1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0 2 /* 2 /* 3 * Adiantum length-preserving encryption mode 3 * Adiantum length-preserving encryption mode 4 * 4 * 5 * Copyright 2018 Google LLC 5 * Copyright 2018 Google LLC 6 */ 6 */ 7 7 8 /* 8 /* 9 * Adiantum is a tweakable, length-preserving 9 * Adiantum is a tweakable, length-preserving encryption mode designed for fast 10 * and secure disk encryption, especially on C 10 * and secure disk encryption, especially on CPUs without dedicated crypto 11 * instructions. Adiantum encrypts each secto 11 * instructions. Adiantum encrypts each sector using the XChaCha12 stream 12 * cipher, two passes of an ε-almost-∆-univ 12 * cipher, two passes of an ε-almost-∆-universal (ε-∆U) hash function based on 13 * NH and Poly1305, and an invocation of the A 13 * NH and Poly1305, and an invocation of the AES-256 block cipher on a single 14 * 16-byte block. See the paper for details: 14 * 16-byte block. See the paper for details: 15 * 15 * 16 * Adiantum: length-preserving encryption 16 * Adiantum: length-preserving encryption for entry-level processors 17 * (https://eprint.iacr.org/2018/720.pdf) 17 * (https://eprint.iacr.org/2018/720.pdf) 18 * 18 * 19 * For flexibility, this implementation also a 19 * For flexibility, this implementation also allows other ciphers: 20 * 20 * 21 * - Stream cipher: XChaCha12 or XChaCha2 21 * - Stream cipher: XChaCha12 or XChaCha20 22 * - Block cipher: any with a 128-bit blo 22 * - Block cipher: any with a 128-bit block size and 256-bit key 23 * 23 * 24 * This implementation doesn't currently allow 24 * This implementation doesn't currently allow other ε-∆U hash functions, i.e. 25 * HPolyC is not supported. This is because A 25 * HPolyC is not supported. This is because Adiantum is ~20% faster than HPolyC 26 * but still provably as secure, and also the 26 * but still provably as secure, and also the ε-∆U hash function of HBSH is 27 * formally defined to take two inputs (tweak, 27 * formally defined to take two inputs (tweak, message) which makes it difficult 28 * to wrap with the crypto_shash API. Rather, 28 * to wrap with the crypto_shash API. Rather, some details need to be handled 29 * here. Nevertheless, if needed in the futur 29 * here. Nevertheless, if needed in the future, support for other ε-∆U hash 30 * functions could be added here. 30 * functions could be added here. 31 */ 31 */ 32 32 33 #include <crypto/b128ops.h> 33 #include <crypto/b128ops.h> 34 #include <crypto/chacha.h> 34 #include <crypto/chacha.h> 35 #include <crypto/internal/cipher.h> << 36 #include <crypto/internal/hash.h> 35 #include <crypto/internal/hash.h> 37 #include <crypto/internal/poly1305.h> << 38 #include <crypto/internal/skcipher.h> 36 #include <crypto/internal/skcipher.h> 39 #include <crypto/nhpoly1305.h> 37 #include <crypto/nhpoly1305.h> 40 #include <crypto/scatterwalk.h> 38 #include <crypto/scatterwalk.h> 41 #include <linux/module.h> 39 #include <linux/module.h> 42 40 >> 41 #include "internal.h" >> 42 43 /* 43 /* 44 * Size of right-hand part of input data, in b 44 * Size of right-hand part of input data, in bytes; also the size of the block 45 * cipher's block size and the hash function's 45 * cipher's block size and the hash function's output. 46 */ 46 */ 47 #define BLOCKCIPHER_BLOCK_SIZE 16 47 #define BLOCKCIPHER_BLOCK_SIZE 16 48 48 49 /* Size of the block cipher key (K_E) in bytes 49 /* Size of the block cipher key (K_E) in bytes */ 50 #define BLOCKCIPHER_KEY_SIZE 32 50 #define BLOCKCIPHER_KEY_SIZE 32 51 51 52 /* Size of the hash key (K_H) in bytes */ 52 /* Size of the hash key (K_H) in bytes */ 53 #define HASH_KEY_SIZE (POLY1305_BLOC 53 #define HASH_KEY_SIZE (POLY1305_BLOCK_SIZE + NHPOLY1305_KEY_SIZE) 54 54 55 /* 55 /* 56 * The specification allows variable-length tw 56 * The specification allows variable-length tweaks, but Linux's crypto API 57 * currently only allows algorithms to support 57 * currently only allows algorithms to support a single length. The "natural" 58 * tweak length for Adiantum is 16, since that 58 * tweak length for Adiantum is 16, since that fits into one Poly1305 block for 59 * the best performance. But longer tweaks ar 59 * the best performance. But longer tweaks are useful for fscrypt, to avoid 60 * needing to derive per-file keys. So instea 60 * needing to derive per-file keys. So instead we use two blocks, or 32 bytes. 61 */ 61 */ 62 #define TWEAK_SIZE 32 62 #define TWEAK_SIZE 32 63 63 64 struct adiantum_instance_ctx { 64 struct adiantum_instance_ctx { 65 struct crypto_skcipher_spawn streamcip 65 struct crypto_skcipher_spawn streamcipher_spawn; 66 struct crypto_cipher_spawn blockcipher !! 66 struct crypto_spawn blockcipher_spawn; 67 struct crypto_shash_spawn hash_spawn; 67 struct crypto_shash_spawn hash_spawn; 68 }; 68 }; 69 69 70 struct adiantum_tfm_ctx { 70 struct adiantum_tfm_ctx { 71 struct crypto_skcipher *streamcipher; 71 struct crypto_skcipher *streamcipher; 72 struct crypto_cipher *blockcipher; 72 struct crypto_cipher *blockcipher; 73 struct crypto_shash *hash; 73 struct crypto_shash *hash; 74 struct poly1305_core_key header_hash_k !! 