xform.c revision 256281
11541Srgrimes/*	$OpenBSD: xform.c,v 1.16 2001/08/28 12:20:43 ben Exp $	*/
21541Srgrimes/*-
31541Srgrimes * The authors of this code are John Ioannidis (ji@tla.org),
41541Srgrimes * Angelos D. Keromytis (kermit@csd.uch.gr),
51541Srgrimes * Niels Provos (provos@physnet.uni-hamburg.de) and
61541Srgrimes * Damien Miller (djm@mindrot.org).
71541Srgrimes *
81541Srgrimes * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
91541Srgrimes * in November 1995.
101541Srgrimes *
111541Srgrimes * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
121541Srgrimes * by Angelos D. Keromytis.
131541Srgrimes *
141541Srgrimes * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
151541Srgrimes * and Niels Provos.
161541Srgrimes *
171541Srgrimes * Additional features in 1999 by Angelos D. Keromytis.
181541Srgrimes *
191541Srgrimes * AES XTS implementation in 2008 by Damien Miller
201541Srgrimes *
211541Srgrimes * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
221541Srgrimes * Angelos D. Keromytis and Niels Provos.
231541Srgrimes *
241541Srgrimes * Copyright (C) 2001, Angelos D. Keromytis.
251541Srgrimes *
261541Srgrimes * Copyright (C) 2008, Damien Miller
271541Srgrimes *
281541Srgrimes * Permission to use, copy, and modify this software with or without fee
291541Srgrimes * is hereby granted, provided that this entire notice is included in
301541Srgrimes * all copies of any software which is or includes a copy or
311541Srgrimes * modification of this software.
321541Srgrimes * You may use this code under the GNU public license if you so wish. Please
331541Srgrimes * contribute changes back to the authors under this freer than GPL license
346247Swollman * so that we may further the use of strong encryption without limitations to
351541Srgrimes * all.
361541Srgrimes *
372169Spaul * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
382169Spaul * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
391541Srgrimes * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
401541Srgrimes * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
411541Srgrimes * PURPOSE.
421541Srgrimes */
431541Srgrimes
441541Srgrimes#include <sys/cdefs.h>
451541Srgrimes__FBSDID("$FreeBSD: stable/10/sys/opencrypto/xform.c 247061 2013-02-20 22:59:53Z pjd $");
461541Srgrimes
471541Srgrimes#include <sys/param.h>
481541Srgrimes#include <sys/systm.h>
491541Srgrimes#include <sys/malloc.h>
501541Srgrimes#include <sys/sysctl.h>
511541Srgrimes#include <sys/errno.h>
521541Srgrimes#include <sys/time.h>
531541Srgrimes#include <sys/kernel.h>
541541Srgrimes#include <machine/cpu.h>
556247Swollman
561541Srgrimes#include <crypto/blowfish/blowfish.h>
571541Srgrimes#include <crypto/des/des.h>
581541Srgrimes#include <crypto/rijndael/rijndael.h>
591541Srgrimes#include <crypto/camellia/camellia.h>
601541Srgrimes#include <crypto/sha1.h>
611541Srgrimes
621541Srgrimes#include <opencrypto/cast.h>
631541Srgrimes#include <opencrypto/deflate.h>
641541Srgrimes#include <opencrypto/rmd160.h>
651541Srgrimes#include <opencrypto/skipjack.h>
661541Srgrimes
671541Srgrimes#include <sys/md5.h>
686247Swollman
696247Swollman#include <opencrypto/cryptodev.h>
706247Swollman#include <opencrypto/xform.h>
716247Swollman
726247Swollmanstatic	int null_setkey(u_int8_t **, u_int8_t *, int);
