1 /* FCrypt encryption algorithm 1
2 *
3 * Copyright (C) 2006 Red Hat, Inc. All Rights
4 * Written by David Howells (dhowells@redhat.c
5 *
6 * This program is free software; you can redi
7 * modify it under the terms of the GNU Genera
8 * as published by the Free Software Foundatio
9 * 2 of the License, or (at your option) any l
10 *
11 * Based on code:
12 *
13 * Copyright (c) 1995 - 2000 Kungliga Tekniska
14 * (Royal Institute of Technology, Stockholm,
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary
18 * modification, are permitted provided that t
19 * are met:
20 *
21 * 1. Redistributions of source code must reta
22 * notice, this list of conditions and the
23 *
24 * 2. Redistributions in binary form must repr
25 * notice, this list of conditions and the
26 * documentation and/or other materials pro
27 *
28 * 3. Neither the name of the Institute nor th
29 * may be used to endorse or promote produc
30 * without specific prior written permissio
31 *
32 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE
33 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDIN
34 * IMPLIED WARRANTIES OF MERCHANTABILITY AND F
35 * ARE DISCLAIMED. IN NO EVENT SHALL THE INST
36 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECI
37 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PRO
38 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
39 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILI
40 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
41 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF AD
42 * SUCH DAMAGE.
43 */
44
45 #include <asm/byteorder.h>
46 #include <crypto/algapi.h>
47 #include <linux/bitops.h>
48 #include <linux/init.h>
49 #include <linux/module.h>
50
51 #define ROUNDS 16
52
53 struct fcrypt_ctx {
54 __be32 sched[ROUNDS];
55 };
56
57 /* Rotate right two 32 bit numbers as a 56 bit
58 #define ror56(hi, lo, n)
59 do {
60 u32 t = lo & ((1 << n) - 1);
61 lo = (lo >> n) | ((hi & ((1 << n) - 1)
62 hi = (hi >> n) | (t << (24-n));
63 } while (0)
64
65 /* Rotate right one 64 bit number as a 56 bit
66 #define ror56_64(k, n) (k = (k >> n) | ((k & (
67
68 /*
69 * Sboxes for Feistel network derived from
70 * /afs/transarc.com/public/afsps/afs.rel31b.e
71 */
72 #undef Z
73 #define Z(x) cpu_to_be32(x << 3)
74 static const __be32 sbox0[256] = {
