| 1 |
|
| 2 | #ifndef _CRYPTO_XTS_H
|
| 3 | #define _CRYPTO_XTS_H
|
| 4 |
|
| 5 | #include <crypto/b128ops.h>
|
| 6 | #include <crypto/internal/skcipher.h>
|
| 7 | #include <linux/fips.h>
|
| 8 |
|
| 9 | #define XTS_BLOCK_SIZE 16
|
| 10 | #define XTS_FORBID_WEAK_KEYS (1 << 0)
|
| 11 |
|
| 12 | static inline int __xts_verify_key(const u8 *key, size_t keylen, int flags)
|
| 13 | {
|
| 14 | |
| 15 | * key consists of keys of equal size concatenated, therefore
|
| 16 | * the length must be even.
|
| 17 |
|
| 18 | if (keylen % 2)
|
| 19 | return -EINVAL;
|
| 20 |
|
| 21 | |
| 22 | * In FIPS mode only a combined key length of either 256 or
|
| 23 | * 512 bits is allowed, c.f. FIPS 140-3 IG C.I.
|
| 24 |
|
| 25 | if (fips_enabled && keylen != 32 && keylen != 64)
|
| 26 | return -EINVAL;
|
| 27 |
|
| 28 | |
| 29 | * Ensure that the AES and tweak key are not identical when
|
| 30 | * in FIPS mode or the FORBID_WEAK_KEYS flag is set.
|
| 31 |
|
| 32 | if ((fips_enabled || (flags & XTS_FORBID_WEAK_KEYS)) &&
|
| 33 | !crypto_memneq(key, key + (keylen / 2), keylen / 2))
|
| 34 | return -EINVAL;
|
| 35 |
|
| 36 | return 0;
|
| 37 | }
|
| 38 |
|
| 39 | static inline int xts_verify_key(struct crypto_skcipher *tfm, const u8 *key,
|
| 40 | unsigned int keylen)
|
| 41 | {
|
| 42 | int flags = (crypto_skcipher_get_flags(tfm) &
|
| 43 | CRYPTO_TFM_REQ_FORBID_WEAK_KEYS) ?
|
| 44 | XTS_FORBID_WEAK_KEYS :
|
| 45 | 0;
|
| 46 |
|
| 47 | return __xts_verify_key(key, keylen, flags);
|
| 48 | }
|
| 49 |
|
| 50 | #endif
|