736247Swollmanstatic	int des1_setkey(u_int8_t **, u_int8_t *, int);
746247Swollmanstatic	int des3_setkey(u_int8_t **, u_int8_t *, int);
751541Srgrimesstatic	int blf_setkey(u_int8_t **, u_int8_t *, int);
761541Srgrimesstatic	int cast5_setkey(u_int8_t **, u_int8_t *, int);
771541Srgrimesstatic	int skipjack_setkey(u_int8_t **, u_int8_t *, int);
781541Srgrimesstatic	int rijndael128_setkey(u_int8_t **, u_int8_t *, int);
791541Srgrimesstatic	int aes_xts_setkey(u_int8_t **, u_int8_t *, int);
801541Srgrimesstatic	int cml_setkey(u_int8_t **, u_int8_t *, int);
811541Srgrimes
821541Srgrimesstatic	void null_encrypt(caddr_t, u_int8_t *);
831541Srgrimesstatic	void des1_encrypt(caddr_t, u_int8_t *);
841541Srgrimesstatic	void des3_encrypt(caddr_t, u_int8_t *);
851541Srgrimesstatic	void blf_encrypt(caddr_t, u_int8_t *);
861541Srgrimesstatic	void cast5_encrypt(caddr_t, u_int8_t *);
871541Srgrimesstatic	void skipjack_encrypt(caddr_t, u_int8_t *);
881541Srgrimesstatic	void rijndael128_encrypt(caddr_t, u_int8_t *);
891541Srgrimesstatic	void aes_xts_encrypt(caddr_t, u_int8_t *);
901541Srgrimesstatic	void cml_encrypt(caddr_t, u_int8_t *);
911541Srgrimes
921541Srgrimesstatic	void null_decrypt(caddr_t, u_int8_t *);
931541Srgrimesstatic	void des1_decrypt(caddr_t, u_int8_t *);
941541Srgrimesstatic	void des3_decrypt(caddr_t, u_int8_t *);
951541Srgrimesstatic	void blf_decrypt(caddr_t, u_int8_t *);
961541Srgrimesstatic	void cast5_decrypt(caddr_t, u_int8_t *);
971541Srgrimesstatic	void skipjack_decrypt(caddr_t, u_int8_t *);
981541Srgrimesstatic	void rijndael128_decrypt(caddr_t, u_int8_t *);
991541Srgrimesstatic	void aes_xts_decrypt(caddr_t, u_int8_t *);
1001541Srgrimesstatic	void cml_decrypt(caddr_t, u_int8_t *);
1011541Srgrimes
1021541Srgrimesstatic	void null_zerokey(u_int8_t **);
1031541Srgrimesstatic	void des1_zerokey(u_int8_t **);
1041541Srgrimesstatic	void des3_zerokey(u_int8_t **);
1051541Srgrimesstatic	void blf_zerokey(u_int8_t **);
1061541Srgrimesstatic	void cast5_zerokey(u_int8_t **);
1071541Srgrimesstatic	void skipjack_zerokey(u_int8_t **);
1081541Srgrimesstatic	void rijndael128_zerokey(u_int8_t **);
1091541Srgrimesstatic	void aes_xts_zerokey(u_int8_t **);
1101541Srgrimesstatic	void cml_zerokey(u_int8_t **);
1111541Srgrimes
1121541Srgrimesstatic	void aes_xts_reinit(caddr_t, u_int8_t *);
1131541Srgrimes
1141541Srgrimesstatic	void null_init(void *);
1151541Srgrimesstatic	int null_update(void *, u_int8_t *, u_int16_t);
1161541Srgrimesstatic	void null_final(u_int8_t *, void *);
1171541Srgrimesstatic	int MD5Update_int(void *, u_int8_t *, u_int16_t);
1181541Srgrimesstatic	void SHA1Init_int(void *);
1191541Srgrimesstatic	int SHA1Update_int(void *, u_int8_t *, u_int16_t);
1201541Srgrimesstatic	void SHA1Final_int(u_int8_t *, void *);
1211541Srgrimesstatic	int RMD160Update_int(void *, u_int8_t *, u_int16_t);
1221541Srgrimesstatic	int SHA256Update_int(void *, u_int8_t *, u_int16_t);
1231541Srgrimesstatic	int SHA384Update_int(void *, u_int8_t *, u_int16_t);
1241541Srgrimesstatic	int SHA512Update_int(void *, u_int8_t *, u_int16_t);
1251541Srgrimes
1261541Srgrimesstatic	u_int32_t deflate_compress(u_int8_t *, u_int32_t, u_int8_t **);
1271541Srgrimesstatic	u_int32_t deflate_decompress(u_int8_t *, u_int32_t, u_int8_t **);
1281541Srgrimes
1291541SrgrimesMALLOC_DEFINE(M_XDATA, "xform", "xform data buffers");
