2 * GCM: Galois/Counter Mode.
4 * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License version 2 as published
8 * by the Free Software Foundation.
11 #include <crypto/gf128mul.h>
12 #include <crypto/internal/aead.h>
13 #include <crypto/internal/skcipher.h>
14 #include <crypto/internal/hash.h>
15 #include <crypto/scatterwalk.h>
16 #include <crypto/hash.h>
18 #include <linux/completion.h>
19 #include <linux/err.h>
20 #include <linux/init.h>
21 #include <linux/kernel.h>
22 #include <linux/module.h>
23 #include <linux/slab.h>
25 struct gcm_instance_ctx {
26 struct crypto_skcipher_spawn ctr;
27 struct crypto_ahash_spawn ghash;
30 struct crypto_gcm_ctx {
31 struct crypto_ablkcipher *ctr;
32 struct crypto_ahash *ghash;
35 struct crypto_rfc4106_ctx {
36 struct crypto_aead *child;
40 struct crypto_gcm_ghash_ctx {
41 unsigned int cryptlen;
42 struct scatterlist *src;
43 crypto_completion_t complete;
46 struct crypto_gcm_req_priv_ctx {
49 struct scatterlist src[2];
50 struct scatterlist dst[2];
51 struct crypto_gcm_ghash_ctx ghash_ctx;
53 struct ahash_request ahreq;
54 struct ablkcipher_request abreq;
58 struct crypto_gcm_setkey_result {
60 struct completion completion;
63 static void *gcm_zeroes;
65 static inline struct crypto_gcm_req_priv_ctx *crypto_gcm_reqctx(
66 struct aead_request *req)
68 unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req));
70 return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1);
73 static void crypto_gcm_setkey_done(struct crypto_async_request *req, int err)
75 struct crypto_gcm_setkey_result *result = req->data;
77 if (err == -EINPROGRESS)
81 complete(&result->completion);
84 static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
87 struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
88 struct crypto_ahash *ghash = ctx->ghash;
89 struct crypto_ablkcipher *ctr = ctx->ctr;
94 struct crypto_gcm_setkey_result result;
96 struct scatterlist sg[1];
97 struct ablkcipher_request req;
101 crypto_ablkcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
102 crypto_ablkcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
103 CRYPTO_TFM_REQ_MASK);
105 err = crypto_ablkcipher_setkey(ctr, key, keylen);
109 crypto_aead_set_flags(aead, crypto_ablkcipher_get_flags(ctr) &
110 CRYPTO_TFM_RES_MASK);
112 data = kzalloc(sizeof(*data) + crypto_ablkcipher_reqsize(ctr),
117 init_completion(&data->result.completion);
118 sg_init_one(data->sg, &data->hash, sizeof(data->hash));
119 ablkcipher_request_set_tfm(&data->req, ctr);
120 ablkcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP |
121 CRYPTO_TFM_REQ_MAY_BACKLOG,
122 crypto_gcm_setkey_done,
124 ablkcipher_request_set_crypt(&data->req, data->sg, data->sg,
125 sizeof(data->hash), data->iv);
127 err = crypto_ablkcipher_encrypt(&data->req);
128 if (err == -EINPROGRESS || err == -EBUSY) {
129 err = wait_for_completion_interruptible(
130 &data->result.completion);
132 err = data->result.err;
138 crypto_ahash_clear_flags(ghash, CRYPTO_TFM_REQ_MASK);
139 crypto_ahash_set_flags(ghash, crypto_aead_get_flags(aead) &
140 CRYPTO_TFM_REQ_MASK);
141 err = crypto_ahash_setkey(ghash, (u8 *)&data->hash, sizeof(be128));
142 crypto_aead_set_flags(aead, crypto_ahash_get_flags(ghash) &
143 CRYPTO_TFM_RES_MASK);
150 static int crypto_gcm_setauthsize(struct crypto_aead *tfm,
151 unsigned int authsize)
169 static void crypto_gcm_init_crypt(struct ablkcipher_request *ablk_req,
170 struct aead_request *req,
171 unsigned int cryptlen)
173 struct crypto_aead *aead = crypto_aead_reqtfm(req);
