xref: /freebsd-src/sys/contrib/openzfs/module/icp/algs/modes/ccm.c (revision 15f0b8c309dea1dcb14d3e374686576ff68ac43f)
1eda14cbcSMatt Macy /*
2eda14cbcSMatt Macy  * CDDL HEADER START
3eda14cbcSMatt Macy  *
4eda14cbcSMatt Macy  * The contents of this file are subject to the terms of the
5eda14cbcSMatt Macy  * Common Development and Distribution License (the "License").
6eda14cbcSMatt Macy  * You may not use this file except in compliance with the License.
7eda14cbcSMatt Macy  *
8eda14cbcSMatt Macy  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9271171e0SMartin Matuska  * or https://opensource.org/licenses/CDDL-1.0.
10eda14cbcSMatt Macy  * See the License for the specific language governing permissions
11eda14cbcSMatt Macy  * and limitations under the License.
12eda14cbcSMatt Macy  *
13eda14cbcSMatt Macy  * When distributing Covered Code, include this CDDL HEADER in each
14eda14cbcSMatt Macy  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15eda14cbcSMatt Macy  * If applicable, add the following below this CDDL HEADER, with the
16eda14cbcSMatt Macy  * fields enclosed by brackets "[]" replaced with your own identifying
17eda14cbcSMatt Macy  * information: Portions Copyright [yyyy] [name of copyright owner]
18eda14cbcSMatt Macy  *
19eda14cbcSMatt Macy  * CDDL HEADER END
20eda14cbcSMatt Macy  */
21eda14cbcSMatt Macy /*
22eda14cbcSMatt Macy  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23eda14cbcSMatt Macy  * Use is subject to license terms.
24eda14cbcSMatt Macy  */
25eda14cbcSMatt Macy 
26eda14cbcSMatt Macy #include <sys/zfs_context.h>
27eda14cbcSMatt Macy #include <modes/modes.h>
28eda14cbcSMatt Macy #include <sys/crypto/common.h>
29eda14cbcSMatt Macy #include <sys/crypto/impl.h>
30eda14cbcSMatt Macy 
31eda14cbcSMatt Macy #ifdef HAVE_EFFICIENT_UNALIGNED_ACCESS
32eda14cbcSMatt Macy #include <sys/byteorder.h>
33eda14cbcSMatt Macy #define	UNALIGNED_POINTERS_PERMITTED
34eda14cbcSMatt Macy #endif
35eda14cbcSMatt Macy 
36eda14cbcSMatt Macy /*
37eda14cbcSMatt Macy  * Encrypt multiple blocks of data in CCM mode.  Decrypt for CCM mode
38eda14cbcSMatt Macy  * is done in another function.
39eda14cbcSMatt Macy  */
40eda14cbcSMatt Macy int
ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))41eda14cbcSMatt Macy ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
42eda14cbcSMatt Macy     crypto_data_t *out, size_t block_size,
43eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
44eda14cbcSMatt Macy     void (*copy_block)(uint8_t *, uint8_t *),
45eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
46eda14cbcSMatt Macy {
47eda14cbcSMatt Macy 	size_t remainder = length;
48eda14cbcSMatt Macy 	size_t need = 0;
49eda14cbcSMatt Macy 	uint8_t *datap = (uint8_t *)data;
50eda14cbcSMatt Macy 	uint8_t *blockp;
51eda14cbcSMatt Macy 	uint8_t *lastp;
52eda14cbcSMatt Macy 	void *iov_or_mp;
53eda14cbcSMatt Macy 	offset_t offset;
54eda14cbcSMatt Macy 	uint8_t *out_data_1;
55eda14cbcSMatt Macy 	uint8_t *out_data_2;
56eda14cbcSMatt Macy 	size_t out_data_1_len;
57eda14cbcSMatt Macy 	uint64_t counter;
58eda14cbcSMatt Macy 	uint8_t *mac_buf;
59eda14cbcSMatt Macy 
60eda14cbcSMatt Macy 	if (length + ctx->ccm_remainder_len < block_size) {
61eda14cbcSMatt Macy 		/* accumulate bytes here and return */
62da5137abSMartin Matuska 		memcpy((uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
63da5137abSMartin Matuska 		    datap,
64eda14cbcSMatt Macy 		    length);
65eda14cbcSMatt Macy 		ctx->ccm_remainder_len += length;
66eda14cbcSMatt Macy 		ctx->ccm_copy_to = datap;
67eda14cbcSMatt Macy 		return (CRYPTO_SUCCESS);
68eda14cbcSMatt Macy 	}
69eda14cbcSMatt Macy 
70eda14cbcSMatt Macy 	crypto_init_ptrs(out, &iov_or_mp, &offset);
71eda14cbcSMatt Macy 
72eda14cbcSMatt Macy 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
73eda14cbcSMatt Macy 
74eda14cbcSMatt Macy 	do {
75eda14cbcSMatt Macy 		/* Unprocessed data from last call. */
76eda14cbcSMatt Macy 		if (ctx->ccm_remainder_len > 0) {
77eda14cbcSMatt Macy 			need = block_size - ctx->ccm_remainder_len;
78eda14cbcSMatt Macy 
79eda14cbcSMatt Macy 			if (need > remainder)
80eda14cbcSMatt Macy 				return (CRYPTO_DATA_LEN_RANGE);
81eda14cbcSMatt Macy 
82da5137abSMartin Matuska 			memcpy(&((uint8_t *)ctx->ccm_remainder)
83da5137abSMartin Matuska 			    [ctx->ccm_remainder_len], datap, need);
84eda14cbcSMatt Macy 
85eda14cbcSMatt Macy 			blockp = (uint8_t *)ctx->ccm_remainder;
86eda14cbcSMatt Macy 		} else {
87eda14cbcSMatt Macy 			blockp = datap;
88eda14cbcSMatt Macy 		}
89eda14cbcSMatt Macy 
90eda14cbcSMatt Macy 		/*
91eda14cbcSMatt Macy 		 * do CBC MAC
92eda14cbcSMatt Macy 		 *
93eda14cbcSMatt Macy 		 * XOR the previous cipher block current clear block.
94eda14cbcSMatt Macy 		 * mac_buf always contain previous cipher block.
95eda14cbcSMatt Macy 		 */
96eda14cbcSMatt Macy 		xor_block(blockp, mac_buf);
97eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
98eda14cbcSMatt Macy 
99eda14cbcSMatt Macy 		/* ccm_cb is the counter block */
100eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb,
101eda14cbcSMatt Macy 		    (uint8_t *)ctx->ccm_tmp);
102eda14cbcSMatt Macy 
103eda14cbcSMatt Macy 		lastp = (uint8_t *)ctx->ccm_tmp;
104eda14cbcSMatt Macy 
105eda14cbcSMatt Macy 		/*
106eda14cbcSMatt Macy 		 * Increment counter. Counter bits are confined
107eda14cbcSMatt Macy 		 * to the bottom 64 bits of the counter block.
108eda14cbcSMatt Macy 		 */
109eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
110eda14cbcSMatt Macy 		counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
111eda14cbcSMatt Macy 		counter = htonll(counter + 1);
112eda14cbcSMatt Macy #else
113eda14cbcSMatt Macy 		counter = ctx->ccm_cb[1] & ctx->ccm_counter_mask;
114eda14cbcSMatt Macy 		counter++;
115eda14cbcSMatt Macy #endif	/* _ZFS_LITTLE_ENDIAN */
116eda14cbcSMatt Macy 		counter &= ctx->ccm_counter_mask;
117eda14cbcSMatt Macy 		ctx->ccm_cb[1] =
118eda14cbcSMatt Macy 		    (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
119eda14cbcSMatt Macy 
120eda14cbcSMatt Macy 		/*
121eda14cbcSMatt Macy 		 * XOR encrypted counter block with the current clear block.