1301541Srgrimes
1311541Srgrimes/* Encryption instances */
1321541Srgrimesstruct enc_xform enc_xform_null = {
1331541Srgrimes	CRYPTO_NULL_CBC, "NULL",
1341541Srgrimes	/* NB: blocksize of 4 is to generate a properly aligned ESP header */
1351541Srgrimes	NULL_BLOCK_LEN, 0, 256, /* 2048 bits, max key */
1361541Srgrimes	null_encrypt,
1376247Swollman	null_decrypt,
1386247Swollman	null_setkey,
1396247Swollman	null_zerokey,
1406247Swollman	NULL
1416247Swollman};
1426247Swollman
1431541Srgrimesstruct enc_xform enc_xform_des = {
1441541Srgrimes	CRYPTO_DES_CBC, "DES",
1451541Srgrimes	DES_BLOCK_LEN, 8, 8,
1461541Srgrimes	des1_encrypt,
1471541Srgrimes	des1_decrypt,
1486247Swollman	des1_setkey,
1496247Swollman	des1_zerokey,
1506247Swollman	NULL
1516247Swollman};
1526247Swollman
1536247Swollmanstruct enc_xform enc_xform_3des = {
1546247Swollman	CRYPTO_3DES_CBC, "3DES",
1556247Swollman	DES3_BLOCK_LEN, 24, 24,
1566247Swollman	des3_encrypt,
1576247Swollman	des3_decrypt,
1586247Swollman	des3_setkey,
1596247Swollman	des3_zerokey,
1606247Swollman	NULL
1616247Swollman};
1626247Swollman
1636247Swollmanstruct enc_xform enc_xform_blf = {
1646247Swollman	CRYPTO_BLF_CBC, "Blowfish",
1656247Swollman	BLOWFISH_BLOCK_LEN, 5, 56 /* 448 bits, max key */,
1666247Swollman	blf_encrypt,
1676247Swollman	blf_decrypt,
1686247Swollman	blf_setkey,
1696247Swollman	blf_zerokey,
1706247Swollman	NULL
1716247Swollman};
1726247Swollman
1736247Swollmanstruct enc_xform enc_xform_cast5 = {
1746247Swollman	CRYPTO_CAST_CBC, "CAST-128",
1756247Swollman	CAST128_BLOCK_LEN, 5, 16,
1766247Swollman	cast5_encrypt,
1776247Swollman	cast5_decrypt,
1786247Swollman	cast5_setkey,
1796247Swollman	cast5_zerokey,
1806247Swollman	NULL
1816247Swollman};
1826247Swollman
1836247Swollmanstruct enc_xform enc_xform_skipjack = {
1846247Swollman	CRYPTO_SKIPJACK_CBC, "Skipjack",
1851541Srgrimes	SKIPJACK_BLOCK_LEN, 10, 10,
1861541Srgrimes	skipjack_encrypt,
1871541Srgrimes	skipjack_decrypt,
1881541Srgrimes	skipjack_setkey,
1891541Srgrimes	skipjack_zerokey,
1901541Srgrimes	NULL
1911541Srgrimes};
1921541Srgrimes
1931541Srgrimesstruct enc_xform enc_xform_rijndael128 = {
1941541Srgrimes	CRYPTO_RIJNDAEL128_CBC, "Rijndael-128/AES",
1951541Srgrimes	RIJNDAEL128_BLOCK_LEN, 8, 32,
1961541Srgrimes	rijndael128_encrypt,
1971541Srgrimes	rijndael128_decrypt,
1981541Srgrimes	rijndael128_setkey,
1991541Srgrimes	rijndael128_zerokey,
2006247Swollman	NULL
2011541Srgrimes};
2021541Srgrimes
2031541Srgrimesstruct enc_xform enc_xform_aes_xts = {
2041541Srgrimes	CRYPTO_AES_XTS, "AES-XTS",
2051541Srgrimes	RIJNDAEL128_BLOCK_LEN, 32, 64,
2061541Srgrimes	aes_xts_encrypt,
2071541Srgrimes	aes_xts_decrypt,
2081541Srgrimes	aes_xts_setkey,
2091541Srgrimes	aes_xts_zerokey,
2101541Srgrimes	aes_xts_reinit
2111541Srgrimes};
2121541Srgrimes
2131541Srgrimesstruct enc_xform enc_xform_arc4 = {
2141541Srgrimes	CRYPTO_ARC4, "ARC4",
2151541Srgrimes	1, 1, 32,
2161541Srgrimes	NULL,
2171541Srgrimes	NULL,
2181541Srgrimes	NULL,
2191541Srgrimes	NULL,
2201541Srgrimes	NULL
2211541Srgrimes};
2221541Srgrimes
2231541Srgrimesstruct enc_xform enc_xform_camellia = {
2241541Srgrimes	CRYPTO_CAMELLIA_CBC, "Camellia",
2251541Srgrimes	CAMELLIA_BLOCK_LEN, 8, 32,
2261541Srgrimes	cml_encrypt,
2271541Srgrimes	cml_decrypt,
2281541Srgrimes	cml_setkey,
2291541Srgrimes	cml_zerokey,
