Message ID | 1456747261-22032-9-git-send-email-berrange@redhat.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
On Mon, 02/29 12:00, Daniel P. Berrange wrote: > New cipher algorithms 'twofish-128', 'twofish-192' and > 'twofish-256' are defined for the Twofish algorithm. > The gcrypt backend does not support 'twofish-192'. > > The nettle and gcrypt cipher backends are updated to > support the new cipher and a test vector added to the > cipher test suite. The new algorithm is enabled in the > LUKS block encryption driver. > > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> > --- > crypto/cipher-gcrypt.c | 12 ++++++++++++ > crypto/cipher-nettle.c | 30 ++++++++++++++++++++++++++++++ > crypto/cipher.c | 6 ++++++ > qapi/crypto.json | 6 +++++- > tests/test-crypto-cipher.c | 29 +++++++++++++++++++++++++++++ > 5 files changed, 82 insertions(+), 1 deletion(-) > > diff --git a/crypto/cipher-gcrypt.c b/crypto/cipher-gcrypt.c > index a667d59..ce26456 100644 > --- a/crypto/cipher-gcrypt.c > +++ b/crypto/cipher-gcrypt.c > @@ -33,6 +33,8 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg) > case QCRYPTO_CIPHER_ALG_SERPENT_128: > case QCRYPTO_CIPHER_ALG_SERPENT_192: > case QCRYPTO_CIPHER_ALG_SERPENT_256: > + case QCRYPTO_CIPHER_ALG_TWOFISH_128: > + case QCRYPTO_CIPHER_ALG_TWOFISH_256: > return true; > default: > return false; > @@ -104,6 +106,14 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, > gcryalg = GCRY_CIPHER_SERPENT256; > break; > > + case QCRYPTO_CIPHER_ALG_TWOFISH_128: > + gcryalg = GCRY_CIPHER_TWOFISH128; > + break; > + > + case QCRYPTO_CIPHER_ALG_TWOFISH_256: > + gcryalg = GCRY_CIPHER_TWOFISH; > + break; > + > default: > error_setg(errp, "Unsupported cipher algorithm %d", alg); > return NULL; > @@ -140,6 +150,8 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, > case QCRYPTO_CIPHER_ALG_SERPENT_128: > case QCRYPTO_CIPHER_ALG_SERPENT_192: > case QCRYPTO_CIPHER_ALG_SERPENT_256: > + case QCRYPTO_CIPHER_ALG_TWOFISH_128: > + case QCRYPTO_CIPHER_ALG_TWOFISH_256: > ctx->blocksize = 16; > break; > case QCRYPTO_CIPHER_ALG_CAST5_128: > diff --git a/crypto/cipher-nettle.c b/crypto/cipher-nettle.c > index 74b55ab..9b057fd 100644 > --- a/crypto/cipher-nettle.c > +++ b/crypto/cipher-nettle.c > @@ -25,6 +25,7 @@ > #include <nettle/cbc.h> > #include <nettle/cast128.h> > #include <nettle/serpent.h> > +#include <nettle/twofish.h> > > #if CONFIG_NETTLE_VERSION_MAJOR < 3 > typedef nettle_crypt_func nettle_cipher_func; > @@ -89,6 +90,18 @@ static void serpent_decrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, > serpent_decrypt(ctx, length, dst, src); > } > > +static void twofish_encrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, > + uint8_t *dst, const uint8_t *src) > +{ > + twofish_encrypt(ctx, length, dst, src); > +} > + > +static void twofish_decrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, > + uint8_t *dst, const uint8_t *src) > +{ > + twofish_decrypt(ctx, length, dst, src); > +} > + > typedef struct QCryptoCipherNettle QCryptoCipherNettle; > struct QCryptoCipherNettle { > void *ctx_encrypt; > @@ -110,6 +123,9 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg) > case QCRYPTO_CIPHER_ALG_SERPENT_128: > case QCRYPTO_CIPHER_ALG_SERPENT_192: > case QCRYPTO_CIPHER_ALG_SERPENT_256: > + case QCRYPTO_CIPHER_ALG_TWOFISH_128: > + case QCRYPTO_CIPHER_ALG_TWOFISH_192: > + case QCRYPTO_CIPHER_ALG_TWOFISH_256: > return true; > default: > return false; > @@ -200,6 +216,20 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, > ctx->blocksize = SERPENT_BLOCK_SIZE; > break; > > + case QCRYPTO_CIPHER_ALG_TWOFISH_128: > + case QCRYPTO_CIPHER_ALG_TWOFISH_192: > + case QCRYPTO_CIPHER_ALG_TWOFISH_256: > + ctx->ctx_encrypt = g_new0(struct twofish_ctx, 1); > + ctx->ctx_decrypt = NULL; /* 1 ctx can do both */ > + > + twofish_set_key(ctx->ctx_encrypt, nkey, key); > + > + ctx->alg_encrypt = twofish_encrypt_wrapper; > + ctx->alg_decrypt = twofish_decrypt_wrapper; > + > + ctx->blocksize = TWOFISH_BLOCK_SIZE; > + break; > + > default: > error_setg(errp, "Unsupported cipher algorithm %d", alg); > goto error; > diff --git a/crypto/cipher.c b/crypto/cipher.c > index 0f6fe98..89fa5a2 100644 > --- a/crypto/cipher.c > +++ b/crypto/cipher.c > @@ -31,6 +31,9 @@ static size_t alg_key_len[QCRYPTO_CIPHER_ALG__MAX] = { > [QCRYPTO_CIPHER_ALG_SERPENT_128] = 16, > [QCRYPTO_CIPHER_ALG_SERPENT_192] = 24, > [QCRYPTO_CIPHER_ALG_SERPENT_256] = 32, > + [QCRYPTO_CIPHER_ALG_TWOFISH_128] = 16, > + [QCRYPTO_CIPHER_ALG_TWOFISH_192] = 24, > + [QCRYPTO_CIPHER_ALG_TWOFISH_256] = 32, > }; > > static size_t alg_block_len[QCRYPTO_CIPHER_ALG__MAX] = { > @@ -42,6 +45,9 @@ static size_t alg_block_len[QCRYPTO_CIPHER_ALG__MAX] = { > [QCRYPTO_CIPHER_ALG_SERPENT_128] = 16, > [QCRYPTO_CIPHER_ALG_SERPENT_192] = 16, > [QCRYPTO_CIPHER_ALG_SERPENT_256] = 16, > + [QCRYPTO_CIPHER_ALG_TWOFISH_128] = 16, > + [QCRYPTO_CIPHER_ALG_TWOFISH_192] = 16, > + [QCRYPTO_CIPHER_ALG_TWOFISH_256] = 16, > }; > > static bool mode_need_iv[QCRYPTO_CIPHER_MODE__MAX] = { > diff --git a/qapi/crypto.json b/qapi/crypto.json > index 6738b95..63c001a 100644 > --- a/qapi/crypto.json > +++ b/qapi/crypto.json > @@ -63,6 +63,9 @@ > # @serpent-128: Serpent with 128 bit / 16 byte keys > # @serpent-192: Serpent with 192 bit / 24 byte keys > # @serpent-256: Serpent with 256 bit / 32 byte keys > +# @twofish-128: Twofish with 128 bit / 16 byte keys > +# @twofish-192: Twofish with 192 bit / 24 byte keys > +# @twofish-256: Twofish with 256 bit / 32 byte keys > # Since: 2.6 > ## > { 'enum': 'QCryptoCipherAlgorithm', > @@ -70,7 +73,8 @@ > 'data': ['aes-128', 'aes-192', 'aes-256', > 'des-rfb', > 'cast5-128', > - 'serpent-128', 'serpent-192', 'serpent-256']} > + 'serpent-128', 'serpent-192', 'serpent-256', > + 'twofish-128', 'twofish-192', 'twofish-256']} > > > ## > diff --git