[qemu.git] / crypto / cipher-nettle.c

/*
 * QEMU Crypto cipher nettle algorithms
 *
 * Copyright (c) 2015 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 *
 */

#include "qemu/osdep.h"
#include "crypto/xts.h"

#include <nettle/nettle-types.h>
#include <nettle/aes.h>
#include <nettle/des.h>
#include <nettle/cbc.h>
#include <nettle/cast128.h>
#include <nettle/serpent.h>
#include <nettle/twofish.h>
#include <nettle/ctr.h>

typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
                                               size_t length,
                                               uint8_t *dst,
                                               const uint8_t *src);

#if CONFIG_NETTLE_VERSION_MAJOR < 3
typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
typedef void *       cipher_ctx_t;
typedef unsigned     cipher_length_t;

#define cast5_set_key cast128_set_key
#else
typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
typedef const void * cipher_ctx_t;
typedef size_t       cipher_length_t;
#endif

typedef struct QCryptoNettleAES {
    struct aes_ctx enc;
    struct aes_ctx dec;
} QCryptoNettleAES;

static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                               uint8_t *dst, const uint8_t *src)
{
    const QCryptoNettleAES *aesctx = ctx;
    aes_encrypt(&aesctx->enc, length, dst, src);
}

static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                               uint8_t *dst, const uint8_t *src)
{
    const QCryptoNettleAES *aesctx = ctx;
    aes_decrypt(&aesctx->dec, length, dst, src);
}

static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                               uint8_t *dst, const uint8_t *src)
{
    des_encrypt(ctx, length, dst, src);
}

static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                               uint8_t *dst, const uint8_t *src)
{
    des_decrypt(ctx, length, dst, src);
}

static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    cast128_encrypt(ctx, length, dst, src);
}

static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    cast128_decrypt(ctx, length, dst, src);
}

static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    serpent_encrypt(ctx, length, dst, src);
}

static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    serpent_decrypt(ctx, length, dst, src);
}

static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    twofish_encrypt(ctx, length, dst, src);
}

static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
                                   uint8_t *dst, const uint8_t *src)
{
    twofish_decrypt(ctx, length, dst, src);
}

static void aes_encrypt_wrapper(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
{
    const QCryptoNettleAES *aesctx = ctx;
    aes_encrypt(&aesctx->enc, length, dst, src);
}

static void aes_decrypt_wrapper(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
{
    const QCryptoNettleAES *aesctx = ctx;
    aes_decrypt(&aesctx->dec, length, dst, src);
}

static void des_encrypt_wrapper(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
{
    des_encrypt(ctx, length, dst, src);
}

static void des_decrypt_wrapper(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
{
    des_decrypt(ctx, length, dst, src);
}

static void cast128_encrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    cast128_encrypt(ctx, length, dst, src);
}

static void cast128_decrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    cast128_decrypt(ctx, length, dst, src);
}

static void serpent_encrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    serpent_encrypt(ctx, length, dst, src);
}

static void serpent_decrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    serpent_decrypt(ctx, length, dst, src);
}

static void twofish_encrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    twofish_encrypt(ctx, length, dst, src);
}

static void twofish_decrypt_wrapper(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
{
    twofish_decrypt(ctx, length, dst, src);
}

typedef struct QCryptoCipherNettle QCryptoCipherNettle;
struct QCryptoCipherNettle {
    /* Primary cipher context for all modes */
    void *ctx;
    /* Second cipher context for XTS mode only */
    void *ctx_tweak;
    /* Cipher callbacks for both contexts */
    QCryptoCipherNettleFuncNative alg_encrypt_native;
    QCryptoCipherNettleFuncNative alg_decrypt_native;
    QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
    QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
    /* Initialization vector or Counter */
    uint8_t *iv;
    size_t blocksize;
};

bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
                             QCryptoCipherMode mode)
{
    switch (alg) {
    case QCRYPTO_CIPHER_ALG_DES_RFB:
    case QCRYPTO_CIPHER_ALG_AES_128:
    case QCRYPTO_CIPHER_ALG_AES_192:
    case QCRYPTO_CIPHER_ALG_AES_256:
    case QCRYPTO_CIPHER_ALG_CAST5_128:
    case QCRYPTO_CIPHER_ALG_SERPENT_128:
    case QCRYPTO_CIPHER_ALG_SERPENT_192:
    case QCRYPTO_CIPHER_ALG_SERPENT_256:
    case QCRYPTO_CIPHER_ALG_TWOFISH_128:
    case QCRYPTO_CIPHER_ALG_TWOFISH_192:
    case QCRYPTO_CIPHER_ALG_TWOFISH_256:
        break;
    default:
        return false;
    }

    switch (mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
    case QCRYPTO_CIPHER_MODE_CBC:
    case QCRYPTO_CIPHER_MODE_XTS:
    case QCRYPTO_CIPHER_MODE_CTR:
        return true;
    default:
        return false;
    }
}


QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
                                  QCryptoCipherMode mode,
                                  const uint8_t *key, size_t nkey,
                                  Error **errp)
{
    QCryptoCipher *cipher;
    QCryptoCipherNettle *ctx;
    uint8_t *rfbkey;

    switch (mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
    case QCRYPTO_CIPHER_MODE_CBC:
    case QCRYPTO_CIPHER_MODE_XTS:
    case QCRYPTO_CIPHER_MODE_CTR:
        break;
    default:
        error_setg(errp, "Unsupported cipher mode %s",
                   QCryptoCipherMode_lookup[mode]);
        return NULL;
    }

    if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
        return NULL;
    }

    cipher = g_new0(QCryptoCipher, 1);
    cipher->alg = alg;
    cipher->mode = mode;

    ctx = g_new0(QCryptoCipherNettle, 1);
    cipher->opaque = ctx;

    switch (alg) {
    case QCRYPTO_CIPHER_ALG_DES_RFB:
        ctx->ctx = g_new0(struct des_ctx, 1);
        rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
        des_set_key(ctx->ctx, rfbkey);
        g_free(rfbkey);

        ctx->alg_encrypt_native = des_encrypt_native;
        ctx->alg_decrypt_native = des_decrypt_native;
        ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
        ctx->alg_decrypt_wrapper = des_decrypt_wrapper;

        ctx->blocksize = DES_BLOCK_SIZE;
        break;

    case QCRYPTO_CIPHER_ALG_AES_128:
    case QCRYPTO_CIPHER_ALG_AES_192:
    case QCRYPTO_CIPHER_ALG_AES_256:
        ctx->ctx = g_new0(QCryptoNettleAES, 1);

        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);

            nkey /= 2;
            aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
                                nkey, key);
            aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
                                nkey, key);

            aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
                                nkey, key + nkey);
            aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
                                nkey, key + nkey);
        } else {
            aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
                                nkey, key);
            aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
                                nkey, key);
        }

        ctx->alg_encrypt_native = aes_encrypt_native;
        ctx->alg_decrypt_native = aes_decrypt_native;
        ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
        ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;

        ctx->blocksize = AES_BLOCK_SIZE;
        break;

    case QCRYPTO_CIPHER_ALG_CAST5_128:
        ctx->ctx = g_new0(struct cast128_ctx, 1);

        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);

            nkey /= 2;
            cast5_set_key(ctx->ctx, nkey, key);
            cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
        } else {
            cast5_set_key(ctx->ctx, nkey, key);
        }

        ctx->alg_encrypt_native = cast128_encrypt_native;
        ctx->alg_decrypt_native = cast128_decrypt_native;
        ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
        ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;

        ctx->blocksize = CAST128_BLOCK_SIZE;
        break;

    case QCRYPTO_CIPHER_ALG_SERPENT_128:
    case QCRYPTO_CIPHER_ALG_SERPENT_192:
    case QCRYPTO_CIPHER_ALG_SERPENT_256:
        ctx->ctx = g_new0(struct serpent_ctx, 1);

        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);

            nkey /= 2;
            serpent_set_key(ctx->ctx, nkey, key);
            serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
        } else {
            serpent_set_key(ctx->ctx, nkey, key);
        }

        ctx->alg_encrypt_native = serpent_encrypt_native;
        ctx->alg_decrypt_native = serpent_decrypt_native;
        ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
        ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;

        ctx->blocksize = SERPENT_BLOCK_SIZE;
        break;

    case QCRYPTO_CIPHER_ALG_TWOFISH_128:
    case QCRYPTO_CIPHER_ALG_TWOFISH_192:
    case QCRYPTO_CIPHER_ALG_TWOFISH_256:
        ctx->ctx = g_new0(struct twofish_ctx, 1);

        if (mode == QCRYPTO_CIPHER_MODE_XTS) {
            ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);

