xref: /illumos-gate/usr/src/common/crypto/modes/modes.h (revision 2f9f8a9b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
26  * Copyright 2019 Joyent, Inc.
27  */
28 
29 #ifndef	_COMMON_CRYPTO_MODES_H
30 #define	_COMMON_CRYPTO_MODES_H
31 
32 #ifdef	__cplusplus
33 extern "C" {
34 #endif
35 
36 #include <sys/strsun.h>
37 #include <sys/systm.h>
38 #include <sys/sysmacros.h>
39 #include <sys/types.h>
40 #include <sys/errno.h>
41 #include <sys/rwlock.h>
42 #include <sys/kmem.h>
43 #include <sys/crypto/common.h>
44 #include <sys/crypto/impl.h>
45 
46 #define	ECB_MODE			0x00000002
47 #define	CBC_MODE			0x00000004
48 #define	CTR_MODE			0x00000008
49 #define	CCM_MODE			0x00000010
50 #define	GCM_MODE			0x00000020
51 #define	GMAC_MODE			0x00000040
52 #define	CMAC_MODE			0x00000080
53 
54 /* Private flag for pkcs11_softtoken */
55 #define	P11_DECRYPTED			0x80000000
56 
57 /*
58  * cc_keysched:		Pointer to key schedule.
59  *
60  * cc_keysched_len:	Length of the key schedule.
61  *
62  * cc_remainder:	This is for residual data, i.e. data that can't
63  *			be processed because there are too few bytes.
64  *			Must wait until more data arrives.
65  *
66  * cc_remainder_len:	Number of bytes in cc_remainder.
67  *
68  * cc_iv:		Scratch buffer that sometimes contains the IV.
69  *
70  * cc_lastp:		Pointer to previous block of ciphertext.
71  *
72  * cc_copy_to:		Pointer to where encrypted residual data needs
73  *			to be copied.
74  *
75  * cc_flags:		PROVIDER_OWNS_KEY_SCHEDULE
76  *			When a context is freed, it is necessary
77  *			to know whether the key schedule was allocated
78  *			by the caller, or internally, e.g. an init routine.
79  *			If allocated by the latter, then it needs to be freed.
80  *
81  *			ECB_MODE, CBC_MODE, CTR_MODE, or CCM_MODE
82  */
83 struct common_ctx {
84 	void *cc_keysched;
85 	size_t cc_keysched_len;
86 	uint64_t cc_iv[2];
87 	uint64_t cc_remainder[2];
88 	size_t cc_remainder_len;
89 	uint8_t *cc_lastp;
90 	uint8_t *cc_copy_to;
91 	uint32_t cc_flags;
92 };
93 
94 typedef struct common_ctx common_ctx_t;
95 
96 typedef struct ecb_ctx {
97 	struct common_ctx ecb_common;
98 	uint64_t ecb_lastblock[2];
99 } ecb_ctx_t;
100 
101 #define	ecb_keysched		ecb_common.cc_keysched
102 #define	ecb_keysched_len	ecb_common.cc_keysched_len
103 #define	ecb_iv			ecb_common.cc_iv
104 #define	ecb_remainder		ecb_common.cc_remainder
105 #define	ecb_remainder_len	ecb_common.cc_remainder_len
106 #define	ecb_lastp		ecb_common.cc_lastp
107 #define	ecb_copy_to		ecb_common.cc_copy_to
108 #define	ecb_flags		ecb_common.cc_flags
109 
110 /*
111  * max_remain			max bytes in cbc_remainder
112  */
113 typedef struct cbc_ctx {
114 	struct common_ctx cbc_common;
115 	uint64_t cbc_lastblock[2];
116 	size_t max_remain;
117 } cbc_ctx_t;
118 
119 #define	cbc_keysched		cbc_common.cc_keysched
120 #define	cbc_keysched_len	cbc_common.cc_keysched_len
121 #define	cbc_iv			cbc_common.cc_iv
122 #define	cbc_remainder		cbc_common.cc_remainder
123 #define	cbc_remainder_len	cbc_common.cc_remainder_len
124 #define	cbc_lastp		cbc_common.cc_lastp
125 #define	cbc_copy_to		cbc_common.cc_copy_to
126 #define	cbc_flags		cbc_common.cc_flags
127 
128 /*
129  * ctr_lower_mask		Bit-mask for lower 8 bytes of counter block.
130  * ctr_upper_mask		Bit-mask for upper 8 bytes of counter block.
