e_padlock.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747
  1. /*
  2. * Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * This file uses the low level AES and engine functions (which are deprecated
  11. * for non-internal use) in order to implement the padlock engine AES ciphers.
  12. */
  13. #define OPENSSL_SUPPRESS_DEPRECATED
  14. #include <stdio.h>
  15. #include <string.h>
  16. #include <openssl/opensslconf.h>
  17. #include <openssl/crypto.h>
  18. #include <openssl/engine.h>
  19. #include <openssl/evp.h>
  20. #include <openssl/aes.h>
  21. #include <openssl/rand.h>
  22. #include <openssl/err.h>
  23. #include <openssl/modes.h>
  24. #ifndef OPENSSL_NO_PADLOCKENG
  25. /*
  26. * VIA PadLock AES is available *ONLY* on some x86 CPUs. Not only that it
  27. * doesn't exist elsewhere, but it even can't be compiled on other platforms!
  28. */
  29. # undef COMPILE_PADLOCKENG
  30. # if defined(PADLOCK_ASM)
  31. # define COMPILE_PADLOCKENG
  32. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  33. static ENGINE *ENGINE_padlock(void);
  34. # endif
  35. # endif
  36. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  37. void engine_load_padlock_int(void);
  38. void engine_load_padlock_int(void)
  39. {
  40. /* On non-x86 CPUs it just returns. */
  41. # ifdef COMPILE_PADLOCKENG
  42. ENGINE *toadd = ENGINE_padlock();
  43. if (!toadd)
  44. return;
  45. ERR_set_mark();
  46. ENGINE_add(toadd);
  47. /*
  48. * If the "add" worked, it gets a structural reference. So either way, we
  49. * release our just-created reference.
  50. */
  51. ENGINE_free(toadd);
  52. /*
  53. * If the "add" didn't work, it was probably a conflict because it was
  54. * already added (eg. someone calling ENGINE_load_blah then calling
  55. * ENGINE_load_builtin_engines() perhaps).
  56. */
  57. ERR_pop_to_mark();
  58. # endif
  59. }
  60. # endif
  61. # ifdef COMPILE_PADLOCKENG
  62. /* Function for ENGINE detection and control */
  63. static int padlock_available(void);
  64. static int padlock_init(ENGINE *e);
  65. /* RNG Stuff */
  66. static RAND_METHOD padlock_rand;
  67. /* Cipher Stuff */
  68. static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
  69. const int **nids, int nid);
  70. /* Engine names */
  71. static const char *padlock_id = "padlock";
  72. static char padlock_name[100];
  73. /* Available features */
  74. static int padlock_use_ace = 0; /* Advanced Cryptography Engine */
  75. static int padlock_use_rng = 0; /* Random Number Generator */
  76. /* ===== Engine "management" functions ===== */
  77. /* Prepare the ENGINE structure for registration */
  78. static int padlock_bind_helper(ENGINE *e)
  79. {
  80. /* Check available features */
  81. padlock_available();
  82. /*
  83. * RNG is currently disabled for reasons discussed in commentary just
  84. * before padlock_rand_bytes function.
  85. */
  86. padlock_use_rng = 0;
  87. /* Generate a nice engine name with available features */
  88. BIO_snprintf(padlock_name, sizeof(padlock_name),
  89. "VIA PadLock (%s, %s)",
  90. padlock_use_rng ? "RNG" : "no-RNG",
  91. padlock_use_ace ? "ACE" : "no-ACE");
  92. /* Register everything or return with an error */
  93. if (!ENGINE_set_id(e, padlock_id) ||
  94. !ENGINE_set_name(e, padlock_name) ||
  95. !ENGINE_set_init_function(e, padlock_init) ||
  96. (padlock_use_ace && !ENGINE_set_ciphers(e, padlock_ciphers)) ||
  97. (padlock_use_rng && !ENGINE_set_RAND(e, &padlock_rand))) {
  98. return 0;
  99. }
  100. /* Everything looks good */
  101. return 1;
  102. }
  103. # ifdef OPENSSL_NO_DYNAMIC_ENGINE
  104. /* Constructor */
  105. static ENGINE *ENGINE_padlock(void)
  106. {
  107. ENGINE *eng = ENGINE_new();
  108. if (eng == NULL) {
  109. return NULL;
  110. }
  111. if (!padlock_bind_helper(eng)) {
  112. ENGINE_free(eng);
  113. return NULL;
  114. }
  115. return eng;
  116. }
  117. # endif
  118. /* Check availability of the engine */
  119. static int padlock_init(ENGINE *e)
  120. {
  121. return (padlock_use_rng || padlock_use_ace);
  122. }
  123. /*
  124. * This stuff is needed if this ENGINE is being compiled into a
  125. * self-contained shared-library.