174 struct crypto_gcm_ctx *ctx = crypto_aead_ctx(aead);
175 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
176 struct scatterlist *dst;
177 __be32 counter = cpu_to_be32(1);
179 memset(pctx->auth_tag, 0, sizeof(pctx->auth_tag));
180 memcpy(req->iv + 12, &counter, 4);
182 sg_init_table(pctx->src, 2);
183 sg_set_buf(pctx->src, pctx->auth_tag, sizeof(pctx->auth_tag));
184 scatterwalk_sg_chain(pctx->src, 2, req->src);
187 if (req->src != req->dst) {
188 sg_init_table(pctx->dst, 2);
189 sg_set_buf(pctx->dst, pctx->auth_tag, sizeof(pctx->auth_tag));
190 scatterwalk_sg_chain(pctx->dst, 2, req->dst);
194 ablkcipher_request_set_tfm(ablk_req, ctx->ctr);
195 ablkcipher_request_set_crypt(ablk_req, pctx->src, dst,
196 cryptlen + sizeof(pctx->auth_tag),
200 static inline unsigned int gcm_remain(unsigned int len)
203 return len ? 16 - len : 0;
206 static void gcm_hash_len_done(struct crypto_async_request *areq, int err);
207 static void gcm_hash_final_done(struct crypto_async_request *areq, int err);
209 static int gcm_hash_update(struct aead_request *req,
210 struct crypto_gcm_req_priv_ctx *pctx,
211 crypto_completion_t complete,
212 struct scatterlist *src,
215 struct ahash_request *ahreq = &pctx->u.ahreq;
217 ahash_request_set_callback(ahreq, aead_request_flags(req),
219 ahash_request_set_crypt(ahreq, src, NULL, len);
221 return crypto_ahash_update(ahreq);
224 static int gcm_hash_remain(struct aead_request *req,
225 struct crypto_gcm_req_priv_ctx *pctx,
227 crypto_completion_t complete)
229 struct ahash_request *ahreq = &pctx->u.ahreq;
231 ahash_request_set_callback(ahreq, aead_request_flags(req),
233 sg_init_one(pctx->src, gcm_zeroes, remain);
234 ahash_request_set_crypt(ahreq, pctx->src, NULL, remain);
236 return crypto_ahash_update(ahreq);
239 static int gcm_hash_len(struct aead_request *req,
240 struct crypto_gcm_req_priv_ctx *pctx)
242 struct ahash_request *ahreq = &pctx->u.ahreq;
243 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
246 lengths.a = cpu_to_be64(req->assoclen * 8);
247 lengths.b = cpu_to_be64(gctx->cryptlen * 8);
248 memcpy(pctx->iauth_tag, &lengths, 16);
249 sg_init_one(pctx->src, pctx->iauth_tag, 16);
250 ahash_request_set_callback(ahreq, aead_request_flags(req),
251 gcm_hash_len_done, req);
252 ahash_request_set_crypt(ahreq, pctx->src,
253 NULL, sizeof(lengths));
255 return crypto_ahash_update(ahreq);
258 static int gcm_hash_final(struct aead_request *req,
259 struct crypto_gcm_req_priv_ctx *pctx)
261 struct ahash_request *ahreq = &pctx->u.ahreq;
263 ahash_request_set_callback(ahreq, aead_request_flags(req),
264 gcm_hash_final_done, req);
265 ahash_request_set_crypt(ahreq, NULL, pctx->iauth_tag, 0);
267 return crypto_ahash_final(ahreq);
270 static void gcm_hash_final_done(struct crypto_async_request *areq,
273 struct aead_request *req = areq->data;
274 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
275 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
278 crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
280 gctx->complete(areq, err);
283 static void gcm_hash_len_done(struct crypto_async_request *areq,
286 struct aead_request *req = areq->data;
287 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
290 err = gcm_hash_final(req, pctx);
291 if (err == -EINPROGRESS || err == -EBUSY)
295 gcm_hash_final_done(areq, err);
298 static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
301 struct aead_request *req = areq->data;
302 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
