tests/qapi/doc-good.json: Prepare for qapi-doc Sphinx extension
[qemu.git] / crypto / cipher-nettle.c.inc
1 /*
2  * QEMU Crypto cipher nettle algorithms
3  *
4  * Copyright (c) 2015 Red Hat, Inc.
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20
21 #ifdef CONFIG_QEMU_PRIVATE_XTS
22 #include "crypto/xts.h"
23 #endif
24
25 #include <nettle/nettle-types.h>
26 #include <nettle/aes.h>
27 #include <nettle/des.h>
28 #include <nettle/cbc.h>
29 #include <nettle/cast128.h>
30 #include <nettle/serpent.h>
31 #include <nettle/twofish.h>
32 #include <nettle/ctr.h>
33 #ifndef CONFIG_QEMU_PRIVATE_XTS
34 #include <nettle/xts.h>
35 #endif
36
37 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
38                                                size_t length,
39                                                uint8_t *dst,
40                                                const uint8_t *src);
41
42 #if CONFIG_NETTLE_VERSION_MAJOR < 3
43 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
44 typedef void *       cipher_ctx_t;
45 typedef unsigned     cipher_length_t;
46 #define CONST_CTX
47
48 #define cast5_set_key cast128_set_key
49
50 #define aes128_ctx aes_ctx
51 #define aes192_ctx aes_ctx
52 #define aes256_ctx aes_ctx
53 #define aes128_set_encrypt_key(c, k) \
54     aes_set_encrypt_key(c, 16, k)
55 #define aes192_set_encrypt_key(c, k) \
56     aes_set_encrypt_key(c, 24, k)
57 #define aes256_set_encrypt_key(c, k) \
58     aes_set_encrypt_key(c, 32, k)
59 #define aes128_set_decrypt_key(c, k) \
60     aes_set_decrypt_key(c, 16, k)
61 #define aes192_set_decrypt_key(c, k) \
62     aes_set_decrypt_key(c, 24, k)
63 #define aes256_set_decrypt_key(c, k) \
64     aes_set_decrypt_key(c, 32, k)
65 #define aes128_encrypt aes_encrypt
66 #define aes192_encrypt aes_encrypt
67 #define aes256_encrypt aes_encrypt
68 #define aes128_decrypt aes_decrypt
69 #define aes192_decrypt aes_decrypt
70 #define aes256_decrypt aes_decrypt
71 #else
72 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
73 typedef const void * cipher_ctx_t;
74 typedef size_t       cipher_length_t;
75 #define CONST_CTX    const
76 #endif
77
78 static inline bool qcrypto_length_check(size_t len, size_t blocksize,
79                                         Error **errp)
80 {
81     if (unlikely(len & (blocksize - 1))) {
82         error_setg(errp, "Length %zu must be a multiple of block size %zu",
83                    len, blocksize);
84         return false;
85     }
86     return true;
87 }
88
89
90 static void qcrypto_cipher_ctx_free(QCryptoCipher *ctx)
91 {
92     g_free(ctx);
93 }
94
95 static int qcrypto_cipher_no_setiv(QCryptoCipher *cipher,
96                                    const uint8_t *iv, size_t niv,
97                                    Error **errp)
98 {
99     error_setg(errp, "Setting IV is not supported");
100     return -1;
101 }
102
103
104 #define DEFINE_SETIV(NAME, TYPE, BLEN)                                  \
105 static int NAME##_setiv(QCryptoCipher *cipher, const uint8_t *iv,       \
106                         size_t niv, Error **errp)                       \
107 {                                                                       \
108     TYPE *ctx = container_of(cipher, TYPE, base);                       \
109     if (niv != BLEN) {                                                  \
110         error_setg(errp, "Expected IV size %d not %zu", BLEN, niv);     \
111         return -1;                                                      \
112     }                                                                   \
113     memcpy(ctx->iv, iv, niv);                                           \
114     return 0;                                                           \
115 }
116
117
118 #define DEFINE_ECB(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                  \
119 static int NAME##_encrypt_ecb(QCryptoCipher *cipher, const void *in,    \
120                               void *out, size_t len, Error **errp)      \
121 {                                                                       \
122     TYPE *ctx = container_of(cipher, TYPE, base);                       \
123     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
124         return -1;                                                      \
125     }                                                                   \
126     ENCRYPT(&ctx->key, len, out, in);                                   \
127     return 0;                                                           \
128 }                                                                       \
