1 // SPDX-License-Identifier: GPL-2.0 1
2 /*
3 * Adiantum length-preserving encryption mode
4 *
5 * Copyright 2018 Google LLC
6 */
7
8 /*
9 * Adiantum is a tweakable, length-preserving
10 * and secure disk encryption, especially on C
11 * instructions. Adiantum encrypts each secto
12 * cipher, two passes of an ε-almost-∆-univ
13 * NH and Poly1305, and an invocation of the A
14 * 16-byte block. See the paper for details:
15 *
16 * Adiantum: length-preserving encryption
17 * (https://eprint.iacr.org/2018/720.pdf)
18 *
19 * For flexibility, this implementation also a
20 *
21 * - Stream cipher: XChaCha12 or XChaCha2
22 * - Block cipher: any with a 128-bit blo
23 *
24 * This implementation doesn't currently allow
25 * HPolyC is not supported. This is because A
26 * but still provably as secure, and also the
27 * formally defined to take two inputs (tweak,
28 * to wrap with the crypto_shash API. Rather,
29 * here. Nevertheless, if needed in the futur
30 * functions could be added here.
31 */
32
33 #include <crypto/b128ops.h>
34 #include <crypto/chacha.h>
35 #include <crypto/internal/cipher.h>
36 #include <crypto/internal/hash.h>
37 #include <crypto/internal/poly1305.h>
38 #include <crypto/internal/skcipher.h>
39 #include <crypto/nhpoly1305.h>
40 #include <crypto/scatterwalk.h>
41 #include <linux/module.h>
42
43 /*
44 * Size of right-hand part of input data, in b
45 * cipher's block size and the hash function's
46 */
47 #define BLOCKCIPHER_BLOCK_SIZE 16
48
49 /* Size of the block cipher key (K_E) in bytes
50 #define BLOCKCIPHER_KEY_SIZE 32
51
52 /* Size of the hash key (K_H) in bytes */
53 #define HASH_KEY_SIZE (POLY1305_BLOC
54
55 /*
56 * The specification allows variable-length tw
57 * currently only allows algorithms to support
58 * tweak length for Adiantum is 16, since that
59 * the best performance. But longer tweaks ar
60 * needing to derive per-file keys. So instea
61 */
62 #define TWEAK_SIZE 32
63
64 struct adiantum_instance_ctx {
65 struct crypto_skcipher_spawn streamcip
66 struct crypto_cipher_spawn blockcipher
67 struct crypto_shash_spawn hash_spawn;
68 };
69
70 struct adiantum_tfm_ctx {
71 struct crypto_skcipher *streamcipher;
72 struct crypto_cipher *blockcipher;
73 struct crypto_shash *hash;
74 struct poly1305_core_key header_hash_k
75 };
76
77 struct adiantum_request_ctx {
78
79 /*
80 * Buffer for right-hand part of data,
81 *
82 * P_L => P_M => C_M => C_R when en
83 * C_R => C_M => P_M => P_L when de
84 *
85 * Also used to build the IV for the s
86 */
87 union {
88 u8 bytes[XCHACHA_IV_SIZE];
89 __le32 words[XCHACHA_IV_SIZE /
90 le128 bignum; /* interpret a
91 } rbuf;
92
93 bool enc; /* true if encrypting, false
94
95 /*
96 * The result of the Poly1305 ε-∆U
97 * (bulk length, tweak)
98 */
99 le128 header_hash;
100
101 /* Sub-requests, must be last */
102 union {
103 struct shash_desc hash_desc;
104 struct skcipher_request stream
105 } u;
106 };
107
108 /*
109 * Given the XChaCha stream key K_S, derive th
110 * hash key K_H as follows:
111 *
112 * K_E || K_H || ... = XChaCha(key=K_S, no
113 *
114 * Note that this denotes using bits from the
115 * get indirectly by encrypting a buffer conta
116 */
117 static int adiantum_setkey(struct crypto_skcip
118 unsigned int keylen
119 {
120 struct adiantum_tfm_ctx *tctx = crypto
121 struct {
122 u8 iv[XCHACHA_IV_SIZE];
123 u8 derived_keys[BLOCKCIPHER_KE
124 struct scatterlist sg;
125 struct crypto_wait wait;
126 struct skcipher_request req; /
127 } *data;
128 u8 *keyp;
129 int err;
130
131 /* Set the stream cipher key (K_S) */
