1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate * 26*0Sstevel@tonic-gate * cryptmod.h 27*0Sstevel@tonic-gate * STREAMS based crypto module definitions. 28*0Sstevel@tonic-gate * 29*0Sstevel@tonic-gate * This is a Sun-private and undocumented interface. 30*0Sstevel@tonic-gate */ 31*0Sstevel@tonic-gate 32*0Sstevel@tonic-gate #ifndef _SYS_CRYPTMOD_H 33*0Sstevel@tonic-gate #define _SYS_CRYPTMOD_H 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate #include <sys/types.h> 38*0Sstevel@tonic-gate #include <sys/types32.h> 39*0Sstevel@tonic-gate #ifdef _KERNEL 40*0Sstevel@tonic-gate #include <sys/crypto/api.h> 41*0Sstevel@tonic-gate #endif /* _KERNEL */ 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gate #ifdef __cplusplus 44*0Sstevel@tonic-gate extern "C" { 45*0Sstevel@tonic-gate #endif 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gate /* 49*0Sstevel@tonic-gate * IOCTLs. 50*0Sstevel@tonic-gate */ 51*0Sstevel@tonic-gate #define CRYPTIOC (('C' << 24) | ('R' << 16) | ('Y' << 8) | 0x00) 52*0Sstevel@tonic-gate 53*0Sstevel@tonic-gate #define CRYPTIOCSETUP (CRYPTIOC | 0x01) 54*0Sstevel@tonic-gate #define CRYPTIOCSTOP (CRYPTIOC | 0x02) 55*0Sstevel@tonic-gate #define CRYPTIOCSTARTENC (CRYPTIOC | 0x03) 56*0Sstevel@tonic-gate #define CRYPTIOCSTARTDEC (CRYPTIOC | 0x04) 57*0Sstevel@tonic-gate 58*0Sstevel@tonic-gate #define CRYPTPASSTHRU (CRYPTIOC | 0x80) 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate /* 61*0Sstevel@tonic-gate * Crypto method definitions, to be used with the CRIOCSETUP ioctl. 62*0Sstevel@tonic-gate */ 63*0Sstevel@tonic-gate #define CRYPT_METHOD_NONE 0 64*0Sstevel@tonic-gate #define CRYPT_METHOD_DES_CFB 101 65*0Sstevel@tonic-gate #define CRYPT_METHOD_DES_CBC_NULL 102 66*0Sstevel@tonic-gate #define CRYPT_METHOD_DES_CBC_MD5 103 67*0Sstevel@tonic-gate #define CRYPT_METHOD_DES_CBC_CRC 104 68*0Sstevel@tonic-gate #define CRYPT_METHOD_DES3_CBC_SHA1 105 69*0Sstevel@tonic-gate #define CRYPT_METHOD_ARCFOUR_HMAC_MD5 106 70*0Sstevel@tonic-gate #define CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP 107 71*0Sstevel@tonic-gate #define CRYPT_METHOD_AES128 108 72*0Sstevel@tonic-gate #define CRYPT_METHOD_AES256 109 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate #define CR_METHOD_OK(m) ((m) == CRYPT_METHOD_NONE || \ 75*0Sstevel@tonic-gate ((m) >= CRYPT_METHOD_DES_CFB && \ 76*0Sstevel@tonic-gate (m) <= CRYPT_METHOD_AES256)) 77*0Sstevel@tonic-gate 78*0Sstevel@tonic-gate #define IS_RC4_METHOD(m) ((m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5 || \ 79*0Sstevel@tonic-gate (m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate #define IS_AES_METHOD(m) ((m) == CRYPT_METHOD_AES128 || \ 82*0Sstevel@tonic-gate (m) == CRYPT_METHOD_AES256) 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate /* 85*0Sstevel@tonic-gate * Direction mask values, also to be used with the CRIOCSETUP ioctl. 86*0Sstevel@tonic-gate */ 87*0Sstevel@tonic-gate #define CRYPT_ENCRYPT 0x01 88*0Sstevel@tonic-gate #define CRYPT_DECRYPT 0x02 89*0Sstevel@tonic-gate 90*0Sstevel@tonic-gate #define CR_DIRECTION_OK(d) ((d) & (CRYPT_ENCRYPT | CRYPT_DECRYPT)) 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate /* 93*0Sstevel@tonic-gate * Define constants for the 'ivec_usage' fields. 