1 /* $OpenBSD: xform.c,v 1.36 2008/09/06 22:23:21 djm Exp $ */ 2 /* 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr), 5 * Niels Provos (provos@physnet.uni-hamburg.de) and 6 * Damien Miller (djm@mindrot.org). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * AES XTS implementation in 2008 by Damien Miller 20 * 21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 22 * Angelos D. Keromytis and Niels Provos. 23 * 24 * Copyright (C) 2001, Angelos D. Keromytis. 25 * 26 * Copyright (C) 2008, Damien Miller 27 * 28 * Permission to use, copy, and modify this software with or without fee 29 * is hereby granted, provided that this entire notice is included in 30 * all copies of any software which is or includes a copy or 31 * modification of this software. 32 * You may use this code under the GNU public license if you so wish. Please 33 * contribute changes back to the authors under this freer than GPL license 34 * so that we may further the use of strong encryption without limitations to 35 * all. 36 * 37 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 38 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 39 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 40 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 41 * PURPOSE. 42 */ 43 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/malloc.h> 47 #include <sys/sysctl.h> 48 #include <sys/errno.h> 49 #include <sys/time.h> 50 #include <sys/kernel.h> 51 #include <machine/cpu.h> 52 53 #include <crypto/md5.h> 54 #include <crypto/sha1.h> 55 #include <crypto/sha2.h> 56 #include <crypto/rmd160.h> 57 #include <crypto/blf.h> 58 #include <crypto/cast.h> 59 #include <crypto/skipjack.h> 60 #include <crypto/rijndael.h> 61 #include <crypto/cryptodev.h> 62 #include <crypto/xform.h> 63 #include <crypto/deflate.h> 64 65 extern void des_ecb3_encrypt(caddr_t, caddr_t, caddr_t, caddr_t, caddr_t, int); 66 extern void des_ecb_encrypt(caddr_t, caddr_t, caddr_t, int); 67 68 int des_set_key(caddr_t, caddr_t); 69 int des1_setkey(u_int8_t **, u_int8_t *, int); 70 int des3_setkey(u_int8_t **, u_int8_t *, int); 71 int blf_setkey(u_int8_t **, u_int8_t *, int); 72 int cast5_setkey(u_int8_t **, u_int8_t *, int); 73 int skipjack_setkey(u_int8_t **, u_int8_t *, int); 74 int rijndael128_setkey(u_int8_t **, u_int8_t *, int); 75 int aes_ctr_setkey(u_int8_t **, u_int8_t *, int); 76 int aes_xts_setkey(u_int8_t **, u_int8_t *, int); 77 int null_setkey(u_int8_t **, u_int8_t *, int); 78 79 void des1_encrypt(caddr_t, u_int8_t *); 80 void des3_encrypt(caddr_t, u_int8_t *); 81 void blf_encrypt(caddr_t, u_int8_t *); 82 void cast5_encrypt(caddr_t, u_int8_t *); 83 void skipjack_encrypt(caddr_t, u_int8_t *); 84 void rijndael128_encrypt(caddr_t, u_int8_t *); 85 void null_encrypt(caddr_t, u_int8_t *); 86 void aes_xts_encrypt(caddr_t, u_int8_t *); 87 88 void des1_decrypt(caddr_t, u_int8_t *); 89 void des3_decrypt(caddr_t, u_int8_t *); 90 void blf_decrypt(caddr_t, u_int8_t *); 91 void cast5_decrypt(caddr_t, u_int8_t *); 92 void skipjack_decrypt(caddr_t, u_int8_t *); 93 void rijndael128_decrypt(caddr_t, u_int8_t *); 94 void null_decrypt(caddr_t, u_int8_t *); 95 void aes_xts_decrypt(caddr_t, u_int8_t *); 96 97 void aes_ctr_crypt(caddr_t, u_int8_t *); 98 99 void des1_zerokey(u_int8_t **); 100 void des3_zerokey(u_int8_t **); 101 void blf_zerokey(u_int8_t **); 102 void cast5_zerokey(u_int8_t **); 103 void skipjack_zerokey(u_int8_t **); 104 void rijndael128_zerokey(u_int8_t **); 105 void aes_ctr_zerokey(u_int8_t **); 106 void aes_xts_zerokey(u_int8_t **); 107 void null_zerokey(u_int8_t **); 108 109 void aes_ctr_reinit(caddr_t, u_int8_t *); 110 void aes_xts_reinit(caddr_t, u_int8_t *); 111 112 int MD5Update_int(void *, const u_int8_t *, u_int16_t); 113 int SHA1Update_int(void *, const u_int8_t *, u_int16_t); 114 int RMD160Update_int(void *, const u_int8_t *, u_int16_t); 115 int SHA256Update_int(void *, const u_int8_t *, u_int16_t); 116 int SHA384Update_int(void *, const u_int8_t *, u_int16_t); 117 int SHA512Update_int(void *, const u_int8_t *, u_int16_t); 118 119 u_int32_t deflate_compress(u_int8_t *, u_int32_t, u_int8_t **); 120 u_int32_t deflate_decompress(u_int8_t *, u_int32_t, u_int8_t **); 121 u_int32_t lzs_dummy(u_int8_t *, u_int32_t, u_int8_t **); 122 123 /* Helper */ 124 struct aes_xts_ctx; 125 void aes_xts_crypt(struct aes_xts_ctx *, u_int8_t *, u_int); 126 127 /* Encryption instances */ 128 struct enc_xform enc_xform_des = { 129 CRYPTO_DES_CBC, "DES", 130 8, 8, 8, 8, 131 des1_encrypt, 132 des1_decrypt, 133 des1_setkey, 134 des1_zerokey, 135 NULL 136 }; 137 138 struct enc_xform enc_xform_3des = { 139 CRYPTO_3DES_CBC, "3DES", 140 8, 8, 24, 24, 141 des3_encrypt, 142 des3_decrypt, 143 des3_setkey, 144 des3_zerokey, 145 NULL 146 }; 147 148 struct enc_xform enc_xform_blf = { 149 CRYPTO_BLF_CBC, "Blowfish", 150 8, 8, 5, 56 /* 448 bits, max key */, 151 blf_encrypt, 152 blf_decrypt, 153 blf_setkey, 154 blf_zerokey, 155 NULL 156 }; 157 158 struct enc_xform enc_xform_cast5 = { 159 CRYPTO_CAST_CBC, "CAST-128", 160 8, 8, 5, 16, 161 cast5_encrypt, 162 cast5_decrypt, 163 cast5_setkey, 164 cast5_zerokey, 165 NULL 166 }; 167 168 struct enc_xform enc_xform_skipjack = { 169 CRYPTO_SKIPJACK_CBC, "Skipjack", 170 8, 8, 10, 10, 171 skipjack_encrypt, 172 skipjack_decrypt, 173 skipjack_setkey, 174 skipjack_zerokey, 175 NULL 176 }; 177 178 struct enc_xform enc_xform_rijndael128 = { 179 CRYPTO_RIJNDAEL128_CBC, "Rijndael-128/AES", 180 