74 struct poly1305_key header_hash_key; 75 }; 75 }; 76 76 77 struct adiantum_request_ctx { 77 struct adiantum_request_ctx { 78 78 79 /* 79 /* 80 * Buffer for right-hand part of data, 80 * Buffer for right-hand part of data, i.e. 81 * 81 * 82 * P_L => P_M => C_M => C_R when en 82 * P_L => P_M => C_M => C_R when encrypting, or 83 * C_R => C_M => P_M => P_L when de 83 * C_R => C_M => P_M => P_L when decrypting. 84 * 84 * 85 * Also used to build the IV for the s 85 * Also used to build the IV for the stream cipher. 86 */ 86 */ 87 union { 87 union { 88 u8 bytes[XCHACHA_IV_SIZE]; 88 u8 bytes[XCHACHA_IV_SIZE]; 89 __le32 words[XCHACHA_IV_SIZE / 89 __le32 words[XCHACHA_IV_SIZE / sizeof(__le32)]; 90 le128 bignum; /* interpret a 90 le128 bignum; /* interpret as element of Z/(2^{128}Z) */ 91 } rbuf; 91 } rbuf; 92 92 93 bool enc; /* true if encrypting, false 93 bool enc; /* true if encrypting, false if decrypting */ 94 94 95 /* 95 /* 96 * The result of the Poly1305 ε-∆U 96 * The result of the Poly1305 ε-∆U hash function applied to 97 * (bulk length, tweak) 97 * (bulk length, tweak) 98 */ 98 */ 99 le128 header_hash; 99 le128 header_hash; 100 100 101 /* Sub-requests, must be last */ 101 /* Sub-requests, must be last */ 102 union { 102 union { 103 struct shash_desc hash_desc; 103 struct shash_desc hash_desc; 104 struct skcipher_request stream 104 struct skcipher_request streamcipher_req; 105 } u; 105 } u; 106 }; 106 }; 107 107 108 /* 108 /* 109 * Given the XChaCha stream key K_S, derive th 109 * Given the XChaCha stream key K_S, derive the block cipher key K_E and the 110 * hash key K_H as follows: 110 * hash key K_H as follows: 111 * 111 * 112 * K_E || K_H || ... = XChaCha(key=K_S, no 112 * K_E || K_H || ... = XChaCha(key=K_S, nonce=1||0^191) 113 * 113 * 114 * Note that this denotes using bits from the 114 * Note that this denotes using bits from the XChaCha keystream, which here we 115 * get indirectly by encrypting a buffer conta 115 * get indirectly by encrypting a buffer containing all 0's. 116 */ 116 */ 117 static int adiantum_setkey(struct crypto_skcip 117 static int adiantum_setkey(struct crypto_skcipher *tfm, const u8 *key, 118 unsigned int keylen 118 unsigned int keylen) 119 { 119 { 120 struct adiantum_tfm_ctx *tctx = crypto 120 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 121 struct { 121 struct { 122 u8 iv[XCHACHA_IV_SIZE]; 122 u8 iv[XCHACHA_IV_SIZE]; 123 u8 derived_keys[BLOCKCIPHER_KE 123 u8 derived_keys[BLOCKCIPHER_KEY_SIZE + HASH_KEY_SIZE]; 124 struct scatterlist sg; 124 struct scatterlist sg; 125 struct crypto_wait wait; 125 struct crypto_wait wait; 126 struct skcipher_request req; / 126 struct skcipher_request req; /* must be last */ 127 } *data; 127 } *data; 128 u8 *keyp; 128 u8 *keyp; 129 int err; 129 int err; 130 130 131 /* Set the stream cipher key (K_S) */ 131 /* Set the stream cipher key (K_S) */ 132 crypto_skcipher_clear_flags(tctx->stre 132 crypto_skcipher_clear_flags(tctx->streamcipher, CRYPTO_TFM_REQ_MASK); 133 crypto_skcipher_set_flags(tctx->stream 133 crypto_skcipher_set_flags(tctx->streamcipher, 134 crypto_skcip 134 crypto_skcipher_get_flags(tfm) & 135 CRYPTO_TFM_R 135 CRYPTO_TFM_REQ_MASK); 136 err = crypto_skcipher_setkey(tctx->str 136 err = crypto_skcipher_setkey(tctx->streamcipher, key, keylen); >> 137 crypto_skcipher_set_flags(tfm, >> 138 crypto_skcipher_get_flags(tctx->streamcipher) & >> 139 CRYPTO_TFM_RES_MASK); 137 if (err) 140 if (err) 138 return err; 141 return err; 139 142 140 /* Derive the subkeys */ 143 /* Derive the subkeys */ 141 data = kzalloc(sizeof(*data) + 144 data = kzalloc(sizeof(*data) + 142 crypto_skcipher_reqsize 145 crypto_skcipher_reqsize(tctx->streamcipher), GFP_KERNEL); 143 if (!data) 146 if (!data) 144 return -ENOMEM; 147 return -ENOMEM; 145 data->iv[0] = 1; 148 data->iv[0] = 1; 146 sg_init_one(&data->sg, data->derived_k 149 sg_init_one(&data->sg, data->derived_keys, sizeof(data->derived_keys)); 147 crypto_init_wait(&data->wait); 150 crypto_init_wait(&data->wait); 148 skcipher_request_set_tfm(&data->req, t 151 skcipher_request_set_tfm(&data->req, tctx->streamcipher); 149 skcipher_request_set_callback(&data->r 152 skcipher_request_set_callback(&data->req, CRYPTO_TFM_REQ_MAY_SLEEP | 150 153 CRYPTO_TFM_REQ_MAY_BACKLOG, 151 crypto_r 154 crypto_req_done, &data->wait); 152 skcipher_request_set_crypt(&data->req, 155 skcipher_request_set_crypt(&data->req, &data->sg, &data->sg, 153 sizeof(data 156 sizeof(data->derived_keys), data->iv); 154 err = crypto_wait_req(crypto_skcipher_ 157 err = crypto_wait_req(crypto_skcipher_encrypt(&data->req), &data->wait); 155 if (err) 158 if (err) 156 goto out; 159 goto out; 157 keyp = data->derived_keys; 160 keyp = data->derived_keys; 158 161 159 /* Set the block cipher key (K_E) */ 162 /* Set the block cipher key (K_E) */ 160 crypto_cipher_clear_flags(tctx->blockc 163 crypto_cipher_clear_flags(tctx->blockcipher, CRYPTO_TFM_REQ_MASK); 161 