23c57df72989c916b3e98084eb88d48777999691mcpowers/*
23c57df72989c916b3e98084eb88d48777999691mcpowers * CDDL HEADER START
23c57df72989c916b3e98084eb88d48777999691mcpowers *
23c57df72989c916b3e98084eb88d48777999691mcpowers * The contents of this file are subject to the terms of the
23c57df72989c916b3e98084eb88d48777999691mcpowers * Common Development and Distribution License (the "License").
23c57df72989c916b3e98084eb88d48777999691mcpowers * You may not use this file except in compliance with the License.
23c57df72989c916b3e98084eb88d48777999691mcpowers *
23c57df72989c916b3e98084eb88d48777999691mcpowers * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
23c57df72989c916b3e98084eb88d48777999691mcpowers * or http://www.opensolaris.org/os/licensing.
23c57df72989c916b3e98084eb88d48777999691mcpowers * See the License for the specific language governing permissions
23c57df72989c916b3e98084eb88d48777999691mcpowers * and limitations under the License.
23c57df72989c916b3e98084eb88d48777999691mcpowers *
23c57df72989c916b3e98084eb88d48777999691mcpowers * When distributing Covered Code, include this CDDL HEADER in each
23c57df72989c916b3e98084eb88d48777999691mcpowers * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
23c57df72989c916b3e98084eb88d48777999691mcpowers * If applicable, add the following below this CDDL HEADER, with the
23c57df72989c916b3e98084eb88d48777999691mcpowers * fields enclosed by brackets "[]" replaced with your own identifying
23c57df72989c916b3e98084eb88d48777999691mcpowers * information: Portions Copyright [yyyy] [name of copyright owner]
23c57df72989c916b3e98084eb88d48777999691mcpowers *
23c57df72989c916b3e98084eb88d48777999691mcpowers * CDDL HEADER END
23c57df72989c916b3e98084eb88d48777999691mcpowers */
23c57df72989c916b3e98084eb88d48777999691mcpowers/*
23c57df72989c916b3e98084eb88d48777999691mcpowers * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
23c57df72989c916b3e98084eb88d48777999691mcpowers * Use is subject to license terms.
23c57df72989c916b3e98084eb88d48777999691mcpowers */
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers#ifndef _KERNEL
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <strings.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <limits.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <assert.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <security/cryptoki.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#endif
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <sys/types.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <modes/modes.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <sys/crypto/common.h>
23c57df72989c916b3e98084eb88d48777999691mcpowers#include <sys/crypto/impl.h>
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson#include <sys/byteorder.h>
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson
23c57df72989c916b3e98084eb88d48777999691mcpowers/*
23c57df72989c916b3e98084eb88d48777999691mcpowers * Encrypt and decrypt multiple blocks of data in counter mode.
23c57df72989c916b3e98084eb88d48777999691mcpowers */
23c57df72989c916b3e98084eb88d48777999691mcpowersint
23c57df72989c916b3e98084eb88d48777999691mcpowersctr_mode_contiguous_blocks(ctr_ctx_t *ctx, char *data, size_t length,
23c57df72989c916b3e98084eb88d48777999691mcpowers crypto_data_t *out, size_t block_size,
23c57df72989c916b3e98084eb88d48777999691mcpowers int (*cipher)(const void *ks, const uint8_t *pt, uint8_t *ct),
23c57df72989c916b3e98084eb88d48777999691mcpowers void (*xor_block)(uint8_t *, uint8_t *))
23c57df72989c916b3e98084eb88d48777999691mcpowers{
23c57df72989c916b3e98084eb88d48777999691mcpowers size_t remainder = length;
23c57df72989c916b3e98084eb88d48777999691mcpowers size_t need;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *datap = (uint8_t *)data;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *blockp;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *lastp;
23c57df72989c916b3e98084eb88d48777999691mcpowers void *iov_or_mp;
23c57df72989c916b3e98084eb88d48777999691mcpowers offset_t offset;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *out_data_1;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *out_data_2;
23c57df72989c916b3e98084eb88d48777999691mcpowers size_t out_data_1_len;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers uint64_t lower_counter, upper_counter;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers if (length + ctx->ctr_remainder_len < block_size) {
23c57df72989c916b3e98084eb88d48777999691mcpowers /* accumulate bytes here and return */
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(datap,
23c57df72989c916b3e98084eb88d48777999691mcpowers (uint8_t *)ctx->ctr_remainder + ctx->ctr_remainder_len,
23c57df72989c916b3e98084eb88d48777999691mcpowers length);
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_remainder_len += length;
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_copy_to = datap;
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_SUCCESS);
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers lastp = (uint8_t *)ctx->ctr_cb;
23c57df72989c916b3e98084eb88d48777999691mcpowers if (out != NULL)
23c57df72989c916b3e98084eb88d48777999691mcpowers crypto_init_ptrs(out, &iov_or_mp, &offset);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers do {
23c57df72989c916b3e98084eb88d48777999691mcpowers /* Unprocessed data from last call. */
23c57df72989c916b3e98084eb88d48777999691mcpowers if (ctx->ctr_remainder_len > 0) {
23c57df72989c916b3e98084eb88d48777999691mcpowers need = block_size - ctx->ctr_remainder_len;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers if (need > remainder)
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_DATA_LEN_RANGE);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(datap, &((uint8_t *)ctx->ctr_remainder)
23c57df72989c916b3e98084eb88d48777999691mcpowers [ctx->ctr_remainder_len], need);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers blockp = (uint8_t *)ctx->ctr_remainder;
23c57df72989c916b3e98084eb88d48777999691mcpowers } else {
23c57df72989c916b3e98084eb88d48777999691mcpowers blockp = datap;
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /* ctr_cb is the counter block */
23c57df72989c916b3e98084eb88d48777999691mcpowers cipher(ctx->ctr_keysched, (uint8_t *)ctx->ctr_cb,
23c57df72989c916b3e98084eb88d48777999691mcpowers (uint8_t *)ctx->ctr_tmp);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers lastp = (uint8_t *)ctx->ctr_tmp;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /*
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers * Increment Counter.