132 crypto_skcipher_clear_flags(tctx->stre
133 crypto_skcipher_set_flags(tctx->stream
134 crypto_skcip
135 CRYPTO_TFM_R
136 err = crypto_skcipher_setkey(tctx->str
137 if (err)
138 return err;
139
140 /* Derive the subkeys */
141 data = kzalloc(sizeof(*data) +
142 crypto_skcipher_reqsize
143 if (!data)
144 return -ENOMEM;
145 data->iv[0] = 1;
146 sg_init_one(&data->sg, data->derived_k
147 crypto_init_wait(&data->wait);
148 skcipher_request_set_tfm(&data->req, t
149 skcipher_request_set_callback(&data->r
150
151 crypto_r
152 skcipher_request_set_crypt(&data->req,
153 sizeof(data
154 err = crypto_wait_req(crypto_skcipher_
155 if (err)
156 goto out;
157 keyp = data->derived_keys;
158
159 /* Set the block cipher key (K_E) */
160 crypto_cipher_clear_flags(tctx->blockc
161 crypto_cipher_set_flags(tctx->blockcip
162 crypto_skciphe
163 CRYPTO_TFM_REQ
164 err = crypto_cipher_setkey(tctx->block
165 BLOCKCIPHER
166 if (err)
167 goto out;
168 keyp += BLOCKCIPHER_KEY_SIZE;
169
170 /* Set the hash key (K_H) */
171 poly1305_core_setkey(&tctx->header_has
172 keyp += POLY1305_BLOCK_SIZE;
173
174 crypto_shash_clear_flags(tctx->hash, C
175 crypto_shash_set_flags(tctx->hash, cry
176 CRY
177 err = crypto_shash_setkey(tctx->hash,
178 keyp += NHPOLY1305_KEY_SIZE;
179 WARN_ON(keyp != &data->derived_keys[AR
180 out:
181 kfree_sensitive(data);
182 return err;
183 }
184
185 /* Addition in Z/(2^{128}Z) */
186 static inline void le128_add(le128 *r, const l
187 {
188 u64 x = le64_to_cpu(v1->b);
189 u64 y = le64_to_cpu(v2->b);
190
191 r->b = cpu_to_le64(x + y);
192 r->a = cpu_to_le64(le64_to_cpu(v1->a)
193 (x + y < x));
194 }
195
196 /* Subtraction in Z/(2^{128}Z) */
197 static inline void le128_sub(le128 *r, const l
198 {
199 u64 x = le64_to_cpu(v1->b);
200 u64 y = le64_to_cpu(v2->b);
201
202 r->b = cpu_to_le64(x - y);
203 r->a = cpu_to_le64(le64_to_cpu(v1->a)
204 (x - y > x));
205 }
206
207 /*
208 * Apply the Poly1305 ε-∆U hash function to
209 * result to rctx->header_hash. This is the c
210 *
211 * H_T ← Poly1305_{K_T}(bin_{128}(|L|)
212 *
213 * from the procedure in section 6.4 of the Ad
214 * is reused in both the first and second hash
215 * to the result of an independently keyed ε-
216 * inputs only) taken over the left-hand part
217 * give the overall Adiantum hash of the (twea
218 */
219 static void adiantum_hash_header(struct skciph
220 {
221 struct crypto_skcipher *tfm = crypto_s
222 const struct adiantum_tfm_ctx *tctx =
223 struct adiantum_request_ctx *rctx = sk
224 const unsigned int bulk_len = req->cry
225 struct {
226 __le64 message_bits;
227 __le64 padding;
228 } header = {
229 .message_bits = cpu_to_le64((u
230 };
231 struct poly1305_state state;
232
233 poly1305_core_init(&state);
234
235 BUILD_BUG_ON(sizeof(header) % POLY1305
236 poly1305_core_blocks(&state, &tctx->he
237 &header, sizeof(h
238
239 BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLO
240 poly1305_core_blocks(&state, &tctx->he
241 TWEAK_SIZE / POLY
242
243 poly1305_core_emit(&state, NULL, &rctx
244 }
245
246 /* Hash the left-hand part (the "bulk") of the
247 static int adiantum_hash_message(struct skciph
248 struct scatte
249 le128 *digest
250 {
251 struct adiantum_request_ctx *rctx = sk
252 const unsigned int bulk_len = req->cry
253 struct shash_desc *hash_desc = &rctx->
254 struct sg_mapping_iter miter;
255 unsigned int i, n;
256 int err;
257
258 err = crypto_shash_init(hash_desc);
259 if (err)
260 return err;
261
262 sg_miter_start(&miter, sgl, nents, SG_
263 for (i = 0; i < bulk_len; i += n) {
264 sg_miter_next(&miter);
265 n = min_t(unsigned int, miter.
