1eda14cbcSMatt Macy /*
2eda14cbcSMatt Macy * CDDL HEADER START
3eda14cbcSMatt Macy *
4eda14cbcSMatt Macy * The contents of this file are subject to the terms of the
5eda14cbcSMatt Macy * Common Development and Distribution License (the "License").
6eda14cbcSMatt Macy * You may not use this file except in compliance with the License.
7eda14cbcSMatt Macy *
8eda14cbcSMatt Macy * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9271171e0SMartin Matuska * or https://opensource.org/licenses/CDDL-1.0.
10eda14cbcSMatt Macy * See the License for the specific language governing permissions
11eda14cbcSMatt Macy * and limitations under the License.
12eda14cbcSMatt Macy *
13eda14cbcSMatt Macy * When distributing Covered Code, include this CDDL HEADER in each
14eda14cbcSMatt Macy * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15eda14cbcSMatt Macy * If applicable, add the following below this CDDL HEADER, with the
16eda14cbcSMatt Macy * fields enclosed by brackets "[]" replaced with your own identifying
17eda14cbcSMatt Macy * information: Portions Copyright [yyyy] [name of copyright owner]
18eda14cbcSMatt Macy *
19eda14cbcSMatt Macy * CDDL HEADER END
20eda14cbcSMatt Macy */
21eda14cbcSMatt Macy /*
22eda14cbcSMatt Macy * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
23eda14cbcSMatt Macy * Use is subject to license terms.
24eda14cbcSMatt Macy */
25eda14cbcSMatt Macy
26eda14cbcSMatt Macy #include <sys/zfs_context.h>
27eda14cbcSMatt Macy #include <modes/modes.h>
28eda14cbcSMatt Macy #include <sys/crypto/common.h>
29eda14cbcSMatt Macy #include <sys/crypto/impl.h>
30eda14cbcSMatt Macy
31eda14cbcSMatt Macy #ifdef HAVE_EFFICIENT_UNALIGNED_ACCESS
32eda14cbcSMatt Macy #include <sys/byteorder.h>
33eda14cbcSMatt Macy #define UNALIGNED_POINTERS_PERMITTED
34eda14cbcSMatt Macy #endif
35eda14cbcSMatt Macy
36eda14cbcSMatt Macy /*
37eda14cbcSMatt Macy * Encrypt multiple blocks of data in CCM mode. Decrypt for CCM mode
38eda14cbcSMatt Macy * is done in another function.
39eda14cbcSMatt Macy */
40eda14cbcSMatt Macy int
ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))41eda14cbcSMatt Macy ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
42eda14cbcSMatt Macy crypto_data_t *out, size_t block_size,
43eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
44eda14cbcSMatt Macy void (*copy_block)(uint8_t *, uint8_t *),
45eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
46eda14cbcSMatt Macy {
47eda14cbcSMatt Macy size_t remainder = length;
48eda14cbcSMatt Macy size_t need = 0;
49eda14cbcSMatt Macy uint8_t *datap = (uint8_t *)data;
50eda14cbcSMatt Macy uint8_t *blockp;
51eda14cbcSMatt Macy uint8_t *lastp;
52eda14cbcSMatt Macy void *iov_or_mp;
53eda14cbcSMatt Macy offset_t offset;
54eda14cbcSMatt Macy uint8_t *out_data_1;
55eda14cbcSMatt Macy uint8_t *out_data_2;
56eda14cbcSMatt Macy size_t out_data_1_len;
57eda14cbcSMatt Macy uint64_t counter;
58eda14cbcSMatt Macy uint8_t *mac_buf;
59eda14cbcSMatt Macy
60eda14cbcSMatt Macy if (length + ctx->ccm_remainder_len < block_size) {
61eda14cbcSMatt Macy /* accumulate bytes here and return */
62da5137abSMartin Matuska memcpy((uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
63da5137abSMartin Matuska datap,
64eda14cbcSMatt Macy length);
65eda14cbcSMatt Macy ctx->ccm_remainder_len += length;
66eda14cbcSMatt Macy ctx->ccm_copy_to = datap;
67eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
68eda14cbcSMatt Macy }
69eda14cbcSMatt Macy
70eda14cbcSMatt Macy crypto_init_ptrs(out, &iov_or_mp, &offset);
71eda14cbcSMatt Macy
72eda14cbcSMatt Macy mac_buf = (uint8_t *)ctx->ccm_mac_buf;
73eda14cbcSMatt Macy
74eda14cbcSMatt Macy do {
75eda14cbcSMatt Macy /* Unprocessed data from last call. */
76eda14cbcSMatt Macy if (ctx->ccm_remainder_len > 0) {
77eda14cbcSMatt Macy need = block_size - ctx->ccm_remainder_len;
78eda14cbcSMatt Macy
79eda14cbcSMatt Macy if (need > remainder)
80eda14cbcSMatt Macy return (CRYPTO_DATA_LEN_RANGE);
81eda14cbcSMatt Macy
82da5137abSMartin Matuska memcpy(&((uint8_t *)ctx->ccm_remainder)
83da5137abSMartin Matuska [ctx->ccm_remainder_len], datap, need);
84eda14cbcSMatt Macy
85eda14cbcSMatt Macy blockp = (uint8_t *)ctx->ccm_remainder;
86eda14cbcSMatt Macy } else {
87eda14cbcSMatt Macy blockp = datap;
88eda14cbcSMatt Macy }
89eda14cbcSMatt Macy
90eda14cbcSMatt Macy /*
91eda14cbcSMatt Macy * do CBC MAC
92eda14cbcSMatt Macy *
93eda14cbcSMatt Macy * XOR the previous cipher block current clear block.
94eda14cbcSMatt Macy * mac_buf always contain previous cipher block.
95eda14cbcSMatt Macy */
96eda14cbcSMatt Macy xor_block(blockp, mac_buf);
97eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
98eda14cbcSMatt Macy
99eda14cbcSMatt Macy /* ccm_cb is the counter block */
100eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb,
101eda14cbcSMatt Macy (uint8_t *)ctx->ccm_tmp);
102eda14cbcSMatt Macy
103eda14cbcSMatt Macy lastp = (uint8_t *)ctx->ccm_tmp;
104eda14cbcSMatt Macy
105eda14cbcSMatt Macy /*
106eda14cbcSMatt Macy * Increment counter. Counter bits are confined
107eda14cbcSMatt Macy * to the bottom 64 bits of the counter block.
108eda14cbcSMatt Macy */
109eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
110eda14cbcSMatt Macy counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
111eda14cbcSMatt Macy counter = htonll(counter + 1);
112eda14cbcSMatt Macy #else
113eda14cbcSMatt Macy counter = ctx->ccm_cb[1] & ctx->ccm_counter_mask;
114eda14cbcSMatt Macy counter++;
115eda14cbcSMatt Macy #endif /* _ZFS_LITTLE_ENDIAN */
116eda14cbcSMatt Macy counter &= ctx->ccm_counter_mask;
117eda14cbcSMatt Macy ctx->ccm_cb[1] =
118eda14cbcSMatt Macy (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
119eda14cbcSMatt Macy
120eda14cbcSMatt Macy /*
121eda14cbcSMatt Macy * XOR encrypted counter block with the current clear block.
