e_padlock.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737
  1. /*
  2. * Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * This file uses the low level AES and engine functions (which are deprecated
  11. * for non-internal use) in order to implement the padlock engine AES ciphers.
  12. */
  13. #define OPENSSL_SUPPRESS_DEPRECATED
  14. #include <stdio.h>
  15. #include <string.h>
  16. #include <openssl/opensslconf.h>
  17. #include <openssl/crypto.h>
  18. #include <openssl/engine.h>
  19. #include <openssl/evp.h>
  20. #include <openssl/aes.h>
  21. #include <openssl/rand.h>
  22. #include <openssl/err.h>
  23. #include <openssl/modes.h>
  24. #ifndef OPENSSL_NO_PADLOCKENG
  25. /*
  26. * VIA PadLock AES is available *ONLY* on some x86 CPUs. Not only that it
  27. * doesn't exist elsewhere, but it even can't be compiled on other platforms!
  28. */
  29. # undef COMPILE_PADLOCKENG
  30. # if defined(PADLOCK_ASM)
  31. # define COMPILE_PADLOCKENG
  32. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  33. static ENGINE *ENGINE_padlock(void);
  34. # endif
  35. # endif
  36. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  37. void engine_load_padlock_int(void);
  38. void engine_load_padlock_int(void)
  39. {
  40. /* On non-x86 CPUs it just returns. */
  41. # ifdef COMPILE_PADLOCKENG
  42. ENGINE *toadd = ENGINE_padlock();
  43. if (!toadd)
  44. return;
  45. ENGINE_add(toadd);
  46. ENGINE_free(toadd);
  47. ERR_clear_error();
  48. # endif
  49. }
  50. # endif
  51. # ifdef COMPILE_PADLOCKENG
  52. /* Function for ENGINE detection and control */
  53. static int padlock_available(void);
  54. static int padlock_init(ENGINE *e);
  55. /* RNG Stuff */
  56. static RAND_METHOD padlock_rand;
  57. /* Cipher Stuff */
  58. static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
  59. const int **nids, int nid);
  60. /* Engine names */
  61. static const char *padlock_id = "padlock";
  62. static char padlock_name[100];
  63. /* Available features */
  64. static int padlock_use_ace = 0; /* Advanced Cryptography Engine */
  65. static int padlock_use_rng = 0; /* Random Number Generator */
  66. /* ===== Engine "management" functions ===== */
  67. /* Prepare the ENGINE structure for registration */
  68. static int padlock_bind_helper(ENGINE *e)
  69. {
  70. /* Check available features */
  71. padlock_available();
  72. /*
  73. * RNG is currently disabled for reasons discussed in commentary just
  74. * before padlock_rand_bytes function.
  75. */
  76. padlock_use_rng = 0;
  77. /* Generate a nice engine name with available features */
  78. BIO_snprintf(padlock_name, sizeof(padlock_name),
  79. "VIA PadLock (%s, %s)",
  80. padlock_use_rng ? "RNG" : "no-RNG",
  81. padlock_use_ace ? "ACE" : "no-ACE");
  82. /* Register everything or return with an error */
  83. if (!ENGINE_set_id(e, padlock_id) ||
  84. !ENGINE_set_name(e, padlock_name) ||
  85. !ENGINE_set_init_function(e, padlock_init) ||
  86. (padlock_use_ace && !ENGINE_set_ciphers(e, padlock_ciphers)) ||
  87. (padlock_use_rng && !ENGINE_set_RAND(e, &padlock_rand))) {
  88. return 0;
  89. }
  90. /* Everything looks good */
  91. return 1;
  92. }
  93. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  94. /* Constructor */
  95. static ENGINE *ENGINE_padlock(void)
  96. {
  97. ENGINE *eng = ENGINE_new();
  98. if (eng == NULL) {
  99. return NULL;
  100. }
  101. if (!padlock_bind_helper(eng)) {
  102. ENGINE_free(eng);
  103. return NULL;
  104. }
  105. return eng;
  106. }
  107. # endif
  108. /* Check availability of the engine */
  109. static int padlock_init(ENGINE *e)
  110. {
  111. return (padlock_use_rng || padlock_use_ace);
  112. }
  113. /*
  114. * This stuff is needed if this ENGINE is being compiled into a
  115. * self-contained shared-library.