  126. */
  127. # ifndef OPENSSL_NO_DYNAMIC_ENGINE
  128. static int padlock_bind_fn(ENGINE *e, const char *id)
  129. {
  130. if (id && (strcmp(id, padlock_id) != 0)) {
  131. return 0;
  132. }
  133. if (!padlock_bind_helper(e)) {
  134. return 0;
  135. }
  136. return 1;
  137. }
  138. IMPLEMENT_DYNAMIC_CHECK_FN()
  139. IMPLEMENT_DYNAMIC_BIND_FN(padlock_bind_fn)
  140. # endif /* !OPENSSL_NO_DYNAMIC_ENGINE */
  141. /* ===== Here comes the "real" engine ===== */
  142. /* Some AES-related constants */
  143. # define AES_BLOCK_SIZE 16
  144. # define AES_KEY_SIZE_128 16
  145. # define AES_KEY_SIZE_192 24
  146. # define AES_KEY_SIZE_256 32
  147. /*
  148. * Here we store the status information relevant to the current context.
  149. */
  150. /*
  151. * BIG FAT WARNING: Inline assembler in PADLOCK_XCRYPT_ASM() depends on
  152. * the order of items in this structure. Don't blindly modify, reorder,
  153. * etc!
  154. */
  155. struct padlock_cipher_data {
  156. unsigned char iv[AES_BLOCK_SIZE]; /* Initialization vector */
  157. union {
  158. unsigned int pad[4];
  159. struct {
  160. int rounds:4;
  161. int dgst:1; /* n/a in C3 */
  162. int align:1; /* n/a in C3 */
  163. int ciphr:1; /* n/a in C3 */
  164. unsigned int keygen:1;
  165. int interm:1;
  166. unsigned int encdec:1;
  167. int ksize:2;
  168. } b;
  169. } cword; /* Control word */
  170. AES_KEY ks; /* Encryption key */
  171. };
  172. /* Interface to assembler module */
  173. unsigned int padlock_capability(void);
  174. void padlock_key_bswap(AES_KEY *key);
  175. void padlock_verify_context(struct padlock_cipher_data *ctx);
  176. void padlock_reload_key(void);
  177. void padlock_aes_block(void *out, const void *inp,
  178. struct padlock_cipher_data *ctx);
  179. int padlock_ecb_encrypt(void *out, const void *inp,
  180. struct padlock_cipher_data *ctx, size_t len);
  181. int padlock_cbc_encrypt(void *out, const void *inp,
  182. struct padlock_cipher_data *ctx, size_t len);
  183. int padlock_cfb_encrypt(void *out, const void *inp,
  184. struct padlock_cipher_data *ctx, size_t len);
  185. int padlock_ofb_encrypt(void *out, const void *inp,
  186. struct padlock_cipher_data *ctx, size_t len);
  187. int padlock_ctr32_encrypt(void *out, const void *inp,
  188. struct padlock_cipher_data *ctx, size_t len);
  189. int padlock_xstore(void *out, int edx);
  190. void padlock_sha1_oneshot(void *ctx, const void *inp, size_t len);
  191. void padlock_sha1(void *ctx, const void *inp, size_t len);
  192. void padlock_sha256_oneshot(void *ctx, const void *inp, size_t len);
  193. void padlock_sha256(void *ctx, const void *inp, size_t len);
  194. /*
  195. * Load supported features of the CPU to see if the PadLock is available.
