Merge git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc-merge
[linux-2.6] / arch / i386 / crypto / aes.c
1 /* 
2  * 
3  * Glue Code for optimized 586 assembler version of AES
4  *
5  * Copyright (c) 2002, Dr Brian Gladman <>, Worcester, UK.
6  * All rights reserved.
7  *
8  * LICENSE TERMS
9  *
10  * The free distribution and use of this software in both source and binary
11  * form is allowed (with or without changes) provided that:
12  *
13  *   1. distributions of this source code include the above copyright
14  *      notice, this list of conditions and the following disclaimer;
15  *
16  *   2. distributions in binary form include the above copyright
17  *      notice, this list of conditions and the following disclaimer
18  *      in the documentation and/or other associated materials;
19  *
20  *   3. the copyright holder's name is not used to endorse products
21  *      built using this software without specific written permission.
22  *
23  * ALTERNATIVELY, provided that this notice is retained in full, this product
24  * may be distributed under the terms of the GNU General Public License (GPL),
25  * in which case the provisions of the GPL apply INSTEAD OF those given above.
26  *
27  * DISCLAIMER
28  *
29  * This software is provided 'as is' with no explicit or implied warranties
30  * in respect of its properties, including, but not limited to, correctness
31  * and/or fitness for purpose.
32  *
33  * Copyright (c) 2003, Adam J. Richter <adam@yggdrasil.com> (conversion to
34  * 2.5 API).
35  * Copyright (c) 2003, 2004 Fruhwirth Clemens <clemens@endorphin.org>
36  * Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
37  *
38  */
39
40 #include <asm/byteorder.h>
41 #include <linux/kernel.h>
42 #include <linux/module.h>
43 #include <linux/init.h>
44 #include <linux/types.h>
45 #include <linux/crypto.h>
46 #include <linux/linkage.h>
47
48 asmlinkage void aes_enc_blk(const u8 *src, u8 *dst, void *ctx);
49 asmlinkage void aes_dec_blk(const u8 *src, u8 *dst, void *ctx);
50
51 #define AES_MIN_KEY_SIZE        16
52 #define AES_MAX_KEY_SIZE        32
53 #define AES_BLOCK_SIZE          16
54 #define AES_KS_LENGTH           4 * AES_BLOCK_SIZE
55 #define RC_LENGTH               29
56
57 struct aes_ctx {
58         u32 ekey[AES_KS_LENGTH];
59         u32 rounds;
60         u32 dkey[AES_KS_LENGTH];
61 };
62
63 #define WPOLY 0x011b
64 #define bytes2word(b0, b1, b2, b3)  \
65         (((u32)(b3) << 24) | ((u32)(b2) << 16) | ((u32)(b1) << 8) | (b0))
66
67 /* define the finite field multiplies required for Rijndael */
68 #define f2(x) ((x) ? pow[log[x] + 0x19] : 0)
69 #define f3(x) ((x) ? pow[log[x] + 0x01] : 0)
70 #define f9(x) ((x) ? pow[log[x] + 0xc7] : 0)
71 #define fb(x) ((x) ? pow[log[x] + 0x68] : 0)
72 #define fd(x) ((x) ? pow[log[x] + 0xee] : 0)
73 #define fe(x) ((x) ? pow[log[x] + 0xdf] : 0)
74 #define fi(x) ((x) ?   pow[255 - log[x]]: 0)
75
76 static inline u32 upr(u32 x, int n)
77 {
78         return (x << 8 * n) | (x >> (32 - 8 * n));
79 }
80
81 static inline u8 bval(u32 x, int n)
82 {
83         return x >> 8 * n;
84 }
85
86 /* The forward and inverse affine transformations used in the S-box */
87 #define fwd_affine(x) \
88         (w = (u32)x, w ^= (w<<1)^(w<<2)^(w<<3)^(w<<4), 0x63^(u8)(w^(w>>8)))
89
90 #define inv_affine(x) \
91         (w = (u32)x, w = (w<<1)^(w<<3)^(w<<6), 0x05^(u8)(w^(w>>8)))
92
93 static u32 rcon_tab[RC_LENGTH];
94
95 u32 ft_tab[4][256];
96 u32 fl_tab[4][256];
97 static u32 im_tab[4][256];
98 u32 il_tab[4][256];
99 u32 it_tab[4][256];
100
101 static void gen_tabs(void)
102 {
103         u32 i, w;
104         u8 pow[512], log[256];
105
106         /*
107          * log and power tables for GF(2^8) finite field with
108          * WPOLY as modular polynomial - the simplest primitive
109          * root is 0x03, used here to generate the tables.