  116. */
  117. # ifndef OPENSSL_NO_DYNAMIC_ENGINE
  118. static int padlock_bind_fn(ENGINE *e, const char *id)
  119. {
  120. if (id && (strcmp(id, padlock_id) != 0)) {
  121. return 0;
  122. }
  123. if (!padlock_bind_helper(e)) {
  124. return 0;
  125. }
  126. return 1;
  127. }
  128. IMPLEMENT_DYNAMIC_CHECK_FN()
  129. IMPLEMENT_DYNAMIC_BIND_FN(padlock_bind_fn)
  130. # endif /* !OPENSSL_NO_DYNAMIC_ENGINE */
  131. /* ===== Here comes the "real" engine ===== */
  132. /* Some AES-related constants */
  133. # define AES_BLOCK_SIZE 16
  134. # define AES_KEY_SIZE_128 16
  135. # define AES_KEY_SIZE_192 24
  136. # define AES_KEY_SIZE_256 32
  137. /*
  138. * Here we store the status information relevant to the current context.
  139. */
  140. /*
  141. * BIG FAT WARNING: Inline assembler in PADLOCK_XCRYPT_ASM() depends on
  142. * the order of items in this structure. Don't blindly modify, reorder,
  143. * etc!
  144. */
  145. struct padlock_cipher_data {
  146. unsigned char iv[AES_BLOCK_SIZE]; /* Initialization vector */
  147. union {
  148. unsigned int pad[4];
  149. struct {
  150. int rounds:4;
  151. int dgst:1; /* n/a in C3 */
  152. int align:1; /* n/a in C3 */
  153. int ciphr:1; /* n/a in C3 */
  154. unsigned int keygen:1;
  155. int interm:1;
  156. unsigned int encdec:1;
  157. int ksize:2;
  158. } b;
  159. } cword; /* Control word */
  160. AES_KEY ks; /* Encryption key */
  161. };
  162. /* Interface to assembler module */
  163. unsigned int padlock_capability(void);
  164. void padlock_key_bswap(AES_KEY *key);
  165. void padlock_verify_context(struct padlock_cipher_data *ctx);
  166. void padlock_reload_key(void);
  167. void padlock_aes_block(void *out, const void *inp,
  168. struct padlock_cipher_data *ctx);
  169. int padlock_ecb_encrypt(void *out, const void *inp,
  170. struct padlock_cipher_data *ctx, size_t len);
  171. int padlock_cbc_encrypt(void *out, const void *inp,
  172. struct padlock_cipher_data *ctx, size_t len);
  173. int padlock_cfb_encrypt(void *out, const void *inp,
  174. struct padlock_cipher_data *ctx, size_t len);
  175. int padlock_ofb_encrypt(void *out, const void *inp,
  176. struct padlock_cipher_data *ctx, size_t len);
  177. int padlock_ctr32_encrypt(void *out, const void *inp,
  178. struct padlock_cipher_data *ctx, size_t len);
  179. int padlock_xstore(void *out, int edx);
  180. void padlock_sha1_oneshot(void *ctx, const void *inp, size_t len);
  181. void padlock_sha1(void *ctx, const void *inp, size_t len);
  182. void padlock_sha256_oneshot(void *ctx, const void *inp, size_t len);
  183. void padlock_sha256(void *ctx, const void *inp, size_t len);
  184. /*
  185. * Load supported features of the CPU to see if the PadLock is available.
