xref: /illumos-gate/usr/src/uts/common/sys/cryptmod.h (revision 2d6eb4a5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  *
26  * cryptmod.h
27  * STREAMS based crypto module definitions.
28  *
29  * This is a Sun-private and undocumented interface.
30  */
31 
32 #ifndef _SYS_CRYPTMOD_H
33 #define	_SYS_CRYPTMOD_H
34 
35 #include <sys/types.h>
36 #include <sys/types32.h>
37 #ifdef _KERNEL
38 #include <sys/crypto/api.h>
39 #endif /* _KERNEL */
40 
41 #ifdef	__cplusplus
42 extern "C" {
43 #endif
44 
45 
46 /*
47  * IOCTLs.
48  */
49 #define	CRYPTIOC (('C' << 24) | ('R' << 16) | ('Y' << 8) | 0x00)
50 
51 #define	CRYPTIOCSETUP		(CRYPTIOC | 0x01)
52 #define	CRYPTIOCSTOP		(CRYPTIOC | 0x02)
53 #define	CRYPTIOCSTARTENC	(CRYPTIOC | 0x03)
54 #define	CRYPTIOCSTARTDEC	(CRYPTIOC | 0x04)
55 
56 #define	CRYPTPASSTHRU		(CRYPTIOC | 0x80)
57 
58 /*
59  * Crypto method definitions, to be used with the CRIOCSETUP ioctl.
60  */
61 #define	CRYPT_METHOD_NONE		0
62 #define	CRYPT_METHOD_DES_CFB		101
63 #define	CRYPT_METHOD_DES_CBC_NULL	102
64 #define	CRYPT_METHOD_DES_CBC_MD5	103
65 #define	CRYPT_METHOD_DES_CBC_CRC	104
66 #define	CRYPT_METHOD_DES3_CBC_SHA1	105
67 #define	CRYPT_METHOD_ARCFOUR_HMAC_MD5	106
68 #define	CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP	107
69 #define	CRYPT_METHOD_AES128		108
70 #define	CRYPT_METHOD_AES256		109
71 
72 #define	CR_METHOD_OK(m) ((m) == CRYPT_METHOD_NONE || \
73 			((m) >= CRYPT_METHOD_DES_CFB && \
74 			(m) <= CRYPT_METHOD_AES256))
75 
76 #define	IS_RC4_METHOD(m) ((m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5 || \
77 			(m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP)
78 
79 #define	IS_AES_METHOD(m) ((m) == CRYPT_METHOD_AES128 || \
80 			(m) == CRYPT_METHOD_AES256)
81 
82 /*
83  * Direction mask values, also to be used with the CRIOCSETUP ioctl.
84  */
85 #define	CRYPT_ENCRYPT  0x01
86 #define	CRYPT_DECRYPT  0x02
87 
88 #define	CR_DIRECTION_OK(d) ((d) & (CRYPT_ENCRYPT | CRYPT_DECRYPT))
89 
90 /*
91  * Define constants for the 'ivec_usage' fields.
92  */
93 #define	IVEC_NEVER 0x00
94 #define	IVEC_REUSE 0x01
95 #define	IVEC_ONETIME 0x02
96 
97 #define	CR_IVUSAGE_OK(iv)	\
98 	((iv) == IVEC_NEVER || (iv) == IVEC_REUSE || (iv) == IVEC_ONETIME)
99 
100 #define	CRYPT_SHA1_BLOCKSIZE 64
101 #define	CRYPT_SHA1_HASHSIZE 20
102 #define	CRYPT_DES3_KEYBYTES 21
103 #define	CRYPT_DES3_KEYLENGTH 24
104 #define	CRYPT_ARCFOUR_KEYBYTES 16
105 #define	CRYPT_ARCFOUR_KEYLENGTH 16
106 #define	CRYPT_AES128_KEYBYTES 16
107 #define	CRYPT_AES128_KEYLENGTH 16
108 #define	CRYPT_AES256_KEYBYTES 32
109 #define	CRYPT_AES256_KEYLENGTH 32
110 
111 #define	AES_TRUNCATED_HMAC_LEN 12
112 
113 /*
114  * Max size of initialization vector and key.
115  * 256 bytes = 2048 bits.