a/tests/test-crypto-cipher.c b/tests/test-crypto-cipher.c > index 5268723..f18bcaa 100644 > --- a/tests/test-crypto-cipher.c > +++ b/tests/test-crypto-cipher.c > @@ -213,6 +213,35 @@ static QCryptoCipherTestData test_data[] = { > .plaintext = "00000000010000000200000003000000", > .ciphertext = "2061a42782bd52ec691ec383b03ba77c", > }, > + { > + /* Twofish paper "Known Answer Test" */ > + .path = "/crypto/cipher/twofish-128", > + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_128, > + .mode = QCRYPTO_CIPHER_MODE_ECB, > + .key = "d491db16e7b1c39e86cb086b789f5419", > + .plaintext = "019f9809de1711858faac3a3ba20fbc3", > + .ciphertext = "6363977de839486297e661c6c9d668eb", > + }, > + { > + /* Twofish paper "Known Answer Test", I=3 */ > + .path = "/crypto/cipher/twofish-192", > + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_192, > + .mode = QCRYPTO_CIPHER_MODE_ECB, > + .key = "88b2b2706b105e36b446bb6d731a1e88" > + "efa71f788965bd44", > + .plaintext = "39da69d6ba4997d585b6dc073ca341b2", > + .ciphertext = "182b02d81497ea45f9daacdc29193a65", > + }, > + { > + /* Twofish paper "Known Answer Test", I=4 */ > + .path = "/crypto/cipher/twofish-256", > + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_256, > + .mode = QCRYPTO_CIPHER_MODE_ECB, > + .key = "d43bb7556ea32e46f2a282b7d45b4e0d" > + "57ff739d4dc92c1bd7fc01700cc8216f", > + .plaintext = "90afe91bb288544f2c32dc239b2635e6", > + .ciphertext = "6cb4561c40bf0a9705931cb6d408e7fa", > + }, > }; > > > -- > 2.5.0 > Reviewed-by: Fam Zheng <famz@redhat.com>
On 02/29/2016 05:00 AM, Daniel P. Berrange wrote: > New cipher algorithms 'twofish-128', 'twofish-192' and > 'twofish-256' are defined for the Twofish algorithm. > The gcrypt backend does not support 'twofish-192'. > > The nettle and gcrypt cipher backends are updated to > support the new cipher and a test vector added to the > cipher test suite. The new algorithm is enabled in the > LUKS block encryption driver. > > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> > --- Reviewed-by: Eric Blake <eblake@redhat.com>
diff --git a/crypto/cipher-gcrypt.c b/crypto/cipher-gcrypt.c index a667d59..ce26456 100644 --- a/crypto/cipher-gcrypt.c +++ b/crypto/cipher-gcrypt.c @@ -33,6 +33,8 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg) case QCRYPTO_CIPHER_ALG_SERPENT_128: case QCRYPTO_CIPHER_ALG_SERPENT_192: case QCRYPTO_CIPHER_ALG_SERPENT_256: + case QCRYPTO_CIPHER_ALG_TWOFISH_128: + case QCRYPTO_CIPHER_ALG_TWOFISH_256: return true; default: return false; @@ -104,6 +106,14 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, gcryalg = GCRY_CIPHER_SERPENT256; break; + case QCRYPTO_CIPHER_ALG_TWOFISH_128: + gcryalg = GCRY_CIPHER_TWOFISH128; + break; + + case QCRYPTO_CIPHER_ALG_TWOFISH_256: + gcryalg = GCRY_CIPHER_TWOFISH; + break; + default: error_setg(errp, "Unsupported cipher algorithm %d", alg); return NULL; @@ -140,6 +150,8 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, case