75 Z(0xea), Z(0x7f), Z(0xb2), Z(0x64), Z(
76 Z(0xcd), Z(0x86), Z(0x86), Z(0x91), Z(
77 Z(0x0e), Z(0x06), Z(0xd2), Z(0x65), Z(
78 Z(0xf2), Z(0x20), Z(0xb5), Z(0x38), Z(
79 Z(0xd2), Z(0xcf), Z(0xc4), Z(0x3c), Z(
80 Z(0x35), Z(0xac), Z(0xaa), Z(0x5f), Z(
81 Z(0x4e), Z(0x9d), Z(0x78), Z(0xa3), Z(
82 Z(0xc6), Z(0x6f), Z(0x66), Z(0xd6), Z(
83 Z(0x3b), Z(0x95), Z(0xe8), Z(0x34), Z(
84 Z(0x9c), Z(0xf3), Z(0xec), Z(0xda), Z(
85 Z(0x3e), Z(0x55), Z(0x4d), Z(0xde), Z(
86 Z(0xf1), Z(0x6b), Z(0x3d), Z(0xd3), Z(
87 Z(0x0b), Z(0x8a), Z(0x83), Z(0xba), Z(
88 Z(0xb1), Z(0xd4), Z(0x01), Z(0xd8), Z(
89 Z(0xd2), Z(0xc3), Z(0xa7), Z(0x75), Z(
90 Z(0x10), Z(0x4e), Z(0xb7), Z(0xc6), Z(
91 Z(0x3d), Z(0xe5), Z(0xb3), Z(0x5b), Z(
92 Z(0xfa), Z(0x5a), Z(0x1e), Z(0x33), Z(
93 Z(0xe7), Z(0xa8), Z(0x45), Z(0xa4), Z(
94 Z(0xb6), Z(0x69), Z(0x7e), Z(0x2e), Z(
95 Z(0x17), Z(0xbb), Z(0xc7), Z(0xf3), Z(
96 Z(0x8e), Z(0x97), Z(0x65), Z(0x60), Z(
97 Z(0x6e), Z(0xe0), Z(0x81), Z(0x59), Z(
98 Z(0x22), Z(0x99), Z(0xfd), Z(0x63), Z(
99 Z(0xb6), Z(0x5b), Z(0xae), Z(0x54), Z(
100 Z(0x3b), Z(0x3e), Z(0xc1), Z(0xd7), Z(
101 Z(0x36), Z(0x4f), Z(0x59), Z(0xc7), Z(
102 Z(0x93), Z(0xc4), Z(0xaa), Z(0x26), Z(
103 Z(0x07), Z(0x9f), Z(0x64), Z(0x81), Z(
104 Z(0x43), Z(0xf8), Z(0xb6), Z(0xb9), Z(
105 Z(0xe4), Z(0xb0), Z(0x99), Z(0x46), Z(
106 Z(0x72), Z(0x12), Z(0xf6), Z(0xba), Z(
107 };
108
109 #undef Z
110 #define Z(x) cpu_to_be32(((x & 0x1f) << 27) |
111 static const __be32 sbox1[256] = {
112 Z(0x77), Z(0x14), Z(0xa6), Z(0xfe), Z(
113 Z(0x67), Z(0x6c), Z(0xa1), Z(0x0d), Z(
114 Z(0x6c), Z(0x7b), Z(0x67), Z(0xc6), Z(
115 Z(0x50), Z(0x9c), Z(0x03), Z(0xb7), Z(
116 Z(0x31), Z(0x2c), Z(0x27), Z(0x9f), Z(
117 Z(0x23), Z(0x83), Z(0x98), Z(0x7d), Z(
118 Z(0x1c), Z(0x1f), Z(0x8c), Z(0x20), Z(
119 Z(0xf4), Z(0xfa), Z(0x95), Z(0xca), Z(
120 Z(0xb8), Z(0xa1), Z(0xa1), Z(0xbe), Z(
121 Z(0x16), Z(0x74), Z(0x31), Z(0x8a), Z(
122 Z(0x79), Z(0x84), Z(0xb1), Z(0xf5), Z(
123 Z(0xaa), Z(0x0c), Z(0x60), Z(0x6b), Z(
124 Z(0xe2), Z(0xaf), Z(0x45), Z(0x73), Z(
125 Z(0x00), Z(0x92), Z(0x7d), Z(0x97), Z(
126 Z(0xcf), Z(0x5b), Z(0xde), Z(0xc6), Z(
127 Z(0x06), Z(0xda), Z(0x08), Z(0x15), Z(
128 Z(0x89), Z(0xd0), Z(0xa9), Z(0xc1), Z(
129 Z(0x43), Z(0xf4), Z(0x68), Z(0xc8), Z(
130 Z(0x52), Z(0x66), Z(0xa3), Z(0xca), Z(
