[linux.git] / crypto / chacha_generic.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * ChaCha and XChaCha stream ciphers, including ChaCha20 (RFC7539)
 *
 * Copyright (C) 2015 Martin Willi
 * Copyright (C) 2018 Google LLC
 */

#include <asm/unaligned.h>
#include <crypto/algapi.h>
#include <crypto/internal/chacha.h>
#include <crypto/internal/skcipher.h>
#include <linux/module.h>

static int chacha_stream_xor(struct skcipher_request *req,
			     const struct chacha_ctx *ctx, const u8 *iv)
{
	struct skcipher_walk walk;
	u32 state[16];
	int err;

	err = skcipher_walk_virt(&walk, req, false);

	chacha_init_generic(state, ctx->key, iv);

	while (walk.nbytes > 0) {
		unsigned int nbytes = walk.nbytes;

		if (nbytes < walk.total)
			nbytes = round_down(nbytes, CHACHA_BLOCK_SIZE);

		chacha_crypt_generic(state, walk.dst.virt.addr,
				     walk.src.virt.addr, nbytes, ctx->nrounds);
		err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
	}

	return err;
}

static int crypto_chacha_crypt(struct skcipher_request *req)
{
	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);

	return chacha_stream_xor(req, ctx, req->iv);
}

static int crypto_xchacha_crypt(struct skcipher_request *req)
{
	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
	struct chacha_ctx subctx;
	u32 state[16];
	u8 real_iv[16];

	/* Compute the subkey given the original key and first 128 nonce bits */
	chacha_init_generic(state, ctx->key, req->iv);
	hchacha_block_generic(state, subctx.key, ctx->nrounds);
	subctx.nrounds = ctx->nrounds;

	/* Build the real IV */
	memcpy(&real_iv[0], req->iv + 24, 8); /* stream position */
	memcpy(&real_iv[8], req->iv + 16, 8); /* remaining 64 nonce bits */

	/* Generate the stream and XOR it with the data */
	return chacha_stream_xor(req, &subctx, real_iv);
}

static struct skcipher_alg algs[] = {
	{
		.base.cra_name		= "chacha20",
		.base.cra_driver_name	= "chacha20-generic",
		.base.cra_priority	= 100,
		.base.cra_blocksize	= 1,
		.base.cra_ctxsize	= sizeof(struct chacha_ctx),
		.base.cra_module	= THIS_MODULE,

		.min_keysize		= CHACHA_KEY_SIZE,
		.max_keysize		= CHACHA_KEY_SIZE,
		.ivsize			= CHACHA_IV_SIZE,
		.chunksize		= CHACHA_BLOCK_SIZE,
		.setkey			= chacha20_setkey,
		.encrypt		= crypto_chacha_crypt,
		.decrypt		= crypto_chacha_crypt,
	}, {
		.base.cra_name		= "xchacha20",
		.base.cra_driver_name	= "xchacha20-generic",
		.base.cra_priority	= 100,
		.base.cra_blocksize	= 1,
		.base.cra_ctxsize	= sizeof(struct chacha_ctx),
		.base.cra_module	= THIS_MODULE,

		.min_keysize		= CHACHA_KEY_SIZE,
		.max_keysize		= CHACHA_KEY_SIZE,
		.ivsize			= XCHACHA_IV_SIZE,
		.chunksize		= CHACHA_BLOCK_SIZE,
		.setkey			= chacha20_setkey,
		.encrypt		= crypto_xchacha_crypt,
		.decrypt		= crypto_xchacha_crypt,
	}, {
		.base.cra_name		= "xchacha12",
		.base.cra_driver_name	= "xchacha12-generic",
		.base.cra_priority	= 100,
		.base.cra_blocksize	= 1,
		.base.cra_ctxsize	= sizeof(struct chacha_ctx),
		.base.cra_module	= THIS_MODULE,