            nkey /= 2;
            twofish_set_key(ctx->ctx, nkey, key);
            twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
        } else {
            twofish_set_key(ctx->ctx, nkey, key);
        }

        ctx->alg_encrypt_native = twofish_encrypt_native;
        ctx->alg_decrypt_native = twofish_decrypt_native;
        ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
        ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;

        ctx->blocksize = TWOFISH_BLOCK_SIZE;
        break;

    default:
        error_setg(errp, "Unsupported cipher algorithm %s",
                   QCryptoCipherAlgorithm_lookup[alg]);
        goto error;
    }

    if (mode == QCRYPTO_CIPHER_MODE_XTS &&
        ctx->blocksize != XTS_BLOCK_SIZE) {
        error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
                   ctx->blocksize, XTS_BLOCK_SIZE);
        goto error;
    }

    ctx->iv = g_new0(uint8_t, ctx->blocksize);

    return cipher;

 error:
    qcrypto_cipher_free(cipher);
    return NULL;
}


void qcrypto_cipher_free(QCryptoCipher *cipher)
{
    QCryptoCipherNettle *ctx;

    if (!cipher) {
        return;
    }

    ctx = cipher->opaque;
    g_free(ctx->iv);
    g_free(ctx->ctx);
    g_free(ctx->ctx_tweak);
    g_free(ctx);
    g_free(cipher);
}


int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
                           const void *in,
                           void *out,
                           size_t len,
                           Error **errp)
{
    QCryptoCipherNettle *ctx = cipher->opaque;

    if (len % ctx->blocksize) {
        error_setg(errp, "Length %zu must be a multiple of block size %zu",
                   len, ctx->blocksize);
        return -1;
    }

    switch (cipher->mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
        ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
        break;

    case QCRYPTO_CIPHER_MODE_CBC:
        cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
                    ctx->blocksize, ctx->iv,
                    len, out, in);
        break;

    case QCRYPTO_CIPHER_MODE_XTS:
        xts_encrypt(ctx->ctx, ctx->ctx_tweak,
                    ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
                    ctx->iv, len, out, in);
        break;

    case QCRYPTO_CIPHER_MODE_CTR:
        ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
                    ctx->blocksize, ctx->iv,
                    len, out, in);
        break;

    default:
        error_setg(errp, "Unsupported cipher mode %s",
                   QCryptoCipherMode_lookup[cipher->mode]);
        return -1;
    }
    return 0;
}


int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
                           const void *in,
                           void *out,
                           size_t len,
                           Error **errp)
{
    QCryptoCipherNettle *ctx = cipher->opaque;

    if (len % ctx->blocksize) {
        error_setg(errp, "Length %zu must be a multiple of block size %zu",
                   len, ctx->blocksize);
        return -1;
    }

    switch (cipher->mode) {
    case QCRYPTO_CIPHER_MODE_ECB:
        ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
        break;

    case QCRYPTO_CIPHER_MODE_CBC:
        cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
                    ctx->blocksize, ctx->iv,
                    len, out, in);
        break;

    case QCRYPTO_CIPHER_MODE_XTS:
        xts_decrypt(ctx->ctx, ctx->ctx_tweak,
                    ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
                    ctx->iv, len, out, in);
        break;
    case QCRYPTO_CIPHER_MODE_CTR:
        ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
                    ctx->blocksize, ctx->iv,
                    len, out, in);
        break;

    default:
        error_setg(errp, "Unsupported cipher mode %s",
                   QCryptoCipherMode_lookup[cipher->mode]);
        return -1;
    }
    return 0;
}

