qxl: check release info object
[qemu.git] / crypto / cipher-nettle.c
1 /*
2 * QEMU Crypto cipher nettle algorithms
3 *
4 * Copyright (c) 2015 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20
21 #include "qemu/osdep.h"
22 #include "crypto/xts.h"
23 #include "cipherpriv.h"
24
25 #include <nettle/nettle-types.h>
26 #include <nettle/aes.h>
27 #include <nettle/des.h>
28 #include <nettle/cbc.h>
29 #include <nettle/cast128.h>
30 #include <nettle/serpent.h>
31 #include <nettle/twofish.h>
32 #include <nettle/ctr.h>
33
34 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
35 size_t length,
36 uint8_t *dst,
37 const uint8_t *src);
38
39 #if CONFIG_NETTLE_VERSION_MAJOR < 3
40 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
41 typedef void * cipher_ctx_t;
42 typedef unsigned cipher_length_t;
43
44 #define cast5_set_key cast128_set_key
45 #else
46 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
47 typedef const void * cipher_ctx_t;
48 typedef size_t cipher_length_t;
49 #endif
50
51 typedef struct QCryptoNettleAES {
52 struct aes_ctx enc;
53 struct aes_ctx dec;
54 } QCryptoNettleAES;
55
56 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
57 uint8_t *dst, const uint8_t *src)
58 {
59 const QCryptoNettleAES *aesctx = ctx;
60 aes_encrypt(&aesctx->enc, length, dst, src);
61 }
62
63 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
64 uint8_t *dst, const uint8_t *src)
65 {
66 const QCryptoNettleAES *aesctx = ctx;
67 aes_decrypt(&aesctx->dec, length, dst, src);
68 }
69
70 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
71 uint8_t *dst, const uint8_t *src)
72 {
73 des_encrypt(ctx, length, dst, src);
74 }
75
76 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
77 uint8_t *dst, const uint8_t *src)
78 {
79 des_decrypt(ctx, length, dst, src);
80 }
81
82 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
83 uint8_t *dst, const uint8_t *src)
84 {
85 des3_encrypt(ctx, length, dst, src);
86 }
87
88 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
89 uint8_t *dst, const uint8_t *src)
90 {
91 des3_decrypt(ctx, length, dst, src);
92 }
93
94 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
95 uint8_t *dst, const uint8_t *src)
96 {
97 cast128_encrypt(ctx, length, dst, src);
98 }
99
100 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
101 uint8_t *dst, const uint8_t *src)
102 {
103 cast128_decrypt(ctx, length, dst, src);
104 }
105
106 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
107 uint8_t *dst, const uint8_t *src)
108 {
109 serpent_encrypt(ctx, length, dst, src);
110 }
111
112 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
113 uint8_t *dst, const uint8_t *src)
114 {
115 serpent_decrypt(ctx, length, dst, src);
116 }
117
118 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
119 uint8_t *dst, const uint8_t *src)
120 {
121 twofish_encrypt(ctx, length, dst, src);
122 }
123
124 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
125 uint8_t *dst, const uint8_t *src)
126 {
127 twofish_decrypt(ctx, length, dst, src);
128 }
129
130 static void aes_encrypt_wrapper(const void *ctx, size_t length,
131 uint8_t *dst, const uint8_t *src)
132 {
133 const QCryptoNettleAES *aesctx = ctx;
134 aes_encrypt(&aesctx->enc, length, dst, src);
135 }
136
137 static void aes_decrypt_wrapper(const void *ctx, size_t length,
138 uint8_t *dst, const uint8_t *src)
139 {
140 const QCryptoNettleAES *aesctx = ctx;
141 aes_decrypt(&aesctx->dec, length, dst, src);
142 }
143
144 static void des_encrypt_wrapper(const void *ctx, size_t length,
145 uint8_t *dst, const uint8_t *src)
146 {
147 des_encrypt(ctx, length, dst, src);
148 }
149
150 static void des_decrypt_wrapper(const void *ctx, size_t length,
151 uint8_t *dst, const uint8_t *src)
152 {
153 des_decrypt(ctx, length, dst, src);
154 }
155