122eda14cbcSMatt Macy */
123eda14cbcSMatt Macy xor_block(blockp, lastp);
124eda14cbcSMatt Macy
125eda14cbcSMatt Macy ctx->ccm_processed_data_len += block_size;
126eda14cbcSMatt Macy
127eda14cbcSMatt Macy crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
128eda14cbcSMatt Macy &out_data_1_len, &out_data_2, block_size);
129eda14cbcSMatt Macy
130eda14cbcSMatt Macy /* copy block to where it belongs */
131eda14cbcSMatt Macy if (out_data_1_len == block_size) {
132eda14cbcSMatt Macy copy_block(lastp, out_data_1);
133eda14cbcSMatt Macy } else {
134da5137abSMartin Matuska memcpy(out_data_1, lastp, out_data_1_len);
135eda14cbcSMatt Macy if (out_data_2 != NULL) {
136da5137abSMartin Matuska memcpy(out_data_2,
137da5137abSMartin Matuska lastp + out_data_1_len,
138eda14cbcSMatt Macy block_size - out_data_1_len);
139eda14cbcSMatt Macy }
140eda14cbcSMatt Macy }
141eda14cbcSMatt Macy /* update offset */
142eda14cbcSMatt Macy out->cd_offset += block_size;
143eda14cbcSMatt Macy
144eda14cbcSMatt Macy /* Update pointer to next block of data to be processed. */
145eda14cbcSMatt Macy if (ctx->ccm_remainder_len != 0) {
146eda14cbcSMatt Macy datap += need;
147eda14cbcSMatt Macy ctx->ccm_remainder_len = 0;
148eda14cbcSMatt Macy } else {
149eda14cbcSMatt Macy datap += block_size;
150eda14cbcSMatt Macy }
151eda14cbcSMatt Macy
152eda14cbcSMatt Macy remainder = (size_t)&data[length] - (size_t)datap;
153eda14cbcSMatt Macy
154eda14cbcSMatt Macy /* Incomplete last block. */
155eda14cbcSMatt Macy if (remainder > 0 && remainder < block_size) {
156da5137abSMartin Matuska memcpy(ctx->ccm_remainder, datap, remainder);
157eda14cbcSMatt Macy ctx->ccm_remainder_len = remainder;
158eda14cbcSMatt Macy ctx->ccm_copy_to = datap;
159eda14cbcSMatt Macy goto out;
160eda14cbcSMatt Macy }
161eda14cbcSMatt Macy ctx->ccm_copy_to = NULL;
162eda14cbcSMatt Macy
163eda14cbcSMatt Macy } while (remainder > 0);
164eda14cbcSMatt Macy
165eda14cbcSMatt Macy out:
166eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
167eda14cbcSMatt Macy }
168eda14cbcSMatt Macy
169eda14cbcSMatt Macy void
calculate_ccm_mac(ccm_ctx_t * ctx,uint8_t * ccm_mac,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))170eda14cbcSMatt Macy calculate_ccm_mac(ccm_ctx_t *ctx, uint8_t *ccm_mac,
171eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
172eda14cbcSMatt Macy {
173eda14cbcSMatt Macy uint64_t counter;
174eda14cbcSMatt Macy uint8_t *counterp, *mac_buf;
175eda14cbcSMatt Macy int i;
176eda14cbcSMatt Macy
177eda14cbcSMatt Macy mac_buf = (uint8_t *)ctx->ccm_mac_buf;
178eda14cbcSMatt Macy
179eda14cbcSMatt Macy /* first counter block start with index 0 */
180eda14cbcSMatt Macy counter = 0;
181eda14cbcSMatt Macy ctx->ccm_cb[1] = (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
182eda14cbcSMatt Macy
183eda14cbcSMatt Macy counterp = (uint8_t *)ctx->ccm_tmp;
184eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
185eda14cbcSMatt Macy
186eda14cbcSMatt Macy /* calculate XOR of MAC with first counter block */
187eda14cbcSMatt Macy for (i = 0; i < ctx->ccm_mac_len; i++) {
188eda14cbcSMatt Macy ccm_mac[i] = mac_buf[i] ^ counterp[i];
189eda14cbcSMatt Macy }
190eda14cbcSMatt Macy }
191eda14cbcSMatt Macy
192eda14cbcSMatt Macy int
ccm_encrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))193eda14cbcSMatt Macy ccm_encrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
194eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
195eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
196eda14cbcSMatt Macy {
197eda14cbcSMatt Macy uint8_t *lastp, *mac_buf, *ccm_mac_p, *macp = NULL;
198eda14cbcSMatt Macy void *iov_or_mp;
199eda14cbcSMatt Macy offset_t offset;
200eda14cbcSMatt Macy uint8_t *out_data_1;
201eda14cbcSMatt Macy uint8_t *out_data_2;
202eda14cbcSMatt Macy size_t out_data_1_len;
203eda14cbcSMatt Macy int i;
204eda14cbcSMatt Macy
205eda14cbcSMatt Macy if (out->cd_length < (ctx->ccm_remainder_len + ctx->ccm_mac_len)) {
206eda14cbcSMatt Macy return (CRYPTO_DATA_LEN_RANGE);
207eda14cbcSMatt Macy }
208eda14cbcSMatt Macy
209eda14cbcSMatt Macy /*
210eda14cbcSMatt Macy * When we get here, the number of bytes of payload processed
211eda14cbcSMatt Macy * plus whatever data remains, if any,
212eda14cbcSMatt Macy * should be the same as the number of bytes that's being
213eda14cbcSMatt Macy * passed in the argument during init time.
