2
0

e_padlock.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782
  1. /*
  2. * Support for VIA PadLock Advanced Cryptography Engine (ACE)
  3. * Written by Michal Ludvig <michal@logix.cz>
  4. * http://www.logix.cz/michal
  5. *
  6. * Big thanks to Andy Polyakov for a help with optimization,
  7. * assembler fixes, port to MS Windows and a lot of other
  8. * valuable work on this engine!
  9. */
  10. /* ====================================================================
  11. * Copyright (c) 1999-2001 The OpenSSL Project. All rights reserved.
  12. *
  13. * Redistribution and use in source and binary forms, with or without
  14. * modification, are permitted provided that the following conditions
  15. * are met:
  16. *
  17. * 1. Redistributions of source code must retain the above copyright
  18. * notice, this list of conditions and the following disclaimer.
  19. *
  20. * 2. Redistributions in binary form must reproduce the above copyright
  21. * notice, this list of conditions and the following disclaimer in
  22. * the documentation and/or other materials provided with the
  23. * distribution.
  24. *
  25. * 3. All advertising materials mentioning features or use of this
  26. * software must display the following acknowledgment:
  27. * "This product includes software developed by the OpenSSL Project
  28. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  29. *
  30. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  31. * endorse or promote products derived from this software without
  32. * prior written permission. For written permission, please contact
  33. * licensing@OpenSSL.org.
  34. *
  35. * 5. Products derived from this software may not be called "OpenSSL"
  36. * nor may "OpenSSL" appear in their names without prior written
  37. * permission of the OpenSSL Project.
  38. *
  39. * 6. Redistributions of any form whatsoever must retain the following
  40. * acknowledgment:
  41. * "This product includes software developed by the OpenSSL Project
  42. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  43. *
  44. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  45. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  46. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  47. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  48. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  49. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  50. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  51. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  52. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  53. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  54. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  55. * OF THE POSSIBILITY OF SUCH DAMAGE.
  56. * ====================================================================
  57. *
  58. * This product includes cryptographic software written by Eric Young
  59. * (eay@cryptsoft.com). This product includes software written by Tim
  60. * Hudson (tjh@cryptsoft.com).
  61. *
  62. */
  63. #include <stdio.h>
  64. #include <string.h>
  65. #include <openssl/opensslconf.h>
  66. #include <openssl/crypto.h>
  67. #include <openssl/dso.h>
  68. #include <openssl/engine.h>
  69. #include <openssl/evp.h>
  70. #ifndef OPENSSL_NO_AES
  71. #include <openssl/aes.h>
  72. #endif
  73. #include <openssl/rand.h>
  74. #include <openssl/err.h>
  75. #include <openssl/modes.h>
  76. #ifndef OPENSSL_NO_HW
  77. #ifndef OPENSSL_NO_HW_PADLOCK
  78. /* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */
  79. #if (OPENSSL_VERSION_NUMBER >= 0x00908000L)
  80. # ifndef OPENSSL_NO_DYNAMIC_ENGINE
  81. # define DYNAMIC_ENGINE
  82. # endif
  83. #elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)
  84. # ifdef ENGINE_DYNAMIC_SUPPORT
  85. # define DYNAMIC_ENGINE
  86. # endif
  87. #else
  88. # error "Only OpenSSL >= 0.9.7 is supported"
  89. #endif
  90. /* VIA PadLock AES is available *ONLY* on some x86 CPUs.
