Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170103-1' into staging
[qemu.git] / crypto / cipher-nettle.c
1 /*
2 * QEMU Crypto cipher nettle algorithms
3 *
4 * Copyright (c) 2015 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20
21 #include "qemu/osdep.h"
22 #include "crypto/xts.h"
23
24 #include <nettle/nettle-types.h>
25 #include <nettle/aes.h>
26 #include <nettle/des.h>
27 #include <nettle/cbc.h>
28 #include <nettle/cast128.h>
29 #include <nettle/serpent.h>
30 #include <nettle/twofish.h>
31 #include <nettle/ctr.h>
32
33 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
34 size_t length,
35 uint8_t *dst,
36 const uint8_t *src);
37
38 #if CONFIG_NETTLE_VERSION_MAJOR < 3
39 typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
40 typedef void * cipher_ctx_t;
41 typedef unsigned cipher_length_t;
42
43 #define cast5_set_key cast128_set_key
44 #else
45 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
46 typedef const void * cipher_ctx_t;
47 typedef size_t cipher_length_t;
48 #endif
49
50 typedef struct QCryptoNettleAES {
51 struct aes_ctx enc;
52 struct aes_ctx dec;
53 } QCryptoNettleAES;
54
55 static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
56 uint8_t *dst, const uint8_t *src)
57 {
58 const QCryptoNettleAES *aesctx = ctx;
59 aes_encrypt(&aesctx->enc, length, dst, src);
60 }
61
62 static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
63 uint8_t *dst, const uint8_t *src)
64 {
65 const QCryptoNettleAES *aesctx = ctx;
66 aes_decrypt(&aesctx->dec, length, dst, src);
67 }
68
69 static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
70 uint8_t *dst, const uint8_t *src)
71 {
72 des_encrypt(ctx, length, dst, src);
73 }
74
75 static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
76 uint8_t *dst, const uint8_t *src)
77 {
78 des_decrypt(ctx, length, dst, src);
79 }
80
81 static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
82 uint8_t *dst, const uint8_t *src)
83 {
84 des3_encrypt(ctx, length, dst, src);
85 }
86
87 static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
88 uint8_t *dst, const uint8_t *src)
89 {
90 des3_decrypt(ctx, length, dst, src);
91 }
92
93 static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
94 uint8_t *dst, const uint8_t *src)
95 {
96 cast128_encrypt(ctx, length, dst, src);
97 }
98
99 static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
100 uint8_t *dst, const uint8_t *src)
101 {
102 cast128_decrypt(ctx, length, dst, src);
103 }
104
105 static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
106 uint8_t *dst, const uint8_t *src)
107 {
108 serpent_encrypt(ctx, length, dst, src);
109 }
110
111 static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
112 uint8_t *dst, const uint8_t *src)
113 {
114 serpent_decrypt(ctx, length, dst, src);
115 }
116
117 static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
118 uint8_t *dst, const uint8_t *src)
119 {
120 twofish_encrypt(ctx, length, dst, src);
121 }
122
123 static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
124 uint8_t *dst, const uint8_t *src)
125 {
126 twofish_decrypt(ctx, length, dst, src);
127 }
128
129 static void aes_encrypt_wrapper(const void *ctx, size_t length,
130 uint8_t *dst, const uint8_t *src)
131 {
132 const QCryptoNettleAES *aesctx = ctx;
133 aes_encrypt(&aesctx->enc, length, dst, src);
134 }
135
136 static void aes_decrypt_wrapper(const void *ctx, size_t length,
137 uint8_t *dst, const uint8_t *src)
138 {
139 const QCryptoNettleAES *aesctx = ctx;
140 aes_decrypt(&aesctx->dec, length, dst, src);
141 }
142
143 static void des_encrypt_wrapper(const void *ctx, size_t length,
144 uint8_t *dst, const uint8_t *src)
145 {
146 des_encrypt(ctx, length, dst, src);
147 }
148
