1 // SPDX-License-Identifier: GPL-2.0-or-later 1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* 2 /*
3 * Cryptographic API. 3 * Cryptographic API.
4 * 4 *
5 * ARIA Cipher Algorithm. 5 * ARIA Cipher Algorithm.
6 * 6 *
7 * Documentation of ARIA can be found in RFC 5 7 * Documentation of ARIA can be found in RFC 5794.
8 * Copyright (c) 2022 Taehee Yoo <ap420073@gma 8 * Copyright (c) 2022 Taehee Yoo <ap420073@gmail.com>
9 * 9 *
10 * Information for ARIA 10 * Information for ARIA
11 * http://210.104.33.10/ARIA/index-e.html 11 * http://210.104.33.10/ARIA/index-e.html (English)
12 * http://seed.kisa.or.kr/ (Korean) 12 * http://seed.kisa.or.kr/ (Korean)
13 * 13 *
14 * Public domain version is distributed above. 14 * Public domain version is distributed above.
15 */ 15 */
16 16
17 #include <crypto/aria.h> 17 #include <crypto/aria.h>
18 18
19 static const u32 key_rc[20] = { 19 static const u32 key_rc[20] = {
20 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0x 20 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
21 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0x 21 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0,
22 0xdb92371d, 0x2126e970, 0x03249775, 0x 22 0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e,
23 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0x 23 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
24 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0x 24 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0
25 }; 25 };
26 26
27 static void aria_set_encrypt_key(struct aria_c 27 static void aria_set_encrypt_key(struct aria_ctx *ctx, const u8 *in_key,
28 unsigned int 28 unsigned int key_len)
29 { 29 {
30 const __be32 *key = (const __be32 *)in 30 const __be32 *key = (const __be32 *)in_key;
31 u32 w0[4], w1[4], w2[4], w3[4]; 31 u32 w0[4], w1[4], w2[4], w3[4];
32 u32 reg0, reg1, reg2, reg3; 32 u32 reg0, reg1, reg2, reg3;
33 const u32 *ck; 33 const u32 *ck;
34 int rkidx = 0; 34 int rkidx = 0;
35 35
36 ck = &key_rc[(key_len - 16) / 2]; 36 ck = &key_rc[(key_len - 16) / 2];
37 37
38 w0[0] = be32_to_cpu(key[0]); 38 w0[0] = be32_to_cpu(key[0]);
39 w0[1] = be32_to_cpu(key[1]); 39 w0[1] = be32_to_cpu(key[1]);
40 w0[2] = be32_to_cpu(key[2]); 40 w0[2] = be32_to_cpu(key[2]);
41 w0[3] = be32_to_cpu(key[3]); 41 w0[3] = be32_to_cpu(key[3]);
42 42
43 reg0 = w0[0] ^ ck[0]; 43 reg0 = w0[0] ^ ck[0];
44 reg1 = w0[1] ^ ck[1]; 44 reg1 = w0[1] ^ ck[1];
45 reg2 = w0[2] ^ ck[2]; 45 reg2 = w0[2] ^ ck[2];
46 reg3 = w0[3] ^ ck[3]; 46 reg3 = w0[3] ^ ck[3];
47 47
48 aria_subst_diff_odd(®0, ®1, ® 48 aria_subst_diff_odd(®0, ®1, ®2, ®3);
49 49
50 if (key_len > 16) { 50 if (key_len > 16) {
51 w1[0] = be32_to_cpu(key[4]); 51 w1[0] = be32_to_cpu(key[4]);
52 w1[1] = be32_to_cpu(key[5]); 52 w1[1] = be32_to_cpu(key[5]);
53 if (key_len > 24) { 53 if (key_len > 24) {
54 w1[2] = be32_to_cpu(ke 54 w1[2] = be32_to_cpu(key[6]);
55 w1[3] = be32_to_cpu(ke 55 w1[3] = be32_to_cpu(key[7]);
56 } else { 56 } else {
57 w1[2] = 0; 57 w1[2] = 0;
58 w1[3] = 0; 58 w1[3] = 0;
59 } 59 }
60 } else { 60 } else {
61 w1[0] = 0; 61 w1[0] = 0;
62 w1[1] = 0; 62 w1[1] = 0;
63 w1[2] = 0; 63 w1[2] = 0;
64 w1[3] = 0; 64 w1[3] = 0;
