Crypto.c:

Ciphers[]

EncryptionAlgorithms[]

CipherInit()

EncipherBlock()

DecipherBlock()

*/

#ifndef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE

// Cipher configuration

static Cipher Ciphers[] =

{

// Block Size Key Size Key Schedule Size

// ID Name (Bytes) (Bytes) (Bytes)

{ AES, "AES", 16, 32, AES_KS },

{ SERPENT, "Serpent", 16, 32, 140*4 },

{ TWOFISH, "Twofish", 16, 32, TWOFISH_KS },

{ 0, 0, 0, 0, 0 }

};

// Encryption algorithm configuration

static EncryptionAlgorithm EncryptionAlgorithms[] =

{

// Cipher(s) Modes FormatEnabled

#ifndef TC_WINDOWS_BOOT

#else // TC_WINDOWS_BOOT

// Encryption algorithms available for boot drive encryption

{ { 0, 0 }, { 0, 0 }, 0 }, // Must be all-zero

{ { AES, 0 }, { XTS, 0 }, 1 },

{ { SERPENT, 0 }, { XTS, 0 }, 1 },

{ { TWOFISH, 0 }, { XTS, 0 }, 1 },

{ { TWOFISH, AES, 0 }, { XTS, 0 }, 1 },

{ { SERPENT, TWOFISH, AES, 0 }, { XTS, 0 }, 1 },

{ { AES, SERPENT, 0 }, { XTS, 0 }, 1 },

{ { AES, TWOFISH, SERPENT, 0 }, { XTS, 0 }, 1 },

{ { SERPENT, TWOFISH, 0 }, { XTS, 0 }, 1 },

{ { 0, 0 }, { 0, 0 }, 0 }, // Must be all-zero

#endif

};

// Hash algorithms

static Hash Hashes[] =

{ // ID Name Deprecated System Encryption

{ RIPEMD160, "RIPEMD-160", FALSE, TRUE },

#ifndef TC_WINDOWS_BOOT

{ SHA512, "SHA-512", FALSE, FALSE },

{ WHIRLPOOL, "Whirlpool", FALSE, FALSE },

#endif

{ 0, 0, 0 }

};

/* Return values: 0 = success, ERR_CIPHER_INIT_FAILURE (fatal), ERR_CIPHER_INIT_WEAK_KEY (non-fatal) */

int CipherInit (int cipher, unsigned char *key, unsigned __int8 *ks)

{

int retVal = ERR_SUCCESS;

switch (cipher)

{

case AES:

#ifndef TC_WINDOWS_BOOT

if (aes_encrypt_key256 (key, (aes_encrypt_ctx *) ks) != EXIT_SUCCESS)

return ERR_CIPHER_INIT_FAILURE;

if (aes_decrypt_key256 (key, (aes_decrypt_ctx *) (ks + sizeof(aes_encrypt_ctx))) != EXIT_SUCCESS)

return ERR_CIPHER_INIT_FAILURE;

#else

if (aes_set_key (key, (length_type) CipherGetKeySize(AES), (aes_context *) ks) != 0)

return ERR_CIPHER_INIT_FAILURE;

#endif

break;

case SERPENT:

serpent_set_key (key, CipherGetKeySize(SERPENT) * 8, ks);

break;

case TWOFISH:

twofish_set_key ((TwofishInstance *)ks, (const u4byte *)key, CipherGetKeySize(TWOFISH) * 8);

break;

default:

// Unknown/wrong cipher ID

return ERR_CIPHER_INIT_FAILURE;

}

return retVal;

}

void EncipherBlock(int cipher, void *data, void *ks)

{

switch (cipher)

{

case AES:

// In 32-bit kernel mode, due to KeSaveFloatingPointState() overhead, AES instructions can be used only when processing the whole data unit.

#if (defined (_WIN64) || !defined (TC_WINDOWS_DRIVER)) && !defined (TC_WINDOWS_BOOT)

if (IsAesHwCpuSupported())

aes_hw_cpu_encrypt (ks, data);

else

#endif

aes_encrypt (data, data, ks);

break;

case TWOFISH: twofish_encrypt (ks, data, data); break;

case SERPENT: serpent_encrypt (data, data, ks); break;

default: TC_THROW_FATAL_EXCEPTION; // Unknown/wrong ID

}

}

#ifndef TC_WINDOWS_BOOT

void EncipherBlocks (int cipher, void *dataPtr, void *ks, size_t blockCount)

{

byte *data = dataPtr;

#if defined (TC_WINDOWS_DRIVER) && !defined (_WIN64)

KFLOATING_SAVE floatingPointState;

#endif

if (cipher == AES

&& (blockCount & (32 - 1)) == 0

&& IsAesHwCpuSupported()

#if defined (TC_WINDOWS_DRIVER) && !defined (_WIN64)

&& NT_SUCCESS (KeSaveFloatingPointState (&floatingPointState))

#endif

)

#endif // !TC_WINDOWS_BOOT

void DecipherBlock(int cipher, void *data, void *ks)

{

switch (cipher)