131 Z(0x31), Z(0xf7), Z(0x88), Z(0x94), Z(
132 Z(0x24), Z(0x66), Z(0xfc), Z(0xb3), Z(
133 Z(0x44), Z(0xc4), Z(0xe0), Z(0x8f), Z(
134 Z(0xf5), Z(0x1e), Z(0xf4), Z(0xcb), Z(
135 Z(0x69), Z(0x10), Z(0x9d), Z(0xd3), Z(
136 Z(0x05), Z(0x5e), Z(0x32), Z(0xc0), Z(
137 Z(0x8b), Z(0x5b), Z(0xfd), Z(0xbc), Z(
138 Z(0xef), Z(0x70), Z(0xcf), Z(0xc2), Z(
139 Z(0x80), Z(0x48), Z(0x81), Z(0xb7), Z(
140 Z(0x45), Z(0xf0), Z(0xd8), Z(0x8a), Z(
141 Z(0x79), Z(0xc7), Z(0x34), Z(0xd6), Z(
142 Z(0x16), Z(0x06), Z(0xda), Z(0x92), Z(
143 Z(0x70), Z(0x03), Z(0xe0), Z(0x2f), Z(
144 };
145
146 #undef Z
147 #define Z(x) cpu_to_be32(x << 11)
148 static const __be32 sbox2[256] = {
149 Z(0xf0), Z(0x37), Z(0x24), Z(0x53), Z(
150 Z(0xd1), Z(0xec), Z(0x50), Z(0xf0), Z(
151 Z(0xbf), Z(0x80), Z(0x87), Z(0x27), Z(
152 Z(0xf9), Z(0x6f), Z(0xdb), Z(0xb4), Z(
153 Z(0xc8), Z(0x1a), Z(0xbb), Z(0x49), Z(
154 Z(0xe8), Z(0xdc), Z(0xb7), Z(0xd9), Z(
155 Z(0x59), Z(0x9d), Z(0x6b), Z(0xbd), Z(
156 Z(0xbc), Z(0x74), Z(0xa6), Z(0xf6), Z(
157 Z(0x84), Z(0xbc), Z(0xa9), Z(0xfd), Z(
158 Z(0x13), Z(0x5e), Z(0x07), Z(0xb8), Z(
159 Z(0x6a), Z(0x1a), Z(0x85), Z(0xbd), Z(
160 Z(0x3f), Z(0x09), Z(0xa3), Z(0x8d), Z(
161 Z(0x6d), Z(0x1c), Z(0x6c), Z(0x01), Z(
162 Z(0x8b), Z(0x6b), Z(0xbe), Z(0x29), Z(
163 Z(0xcd), Z(0xb3), Z(0xbd), Z(0x35), Z(
164 Z(0x2a), Z(0x79), Z(0x5a), Z(0xa5), Z(
165 Z(0x2c), Z(0xd0), Z(0x22), Z(0x4b), Z(
166 Z(0xc0), Z(0x30), Z(0x9f), Z(0x73), Z(
167 Z(0x07), Z(0x2d), Z(0x8f), Z(0x80), Z(
168 Z(0xb7), Z(0x5e), Z(0xac), Z(0x24), Z(
169 Z(0x05), Z(0xe8), Z(0x02), Z(0x77), Z(
170 Z(0x89), Z(0xd1), Z(0xea), Z(0xde), Z(
171 Z(0x6c), Z(0x3e), Z(0x95), Z(0xdd), Z(
172 Z(0xdc), Z(0xff), Z(0xfd), Z(0x62), Z(
173 Z(0xec), Z(0x8e), Z(0x19), Z(0x18), Z(
174 Z(0x74), Z(0x54), Z(0x1e), Z(0x04), Z(
175 Z(0x56), Z(0xe7), Z(0x3a), Z(0x56), Z(
176 Z(0xf3), Z(0x8e), Z(0xde), Z(0xae), Z(
177 Z(0xc8), Z(0xf4), Z(0x1f), Z(0xe0), Z(
178 Z(0x34), Z(0x0e), Z(0xb5), Z(0xe0), Z(
179 Z(0x56), Z(0x68), Z(0x77), Z(0xa5), Z(
180 Z(0x8c), Z(0x8a), Z(0x73), Z(0x80), Z(
181 };
182
183 #undef Z
184 #define Z(x) cpu_to_be32(x << 19)
185 static const __be32 sbox3[256] = {
186 Z(0xa9), Z(0x2a), Z(0x48), Z(0x51), Z(
187 Z(0xb5), Z(0xb7), Z(0x42), Z(0x33), Z(
188 Z(0x44), Z(0x48), Z(0x6d), Z(0x28), Z(
189 Z(0xd6), Z(0x6b), Z(0x5d), Z(0x72), Z(