266 err = crypto_shash_update(hash
267 if (err)
268 break;
269 }
270 sg_miter_stop(&miter);
271 if (err)
272 return err;
273
274 return crypto_shash_final(hash_desc, (
275 }
276
277 /* Continue Adiantum encryption/decryption aft
278 static int adiantum_finish(struct skcipher_req
279 {
280 struct crypto_skcipher *tfm = crypto_s
281 const struct adiantum_tfm_ctx *tctx =
282 struct adiantum_request_ctx *rctx = sk
283 const unsigned int bulk_len = req->cry
284 struct scatterlist *dst = req->dst;
285 const unsigned int dst_nents = sg_nent
286 le128 digest;
287 int err;
288
289 /* If decrypting, decrypt C_M with the
290 if (!rctx->enc)
291 crypto_cipher_decrypt_one(tctx
292 rctx
293
294 /*
295 * Second hash step
296 * enc: C_R = C_M - H_{K_H}(T, C_
297 * dec: P_R = P_M - H_{K_H}(T, P_
298 */
299 rctx->u.hash_desc.tfm = tctx->hash;
300 le128_sub(&rctx->rbuf.bignum, &rctx->r
301 if (dst_nents == 1 && dst->offset + re
302 /* Fast path for single-page d
303 struct page *page = sg_page(ds
304 void *virt = kmap_local_page(p
305
306 err = crypto_shash_digest(&rct
307 (u8
308 if (err) {
309 kunmap_local(virt);
310 return err;
311 }
312 le128_sub(&rctx->rbuf.bignum,
313 memcpy(virt + bulk_len, &rctx-
314 flush_dcache_page(page);
315 kunmap_local(virt);
316 } else {
317 /* Slow path that works for an
318 err = adiantum_hash_message(re
319 if (err)
320 return err;
321 le128_sub(&rctx->rbuf.bignum,
322 scatterwalk_map_and_copy(&rctx
323 bulk_
324 }
325 return 0;
326 }
327
328 static void adiantum_streamcipher_done(void *d
329 {
330 struct skcipher_request *req = data;
331
332 if (!err)
333 err = adiantum_finish(req);
334
335 skcipher_request_complete(req, err);
336 }
337
338 static int adiantum_crypt(struct skcipher_requ
339 {
340 struct crypto_skcipher *tfm = crypto_s
341 const struct adiantum_tfm_ctx *tctx =
342 struct adiantum_request_ctx *rctx = sk
343 const unsigned int bulk_len = req->cry
344 struct scatterlist *src = req->src;
345 const unsigned int src_nents = sg_nent
346 unsigned int stream_len;
347 le128 digest;
348 int err;
349
350 if (req->cryptlen < BLOCKCIPHER_BLOCK_
351 return -EINVAL;
352
353 rctx->enc = enc;
354
355 /*
356 * First hash step
357 * enc: P_M = P_R + H_{K_H}(T, P_
358 * dec: C_M = C_R + H_{K_H}(T, C_
359 */
360 adiantum_hash_header(req);
361 rctx->u.hash_desc.tfm = tctx->hash;
362 if (src_nents == 1 && src->offset + re
363 /* Fast path for single-page s
364 void *virt = kmap_local_page(s
365
366 err = crypto_shash_digest(&rct
367 (u8
368 memcpy(&rctx->rbuf.bignum, vir
369 kunmap_local(virt);
370 } else {
371 /* Slow path that works for an
372 err = adiantum_hash_message(re
373 scatterwalk_map_and_copy(&rctx
374 bulk_
375 }
376 if (err)
377 return err;
378 le128_add(&rctx->rbuf.bignum, &rctx->r
379 le128_add(&rctx->rbuf.bignum, &rctx->r
380
381 /* If encrypting, encrypt P_M with the
382 if (enc)
383 crypto_cipher_encrypt_one(tctx
384 rctx
385
386 /* Initialize the rest of the XChaCha
387 BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE !=
388 BUILD_BUG_ON(XCHACHA_IV_SIZE != 32);
389 rctx->rbuf.words[4] = cpu_to_le32(1);
390 rctx->rbuf.words[5] = 0;
391 rctx->rbuf.words[6] = 0;
392 rctx->rbuf.words[7] = 0;
393
394 /*
395 * XChaCha needs to be done on all the
396 * for disk encryption that usually me
397 * implementations tend to be most eff