214eda14cbcSMatt Macy */
215eda14cbcSMatt Macy if ((ctx->ccm_processed_data_len + ctx->ccm_remainder_len)
216eda14cbcSMatt Macy != (ctx->ccm_data_len)) {
217eda14cbcSMatt Macy return (CRYPTO_DATA_LEN_RANGE);
218eda14cbcSMatt Macy }
219eda14cbcSMatt Macy
220eda14cbcSMatt Macy mac_buf = (uint8_t *)ctx->ccm_mac_buf;
221eda14cbcSMatt Macy
222eda14cbcSMatt Macy if (ctx->ccm_remainder_len > 0) {
223eda14cbcSMatt Macy
224eda14cbcSMatt Macy /* ccm_mac_input_buf is not used for encryption */
225eda14cbcSMatt Macy macp = (uint8_t *)ctx->ccm_mac_input_buf;
226da5137abSMartin Matuska memset(macp, 0, block_size);
227eda14cbcSMatt Macy
228eda14cbcSMatt Macy /* copy remainder to temporary buffer */
229da5137abSMartin Matuska memcpy(macp, ctx->ccm_remainder, ctx->ccm_remainder_len);
230eda14cbcSMatt Macy
231eda14cbcSMatt Macy /* calculate the CBC MAC */
232eda14cbcSMatt Macy xor_block(macp, mac_buf);
233eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
234eda14cbcSMatt Macy
235eda14cbcSMatt Macy /* calculate the counter mode */
236eda14cbcSMatt Macy lastp = (uint8_t *)ctx->ccm_tmp;
237eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, lastp);
238eda14cbcSMatt Macy
239eda14cbcSMatt Macy /* XOR with counter block */
240eda14cbcSMatt Macy for (i = 0; i < ctx->ccm_remainder_len; i++) {
241eda14cbcSMatt Macy macp[i] ^= lastp[i];
242eda14cbcSMatt Macy }
243eda14cbcSMatt Macy ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
244eda14cbcSMatt Macy }
245eda14cbcSMatt Macy
246eda14cbcSMatt Macy /* Calculate the CCM MAC */
247eda14cbcSMatt Macy ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
248eda14cbcSMatt Macy calculate_ccm_mac(ctx, ccm_mac_p, encrypt_block);
249eda14cbcSMatt Macy
250eda14cbcSMatt Macy crypto_init_ptrs(out, &iov_or_mp, &offset);
251eda14cbcSMatt Macy crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
252eda14cbcSMatt Macy &out_data_1_len, &out_data_2,
253eda14cbcSMatt Macy ctx->ccm_remainder_len + ctx->ccm_mac_len);
254eda14cbcSMatt Macy
255eda14cbcSMatt Macy if (ctx->ccm_remainder_len > 0) {
256eda14cbcSMatt Macy /* copy temporary block to where it belongs */
257eda14cbcSMatt Macy if (out_data_2 == NULL) {
258eda14cbcSMatt Macy /* everything will fit in out_data_1 */
259da5137abSMartin Matuska memcpy(out_data_1, macp, ctx->ccm_remainder_len);
260da5137abSMartin Matuska memcpy(out_data_1 + ctx->ccm_remainder_len, ccm_mac_p,
261eda14cbcSMatt Macy ctx->ccm_mac_len);
262eda14cbcSMatt Macy } else {
263eda14cbcSMatt Macy if (out_data_1_len < ctx->ccm_remainder_len) {
264eda14cbcSMatt Macy size_t data_2_len_used;
265eda14cbcSMatt Macy
266da5137abSMartin Matuska memcpy(out_data_1, macp, out_data_1_len);
267eda14cbcSMatt Macy
268eda14cbcSMatt Macy data_2_len_used = ctx->ccm_remainder_len
269eda14cbcSMatt Macy - out_data_1_len;
270eda14cbcSMatt Macy
271da5137abSMartin Matuska memcpy(out_data_2,
272da5137abSMartin Matuska (uint8_t *)macp + out_data_1_len,
273da5137abSMartin Matuska data_2_len_used);
274da5137abSMartin Matuska memcpy(out_data_2 + data_2_len_used,
275da5137abSMartin Matuska ccm_mac_p,
276eda14cbcSMatt Macy ctx->ccm_mac_len);
277eda14cbcSMatt Macy } else {
278da5137abSMartin Matuska memcpy(out_data_1, macp, out_data_1_len);
279eda14cbcSMatt Macy if (out_data_1_len == ctx->ccm_remainder_len) {
280eda14cbcSMatt Macy /* mac will be in out_data_2 */
281da5137abSMartin Matuska memcpy(out_data_2, ccm_mac_p,
282eda14cbcSMatt Macy ctx->ccm_mac_len);
283eda14cbcSMatt Macy } else {
284eda14cbcSMatt Macy size_t len_not_used = out_data_1_len -
285eda14cbcSMatt Macy ctx->ccm_remainder_len;
286eda14cbcSMatt Macy /*
287eda14cbcSMatt Macy * part of mac in will be in
288eda14cbcSMatt Macy * out_data_1, part of the mac will be
289eda14cbcSMatt Macy * in out_data_2
290eda14cbcSMatt Macy */
291da5137abSMartin Matuska memcpy(out_data_1 +
292da5137abSMartin Matuska ctx->ccm_remainder_len,
293da5137abSMartin Matuska ccm_mac_p, len_not_used);
294da5137abSMartin Matuska memcpy(out_data_2,
295da5137abSMartin Matuska ccm_mac_p + len_not_used,
296eda14cbcSMatt Macy ctx->ccm_mac_len - len_not_used);
297eda14cbcSMatt Macy
298eda14cbcSMatt Macy }
299eda14cbcSMatt Macy }
300eda14cbcSMatt Macy }
301eda14cbcSMatt Macy } else {
302eda14cbcSMatt Macy /* copy block to where it belongs */
303da5137abSMartin Matuska memcpy(out_data_1, ccm_mac_p, out_data_1_len);
304eda14cbcSMatt Macy if (out_data_2 != NULL) {
305da5137abSMartin Matuska memcpy(out_data_2, ccm_mac_p + out_data_1_len,
306eda14cbcSMatt Macy block_size - out_data_1_len);
307eda14cbcSMatt Macy }
308eda14cbcSMatt Macy }
309eda14cbcSMatt Macy out->cd_offset += ctx->ccm_remainder_len + ctx->ccm_mac_len;
310eda14cbcSMatt Macy ctx->ccm_remainder_len = 0;
311eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
312eda14cbcSMatt Macy }
313eda14cbcSMatt Macy
314eda14cbcSMatt Macy /*
315eda14cbcSMatt Macy * This will only deal with decrypting the last block of the input that
316eda14cbcSMatt Macy * might not be a multiple of block length.
317eda14cbcSMatt Macy */
318eda14cbcSMatt Macy static void
ccm_decrypt_incomplete_block(ccm_ctx_t * ctx,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))319eda14cbcSMatt Macy ccm_decrypt_incomplete_block(ccm_ctx_t *ctx,
320eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
321eda14cbcSMatt Macy {
322eda14cbcSMatt Macy uint8_t *datap, *outp, *counterp;
323eda14cbcSMatt Macy int i;
324eda14cbcSMatt Macy
325eda14cbcSMatt Macy datap = (uint8_t *)ctx->ccm_remainder;
326eda14cbcSMatt Macy outp = &((ctx->ccm_pt_buf)[ctx->ccm_processed_data_len]);
327eda14cbcSMatt Macy
328eda14cbcSMatt Macy counterp = (uint8_t *)ctx->ccm_tmp;
329eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
330eda14cbcSMatt Macy
331eda14cbcSMatt Macy /* XOR with counter block */
332eda14cbcSMatt Macy for (i = 0; i < ctx->ccm_remainder_len; i++) {
333eda14cbcSMatt Macy outp[i] = datap[i] ^ counterp[i];
334eda14cbcSMatt Macy }
335eda14cbcSMatt Macy }
336eda14cbcSMatt Macy
337eda14cbcSMatt Macy /*
338eda14cbcSMatt Macy * This will decrypt the cipher text. However, the plaintext won't be
339eda14cbcSMatt Macy * returned to the caller. It will be returned when decrypt_final() is
340eda14cbcSMatt Macy * called if the MAC matches
341eda14cbcSMatt Macy */
342eda14cbcSMatt Macy int
ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))343eda14cbcSMatt Macy ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
344eda14cbcSMatt Macy crypto_data_t *out, size_t block_size,
345eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
346eda14cbcSMatt Macy void (*copy_block)(uint8_t *, uint8_t *),
347eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
348eda14cbcSMatt Macy {
349e92ffd9bSMartin Matuska (void) out;
350eda14cbcSMatt Macy size_t remainder = length;
351eda14cbcSMatt Macy size_t need = 0;
352eda14cbcSMatt Macy uint8_t *datap = (uint8_t *)data;
353eda14cbcSMatt Macy uint8_t *blockp;
354eda14cbcSMatt Macy uint8_t *cbp;
355eda14cbcSMatt Macy uint64_t counter;
356eda14cbcSMatt Macy size_t pt_len, total_decrypted_len, mac_len, pm_len, pd_len;
357eda14cbcSMatt Macy uint8_t *resultp;
358eda14cbcSMatt Macy
359eda14cbcSMatt Macy
360eda14cbcSMatt Macy pm_len = ctx->ccm_processed_mac_len;
361eda14cbcSMatt Macy
362eda14cbcSMatt Macy if (pm_len > 0) {
363eda14cbcSMatt Macy uint8_t *tmp;
364eda14cbcSMatt Macy /*
365eda14cbcSMatt Macy * all ciphertext has been processed, just waiting for
366eda14cbcSMatt Macy * part of the value of the mac
367eda14cbcSMatt Macy */
368eda14cbcSMatt Macy if ((pm_len + length) > ctx->ccm_mac_len) {
369eda14cbcSMatt Macy return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
370eda14cbcSMatt Macy }
371eda14cbcSMatt Macy tmp = (uint8_t *)ctx->ccm_mac_input_buf;
372eda14cbcSMatt Macy
373da5137abSMartin Matuska memcpy(tmp + pm_len, datap, length);
374eda14cbcSMatt Macy
375eda14cbcSMatt Macy ctx->ccm_processed_mac_len += length;
376eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
377eda14cbcSMatt Macy }
378eda14cbcSMatt Macy
379eda14cbcSMatt Macy /*
380eda14cbcSMatt Macy * If we decrypt the given data, what total amount of data would
381eda14cbcSMatt Macy * have been decrypted?
