Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170103-1' into staging
[qemu.git] / crypto / xts.c
1 /*
2 * QEMU Crypto XTS cipher mode
3 *
4 * Copyright (c) 2015-2016 Red Hat, Inc.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 *
19 * This code is originally derived from public domain / WTFPL code in
20 * LibTomCrypt crytographic library http://libtom.org. The XTS code
21 * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com)
22 * to the LibTom Projects
23 *
24 */
25
26 #include "qemu/osdep.h"
27 #include "crypto/xts.h"
28
29 static void xts_mult_x(uint8_t *I)
30 {
31 int x;
32 uint8_t t, tt;
33
34 for (x = t = 0; x < 16; x++) {
35 tt = I[x] >> 7;
36 I[x] = ((I[x] << 1) | t) & 0xFF;
37 t = tt;
38 }
39 if (tt) {
40 I[0] ^= 0x87;
41 }
42 }
43
44
45 /**
46 * xts_tweak_uncrypt:
47 * @param ctxt: the cipher context
48 * @param func: the cipher function
49 * @src: buffer providing the cipher text of XTS_BLOCK_SIZE bytes
50 * @dst: buffer to output the plain text of XTS_BLOCK_SIZE bytes
51 * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes
52 *
53 * Decrypt data with a tweak
54 */
55 static void xts_tweak_decrypt(const void *ctx,
56 xts_cipher_func *func,
57 const uint8_t *src,
58 uint8_t *dst,
59 uint8_t *iv)
60 {
61 unsigned long x;
62
63 /* tweak encrypt block i */
64 for (x = 0; x < XTS_BLOCK_SIZE; x++) {
65 dst[x] = src[x] ^ iv[x];
66 }
67
68 func(ctx, XTS_BLOCK_SIZE, dst, dst);
69
70 for (x = 0; x < XTS_BLOCK_SIZE; x++) {
71 dst[x] = dst[x] ^ iv[x];
72 }
73
74 /* LFSR the tweak */
75 xts_mult_x(iv);
76 }
77
78
79 void xts_decrypt(const void *datactx,
80 const void *tweakctx,
81 xts_cipher_func *encfunc,
82 xts_cipher_func *decfunc,
83 uint8_t *iv,
84 size_t length,
85 uint8_t *dst,
86 const uint8_t *src)
87 {
88 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE];
89 unsigned long i, m, mo, lim;
90
91 /* get number of blocks */
92 m = length >> 4;
93 mo = length & 15;
94
95 /* must have at least one full block */
96 g_assert(m != 0);
97
98 if (mo == 0) {
99 lim = m;
100 } else {
101 lim = m - 1;
102 }
103
104 /* encrypt the iv */
105 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv);
106
107 for (i = 0; i < lim; i++) {
108 xts_tweak_decrypt(datactx, decfunc, src, dst, T);
109
110 src += XTS_BLOCK_SIZE;
111 dst += XTS_BLOCK_SIZE;
112 }
113
114 /* if length is not a multiple of XTS_BLOCK_SIZE then */
115 if (mo > 0) {
116 memcpy(CC, T, XTS_BLOCK_SIZE);
117 xts_mult_x(CC);
118
119 /* PP = tweak decrypt block m-1 */
120 xts_tweak_decrypt(datactx, decfunc, src, PP, CC);
121
122 /* Pm = first length % XTS_BLOCK_SIZE bytes of PP */
123 for (i = 0; i < mo; i++) {
124 CC[i] = src[XTS_BLOCK_SIZE + i];
125 dst[XTS_BLOCK_SIZE + i] = PP[i];
126 }
127 for (; i < XTS_BLOCK_SIZE; i++) {
128 CC[i] = PP[i];
129 }
130
131 /* Pm-1 = Tweak uncrypt CC */
132 xts_tweak_decrypt(datactx, decfunc, CC, dst, T);
133 }
134
135 /* Decrypt the iv back */
136 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T);
137 }
138
139
140 /**
141 * xts_tweak_crypt:
142 * @param ctxt: the cipher context
143 * @param func: the cipher function
144 * @src: buffer providing the plain text of XTS_BLOCK_SIZE bytes
145 * @dst: buffer to output the cipher text of XTS_BLOCK_SIZE bytes
146 * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes
147 *
148 * Encrypt data with a tweak
149 */
150 static void xts_tweak_encrypt(const void *ctx,
151 xts_cipher_func *func,
152 const uint8_t *src,
153 uint8_t *dst,
154 uint8_t *iv)
155 {
156 unsigned long x;
157
158 /* tweak encrypt block i */
159 for (x = 0; x < XTS_BLOCK_SIZE; x++) {
160 dst[x] = src[x] ^ iv[x];
161 }
162
163 func(ctx, XTS_BLOCK_SIZE, dst, dst);
164
165 for (x = 0; x < XTS_BLOCK_SIZE; x++) {
166 dst[x] = dst[x] ^ iv[x];
167 }
168
169 /* LFSR the tweak */
170 xts_mult_x(iv);
171 }
172
173
174 void xts_encrypt(const void *datactx,
175 const void *tweakctx,
176 xts_cipher_func *encfunc,
177 xts_cipher_func *decfunc,
178 uint8_t *iv,
179 size_t length,
180 uint8_t *dst,
181 const uint8_t *src)
182 {
183 uint8_t PP[XTS_BLOCK_SIZE], CC[XTS_BLOCK_SIZE], T[XTS_BLOCK_SIZE];
184 unsigned long i, m, mo, lim;
185
186 /* get number of blocks */
187 m = length >> 4;
188 mo = length & 15;
189
190 /* must have at least one full block */
191 g_assert(m != 0);
192
193 if (mo == 0) {
194 lim = m;
195 } else {
196 lim = m - 1;
197 }
198
199 /* encrypt the iv */
200 encfunc(tweakctx, XTS_BLOCK_SIZE, T, iv);
201
202 for (i = 0; i < lim; i++) {
203 xts_tweak_encrypt(datactx, encfunc, src, dst, T);
204
205 dst += XTS_BLOCK_SIZE;
206 src += XTS_BLOCK_SIZE;
207 }
208
209 /* if length is not a multiple of XTS_BLOCK_SIZE then */
210 if (mo > 0) {
211 /* CC = tweak encrypt block m-1 */
212 xts_tweak_encrypt(datactx, encfunc, src, CC, T);
213
214 /* Cm = first length % XTS_BLOCK_SIZE bytes of CC */
215 for (i = 0; i < mo; i++) {
216 PP[i] = src[XTS_BLOCK_SIZE + i];
217 dst[XTS_BLOCK_SIZE + i] = CC[i];
218 }
219
220 for (; i < XTS_BLOCK_SIZE; i++) {
221 PP[i] = CC[i];
222 }
223
224 /* Cm-1 = Tweak encrypt PP */
225 xts_tweak_encrypt(datactx, encfunc, PP, dst, T);
226 }
227
228 /* Decrypt the iv back */
229 decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T);
230 }