  91. Not only that it doesn't exist elsewhere, but it
  92. even can't be compiled on other platforms! */
  93. #undef COMPILE_HW_PADLOCK
  94. #if !defined(I386_ONLY) && !defined(OPENSSL_NO_ASM)
  95. # if defined(__i386__) || defined(__i386) || \
  96. defined(__x86_64__) || defined(__x86_64) || \
  97. defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64) || \
  98. defined(__INTEL__)
  99. # define COMPILE_HW_PADLOCK
  100. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  101. static ENGINE *ENGINE_padlock (void);
  102. # endif
  103. # endif
  104. #endif
  105. #ifdef OPENSSL_NO_DYNAMIC_ENGINE
  106. void ENGINE_load_padlock (void)
  107. {
  108. /* On non-x86 CPUs it just returns. */
  109. #ifdef COMPILE_HW_PADLOCK
  110. ENGINE *toadd = ENGINE_padlock ();
  111. if (!toadd) return;
  112. ENGINE_add (toadd);
  113. ENGINE_free (toadd);
  114. ERR_clear_error ();
  115. #endif
  116. }
  117. #endif
  118. #ifdef COMPILE_HW_PADLOCK
  119. /* Function for ENGINE detection and control */
  120. static int padlock_available(void);
  121. static int padlock_init(ENGINE *e);
  122. /* RNG Stuff */
  123. static RAND_METHOD padlock_rand;
  124. /* Cipher Stuff */
  125. #ifndef OPENSSL_NO_AES
  126. static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
  127. #endif
  128. /* Engine names */
  129. static const char *padlock_id = "padlock";
  130. static char padlock_name[100];
  131. /* Available features */
  132. static int padlock_use_ace = 0; /* Advanced Cryptography Engine */
  133. static int padlock_use_rng = 0; /* Random Number Generator */
  134. /* ===== Engine "management" functions ===== */
  135. /* Prepare the ENGINE structure for registration */
  136. static int
  137. padlock_bind_helper(ENGINE *e)
  138. {
  139. /* Check available features */
  140. padlock_available();
  141. #if 1 /* disable RNG for now, see commentary in vicinity of RNG code */
  142. padlock_use_rng=0;
  143. #endif
  144. /* Generate a nice engine name with available features */
  145. BIO_snprintf(padlock_name, sizeof(padlock_name),
  146. "VIA PadLock (%s, %s)",
  147. padlock_use_rng ? "RNG" : "no-RNG",
  148. padlock_use_ace ? "ACE" : "no-ACE");
  149. /* Register everything or return with an error */
  150. if (!ENGINE_set_id(e, padlock_id) ||
  151. !ENGINE_set_name(e, padlock_name) ||
  152. !ENGINE_set_init_function(e, padlock_init) ||
  153. #ifndef OPENSSL_NO_AES
  154. (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||
  155. #endif
  156. (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {
  157. return 0;
  158. }
  159. /* Everything looks good */
  160. return 1;
  161. }
  162. #ifdef OPENSSL_NO_DYNAMIC_ENGINE
  163. /* Constructor */
  164. static ENGINE *
  165. ENGINE_padlock(void)
  166. {
  167. ENGINE *eng = ENGINE_new();
  168. if (!eng) {
  169. return NULL;
  170. }
  171. if (!padlock_bind_helper(eng)) {
  172. ENGINE_free(eng);
  173. return NULL;
  174. }
  175. return eng;
  176. }
  177. #endif
  178. /* Check availability of the engine */
  179. static int
  180. padlock_init(ENGINE *e)
  181. {
  182. return (padlock_use_rng || padlock_use_ace);
  183. }
  184. /* This stuff is needed if this ENGINE is being compiled into a self-contained
  185. * shared-library.
  186. */
  187. #ifdef DYNAMIC_ENGINE
  188. static int
  189. padlock_bind_fn(ENGINE *e, const char *id)
  190. {
  191. if (id && (strcmp(id, padlock_id) != 0)) {
  192. return 0;
  193. }
  194. if (!padlock_bind_helper(e)) {
  195. return 0;
  196. }
  197. return 1;
  198. }
  199. IMPLEMENT_DYNAMIC_CHECK_FN()
  200. IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)
  201. #endif /* DYNAMIC_ENGINE */
  202. /* ===== Here comes the "real" engine ===== */
  203. #ifndef OPENSSL_NO_AES
  204. /* Some AES-related constants */
  205. #define AES_BLOCK_SIZE 16
  206. #define AES_KEY_SIZE_128 16
  207. #define AES_KEY_SIZE_192 24
  208. #define AES_KEY_SIZE_256 32
  209. /* Here we store the status information relevant to the
  210. current context. */
  211. /* BIG FAT WARNING:
  212. * Inline assembler in PADLOCK_XCRYPT_ASM()
  213. * depends on the order of items in this structure.
  214. * Don't blindly modify, reorder, etc!
