From patchwork Wed Jun 26 20:40:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167856 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413646ilk; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) X-Google-Smtp-Source: APXvYqxwwpcOViO3iMoOXT1R/H7Lr3Qw4p/1Sx+h2UXXqEyqTutrLEbqPNH+ysx9Pa57zOlf71VU X-Received: by 2002:a63:d211:: with SMTP id a17mr4774763pgg.269.1561581659707; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581659; cv=none; d=google.com; s=arc-20160816; b=HVUCZQYab9H2gqkK5mL38mRiFsvyKiFc8K7j3WjOotC4FT0E1bYhwAeQa8T6pSK/SI gYFNPv9k7XD1ecpqJTI2UbPjec7Lgqsxb7amQzGw5ohUjHXHCUmyP0DAJkbxEQ5ttroX jtr3qz2dATdMNzUr6YzpHnDHQk0bV6R3K2bUdK6GMmRno/198KIBezlJsFAmLSuAuD3Z m4iZMl1MYYAZcCMcS/rMIRs9HOS3/C4kjWwQhkgd1lJZ3WDoODmsbcLa8T81yurcLE5o NnmgVfXdOF4QgAFj7Y1rQyjqTeooeAaE0dsvYoU6/vimuabpXXDt1TbItC+Kz4xTPzbA 8GaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=dZjIzbWBokamE1CcflOcCyYZMP5I+9ljVAlohoVMjUE=; b=XKTig7KYRobAYQLIpUiDu3K/42ZpC5SLPBkowqC3zHqQsOkzLQpY+wxZaROeidUM59 AjCGyxutbniEZukSH9RloEh3xHIrLxHMOk2s9IbCYiFrHgwiMORTGFrGZOoOkUlawCmG oC36ghVMhl1sXNuGAXZY1a3pm3+0jrMbGIhaiOyyKTr6dYPxzaTNKY7qVcS+UXpXtS8e vbdLUpSp6zG7JNJDjUnO9vEqC0HHSTFQ+Z2eN8LsfWh6W2NKcfXKw6OT+PA7CCVgjE+Y PIAsityD4+X9PDpHYRRCbex4pvdQCsnAUT4tDJ3ACq/nodlSvZQJeKidYLhdOi2/lGj/ ytqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=YOEPQplX; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.40.59; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=YOEPQplX; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726373AbfFZUk6 (ORCPT + 3 others); Wed, 26 Jun 2019 16:40:58 -0400 Received: from mail-wr1-f66.google.com ([209.85.221.66]:42159 "EHLO mail-wr1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726293AbfFZUk6 (ORCPT ); Wed, 26 Jun 2019 16:40:58 -0400 Received: by mail-wr1-f66.google.com with SMTP id x17so4249230wrl.9 for ; Wed, 26 Jun 2019 13:40:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dZjIzbWBokamE1CcflOcCyYZMP5I+9ljVAlohoVMjUE=; b=YOEPQplXettXIS+1KmB7BWDPz6pjtVh85/JTRET1+jlIuAnrZYgLz1A+FVnAiM7Ng2 ODLSHQgxcnENc7EcCc5lyVWhPM9fyMJIaAizwErzLaTpEeS8UtLtSP0FuSkbhK/ify+C c/rZnUHiYms6MfWgXummgZV68AaP9E46QpSEesmVP+DRDPxXK+ur48G8e/EOIqCB/Hdg rfNCYireYrxCrWSYButqY3+Z5SgHdRYMUCb4ntWLq+S0aVHAYJaq8SO7kRQENWK9TpF+ uVFbzCA5jmvOyooOSw/fQVnWIHKw6dOP2k3SQfB4qifgo3cU8uFFdHYYFLQd2Zz9Wm+V ko4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dZjIzbWBokamE1CcflOcCyYZMP5I+9ljVAlohoVMjUE=; b=JA2l1/LMwdMDZktEI1ulqi+44yFETJ7NYpGzJsDTqS+JbZwQTeaudNSbw9UQkWA/7/ A58JPJbIe1csWeu5cJ1ATgkS976zHWmUpT2FTuG7X1PBr6e98e31GQZo8oV56HWHVG4s h82o4Om138NFBz3al2kvPmD6QmjZaprEtILg06r1TGN6VU2/t23q7Hwc0zx40AU8nyvz jFV4lro/6yHF6pAqW/I0TuBSWOzxDPjVSLKB15Ec52Pk5Z2/ZCPS9epgqRcrtex4juCI jFxHPPhM4C1DuCK+W1B1B71j8oJgcENHpJr/CNWfDd3yi2WrLmnyoolgikn0Mf8ui1HX OXxg== X-Gm-Message-State: APjAAAWA1DvhUeopAeoPl06atR8doJElbRaSKgim6OLcFauEH47m7507 IT9vMkSri6pmu+zehhdn/koNRtUF1hBWhQ== X-Received: by 2002:adf:e841:: with SMTP id d1mr5119612wrn.204.1561581652880; Wed, 26 Jun 2019 13:40:52 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:52 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 1/7] crypto: essiv - create wrapper template for ESSIV generation Date: Wed, 26 Jun 2019 22:40:41 +0200 Message-Id: <20190626204047.32131-2-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Implement a template that wraps a (skcipher,cipher,shash) or (aead,cipher,shash) tuple so that we can consolidate the ESSIV handling in fscrypt and dm-crypt and move it into the crypto API. This will result in better test coverage, and will allow future changes to make the bare cipher interface internal to the crypto subsystem, in order to increase robustness of the API against misuse. Signed-off-by: Ard Biesheuvel --- crypto/Kconfig | 4 + crypto/Makefile | 1 + crypto/essiv.c | 636 ++++++++++++++++++++ 3 files changed, 641 insertions(+) -- 2.20.1 diff --git a/crypto/Kconfig b/crypto/Kconfig index 3d056e7da65f..1aa47087c1a2 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -1917,6 +1917,10 @@ config CRYPTO_STATS config CRYPTO_HASH_INFO bool +config CRYPTO_ESSIV + tristate + select CRYPTO_AUTHENC + source "drivers/crypto/Kconfig" source "crypto/asymmetric_keys/Kconfig" source "certs/Kconfig" diff --git a/crypto/Makefile b/crypto/Makefile index 266a4cdbb9e2..ad1d99ba6d56 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -148,6 +148,7 @@ obj-$(CONFIG_CRYPTO_USER_API_AEAD) += algif_aead.o obj-$(CONFIG_CRYPTO_ZSTD) += zstd.o obj-$(CONFIG_CRYPTO_OFB) += ofb.o obj-$(CONFIG_CRYPTO_ECC) += ecc.o +obj-$(CONFIG_CRYPTO_ESSIV) += essiv.o ecdh_generic-y += ecdh.o ecdh_generic-y += ecdh_helper.o diff --git a/crypto/essiv.c b/crypto/essiv.c new file mode 100644 index 000000000000..fddf6dcc3823 --- /dev/null +++ b/crypto/essiv.c @@ -0,0 +1,636 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * ESSIV skcipher and aead template for block encryption + * + * This template encapsulates the ESSIV IV generation algorithm used by + * dm-crypt and fscrypt, which converts the initial vector for the skcipher + * used for block encryption, by encrypting it using the hash of the + * skcipher key as encryption key. Usually, the input IV is a 64-bit sector + * number in LE representation zero-padded to the size of the IV, but this + * is not assumed by this driver. + * + * The typical use of this template is to instantiate the skcipher + * 'essiv(cbc(aes),aes,sha256)', which is the only instantiation used by + * fscrypt, and the most relevant one for dm-crypt. However, dm-crypt + * also permits ESSIV to be used in combination with the authenc template, + * e.g., 'essiv(authenc(hmac(sha256),cbc(aes)),aes,sha256)', in which case + * we need to instantiate an aead that accepts the same special key format + * as the authenc template, and deals with the way the encrypted IV is + * embedded into the AAD area of the aead request. This means the AEAD + * flavor produced by this template is tightly coupled to the way dm-crypt + * happens to use it. + * + * Copyright (c) 2019 Linaro, Ltd. + * + * Heavily based on: + * adiantum length-preserving encryption mode + * + * Copyright 2018 Google LLC + */ + +#include +#include +#include +#include +#include +#include + +#include "internal.h" + +struct essiv_instance_ctx { + union { + struct crypto_skcipher_spawn skcipher_spawn; + struct crypto_aead_spawn aead_spawn; + } u; + struct crypto_spawn essiv_cipher_spawn; + struct crypto_shash_spawn hash_spawn; +}; + +struct essiv_tfm_ctx { + union { + struct crypto_skcipher *skcipher; + struct crypto_aead *aead; + } u; + struct crypto_cipher *essiv_cipher; + struct crypto_shash *hash; +}; + +struct essiv_aead_request_ctx { + struct scatterlist sg[4]; + u8 *iv; + struct aead_request aead_req; +}; + +static int essiv_skcipher_setkey(struct crypto_skcipher *tfm, + const u8 *key, unsigned int keylen) +{ + struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); + SHASH_DESC_ON_STACK(desc, tctx->hash); + u8 salt[HASH_MAX_DIGESTSIZE]; + int err; + + crypto_skcipher_clear_flags(tctx->u.skcipher, CRYPTO_TFM_REQ_MASK); + crypto_skcipher_set_flags(tctx->u.skcipher, + crypto_skcipher_get_flags(tfm) & + CRYPTO_TFM_REQ_MASK); + err = crypto_skcipher_setkey(tctx->u.skcipher, key, keylen); + crypto_skcipher_set_flags(tfm, + crypto_skcipher_get_flags(tctx->u.skcipher) & + CRYPTO_TFM_RES_MASK); + if (err) + return err; + + desc->tfm = tctx->hash; + err = crypto_shash_digest(desc, key, keylen, salt); + if (err) + return err; + + crypto_cipher_clear_flags(tctx->essiv_cipher, CRYPTO_TFM_REQ_MASK); + crypto_cipher_set_flags(tctx->essiv_cipher, + crypto_skcipher_get_flags(tfm) & + CRYPTO_TFM_REQ_MASK); + err = crypto_cipher_setkey(tctx->essiv_cipher, salt, + crypto_shash_digestsize(tctx->hash)); + crypto_skcipher_set_flags(tfm, + crypto_cipher_get_flags(tctx->essiv_cipher) & + CRYPTO_TFM_RES_MASK); + + return err; +} + +static int essiv_aead_setkey(struct crypto_aead *tfm, const u8 *key, + unsigned int keylen) +{ + struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + SHASH_DESC_ON_STACK(desc, tctx->hash); + struct crypto_authenc_keys keys; + u8 salt[HASH_MAX_DIGESTSIZE]; + int err; + + crypto_aead_clear_flags(tctx->u.aead, CRYPTO_TFM_REQ_MASK); + crypto_aead_set_flags(tctx->u.aead, crypto_aead_get_flags(tfm) & + CRYPTO_TFM_REQ_MASK); + err = crypto_aead_setkey(tctx->u.aead, key, keylen); + crypto_aead_set_flags(tfm, crypto_aead_get_flags(tctx->u.aead) & + CRYPTO_TFM_RES_MASK); + if (err) + return err; + + if (crypto_authenc_extractkeys(&keys, key, keylen) != 0) { + crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); + return -EINVAL; + } + + desc->tfm = tctx->hash; + err = crypto_shash_init(desc) ?: + crypto_shash_update(desc, keys.enckey, keys.enckeylen) ?: + crypto_shash_finup(desc, keys.authkey, keys.authkeylen, salt); + if (err) + return err; + + crypto_cipher_clear_flags(tctx->essiv_cipher, CRYPTO_TFM_REQ_MASK); + crypto_cipher_set_flags(tctx->essiv_cipher, crypto_aead_get_flags(tfm) & + CRYPTO_TFM_REQ_MASK); + err = crypto_cipher_setkey(tctx->essiv_cipher, salt, + crypto_shash_digestsize(tctx->hash)); + crypto_aead_set_flags(tfm, crypto_cipher_get_flags(tctx->essiv_cipher) & + CRYPTO_TFM_RES_MASK); + + return err; +} + +static int essiv_aead_setauthsize(struct crypto_aead *tfm, + unsigned int authsize) +{ + struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + + return crypto_aead_setauthsize(tctx->u.aead, authsize); +} + +static void essiv_skcipher_done(struct