94*0Sstevel@tonic-gate */ 95*0Sstevel@tonic-gate #define IVEC_NEVER 0x00 96*0Sstevel@tonic-gate #define IVEC_REUSE 0x01 97*0Sstevel@tonic-gate #define IVEC_ONETIME 0x02 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate #define CR_IVUSAGE_OK(iv) \ 100*0Sstevel@tonic-gate ((iv) == IVEC_NEVER || (iv) == IVEC_REUSE || (iv) == IVEC_ONETIME) 101*0Sstevel@tonic-gate 102*0Sstevel@tonic-gate #define CRYPT_SHA1_BLOCKSIZE 64 103*0Sstevel@tonic-gate #define CRYPT_SHA1_HASHSIZE 20 104*0Sstevel@tonic-gate #define CRYPT_DES3_KEYBYTES 21 105*0Sstevel@tonic-gate #define CRYPT_DES3_KEYLENGTH 24 106*0Sstevel@tonic-gate #define CRYPT_ARCFOUR_KEYBYTES 16 107*0Sstevel@tonic-gate #define CRYPT_ARCFOUR_KEYLENGTH 16 108*0Sstevel@tonic-gate #define CRYPT_AES128_KEYBYTES 16 109*0Sstevel@tonic-gate #define CRYPT_AES128_KEYLENGTH 16 110*0Sstevel@tonic-gate #define CRYPT_AES256_KEYBYTES 32 111*0Sstevel@tonic-gate #define CRYPT_AES256_KEYLENGTH 32 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate #define AES_TRUNCATED_HMAC_LEN 12 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate /* 116*0Sstevel@tonic-gate * Max size of initialization vector and key. 117*0Sstevel@tonic-gate * 256 bytes = 2048 bits. 118*0Sstevel@tonic-gate */ 119*0Sstevel@tonic-gate #define CRYPT_MAX_KEYLEN 256 120*0Sstevel@tonic-gate #define CRYPT_MAX_IVLEN 256 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate typedef uint8_t crkeylen_t; 123*0Sstevel@tonic-gate typedef uint8_t crivlen_t; 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate typedef uchar_t crmeth_t; 126*0Sstevel@tonic-gate typedef uchar_t cropt_t; 127*0Sstevel@tonic-gate typedef uchar_t crdir_t; 128*0Sstevel@tonic-gate typedef uchar_t crivuse_t; 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gate /* 131*0Sstevel@tonic-gate * Define values for the option mask field. 132*0Sstevel@tonic-gate * These can be extended to alter the behavior 133*0Sstevel@tonic-gate * of the module. For example, when used by kerberized 134*0Sstevel@tonic-gate * Unix r commands (rlogind, rshd), all msgs must be 135*0Sstevel@tonic-gate * prepended with 4 bytes of clear text data that represent 136*0Sstevel@tonic-gate * the 'length' of the cipher text that follows. 137*0Sstevel@tonic-gate */ 138*0Sstevel@tonic-gate #define CRYPTOPT_NONE 0x00 139*0Sstevel@tonic-gate #define CRYPTOPT_RCMD_MODE_V1 0x01 140*0Sstevel@tonic-gate #define CRYPTOPT_RCMD_MODE_V2 0x02 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate #define ANY_RCMD_MODE(m) ((m) & (CRYPTOPT_RCMD_MODE_V1 |\ 143*0Sstevel@tonic-gate CRYPTOPT_RCMD_MODE_V2)) 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate /* Define the size of the length field used in 'rcmd' mode */ 146*0Sstevel@tonic-gate #define RCMD_LEN_SZ sizeof (uint32_t) 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate #define CR_OPTIONS_OK(opt) ((opt) == CRYPTOPT_NONE || \ 149*0Sstevel@tonic-gate ANY_RCMD_MODE(opt)) 150*0Sstevel@tonic-gate /* 151*0Sstevel@tonic-gate * Structure used by userland apps to pass data into crypto module 152*0Sstevel@tonic-gate * with the CRIOCSETUP iotcl. 