  215. */
  216. struct padlock_cipher_data
  217. {
  218. unsigned char iv[AES_BLOCK_SIZE]; /* Initialization vector */
  219. union { unsigned int pad[4];
  220. struct {
  221. int rounds:4;
  222. int dgst:1; /* n/a in C3 */
  223. int align:1; /* n/a in C3 */
  224. int ciphr:1; /* n/a in C3 */
  225. unsigned int keygen:1;
  226. int interm:1;
  227. unsigned int encdec:1;
  228. int ksize:2;
  229. } b;
  230. } cword; /* Control word */
  231. AES_KEY ks; /* Encryption key */
  232. };
  233. #endif
  234. /* Interface to assembler module */
  235. unsigned int padlock_capability();
  236. void padlock_key_bswap(AES_KEY *key);
  237. void padlock_verify_context(struct padlock_cipher_data *ctx);
  238. void padlock_reload_key();
  239. void padlock_aes_block(void *out, const void *inp,
  240. struct padlock_cipher_data *ctx);
  241. int padlock_ecb_encrypt(void *out, const void *inp,
  242. struct padlock_cipher_data *ctx, size_t len);
  243. int padlock_cbc_encrypt(void *out, const void *inp,
  244. struct padlock_cipher_data *ctx, size_t len);
  245. int padlock_cfb_encrypt(void *out, const void *inp,
  246. struct padlock_cipher_data *ctx, size_t len);
  247. int padlock_ofb_encrypt(void *out, const void *inp,
  248. struct padlock_cipher_data *ctx, size_t len);
  249. int padlock_ctr32_encrypt(void *out, const void *inp,
  250. struct padlock_cipher_data *ctx, size_t len);
  251. int padlock_xstore(void *out,int edx);
  252. void padlock_sha1_oneshot(void *ctx,const void *inp,size_t len);
  253. void padlock_sha1(void *ctx,const void *inp,size_t len);
  254. void padlock_sha256_oneshot(void *ctx,const void *inp,size_t len);
  255. void padlock_sha256(void *ctx,const void *inp,size_t len);
  256. /* Load supported features of the CPU to see if
  257. the PadLock is available. */
  258. static int
  259. padlock_available(void)
  260. {
  261. unsigned int edx = padlock_capability();
  262. /* Fill up some flags */
  263. padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));
  264. padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));
  265. return padlock_use_ace + padlock_use_rng;
  266. }
  267. /* ===== AES encryption/decryption ===== */
  268. #ifndef OPENSSL_NO_AES
  269. #if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
  270. #define NID_aes_128_cfb NID_aes_128_cfb128
  271. #endif
  272. #if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
  273. #define NID_aes_128_ofb NID_aes_128_ofb128
  274. #endif
  275. #if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
  276. #define NID_aes_192_cfb NID_aes_192_cfb128
  277. #endif
  278. #if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
  279. #define NID_aes_192_ofb NID_aes_192_ofb128
  280. #endif
  281. #if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
  282. #define NID_aes_256_cfb NID_aes_256_cfb128
  283. #endif
  284. #if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
  285. #define NID_aes_256_ofb NID_aes_256_ofb128
  286. #endif
  287. /* List of supported ciphers. */
  288. static int padlock_cipher_nids[] = {
  289. NID_aes_128_ecb,
  290. NID_aes_128_cbc,
  291. NID_aes_128_cfb,
  292. NID_aes_128_ofb,
  293. NID_aes_128_ctr,
  294. NID_aes_192_ecb,
  295. NID_aes_192_cbc,
  296. NID_aes_192_cfb,
  297. NID_aes_192_ofb,
  298. NID_aes_192_ctr,
  299. NID_aes_256_ecb,
  300. NID_aes_256_cbc,
  301. NID_aes_256_cfb,
  302. NID_aes_256_ofb,
  303. NID_aes_256_ctr
  304. };
  305. static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/
  306. sizeof(padlock_cipher_nids[0]));
  307. /* Function prototypes ... */
  308. static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  309. const unsigned char *iv, int enc);
  310. #define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) + \
  311. ( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F ) )
  312. #define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
  313. NEAREST_ALIGNED(ctx->cipher_data))
  314. static int
  315. padlock_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  316. const unsigned char *in_arg, size_t nbytes)
  317. {
  318. return padlock_ecb_encrypt(out_arg,in_arg,
  319. ALIGNED_CIPHER_DATA(ctx),nbytes);
  320. }
  321. static int
  322. padlock_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  323. const unsigned char *in_arg, size_t nbytes)
  324. {
  325. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  326. int ret;
  327. memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