QCRYPTO_CIPHER_ALG_SERPENT_128: case QCRYPTO_CIPHER_ALG_SERPENT_192: case QCRYPTO_CIPHER_ALG_SERPENT_256: + case QCRYPTO_CIPHER_ALG_TWOFISH_128: + case QCRYPTO_CIPHER_ALG_TWOFISH_256: ctx->blocksize = 16; break; case QCRYPTO_CIPHER_ALG_CAST5_128: diff --git a/crypto/cipher-nettle.c b/crypto/cipher-nettle.c index 74b55ab..9b057fd 100644 --- a/crypto/cipher-nettle.c +++ b/crypto/cipher-nettle.c @@ -25,6 +25,7 @@ #include <nettle/cbc.h> #include <nettle/cast128.h> #include <nettle/serpent.h> +#include <nettle/twofish.h> #if CONFIG_NETTLE_VERSION_MAJOR < 3 typedef nettle_crypt_func nettle_cipher_func; @@ -89,6 +90,18 @@ static void serpent_decrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, serpent_decrypt(ctx, length, dst, src); } +static void twofish_encrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, + uint8_t *dst, const uint8_t *src) +{ + twofish_encrypt(ctx, length, dst, src); +} + +static void twofish_decrypt_wrapper(cipher_ctx_t ctx, cipher_length_t length, + uint8_t *dst, const uint8_t *src) +{ + twofish_decrypt(ctx, length, dst, src); +} + typedef struct QCryptoCipherNettle QCryptoCipherNettle; struct QCryptoCipherNettle { void *ctx_encrypt; @@ -110,6 +123,9 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg) case QCRYPTO_CIPHER_ALG_SERPENT_128: case QCRYPTO_CIPHER_ALG_SERPENT_192: case QCRYPTO_CIPHER_ALG_SERPENT_256: + case QCRYPTO_CIPHER_ALG_TWOFISH_128: + case QCRYPTO_CIPHER_ALG_TWOFISH_192: + case QCRYPTO_CIPHER_ALG_TWOFISH_256: return true; default: return false; @@ -200,6 +216,20 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg, ctx->blocksize = SERPENT_BLOCK_SIZE; break; + case QCRYPTO_CIPHER_ALG_TWOFISH_128: + case QCRYPTO_CIPHER_ALG_TWOFISH_192: + case QCRYPTO_CIPHER_ALG_TWOFISH_256: + ctx->ctx_encrypt = g_new0(struct twofish_ctx, 1); + ctx->ctx_decrypt = NULL; /* 1 ctx can do both */ + + twofish_set_key(ctx->ctx_encrypt, nkey, key); + + ctx->alg_encrypt = twofish_encrypt_wrapper; + ctx->alg_decrypt = twofish_decrypt_wrapper; + + ctx->blocksize = TWOFISH_BLOCK_SIZE; + break; + default: error_setg(errp, "Unsupported cipher algorithm %d", alg); goto error; diff --git a/crypto/cipher.c b/crypto/cipher.c index 0f6fe98..89fa5a2 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -31,6 +31,9 @@ static size_t alg_key_len[QCRYPTO_CIPHER_ALG__MAX] = { [QCRYPTO_CIPHER_ALG_SERPENT_128] = 16, [QCRYPTO_CIPHER_ALG_SERPENT_192] = 24, [QCRYPTO_CIPHER_ALG_SERPENT_256] = 32, + [QCRYPTO_CIPHER_ALG_TWOFISH_128] = 16, + [QCRYPTO_CIPHER_ALG_TWOFISH_192] = 24, + [QCRYPTO_CIPHER_ALG_TWOFISH_256] = 32, }; static size_t alg_block_len[QCRYPTO_CIPHER_ALG__MAX] = { @@ -42,6 +45,9 @@ static size_t alg_block_len[QCRYPTO_CIPHER_ALG__MAX] = { [QCRYPTO_CIPHER_ALG_SERPENT_128] = 16, [QCRYPTO_CIPHER_ALG_SERPENT_192] = 16, [QCRYPTO_CIPHER_ALG_SERPENT_256] = 16, + [QCRYPTO_CIPHER_ALG_TWOFISH_128] = 16, + [QCRYPTO_CIPHER_ALG_TWOFISH_192] = 