305 err = gcm_hash_len(req, pctx);
306 if (err == -EINPROGRESS || err == -EBUSY)
310 gcm_hash_len_done(areq, err);
313 static void gcm_hash_crypt_done(struct crypto_async_request *areq,
316 struct aead_request *req = areq->data;
317 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
318 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
322 remain = gcm_remain(gctx->cryptlen);
324 err = gcm_hash_remain(req, pctx, remain,
325 gcm_hash_crypt_remain_done);
326 if (err == -EINPROGRESS || err == -EBUSY)
330 gcm_hash_crypt_remain_done(areq, err);
333 static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
336 struct aead_request *req = areq->data;
337 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
338 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
339 crypto_completion_t complete;
340 unsigned int remain = 0;
342 if (!err && gctx->cryptlen) {
343 remain = gcm_remain(gctx->cryptlen);
344 complete = remain ? gcm_hash_crypt_done :
345 gcm_hash_crypt_remain_done;
346 err = gcm_hash_update(req, pctx, complete,
347 gctx->src, gctx->cryptlen);
348 if (err == -EINPROGRESS || err == -EBUSY)
353 gcm_hash_crypt_done(areq, err);
355 gcm_hash_crypt_remain_done(areq, err);
358 static void gcm_hash_assoc_done(struct crypto_async_request *areq,
361 struct aead_request *req = areq->data;
362 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
366 remain = gcm_remain(req->assoclen);
368 err = gcm_hash_remain(req, pctx, remain,
369 gcm_hash_assoc_remain_done);
370 if (err == -EINPROGRESS || err == -EBUSY)
374 gcm_hash_assoc_remain_done(areq, err);
377 static void gcm_hash_init_done(struct crypto_async_request *areq,
380 struct aead_request *req = areq->data;
381 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
382 crypto_completion_t complete;
383 unsigned int remain = 0;
385 if (!err && req->assoclen) {
386 remain = gcm_remain(req->assoclen);
387 complete = remain ? gcm_hash_assoc_done :
388 gcm_hash_assoc_remain_done;
389 err = gcm_hash_update(req, pctx, complete,
390 req->assoc, req->assoclen);
391 if (err == -EINPROGRESS || err == -EBUSY)
396 gcm_hash_assoc_done(areq, err);
398 gcm_hash_assoc_remain_done(areq, err);
401 static int gcm_hash(struct aead_request *req,
402 struct crypto_gcm_req_priv_ctx *pctx)
404 struct ahash_request *ahreq = &pctx->u.ahreq;
405 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
406 struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
408 crypto_completion_t complete;
411 ahash_request_set_tfm(ahreq, ctx->ghash);
413 ahash_request_set_callback(ahreq, aead_request_flags(req),
414 gcm_hash_init_done, req);
415 err = crypto_ahash_init(ahreq);
418 remain = gcm_remain(req->assoclen);
419 complete = remain ? gcm_hash_assoc_done : gcm_hash_assoc_remain_done;
420 err = gcm_hash_update(req, pctx, complete, req->assoc, req->assoclen);
424 err = gcm_hash_remain(req, pctx, remain,
425 gcm_hash_assoc_remain_done);
429 remain = gcm_remain(gctx->cryptlen);
430 complete = remain ? gcm_hash_crypt_done : gcm_hash_crypt_remain_done;
431 err = gcm_hash_update(req, pctx, complete, gctx->src, gctx->cryptlen);
435 err = gcm_hash_remain(req, pctx, remain,
436 gcm_hash_crypt_remain_done);
440 err = gcm_hash_len(req, pctx);
443 err = gcm_hash_final(req, pctx);
450 static void gcm_enc_copy_hash(struct aead_request *req,
451 struct crypto_gcm_req_priv_ctx *pctx)
453 struct crypto_aead *aead = crypto_aead_reqtfm(req);
454 u8 *auth_tag = pctx->auth_tag;
