crypto/internal/des.h

0001 /* SPDX-License-Identifier: GPL-2.0 */
0002 /*
0003  * DES & Triple DES EDE key verification helpers
0004  */
0005
0006 #ifndef __CRYPTO_INTERNAL_DES_H
0007 #define __CRYPTO_INTERNAL_DES_H
0008
0009 #include <linux/crypto.h>
0010 #include <linux/fips.h>
0011 #include <crypto/des.h>
0012 #include <crypto/aead.h>
0013 #include <crypto/skcipher.h>
0014
0015 /**
0016  * crypto_des_verify_key - Check whether a DES key is weak
0017  * @tfm: the crypto algo
0018  * @key: the key buffer
0019  *
0020  * Returns -EINVAL if the key is weak and the crypto TFM does not permit weak
0021  * keys. Otherwise, 0 is returned.
0022  *
0023  * It is the job of the caller to ensure that the size of the key equals
0024  * DES_KEY_SIZE.
0025  */
0026 static inline int crypto_des_verify_key(struct crypto_tfm *tfm, const u8 *key)
0027 {
0028     struct des_ctx tmp;
0029     int err;
0030
0031     err = des_expand_key(&tmp, key, DES_KEY_SIZE);
0032     if (err == -ENOKEY) {
0033         if (crypto_tfm_get_flags(tfm) & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)
0034             err = -EINVAL;
0035         else
0036             err = 0;
0037     }
0038     memzero_explicit(&tmp, sizeof(tmp));
0039     return err;
0040 }
0041
0042 /*
0043  * RFC2451:
0044  *
0045  *   For DES-EDE3, there is no known need to reject weak or
0046  *   complementation keys.  Any weakness is obviated by the use of
0047  *   multiple keys.
0048  *
0049  *   However, if the first two or last two independent 64-bit keys are
0050  *   equal (k1 == k2 or k2 == k3), then the DES3 operation is simply the
0051  *   same as DES.  Implementers MUST reject keys that exhibit this
0052  *   property.
0053  *
0054  */
0055 static inline int des3_ede_verify_key(const u8 *key, unsigned int key_len,
0056                       bool check_weak)
0057 {
0058     int ret = fips_enabled ? -EINVAL : -ENOKEY;
0059     u32 K[6];
0060
0061     memcpy(K, key, DES3_EDE_KEY_SIZE);
0062
0063     if ((!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
0064          !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
0065         (fips_enabled || check_weak))
0066         goto bad;
0067
0068     if ((!((K[0] ^ K[4]) | (K[1] ^ K[5]))) && fips_enabled)
0069         goto bad;
0070
0071     ret = 0;
0072 bad:
0073     memzero_explicit(K, DES3_EDE_KEY_SIZE);
0074
0075     return ret;
0076 }
0077
0078 /**
0079  * crypto_des3_ede_verify_key - Check whether a DES3-EDE key is weak
0080  * @tfm: the crypto algo
0081  * @key: the key buffer
0082  *
0083  * Returns -EINVAL if the key is weak and the crypto TFM does not permit weak
0084  * keys or when running in FIPS mode. Otherwise, 0 is returned. Note that some
0085  * keys are rejected in FIPS mode even if weak keys are permitted by the TFM
0086  * flags.
0087  *
0088  * It is the job of the caller to ensure that the size of the key equals
0089  * DES3_EDE_KEY_SIZE.
0090  */
0091 static inline int crypto_des3_ede_verify_key(struct crypto_tfm *tfm,
0092                          const u8 *key)
0093 {
0094     return des3_ede_verify_key(key, DES3_EDE_KEY_SIZE,
0095                    crypto_tfm_get_flags(tfm) &
0096                    CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
0097 }
0098
0099 static inline int verify_skcipher_des_key(struct crypto_skcipher *tfm,
0100                       const u8 *key)
0101 {
0102     return crypto_des_verify_key(crypto_skcipher_tfm(tfm), key);
0103 }
0104
0105 static inline int verify_skcipher_des3_key(struct crypto_skcipher *tfm,
0106                        const u8 *key)
0107 {
0108     return crypto_des3_ede_verify_key(crypto_skcipher_tfm(tfm), key);
0109 }
0110
0111 static inline int verify_aead_des_key(struct crypto_aead *tfm, const u8 *key,
0112                       int keylen)
0113 {
0114     if (keylen != DES_KEY_SIZE)
0115         return -EINVAL;
0116     return crypto_des_verify_key(crypto_aead_tfm(tfm), key);
0117 }
0118
0119 static inline int verify_aead_des3_key(struct crypto_aead *tfm, const u8 *key,
0120                        int keylen)
0121 {
0122     if (keylen != DES3_EDE_KEY_SIZE)
0123         return -EINVAL;
0124     return crypto_des3_ede_verify_key(crypto_aead_tfm(tfm), key);
0125 }
0126
0127 #endif /* __CRYPTO_INTERNAL_DES_H */