65 } 65 }
66 66
67 w1[0] ^= reg0; 67 w1[0] ^= reg0;
68 w1[1] ^= reg1; 68 w1[1] ^= reg1;
69 w1[2] ^= reg2; 69 w1[2] ^= reg2;
70 w1[3] ^= reg3; 70 w1[3] ^= reg3;
71 71
72 reg0 = w1[0]; 72 reg0 = w1[0];
73 reg1 = w1[1]; 73 reg1 = w1[1];
74 reg2 = w1[2]; 74 reg2 = w1[2];
75 reg3 = w1[3]; 75 reg3 = w1[3];
76 76
77 reg0 ^= ck[4]; 77 reg0 ^= ck[4];
78 reg1 ^= ck[5]; 78 reg1 ^= ck[5];
79 reg2 ^= ck[6]; 79 reg2 ^= ck[6];
80 reg3 ^= ck[7]; 80 reg3 ^= ck[7];
81 81
82 aria_subst_diff_even(®0, ®1, &re 82 aria_subst_diff_even(®0, ®1, ®2, ®3);
83 83
84 reg0 ^= w0[0]; 84 reg0 ^= w0[0];
85 reg1 ^= w0[1]; 85 reg1 ^= w0[1];
86 reg2 ^= w0[2]; 86 reg2 ^= w0[2];
87 reg3 ^= w0[3]; 87 reg3 ^= w0[3];
88 88
89 w2[0] = reg0; 89 w2[0] = reg0;
90 w2[1] = reg1; 90 w2[1] = reg1;
91 w2[2] = reg2; 91 w2[2] = reg2;
92 w2[3] = reg3; 92 w2[3] = reg3;
93 93
94 reg0 ^= ck[8]; 94 reg0 ^= ck[8];
95 reg1 ^= ck[9]; 95 reg1 ^= ck[9];
96 reg2 ^= ck[10]; 96 reg2 ^= ck[10];
97 reg3 ^= ck[11]; 97 reg3 ^= ck[11];
98 98
99 aria_subst_diff_odd(®0, ®1, ® 99 aria_subst_diff_odd(®0, ®1, ®2, ®3);
100 100
101 w3[0] = reg0 ^ w1[0]; 101 w3[0] = reg0 ^ w1[0];
102 w3[1] = reg1 ^ w1[1]; 102 w3[1] = reg1 ^ w1[1];
103 w3[2] = reg2 ^ w1[2]; 103 w3[2] = reg2 ^ w1[2];
104 w3[3] = reg3 ^ w1[3]; 104 w3[3] = reg3 ^ w1[3];
105 105
106 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 106 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 19);
107 rkidx++; 107 rkidx++;
108 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 108 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 19);
109 rkidx++; 109 rkidx++;
110 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 110 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 19);
111 rkidx++; 111 rkidx++;
112 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 112 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 19);
113 113
114 rkidx++; 114 rkidx++;
115 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 115 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 31);
116 rkidx++; 116 rkidx++;
117 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 117 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 31);
118 rkidx++; 118 rkidx++;
119 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 119 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 31);
120 rkidx++; 120 rkidx++;
121 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 121 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 31);
122 122
123 rkidx++; 123 rkidx++;
124 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 124 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 67);
125 rkidx++; 125 rkidx++;
126 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 126 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 67);
127 rkidx++; 127 rkidx++;
128 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 128 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 67);
129 rkidx++; 129 rkidx++;
130 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 130 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 67);
131 131
132 rkidx++; 132 rkidx++;
133 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 133 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 97);