129 static int NAME##_decrypt_ecb(QCryptoCipher *cipher, const void *in,    \
130                               void *out, size_t len, Error **errp)      \
131 {                                                                       \
132     TYPE *ctx = container_of(cipher, TYPE, base);                       \
133     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
134         return -1;                                                      \
135     }                                                                   \
136     DECRYPT(&ctx->key, len, out, in);                                   \
137     return 0;                                                           \
138 }                                                                       \
139 static const struct QCryptoCipherDriver NAME##_driver_ecb = {           \
140     .cipher_encrypt = NAME##_encrypt_ecb,                               \
141     .cipher_decrypt = NAME##_decrypt_ecb,                               \
142     .cipher_setiv = qcrypto_cipher_no_setiv,                            \
143     .cipher_free = qcrypto_cipher_ctx_free,                             \
144 };
145
146
147 #define DEFINE_CBC(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                  \
148 static int NAME##_encrypt_cbc(QCryptoCipher *cipher, const void *in,    \
149                               void *out, size_t len, Error **errp)      \
150 {                                                                       \
151     TYPE *ctx = container_of(cipher, TYPE, base);                       \
152     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
153         return -1;                                                      \
154     }                                                                   \
155     cbc_encrypt(&ctx->key, ENCRYPT, BLEN, ctx->iv, len, out, in);       \
156     return 0;                                                           \
157 }                                                                       \
158 static int NAME##_decrypt_cbc(QCryptoCipher *cipher, const void *in,    \
159                               void *out, size_t len, Error **errp)      \
160 {                                                                       \
161     TYPE *ctx = container_of(cipher, TYPE, base);                       \
162     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
163         return -1;                                                      \
164     }                                                                   \
165     cbc_decrypt(&ctx->key, DECRYPT, BLEN, ctx->iv, len, out, in);       \
166     return 0;                                                           \
167 }                                                                       \
168 static const struct QCryptoCipherDriver NAME##_driver_cbc = {           \
169     .cipher_encrypt = NAME##_encrypt_cbc,                               \
170     .cipher_decrypt = NAME##_decrypt_cbc,                               \
171     .cipher_setiv = NAME##_setiv,                                       \
172     .cipher_free = qcrypto_cipher_ctx_free,                             \
173 };
174
175
176 #define DEFINE_CTR(NAME, TYPE, BLEN, ENCRYPT)                           \
177 static int NAME##_encrypt_ctr(QCryptoCipher *cipher, const void *in,    \
178                               void *out, size_t len, Error **errp)      \
179 {                                                                       \
180     TYPE *ctx = container_of(cipher, TYPE, base);                       \
181     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
182         return -1;                                                      \
183     }                                                                   \
184     ctr_crypt(&ctx->key, ENCRYPT, BLEN, ctx->iv, len, out, in);         \
185     return 0;                                                           \
186 }                                                                       \
187 static const struct QCryptoCipherDriver NAME##_driver_ctr = {           \
188     .cipher_encrypt = NAME##_encrypt_ctr,                               \
189     .cipher_decrypt = NAME##_encrypt_ctr,                               \
190     .cipher_setiv = NAME##_setiv,                                       \
191     .cipher_free = qcrypto_cipher_ctx_free,                             \
192 };
193
194
195 #ifdef CONFIG_QEMU_PRIVATE_XTS
196 #define DEFINE__XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                 \