23c57df72989c916b3e98084eb88d48777999691mcpowers */
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_counter = ntohll(ctx->ctr_cb[1] & ctx->ctr_lower_mask);
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_counter = htonll(lower_counter + 1);
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_counter &= ctx->ctr_lower_mask;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers ctx->ctr_cb[1] = (ctx->ctr_cb[1] & ~(ctx->ctr_lower_mask)) |
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_counter;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers /* wrap around */
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers if (lower_counter == 0) {
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers upper_counter =
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers ntohll(ctx->ctr_cb[0] & ctx->ctr_upper_mask);
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers upper_counter = htonll(upper_counter + 1);
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers upper_counter &= ctx->ctr_upper_mask;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers ctx->ctr_cb[0] =
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers (ctx->ctr_cb[0] & ~(ctx->ctr_upper_mask)) |
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers upper_counter;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /*
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers * XOR encrypted counter block with the current clear block.
23c57df72989c916b3e98084eb88d48777999691mcpowers */
23c57df72989c916b3e98084eb88d48777999691mcpowers xor_block(blockp, lastp);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers if (out == NULL) {
23c57df72989c916b3e98084eb88d48777999691mcpowers if (ctx->ctr_remainder_len > 0) {
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(lastp, ctx->ctr_copy_to,
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_remainder_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(lastp + ctx->ctr_remainder_len, datap,
23c57df72989c916b3e98084eb88d48777999691mcpowers need);
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers } else {
23c57df72989c916b3e98084eb88d48777999691mcpowers crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
23c57df72989c916b3e98084eb88d48777999691mcpowers &out_data_1_len, &out_data_2, block_size);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /* copy block to where it belongs */
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(lastp, out_data_1, out_data_1_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers if (out_data_2 != NULL) {
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(lastp + out_data_1_len, out_data_2,
23c57df72989c916b3e98084eb88d48777999691mcpowers block_size - out_data_1_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers /* update offset */
23c57df72989c916b3e98084eb88d48777999691mcpowers out->cd_offset += block_size;
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /* Update pointer to next block of data to be processed. */
23c57df72989c916b3e98084eb88d48777999691mcpowers if (ctx->ctr_remainder_len != 0) {
23c57df72989c916b3e98084eb88d48777999691mcpowers datap += need;
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_remainder_len = 0;
23c57df72989c916b3e98084eb88d48777999691mcpowers } else {
23c57df72989c916b3e98084eb88d48777999691mcpowers datap += block_size;
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers remainder = (size_t)&data[length] - (size_t)datap;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers /* Incomplete last block. */
23c57df72989c916b3e98084eb88d48777999691mcpowers if (remainder > 0 && remainder < block_size) {
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(datap, ctx->ctr_remainder, remainder);
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_remainder_len = remainder;
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_copy_to = datap;
23c57df72989c916b3e98084eb88d48777999691mcpowers goto out;
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_copy_to = NULL;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers } while (remainder > 0);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowersout:
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_SUCCESS);
23c57df72989c916b3e98084eb88d48777999691mcpowers}
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowersint
23c57df72989c916b3e98084eb88d48777999691mcpowersctr_mode_final(ctr_ctx_t *ctx, crypto_data_t *out,
23c57df72989c916b3e98084eb88d48777999691mcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
23c57df72989c916b3e98084eb88d48777999691mcpowers{
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *lastp;
23c57df72989c916b3e98084eb88d48777999691mcpowers void *iov_or_mp;
23c57df72989c916b3e98084eb88d48777999691mcpowers offset_t offset;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *out_data_1;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *out_data_2;
23c57df72989c916b3e98084eb88d48777999691mcpowers size_t out_data_1_len;
