projects/linux·blob master · refs

419 lines · 17.0 KiB

1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * Common values for AES algorithms
4 */
5
6#ifndef _CRYPTO_AES_H
7#define _CRYPTO_AES_H
8
9#include <linux/types.h>
10#include <linux/crypto.h>
11
12#define AES_MIN_KEY_SIZE 16
13#define AES_MAX_KEY_SIZE 32
14#define AES_KEYSIZE_128 16
15#define AES_KEYSIZE_192 24
16#define AES_KEYSIZE_256 32
17#define AES_BLOCK_SIZE 16
18#define AES_MAX_KEYLENGTH (15 * 16)
19#define AES_MAX_KEYLENGTH_U32 (AES_MAX_KEYLENGTH / sizeof(u32))
20
21/*
22 * The POWER8 VSX optimized AES assembly code is borrowed from OpenSSL and
23 * inherits OpenSSL's AES_KEY format, which stores the number of rounds after
24 * the round keys. That assembly code is difficult to change. So for
25 * compatibility purposes we reserve space for the extra nrounds field on PPC64.
26 *
27 * Note: when prepared for decryption, the round keys are just the reversed
28 * standard round keys, not the round keys for the Equivalent Inverse Cipher.
29 */
30struct p8_aes_key {
31 u32 rndkeys[AES_MAX_KEYLENGTH_U32];
32 int nrounds;
33};
34
35union aes_enckey_arch {
36 u32 rndkeys[AES_MAX_KEYLENGTH_U32];
37#ifdef CONFIG_CRYPTO_LIB_AES_ARCH
38#if defined(CONFIG_PPC) && defined(CONFIG_SPE)
39 /* Used unconditionally (when SPE AES code is enabled in kconfig) */
40 u32 spe_enc_key[AES_MAX_KEYLENGTH_U32] __aligned(8);
41#elif defined(CONFIG_PPC)
42 /*
43 * Kernels that include the POWER8 VSX optimized AES code use this field
44 * when that code is usable at key preparation time. Otherwise they
45 * fall back to rndkeys. In the latter case, p8.nrounds (which doesn't
46 * overlap rndkeys) is set to 0 to differentiate the two formats.
47 */
48 struct p8_aes_key p8;
49#elif defined(CONFIG_S390)
50 /* Used when the CPU supports CPACF AES for this key's length */
51 u8 raw_key[AES_MAX_KEY_SIZE];
52#elif defined(CONFIG_SPARC64)
53 /* Used when the CPU supports the SPARC64 AES opcodes */
54 u64 sparc_rndkeys[AES_MAX_KEYLENGTH / sizeof(u64)];
55#endif
56#endif /* CONFIG_CRYPTO_LIB_AES_ARCH */
57};
58
59union aes_invkey_arch {
60 u32 inv_rndkeys[AES_MAX_KEYLENGTH_U32];
61#ifdef CONFIG_CRYPTO_LIB_AES_ARCH
62#if defined(CONFIG_PPC) && defined(CONFIG_SPE)
63 /* Used unconditionally (when SPE AES code is enabled in kconfig) */
64 u32 spe_dec_key[AES_MAX_KEYLENGTH_U32] __aligned(8);
65#elif defined(CONFIG_PPC)
66 /* Used conditionally, analogous to aes_enckey_arch::p8 */
67 struct p8_aes_key p8;
68#endif
69#endif /* CONFIG_CRYPTO_LIB_AES_ARCH */
70};
71
72/**
73 * struct aes_enckey - An AES key prepared for encryption
74 * @len: Key length in bytes: 16 for AES-128, 24 for AES-192, 32 for AES-256.
75 * @nrounds: Number of rounds: 10 for AES-128, 12 for AES-192, 14 for AES-256.
76 * This is '6 + @len / 4' and is cached so that AES implementations
77 * that need it don't have to recompute it for each en/decryption.
78 * @padding: Padding to make offsetof(@k) be a multiple of 16, so that aligning
79 * this struct to a 16-byte boundary results in @k also being 16-byte
80 * aligned. Users aren't required to align this struct to 16 bytes,
81 * but it may slightly improve performance.
82 * @k: This typically contains the AES round keys as an array of '@nrounds + 1'
83 * groups of four u32 words. However, architecture-specific implementations
84 * of AES may store something else here, e.g. just the raw key if it's all
85 * they need.