crypto_cipher_set_flags(tctx->blockcip 164 crypto_cipher_set_flags(tctx->blockcipher, 162 crypto_skciphe 165 crypto_skcipher_get_flags(tfm) & 163 CRYPTO_TFM_REQ 166 CRYPTO_TFM_REQ_MASK); 164 err = crypto_cipher_setkey(tctx->block 167 err = crypto_cipher_setkey(tctx->blockcipher, keyp, 165 BLOCKCIPHER 168 BLOCKCIPHER_KEY_SIZE); >> 169 crypto_skcipher_set_flags(tfm, >> 170 crypto_cipher_get_flags(tctx->blockcipher) & >> 171 CRYPTO_TFM_RES_MASK); 166 if (err) 172 if (err) 167 goto out; 173 goto out; 168 keyp += BLOCKCIPHER_KEY_SIZE; 174 keyp += BLOCKCIPHER_KEY_SIZE; 169 175 170 /* Set the hash key (K_H) */ 176 /* Set the hash key (K_H) */ 171 poly1305_core_setkey(&tctx->header_has 177 poly1305_core_setkey(&tctx->header_hash_key, keyp); 172 keyp += POLY1305_BLOCK_SIZE; 178 keyp += POLY1305_BLOCK_SIZE; 173 179 174 crypto_shash_clear_flags(tctx->hash, C 180 crypto_shash_clear_flags(tctx->hash, CRYPTO_TFM_REQ_MASK); 175 crypto_shash_set_flags(tctx->hash, cry 181 crypto_shash_set_flags(tctx->hash, crypto_skcipher_get_flags(tfm) & 176 CRY 182 CRYPTO_TFM_REQ_MASK); 177 err = crypto_shash_setkey(tctx->hash, 183 err = crypto_shash_setkey(tctx->hash, keyp, NHPOLY1305_KEY_SIZE); >> 184 crypto_skcipher_set_flags(tfm, crypto_shash_get_flags(tctx->hash) & >> 185 CRYPTO_TFM_RES_MASK); 178 keyp += NHPOLY1305_KEY_SIZE; 186 keyp += NHPOLY1305_KEY_SIZE; 179 WARN_ON(keyp != &data->derived_keys[AR 187 WARN_ON(keyp != &data->derived_keys[ARRAY_SIZE(data->derived_keys)]); 180 out: 188 out: 181 kfree_sensitive(data); !! 189 kzfree(data); 182 return err; 190 return err; 183 } 191 } 184 192 185 /* Addition in Z/(2^{128}Z) */ 193 /* Addition in Z/(2^{128}Z) */ 186 static inline void le128_add(le128 *r, const l 194 static inline void le128_add(le128 *r, const le128 *v1, const le128 *v2) 187 { 195 { 188 u64 x = le64_to_cpu(v1->b); 196 u64 x = le64_to_cpu(v1->b); 189 u64 y = le64_to_cpu(v2->b); 197 u64 y = le64_to_cpu(v2->b); 190 198 191 r->b = cpu_to_le64(x + y); 199 r->b = cpu_to_le64(x + y); 192 r->a = cpu_to_le64(le64_to_cpu(v1->a) 200 r->a = cpu_to_le64(le64_to_cpu(v1->a) + le64_to_cpu(v2->a) + 193 (x + y < x)); 201 (x + y < x)); 194 } 202 } 195 203 196 /* Subtraction in Z/(2^{128}Z) */ 204 /* Subtraction in Z/(2^{128}Z) */ 197 static inline void le128_sub(le128 *r, const l 205 static inline void le128_sub(le128 *r, const le128 *v1, const le128 *v2) 198 { 206 { 199 u64 x = le64_to_cpu(v1->b); 207 u64 x = le64_to_cpu(v1->b); 200 u64 y = le64_to_cpu(v2->b); 208 u64 y = le64_to_cpu(v2->b); 201 209 202 r->b = cpu_to_le64(x - y); 210 r->b = cpu_to_le64(x - y); 203 r->a = cpu_to_le64(le64_to_cpu(v1->a) 211 r->a = cpu_to_le64(le64_to_cpu(v1->a) - le64_to_cpu(v2->a) - 204 (x - y > x)); 212 (x - y > x)); 205 } 213 } 206 214 207 /* 215 /* 208 * Apply the Poly1305 ε-∆U hash function to 216 * Apply the Poly1305 ε-∆U hash function to (bulk length, tweak) and save the 209 * result to rctx->header_hash. This is the c 217 * result to rctx->header_hash. This is the calculation 210 * 218 * 211 * H_T ← Poly1305_{K_T}(bin_{128}(|L|) 219 * H_T ← Poly1305_{K_T}(bin_{128}(|L|) || T) 212 * 220 * 213 * from the procedure in section 6.4 of the Ad 221 * from the procedure in section 6.4 of the Adiantum paper. The resulting value 214 * is reused in both the first and second hash 222 * is reused in both the first and second hash steps. Specifically, it's added 215 * to the result of an independently keyed ε- 223 * to the result of an independently keyed ε-∆U hash function (for equal length 216 * inputs only) taken over the left-hand part 224 * inputs only) taken over the left-hand part (the "bulk") of the message, to 217 * give the overall Adiantum hash of the (twea 225 * give the overall Adiantum hash of the (tweak, left-hand part) pair. 218 */ 226 */ 219 static void adiantum_hash_header(struct skciph 227 static void adiantum_hash_header(struct skcipher_request *req) 220 { 228 { 221 struct crypto_skcipher *tfm = crypto_s 229 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 222 const struct adiantum_tfm_ctx *tctx = 230 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 223 struct adiantum_request_ctx *rctx = sk 231 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); 224 const unsigned int bulk_len = req->cry 232 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; 225 struct { 233 struct { 226 __le64 message_bits; 234 __le64 message_bits; 227 __le64 padding; 235 __le64 padding; 228 } header = { 236 } header = { 229 .message_bits = cpu_to_le64((u 237 .message_bits = cpu_to_le64((u64)bulk_len * 8) 230 }; 238 }; 231 struct poly1305_state state; 239 struct poly1305_state state; 232 240 233 poly1305_core_init(&state); 241 poly1305_core_init(&state); 234 242 235 BUILD_BUG_ON(sizeof(header) % POLY1305 243 BUILD_BUG_ON(sizeof(header) % POLY1305_BLOCK_SIZE != 0); 236 poly1305_core_blocks(&state, &tctx->he 244 poly1305_core_blocks(&state, &tctx->header_hash_key, 237 &header, sizeof(h !! 