16, 16, 16, 32, 181 rijndael128_encrypt, 182 rijndael128_decrypt, 183 rijndael128_setkey, 184 rijndael128_zerokey, 185 NULL 186 }; 187 188 struct enc_xform enc_xform_aes_ctr = { 189 CRYPTO_AES_CTR, "AES-CTR", 190 16, 8, 16+4, 32+4, 191 aes_ctr_crypt, 192 aes_ctr_crypt, 193 aes_ctr_setkey, 194 aes_ctr_zerokey, 195 aes_ctr_reinit 196 }; 197 198 struct enc_xform enc_xform_aes_xts = { 199 CRYPTO_AES_XTS, "AES-XTS", 200 16, 8, 32, 64, 201 aes_xts_encrypt, 202 aes_xts_decrypt, 203 aes_xts_setkey, 204 aes_xts_zerokey, 205 aes_xts_reinit 206 }; 207 208 struct enc_xform enc_xform_arc4 = { 209 CRYPTO_ARC4, "ARC4", 210 1, 1, 1, 32, 211 NULL, 212 NULL, 213 NULL, 214 NULL, 215 NULL 216 }; 217 218 struct enc_xform enc_xform_null = { 219 CRYPTO_NULL, "NULL", 220 4, 0, 0, 256, 221 null_encrypt, 222 null_decrypt, 223 null_setkey, 224 null_zerokey, 225 NULL 226 }; 227 228 /* Authentication instances */ 229 struct auth_hash auth_hash_hmac_md5_96 = { 230 CRYPTO_MD5_HMAC, "HMAC-MD5", 231 16, 16, 12, sizeof(MD5_CTX), 232 (void (*) (void *)) MD5Init, MD5Update_int, 233 (void (*) (u_int8_t *, void *)) MD5Final 234 }; 235 236 struct auth_hash auth_hash_hmac_sha1_96 = { 237 CRYPTO_SHA1_HMAC, "HMAC-SHA1", 238 20, 20, 12, sizeof(SHA1_CTX), 239 (void (*) (void *)) SHA1Init, SHA1Update_int, 240 (void (*) (u_int8_t *, void *)) SHA1Final 241 }; 242 243 struct auth_hash auth_hash_hmac_ripemd_160_96 = { 244 CRYPTO_RIPEMD160_HMAC, "HMAC-RIPEMD-160", 245 20, 20, 12, sizeof(RMD160_CTX), 246 (void (*)(void *)) RMD160Init, RMD160Update_int, 247 (void (*)(u_int8_t *, void *)) RMD160Final 248 }; 249 250 struct auth_hash auth_hash_hmac_sha2_256_96 = { 251 CRYPTO_SHA2_256_HMAC, "HMAC-SHA2-256", 252 32, 32, 12, sizeof(SHA2_CTX), 253 (void (*)(void *)) SHA256Init, SHA256Update_int, 254 (void (*)(u_int8_t *, void *)) SHA256Final 255 }; 256 257 struct auth_hash auth_hash_hmac_sha2_384_96 = { 258 CRYPTO_SHA2_384_HMAC, "HMAC-SHA2-384", 259 48, 48, 12, sizeof(SHA2_CTX), 260 (void (*)(void *)) SHA384Init, SHA384Update_int, 261 (void (*)(u_int8_t *, void *)) SHA384Final 262 }; 263 264 struct auth_hash auth_hash_hmac_sha2_512_96 = { 265 CRYPTO_SHA2_512_HMAC, "HMAC-SHA2-512", 266 64, 64, 12, sizeof(SHA2_CTX), 267 (void (*)(void *)) SHA512Init, SHA512Update_int, 268 (void (*)(u_int8_t *, void *)) SHA512Final 269 }; 270 271 struct auth_hash auth_hash_key_md5 = { 272 CRYPTO_MD5_KPDK, "Keyed MD5", 273 0, 16, 16, sizeof(MD5_CTX), 274 (void (*)(void *)) MD5Init, MD5Update_int, 275 (void (*)(u_int8_t *, void *)) MD5Final 276 }; 277 278 struct auth_hash auth_hash_key_sha1 = { 279 CRYPTO_SHA1_KPDK, "Keyed SHA1", 280 0, 20, 20, sizeof(SHA1_CTX), 281 (void (*)(void *)) SHA1Init, SHA1Update_int, 282 (void (*)(u_int8_t *, void *)) SHA1Final 283 }; 284 285 struct auth_hash auth_hash_md5 = { 286 CRYPTO_MD5, "MD5", 287 0, 16, 16, sizeof(MD5_CTX), 288 (void (*) (void *)) MD5Init, MD5Update_int, 289 (void (*) (u_int8_t *, void *)) MD5Final 290 }; 291 292 struct auth_hash auth_hash_sha1 = { 293 CRYPTO_SHA1, "SHA1", 294 0, 20, 20, sizeof(SHA1_CTX), 295 (void (*)(void *)) SHA1Init, SHA1Update_int, 296 (void (*)(u_int8_t *, void *)) SHA1Final 297 }; 298 299 /* Compression instance */ 300 struct comp_algo comp_algo_deflate = { 301 CRYPTO_DEFLATE_COMP, "Deflate", 302 90, deflate_compress, 303 deflate_decompress 304 }; 305 306 struct comp_algo comp_algo_lzs = { 307 CRYPTO_LZS_COMP, "LZS", 308 90, lzs_dummy, 309 lzs_dummy 310 }; 311 312 /* 313 * Encryption wrapper routines. 314 */ 315 void 316 des1_encrypt(caddr_t key, u_int8_t *blk) 317 { 318 des_ecb_encrypt(blk, blk, key, 1); 319 } 320 321 void 322 des1_decrypt(caddr_t key, u_int8_t *blk) 323 { 324 des_ecb_encrypt(blk, blk, key, 0); 325 } 326 327 int 328 des1_setkey(u_int8_t **sched, u_int8_t *key, int len) 329 { 330 *sched = malloc(128, M_CRYPTO_DATA, M_WAITOK | M_ZERO); 331 332 if (des_set_key(key, *sched) < 0) { 333 des1_zerokey(sched); 334 return -1; 335 } 336 337 return 0; 338 } 339 340 void 341 des1_zerokey(u_int8_t **sched) 342 { 343 bzero(*sched, 128); 344 free(*sched, M_CRYPTO_DATA); 345 *sched = NULL; 346 } 347 348 void 349 des3_encrypt(caddr_t key, u_int8_t *blk) 350 { 351 des_ecb3_encrypt(blk, blk, key, key + 128, key + 256, 1); 352 } 353 354 void 355 des3_decrypt(caddr_t key, u_int8_t *blk) 356 { 357 des_ecb3_encrypt(blk, blk, key + 256, key + 128, key, 0); 358 } 359 360 int 361 des3_setkey(u_int8_t **sched, u_int8_t *key, int len) 362 { 363 *sched = malloc(384, M_CRYPTO_DATA, M_WAITOK | M_ZERO); 364 365 if (des_set_key(key, *sched) < 0 || des_set_key(key + 8, *sched + 128) 366 < 0 || des_set_key(key + 16, *sched + 256) < 0) { 367 des3_zerokey(sched); 368 return -1; 369 } 370 371 return 0; 372 } 373 374 void 375 des3_zerokey(u_int8_t **sched) 376 { 377 bzero(*sched, 384); 378 free(*sched, M_CRYPTO_DATA); 379 *sched = NULL; 380 } 381 382 void 383 blf_encrypt(caddr_t key, u_int8_t *blk) 384 { 385 blf_ecb_encrypt((blf_ctx *) key, blk, 8); 386 } 387 388 void 389 blf_decrypt(caddr_t key, u_int8_t *blk) 390 { 391 blf_ecb_decrypt((blf_ctx *) key, blk, 8); 392 } 393 394 int 395 blf_setkey(u_int8_t **sched, u_int8_t *key, int len) 396 { 397 *sched = malloc(sizeof(blf_ctx), M_CRYPTO_DATA, M_WAITOK | M_ZERO); 398 blf_key((blf_ctx *)*sched, key, len); 399 400 return 0; 401 } 402 403 void 404 blf_zerokey(u_int8_t **sched) 405 { 406 bzero(*sched, sizeof(blf_ctx)); 407 free(*sched, M_CRYPTO_DATA); 408 *sched = NULL; 409 } 410 411 int 412 null_setkey(u_int8_t **sched, u_int8_t *key, int len) 413 { 414 return 0; 415 } 416 417 void 418 null_zerokey(u_int8_t **sched) 419 { 420 } 421 422 void 423 null_encrypt(caddr_t key, u_int8_t *blk) 424 { 425 } 426 427 void 428 null_decrypt(caddr_t key, u_int8_t *blk) 429 { 430 } 431 432 void 433 cast5_encrypt(caddr_t key, u_int8_t *blk) 434 { 435 cast_encrypt((cast_key *) key, blk, blk); 436 } 437 438 void 439 cast5_decrypt(caddr_t key, u_int8_t *blk) 440 { 441 cast_decrypt((cast_key *) key, blk, blk); 442 } 443 444 int 445 cast5_setkey(u_int8_t **sched, u_int8_t *key, int len) 446 { 447 *sched = malloc(sizeof(cast_key), M_CRYPTO_DATA, M_WAITOK | M_ZERO); 448 cast_setkey((cast_key *)*sched, key, len); 449 450 return 0; 451 } 452 453 void 454 cast5_zerokey(u_int8_t **sched) 455 { 456 bzero(*sched, sizeof(cast_key)); 457 free(*sched, M_CRYPTO_DATA); 458 *sched = NULL; 459 } 460 461 void 462 skipjack_encrypt(caddr_t key, u_int8_t *blk) 463 { 464 skipjack_forwards(blk, blk, (u_int8_t **) key); 465 } 466 467 void 468 skipjack_decrypt(caddr_t key, u_int8_t *blk) 469 { 470 skipjack_backwards(blk, blk, (u_int8_t **) key); 471 } 472 473 int 474 skipjack_setkey(u_int8_t **sched, u_int8_t *key, int len) 475 { 476 *sched = malloc(10 * sizeof(u_int8_t *), M_CRYPTO_DATA, M_WAITOK | 477 M_ZERO); 478 subkey_table_gen(key, (u_int8_t **) *sched); 479 480 return 0; 481 } 482 483 void 484 skipjack_zerokey(u_int8_t **sched) 485 { 486 int k; 487 488 for (k = 0; k < 10; k++) { 489 if (((u_int8_t **)(*sched))[k]) { 490 bzero(((u_int8_t **)(*sched))[k], 0x100); 491 free(((u_int8_t **)(*sched))[k], M_CRYPTO_DATA); 492 } 493 } 494 bzero(*sched, 10 * sizeof(u_int8_t *)); 495 free(*sched, M_CRYPTO_DATA); 496 *sched = NULL; 497 } 498 499 void 500 rijndael128_encrypt(caddr_t key, u_int8_t *blk) 501 { 502 rijndael_encrypt((rijndael_ctx *) key, (u_char *) blk, (u_char *) blk); 503 } 504 505 void 506 rijndael128_decrypt(caddr_t key, u_int8_t *blk) 507 { 508 rijndael_decrypt((rijndael_ctx *) key, (u_char *) blk, (u_char *) blk); 509 } 510 511 int 512 rijndael128_setkey(u_int8_t **sched, u_int8_t *key, int len) 513 { 514 *sched = malloc(sizeof(rijndael_ctx), M_CRYPTO_DATA, M_WAITOK | M_ZERO); 515 516 if (rijndael_set_key((rijndael_ctx *)*sched, (u_char *)key, len * 8) 517 < 0) { 518 rijndael128_zerokey(sched); 519 return -1; 520 } 521 522 return 0; 523 } 524 525 void 526 rijndael128_zerokey(u_int8_t **sched) 527 { 528 bzero(*sched, sizeof(rijndael_ctx)); 529 free(*sched, M_CRYPTO_DATA); 530 *sched = NULL; 531 } 532 533 #define AESCTR_NONCESIZE 4 534 #define AESCTR_IVSIZE 8 535 #define AESCTR_BLOCKSIZE 16 536 537 struct aes_ctr_ctx { 538 u_int32_t ac_ek[4*(AES_MAXROUNDS + 1)]; 539 u_int8_t ac_block[AESCTR_BLOCKSIZE]; 540 