23c57df72989c916b3e98084eb88d48777999691mcpowers uint8_t *p;
23c57df72989c916b3e98084eb88d48777999691mcpowers int i;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers if (out->cd_length < ctx->ctr_remainder_len)
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_DATA_LEN_RANGE);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers encrypt_block(ctx->ctr_keysched, (uint8_t *)ctx->ctr_cb,
23c57df72989c916b3e98084eb88d48777999691mcpowers (uint8_t *)ctx->ctr_tmp);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers lastp = (uint8_t *)ctx->ctr_tmp;
23c57df72989c916b3e98084eb88d48777999691mcpowers p = (uint8_t *)ctx->ctr_remainder;
23c57df72989c916b3e98084eb88d48777999691mcpowers for (i = 0; i < ctx->ctr_remainder_len; i++) {
23c57df72989c916b3e98084eb88d48777999691mcpowers p[i] ^= lastp[i];
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers crypto_init_ptrs(out, &iov_or_mp, &offset);
23c57df72989c916b3e98084eb88d48777999691mcpowers crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
23c57df72989c916b3e98084eb88d48777999691mcpowers &out_data_1_len, &out_data_2, ctx->ctr_remainder_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy(p, out_data_1, out_data_1_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers if (out_data_2 != NULL) {
23c57df72989c916b3e98084eb88d48777999691mcpowers bcopy((uint8_t *)p + out_data_1_len,
23c57df72989c916b3e98084eb88d48777999691mcpowers out_data_2, ctx->ctr_remainder_len - out_data_1_len);
23c57df72989c916b3e98084eb88d48777999691mcpowers }
23c57df72989c916b3e98084eb88d48777999691mcpowers out->cd_offset += ctx->ctr_remainder_len;
23c57df72989c916b3e98084eb88d48777999691mcpowers ctx->ctr_remainder_len = 0;
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_SUCCESS);
23c57df72989c916b3e98084eb88d48777999691mcpowers}
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowersint
23c57df72989c916b3e98084eb88d48777999691mcpowersctr_init_ctx(ctr_ctx_t *ctr_ctx, ulong_t count, uint8_t *cb,
23c57df72989c916b3e98084eb88d48777999691mcpowersvoid (*copy_block)(uint8_t *, uint8_t *))
23c57df72989c916b3e98084eb88d48777999691mcpowers{
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers uint64_t upper_mask = 0;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers uint64_t lower_mask = 0;
23c57df72989c916b3e98084eb88d48777999691mcpowers
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers if (count == 0 || count > 128) {
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_MECHANISM_PARAM_INVALID);
23c57df72989c916b3e98084eb88d48777999691mcpowers }
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers /* upper 64 bits of the mask */
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers if (count >= 64) {
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers count -= 64;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers upper_mask = (count == 64) ? UINT64_MAX : (1ULL << count) - 1;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_mask = UINT64_MAX;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers } else {
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers /* now the lower 63 bits */
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers lower_mask = (1ULL << count) - 1;
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers }
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers ctr_ctx->ctr_lower_mask = htonll(lower_mask);
16239bc82c111618343e0a5b1a70e0fc702d00e0Mark Powers ctr_ctx->ctr_upper_mask = htonll(upper_mask);
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson
23c57df72989c916b3e98084eb88d48777999691mcpowers copy_block(cb, (uchar_t *)ctr_ctx->ctr_cb);
23c57df72989c916b3e98084eb88d48777999691mcpowers ctr_ctx->ctr_lastp = (uint8_t *)&ctr_ctx->ctr_cb[0];
23c57df72989c916b3e98084eb88d48777999691mcpowers ctr_ctx->ctr_flags |= CTR_MODE;
23c57df72989c916b3e98084eb88d48777999691mcpowers return (CRYPTO_SUCCESS);
23c57df72989c916b3e98084eb88d48777999691mcpowers}
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers/* ARGSUSED */
23c57df72989c916b3e98084eb88d48777999691mcpowersvoid *
23c57df72989c916b3e98084eb88d48777999691mcpowersctr_alloc_ctx(int kmflag)
23c57df72989c916b3e98084eb88d48777999691mcpowers{
23c57df72989c916b3e98084eb88d48777999691mcpowers ctr_ctx_t *ctr_ctx;
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers#ifdef _KERNEL
23c57df72989c916b3e98084eb88d48777999691mcpowers if ((ctr_ctx = kmem_zalloc(sizeof (ctr_ctx_t), kmflag)) == NULL)
23c57df72989c916b3e98084eb88d48777999691mcpowers#else
23c57df72989c916b3e98084eb88d48777999691mcpowers if ((ctr_ctx = calloc(1, sizeof (ctr_ctx_t))) == NULL)
23c57df72989c916b3e98084eb88d48777999691mcpowers#endif
23c57df72989c916b3e98084eb88d48777999691mcpowers return (NULL);
23c57df72989c916b3e98084eb88d48777999691mcpowers
23c57df72989c916b3e98084eb88d48777999691mcpowers ctr_ctx->ctr_flags = CTR_MODE;
23c57df72989c916b3e98084eb88d48777999691mcpowers return (ctr_ctx);
23c57df72989c916b3e98084eb88d48777999691mcpowers}