382eda14cbcSMatt Macy */
383eda14cbcSMatt Macy pd_len = ctx->ccm_processed_data_len;
384eda14cbcSMatt Macy total_decrypted_len = pd_len + length + ctx->ccm_remainder_len;
385eda14cbcSMatt Macy
386eda14cbcSMatt Macy if (total_decrypted_len >
387eda14cbcSMatt Macy (ctx->ccm_data_len + ctx->ccm_mac_len)) {
388eda14cbcSMatt Macy return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
389eda14cbcSMatt Macy }
390eda14cbcSMatt Macy
391eda14cbcSMatt Macy pt_len = ctx->ccm_data_len;
392eda14cbcSMatt Macy
393eda14cbcSMatt Macy if (total_decrypted_len > pt_len) {
394eda14cbcSMatt Macy /*
395eda14cbcSMatt Macy * part of the input will be the MAC, need to isolate that
396eda14cbcSMatt Macy * to be dealt with later. The left-over data in
397eda14cbcSMatt Macy * ccm_remainder_len from last time will not be part of the
398eda14cbcSMatt Macy * MAC. Otherwise, it would have already been taken out
399eda14cbcSMatt Macy * when this call is made last time.
400eda14cbcSMatt Macy */
401eda14cbcSMatt Macy size_t pt_part = pt_len - pd_len - ctx->ccm_remainder_len;
402eda14cbcSMatt Macy
403eda14cbcSMatt Macy mac_len = length - pt_part;
404eda14cbcSMatt Macy
405eda14cbcSMatt Macy ctx->ccm_processed_mac_len = mac_len;
406da5137abSMartin Matuska memcpy(ctx->ccm_mac_input_buf, data + pt_part, mac_len);
407eda14cbcSMatt Macy
408eda14cbcSMatt Macy if (pt_part + ctx->ccm_remainder_len < block_size) {
409eda14cbcSMatt Macy /*
410eda14cbcSMatt Macy * since this is last of the ciphertext, will
411eda14cbcSMatt Macy * just decrypt with it here
412eda14cbcSMatt Macy */
413da5137abSMartin Matuska memcpy(&((uint8_t *)ctx->ccm_remainder)
414da5137abSMartin Matuska [ctx->ccm_remainder_len], datap, pt_part);
415eda14cbcSMatt Macy ctx->ccm_remainder_len += pt_part;
416eda14cbcSMatt Macy ccm_decrypt_incomplete_block(ctx, encrypt_block);
417eda14cbcSMatt Macy ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
418eda14cbcSMatt Macy ctx->ccm_remainder_len = 0;
419eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
420eda14cbcSMatt Macy } else {
421eda14cbcSMatt Macy /* let rest of the code handle this */
422eda14cbcSMatt Macy length = pt_part;
423eda14cbcSMatt Macy }
424eda14cbcSMatt Macy } else if (length + ctx->ccm_remainder_len < block_size) {
425eda14cbcSMatt Macy /* accumulate bytes here and return */
426da5137abSMartin Matuska memcpy((uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
427da5137abSMartin Matuska datap,
428eda14cbcSMatt Macy length);
429eda14cbcSMatt Macy ctx->ccm_remainder_len += length;
430eda14cbcSMatt Macy ctx->ccm_copy_to = datap;
431eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
432eda14cbcSMatt Macy }
433eda14cbcSMatt Macy
434eda14cbcSMatt Macy do {
435eda14cbcSMatt Macy /* Unprocessed data from last call. */
436eda14cbcSMatt Macy if (ctx->ccm_remainder_len > 0) {
437eda14cbcSMatt Macy need = block_size - ctx->ccm_remainder_len;
438eda14cbcSMatt Macy
439eda14cbcSMatt Macy if (need > remainder)
440eda14cbcSMatt Macy return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
441eda14cbcSMatt Macy
442da5137abSMartin Matuska memcpy(&((uint8_t *)ctx->ccm_remainder)
443da5137abSMartin Matuska [ctx->ccm_remainder_len], datap, need);
444eda14cbcSMatt Macy
445eda14cbcSMatt Macy blockp = (uint8_t *)ctx->ccm_remainder;
446eda14cbcSMatt Macy } else {
447eda14cbcSMatt Macy blockp = datap;
448eda14cbcSMatt Macy }
449eda14cbcSMatt Macy
450eda14cbcSMatt Macy /* Calculate the counter mode, ccm_cb is the counter block */
451eda14cbcSMatt Macy cbp = (uint8_t *)ctx->ccm_tmp;
452eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, cbp);
453eda14cbcSMatt Macy
454eda14cbcSMatt Macy /*
455eda14cbcSMatt Macy * Increment counter.