122eda14cbcSMatt Macy 		 */
123eda14cbcSMatt Macy 		xor_block(blockp, lastp);
124eda14cbcSMatt Macy 
125eda14cbcSMatt Macy 		ctx->ccm_processed_data_len += block_size;
126eda14cbcSMatt Macy 
127eda14cbcSMatt Macy 		crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
128eda14cbcSMatt Macy 		    &out_data_1_len, &out_data_2, block_size);
129eda14cbcSMatt Macy 
130eda14cbcSMatt Macy 		/* copy block to where it belongs */
131eda14cbcSMatt Macy 		if (out_data_1_len == block_size) {
132eda14cbcSMatt Macy 			copy_block(lastp, out_data_1);
133eda14cbcSMatt Macy 		} else {
134da5137abSMartin Matuska 			memcpy(out_data_1, lastp, out_data_1_len);
135eda14cbcSMatt Macy 			if (out_data_2 != NULL) {
136da5137abSMartin Matuska 				memcpy(out_data_2,
137da5137abSMartin Matuska 				    lastp + out_data_1_len,
138eda14cbcSMatt Macy 				    block_size - out_data_1_len);
139eda14cbcSMatt Macy 			}
140eda14cbcSMatt Macy 		}
141eda14cbcSMatt Macy 		/* update offset */
142eda14cbcSMatt Macy 		out->cd_offset += block_size;
143eda14cbcSMatt Macy 
144eda14cbcSMatt Macy 		/* Update pointer to next block of data to be processed. */
145eda14cbcSMatt Macy 		if (ctx->ccm_remainder_len != 0) {
146eda14cbcSMatt Macy 			datap += need;
147eda14cbcSMatt Macy 			ctx->ccm_remainder_len = 0;
148eda14cbcSMatt Macy 		} else {
149eda14cbcSMatt Macy 			datap += block_size;
150eda14cbcSMatt Macy 		}
151eda14cbcSMatt Macy 
152eda14cbcSMatt Macy 		remainder = (size_t)&data[length] - (size_t)datap;
153eda14cbcSMatt Macy 
154eda14cbcSMatt Macy 		/* Incomplete last block. */
155eda14cbcSMatt Macy 		if (remainder > 0 && remainder < block_size) {
156da5137abSMartin Matuska 			memcpy(ctx->ccm_remainder, datap, remainder);
157eda14cbcSMatt Macy 			ctx->ccm_remainder_len = remainder;
158eda14cbcSMatt Macy 			ctx->ccm_copy_to = datap;
159eda14cbcSMatt Macy 			goto out;
160eda14cbcSMatt Macy 		}
161eda14cbcSMatt Macy 		ctx->ccm_copy_to = NULL;
162eda14cbcSMatt Macy 
163eda14cbcSMatt Macy 	} while (remainder > 0);
164eda14cbcSMatt Macy 
165eda14cbcSMatt Macy out:
166eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
167eda14cbcSMatt Macy }
168eda14cbcSMatt Macy 
169eda14cbcSMatt Macy void
calculate_ccm_mac(ccm_ctx_t * ctx,uint8_t * ccm_mac,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))170eda14cbcSMatt Macy calculate_ccm_mac(ccm_ctx_t *ctx, uint8_t *ccm_mac,
171eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
172eda14cbcSMatt Macy {
173eda14cbcSMatt Macy 	uint64_t counter;
174eda14cbcSMatt Macy 	uint8_t *counterp, *mac_buf;
175eda14cbcSMatt Macy 	int i;
176eda14cbcSMatt Macy 
177eda14cbcSMatt Macy 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
178eda14cbcSMatt Macy 
179eda14cbcSMatt Macy 	/* first counter block start with index 0 */
180eda14cbcSMatt Macy 	counter = 0;
181eda14cbcSMatt Macy 	ctx->ccm_cb[1] = (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
182eda14cbcSMatt Macy 
183eda14cbcSMatt Macy 	counterp = (uint8_t *)ctx->ccm_tmp;
184eda14cbcSMatt Macy 	encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
185eda14cbcSMatt Macy 
186eda14cbcSMatt Macy 	/* calculate XOR of MAC with first counter block */
187eda14cbcSMatt Macy 	for (i = 0; i < ctx->ccm_mac_len; i++) {
188eda14cbcSMatt Macy 		ccm_mac[i] = mac_buf[i] ^ counterp[i];
189eda14cbcSMatt Macy 	}
190eda14cbcSMatt Macy }
191eda14cbcSMatt Macy 
192eda14cbcSMatt Macy int
ccm_encrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))193eda14cbcSMatt Macy ccm_encrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
194eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
195eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
196eda14cbcSMatt Macy {
197eda14cbcSMatt Macy 	uint8_t *lastp, *mac_buf, *ccm_mac_p, *macp = NULL;
198eda14cbcSMatt Macy 	void *iov_or_mp;
199eda14cbcSMatt Macy 	offset_t offset;
200eda14cbcSMatt Macy 	uint8_t *out_data_1;
201eda14cbcSMatt Macy 	uint8_t *out_data_2;
202eda14cbcSMatt Macy 	size_t out_data_1_len;
203eda14cbcSMatt Macy 	int i;
204eda14cbcSMatt Macy 
205eda14cbcSMatt Macy 	if (out->cd_length < (ctx->ccm_remainder_len + ctx->ccm_mac_len)) {
206eda14cbcSMatt Macy 		return (CRYPTO_DATA_LEN_RANGE);
207eda14cbcSMatt Macy 	}
208eda14cbcSMatt Macy 
209eda14cbcSMatt Macy 	/*
210eda14cbcSMatt Macy 	 * When we get here, the number of bytes of payload processed
211eda14cbcSMatt Macy 	 * plus whatever data remains, if any,
212eda14cbcSMatt Macy 	 * should be the same as the number of bytes that's being
213eda14cbcSMatt Macy 	 * passed in the argument during init time.