156 static void des3_encrypt_wrapper(const void *ctx, size_t length,
157 uint8_t *dst, const uint8_t *src)
158 {
159 des3_encrypt(ctx, length, dst, src);
160 }
161
162 static void des3_decrypt_wrapper(const void *ctx, size_t length,
163 uint8_t *dst, const uint8_t *src)
164 {
165 des3_decrypt(ctx, length, dst, src);
166 }
167
168 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
169 uint8_t *dst, const uint8_t *src)
170 {
171 cast128_encrypt(ctx, length, dst, src);
172 }
173
174 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
175 uint8_t *dst, const uint8_t *src)
176 {
177 cast128_decrypt(ctx, length, dst, src);
178 }
179
180 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
181 uint8_t *dst, const uint8_t *src)
182 {
183 serpent_encrypt(ctx, length, dst, src);
184 }
185
186 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
187 uint8_t *dst, const uint8_t *src)
188 {
189 serpent_decrypt(ctx, length, dst, src);
190 }
191
192 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
193 uint8_t *dst, const uint8_t *src)
194 {
195 twofish_encrypt(ctx, length, dst, src);
196 }
197
198 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
199 uint8_t *dst, const uint8_t *src)
200 {
201 twofish_decrypt(ctx, length, dst, src);
202 }
203
204 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
205 struct QCryptoCipherNettle {
206 /* Primary cipher context for all modes */
207 void *ctx;
208 /* Second cipher context for XTS mode only */
209 void *ctx_tweak;
210 /* Cipher callbacks for both contexts */
211 QCryptoCipherNettleFuncNative alg_encrypt_native;
212 QCryptoCipherNettleFuncNative alg_decrypt_native;
213 QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
214 QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
215 /* Initialization vector or Counter */
216 uint8_t *iv;
217 size_t blocksize;
218 };
219
220 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
221 QCryptoCipherMode mode)
222 {
223 switch (alg) {
224 case QCRYPTO_CIPHER_ALG_DES_RFB:
225 case QCRYPTO_CIPHER_ALG_3DES:
226 case QCRYPTO_CIPHER_ALG_AES_128:
227 case QCRYPTO_CIPHER_ALG_AES_192:
228 case QCRYPTO_CIPHER_ALG_AES_256:
229 case QCRYPTO_CIPHER_ALG_CAST5_128:
230 case QCRYPTO_CIPHER_ALG_SERPENT_128:
231 case QCRYPTO_CIPHER_ALG_SERPENT_192:
232 case QCRYPTO_CIPHER_ALG_SERPENT_256:
233 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
234 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
235 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
236 break;
237 default:
238 return false;
239 }
240
241 switch (mode) {
242 case QCRYPTO_CIPHER_MODE_ECB:
243 case QCRYPTO_CIPHER_MODE_CBC:
244 case QCRYPTO_CIPHER_MODE_XTS:
245 case QCRYPTO_CIPHER_MODE_CTR:
246 return true;
247 default:
248 return false;
249 }
250 }
251
252
253 static void
254 qcrypto_nettle_cipher_free_ctx(QCryptoCipherNettle *ctx)
255 {
256 if (!ctx) {
257 return;
258 }
259
260 g_free(ctx->iv);
261 g_free(ctx->ctx);
262 g_free(ctx->ctx_tweak);
263 g_free(ctx);
264 }
265
266
267 static QCryptoCipherNettle *qcrypto_cipher_ctx_new(QCryptoCipherAlgorithm alg,
268 QCryptoCipherMode mode,
269 const uint8_t *key,
270 size_t nkey,
271 Error **errp)
272 {
273 QCryptoCipherNettle *ctx;
274 uint8_t *rfbkey;
275
276 switch (mode) {
277 case QCRYPTO_CIPHER_MODE_ECB:
278 case QCRYPTO_CIPHER_MODE_CBC:
279 case QCRYPTO_CIPHER_MODE_XTS:
280 case QCRYPTO_CIPHER_MODE_CTR:
281 break;
282 default:
283 error_setg(errp, "Unsupported cipher mode %s",
284 QCryptoCipherMode_str(mode));
285 return NULL;
286 }
287
288 if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
289 return NULL;
290 }
291
292 ctx = g_new0(QCryptoCipherNettle, 1);
293
294 switch (alg) {
295 case QCRYPTO_CIPHER_ALG_DES_RFB:
296 ctx->ctx = g_new0(struct des_ctx, 1);
297 rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
298 des_set_key(ctx->ctx, rfbkey);