  186. */
  187. static int padlock_available(void)
  188. {
  189. unsigned int edx = padlock_capability();
  190. /* Fill up some flags */
  191. padlock_use_ace = ((edx & (0x3 << 6)) == (0x3 << 6));
  192. padlock_use_rng = ((edx & (0x3 << 2)) == (0x3 << 2));
  193. return padlock_use_ace + padlock_use_rng;
  194. }
  195. /* ===== AES encryption/decryption ===== */
  196. # if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
  197. # define NID_aes_128_cfb NID_aes_128_cfb128
  198. # endif
  199. # if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
  200. # define NID_aes_128_ofb NID_aes_128_ofb128
  201. # endif
  202. # if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
  203. # define NID_aes_192_cfb NID_aes_192_cfb128
  204. # endif
  205. # if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
  206. # define NID_aes_192_ofb NID_aes_192_ofb128
  207. # endif
  208. # if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
  209. # define NID_aes_256_cfb NID_aes_256_cfb128
  210. # endif
  211. # if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
  212. # define NID_aes_256_ofb NID_aes_256_ofb128
  213. # endif
  214. /* List of supported ciphers. */
  215. static const int padlock_cipher_nids[] = {
  216. NID_aes_128_ecb,
  217. NID_aes_128_cbc,
  218. NID_aes_128_cfb,
  219. NID_aes_128_ofb,
  220. NID_aes_128_ctr,
  221. NID_aes_192_ecb,
  222. NID_aes_192_cbc,
  223. NID_aes_192_cfb,
  224. NID_aes_192_ofb,
  225. NID_aes_192_ctr,
  226. NID_aes_256_ecb,
  227. NID_aes_256_cbc,
  228. NID_aes_256_cfb,
  229. NID_aes_256_ofb,
  230. NID_aes_256_ctr
  231. };
  232. static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids) /
  233. sizeof(padlock_cipher_nids[0]));
  234. /* Function prototypes ... */
  235. static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  236. const unsigned char *iv, int enc);
  237. # define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) + \
  238. ( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F ) )
  239. # define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
  240. NEAREST_ALIGNED(EVP_CIPHER_CTX_get_cipher_data(ctx)))
  241. static int
  242. padlock_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  243. const unsigned char *in_arg, size_t nbytes)
  244. {
  245. return padlock_ecb_encrypt(out_arg, in_arg,
  246. ALIGNED_CIPHER_DATA(ctx), nbytes);
  247. }
  248. static int
  249. padlock_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  250. const unsigned char *in_arg, size_t nbytes)
  251. {
  252. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  253. int ret;
  254. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  255. if ((ret = padlock_cbc_encrypt(out_arg, in_arg, cdata, nbytes)))
  256. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  257. return ret;
  258. }
  259. static int
  260. padlock_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  261. const unsigned char *in_arg, size_t nbytes)
  262. {
  263. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  264. size_t chunk;
  265. if ((chunk = EVP_CIPHER_CTX_num(ctx))) { /* borrow chunk variable */
  266. unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx);
  267. if (chunk >= AES_BLOCK_SIZE)
  268. return 0; /* bogus value */
  269. if (EVP_CIPHER_CTX_encrypting(ctx))
  270. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  271. ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  272. chunk++, nbytes--;
  273. } else
  274. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  275. unsigned char c = *(in_arg++);
  276. *(out_arg++) = c ^ ivp[chunk];
  277. ivp[chunk++] = c, nbytes--;
  278. }
  279. EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE);
  280. }
  281. if (nbytes == 0)
  282. return 1;
  283. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  284. if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) {
  285. if (!padlock_cfb_encrypt(out_arg, in_arg, cdata, chunk))
  286. return 0;
  287. nbytes -= chunk;
  288. }
  289. if (nbytes) {
  290. unsigned char *ivp = cdata->iv;
  291. out_arg += chunk;
  292. in_arg += chunk;
  293. EVP_CIPHER_CTX_set_num(ctx, nbytes);
  294. if (cdata->cword.b.encdec) {
  295. cdata->cword.b.encdec = 0;
  296. padlock_reload_key();
  297. padlock_aes_block(ivp, ivp, cdata);
  298. cdata->cword.b.encdec = 1;
  299. padlock_reload_key();
  300. while (nbytes) {
  301. unsigned char c = *(in_arg++);
  302. *(out_arg++) = c ^ *ivp;
  303. *(ivp++) = c, nbytes--;
  304. }
  305. } else {
  306. padlock_reload_key();
  307. padlock_aes_block(ivp, ivp, cdata);
  308. padlock_reload_key();
  309. while (nbytes) {
  310. *ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
  311. ivp++, nbytes--;
  312. }
  313. }
  314. }
  315. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  316. return 1;
  317. }
  318. static int
  319. padlock_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  320. const unsigned char *in_arg, size_t nbytes)
  321. {
  322. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  323. size_t chunk;
  324. /*
  325. * ctx->num is maintained in byte-oriented modes, such as CFB and OFB...