2301541Srgrimes	NULL
2311541Srgrimes};
2321541Srgrimes
2331541Srgrimes/* Authentication instances */
2341541Srgrimesstruct auth_hash auth_hash_null = {
2351541Srgrimes	CRYPTO_NULL_HMAC, "NULL-HMAC",
2361541Srgrimes	0, NULL_HASH_LEN, NULL_HMAC_BLOCK_LEN, sizeof(int),	/* NB: context isn't used */
2371541Srgrimes	null_init, null_update, null_final
2381541Srgrimes};
2391541Srgrimes
2401541Srgrimesstruct auth_hash auth_hash_hmac_md5 = {
2411541Srgrimes	CRYPTO_MD5_HMAC, "HMAC-MD5",
2421541Srgrimes	16, MD5_HASH_LEN, MD5_HMAC_BLOCK_LEN, sizeof(MD5_CTX),
2431541Srgrimes	(void (*) (void *)) MD5Init, MD5Update_int,
2441541Srgrimes	(void (*) (u_int8_t *, void *)) MD5Final
2451541Srgrimes};
2461541Srgrimes
2471541Srgrimesstruct auth_hash auth_hash_hmac_sha1 = {
2481541Srgrimes	CRYPTO_SHA1_HMAC, "HMAC-SHA1",
2491541Srgrimes	20, SHA1_HASH_LEN, SHA1_HMAC_BLOCK_LEN, sizeof(SHA1_CTX),
2501541Srgrimes	SHA1Init_int, SHA1Update_int, SHA1Final_int
2511541Srgrimes};
2521541Srgrimes
2531541Srgrimesstruct auth_hash auth_hash_hmac_ripemd_160 = {
2541541Srgrimes	CRYPTO_RIPEMD160_HMAC, "HMAC-RIPEMD-160",
2551541Srgrimes	20, RIPEMD160_HASH_LEN, RIPEMD160_HMAC_BLOCK_LEN, sizeof(RMD160_CTX),
2561541Srgrimes	(void (*)(void *)) RMD160Init, RMD160Update_int,
2571541Srgrimes	(void (*)(u_int8_t *, void *)) RMD160Final
2581541Srgrimes};
2591541Srgrimes
2601541Srgrimesstruct auth_hash auth_hash_key_md5 = {
2611541Srgrimes	CRYPTO_MD5_KPDK, "Keyed MD5",
2621541Srgrimes	0, MD5_KPDK_HASH_LEN, 0, sizeof(MD5_CTX),
2631541Srgrimes	(void (*)(void *)) MD5Init, MD5Update_int,
2641541Srgrimes	(void (*)(u_int8_t *, void *)) MD5Final
2651541Srgrimes};
2661541Srgrimes
2671541Srgrimesstruct auth_hash auth_hash_key_sha1 = {
2681541Srgrimes	CRYPTO_SHA1_KPDK, "Keyed SHA1",
2691541Srgrimes	0, SHA1_KPDK_HASH_LEN, 0, sizeof(SHA1_CTX),
2701541Srgrimes	SHA1Init_int, SHA1Update_int, SHA1Final_int
2711541Srgrimes};
2721541Srgrimes
2731541Srgrimesstruct auth_hash auth_hash_hmac_sha2_256 = {
2741541Srgrimes	CRYPTO_SHA2_256_HMAC, "HMAC-SHA2-256",
2751541Srgrimes	32, SHA2_256_HASH_LEN, SHA2_256_HMAC_BLOCK_LEN, sizeof(SHA256_CTX),
2761541Srgrimes	(void (*)(void *)) SHA256_Init, SHA256Update_int,
2771541Srgrimes	(void (*)(u_int8_t *, void *)) SHA256_Final
2781541Srgrimes};
2791541Srgrimes
2801541Srgrimesstruct auth_hash auth_hash_hmac_sha2_384 = {
2811541Srgrimes	CRYPTO_SHA2_384_HMAC, "HMAC-SHA2-384",
2821541Srgrimes	48, SHA2_384_HASH_LEN, SHA2_384_HMAC_BLOCK_LEN, sizeof(SHA384_CTX),
2831541Srgrimes	(void (*)(void *)) SHA384_Init, SHA384Update_int,
2841541Srgrimes	(void (*)(u_int8_t *, void *)) SHA384_Final
2851541Srgrimes};
2861541Srgrimes
2871541Srgrimesstruct auth_hash auth_hash_hmac_sha2_512 = {
2886247Swollman	CRYPTO_SHA2_512_HMAC, "HMAC-SHA2-512",
2896247Swollman	64, SHA2_512_HASH_LEN, SHA2_512_HMAC_BLOCK_LEN, sizeof(SHA512_CTX),
2906247Swollman	(void (*)(void *)) SHA512_Init, SHA512Update_int,
2916247Swollman	(void (*)(u_int8_t *, void *)) SHA512_Final
2926247Swollman};
2936247Swollman
2946247Swollman/* Compression instance */
2956247Swollmanstruct comp_algo comp_algo_deflate = {
2966247Swollman	CRYPTO_DEFLATE_COMP, "Deflate",
2976247Swollman	90, deflate_compress,
2986247Swollman	deflate_decompress
2996247Swollman};
3006247Swollman
3016247Swollman/*
3026247Swollman * Encryption wrapper routines.