149 static void des_decrypt_wrapper(const void *ctx, size_t length,
150 uint8_t *dst, const uint8_t *src)
151 {
152 des_decrypt(ctx, length, dst, src);
153 }
154
155 static void des3_encrypt_wrapper(const void *ctx, size_t length,
156 uint8_t *dst, const uint8_t *src)
157 {
158 des3_encrypt(ctx, length, dst, src);
159 }
160
161 static void des3_decrypt_wrapper(const void *ctx, size_t length,
162 uint8_t *dst, const uint8_t *src)
163 {
164 des3_decrypt(ctx, length, dst, src);
165 }
166
167 static void cast128_encrypt_wrapper(const void *ctx, size_t length,
168 uint8_t *dst, const uint8_t *src)
169 {
170 cast128_encrypt(ctx, length, dst, src);
171 }
172
173 static void cast128_decrypt_wrapper(const void *ctx, size_t length,
174 uint8_t *dst, const uint8_t *src)
175 {
176 cast128_decrypt(ctx, length, dst, src);
177 }
178
179 static void serpent_encrypt_wrapper(const void *ctx, size_t length,
180 uint8_t *dst, const uint8_t *src)
181 {
182 serpent_encrypt(ctx, length, dst, src);
183 }
184
185 static void serpent_decrypt_wrapper(const void *ctx, size_t length,
186 uint8_t *dst, const uint8_t *src)
187 {
188 serpent_decrypt(ctx, length, dst, src);
189 }
190
191 static void twofish_encrypt_wrapper(const void *ctx, size_t length,
192 uint8_t *dst, const uint8_t *src)
193 {
194 twofish_encrypt(ctx, length, dst, src);
195 }
196
197 static void twofish_decrypt_wrapper(const void *ctx, size_t length,
198 uint8_t *dst, const uint8_t *src)
199 {
200 twofish_decrypt(ctx, length, dst, src);
201 }
202
203 typedef struct QCryptoCipherNettle QCryptoCipherNettle;
204 struct QCryptoCipherNettle {
205 /* Primary cipher context for all modes */
206 void *ctx;
207 /* Second cipher context for XTS mode only */
208 void *ctx_tweak;
209 /* Cipher callbacks for both contexts */
210 QCryptoCipherNettleFuncNative alg_encrypt_native;
211 QCryptoCipherNettleFuncNative alg_decrypt_native;
212 QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
213 QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
214 /* Initialization vector or Counter */
215 uint8_t *iv;
216 size_t blocksize;
217 };
218
219 bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
220 QCryptoCipherMode mode)
221 {
222 switch (alg) {
223 case QCRYPTO_CIPHER_ALG_DES_RFB:
224 case QCRYPTO_CIPHER_ALG_3DES:
225 case QCRYPTO_CIPHER_ALG_AES_128:
226 case QCRYPTO_CIPHER_ALG_AES_192:
227 case QCRYPTO_CIPHER_ALG_AES_256:
228 case QCRYPTO_CIPHER_ALG_CAST5_128:
229 case QCRYPTO_CIPHER_ALG_SERPENT_128:
230 case QCRYPTO_CIPHER_ALG_SERPENT_192:
231 case QCRYPTO_CIPHER_ALG_SERPENT_256:
232 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
233 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
234 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
235 break;
236 default:
237 return false;
238 }
239
240 switch (mode) {
241 case QCRYPTO_CIPHER_MODE_ECB:
242 case QCRYPTO_CIPHER_MODE_CBC:
243 case QCRYPTO_CIPHER_MODE_XTS:
244 case QCRYPTO_CIPHER_MODE_CTR:
245 return true;
246 default:
247 return false;
248 }
249 }
250
251
252 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
253 QCryptoCipherMode mode,
254 const uint8_t *key, size_t nkey,
255 Error **errp)
256 {
257 QCryptoCipher *cipher;
258 QCryptoCipherNettle *ctx;
259 uint8_t *rfbkey;
260
261 switch (mode) {
262 case QCRYPTO_CIPHER_MODE_ECB:
263 case QCRYPTO_CIPHER_MODE_CBC:
264 case QCRYPTO_CIPHER_MODE_XTS:
265 case QCRYPTO_CIPHER_MODE_CTR:
266 break;
267 default:
268 error_setg(errp, "Unsupported cipher mode %s",
269 QCryptoCipherMode_lookup[mode]);
270 return NULL;
271 }
272
273 if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
274 return NULL;
275 }
276
277 cipher = g_new0(QCryptoCipher, 1);
278 cipher->alg = alg;
279 cipher->mode = mode;
280
281 ctx = g_new0(QCryptoCipherNettle, 1);
282 cipher->opaque = ctx;