456 scatterwalk_map_and_copy(auth_tag, req->dst, req->cryptlen,
457 crypto_aead_authsize(aead), 1);
460 static void gcm_enc_hash_done(struct crypto_async_request *areq,
463 struct aead_request *req = areq->data;
464 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
467 gcm_enc_copy_hash(req, pctx);
469 aead_request_complete(req, err);
472 static void gcm_encrypt_done(struct crypto_async_request *areq,
475 struct aead_request *req = areq->data;
476 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
479 err = gcm_hash(req, pctx);
480 if (err == -EINPROGRESS || err == -EBUSY)
484 gcm_enc_hash_done(areq, err);
487 static int crypto_gcm_encrypt(struct aead_request *req)
489 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
490 struct ablkcipher_request *abreq = &pctx->u.abreq;
491 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
494 crypto_gcm_init_crypt(abreq, req, req->cryptlen);
495 ablkcipher_request_set_callback(abreq, aead_request_flags(req),
496 gcm_encrypt_done, req);
498 gctx->src = req->dst;
499 gctx->cryptlen = req->cryptlen;
500 gctx->complete = gcm_enc_hash_done;
502 err = crypto_ablkcipher_encrypt(abreq);
506 err = gcm_hash(req, pctx);
510 crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
511 gcm_enc_copy_hash(req, pctx);
516 static int crypto_gcm_verify(struct aead_request *req,
517 struct crypto_gcm_req_priv_ctx *pctx)
519 struct crypto_aead *aead = crypto_aead_reqtfm(req);
520 u8 *auth_tag = pctx->auth_tag;
521 u8 *iauth_tag = pctx->iauth_tag;
522 unsigned int authsize = crypto_aead_authsize(aead);
523 unsigned int cryptlen = req->cryptlen - authsize;
525 crypto_xor(auth_tag, iauth_tag, 16);
526 scatterwalk_map_and_copy(iauth_tag, req->src, cryptlen, authsize, 0);
527 return memcmp(iauth_tag, auth_tag, authsize) ? -EBADMSG : 0;
530 static void gcm_decrypt_done(struct crypto_async_request *areq, int err)
532 struct aead_request *req = areq->data;
533 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
536 err = crypto_gcm_verify(req, pctx);
538 aead_request_complete(req, err);
541 static void gcm_dec_hash_done(struct crypto_async_request *areq, int err)
543 struct aead_request *req = areq->data;
544 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
545 struct ablkcipher_request *abreq = &pctx->u.abreq;
546 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
549 ablkcipher_request_set_callback(abreq, aead_request_flags(req),
550 gcm_decrypt_done, req);
551 crypto_gcm_init_crypt(abreq, req, gctx->cryptlen);
552 err = crypto_ablkcipher_decrypt(abreq);
553 if (err == -EINPROGRESS || err == -EBUSY)
557 gcm_decrypt_done(areq, err);
560 static int crypto_gcm_decrypt(struct aead_request *req)
562 struct crypto_aead *aead = crypto_aead_reqtfm(req);
563 struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
564 struct ablkcipher_request *abreq = &pctx->u.abreq;
565 struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
566 unsigned int authsize = crypto_aead_authsize(aead);
567 unsigned int cryptlen = req->cryptlen;
570 if (cryptlen < authsize)
572 cryptlen -= authsize;
574 gctx->src = req->src;
575 gctx->cryptlen = cryptlen;
576 gctx->complete = gcm_dec_hash_done;
578 err = gcm_hash(req, pctx);
582 ablkcipher_request_set_callback(abreq, aead_request_flags(req),
583 gcm_decrypt_done, req);
584 crypto_gcm_init_crypt(abreq, req, cryptlen);
585 err = crypto_ablkcipher_decrypt(abreq);
589 return crypto_gcm_verify(req, pctx);
592 static int crypto_gcm_init_tfm(struct crypto_tfm *tfm)
594 struct crypto_instance *inst = (void *)tfm->__crt_alg;