456eda14cbcSMatt Macy * Counter bits are confined to the bottom 64 bits
457eda14cbcSMatt Macy */
458eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
459eda14cbcSMatt Macy counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
460eda14cbcSMatt Macy counter = htonll(counter + 1);
461eda14cbcSMatt Macy #else
462eda14cbcSMatt Macy counter = ctx->ccm_cb[1] & ctx->ccm_counter_mask;
463eda14cbcSMatt Macy counter++;
464eda14cbcSMatt Macy #endif /* _ZFS_LITTLE_ENDIAN */
465eda14cbcSMatt Macy counter &= ctx->ccm_counter_mask;
466eda14cbcSMatt Macy ctx->ccm_cb[1] =
467eda14cbcSMatt Macy (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
468eda14cbcSMatt Macy
469eda14cbcSMatt Macy /* XOR with the ciphertext */
470eda14cbcSMatt Macy xor_block(blockp, cbp);
471eda14cbcSMatt Macy
472eda14cbcSMatt Macy /* Copy the plaintext to the "holding buffer" */
473eda14cbcSMatt Macy resultp = (uint8_t *)ctx->ccm_pt_buf +
474eda14cbcSMatt Macy ctx->ccm_processed_data_len;
475eda14cbcSMatt Macy copy_block(cbp, resultp);
476eda14cbcSMatt Macy
477eda14cbcSMatt Macy ctx->ccm_processed_data_len += block_size;
478eda14cbcSMatt Macy
479eda14cbcSMatt Macy ctx->ccm_lastp = blockp;
480eda14cbcSMatt Macy
481eda14cbcSMatt Macy /* Update pointer to next block of data to be processed. */
482eda14cbcSMatt Macy if (ctx->ccm_remainder_len != 0) {
483eda14cbcSMatt Macy datap += need;
484eda14cbcSMatt Macy ctx->ccm_remainder_len = 0;
485eda14cbcSMatt Macy } else {
486eda14cbcSMatt Macy datap += block_size;
487eda14cbcSMatt Macy }
488eda14cbcSMatt Macy
489eda14cbcSMatt Macy remainder = (size_t)&data[length] - (size_t)datap;
490eda14cbcSMatt Macy
491eda14cbcSMatt Macy /* Incomplete last block */
492eda14cbcSMatt Macy if (remainder > 0 && remainder < block_size) {
493da5137abSMartin Matuska memcpy(ctx->ccm_remainder, datap, remainder);
494eda14cbcSMatt Macy ctx->ccm_remainder_len = remainder;
495eda14cbcSMatt Macy ctx->ccm_copy_to = datap;
496eda14cbcSMatt Macy if (ctx->ccm_processed_mac_len > 0) {
497eda14cbcSMatt Macy /*
498eda14cbcSMatt Macy * not expecting anymore ciphertext, just
499eda14cbcSMatt Macy * compute plaintext for the remaining input
500eda14cbcSMatt Macy */
501eda14cbcSMatt Macy ccm_decrypt_incomplete_block(ctx,
502eda14cbcSMatt Macy encrypt_block);
503eda14cbcSMatt Macy ctx->ccm_processed_data_len += remainder;
504eda14cbcSMatt Macy ctx->ccm_remainder_len = 0;
505eda14cbcSMatt Macy }
506eda14cbcSMatt Macy goto out;
507eda14cbcSMatt Macy }
508eda14cbcSMatt Macy ctx->ccm_copy_to = NULL;
509eda14cbcSMatt Macy
510eda14cbcSMatt Macy } while (remainder > 0);
511eda14cbcSMatt Macy
512eda14cbcSMatt Macy out:
513eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
514eda14cbcSMatt Macy }
515eda14cbcSMatt Macy
516eda14cbcSMatt Macy int
ccm_decrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))517eda14cbcSMatt Macy ccm_decrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
518eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
519eda14cbcSMatt Macy void (*copy_block)(uint8_t *, uint8_t *),
520eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
521eda14cbcSMatt Macy {
522eda14cbcSMatt Macy size_t mac_remain, pt_len;
523eda14cbcSMatt Macy uint8_t *pt, *mac_buf, *macp, *ccm_mac_p;
524eda14cbcSMatt Macy int rv;
525eda14cbcSMatt Macy
526eda14cbcSMatt Macy pt_len = ctx->ccm_data_len;
527eda14cbcSMatt Macy
528eda14cbcSMatt Macy /* Make sure output buffer can fit all of the plaintext */
529eda14cbcSMatt Macy if (out->cd_length < pt_len) {
530eda14cbcSMatt Macy return (CRYPTO_DATA_LEN_RANGE);
531eda14cbcSMatt Macy }
532eda14cbcSMatt Macy
533eda14cbcSMatt Macy pt = ctx->ccm_pt_buf;
534eda14cbcSMatt Macy mac_remain = ctx->ccm_processed_data_len;
535eda14cbcSMatt Macy mac_buf = (uint8_t *)ctx->ccm_mac_buf;
536eda14cbcSMatt Macy
537eda14cbcSMatt Macy macp = (uint8_t *)ctx->ccm_tmp;
538eda14cbcSMatt Macy
539eda14cbcSMatt Macy while (mac_remain > 0) {
540eda14cbcSMatt Macy if (mac_remain < block_size) {
541da5137abSMartin Matuska memset(macp, 0, block_size);
542da5137abSMartin Matuska memcpy(macp, pt, mac_remain);
543eda14cbcSMatt Macy mac_remain = 0;
544eda14cbcSMatt Macy } else {
545eda14cbcSMatt Macy copy_block(pt, macp);
546eda14cbcSMatt Macy mac_remain -= block_size;
547eda14cbcSMatt Macy pt += block_size;
548eda14cbcSMatt Macy }
549eda14cbcSMatt Macy
550eda14cbcSMatt Macy /* calculate the CBC MAC */
551eda14cbcSMatt Macy xor_block(macp, mac_buf);
552eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
553eda14cbcSMatt Macy }
554eda14cbcSMatt Macy
555eda14cbcSMatt Macy /* Calculate the CCM MAC */
556eda14cbcSMatt Macy ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
557eda14cbcSMatt Macy calculate_ccm_mac((ccm_ctx_t *)ctx, ccm_mac_p, encrypt_block);
558eda14cbcSMatt Macy
559eda14cbcSMatt Macy /* compare the input CCM MAC value with what we calculated */
560da5137abSMartin Matuska if (memcmp(ctx->ccm_mac_input_buf, ccm_mac_p, ctx->ccm_mac_len)) {
561eda14cbcSMatt Macy /* They don't match */
562eda14cbcSMatt Macy return (CRYPTO_INVALID_MAC);
563eda14cbcSMatt Macy } else {
564eda14cbcSMatt Macy rv = crypto_put_output_data(ctx->ccm_pt_buf, out, pt_len);
565eda14cbcSMatt Macy if (rv != CRYPTO_SUCCESS)
566eda14cbcSMatt Macy return (rv);
567eda14cbcSMatt Macy out->cd_offset += pt_len;
568eda14cbcSMatt Macy }
569eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
570eda14cbcSMatt Macy }
571eda14cbcSMatt Macy
572eda14cbcSMatt Macy static int
ccm_validate_args(CK_AES_CCM_PARAMS * ccm_param,boolean_t is_encrypt_init)573eda14cbcSMatt Macy ccm_validate_args(CK_AES_CCM_PARAMS *ccm_param, boolean_t is_encrypt_init)
574eda14cbcSMatt Macy {
575eda14cbcSMatt Macy size_t macSize, nonceSize;