245 &header, sizeof(header) / POLY1305_BLOCK_SIZE); 238 246 239 BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLO 247 BUILD_BUG_ON(TWEAK_SIZE % POLY1305_BLOCK_SIZE != 0); 240 poly1305_core_blocks(&state, &tctx->he 248 poly1305_core_blocks(&state, &tctx->header_hash_key, req->iv, 241 TWEAK_SIZE / POLY !! 249 TWEAK_SIZE / POLY1305_BLOCK_SIZE); 242 250 243 poly1305_core_emit(&state, NULL, &rctx !! 251 poly1305_core_emit(&state, &rctx->header_hash); 244 } 252 } 245 253 246 /* Hash the left-hand part (the "bulk") of the 254 /* Hash the left-hand part (the "bulk") of the message using NHPoly1305 */ 247 static int adiantum_hash_message(struct skciph 255 static int adiantum_hash_message(struct skcipher_request *req, 248 struct scatte !! 256 struct scatterlist *sgl, le128 *digest) 249 le128 *digest << 250 { 257 { >> 258 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); >> 259 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 251 struct adiantum_request_ctx *rctx = sk 260 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); 252 const unsigned int bulk_len = req->cry 261 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; 253 struct shash_desc *hash_desc = &rctx-> 262 struct shash_desc *hash_desc = &rctx->u.hash_desc; 254 struct sg_mapping_iter miter; 263 struct sg_mapping_iter miter; 255 unsigned int i, n; 264 unsigned int i, n; 256 int err; 265 int err; 257 266 >> 267 hash_desc->tfm = tctx->hash; >> 268 258 err = crypto_shash_init(hash_desc); 269 err = crypto_shash_init(hash_desc); 259 if (err) 270 if (err) 260 return err; 271 return err; 261 272 262 sg_miter_start(&miter, sgl, nents, SG_ !! 273 sg_miter_start(&miter, sgl, sg_nents(sgl), >> 274 SG_MITER_FROM_SG | SG_MITER_ATOMIC); 263 for (i = 0; i < bulk_len; i += n) { 275 for (i = 0; i < bulk_len; i += n) { 264 sg_miter_next(&miter); 276 sg_miter_next(&miter); 265 n = min_t(unsigned int, miter. 277 n = min_t(unsigned int, miter.length, bulk_len - i); 266 err = crypto_shash_update(hash 278 err = crypto_shash_update(hash_desc, miter.addr, n); 267 if (err) 279 if (err) 268 break; 280 break; 269 } 281 } 270 sg_miter_stop(&miter); 282 sg_miter_stop(&miter); 271 if (err) 283 if (err) 272 return err; 284 return err; 273 285 274 return crypto_shash_final(hash_desc, ( 286 return crypto_shash_final(hash_desc, (u8 *)digest); 275 } 287 } 276 288 277 /* Continue Adiantum encryption/decryption aft 289 /* Continue Adiantum encryption/decryption after the stream cipher step */ 278 static int adiantum_finish(struct skcipher_req 290 static int adiantum_finish(struct skcipher_request *req) 279 { 291 { 280 struct crypto_skcipher *tfm = crypto_s 292 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 281 const struct adiantum_tfm_ctx *tctx = 293 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 282 struct adiantum_request_ctx *rctx = sk 294 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); 283 const unsigned int bulk_len = req->cry 295 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; 284 struct scatterlist *dst = req->dst; << 285 const unsigned int dst_nents = sg_nent << 286 le128 digest; 296 le128 digest; 287 int err; 297 int err; 288 298 289 /* If decrypting, decrypt C_M with the 299 /* If decrypting, decrypt C_M with the block cipher to get P_M */ 290 if (!rctx->enc) 300 if (!rctx->enc) 291 crypto_cipher_decrypt_one(tctx 301 crypto_cipher_decrypt_one(tctx->blockcipher, rctx->rbuf.bytes, 292 rctx 302 rctx->rbuf.bytes); 293 303 294 /* 304 /* 295 * Second hash step 305 * Second hash step 296 * enc: C_R = C_M - H_{K_H}(T, C_ 306 * enc: C_R = C_M - H_{K_H}(T, C_L) 297 * dec: P_R = P_M - H_{K_H}(T, P_ 307 * dec: P_R = P_M - H_{K_H}(T, P_L) 298 */ 308 */ 299 rctx->u.hash_desc.tfm = tctx->hash; !! 309 err = adiantum_hash_message(req, req->dst, &digest); 300 le128_sub(&rctx->rbuf.bignum, &rctx->r !! 310 if (err) 301 if (dst_nents == 1 && dst->offset + re !! 311 return err; 302 /* Fast path for single-page d !! 312 le128_add(&digest, &digest, &rctx->header_hash); 303 struct page *page = sg_page(ds !! 313 le128_sub(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); 304 void *virt = kmap_local_page(p !! 314 scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->dst, 305 !! 315 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 1); 306 err = crypto_shash_digest(&rct << 307 (u8 << 308 if (err) { << 309 kunmap_local(virt); << 310 return err; << 311 } << 312 le128_sub(&rctx->rbuf.bignum, << 313 memcpy(virt + bulk_len, &rctx- << 314 flush_dcache_page(page); << 315 kunmap_local(virt); << 316 } else { << 317 /* Slow path that works for an << 318 err = adiantum_hash_message(re << 319 if (err) << 320 return err; << 321 le128_sub(&rctx->rbuf.bignum, << 322 scatterwalk_map_and_copy(&rctx << 323 bulk_ << 324 } << 325 return 0; 316 return 0; 326 } 317 } 327 318 328 static void adiantum_streamcipher_done(void *d !! 319 static void adiantum_streamcipher_done(struct crypto_async_request *areq, >> 320 int err) 329 { 321 { 330 struct skcipher_request *req = data; !! 