595 struct gcm_instance_ctx *ictx = crypto_instance_ctx(inst);
596 struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
597 struct crypto_ablkcipher *ctr;
598 struct crypto_ahash *ghash;
602 ghash = crypto_spawn_ahash(&ictx->ghash);
604 return PTR_ERR(ghash);
606 ctr = crypto_spawn_skcipher(&ictx->ctr);
614 align = crypto_tfm_alg_alignmask(tfm);
615 align &= ~(crypto_tfm_ctx_alignment() - 1);
616 tfm->crt_aead.reqsize = align +
617 offsetof(struct crypto_gcm_req_priv_ctx, u) +
618 max(sizeof(struct ablkcipher_request) +
619 crypto_ablkcipher_reqsize(ctr),
620 sizeof(struct ahash_request) +
621 crypto_ahash_reqsize(ghash));
626 crypto_free_ahash(ghash);
630 static void crypto_gcm_exit_tfm(struct crypto_tfm *tfm)
632 struct crypto_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
634 crypto_free_ahash(ctx->ghash);
635 crypto_free_ablkcipher(ctx->ctr);
638 static struct crypto_instance *crypto_gcm_alloc_common(struct rtattr **tb,
639 const char *full_name,
640 const char *ctr_name,
641 const char *ghash_name)
643 struct crypto_attr_type *algt;
644 struct crypto_instance *inst;
645 struct crypto_alg *ctr;
646 struct crypto_alg *ghash_alg;
647 struct ahash_alg *ghash_ahash_alg;
648 struct gcm_instance_ctx *ctx;
651 algt = crypto_get_attr_type(tb);
656 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
657 return ERR_PTR(-EINVAL);
659 ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type,
660 CRYPTO_ALG_TYPE_HASH,
661 CRYPTO_ALG_TYPE_AHASH_MASK);
662 err = PTR_ERR(ghash_alg);
663 if (IS_ERR(ghash_alg))
667 inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
671 ctx = crypto_instance_ctx(inst);
672 ghash_ahash_alg = container_of(ghash_alg, struct ahash_alg, halg.base);
673 err = crypto_init_ahash_spawn(&ctx->ghash, &ghash_ahash_alg->halg,
678 crypto_set_skcipher_spawn(&ctx->ctr, inst);
679 err = crypto_grab_skcipher(&ctx->ctr, ctr_name, 0,
680 crypto_requires_sync(algt->type,
685 ctr = crypto_skcipher_spawn_alg(&ctx->ctr);
687 /* We only support 16-byte blocks. */
688 if (ctr->cra_ablkcipher.ivsize != 16)
691 /* Not a stream cipher? */
693 if (ctr->cra_blocksize != 1)
697 if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
698 "gcm_base(%s,%s)", ctr->cra_driver_name,
699 ghash_alg->cra_driver_name) >=
703 memcpy(inst->alg.cra_name, full_name, CRYPTO_MAX_ALG_NAME);
705 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD;
706 inst->alg.cra_flags |= ctr->cra_flags & CRYPTO_ALG_ASYNC;
707 inst->alg.cra_priority = ctr->cra_priority;
708 inst->alg.cra_blocksize = 1;
709 inst->alg.cra_alignmask = ctr->cra_alignmask | (__alignof__(u64) - 1);
710 inst->alg.cra_type = &crypto_aead_type;
711 inst->alg.cra_aead.ivsize = 16;
712 inst->alg.cra_aead.maxauthsize = 16;
713 inst->alg.cra_ctxsize = sizeof(struct crypto_gcm_ctx);
714 inst->alg.cra_init = crypto_gcm_init_tfm;
715 inst->alg.cra_exit = crypto_gcm_exit_tfm;
716 inst->alg.cra_aead.setkey = crypto_gcm_setkey;
717 inst->alg.cra_aead.setauthsize = crypto_gcm_setauthsize;
718 inst->alg.cra_aead.encrypt = crypto_gcm_encrypt;
719 inst->alg.cra_aead.decrypt = crypto_gcm_decrypt;
722 crypto_mod_put(ghash_alg);
726 crypto_drop_skcipher(&ctx->ctr);
728 crypto_drop_ahash(&ctx->ghash);
736 static struct crypto_instance *crypto_gcm_alloc(struct rtattr **tb)
739 const char *cipher_name;
740 char ctr_name[CRYPTO_MAX_ALG_NAME];
741 char full_name[CRYPTO_MAX_ALG_NAME];
743 cipher_name = crypto_attr_alg_name(tb[1]);
744 err = PTR_ERR(cipher_name);