299 g_free(rfbkey);
300
301 ctx->alg_encrypt_native = des_encrypt_native;
302 ctx->alg_decrypt_native = des_decrypt_native;
303 ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
304 ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
305
306 ctx->blocksize = DES_BLOCK_SIZE;
307 break;
308
309 case QCRYPTO_CIPHER_ALG_3DES:
310 ctx->ctx = g_new0(struct des3_ctx, 1);
311 des3_set_key(ctx->ctx, key);
312
313 ctx->alg_encrypt_native = des3_encrypt_native;
314 ctx->alg_decrypt_native = des3_decrypt_native;
315 ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
316 ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
317
318 ctx->blocksize = DES3_BLOCK_SIZE;
319 break;
320
321 case QCRYPTO_CIPHER_ALG_AES_128:
322 case QCRYPTO_CIPHER_ALG_AES_192:
323 case QCRYPTO_CIPHER_ALG_AES_256:
324 ctx->ctx = g_new0(QCryptoNettleAES, 1);
325
326 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
327 ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
328
329 nkey /= 2;
330 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
331 nkey, key);
332 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
333 nkey, key);
334
335 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
336 nkey, key + nkey);
337 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
338 nkey, key + nkey);
339 } else {
340 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
341 nkey, key);
342 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
343 nkey, key);
344 }
345
346 ctx->alg_encrypt_native = aes_encrypt_native;
347 ctx->alg_decrypt_native = aes_decrypt_native;
348 ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
349 ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
350
351 ctx->blocksize = AES_BLOCK_SIZE;
352 break;
353
354 case QCRYPTO_CIPHER_ALG_CAST5_128:
355 ctx->ctx = g_new0(struct cast128_ctx, 1);
356
357 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
358 ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
359
360 nkey /= 2;
361 cast5_set_key(ctx->ctx, nkey, key);
362 cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
363 } else {
364 cast5_set_key(ctx->ctx, nkey, key);
365 }
366
367 ctx->alg_encrypt_native = cast128_encrypt_native;
368 ctx->alg_decrypt_native = cast128_decrypt_native;
369 ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
370 ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
371
372 ctx->blocksize = CAST128_BLOCK_SIZE;
373 break;
374
375 case QCRYPTO_CIPHER_ALG_SERPENT_128:
376 case QCRYPTO_CIPHER_ALG_SERPENT_192:
377 case QCRYPTO_CIPHER_ALG_SERPENT_256:
378 ctx->ctx = g_new0(struct serpent_ctx, 1);
379
380 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
381 ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
382
383 nkey /= 2;
384 serpent_set_key(ctx->ctx, nkey, key);
385 serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
386 } else {
387 serpent_set_key(ctx->ctx, nkey, key);
388 }
389
390 ctx->alg_encrypt_native = serpent_encrypt_native;
391 ctx->alg_decrypt_native = serpent_decrypt_native;
392 ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
393 ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
394
395 ctx->blocksize = SERPENT_BLOCK_SIZE;
396 break;
397
398 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
399 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
400 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
401 ctx->ctx = g_new0(struct twofish_ctx, 1);
402
403 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
404 ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
405
406 nkey /= 2;
407 twofish_set_key(ctx->ctx, nkey, key);
408 twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
409 } else {
410 twofish_set_key(ctx->ctx, nkey, key);
411 }
412
413 ctx->alg_encrypt_native = twofish_encrypt_native;
414 ctx->alg_decrypt_native = twofish_decrypt_native;