86 *
87 * Note that this struct is about half the size of struct aes_key. This is
88 * separate from struct aes_key so that modes that need only AES encryption
89 * (e.g. AES-GCM, AES-CTR, AES-CMAC, tweak key in AES-XTS) don't incur the time
90 * and space overhead of computing and caching the decryption round keys.
91 *
92 * Note that there's no decryption-only equivalent (i.e. "struct aes_deckey"),
93 * since (a) it's rare that modes need decryption-only, and (b) some AES
94 * implementations use the same @k for both encryption and decryption, either
95 * always or conditionally; in the latter case both @k and @inv_k are needed.
96 */
97struct aes_enckey {
98 u32 len;
99 u32 nrounds;
100 u32 padding[2];
101 union aes_enckey_arch k;
102};
103
104/**
105 * aes_zeroize_enckey() - Zeroize an aes_enckey structure
106 * @key: The aes_enckey to zeroize
107 */
108static inline void aes_zeroize_enckey(struct aes_enckey *key)
109{
110 memzero_explicit(key, sizeof(*key));
111}
112
113/**
114 * struct aes_key - An AES key prepared for encryption and decryption
115 * @aes_enckey: Common fields and the key prepared for encryption
116 * @inv_k: This generally contains the round keys for the AES Equivalent
117 * Inverse Cipher, as an array of '@nrounds + 1' groups of four u32
118 * words. However, architecture-specific implementations of AES may
119 * store something else here. For example, they may leave this field
120 * uninitialized if they use @k for both encryption and decryption.
121 */
122struct aes_key {
123 struct aes_enckey; /* Include all fields of aes_enckey. */
124 union aes_invkey_arch inv_k;
125};
126
127/**
128 * aes_zeroize_key() - Zeroize an aes_key structure
129 * @key: The aes_key to zeroize
130 */
131static inline void aes_zeroize_key(struct aes_key *key)
132{
133 memzero_explicit(key, sizeof(*key));
134}
135
136/*
137 * Please ensure that the first two fields are 16-byte aligned
138 * relative to the start of the structure, i.e., don't move them!
139 */
140struct crypto_aes_ctx {
141 u32 key_enc[AES_MAX_KEYLENGTH_U32];
142 u32 key_dec[AES_MAX_KEYLENGTH_U32];
143 u32 key_length;
144};
145
146/*
147 * validate key length for AES algorithms
148 */
149static inline int aes_check_keylen(size_t keylen)
150{
151 switch (keylen) {
152 case AES_KEYSIZE_128:
153 case AES_KEYSIZE_192:
154 case AES_KEYSIZE_256:
155 break;
156 default:
157 return -EINVAL;
158 }
159
160 return 0;
161}
162
163/**
164 * aes_expandkey - Expands the AES key as described in FIPS-197
165 * @ctx: The location where the computed key will be stored.
166 * @in_key: The supplied key.
167 * @key_len: The length of the supplied key.
168 *
169 * Returns 0 on success. The function fails only if an invalid key size (or
170 * pointer) is supplied.
171 * The expanded key size is 240 bytes (max of 14 rounds with a unique 16 bytes
172 * key schedule plus a 16 bytes key which is used before the first round).
173 * The decryption key is prepared for the "Equivalent Inverse Cipher" as
174 * described in FIPS-197. The first slot (16 bytes) of each key (enc or dec) is
175 * for the initial combination, the second slot for the first round and so on.
176 */
177int aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key,
178 unsigned int key_len);
179
180/*
181 * The following functions are temporarily exported for use by the AES mode
182 * implementations in arch/$(SRCARCH)/crypto/. These exports will go away when
183 * that code is migrated into lib/crypto/.