  196. */
  197. static int padlock_available(void)
  198. {
  199. unsigned int edx = padlock_capability();
  200. /* Fill up some flags */
  201. padlock_use_ace = ((edx & (0x3 << 6)) == (0x3 << 6));
  202. padlock_use_rng = ((edx & (0x3 << 2)) == (0x3 << 2));
  203. return padlock_use_ace + padlock_use_rng;
  204. }
  205. /* ===== AES encryption/decryption ===== */
  206. # if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
  207. # define NID_aes_128_cfb NID_aes_128_cfb128
  208. # endif
  209. # if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
  210. # define NID_aes_128_ofb NID_aes_128_ofb128
  211. # endif
  212. # if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
  213. # define NID_aes_192_cfb NID_aes_192_cfb128
  214. # endif
  215. # if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
  216. # define NID_aes_192_ofb NID_aes_192_ofb128
  217. # endif
  218. # if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
  219. # define NID_aes_256_cfb NID_aes_256_cfb128
  220. # endif
  221. # if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
  222. # define NID_aes_256_ofb NID_aes_256_ofb128
  223. # endif
  224. /* List of supported ciphers. */
  225. static const int padlock_cipher_nids[] = {
  226. NID_aes_128_ecb,
  227. NID_aes_128_cbc,
  228. NID_aes_128_cfb,
  229. NID_aes_128_ofb,
  230. NID_aes_128_ctr,
  231. NID_aes_192_ecb,
  232. NID_aes_192_cbc,
  233. NID_aes_192_cfb,
  234. NID_aes_192_ofb,
  235. NID_aes_192_ctr,
  236. NID_aes_256_ecb,
  237. NID_aes_256_cbc,
  238. NID_aes_256_cfb,
  239. NID_aes_256_ofb,
  240. NID_aes_256_ctr
  241. };
  242. static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids) /
  243. sizeof(padlock_cipher_nids[0]));
  244. /* Function prototypes ... */
  245. static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  246. const unsigned char *iv, int enc);
  247. # define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) + \
  248. ( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F ) )
  249. # define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
  250. NEAREST_ALIGNED(EVP_CIPHER_CTX_get_cipher_data(ctx)))
  251. static int
  252. padlock_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  253. const unsigned char *in_arg, size_t nbytes)
  254. {
  255. return padlock_ecb_encrypt(out_arg, in_arg,
  256. ALIGNED_CIPHER_DATA(ctx), nbytes);
  257. }
  258. static int
  259. padlock_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  260. const unsigned char *in_arg, size_t nbytes)
  261. {
  262. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  263. int ret;
  264. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  265. if ((ret = padlock_cbc_encrypt(out_arg, in_arg, cdata, nbytes)))
  266. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  267. return ret;
  268. }
  269. static int
  270. padlock_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  271. const unsigned char *in_arg, size_t nbytes)
  272. {
  273. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  274. size_t chunk;
  275. if ((chunk = EVP_CIPHER_CTX_num(ctx))) { /* borrow chunk variable */
  276. unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx);
  277. if (chunk >= AES_BLOCK_SIZE)
  278. return 0; /* bogus value */
  279. if (EVP_CIPHER_CTX_encrypting(ctx))
  280. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  281. ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  282. chunk++, nbytes--;
  283. } else
  284. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  285. unsigned char c = *(in_arg++);
  286. *(out_arg++) = c ^ ivp[chunk];
  287. ivp[chunk++] = c, nbytes--;
  288. }
  289. EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE);
  290. }
  291. if (nbytes == 0)
  292. return 1;
  293. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  294. if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) {
  295. if (!padlock_cfb_encrypt(out_arg, in_arg, cdata, chunk))
  296. return 0;
  297. nbytes -= chunk;
  298. }
  299. if (nbytes) {
  300. unsigned char *ivp = cdata->iv;
  301. out_arg += chunk;
  302. in_arg += chunk;
  303. EVP_CIPHER_CTX_set_num(ctx, nbytes);
  304. if (cdata->cword.b.encdec) {
  305. cdata->cword.b.encdec = 0;
  306. padlock_reload_key();
  307. padlock_aes_block(ivp, ivp, cdata);
  308. cdata->cword.b.encdec = 1;
  309. padlock_reload_key();
  310. while (nbytes) {
  311. unsigned char c = *(in_arg++);
  312. *(out_arg++) = c ^ *ivp;
  313. *(ivp++) = c, nbytes--;
  314. }
  315. } else {
  316. padlock_reload_key();
  317. padlock_aes_block(ivp, ivp, cdata);
  318. padlock_reload_key();
  319. while (nbytes) {
  320. *ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
  321. ivp++, nbytes--;
  322. }
  323. }
  324. }
  325. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  326. return 1;
  327. }
  328. static int
  329. padlock_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  330. const unsigned char *in_arg, size_t nbytes)
  331. {
  332. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  333. size_t chunk;
  334. /*
  335. * ctx->num is maintained in byte-oriented modes, such as CFB and OFB...