214eda14cbcSMatt Macy 	 */
215eda14cbcSMatt Macy 	if ((ctx->ccm_processed_data_len + ctx->ccm_remainder_len)
216eda14cbcSMatt Macy 	    != (ctx->ccm_data_len)) {
217eda14cbcSMatt Macy 		return (CRYPTO_DATA_LEN_RANGE);
218eda14cbcSMatt Macy 	}
219eda14cbcSMatt Macy 
220eda14cbcSMatt Macy 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
221eda14cbcSMatt Macy 
222eda14cbcSMatt Macy 	if (ctx->ccm_remainder_len > 0) {
223eda14cbcSMatt Macy 
224eda14cbcSMatt Macy 		/* ccm_mac_input_buf is not used for encryption */
225eda14cbcSMatt Macy 		macp = (uint8_t *)ctx->ccm_mac_input_buf;
226da5137abSMartin Matuska 		memset(macp, 0, block_size);
227eda14cbcSMatt Macy 
228eda14cbcSMatt Macy 		/* copy remainder to temporary buffer */
229da5137abSMartin Matuska 		memcpy(macp, ctx->ccm_remainder, ctx->ccm_remainder_len);
230eda14cbcSMatt Macy 
231eda14cbcSMatt Macy 		/* calculate the CBC MAC */
232eda14cbcSMatt Macy 		xor_block(macp, mac_buf);
233eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
234eda14cbcSMatt Macy 
235eda14cbcSMatt Macy 		/* calculate the counter mode */
236eda14cbcSMatt Macy 		lastp = (uint8_t *)ctx->ccm_tmp;
237eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, lastp);
238eda14cbcSMatt Macy 
239eda14cbcSMatt Macy 		/* XOR with counter block */
240eda14cbcSMatt Macy 		for (i = 0; i < ctx->ccm_remainder_len; i++) {
241eda14cbcSMatt Macy 			macp[i] ^= lastp[i];
242eda14cbcSMatt Macy 		}
243eda14cbcSMatt Macy 		ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
244eda14cbcSMatt Macy 	}
245eda14cbcSMatt Macy 
246eda14cbcSMatt Macy 	/* Calculate the CCM MAC */
247eda14cbcSMatt Macy 	ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
248eda14cbcSMatt Macy 	calculate_ccm_mac(ctx, ccm_mac_p, encrypt_block);
249eda14cbcSMatt Macy 
250eda14cbcSMatt Macy 	crypto_init_ptrs(out, &iov_or_mp, &offset);
251eda14cbcSMatt Macy 	crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
252eda14cbcSMatt Macy 	    &out_data_1_len, &out_data_2,
253eda14cbcSMatt Macy 	    ctx->ccm_remainder_len + ctx->ccm_mac_len);
254eda14cbcSMatt Macy 
255eda14cbcSMatt Macy 	if (ctx->ccm_remainder_len > 0) {
256eda14cbcSMatt Macy 		/* copy temporary block to where it belongs */
257eda14cbcSMatt Macy 		if (out_data_2 == NULL) {
258eda14cbcSMatt Macy 			/* everything will fit in out_data_1 */
259da5137abSMartin Matuska 			memcpy(out_data_1, macp, ctx->ccm_remainder_len);
260da5137abSMartin Matuska 			memcpy(out_data_1 + ctx->ccm_remainder_len, ccm_mac_p,
261eda14cbcSMatt Macy 			    ctx->ccm_mac_len);
262eda14cbcSMatt Macy 		} else {
263eda14cbcSMatt Macy 			if (out_data_1_len < ctx->ccm_remainder_len) {
264eda14cbcSMatt Macy 				size_t data_2_len_used;
265eda14cbcSMatt Macy 
266da5137abSMartin Matuska 				memcpy(out_data_1, macp, out_data_1_len);
267eda14cbcSMatt Macy 
268eda14cbcSMatt Macy 				data_2_len_used = ctx->ccm_remainder_len
269eda14cbcSMatt Macy 				    - out_data_1_len;
270eda14cbcSMatt Macy 
271da5137abSMartin Matuska 				memcpy(out_data_2,
272da5137abSMartin Matuska 				    (uint8_t *)macp + out_data_1_len,
273da5137abSMartin Matuska 				    data_2_len_used);
274da5137abSMartin Matuska 				memcpy(out_data_2 + data_2_len_used,
275da5137abSMartin Matuska 				    ccm_mac_p,
276eda14cbcSMatt Macy 				    ctx->ccm_mac_len);
277eda14cbcSMatt Macy 			} else {
278da5137abSMartin Matuska 				memcpy(out_data_1, macp, out_data_1_len);
279eda14cbcSMatt Macy 				if (out_data_1_len == ctx->ccm_remainder_len) {
280eda14cbcSMatt Macy 					/* mac will be in out_data_2 */
281da5137abSMartin Matuska 					memcpy(out_data_2, ccm_mac_p,
282eda14cbcSMatt Macy 					    ctx->ccm_mac_len);
283eda14cbcSMatt Macy 				} else {
284eda14cbcSMatt Macy 					size_t len_not_used = out_data_1_len -
285eda14cbcSMatt Macy 					    ctx->ccm_remainder_len;
286eda14cbcSMatt Macy 					/*
287eda14cbcSMatt Macy 					 * part of mac in will be in
288eda14cbcSMatt Macy 					 * out_data_1, part of the mac will be
289eda14cbcSMatt Macy 					 * in out_data_2
290eda14cbcSMatt Macy 					 */
291da5137abSMartin Matuska 					memcpy(out_data_1 +
292da5137abSMartin Matuska 					    ctx->ccm_remainder_len,
293da5137abSMartin Matuska 					    ccm_mac_p, len_not_used);
294da5137abSMartin Matuska 					memcpy(out_data_2,
295da5137abSMartin Matuska 					    ccm_mac_p + len_not_used,
296eda14cbcSMatt Macy 					    ctx->ccm_mac_len - len_not_used);
297eda14cbcSMatt Macy 
298eda14cbcSMatt Macy 				}
299eda14cbcSMatt Macy 			}
300eda14cbcSMatt Macy 		}
301eda14cbcSMatt Macy 	} else {
302eda14cbcSMatt Macy 		/* copy block to where it belongs */
303da5137abSMartin Matuska 		memcpy(out_data_1, ccm_mac_p, out_data_1_len);
304eda14cbcSMatt Macy 		if (out_data_2 != NULL) {
305da5137abSMartin Matuska 			memcpy(out_data_2, ccm_mac_p + out_data_1_len,
306eda14cbcSMatt Macy 			    block_size - out_data_1_len);
307eda14cbcSMatt Macy 		}
308eda14cbcSMatt Macy 	}
309eda14cbcSMatt Macy 	out->cd_offset += ctx->ccm_remainder_len + ctx->ccm_mac_len;
310eda14cbcSMatt Macy 	ctx->ccm_remainder_len = 0;
311eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
312eda14cbcSMatt Macy }
313eda14cbcSMatt Macy 
314eda14cbcSMatt Macy /*
315eda14cbcSMatt Macy  * This will only deal with decrypting the last block of the input that
316eda14cbcSMatt Macy  * might not be a multiple of block length.
317eda14cbcSMatt Macy  */
318eda14cbcSMatt Macy static void
ccm_decrypt_incomplete_block(ccm_ctx_t * ctx,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))319eda14cbcSMatt Macy ccm_decrypt_incomplete_block(ccm_ctx_t *ctx,
320eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
321eda14cbcSMatt Macy {
322eda14cbcSMatt Macy 	uint8_t *datap, *outp, *counterp;
323eda14cbcSMatt Macy 	int i;
324eda14cbcSMatt Macy 
325eda14cbcSMatt Macy 	datap = (uint8_t *)ctx->ccm_remainder;
326eda14cbcSMatt Macy 	outp = &((ctx->ccm_pt_buf)[ctx->ccm_processed_data_len]);
327eda14cbcSMatt Macy 
328eda14cbcSMatt Macy 	counterp = (uint8_t *)ctx->ccm_tmp;
329eda14cbcSMatt Macy 	encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
330eda14cbcSMatt Macy 
331eda14cbcSMatt Macy 	/* XOR with counter block */
332eda14cbcSMatt Macy 	for (i = 0; i < ctx->ccm_remainder_len; i++) {
333eda14cbcSMatt Macy 		outp[i] = datap[i] ^ counterp[i];
334eda14cbcSMatt Macy 	}
335eda14cbcSMatt Macy }
336eda14cbcSMatt Macy 
337eda14cbcSMatt Macy /*
338eda14cbcSMatt Macy  * This will decrypt the cipher text.  However, the plaintext won't be
339eda14cbcSMatt Macy  * returned to the caller.  It will be returned when decrypt_final() is
340eda14cbcSMatt Macy  * called if the MAC matches
341eda14cbcSMatt Macy  */
342eda14cbcSMatt Macy int
ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))343eda14cbcSMatt Macy ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
344eda14cbcSMatt Macy     crypto_data_t *out, size_t block_size,
345eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
346eda14cbcSMatt Macy     void (*copy_block)(uint8_t *, uint8_t *),
347eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
348eda14cbcSMatt Macy {
349e92ffd9bSMartin Matuska 	(void) out;
350eda14cbcSMatt Macy 	size_t remainder = length;
351eda14cbcSMatt Macy 	size_t need = 0;
352eda14cbcSMatt Macy 	uint8_t *datap = (uint8_t *)data;
353eda14cbcSMatt Macy 	uint8_t *blockp;
354eda14cbcSMatt Macy 	uint8_t *cbp;
355eda14cbcSMatt Macy 	uint64_t counter;
356eda14cbcSMatt Macy 	size_t pt_len, total_decrypted_len, mac_len, pm_len, pd_len;
357eda14cbcSMatt Macy 	uint8_t *resultp;
358eda14cbcSMatt Macy 
359eda14cbcSMatt Macy 
360eda14cbcSMatt Macy 	pm_len = ctx->ccm_processed_mac_len;
361eda14cbcSMatt Macy 
362eda14cbcSMatt Macy 	if (pm_len > 0) {
363eda14cbcSMatt Macy 		uint8_t *tmp;
364eda14cbcSMatt Macy 		/*
365eda14cbcSMatt Macy 		 * all ciphertext has been processed, just waiting for
366eda14cbcSMatt Macy 		 * part of the value of the mac
367eda14cbcSMatt Macy 		 */
368eda14cbcSMatt Macy 		if ((pm_len + length) > ctx->ccm_mac_len) {
369eda14cbcSMatt Macy 			return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
370eda14cbcSMatt Macy 		}
371eda14cbcSMatt Macy 		tmp = (uint8_t *)ctx->ccm_mac_input_buf;
372eda14cbcSMatt Macy 
373da5137abSMartin Matuska 		memcpy(tmp + pm_len, datap, length);
374eda14cbcSMatt Macy 
375eda14cbcSMatt Macy 		ctx->ccm_processed_mac_len += length;
376eda14cbcSMatt Macy 		return (CRYPTO_SUCCESS);
377eda14cbcSMatt Macy 	}
378eda14cbcSMatt Macy 
379eda14cbcSMatt Macy 	/*
380eda14cbcSMatt Macy 	 * If we decrypt the given data, what total amount of data would
381eda14cbcSMatt Macy 	 * have been decrypted?