398 * of 64-byte ChaCha blocks, or someti
399 * And here it doesn't matter whether
400 * as the second hash step will overwr
401 * length up to the next 64-byte bound
402 */
403 stream_len = bulk_len;
404 if (round_up(stream_len, CHACHA_BLOCK_
405 stream_len = round_up(stream_l
406
407 skcipher_request_set_tfm(&rctx->u.stre
408 skcipher_request_set_crypt(&rctx->u.st
409 req->dst, s
410 skcipher_request_set_callback(&rctx->u
411 req->bas
412 adiantum
413 return crypto_skcipher_encrypt(&rctx->
414 adiantum_finish(req);
415 }
416
417 static int adiantum_encrypt(struct skcipher_re
418 {
419 return adiantum_crypt(req, true);
420 }
421
422 static int adiantum_decrypt(struct skcipher_re
423 {
424 return adiantum_crypt(req, false);
425 }
426
427 static int adiantum_init_tfm(struct crypto_skc
428 {
429 struct skcipher_instance *inst = skcip
430 struct adiantum_instance_ctx *ictx = s
431 struct adiantum_tfm_ctx *tctx = crypto
432 struct crypto_skcipher *streamcipher;
433 struct crypto_cipher *blockcipher;
434 struct crypto_shash *hash;
435 unsigned int subreq_size;
436 int err;
437
438 streamcipher = crypto_spawn_skcipher(&
439 if (IS_ERR(streamcipher))
440 return PTR_ERR(streamcipher);
441
442 blockcipher = crypto_spawn_cipher(&ict
443 if (IS_ERR(blockcipher)) {
444 err = PTR_ERR(blockcipher);
445 goto err_free_streamcipher;
446 }
447
448 hash = crypto_spawn_shash(&ictx->hash_
449 if (IS_ERR(hash)) {
450 err = PTR_ERR(hash);
451 goto err_free_blockcipher;
452 }
453
454 tctx->streamcipher = streamcipher;
455 tctx->blockcipher = blockcipher;
456 tctx->hash = hash;
457
458 BUILD_BUG_ON(offsetofend(struct adiant
459 sizeof(struct adiantum_re
460 subreq_size = max(sizeof_field(struct
461 u.hash_
462 crypto_shash_descsiz
463 sizeof_field(struct
464 u.strea
465 crypto_skcipher_reqs
466
467 crypto_skcipher_set_reqsize(tfm,
468 offsetof(s
469 subreq_siz
470 return 0;
471
472 err_free_blockcipher:
473 crypto_free_cipher(blockcipher);
474 err_free_streamcipher:
475 crypto_free_skcipher(streamcipher);
476 return err;
477 }
478
479 static void adiantum_exit_tfm(struct crypto_sk
480 {
481 struct adiantum_tfm_ctx *tctx = crypto
482
483 crypto_free_skcipher(tctx->streamciphe
484 crypto_free_cipher(tctx->blockcipher);
485 crypto_free_shash(tctx->hash);
486 }
487
488 static void adiantum_free_instance(struct skci
489 {
490 struct adiantum_instance_ctx *ictx = s
491
492 crypto_drop_skcipher(&ictx->streamciph
493 crypto_drop_cipher(&ictx->blockcipher_
494 crypto_drop_shash(&ictx->hash_spawn);
495 kfree(inst);
496 }
497
498 /*
499 * Check for a supported set of inner algorith
500 * See the comment at the beginning of this fi
501 */
502 static bool adiantum_supported_algorithms(stru
503 stru
504 stru
505 {
506 if (strcmp(streamcipher_alg->base.cra_
507 strcmp(streamcipher_alg->base.cra_
508 return false;
509
510 if (blockcipher_alg->cra_cipher.cia_mi
511 blockcipher_alg->cra_cipher.cia_ma
512 return false;
513 if (blockcipher_alg->cra_blocksize !=
514 return false;
515
516 if (strcmp(hash_alg->base.cra_name, "n
517 return false;
518
519 return true;
520 }
521
522 static int adiantum_create(struct crypto_templ
523 {
524 u32 mask;
525 const char *nhpoly1305_name;
526 struct skcipher_instance *inst;
527 struct adiantum_instance_ctx *ictx;