131  */
132 typedef struct ctr_ctx {
133 	struct common_ctx ctr_common;
134 	uint64_t ctr_lower_mask;
135 	uint64_t ctr_upper_mask;
136 	size_t ctr_offset;
137 	uint32_t ctr_keystream[4];
138 } ctr_ctx_t;
139 
140 /*
141  * ctr_cb			Counter block.
142  */
143 #define	ctr_keysched		ctr_common.cc_keysched
144 #define	ctr_keysched_len	ctr_common.cc_keysched_len
145 #define	ctr_cb			ctr_common.cc_iv
146 #define	ctr_remainder		ctr_common.cc_remainder
147 #define	ctr_remainder_len	ctr_common.cc_remainder_len
148 #define	ctr_lastp		ctr_common.cc_lastp
149 #define	ctr_copy_to		ctr_common.cc_copy_to
150 #define	ctr_flags		ctr_common.cc_flags
151 
152 /*
153  *
154  * ccm_mac_len:		Stores length of the MAC in CCM mode.
155  * ccm_mac_buf:		Stores the intermediate value for MAC in CCM encrypt.
156  *			In CCM decrypt, stores the input MAC value.
157  * ccm_data_len:	Length of the plaintext for CCM mode encrypt, or
158  *			length of the ciphertext for CCM mode decrypt.
159  * ccm_processed_data_len:
160  *			Length of processed plaintext in CCM mode encrypt,
161  *			or length of processed ciphertext for CCM mode decrypt.
162  * ccm_processed_mac_len:
163  *			Length of MAC data accumulated in CCM mode decrypt.
164  *
165  * ccm_pt_buf:		Only used in CCM mode decrypt.  It stores the
166  *			decrypted plaintext to be returned when
167  *			MAC verification succeeds in decrypt_final.
168  *			Memory for this should be allocated in the AES module.
169  *
170  */
171 typedef struct ccm_ctx {
172 	struct common_ctx ccm_common;
173 	uint32_t ccm_tmp[4];
174 	size_t ccm_mac_len;
175 	uint64_t ccm_mac_buf[2];
176 	size_t ccm_data_len;
177 	size_t ccm_processed_data_len;
178 	size_t ccm_processed_mac_len;
179 	uint8_t *ccm_pt_buf;
180 	uint64_t ccm_mac_input_buf[2];
181 	uint64_t ccm_counter_mask;
182 } ccm_ctx_t;
183 
184 #define	ccm_keysched		ccm_common.cc_keysched
185 #define	ccm_keysched_len	ccm_common.cc_keysched_len
186 #define	ccm_cb			ccm_common.cc_iv
187 #define	ccm_remainder		ccm_common.cc_remainder
188 #define	ccm_remainder_len	ccm_common.cc_remainder_len
189 #define	ccm_lastp		ccm_common.cc_lastp
190 #define	ccm_copy_to		ccm_common.cc_copy_to
191 #define	ccm_flags		ccm_common.cc_flags
192 
193 /*
194  * gcm_tag_len:		Length of authentication tag.
195  *
196  * gcm_ghash:		Stores output from the GHASH function.
197  *
198  * gcm_processed_data_len:
199  *			Length of processed plaintext (encrypt) or
200  *			length of processed ciphertext (decrypt).
201  *
202  * gcm_pt_buf:		Stores the decrypted plaintext returned by
203  *			decrypt_final when the computed authentication
204  *			tag matches the	user supplied tag.
205  *
206  * gcm_pt_buf_len:	Length of the plaintext buffer.
207  *
208  * gcm_H:		Subkey.
209  *
210  * gcm_J0:		Pre-counter block generated from the IV.
211  *
212  * gcm_len_a_len_c:	64-bit representations of the bit lengths of
213  *			AAD and ciphertext.
214  *
215  * gcm_kmflag:		Current value of kmflag. Used only for allocating
216  *			the plaintext buffer during decryption.