110          */
111         i = 0; w = 1; 
112         
113         do {
114                 pow[i] = (u8)w;
115                 pow[i + 255] = (u8)w;
116                 log[w] = (u8)i++;
117                 w ^=  (w << 1) ^ (w & 0x80 ? WPOLY : 0);
118         } while (w != 1);
119         
120         for(i = 0, w = 1; i < RC_LENGTH; ++i) {
121                 rcon_tab[i] = bytes2word(w, 0, 0, 0);
122                 w = f2(w);
123         }
124
125         for(i = 0; i < 256; ++i) {
126                 u8 b;
127                 
128                 b = fwd_affine(fi((u8)i));
129                 w = bytes2word(f2(b), b, b, f3(b));
130
131                 /* tables for a normal encryption round */
132                 ft_tab[0][i] = w;
133                 ft_tab[1][i] = upr(w, 1);
134                 ft_tab[2][i] = upr(w, 2);
135                 ft_tab[3][i] = upr(w, 3);
136                 w = bytes2word(b, 0, 0, 0);
137                 
138                 /*
139                  * tables for last encryption round
140                  * (may also be used in the key schedule)
141                  */
142                 fl_tab[0][i] = w;
143                 fl_tab[1][i] = upr(w, 1);
144                 fl_tab[2][i] = upr(w, 2);
145                 fl_tab[3][i] = upr(w, 3);
146                 
147                 b = fi(inv_affine((u8)i));
148                 w = bytes2word(fe(b), f9(b), fd(b), fb(b));
149
150                 /* tables for the inverse mix column operation  */
151                 im_tab[0][b] = w;
152                 im_tab[1][b] = upr(w, 1);
153                 im_tab[2][b] = upr(w, 2);
154                 im_tab[3][b] = upr(w, 3);
155
156                 /* tables for a normal decryption round */
157                 it_tab[0][i] = w;
158                 it_tab[1][i] = upr(w,1);
159                 it_tab[2][i] = upr(w,2);
160                 it_tab[3][i] = upr(w,3);
161
162                 w = bytes2word(b, 0, 0, 0);
163                 
164                 /* tables for last decryption round */
165                 il_tab[0][i] = w;
166                 il_tab[1][i] = upr(w,1);
167                 il_tab[2][i] = upr(w,2);
168                 il_tab[3][i] = upr(w,3);
169     }
170 }
171
172 #define four_tables(x,tab,vf,rf,c)              \
173 (       tab[0][bval(vf(x,0,c),rf(0,c))] ^       \
174         tab[1][bval(vf(x,1,c),rf(1,c))] ^       \
175         tab[2][bval(vf(x,2,c),rf(2,c))] ^       \
176         tab[3][bval(vf(x,3,c),rf(3,c))]         \
177 )
178
179 #define vf1(x,r,c)  (x)
180 #define rf1(r,c)    (r)
181 #define rf2(r,c)    ((r-c)&3)
182
183 #define inv_mcol(x) four_tables(x,im_tab,vf1,rf1,0)
184 #define ls_box(x,c) four_tables(x,fl_tab,vf1,rf2,c)
185
186 #define ff(x) inv_mcol(x)
187
188 #define ke4(k,i)                                                        \
189 {                                                                       \
190         k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];            \
191         k[4*(i)+5] = ss[1] ^= ss[0];                                    \
192         k[4*(i)+6] = ss[2] ^= ss[1];                                    \
193         k[4*(i)+7] = ss[3] ^= ss[2];                                    \
194 }
195
196 #define kel4(k,i)                                                       \
197 {                                                                       \
198         k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];            \
199         k[4*(i)+5] = ss[1] ^= ss[0];                                    \
200         k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2];       \
201 }
202
203 #define ke6(k,i)                                                        \
204 {                                                                       \
205         k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];           \
206         k[6*(i)+ 7] = ss[1] ^= ss[0];                                   \
207         k[6*(i)+ 8] = ss[2] ^= ss[1];                                   \
208         k[6*(i)+ 9] = ss[3] ^= ss[2];                                   \
209         k[6*(i)+10] = ss[4] ^= ss[3];                                   \
210         k[6*(i)+11] = ss[5] ^= ss[4];                                   \
211 }
212
213 #define kel6(k,i)                                                       \
214 {                                                                       \
215         k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];           \
216         k[6*(i)+ 7] = ss[1] ^= ss[0];                                   \
217         k[6*(i)+ 8] = ss[2] ^= ss[1];                                   \
218         k[6*(i)+ 9] = ss[3] ^= ss[2];                                   \
219 }
220
221 #define ke8(k,i)                                                        \
222 {                                                                       \
223         k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];           \
224         k[8*(i)+ 9] = ss[1] ^= ss[0];                                   \
225         k[8*(i)+10] = ss[2] ^= ss[1];                                   \
226         k[8*(i)+11] = ss[3] ^= ss[2];                                   \