int ac_nr; 541 }; 542 543 void 544 aes_ctr_reinit(caddr_t key, u_int8_t *iv) 545 { 546 struct aes_ctr_ctx *ctx; 547 548 ctx = (struct aes_ctr_ctx *)key; 549 bcopy(iv, ctx->ac_block + AESCTR_NONCESIZE, AESCTR_IVSIZE); 550 551 /* reset counter */ 552 bzero(ctx->ac_block + AESCTR_NONCESIZE + AESCTR_IVSIZE, 4); 553 } 554 555 void 556 aes_ctr_crypt(caddr_t key, u_int8_t *data) 557 { 558 struct aes_ctr_ctx *ctx; 559 u_int8_t keystream[AESCTR_BLOCKSIZE]; 560 int i; 561 562 ctx = (struct aes_ctr_ctx *)key; 563 /* increment counter */ 564 for (i = AESCTR_BLOCKSIZE - 1; 565 i >= AESCTR_NONCESIZE + AESCTR_IVSIZE; i--) 566 if (++ctx->ac_block[i]) /* continue on overflow */ 567 break; 568 rijndaelEncrypt(ctx->ac_ek, ctx->ac_nr, ctx->ac_block, keystream); 569 for (i = 0; i < AESCTR_BLOCKSIZE; i++) 570 data[i] ^= keystream[i]; 571 } 572 573 int 574 aes_ctr_setkey(u_int8_t **sched, u_int8_t *key, int len) 575 { 576 struct aes_ctr_ctx *ctx; 577 578 if (len < AESCTR_NONCESIZE) 579 return -1; 580 581 *sched = malloc(sizeof(struct aes_ctr_ctx), M_CRYPTO_DATA, M_WAITOK | 582 M_ZERO); 583 ctx = (struct aes_ctr_ctx *)*sched; 584 ctx->ac_nr = rijndaelKeySetupEnc(ctx->ac_ek, (u_char *)key, 585 (len - AESCTR_NONCESIZE) * 8); 586 if (ctx->ac_nr == 0) { 587 aes_ctr_zerokey(sched); 588 return -1; 589 } 590 bcopy(key + len - AESCTR_NONCESIZE, ctx->ac_block, AESCTR_NONCESIZE); 591 return 0; 592 } 593 594 void 595 aes_ctr_zerokey(u_int8_t **sched) 596 { 597 bzero(*sched, sizeof(struct aes_ctr_ctx)); 598 free(*sched, M_CRYPTO_DATA); 599 *sched = NULL; 600 } 601 602 #define AES_XTS_BLOCKSIZE 16 603 #define AES_XTS_IVSIZE 8 604 #define AES_XTS_ALPHA 0x87 /* GF(2^128) generator polynomial */ 605 606 struct aes_xts_ctx { 607 rijndael_ctx key1; 608 rijndael_ctx key2; 609 u_int8_t tweak[AES_XTS_BLOCKSIZE]; 610 }; 611 612 void 613 aes_xts_reinit(caddr_t key, u_int8_t *iv) 614 { 615 struct aes_xts_ctx *ctx = (struct aes_xts_ctx *)key; 616 u_int64_t blocknum; 617 u_int i; 618 619 /* 620 * Prepare tweak as E_k2(IV). IV is specified as LE representation 621 * of a 64-bit block number which we allow to be passed in directly. 622 */ 623 bcopy(iv, &blocknum, AES_XTS_IVSIZE); 624 for (i = 0; i < AES_XTS_IVSIZE; i++) { 625 ctx->tweak[i] = blocknum & 0xff; 626 blocknum >>= 8; 627 } 628 /* Last 64 bits of IV are always zero */ 629 bzero(ctx->tweak + AES_XTS_IVSIZE, AES_XTS_IVSIZE); 630 631 rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); 632 } 633 634 void 635 aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int do_encrypt) 636 { 637 u_int8_t block[AES_XTS_BLOCKSIZE]; 638 u_int i, carry_in, carry_out; 639 640 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 641 block[i] = data[i] ^ ctx->tweak[i]; 