Linux-2.6.12-rc2
[linux-3.10.git] / arch / i386 / crypto / aes.c
1 /* 
2  * 
3  * Glue Code for optimized 586 assembler version of AES
4  *
5  * Copyright (c) 2002, Dr Brian Gladman <>, Worcester, UK.
6  * All rights reserved.
7  *
8  * LICENSE TERMS
9  *
10  * The free distribution and use of this software in both source and binary
11  * form is allowed (with or without changes) provided that:
12  *
13  *   1. distributions of this source code include the above copyright
14  *      notice, this list of conditions and the following disclaimer;
15  *
16  *   2. distributions in binary form include the above copyright
17  *      notice, this list of conditions and the following disclaimer
18  *      in the documentation and/or other associated materials;
19  *
20  *   3. the copyright holder's name is not used to endorse products
21  *      built using this software without specific written permission.
22  *
23  * ALTERNATIVELY, provided that this notice is retained in full, this product
24  * may be distributed under the terms of the GNU General Public License (GPL),
25  * in which case the provisions of the GPL apply INSTEAD OF those given above.
26  *
27  * DISCLAIMER
28  *
29  * This software is provided 'as is' with no explicit or implied warranties
30  * in respect of its properties, including, but not limited to, correctness
31  * and/or fitness for purpose.
32  *
33  * Copyright (c) 2003, Adam J. Richter <adam@yggdrasil.com> (conversion to
34  * 2.5 API).
35  * Copyright (c) 2003, 2004 Fruhwirth Clemens <clemens@endorphin.org>
36  * Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
37  *
38  */
39 #include <linux/kernel.h>
40 #include <linux/module.h>
41 #include <linux/init.h>
42 #include <linux/types.h>
43 #include <linux/crypto.h>
44 #include <linux/linkage.h>
45
46 asmlinkage void aes_enc_blk(const u8 *src, u8 *dst, void *ctx);
47 asmlinkage void aes_dec_blk(const u8 *src, u8 *dst, void *ctx);
48
49 #define AES_MIN_KEY_SIZE        16
50 #define AES_MAX_KEY_SIZE        32
51 #define AES_BLOCK_SIZE          16
52 #define AES_KS_LENGTH           4 * AES_BLOCK_SIZE
53 #define RC_LENGTH               29
54
55 struct aes_ctx {
56         u32 ekey[AES_KS_LENGTH];
57         u32 rounds;
58         u32 dkey[AES_KS_LENGTH];
59 };
60
61 #define WPOLY 0x011b
62 #define u32_in(x) le32_to_cpu(*(const u32 *)(x))
63 #define bytes2word(b0, b1, b2, b3)  \
64         (((u32)(b3) << 24) | ((u32)(b2) << 16) | ((u32)(b1) << 8) | (b0))
65
66 /* define the finite field multiplies required for Rijndael */
67 #define f2(x) ((x) ? pow[log[x] + 0x19] : 0)
68 #define f3(x) ((x) ? pow[log[x] + 0x01] : 0)
69 #define f9(x) ((x) ? pow[log[x] + 0xc7] : 0)
70 #define fb(x) ((x) ? pow[log[x] + 0x68] : 0)
71 #define fd(x) ((x) ? pow[log[x] + 0xee] : 0)
72 #define fe(x) ((x) ? pow[log[x] + 0xdf] : 0)
73 #define fi(x) ((x) ?   pow[255 - log[x]]: 0)
74
75 static inline u32 upr(u32 x, int n)
76 {
77         return (x << 8 * n) | (x >> (32 - 8 * n));
78 }
79
80 static inline u8 bval(u32 x, int n)
81 {
82         return x >> 8 * n;
83 }
84
85 /* The forward and inverse affine transformations used in the S-box */
86 #define fwd_affine(x) \
87         (w = (u32)x, w ^= (w<<1)^(w<<2)^(w<<3)^(w<<4), 0x63^(u8)(w^(w>>8)))
88
89 #define inv_affine(x) \
90         (w = (u32)x, w = (w<<1)^(w<<3)^(w<<6), 0x05^(u8)(w^(w>>8)))
91
92 static u32 rcon_tab[RC_LENGTH];
93
94 u32 ft_tab[4][256];
95 u32 fl_tab[4][256];
96 static u32 ls_tab[4][256];
97 static u32 im_tab[4][256];
98 u32 il_tab[4][256];
99 u32 it_tab[4][256];
100
101 static void gen_tabs(void)
102 {
103         u32 i, w;
104         u8 pow[512], log[256];
105
106         /*
107          * log and power tables for GF(2^8) finite field with
108          * WPOLY as modular polynomial - the simplest primitive
109          * root is 0x03, used here to generate the tables.
