATA); 704 *sched = NULL; 705 } 706 707 #define AESCTR_NONCESIZE 4 708 #define AESCTR_IVSIZE 8 709 #define AESCTR_BLOCKSIZE 16 710 711 struct aes_ctr_ctx { 712 /* need only encryption half */ 713 struct aesenc ac_ek; 714 uint8_t ac_block[AESCTR_BLOCKSIZE]; 715 int ac_nr; 716 struct { 717 uint64_t lastiv; 718 } ivgenctx; 719 }; 720 721 static void 722 aes_ctr_crypt(void *key, uint8_t *blk) 723 { 724 struct aes_ctr_ctx *ctx; 725 uint8_t keystream[AESCTR_BLOCKSIZE]; 726 int i; 727 728 ctx = key; 729 /* increment counter */ 730 for (i = AESCTR_BLOCKSIZE - 1; 731 i >= AESCTR_NONCESIZE + AESCTR_IVSIZE; i--) 732 if (++ctx->ac_block[i]) /* continue on overflow */ 733 break; 734 aes_enc(&ctx->ac_ek, ctx->ac_block, keystream, ctx->ac_nr); 735 for (i = 0; i < AESCTR_BLOCKSIZE; i++) 736 blk[i] ^= keystream[i]; 737 explicit_memset(keystream, 0, sizeof(keystream)); 738 } 739 740 int 741 aes_ctr_setkey(uint8_t **sched, const uint8_t *key, int len) 742 { 743 struct aes_ctr_ctx *ctx; 744 745 if (len < AESCTR_NONCESIZE) 746 return SET_ERROR(EINVAL); 747 748 ctx = kmem_zalloc(sizeof(*ctx), KM_NOSLEEP); 749 if (!ctx) 750 return SET_ERROR(ENOMEM); 751 switch (len) { 752 case 16 + AESCTR_NONCESIZE: 753 ctx->ac_nr = aes_setenckey128(&ctx->ac_ek, key); 754 break; 755 case 24 + AESCTR_NONCESIZE: 756 ctx->ac_nr = aes_setenckey192(&ctx->ac_ek, key); 757 break; 758 case 32 + AESCTR_NONCESIZE: 759 ctx->ac_nr = aes_setenckey256(&ctx->ac_ek, key); 760 break; 761 default: 762 aes_ctr_zerokey((uint8_t **)&ctx); 763 return SET_ERROR(EINVAL); 764 } 765 memcpy(ctx->ac_block, key + len - AESCTR_NONCESIZE, AESCTR_NONCESIZE); 766 /* random start value for simple counter */ 767 cprng_fast(&ctx->ivgenctx.lastiv, sizeof(ctx->ivgenctx.lastiv)); 768 *sched = (void *)ctx; 769 return 0; 770 } 771 772 void 773 aes_ctr_zerokey(uint8_t **sched) 774 { 775 struct aes_ctr_ctx *ctx = (void *)*sched; 776 777 explicit_memset(ctx, 0, sizeof(*ctx)); 778 kmem_free(ctx, sizeof(*ctx)); 779 *sched = NULL; 780 } 781 782 void 783 aes_ctr_reinit(void *key, const uint8_t *iv, uint8_t *ivout) 784 { 785 struct aes_ctr_ctx *ctx = key; 786 787 if (!iv) { 788 ctx->ivgenctx.lastiv++; 789 iv = (const uint8_t *)&ctx->ivgenctx.lastiv; 790 } 791 if (ivout) 792 memcpy(ivout, iv, AESCTR_IVSIZE); 793 memcpy(ctx->ac_block + AESCTR_NONCESIZE, iv, AESCTR_IVSIZE); 794 /* reset counter */ 795 memset(ctx->ac_block + AESCTR_NONCESIZE + AESCTR_IVSIZE, 0, 4); 796 } 797 798 void 799 aes_gcm_reinit(void *key, const uint8_t *iv, uint8_t *ivout) 800 { 801 struct aes_ctr_ctx *ctx = key; 802 803 if (!iv) { 804 ctx->ivgenctx.lastiv++; 805 iv = (const uint8_t *)&ctx->ivgenctx.lastiv; 806 } 807 if (ivout) 808 memcpy(ivout, iv, AESCTR_IVSIZE); 809 memcpy(ctx->ac_block + AESCTR_NONCESIZE, iv, AESCTR_IVSIZE); 810 /* reset counter */ 811 memset(ctx->ac_block + AESCTR_NONCESIZE + AESCTR_IVSIZE, 0, 4); 812 ctx->ac_block[AESCTR_BLOCKSIZE - 1] = 1; /* GCM starts with 1 */ 813 } 814 815 struct aes_gmac_ctx { 816 struct { 817 