217  */
218 typedef struct gcm_ctx {
219 	struct common_ctx gcm_common;
220 	size_t gcm_tag_len;
221 	size_t gcm_processed_data_len;
222 	size_t gcm_pt_buf_len;
223 	uint32_t gcm_tmp[4];
224 	uint64_t gcm_ghash[2];
225 	uint64_t gcm_H[2];
226 	uint64_t gcm_J0[2];
227 	uint64_t gcm_len_a_len_c[2];
228 	uint8_t *gcm_pt_buf;
229 	int gcm_kmflag;
230 } gcm_ctx_t;
231 
232 #define	gcm_keysched		gcm_common.cc_keysched
233 #define	gcm_keysched_len	gcm_common.cc_keysched_len
234 #define	gcm_cb			gcm_common.cc_iv
235 #define	gcm_remainder		gcm_common.cc_remainder
236 #define	gcm_remainder_len	gcm_common.cc_remainder_len
237 #define	gcm_lastp		gcm_common.cc_lastp
238 #define	gcm_copy_to		gcm_common.cc_copy_to
239 #define	gcm_flags		gcm_common.cc_flags
240 
241 #define	AES_GMAC_IV_LEN		12
242 #define	AES_GMAC_TAG_BITS	128
243 
244 typedef struct aes_ctx {
245 	union {
246 		ecb_ctx_t acu_ecb;
247 		cbc_ctx_t acu_cbc;
248 		ctr_ctx_t acu_ctr;
249 		ccm_ctx_t acu_ccm;
250 		gcm_ctx_t acu_gcm;
251 	} acu;
252 } aes_ctx_t;
253 
254 #define	ac_flags		acu.acu_ecb.ecb_common.cc_flags
255 #define	ac_remainder_len	acu.acu_ecb.ecb_common.cc_remainder_len
256 #define	ac_remainder		acu.acu_ecb.ecb_common.cc_remainder
257 #define	ac_keysched		acu.acu_ecb.ecb_common.cc_keysched
258 #define	ac_keysched_len		acu.acu_ecb.ecb_common.cc_keysched_len
259 #define	ac_iv			acu.acu_ecb.ecb_common.cc_iv
260 #define	ac_lastp		acu.acu_ecb.ecb_common.cc_lastp
261 #define	ac_pt_buf		acu.acu_ccm.ccm_pt_buf
262 #define	ac_mac_len		acu.acu_ccm.ccm_mac_len
263 #define	ac_data_len		acu.acu_ccm.ccm_data_len
264 #define	ac_processed_mac_len	acu.acu_ccm.ccm_processed_mac_len
265 #define	ac_processed_data_len	acu.acu_ccm.ccm_processed_data_len
266 #define	ac_tag_len		acu.acu_gcm.gcm_tag_len
267 
268 typedef struct blowfish_ctx {
269 	union {
270 		ecb_ctx_t bcu_ecb;
271 		cbc_ctx_t bcu_cbc;
272 	} bcu;
273 } blowfish_ctx_t;
274 
275 #define	bc_flags		bcu.bcu_ecb.ecb_common.cc_flags
276 #define	bc_remainder_len	bcu.bcu_ecb.ecb_common.cc_remainder_len
277 #define	bc_keysched		bcu.bcu_ecb.ecb_common.cc_keysched
278 #define	bc_keysched_len		bcu.bcu_ecb.ecb_common.cc_keysched_len
279 #define	bc_iv			bcu.bcu_ecb.ecb_common.cc_iv
280 #define	bc_lastp		bcu.bcu_ecb.ecb_common.cc_lastp
281 
282 typedef struct des_ctx {
283 	union {
284 		ecb_ctx_t dcu_ecb;
285 		cbc_ctx_t dcu_cbc;
286 	} dcu;
287 } des_ctx_t;
288 
289 #define	dc_flags		dcu.dcu_ecb.ecb_common.cc_flags
290 #define	dc_remainder_len	dcu.dcu_ecb.ecb_common.cc_remainder_len
291 #define	dc_keysched		dcu.dcu_ecb.ecb_common.cc_keysched
292 #define	dc_keysched_len		dcu.dcu_ecb.ecb_common.cc_keysched_len
293 #define	dc_iv			dcu.dcu_ecb.ecb_common.cc_iv
294 #define	dc_lastp		dcu.dcu_ecb.ecb_common.cc_lastp
295 
296 extern int ecb_cipher_contiguous_blocks(ecb_ctx_t *, char *, size_t,
297     crypto_data_t *, size_t, int (*cipher)(const void *, const uint8_t *,
298     uint8_t *));
299 
300 extern int cbc_encrypt_contiguous_blocks(cbc_ctx_t *, char *, size_t,
301     crypto_data_t *, size_t,
302     int (*encrypt)(const void *, const uint8_t *, uint8_t *),
303     void (*copy_block)(uint8_t *, uint8_t *),
304     void (*xor_block)(uint8_t *, uint8_t *));
305 
306 extern int cbc_decrypt_contiguous_blocks(cbc_ctx_t *, char *, size_t,
307     crypto_data_t *, size_t,
308     int (*decrypt)(const void *, const uint8_t *, uint8_t *),
309     void (*copy_block)(uint8_t *, uint8_t *),
310     void (*xor_block)(uint8_t *, uint8_t *));
311 
312 extern int ctr_mode_contiguous_blocks(ctr_ctx_t *, char *, size_t,
313     crypto_data_t *, size_t,
314     int (*cipher)(const void *, const uint8_t *, uint8_t *));
315 
316 extern int ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *, char *, size_t,
317     crypto_data_t *, size_t,
318     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