110          */
111         i = 0; w = 1; 
112         
113         do {
114                 pow[i] = (u8)w;
115                 pow[i + 255] = (u8)w;
116                 log[w] = (u8)i++;
117                 w ^=  (w << 1) ^ (w & 0x80 ? WPOLY : 0);
118         } while (w != 1);
119         
120         for(i = 0, w = 1; i < RC_LENGTH; ++i) {
121                 rcon_tab[i] = bytes2word(w, 0, 0, 0);
122                 w = f2(w);
123         }
124
125         for(i = 0; i < 256; ++i) {
126                 u8 b;
127                 
128                 b = fwd_affine(fi((u8)i));
129                 w = bytes2word(f2(b), b, b, f3(b));
130
131                 /* tables for a normal encryption round */
132                 ft_tab[0][i] = w;
133                 ft_tab[1][i] = upr(w, 1);
134                 ft_tab[2][i] = upr(w, 2);
135                 ft_tab[3][i] = upr(w, 3);
136                 w = bytes2word(b, 0, 0, 0);
137                 
138                 /*
139                  * tables for last encryption round
140                  * (may also be used in the key schedule)
141                  */
142                 fl_tab[0][i] = w;
143                 fl_tab[1][i] = upr(w, 1);
144                 fl_tab[2][i] = upr(w, 2);
145                 fl_tab[3][i] = upr(w, 3);
146                 
147                 /*
148                  * table for key schedule if fl_tab above is
149                  * not of the required form
150                  */
151                 ls_tab[0][i] = w;
152                 ls_tab[1][i] = upr(w, 1);
153                 ls_tab[2][i] = upr(w, 2);
154                 ls_tab[3][i] = upr(w, 3);
155                 
156                 b = fi(inv_affine((u8)i));
157                 w = bytes2word(fe(b), f9(b), fd(b), fb(b));
158
159                 /* tables for the inverse mix column operation  */
160                 im_tab[0][b] = w;
161                 im_tab[1][b] = upr(w, 1);
162                 im_tab[2][b] = upr(w, 2);
163                 im_tab[3][b] = upr(w, 3);
164
165                 /* tables for a normal decryption round */
166                 it_tab[0][i] = w;
167                 it_tab[1][i] = upr(w,1);
168                 it_tab[2][i] = upr(w,2);
169                 it_tab[3][i] = upr(w,3);
170
171                 w = bytes2word(b, 0, 0, 0);
172                 
173                 /* tables for last decryption round */
174                 il_tab[0][i] = w;
175                 il_tab[1][i] = upr(w,1);
176                 il_tab[2][i] = upr(w,2);
177                 il_tab[3][i] = upr(w,3);
178     }
179 }
180
181 #define four_tables(x,tab,vf,rf,c)              \
182 (       tab[0][bval(vf(x,0,c),rf(0,c))] ^       \
183         tab[1][bval(vf(x,1,c),rf(1,c))] ^       \
184         tab[2][bval(vf(x,2,c),rf(2,c))] ^       \
185         tab[3][bval(vf(x,3,c),rf(3,c))]         \
186 )
187
188 #define vf1(x,r,c)  (x)
189 #define rf1(r,c)    (r)
190 #define rf2(r,c)    ((r-c)&3)
191
192 #define inv_mcol(x) four_tables(x,im_tab,vf1,rf1,0)
193 #define ls_box(x,c) four_tables(x,fl_tab,vf1,rf2,c)
194
195 #define ff(x) inv_mcol(x)
196
197 #define ke4(k,i)                                                        \
198 {                                                                       \
199         k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];            \
200         k[4*(i)+5] = ss[1] ^= ss[0];                                    \
201         k[4*(i)+6] = ss[2] ^= ss[1];                                    \
202         k[4*(i)+7] = ss[3] ^= ss[2];                                    \
203 }
204
205 #define kel4(k,i)                                                       \
206 {                                                                       \
207         k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];            \
208         k[4*(i)+5] = ss[1] ^= ss[0];                                    \
209         k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2];       \
210 }
211
212 #define ke6(k,i)                                                        \
213 {                                                                       \
214         k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];           \
215         k[6*(i)+ 7] = ss[1] ^= ss[0];                                   \
216         k[6*(i)+ 8] = ss[2] ^= ss[1];                                   \
217         k[6*(i)+ 9] = ss[3] ^= ss[2];                                   \
218         k[6*(i)+10] = ss[4] ^= ss[3];                                   \
219         k[6*(i)+11] = ss[5] ^= ss[4];                                   \
220 }
221
222 #define kel6(k,i)                                                       \
223 {                                                                       \
224         k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];           \
225         k[6*(i)+ 7] = ss[1] ^= ss[0];                                   \
226         k[6*(i)+ 8] = ss[2] ^= ss[1];                                   \
227         k[6*(i)+ 9] = ss[3] ^= ss[2];                                   \
228 }
229
230 #define ke8(k,i)                                                        \
231 {                                                                       \