745 if (IS_ERR(cipher_name))
748 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", cipher_name) >=
750 return ERR_PTR(-ENAMETOOLONG);
752 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm(%s)", cipher_name) >=
754 return ERR_PTR(-ENAMETOOLONG);
756 return crypto_gcm_alloc_common(tb, full_name, ctr_name, "ghash");
759 static void crypto_gcm_free(struct crypto_instance *inst)
761 struct gcm_instance_ctx *ctx = crypto_instance_ctx(inst);
763 crypto_drop_skcipher(&ctx->ctr);
764 crypto_drop_ahash(&ctx->ghash);
768 static struct crypto_template crypto_gcm_tmpl = {
770 .alloc = crypto_gcm_alloc,
771 .free = crypto_gcm_free,
772 .module = THIS_MODULE,
775 static struct crypto_instance *crypto_gcm_base_alloc(struct rtattr **tb)
778 const char *ctr_name;
779 const char *ghash_name;
780 char full_name[CRYPTO_MAX_ALG_NAME];
782 ctr_name = crypto_attr_alg_name(tb[1]);
783 err = PTR_ERR(ctr_name);
784 if (IS_ERR(ctr_name))
787 ghash_name = crypto_attr_alg_name(tb[2]);
788 err = PTR_ERR(ghash_name);
789 if (IS_ERR(ghash_name))
792 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)",
793 ctr_name, ghash_name) >= CRYPTO_MAX_ALG_NAME)
794 return ERR_PTR(-ENAMETOOLONG);
796 return crypto_gcm_alloc_common(tb, full_name, ctr_name, ghash_name);
799 static struct crypto_template crypto_gcm_base_tmpl = {
801 .alloc = crypto_gcm_base_alloc,
802 .free = crypto_gcm_free,
803 .module = THIS_MODULE,
806 static int crypto_rfc4106_setkey(struct crypto_aead *parent, const u8 *key,
809 struct crypto_rfc4106_ctx *ctx = crypto_aead_ctx(parent);
810 struct crypto_aead *child = ctx->child;
817 memcpy(ctx->nonce, key + keylen, 4);
819 crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK);
820 crypto_aead_set_flags(child, crypto_aead_get_flags(parent) &
821 CRYPTO_TFM_REQ_MASK);
822 err = crypto_aead_setkey(child, key, keylen);
823 crypto_aead_set_flags(parent, crypto_aead_get_flags(child) &
824 CRYPTO_TFM_RES_MASK);
829 static int crypto_rfc4106_setauthsize(struct crypto_aead *parent,
830 unsigned int authsize)
832 struct crypto_rfc4106_ctx *ctx = crypto_aead_ctx(parent);
843 return crypto_aead_setauthsize(ctx->child, authsize);
846 static struct aead_request *crypto_rfc4106_crypt(struct aead_request *req)
848 struct aead_request *subreq = aead_request_ctx(req);
849 struct crypto_aead *aead = crypto_aead_reqtfm(req);
850 struct crypto_rfc4106_ctx *ctx = crypto_aead_ctx(aead);
851 struct crypto_aead *child = ctx->child;
852 u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child),
853 crypto_aead_alignmask(child) + 1);
855 memcpy(iv, ctx->nonce, 4);
856 memcpy(iv + 4, req->iv, 8);
858 aead_request_set_tfm(subreq, child);
859 aead_request_set_callback(subreq, req->base.flags, req->base.complete,
861 aead_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, iv);
862 aead_request_set_assoc(subreq, req->assoc, req->assoclen);
867 static int crypto_rfc4106_encrypt(struct aead_request *req)
869 req = crypto_rfc4106_crypt(req);
871 return crypto_aead_encrypt(req);
874 static int crypto_rfc4106_decrypt(struct aead_request *req)
876 req = crypto_rfc4106_crypt(req);
878 return crypto_aead_decrypt(req);
881 static int crypto_rfc4106_init_tfm(struct crypto_tfm *tfm)
883 struct crypto_instance *inst = (void *)tfm->__crt_alg;
884 struct crypto_aead_spawn *spawn = crypto_instance_ctx(inst);
885 struct crypto_rfc4106_ctx *ctx = crypto_tfm_ctx(tfm);
886 struct crypto_aead *aead;
889 aead = crypto_spawn_aead(spawn);
891 return PTR_ERR(aead);