227         k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0);                         \
228         k[8*(i)+13] = ss[5] ^= ss[4];                                   \
229         k[8*(i)+14] = ss[6] ^= ss[5];                                   \
230         k[8*(i)+15] = ss[7] ^= ss[6];                                   \
231 }
232
233 #define kel8(k,i)                                                       \
234 {                                                                       \
235         k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];           \
236         k[8*(i)+ 9] = ss[1] ^= ss[0];                                   \
237         k[8*(i)+10] = ss[2] ^= ss[1];                                   \
238         k[8*(i)+11] = ss[3] ^= ss[2];                                   \
239 }
240
241 #define kdf4(k,i)                                                       \
242 {                                                                       \
243         ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3];                          \
244         ss[1] = ss[1] ^ ss[3];                                          \
245         ss[2] = ss[2] ^ ss[3];                                          \
246         ss[3] = ss[3];                                                  \
247         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
248         ss[i % 4] ^= ss[4];                                             \
249         ss[4] ^= k[4*(i)];                                              \
250         k[4*(i)+4] = ff(ss[4]);                                         \
251         ss[4] ^= k[4*(i)+1];                                            \
252         k[4*(i)+5] = ff(ss[4]);                                         \
253         ss[4] ^= k[4*(i)+2];                                            \
254         k[4*(i)+6] = ff(ss[4]);                                         \
255         ss[4] ^= k[4*(i)+3];                                            \
256         k[4*(i)+7] = ff(ss[4]);                                         \
257 }
258
259 #define kd4(k,i)                                                        \
260 {                                                                       \
261         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
262         ss[i % 4] ^= ss[4];                                             \
263         ss[4] = ff(ss[4]);                                              \
264         k[4*(i)+4] = ss[4] ^= k[4*(i)];                                 \
265         k[4*(i)+5] = ss[4] ^= k[4*(i)+1];                               \
266         k[4*(i)+6] = ss[4] ^= k[4*(i)+2];                               \
267         k[4*(i)+7] = ss[4] ^= k[4*(i)+3];                               \
268 }
269
270 #define kdl4(k,i)                                                       \
271 {                                                                       \
272         ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];                 \
273         ss[i % 4] ^= ss[4];                                             \
274         k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3];                  \
275         k[4*(i)+5] = ss[1] ^ ss[3];                                     \
276         k[4*(i)+6] = ss[0];                                             \
277         k[4*(i)+7] = ss[1];                                             \
278 }
279
280 #define kdf6(k,i)                                                       \
281 {                                                                       \
282         ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];                         \
283         k[6*(i)+ 6] = ff(ss[0]);                                        \
284         ss[1] ^= ss[0];                                                 \
285         k[6*(i)+ 7] = ff(ss[1]);                                        \
286         ss[2] ^= ss[1];                                                 \
287         k[6*(i)+ 8] = ff(ss[2]);                                        \
288         ss[3] ^= ss[2];                                                 \
289         k[6*(i)+ 9] = ff(ss[3]);                                        \
290         ss[4] ^= ss[3];                                                 \
291         k[6*(i)+10] = ff(ss[4]);                                        \
292         ss[5] ^= ss[4];                                                 \
293         k[6*(i)+11] = ff(ss[5]);                                        \
294 }
295
296 #define kd6(k,i)                                                        \
297 {                                                                       \
298         ss[6] = ls_box(ss[5],3) ^ rcon_tab[i];                          \
299         ss[0] ^= ss[6]; ss[6] = ff(ss[6]);                              \
300         k[6*(i)+ 6] = ss[6] ^= k[6*(i)];                                \
301         ss[1] ^= ss[0];                                                 \
302         k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1];                             \
303         ss[2] ^= ss[1];                                                 \