{

case SERPENT: serpent_decrypt (data, data, ks); break;

case TWOFISH: twofish_decrypt (ks, data, data); break;

#ifndef TC_WINDOWS_BOOT

case AES:

#if defined (_WIN64) || !defined (TC_WINDOWS_DRIVER)

if (IsAesHwCpuSupported())

aes_hw_cpu_decrypt ((byte *) ks + sizeof (aes_encrypt_ctx), data);

else

#endif

aes_decrypt (data, data, (void *) ((char *) ks + sizeof(aes_encrypt_ctx)));

break;

#else

case AES: aes_decrypt (data, data, ks); break;

#endif

default: TC_THROW_FATAL_EXCEPTION; // Unknown/wrong ID

}

}

#ifndef TC_WINDOWS_BOOT

void DecipherBlocks (int cipher, void *dataPtr, void *ks, size_t blockCount)

{

byte *data = dataPtr;

#if defined (TC_WINDOWS_DRIVER) && !defined (_WIN64)

KFLOATING_SAVE floatingPointState;

#endif

if (cipher == AES

&& (blockCount & (32 - 1)) == 0

&& IsAesHwCpuSupported()

#if defined (TC_WINDOWS_DRIVER) && !defined (_WIN64)

#ifndef TC_WINDOWS_BOOT

BOOL EAInitMode (PCRYPTO_INFO ci)

{

switch (ci->mode)

{

case XTS:

// Secondary key schedule

if (EAInit (ci->ea, ci->k2, ci->ks2) != ERR_SUCCESS)

return FALSE;

/* Note: XTS mode could potentially be initialized with a weak key causing all blocks in one data unit

on the volume to be tweaked with zero tweaks (i.e. 512 bytes of the volume would be encrypted in ECB

mode). However, to create a TrueCrypt volume with such a weak key, each human being on Earth would have

to create approximately 11,378,125,361,078,862 (about eleven quadrillion) TrueCrypt volumes (provided

that the size of each of the volumes is 1024 terabytes). */

break;

default:

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

return TRUE;

}

// Returns name of EA, cascaded cipher names are separated by hyphens

char *EAGetName (char *buf, int ea)

{

int i = EAGetLastCipher(ea);

strcpy (buf, (i != 0) ? CipherGetName (i) : "?");

while (i = EAGetPreviousCipher(ea, i))

{

strcat (buf, "-");

strcat (buf, CipherGetName (i));

}

{

if (c == previousModeId)

return EncryptionAlgorithms[ea].Modes[i];

}

return 0;

}

#ifndef TC_WINDOWS_BOOT

// Returns the name of the mode of operation of the whole EA

char *EAGetModeName (int ea, int mode, BOOL capitalLetters)

{

switch (mode)

{

case XTS:

return "XTS";

}

return "[unknown]";

}

#endif // TC_WINDOWS_BOOT

// Returns sum of key schedule sizes of all ciphers of the EA

int EAGetKeyScheduleSize (int ea)

{

int i = EAGetFirstCipher(ea);

int size = CipherGetKeyScheduleSize (i);

while (i = EAGetNextCipher(ea, i))

{

size += CipherGetKeyScheduleSize (i);

}

return size;

}

{

burn (cryptoInfo, sizeof (CRYPTO_INFO));

#ifndef DEVICE_DRIVER

VirtualUnlock (cryptoInfo, sizeof (CRYPTO_INFO));

#endif

TCfree (cryptoInfo);

}

#else // TC_WINDOWS_BOOT

burn (&CryptoInfoBuffer, sizeof (CryptoInfoBuffer));

CryptoInfoBufferInUse = FALSE;

#endif // TC_WINDOWS_BOOT

}

#ifndef TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE

// EncryptBuffer

//

// buf: data to be encrypted; the start of the buffer is assumed to be aligned with the start of a data unit.

// len: number of bytes to encrypt; must be divisible by the block size (for cascaded ciphers, divisible

// by the largest block size used within the cascade)

void EncryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo)

{

switch (cryptoInfo->mode)

{

case XTS:

{

unsigned __int8 *ks = cryptoInfo->ks;

unsigned __int8 *ks2 = cryptoInfo->ks2;

UINT64_STRUCT dataUnitNo;

int cipher;

// When encrypting/decrypting a buffer (typically a volume header) the sequential number

// of the first XTS data unit in the buffer is always 0 and the start of the buffer is

// always assumed to be aligned with the start of a data unit.

dataUnitNo.LowPart = 0;

dataUnitNo.HighPart = 0;

for (cipher = EAGetFirstCipher (cryptoInfo->ea);

cipher != 0;

cipher = EAGetNextCipher (cryptoInfo->ea, cipher))

{

EncryptBufferXTS (buf, len, &dataUnitNo, 0, ks, ks2, cipher);

ks += CipherGetKeyScheduleSize (cipher);

ks2 += CipherGetKeyScheduleSize (cipher);

}

}

break;

default:

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

}

// buf: data to be encrypted

// unitNo: sequential number of the data unit with which the buffer starts

// nbrUnits: number of data units in the buffer

void EncryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci)