283
284 switch (alg) {
285 case QCRYPTO_CIPHER_ALG_DES_RFB:
286 ctx->ctx = g_new0(struct des_ctx, 1);
287 rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
288 des_set_key(ctx->ctx, rfbkey);
289 g_free(rfbkey);
290
291 ctx->alg_encrypt_native = des_encrypt_native;
292 ctx->alg_decrypt_native = des_decrypt_native;
293 ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
294 ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
295
296 ctx->blocksize = DES_BLOCK_SIZE;
297 break;
298
299 case QCRYPTO_CIPHER_ALG_3DES:
300 ctx->ctx = g_new0(struct des3_ctx, 1);
301 des3_set_key(ctx->ctx, key);
302
303 ctx->alg_encrypt_native = des3_encrypt_native;
304 ctx->alg_decrypt_native = des3_decrypt_native;
305 ctx->alg_encrypt_wrapper = des3_encrypt_wrapper;
306 ctx->alg_decrypt_wrapper = des3_decrypt_wrapper;
307
308 ctx->blocksize = DES3_BLOCK_SIZE;
309 break;
310
311 case QCRYPTO_CIPHER_ALG_AES_128:
312 case QCRYPTO_CIPHER_ALG_AES_192:
313 case QCRYPTO_CIPHER_ALG_AES_256:
314 ctx->ctx = g_new0(QCryptoNettleAES, 1);
315
316 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
317 ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
318
319 nkey /= 2;
320 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
321 nkey, key);
322 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
323 nkey, key);
324
325 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
326 nkey, key + nkey);
327 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
328 nkey, key + nkey);
329 } else {
330 aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
331 nkey, key);
332 aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
333 nkey, key);
334 }
335
336 ctx->alg_encrypt_native = aes_encrypt_native;
337 ctx->alg_decrypt_native = aes_decrypt_native;
338 ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
339 ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
340
341 ctx->blocksize = AES_BLOCK_SIZE;
342 break;
343
344 case QCRYPTO_CIPHER_ALG_CAST5_128:
345 ctx->ctx = g_new0(struct cast128_ctx, 1);
346
347 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
348 ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
349
350 nkey /= 2;
351 cast5_set_key(ctx->ctx, nkey, key);
352 cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
353 } else {
354 cast5_set_key(ctx->ctx, nkey, key);
355 }
356
357 ctx->alg_encrypt_native = cast128_encrypt_native;
358 ctx->alg_decrypt_native = cast128_decrypt_native;
359 ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
360 ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
361
362 ctx->blocksize = CAST128_BLOCK_SIZE;
363 break;
364
365 case QCRYPTO_CIPHER_ALG_SERPENT_128:
366 case QCRYPTO_CIPHER_ALG_SERPENT_192:
367 case QCRYPTO_CIPHER_ALG_SERPENT_256:
368 ctx->ctx = g_new0(struct serpent_ctx, 1);
369
370 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
371 ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
372
373 nkey /= 2;
374 serpent_set_key(ctx->ctx, nkey, key);
375 serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
376 } else {
377 serpent_set_key(ctx->ctx, nkey, key);
378 }
379
380 ctx->alg_encrypt_native = serpent_encrypt_native;
381 ctx->alg_decrypt_native = serpent_decrypt_native;
382 ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
383 ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
384
385 ctx->blocksize = SERPENT_BLOCK_SIZE;
386 break;
387
388 case QCRYPTO_CIPHER_ALG_TWOFISH_128:
389 case QCRYPTO_CIPHER_ALG_TWOFISH_192:
390 case QCRYPTO_CIPHER_ALG_TWOFISH_256:
391 ctx->ctx = g_new0(struct twofish_ctx, 1);
392
393 if (mode == QCRYPTO_CIPHER_MODE_XTS) {
394 ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
395
396 nkey /= 2;
397 twofish_set_key(ctx->ctx, nkey, key);
398 twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