382eda14cbcSMatt Macy 	 */
383eda14cbcSMatt Macy 	pd_len = ctx->ccm_processed_data_len;
384eda14cbcSMatt Macy 	total_decrypted_len = pd_len + length + ctx->ccm_remainder_len;
385eda14cbcSMatt Macy 
386eda14cbcSMatt Macy 	if (total_decrypted_len >
387eda14cbcSMatt Macy 	    (ctx->ccm_data_len + ctx->ccm_mac_len)) {
388eda14cbcSMatt Macy 		return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
389eda14cbcSMatt Macy 	}
390eda14cbcSMatt Macy 
391eda14cbcSMatt Macy 	pt_len = ctx->ccm_data_len;
392eda14cbcSMatt Macy 
393eda14cbcSMatt Macy 	if (total_decrypted_len > pt_len) {
394eda14cbcSMatt Macy 		/*
395eda14cbcSMatt Macy 		 * part of the input will be the MAC, need to isolate that
396eda14cbcSMatt Macy 		 * to be dealt with later.  The left-over data in
397eda14cbcSMatt Macy 		 * ccm_remainder_len from last time will not be part of the
398eda14cbcSMatt Macy 		 * MAC.  Otherwise, it would have already been taken out
399eda14cbcSMatt Macy 		 * when this call is made last time.
400eda14cbcSMatt Macy 		 */
401eda14cbcSMatt Macy 		size_t pt_part = pt_len - pd_len - ctx->ccm_remainder_len;
402eda14cbcSMatt Macy 
403eda14cbcSMatt Macy 		mac_len = length - pt_part;
404eda14cbcSMatt Macy 
405eda14cbcSMatt Macy 		ctx->ccm_processed_mac_len = mac_len;
406da5137abSMartin Matuska 		memcpy(ctx->ccm_mac_input_buf, data + pt_part, mac_len);
407eda14cbcSMatt Macy 
408eda14cbcSMatt Macy 		if (pt_part + ctx->ccm_remainder_len < block_size) {
409eda14cbcSMatt Macy 			/*
410eda14cbcSMatt Macy 			 * since this is last of the ciphertext, will
411eda14cbcSMatt Macy 			 * just decrypt with it here
412eda14cbcSMatt Macy 			 */
413da5137abSMartin Matuska 			memcpy(&((uint8_t *)ctx->ccm_remainder)
414da5137abSMartin Matuska 			    [ctx->ccm_remainder_len], datap, pt_part);
415eda14cbcSMatt Macy 			ctx->ccm_remainder_len += pt_part;
416eda14cbcSMatt Macy 			ccm_decrypt_incomplete_block(ctx, encrypt_block);
417eda14cbcSMatt Macy 			ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
418eda14cbcSMatt Macy 			ctx->ccm_remainder_len = 0;
419eda14cbcSMatt Macy 			return (CRYPTO_SUCCESS);
420eda14cbcSMatt Macy 		} else {
421eda14cbcSMatt Macy 			/* let rest of the code handle this */
422eda14cbcSMatt Macy 			length = pt_part;
423eda14cbcSMatt Macy 		}
424eda14cbcSMatt Macy 	} else if (length + ctx->ccm_remainder_len < block_size) {
425eda14cbcSMatt Macy 		/* accumulate bytes here and return */
426da5137abSMartin Matuska 		memcpy((uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
427da5137abSMartin Matuska 		    datap,
428eda14cbcSMatt Macy 		    length);
429eda14cbcSMatt Macy 		ctx->ccm_remainder_len += length;
430eda14cbcSMatt Macy 		ctx->ccm_copy_to = datap;
431eda14cbcSMatt Macy 		return (CRYPTO_SUCCESS);
432eda14cbcSMatt Macy 	}
433eda14cbcSMatt Macy 
434eda14cbcSMatt Macy 	do {
435eda14cbcSMatt Macy 		/* Unprocessed data from last call. */
436eda14cbcSMatt Macy 		if (ctx->ccm_remainder_len > 0) {
437eda14cbcSMatt Macy 			need = block_size - ctx->ccm_remainder_len;
438eda14cbcSMatt Macy 
439eda14cbcSMatt Macy 			if (need > remainder)
440eda14cbcSMatt Macy 				return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
441eda14cbcSMatt Macy 
442da5137abSMartin Matuska 			memcpy(&((uint8_t *)ctx->ccm_remainder)
443da5137abSMartin Matuska 			    [ctx->ccm_remainder_len], datap, need);
444eda14cbcSMatt Macy 
445eda14cbcSMatt Macy 			blockp = (uint8_t *)ctx->ccm_remainder;
446eda14cbcSMatt Macy 		} else {
447eda14cbcSMatt Macy 			blockp = datap;
448eda14cbcSMatt Macy 		}
449eda14cbcSMatt Macy 
450eda14cbcSMatt Macy 		/* Calculate the counter mode, ccm_cb is the counter block */
451eda14cbcSMatt Macy 		cbp = (uint8_t *)ctx->ccm_tmp;
452eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, cbp);
453eda14cbcSMatt Macy 
454eda14cbcSMatt Macy 		/*
455eda14cbcSMatt Macy 		 * Increment counter.