232         k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];           \
233         k[8*(i)+ 9] = ss[1] ^= ss[0];                                   \
234         k[8*(i)+10] = ss[2] ^= ss[1];                                   \
235         k[8*(i)+11] = ss[3] ^= ss[2];                                   \
236         k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0);                         \
237         k[8*(i)+13] = ss[5] ^= ss[4];                                   \
238         k[8*(i)+14] = ss[6] ^= ss[5];                                   \
239         k[8*(i)+15] = ss[7] ^= ss[6];                                   \
240 }
241
242 #define kel8(k,i)                                                       \
243 {                                                                       \
244         k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];           \
245         k[8*(i)+ 9] = ss[1] ^= ss[0];                                   \
246         k[8*(i)+10] = ss[2] ^= ss[1];                                   \
247         k[8*(i)+11] = ss[3] ^= ss[2];                                   \
248 }
249
250 #define kdf4(k,i)                                                       \
251 {                                                                       \
252         ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3];                          \
253         ss[1] = ss[1] ^ ss[3];                                          \
254         ss[2] = ss[2] ^ ss[3];                                          \
255         ss[3] = ss[3];                                                  \
256         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
257         ss[i % 4] ^= ss[4];                                             \
258         ss[4] ^= k[4*(i)];                                              \
259         k[4*(i)+4] = ff(ss[4]);                                         \
260         ss[4] ^= k[4*(i)+1];                                            \
261         k[4*(i)+5] = ff(ss[4]);                                         \
262         ss[4] ^= k[4*(i)+2];                                            \
263         k[4*(i)+6] = ff(ss[4]);                                         \
264         ss[4] ^= k[4*(i)+3];                                            \
265         k[4*(i)+7] = ff(ss[4]);                                         \
266 }
267
268 #define kd4(k,i)                                                        \
269 {                                                                       \
270         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
271         ss[i % 4] ^= ss[4];                                             \
272         ss[4] = ff(ss[4]);                                              \
273         k[4*(i)+4] = ss[4] ^= k[4*(i)];                                 \
274         k[4*(i)+5] = ss[4] ^= k[4*(i)+1];                               \
275         k[4*(i)+6] = ss[4] ^= k[4*(i)+2];                               \
276         k[4*(i)+7] = ss[4] ^= k[4*(i)+3];                               \
277 }
278
279 #define kdl4(k,i)                                                       \
280 {                                                                       \
281         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
282         ss[i % 4] ^= ss[4];                                             \
283         k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3];                  \
284         k[4*(i)+5] = ss[1] ^ ss[3];                                     \
285         k[4*(i)+6] = ss[0];                                             \
286         k[4*(i)+7] = ss[1];                                             \
287 }
288
289 #define kdf6(k,i)                                                       \
290 {                                                                       \
291         ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];                         \
292         k[6*(i)+ 6] = ff(ss[0]);                                        \
293         ss[1] ^= ss[0];                                                 \
294         k[6*(i)+ 7] = ff(ss[1]);                                        \
295         ss[2] ^= ss[1];                                                 \
296         k[6*(i)+ 8] = ff(ss[2]);                                        \
297         ss[3] ^= ss[2];                                                 \
298         k[6*(i)+ 9] = ff(ss[3]);                                        \
299         ss[4] ^= ss[3];                                                 \
300         k[6*(i)+10] = ff(ss[4]);                                        \
301         ss[5] ^= ss[4];                                                 \
302         k[6*(i)+11] = ff(ss[5]);                                        \
303 }
304
305 #define kd6(k,i)                                                        \
306 {                                                                       \
307         ss[6] = ls_box(ss[5],3) ^ rcon_tab[i];                          \
308         ss[0] ^= ss[6]; ss[6] = ff(ss[6]);                              \
309         k[6*(i)+ 6] = ss[6] ^= k[6*(i)];                                \