crypto_async_request *areq, int err) +{ + struct skcipher_request *req = areq->data; + + skcipher_request_complete(req, err); +} + +static int essiv_skcipher_crypt(struct skcipher_request *req, bool enc) +{ + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); + const struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); + struct skcipher_request *subreq = skcipher_request_ctx(req); + + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + skcipher_request_set_tfm(subreq, tctx->u.skcipher); + skcipher_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, + req->iv); + skcipher_request_set_callback(subreq, skcipher_request_flags(req), + essiv_skcipher_done, req); + + return enc ? crypto_skcipher_encrypt(subreq) : + crypto_skcipher_decrypt(subreq); +} + +static int essiv_skcipher_encrypt(struct skcipher_request *req) +{ + return essiv_skcipher_crypt(req, true); +} + +static int essiv_skcipher_decrypt(struct skcipher_request *req) +{ + return essiv_skcipher_crypt(req, false); +} + +static void essiv_aead_done(struct crypto_async_request *areq, int err) +{ + struct aead_request *req = areq->data; + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + + if (rctx->iv) + kfree(rctx->iv); + aead_request_complete(req, err); +} + +static int essiv_aead_crypt(struct aead_request *req, bool enc) +{ + gfp_t gfp = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ? GFP_KERNEL + : GFP_ATOMIC; + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; + struct scatterlist *sg; + int err; + + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* + * dm-crypt embeds the sector number and the IV in the AAD region, so + * we have to copy the converted IV into the source scatterlist before + * we pass it on. If the source and destination scatterlist pointers + * are the same, we just update the IV copy in the AAD region in-place. + * However, if they are different, the caller is not expecting us to + * modify the memory described by the source scatterlist, and so we have + * to do this little dance to create a new scatterlist that backs the + * IV slot in the AAD region with a scratch buffer that we can freely + * modify. + */ + rctx->iv = NULL; + if (req->src != req->dst) { + int ivsize = crypto_aead_ivsize(tfm); + int ssize = req->assoclen - ivsize; + u8 *iv; + + if (ssize < 0 || sg_nents_for_len(req->src, ssize) != 1) + return -EINVAL; + + if (enc) { + rctx->iv = iv = kmemdup(req->iv, ivsize, gfp); + if (!iv) + return -ENOMEM; + } else { + /* + * On the decrypt path, the ahash executes before the + * skcipher gets a chance to clobber req->iv with its + * output IV, so just map the buffer directly. + */ + iv = req->iv; + } + + sg_init_table(rctx->sg, 4); + sg_set_page(rctx->sg, sg_page(req->src), ssize, req->src->offset); + sg_set_buf(rctx->sg + 1, iv, ivsize); + sg = scatterwalk_ffwd(rctx->sg + 2, req->src, req->assoclen); + if (sg != rctx->sg + 2) + sg_chain(rctx->sg, 3, sg); + sg = rctx->sg; + } else { + scatterwalk_map_and_copy(req->iv, req->dst, + req->assoclen - crypto_aead_ivsize(tfm), + crypto_aead_ivsize(tfm), 1); + sg = req->src; + } + + aead_request_set_tfm(subreq, tctx->u.aead); + aead_request_set_ad(subreq, req->assoclen); + aead_request_set_callback(subreq, aead_request_flags(req), + essiv_aead_done, req); + aead_request_set_crypt(subreq, sg, req->dst, req->cryptlen, req->iv); + + err = enc ? crypto_aead_encrypt(subreq) : + crypto_aead_decrypt(subreq); + + if (rctx->iv && err != -EINPROGRESS) + kfree(rctx->iv); + + return err; +} + +static int essiv_aead_encrypt(struct aead_request *req) +{ + return essiv_aead_crypt(req, true); +} + +static int essiv_aead_decrypt(struct aead_request *req) +{ + return essiv_aead_crypt(req, false); +} + +static int essiv_init_tfm(struct essiv_instance_ctx *ictx, + struct essiv_tfm_ctx *tctx) +{ + struct crypto_cipher *essiv_cipher; + struct crypto_shash *hash; + int err; + + essiv_cipher = crypto_spawn_cipher(&ictx->essiv_cipher_spawn); + if (IS_ERR(essiv_cipher)) + return PTR_ERR(essiv_cipher); + + hash = crypto_spawn_shash(&ictx->hash_spawn); + if (IS_ERR(hash)) { + err = PTR_ERR(hash); + goto err_free_essiv_cipher; + } + + tctx->essiv_cipher = essiv_cipher; + tctx->hash = hash; + + return 0; + +err_free_essiv_cipher: + crypto_free_cipher(essiv_cipher); + return err; +} + +static int essiv_skcipher_init_tfm(struct crypto_skcipher *tfm) +{ + struct skcipher_instance *inst = skcipher_alg_instance(tfm); + struct essiv_instance_ctx *ictx = skcipher_instance_ctx(inst); + struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); + struct crypto_skcipher *skcipher; + int err; + + skcipher = crypto_spawn_skcipher(&ictx->u.skcipher_spawn); + if (IS_ERR(skcipher)) + return