3031541Srgrimes */
3041541Srgrimesstatic void
3051541Srgrimesnull_encrypt(caddr_t key, u_int8_t *blk)
3061541Srgrimes{
3071541Srgrimes}
3081541Srgrimesstatic void
3091541Srgrimesnull_decrypt(caddr_t key, u_int8_t *blk)
3101541Srgrimes{
3111541Srgrimes}
3126247Swollmanstatic int
3136247Swollmannull_setkey(u_int8_t **sched, u_int8_t *key, int len)
3146247Swollman{
3151541Srgrimes	*sched = NULL;
3161541Srgrimes	return 0;
3171541Srgrimes}
3181541Srgrimesstatic void
3191541Srgrimesnull_zerokey(u_int8_t **sched)
3201541Srgrimes{
3216247Swollman	*sched = NULL;
3221541Srgrimes}
3236247Swollman
3246247Swollmanstatic void
3256247Swollmandes1_encrypt(caddr_t key, u_int8_t *blk)
3261541Srgrimes{
3276247Swollman	des_cblock *cb = (des_cblock *) blk;
3281541Srgrimes	des_key_schedule *p = (des_key_schedule *) key;
3291541Srgrimes
3306247Swollman	des_ecb_encrypt(cb, cb, p[0], DES_ENCRYPT);
3316247Swollman}
3326247Swollman
3336247Swollmanstatic void
3341541Srgrimesdes1_decrypt(caddr_t key, u_int8_t *blk)
3351541Srgrimes{
3366247Swollman	des_cblock *cb = (des_cblock *) blk;
3376247Swollman	des_key_schedule *p = (des_key_schedule *) key;
3381541Srgrimes
3391541Srgrimes	des_ecb_encrypt(cb, cb, p[0], DES_DECRYPT);
3401541Srgrimes}
3411541Srgrimes
3421541Srgrimesstatic int
3431541Srgrimesdes1_setkey(u_int8_t **sched, u_int8_t *key, int len)
3441541Srgrimes{
3451541Srgrimes	des_key_schedule *p;
3461541Srgrimes	int err;
3471541Srgrimes
3486247Swollman	p = malloc(sizeof (des_key_schedule),
3496247Swollman		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
3501541Srgrimes	if (p != NULL) {
3511541Srgrimes		des_set_key((des_cblock *) key, p[0]);
3526247Swollman		err = 0;
3531541Srgrimes	} else
3541541Srgrimes		err = ENOMEM;
3551541Srgrimes	*sched = (u_int8_t *) p;
3561541Srgrimes	return err;
3571541Srgrimes}
3581541Srgrimes
3591541Srgrimesstatic void
3601541Srgrimesdes1_zerokey(u_int8_t **sched)
3611541Srgrimes{
3621541Srgrimes	bzero(*sched, sizeof (des_key_schedule));
3631541Srgrimes	free(*sched, M_CRYPTO_DATA);
3642169Spaul	*sched = NULL;
3652169Spaul}
366
367static void
368des3_encrypt(caddr_t key, u_int8_t *blk)
369{
370	des_cblock *cb = (des_cblock *) blk;
371	des_key_schedule *p = (des_key_schedule *) key;
372
373	des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_ENCRYPT);
374}
375
376static void
377des3_decrypt(caddr_t key, u_int8_t *blk)
378{
379	des_cblock *cb = (des_cblock *) blk;
380	des_key_schedule *p = (des_key_schedule *) key;
381
382	des_ecb3_encrypt(cb, cb, p[0], p[1], p[2], DES_DECRYPT);
383}
384
385static int
386des3_setkey(u_int8_t **sched, u_int8_t *key, int len)
387{
388	des_key_schedule *p;
389	int err;
390
391	p = malloc(3*sizeof (des_key_schedule),
392		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
393	if (p != NULL) {
394		des_set_key((des_cblock *)(key +  0), p[0]);
395		des_set_key((des_cblock *)(key +  8), p[1]);
396		des_set_key((des_cblock *)(key + 16), p[2]);
397		err = 0;
398	} else
399		err = ENOMEM;
400	*sched = (u_int8_t *) p;
401	return err;
402}
403
404static void