456eda14cbcSMatt Macy 		 * Counter bits are confined to the bottom 64 bits
457eda14cbcSMatt Macy 		 */
458eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
459eda14cbcSMatt Macy 		counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
460eda14cbcSMatt Macy 		counter = htonll(counter + 1);
461eda14cbcSMatt Macy #else
462eda14cbcSMatt Macy 		counter = ctx->ccm_cb[1] & ctx->ccm_counter_mask;
463eda14cbcSMatt Macy 		counter++;
464eda14cbcSMatt Macy #endif	/* _ZFS_LITTLE_ENDIAN */
465eda14cbcSMatt Macy 		counter &= ctx->ccm_counter_mask;
466eda14cbcSMatt Macy 		ctx->ccm_cb[1] =
467eda14cbcSMatt Macy 		    (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
468eda14cbcSMatt Macy 
469eda14cbcSMatt Macy 		/* XOR with the ciphertext */
470eda14cbcSMatt Macy 		xor_block(blockp, cbp);
471eda14cbcSMatt Macy 
472eda14cbcSMatt Macy 		/* Copy the plaintext to the "holding buffer" */
473eda14cbcSMatt Macy 		resultp = (uint8_t *)ctx->ccm_pt_buf +
474eda14cbcSMatt Macy 		    ctx->ccm_processed_data_len;
475eda14cbcSMatt Macy 		copy_block(cbp, resultp);
476eda14cbcSMatt Macy 
477eda14cbcSMatt Macy 		ctx->ccm_processed_data_len += block_size;
478eda14cbcSMatt Macy 
479eda14cbcSMatt Macy 		ctx->ccm_lastp = blockp;
480eda14cbcSMatt Macy 
481eda14cbcSMatt Macy 		/* Update pointer to next block of data to be processed. */
482eda14cbcSMatt Macy 		if (ctx->ccm_remainder_len != 0) {
483eda14cbcSMatt Macy 			datap += need;
484eda14cbcSMatt Macy 			ctx->ccm_remainder_len = 0;
485eda14cbcSMatt Macy 		} else {
486eda14cbcSMatt Macy 			datap += block_size;
487eda14cbcSMatt Macy 		}
488eda14cbcSMatt Macy 
489eda14cbcSMatt Macy 		remainder = (size_t)&data[length] - (size_t)datap;
490eda14cbcSMatt Macy 
491eda14cbcSMatt Macy 		/* Incomplete last block */
492eda14cbcSMatt Macy 		if (remainder > 0 && remainder < block_size) {
493da5137abSMartin Matuska 			memcpy(ctx->ccm_remainder, datap, remainder);
494eda14cbcSMatt Macy 			ctx->ccm_remainder_len = remainder;
495eda14cbcSMatt Macy 			ctx->ccm_copy_to = datap;
496eda14cbcSMatt Macy 			if (ctx->ccm_processed_mac_len > 0) {
497eda14cbcSMatt Macy 				/*
498eda14cbcSMatt Macy 				 * not expecting anymore ciphertext, just
499eda14cbcSMatt Macy 				 * compute plaintext for the remaining input
500eda14cbcSMatt Macy 				 */
501eda14cbcSMatt Macy 				ccm_decrypt_incomplete_block(ctx,
502eda14cbcSMatt Macy 				    encrypt_block);
503eda14cbcSMatt Macy 				ctx->ccm_processed_data_len += remainder;
504eda14cbcSMatt Macy 				ctx->ccm_remainder_len = 0;
505eda14cbcSMatt Macy 			}
506eda14cbcSMatt Macy 			goto out;
507eda14cbcSMatt Macy 		}
508eda14cbcSMatt Macy 		ctx->ccm_copy_to = NULL;
509eda14cbcSMatt Macy 
510eda14cbcSMatt Macy 	} while (remainder > 0);
511eda14cbcSMatt Macy 
512eda14cbcSMatt Macy out:
513eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
514eda14cbcSMatt Macy }
515eda14cbcSMatt Macy 
516eda14cbcSMatt Macy int
ccm_decrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))517eda14cbcSMatt Macy ccm_decrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
518eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
519eda14cbcSMatt Macy     void (*copy_block)(uint8_t *, uint8_t *),
520eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
521eda14cbcSMatt Macy {
522eda14cbcSMatt Macy 	size_t mac_remain, pt_len;
523eda14cbcSMatt Macy 	uint8_t *pt, *mac_buf, *macp, *ccm_mac_p;
524eda14cbcSMatt Macy 	int rv;
525eda14cbcSMatt Macy 
526eda14cbcSMatt Macy 	pt_len = ctx->ccm_data_len;
527eda14cbcSMatt Macy 
528eda14cbcSMatt Macy 	/* Make sure output buffer can fit all of the plaintext */
529eda14cbcSMatt Macy 	if (out->cd_length < pt_len) {
530eda14cbcSMatt Macy 		return (CRYPTO_DATA_LEN_RANGE);
531eda14cbcSMatt Macy 	}
532eda14cbcSMatt Macy 
533eda14cbcSMatt Macy 	pt = ctx->ccm_pt_buf;
534eda14cbcSMatt Macy 	mac_remain = ctx->ccm_processed_data_len;
535eda14cbcSMatt Macy 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
536eda14cbcSMatt Macy 
537eda14cbcSMatt Macy 	macp = (uint8_t *)ctx->ccm_tmp;
538eda14cbcSMatt Macy 
539eda14cbcSMatt Macy 	while (mac_remain > 0) {
540eda14cbcSMatt Macy 		if (mac_remain < block_size) {
541da5137abSMartin Matuska 			memset(macp, 0, block_size);
542da5137abSMartin Matuska 			memcpy(macp, pt, mac_remain);
543eda14cbcSMatt Macy 			mac_remain = 0;
544eda14cbcSMatt Macy 		} else {
545eda14cbcSMatt Macy 			copy_block(pt, macp);
546eda14cbcSMatt Macy 			mac_remain -= block_size;
547eda14cbcSMatt Macy 			pt += block_size;
548eda14cbcSMatt Macy 		}
549eda14cbcSMatt Macy 
550eda14cbcSMatt Macy 		/* calculate the CBC MAC */
551eda14cbcSMatt Macy 		xor_block(macp, mac_buf);
552eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
553eda14cbcSMatt Macy 	}
554eda14cbcSMatt Macy 
555eda14cbcSMatt Macy 	/* Calculate the CCM MAC */
556eda14cbcSMatt Macy 	ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
557eda14cbcSMatt Macy 	calculate_ccm_mac((ccm_ctx_t *)ctx, ccm_mac_p, encrypt_block);
558eda14cbcSMatt Macy 
559eda14cbcSMatt Macy 	/* compare the input CCM MAC value with what we calculated */
560da5137abSMartin Matuska 	if (memcmp(ctx->ccm_mac_input_buf, ccm_mac_p, ctx->ccm_mac_len)) {
561eda14cbcSMatt Macy 		/* They don't match */
562eda14cbcSMatt Macy 		return (CRYPTO_INVALID_MAC);
563eda14cbcSMatt Macy 	} else {
564eda14cbcSMatt Macy 		rv = crypto_put_output_data(ctx->ccm_pt_buf, out, pt_len);
565eda14cbcSMatt Macy 		if (rv != CRYPTO_SUCCESS)
566eda14cbcSMatt Macy 			return (rv);
567eda14cbcSMatt Macy 		out->cd_offset += pt_len;
568eda14cbcSMatt Macy 	}
569eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
570eda14cbcSMatt Macy }
571eda14cbcSMatt Macy 
572eda14cbcSMatt Macy static int
ccm_validate_args(CK_AES_CCM_PARAMS * ccm_param,boolean_t is_encrypt_init)573eda14cbcSMatt Macy ccm_validate_args(CK_AES_CCM_PARAMS *ccm_param, boolean_t is_encrypt_init)