PTR_ERR(skcipher); + + crypto_skcipher_set_reqsize(tfm, sizeof(struct skcipher_request) + + crypto_skcipher_reqsize(skcipher)); + + err = essiv_init_tfm(ictx, tctx); + if (err) { + crypto_free_skcipher(skcipher); + return err; + } + + tctx->u.skcipher = skcipher; + return 0; +} + +static int essiv_aead_init_tfm(struct crypto_aead *tfm) +{ + struct aead_instance *inst = aead_alg_instance(tfm); + struct essiv_instance_ctx *ictx = aead_instance_ctx(inst); + struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct crypto_aead *aead; + unsigned int subreq_size; + int err; + + BUILD_BUG_ON(offsetofend(struct essiv_aead_request_ctx, aead_req) != + sizeof(struct essiv_aead_request_ctx)); + + aead = crypto_spawn_aead(&ictx->u.aead_spawn); + if (IS_ERR(aead)) + return PTR_ERR(aead); + + subreq_size = FIELD_SIZEOF(struct essiv_aead_request_ctx, aead_req) + + crypto_aead_reqsize(aead); + + crypto_aead_set_reqsize(tfm, offsetof(struct essiv_aead_request_ctx, + aead_req) + subreq_size); + + err = essiv_init_tfm(ictx, tctx); + if (err) { + crypto_free_aead(aead); + return err; + } + + tctx->u.aead = aead; + return 0; +} + +static void essiv_skcipher_exit_tfm(struct crypto_skcipher *tfm) +{ + struct essiv_tfm_ctx *tctx = crypto_skcipher_ctx(tfm); + + crypto_free_skcipher(tctx->u.skcipher); + crypto_free_cipher(tctx->essiv_cipher); + crypto_free_shash(tctx->hash); +} + +static void essiv_aead_exit_tfm(struct crypto_aead *tfm) +{ + struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + + crypto_free_aead(tctx->u.aead); + crypto_free_cipher(tctx->essiv_cipher); + crypto_free_shash(tctx->hash); +} + +static void essiv_skcipher_free_instance(struct skcipher_instance *inst) +{ + struct essiv_instance_ctx *ictx = skcipher_instance_ctx(inst); + + crypto_drop_skcipher(&ictx->u.skcipher_spawn); + crypto_drop_spawn(&ictx->essiv_cipher_spawn); + crypto_drop_shash(&ictx->hash_spawn); + kfree(inst); +} + +static void essiv_aead_free_instance(struct aead_instance *inst) +{ + struct essiv_instance_ctx *ictx = aead_instance_ctx(inst); + + crypto_drop_aead(&ictx->u.aead_spawn); + crypto_drop_spawn(&ictx->essiv_cipher_spawn); + crypto_drop_shash(&ictx->hash_spawn); + kfree(inst); +} + +static bool essiv_supported_algorithms(struct crypto_alg *essiv_cipher_alg, + struct shash_alg *hash_alg, + int ivsize) +{ + if (hash_alg->digestsize < essiv_cipher_alg->cra_cipher.cia_min_keysize || + hash_alg->digestsize > essiv_cipher_alg->cra_cipher.cia_max_keysize) + return false; + + if (ivsize != essiv_cipher_alg->cra_blocksize) + return false; + + if (crypto_shash_alg_has_setkey(hash_alg)) + return false; + + return true; +} + +static int essiv_create(struct crypto_template *tmpl, struct rtattr **tb) +{ + struct crypto_attr_type *algt; + const char *inner_cipher_name; + const char *essiv_cipher_name; + const char *shash_name; + struct skcipher_instance *skcipher_inst = NULL; + struct aead_instance *aead_inst = NULL; + struct crypto_instance *inst; + struct crypto_alg *base, *block_base; + struct essiv_instance_ctx *ictx; + struct skcipher_alg *skcipher_alg = NULL; + struct aead_alg *aead_alg = NULL; + struct crypto_alg *essiv_cipher_alg; + struct crypto_alg *_hash_alg; + struct shash_alg *hash_alg; + int ivsize; + u32 type; + int err; + + algt = crypto_get_attr_type(tb); + if (IS_ERR(algt)) + return PTR_ERR(algt); + + inner_cipher_name = crypto_attr_alg_name(tb[1]); + if (IS_ERR(inner_cipher_name)) + return PTR_ERR(inner_cipher_name); + + essiv_cipher_name = crypto_attr_alg_name(tb[2]); + if (IS_ERR(essiv_cipher_name)) + return PTR_ERR(essiv_cipher_name); + + shash_name = crypto_attr_alg_name(tb[3]); + if (IS_ERR(shash_name)) + return PTR_ERR(shash_name); + + type = algt->type & algt->mask; + + switch (type) { + case CRYPTO_ALG_TYPE_BLKCIPHER: + skcipher_inst = kzalloc(sizeof(*skcipher_inst) + + sizeof(*ictx), GFP_KERNEL); + if (!skcipher_inst) + return -ENOMEM; + inst = skcipher_crypto_instance(skcipher_inst); + base = &skcipher_inst->alg.base; + ictx = crypto_instance_ctx(inst); + + /* Block cipher, e.g. "cbc(aes)" */ + crypto_set_skcipher_spawn(&ictx->u.skcipher_spawn, inst); + err = crypto_grab_skcipher(&ictx->u.skcipher_spawn, + inner_cipher_name, 0, + crypto_requires_sync(algt->type, + algt->mask)); + if (err) + goto out_free_inst; + skcipher_alg = crypto_spawn_skcipher_alg(&ictx->u.skcipher_spawn); + block_base = &skcipher_alg->base; + ivsize = crypto_skcipher_alg_ivsize(skcipher_alg); + break; + + case CRYPTO_ALG_TYPE_AEAD: + aead_inst = kzalloc(sizeof(*aead_inst) + + sizeof(*ictx), GFP_KERNEL); + if (!aead_inst) + return -ENOMEM; + inst = aead_crypto_instance(aead_inst); + base = &aead_inst->alg.base; + ictx = crypto_instance_ctx(inst); + + /* AEAD