projects/linux·blob master · refs

314 lines · 7.5 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Cryptographic API.
4 *
5 * ARIA Cipher Algorithm.
6 *
7 * Documentation of ARIA can be found in RFC 5794.
8 * Copyright (c) 2022 Taehee Yoo <[email protected]>
9 *
10 * Information for ARIA
11 * http://210.104.33.10/ARIA/index-e.html (English)
12 * http://seed.kisa.or.kr/ (Korean)
13 *
14 * Public domain version is distributed above.
15 */
16
17#include <crypto/aria.h>
18#include <linux/unaligned.h>
19
20static const u32 key_rc[20] = {
21 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
22 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0,
23 0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e,
24 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
25 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0
26};
27
28static void aria_set_encrypt_key(struct aria_ctx *ctx, const u8 *in_key,
29 unsigned int key_len)
30{
31 u32 w0[4], w1[4], w2[4], w3[4];
32 u32 reg0, reg1, reg2, reg3;
33 const u32 *ck;
34 int rkidx = 0;
35
36 ck = &key_rc[(key_len - 16) / 2];
37
38 w0[0] = get_unaligned_be32(&in_key[0]);
39 w0[1] = get_unaligned_be32(&in_key[4]);
40 w0[2] = get_unaligned_be32(&in_key[8]);
41 w0[3] = get_unaligned_be32(&in_key[12]);
42
43 reg0 = w0[0] ^ ck[0];
44 reg1 = w0[1] ^ ck[1];
45 reg2 = w0[2] ^ ck[2];
46 reg3 = w0[3] ^ ck[3];
47
48 aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
49
50 if (key_len > 16) {
51 w1[0] = get_unaligned_be32(&in_key[16]);
52 w1[1] = get_unaligned_be32(&in_key[20]);
53 if (key_len > 24) {
54 w1[2] = get_unaligned_be32(&in_key[24]);
55 w1[3] = get_unaligned_be32(&in_key[28]);
56 } else {
57 w1[2] = 0;
58 w1[3] = 0;
59 }
60 } else {
61 w1[0] = 0;
62 w1[1] = 0;
63 w1[2] = 0;
64 w1[3] = 0;
65 }
66
67 w1[0] ^= reg0;
68 w1[1] ^= reg1;
69 w1[2] ^= reg2;
70 w1[3] ^= reg3;
71
72 reg0 = w1[0];
73 reg1 = w1[1];
74 reg2 = w1[2];
75 reg3 = w1[3];
76
77 reg0 ^= ck[4];
78 reg1 ^= ck[5];
79 reg2 ^= ck[6];
80 reg3 ^= ck[7];
81
82 aria_subst_diff_even(&reg0, &reg1, &reg2, &reg3);
83
84 reg0 ^= w0[0];
85 reg1 ^= w0[1];
86 reg2 ^= w0[2];
87 reg3 ^= w0[3];
88
89 w2[0] = reg0;
90 w2[1] = reg1;
91 w2[2] = reg2;
92 w2[3] = reg3;
93
94 reg0 ^= ck[8];
95 reg1 ^= ck[9];
96 reg2 ^= ck[10];
97 reg3 ^= ck[11];
98
99 aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
100
101 w3[0] = reg0 ^ w1[0];
102 w3[1] = reg1 ^ w1[1];
103 w3[2] = reg2 ^ w1[2];
104 w3[3] = reg3 ^ w1[3];
105
106 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 19);
107 rkidx++;
108 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 19);
109 rkidx++;
110 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 19);
111 rkidx++;
112 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 19);
113
114 rkidx++;
115 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 31);
116 rkidx++;
117 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 31);
118 rkidx++;
119 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 31);
120 rkidx++;
121 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 31);
122
123 rkidx++;
124 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 67);
125 rkidx++;
126 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 67);
127 rkidx++;
128 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 67);
129 rkidx++;
130 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 67);
131
132 rkidx++;
133 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 97);
134 if (key_len > 16) {
135 rkidx++;
136 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 97);
137 rkidx++;
138 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 97);
139
140 if (key_len > 24) {
141 rkidx++;
142 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 97);
143
144 rkidx++;
145 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 109);
146 }
147 }
148}
149
150static void aria_set_decrypt_key(struct aria_ctx *ctx)
151{
152 int i;
153
154 for (i = 0; i < 4; i++) {
155 ctx->dec_key[0][i] = ctx->enc_key[ctx->rounds][i];
156 ctx->dec_key[ctx->rounds][i] = ctx->enc_key[0][i];
157 }
158
159 for (i = 1; i < ctx->rounds; i++) {
160 ctx->dec_key[i][0] = aria_m(ctx->enc_key[ctx->rounds - i][0]);
161 ctx->dec_key[i][1] = aria_m(ctx->enc_key[ctx->rounds - i][1]);
162 ctx->dec_key[i][2] = aria_m(ctx->enc_key[ctx->rounds - i][2]);
163 ctx->dec_key[i][3] = aria_m(ctx->enc_key[ctx->rounds - i][3]);
164
165 aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