134 if (key_len > 16) { 134 if (key_len > 16) {
135 rkidx++; 135 rkidx++;
136 aria_gsrk(ctx->enc_key[rkidx], 136 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 97);
137 rkidx++; 137 rkidx++;
138 aria_gsrk(ctx->enc_key[rkidx], 138 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 97);
139 139
140 if (key_len > 24) { 140 if (key_len > 24) {
141 rkidx++; 141 rkidx++;
142 aria_gsrk(ctx->enc_key 142 aria_gsrk(ctx->enc_key[rkidx], w3, w0, 97);
143 143
144 rkidx++; 144 rkidx++;
145 aria_gsrk(ctx->enc_key 145 aria_gsrk(ctx->enc_key[rkidx], w0, w1, 109);
146 } 146 }
147 } 147 }
148 } 148 }
149 149
150 static void aria_set_decrypt_key(struct aria_c 150 static void aria_set_decrypt_key(struct aria_ctx *ctx)
151 { 151 {
152 int i; 152 int i;
153 153
154 for (i = 0; i < 4; i++) { 154 for (i = 0; i < 4; i++) {
155 ctx->dec_key[0][i] = ctx->enc_ 155 ctx->dec_key[0][i] = ctx->enc_key[ctx->rounds][i];
156 ctx->dec_key[ctx->rounds][i] = 156 ctx->dec_key[ctx->rounds][i] = ctx->enc_key[0][i];
157 } 157 }
158 158
159 for (i = 1; i < ctx->rounds; i++) { 159 for (i = 1; i < ctx->rounds; i++) {
160 ctx->dec_key[i][0] = aria_m(ct 160 ctx->dec_key[i][0] = aria_m(ctx->enc_key[ctx->rounds - i][0]);
161 ctx->dec_key[i][1] = aria_m(ct 161 ctx->dec_key[i][1] = aria_m(ctx->enc_key[ctx->rounds - i][1]);
162 ctx->dec_key[i][2] = aria_m(ct 162 ctx->dec_key[i][2] = aria_m(ctx->enc_key[ctx->rounds - i][2]);
163 ctx->dec_key[i][3] = aria_m(ct 163 ctx->dec_key[i][3] = aria_m(ctx->enc_key[ctx->rounds - i][3]);
164 164
165 aria_diff_word(&ctx->dec_key[i 165 aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
166 &ctx->dec_key[i 166 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
167 aria_diff_byte(&ctx->dec_key[i 167 aria_diff_byte(&ctx->dec_key[i][1],
168 &ctx->dec_key[i 168 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
169 aria_diff_word(&ctx->dec_key[i 169 aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
170 &ctx->dec_key[i 170 &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
171 } 171 }
172 } 172 }
173 173
174 int aria_set_key(struct crypto_tfm *tfm, const 174 int aria_set_key(struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
175 { 175 {
176 struct aria_ctx *ctx = crypto_tfm_ctx( 176 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
177 177
178 if (key_len != 16 && key_len != 24 && 178 if (key_len != 16 && key_len != 24 && key_len != 32)
179 return -EINVAL; 179 return -EINVAL;
180 180
181 BUILD_BUG_ON(sizeof(ctx->enc_key) != 2 181 BUILD_BUG_ON(sizeof(ctx->enc_key) != 272);
182 BUILD_BUG_ON(sizeof(ctx->dec_key) != 2 182 BUILD_BUG_ON(sizeof(ctx->dec_key) != 272);
183 BUILD_BUG_ON(sizeof(int) != sizeof(ctx 183 BUILD_BUG_ON(sizeof(int) != sizeof(ctx->rounds));
184 184
185 ctx->key_length = key_len; 185 ctx->key_length = key_len;
186 ctx->rounds = (key_len + 32) / 4; 186 ctx->rounds = (key_len + 32) / 4;
187 187
188 aria_set_encrypt_key(ctx, in_key, key_ 188 aria_set_encrypt_key(ctx, in_key, key_len);
189 aria_set_decrypt_key(ctx); 189 aria_set_decrypt_key(ctx);
190 190
191 return 0; 191 return 0;
192 } 192 }
193 EXPORT_SYMBOL_GPL(aria_set_key); 193 EXPORT_SYMBOL_GPL(aria_set_key);
