wg_crypto.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10

    1 /* SPDX-License-Identifier: MIT
    2  *
    3  * Copyright (C) 2015-2021 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
    4  * Copyright (c) 2022 The FreeBSD Foundation
    5  */
    6 
    7 #include <sys/types.h>
    8 #include <sys/systm.h>
    9 #include <sys/endian.h>
   10 #include <sys/mbuf.h>
   11 #include <opencrypto/cryptodev.h>
   12 
   13 #include "crypto.h"
   14 
   15 static crypto_session_t chacha20_poly1305_sid;
   16 
   17 #ifdef COMPAT_NEED_BLAKE2S
   18 #ifndef ARRAY_SIZE
   19 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
   20 #endif
   21 #ifndef DIV_ROUND_UP
   22 #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
   23 #endif
   24 
   25 #define le32_to_cpup(a) le32toh(*(a))
   26 #define cpu_to_le32(a) htole32(a)
   27 
   28 static inline void cpu_to_le32_array(uint32_t *buf, unsigned int words)
   29 {
   30         while (words--) {
   31                 *buf = cpu_to_le32(*buf);
   32                 ++buf;
   33         }
   34 }
   35 static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words)
   36 {
   37         while (words--) {
   38                 *buf = le32_to_cpup(buf);
   39                 ++buf;
   40         }
   41 }
   42 static inline uint32_t ror32(uint32_t word, unsigned int shift)
   43 {
   44         return (word >> (shift & 31)) | (word << ((-shift) & 31));
   45 }
   46 
   47 static const uint32_t blake2s_iv[8] = {
   48         0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
   49         0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
   50 };
   51 
   52 static const uint8_t blake2s_sigma[10][16] = {
   53         { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
   54         { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
   55         { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
   56         { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
   57         { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
   58         { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
   59         { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
   60         { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
   61         { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
   62         { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
   63 };
   64 
   65 static inline void blake2s_set_lastblock(struct blake2s_state *state)
   66 {
   67         state->f[0] = -1;
   68 }
   69 
   70 static inline void blake2s_increment_counter(struct blake2s_state *state,
   71                                              const uint32_t inc)
   72 {
   73         state->t[0] += inc;
   74         state->t[1] += (state->t[0] < inc);
   75 }
   76 
   77 static inline void blake2s_init_param(struct blake2s_state *state,
   78                                       const uint32_t param)
   79 {
   80         int i;
   81 
   82         memset(state, 0, sizeof(*state));
   83         for (i = 0; i < 8; ++i)
   84                 state->h[i] = blake2s_iv[i];
   85         state->h[0] ^= param;
   86 }
   87 
   88 void blake2s_init(struct blake2s_state *state, const size_t outlen)
   89 {
   90         blake2s_init_param(state, 0x01010000 | outlen);
   91         state->outlen = outlen;
   92 }
   93 
   94 void blake2s_init_key(struct blake2s_state *state, const size_t outlen,
   95                       const uint8_t *key, const size_t keylen)
   96 {
   97         uint8_t block[BLAKE2S_BLOCK_SIZE] = { 0 };
   98 
   99         blake2s_init_param(state, 0x01010000 | keylen << 8 | outlen);
  100         state->outlen = outlen;
  101         memcpy(block, key, keylen);
  102         blake2s_update(state, block, BLAKE2S_BLOCK_SIZE);
  103         explicit_bzero(block, BLAKE2S_BLOCK_SIZE);
  104 }
  105 
  106 static inline void blake2s_compress(struct blake2s_state *state,
  107                                     const uint8_t *block, size_t nblocks,
  108                                     const uint32_t inc)
  109 {
  110         uint32_t m[16];
  111         uint32_t v[16];
  112         int i;
  113 
  114         while (nblocks > 0) {
  115                 blake2s_increment_counter(state, inc);
  116                 memcpy(m, block, BLAKE2S_BLOCK_SIZE);
  117                 le32_to_cpu_array(m, ARRAY_SIZE(m));
  118                 memcpy(v, state->h, 32);
  119                 v[ 8] = blake2s_iv[0];
  120                 v[ 9] = blake2s_iv[1];
  121                 v[10] = blake2s_iv[2];
  122                 v[11] = blake2s_iv[3];
  123                 v[12] = blake2s_iv[4] ^ state->t[0];
  124                 v[13] = blake2s_iv[5] ^ state->t[1];
  125                 v[14] = blake2s_iv[6] ^ state->f[0];
  126                 v[15] = blake2s_iv[7] ^ state->f[1];
  127 
  128 #define G(r, i, a, b, c, d) do { \
  129         a += b + m[blake2s_sigma[r][2 * i + 0]]; \
  130         d = ror32(d ^ a, 16); \
  131         c += d; \
  132         b = ror32(b ^ c, 12); \
  133         a += b + m[blake2s_sigma[r][2 * i + 1]]; \
  134         d = ror32(d ^ a, 8); \
  135         c += d; \
  136         b = ror32(b ^ c, 7); \
  137 } while (0)
  138 
  139 #define ROUND(r) do { \
  140         G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
  141         G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
  142         G(r, 2, v[2], v[ 6], v[10], v[14]); \
  143         G(r, 3, v[3], v[ 7], v[11], v[15]); \
  144         G(r, 4, v[0], v[ 5], v[10], v[15]); \
  145         G(r, 5, v[1], v[ 6], v[11], v[12]); \