322 struct skcipher_request *req = areq->data; 331 323 332 if (!err) 324 if (!err) 333 err = adiantum_finish(req); 325 err = adiantum_finish(req); 334 326 335 skcipher_request_complete(req, err); 327 skcipher_request_complete(req, err); 336 } 328 } 337 329 338 static int adiantum_crypt(struct skcipher_requ 330 static int adiantum_crypt(struct skcipher_request *req, bool enc) 339 { 331 { 340 struct crypto_skcipher *tfm = crypto_s 332 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 341 const struct adiantum_tfm_ctx *tctx = 333 const struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 342 struct adiantum_request_ctx *rctx = sk 334 struct adiantum_request_ctx *rctx = skcipher_request_ctx(req); 343 const unsigned int bulk_len = req->cry 335 const unsigned int bulk_len = req->cryptlen - BLOCKCIPHER_BLOCK_SIZE; 344 struct scatterlist *src = req->src; << 345 const unsigned int src_nents = sg_nent << 346 unsigned int stream_len; 336 unsigned int stream_len; 347 le128 digest; 337 le128 digest; 348 int err; 338 int err; 349 339 350 if (req->cryptlen < BLOCKCIPHER_BLOCK_ 340 if (req->cryptlen < BLOCKCIPHER_BLOCK_SIZE) 351 return -EINVAL; 341 return -EINVAL; 352 342 353 rctx->enc = enc; 343 rctx->enc = enc; 354 344 355 /* 345 /* 356 * First hash step 346 * First hash step 357 * enc: P_M = P_R + H_{K_H}(T, P_ 347 * enc: P_M = P_R + H_{K_H}(T, P_L) 358 * dec: C_M = C_R + H_{K_H}(T, C_ 348 * dec: C_M = C_R + H_{K_H}(T, C_L) 359 */ 349 */ 360 adiantum_hash_header(req); 350 adiantum_hash_header(req); 361 rctx->u.hash_desc.tfm = tctx->hash; !! 351 err = adiantum_hash_message(req, req->src, &digest); 362 if (src_nents == 1 && src->offset + re << 363 /* Fast path for single-page s << 364 void *virt = kmap_local_page(s << 365 << 366 err = crypto_shash_digest(&rct << 367 (u8 << 368 memcpy(&rctx->rbuf.bignum, vir << 369 kunmap_local(virt); << 370 } else { << 371 /* Slow path that works for an << 372 err = adiantum_hash_message(re << 373 scatterwalk_map_and_copy(&rctx << 374 bulk_ << 375 } << 376 if (err) 352 if (err) 377 return err; 353 return err; 378 le128_add(&rctx->rbuf.bignum, &rctx->r !! 354 le128_add(&digest, &digest, &rctx->header_hash); >> 355 scatterwalk_map_and_copy(&rctx->rbuf.bignum, req->src, >> 356 bulk_len, BLOCKCIPHER_BLOCK_SIZE, 0); 379 le128_add(&rctx->rbuf.bignum, &rctx->r 357 le128_add(&rctx->rbuf.bignum, &rctx->rbuf.bignum, &digest); 380 358 381 /* If encrypting, encrypt P_M with the 359 /* If encrypting, encrypt P_M with the block cipher to get C_M */ 382 if (enc) 360 if (enc) 383 crypto_cipher_encrypt_one(tctx 361 crypto_cipher_encrypt_one(tctx->blockcipher, rctx->rbuf.bytes, 384 rctx 362 rctx->rbuf.bytes); 385 363 386 /* Initialize the rest of the XChaCha 364 /* Initialize the rest of the XChaCha IV (first part is C_M) */ 387 BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 365 BUILD_BUG_ON(BLOCKCIPHER_BLOCK_SIZE != 16); 388 BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); 366 BUILD_BUG_ON(XCHACHA_IV_SIZE != 32); /* nonce || stream position */ 389 rctx->rbuf.words[4] = cpu_to_le32(1); 367 rctx->rbuf.words[4] = cpu_to_le32(1); 390 rctx->rbuf.words[5] = 0; 368 rctx->rbuf.words[5] = 0; 391 rctx->rbuf.words[6] = 0; 369 rctx->rbuf.words[6] = 0; 392 rctx->rbuf.words[7] = 0; 370 rctx->rbuf.words[7] = 0; 393 371 394 /* 372 /* 395 * XChaCha needs to be done on all the 373 * XChaCha needs to be done on all the data except the last 16 bytes; 396 * for disk encryption that usually me 374 * for disk encryption that usually means 4080 or 496 bytes. But ChaCha 397 * implementations tend to be most eff 375 * implementations tend to be most efficient when passed a whole number 398 * of 64-byte ChaCha blocks, or someti 376 * of 64-byte ChaCha blocks, or sometimes even a multiple of 256 bytes. 399 * And here it doesn't matter whether 377 * And here it doesn't matter whether the last 16 bytes are written to, 400 * as the second hash step will overwr 378 * as the second hash step will overwrite them. Thus, round the XChaCha 401 * length up to the next 64-byte bound 379 * length up to the next 64-byte boundary if possible. 402 */ 380 */ 403 stream_len = bulk_len; 381 stream_len = bulk_len; 404 if (round_up(stream_len, CHACHA_BLOCK_ 382 if (round_up(stream_len, CHACHA_BLOCK_SIZE) <= req->cryptlen) 405 stream_len = round_up(stream_l 383 stream_len = round_up(stream_len, CHACHA_BLOCK_SIZE); 406 384 407 skcipher_request_set_tfm(&rctx->u.stre 385 skcipher_request_set_tfm(&rctx->u.streamcipher_req, tctx->streamcipher); 408 skcipher_request_set_crypt(&rctx->u.st 386 skcipher_request_set_crypt(&rctx->u.streamcipher_req, req->src, 409 req->dst, s 387 req->dst, stream_len, &rctx->rbuf); 410 skcipher_request_set_callback(&rctx->u 388 skcipher_request_set_callback(&rctx->u.streamcipher_req, 411 req->bas 389 req->base.flags, 412 adiantum 390 adiantum_streamcipher_done, req); 413 return crypto_skcipher_encrypt(&rctx-> 391 return crypto_skcipher_encrypt(&rctx->u.streamcipher_req) ?: 414 adiantum_finish(req); 392 adiantum_finish(req); 415 } 393 } 416 394 417 static int adiantum_encrypt(struct skcipher_re 395 static int adiantum_encrypt(struct