194 194
195 static void __aria_crypt(struct aria_ctx *ctx, 195 static void __aria_crypt(struct aria_ctx *ctx, u8 *out, const u8 *in,
196 u32 key[][ARIA_RD_KEY 196 u32 key[][ARIA_RD_KEY_WORDS])
197 { 197 {
198 const __be32 *src = (const __be32 *)in 198 const __be32 *src = (const __be32 *)in;
199 __be32 *dst = (__be32 *)out; 199 __be32 *dst = (__be32 *)out;
200 u32 reg0, reg1, reg2, reg3; 200 u32 reg0, reg1, reg2, reg3;
201 int rounds, rkidx = 0; 201 int rounds, rkidx = 0;
202 202
203 rounds = ctx->rounds; 203 rounds = ctx->rounds;
204 204
205 reg0 = be32_to_cpu(src[0]); 205 reg0 = be32_to_cpu(src[0]);
206 reg1 = be32_to_cpu(src[1]); 206 reg1 = be32_to_cpu(src[1]);
207 reg2 = be32_to_cpu(src[2]); 207 reg2 = be32_to_cpu(src[2]);
208 reg3 = be32_to_cpu(src[3]); 208 reg3 = be32_to_cpu(src[3]);
209 209
210 aria_add_round_key(key[rkidx], ®0, 210 aria_add_round_key(key[rkidx], ®0, ®1, ®2, ®3);
211 rkidx++; 211 rkidx++;
212 212
213 aria_subst_diff_odd(®0, ®1, ® 213 aria_subst_diff_odd(®0, ®1, ®2, ®3);
214 aria_add_round_key(key[rkidx], ®0, 214 aria_add_round_key(key[rkidx], ®0, ®1, ®2, ®3);
215 rkidx++; 215 rkidx++;
216 216
217 while ((rounds -= 2) > 0) { 217 while ((rounds -= 2) > 0) {
218 aria_subst_diff_even(®0, &r 218 aria_subst_diff_even(®0, ®1, ®2, ®3);
219 aria_add_round_key(key[rkidx], 219 aria_add_round_key(key[rkidx], ®0, ®1, ®2, ®3);
220 rkidx++; 220 rkidx++;
221 221
222 aria_subst_diff_odd(®0, &re 222 aria_subst_diff_odd(®0, ®1, ®2, ®3);
223 aria_add_round_key(key[rkidx], 223 aria_add_round_key(key[rkidx], ®0, ®1, ®2, ®3);
224 rkidx++; 224 rkidx++;
225 } 225 }
226 226
227 reg0 = key[rkidx][0] ^ make_u32((u8)(x 227 reg0 = key[rkidx][0] ^ make_u32((u8)(x1[get_u8(reg0, 0)]),
228 (u8)(x 228 (u8)(x2[get_u8(reg0, 1)] >> 8),
229 (u8)(s 229 (u8)(s1[get_u8(reg0, 2)]),
230 (u8)(s 230 (u8)(s2[get_u8(reg0, 3)]));
231 reg1 = key[rkidx][1] ^ make_u32((u8)(x 231 reg1 = key[rkidx][1] ^ make_u32((u8)(x1[get_u8(reg1, 0)]),
232 (u8)(x 232 (u8)(x2[get_u8(reg1, 1)] >> 8),
233 (u8)(s 233 (u8)(s1[get_u8(reg1, 2)]),
234 (u8)(s 234 (u8)(s2[get_u8(reg1, 3)]));
235 reg2 = key[rkidx][2] ^ make_u32((u8)(x 235 reg2 = key[rkidx][2] ^ make_u32((u8)(x1[get_u8(reg2, 0)]),
236 (u8)(x 236 (u8)(x2[get_u8(reg2, 1)] >> 8),
237 (u8)(s 237 (u8)(s1[get_u8(reg2, 2)]),
238 (u8)(s 238 (u8)(s2[get_u8(reg2, 3)]));
239 reg3 = key[rkidx][3] ^ make_u32((u8)(x 239 reg3 = key[rkidx][3] ^ make_u32((u8)(x1[get_u8(reg3, 0)]),
240 (u8)(x 240 (u8)(x2[get_u8(reg3, 1)] >> 8),
241 (u8)(s 241 (u8)(s1[get_u8(reg3, 2)]),
242 (u8)(s 242 (u8)(s2[get_u8(reg3, 3)]));
243 243
244 dst[0] = cpu_to_be32(reg0); 244 dst[0] = cpu_to_be32(reg0);
245 dst[1] = cpu_to_be32(reg1); 245 dst[1] = cpu_to_be32(reg1);
246 dst[2] = cpu_to_be32(reg2); 246 dst[2] = cpu_to_be32(reg2);
247 dst[3] = cpu_to_be32(reg3); 247 dst[3] = cpu_to_be32(reg3);
248 } 248 }
249 249
250 void aria_encrypt(void *_ctx, u8 *out, const u 250 void aria_encrypt(void *_ctx, u8 *out, const u8 *in)
251 { 251 {
252 struct aria_ctx *ctx = (struct aria_ct 252 struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
253 253
254 __aria_crypt(ctx, out, in, ctx->enc_ke 254 __aria_crypt(ctx, out, in, ctx->enc_key);