int qcrypto_cipher_setiv(QCryptoCipher *cipher,
                         const uint8_t *iv, size_t niv,
                         Error **errp)
{
    QCryptoCipherNettle *ctx = cipher->opaque;
    if (niv != ctx->blocksize) {
        error_setg(errp, "Expected IV size %zu not %zu",
                   ctx->blocksize, niv);
        return -1;
    }
    memcpy(ctx->iv, iv, niv);
    return 0;
}
Commit	Line	Data
ed754746 DB	1	/*
	2	* QEMU Crypto cipher nettle algorithms
	3	*
	4	* Copyright (c) 2015 Red Hat, Inc.
	5	*
	6	* This library is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU Lesser General Public
	8	* License as published by the Free Software Foundation; either
	9	* version 2 of the License, or (at your option) any later version.
	10	*
	11	* This library is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* Lesser General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU Lesser General Public
	17	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
	18	*
	19	*/
	20
42f7a448	21	#include "qemu/osdep.h"
eaec903c DB	22	#include "crypto/xts.h"
eaec903c DB	23
ed754746 DB	24	#include <nettle/nettle-types.h>
	25	#include <nettle/aes.h>
	26	#include <nettle/des.h>
	27	#include <nettle/cbc.h>
084a85ee	28	#include <nettle/cast128.h>
94318522	29	#include <nettle/serpent.h>
50f6753e	30	#include <nettle/twofish.h>
3c28292f	31	#include <nettle/ctr.h>
ed754746	32
f7ac78cf DB	33	typedef void (QCryptoCipherNettleFuncWrapper)(const void ctx,
	34	size_t length,
	35	uint8_t *dst,
	36	const uint8_t *src);
d3462e37	37
f7ac78cf DB	38	#if CONFIG_NETTLE_VERSION_MAJOR < 3
f7ac78cf DB	39	typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
d3462e37 RK	40	typedef void * cipher_ctx_t;
d3462e37 RK	41	typedef unsigned cipher_length_t;
621e6ae6 DB	42
621e6ae6 DB	43	#define cast5_set_key cast128_set_key
d3462e37	44	#else
f7ac78cf	45	typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
d3462e37 RK	46	typedef const void * cipher_ctx_t;
d3462e37 RK	47	typedef size_t cipher_length_t;
becaeb72 RK	48	#endif
becaeb72 RK	49
e3ba0b67 DB	50	typedef struct QCryptoNettleAES {
	51	struct aes_ctx enc;
	52	struct aes_ctx dec;
	53	} QCryptoNettleAES;
	54
f7ac78cf DB	55	static void aes_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	56	uint8_t dst, const uint8_t src)
	57	{
	58	const QCryptoNettleAES *aesctx = ctx;
	59	aes_encrypt(&aesctx->enc, length, dst, src);
	60	}
	61
	62	static void aes_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	63	uint8_t dst, const uint8_t src)
	64	{
	65	const QCryptoNettleAES *aesctx = ctx;
	66	aes_decrypt(&aesctx->dec, length, dst, src);
	67	}
	68
	69	static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	70	uint8_t dst, const uint8_t src)
	71	{
	72	des_encrypt(ctx, length, dst, src);
	73	}
	74
	75	static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	76	uint8_t dst, const uint8_t src)
	77	{
	78	des_decrypt(ctx, length, dst, src);
	79	}
	80
	81	static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	82	uint8_t dst, const uint8_t src)
	83	{
	84	cast128_encrypt(ctx, length, dst, src);
	85	}
	86
	87	static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	88	uint8_t dst, const uint8_t src)
	89	{
	90	cast128_decrypt(ctx, length, dst, src);
	91	}
	92
	93	static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	94	uint8_t dst, const uint8_t src)
