1 /* $OpenBSD: aes_xts.c,v 1.2 2017/05/31 00:34:33 djm Exp $ */
2 /*
3 * Copyright (C) 2008, Damien Miller
4 *
5 * Permission to use, copy, and modify this software with or without fee
6 * is hereby granted, provided that this entire notice is included in
7 * all copies of any software which is or includes a copy or
8 * modification of this software.
9 * You may use this code under the GNU public license if you so wish. Please
10 * contribute changes back to the authors under this freer than GPL license
11 * so that we may further the use of strong encryption without limitations to
12 * all.
13 *
14 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
15 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
16 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
17 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
18 * PURPOSE.
19 */
20
21 #include <lib/libsa/stand.h>
22
23 #include "aes_xts.h"
24
25 void
aes_xts_reinit(struct aes_xts_ctx * ctx,u_int8_t * iv)26 aes_xts_reinit(struct aes_xts_ctx *ctx, u_int8_t *iv)
27 {
28 u_int64_t blocknum;
29 u_int i;
30
31 /*
32 * Prepare tweak as E_k2(IV). IV is specified as LE representation
33 * of a 64-bit block number which we allow to be passed in directly.
34 */
35 bcopy(iv, &blocknum, AES_XTS_IVSIZE);
36 for (i = 0; i < AES_XTS_IVSIZE; i++) {
37 ctx->tweak[i] = blocknum & 0xff;
38 blocknum >>= 8;
39 }
40 /* Last 64 bits of IV are always zero */
41 bzero(ctx->tweak + AES_XTS_IVSIZE, AES_XTS_IVSIZE);
42
43 rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak);
44 }
45
46 void
aes_xts_crypt(struct aes_xts_ctx * ctx,u_int8_t * data,u_int do_encrypt)47 aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int do_encrypt)
48 {
49 u_int8_t block[AES_XTS_BLOCKSIZE];
50 u_int i, carry_in, carry_out;
51
52 for (i = 0; i < AES_XTS_BLOCKSIZE; i++)
53 block[i] = data[i] ^ ctx->tweak[i];
54
55 if (do_encrypt)
56 rijndael_encrypt(&ctx->key1, block, data);
57 else
58 rijndael_decrypt(&ctx->key1, block, data);
59
60 for (i = 0; i < AES_XTS_BLOCKSIZE; i++)
61 data[i] ^= ctx->tweak[i];
62
63 /* Exponentiate tweak */
64 carry_in = 0;
65 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) {
66 carry_out = ctx->tweak[i] & 0x80;
67 ctx->tweak[i] = (ctx->tweak[i] << 1) | carry_in;
68 carry_in = carry_out >> 7;
69 }
70 ctx->tweak[0] ^= (AES_XTS_ALPHA & -carry_in);
71 explicit_bzero(block, sizeof(block));
72 }
73
74 void
aes_xts_encrypt(struct aes_xts_ctx * ctx,u_int8_t * data)75 aes_xts_encrypt(struct aes_xts_ctx *ctx, u_int8_t *data)
76 {
77 aes_xts_crypt(ctx, data, 1);
78 }
79
80 void
aes_xts_decrypt(struct aes_xts_ctx * ctx,u_int8_t * data)81 aes_xts_decrypt(struct aes_xts_ctx *ctx, u_int8_t *data)
82 {
83 aes_xts_crypt(ctx, data, 0);
84 }
85
86 int
aes_xts_setkey(struct aes_xts_ctx * ctx,u_int8_t * key,int len)87 aes_xts_setkey(struct aes_xts_ctx *ctx, u_int8_t *key, int len)
88 {
89 if (len != 32 && len != 64)
90 return -1;
91
92 rijndael_set_key(&ctx->key1, key, len * 4);
93 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4);
94
95 return 0;
96 }
97
98 void
aes_xts_zerokey(struct aes_xts_ctx * ctx)99 aes_xts_zerokey(struct aes_xts_ctx *ctx)
100 {
101 explicit_bzero(ctx, sizeof(struct aes_xts_ctx));
102 }
103