190 Z(0x53), Z(0x80), Z(0x24), Z(0x70), Z(
191 Z(0xa1), Z(0x01), Z(0xa5), Z(0x41), Z(
192 Z(0xf1), Z(0x14), Z(0xcf), Z(0x53), Z(
193 Z(0x2a), Z(0x7d), Z(0xd2), Z(0xbf), Z(
194 Z(0x47), Z(0xf6), Z(0x51), Z(0x36), Z(
195 Z(0xa7), Z(0xdf), Z(0x29), Z(0x43), Z(
196 Z(0xbf), Z(0xd4), Z(0x0b), Z(0x53), Z(
197 Z(0xa1), Z(0x18), Z(0x68), Z(0x4f), Z(
198 Z(0x2a), Z(0x41), Z(0xb2), Z(0x42), Z(
199 Z(0x13), Z(0x3a), Z(0x3c), Z(0x6e), Z(
200 Z(0x85), Z(0xe9), Z(0x64), Z(0x02), Z(
201 Z(0x96), Z(0xdf), Z(0xbe), Z(0xf2), Z(
202 Z(0x5a), Z(0x83), Z(0xbf), Z(0x92), Z(
203 Z(0xcf), Z(0x4b), Z(0x00), Z(0x75), Z(
204 Z(0x5d), Z(0x3a), Z(0x4d), Z(0x09), Z(
205 Z(0x17), Z(0xe4), Z(0x01), Z(0x1d), Z(
206 Z(0x82), Z(0x4c), Z(0x9d), Z(0x2f), Z(
207 Z(0x10), Z(0xcd), Z(0x59), Z(0x89), Z(
208 Z(0xc8), Z(0x84), Z(0xfa), Z(0xc7), Z(
209 Z(0x19), Z(0xf1), Z(0xa1), Z(0x3b), Z(
210 Z(0x98), Z(0x8d), Z(0x0b), Z(0x23), Z(
211 Z(0xdf), Z(0x13), Z(0xa0), Z(0xa8), Z(
212 Z(0x47), Z(0x13), Z(0x13), Z(0x52), Z(
213 Z(0x3d), Z(0xa2), Z(0x54), Z(0xbd), Z(
214 Z(0x05), Z(0x28), Z(0xf1), Z(0x16), Z(
215 Z(0xd3), Z(0xb7), Z(0x95), Z(0x49), Z(
216 Z(0xd8), Z(0xe1), Z(0x73), Z(0xdb), Z(
217 Z(0xa1), Z(0xc2), Z(0xc5), Z(0xe3), Z(
218 };
219
220 /*
221 * This is a 16 round Feistel network with per
222 */
223 #define F_ENCRYPT(R, L, sched)
224 do {
225 union lc4 { __be32 l; u8 c[4]; } u;
226 u.l = sched ^ R;
227 L ^= sbox0[u.c[0]] ^ sbox1[u.c[1]] ^ s
228 } while (0)
229
230 /*
231 * encryptor
232 */
233 static void fcrypt_encrypt(struct crypto_tfm *
234 {
235 const struct fcrypt_ctx *ctx = crypto_
236 struct {
237 __be32 l, r;
238 } X;
239
240 memcpy(&X, src, sizeof(X));
241
242 F_ENCRYPT(X.r, X.l, ctx->sched[0x0]);
243 F_ENCRYPT(X.l, X.r, ctx->sched[0x1]);
244 F_ENCRYPT(X.r, X.l, ctx->sched[0x2]);
245 F_ENCRYPT(X.l, X.r, ctx->sched[0x3]);
246 F_ENCRYPT(X.r, X.l, ctx->sched[0x4]);
247 F_ENCRYPT(X.l, X.r, ctx->sched[0x5]);
248 F_ENCRYPT(X.r, X.l, ctx->sched[0x6]);
249 F_ENCRYPT(X.l, X.r, ctx->sched[0x7]);
250 F_ENCRYPT(X.r, X.l, ctx->sched[0x8]);
251 F_ENCRYPT(X.l, X.r, ctx->sched[0x9]);
252 F_ENCRYPT(X.r, X.l, ctx->sched[0xa]);
253 F_ENCRYPT(X.l, X.r, ctx->sched[0xb]);
254 F_ENCRYPT(X.r, X.l, ctx->sched[0xc]);
255 F_ENCRYPT(X.l, X.r, ctx->sched[0xd]);
256 F_ENCRYPT(X.r, X.l, ctx->sched[0xe]);