	95	{
	96	serpent_encrypt(ctx, length, dst, src);
	97	}
	98
	99	static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	100	uint8_t dst, const uint8_t src)
	101	{
	102	serpent_decrypt(ctx, length, dst, src);
	103	}
	104
	105	static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	106	uint8_t dst, const uint8_t src)
	107	{
	108	twofish_encrypt(ctx, length, dst, src);
	109	}
	110
	111	static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
	112	uint8_t dst, const uint8_t src)
	113	{
	114	twofish_decrypt(ctx, length, dst, src);
	115	}
	116
	117	static void aes_encrypt_wrapper(const void *ctx, size_t length,
d3462e37 RK	118	uint8_t dst, const uint8_t src)
d3462e37 RK	119	{
e3ba0b67 DB	120	const QCryptoNettleAES *aesctx = ctx;
e3ba0b67 DB	121	aes_encrypt(&aesctx->enc, length, dst, src);
d3462e37 RK	122	}
d3462e37 RK	123
f7ac78cf	124	static void aes_decrypt_wrapper(const void *ctx, size_t length,
d3462e37 RK	125	uint8_t dst, const uint8_t src)
d3462e37 RK	126	{
e3ba0b67 DB	127	const QCryptoNettleAES *aesctx = ctx;
e3ba0b67 DB	128	aes_decrypt(&aesctx->dec, length, dst, src);
d3462e37 RK	129	}
d3462e37 RK	130
f7ac78cf	131	static void des_encrypt_wrapper(const void *ctx, size_t length,
d3462e37 RK	132	uint8_t dst, const uint8_t src)
	133	{
	134	des_encrypt(ctx, length, dst, src);
	135	}
	136
f7ac78cf	137	static void des_decrypt_wrapper(const void *ctx, size_t length,
d3462e37 RK	138	uint8_t dst, const uint8_t src)
	139	{
	140	des_decrypt(ctx, length, dst, src);
	141	}
	142
f7ac78cf	143	static void cast128_encrypt_wrapper(const void *ctx, size_t length,
084a85ee DB	144	uint8_t dst, const uint8_t src)
	145	{
	146	cast128_encrypt(ctx, length, dst, src);
	147	}
	148
f7ac78cf	149	static void cast128_decrypt_wrapper(const void *ctx, size_t length,
084a85ee DB	150	uint8_t dst, const uint8_t src)
	151	{
	152	cast128_decrypt(ctx, length, dst, src);
	153	}
	154
f7ac78cf	155	static void serpent_encrypt_wrapper(const void *ctx, size_t length,
94318522 DB	156	uint8_t dst, const uint8_t src)
	157	{
	158	serpent_encrypt(ctx, length, dst, src);
	159	}
	160
f7ac78cf	161	static void serpent_decrypt_wrapper(const void *ctx, size_t length,
94318522 DB	162	uint8_t dst, const uint8_t src)
	163	{
	164	serpent_decrypt(ctx, length, dst, src);
	165	}
	166
f7ac78cf	167	static void twofish_encrypt_wrapper(const void *ctx, size_t length,
50f6753e DB	168	uint8_t dst, const uint8_t src)
	169	{
	170	twofish_encrypt(ctx, length, dst, src);
	171	}
	172
f7ac78cf	173	static void twofish_decrypt_wrapper(const void *ctx, size_t length,
50f6753e DB	174	uint8_t dst, const uint8_t src)
	175	{
	176	twofish_decrypt(ctx, length, dst, src);
	177	}
	178
ed754746 DB	179	typedef struct QCryptoCipherNettle QCryptoCipherNettle;
ed754746 DB	180	struct QCryptoCipherNettle {
eaec903c	181	/* Primary cipher context for all modes */
e3ba0b67	182	void *ctx;
eaec903c DB	183	/* Second cipher context for XTS mode only */
	184	void *ctx_tweak;
	185	/* Cipher callbacks for both contexts */
f7ac78cf DB	186	QCryptoCipherNettleFuncNative alg_encrypt_native;
	187	QCryptoCipherNettleFuncNative alg_decrypt_native;
	188	QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
	189	QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
3c28292f	190	/* Initialization vector or Counter */
ed754746	191	uint8_t *iv;
3a661f1e	192	size_t blocksize;