197 static void NAME##_xts_wrape(const void *ctx, size_t length,            \
198                              uint8_t *dst, const uint8_t *src)          \
199 {                                                                       \
200     ENCRYPT((cipher_ctx_t)ctx, length, dst, src);                       \
201 }                                                                       \
202 static void NAME##_xts_wrapd(const void *ctx, size_t length,            \
203                              uint8_t *dst, const uint8_t *src)          \
204 {                                                                       \
205     DECRYPT((cipher_ctx_t)ctx, length, dst, src);                       \
206 }                                                                       \
207 static int NAME##_encrypt_xts(QCryptoCipher *cipher, const void *in,    \
208                               void *out, size_t len, Error **errp)      \
209 {                                                                       \
210     TYPE *ctx = container_of(cipher, TYPE, base);                       \
211     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
212         return -1;                                                      \
213     }                                                                   \
214     xts_encrypt(&ctx->key, &ctx->key_xts,                               \
215                 NAME##_xts_wrape, NAME##_xts_wrapd,                     \
216                 ctx->iv, len, out, in);                                 \
217     return 0;                                                           \
218 }                                                                       \
219 static int NAME##_decrypt_xts(QCryptoCipher *cipher, const void *in,    \
220                               void *out, size_t len, Error **errp)      \
221 {                                                                       \
222     TYPE *ctx = container_of(cipher, TYPE, base);                       \
223     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
224         return -1;                                                      \
225     }                                                                   \
226     xts_decrypt(&ctx->key, &ctx->key_xts,                               \
227                 NAME##_xts_wrape, NAME##_xts_wrapd,                     \
228                 ctx->iv, len, out, in);                                 \
229     return 0;                                                           \
230 }
231 #else
232 #define DEFINE__XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                 \
233 static int NAME##_encrypt_xts(QCryptoCipher *cipher, const void *in,    \
234                               void *out, size_t len, Error **errp)      \
235 {                                                                       \
236     TYPE *ctx = container_of(cipher, TYPE, base);                       \
237     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
238         return -1;                                                      \
239     }                                                                   \
240     xts_encrypt_message(&ctx->key, &ctx->key_xts, ENCRYPT,              \
241                         ctx->iv, len, out, in);                         \
242     return 0;                                                           \
243 }                                                                       \
244 static int NAME##_decrypt_xts(QCryptoCipher *cipher, const void *in,    \
245                               void *out, size_t len, Error **errp)      \
246 {                                                                       \
247     TYPE *ctx = container_of(cipher, TYPE, base);                       \
248     if (!qcrypto_length_check(len, BLEN, errp)) {                       \
249         return -1;                                                      \
250     }                                                                   \
251     xts_decrypt_message(&ctx->key, &ctx->key_xts, DECRYPT, ENCRYPT,     \
252                         ctx->iv, len, out, in);                         \
253     return 0;                                                           \
254 }
255 #endif
256
257 #define DEFINE_XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)          \
258     QEMU_BUILD_BUG_ON(BLEN != XTS_BLOCK_SIZE);                  \
259     DEFINE__XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)             \
260 static const struct QCryptoCipherDriver NAME##_driver_xts = {   \