cipher, e.g. "authenc(hmac(sha256),cbc(aes))" */ + crypto_set_aead_spawn(&ictx->u.aead_spawn, inst); + err = crypto_grab_aead(&ictx->u.aead_spawn, + inner_cipher_name, 0, + crypto_requires_sync(algt->type, + algt->mask)); + if (err) + goto out_free_inst; + aead_alg = crypto_spawn_aead_alg(&ictx->u.aead_spawn); + block_base = &aead_alg->base; + ivsize = aead_alg->ivsize; + break; + + default: + return -EINVAL; + } + + /* Block cipher, e.g. "aes" */ + crypto_set_spawn(&ictx->essiv_cipher_spawn, inst); + err = crypto_grab_spawn(&ictx->essiv_cipher_spawn, essiv_cipher_name, + CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK); + if (err) + goto out_drop_skcipher; + essiv_cipher_alg = ictx->essiv_cipher_spawn.alg; + + /* Synchronous hash, e.g., "sha256" */ + _hash_alg = crypto_alg_mod_lookup(shash_name, + CRYPTO_ALG_TYPE_SHASH, + CRYPTO_ALG_TYPE_MASK); + if (IS_ERR(_hash_alg)) { + err = PTR_ERR(_hash_alg); + goto out_drop_essiv_cipher; + } + hash_alg = __crypto_shash_alg(_hash_alg); + err = crypto_init_shash_spawn(&ictx->hash_spawn, hash_alg, inst); + if (err) + goto out_put_hash; + + /* Check the set of algorithms */ + if (!essiv_supported_algorithms(essiv_cipher_alg, hash_alg, ivsize)) { + pr_warn("Unsupported essiv instantiation: essiv(%s,%s,%s)\n", + block_base->cra_name, + essiv_cipher_alg->cra_name, + hash_alg->base.cra_name); + err = -EINVAL; + goto out_drop_hash; + } + + /* Instance fields */ + + err = -ENAMETOOLONG; + if (snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, + "essiv(%s,%s,%s)", block_base->cra_name, + essiv_cipher_alg->cra_name, + hash_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME) + goto out_drop_hash; + if (snprintf(base->cra_driver_name, CRYPTO_MAX_ALG_NAME, + "essiv(%s,%s,%s)", + block_base->cra_driver_name, + essiv_cipher_alg->cra_driver_name, + hash_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME) + goto out_drop_hash; + + base->cra_flags = block_base->cra_flags & CRYPTO_ALG_ASYNC; + base->cra_blocksize = block_base->cra_blocksize; + base->cra_ctxsize = sizeof(struct essiv_tfm_ctx); + base->cra_alignmask = block_base->cra_alignmask; + base->cra_priority = block_base->cra_priority; + + if (type == CRYPTO_ALG_TYPE_BLKCIPHER) { + skcipher_inst->alg.setkey = essiv_skcipher_setkey; + skcipher_inst->alg.encrypt = essiv_skcipher_encrypt; + skcipher_inst->alg.decrypt = essiv_skcipher_decrypt; + skcipher_inst->alg.init = essiv_skcipher_init_tfm; + skcipher_inst->alg.exit = essiv_skcipher_exit_tfm; + + skcipher_inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(skcipher_alg); + skcipher_inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(skcipher_alg); + skcipher_inst->alg.ivsize = crypto_skcipher_alg_ivsize(skcipher_alg); + skcipher_inst->alg.chunksize = crypto_skcipher_alg_chunksize(skcipher_alg); + skcipher_inst->alg.walksize = crypto_skcipher_alg_walksize(skcipher_alg); + + skcipher_inst->free = essiv_skcipher_free_instance; + + err = skcipher_register_instance(tmpl, skcipher_inst); + } else { + aead_inst->alg.setkey = essiv_aead_setkey; + aead_inst->alg.setauthsize = essiv_aead_setauthsize; + aead_inst->alg.encrypt = essiv_aead_encrypt; + aead_inst->alg.decrypt = essiv_aead_decrypt; + aead_inst->alg.init = essiv_aead_init_tfm; + aead_inst->alg.exit = essiv_aead_exit_tfm; + + aead_inst->alg.ivsize = crypto_aead_alg_ivsize(aead_alg); + aead_inst->alg.maxauthsize = crypto_aead_alg_maxauthsize(aead_alg); + aead_inst->alg.chunksize = crypto_aead_alg_chunksize(aead_alg); + + aead_inst->free = essiv_aead_free_instance; + + err = aead_register_instance(tmpl, aead_inst); + } + + if (err) + goto out_drop_hash; + + crypto_mod_put(_hash_alg); + return 0; + +out_drop_hash: + crypto_drop_shash(&ictx->hash_spawn); +out_put_hash: + crypto_mod_put(_hash_alg); +out_drop_essiv_cipher: + crypto_drop_spawn(&ictx->essiv_cipher_spawn); +out_drop_skcipher: + if (type == CRYPTO_ALG_TYPE_BLKCIPHER) + crypto_drop_skcipher(&ictx->u.skcipher_spawn); + else + crypto_drop_aead(&ictx->u.aead_spawn); +out_free_inst: + kfree(skcipher_inst); + kfree(aead_inst); + return err; +} + +/* essiv(inner_cipher_name, essiv_cipher_name, shash_name) */ +static struct crypto_template essiv_tmpl = { + .name = "essiv", + .create = essiv_create, + .module = THIS_MODULE, +}; + +static int __init essiv_module_init(void) +{ + return crypto_register_template(&essiv_tmpl); +} + +static void __exit essiv_module_exit(void) +{ + crypto_unregister_template(&essiv_tmpl); +} + +subsys_initcall(essiv_module_init); +module_exit(essiv_module_exit); + +MODULE_DESCRIPTION("ESSIV skcipher/aead wrapper for block encryption"); +MODULE_LICENSE("GPL v2"); +MODULE_ALIAS_CRYPTO("essiv"); From patchwork Wed Jun 26 20:40:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167854 