		.min_keysize		= CHACHA_KEY_SIZE,
		.max_keysize		= CHACHA_KEY_SIZE,
		.ivsize			= XCHACHA_IV_SIZE,
		.chunksize		= CHACHA_BLOCK_SIZE,
		.setkey			= chacha12_setkey,
		.encrypt		= crypto_xchacha_crypt,
		.decrypt		= crypto_xchacha_crypt,
	}
};

static int __init chacha_generic_mod_init(void)
{
	return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
}

static void __exit chacha_generic_mod_fini(void)
{
	crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
}

subsys_initcall(chacha_generic_mod_init);
module_exit(chacha_generic_mod_fini);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Martin Willi <[email protected]>");
MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (generic)");
MODULE_ALIAS_CRYPTO("chacha20");
MODULE_ALIAS_CRYPTO("chacha20-generic");
MODULE_ALIAS_CRYPTO("xchacha20");
MODULE_ALIAS_CRYPTO("xchacha20-generic");
MODULE_ALIAS_CRYPTO("xchacha12");
MODULE_ALIAS_CRYPTO("xchacha12-generic");
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
c08d0e64	2	/*
aa762409	3	* ChaCha and XChaCha stream ciphers, including ChaCha20 (RFC7539)
c08d0e64 MW	4	*
c08d0e64 MW	5	* Copyright (C) 2015 Martin Willi
de61d7ae	6	* Copyright (C) 2018 Google LLC
c08d0e64 MW	7	*/
c08d0e64 MW	8
dbd872a1	9	#include <asm/unaligned.h>
c08d0e64	10	#include <crypto/algapi.h>
5fb8ef25	11	#include <crypto/internal/chacha.h>
9ae433bc AB	12	#include <crypto/internal/skcipher.h>
9ae433bc AB	13	#include <linux/module.h>
c08d0e64	14
1ca1b917	15	static int chacha_stream_xor(struct skcipher_request *req,
860ab2e5	16	const struct chacha_ctx ctx, const u8 iv)
de61d7ae EB	17	{
	18	struct skcipher_walk walk;
	19	u32 state[16];
	20	int err;
	21
	22	err = skcipher_walk_virt(&walk, req, false);
	23
22cf7053	24	chacha_init_generic(state, ctx->key, iv);
de61d7ae EB	25
	26	while (walk.nbytes > 0) {
	27	unsigned int nbytes = walk.nbytes;
	28
	29	if (nbytes < walk.total)
7aceaaef	30	nbytes = round_down(nbytes, CHACHA_BLOCK_SIZE);
de61d7ae	31
5fb8ef25 AB	32	chacha_crypt_generic(state, walk.dst.virt.addr,
5fb8ef25 AB	33	walk.src.virt.addr, nbytes, ctx->nrounds);
de61d7ae EB	34	err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
	35	}
	36
	37	return err;
	38	}
	39
22cf7053	40	static int crypto_chacha_crypt(struct skcipher_request *req)
c08d0e64	41	{
9ae433bc	42	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
1ca1b917	43	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
c08d0e64	44
1ca1b917	45	return chacha_stream_xor(req, ctx, req->iv);
de61d7ae	46	}
c08d0e64	47
22cf7053	48	static int crypto_xchacha_crypt(struct skcipher_request *req)
de61d7ae EB	49	{
de61d7ae EB	50	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
1ca1b917 EB	51	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
1ca1b917 EB	52	struct chacha_ctx subctx;
de61d7ae EB	53	u32 state[16];
de61d7ae EB	54	u8 real_iv[16];
4de43726	55
de61d7ae	56	/* Compute the subkey given the original key and first 128 nonce bits */
22cf7053	57	chacha_init_generic(state, ctx->key, req->iv);
5fb8ef25	58	hchacha_block_generic(state, subctx.key, ctx->nrounds);
1ca1b917	59	subctx.nrounds = ctx->nrounds;