184 */
185#ifdef CONFIG_ARM64
186int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key,
187 unsigned int key_len);
188asmlinkage void neon_aes_ecb_encrypt(u8 out[], u8 const in[], u32 const rk[],
189 int rounds, int blocks);
190asmlinkage void neon_aes_ecb_decrypt(u8 out[], u8 const in[], u32 const rk[],
191 int rounds, int blocks);
192asmlinkage void neon_aes_cbc_encrypt(u8 out[], u8 const in[], u32 const rk[],
193 int rounds, int blocks, u8 iv[]);
194asmlinkage void neon_aes_cbc_decrypt(u8 out[], u8 const in[], u32 const rk[],
195 int rounds, int blocks, u8 iv[]);
196asmlinkage void neon_aes_cbc_cts_encrypt(u8 out[], u8 const in[],
197 u32 const rk[], int rounds, int bytes,
198 u8 const iv[]);
199asmlinkage void neon_aes_cbc_cts_decrypt(u8 out[], u8 const in[],
200 u32 const rk[], int rounds, int bytes,
201 u8 const iv[]);
202asmlinkage void neon_aes_ctr_encrypt(u8 out[], u8 const in[], u32 const rk[],
203 int rounds, int bytes, u8 ctr[]);
204asmlinkage void neon_aes_xctr_encrypt(u8 out[], u8 const in[], u32 const rk[],
205 int rounds, int bytes, u8 ctr[],
206 int byte_ctr);
207asmlinkage void neon_aes_xts_encrypt(u8 out[], u8 const in[], u32 const rk1[],
208 int rounds, int bytes, u32 const rk2[],
209 u8 iv[], int first);
210asmlinkage void neon_aes_xts_decrypt(u8 out[], u8 const in[], u32 const rk1[],
211 int rounds, int bytes, u32 const rk2[],
212 u8 iv[], int first);
213asmlinkage void neon_aes_essiv_cbc_encrypt(u8 out[], u8 const in[],
214 u32 const rk1[], int rounds,
215 int blocks, u8 iv[],
216 u32 const rk2[]);
217asmlinkage void neon_aes_essiv_cbc_decrypt(u8 out[], u8 const in[],
218 u32 const rk1[], int rounds,
219 int blocks, u8 iv[],
220 u32 const rk2[]);
221
222asmlinkage void ce_aes_ecb_encrypt(u8 out[], u8 const in[], u32 const rk[],
223 int rounds, int blocks);
224asmlinkage void ce_aes_ecb_decrypt(u8 out[], u8 const in[], u32 const rk[],
225 int rounds, int blocks);
226asmlinkage void ce_aes_cbc_encrypt(u8 out[], u8 const in[], u32 const rk[],
227 int rounds, int blocks, u8 iv[]);
228asmlinkage void ce_aes_cbc_decrypt(u8 out[], u8 const in[], u32 const rk[],
229 int rounds, int blocks, u8 iv[]);
230asmlinkage void ce_aes_cbc_cts_encrypt(u8 out[], u8 const in[], u32 const rk[],
231 int rounds, int bytes, u8 const iv[]);
232asmlinkage void ce_aes_cbc_cts_decrypt(u8 out[], u8 const in[], u32 const rk[],
233 int rounds, int bytes, u8 const iv[]);
234asmlinkage void ce_aes_ctr_encrypt(u8 out[], u8 const in[], u32 const rk[],
235 int rounds, int bytes, u8 ctr[]);
236asmlinkage void ce_aes_xctr_encrypt(u8 out[], u8 const in[], u32 const rk[],
237 int rounds, int bytes, u8 ctr[],
238 int byte_ctr);
239asmlinkage void ce_aes_xts_encrypt(u8 out[], u8 const in[], u32 const rk1[],
240 int rounds, int bytes, u32 const rk2[],
241 u8 iv[], int first);
242asmlinkage void ce_aes_xts_decrypt(u8 out[], u8 const in[], u32 const rk1[],
243 int rounds, int bytes, u32 const rk2[],
244 u8 iv[], int first);
245asmlinkage void ce_aes_essiv_cbc_encrypt(u8 out[], u8 const in[],
246 u32 const rk1[], int rounds,
247 int blocks, u8 iv[], u32 const rk2[]);
248asmlinkage void ce_aes_essiv_cbc_decrypt(u8 out[], u8 const in[],
249 u32 const rk1[], int rounds,
250 int blocks, u8 iv[], u32 const rk2[]);
251asmlinkage void ce_aes_mac_update(u8 const in[], u32 const rk[], int rounds,
252 size_t blocks, u8 dg[], int enc_before,
253 int enc_after);
254#elif defined(CONFIG_PPC)
255void ppc_expand_key_128(u32 *key_enc, const u8 *key);
256void ppc_expand_key_192(u32 *key_enc, const u8 *key);
257void ppc_expand_key_256(u32 *key_enc, const u8 *key);
258void ppc_generate_decrypt_key(u32 *key_dec, u32 *key_enc, unsigned int key_len);
259void ppc_encrypt_ecb(u8 *out, const u8 *in, u32 *key_enc, u32 rounds,
260 u32 bytes);
261void ppc_decrypt_ecb(u8 *out, const u8 *in, u32 *key_dec, u32 rounds,