16, + [QCRYPTO_CIPHER_ALG_TWOFISH_256] = 16, }; static bool mode_need_iv[QCRYPTO_CIPHER_MODE__MAX] = { diff --git a/qapi/crypto.json b/qapi/crypto.json index 6738b95..63c001a 100644 --- a/qapi/crypto.json +++ b/qapi/crypto.json @@ -63,6 +63,9 @@ # @serpent-128: Serpent with 128 bit / 16 byte keys # @serpent-192: Serpent with 192 bit / 24 byte keys # @serpent-256: Serpent with 256 bit / 32 byte keys +# @twofish-128: Twofish with 128 bit / 16 byte keys +# @twofish-192: Twofish with 192 bit / 24 byte keys +# @twofish-256: Twofish with 256 bit / 32 byte keys # Since: 2.6 ## { 'enum': 'QCryptoCipherAlgorithm', @@ -70,7 +73,8 @@ 'data': ['aes-128', 'aes-192', 'aes-256', 'des-rfb', 'cast5-128', - 'serpent-128', 'serpent-192', 'serpent-256']} + 'serpent-128', 'serpent-192', 'serpent-256', + 'twofish-128', 'twofish-192', 'twofish-256']} ## diff --git a/tests/test-crypto-cipher.c b/tests/test-crypto-cipher.c index 5268723..f18bcaa 100644 --- a/tests/test-crypto-cipher.c +++ b/tests/test-crypto-cipher.c @@ -213,6 +213,35 @@ static QCryptoCipherTestData test_data[] = { .plaintext = "00000000010000000200000003000000", .ciphertext = "2061a42782bd52ec691ec383b03ba77c", }, + { + /* Twofish paper "Known Answer Test" */ + .path = "/crypto/cipher/twofish-128", + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_128, + .mode = QCRYPTO_CIPHER_MODE_ECB, + .key = "d491db16e7b1c39e86cb086b789f5419", + .plaintext = "019f9809de1711858faac3a3ba20fbc3", + .ciphertext = "6363977de839486297e661c6c9d668eb", + }, + { + /* Twofish paper "Known Answer Test", I=3 */ + .path = "/crypto/cipher/twofish-192", + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_192, + .mode = QCRYPTO_CIPHER_MODE_ECB, + .key = "88b2b2706b105e36b446bb6d731a1e88" + "efa71f788965bd44", + .plaintext = "39da69d6ba4997d585b6dc073ca341b2", + .ciphertext = "182b02d81497ea45f9daacdc29193a65", + }, + { + /* Twofish paper "Known Answer Test", I=4 */ + .path = "/crypto/cipher/twofish-256", + .alg = QCRYPTO_CIPHER_ALG_TWOFISH_256, + .mode = QCRYPTO_CIPHER_MODE_ECB, + .key = "d43bb7556ea32e46f2a282b7d45b4e0d" + "57ff739d4dc92c1bd7fc01700cc8216f", + .plaintext = "90afe91bb288544f2c32dc239b2635e6", + .ciphertext = "6cb4561c40bf0a9705931cb6d408e7fa", + }, };
New cipher algorithms 'twofish-128', 'twofish-192' and 'twofish-256' are defined for the Twofish algorithm. The gcrypt backend does not support 'twofish-192'. The nettle and gcrypt cipher backends are updated to support the new cipher and a test vector added to the cipher test suite. The new algorithm is enabled in the LUKS block encryption driver. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- crypto/cipher-gcrypt.c | 12 ++++++++++++ crypto/cipher-nettle.c | 30 ++++++++++++++++++++++++++++++ crypto/cipher.c | 6 ++++++ qapi/crypto.json | 6 +++++- tests/test-crypto-cipher.c | 29 +++++++++++++++++++++++++++++ 5 files changed, 82 insertions(+), 1 deletion(-)