skcipher_request *req) 418 { 396 { 419 return adiantum_crypt(req, true); 397 return adiantum_crypt(req, true); 420 } 398 } 421 399 422 static int adiantum_decrypt(struct skcipher_re 400 static int adiantum_decrypt(struct skcipher_request *req) 423 { 401 { 424 return adiantum_crypt(req, false); 402 return adiantum_crypt(req, false); 425 } 403 } 426 404 427 static int adiantum_init_tfm(struct crypto_skc 405 static int adiantum_init_tfm(struct crypto_skcipher *tfm) 428 { 406 { 429 struct skcipher_instance *inst = skcip 407 struct skcipher_instance *inst = skcipher_alg_instance(tfm); 430 struct adiantum_instance_ctx *ictx = s 408 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); 431 struct adiantum_tfm_ctx *tctx = crypto 409 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 432 struct crypto_skcipher *streamcipher; 410 struct crypto_skcipher *streamcipher; 433 struct crypto_cipher *blockcipher; 411 struct crypto_cipher *blockcipher; 434 struct crypto_shash *hash; 412 struct crypto_shash *hash; 435 unsigned int subreq_size; 413 unsigned int subreq_size; 436 int err; 414 int err; 437 415 438 streamcipher = crypto_spawn_skcipher(& 416 streamcipher = crypto_spawn_skcipher(&ictx->streamcipher_spawn); 439 if (IS_ERR(streamcipher)) 417 if (IS_ERR(streamcipher)) 440 return PTR_ERR(streamcipher); 418 return PTR_ERR(streamcipher); 441 419 442 blockcipher = crypto_spawn_cipher(&ict 420 blockcipher = crypto_spawn_cipher(&ictx->blockcipher_spawn); 443 if (IS_ERR(blockcipher)) { 421 if (IS_ERR(blockcipher)) { 444 err = PTR_ERR(blockcipher); 422 err = PTR_ERR(blockcipher); 445 goto err_free_streamcipher; 423 goto err_free_streamcipher; 446 } 424 } 447 425 448 hash = crypto_spawn_shash(&ictx->hash_ 426 hash = crypto_spawn_shash(&ictx->hash_spawn); 449 if (IS_ERR(hash)) { 427 if (IS_ERR(hash)) { 450 err = PTR_ERR(hash); 428 err = PTR_ERR(hash); 451 goto err_free_blockcipher; 429 goto err_free_blockcipher; 452 } 430 } 453 431 454 tctx->streamcipher = streamcipher; 432 tctx->streamcipher = streamcipher; 455 tctx->blockcipher = blockcipher; 433 tctx->blockcipher = blockcipher; 456 tctx->hash = hash; 434 tctx->hash = hash; 457 435 458 BUILD_BUG_ON(offsetofend(struct adiant 436 BUILD_BUG_ON(offsetofend(struct adiantum_request_ctx, u) != 459 sizeof(struct adiantum_re 437 sizeof(struct adiantum_request_ctx)); 460 subreq_size = max(sizeof_field(struct !! 438 subreq_size = max(FIELD_SIZEOF(struct adiantum_request_ctx, 461 u.hash_ 439 u.hash_desc) + 462 crypto_shash_descsiz 440 crypto_shash_descsize(hash), 463 sizeof_field(struct !! 441 FIELD_SIZEOF(struct adiantum_request_ctx, 464 u.strea 442 u.streamcipher_req) + 465 crypto_skcipher_reqs 443 crypto_skcipher_reqsize(streamcipher)); 466 444 467 crypto_skcipher_set_reqsize(tfm, 445 crypto_skcipher_set_reqsize(tfm, 468 offsetof(s 446 offsetof(struct adiantum_request_ctx, u) + 469 subreq_siz 447 subreq_size); 470 return 0; 448 return 0; 471 449 472 err_free_blockcipher: 450 err_free_blockcipher: 473 crypto_free_cipher(blockcipher); 451 crypto_free_cipher(blockcipher); 474 err_free_streamcipher: 452 err_free_streamcipher: 475 crypto_free_skcipher(streamcipher); 453 crypto_free_skcipher(streamcipher); 476 return err; 454 return err; 477 } 455 } 478 456 479 static void adiantum_exit_tfm(struct crypto_sk 457 static void adiantum_exit_tfm(struct crypto_skcipher *tfm) 480 { 458 { 481 struct adiantum_tfm_ctx *tctx = crypto 459 struct adiantum_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); 482 460 483 crypto_free_skcipher(tctx->streamciphe 461 crypto_free_skcipher(tctx->streamcipher); 484 crypto_free_cipher(tctx->blockcipher); 462 crypto_free_cipher(tctx->blockcipher); 485 crypto_free_shash(tctx->hash); 463 crypto_free_shash(tctx->hash); 486 } 464 } 487 465 488 static void adiantum_free_instance(struct skci 466 static void adiantum_free_instance(struct skcipher_instance *inst) 489 { 467 { 490 struct adiantum_instance_ctx *ictx = s 468 struct adiantum_instance_ctx *ictx = skcipher_instance_ctx(inst); 491 469 492 crypto_drop_skcipher(&ictx->streamciph 470 crypto_drop_skcipher(&ictx->streamcipher_spawn); 493 crypto_drop_cipher(&ictx->blockcipher_ !! 471 crypto_drop_spawn(&ictx->blockcipher_spawn); 494 crypto_drop_shash(&ictx->hash_spawn); 472 crypto_drop_shash(&ictx->hash_spawn); 495 kfree(inst); 473 kfree(inst); 496 } 474 } 497 475 498 /* 476 /* 499 * Check for a supported set of inner algorith 477 * Check for a supported set of inner algorithms. 500 * See the comment at the beginning of this fi 478 * See the comment at the beginning of this file. 501 */ 479 */ 502 static bool adiantum_supported_algorithms(stru !! 