576eda14cbcSMatt Macy uint8_t q;
577eda14cbcSMatt Macy uint64_t maxValue;
578eda14cbcSMatt Macy
579eda14cbcSMatt Macy /*
580eda14cbcSMatt Macy * Check the length of the MAC. The only valid
581eda14cbcSMatt Macy * lengths for the MAC are: 4, 6, 8, 10, 12, 14, 16
582eda14cbcSMatt Macy */
583eda14cbcSMatt Macy macSize = ccm_param->ulMACSize;
584eda14cbcSMatt Macy if ((macSize < 4) || (macSize > 16) || ((macSize % 2) != 0)) {
585eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
586eda14cbcSMatt Macy }
587eda14cbcSMatt Macy
588eda14cbcSMatt Macy /* Check the nonce length. Valid values are 7, 8, 9, 10, 11, 12, 13 */
589eda14cbcSMatt Macy nonceSize = ccm_param->ulNonceSize;
590eda14cbcSMatt Macy if ((nonceSize < 7) || (nonceSize > 13)) {
591eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
592eda14cbcSMatt Macy }
593eda14cbcSMatt Macy
594eda14cbcSMatt Macy /* q is the length of the field storing the length, in bytes */
595eda14cbcSMatt Macy q = (uint8_t)((15 - nonceSize) & 0xFF);
596eda14cbcSMatt Macy
597eda14cbcSMatt Macy
598eda14cbcSMatt Macy /*
599eda14cbcSMatt Macy * If it is decrypt, need to make sure size of ciphertext is at least
600eda14cbcSMatt Macy * bigger than MAC len
601eda14cbcSMatt Macy */
602eda14cbcSMatt Macy if ((!is_encrypt_init) && (ccm_param->ulDataSize < macSize)) {
603eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
604eda14cbcSMatt Macy }
605eda14cbcSMatt Macy
606eda14cbcSMatt Macy /*
607eda14cbcSMatt Macy * Check to make sure the length of the payload is within the
608eda14cbcSMatt Macy * range of values allowed by q
609eda14cbcSMatt Macy */
610eda14cbcSMatt Macy if (q < 8) {
611eda14cbcSMatt Macy maxValue = (1ULL << (q * 8)) - 1;
612eda14cbcSMatt Macy } else {
613eda14cbcSMatt Macy maxValue = ULONG_MAX;
614eda14cbcSMatt Macy }
615eda14cbcSMatt Macy
616eda14cbcSMatt Macy if (ccm_param->ulDataSize > maxValue) {
617eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
618eda14cbcSMatt Macy }
619eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
620eda14cbcSMatt Macy }
621eda14cbcSMatt Macy
622eda14cbcSMatt Macy /*
623eda14cbcSMatt Macy * Format the first block used in CBC-MAC (B0) and the initial counter
624eda14cbcSMatt Macy * block based on formatting functions and counter generation functions
625eda14cbcSMatt Macy * specified in RFC 3610 and NIST publication 800-38C, appendix A
626eda14cbcSMatt Macy *
627eda14cbcSMatt Macy * b0 is the first block used in CBC-MAC
628eda14cbcSMatt Macy * cb0 is the first counter block
629eda14cbcSMatt Macy *
630eda14cbcSMatt Macy * It's assumed that the arguments b0 and cb0 are preallocated AES blocks
631eda14cbcSMatt Macy *
632eda14cbcSMatt Macy */
633eda14cbcSMatt Macy static void
ccm_format_initial_blocks(uchar_t * nonce,ulong_t nonceSize,ulong_t authDataSize,uint8_t * b0,ccm_ctx_t * aes_ctx)634eda14cbcSMatt Macy ccm_format_initial_blocks(uchar_t *nonce, ulong_t nonceSize,
635eda14cbcSMatt Macy ulong_t authDataSize, uint8_t *b0, ccm_ctx_t *aes_ctx)
636eda14cbcSMatt Macy {
637eda14cbcSMatt Macy uint64_t payloadSize;
638eda14cbcSMatt Macy uint8_t t, q, have_adata = 0;
639eda14cbcSMatt Macy size_t limit;
640eda14cbcSMatt Macy int i, j, k;
641eda14cbcSMatt Macy uint64_t mask = 0;
642eda14cbcSMatt Macy uint8_t *cb;
643eda14cbcSMatt Macy
644eda14cbcSMatt Macy q = (uint8_t)((15 - nonceSize) & 0xFF);
645eda14cbcSMatt Macy t = (uint8_t)((aes_ctx->ccm_mac_len) & 0xFF);
646eda14cbcSMatt Macy
647eda14cbcSMatt Macy /* Construct the first octet of b0 */
648eda14cbcSMatt Macy if (authDataSize > 0) {
649eda14cbcSMatt Macy have_adata = 1;
650eda14cbcSMatt Macy }
651eda14cbcSMatt Macy b0[0] = (have_adata << 6) | (((t - 2) / 2) << 3) | (q - 1);
652eda14cbcSMatt Macy
653eda14cbcSMatt Macy /* copy the nonce value into b0 */
654da5137abSMartin Matuska memcpy(&(b0[1]), nonce, nonceSize);
655eda14cbcSMatt Macy
656eda14cbcSMatt Macy /* store the length of the payload into b0 */
657da5137abSMartin Matuska memset(&(b0[1+nonceSize]), 0, q);
658eda14cbcSMatt Macy
659eda14cbcSMatt Macy payloadSize = aes_ctx->ccm_data_len;
660*15f0b8c3SMartin Matuska limit = MIN(8, q);
661eda14cbcSMatt Macy
662eda14cbcSMatt Macy for (i = 0, j = 0, k = 15; i < limit; i++, j += 8, k--) {
663eda14cbcSMatt Macy b0[k] = (uint8_t)((payloadSize >> j) & 0xFF);
664eda14cbcSMatt Macy }
665eda14cbcSMatt Macy
666eda14cbcSMatt Macy /* format the counter block */
667eda14cbcSMatt Macy
668eda14cbcSMatt Macy cb = (uint8_t *)aes_ctx->ccm_cb;
669eda14cbcSMatt Macy
670eda14cbcSMatt Macy cb[0] = 0x07 & (q-1); /* first byte */
671eda14cbcSMatt Macy
672eda14cbcSMatt Macy /* copy the nonce value into the counter block */
673da5137abSMartin Matuska memcpy(&(cb[1]), nonce, nonceSize);
674eda14cbcSMatt Macy
675da5137abSMartin Matuska memset(&(cb[1+nonceSize]), 0, q);
676eda14cbcSMatt Macy
677eda14cbcSMatt Macy /* Create the mask for the counter field based on the size of nonce */
678eda14cbcSMatt Macy q <<= 3;
679eda14cbcSMatt Macy while (q-- > 0) {
680eda14cbcSMatt Macy mask |= (1ULL << q);
681eda14cbcSMatt Macy }
682eda14cbcSMatt Macy
683eda14cbcSMatt Macy #ifdef _ZFS_LITTLE_ENDIAN
684eda14cbcSMatt Macy mask = htonll(mask);
685eda14cbcSMatt Macy #endif
686eda14cbcSMatt Macy aes_ctx->ccm_counter_mask = mask;
687eda14cbcSMatt Macy
688eda14cbcSMatt Macy /*
689eda14cbcSMatt Macy * During calculation, we start using counter block 1, we will
690eda14cbcSMatt Macy * set it up right here.
691eda14cbcSMatt Macy * We can just set the last byte to have the value 1, because
692eda14cbcSMatt Macy * even with the biggest nonce of 13, the last byte of the
693eda14cbcSMatt Macy * counter block will be used for the counter value.
