aria_generic.c 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Cryptographic API.
  4. *
  5. * ARIA Cipher Algorithm.
  6. *
  7. * Documentation of ARIA can be found in RFC 5794.
  8. * Copyright (c) 2022 Taehee Yoo <[email protected]>
  9. *
  10. * Information for ARIA
  11. * http://210.104.33.10/ARIA/index-e.html (English)
  12. * http://seed.kisa.or.kr/ (Korean)
  13. *
  14. * Public domain version is distributed above.
  15. */
  16. #include <crypto/aria.h>
  17. static const u32 key_rc[20] = {
  18. 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
  19. 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0,
  20. 0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e,
  21. 0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0,
  22. 0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0
  23. };
  24. static void aria_set_encrypt_key(struct aria_ctx *ctx, const u8 *in_key,
  25. unsigned int key_len)
  26. {
  27. const __be32 *key = (const __be32 *)in_key;
  28. u32 w0[4], w1[4], w2[4], w3[4];
  29. u32 reg0, reg1, reg2, reg3;
  30. const u32 *ck;
  31. int rkidx = 0;
  32. ck = &key_rc[(key_len - 16) / 2];
  33. w0[0] = be32_to_cpu(key[0]);
  34. w0[1] = be32_to_cpu(key[1]);
  35. w0[2] = be32_to_cpu(key[2]);
  36. w0[3] = be32_to_cpu(key[3]);
  37. reg0 = w0[0] ^ ck[0];
  38. reg1 = w0[1] ^ ck[1];
  39. reg2 = w0[2] ^ ck[2];
  40. reg3 = w0[3] ^ ck[3];
  41. aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
  42. if (key_len > 16) {
  43. w1[0] = be32_to_cpu(key[4]);
  44. w1[1] = be32_to_cpu(key[5]);
  45. if (key_len > 24) {
  46. w1[2] = be32_to_cpu(key[6]);
  47. w1[3] = be32_to_cpu(key[7]);
  48. } else {
  49. w1[2] = 0;
  50. w1[3] = 0;
  51. }
  52. } else {
  53. w1[0] = 0;
  54. w1[1] = 0;
  55. w1[2] = 0;
  56. w1[3] = 0;
  57. }
  58. w1[0] ^= reg0;
  59. w1[1] ^= reg1;
  60. w1[2] ^= reg2;
  61. w1[3] ^= reg3;
  62. reg0 = w1[0];
  63. reg1 = w1[1];
  64. reg2 = w1[2];
  65. reg3 = w1[3];
  66. reg0 ^= ck[4];
  67. reg1 ^= ck[5];
  68. reg2 ^= ck[6];
  69. reg3 ^= ck[7];
  70. aria_subst_diff_even(&reg0, &reg1, &reg2, &reg3);
  71. reg0 ^= w0[0];
  72. reg1 ^= w0[1];
  73. reg2 ^= w0[2];
  74. reg3 ^= w0[3];
  75. w2[0] = reg0;
  76. w2[1] = reg1;
  77. w2[2] = reg2;
  78. w2[3] = reg3;
  79. reg0 ^= ck[8];
  80. reg1 ^= ck[9];
  81. reg2 ^= ck[10];
  82. reg3 ^= ck[11];
  83. aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
  84. w3[0] = reg0 ^ w1[0];
  85. w3[1] = reg1 ^ w1[1];
  86. w3[2] = reg2 ^ w1[2];
  87. w3[3] = reg3 ^ w1[3];
  88. aria_gsrk(ctx->enc_key[rkidx], w0, w1, 19);
  89. rkidx++;
  90. aria_gsrk(ctx->enc_key[rkidx], w1, w2, 19);
  91. rkidx++;
  92. aria_gsrk(ctx->enc_key[rkidx], w2, w3, 19);
  93. rkidx++;
  94. aria_gsrk(ctx->enc_key[rkidx], w3, w0, 19);
  95. rkidx++;
  96. aria_gsrk(ctx->enc_key[rkidx], w0, w1, 31);
  97. rkidx++;
  98. aria_gsrk(ctx->enc_key[rkidx], w1, w2, 31);
  99. rkidx++;
  100. aria_gsrk(ctx->enc_key[rkidx], w2, w3, 31);
