1 /* Written by Ben Laurie, 2001 */
3 * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@openssl.org.
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
31 * 6. Redistributions of any form whatsoever must retain the following
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
50 #include <openssl/evp.h>
51 #include <openssl/objects.h>
52 #include <openssl/rsa.h>
56 * This stuff should now all be supported through
57 * crypto/engine/hw_openbsd_dev_crypto.c unless I botched it up
59 static void *dummy = &dummy;
63 /* check flag after OpenSSL headers to ensure make depend works */
64 # ifdef OPENSSL_OPENBSD_DEV_CRYPTO
69 # include <sys/ioctl.h>
70 # include <crypto/cryptodev.h>
74 /* longest key supported in hardware */
75 # define MAX_HW_KEY 24
78 # define MD5_DIGEST_LENGTH 16
79 # define MD5_CBLOCK 64
82 static int dev_failed;
84 typedef struct session_op session_op;
86 # define CDATA(ctx) EVP_C_DATA(session_op,ctx)
88 static void err(const char *str)
90 fprintf(stderr, "%s: errno %d\n", str, errno);
93 static int dev_crypto_init(session_op *ses)
100 if ((cryptodev_fd = open("/dev/crypto", O_RDWR, 0)) < 0) {
105 if (ioctl(cryptodev_fd, CRIOGET, &fd) == -1) {
106 err("CRIOGET failed");
114 memset(ses, '\0', sizeof *ses);
119 static int dev_crypto_cleanup(EVP_CIPHER_CTX *ctx)
121 if (ioctl(fd, CIOCFSESSION, &CDATA(ctx)->ses) == -1)
122 err("CIOCFSESSION failed");
124 OPENSSL_free(CDATA(ctx)->key);
129 static int dev_crypto_init_key(EVP_CIPHER_CTX *ctx, int cipher,
130 const unsigned char *key, int klen)
132 if (!dev_crypto_init(CDATA(ctx)))
135 CDATA(ctx)->key = OPENSSL_malloc(MAX_HW_KEY);
136 if (CDATA(ctx)->key == NULL {
137 err("CDATA(ctx)->key memory allocation failed");
141 assert(ctx->cipher->iv_len <= MAX_HW_IV);
143 memcpy(CDATA(ctx)->key, key, klen);
145 CDATA(ctx)->cipher = cipher;
146 CDATA(ctx)->keylen = klen;
148 if (ioctl(fd, CIOCGSESSION, CDATA(ctx)) == -1) {
149 err("CIOCGSESSION failed");
155 static int dev_crypto_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
156 const unsigned char *in, unsigned int inl)
158 struct crypt_op cryp;
159 unsigned char lb[MAX_HW_IV];
167 memset(&cryp, '\0', sizeof cryp);
168 cryp.ses = CDATA(ctx)->ses;
169 cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
172 assert((inl & (ctx->cipher->block_size - 1)) == 0);
173 cryp.src = (caddr_t) in;
174 cryp.dst = (caddr_t) out;
176 if (ctx->cipher->iv_len)
177 cryp.iv = (caddr_t) ctx->iv;
180 memcpy(lb, &in[cryp.len - ctx->cipher->iv_len], ctx->cipher->iv_len);
182 if (ioctl(fd, CIOCCRYPT, &cryp) == -1) {
183 if (errno == EINVAL) { /* buffers are misaligned */
184 unsigned int cinl = 0;
188 /* NB: this can only make cinl != inl with stream ciphers */
189 cinl = (inl + 3) / 4 * 4;
191 if (((unsigned long)in & 3) || cinl != inl) {
192 cin = OPENSSL_malloc(cinl);
194 err("cin - memory allocation failed");
198 memcpy(cin, in, inl);
202 if (((unsigned long)out & 3) || cinl != inl) {
203 cout = OPENSSL_malloc(cinl);
209 if (ioctl(fd, CIOCCRYPT, &cryp) == -1) {
210 err("CIOCCRYPT(2) failed");
211 printf("src=%p dst=%p\n", cryp.src, cryp.dst);
217 memcpy(out, cout, inl);
223 err("CIOCCRYPT failed");
230 memcpy(ctx->iv, &out[cryp.len - ctx->cipher->iv_len],
231 ctx->cipher->iv_len);
233 memcpy(ctx->iv, lb, ctx->cipher->iv_len);
238 static int dev_crypto_des_ede3_init_key(EVP_CIPHER_CTX *ctx,
239 const unsigned char *key,
240 const unsigned char *iv, int enc)
242 return dev_crypto_init_key(ctx, CRYPTO_3DES_CBC, key, 24);
245 # define dev_crypto_des_ede3_cbc_cipher dev_crypto_cipher
247 BLOCK_CIPHER_def_cbc(dev_crypto_des_ede3, session_op, NID_des_ede3, 8, 24, 8,
248 0, dev_crypto_des_ede3_init_key,