ed754746 DB	193	};
ed754746 DB	194
f844836d GA	195	bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
f844836d GA	196	QCryptoCipherMode mode)
ed754746 DB	197	{
	198	switch (alg) {
	199	case QCRYPTO_CIPHER_ALG_DES_RFB:
	200	case QCRYPTO_CIPHER_ALG_AES_128:
	201	case QCRYPTO_CIPHER_ALG_AES_192:
	202	case QCRYPTO_CIPHER_ALG_AES_256:
084a85ee	203	case QCRYPTO_CIPHER_ALG_CAST5_128:
94318522 DB	204	case QCRYPTO_CIPHER_ALG_SERPENT_128:
	205	case QCRYPTO_CIPHER_ALG_SERPENT_192:
	206	case QCRYPTO_CIPHER_ALG_SERPENT_256:
50f6753e DB	207	case QCRYPTO_CIPHER_ALG_TWOFISH_128:
	208	case QCRYPTO_CIPHER_ALG_TWOFISH_192:
	209	case QCRYPTO_CIPHER_ALG_TWOFISH_256:
f844836d GA	210	break;
	211	default:
	212	return false;
	213	}
	214
	215	switch (mode) {
	216	case QCRYPTO_CIPHER_MODE_ECB:
	217	case QCRYPTO_CIPHER_MODE_CBC:
	218	case QCRYPTO_CIPHER_MODE_XTS:
	219	case QCRYPTO_CIPHER_MODE_CTR:
ed754746 DB	220	return true;
	221	default:
	222	return false;
	223	}
	224	}
	225
	226
	227	QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
	228	QCryptoCipherMode mode,
	229	const uint8_t *key, size_t nkey,
	230	Error **errp)
	231	{
	232	QCryptoCipher *cipher;
	233	QCryptoCipherNettle *ctx;
	234	uint8_t *rfbkey;
	235
	236	switch (mode) {
	237	case QCRYPTO_CIPHER_MODE_ECB:
	238	case QCRYPTO_CIPHER_MODE_CBC:
eaec903c	239	case QCRYPTO_CIPHER_MODE_XTS:
3c28292f	240	case QCRYPTO_CIPHER_MODE_CTR:
ed754746 DB	241	break;
ed754746 DB	242	default:
90d6f60d DB	243	error_setg(errp, "Unsupported cipher mode %s",
90d6f60d DB	244	QCryptoCipherMode_lookup[mode]);
ed754746 DB	245	return NULL;
	246	}
	247
eaec903c	248	if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
ed754746 DB	249	return NULL;
	250	}
	251
	252	cipher = g_new0(QCryptoCipher, 1);
	253	cipher->alg = alg;
	254	cipher->mode = mode;
	255
	256	ctx = g_new0(QCryptoCipherNettle, 1);
d4c64800	257	cipher->opaque = ctx;
ed754746 DB	258
	259	switch (alg) {
	260	case QCRYPTO_CIPHER_ALG_DES_RFB:
e3ba0b67	261	ctx->ctx = g_new0(struct des_ctx, 1);
ed754746	262	rfbkey = qcrypto_cipher_munge_des_rfb_key(key, nkey);
e3ba0b67	263	des_set_key(ctx->ctx, rfbkey);
ed754746 DB	264	g_free(rfbkey);
ed754746 DB	265
f7ac78cf DB	266	ctx->alg_encrypt_native = des_encrypt_native;
	267	ctx->alg_decrypt_native = des_decrypt_native;
	268	ctx->alg_encrypt_wrapper = des_encrypt_wrapper;
	269	ctx->alg_decrypt_wrapper = des_decrypt_wrapper;
ed754746	270
3a661f1e	271	ctx->blocksize = DES_BLOCK_SIZE;
ed754746 DB	272	break;
	273
	274	case QCRYPTO_CIPHER_ALG_AES_128:
	275	case QCRYPTO_CIPHER_ALG_AES_192:
	276	case QCRYPTO_CIPHER_ALG_AES_256:
e3ba0b67	277	ctx->ctx = g_new0(QCryptoNettleAES, 1);
ed754746	278
eaec903c DB	279	if (mode == QCRYPTO_CIPHER_MODE_XTS) {
	280	ctx->ctx_tweak = g_new0(QCryptoNettleAES, 1);
	281
	282	nkey /= 2;
	283	aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
	284	nkey, key);
	285	aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
	286	nkey, key);
	287
	288	aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->enc,
	289	nkey, key + nkey);
	290	aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx_tweak)->dec,
	291	nkey, key + nkey);
	292	} else {
	293	aes_set_encrypt_key(&((QCryptoNettleAES *)ctx->ctx)->enc,
	294	nkey, key);
	295	aes_set_decrypt_key(&((QCryptoNettleAES *)ctx->ctx)->dec,
	296	nkey, key);
	297	}
ed754746	298
f7ac78cf DB	299	ctx->alg_encrypt_native = aes_encrypt_native;