153*0Sstevel@tonic-gate */ 154*0Sstevel@tonic-gate struct cr_info_t { 155*0Sstevel@tonic-gate uchar_t key[CRYPT_MAX_KEYLEN]; 156*0Sstevel@tonic-gate uchar_t ivec[CRYPT_MAX_IVLEN]; 157*0Sstevel@tonic-gate crkeylen_t keylen; 158*0Sstevel@tonic-gate crivlen_t iveclen; 159*0Sstevel@tonic-gate crivuse_t ivec_usage; 160*0Sstevel@tonic-gate crdir_t direction_mask; 161*0Sstevel@tonic-gate crmeth_t crypto_method; 162*0Sstevel@tonic-gate cropt_t option_mask; 163*0Sstevel@tonic-gate }; 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate #if defined(_KERNEL) 166*0Sstevel@tonic-gate 167*0Sstevel@tonic-gate #define RCMDV1_USAGE 1026 168*0Sstevel@tonic-gate #define ARCFOUR_DECRYPT_USAGE 1032 169*0Sstevel@tonic-gate #define ARCFOUR_ENCRYPT_USAGE 1028 170*0Sstevel@tonic-gate #define AES_ENCRYPT_USAGE 1028 171*0Sstevel@tonic-gate #define AES_DECRYPT_USAGE 1032 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate #define DEFAULT_DES_BLOCKLEN 8 174*0Sstevel@tonic-gate #define DEFAULT_AES_BLOCKLEN 16 175*0Sstevel@tonic-gate #define ARCFOUR_EXP_SALT "fortybits" 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate struct cipher_data_t { 178*0Sstevel@tonic-gate char *key; 179*0Sstevel@tonic-gate char *block; 180*0Sstevel@tonic-gate char *ivec; 181*0Sstevel@tonic-gate char *saveblock; 182*0Sstevel@tonic-gate crypto_mech_type_t mech_type; 183*0Sstevel@tonic-gate crypto_key_t *ckey; /* initial encryption key */ 184*0Sstevel@tonic-gate crypto_key_t d_encr_key; /* derived encr key */ 185*0Sstevel@tonic-gate crypto_key_t d_hmac_key; /* derived hmac key */ 186*0Sstevel@tonic-gate crypto_ctx_template_t enc_tmpl; 187*0Sstevel@tonic-gate crypto_ctx_template_t hmac_tmpl; 188*0Sstevel@tonic-gate crypto_context_t ctx; 189*0Sstevel@tonic-gate size_t bytes; 190*0Sstevel@tonic-gate crkeylen_t blocklen; 191*0Sstevel@tonic-gate crkeylen_t keylen; 192*0Sstevel@tonic-gate crkeylen_t ivlen; 193*0Sstevel@tonic-gate crivuse_t ivec_usage; 194*0Sstevel@tonic-gate crmeth_t method; 195*0Sstevel@tonic-gate cropt_t option_mask; 196*0Sstevel@tonic-gate }; 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate struct rcmd_state_t { 199*0Sstevel@tonic-gate size_t pt_len; /* Plain text length */ 200*0Sstevel@tonic-gate size_t cd_len; /* Cipher Data length */ 201*0Sstevel@tonic-gate size_t cd_rcvd; /* Cipher Data bytes received so far */ 202*0Sstevel@tonic-gate uint32_t next_len; 203*0Sstevel@tonic-gate mblk_t *c_msg; /* mblk that will contain the new data */ 204*0Sstevel@tonic-gate }; 205*0Sstevel@tonic-gate 206*0Sstevel@tonic-gate /* Values for "ready" mask. */ 207*0Sstevel@tonic-gate #define CRYPT_WRITE_READY 0x01 208*0Sstevel@tonic-gate #define CRYPT_READ_READY 0x02 209*0Sstevel@tonic-gate 210*0Sstevel@tonic-gate /* 211*0Sstevel@tonic-gate * State information for the streams module. 212*0Sstevel@tonic-gate */ 213*0Sstevel@tonic-gate struct tmodinfo { 214*0Sstevel@tonic-gate struct cipher_data_t enc_data; 215*0Sstevel@tonic-gate struct cipher_data_t dec_data; 216*0Sstevel@tonic-gate struct rcmd_state_t rcmd_state; 217*0Sstevel@tonic-gate uchar_t ready; 218*0Sstevel@tonic-gate }; 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate #endif /* _KERNEL */ 221*0Sstevel@tonic-gate 222*0Sstevel@tonic-gate #ifdef __cplusplus 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate #endif 225*0Sstevel@tonic-gate 226*0Sstevel@tonic-gate #endif /* _SYS_CRYPTMOD_H */ 227