310         ss[1] ^= ss[0];                                                 \
311         k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1];                             \
312         ss[2] ^= ss[1];                                                 \
313         k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2];                             \
314         ss[3] ^= ss[2];                                                 \
315         k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3];                             \
316         ss[4] ^= ss[3];                                                 \
317         k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4];                             \
318         ss[5] ^= ss[4];                                                 \
319         k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5];                             \
320 }
321
322 #define kdl6(k,i)                                                       \
323 {                                                                       \
324         ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];                         \
325         k[6*(i)+ 6] = ss[0];                                            \
326         ss[1] ^= ss[0];                                                 \
327         k[6*(i)+ 7] = ss[1];                                            \
328         ss[2] ^= ss[1];                                                 \
329         k[6*(i)+ 8] = ss[2];                                            \
330         ss[3] ^= ss[2];                                                 \
331         k[6*(i)+ 9] = ss[3];                                            \
332 }
333
334 #define kdf8(k,i)                                                       \
335 {                                                                       \
336         ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];                         \
337         k[8*(i)+ 8] = ff(ss[0]);                                        \
338         ss[1] ^= ss[0];                                                 \
339         k[8*(i)+ 9] = ff(ss[1]);                                        \
340         ss[2] ^= ss[1];                                                 \
341         k[8*(i)+10] = ff(ss[2]);                                        \
342         ss[3] ^= ss[2];                                                 \
343         k[8*(i)+11] = ff(ss[3]);                                        \
344         ss[4] ^= ls_box(ss[3],0);                                       \
345         k[8*(i)+12] = ff(ss[4]);                                        \
346         ss[5] ^= ss[4];                                                 \
347         k[8*(i)+13] = ff(ss[5]);                                        \
348         ss[6] ^= ss[5];                                                 \
349         k[8*(i)+14] = ff(ss[6]);                                        \
350         ss[7] ^= ss[6];                                                 \
351         k[8*(i)+15] = ff(ss[7]);                                        \
352 }
353
354 #define kd8(k,i)                                                        \
355 {                                                                       \
356         u32 __g = ls_box(ss[7],3) ^ rcon_tab[i];                        \
357         ss[0] ^= __g;                                                   \
358         __g = ff(__g);                                                  \
359         k[8*(i)+ 8] = __g ^= k[8*(i)];                                  \
360         ss[1] ^= ss[0];                                                 \
361         k[8*(i)+ 9] = __g ^= k[8*(i)+ 1];                               \
362         ss[2] ^= ss[1];                                                 \
363         k[8*(i)+10] = __g ^= k[8*(i)+ 2];                               \
364         ss[3] ^= ss[2];                                                 \
365         k[8*(i)+11] = __g ^= k[8*(i)+ 3];                               \
366         __g = ls_box(ss[3],0);                                          \
367         ss[4] ^= __g;                                                   \
368         __g = ff(__g);                                                  \
369         k[8*(i)+12] = __g ^= k[8*(i)+ 4];                               \
370         ss[5] ^= ss[4];                                                 \
371         k[8*(i)+13] = __g ^= k[8*(i)+ 5];                               \
372         ss[6] ^= ss[5];                                                 \
373         k[8*(i)+14] = __g ^= k[8*(i)+ 6];                               \
374         ss[7] ^= ss[6];                                                 \
375         k[8*(i)+15] = __g ^= k[8*(i)+ 7];                               \
376 }
377
378 #define kdl8(k,i)                                                       \
379 {                                                                       \
380         ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];                         \
381         k[8*(i)+ 8] = ss[0];                                            \
382         ss[1] ^= ss[0];                                                 \