	300	ctx->alg_decrypt_native = aes_decrypt_native;
	301	ctx->alg_encrypt_wrapper = aes_encrypt_wrapper;
	302	ctx->alg_decrypt_wrapper = aes_decrypt_wrapper;
ed754746	303
3a661f1e	304	ctx->blocksize = AES_BLOCK_SIZE;
ed754746	305	break;
084a85ee DB	306
084a85ee DB	307	case QCRYPTO_CIPHER_ALG_CAST5_128:
e3ba0b67	308	ctx->ctx = g_new0(struct cast128_ctx, 1);
084a85ee	309
eaec903c DB	310	if (mode == QCRYPTO_CIPHER_MODE_XTS) {
	311	ctx->ctx_tweak = g_new0(struct cast128_ctx, 1);
	312
	313	nkey /= 2;
	314	cast5_set_key(ctx->ctx, nkey, key);
	315	cast5_set_key(ctx->ctx_tweak, nkey, key + nkey);
	316	} else {
	317	cast5_set_key(ctx->ctx, nkey, key);
	318	}
084a85ee	319
f7ac78cf DB	320	ctx->alg_encrypt_native = cast128_encrypt_native;
	321	ctx->alg_decrypt_native = cast128_decrypt_native;
	322	ctx->alg_encrypt_wrapper = cast128_encrypt_wrapper;
	323	ctx->alg_decrypt_wrapper = cast128_decrypt_wrapper;
084a85ee DB	324
	325	ctx->blocksize = CAST128_BLOCK_SIZE;
	326	break;
94318522 DB	327
	328	case QCRYPTO_CIPHER_ALG_SERPENT_128:
	329	case QCRYPTO_CIPHER_ALG_SERPENT_192:
	330	case QCRYPTO_CIPHER_ALG_SERPENT_256:
e3ba0b67	331	ctx->ctx = g_new0(struct serpent_ctx, 1);
94318522	332
eaec903c DB	333	if (mode == QCRYPTO_CIPHER_MODE_XTS) {
	334	ctx->ctx_tweak = g_new0(struct serpent_ctx, 1);
	335
	336	nkey /= 2;
	337	serpent_set_key(ctx->ctx, nkey, key);
	338	serpent_set_key(ctx->ctx_tweak, nkey, key + nkey);
	339	} else {
	340	serpent_set_key(ctx->ctx, nkey, key);
	341	}
94318522	342
f7ac78cf DB	343	ctx->alg_encrypt_native = serpent_encrypt_native;
	344	ctx->alg_decrypt_native = serpent_decrypt_native;
	345	ctx->alg_encrypt_wrapper = serpent_encrypt_wrapper;
	346	ctx->alg_decrypt_wrapper = serpent_decrypt_wrapper;
94318522 DB	347
	348	ctx->blocksize = SERPENT_BLOCK_SIZE;
	349	break;
	350
50f6753e DB	351	case QCRYPTO_CIPHER_ALG_TWOFISH_128:
	352	case QCRYPTO_CIPHER_ALG_TWOFISH_192:
	353	case QCRYPTO_CIPHER_ALG_TWOFISH_256:
e3ba0b67	354	ctx->ctx = g_new0(struct twofish_ctx, 1);
50f6753e	355
eaec903c DB	356	if (mode == QCRYPTO_CIPHER_MODE_XTS) {
	357	ctx->ctx_tweak = g_new0(struct twofish_ctx, 1);
	358
	359	nkey /= 2;
	360	twofish_set_key(ctx->ctx, nkey, key);
	361	twofish_set_key(ctx->ctx_tweak, nkey, key + nkey);
	362	} else {
	363	twofish_set_key(ctx->ctx, nkey, key);
	364	}
50f6753e	365
f7ac78cf DB	366	ctx->alg_encrypt_native = twofish_encrypt_native;
	367	ctx->alg_decrypt_native = twofish_decrypt_native;
	368	ctx->alg_encrypt_wrapper = twofish_encrypt_wrapper;
	369	ctx->alg_decrypt_wrapper = twofish_decrypt_wrapper;
50f6753e DB	370
	371	ctx->blocksize = TWOFISH_BLOCK_SIZE;
	372	break;
	373
ed754746	374	default:
90d6f60d DB	375	error_setg(errp, "Unsupported cipher algorithm %s",
90d6f60d DB	376	QCryptoCipherAlgorithm_lookup[alg]);
ed754746 DB	377	goto error;
	378	}
	379
a5d2f44d DB	380	if (mode == QCRYPTO_CIPHER_MODE_XTS &&
	381	ctx->blocksize != XTS_BLOCK_SIZE) {
	382	error_setg(errp, "Cipher block size %zu must equal XTS block size %d",
	383	ctx->blocksize, XTS_BLOCK_SIZE);
	384	goto error;
	385	}
	386
3a661f1e	387	ctx->iv = g_new0(uint8_t, ctx->blocksize);
ed754746 DB	388
	389	return cipher;
	390
	391	error:
d4c64800	392	qcrypto_cipher_free(cipher);
ed754746 DB	393	return NULL;
	394	}
	395
	396
	397	void qcrypto_cipher_free(QCryptoCipher *cipher)
	398	{