405des3_zerokey(u_int8_t **sched)
406{
407	bzero(*sched, 3*sizeof (des_key_schedule));
408	free(*sched, M_CRYPTO_DATA);
409	*sched = NULL;
410}
411
412static void
413blf_encrypt(caddr_t key, u_int8_t *blk)
414{
415	BF_LONG t[2];
416
417	memcpy(t, blk, sizeof (t));
418	t[0] = ntohl(t[0]);
419	t[1] = ntohl(t[1]);
420	/* NB: BF_encrypt expects the block in host order! */
421	BF_encrypt(t, (BF_KEY *) key);
422	t[0] = htonl(t[0]);
423	t[1] = htonl(t[1]);
424	memcpy(blk, t, sizeof (t));
425}
426
427static void
428blf_decrypt(caddr_t key, u_int8_t *blk)
429{
430	BF_LONG t[2];
431
432	memcpy(t, blk, sizeof (t));
433	t[0] = ntohl(t[0]);
434	t[1] = ntohl(t[1]);
435	/* NB: BF_decrypt expects the block in host order! */
436	BF_decrypt(t, (BF_KEY *) key);
437	t[0] = htonl(t[0]);
438	t[1] = htonl(t[1]);
439	memcpy(blk, t, sizeof (t));
440}
441
442static int
443blf_setkey(u_int8_t **sched, u_int8_t *key, int len)
444{
445	int err;
446
447	*sched = malloc(sizeof(BF_KEY),
448		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
449	if (*sched != NULL) {
450		BF_set_key((BF_KEY *) *sched, len, key);
451		err = 0;
452	} else
453		err = ENOMEM;
454	return err;
455}
456
457static void
458blf_zerokey(u_int8_t **sched)
459{
460	bzero(*sched, sizeof(BF_KEY));
461	free(*sched, M_CRYPTO_DATA);
462	*sched = NULL;
463}
464
465static void
466cast5_encrypt(caddr_t key, u_int8_t *blk)
467{
468	cast_encrypt((cast_key *) key, blk, blk);
469}
470
471static void
472cast5_decrypt(caddr_t key, u_int8_t *blk)
473{
474	cast_decrypt((cast_key *) key, blk, blk);
475}
476
477static int
478cast5_setkey(u_int8_t **sched, u_int8_t *key, int len)
479{
480	int err;
481
482	*sched = malloc(sizeof(cast_key), M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
483	if (*sched != NULL) {
484		cast_setkey((cast_key *)*sched, key, len);
485		err = 0;
486	} else
487		err = ENOMEM;
488	return err;
489}
490
491static void
492cast5_zerokey(u_int8_t **sched)
493{
494	bzero(*sched, sizeof(cast_key));
495	free(*sched, M_CRYPTO_DATA);
496	*sched = NULL;
497}
498
499static void
500skipjack_encrypt(caddr_t key, u_int8_t *blk)
501{
502	skipjack_forwards(blk, blk, (u_int8_t **) key);
503}
504
505static void
506skipjack_decrypt(caddr_t key, u_int8_t *blk)
507{
508	skipjack_backwards(blk, blk, (u_int8_t **) key);
509}
510
511static int
512skipjack_setkey(u_int8_t **sched, u_int8_t *key, int len)
513{
514	int err;
515
516	/* NB: allocate all the memory that's needed at once */
517	*sched = malloc(10 * (sizeof(u_int8_t *) + 0x100),
518		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
519	if (*sched != NULL) {
520		u_int8_t** key_tables = (u_int8_t**) *sched;
521		u_int8_t* table = (u_int8_t*) &key_tables[10];
522		int k;
523
524		for (k = 0; k < 10; k++) {
525			key_tables[k] = table;
526			table += 0x100;
527		}
528		subkey_table_gen(key, (u_int8_t **) *sched);
529		err = 0;
530	} else
531		err = ENOMEM;
532	return err;
533}
534
535static void
536skipjack_zerokey(u_int8_t **sched)
537{
538	bzero(*sched, 10 * (sizeof(u_int8_t *) + 0x100));
539	free(*sched, M_CRYPTO_DATA);
