linux.git/crypto/ccm.c, branch v4.19

crypto: ccm - preserve the IV buffer

2017-11-03T13:35:35+00:00

The IV buffer used during CCM operations is used twice, during both the
hashing step and the ciphering step.

When using a hardware accelerator that updates the contents of the IV
buffer at the end of ciphering operations, the value will be modified.
In the decryption case, the subsequent setup of the hashing algorithm
will interpret the updated IV instead of the original value, which can
lead to out-of-bounds writes.

Reuse the idata buffer, only used in the hashing step, to preserve the
IV's value during the ciphering step in the decryption case.

Signed-off-by: Romain Izard 
Reviewed-by: Tudor Ambarus 
Cc: 
Signed-off-by: Herbert Xu

crypto: ccm - move cbcmac input off the stack

2017-02-28T09:29:17+00:00

Commit f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver")
refactored the CCM driver to allow separate implementations of the
underlying MAC to be provided by a platform. However, in doing so, it
moved some data from the linear region to the stack, which violates the
SG constraints when the stack is virtually mapped.

So move idata/odata back to the request ctx struct, of which we can
reasonably expect that it has been allocated using kmalloc() et al.

Reported-by: Johannes Berg 
Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver")
Signed-off-by: Ard Biesheuvel 
Tested-by: Johannes Berg 
Signed-off-by: Herbert Xu

crypto: ccm - drop unnecessary minimum 32-bit alignment

2017-02-15T05:23:46+00:00

The CCM driver forces 32-bit alignment even if the underlying ciphers
don't care about alignment. This is because crypto_xor() used to require
this, but since this is no longer the case, drop the hardcoded minimum
of 32 bits.

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu

crypto: ccm - honour alignmask of subordinate MAC cipher

2017-02-15T05:23:45+00:00

The CCM driver was recently updated to defer the MAC part of the algorithm
to a dedicated crypto transform, and a template for instantiating such
transforms was added at the same time.

However, this new cbcmac template fails to take the alignmask of the
encapsulated cipher into account, which may result in buffer addresses
being passed down that are not sufficiently aligned.

So update the code to ensure that the digest buffer in the desc ctx
appears at a sufficiently aligned offset, and tweak the code so that all
calls to crypto_cipher_encrypt_one() operate on this buffer exclusively.

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu

crypto: ccm - switch to separate cbcmac driver

2017-02-11T09:50:45+00:00

Update the generic CCM driver to defer CBC-MAC processing to a
dedicated CBC-MAC ahash transform rather than open coding this
transform (and much of the associated scatterwalk plumbing) in
the CCM driver itself.

This cleans up the code considerably, but more importantly, it allows
the use of alternative CBC-MAC implementations that don't suffer from
performance degradation due to significant setup time (e.g., the NEON
based AES code needs to enable/disable the NEON, and load the S-box
into 16 SIMD registers, which cannot be amortized over the entire input
when using the cipher interface)

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu

crypto: skcipher - Get rid of crypto_spawn_skcipher2()

2016-11-01T00:37:17+00:00

Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-level
givcipher interface"), crypto_spawn_skcipher2() and
crypto_spawn_skcipher() are equivalent.  So switch callers of
crypto_spawn_skcipher2() to crypto_spawn_skcipher() and remove it.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: skcipher - Get rid of crypto_grab_skcipher2()

2016-11-01T00:37:16+00:00

Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-level
givcipher interface"), crypto_grab_skcipher2() and
crypto_grab_skcipher() are equivalent.  So switch callers of
crypto_grab_skcipher2() to crypto_grab_skcipher() and remove it.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: ccm - Use skcipher

2016-07-18T09:35:40+00:00

This patch converts ccm to use the new skcipher interface as opposed
to ablkcipher.

Signed-off-by: Herbert Xu

crypto: aead - Remove CRYPTO_ALG_AEAD_NEW flag

2015-08-17T08:53:53+00:00

This patch removes the CRYPTO_ALG_AEAD_NEW flag now that everyone
has been converted.

Signed-off-by: Herbert Xu

crypto: ccm - Convert to new AEAD interface

2015-07-17T13:20:09+00:00

This patch converts generic ccm and its associated transforms to
the new AEAD interface.

Signed-off-by: Herbert Xu