261     .cipher_encrypt = NAME##_encrypt_xts,                       \
262     .cipher_decrypt = NAME##_decrypt_xts,                       \
263     .cipher_setiv = NAME##_setiv,                               \
264     .cipher_free = qcrypto_cipher_ctx_free,                     \
265 };
266
267
268 #define DEFINE_ECB_CBC_CTR(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)  \
269     DEFINE_SETIV(NAME, TYPE, BLEN)                              \
270     DEFINE_ECB(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)              \
271     DEFINE_CBC(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)              \
272     DEFINE_CTR(NAME, TYPE, BLEN, ENCRYPT)
273
274 #define DEFINE_ECB_CBC_CTR_XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)      \
275     DEFINE_ECB_CBC_CTR(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)              \
276     DEFINE_XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)
277
278
279 typedef struct QCryptoNettleDESRFB {
280     QCryptoCipher base;
281     struct des_ctx key;
282     uint8_t iv[DES_BLOCK_SIZE];
283 } QCryptoNettleDESRFB;
284
285 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
286                                uint8_t *dst, const uint8_t *src)
287 {
288     des_encrypt(ctx, length, dst, src);
289 }
290
291 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
292                                uint8_t *dst, const uint8_t *src)
293 {
294     des_decrypt(ctx, length, dst, src);
295 }
296
297 DEFINE_ECB_CBC_CTR(qcrypto_nettle_des_rfb, QCryptoNettleDESRFB,
298                    DES_BLOCK_SIZE, des_encrypt_native, des_decrypt_native)
299
300
301 typedef struct QCryptoNettleDES3 {
302     QCryptoCipher base;
303     struct des3_ctx key;
304     uint8_t iv[DES3_BLOCK_SIZE];
305 } QCryptoNettleDES3;
306
307 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
308                                 uint8_t *dst, const uint8_t *src)
309 {
310     des3_encrypt(ctx, length, dst, src);
311 }
312
313 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
314                                 uint8_t *dst, const uint8_t *src)
315 {
316     des3_decrypt(ctx, length, dst, src);
317 }
318
319 DEFINE_ECB_CBC_CTR(qcrypto_nettle_des3, QCryptoNettleDES3, DES3_BLOCK_SIZE,
320                    des3_encrypt_native, des3_decrypt_native)
321
322
323 typedef struct QCryptoNettleAES128 {
324     QCryptoCipher base;
325     uint8_t iv[AES_BLOCK_SIZE];
326     /* First key from pair is encode, second key is decode. */
327     struct aes128_ctx key[2], key_xts[2];
328 } QCryptoNettleAES128;
329
330 static void aes128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
331                                   uint8_t *dst, const uint8_t *src)
332 {
333     CONST_CTX struct aes128_ctx *keys = ctx;
334     aes128_encrypt(&keys[0], length, dst, src);
335 }
336
337 static void aes128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
338                                   uint8_t *dst, const uint8_t *src)
339 {
340     CONST_CTX struct aes128_ctx *keys = ctx;
341     aes128_decrypt(&keys[1], length, dst, src);
342 }
343
344 DEFINE_ECB_CBC_CTR_XTS(qcrypto_nettle_aes128,
345                        QCryptoNettleAES128, AES_BLOCK_SIZE,
346                        aes128_encrypt_native, aes128_decrypt_native)
347
348
349 typedef struct QCryptoNettleAES192 {
350     QCryptoCipher base;
351     uint8_t iv[AES_BLOCK_SIZE];
352     /* First key from pair is encode, second key is decode. */
353     struct aes192_ctx key[2], key_xts[2];
354 } QCryptoNettleAES192;
355
356 static void aes192_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
357                                   uint8_t *dst, const uint8_t *src)
358 {
359     CONST_CTX struct aes192_ctx *keys = ctx;
360     aes192_encrypt(&keys[0], length, dst, src);
361 }
362
363 static void aes192_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
364                                   uint8_t *dst, const uint8_t *src)
365 {
366     CONST_CTX struct aes192_ctx *keys = ctx;
367     aes192_decrypt(&keys[1], length, dst, src);
368 }
369
370 DEFINE_ECB_CBC_CTR_XTS(qcrypto_nettle_aes192,
371                        QCryptoNettleAES192, AES_BLOCK_SIZE,
372                        aes192_encrypt_native, aes192_decrypt_native)
373
374
375 typedef struct QCryptoNettleAES256 {
376     QCryptoCipher base;
377     uint8_t iv[AES_BLOCK_SIZE];
378     /* First key from pair is encode, second key is decode. */
379     struct aes256_ctx key[2], key_xts[2];
380 } QCryptoNettleAES256;
381
382 static void aes256_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