694eda14cbcSMatt Macy */
695eda14cbcSMatt Macy cb[15] = 0x01;
696eda14cbcSMatt Macy }
697eda14cbcSMatt Macy
698eda14cbcSMatt Macy /*
699eda14cbcSMatt Macy * Encode the length of the associated data as
700eda14cbcSMatt Macy * specified in RFC 3610 and NIST publication 800-38C, appendix A
701eda14cbcSMatt Macy */
702eda14cbcSMatt Macy static void
encode_adata_len(ulong_t auth_data_len,uint8_t * encoded,size_t * encoded_len)703eda14cbcSMatt Macy encode_adata_len(ulong_t auth_data_len, uint8_t *encoded, size_t *encoded_len)
704eda14cbcSMatt Macy {
705eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
706eda14cbcSMatt Macy uint32_t *lencoded_ptr;
707eda14cbcSMatt Macy #ifdef _LP64
708eda14cbcSMatt Macy uint64_t *llencoded_ptr;
709eda14cbcSMatt Macy #endif
710eda14cbcSMatt Macy #endif /* UNALIGNED_POINTERS_PERMITTED */
711eda14cbcSMatt Macy
712eda14cbcSMatt Macy if (auth_data_len < ((1ULL<<16) - (1ULL<<8))) {
713eda14cbcSMatt Macy /* 0 < a < (2^16-2^8) */
714eda14cbcSMatt Macy *encoded_len = 2;
715eda14cbcSMatt Macy encoded[0] = (auth_data_len & 0xff00) >> 8;
716eda14cbcSMatt Macy encoded[1] = auth_data_len & 0xff;
717eda14cbcSMatt Macy
718eda14cbcSMatt Macy } else if ((auth_data_len >= ((1ULL<<16) - (1ULL<<8))) &&
719eda14cbcSMatt Macy (auth_data_len < (1ULL << 31))) {
720eda14cbcSMatt Macy /* (2^16-2^8) <= a < 2^32 */
721eda14cbcSMatt Macy *encoded_len = 6;
722eda14cbcSMatt Macy encoded[0] = 0xff;
723eda14cbcSMatt Macy encoded[1] = 0xfe;
724eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
725eda14cbcSMatt Macy lencoded_ptr = (uint32_t *)&encoded[2];
726eda14cbcSMatt Macy *lencoded_ptr = htonl(auth_data_len);
727eda14cbcSMatt Macy #else
728eda14cbcSMatt Macy encoded[2] = (auth_data_len & 0xff000000) >> 24;
729eda14cbcSMatt Macy encoded[3] = (auth_data_len & 0xff0000) >> 16;
730eda14cbcSMatt Macy encoded[4] = (auth_data_len & 0xff00) >> 8;
731eda14cbcSMatt Macy encoded[5] = auth_data_len & 0xff;
732eda14cbcSMatt Macy #endif /* UNALIGNED_POINTERS_PERMITTED */
733eda14cbcSMatt Macy
734eda14cbcSMatt Macy #ifdef _LP64
735eda14cbcSMatt Macy } else {
736eda14cbcSMatt Macy /* 2^32 <= a < 2^64 */
737eda14cbcSMatt Macy *encoded_len = 10;
738eda14cbcSMatt Macy encoded[0] = 0xff;
739eda14cbcSMatt Macy encoded[1] = 0xff;
740eda14cbcSMatt Macy #ifdef UNALIGNED_POINTERS_PERMITTED
741eda14cbcSMatt Macy llencoded_ptr = (uint64_t *)&encoded[2];
742eda14cbcSMatt Macy *llencoded_ptr = htonl(auth_data_len);
743eda14cbcSMatt Macy #else
744eda14cbcSMatt Macy encoded[2] = (auth_data_len & 0xff00000000000000) >> 56;
745eda14cbcSMatt Macy encoded[3] = (auth_data_len & 0xff000000000000) >> 48;
746eda14cbcSMatt Macy encoded[4] = (auth_data_len & 0xff0000000000) >> 40;
747eda14cbcSMatt Macy encoded[5] = (auth_data_len & 0xff00000000) >> 32;
748eda14cbcSMatt Macy encoded[6] = (auth_data_len & 0xff000000) >> 24;
749eda14cbcSMatt Macy encoded[7] = (auth_data_len & 0xff0000) >> 16;
750eda14cbcSMatt Macy encoded[8] = (auth_data_len & 0xff00) >> 8;
751eda14cbcSMatt Macy encoded[9] = auth_data_len & 0xff;
752eda14cbcSMatt Macy #endif /* UNALIGNED_POINTERS_PERMITTED */
753eda14cbcSMatt Macy #endif /* _LP64 */
754eda14cbcSMatt Macy }
755eda14cbcSMatt Macy }
756eda14cbcSMatt Macy
757eda14cbcSMatt Macy static int
ccm_init(ccm_ctx_t * ctx,unsigned char * nonce,size_t nonce_len,unsigned char * auth_data,size_t auth_data_len,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))758eda14cbcSMatt Macy ccm_init(ccm_ctx_t *ctx, unsigned char *nonce, size_t nonce_len,
759eda14cbcSMatt Macy unsigned char *auth_data, size_t auth_data_len, size_t block_size,
760eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
761eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
762eda14cbcSMatt Macy {
763eda14cbcSMatt Macy uint8_t *mac_buf, *datap, *ivp, *authp;
764eda14cbcSMatt Macy size_t remainder, processed;
765eda14cbcSMatt Macy uint8_t encoded_a[10]; /* max encoded auth data length is 10 octets */
766eda14cbcSMatt Macy size_t encoded_a_len = 0;
767eda14cbcSMatt Macy
768eda14cbcSMatt Macy mac_buf = (uint8_t *)&(ctx->ccm_mac_buf);
769eda14cbcSMatt Macy
770eda14cbcSMatt Macy /*
771eda14cbcSMatt Macy * Format the 1st block for CBC-MAC and construct the
772eda14cbcSMatt Macy * 1st counter block.
773eda14cbcSMatt Macy *
774eda14cbcSMatt Macy * aes_ctx->ccm_iv is used for storing the counter block
775eda14cbcSMatt Macy * mac_buf will store b0 at this time.