250 EVP_CIPHER_set_asn1_iv, EVP_CIPHER_get_asn1_iv, NULL)
252 static int dev_crypto_rc4_init_key(EVP_CIPHER_CTX *ctx,
253 const unsigned char *key,
254 const unsigned char *iv, int enc)
256 return dev_crypto_init_key(ctx, CRYPTO_ARC4, key, 16);
259 static const EVP_CIPHER r4_cipher = {
261 1, 16, 0, /* FIXME: key should be up to 256 bytes */
262 EVP_CIPH_VARIABLE_LENGTH,
263 dev_crypto_rc4_init_key,
272 const EVP_CIPHER *EVP_dev_crypto_rc4(void)
281 unsigned char md[EVP_MAX_MD_SIZE];
284 static int dev_crypto_init_digest(MD_DATA *md_data, int mac)
286 if (!dev_crypto_init(&md_data->sess))
290 md_data->data = NULL;
292 md_data->sess.mac = mac;
294 if (ioctl(fd, CIOCGSESSION, &md_data->sess) == -1) {
295 err("CIOCGSESSION failed");
301 static int dev_crypto_cleanup_digest(MD_DATA *md_data)
303 if (ioctl(fd, CIOCFSESSION, &md_data->sess.ses) == -1) {
304 err("CIOCFSESSION failed");
311 /* FIXME: if device can do chained MACs, then don't accumulate */
312 /* FIXME: move accumulation to the framework */
313 static int dev_crypto_md5_init(EVP_MD_CTX *ctx)
315 return dev_crypto_init_digest(ctx->md_data, CRYPTO_MD5);
318 static int do_digest(int ses, unsigned char *md, const void *data, int len)
320 struct crypt_op cryp;
321 static unsigned char md5zero[16] = {
322 0xd4, 0x1d, 0x8c, 0xd9, 0x8f, 0x00, 0xb2, 0x04,
323 0xe9, 0x80, 0x09, 0x98, 0xec, 0xf8, 0x42, 0x7e
326 /* some cards can't do zero length */
328 memcpy(md, md5zero, 16);
332 memset(&cryp, '\0', sizeof cryp);
334 cryp.op = COP_ENCRYPT; /* required to do the MAC rather than check
337 cryp.src = (caddr_t) data;
338 cryp.dst = (caddr_t) data; // FIXME!!!
339 cryp.mac = (caddr_t) md;
341 if (ioctl(fd, CIOCCRYPT, &cryp) == -1) {
342 if (errno == EINVAL) { /* buffer is misaligned */
345 dcopy = OPENSSL_malloc(len);
347 err("dcopy - memory allocation failed");
351 memcpy(dcopy, data, len);
353 cryp.dst = cryp.src; // FIXME!!!
355 if (ioctl(fd, CIOCCRYPT, &cryp) == -1) {
356 err("CIOCCRYPT(MAC2) failed");
362 err("CIOCCRYPT(MAC) failed");
372 static int dev_crypto_md5_update(EVP_MD_CTX *ctx, const void *data,
375 MD_DATA *md_data = ctx->md_data;
377 if (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)
378 return do_digest(md_data->sess.ses, md_data->md, data, len);
380 md_data->data = OPENSSL_realloc(md_data->data, md_data->len + len);
381 if (md_data->data == NULL) {
382 err("DEV_CRYPTO_MD5_UPDATE: unable to allocate memory");
385 memcpy(md_data->data + md_data->len, data, len);
391 static int dev_crypto_md5_final(EVP_MD_CTX *ctx, unsigned char *md)
394 MD_DATA *md_data = ctx->md_data;
396 if (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) {
397 memcpy(md, md_data->md, MD5_DIGEST_LENGTH);
400 ret = do_digest(md_data->sess.ses, md, md_data->data, md_data->len);
401 OPENSSL_free(md_data->data);
402 md_data->data = NULL;
409 static int dev_crypto_md5_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from)
411 const MD_DATA *from_md = from->md_data;
412 MD_DATA *to_md = to->md_data;
414 // How do we copy sessions?
415 assert(from->digest->flags & EVP_MD_FLAG_ONESHOT);
417 to_md->data = OPENSSL_malloc(from_md->len);
418 if (to_md->data == NULL) {
419 err("DEV_CRYPTO_MD5_COPY: unable to allocate memory");
422 memcpy(to_md->data, from_md->data, from_md->len);
427 static int dev_crypto_md5_cleanup(EVP_MD_CTX *ctx)
429 return dev_crypto_cleanup_digest(ctx->md_data);
432 static const EVP_MD md5_md = {
434 NID_md5WithRSAEncryption,
436 EVP_MD_FLAG_ONESHOT, // XXX: set according to device info...
438 dev_crypto_md5_update,
439 dev_crypto_md5_final,
441 dev_crypto_md5_cleanup,
447 const EVP_MD *EVP_dev_crypto_md5(void)