574eda14cbcSMatt Macy {
575eda14cbcSMatt Macy 	size_t macSize, nonceSize;
576eda14cbcSMatt Macy 	uint8_t q;
577eda14cbcSMatt Macy 	uint64_t maxValue;
578eda14cbcSMatt Macy 
579eda14cbcSMatt Macy 	/*
580eda14cbcSMatt Macy 	 * Check the length of the MAC.  The only valid
581eda14cbcSMatt Macy 	 * lengths for the MAC are: 4, 6, 8, 10, 12, 14, 16
582eda14cbcSMatt Macy 	 */
583eda14cbcSMatt Macy 	macSize = ccm_param->ulMACSize;
584eda14cbcSMatt Macy 	if ((macSize < 4) || (macSize > 16) || ((macSize % 2) != 0)) {
585eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
586eda14cbcSMatt Macy 	}
587eda14cbcSMatt Macy 
588eda14cbcSMatt Macy 	/* Check the nonce length.  Valid values are 7, 8, 9, 10, 11, 12, 13 */
589eda14cbcSMatt Macy 	nonceSize = ccm_param->ulNonceSize;
590eda14cbcSMatt Macy 	if ((nonceSize < 7) || (nonceSize > 13)) {
591eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
592eda14cbcSMatt Macy 	}
593eda14cbcSMatt Macy 
594eda14cbcSMatt Macy 	/* q is the length of the field storing the length, in bytes */
595eda14cbcSMatt Macy 	q = (uint8_t)((15 - nonceSize) & 0xFF);
596eda14cbcSMatt Macy 
597eda14cbcSMatt Macy 
598eda14cbcSMatt Macy 	/*
599eda14cbcSMatt Macy 	 * If it is decrypt, need to make sure size of ciphertext is at least
600eda14cbcSMatt Macy 	 * bigger than MAC len
601eda14cbcSMatt Macy 	 */
602eda14cbcSMatt Macy 	if ((!is_encrypt_init) && (ccm_param->ulDataSize < macSize)) {
603eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
604eda14cbcSMatt Macy 	}
605eda14cbcSMatt Macy 
606eda14cbcSMatt Macy 	/*
607eda14cbcSMatt Macy 	 * Check to make sure the length of the payload is within the
608eda14cbcSMatt Macy 	 * range of values allowed by q
609eda14cbcSMatt Macy 	 */
610eda14cbcSMatt Macy 	if (q < 8) {
611eda14cbcSMatt Macy 		maxValue = (1ULL << (q * 8)) - 1;
612eda14cbcSMatt Macy 	} else {
613eda14cbcSMatt Macy 		maxValue = ULONG_MAX;
614eda14cbcSMatt Macy 	}
615eda14cbcSMatt Macy 
616eda14cbcSMatt Macy 	if (ccm_param->ulDataSize > maxValue) {
617eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
618eda14cbcSMatt Macy 	}
619eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
620eda14cbcSMatt Macy }
621eda14cbcSMatt Macy 
622eda14cbcSMatt Macy /*
623eda14cbcSMatt Macy  * Format the first block used in CBC-MAC (B0) and the initial counter
624eda14cbcSMatt Macy  * block based on formatting functions and counter generation functions
625eda14cbcSMatt Macy  * specified in RFC 3610 and NIST publication 800-38C, appendix A
626eda14cbcSMatt Macy  *
627eda14cbcSMatt Macy  * b0 is the first block used in CBC-MAC
628eda14cbcSMatt Macy  * cb0 is the first counter block
629eda14cbcSMatt Macy  *
630eda14cbcSMatt Macy  * It's assumed that the arguments b0 and cb0 are preallocated AES blocks
631eda14cbcSMatt Macy  *
632eda14cbcSMatt Macy  */
633eda14cbcSMatt Macy static void
ccm_format_initial_blocks(uchar_t * nonce,ulong_t nonceSize,ulong_t authDataSize,uint8_t * b0,ccm_ctx_t * aes_ctx)634eda14cbcSMatt Macy ccm_format_initial_blocks(uchar_t *nonce, ulong_t nonceSize,
635eda14cbcSMatt Macy     ulong_t authDataSize, uint8_t *b0, ccm_ctx_t *aes_ctx)
636eda14cbcSMatt Macy {
637eda14cbcSMatt Macy 	uint64_t payloadSize;
638eda14cbcSMatt Macy 	uint8_t t, q, have_adata = 0;
639eda14cbcSMatt Macy 	size_t limit;
640eda14cbcSMatt Macy 	int i, j, k;
641eda14cbcSMatt Macy 	uint64_t mask = 0;
642eda14cbcSMatt Macy 	uint8_t *cb;
643eda14cbcSMatt Macy 
644eda14cbcSMatt Macy 	q = (uint8_t)((15 - nonceSize) & 0xFF);
645eda14cbcSMatt Macy 	t = (uint8_t)((aes_ctx->ccm_mac_len) & 0xFF);
646eda14cbcSMatt Macy 
647eda14cbcSMatt Macy 	/* Construct the first octet of b0 */
648eda14cbcSMatt Macy 	if (authDataSize > 0) {
649eda14cbcSMatt Macy 		have_adata = 1;
650eda14cbcSMatt Macy 	}
651eda14cbcSMatt Macy 	b0[0] = (have_adata << 6) | (((t - 2)  / 2) << 3) | (q - 1);
652eda14cbcSMatt Macy 
653eda14cbcSMatt Macy 	/* copy the nonce value into b0 */
654da5137abSMartin Matuska 	memcpy(&(b0[1]), nonce, nonceSize);
655eda14cbcSMatt Macy 
656eda14cbcSMatt Macy 	/* store the length of the payload into b0 */
657da5137abSMartin Matuska 	memset(&(b0[1+nonceSize]), 0, q);
658eda14cbcSMatt Macy 
659eda14cbcSMatt Macy 	payloadSize = aes_ctx->ccm_data_len;
660*15f0b8c3SMartin Matuska 	limit = MIN(8, q);
661eda14cbcSMatt Macy 
662eda14cbcSMatt Macy 	for (i = 0, j = 0, k = 15; i < limit; i++, j += 8, k--) {
663eda14cbcSMatt Macy 		b0[k] = (uint8_t)((payloadSize >> j) & 0xFF);
664eda14cbcSMatt Macy 	}
665eda14cbcSMatt Macy 
666eda14cbcSMatt Macy 	/* format the counter block */
667eda14cbcSMatt Macy 
668eda14cbcSMatt Macy 	cb = (uint8_t *)aes_ctx->ccm_cb;
669eda14cbcSMatt Macy 
670eda14cbcSMatt Macy 	cb[0] = 0x07 & (q-1); /* first byte */
671eda14cbcSMatt Macy 
672eda14cbcSMatt Macy 	/* copy the nonce value into the counter block */
673da5137abSMartin Matuska 	memcpy(&(cb[1]), nonce, nonceSize);
674eda14cbcSMatt Macy 
675da5137abSMartin Matuska 	memset(&(cb[1+nonceSize]), 0, q);
676eda14cbcSMatt Macy 
677eda14cbcSMatt Macy 	/* Create the mask for the counter field based on the size of nonce */
678eda14cbcSMatt Macy 	q <<= 3;
679eda14cbcSMatt Macy 	while (q-- > 0) {
680eda14cbcSMatt Macy 		mask |= (1ULL << q);
681eda14cbcSMatt Macy 	}
682eda14cbcSMatt Macy 
683eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
684eda14cbcSMatt Macy 	mask = htonll(mask);
685eda14cbcSMatt Macy #endif
686eda14cbcSMatt Macy 	aes_ctx->ccm_counter_mask = mask;
687eda14cbcSMatt Macy 
688eda14cbcSMatt Macy 	/*
689eda14cbcSMatt Macy 	 * During calculation, we start using counter block 1, we will
690eda14cbcSMatt Macy 	 * set it up right here.
691eda14cbcSMatt Macy 	 * We can just set the last byte to have the value 1, because
692eda14cbcSMatt Macy 	 * even with the biggest nonce of 13, the last byte of the
693eda14cbcSMatt Macy 	 * counter block will be used for the counter value.