480 static bool adiantum_supported_algorithms(struct skcipher_alg *streamcipher_alg, 503 stru 481 struct crypto_alg *blockcipher_alg, 504 stru 482 struct shash_alg *hash_alg) 505 { 483 { 506 if (strcmp(streamcipher_alg->base.cra_ 484 if (strcmp(streamcipher_alg->base.cra_name, "xchacha12") != 0 && 507 strcmp(streamcipher_alg->base.cra_ 485 strcmp(streamcipher_alg->base.cra_name, "xchacha20") != 0) 508 return false; 486 return false; 509 487 510 if (blockcipher_alg->cra_cipher.cia_mi 488 if (blockcipher_alg->cra_cipher.cia_min_keysize > BLOCKCIPHER_KEY_SIZE || 511 blockcipher_alg->cra_cipher.cia_ma 489 blockcipher_alg->cra_cipher.cia_max_keysize < BLOCKCIPHER_KEY_SIZE) 512 return false; 490 return false; 513 if (blockcipher_alg->cra_blocksize != 491 if (blockcipher_alg->cra_blocksize != BLOCKCIPHER_BLOCK_SIZE) 514 return false; 492 return false; 515 493 516 if (strcmp(hash_alg->base.cra_name, "n 494 if (strcmp(hash_alg->base.cra_name, "nhpoly1305") != 0) 517 return false; 495 return false; 518 496 519 return true; 497 return true; 520 } 498 } 521 499 522 static int adiantum_create(struct crypto_templ 500 static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb) 523 { 501 { 524 u32 mask; !! 502 struct crypto_attr_type *algt; >> 503 const char *streamcipher_name; >> 504 const char *blockcipher_name; 525 const char *nhpoly1305_name; 505 const char *nhpoly1305_name; 526 struct skcipher_instance *inst; 506 struct skcipher_instance *inst; 527 struct adiantum_instance_ctx *ictx; 507 struct adiantum_instance_ctx *ictx; 528 struct skcipher_alg_common *streamciph !! 508 struct skcipher_alg *streamcipher_alg; 529 struct crypto_alg *blockcipher_alg; 509 struct crypto_alg *blockcipher_alg; >> 510 struct crypto_alg *_hash_alg; 530 struct shash_alg *hash_alg; 511 struct shash_alg *hash_alg; 531 int err; 512 int err; 532 513 533 err = crypto_check_attr_type(tb, CRYPT !! 514 algt = crypto_get_attr_type(tb); 534 if (err) !! 515 if (IS_ERR(algt)) 535 return err; !! 516 return PTR_ERR(algt); >> 517 >> 518 if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask) >> 519 return -EINVAL; >> 520 >> 521 streamcipher_name = crypto_attr_alg_name(tb[1]); >> 522 if (IS_ERR(streamcipher_name)) >> 523 return PTR_ERR(streamcipher_name); >> 524 >> 525 blockcipher_name = crypto_attr_alg_name(tb[2]); >> 526 if (IS_ERR(blockcipher_name)) >> 527 return PTR_ERR(blockcipher_name); >> 528 >> 529 nhpoly1305_name = crypto_attr_alg_name(tb[3]); >> 530 if (nhpoly1305_name == ERR_PTR(-ENOENT)) >> 531 nhpoly1305_name = "nhpoly1305"; >> 532 if (IS_ERR(nhpoly1305_name)) >> 533 return PTR_ERR(nhpoly1305_name); 536 534 537 inst = kzalloc(sizeof(*inst) + sizeof( 535 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL); 538 if (!inst) 536 if (!inst) 539 return -ENOMEM; 537 return -ENOMEM; 540 ictx = skcipher_instance_ctx(inst); 538 ictx = skcipher_instance_ctx(inst); 541 539 542 /* Stream cipher, e.g. "xchacha12" */ 540 /* Stream cipher, e.g. "xchacha12" */ 543 err = crypto_grab_skcipher(&ictx->stre !! 541 crypto_set_skcipher_spawn(&ictx->streamcipher_spawn, 544 skcipher_cr !! 542 skcipher_crypto_instance(inst)); 545 crypto_attr !! 543 err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name, >> 544 0, crypto_requires_sync(algt->type, >> 545 algt->mask)); 546 if (err) 546 if (err) 547 goto err_free_inst; !! 547 goto out_free_inst; 548 streamcipher_alg = crypto_spawn_skciph !! 548 streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn); 549 549 550 /* Block cipher, e.g. "aes" */ 550 /* Block cipher, e.g. "aes" */ 551 err = crypto_grab_cipher(&ictx->blockc !! 551 crypto_set_spawn(&ictx->blockcipher_spawn, 552 skcipher_cryp !! 552 skcipher_crypto_instance(inst)); 553 crypto_attr_a !! 553 err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name, >> 554 CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK); 554 if (err) 555 if (err) 555 goto err_free_inst; !! 556 goto out_drop_streamcipher; 556 blockcipher_alg = crypto_spawn_cipher_ !! 557 blockcipher_alg = ictx->blockcipher_spawn.alg; 557 558 558 /* NHPoly1305 ε-∆U hash function */ 559 /* NHPoly1305 ε-∆U hash function */ 559 nhpoly1305_name = crypto_attr_alg_name !! 560 _hash_alg = crypto_alg_mod_lookup(nhpoly1305_name, 560 if (nhpoly1305_name == ERR_PTR(-ENOENT !! 561 CRYPTO_ALG_TYPE_SHASH, 561 nhpoly1305_name = "nhpoly1305" !! 562 CRYPTO_ALG_TYPE_MASK); 562 err = crypto_grab_shash(&ictx->hash_sp !! 563 if (IS_ERR(_hash_alg)) { 563 skcipher_crypt !! 564 err = PTR_ERR(_hash_alg); 564 nhpoly1305_nam !! 565 goto out_drop_blockcipher; >> 566 } >> 567 hash_alg = __crypto_shash_alg(_hash_alg); >> 568 err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg, >> 569 skcipher_crypto_instance(inst)); 565 if (err) 570 if (err) 566 goto err_free_inst; !! 571 goto out_put_hash; 567 hash_alg = crypto_spawn_shash_alg(&ict << 568 572 569 /* Check the set of algorithms */ 573 /* Check the set of algorithms */ 570 if (!adiantum_supported_algorithms(str 574 if (!adiantum_supported_algorithms(streamcipher_alg, blockcipher_alg, 571 has 575 hash_alg)) { 572 pr_warn("Unsupported Adiantum 576 pr_warn("Unsupported Adiantum instantiation: (%s,%s,%s)\n", 573 streamcipher_alg->base 577 streamcipher_alg->base.cra_name, 574 blockcipher_alg->cra_n 578 blockcipher_alg->cra_name, hash_alg->base.cra_name); 575 err = -EINVAL; 579 err = -EINVAL; 576 goto err_free_inst; !! 