	399	QCryptoCipherNettle *ctx;
	400
	401	if (!cipher) {
	402	return;
	403	}
	404
	405	ctx = cipher->opaque;
	406	g_free(ctx->iv);
e3ba0b67	407	g_free(ctx->ctx);
eaec903c	408	g_free(ctx->ctx_tweak);
ed754746 DB	409	g_free(ctx);
	410	g_free(cipher);
	411	}
	412
	413
	414	int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
	415	const void *in,
	416	void *out,
	417	size_t len,
	418	Error **errp)
	419	{
	420	QCryptoCipherNettle *ctx = cipher->opaque;
	421
3a661f1e DB	422	if (len % ctx->blocksize) {
	423	error_setg(errp, "Length %zu must be a multiple of block size %zu",
	424	len, ctx->blocksize);
	425	return -1;
	426	}
	427
ed754746 DB	428	switch (cipher->mode) {
ed754746 DB	429	case QCRYPTO_CIPHER_MODE_ECB:
f7ac78cf	430	ctx->alg_encrypt_wrapper(ctx->ctx, len, out, in);
ed754746 DB	431	break;
	432
	433	case QCRYPTO_CIPHER_MODE_CBC:
f7ac78cf	434	cbc_encrypt(ctx->ctx, ctx->alg_encrypt_native,
3a661f1e	435	ctx->blocksize, ctx->iv,
ed754746 DB	436	len, out, in);
ed754746 DB	437	break;
e3ba0b67	438
eaec903c DB	439	case QCRYPTO_CIPHER_MODE_XTS:
eaec903c DB	440	xts_encrypt(ctx->ctx, ctx->ctx_tweak,
f7ac78cf	441	ctx->alg_encrypt_wrapper, ctx->alg_encrypt_wrapper,
eaec903c DB	442	ctx->iv, len, out, in);
	443	break;
	444
3c28292f GA	445	case QCRYPTO_CIPHER_MODE_CTR:
	446	ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
	447	ctx->blocksize, ctx->iv,
	448	len, out, in);
	449	break;
	450
ed754746	451	default:
90d6f60d DB	452	error_setg(errp, "Unsupported cipher mode %s",
90d6f60d DB	453	QCryptoCipherMode_lookup[cipher->mode]);
ed754746 DB	454	return -1;
	455	}
	456	return 0;
	457	}
	458
	459
	460	int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
	461	const void *in,
	462	void *out,
	463	size_t len,
	464	Error **errp)
	465	{
	466	QCryptoCipherNettle *ctx = cipher->opaque;
	467
3a661f1e DB	468	if (len % ctx->blocksize) {
	469	error_setg(errp, "Length %zu must be a multiple of block size %zu",
	470	len, ctx->blocksize);
	471	return -1;
	472	}
	473
ed754746 DB	474	switch (cipher->mode) {
ed754746 DB	475	case QCRYPTO_CIPHER_MODE_ECB:
f7ac78cf	476	ctx->alg_decrypt_wrapper(ctx->ctx, len, out, in);
ed754746 DB	477	break;
	478
	479	case QCRYPTO_CIPHER_MODE_CBC:
f7ac78cf	480	cbc_decrypt(ctx->ctx, ctx->alg_decrypt_native,
e3ba0b67	481	ctx->blocksize, ctx->iv,
ed754746 DB	482	len, out, in);
ed754746 DB	483	break;
e3ba0b67	484
eaec903c	485	case QCRYPTO_CIPHER_MODE_XTS:
eaec903c	486	xts_decrypt(ctx->ctx, ctx->ctx_tweak,
f7ac78cf	487	ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
eaec903c DB	488	ctx->iv, len, out, in);
eaec903c DB	489	break;
3c28292f GA	490	case QCRYPTO_CIPHER_MODE_CTR:
	491	ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
	492	ctx->blocksize, ctx->iv,
	493	len, out, in);
	494	break;
eaec903c	495
ed754746	496	default:
90d6f60d DB	497	error_setg(errp, "Unsupported cipher mode %s",
90d6f60d DB	498	QCryptoCipherMode_lookup[cipher->mode]);
ed754746 DB	499	return -1;
	500	}
	501	return 0;
	502	}
	503
	504	int qcrypto_cipher_setiv(QCryptoCipher *cipher,
	505	const uint8_t *iv, size_t niv,
	506	Error **errp)
	507	{
	508	QCryptoCipherNettle *ctx = cipher->opaque;
3a661f1e	509	if (niv != ctx->blocksize) {
ed754746	510	error_setg(errp, "Expected IV size %zu not %zu",
3a661f1e	511	ctx->blocksize, niv);
ed754746 DB	512	return -1;
	513	}
	514	memcpy(ctx->iv, iv, niv);
	515	return 0;
	516	}