540	*sched = NULL;
541}
542
543static void
544rijndael128_encrypt(caddr_t key, u_int8_t *blk)
545{
546	rijndael_encrypt((rijndael_ctx *) key, (u_char *) blk, (u_char *) blk);
547}
548
549static void
550rijndael128_decrypt(caddr_t key, u_int8_t *blk)
551{
552	rijndael_decrypt(((rijndael_ctx *) key), (u_char *) blk,
553	    (u_char *) blk);
554}
555
556static int
557rijndael128_setkey(u_int8_t **sched, u_int8_t *key, int len)
558{
559	int err;
560
561	if (len != 16 && len != 24 && len != 32)
562		return (EINVAL);
563	*sched = malloc(sizeof(rijndael_ctx), M_CRYPTO_DATA,
564	    M_NOWAIT|M_ZERO);
565	if (*sched != NULL) {
566		rijndael_set_key((rijndael_ctx *) *sched, (u_char *) key,
567		    len * 8);
568		err = 0;
569	} else
570		err = ENOMEM;
571	return err;
572}
573
574static void
575rijndael128_zerokey(u_int8_t **sched)
576{
577	bzero(*sched, sizeof(rijndael_ctx));
578	free(*sched, M_CRYPTO_DATA);
579	*sched = NULL;
580}
581
582#define	AES_XTS_BLOCKSIZE	16
583#define	AES_XTS_IVSIZE		8
584#define	AES_XTS_ALPHA		0x87	/* GF(2^128) generator polynomial */
585
586struct aes_xts_ctx {
587	rijndael_ctx key1;
588	rijndael_ctx key2;
589	u_int8_t tweak[AES_XTS_BLOCKSIZE];
590};
591
592void
593aes_xts_reinit(caddr_t key, u_int8_t *iv)
594{
595	struct aes_xts_ctx *ctx = (struct aes_xts_ctx *)key;
596	u_int64_t blocknum;
597	u_int i;
598
599	/*
600	 * Prepare tweak as E_k2(IV). IV is specified as LE representation
601	 * of a 64-bit block number which we allow to be passed in directly.
602	 */
603	bcopy(iv, &blocknum, AES_XTS_IVSIZE);
604	for (i = 0; i < AES_XTS_IVSIZE; i++) {
605		ctx->tweak[i] = blocknum & 0xff;
606		blocknum >>= 8;
607	}
608	/* Last 64 bits of IV are always zero */
609	bzero(ctx->tweak + AES_XTS_IVSIZE, AES_XTS_IVSIZE);
610
611	rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak);
612}
613
614static void
615aes_xts_crypt(struct aes_xts_ctx *ctx, u_int8_t *data, u_int do_encrypt)
616{
617	u_int8_t block[AES_XTS_BLOCKSIZE];
618	u_int i, carry_in, carry_out;
619
620	for (i = 0; i < AES_XTS_BLOCKSIZE; i++)
621		block[i] = data[i] ^ ctx->tweak[i];
622
623	if (do_encrypt)
624		rijndael_encrypt(&ctx->key1, block, data);
625	else
626		rijndael_decrypt(&ctx->key1, block, data);
627
628	for (i = 0; i < AES_XTS_BLOCKSIZE; i++)
629		data[i] ^= ctx->tweak[i];
630
631	/* Exponentiate tweak */
632	carry_in = 0;
633	for (i = 0; i < AES_XTS_BLOCKSIZE; i++) {
634		carry_out = ctx->tweak[i] & 0x80;
635		ctx->tweak[i] = (ctx->tweak[i] << 1) | (carry_in ? 1 : 0);
636		carry_in = carry_out;
637	}
638	if (carry_in)
639		ctx->tweak[0] ^= AES_XTS_ALPHA;
640	bzero(block, sizeof(block));
641}
642
643void
644aes_xts_encrypt(caddr_t key, u_int8_t *data)
645{
646	aes_xts_crypt((struct aes_xts_ctx *)key, data, 1);
647}
648
649void
650aes_xts_decrypt(caddr_t key, u_int8_t *data)
651{
652	aes_xts_crypt((struct aes_xts_ctx *)key, data, 0);
653}
654
655int
656aes_xts_setkey(u_int8_t **sched, u_int8_t *key, int len)
657{
658	struct aes_xts_ctx *ctx;
659
660	if (len != 32 && len != 64)
661		return EINVAL;
662