383                                   uint8_t *dst, const uint8_t *src)
384 {
385     CONST_CTX struct aes256_ctx *keys = ctx;
386     aes256_encrypt(&keys[0], length, dst, src);
387 }
388
389 static void aes256_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
390                                uint8_t *dst, const uint8_t *src)
391 {
392     CONST_CTX struct aes256_ctx *keys = ctx;
393     aes256_decrypt(&keys[1], length, dst, src);
394 }
395
396 DEFINE_ECB_CBC_CTR_XTS(qcrypto_nettle_aes256,
397                        QCryptoNettleAES256, AES_BLOCK_SIZE,
398                        aes256_encrypt_native, aes256_decrypt_native)
399
400
401 typedef struct QCryptoNettleCAST128 {
402     QCryptoCipher base;
403     uint8_t iv[CAST128_BLOCK_SIZE];
404     struct cast128_ctx key, key_xts;
405 } QCryptoNettleCAST128;
406
407 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
408                                    uint8_t *dst, const uint8_t *src)
409 {
410     cast128_encrypt(ctx, length, dst, src);
411 }
412
413 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
414                                    uint8_t *dst, const uint8_t *src)
415 {
416     cast128_decrypt(ctx, length, dst, src);
417 }
418
419 DEFINE_ECB_CBC_CTR(qcrypto_nettle_cast128,
420                    QCryptoNettleCAST128, CAST128_BLOCK_SIZE,
421                    cast128_encrypt_native, cast128_decrypt_native)
422
423
424 typedef struct QCryptoNettleSerpent {
425     QCryptoCipher base;
426     uint8_t iv[SERPENT_BLOCK_SIZE];
427     struct serpent_ctx key, key_xts;
428 } QCryptoNettleSerpent;
429
430
431 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
432                                    uint8_t *dst, const uint8_t *src)
433 {
434     serpent_encrypt(ctx, length, dst, src);
435 }
436
437 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
438                                    uint8_t *dst, const uint8_t *src)
439 {
440     serpent_decrypt(ctx, length, dst, src);
441 }
442
443 DEFINE_ECB_CBC_CTR_XTS(qcrypto_nettle_serpent,
444                        QCryptoNettleSerpent, SERPENT_BLOCK_SIZE,
445                        serpent_encrypt_native, serpent_decrypt_native)
446
447
448 typedef struct QCryptoNettleTwofish {
449     QCryptoCipher base;
450     uint8_t iv[TWOFISH_BLOCK_SIZE];
451     struct twofish_ctx key, key_xts;
452 } QCryptoNettleTwofish;
453
454 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
455                                    uint8_t *dst, const uint8_t *src)
456 {
457     twofish_encrypt(ctx, length, dst, src);
458 }
459
460 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
461                                    uint8_t *dst, const uint8_t *src)
462 {
463     twofish_decrypt(ctx, length, dst, src);
464 }
465
466 DEFINE_ECB_CBC_CTR_XTS(qcrypto_nettle_twofish,
467                        QCryptoNettleTwofish, TWOFISH_BLOCK_SIZE,
468                        twofish_encrypt_native, twofish_decrypt_native)
469
470
471 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
472                              QCryptoCipherMode mode)
473 {
474     switch (alg) {
475     case QCRYPTO_CIPHER_ALG_DES_RFB:
476     case QCRYPTO_CIPHER_ALG_3DES:
477     case QCRYPTO_CIPHER_ALG_AES_128:
478     case QCRYPTO_CIPHER_ALG_AES_192:
479     case QCRYPTO_CIPHER_ALG_AES_256:
480     case QCRYPTO_CIPHER_ALG_CAST5_128:
481     case QCRYPTO_CIPHER_ALG_SERPENT_128:
482     case QCRYPTO_CIPHER_ALG_SERPENT_192:
483     case QCRYPTO_CIPHER_ALG_SERPENT_256:
484     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
485     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
486     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
487         break;
488     default:
489         return false;
490     }
491
492     switch (mode) {
493     case QCRYPTO_CIPHER_MODE_ECB:
494     case QCRYPTO_CIPHER_MODE_CBC:
495     case QCRYPTO_CIPHER_MODE_XTS:
496     case QCRYPTO_CIPHER_MODE_CTR:
497         return true;
498     default:
499         return false;
500     }
501 }
502
503 static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgorithm alg,
504                                              QCryptoCipherMode mode,
505                                              const uint8_t *key,
506                                              size_t nkey,
507                                              Error **errp)
508 {
509     switch (mode) {
510     case QCRYPTO_CIPHER_MODE_ECB:
511     case QCRYPTO_CIPHER_MODE_CBC:
512     case QCRYPTO_CIPHER_MODE_XTS:
513     case QCRYPTO_CIPHER_MODE_CTR:
514         break;
515     default:
516         goto bad_cipher_mode;
517     }
518
519     if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
520         return NULL;
521     }
522
523     switch (alg) {
524     case QCRYPTO_CIPHER_ALG_DES_RFB:
525         {
526             QCryptoNettleDESRFB *ctx;
527             const QCryptoCipherDriver *drv;
528             uint8_t *rfbkey;
529
530             switch (mode) {
531             case QCRYPTO_CIPHER_MODE_ECB:
532                 drv = &qcrypto_nettle_des_rfb_driver_ecb;
533                 break;
534             case QCRYPTO_CIPHER_MODE_CBC:
535                 drv = &qcrypto_nettle_des_rfb_driver_cbc;
536                 break;
537             case QCRYPTO_CIPHER_MODE_CTR:
538                 drv = &qcrypto_nettle_des_rfb_driver_ctr;
539                 break;
540             default:
541                 goto bad_cipher_mode;
542             }
543
544             ctx = g_new0(QCryptoNettleDESRFB, 1);
545             ctx->base.driver = drv;
546
547             rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
548             des_set_key(&ctx->key, rfbkey);
549             g_free(rfbkey);
550
551             return &ctx->base;
552         }
553
554     case QCRYPTO_CIPHER_ALG_3DES:
555         {
556             QCryptoNettleDES3 *ctx;
557             const QCryptoCipherDriver *drv;
558
559             switch (mode) {
560             case QCRYPTO_CIPHER_MODE_ECB:
561                 drv = &qcrypto_nettle_des3_driver_ecb;
562                 break;
563             case QCRYPTO_CIPHER_MODE_CBC:
564                 drv = &qcrypto_nettle_des3_driver_cbc;
565                 break;
566             case QCRYPTO_CIPHER_MODE_CTR:
567                 drv = &qcrypto_nettle_des3_driver_ctr;
568                 break;
569             default:
570                 goto bad_cipher_mode;
571             }
572
573             ctx = g_new0(QCryptoNettleDES3, 1);
574             ctx->base.driver = drv;
575             des3_set_key(&ctx->key, key);
576             return &ctx->base;
577         }
578
579     case QCRYPTO_CIPHER_ALG_AES_128:
580         {
581             QCryptoNettleAES128 *ctx = g_new0(QCryptoNettleAES128, 1);
582
583             switch (mode) {
584             case QCRYPTO_CIPHER_MODE_ECB:
585                 ctx->base.driver = &qcrypto_nettle_aes128_driver_ecb;
586                 break;
587             case QCRYPTO_CIPHER_MODE_CBC:
588                 ctx->base.driver = &qcrypto_nettle_aes128_driver_cbc;
589                 break;
590             case QCRYPTO_CIPHER_MODE_CTR:
591                 ctx->base.driver = &qcrypto_nettle_aes128_driver_ctr;
592                 break;
593             case QCRYPTO_CIPHER_MODE_XTS:
594                 ctx->base.driver = &qcrypto_nettle_aes128_driver_xts;
595                 nkey /= 2;
596                 aes128_set_encrypt_key(&ctx->key_xts[0], key + nkey);
597                 aes128_set_decrypt_key(&ctx->key_xts[1], key + nkey);
598                 break;
599             default:
600                 g_assert_not_reached();
601             }
602             aes128_set_encrypt_key(&ctx->key[0], key);
603             aes128_set_decrypt_key(&ctx->key[1], key);
604
605             return &ctx->base;
606         }
607
608     case QCRYPTO_CIPHER_ALG_AES_192:
609         {
610             QCryptoNettleAES192 *ctx = g_new0(QCryptoNettleAES192, 1);
611
612             switch (mode) {
613             case QCRYPTO_CIPHER_MODE_ECB:
614                 ctx->base.driver = &qcrypto_nettle_aes192_driver_ecb;
615                 break;
616             case QCRYPTO_CIPHER_MODE_CBC:
617                 ctx->base.driver = &qcrypto_nettle_aes192_driver_cbc;
618                 break;
619             case QCRYPTO_CIPHER_MODE_CTR:
620                 ctx->base.driver = &qcrypto_nettle_aes192_driver_ctr;
621                 break;
622             case QCRYPTO_CIPHER_MODE_XTS:
623                 ctx->base.driver = &qcrypto_nettle_aes192_driver_xts;
624                 nkey /= 2;
625                 aes192_set_encrypt_key(&ctx->key_xts[0], key + nkey);
626                 aes192_set_decrypt_key(&ctx->key_xts[1], key + nkey);
627                 break;
628             default:
629                 g_assert_not_reached();
630             }
631             aes192_set_encrypt_key(&ctx->key[0], key);
632             aes192_set_decrypt_key(&ctx->key[1], key);
633
634             return &ctx->base;
635         }
636
637     case QCRYPTO_CIPHER_ALG_AES_256:
638         {
639             QCryptoNettleAES256 *ctx = g_new0(QCryptoNettleAES256, 1);