528 struct skcipher_alg_common *streamciph
529 struct crypto_alg *blockcipher_alg;
530 struct shash_alg *hash_alg;
531 int err;
532
533 err = crypto_check_attr_type(tb, CRYPT
534 if (err)
535 return err;
536
537 inst = kzalloc(sizeof(*inst) + sizeof(
538 if (!inst)
539 return -ENOMEM;
540 ictx = skcipher_instance_ctx(inst);
541
542 /* Stream cipher, e.g. "xchacha12" */
543 err = crypto_grab_skcipher(&ictx->stre
544 skcipher_cr
545 crypto_attr
546 if (err)
547 goto err_free_inst;
548 streamcipher_alg = crypto_spawn_skciph
549
550 /* Block cipher, e.g. "aes" */
551 err = crypto_grab_cipher(&ictx->blockc
552 skcipher_cryp
553 crypto_attr_a
554 if (err)
555 goto err_free_inst;
556 blockcipher_alg = crypto_spawn_cipher_
557
558 /* NHPoly1305 ε-∆U hash function */
559 nhpoly1305_name = crypto_attr_alg_name
560 if (nhpoly1305_name == ERR_PTR(-ENOENT
561 nhpoly1305_name = "nhpoly1305"
562 err = crypto_grab_shash(&ictx->hash_sp
563 skcipher_crypt
564 nhpoly1305_nam
565 if (err)
566 goto err_free_inst;
567 hash_alg = crypto_spawn_shash_alg(&ict
568
569 /* Check the set of algorithms */
570 if (!adiantum_supported_algorithms(str
571 has
572 pr_warn("Unsupported Adiantum
573 streamcipher_alg->base
574 blockcipher_alg->cra_n
575 err = -EINVAL;
576 goto err_free_inst;
577 }
578
579 /* Instance fields */
580
581 err = -ENAMETOOLONG;
582 if (snprintf(inst->alg.base.cra_name,
583 "adiantum(%s,%s)", stream
584 blockcipher_alg->cra_name
585 goto err_free_inst;
586 if (snprintf(inst->alg.base.cra_driver
587 "adiantum(%s,%s,%s)",
588 streamcipher_alg->base.cr
589 blockcipher_alg->cra_driv
590 hash_alg->base.cra_driver
591 goto err_free_inst;
592
593 inst->alg.base.cra_blocksize = BLOCKCI
594 inst->alg.base.cra_ctxsize = sizeof(st
595 inst->alg.base.cra_alignmask = streamc
596 /*
597 * The block cipher is only invoked on
598 * messages (e.g. sectors for disk enc
599 * matter as much as that of the strea
600 * weigh the block cipher's ->cra_prio
601 */
602 inst->alg.base.cra_priority = (4 * str
603 2 * has
604 blockci
605
606 inst->alg.setkey = adiantum_setkey;
607 inst->alg.encrypt = adiantum_encrypt;
608 inst->alg.decrypt = adiantum_decrypt;
609 inst->alg.init = adiantum_init_tfm;
610 inst->alg.exit = adiantum_exit_tfm;
611 inst->alg.min_keysize = streamcipher_a
612 inst->alg.max_keysize = streamcipher_a
613 inst->alg.ivsize = TWEAK_SIZE;
614
615 inst->free = adiantum_free_instance;
616
617 err = skcipher_register_instance(tmpl,
618 if (err) {
619 err_free_inst:
620 adiantum_free_instance(inst);
621 }
622 return err;
623 }
624
625 /* adiantum(streamcipher_name, blockcipher_nam
626 static struct crypto_template adiantum_tmpl =
627 .name = "adiantum",
628 .create = adiantum_create,
629 .module = THIS_MODULE,
630 };
631
632 static int __init adiantum_module_init(void)
633 {
634 return crypto_register_template(&adian
635 }
636
637 static void __exit adiantum_module_exit(void)
638 {
639 crypto_unregister_template(&adiantum_t
640 }
641
642 subsys_initcall(adiantum_module_init);
643 module_exit(adiantum_module_exit);
644
645 MODULE_DESCRIPTION("Adiantum length-preserving
646 MODULE_LICENSE("GPL v2");
647 MODULE_AUTHOR("Eric Biggers <ebiggers@google.c
648 MODULE_ALIAS_CRYPTO("adiantum");
649 MODULE_IMPORT_NS(CRYPTO_INTERNAL);
650
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.