  328. if ((ret = padlock_cbc_encrypt(out_arg,in_arg,cdata,nbytes)))
  329. memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
  330. return ret;
  331. }
  332. static int
  333. padlock_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  334. const unsigned char *in_arg, size_t nbytes)
  335. {
  336. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  337. size_t chunk;
  338. if ((chunk = ctx->num)) { /* borrow chunk variable */
  339. unsigned char *ivp=ctx->iv;
  340. if (chunk >= AES_BLOCK_SIZE)
  341. return 0; /* bogus value */
  342. if (ctx->encrypt)
  343. while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
  344. ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  345. chunk++, nbytes--;
  346. }
  347. else while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
  348. unsigned char c = *(in_arg++);
  349. *(out_arg++) = c ^ ivp[chunk];
  350. ivp[chunk++] = c, nbytes--;
  351. }
  352. ctx->num = chunk%AES_BLOCK_SIZE;
  353. }
  354. if (nbytes == 0)
  355. return 1;
  356. memcpy (cdata->iv, ctx->iv, AES_BLOCK_SIZE);
  357. if ((chunk = nbytes & ~(AES_BLOCK_SIZE-1))) {
  358. if (!padlock_cfb_encrypt(out_arg,in_arg,cdata,chunk))
  359. return 0;
  360. nbytes -= chunk;
  361. }
  362. if (nbytes) {
  363. unsigned char *ivp = cdata->iv;
  364. out_arg += chunk;
  365. in_arg += chunk;
  366. ctx->num = nbytes;
  367. if (cdata->cword.b.encdec) {
  368. cdata->cword.b.encdec=0;
  369. padlock_reload_key();
  370. padlock_aes_block(ivp,ivp,cdata);
  371. cdata->cword.b.encdec=1;
  372. padlock_reload_key();
  373. while(nbytes) {
  374. unsigned char c = *(in_arg++);
  375. *(out_arg++) = c ^ *ivp;
  376. *(ivp++) = c, nbytes--;
  377. }
  378. }
  379. else { padlock_reload_key();
  380. padlock_aes_block(ivp,ivp,cdata);
  381. padlock_reload_key();
  382. while (nbytes) {
  383. *ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
  384. ivp++, nbytes--;
  385. }
  386. }
  387. }
  388. memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
  389. return 1;
  390. }
  391. static int
  392. padlock_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  393. const unsigned char *in_arg, size_t nbytes)
  394. {
  395. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  396. size_t chunk;
  397. /* ctx->num is maintained in byte-oriented modes,
  398. such as CFB and OFB... */
  399. if ((chunk = ctx->num)) { /* borrow chunk variable */
  400. unsigned char *ivp=ctx->iv;
  401. if (chunk >= AES_BLOCK_SIZE)
  402. return 0; /* bogus value */
  403. while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
  404. *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  405. chunk++, nbytes--;
  406. }
  407. ctx->num = chunk%AES_BLOCK_SIZE;
  408. }
  409. if (nbytes == 0)
  410. return 1;
  411. memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
  412. if ((chunk = nbytes & ~(AES_BLOCK_SIZE-1))) {
  413. if (!padlock_ofb_encrypt(out_arg,in_arg,cdata,chunk))
  414. return 0;
  415. nbytes -= chunk;
  416. }
  417. if (nbytes) {
  418. unsigned char *ivp = cdata->iv;
  419. out_arg += chunk;
  420. in_arg += chunk;
  421. ctx->num = nbytes;
  422. padlock_reload_key(); /* empirically found */
  423. padlock_aes_block(ivp,ivp,cdata);
  424. padlock_reload_key(); /* empirically found */
  425. while (nbytes) {
  426. *(out_arg++) = *(in_arg++) ^ *ivp;
  427. ivp++, nbytes--;
  428. }
  429. }
  430. memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
  431. return 1;
  432. }
  433. static void padlock_ctr32_encrypt_glue(const unsigned char *in,
  434. unsigned char *out, size_t blocks,
  435. struct padlock_cipher_data *ctx,
  436. const unsigned char *ivec)
  437. {
  438. memcpy(ctx->iv,ivec,AES_BLOCK_SIZE);
  439. padlock_ctr32_encrypt(out,in,ctx,AES_BLOCK_SIZE*blocks);
  440. }
  441. static int
  442. padlock_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  443. const unsigned char *in_arg, size_t nbytes)
  444. {
  445. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  446. unsigned int num = ctx->num;
  447. CRYPTO_ctr128_encrypt_ctr32(in_arg,out_arg,nbytes,
  448. cdata,ctx->iv,ctx->buf,&num,
  449. (ctr128_f)padlock_ctr32_encrypt_glue);
  450. ctx->num = (size_t)num;
  451. return 1;
  452. }
  453. #define EVP_CIPHER_block_size_ECB AES_BLOCK_SIZE
  454. #define EVP_CIPHER_block_size_CBC AES_BLOCK_SIZE
  455. #define EVP_CIPHER_block_size_OFB 1
  456. #define EVP_CIPHER_block_size_CFB 1
  457. #define EVP_CIPHER_block_size_CTR 1
  458. /* Declaring so many ciphers by hand would be a pain.