257 F_ENCRYPT(X.l, X.r, ctx->sched[0xf]);
258
259 memcpy(dst, &X, sizeof(X));
260 }
261
262 /*
263 * decryptor
264 */
265 static void fcrypt_decrypt(struct crypto_tfm *
266 {
267 const struct fcrypt_ctx *ctx = crypto_
268 struct {
269 __be32 l, r;
270 } X;
271
272 memcpy(&X, src, sizeof(X));
273
274 F_ENCRYPT(X.l, X.r, ctx->sched[0xf]);
275 F_ENCRYPT(X.r, X.l, ctx->sched[0xe]);
276 F_ENCRYPT(X.l, X.r, ctx->sched[0xd]);
277 F_ENCRYPT(X.r, X.l, ctx->sched[0xc]);
278 F_ENCRYPT(X.l, X.r, ctx->sched[0xb]);
279 F_ENCRYPT(X.r, X.l, ctx->sched[0xa]);
280 F_ENCRYPT(X.l, X.r, ctx->sched[0x9]);
281 F_ENCRYPT(X.r, X.l, ctx->sched[0x8]);
282 F_ENCRYPT(X.l, X.r, ctx->sched[0x7]);
283 F_ENCRYPT(X.r, X.l, ctx->sched[0x6]);
284 F_ENCRYPT(X.l, X.r, ctx->sched[0x5]);
285 F_ENCRYPT(X.r, X.l, ctx->sched[0x4]);
286 F_ENCRYPT(X.l, X.r, ctx->sched[0x3]);
287 F_ENCRYPT(X.r, X.l, ctx->sched[0x2]);
288 F_ENCRYPT(X.l, X.r, ctx->sched[0x1]);
289 F_ENCRYPT(X.r, X.l, ctx->sched[0x0]);
290
291 memcpy(dst, &X, sizeof(X));
292 }
293
294 /*
295 * Generate a key schedule from key, the least
296 * is parity and shall be ignored. This leaves
297 * to scatter over the 16 key schedules. For e
298 * order 32 bits and use as schedule, then rot
299 */
300 static int fcrypt_setkey(struct crypto_tfm *tf
301 {
302 struct fcrypt_ctx *ctx = crypto_tfm_ct
303
304 #if BITS_PER_LONG == 64 /* the 64-bit version
305 * kernels - it seems
306 * larger */
307
308 u64 k; /* k holds all 56 non-parity b
309
310 /* discard the parity bits */
311 k = (*key++) >> 1;
312 k <<= 7;
313 k |= (*key++) >> 1;
314 k <<= 7;
315 k |= (*key++) >> 1;
316 k <<= 7;
317 k |= (*key++) >> 1;
318 k <<= 7;
319 k |= (*key++) >> 1;
320 k <<= 7;
321 k |= (*key++) >> 1;
322 k <<= 7;
323 k |= (*key++) >> 1;
324 k <<= 7;
325 k |= (*key) >> 1;
326
327 /* Use lower 32 bits for schedule, rot
328 ctx->sched[0x0] = cpu_to_be32(k); ror5
329 ctx->sched[0x1] = cpu_to_be32(k); ror5
330 ctx->sched[0x2] = cpu_to_be32(k); ror5
331 ctx->sched[0x3] = cpu_to_be32(k); ror5
332 ctx->sched[0x4] = cpu_to_be32(k); ror5
333 ctx->sched[0x5] = cpu_to_be32(k); ror5
334 ctx->sched[0x6] = cpu_to_be32(k); ror5
335 ctx->sched[0x7] = cpu_to_be32(k); ror5
336 ctx->sched[0x8] = cpu_to_be32(k); ror5
337 ctx->sched[0x9] = cpu_to_be32(k); ror5