#ifndef TC_WINDOWS_BOOT

{

EncryptionThreadPoolDoWork (EncryptDataUnitsWork, buf, structUnitNo, nbrUnits, ci);

}

void EncryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci)

#endif // !TC_WINDOWS_BOOT

{

int ea = ci->ea;

unsigned __int8 *ks = ci->ks;

unsigned __int8 *ks2 = ci->ks2;

int cipher;

switch (ci->mode)

{

case XTS:

for (cipher = EAGetFirstCipher (ea); cipher != 0; cipher = EAGetNextCipher (ea, cipher))

{

EncryptBufferXTS (buf,

nbrUnits * ENCRYPTION_DATA_UNIT_SIZE,

structUnitNo,

0,

ks,

ks2,

cipher);

ks += CipherGetKeyScheduleSize (cipher);

ks2 += CipherGetKeyScheduleSize (cipher);

}

break;

default:

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

}

// DecryptBuffer

//

// buf: data to be decrypted; the start of the buffer is assumed to be aligned with the start of a data unit.

// len: number of bytes to decrypt; must be divisible by the block size (for cascaded ciphers, divisible

// by the largest block size used within the cascade)

void DecryptBuffer (unsigned __int8 *buf, TC_LARGEST_COMPILER_UINT len, PCRYPTO_INFO cryptoInfo)

{

switch (cryptoInfo->mode)

{

case XTS:

{

unsigned __int8 *ks = cryptoInfo->ks + EAGetKeyScheduleSize (cryptoInfo->ea);

unsigned __int8 *ks2 = cryptoInfo->ks2 + EAGetKeyScheduleSize (cryptoInfo->ea);

UINT64_STRUCT dataUnitNo;

int cipher;

// When encrypting/decrypting a buffer (typically a volume header) the sequential number

// of the first XTS data unit in the buffer is always 0 and the start of the buffer is

// always assumed to be aligned with the start of the data unit 0.

dataUnitNo.LowPart = 0;

dataUnitNo.HighPart = 0;

for (cipher = EAGetLastCipher (cryptoInfo->ea);

cipher != 0;

cipher = EAGetPreviousCipher (cryptoInfo->ea, cipher))

{

ks -= CipherGetKeyScheduleSize (cipher);

ks2 -= CipherGetKeyScheduleSize (cipher);

DecryptBufferXTS (buf, len, &dataUnitNo, 0, ks, ks2, cipher);

}

}

break;

default:

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

}

// buf: data to be decrypted

// unitNo: sequential number of the data unit with which the buffer starts

// nbrUnits: number of data units in the buffer

void DecryptDataUnits (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, uint32 nbrUnits, PCRYPTO_INFO ci)

#ifndef TC_WINDOWS_BOOT

{

EncryptionThreadPoolDoWork (DecryptDataUnitsWork, buf, structUnitNo, nbrUnits, ci);

}

void DecryptDataUnitsCurrentThread (unsigned __int8 *buf, const UINT64_STRUCT *structUnitNo, TC_LARGEST_COMPILER_UINT nbrUnits, PCRYPTO_INFO ci)

#endif // !TC_WINDOWS_BOOT

{

int ea = ci->ea;

unsigned __int8 *ks = ci->ks;

unsigned __int8 *ks2 = ci->ks2;

int cipher;

switch (ci->mode)

{

case XTS:

ks += EAGetKeyScheduleSize (ea);

ks2 += EAGetKeyScheduleSize (ea);

for (cipher = EAGetLastCipher (ea); cipher != 0; cipher = EAGetPreviousCipher (ea, cipher))

{

ks -= CipherGetKeyScheduleSize (cipher);

ks2 -= CipherGetKeyScheduleSize (cipher);

DecryptBufferXTS (buf,

nbrUnits * ENCRYPTION_DATA_UNIT_SIZE,

structUnitNo,

0,

ks,

ks2,

cipher);

}

break;

default:

// Unknown/wrong ID

TC_THROW_FATAL_EXCEPTION;

}

}

// Returns the maximum number of bytes necessary to be generated by the PBKDF2 (PKCS #5)

int GetMaxPkcs5OutSize (void)

{

int size = 32;

size = max (size, EAGetLargestKeyForMode (XTS) * 2); // Sizes of primary + secondary keys

return size;

}

#else // TC_WINDOWS_BOOT_SINGLE_CIPHER_MODE

#if !defined (TC_WINDOWS_BOOT_AES) && !defined (TC_WINDOWS_BOOT_SERPENT) && !defined (TC_WINDOWS_BOOT_TWOFISH)

#error No cipher defined

#endif

void EncipherBlock(int cipher, void *data, void *ks)

{

#ifdef TC_WINDOWS_BOOT_AES

if (IsAesHwCpuSupported())

aes_hw_cpu_encrypt ((byte *) ks, data);

else

aes_encrypt (data, data, ks);

#elif defined (TC_WINDOWS_BOOT_SERPENT)

serpent_encrypt (data, data, ks);