  459. Instead introduce a bit of preprocessor magic :-) */
  460. #define DECLARE_AES_EVP(ksize,lmode,umode) \
  461. static const EVP_CIPHER padlock_aes_##ksize##_##lmode = { \
  462. NID_aes_##ksize##_##lmode, \
  463. EVP_CIPHER_block_size_##umode, \
  464. AES_KEY_SIZE_##ksize, \
  465. AES_BLOCK_SIZE, \
  466. 0 | EVP_CIPH_##umode##_MODE, \
  467. padlock_aes_init_key, \
  468. padlock_##lmode##_cipher, \
  469. NULL, \
  470. sizeof(struct padlock_cipher_data) + 16, \
  471. EVP_CIPHER_set_asn1_iv, \
  472. EVP_CIPHER_get_asn1_iv, \
  473. NULL, \
  474. NULL \
  475. }
  476. DECLARE_AES_EVP(128,ecb,ECB);
  477. DECLARE_AES_EVP(128,cbc,CBC);
  478. DECLARE_AES_EVP(128,cfb,CFB);
  479. DECLARE_AES_EVP(128,ofb,OFB);
  480. DECLARE_AES_EVP(128,ctr,CTR);
  481. DECLARE_AES_EVP(192,ecb,ECB);
  482. DECLARE_AES_EVP(192,cbc,CBC);
  483. DECLARE_AES_EVP(192,cfb,CFB);
  484. DECLARE_AES_EVP(192,ofb,OFB);
  485. DECLARE_AES_EVP(192,ctr,CTR);
  486. DECLARE_AES_EVP(256,ecb,ECB);
  487. DECLARE_AES_EVP(256,cbc,CBC);
  488. DECLARE_AES_EVP(256,cfb,CFB);
  489. DECLARE_AES_EVP(256,ofb,OFB);
  490. DECLARE_AES_EVP(256,ctr,CTR);
  491. static int
  492. padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)
  493. {
  494. /* No specific cipher => return a list of supported nids ... */
  495. if (!cipher) {
  496. *nids = padlock_cipher_nids;
  497. return padlock_cipher_nids_num;
  498. }
  499. /* ... or the requested "cipher" otherwise */
  500. switch (nid) {
  501. case NID_aes_128_ecb:
  502. *cipher = &padlock_aes_128_ecb;
  503. break;
  504. case NID_aes_128_cbc:
  505. *cipher = &padlock_aes_128_cbc;
  506. break;
  507. case NID_aes_128_cfb:
  508. *cipher = &padlock_aes_128_cfb;
  509. break;
  510. case NID_aes_128_ofb:
  511. *cipher = &padlock_aes_128_ofb;
  512. break;
  513. case NID_aes_128_ctr:
  514. *cipher = &padlock_aes_128_ctr;
  515. break;
  516. case NID_aes_192_ecb:
  517. *cipher = &padlock_aes_192_ecb;
  518. break;
  519. case NID_aes_192_cbc:
  520. *cipher = &padlock_aes_192_cbc;
  521. break;
  522. case NID_aes_192_cfb:
  523. *cipher = &padlock_aes_192_cfb;
  524. break;
  525. case NID_aes_192_ofb:
  526. *cipher = &padlock_aes_192_ofb;
  527. break;
  528. case NID_aes_192_ctr:
  529. *cipher = &padlock_aes_192_ctr;
  530. break;
  531. case NID_aes_256_ecb:
  532. *cipher = &padlock_aes_256_ecb;
  533. break;
  534. case NID_aes_256_cbc:
  535. *cipher = &padlock_aes_256_cbc;
  536. break;
  537. case NID_aes_256_cfb:
  538. *cipher = &padlock_aes_256_cfb;
  539. break;
  540. case NID_aes_256_ofb:
  541. *cipher = &padlock_aes_256_ofb;
  542. break;
  543. case NID_aes_256_ctr:
  544. *cipher = &padlock_aes_256_ctr;
  545. break;
  546. default:
  547. /* Sorry, we don't support this NID */
  548. *cipher = NULL;
  549. return 0;
  550. }
  551. return 1;
  552. }
  553. /* Prepare the encryption key for PadLock usage */
  554. static int
  555. padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,
  556. const unsigned char *iv, int enc)
  557. {
  558. struct padlock_cipher_data *cdata;
  559. int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
  560. unsigned long mode = EVP_CIPHER_CTX_mode(ctx);
  561. if (key==NULL) return 0; /* ERROR */
  562. cdata = ALIGNED_CIPHER_DATA(ctx);
  563. memset(cdata, 0, sizeof(struct padlock_cipher_data));
  564. /* Prepare Control word. */
  565. if (mode == EVP_CIPH_OFB_MODE || mode == EVP_CIPH_CTR_MODE)
  566. cdata->cword.b.encdec = 0;
  567. else
  568. cdata->cword.b.encdec = (ctx->encrypt == 0);
  569. cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
  570. cdata->cword.b.ksize = (key_len - 128) / 64;
  571. switch(key_len) {
  572. case 128:
  573. /* PadLock can generate an extended key for
  574. AES128 in hardware */
  575. memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
  576. cdata->cword.b.keygen = 0;
  577. break;
  578. case 192:
  579. case 256:
  580. /* Generate an extended AES key in software.