  336. */
  337. if ((chunk = EVP_CIPHER_CTX_num(ctx))) { /* borrow chunk variable */
  338. unsigned char *ivp = EVP_CIPHER_CTX_iv_noconst(ctx);
  339. if (chunk >= AES_BLOCK_SIZE)
  340. return 0; /* bogus value */
  341. while (chunk < AES_BLOCK_SIZE && nbytes != 0) {
  342. *(out_arg++) = *(in_arg++) ^ ivp[chunk];
  343. chunk++, nbytes--;
  344. }
  345. EVP_CIPHER_CTX_set_num(ctx, chunk % AES_BLOCK_SIZE);
  346. }
  347. if (nbytes == 0)
  348. return 1;
  349. memcpy(cdata->iv, EVP_CIPHER_CTX_iv(ctx), AES_BLOCK_SIZE);
  350. if ((chunk = nbytes & ~(AES_BLOCK_SIZE - 1))) {
  351. if (!padlock_ofb_encrypt(out_arg, in_arg, cdata, chunk))
  352. return 0;
  353. nbytes -= chunk;
  354. }
  355. if (nbytes) {
  356. unsigned char *ivp = cdata->iv;
  357. out_arg += chunk;
  358. in_arg += chunk;
  359. EVP_CIPHER_CTX_set_num(ctx, nbytes);
  360. padlock_reload_key(); /* empirically found */
  361. padlock_aes_block(ivp, ivp, cdata);
  362. padlock_reload_key(); /* empirically found */
  363. while (nbytes) {
  364. *(out_arg++) = *(in_arg++) ^ *ivp;
  365. ivp++, nbytes--;
  366. }
  367. }
  368. memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), cdata->iv, AES_BLOCK_SIZE);
  369. return 1;
  370. }
  371. static void padlock_ctr32_encrypt_glue(const unsigned char *in,
  372. unsigned char *out, size_t blocks,
  373. struct padlock_cipher_data *ctx,
  374. const unsigned char *ivec)
  375. {
  376. memcpy(ctx->iv, ivec, AES_BLOCK_SIZE);
  377. padlock_ctr32_encrypt(out, in, ctx, AES_BLOCK_SIZE * blocks);
  378. }
  379. static int
  380. padlock_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
  381. const unsigned char *in_arg, size_t nbytes)
  382. {
  383. struct padlock_cipher_data *cdata = ALIGNED_CIPHER_DATA(ctx);
  384. unsigned int num = EVP_CIPHER_CTX_num(ctx);
  385. CRYPTO_ctr128_encrypt_ctr32(in_arg, out_arg, nbytes,
  386. cdata, EVP_CIPHER_CTX_iv_noconst(ctx),
  387. EVP_CIPHER_CTX_buf_noconst(ctx), &num,
  388. (ctr128_f) padlock_ctr32_encrypt_glue);
  389. EVP_CIPHER_CTX_set_num(ctx, (size_t)num);
  390. return 1;
  391. }
  392. # define EVP_CIPHER_block_size_ECB AES_BLOCK_SIZE
  393. # define EVP_CIPHER_block_size_CBC AES_BLOCK_SIZE
  394. # define EVP_CIPHER_block_size_OFB 1
  395. # define EVP_CIPHER_block_size_CFB 1
  396. # define EVP_CIPHER_block_size_CTR 1
  397. /*
  398. * Declaring so many ciphers by hand would be a pain. Instead introduce a bit
  399. * of preprocessor magic :-)
  400. */
  401. # define DECLARE_AES_EVP(ksize,lmode,umode) \
  402. static EVP_CIPHER *_hidden_aes_##ksize##_##lmode = NULL; \
  403. static const EVP_CIPHER *padlock_aes_##ksize##_##lmode(void) \
  404. { \
  405. if (_hidden_aes_##ksize##_##lmode == NULL \
  406. && ((_hidden_aes_##ksize##_##lmode = \
  407. EVP_CIPHER_meth_new(NID_aes_##ksize##_##lmode, \
  408. EVP_CIPHER_block_size_##umode, \
  409. AES_KEY_SIZE_##ksize)) == NULL \
  410. || !EVP_CIPHER_meth_set_iv_length(_hidden_aes_##ksize##_##lmode, \
  411. AES_BLOCK_SIZE) \
  412. || !EVP_CIPHER_meth_set_flags(_hidden_aes_##ksize##_##lmode, \
  413. 0 | EVP_CIPH_##umode##_MODE) \
  414. || !EVP_CIPHER_meth_set_init(_hidden_aes_##ksize##_##lmode, \
  415. padlock_aes_init_key) \
  416. || !EVP_CIPHER_meth_set_do_cipher(_hidden_aes_##ksize##_##lmode, \
  417. padlock_##lmode##_cipher) \
  418. || !EVP_CIPHER_meth_set_impl_ctx_size(_hidden_aes_##ksize##_##lmode, \
  419. sizeof(struct padlock_cipher_data) + 16) \
  420. || !EVP_CIPHER_meth_set_set_asn1_params(_hidden_aes_##ksize##_##lmode, \
  421. EVP_CIPHER_set_asn1_iv) \
  422. || !EVP_CIPHER_meth_set_get_asn1_params(_hidden_aes_##ksize##_##lmode, \
  423. EVP_CIPHER_get_asn1_iv))) { \
  424. EVP_CIPHER_meth_free(_hidden_aes_##ksize##_##lmode); \
  425. _hidden_aes_##ksize##_##lmode = NULL; \