694eda14cbcSMatt Macy 	 */
695eda14cbcSMatt Macy 	cb[15] = 0x01;
696eda14cbcSMatt Macy }
697eda14cbcSMatt Macy 
698eda14cbcSMatt Macy /*
699eda14cbcSMatt Macy  * Encode the length of the associated data as
700eda14cbcSMatt Macy  * specified in RFC 3610 and NIST publication 800-38C, appendix A
701eda14cbcSMatt Macy  */
702eda14cbcSMatt Macy static void
encode_adata_len(ulong_t auth_data_len,uint8_t * encoded,size_t * encoded_len)703eda14cbcSMatt Macy encode_adata_len(ulong_t auth_data_len, uint8_t *encoded, size_t *encoded_len)
704eda14cbcSMatt Macy {
705eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
706eda14cbcSMatt Macy 	uint32_t	*lencoded_ptr;
707eda14cbcSMatt Macy #ifdef _LP64
708eda14cbcSMatt Macy 	uint64_t	*llencoded_ptr;
709eda14cbcSMatt Macy #endif
710eda14cbcSMatt Macy #endif	/* UNALIGNED_POINTERS_PERMITTED */
711eda14cbcSMatt Macy 
712eda14cbcSMatt Macy 	if (auth_data_len < ((1ULL<<16) - (1ULL<<8))) {
713eda14cbcSMatt Macy 		/* 0 < a < (2^16-2^8) */
714eda14cbcSMatt Macy 		*encoded_len = 2;
715eda14cbcSMatt Macy 		encoded[0] = (auth_data_len & 0xff00) >> 8;
716eda14cbcSMatt Macy 		encoded[1] = auth_data_len & 0xff;
717eda14cbcSMatt Macy 
718eda14cbcSMatt Macy 	} else if ((auth_data_len >= ((1ULL<<16) - (1ULL<<8))) &&
719eda14cbcSMatt Macy 	    (auth_data_len < (1ULL << 31))) {
720eda14cbcSMatt Macy 		/* (2^16-2^8) <= a < 2^32 */
721eda14cbcSMatt Macy 		*encoded_len = 6;
722eda14cbcSMatt Macy 		encoded[0] = 0xff;
723eda14cbcSMatt Macy 		encoded[1] = 0xfe;
724eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
725eda14cbcSMatt Macy 		lencoded_ptr = (uint32_t *)&encoded[2];
726eda14cbcSMatt Macy 		*lencoded_ptr = htonl(auth_data_len);
727eda14cbcSMatt Macy #else
728eda14cbcSMatt Macy 		encoded[2] = (auth_data_len & 0xff000000) >> 24;
729eda14cbcSMatt Macy 		encoded[3] = (auth_data_len & 0xff0000) >> 16;
730eda14cbcSMatt Macy 		encoded[4] = (auth_data_len & 0xff00) >> 8;
731eda14cbcSMatt Macy 		encoded[5] = auth_data_len & 0xff;
732eda14cbcSMatt Macy #endif	/* UNALIGNED_POINTERS_PERMITTED */
733eda14cbcSMatt Macy 
734eda14cbcSMatt Macy #ifdef _LP64
735eda14cbcSMatt Macy 	} else {
736eda14cbcSMatt Macy 		/* 2^32 <= a < 2^64 */
737eda14cbcSMatt Macy 		*encoded_len = 10;
738eda14cbcSMatt Macy 		encoded[0] = 0xff;
739eda14cbcSMatt Macy 		encoded[1] = 0xff;
740eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
741eda14cbcSMatt Macy 		llencoded_ptr = (uint64_t *)&encoded[2];
742eda14cbcSMatt Macy 		*llencoded_ptr = htonl(auth_data_len);
743eda14cbcSMatt Macy #else
744eda14cbcSMatt Macy 		encoded[2] = (auth_data_len & 0xff00000000000000) >> 56;
745eda14cbcSMatt Macy 		encoded[3] = (auth_data_len & 0xff000000000000) >> 48;
746eda14cbcSMatt Macy 		encoded[4] = (auth_data_len & 0xff0000000000) >> 40;
747eda14cbcSMatt Macy 		encoded[5] = (auth_data_len & 0xff00000000) >> 32;
748eda14cbcSMatt Macy 		encoded[6] = (auth_data_len & 0xff000000) >> 24;
749eda14cbcSMatt Macy 		encoded[7] = (auth_data_len & 0xff0000) >> 16;
750eda14cbcSMatt Macy 		encoded[8] = (auth_data_len & 0xff00) >> 8;
751eda14cbcSMatt Macy 		encoded[9] = auth_data_len & 0xff;
752eda14cbcSMatt Macy #endif	/* UNALIGNED_POINTERS_PERMITTED */
753eda14cbcSMatt Macy #endif	/* _LP64 */
754eda14cbcSMatt Macy 	}
755eda14cbcSMatt Macy }
756eda14cbcSMatt Macy 
757eda14cbcSMatt Macy static int
ccm_init(ccm_ctx_t * ctx,unsigned char * nonce,size_t nonce_len,unsigned char * auth_data,size_t auth_data_len,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))758eda14cbcSMatt Macy ccm_init(ccm_ctx_t *ctx, unsigned char *nonce, size_t nonce_len,
759eda14cbcSMatt Macy     unsigned char *auth_data, size_t auth_data_len, size_t block_size,
760eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
761eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
762eda14cbcSMatt Macy {
763eda14cbcSMatt Macy 	uint8_t *mac_buf, *datap, *ivp, *authp;
764eda14cbcSMatt Macy 	size_t remainder, processed;
765eda14cbcSMatt Macy 	uint8_t encoded_a[10]; /* max encoded auth data length is 10 octets */
766eda14cbcSMatt Macy 	size_t encoded_a_len = 0;
767eda14cbcSMatt Macy 
768eda14cbcSMatt Macy 	mac_buf = (uint8_t *)&(ctx->ccm_mac_buf);
769eda14cbcSMatt Macy 
770eda14cbcSMatt Macy 	/*
771eda14cbcSMatt Macy 	 * Format the 1st block for CBC-MAC and construct the
772eda14cbcSMatt Macy 	 * 1st counter block.
773eda14cbcSMatt Macy 	 *
774eda14cbcSMatt Macy 	 * aes_ctx->ccm_iv is used for storing the counter block
775eda14cbcSMatt Macy 	 * mac_buf will store b0 at this time.