  326. */
  327. if ((chunk = EVP_CIPHER_CTX_num(ctx))) { /* borrow chunk variable */
  328. unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx);
  329. if (chunk >= AES_BLOCK_SIZE)
  330. return 0; /* bogus value */
  331. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  332. *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  333. chunk++, nbytes--;
  334. }
  335. EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE);
  336. }
  337. if (nbytes == 0)
  338. return 1;
  339. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  340. if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) {
  341. if (!padlock_ofb_encrypt(out_arg, in_arg, cdata, chunk))
  342. return 0;
  343. nbytes -= chunk;
  344. }
  345. if (nbytes) {
  346. unsigned char *ivp = cdata->iv;
  347. out_arg += chunk;
  348. in_arg += chunk;
  349. EVP_CIPHER_CTX_set_num(ctx, nbytes);
  350. padlock_reload_key(); /* empirically found */
  351. padlock_aes_block(ivp, ivp, cdata);
  352. padlock_reload_key(); /* empirically found */
  353. while (nbytes) {
  354. *(out_arg++) = *(in_arg++) ^ *ivp;
  355. ivp++, nbytes--;
  356. }
  357. }
  358. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  359. return 1;
  360. }
  361. static void padlock_ctr32_encrypt_glue(const unsigned char *in,
  362. unsigned char *out, size_t blocks,
  363. struct padlock_cipher_data *ctx,
  364. const unsigned char *ivec)
  365. {
  366. memcpy(ctx->iv, ivec, AES_BLOCK_SIZE);
  367. padlock_ctr32_encrypt(out, in, ctx, AES_BLOCK_SIZE * blocks);
  368. }
  369. static int
  370. padlock_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  371. const unsigned char *in_arg, size_t nbytes)
  372. {
  373. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  374. unsigned int num = EVP_CIPHER_CTX_num(ctx);
  375. CRYPTO_ctr128_encrypt_ctr32(in_arg, out_arg, nbytes,
  376. cdata, EVP_CIPHER_CTX_iv_noconst(ctx),
  377. EVP_CIPHER_CTX_buf_noconst(ctx), &num,
  378. (ctr128_f) padlock_ctr32_encrypt_glue);
  379. EVP_CIPHER_CTX_set_num(ctx, (size_t)num);
  380. return 1;
  381. }
  382. # define EVP_CIPHER_block_size_ECB AES_BLOCK_SIZE
  383. # define EVP_CIPHER_block_size_CBC AES_BLOCK_SIZE
  384. # define EVP_CIPHER_block_size_OFB 1
  385. # define EVP_CIPHER_block_size_CFB 1
  386. # define EVP_CIPHER_block_size_CTR 1
  387. /*
  388. * Declaring so many ciphers by hand would be a pain. Instead introduce a bit
  389. * of preprocessor magic :-)
  390. */
  391. # define DECLARE_AES_EVP(ksize,lmode,umode) \
  392. static EVP_CIPHER *_hidden_aes_##ksize##_##lmode = NULL; \
  393. static const EVP_CIPHER *padlock_aes_##ksize##_##lmode(void) \
  394. { \
  395. if (_hidden_aes_##ksize##_##lmode == NULL \
  396. && ((_hidden_aes_##ksize##_##lmode = \
  397. EVP_CIPHER_meth_new(NID_aes_##ksize##_##lmode, \
  398. EVP_CIPHER_block_size_##umode, \
  399. AES_KEY_SIZE_##ksize)) == NULL \
  400. || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_##ksize##_##lmode, \
  401. AES_BLOCK_SIZE) \
  402. || !EVP_CIPHER_meth_set_flags(_hidden_aes_##ksize##_##lmode, \
  403. 0 | EVP_CIPH_##umode##_MODE) \
  404. || !EVP_CIPHER_meth_set_init(_hidden_aes_##ksize##_##lmode, \
  405. padlock_aes_init_key) \
  406. || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_##ksize##_##lmode, \
  407. padlock_##lmode##_cipher) \
  408. || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_##ksize##_##lmode, \
  409. sizeof(struct padlock_cipher_data) + 16) \
  410. || !EVP_CIPHER_meth_set_set_asn1_params(_hidden_aes_##ksize##_##lmode, \
  411. EVP_CIPHER_set_asn1_iv) \
  412. || !EVP_CIPHER_meth_set_get_asn1_params(_hidden_aes_##ksize##_##lmode, \
  413. EVP_CIPHER_get_asn1_iv))) { \
  414. EVP_CIPHER_meth_free(_hidden_aes_##ksize##_##lmode); \
  415. _hidden_aes_##ksize##_##lmode = NULL; \