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413610ilk; Wed, 26 Jun 2019 13:40:58 -0700 (PDT) X-Google-Smtp-Source: APXvYqy06lEhFSegbkyIjvAqIJIdoiV33qSobtZhYe7epFX0H01aVFCjr2B35AmoHbWP/Cw8VaaA X-Received: by 2002:a17:902:d20a:: with SMTP id t10mr74442ply.52.1561581658307; Wed, 26 Jun 2019 13:40:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581658; cv=none; d=google.com; s=arc-20160816; b=Wnk//+PyumNDF9N8aUfITgQ/8+R6xOVp95Ua+ueV6V8MVr1+wMnNCCNLpGaJnPMPA4 TZ4U7HDO5FI+WA6YuZM8MRioTjy1iJiUM2hK00TbxbAzNRX/uvAxP0SkBXJsFxeEYbZh fpzSbf9qzVNAZcebBEccGwHkJf9Vnhr2kWRC7RC7lkZf/gRBeSycTeIGTUQICau5CovE G1IBNFa5Op9Z7MpYwL/kUu4hamaXeLW15gmc9jW12WbrLtLmeyPX0EVeW0OIhvNBP3+i /9jWUZIzttoTmbE+13tYw5kpvMgzfwpT3rpI9nL2RVidVbv32pIqyk/fItDt8vEgPfs7 aNmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=EdwcyrYKvFlRQfInLeYh/Y96ip8pVuH6VkdGJzNxS+E=; b=OJ7gG8/g/HuE9aXfvENXSrLXF44cNp+MgRp++RAXtJYdwF+o5I05o9tKdrJubouMaH VcDF1+otQxKJ9UDJv+D32bulM4pFs4qtfIRfMLX5ItQvQGwTpPVUd3ZbHReidVeM3S00 sQKpA9YQnJuzVa+y0G7iCgjLkIGEEzksGxDozvjYxnfnmnS/SCE67ceCmTQKZnv06MsU EhmMjBGl3iOSqlZTEus4Q8ofXGZIAyDqZ9LyhCpgePR5rp32O0MNaj7FlpvOY+vSFcWG cy2pH7Y1Ya/8td5UzNFaVwb9PgzH7MIhCWL2lG/d+tAhJwV2sb1hQBwRa+XbnK/cYzPh wTVw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=XrnuWSNN; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.40.58; Wed, 26 Jun 2019 13:40:58 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=XrnuWSNN; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726440AbfFZUk5 (ORCPT + 3 others); Wed, 26 Jun 2019 16:40:57 -0400 Received: from mail-wr1-f68.google.com ([209.85.221.68]:40347 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726359AbfFZUk5 (ORCPT ); Wed, 26 Jun 2019 16:40:57 -0400 Received: by mail-wr1-f68.google.com with SMTP id p11so4269354wre.7 for ; Wed, 26 Jun 2019 13:40:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=EdwcyrYKvFlRQfInLeYh/Y96ip8pVuH6VkdGJzNxS+E=; b=XrnuWSNNkW08C74+DGwDRNN3HBQvCzxpgTYZasn4brh9daF9IptDFD5eyDvkrAEqyM rQe+sGEnGTDz9rneK2BmCzOy9yxCueqMDWXXws68+JkbkAip/vQJhpLZlzMs3//K2KfL WJQyOWmGEyesXOx4z6d/HV2ML2aEZQ26KJxMlh7bT4YtSE9b1O8GHHmPVNzL7X8HZaiF Js5xYwLpUkMb+3uINqGwa5VwmSfgZ2CQ4+JMmUdvdLFh31HGHokLCSxnYQt9Bdc2ViDe qamnOr/Z+xc0UvLw8RKxGpbE3zbcebrmLl4MCIeRQA0vOKs3eY5oNEqDlrX/CJrBSv+m tz2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=EdwcyrYKvFlRQfInLeYh/Y96ip8pVuH6VkdGJzNxS+E=; b=PMEH3Zn+OcWkpb7n9X1Q92fRXK4Vwl14mddD/KuJVVXpZzzVikHnA2A0X9U9VQIeur X2eMMKUNl0JHLg4o1L1u8CnNoe4UZE2BKacNnZOFWjgEiAQXzGhrTo7ri5wkU37RiiN9 yFn1IP3auBdWMZqluz2vDiEnKV5v4bZPNFIol6YasqrxAgToUCb85x8cR3grGHSBgXlm tFpRdyxSyF7h1clztm8iTGSpxsKL7ekh3dI7mt2tPlHpF/4S4g6e6ZDBJoBwKuawe9nb AWv5u0BIhQiHt8wAmmSmSzI90KcMVBSsAF0kcnR9cy7Ky4XgB6K5iGy4n/Y1IPu7B+PB SAig== X-Gm-Message-State: APjAAAXdwk1ZlU0dDqFAr1O6+ahUY94PNG3UjZ7CCSvrHFyzjywUHBBb ZhoC3Hzao9CVBanvtRTm/3kD3aMsVFnR2w== X-Received: by 2002:a5d:5303:: with SMTP id e3mr4937859wrv.239.1561581654177; Wed, 26 Jun 2019 13:40:54 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:53 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 2/7] fs: crypto: invoke crypto API for ESSIV handling Date: Wed, 26 Jun 2019 22:40:42 +0200 Message-Id: <20190626204047.32131-3-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Instead of open coding the calculations for ESSIV handling, use a ESSIV skcipher which does all of this under the hood. Signed-off-by: Ard Biesheuvel --- fs/crypto/Kconfig | 1 + fs/crypto/crypto.c | 5 -- fs/crypto/fscrypt_private.h | 9 -- fs/crypto/keyinfo.c | 88 +------------------- 4 files changed, 3 insertions(+), 100 deletions(-) -- 2.20.1 diff --git a/fs/crypto/Kconfig b/fs/crypto/Kconfig index 24ed99e2eca0..b0292da8613c 100644 --- a/fs/crypto/Kconfig +++ b/fs/crypto/Kconfig @@ -5,6 +5,7 @@ config FS_ENCRYPTION select CRYPTO_AES select CRYPTO_CBC select CRYPTO_ECB + select CRYPTO_ESSIV select CRYPTO_XTS select CRYPTO_CTS select CRYPTO_SHA256 diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c index 335a362ee446..c53ce262a06c 100644 --- a/fs/crypto/crypto.c +++ b/fs/crypto/crypto.c @@ -136,9 +136,6 @@ void fscrypt_generate_iv(union fscrypt_iv *iv, u64 lblk_num, if (ci->ci_flags & FS_POLICY_FLAG_DIRECT_KEY) memcpy(iv->nonce, ci->ci_nonce, FS_KEY_DERIVATION_NONCE_SIZE); - - if (ci->ci_essiv_tfm != NULL) - crypto_cipher_encrypt_one(ci->ci_essiv_tfm, iv->raw, iv->raw); } int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw, @@ -492,8 +489,6 @@ static void __exit fscrypt_exit(void) destroy_workqueue(fscrypt_read_workqueue); kmem_cache_destroy(fscrypt_ctx_cachep); kmem_cache_destroy(fscrypt_info_cachep); - - fscrypt_essiv_cleanup(); } module_exit(fscrypt_exit); diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h index 7da276159593..59d0cba9cfb9 