338 ctx->sched[0xa] = cpu_to_be32(k); ror5
339 ctx->sched[0xb] = cpu_to_be32(k); ror5
340 ctx->sched[0xc] = cpu_to_be32(k); ror5
341 ctx->sched[0xd] = cpu_to_be32(k); ror5
342 ctx->sched[0xe] = cpu_to_be32(k); ror5
343 ctx->sched[0xf] = cpu_to_be32(k);
344
345 return 0;
346 #else
347 u32 hi, lo; /* hi is upper
348
349 /* discard the parity bits */
350 lo = (*key++) >> 1;
351 lo <<= 7;
352 lo |= (*key++) >> 1;
353 lo <<= 7;
354 lo |= (*key++) >> 1;
355 lo <<= 7;
356 lo |= (*key++) >> 1;
357 hi = lo >> 4;
358 lo &= 0xf;
359 lo <<= 7;
360 lo |= (*key++) >> 1;
361 lo <<= 7;
362 lo |= (*key++) >> 1;
363 lo <<= 7;
364 lo |= (*key++) >> 1;
365 lo <<= 7;
366 lo |= (*key) >> 1;
367
368 /* Use lower 32 bits for schedule, rot
369 ctx->sched[0x0] = cpu_to_be32(lo); ror
370 ctx->sched[0x1] = cpu_to_be32(lo); ror
371 ctx->sched[0x2] = cpu_to_be32(lo); ror
372 ctx->sched[0x3] = cpu_to_be32(lo); ror
373 ctx->sched[0x4] = cpu_to_be32(lo); ror
374 ctx->sched[0x5] = cpu_to_be32(lo); ror
375 ctx->sched[0x6] = cpu_to_be32(lo); ror
376 ctx->sched[0x7] = cpu_to_be32(lo); ror
377 ctx->sched[0x8] = cpu_to_be32(lo); ror
378 ctx->sched[0x9] = cpu_to_be32(lo); ror
379 ctx->sched[0xa] = cpu_to_be32(lo); ror
380 ctx->sched[0xb] = cpu_to_be32(lo); ror
381 ctx->sched[0xc] = cpu_to_be32(lo); ror
382 ctx->sched[0xd] = cpu_to_be32(lo); ror
383 ctx->sched[0xe] = cpu_to_be32(lo); ror
384 ctx->sched[0xf] = cpu_to_be32(lo);
385 return 0;
386 #endif
387 }
388
389 static struct crypto_alg fcrypt_alg = {
390 .cra_name = "fcryp
391 .cra_driver_name = "fcryp
392 .cra_flags = CRYPTO
393 .cra_blocksize = 8,
394 .cra_ctxsize = sizeof
395 .cra_module = THIS_M
396 .cra_u = { .cip
397 .cia_min_keysize = 8,
398 .cia_max_keysize = 8,
399 .cia_setkey = fcrypt
400 .cia_encrypt = fcrypt
401 .cia_decrypt = fcrypt
402 };
403
404 static int __init fcrypt_mod_init(void)
405 {
406 return crypto_register_alg(&fcrypt_alg
407 }
408
409 static void __exit fcrypt_mod_fini(void)
410 {
411 crypto_unregister_alg(&fcrypt_alg);
412 }
413
414 subsys_initcall(fcrypt_mod_init);
415 module_exit(fcrypt_mod_fini);
416
417 MODULE_LICENSE("Dual BSD/GPL");
418 MODULE_DESCRIPTION("FCrypt Cipher Algorithm");
419 MODULE_AUTHOR("David Howells <dhowells@redhat.
420 MODULE_ALIAS_CRYPTO("fcrypt");
421
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.