262 u32 bytes);
263void ppc_encrypt_cbc(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes,
264 u8 *iv);
265void ppc_decrypt_cbc(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes,
266 u8 *iv);
267void ppc_crypt_ctr(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes,
268 u8 *iv);
269void ppc_encrypt_xts(u8 *out, const u8 *in, u32 *key_enc, u32 rounds, u32 bytes,
270 u8 *iv, u32 *key_twk);
271void ppc_decrypt_xts(u8 *out, const u8 *in, u32 *key_dec, u32 rounds, u32 bytes,
272 u8 *iv, u32 *key_twk);
273int aes_p8_set_encrypt_key(const u8 *userKey, const int bits,
274 struct p8_aes_key *key);
275int aes_p8_set_decrypt_key(const u8 *userKey, const int bits,
276 struct p8_aes_key *key);
277void aes_p8_encrypt(const u8 *in, u8 *out, const struct p8_aes_key *key);
278void aes_p8_decrypt(const u8 *in, u8 *out, const struct p8_aes_key *key);
279void aes_p8_cbc_encrypt(const u8 *in, u8 *out, size_t len,
280 const struct p8_aes_key *key, u8 *iv, bool enc);
281void aes_p8_ctr32_encrypt_blocks(const u8 *in, u8 *out, size_t len,
282 const struct p8_aes_key *key, const u8 *iv);
283void aes_p8_xts_encrypt(const u8 *in, u8 *out, size_t len,
284 const struct p8_aes_key *key1,
285 const struct p8_aes_key *key2, u8 *iv);
286void aes_p8_xts_decrypt(const u8 *in, u8 *out, size_t len,
287 const struct p8_aes_key *key1,
288 const struct p8_aes_key *key2, u8 *iv);
289#elif defined(CONFIG_SPARC64)
290void aes_sparc64_key_expand(const u32 *in_key, u64 *output_key,
291 unsigned int key_len);
292void aes_sparc64_load_encrypt_keys_128(const u64 *key);
293void aes_sparc64_load_encrypt_keys_192(const u64 *key);
294void aes_sparc64_load_encrypt_keys_256(const u64 *key);
295void aes_sparc64_load_decrypt_keys_128(const u64 *key);
296void aes_sparc64_load_decrypt_keys_192(const u64 *key);
297void aes_sparc64_load_decrypt_keys_256(const u64 *key);
298void aes_sparc64_ecb_encrypt_128(const u64 *key, const u64 *input, u64 *output,
299 unsigned int len);
300void aes_sparc64_ecb_encrypt_192(const u64 *key, const u64 *input, u64 *output,
301 unsigned int len);
302void aes_sparc64_ecb_encrypt_256(const u64 *key, const u64 *input, u64 *output,
303 unsigned int len);
304void aes_sparc64_ecb_decrypt_128(const u64 *key, const u64 *input, u64 *output,
305 unsigned int len);
306void aes_sparc64_ecb_decrypt_192(const u64 *key, const u64 *input, u64 *output,
307 unsigned int len);
308void aes_sparc64_ecb_decrypt_256(const u64 *key, const u64 *input, u64 *output,
309 unsigned int len);
310void aes_sparc64_cbc_encrypt_128(const u64 *key, const u64 *input, u64 *output,
311 unsigned int len, u64 *iv);
312void aes_sparc64_cbc_encrypt_192(const u64 *key, const u64 *input, u64 *output,
313 unsigned int len, u64 *iv);
314void aes_sparc64_cbc_encrypt_256(const u64 *key, const u64 *input, u64 *output,
315 unsigned int len, u64 *iv);
316void aes_sparc64_cbc_decrypt_128(const u64 *key, const u64 *input, u64 *output,
317 unsigned int len, u64 *iv);
318void aes_sparc64_cbc_decrypt_192(const u64 *key, const u64 *input, u64 *output,
319 unsigned int len, u64 *iv);
320void aes_sparc64_cbc_decrypt_256(const u64 *key, const u64 *input, u64 *output,
321 unsigned int len, u64 *iv);
322void aes_sparc64_ctr_crypt_128(const u64 *key, const u64 *input, u64 *output,
323 unsigned int len, u64 *iv);
324void aes_sparc64_ctr_crypt_192(const u64 *key, const u64 *input, u64 *output,
325 unsigned int len, u64 *iv);
326void aes_sparc64_ctr_crypt_256(const u64 *key, const u64 *input, u64 *output,
327 unsigned int len, u64 *iv);
328#endif
329
330/**
331 * aes_preparekey() - Prepare an AES key for encryption and decryption
332 * @key: (output) The key structure to initialize
333 * @in_key: The raw AES key
334 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128,
335 * AES_KEYSIZE_192, or AES_KEYSIZE_256.