  101. rkidx++;
  102. aria_gsrk(ctx->enc_key[rkidx], w3, w0, 31);
  103. rkidx++;
  104. aria_gsrk(ctx->enc_key[rkidx], w0, w1, 67);
  105. rkidx++;
  106. aria_gsrk(ctx->enc_key[rkidx], w1, w2, 67);
  107. rkidx++;
  108. aria_gsrk(ctx->enc_key[rkidx], w2, w3, 67);
  109. rkidx++;
  110. aria_gsrk(ctx->enc_key[rkidx], w3, w0, 67);
  111. rkidx++;
  112. aria_gsrk(ctx->enc_key[rkidx], w0, w1, 97);
  113. if (key_len > 16) {
  114. rkidx++;
  115. aria_gsrk(ctx->enc_key[rkidx], w1, w2, 97);
  116. rkidx++;
  117. aria_gsrk(ctx->enc_key[rkidx], w2, w3, 97);
  118. if (key_len > 24) {
  119. rkidx++;
  120. aria_gsrk(ctx->enc_key[rkidx], w3, w0, 97);
  121. rkidx++;
  122. aria_gsrk(ctx->enc_key[rkidx], w0, w1, 109);
  123. }
  124. }
  125. }
  126. static void aria_set_decrypt_key(struct aria_ctx *ctx)
  127. {
  128. int i;
  129. for (i = 0; i < 4; i++) {
  130. ctx->dec_key[0][i] = ctx->enc_key[ctx->rounds][i];
  131. ctx->dec_key[ctx->rounds][i] = ctx->enc_key[0][i];
  132. }
  133. for (i = 1; i < ctx->rounds; i++) {
  134. ctx->dec_key[i][0] = aria_m(ctx->enc_key[ctx->rounds - i][0]);
  135. ctx->dec_key[i][1] = aria_m(ctx->enc_key[ctx->rounds - i][1]);
  136. ctx->dec_key[i][2] = aria_m(ctx->enc_key[ctx->rounds - i][2]);
  137. ctx->dec_key[i][3] = aria_m(ctx->enc_key[ctx->rounds - i][3]);
  138. aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
  139. &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
  140. aria_diff_byte(&ctx->dec_key[i][1],
  141. &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
  142. aria_diff_word(&ctx->dec_key[i][0], &ctx->dec_key[i][1],
  143. &ctx->dec_key[i][2], &ctx->dec_key[i][3]);
  144. }
  145. }
  146. int aria_set_key(struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
  147. {
  148. struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
  149. if (key_len != 16 && key_len != 24 && key_len != 32)
  150. return -EINVAL;
  151. ctx->key_length = key_len;
  152. ctx->rounds = (key_len + 32) / 4;
  153. aria_set_encrypt_key(ctx, in_key, key_len);
  154. aria_set_decrypt_key(ctx);
  155. return 0;
  156. }
  157. EXPORT_SYMBOL_GPL(aria_set_key);
  158. static void __aria_crypt(struct aria_ctx *ctx, u8 *out, const u8 *in,
  159. u32 key[][ARIA_RD_KEY_WORDS])
  160. {
  161. const __be32 *src = (const __be32 *)in;
  162. __be32 *dst = (__be32 *)out;
  163. u32 reg0, reg1, reg2, reg3;
  164. int rounds, rkidx = 0;
  165. rounds = ctx->rounds;
  166. reg0 = be32_to_cpu(src[0]);
  167. reg1 = be32_to_cpu(src[1]);
  168. reg2 = be32_to_cpu(src[2]);
  169. reg3 = be32_to_cpu(src[3]);
  170. aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
  171. rkidx++;
  172. aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
  173. aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
  174. rkidx++;
  175. while ((rounds -= 2) > 0) {
  176. aria_subst_diff_even(&reg0, &reg1, &reg2, &reg3);
  177. aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
  178. rkidx++;