  416. } \
  417. return _hidden_aes_##ksize##_##lmode; \
  418. }
  419. DECLARE_AES_EVP(128, ecb, ECB)
  420. DECLARE_AES_EVP(128, cbc, CBC)
  421. DECLARE_AES_EVP(128, cfb, CFB)
  422. DECLARE_AES_EVP(128, ofb, OFB)
  423. DECLARE_AES_EVP(128, ctr, CTR)
  424. DECLARE_AES_EVP(192, ecb, ECB)
  425. DECLARE_AES_EVP(192, cbc, CBC)
  426. DECLARE_AES_EVP(192, cfb, CFB)
  427. DECLARE_AES_EVP(192, ofb, OFB)
  428. DECLARE_AES_EVP(192, ctr, CTR)
  429. DECLARE_AES_EVP(256, ecb, ECB)
  430. DECLARE_AES_EVP(256, cbc, CBC)
  431. DECLARE_AES_EVP(256, cfb, CFB)
  432. DECLARE_AES_EVP(256, ofb, OFB)
  433. DECLARE_AES_EVP(256, ctr, CTR)
  434. static int
  435. padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids,
  436. int nid)
  437. {
  438. /* No specific cipher => return a list of supported nids ... */
  439. if (!cipher) {
  440. *nids = padlock_cipher_nids;
  441. return padlock_cipher_nids_num;
  442. }
  443. /* ... or the requested "cipher" otherwise */
  444. switch (nid) {
  445. case NID_aes_128_ecb:
  446. *cipher = padlock_aes_128_ecb();
  447. break;
  448. case NID_aes_128_cbc:
  449. *cipher = padlock_aes_128_cbc();
  450. break;
  451. case NID_aes_128_cfb:
  452. *cipher = padlock_aes_128_cfb();
  453. break;
  454. case NID_aes_128_ofb:
  455. *cipher = padlock_aes_128_ofb();
  456. break;
  457. case NID_aes_128_ctr:
  458. *cipher = padlock_aes_128_ctr();
  459. break;
  460. case NID_aes_192_ecb:
  461. *cipher = padlock_aes_192_ecb();
  462. break;
  463. case NID_aes_192_cbc:
  464. *cipher = padlock_aes_192_cbc();
  465. break;
  466. case NID_aes_192_cfb:
  467. *cipher = padlock_aes_192_cfb();
  468. break;
  469. case NID_aes_192_ofb:
  470. *cipher = padlock_aes_192_ofb();
  471. break;
  472. case NID_aes_192_ctr:
  473. *cipher = padlock_aes_192_ctr();
  474. break;
  475. case NID_aes_256_ecb:
  476. *cipher = padlock_aes_256_ecb();
  477. break;
  478. case NID_aes_256_cbc:
  479. *cipher = padlock_aes_256_cbc();
  480. break;
  481. case NID_aes_256_cfb:
  482. *cipher = padlock_aes_256_cfb();
  483. break;
  484. case NID_aes_256_ofb:
  485. *cipher = padlock_aes_256_ofb();
  486. break;
  487. case NID_aes_256_ctr:
  488. *cipher = padlock_aes_256_ctr();
  489. break;
  490. default:
  491. /* Sorry, we don't support this NID */
  492. *cipher = NULL;
  493. return 0;
  494. }
  495. return 1;
  496. }
  497. /* Prepare the encryption key for PadLock usage */
  498. static int
  499. padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  500. const unsigned char *iv, int enc)
  501. {
  502. struct padlock_cipher_data *cdata;
  503. int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
  504. unsigned long mode = EVP_CIPHER_CTX_mode(ctx);
  505. if (key == NULL)
  506. return 0; /* ERROR */
  507. cdata = ALIGNED_CIPHER_DATA(ctx);
  508. memset(cdata, 0, sizeof(*cdata));
  509. /* Prepare Control word. */
  510. if (mode == EVP_CIPH_OFB_MODE || mode == EVP_CIPH_CTR_MODE)
  511. cdata->cword.b.encdec = 0;
  512. else
  513. cdata->cword.b.encdec = (EVP_CIPHER_CTX_encrypting(ctx) == 0);
  514. cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
  515. cdata->cword.b.ksize = (key_len - 128) / 64;
  516. switch (key_len) {
  517. case 128:
  518. /*
  519. * PadLock can generate an extended key for AES128 in hardware
  520. */
  521. memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
  522. cdata->cword.b.keygen = 0;
  523. break;
  524. case 192:
  525. case 256:
  526. /*
  527. * Generate an extended AES key in software. Needed for AES192/AES256
  528. */
  529. /*
  530. * Well, the above applies to Stepping 8 CPUs and is listed as
  531. * hardware errata. They most likely will fix it at some point and
  532. * then a check for stepping would be due here.