116  */
117 #define	CRYPT_MAX_KEYLEN 256
118 #define	CRYPT_MAX_IVLEN  256
119 
120 typedef uint8_t	crkeylen_t;
121 typedef uint8_t	crivlen_t;
122 
123 typedef uchar_t crmeth_t;
124 typedef uchar_t cropt_t;
125 typedef uchar_t crdir_t;
126 typedef uchar_t crivuse_t;
127 
128 /*
129  * Define values for the option mask field.
130  * These can be extended to alter the behavior
131  * of the module.  For example, when used by kerberized
132  * Unix r commands (rlogind, rshd), all msgs must be
133  * prepended with 4 bytes of clear text data that represent
134  * the 'length' of the cipher text that follows.
135  */
136 #define	CRYPTOPT_NONE		0x00
137 #define	CRYPTOPT_RCMD_MODE_V1	0x01
138 #define	CRYPTOPT_RCMD_MODE_V2	0x02
139 
140 #define	ANY_RCMD_MODE(m) ((m) & (CRYPTOPT_RCMD_MODE_V1 |\
141 			CRYPTOPT_RCMD_MODE_V2))
142 
143 /* Define the size of the length field used in 'rcmd' mode */
144 #define	RCMD_LEN_SZ	sizeof (uint32_t)
145 
146 #define	CR_OPTIONS_OK(opt) ((opt) == CRYPTOPT_NONE || \
147 			ANY_RCMD_MODE(opt))
148 /*
149  * Structure used by userland apps to pass data into crypto module
150  * with the CRIOCSETUP iotcl.
151  */
152 struct cr_info_t {
153 	uchar_t		key[CRYPT_MAX_KEYLEN];
154 	uchar_t		ivec[CRYPT_MAX_IVLEN];
155 	crkeylen_t	keylen;
156 	crivlen_t	iveclen;
157 	crivuse_t	ivec_usage;
158 	crdir_t		direction_mask;
159 	crmeth_t	crypto_method;
160 	cropt_t		option_mask;
161 };
162 
163 #if defined(_KERNEL)
164 
165 #define	RCMDV1_USAGE	1026
166 #define	ARCFOUR_DECRYPT_USAGE 1032
167 #define	ARCFOUR_ENCRYPT_USAGE 1028
168 #define	AES_ENCRYPT_USAGE 1028
169 #define	AES_DECRYPT_USAGE 1032
170 
171 #define	DEFAULT_DES_BLOCKLEN 8
172 #define	DEFAULT_AES_BLOCKLEN 16
173 #define	ARCFOUR_EXP_SALT "fortybits"
174 
175 struct cipher_data_t {
176 	char		*key;
177 	char		*block;
178 	char		*ivec;
179 	char		*saveblock;
180 	crypto_mech_type_t mech_type;
181 	crypto_key_t    *ckey;		/* initial encryption key */
182 	crypto_key_t    d_encr_key;	/* derived encr key */
183 	crypto_key_t    d_hmac_key;	/* derived hmac key */
184 	crypto_ctx_template_t enc_tmpl;
185 	crypto_ctx_template_t hmac_tmpl;
186 	crypto_context_t ctx;
187 	size_t		bytes;
188 	crkeylen_t	blocklen;
189 	crkeylen_t	keylen;
190 	crkeylen_t	ivlen;
191 	crivuse_t	ivec_usage;
192 	crmeth_t	method;
193 	cropt_t		option_mask;
194 };
195 
196 struct rcmd_state_t {
197 	size_t	pt_len;    /* Plain text length */
198 	size_t	cd_len;    /* Cipher Data length */
199 	size_t	cd_rcvd;   /* Cipher Data bytes received so far */
200 	uint32_t next_len;
201 	mblk_t  *c_msg;	/* mblk that will contain the new data */
202 };
203 
204 /* Values for "ready" mask. */
205 #define	CRYPT_WRITE_READY 0x01
206 #define	CRYPT_READ_READY  0x02
207 
208 /*
209  * State information for the streams module.
210  */
211 struct tmodinfo {
212 	struct cipher_data_t	enc_data;
213 	struct cipher_data_t	dec_data;
214 	struct rcmd_state_t	rcmd_state;
215 	uchar_t			ready;
216 };
217 
218 #endif /* _KERNEL */
219 
220 #ifdef	__cplusplus
221 }
222 #endif
223 
224 #endif	/* _SYS_CRYPTMOD_H */
225