304         k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2];                             \
305         ss[3] ^= ss[2];                                                 \
306         k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3];                             \
307         ss[4] ^= ss[3];                                                 \
308         k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4];                             \
309         ss[5] ^= ss[4];                                                 \
310         k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5];                             \
311 }
312
313 #define kdl6(k,i)                                                       \
314 {                                                                       \
315         ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];                         \
316         k[6*(i)+ 6] = ss[0];                                            \
317         ss[1] ^= ss[0];                                                 \
318         k[6*(i)+ 7] = ss[1];                                            \
319         ss[2] ^= ss[1];                                                 \
320         k[6*(i)+ 8] = ss[2];                                            \
321         ss[3] ^= ss[2];                                                 \
322         k[6*(i)+ 9] = ss[3];                                            \
323 }
324
325 #define kdf8(k,i)                                                       \
326 {                                                                       \
327         ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];                         \
328         k[8*(i)+ 8] = ff(ss[0]);                                        \
329         ss[1] ^= ss[0];                                                 \
330         k[8*(i)+ 9] = ff(ss[1]);                                        \
331         ss[2] ^= ss[1];                                                 \
332         k[8*(i)+10] = ff(ss[2]);                                        \
333         ss[3] ^= ss[2];                                                 \
334         k[8*(i)+11] = ff(ss[3]);                                        \
335         ss[4] ^= ls_box(ss[3],0);                                       \
336         k[8*(i)+12] = ff(ss[4]);                                        \
337         ss[5] ^= ss[4];                                                 \
338         k[8*(i)+13] = ff(ss[5]);                                        \
339         ss[6] ^= ss[5];                                                 \
340         k[8*(i)+14] = ff(ss[6]);                                        \
341         ss[7] ^= ss[6];                                                 \
342         k[8*(i)+15] = ff(ss[7]);                                        \
343 }
344
345 #define kd8(k,i)                                                        \
346 {                                                                       \
347         u32 __g = ls_box(ss[7],3) ^ rcon_tab[i];                        \
348         ss[0] ^= __g;                                                   \
349         __g = ff(__g);                                                  \
350         k[8*(i)+ 8] = __g ^= k[8*(i)];                                  \
351         ss[1] ^= ss[0];                                                 \
352         k[8*(i)+ 9] = __g ^= k[8*(i)+ 1];                               \
353         ss[2] ^= ss[1];                                                 \
354         k[8*(i)+10] = __g ^= k[8*(i)+ 2];                               \
355         ss[3] ^= ss[2];                                                 \
356         k[8*(i)+11] = __g ^= k[8*(i)+ 3];                               \
357         __g = ls_box(ss[3],0);                                          \
358         ss[4] ^= __g;                                                   \
359         __g = ff(__g);                                                  \
360         k[8*(i)+12] = __g ^= k[8*(i)+ 4];                               \
361         ss[5] ^= ss[4];                                                 \
362         k[8*(i)+13] = __g ^= k[8*(i)+ 5];                               \
363         ss[6] ^= ss[5];                                                 \
364         k[8*(i)+14] = __g ^= k[8*(i)+ 6];                               \
365         ss[7] ^= ss[6];                                                 \
366         k[8*(i)+15] = __g ^= k[8*(i)+ 7];                               \
367 }
368
369 #define kdl8(k,i)                                                       \
370 {                                                                       \
371         ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];                         \
372         k[8*(i)+ 8] = ss[0];                                            \
373         ss[1] ^= ss[0];                                                 \
374         k[8*(i)+ 9] = ss[1];                                            \
375         ss[2] ^= ss[1];                                                 \
376         k[8*(i)+10] = ss[2];                                            \