  581. Needed for AES192/AES256 */
  582. /* Well, the above applies to Stepping 8 CPUs
  583. and is listed as hardware errata. They most
  584. likely will fix it at some point and then
  585. a check for stepping would be due here. */
  586. if ((mode == EVP_CIPH_ECB_MODE ||
  587. mode == EVP_CIPH_CBC_MODE)
  588. && !enc)
  589. AES_set_decrypt_key(key, key_len, &cdata->ks);
  590. else
  591. AES_set_encrypt_key(key, key_len, &cdata->ks);
  592. #ifndef AES_ASM
  593. /* OpenSSL C functions use byte-swapped extended key. */
  594. padlock_key_bswap(&cdata->ks);
  595. #endif
  596. cdata->cword.b.keygen = 1;
  597. break;
  598. default:
  599. /* ERROR */
  600. return 0;
  601. }
  602. /*
  603. * This is done to cover for cases when user reuses the
  604. * context for new key. The catch is that if we don't do
  605. * this, padlock_eas_cipher might proceed with old key...
  606. */
  607. padlock_reload_key ();
  608. return 1;
  609. }
  610. #endif /* OPENSSL_NO_AES */
  611. /* ===== Random Number Generator ===== */
  612. /*
  613. * This code is not engaged. The reason is that it does not comply
  614. * with recommendations for VIA RNG usage for secure applications
  615. * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
  616. * provide meaningful error control...
  617. */
  618. /* Wrapper that provides an interface between the API and
  619. the raw PadLock RNG */
  620. static int
  621. padlock_rand_bytes(unsigned char *output, int count)
  622. {
  623. unsigned int eax, buf;
  624. while (count >= 8) {
  625. eax = padlock_xstore(output, 0);
  626. if (!(eax&(1<<6))) return 0; /* RNG disabled */
  627. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  628. if (eax&(0x1F<<10)) return 0;
  629. if ((eax&0x1F)==0) continue; /* no data, retry... */
  630. if ((eax&0x1F)!=8) return 0; /* fatal failure... */
  631. output += 8;
  632. count -= 8;
  633. }
  634. while (count > 0) {
  635. eax = padlock_xstore(&buf, 3);
  636. if (!(eax&(1<<6))) return 0; /* RNG disabled */
  637. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  638. if (eax&(0x1F<<10)) return 0;
  639. if ((eax&0x1F)==0) continue; /* no data, retry... */
  640. if ((eax&0x1F)!=1) return 0; /* fatal failure... */
  641. *output++ = (unsigned char)buf;
  642. count--;
  643. }
  644. *(volatile unsigned int *)&buf=0;
  645. return 1;
  646. }
  647. /* Dummy but necessary function */
  648. static int
  649. padlock_rand_status(void)
  650. {
  651. return 1;
  652. }
  653. /* Prepare structure for registration */
  654. static RAND_METHOD padlock_rand = {
  655. NULL, /* seed */
  656. padlock_rand_bytes, /* bytes */
  657. NULL, /* cleanup */
  658. NULL, /* add */
  659. padlock_rand_bytes, /* pseudorand */
  660. padlock_rand_status, /* rand status */
  661. };
  662. #else /* !COMPILE_HW_PADLOCK */
  663. #ifndef OPENSSL_NO_DYNAMIC_ENGINE
  664. OPENSSL_EXPORT
  665. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
  666. OPENSSL_EXPORT
  667. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
  668. IMPLEMENT_DYNAMIC_CHECK_FN()
  669. #endif
  670. #endif /* COMPILE_HW_PADLOCK */
  671. #endif /* !OPENSSL_NO_HW_PADLOCK */
  672. #endif /* !OPENSSL_NO_HW */