  146         G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
  147         G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
  148 } while (0)
  149                 ROUND(0);
  150                 ROUND(1);
  151                 ROUND(2);
  152                 ROUND(3);
  153                 ROUND(4);
  154                 ROUND(5);
  155                 ROUND(6);
  156                 ROUND(7);
  157                 ROUND(8);
  158                 ROUND(9);
  159 
  160 #undef G
  161 #undef ROUND
  162 
  163                 for (i = 0; i < 8; ++i)
  164                         state->h[i] ^= v[i] ^ v[i + 8];
  165 
  166                 block += BLAKE2S_BLOCK_SIZE;
  167                 --nblocks;
  168         }
  169 }
  170 
  171 void blake2s_update(struct blake2s_state *state, const uint8_t *in, size_t inlen)
  172 {
  173         const size_t fill = BLAKE2S_BLOCK_SIZE - state->buflen;
  174 
  175         if (!inlen)
  176                 return;
  177         if (inlen > fill) {
  178                 memcpy(state->buf + state->buflen, in, fill);
  179                 blake2s_compress(state, state->buf, 1, BLAKE2S_BLOCK_SIZE);
  180                 state->buflen = 0;
  181                 in += fill;
  182                 inlen -= fill;
  183         }
  184         if (inlen > BLAKE2S_BLOCK_SIZE) {
  185                 const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_SIZE);
  186                 /* Hash one less (full) block than strictly possible */
  187                 blake2s_compress(state, in, nblocks - 1, BLAKE2S_BLOCK_SIZE);
  188                 in += BLAKE2S_BLOCK_SIZE * (nblocks - 1);
  189                 inlen -= BLAKE2S_BLOCK_SIZE * (nblocks - 1);
  190         }
  191         memcpy(state->buf + state->buflen, in, inlen);
  192         state->buflen += inlen;
  193 }
  194 
  195 void blake2s_final(struct blake2s_state *state, uint8_t *out)
  196 {
  197         blake2s_set_lastblock(state);
  198         memset(state->buf + state->buflen, 0,
  199                BLAKE2S_BLOCK_SIZE - state->buflen); /* Padding */
  200         blake2s_compress(state, state->buf, 1, state->buflen);
  201         cpu_to_le32_array(state->h, ARRAY_SIZE(state->h));
  202         memcpy(out, state->h, state->outlen);
  203         explicit_bzero(state, sizeof(*state));
  204 }
  205 #endif
  206 
  207 static int
  208 crypto_callback(struct cryptop *crp)
  209 {
  210         return (0);
  211 }
  212 
  213 int
  214 chacha20poly1305_encrypt_mbuf(struct mbuf *m, const uint64_t nonce,
  215                               const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
  216 {
  217         static const char blank_tag[POLY1305_HASH_LEN];
  218         struct cryptop crp;
  219         int ret;
  220 
  221         if (!m_append(m, POLY1305_HASH_LEN, blank_tag))
  222                 return (ENOMEM);
  223         crypto_initreq(&crp, chacha20_poly1305_sid);
  224         crp.crp_op = CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST;
  225         crp.crp_flags = CRYPTO_F_IV_SEPARATE | CRYPTO_F_CBIMM;
  226         crypto_use_mbuf(&crp, m);
  227         crp.crp_payload_length = m->m_pkthdr.len - POLY1305_HASH_LEN;
  228         crp.crp_digest_start = crp.crp_payload_length;
  229         le64enc(crp.crp_iv, nonce);
  230         crp.crp_cipher_key = key;
  231         crp.crp_callback = crypto_callback;
  232         ret = crypto_dispatch(&crp);
  233         crypto_destroyreq(&crp);
  234         return (ret);
  235 }
  236 
  237 int
  238 chacha20poly1305_decrypt_mbuf(struct mbuf *m, const uint64_t nonce,
  239                               const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
  240 {
  241         struct cryptop crp;
  242         int ret;
  243 
  244         if (m->m_pkthdr.len < POLY1305_HASH_LEN)
  245                 return (EMSGSIZE);
  246         crypto_initreq(&crp, chacha20_poly1305_sid);
  247         crp.crp_op = CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST;
  248         crp.crp_flags = CRYPTO_F_IV_SEPARATE | CRYPTO_F_CBIMM;
  249         crypto_use_mbuf(&crp, m);
  250         crp.crp_payload_length = m->m_pkthdr.len - POLY1305_HASH_LEN;
  251         crp.crp_digest_start = crp.crp_payload_length;
  252         le64enc(crp.crp_iv, nonce);
  253         crp.crp_cipher_key = key;
  254         crp.crp_callback = crypto_callback;
  255         ret = crypto_dispatch(&crp);
  256         crypto_destroyreq(&crp);
  257         if (ret)
  258                 return (ret);
  259         m_adj(m, -POLY1305_HASH_LEN);
  260         return (0);
  261 }
  262 
  263 int
  264 crypto_init(void)
  265 {
  266         struct crypto_session_params csp = {
  267                 .csp_mode = CSP_MODE_AEAD,
  268                 .csp_ivlen = sizeof(uint64_t),
  269                 .csp_cipher_alg = CRYPTO_CHACHA20_POLY1305,
  270                 .csp_cipher_klen = CHACHA20POLY1305_KEY_SIZE,
  271                 .csp_flags = CSP_F_SEPARATE_AAD | CSP_F_SEPARATE_OUTPUT
  272         };
  273         int ret = crypto_newsession(&chacha20_poly1305_sid, &csp, CRYPTOCAP_F_SOFTWARE);
  274         if (ret != 0)
  275                 return (ret);
  276         return (0);
  277 }
  278 
  279 void
  280 crypto_deinit(void)
  281 {
  282         crypto_freesession(chacha20_poly1305_sid);
  283 }

Cache object: 1aabcbdd598e9cec2104be88b067de86

[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.

FreeBSD/Linux Kernel Cross Reference sys/dev/wg/wg_crypto.c

FreeBSD/Linux Kernel Cross Reference
sys/dev/wg/wg_crypto.c