377         ss[3] ^= ss[2];                                                 \
378         k[8*(i)+11] = ss[3];                                            \
379 }
380
381 static int
382 aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
383 {
384         int i;
385         u32 ss[8];
386         struct aes_ctx *ctx = ctx_arg;
387         const __le32 *key = (const __le32 *)in_key;
388
389         /* encryption schedule */
390         
391         ctx->ekey[0] = ss[0] = le32_to_cpu(key[0]);
392         ctx->ekey[1] = ss[1] = le32_to_cpu(key[1]);
393         ctx->ekey[2] = ss[2] = le32_to_cpu(key[2]);
394         ctx->ekey[3] = ss[3] = le32_to_cpu(key[3]);
395
396         switch(key_len) {
397         case 16:
398                 for (i = 0; i < 9; i++)
399                         ke4(ctx->ekey, i);
400                 kel4(ctx->ekey, 9);
401                 ctx->rounds = 10;
402                 break;
403                 
404         case 24:
405                 ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
406                 ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
407                 for (i = 0; i < 7; i++)
408                         ke6(ctx->ekey, i);
409                 kel6(ctx->ekey, 7); 
410                 ctx->rounds = 12;
411                 break;
412
413         case 32:
414                 ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
415                 ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
416                 ctx->ekey[6] = ss[6] = le32_to_cpu(key[6]);
417                 ctx->ekey[7] = ss[7] = le32_to_cpu(key[7]);
418                 for (i = 0; i < 6; i++)
419                         ke8(ctx->ekey, i);
420                 kel8(ctx->ekey, 6);
421                 ctx->rounds = 14;
422                 break;
423
424         default:
425                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
426                 return -EINVAL;
427         }
428         
429         /* decryption schedule */
430         
431         ctx->dkey[0] = ss[0] = le32_to_cpu(key[0]);
432         ctx->dkey[1] = ss[1] = le32_to_cpu(key[1]);
433         ctx->dkey[2] = ss[2] = le32_to_cpu(key[2]);
434         ctx->dkey[3] = ss[3] = le32_to_cpu(key[3]);
435
436         switch (key_len) {
437         case 16:
438                 kdf4(ctx->dkey, 0);
439                 for (i = 1; i < 9; i++)
440                         kd4(ctx->dkey, i);
441                 kdl4(ctx->dkey, 9);
442                 break;
443                 
444         case 24:
445                 ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
446                 ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
447                 kdf6(ctx->dkey, 0);
448                 for (i = 1; i < 7; i++)
449                         kd6(ctx->dkey, i);
450                 kdl6(ctx->dkey, 7);
451                 break;
452
453         case 32:
454                 ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
455                 ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
456                 ctx->dkey[6] = ff(ss[6] = le32_to_cpu(key[6]));
457                 ctx->dkey[7] = ff(ss[7] = le32_to_cpu(key[7]));
458                 kdf8(ctx->dkey, 0);
459                 for (i = 1; i < 6; i++)
460                         kd8(ctx->dkey, i);
461                 kdl8(ctx->dkey, 6);
462                 break;
463         }
464         return 0;
465 }
466
467 static inline void aes_encrypt(void *ctx, u8 *dst, const u8 *src)
468 {
469         aes_enc_blk(src, dst, ctx);
470 }
471 static inline void aes_decrypt(void *ctx, u8 *dst, const u8 *src)
472 {
473         aes_dec_blk(src, dst, ctx);
474 }
475
476
477 static struct crypto_alg aes_alg = {
478         .cra_name               =       "aes",
479         .cra_driver_name        =       "aes-i586",
480         .cra_priority           =       200,
481         .cra_flags              =       CRYPTO_ALG_TYPE_CIPHER,
482         .cra_blocksize          =       AES_BLOCK_SIZE,
483         .cra_ctxsize            =       sizeof(struct aes_ctx),
484         .cra_module             =       THIS_MODULE,
485         .cra_list               =       LIST_HEAD_INIT(aes_alg.cra_list),
486         .cra_u                  =       {
487                 .cipher = {
488                         .cia_min_keysize        =       AES_MIN_KEY_SIZE,
489                         .cia_max_keysize        =       AES_MAX_KEY_SIZE,
490                         .cia_setkey             =       aes_set_key,
491                         .cia_encrypt            =       aes_encrypt,
492                         .cia_decrypt            =       aes_decrypt
493                 }
494         }
495 };
496
497 static int __init aes_init(void)
498 {
499         gen_tabs();
500         return crypto_register_alg(&aes_alg);
501 }
502
503 static void __exit aes_fini(void)
504 {
505         crypto_unregister_alg(&aes_alg);
506 }
507
508 module_init(aes_init);
509 module_exit(aes_fini);
510
511 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, i586 asm optimized");
512 MODULE_LICENSE("Dual BSD/GPL");
513 MODULE_AUTHOR("Fruhwirth Clemens, James Morris, Brian Gladman, Adam Richter");
514 MODULE_ALIAS("aes");