  179. aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
  180. aria_add_round_key(key[rkidx], &reg0, &reg1, &reg2, &reg3);
  181. rkidx++;
  182. }
  183. reg0 = key[rkidx][0] ^ make_u32((u8)(x1[get_u8(reg0, 0)]),
  184. (u8)(x2[get_u8(reg0, 1)] >> 8),
  185. (u8)(s1[get_u8(reg0, 2)]),
  186. (u8)(s2[get_u8(reg0, 3)]));
  187. reg1 = key[rkidx][1] ^ make_u32((u8)(x1[get_u8(reg1, 0)]),
  188. (u8)(x2[get_u8(reg1, 1)] >> 8),
  189. (u8)(s1[get_u8(reg1, 2)]),
  190. (u8)(s2[get_u8(reg1, 3)]));
  191. reg2 = key[rkidx][2] ^ make_u32((u8)(x1[get_u8(reg2, 0)]),
  192. (u8)(x2[get_u8(reg2, 1)] >> 8),
  193. (u8)(s1[get_u8(reg2, 2)]),
  194. (u8)(s2[get_u8(reg2, 3)]));
  195. reg3 = key[rkidx][3] ^ make_u32((u8)(x1[get_u8(reg3, 0)]),
  196. (u8)(x2[get_u8(reg3, 1)] >> 8),
  197. (u8)(s1[get_u8(reg3, 2)]),
  198. (u8)(s2[get_u8(reg3, 3)]));
  199. dst[0] = cpu_to_be32(reg0);
  200. dst[1] = cpu_to_be32(reg1);
  201. dst[2] = cpu_to_be32(reg2);
  202. dst[3] = cpu_to_be32(reg3);
  203. }
  204. void aria_encrypt(void *_ctx, u8 *out, const u8 *in)
  205. {
  206. struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
  207. __aria_crypt(ctx, out, in, ctx->enc_key);
  208. }
  209. EXPORT_SYMBOL_GPL(aria_encrypt);
  210. void aria_decrypt(void *_ctx, u8 *out, const u8 *in)
  211. {
  212. struct aria_ctx *ctx = (struct aria_ctx *)_ctx;
  213. __aria_crypt(ctx, out, in, ctx->dec_key);
  214. }
  215. EXPORT_SYMBOL_GPL(aria_decrypt);
  216. static void __aria_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
  217. {
  218. struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
  219. __aria_crypt(ctx, out, in, ctx->enc_key);
  220. }
  221. static void __aria_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
  222. {
  223. struct aria_ctx *ctx = crypto_tfm_ctx(tfm);
  224. __aria_crypt(ctx, out, in, ctx->dec_key);
  225. }
  226. static struct crypto_alg aria_alg = {
  227. .cra_name = "aria",
  228. .cra_driver_name = "aria-generic",
  229. .cra_priority = 100,
  230. .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
  231. .cra_blocksize = ARIA_BLOCK_SIZE,
  232. .cra_ctxsize = sizeof(struct aria_ctx),
  233. .cra_alignmask = 3,
  234. .cra_module = THIS_MODULE,
  235. .cra_u = {
  236. .cipher = {
  237. .cia_min_keysize = ARIA_MIN_KEY_SIZE,
  238. .cia_max_keysize = ARIA_MAX_KEY_SIZE,
  239. .cia_setkey = aria_set_key,
  240. .cia_encrypt = __aria_encrypt,
  241. .cia_decrypt = __aria_decrypt
  242. }
  243. }
  244. };
  245. static int __init aria_init(void)
  246. {
  247. return crypto_register_alg(&aria_alg);
  248. }
  249. static void __exit aria_fini(void)
  250. {
  251. crypto_unregister_alg(&aria_alg);
  252. }
  253. subsys_initcall(aria_init);
  254. module_exit(aria_fini);
  255. MODULE_DESCRIPTION("ARIA Cipher Algorithm");
  256. MODULE_LICENSE("GPL");
  257. MODULE_AUTHOR("Taehee Yoo <[email protected]>");
  258. MODULE_ALIAS_CRYPTO("aria");
  259. MODULE_ALIAS_CRYPTO("aria-generic");