319     void (*copy_block)(uint8_t *, uint8_t *),
320     void (*xor_block)(uint8_t *, uint8_t *));
321 
322 extern int ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *, char *, size_t,
323     crypto_data_t *, size_t,
324     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
325     void (*copy_block)(uint8_t *, uint8_t *),
326     void (*xor_block)(uint8_t *, uint8_t *));
327 
328 extern int gcm_mode_encrypt_contiguous_blocks(gcm_ctx_t *, char *, size_t,
329     crypto_data_t *, size_t,
330     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
331     void (*copy_block)(uint8_t *, uint8_t *),
332     void (*xor_block)(uint8_t *, uint8_t *));
333 
334 extern int gcm_mode_decrypt_contiguous_blocks(gcm_ctx_t *, char *, size_t,
335     crypto_data_t *, size_t,
336     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
337     void (*copy_block)(uint8_t *, uint8_t *),
338     void (*xor_block)(uint8_t *, uint8_t *));
339 
340 int ccm_encrypt_final(ccm_ctx_t *, crypto_data_t *, size_t,
341     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
342     void (*xor_block)(uint8_t *, uint8_t *));
343 
344 int gcm_encrypt_final(gcm_ctx_t *, crypto_data_t *, size_t,
345     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
346     void (*copy_block)(uint8_t *, uint8_t *),
347     void (*xor_block)(uint8_t *, uint8_t *));
348 
349 extern int ccm_decrypt_final(ccm_ctx_t *, crypto_data_t *, size_t,
350     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
351     void (*copy_block)(uint8_t *, uint8_t *),
352     void (*xor_block)(uint8_t *, uint8_t *));
353 
354 extern int gcm_decrypt_final(gcm_ctx_t *, crypto_data_t *, size_t,
355     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
356     void (*xor_block)(uint8_t *, uint8_t *));
357 
358 extern int cmac_mode_final(cbc_ctx_t *, crypto_data_t *,
359     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
360     void (*xor_block)(uint8_t *, uint8_t *));
361 
362 extern int cbc_init_ctx(cbc_ctx_t *, char *, size_t, size_t,
363     void (*copy_block)(uint8_t *, uint64_t *));
364 
365 extern int cmac_init_ctx(cbc_ctx_t *, size_t);
366 
367 extern int ctr_init_ctx(ctr_ctx_t *, ulong_t, uint8_t *,
368     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
369     void (*copy_block)(uint8_t *, uint8_t *));
370 
371 extern int ccm_init_ctx(ccm_ctx_t *, char *, int, boolean_t, size_t,
372     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
373     void (*xor_block)(uint8_t *, uint8_t *));
374 
375 extern int gcm_init_ctx(gcm_ctx_t *, char *, size_t,
376     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
377     void (*copy_block)(uint8_t *, uint8_t *),
378     void (*xor_block)(uint8_t *, uint8_t *));
379 
380 extern int gmac_init_ctx(gcm_ctx_t *, char *, size_t,
381     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
382     void (*copy_block)(uint8_t *, uint8_t *),
383     void (*xor_block)(uint8_t *, uint8_t *));
384 
385 extern void calculate_ccm_mac(ccm_ctx_t *, uint8_t *,
386     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *));
387 
388 extern void gcm_mul(uint64_t *, uint64_t *, uint64_t *);
389 
390 extern void crypto_init_ptrs(crypto_data_t *, void **, offset_t *);
391 extern void crypto_get_ptrs(crypto_data_t *, void **, offset_t *,
392     uint8_t **, size_t *, uint8_t **, size_t);
393 
394 extern void *ecb_alloc_ctx(int);
395 extern void *cbc_alloc_ctx(int);
396 extern void *cmac_alloc_ctx(int);
397 extern void *ctr_alloc_ctx(int);
398 extern void *ccm_alloc_ctx(int);
399 extern void *gcm_alloc_ctx(int);
400 extern void *gmac_alloc_ctx(int);
401 extern void crypto_free_mode_ctx(void *);
402 extern void gcm_set_kmflag(gcm_ctx_t *, int);
403 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int);
404 
405 #ifdef	__cplusplus
406 }
407 #endif
408 
409 #endif	/* _COMMON_CRYPTO_MODES_H */
410