uint64_t lastiv; 818 } ivgenctx; 819 }; 820 821 int 822 aes_gmac_setkey(uint8_t **sched, const uint8_t *key, int len) 823 { 824 struct aes_gmac_ctx *ctx; 825 826 ctx = kmem_zalloc(sizeof(*ctx), KM_NOSLEEP); 827 if (!ctx) 828 return SET_ERROR(ENOMEM); 829 830 /* random start value for simple counter */ 831 cprng_fast(&ctx->ivgenctx.lastiv, sizeof(ctx->ivgenctx.lastiv)); 832 *sched = (void *)ctx; 833 return 0; 834 } 835 836 void 837 aes_gmac_zerokey(uint8_t **sched) 838 { 839 struct aes_gmac_ctx *ctx = (void *)*sched; 840 841 kmem_free(ctx, sizeof(*ctx)); 842 *sched = NULL; 843 } 844 845 void 846 aes_gmac_reinit(void *key, const uint8_t *iv, uint8_t *ivout) 847 { 848 struct aes_gmac_ctx *ctx = key; 849 850 if (!iv) { 851 ctx->ivgenctx.lastiv++; 852 iv = (const uint8_t *)&ctx->ivgenctx.lastiv; 853 } 854 if (ivout) 855 memcpy(ivout, iv, AESCTR_IVSIZE); 856 } 857 858 /* 859 * And now for auth. 860 */ 861 862 static void 863 null_init(void *ctx) 864 { 865 } 866 867 static int 868 null_update(void *ctx, const uint8_t *buf, 869 uint16_t len) 870 { 871 return 0; 872 } 873 874 static void 875 null_final(uint8_t *buf, void *ctx) 876 { 877 if (buf != (uint8_t *) 0) 878 memset(buf, 0, 12); 879 } 880 881 static int 882 RMD160Update_int(void *ctx, const uint8_t *buf, uint16_t len) 883 { 884 RMD160Update(ctx, buf, len); 885 return 0; 886 } 887 888 static int 889 MD5Update_int(void *ctx, const uint8_t *buf, uint16_t len) 890 { 891 MD5Update(ctx, buf, len); 892 return 0; 893 } 894 895 static void 896 SHA1Init_int(void *ctx) 897 { 898 SHA1Init(ctx); 899 } 900 901 static int 902 SHA1Update_int(void *ctx, const uint8_t *buf, uint16_t len) 903 { 904 SHA1Update(ctx, buf, len); 905 return 0; 906 } 907 908 static void 909 SHA1Final_int(uint8_t *blk, void *ctx) 910 { 911 SHA1Final(blk, ctx); 912 } 913 914 static int 915 SHA256Update_int(void *ctx, const uint8_t *buf, uint16_t len) 916 { 917 SHA256_Update(ctx, buf, len); 918 return 0; 919 } 920 921 static int 922 SHA384Update_int(void *ctx, const uint8_t *buf, uint16_t len) 923 { 924 SHA384_Update(ctx, buf, len); 925 return 0; 926 } 927 928 static int 929 SHA512Update_int(void *ctx, const uint8_t *buf, uint16_t len) 930 { 931 SHA512_Update(ctx, buf, len); 932 return 0; 933 } 934 935 /* 936 * And compression 937 */ 938 939 static uint32_t 940 deflate_compress(uint8_t *data, uint32_t size, uint8_t **out) 941 { 942 return deflate_global(data, size, 0, out, 0); 943 } 944 945 static uint32_t 946 deflate_decompress(uint8_t *data, uint32_t size, uint8_t **out, 947 int size_hint) 948 { 949 return deflate_global(data, size, 1, out, size_hint); 950 } 951 952 static uint32_t 953 gzip_compress(uint8_t *data, uint32_t size, uint8_t **out) 954 { 955 return gzip_global(data, size, 0, out, 0); 956 } 957 958 static uint32_t 959 gzip_decompress(uint8_t *data, uint32_t size, uint8_t **out, 960 int size_hint) 961 { 962 return gzip_global(data, size, 1, out, size_hint); 963 } 964
Indexes created Tue Aug 18 00:25:06 UTC 2026