895 align = crypto_aead_alignmask(aead);
896 align &= ~(crypto_tfm_ctx_alignment() - 1);
897 tfm->crt_aead.reqsize = sizeof(struct aead_request) +
898 ALIGN(crypto_aead_reqsize(aead),
899 crypto_tfm_ctx_alignment()) +
905 static void crypto_rfc4106_exit_tfm(struct crypto_tfm *tfm)
907 struct crypto_rfc4106_ctx *ctx = crypto_tfm_ctx(tfm);
909 crypto_free_aead(ctx->child);
912 static struct crypto_instance *crypto_rfc4106_alloc(struct rtattr **tb)
914 struct crypto_attr_type *algt;
915 struct crypto_instance *inst;
916 struct crypto_aead_spawn *spawn;
917 struct crypto_alg *alg;
918 const char *ccm_name;
921 algt = crypto_get_attr_type(tb);
926 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
927 return ERR_PTR(-EINVAL);
929 ccm_name = crypto_attr_alg_name(tb[1]);
930 err = PTR_ERR(ccm_name);
931 if (IS_ERR(ccm_name))
934 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
936 return ERR_PTR(-ENOMEM);
938 spawn = crypto_instance_ctx(inst);
939 crypto_set_aead_spawn(spawn, inst);
940 err = crypto_grab_aead(spawn, ccm_name, 0,
941 crypto_requires_sync(algt->type, algt->mask));
945 alg = crypto_aead_spawn_alg(spawn);
949 /* We only support 16-byte blocks. */
950 if (alg->cra_aead.ivsize != 16)
953 /* Not a stream cipher? */
954 if (alg->cra_blocksize != 1)
958 if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
959 "rfc4106(%s)", alg->cra_name) >= CRYPTO_MAX_ALG_NAME ||
960 snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
961 "rfc4106(%s)", alg->cra_driver_name) >=
965 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD;
966 inst->alg.cra_flags |= alg->cra_flags & CRYPTO_ALG_ASYNC;
967 inst->alg.cra_priority = alg->cra_priority;
968 inst->alg.cra_blocksize = 1;
969 inst->alg.cra_alignmask = alg->cra_alignmask;
970 inst->alg.cra_type = &crypto_nivaead_type;
972 inst->alg.cra_aead.ivsize = 8;
973 inst->alg.cra_aead.maxauthsize = 16;
975 inst->alg.cra_ctxsize = sizeof(struct crypto_rfc4106_ctx);
977 inst->alg.cra_init = crypto_rfc4106_init_tfm;
978 inst->alg.cra_exit = crypto_rfc4106_exit_tfm;
980 inst->alg.cra_aead.setkey = crypto_rfc4106_setkey;
981 inst->alg.cra_aead.setauthsize = crypto_rfc4106_setauthsize;
982 inst->alg.cra_aead.encrypt = crypto_rfc4106_encrypt;
983 inst->alg.cra_aead.decrypt = crypto_rfc4106_decrypt;
985 inst->alg.cra_aead.geniv = "seqiv";
991 crypto_drop_aead(spawn);
998 static void crypto_rfc4106_free(struct crypto_instance *inst)
1000 crypto_drop_spawn(crypto_instance_ctx(inst));
1004 static struct crypto_template crypto_rfc4106_tmpl = {
1006 .alloc = crypto_rfc4106_alloc,
1007 .free = crypto_rfc4106_free,
1008 .module = THIS_MODULE,
1011 static int __init crypto_gcm_module_init(void)
1015 gcm_zeroes = kzalloc(16, GFP_KERNEL);
1019 err = crypto_register_template(&crypto_gcm_base_tmpl);
1023 err = crypto_register_template(&crypto_gcm_tmpl);
1027 err = crypto_register_template(&crypto_rfc4106_tmpl);
1034 crypto_unregister_template(&crypto_gcm_tmpl);
1036 crypto_unregister_template(&crypto_gcm_base_tmpl);
1042 static void __exit crypto_gcm_module_exit(void)
1045 crypto_unregister_template(&crypto_rfc4106_tmpl);
1046 crypto_unregister_template(&crypto_gcm_tmpl);
1047 crypto_unregister_template(&crypto_gcm_base_tmpl);
1050 module_init(crypto_gcm_module_init);
1051 module_exit(crypto_gcm_module_exit);
1053 MODULE_LICENSE("GPL");
1054 MODULE_DESCRIPTION("Galois/Counter Mode");
1055 MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");
1056 MODULE_ALIAS("gcm_base");
1057 MODULE_ALIAS("rfc4106");