415 ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
416 ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
417
418 ctx->blocksize = TWOFISH_BLOCK_SIZE;
419 break;
420
421 default:
422 error_setg(errp, "Unsupported cipher algorithm %s",
423 QCryptoCipherAlgorithm_str(alg));
424 goto error;
425 }
426
427 if (mode == QCRYPTO_CIPHER_MODE_XTS &&
428 ctx->blocksize != XTS_BLOCK_SIZE) {
429 error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
430 ctx->blocksize, XTS_BLOCK_SIZE);
431 goto error;
432 }
433
434 ctx->iv = g_new0(uint8_t, ctx->blocksize);
435
436 return ctx;
437
438 error:
439 qcrypto_nettle_cipher_free_ctx(ctx);
440 return NULL;
441 }
442
443
444 static void
445 qcrypto_nettle_cipher_ctx_free(QCryptoCipher *cipher)
446 {
447 QCryptoCipherNettle *ctx;
448
449 ctx = cipher->opaque;
450 qcrypto_nettle_cipher_free_ctx(ctx);
451 }
452
453
454 static int
455 qcrypto_nettle_cipher_encrypt(QCryptoCipher *cipher,
456 const void *in,
457 void *out,
458 size_t len,
459 Error **errp)
460 {
461 QCryptoCipherNettle *ctx = cipher->opaque;
462
463 if (len % ctx->blocksize) {
464 error_setg(errp, "Length %zu must be a multiple of block size %zu",
465 len, ctx->blocksize);
466 return -1;
467 }
468
469 switch (cipher->mode) {
470 case QCRYPTO_CIPHER_MODE_ECB:
471 ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
472 break;
473
474 case QCRYPTO_CIPHER_MODE_CBC:
475 cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
476 ctx->blocksize, ctx->iv,
477 len, out, in);
478 break;
479
480 case QCRYPTO_CIPHER_MODE_XTS:
481 xts_encrypt(ctx->ctx, ctx->ctx_tweak,
482 ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
483 ctx->iv, len, out, in);
484 break;
485
486 case QCRYPTO_CIPHER_MODE_CTR:
487 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
488 ctx->blocksize, ctx->iv,
489 len, out, in);
490 break;
491
492 default:
493 error_setg(errp, "Unsupported cipher mode %s",
494 QCryptoCipherMode_str(cipher->mode));
495 return -1;
496 }
497 return 0;
498 }
499
500
501 static int
502 qcrypto_nettle_cipher_decrypt(QCryptoCipher *cipher,
503 const void *in,
504 void *out,
505 size_t len,
506 Error **errp)
507 {
508 QCryptoCipherNettle *ctx = cipher->opaque;
509
510 if (len % ctx->blocksize) {
511 error_setg(errp, "Length %zu must be a multiple of block size %zu",
512 len, ctx->blocksize);
513 return -1;
514 }
515
516 switch (cipher->mode) {
517 case QCRYPTO_CIPHER_MODE_ECB:
518 ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
519 break;
520
521 case QCRYPTO_CIPHER_MODE_CBC:
522 cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
523 ctx->blocksize, ctx->iv,
524 len, out, in);
525 break;
526
527 case QCRYPTO_CIPHER_MODE_XTS:
528 xts_decrypt(ctx->ctx, ctx->ctx_tweak,
529 ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
530 ctx->iv, len, out, in);
531 break;
532 case QCRYPTO_CIPHER_MODE_CTR:
533 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
534 ctx->blocksize, ctx->iv,
535 len, out, in);
536 break;
537
538 default:
539 error_setg(errp, "Unsupported cipher mode %s",
540 QCryptoCipherMode_str(cipher->mode));
541 return -1;
542 }
543 return 0;
544 }
545
546 static int
547 qcrypto_nettle_cipher_setiv(QCryptoCipher *cipher,
548 const uint8_t *iv, size_t niv,
549 Error **errp)
550 {
551 QCryptoCipherNettle *ctx = cipher->opaque;
552 if (niv != ctx->blocksize) {
553 error_setg(errp, "Expected IV size %zu not %zu",
554 ctx->blocksize, niv);
555 return -1;
556 }
557 memcpy(ctx->iv, iv, niv);
558 return 0;
559 }
560
561
562 static struct QCryptoCipherDriver qcrypto_cipher_lib_driver = {
563 .cipher_encrypt = qcrypto_nettle_cipher_encrypt,
564 .cipher_decrypt = qcrypto_nettle_cipher_decrypt,
565 .cipher_setiv = qcrypto_nettle_cipher_setiv,
566 .cipher_free = qcrypto_nettle_cipher_ctx_free,
567 };