642 643 if (do_encrypt) 644 rijndael_encrypt(&ctx->key1, block, data); 645 else 646 rijndael_decrypt(&ctx->key1, block, data); 647 648 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 649 data[i] ^= ctx->tweak[i]; 650 651 /* Exponentiate tweak */ 652 carry_in = 0; 653 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) { 654 carry_out = ctx->tweak[i] & 0x80; 655 ctx->tweak[i] = (ctx->tweak[i] << 1) | (carry_in ? 1 : 0); 656 carry_in = carry_out; 657 } 658 if (carry_in) 659 ctx->tweak[0] ^= AES_XTS_ALPHA; 660 bzero(block, sizeof(block)); 661 } 662 663 void 664 aes_xts_encrypt(caddr_t key, u_int8_t *data) 665 { 666 aes_xts_crypt((struct aes_xts_ctx *)key, data, 1); 667 } 668 669 void 670 aes_xts_decrypt(caddr_t key, u_int8_t *data) 671 { 672 aes_xts_crypt((struct aes_xts_ctx *)key, data, 0); 673 } 674 675 int 676 aes_xts_setkey(u_int8_t **sched, u_int8_t *key, int len) 677 { 678 struct aes_xts_ctx *ctx; 679 680 if (len != 32 && len != 64) 681 return -1; 682 683 *sched = malloc(sizeof(struct aes_xts_ctx), M_CRYPTO_DATA, 684 M_WAITOK | M_ZERO); 685 ctx = (struct aes_xts_ctx *)*sched; 686 687 rijndael_set_key(&ctx->key1, key, len * 4); 688 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4); 689 690 return 0; 691 } 692 693 void 694 aes_xts_zerokey(u_int8_t **sched) 695 { 696 bzero(*sched, sizeof(struct aes_xts_ctx)); 697 free(*sched, M_CRYPTO_DATA); 698 *sched = NULL; 699 } 700 701 702 /* 703 * And now for auth. 704 */ 705 706 int 707 RMD160Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 708 { 709 RMD160Update(ctx, buf, len); 710 return 0; 711 } 712 713 int 714 MD5Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 715 { 716 MD5Update(ctx, buf, len); 717 return 0; 718 } 719 720 int 721 SHA1Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 722 { 723 SHA1Update(ctx, buf, len); 724 return 0; 725 } 726 727 int 728 SHA256Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 729 { 730 SHA256Update(ctx, buf, len); 731 return 0; 732 } 733 734 int 735 SHA384Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 736 { 737 SHA384Update(ctx, buf, len); 738 return 0; 739 } 740 741 int 742 SHA512Update_int(void *ctx, const u_int8_t *buf, u_int16_t len) 743 { 744 SHA512Update(ctx, buf, len); 745 return 0; 746 } 747 748 /* 749 * And compression 750 */ 751 752 u_int32_t 753 deflate_compress(u_int8_t *data, u_int32_t size, u_int8_t **out) 754 { 755 return deflate_global(data, size, 0, out); 756 } 757 758 u_int32_t 759 deflate_decompress(u_int8_t *data, u_int32_t size, u_int8_t **out) 760 { 761 return deflate_global(data, size, 1, out); 762 } 763 764 u_int32_t 765 lzs_dummy(u_int8_t *data, u_int32_t size, u_int8_t **out) 766 { 767 *out = NULL; 768 return (0); 769 } 770