640
641             switch (mode) {
642             case QCRYPTO_CIPHER_MODE_ECB:
643                 ctx->base.driver = &qcrypto_nettle_aes256_driver_ecb;
644                 break;
645             case QCRYPTO_CIPHER_MODE_CBC:
646                 ctx->base.driver = &qcrypto_nettle_aes256_driver_cbc;
647                 break;
648             case QCRYPTO_CIPHER_MODE_CTR:
649                 ctx->base.driver = &qcrypto_nettle_aes256_driver_ctr;
650                 break;
651             case QCRYPTO_CIPHER_MODE_XTS:
652                 ctx->base.driver = &qcrypto_nettle_aes256_driver_xts;
653                 nkey /= 2;
654                 aes256_set_encrypt_key(&ctx->key_xts[0], key + nkey);
655                 aes256_set_decrypt_key(&ctx->key_xts[1], key + nkey);
656                 break;
657             default:
658                 g_assert_not_reached();
659             }
660             aes256_set_encrypt_key(&ctx->key[0], key);
661             aes256_set_decrypt_key(&ctx->key[1], key);
662
663             return &ctx->base;
664         }
665
666     case QCRYPTO_CIPHER_ALG_CAST5_128:
667         {
668             QCryptoNettleCAST128 *ctx;
669             const QCryptoCipherDriver *drv;
670
671             switch (mode) {
672             case QCRYPTO_CIPHER_MODE_ECB:
673                 drv = &qcrypto_nettle_cast128_driver_ecb;
674                 break;
675             case QCRYPTO_CIPHER_MODE_CBC:
676                 drv = &qcrypto_nettle_cast128_driver_cbc;
677                 break;
678             case QCRYPTO_CIPHER_MODE_CTR:
679                 drv = &qcrypto_nettle_cast128_driver_ctr;
680                 break;
681             default:
682                 goto bad_cipher_mode;
683             }
684
685             ctx = g_new0(QCryptoNettleCAST128, 1);
686             ctx->base.driver = drv;
687             cast5_set_key(&ctx->key, nkey, key);
688
689             return &ctx->base;
690         }
691
692     case QCRYPTO_CIPHER_ALG_SERPENT_128:
693     case QCRYPTO_CIPHER_ALG_SERPENT_192:
694     case QCRYPTO_CIPHER_ALG_SERPENT_256:
695         {
696             QCryptoNettleSerpent *ctx = g_new0(QCryptoNettleSerpent, 1);
697
698             switch (mode) {
699             case QCRYPTO_CIPHER_MODE_ECB:
700                 ctx->base.driver = &qcrypto_nettle_serpent_driver_ecb;
701                 break;
702             case QCRYPTO_CIPHER_MODE_CBC:
703                 ctx->base.driver = &qcrypto_nettle_serpent_driver_cbc;
704                 break;
705             case QCRYPTO_CIPHER_MODE_CTR:
706                 ctx->base.driver = &qcrypto_nettle_serpent_driver_ctr;
707                 break;
708             case QCRYPTO_CIPHER_MODE_XTS:
709                 ctx->base.driver = &qcrypto_nettle_serpent_driver_xts;
710                 nkey /= 2;
711                 serpent_set_key(&ctx->key_xts, nkey, key + nkey);
712                 break;
713             default:
714                 g_assert_not_reached();
715             }
716             serpent_set_key(&ctx->key, nkey, key);
717
718             return &ctx->base;
719         }
720
721     case QCRYPTO_CIPHER_ALG_TWOFISH_128:
722     case QCRYPTO_CIPHER_ALG_TWOFISH_192:
723     case QCRYPTO_CIPHER_ALG_TWOFISH_256:
724         {
725             QCryptoNettleTwofish *ctx = g_new0(QCryptoNettleTwofish, 1);
726
727             switch (mode) {
728             case QCRYPTO_CIPHER_MODE_ECB:
729                 ctx->base.driver = &qcrypto_nettle_twofish_driver_ecb;
730                 break;
731             case QCRYPTO_CIPHER_MODE_CBC:
732                 ctx->base.driver = &qcrypto_nettle_twofish_driver_cbc;
733                 break;
734             case QCRYPTO_CIPHER_MODE_CTR:
735                 ctx->base.driver = &qcrypto_nettle_twofish_driver_ctr;
736                 break;
737             case QCRYPTO_CIPHER_MODE_XTS:
738                 ctx->base.driver = &qcrypto_nettle_twofish_driver_xts;
739                 nkey /= 2;
740                 twofish_set_key(&ctx->key_xts, nkey, key + nkey);
741                 break;
742             default:
743                 g_assert_not_reached();
744             }
745             twofish_set_key(&ctx->key, nkey, key);
746
747             return &ctx->base;
748         }
749
750     default:
751         error_setg(errp, "Unsupported cipher algorithm %s",
752                    QCryptoCipherAlgorithm_str(alg));
753         return NULL;
754     }
755
756  bad_cipher_mode:
757     error_setg(errp, "Unsupported cipher mode %s",
758                QCryptoCipherMode_str(mode));
759     return NULL;
760 }