  533. */
  534. if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
  535. && !enc)
  536. AES_set_decrypt_key(key, key_len, &cdata->ks);
  537. else
  538. AES_set_encrypt_key(key, key_len, &cdata->ks);
  539. # ifndef AES_ASM
  540. /*
  541. * OpenSSL C functions use byte-swapped extended key.
  542. */
  543. padlock_key_bswap(&cdata->ks);
  544. # endif
  545. cdata->cword.b.keygen = 1;
  546. break;
  547. default:
  548. /* ERROR */
  549. return 0;
  550. }
  551. /*
  552. * This is done to cover for cases when user reuses the
  553. * context for new key. The catch is that if we don't do
  554. * this, padlock_eas_cipher might proceed with old key...
  555. */
  556. padlock_reload_key();
  557. return 1;
  558. }
  559. /* ===== Random Number Generator ===== */
  560. /*
  561. * This code is not engaged. The reason is that it does not comply
  562. * with recommendations for VIA RNG usage for secure applications
  563. * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
  564. * provide meaningful error control...
  565. */
  566. /*
  567. * Wrapper that provides an interface between the API and the raw PadLock
  568. * RNG
  569. */
  570. static int padlock_rand_bytes(unsigned char *output, int count)
  571. {
  572. unsigned int eax, buf;
  573. while (count >= 8) {
  574. eax = padlock_xstore(output, 0);
  575. if (!(eax & (1 << 6)))
  576. return 0; /* RNG disabled */
  577. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  578. if (eax & (0x1F << 10))
  579. return 0;
  580. if ((eax & 0x1F) == 0)
  581. continue; /* no data, retry... */
  582. if ((eax & 0x1F) != 8)
  583. return 0; /* fatal failure... */
  584. output += 8;
  585. count -= 8;
  586. }
  587. while (count > 0) {
  588. eax = padlock_xstore(&buf, 3);
  589. if (!(eax & (1 << 6)))
  590. return 0; /* RNG disabled */
  591. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  592. if (eax & (0x1F << 10))
  593. return 0;
  594. if ((eax & 0x1F) == 0)
  595. continue; /* no data, retry... */
  596. if ((eax & 0x1F) != 1)
  597. return 0; /* fatal failure... */
  598. *output++ = (unsigned char)buf;
  599. count--;
  600. }
  601. OPENSSL_cleanse(&buf, sizeof(buf));
  602. return 1;
  603. }
  604. /* Dummy but necessary function */
  605. static int padlock_rand_status(void)
  606. {
  607. return 1;
  608. }
  609. /* Prepare structure for registration */
  610. static RAND_METHOD padlock_rand = {
  611. NULL, /* seed */
  612. padlock_rand_bytes, /* bytes */
  613. NULL, /* cleanup */
  614. NULL, /* add */
  615. padlock_rand_bytes, /* pseudorand */
  616. padlock_rand_status, /* rand status */
  617. };
  618. # endif /* COMPILE_PADLOCKENG */
  619. #endif /* !OPENSSL_NO_PADLOCKENG */
  620. #if defined(OPENSSL_NO_PADLOCKENG) || !defined(COMPILE_PADLOCKENG)
  621. # ifndef OPENSSL_NO_DYNAMIC_ENGINE
  622. OPENSSL_EXPORT
  623. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
  624. OPENSSL_EXPORT
  625. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns)
  626. {
  627. return 0;
  628. }
  629. IMPLEMENT_DYNAMIC_CHECK_FN()
  630. # endif
  631. #endif