1 /* $OpenBSD: aes_xts.c,v 1.1 2012/10/09 12:36:50 jsing Exp $ */ 2 /* 3 * Copyright (C) 2008, Damien Miller 4 * 5 * Permission to use, copy, and modify this software with or without fee 6 * is hereby granted, provided that this entire notice is included in 7 * all copies of any software which is or includes a copy or 8 * modification of this software. 9 * You may use this code under the GNU public license if you so wish. Please 10 * contribute changes back to the authors under this freer than GPL license 11 * so that we may further the use of strong encryption without limitations to 12 * all. 13 * 14 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 15 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 16 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 17 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 18 * PURPOSE. 19 */ 20 21 #include <lib/libsa/stand.h> 22 23 #include "aes_xts.h" 24 25 void 26 aes_xts_reinit(struct aes_xts_ctx *ctx, u_int8_t *iv) 27 { 28 u_int64_t blocknum; 29 u_int i; 30 31 /* 32 * Prepare tweak as E_k2(IV). IV is specified as LE representation 33 * of a 64-bit block number which we allow to be passed in directly. 34 */ 35 bcopy(iv, &blocknum, AES_XTS_IVSIZE); 36 for (i = 0; i < AES_XTS_IVSIZE; i++) { 37 ctx->tweak[i] = blocknum & 0xff; 38 blocknum >>= 8; 39 } 40 /* Last 64 bits of IV are always zero */ 41 bzero(ctx->tweak + AES_XTS_IVSIZE, AES_XTS_IVSIZE); 42 43 rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); 44 } 45 46 void 47 aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int do_encrypt) 48 { 49 u_int8_t block[AES_XTS_BLOCKSIZE]; 50 u_int i, carry_in, carry_out; 51 52 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 53 block[i] = data[i] ^ ctx->tweak[i]; 54 55 if (do_encrypt) 56 rijndael_encrypt(&ctx->key1, block, data); 57 else 58 rijndael_decrypt(&ctx->key1, block, data); 59 60 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) 61 data[i] ^= ctx->tweak[i]; 62 63 /* Exponentiate tweak */ 64 carry_in = 0; 65 for (i = 0; i < AES_XTS_BLOCKSIZE; i++) { 66 carry_out = ctx->tweak[i] & 0x80; 67 ctx->tweak[i] = (ctx->tweak[i] << 1) | (carry_in ? 1 : 0); 68 carry_in = carry_out; 69 } 70 if (carry_in) 71 ctx->tweak[0] ^= AES_XTS_ALPHA; 72 explicit_bzero(block, sizeof(block)); 73 } 74 75 void 76 aes_xts_encrypt(struct aes_xts_ctx *ctx, u_int8_t *data) 77 { 78 aes_xts_crypt(ctx, data, 1); 79 } 80 81 void 82 aes_xts_decrypt(struct aes_xts_ctx *ctx, u_int8_t *data) 83 { 84 aes_xts_crypt(ctx, data, 0); 85 } 86 87 int 88 aes_xts_setkey(struct aes_xts_ctx *ctx, u_int8_t *key, int len) 89 { 90 if (len != 32 && len != 64) 91 return -1; 92 93 rijndael_set_key(&ctx->key1, key, len * 4); 94 rijndael_set_key(&ctx->key2, key + (len / 2), len * 4); 95 96 return 0; 97 } 98 99 void 100 aes_xts_zerokey(struct aes_xts_ctx *ctx) 101 { 102 explicit_bzero(ctx, sizeof(struct aes_xts_ctx)); 103 } 104