663	*sched = malloc(sizeof(struct aes_xts_ctx), M_CRYPTO_DATA,
664	    M_NOWAIT | M_ZERO);
665	if (*sched == NULL)
666		return ENOMEM;
667	ctx = (struct aes_xts_ctx *)*sched;
668
669	rijndael_set_key(&ctx->key1, key, len * 4);
670	rijndael_set_key(&ctx->key2, key + (len / 2), len * 4);
671
672	return 0;
673}
674
675void
676aes_xts_zerokey(u_int8_t **sched)
677{
678	bzero(*sched, sizeof(struct aes_xts_ctx));
679	free(*sched, M_CRYPTO_DATA);
680	*sched = NULL;
681}
682
683static void
684cml_encrypt(caddr_t key, u_int8_t *blk)
685{
686	camellia_encrypt((camellia_ctx *) key, (u_char *) blk, (u_char *) blk);
687}
688
689static void
690cml_decrypt(caddr_t key, u_int8_t *blk)
691{
692	camellia_decrypt(((camellia_ctx *) key), (u_char *) blk,
693	    (u_char *) blk);
694}
695
696static int
697cml_setkey(u_int8_t **sched, u_int8_t *key, int len)
698{
699	int err;
700
701	if (len != 16 && len != 24 && len != 32)
702		return (EINVAL);
703	*sched = malloc(sizeof(camellia_ctx), M_CRYPTO_DATA,
704	    M_NOWAIT|M_ZERO);
705	if (*sched != NULL) {
706		camellia_set_key((camellia_ctx *) *sched, (u_char *) key,
707		    len * 8);
708		err = 0;
709	} else
710		err = ENOMEM;
711	return err;
712}
713
714static void
715cml_zerokey(u_int8_t **sched)
716{
717	bzero(*sched, sizeof(camellia_ctx));
718	free(*sched, M_CRYPTO_DATA);
719	*sched = NULL;
720}
721
722/*
723 * And now for auth.
724 */
725
726static void
727null_init(void *ctx)
728{
729}
730
731static int
732null_update(void *ctx, u_int8_t *buf, u_int16_t len)
733{
734	return 0;
735}
736
737static void
738null_final(u_int8_t *buf, void *ctx)
739{
740	if (buf != (u_int8_t *) 0)
741		bzero(buf, 12);
742}
743
744static int
745RMD160Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
746{
747	RMD160Update(ctx, buf, len);
748	return 0;
749}
750
751static int
752MD5Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
753{
754	MD5Update(ctx, buf, len);
755	return 0;
756}
757
758static void
759SHA1Init_int(void *ctx)
760{
761	SHA1Init(ctx);
762}
763
764static int
765SHA1Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
766{
767	SHA1Update(ctx, buf, len);
768	return 0;
769}
770
771static void
772SHA1Final_int(u_int8_t *blk, void *ctx)
773{
774	SHA1Final(blk, ctx);
775}
776
777static int
778SHA256Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
779{
780	SHA256_Update(ctx, buf, len);
781	return 0;
782}
783
784static int
785SHA384Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
786{
787	SHA384_Update(ctx, buf, len);
788	return 0;
789}
790
791static int
792SHA512Update_int(void *ctx, u_int8_t *buf, u_int16_t len)
793{
794	SHA512_Update(ctx, buf, len);
795	return 0;
796}
797
798/*
799 * And compression
800 */
801
802static u_int32_t
803deflate_compress(data, size, out)
804	u_int8_t *data;
805	u_int32_t size;
806	u_int8_t **out;
807{
808	return deflate_global(data, size, 0, out);
809}
810
811static u_int32_t
812deflate_decompress(data, size, out)
813	u_int8_t *data;
814	u_int32_t size;
815	u_int8_t **out;
816{
817	return deflate_global(data, size, 1, out);
818}
819