399 } else {
400 twofish_set_key(ctx->ctx, nkey, key);
401 }
402
403 ctx->alg_encrypt_native = twofish_encrypt_native;
404 ctx->alg_decrypt_native = twofish_decrypt_native;
405 ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
406 ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
407
408 ctx->blocksize = TWOFISH_BLOCK_SIZE;
409 break;
410
411 default:
412 error_setg(errp, "Unsupported cipher algorithm %s",
413 QCryptoCipherAlgorithm_lookup[alg]);
414 goto error;
415 }
416
417 if (mode == QCRYPTO_CIPHER_MODE_XTS &&
418 ctx->blocksize != XTS_BLOCK_SIZE) {
419 error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
420 ctx->blocksize, XTS_BLOCK_SIZE);
421 goto error;
422 }
423
424 ctx->iv = g_new0(uint8_t, ctx->blocksize);
425
426 return cipher;
427
428 error:
429 qcrypto_cipher_free(cipher);
430 return NULL;
431 }
432
433
434 void qcrypto_cipher_free(QCryptoCipher *cipher)
435 {
436 QCryptoCipherNettle *ctx;
437
438 if (!cipher) {
439 return;
440 }
441
442 ctx = cipher->opaque;
443 g_free(ctx->iv);
444 g_free(ctx->ctx);
445 g_free(ctx->ctx_tweak);
446 g_free(ctx);
447 g_free(cipher);
448 }
449
450
451 int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
452 const void *in,
453 void *out,
454 size_t len,
455 Error **errp)
456 {
457 QCryptoCipherNettle *ctx = cipher->opaque;
458
459 if (len % ctx->blocksize) {
460 error_setg(errp, "Length %zu must be a multiple of block size %zu",
461 len, ctx->blocksize);
462 return -1;
463 }
464
465 switch (cipher->mode) {
466 case QCRYPTO_CIPHER_MODE_ECB:
467 ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
468 break;
469
470 case QCRYPTO_CIPHER_MODE_CBC:
471 cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
472 ctx->blocksize, ctx->iv,
473 len, out, in);
474 break;
475
476 case QCRYPTO_CIPHER_MODE_XTS:
477 xts_encrypt(ctx->ctx, ctx->ctx_tweak,
478 ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
479 ctx->iv, len, out, in);
480 break;
481
482 case QCRYPTO_CIPHER_MODE_CTR:
483 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
484 ctx->blocksize, ctx->iv,
485 len, out, in);
486 break;
487
488 default:
489 error_setg(errp, "Unsupported cipher mode %s",
490 QCryptoCipherMode_lookup[cipher->mode]);
491 return -1;
492 }
493 return 0;
494 }
495
496
497 int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
498 const void *in,
499 void *out,
500 size_t len,
501 Error **errp)
502 {
503 QCryptoCipherNettle *ctx = cipher->opaque;
504
505 if (len % ctx->blocksize) {
506 error_setg(errp, "Length %zu must be a multiple of block size %zu",
507 len, ctx->blocksize);
508 return -1;
509 }
510
511 switch (cipher->mode) {
512 case QCRYPTO_CIPHER_MODE_ECB:
513 ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
514 break;
515
516 case QCRYPTO_CIPHER_MODE_CBC:
517 cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
518 ctx->blocksize, ctx->iv,
519 len, out, in);
520 break;
521
522 case QCRYPTO_CIPHER_MODE_XTS:
523 xts_decrypt(ctx->ctx, ctx->ctx_tweak,
524 ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
525 ctx->iv, len, out, in);
526 break;
527 case QCRYPTO_CIPHER_MODE_CTR:
528 ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
529 ctx->blocksize, ctx->iv,
530 len, out, in);
531 break;
532
533 default:
534 error_setg(errp, "Unsupported cipher mode %s",
535 QCryptoCipherMode_lookup[cipher->mode]);
536 return -1;
537 }
538 return 0;
539 }
540
541 int qcrypto_cipher_setiv(QCryptoCipher *cipher,
542 const uint8_t *iv, size_t niv,
543 Error **errp)
544 {
545 QCryptoCipherNettle *ctx = cipher->opaque;
546 if (niv != ctx->blocksize) {
547 error_setg(errp, "Expected IV size %zu not %zu",
548 ctx->blocksize, niv);
549 return -1;
550 }
551 memcpy(ctx->iv, iv, niv);
552 return 0;
553 }