580 goto out_drop_hash; 577 } 581 } 578 582 579 /* Instance fields */ 583 /* Instance fields */ 580 584 581 err = -ENAMETOOLONG; 585 err = -ENAMETOOLONG; 582 if (snprintf(inst->alg.base.cra_name, 586 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, 583 "adiantum(%s,%s)", stream 587 "adiantum(%s,%s)", streamcipher_alg->base.cra_name, 584 blockcipher_alg->cra_name 588 blockcipher_alg->cra_name) >= CRYPTO_MAX_ALG_NAME) 585 goto err_free_inst; !! 589 goto out_drop_hash; 586 if (snprintf(inst->alg.base.cra_driver 590 if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, 587 "adiantum(%s,%s,%s)", 591 "adiantum(%s,%s,%s)", 588 streamcipher_alg->base.cr 592 streamcipher_alg->base.cra_driver_name, 589 blockcipher_alg->cra_driv 593 blockcipher_alg->cra_driver_name, 590 hash_alg->base.cra_driver 594 hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) 591 goto err_free_inst; !! 595 goto out_drop_hash; 592 596 >> 597 inst->alg.base.cra_flags = streamcipher_alg->base.cra_flags & >> 598 CRYPTO_ALG_ASYNC; 593 inst->alg.base.cra_blocksize = BLOCKCI 599 inst->alg.base.cra_blocksize = BLOCKCIPHER_BLOCK_SIZE; 594 inst->alg.base.cra_ctxsize = sizeof(st 600 inst->alg.base.cra_ctxsize = sizeof(struct adiantum_tfm_ctx); 595 inst->alg.base.cra_alignmask = streamc !! 601 inst->alg.base.cra_alignmask = streamcipher_alg->base.cra_alignmask | >> 602 hash_alg->base.cra_alignmask; 596 /* 603 /* 597 * The block cipher is only invoked on 604 * The block cipher is only invoked once per message, so for long 598 * messages (e.g. sectors for disk enc 605 * messages (e.g. sectors for disk encryption) its performance doesn't 599 * matter as much as that of the strea 606 * matter as much as that of the stream cipher and hash function. Thus, 600 * weigh the block cipher's ->cra_prio 607 * weigh the block cipher's ->cra_priority less. 601 */ 608 */ 602 inst->alg.base.cra_priority = (4 * str 609 inst->alg.base.cra_priority = (4 * streamcipher_alg->base.cra_priority + 603 2 * has 610 2 * hash_alg->base.cra_priority + 604 blockci 611 blockcipher_alg->cra_priority) / 7; 605 612 606 inst->alg.setkey = adiantum_setkey; 613 inst->alg.setkey = adiantum_setkey; 607 inst->alg.encrypt = adiantum_encrypt; 614 inst->alg.encrypt = adiantum_encrypt; 608 inst->alg.decrypt = adiantum_decrypt; 615 inst->alg.decrypt = adiantum_decrypt; 609 inst->alg.init = adiantum_init_tfm; 616 inst->alg.init = adiantum_init_tfm; 610 inst->alg.exit = adiantum_exit_tfm; 617 inst->alg.exit = adiantum_exit_tfm; 611 inst->alg.min_keysize = streamcipher_a !! 618 inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(streamcipher_alg); 612 inst->alg.max_keysize = streamcipher_a !! 619 inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(streamcipher_alg); 613 inst->alg.ivsize = TWEAK_SIZE; 620 inst->alg.ivsize = TWEAK_SIZE; 614 621 615 inst->free = adiantum_free_instance; 622 inst->free = adiantum_free_instance; 616 623 617 err = skcipher_register_instance(tmpl, 624 err = skcipher_register_instance(tmpl, inst); 618 if (err) { !! 625 if (err) 619 err_free_inst: !! 626 goto out_drop_hash; 620 adiantum_free_instance(inst); !! 627 621 } !! 628 crypto_mod_put(_hash_alg); >> 629 return 0; >> 630 >> 631 out_drop_hash: >> 632 crypto_drop_shash(&ictx->hash_spawn); >> 633 out_put_hash: >> 634 crypto_mod_put(_hash_alg); >> 635 out_drop_blockcipher: >> 636 crypto_drop_spawn(&ictx->blockcipher_spawn); >> 637 out_drop_streamcipher: >> 638 crypto_drop_skcipher(&ictx->streamcipher_spawn); >> 639 out_free_inst: >> 640 kfree(inst); 622 return err; 641 return err; 623 } 642 } 624 643 625 /* adiantum(streamcipher_name, blockcipher_nam 644 /* adiantum(streamcipher_name, blockcipher_name [, nhpoly1305_name]) */ 626 static struct crypto_template adiantum_tmpl = 645 static struct crypto_template adiantum_tmpl = { 627 .name = "adiantum", 646 .name = "adiantum", 628 .create = adiantum_create, 647 .create = adiantum_create, 629 .module = THIS_MODULE, 648 .module = THIS_MODULE, 630 }; 649 }; 631 650 632 static int __init adiantum_module_init(void) 651 static int __init adiantum_module_init(void) 633 { 652 { 634 return crypto_register_template(&adian 653 return crypto_register_template(&adiantum_tmpl); 635 } 654 } 636 655 637 static void __exit adiantum_module_exit(void) 656 static void __exit adiantum_module_exit(void) 638 { 657 { 639 crypto_unregister_template(&adiantum_t 658 crypto_unregister_template(&adiantum_tmpl); 640 } 659 } 641 660 642 subsys_initcall(adiantum_module_init); 661 subsys_initcall(adiantum_module_init); 643 module_exit(adiantum_module_exit); 662 module_exit(adiantum_module_exit); 644 663 645 MODULE_DESCRIPTION("Adiantum length-preserving 664 MODULE_DESCRIPTION("Adiantum length-preserving encryption mode"); 646 MODULE_LICENSE("GPL v2"); 665 MODULE_LICENSE("GPL v2"); 647 MODULE_AUTHOR("Eric Biggers <ebiggers@google.c 666 MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>"); 648 MODULE_ALIAS_CRYPTO("adiantum"); 667 MODULE_ALIAS_CRYPTO("adiantum"); 649 MODULE_IMPORT_NS(CRYPTO_INTERNAL); << 650 668
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.