4de43726	60
de61d7ae EB	61	/* Build the real IV */
	62	memcpy(&real_iv[0], req->iv + 24, 8); /* stream position */
	63	memcpy(&real_iv[8], req->iv + 16, 8); /* remaining 64 nonce bits */
c08d0e64	64
de61d7ae	65	/* Generate the stream and XOR it with the data */
1ca1b917	66	return chacha_stream_xor(req, &subctx, real_iv);
c08d0e64	67	}
de61d7ae EB	68
	69	static struct skcipher_alg algs[] = {
	70	{
	71	.base.cra_name = "chacha20",
	72	.base.cra_driver_name = "chacha20-generic",
	73	.base.cra_priority = 100,
	74	.base.cra_blocksize = 1,
1ca1b917	75	.base.cra_ctxsize = sizeof(struct chacha_ctx),
de61d7ae EB	76	.base.cra_module = THIS_MODULE,
de61d7ae EB	77
1ca1b917 EB	78	.min_keysize = CHACHA_KEY_SIZE,
	79	.max_keysize = CHACHA_KEY_SIZE,
	80	.ivsize = CHACHA_IV_SIZE,
	81	.chunksize = CHACHA_BLOCK_SIZE,
2043323a	82	.setkey = chacha20_setkey,
1ca1b917 EB	83	.encrypt = crypto_chacha_crypt,
1ca1b917 EB	84	.decrypt = crypto_chacha_crypt,
de61d7ae EB	85	}, {
	86	.base.cra_name = "xchacha20",
	87	.base.cra_driver_name = "xchacha20-generic",
	88	.base.cra_priority = 100,
	89	.base.cra_blocksize = 1,
1ca1b917	90	.base.cra_ctxsize = sizeof(struct chacha_ctx),
de61d7ae EB	91	.base.cra_module = THIS_MODULE,
de61d7ae EB	92
1ca1b917 EB	93	.min_keysize = CHACHA_KEY_SIZE,
	94	.max_keysize = CHACHA_KEY_SIZE,
	95	.ivsize = XCHACHA_IV_SIZE,
	96	.chunksize = CHACHA_BLOCK_SIZE,
2043323a	97	.setkey = chacha20_setkey,
1ca1b917 EB	98	.encrypt = crypto_xchacha_crypt,
1ca1b917 EB	99	.decrypt = crypto_xchacha_crypt,
aa762409 EB	100	}, {
	101	.base.cra_name = "xchacha12",
	102	.base.cra_driver_name = "xchacha12-generic",
	103	.base.cra_priority = 100,
	104	.base.cra_blocksize = 1,
	105	.base.cra_ctxsize = sizeof(struct chacha_ctx),
	106	.base.cra_module = THIS_MODULE,
	107
	108	.min_keysize = CHACHA_KEY_SIZE,
	109	.max_keysize = CHACHA_KEY_SIZE,
	110	.ivsize = XCHACHA_IV_SIZE,
	111	.chunksize = CHACHA_BLOCK_SIZE,
2043323a	112	.setkey = chacha12_setkey,
aa762409 EB	113	.encrypt = crypto_xchacha_crypt,
aa762409 EB	114	.decrypt = crypto_xchacha_crypt,
de61d7ae	115	}
c08d0e64 MW	116	};
c08d0e64 MW	117
1ca1b917	118	static int __init chacha_generic_mod_init(void)
c08d0e64	119	{
de61d7ae	120	return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
c08d0e64 MW	121	}
c08d0e64 MW	122
1ca1b917	123	static void __exit chacha_generic_mod_fini(void)
c08d0e64	124	{
de61d7ae	125	crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
c08d0e64 MW	126	}
c08d0e64 MW	127
c4741b23	128	subsys_initcall(chacha_generic_mod_init);
1ca1b917	129	module_exit(chacha_generic_mod_fini);
c08d0e64 MW	130
	131	MODULE_LICENSE("GPL");
	132	MODULE_AUTHOR("Martin Willi <[email protected]>");
1ca1b917	133	MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (generic)");
c08d0e64 MW	134	MODULE_ALIAS_CRYPTO("chacha20");
c08d0e64 MW	135	MODULE_ALIAS_CRYPTO("chacha20-generic");
de61d7ae EB	136	MODULE_ALIAS_CRYPTO("xchacha20");
de61d7ae EB	137	MODULE_ALIAS_CRYPTO("xchacha20-generic");
aa762409 EB	138	MODULE_ALIAS_CRYPTO("xchacha12");
aa762409 EB	139	MODULE_ALIAS_CRYPTO("xchacha12-generic");