776eda14cbcSMatt Macy */
777eda14cbcSMatt Macy ccm_format_initial_blocks(nonce, nonce_len,
778eda14cbcSMatt Macy auth_data_len, mac_buf, ctx);
779eda14cbcSMatt Macy
780eda14cbcSMatt Macy /* The IV for CBC MAC for AES CCM mode is always zero */
781eda14cbcSMatt Macy ivp = (uint8_t *)ctx->ccm_tmp;
782da5137abSMartin Matuska memset(ivp, 0, block_size);
783eda14cbcSMatt Macy
784eda14cbcSMatt Macy xor_block(ivp, mac_buf);
785eda14cbcSMatt Macy
786eda14cbcSMatt Macy /* encrypt the nonce */
787eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
788eda14cbcSMatt Macy
789eda14cbcSMatt Macy /* take care of the associated data, if any */
790eda14cbcSMatt Macy if (auth_data_len == 0) {
791eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
792eda14cbcSMatt Macy }
793eda14cbcSMatt Macy
794eda14cbcSMatt Macy encode_adata_len(auth_data_len, encoded_a, &encoded_a_len);
795eda14cbcSMatt Macy
796eda14cbcSMatt Macy remainder = auth_data_len;
797eda14cbcSMatt Macy
798eda14cbcSMatt Macy /* 1st block: it contains encoded associated data, and some data */
799eda14cbcSMatt Macy authp = (uint8_t *)ctx->ccm_tmp;
800da5137abSMartin Matuska memset(authp, 0, block_size);
801da5137abSMartin Matuska memcpy(authp, encoded_a, encoded_a_len);
802eda14cbcSMatt Macy processed = block_size - encoded_a_len;
803eda14cbcSMatt Macy if (processed > auth_data_len) {
804eda14cbcSMatt Macy /* in case auth_data is very small */
805eda14cbcSMatt Macy processed = auth_data_len;
806eda14cbcSMatt Macy }
807da5137abSMartin Matuska memcpy(authp+encoded_a_len, auth_data, processed);
808eda14cbcSMatt Macy /* xor with previous buffer */
809eda14cbcSMatt Macy xor_block(authp, mac_buf);
810eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
811eda14cbcSMatt Macy remainder -= processed;
812eda14cbcSMatt Macy if (remainder == 0) {
813eda14cbcSMatt Macy /* a small amount of associated data, it's all done now */
814eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
815eda14cbcSMatt Macy }
816eda14cbcSMatt Macy
817eda14cbcSMatt Macy do {
818eda14cbcSMatt Macy if (remainder < block_size) {
819eda14cbcSMatt Macy /*
820eda14cbcSMatt Macy * There's not a block full of data, pad rest of
821eda14cbcSMatt Macy * buffer with zero
822eda14cbcSMatt Macy */
823da5137abSMartin Matuska memset(authp, 0, block_size);
824da5137abSMartin Matuska memcpy(authp, &(auth_data[processed]), remainder);
825eda14cbcSMatt Macy datap = (uint8_t *)authp;
826eda14cbcSMatt Macy remainder = 0;
827eda14cbcSMatt Macy } else {
828eda14cbcSMatt Macy datap = (uint8_t *)(&(auth_data[processed]));
829eda14cbcSMatt Macy processed += block_size;
830eda14cbcSMatt Macy remainder -= block_size;
831eda14cbcSMatt Macy }
832eda14cbcSMatt Macy
833eda14cbcSMatt Macy xor_block(datap, mac_buf);
834eda14cbcSMatt Macy encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
835eda14cbcSMatt Macy
836eda14cbcSMatt Macy } while (remainder > 0);
837eda14cbcSMatt Macy
838eda14cbcSMatt Macy return (CRYPTO_SUCCESS);
839eda14cbcSMatt Macy }
840eda14cbcSMatt Macy
841eda14cbcSMatt Macy /*
842eda14cbcSMatt Macy * The following function should be call at encrypt or decrypt init time
843eda14cbcSMatt Macy * for AES CCM mode.
844eda14cbcSMatt Macy */
845eda14cbcSMatt Macy int
ccm_init_ctx(ccm_ctx_t * ccm_ctx,char * param,int kmflag,boolean_t is_encrypt_init,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))846eda14cbcSMatt Macy ccm_init_ctx(ccm_ctx_t *ccm_ctx, char *param, int kmflag,
847eda14cbcSMatt Macy boolean_t is_encrypt_init, size_t block_size,
848eda14cbcSMatt Macy int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
849eda14cbcSMatt Macy void (*xor_block)(uint8_t *, uint8_t *))
850eda14cbcSMatt Macy {
851eda14cbcSMatt Macy int rv;
852eda14cbcSMatt Macy CK_AES_CCM_PARAMS *ccm_param;
853eda14cbcSMatt Macy
854eda14cbcSMatt Macy if (param != NULL) {
855eda14cbcSMatt Macy ccm_param = (CK_AES_CCM_PARAMS *)param;
856eda14cbcSMatt Macy
857eda14cbcSMatt Macy if ((rv = ccm_validate_args(ccm_param,
858eda14cbcSMatt Macy is_encrypt_init)) != 0) {
859eda14cbcSMatt Macy return (rv);
860eda14cbcSMatt Macy }
861eda14cbcSMatt Macy
862eda14cbcSMatt Macy ccm_ctx->ccm_mac_len = ccm_param->ulMACSize;
863eda14cbcSMatt Macy if (is_encrypt_init) {
864eda14cbcSMatt Macy ccm_ctx->ccm_data_len = ccm_param->ulDataSize;
865eda14cbcSMatt Macy } else {
866eda14cbcSMatt Macy ccm_ctx->ccm_data_len =
867eda14cbcSMatt Macy ccm_param->ulDataSize - ccm_ctx->ccm_mac_len;
868eda14cbcSMatt Macy ccm_ctx->ccm_processed_mac_len = 0;
869eda14cbcSMatt Macy }
870eda14cbcSMatt Macy ccm_ctx->ccm_processed_data_len = 0;
871eda14cbcSMatt Macy
872eda14cbcSMatt Macy ccm_ctx->ccm_flags |= CCM_MODE;
873eda14cbcSMatt Macy } else {
874eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
875eda14cbcSMatt Macy }
876eda14cbcSMatt Macy
877eda14cbcSMatt Macy if (ccm_init(ccm_ctx, ccm_param->nonce, ccm_param->ulNonceSize,
878eda14cbcSMatt Macy ccm_param->authData, ccm_param->ulAuthDataSize, block_size,
879eda14cbcSMatt Macy encrypt_block, xor_block) != 0) {
880eda14cbcSMatt Macy return (CRYPTO_MECHANISM_PARAM_INVALID);
881eda14cbcSMatt Macy }
882eda14cbcSMatt Macy if (!is_encrypt_init) {
883eda14cbcSMatt Macy /* allocate buffer for storing decrypted plaintext */
884eda14cbcSMatt Macy ccm_ctx->ccm_pt_buf = vmem_alloc(ccm_ctx->ccm_data_len,
885eda14cbcSMatt Macy kmflag);
886eda14cbcSMatt Macy if (ccm_ctx->ccm_pt_buf == NULL) {
887eda14cbcSMatt Macy rv = CRYPTO_HOST_MEMORY;
888eda14cbcSMatt Macy }
889eda14cbcSMatt Macy }
890eda14cbcSMatt Macy return (rv);
891eda14cbcSMatt Macy }
892eda14cbcSMatt Macy
893eda14cbcSMatt Macy void *
ccm_alloc_ctx(int kmflag)894eda14cbcSMatt Macy ccm_alloc_ctx(int kmflag)
895eda14cbcSMatt Macy {
896eda14cbcSMatt Macy ccm_ctx_t *ccm_ctx;
897eda14cbcSMatt Macy
898eda14cbcSMatt Macy if ((ccm_ctx = kmem_zalloc(sizeof (ccm_ctx_t), kmflag)) == NULL)
899eda14cbcSMatt Macy return (NULL);
900eda14cbcSMatt Macy
901eda14cbcSMatt Macy ccm_ctx->ccm_flags = CCM_MODE;
902eda14cbcSMatt Macy return (ccm_ctx);
903eda14cbcSMatt Macy }
904