  426. } \
  427. return _hidden_aes_##ksize##_##lmode; \
  428. }
  429. DECLARE_AES_EVP(128, ecb, ECB)
  430. DECLARE_AES_EVP(128, cbc, CBC)
  431. DECLARE_AES_EVP(128, cfb, CFB)
  432. DECLARE_AES_EVP(128, ofb, OFB)
  433. DECLARE_AES_EVP(128, ctr, CTR)
  434. DECLARE_AES_EVP(192, ecb, ECB)
  435. DECLARE_AES_EVP(192, cbc, CBC)
  436. DECLARE_AES_EVP(192, cfb, CFB)
  437. DECLARE_AES_EVP(192, ofb, OFB)
  438. DECLARE_AES_EVP(192, ctr, CTR)
  439. DECLARE_AES_EVP(256, ecb, ECB)
  440. DECLARE_AES_EVP(256, cbc, CBC)
  441. DECLARE_AES_EVP(256, cfb, CFB)
  442. DECLARE_AES_EVP(256, ofb, OFB)
  443. DECLARE_AES_EVP(256, ctr, CTR)
  444. static int
  445. padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids,
  446. int nid)
  447. {
  448. /* No specific cipher => return a list of supported nids ... */
  449. if (!cipher) {
  450. *nids = padlock_cipher_nids;
  451. return padlock_cipher_nids_num;
  452. }
  453. /* ... or the requested "cipher" otherwise */
  454. switch (nid) {
  455. case NID_aes_128_ecb:
  456. *cipher = padlock_aes_128_ecb();
  457. break;
  458. case NID_aes_128_cbc:
  459. *cipher = padlock_aes_128_cbc();
  460. break;
  461. case NID_aes_128_cfb:
  462. *cipher = padlock_aes_128_cfb();
  463. break;
  464. case NID_aes_128_ofb:
  465. *cipher = padlock_aes_128_ofb();
  466. break;
  467. case NID_aes_128_ctr:
  468. *cipher = padlock_aes_128_ctr();
  469. break;
  470. case NID_aes_192_ecb:
  471. *cipher = padlock_aes_192_ecb();
  472. break;
  473. case NID_aes_192_cbc:
  474. *cipher = padlock_aes_192_cbc();
  475. break;
  476. case NID_aes_192_cfb:
  477. *cipher = padlock_aes_192_cfb();
  478. break;
  479. case NID_aes_192_ofb:
  480. *cipher = padlock_aes_192_ofb();
  481. break;
  482. case NID_aes_192_ctr:
  483. *cipher = padlock_aes_192_ctr();
  484. break;
  485. case NID_aes_256_ecb:
  486. *cipher = padlock_aes_256_ecb();
  487. break;
  488. case NID_aes_256_cbc:
  489. *cipher = padlock_aes_256_cbc();
  490. break;
  491. case NID_aes_256_cfb:
  492. *cipher = padlock_aes_256_cfb();
  493. break;
  494. case NID_aes_256_ofb:
  495. *cipher = padlock_aes_256_ofb();
  496. break;
  497. case NID_aes_256_ctr:
  498. *cipher = padlock_aes_256_ctr();
  499. break;
  500. default:
  501. /* Sorry, we don't support this NID */
  502. *cipher = NULL;
  503. return 0;
  504. }
  505. return 1;
  506. }
  507. /* Prepare the encryption key for PadLock usage */
  508. static int
  509. padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  510. const unsigned char *iv, int enc)
  511. {
  512. struct padlock_cipher_data *cdata;
  513. int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
  514. unsigned long mode = EVP_CIPHER_CTX_mode(ctx);
  515. if (key == NULL)
  516. return 0; /* ERROR */
  517. cdata = ALIGNED_CIPHER_DATA(ctx);
  518. memset(cdata, 0, sizeof(*cdata));
  519. /* Prepare Control word. */
  520. if (mode == EVP_CIPH_OFB_MODE || mode == EVP_CIPH_CTR_MODE)
  521. cdata->cword.b.encdec = 0;
  522. else
  523. cdata->cword.b.encdec = (EVP_CIPHER_CTX_encrypting(ctx) == 0);
  524. cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
  525. cdata->cword.b.ksize = (key_len - 128) / 64;
  526. switch (key_len) {
  527. case 128:
  528. /*
  529. * PadLock can generate an extended key for AES128 in hardware
  530. */
  531. memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
  532. cdata->cword.b.keygen = 0;
  533. break;
  534. case 192:
  535. case 256:
  536. /*
  537. * Generate an extended AES key in software. Needed for AES192/AES256
  538. */
  539. /*
  540. * Well, the above applies to Stepping 8 CPUs and is listed as
  541. * hardware errata. They most likely will fix it at some point and
  542. * then a check for stepping would be due here.