776eda14cbcSMatt Macy 	 */
777eda14cbcSMatt Macy 	ccm_format_initial_blocks(nonce, nonce_len,
778eda14cbcSMatt Macy 	    auth_data_len, mac_buf, ctx);
779eda14cbcSMatt Macy 
780eda14cbcSMatt Macy 	/* The IV for CBC MAC for AES CCM mode is always zero */
781eda14cbcSMatt Macy 	ivp = (uint8_t *)ctx->ccm_tmp;
782da5137abSMartin Matuska 	memset(ivp, 0, block_size);
783eda14cbcSMatt Macy 
784eda14cbcSMatt Macy 	xor_block(ivp, mac_buf);
785eda14cbcSMatt Macy 
786eda14cbcSMatt Macy 	/* encrypt the nonce */
787eda14cbcSMatt Macy 	encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
788eda14cbcSMatt Macy 
789eda14cbcSMatt Macy 	/* take care of the associated data, if any */
790eda14cbcSMatt Macy 	if (auth_data_len == 0) {
791eda14cbcSMatt Macy 		return (CRYPTO_SUCCESS);
792eda14cbcSMatt Macy 	}
793eda14cbcSMatt Macy 
794eda14cbcSMatt Macy 	encode_adata_len(auth_data_len, encoded_a, &encoded_a_len);
795eda14cbcSMatt Macy 
796eda14cbcSMatt Macy 	remainder = auth_data_len;
797eda14cbcSMatt Macy 
798eda14cbcSMatt Macy 	/* 1st block: it contains encoded associated data, and some data */
799eda14cbcSMatt Macy 	authp = (uint8_t *)ctx->ccm_tmp;
800da5137abSMartin Matuska 	memset(authp, 0, block_size);
801da5137abSMartin Matuska 	memcpy(authp, encoded_a, encoded_a_len);
802eda14cbcSMatt Macy 	processed = block_size - encoded_a_len;
803eda14cbcSMatt Macy 	if (processed > auth_data_len) {
804eda14cbcSMatt Macy 		/* in case auth_data is very small */
805eda14cbcSMatt Macy 		processed = auth_data_len;
806eda14cbcSMatt Macy 	}
807da5137abSMartin Matuska 	memcpy(authp+encoded_a_len, auth_data, processed);
808eda14cbcSMatt Macy 	/* xor with previous buffer */
809eda14cbcSMatt Macy 	xor_block(authp, mac_buf);
810eda14cbcSMatt Macy 	encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
811eda14cbcSMatt Macy 	remainder -= processed;
812eda14cbcSMatt Macy 	if (remainder == 0) {
813eda14cbcSMatt Macy 		/* a small amount of associated data, it's all done now */
814eda14cbcSMatt Macy 		return (CRYPTO_SUCCESS);
815eda14cbcSMatt Macy 	}
816eda14cbcSMatt Macy 
817eda14cbcSMatt Macy 	do {
818eda14cbcSMatt Macy 		if (remainder < block_size) {
819eda14cbcSMatt Macy 			/*
820eda14cbcSMatt Macy 			 * There's not a block full of data, pad rest of
821eda14cbcSMatt Macy 			 * buffer with zero
822eda14cbcSMatt Macy 			 */
823da5137abSMartin Matuska 			memset(authp, 0, block_size);
824da5137abSMartin Matuska 			memcpy(authp, &(auth_data[processed]), remainder);
825eda14cbcSMatt Macy 			datap = (uint8_t *)authp;
826eda14cbcSMatt Macy 			remainder = 0;
827eda14cbcSMatt Macy 		} else {
828eda14cbcSMatt Macy 			datap = (uint8_t *)(&(auth_data[processed]));
829eda14cbcSMatt Macy 			processed += block_size;
830eda14cbcSMatt Macy 			remainder -= block_size;
831eda14cbcSMatt Macy 		}
832eda14cbcSMatt Macy 
833eda14cbcSMatt Macy 		xor_block(datap, mac_buf);
834eda14cbcSMatt Macy 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
835eda14cbcSMatt Macy 
836eda14cbcSMatt Macy 	} while (remainder > 0);
837eda14cbcSMatt Macy 
838eda14cbcSMatt Macy 	return (CRYPTO_SUCCESS);
839eda14cbcSMatt Macy }
840eda14cbcSMatt Macy 
841eda14cbcSMatt Macy /*
842eda14cbcSMatt Macy  * The following function should be call at encrypt or decrypt init time
843eda14cbcSMatt Macy  * for AES CCM mode.
844eda14cbcSMatt Macy  */
845eda14cbcSMatt Macy int
ccm_init_ctx(ccm_ctx_t * ccm_ctx,char * param,int kmflag,boolean_t is_encrypt_init,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))846eda14cbcSMatt Macy ccm_init_ctx(ccm_ctx_t *ccm_ctx, char *param, int kmflag,
847eda14cbcSMatt Macy     boolean_t is_encrypt_init, size_t block_size,
848eda14cbcSMatt Macy     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
849eda14cbcSMatt Macy     void (*xor_block)(uint8_t *, uint8_t *))
850eda14cbcSMatt Macy {
851eda14cbcSMatt Macy 	int rv;
852eda14cbcSMatt Macy 	CK_AES_CCM_PARAMS *ccm_param;
853eda14cbcSMatt Macy 
854eda14cbcSMatt Macy 	if (param != NULL) {
855eda14cbcSMatt Macy 		ccm_param = (CK_AES_CCM_PARAMS *)param;
856eda14cbcSMatt Macy 
857eda14cbcSMatt Macy 		if ((rv = ccm_validate_args(ccm_param,
858eda14cbcSMatt Macy 		    is_encrypt_init)) != 0) {
859eda14cbcSMatt Macy 			return (rv);
860eda14cbcSMatt Macy 		}
861eda14cbcSMatt Macy 
862eda14cbcSMatt Macy 		ccm_ctx->ccm_mac_len = ccm_param->ulMACSize;
863eda14cbcSMatt Macy 		if (is_encrypt_init) {
864eda14cbcSMatt Macy 			ccm_ctx->ccm_data_len = ccm_param->ulDataSize;
865eda14cbcSMatt Macy 		} else {
866eda14cbcSMatt Macy 			ccm_ctx->ccm_data_len =
867eda14cbcSMatt Macy 			    ccm_param->ulDataSize - ccm_ctx->ccm_mac_len;
868eda14cbcSMatt Macy 			ccm_ctx->ccm_processed_mac_len = 0;
869eda14cbcSMatt Macy 		}
870eda14cbcSMatt Macy 		ccm_ctx->ccm_processed_data_len = 0;
871eda14cbcSMatt Macy 
872eda14cbcSMatt Macy 		ccm_ctx->ccm_flags |= CCM_MODE;
873eda14cbcSMatt Macy 	} else {
874eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
875eda14cbcSMatt Macy 	}
876eda14cbcSMatt Macy 
877eda14cbcSMatt Macy 	if (ccm_init(ccm_ctx, ccm_param->nonce, ccm_param->ulNonceSize,
878eda14cbcSMatt Macy 	    ccm_param->authData, ccm_param->ulAuthDataSize, block_size,
879eda14cbcSMatt Macy 	    encrypt_block, xor_block) != 0) {
880eda14cbcSMatt Macy 		return (CRYPTO_MECHANISM_PARAM_INVALID);
881eda14cbcSMatt Macy 	}
882eda14cbcSMatt Macy 	if (!is_encrypt_init) {
883eda14cbcSMatt Macy 		/* allocate buffer for storing decrypted plaintext */
884eda14cbcSMatt Macy 		ccm_ctx->ccm_pt_buf = vmem_alloc(ccm_ctx->ccm_data_len,
885eda14cbcSMatt Macy 		    kmflag);
886eda14cbcSMatt Macy 		if (ccm_ctx->ccm_pt_buf == NULL) {
887eda14cbcSMatt Macy 			rv = CRYPTO_HOST_MEMORY;
888eda14cbcSMatt Macy 		}
889eda14cbcSMatt Macy 	}
890eda14cbcSMatt Macy 	return (rv);
891eda14cbcSMatt Macy }
892eda14cbcSMatt Macy 
893eda14cbcSMatt Macy void *
ccm_alloc_ctx(int kmflag)894eda14cbcSMatt Macy ccm_alloc_ctx(int kmflag)
895eda14cbcSMatt Macy {
896eda14cbcSMatt Macy 	ccm_ctx_t *ccm_ctx;
897eda14cbcSMatt Macy 
898eda14cbcSMatt Macy 	if ((ccm_ctx = kmem_zalloc(sizeof (ccm_ctx_t), kmflag)) == NULL)
899eda14cbcSMatt Macy 		return (NULL);
900eda14cbcSMatt Macy 
901eda14cbcSMatt Macy 	ccm_ctx->ccm_flags = CCM_MODE;
902eda14cbcSMatt Macy 	return (ccm_ctx);
903eda14cbcSMatt Macy }
904