166 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
167 aria_diff_byte(&ctx->dec_key[i][1],
168 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
169 aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
170 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
171 }
172}
173
174int aria_set_key(struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
175{
176 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
177
178 if (key_len != 16 && key_len != 24 && key_len != 32)
179 return -EINVAL;
180
181 BUILD_BUG_ON(sizeof(ctx->enc_key) != 272);
182 BUILD_BUG_ON(sizeof(ctx->dec_key) != 272);
183 BUILD_BUG_ON(sizeof(int) != sizeof(ctx->rounds));
184
185 ctx->key_length = key_len;
186 ctx->rounds = (key_len + 32) / 4;
187
188 aria_set_encrypt_key(ctx, in_key, key_len);
189 aria_set_decrypt_key(ctx);
190
191 return 0;
192}
193EXPORT_SYMBOL_GPL(aria_set_key);
194
195static void __aria_crypt(struct aria_ctx *ctx, u8 *out, const u8 *in,
196 u32 key[][ARIA_RD_KEY_WORDS])
197{
198 u32 reg0, reg1, reg2, reg3;
199 int rounds, rkidx = 0;
200
201 rounds = ctx->rounds;
202
203 reg0 = get_unaligned_be32(&in[0]);
204 reg1 = get_unaligned_be32(&in[4]);
205 reg2 = get_unaligned_be32(&in[8]);
206 reg3 = get_unaligned_be32(&in[12]);
207
208 aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
209 rkidx++;
210
211 aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
212 aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
213 rkidx++;
214
215 while ((rounds -= 2) > 0) {
216 aria_subst_diff_even(&reg0, &reg1, &reg2, &reg3);
217 aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
218 rkidx++;
219
220 aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
221 aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
222 rkidx++;
223 }
224
225 reg0 = key[rkidx][0] ^ make_u32((u8)(x1[get_u8(reg0, 0)]),
226 (u8)(x2[get_u8(reg0, 1)] >> 8),
227 (u8)(s1[get_u8(reg0, 2)]),
228 (u8)(s2[get_u8(reg0, 3)]));
229 reg1 = key[rkidx][1] ^ make_u32((u8)(x1[get_u8(reg1, 0)]),
230 (u8)(x2[get_u8(reg1, 1)] >> 8),
231 (u8)(s1[get_u8(reg1, 2)]),
232 (u8)(s2[get_u8(reg1, 3)]));
233 reg2 = key[rkidx][2] ^ make_u32((u8)(x1[get_u8(reg2, 0)]),
234 (u8)(x2[get_u8(reg2, 1)] >> 8),
235 (u8)(s1[get_u8(reg2, 2)]),
236 (u8)(s2[get_u8(reg2, 3)]));
237 reg3 = key[rkidx][3] ^ make_u32((u8)(x1[get_u8(reg3, 0)]),
238 (u8)(x2[get_u8(reg3, 1)] >> 8),
239 (u8)(s1[get_u8(reg3, 2)]),
240 (u8)(s2[get_u8(reg3, 3)]));
241
242 put_unaligned_be32(reg0, &out[0]);
243 put_unaligned_be32(reg1, &out[4]);
244 put_unaligned_be32(reg2, &out[8]);
245 put_unaligned_be32(reg3, &out[12]);
246}
247
248void aria_encrypt(void *_ctx, u8 *out, const u8 *in)
249{
250 struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
251
252 __aria_crypt(ctx, out, in, ctx->enc_key);
253}
254EXPORT_SYMBOL_GPL(aria_encrypt);
255
256void aria_decrypt(void *_ctx, u8 *out, const u8 *in)
257{
258 struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
259
260 __aria_crypt(ctx, out, in, ctx->dec_key);
261}
262EXPORT_SYMBOL_GPL(aria_decrypt);
263
264static void __aria_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
265{
266 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
267
268 __aria_crypt(ctx, out, in, ctx->enc_key);
269}
270
271static void __aria_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
272{
273 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
274
275 __aria_crypt(ctx, out, in, ctx->dec_key);
276}
277
278static struct crypto_alg aria_alg = {
279 .cra_name = "aria",
280 .cra_driver_name = "aria-generic",
281 .cra_priority = 100,
282 .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
283 .cra_blocksize = ARIA_BLOCK_SIZE,
284 .cra_ctxsize = sizeof(struct aria_ctx),
285 .cra_module = THIS_MODULE,
286 .cra_u = {
287 .cipher = {
288 .cia_min_keysize = ARIA_MIN_KEY_SIZE,
289 .cia_max_keysize = ARIA_MAX_KEY_SIZE,
290 .cia_setkey = aria_set_key,
291 .cia_encrypt = __aria_encrypt,
292 .cia_decrypt = __aria_decrypt
293 }
294 }
295};
296
297static int __init aria_init(void)
298{
299 return crypto_register_alg(&aria_alg);
300}
301
302static void __exit aria_fini(void)
303{
304 crypto_unregister_alg(&aria_alg);
305}
306
307module_init(aria_init);
308module_exit(aria_fini);
309
310MODULE_DESCRIPTION("ARIA Cipher Algorithm");
311MODULE_LICENSE("GPL");
312MODULE_AUTHOR("Taehee Yoo <[email protected]>");
313MODULE_ALIAS_CRYPTO("aria");
314MODULE_ALIAS_CRYPTO("aria-generic");