  543. */
  544. if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
  545. && !enc)
  546. AES_set_decrypt_key(key, key_len, &cdata->ks);
  547. else
  548. AES_set_encrypt_key(key, key_len, &cdata->ks);
  549. # ifndef AES_ASM
  550. /*
  551. * OpenSSL C functions use byte-swapped extended key.
  552. */
  553. padlock_key_bswap(&cdata->ks);
  554. # endif
  555. cdata->cword.b.keygen = 1;
  556. break;
  557. default:
  558. /* ERROR */
  559. return 0;
  560. }
  561. /*
  562. * This is done to cover for cases when user reuses the
  563. * context for new key. The catch is that if we don't do
  564. * this, padlock_eas_cipher might proceed with old key...
  565. */
  566. padlock_reload_key();
  567. return 1;
  568. }
  569. /* ===== Random Number Generator ===== */
  570. /*
  571. * This code is not engaged. The reason is that it does not comply
  572. * with recommendations for VIA RNG usage for secure applications
  573. * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
  574. * provide meaningful error control...
  575. */
  576. /*
  577. * Wrapper that provides an interface between the API and the raw PadLock
  578. * RNG
  579. */
  580. static int padlock_rand_bytes(unsigned char *output, int count)
  581. {
  582. unsigned int eax, buf;
  583. while (count >= 8) {
  584. eax = padlock_xstore(output, 0);
  585. if (!(eax & (1 << 6)))
  586. return 0; /* RNG disabled */
  587. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  588. if (eax & (0x1F << 10))
  589. return 0;
  590. if ((eax & 0x1F) == 0)
  591. continue; /* no data, retry... */
  592. if ((eax & 0x1F) != 8)
  593. return 0; /* fatal failure... */
  594. output += 8;
  595. count -= 8;
  596. }
  597. while (count > 0) {
  598. eax = padlock_xstore(&buf, 3);
  599. if (!(eax & (1 << 6)))
  600. return 0; /* RNG disabled */
  601. /* this ---vv--- covers DC bias, Raw Bits and String Filter */
  602. if (eax & (0x1F << 10))
  603. return 0;
  604. if ((eax & 0x1F) == 0)
  605. continue; /* no data, retry... */
  606. if ((eax & 0x1F) != 1)
  607. return 0; /* fatal failure... */
  608. *output++ = (unsigned char)buf;
  609. count--;
  610. }
  611. OPENSSL_cleanse(&buf, sizeof(buf));
  612. return 1;
  613. }
  614. /* Dummy but necessary function */
  615. static int padlock_rand_status(void)
  616. {
  617. return 1;
  618. }
  619. /* Prepare structure for registration */
  620. static RAND_METHOD padlock_rand = {
  621. NULL, /* seed */
  622. padlock_rand_bytes, /* bytes */
  623. NULL, /* cleanup */
  624. NULL, /* add */
  625. padlock_rand_bytes, /* pseudorand */
  626. padlock_rand_status, /* rand status */
  627. };
  628. # endif /* COMPILE_PADLOCKENG */
  629. #endif /* !OPENSSL_NO_PADLOCKENG */
  630. #if defined(OPENSSL_NO_PADLOCKENG) || !defined(COMPILE_PADLOCKENG)
  631. # ifndef OPENSSL_NO_DYNAMIC_ENGINE
  632. OPENSSL_EXPORT
  633. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
  634. OPENSSL_EXPORT
  635. int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns)
  636. {
  637. return 0;
  638. }
  639. IMPLEMENT_DYNAMIC_CHECK_FN()
  640. # endif
  641. #endif