336 *
337 * This prepares an AES key for both the encryption and decryption directions of
338 * the block cipher. Typically this involves expanding the raw key into both
339 * the standard round keys and the Equivalent Inverse Cipher round keys, but
340 * some architecture-specific implementations don't do the full expansion here.
341 *
342 * The caller is responsible for zeroizing both the struct aes_key and the raw
343 * key once they are no longer needed.
344 *
345 * If you don't need decryption support, use aes_prepareenckey() instead.
346 *
347 * Return: 0 on success or -EINVAL if the given key length is invalid. No other
348 * errors are possible, so callers that always pass a valid key length
349 * don't need to check for errors.
350 *
351 * Context: Any context.
352 */
353int aes_preparekey(struct aes_key *key, const u8 *in_key, size_t key_len);
354
355/**
356 * aes_prepareenckey() - Prepare an AES key for encryption-only
357 * @key: (output) The key structure to initialize
358 * @in_key: The raw AES key
359 * @key_len: Length of the raw key in bytes. Should be either AES_KEYSIZE_128,
360 * AES_KEYSIZE_192, or AES_KEYSIZE_256.
361 *
362 * This prepares an AES key for only the encryption direction of the block
363 * cipher. Typically this involves expanding the raw key into only the standard
364 * round keys, resulting in a struct about half the size of struct aes_key.
365 *
366 * The caller is responsible for zeroizing both the struct aes_enckey and the
367 * raw key once they are no longer needed.
368 *
369 * Note that while the resulting prepared key supports only AES encryption, it
370 * can still be used for decrypting in a mode of operation that uses AES in only
371 * the encryption (forward) direction, for example counter mode.
372 *
373 * Return: 0 on success or -EINVAL if the given key length is invalid. No other
374 * errors are possible, so callers that always pass a valid key length
375 * don't need to check for errors.
376 *
377 * Context: Any context.
378 */
379int aes_prepareenckey(struct aes_enckey *key, const u8 *in_key, size_t key_len);
380
381typedef union {
382 const struct aes_enckey *enc_key;
383 const struct aes_key *full_key;
384} aes_encrypt_arg __attribute__ ((__transparent_union__));
385
386/**
387 * aes_encrypt() - Encrypt a single AES block
388 * @key: The AES key, as a pointer to either an encryption-only key
389 * (struct aes_enckey) or a full, bidirectional key (struct aes_key).
390 * @out: Buffer to store the ciphertext block
391 * @in: Buffer containing the plaintext block
392 *
393 * Context: Any context.
394 */
395void aes_encrypt(aes_encrypt_arg key, u8 out[at_least AES_BLOCK_SIZE],
396 const u8 in[at_least AES_BLOCK_SIZE]);
397
398/**
399 * aes_decrypt() - Decrypt a single AES block
400 * @key: The AES key, previously initialized by aes_preparekey()
401 * @out: Buffer to store the plaintext block
402 * @in: Buffer containing the ciphertext block
403 *
404 * Context: Any context.
405 */
406void aes_decrypt(const struct aes_key *key, u8 out[at_least AES_BLOCK_SIZE],
407 const u8 in[at_least AES_BLOCK_SIZE]);
408
409extern const u8 crypto_aes_sbox[];
410extern const u8 crypto_aes_inv_sbox[];
411extern const u32 aes_enc_tab[256];
412extern const u32 aes_dec_tab[256];
413
414void aescfb_encrypt(const struct aes_enckey *key, u8 *dst, const u8 *src,
415 int len, const u8 iv[AES_BLOCK_SIZE]);
416void aescfb_decrypt(const struct aes_enckey *key, u8 *dst, const u8 *src,
417 int len, const u8 iv[AES_BLOCK_SIZE]);
418
419#endif