383         k[8*(i)+ 9] = ss[1];                                            \
384         ss[2] ^= ss[1];                                                 \
385         k[8*(i)+10] = ss[2];                                            \
386         ss[3] ^= ss[2];                                                 \
387         k[8*(i)+11] = ss[3];                                            \
388 }
389
390 static int
391 aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
392 {
393         int i;
394         u32 ss[8];
395         struct aes_ctx *ctx = ctx_arg;
396
397         /* encryption schedule */
398         
399         ctx->ekey[0] = ss[0] = u32_in(in_key);
400         ctx->ekey[1] = ss[1] = u32_in(in_key + 4);
401         ctx->ekey[2] = ss[2] = u32_in(in_key + 8);
402         ctx->ekey[3] = ss[3] = u32_in(in_key + 12);
403
404         switch(key_len) {
405         case 16:
406                 for (i = 0; i < 9; i++)
407                         ke4(ctx->ekey, i);
408                 kel4(ctx->ekey, 9);
409                 ctx->rounds = 10;
410                 break;
411                 
412         case 24:
413                 ctx->ekey[4] = ss[4] = u32_in(in_key + 16);
414                 ctx->ekey[5] = ss[5] = u32_in(in_key + 20);
415                 for (i = 0; i < 7; i++)
416                         ke6(ctx->ekey, i);
417                 kel6(ctx->ekey, 7); 
418                 ctx->rounds = 12;
419                 break;
420
421         case 32:
422                 ctx->ekey[4] = ss[4] = u32_in(in_key + 16);
423                 ctx->ekey[5] = ss[5] = u32_in(in_key + 20);
424                 ctx->ekey[6] = ss[6] = u32_in(in_key + 24);
425                 ctx->ekey[7] = ss[7] = u32_in(in_key + 28);
426                 for (i = 0; i < 6; i++)
427                         ke8(ctx->ekey, i);
428                 kel8(ctx->ekey, 6);
429                 ctx->rounds = 14;
430                 break;
431
432         default:
433                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
434                 return -EINVAL;
435         }
436         
437         /* decryption schedule */
438         
439         ctx->dkey[0] = ss[0] = u32_in(in_key);
440         ctx->dkey[1] = ss[1] = u32_in(in_key + 4);
441         ctx->dkey[2] = ss[2] = u32_in(in_key + 8);
442         ctx->dkey[3] = ss[3] = u32_in(in_key + 12);
443
444         switch (key_len) {
445         case 16:
446                 kdf4(ctx->dkey, 0);
447                 for (i = 1; i < 9; i++)
448                         kd4(ctx->dkey, i);
449                 kdl4(ctx->dkey, 9);
450                 break;
451                 
452         case 24:
453                 ctx->dkey[4] = ff(ss[4] = u32_in(in_key + 16));
454                 ctx->dkey[5] = ff(ss[5] = u32_in(in_key + 20));
455                 kdf6(ctx->dkey, 0);
456                 for (i = 1; i < 7; i++)
457                         kd6(ctx->dkey, i);
458                 kdl6(ctx->dkey, 7);
459                 break;
460
461         case 32:
462                 ctx->dkey[4] = ff(ss[4] = u32_in(in_key + 16));
463                 ctx->dkey[5] = ff(ss[5] = u32_in(in_key + 20));
464                 ctx->dkey[6] = ff(ss[6] = u32_in(in_key + 24));
465                 ctx->dkey[7] = ff(ss[7] = u32_in(in_key + 28));
466                 kdf8(ctx->dkey, 0);
467                 for (i = 1; i < 6; i++)
468                         kd8(ctx->dkey, i);
469                 kdl8(ctx->dkey, 6);
470                 break;
471         }
472         return 0;
473 }
474
475 static inline void aes_encrypt(void *ctx, u8 *dst, const u8 *src)
476 {
477         aes_enc_blk(src, dst, ctx);
478 }
479 static inline void aes_decrypt(void *ctx, u8 *dst, const u8 *src)
480 {
481         aes_dec_blk(src, dst, ctx);
482 }
483
484
485 static struct crypto_alg aes_alg = {
486         .cra_name               =       "aes",
487         .cra_flags              =       CRYPTO_ALG_TYPE_CIPHER,
488         .cra_blocksize          =       AES_BLOCK_SIZE,
489         .cra_ctxsize            =       sizeof(struct aes_ctx),
490         .cra_module             =       THIS_MODULE,
491         .cra_list               =       LIST_HEAD_INIT(aes_alg.cra_list),
492         .cra_u                  =       {
493                 .cipher = {
494                         .cia_min_keysize        =       AES_MIN_KEY_SIZE,
495                         .cia_max_keysize        =       AES_MAX_KEY_SIZE,
496                         .cia_setkey             =       aes_set_key,
497                         .cia_encrypt            =       aes_encrypt,
498                         .cia_decrypt            =       aes_decrypt
499                 }
500         }
501 };
502
503 static int __init aes_init(void)
504 {
505         gen_tabs();
506         return crypto_register_alg(&aes_alg);
507 }
508
509 static void __exit aes_fini(void)
510 {
511         crypto_unregister_alg(&aes_alg);
512 }
513
514 module_init(aes_init);
515 module_exit(aes_fini);
516
517 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, i586 asm optimized");
518 MODULE_LICENSE("Dual BSD/GPL");
519 MODULE_AUTHOR("Fruhwirth Clemens, James Morris, Brian Gladman, Adam Richter");
520 MODULE_ALIAS("aes");