255 } 255 }
256 EXPORT_SYMBOL_GPL(aria_encrypt); 256 EXPORT_SYMBOL_GPL(aria_encrypt);
257 257
258 void aria_decrypt(void *_ctx, u8 *out, const u 258 void aria_decrypt(void *_ctx, u8 *out, const u8 *in)
259 { 259 {
260 struct aria_ctx *ctx = (struct aria_ct 260 struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
261 261
262 __aria_crypt(ctx, out, in, ctx->dec_ke 262 __aria_crypt(ctx, out, in, ctx->dec_key);
263 } 263 }
264 EXPORT_SYMBOL_GPL(aria_decrypt); 264 EXPORT_SYMBOL_GPL(aria_decrypt);
265 265
266 static void __aria_encrypt(struct crypto_tfm * 266 static void __aria_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
267 { 267 {
268 struct aria_ctx *ctx = crypto_tfm_ctx( 268 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
269 269
270 __aria_crypt(ctx, out, in, ctx->enc_ke 270 __aria_crypt(ctx, out, in, ctx->enc_key);
271 } 271 }
272 272
273 static void __aria_decrypt(struct crypto_tfm * 273 static void __aria_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
274 { 274 {
275 struct aria_ctx *ctx = crypto_tfm_ctx( 275 struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
276 276
277 __aria_crypt(ctx, out, in, ctx->dec_ke 277 __aria_crypt(ctx, out, in, ctx->dec_key);
278 } 278 }
279 279
280 static struct crypto_alg aria_alg = { 280 static struct crypto_alg aria_alg = {
281 .cra_name = "aria" 281 .cra_name = "aria",
282 .cra_driver_name = "aria- 282 .cra_driver_name = "aria-generic",
283 .cra_priority = 100, 283 .cra_priority = 100,
284 .cra_flags = CRYPTO 284 .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
285 .cra_blocksize = ARIA_B 285 .cra_blocksize = ARIA_BLOCK_SIZE,
286 .cra_ctxsize = sizeof 286 .cra_ctxsize = sizeof(struct aria_ctx),
287 .cra_alignmask = 3, 287 .cra_alignmask = 3,
288 .cra_module = THIS_M 288 .cra_module = THIS_MODULE,
289 .cra_u = { 289 .cra_u = {
290 .cipher = { 290 .cipher = {
291 .cia_min_keysize 291 .cia_min_keysize = ARIA_MIN_KEY_SIZE,
292 .cia_max_keysize 292 .cia_max_keysize = ARIA_MAX_KEY_SIZE,
293 .cia_setkey 293 .cia_setkey = aria_set_key,
294 .cia_encrypt 294 .cia_encrypt = __aria_encrypt,
295 .cia_decrypt 295 .cia_decrypt = __aria_decrypt
296 } 296 }
297 } 297 }
298 }; 298 };
299 299
300 static int __init aria_init(void) 300 static int __init aria_init(void)
301 { 301 {
302 return crypto_register_alg(&aria_alg); 302 return crypto_register_alg(&aria_alg);
303 } 303 }
304 304
305 static void __exit aria_fini(void) 305 static void __exit aria_fini(void)
306 { 306 {
307 crypto_unregister_alg(&aria_alg); 307 crypto_unregister_alg(&aria_alg);
308 } 308 }
309 309
310 subsys_initcall(aria_init); 310 subsys_initcall(aria_init);
311 module_exit(aria_fini); 311 module_exit(aria_fini);
312 312
313 MODULE_DESCRIPTION("ARIA Cipher Algorithm"); 313 MODULE_DESCRIPTION("ARIA Cipher Algorithm");
314 MODULE_LICENSE("GPL"); 314 MODULE_LICENSE("GPL");
315 MODULE_AUTHOR("Taehee Yoo <ap420073@gmail.com> 315 MODULE_AUTHOR("Taehee Yoo <ap420073@gmail.com>");
316 MODULE_ALIAS_CRYPTO("aria"); 316 MODULE_ALIAS_CRYPTO("aria");
317 MODULE_ALIAS_CRYPTO("aria-generic"); 317 MODULE_ALIAS_CRYPTO("aria-generic");
318 318
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.