100644 --- a/fs/crypto/fscrypt_private.h +++ b/fs/crypto/fscrypt_private.h @@ -61,12 +61,6 @@ struct fscrypt_info { /* The actual crypto transform used for encryption and decryption */ struct crypto_skcipher *ci_ctfm; - /* - * Cipher for ESSIV IV generation. Only set for CBC contents - * encryption, otherwise is NULL. - */ - struct crypto_cipher *ci_essiv_tfm; - /* * Encryption mode used for this inode. It corresponds to either * ci_data_mode or ci_filename_mode, depending on the inode type. @@ -166,9 +160,6 @@ struct fscrypt_mode { int keysize; int ivsize; bool logged_impl_name; - bool needs_essiv; }; -extern void __exit fscrypt_essiv_cleanup(void); - #endif /* _FSCRYPT_PRIVATE_H */ diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index dcd91a3fbe49..82c7eb86ca00 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -19,8 +19,6 @@ #include #include "fscrypt_private.h" -static struct crypto_shash *essiv_hash_tfm; - /* Table of keys referenced by FS_POLICY_FLAG_DIRECT_KEY policies */ static DEFINE_HASHTABLE(fscrypt_master_keys, 6); /* 6 bits = 64 buckets */ static DEFINE_SPINLOCK(fscrypt_master_keys_lock); @@ -144,10 +142,9 @@ static struct fscrypt_mode available_modes[] = { }, [FS_ENCRYPTION_MODE_AES_128_CBC] = { .friendly_name = "AES-128-CBC", - .cipher_str = "cbc(aes)", + .cipher_str = "essiv(cbc(aes),aes,sha256)", .keysize = 16, - .ivsize = 16, - .needs_essiv = true, + .ivsize = 8, }, [FS_ENCRYPTION_MODE_AES_128_CTS] = { .friendly_name = "AES-128-CTS-CBC", @@ -377,72 +374,6 @@ fscrypt_get_master_key(const struct fscrypt_info *ci, struct fscrypt_mode *mode, return ERR_PTR(err); } -static int derive_essiv_salt(const u8 *key, int keysize, u8 *salt) -{ - struct crypto_shash *tfm = READ_ONCE(essiv_hash_tfm); - - /* init hash transform on demand */ - if (unlikely(!tfm)) { - struct crypto_shash *prev_tfm; - - tfm = crypto_alloc_shash("sha256", 0, 0); - if (IS_ERR(tfm)) { - fscrypt_warn(NULL, - "error allocating SHA-256 transform: %ld", - PTR_ERR(tfm)); - return PTR_ERR(tfm); - } - prev_tfm = cmpxchg(&essiv_hash_tfm, NULL, tfm); - if (prev_tfm) { - crypto_free_shash(tfm); - tfm = prev_tfm; - } - } - - { - SHASH_DESC_ON_STACK(desc, tfm); - desc->tfm = tfm; - - return crypto_shash_digest(desc, key, keysize, salt); - } -} - -static int init_essiv_generator(struct fscrypt_info *ci, const u8 *raw_key, - int keysize) -{ - int err; - struct crypto_cipher *essiv_tfm; - u8 salt[SHA256_DIGEST_SIZE]; - - essiv_tfm = crypto_alloc_cipher("aes", 0, 0); - if (IS_ERR(essiv_tfm)) - return PTR_ERR(essiv_tfm); - - ci->ci_essiv_tfm = essiv_tfm; - - err = derive_essiv_salt(raw_key, keysize, salt); - if (err) - goto out; - - /* - * Using SHA256 to derive the salt/key will result in AES-256 being - * used for IV generation. File contents encryption will still use the - * configured keysize (AES-128) nevertheless. - */ - err = crypto_cipher_setkey(essiv_tfm, salt, sizeof(salt)); - if (err) - goto out; - -out: - memzero_explicit(salt, sizeof(salt)); - return err; -} - -void __exit fscrypt_essiv_cleanup(void) -{ - crypto_free_shash(essiv_hash_tfm); -} - /* * Given the encryption mode and key (normally the derived key, but for * FS_POLICY_FLAG_DIRECT_KEY mode it's the master key), set up the inode's @@ -454,7 +385,6 @@ static int setup_crypto_transform(struct fscrypt_info *ci, { struct fscrypt_master_key *mk; struct crypto_skcipher *ctfm; - int err; if (ci->ci_flags & FS_POLICY_FLAG_DIRECT_KEY) { mk = fscrypt_get_master_key(ci, mode, raw_key, inode); @@ -470,19 +400,6 @@ static int setup_crypto_transform(struct fscrypt_info *ci, ci->ci_master_key = mk; ci->ci_ctfm = ctfm; - if (mode->needs_essiv) { - /* ESSIV implies 16-byte IVs which implies !DIRECT_KEY */ - WARN_ON(mode->ivsize != AES_BLOCK_SIZE); - WARN_ON(ci->ci_flags & FS_POLICY_FLAG_DIRECT_KEY); - - err = init_essiv_generator(ci, raw_key, mode->keysize); - if (err) { - fscrypt_warn(inode->i_sb, - "error initializing ESSIV generator for inode %lu: %d", - inode->i_ino, err); - return err; - } - } return 0; } @@ -495,7 +412,6 @@ static void put_crypt_info(struct fscrypt_info *ci) put_master_key(ci->ci_master_key); } else { crypto_free_skcipher(ci->ci_ctfm); - crypto_free_cipher(ci->ci_essiv_tfm); } kmem_cache_free(fscrypt_info_cachep, ci); } From patchwork Wed Jun 26 20:40:43 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167855 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413623ilk; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) X-Google-Smtp-Source: APXvYqz2oPjOfXXszvd4GM52+v5ZrGjx4tJdp7hgjsQ1Wi+MytUuodVHnednGlAjI7p3FqIwVoL8 X-Received: by 2002:a63:f817:: with SMTP id n23mr4840593pgh.35.1561581659036; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581659; cv=none; d=google.com; s=arc-20160816; b=UpqRw00WKto+NdiOctpChOCu+Ou9bQPX+LN/5ifD+MgVfG/Z4gIWmA9SH96rKBuQwl /rCX0A0pBa5p5IsYZ1OxzRvm8H76nx8Q+Ma1se5IX3wnxFIvPf2Y7p8blZjueLtZuf4D NqhdTdQ5XV+pIHT0l6OqcE+qG8+gZSzXtgxAMvb+zi2nwhxupWBogNAU64Gx6R5pcfJi i9xeA8y+tfCTPt/Bv6MGeMrvs51k9odUzdFcXcAqvNjgzGUdrT2E+DlJpECbMdQXK1MW CsYRHcbz1kKaHbi7JPUodNuEUIOTO09GtAp6zN4tmBFseq6NViuEeqfdtEOVeNyHkFIO WrkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=qsECSzDwZmZWjunZWkZ4/sxN9oyV7lbTfmYWPWEtO7o=; b=ZFsVV+LXZJkULUTuSBsT1u6Ha36utchHwlz0t3a5EGunogGPO+qyW/DiCgXsfw4eIg 2/6noZpuCQ7biNCy9QUjYZuv5CkwLE4ZZH0eDB5C4k+uaL/wejXsovWrIaZD/xFR+fVt qeMEQyOvrkADwO6iROfdnI0p9Cdw9RYLUt6cXnM5u3hhWOGIPTBQ+WGP2LJRU5VWLtJ7 rN+cbnVjknJOhcBi2/7uHf0H3absKs8jVJh+T2rbdf+L7BChzZQ3QFHJCi+RELfVsS1u vidyt22nsPYedtB01umdmTdrFlc7l82ONHX+PReBoW4f8bGfbvedKETNkq09oBYChSjc E8jQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=FuRzHg6W; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.40.58; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=FuRzHg6W; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726271AbfFZUk6 (ORCPT + 3 others); Wed, 26 Jun 2019 16:40:58 -0400 Received: from mail-wr1-f67.google.com ([209.85.221.67]:40349 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726373AbfFZUk5 (ORCPT ); Wed, 26 Jun 2019 16:40:57 -0400 Received: by mail-wr1-f67.google.com with SMTP id p11so4269394wre.7 for ; Wed, 26 Jun 2019 13:40:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qsECSzDwZmZWjunZWkZ4/sxN9oyV7lbTfmYWPWEtO7o=; b=FuRzHg6WARvoMr4E98EICb8lwwzIkbNBKvhn//9fQIZP0++3MvWAoCSrdGYu8BCegm 5ISVo6liu2D7Wo8iyygHWiH0pepQFFzZ59L+Y5efKzNWIRpBllpV+SBsfvNuTG9GnNny ZUMOlkGUgaQT3cliACBRB6tqcbJ2jE9miSPiinOPLUrNbI+M/uQBIDhKlbpmZ6pOw9+z Y7J0Wogs6S1do87Ht/xrJhSzF1Fii0Drd+eM/u8hTZKTyXw547DaqLmLCuox/Egkbyuh NbILSRFmsOXMBCiPHzh3brPgtl7mkkYGIGJSSyO9ATt7lHHJv+H+Pw2f988YEk1NyzF8 B/qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qsECSzDwZmZWjunZWkZ4/sxN9oyV7lbTfmYWPWEtO7o=; b=JIXgUfVxpBoGtJNtX4+a3y8JsLRK9nS0bOQY5Tj8sRLAZVX5tPo6mAT/TeQouGYkT/ OonK0jvEtkS4QLAELB4apvoAwSNfJGSt1/264iH6cyWNV7maFXsiUPay28fApABxZLIw Y7cA3fqAi3r1J159sV/oQvZfQcTaqGDxYRr1vL8WNHWtUPdil4PhuKjxmk6mz/YyNgMY 8oWGJi0u7kpOXP9AjF5v6m5/gek3BIkhGly1JmFQTqg+jp+bIkSaCJZMaXRb3OczfP27 uExYt6kZlHWdVlpXxcgKQD/2A3TUG2i3K7D2ydfloA/fJJR4h9XdIurtq+NXdwZw//at UKEA== X-Gm-Message-State: APjAAAVKDtFpIf8fu9SZ4wZ5hEOB9WM9bW0V8qFVGmUPheT97l4Gof0t WEh1EtrvoWIyNkHcH8dj84ostkaInUulbQ== X-Received: by 2002:adf:e691:: with SMTP id r17mr5121901wrm.67.1561581655279; Wed, 26 Jun 2019 13:40:55 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:54 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 3/7] md: dm-crypt: infer ESSIV block cipher from cipher string directly Date: Wed, 26 Jun 2019 22:40:43 +0200 Message-Id: <20190626204047.32131-4-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Instead of allocating a crypto skcipher tfm 'foo' and attempting to infer the encapsulated block cipher from the driver's 'name' field, directly parse the string that we used to allocated the tfm. These are always identical (unless the allocation failed, in which case we bail anyway), but using the string allows us to use it in the allocation, which is something we will need when switching to the 'essiv' crypto API template. Signed-off-by: Ard Biesheuvel --- drivers/md/dm-crypt.c | 35 +++++++++----------- 1 file changed, 15 insertions(+), 20 deletions(-) -- 2.20.1 diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 1b16d34bb785..f001f1104cb5 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2321,25 +2321,17 @@ static int crypt_ctr_ivmode(struct dm_target *ti, const char *ivmode) * The cc->cipher is currently used only in ESSIV. * This should be probably done by crypto-api calls (once available...) */ -static int crypt_ctr_blkdev_cipher(struct crypt_config *cc) +static int crypt_ctr_blkdev_cipher(struct crypt_config *cc, char *alg_name) { - const char *alg_name = NULL; char *start, *end; if (crypt_integrity_aead(cc)) { - alg_name = crypto_tfm_alg_name(crypto_aead_tfm(any_tfm_aead(cc))); - if (!alg_name) - return -EINVAL; if (crypt_integrity_hmac(cc)) { alg_name = strchr(alg_name, ','); if (!alg_name) return -EINVAL; } alg_name++; - } else { - alg_name = crypto_tfm_alg_name(crypto_skcipher_tfm(any_tfm(cc))); - if (!alg_name) - return -EINVAL; } start = strchr(alg_name, '('); @@ -2434,6 +2426,20 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key if (*ivmode && !strcmp(*ivmode, "lmk")) cc->tfms_count = 64; + if (crypt_integrity_aead(cc)) { + ret = crypt_ctr_auth_cipher(cc, cipher_api); + if (ret < 0) { + ti->error = "Invalid AEAD cipher spec"; + return -ENOMEM; + } + } + + ret = crypt_ctr_blkdev_cipher(cc, cipher_api); + if (ret < 0) { + ti->error = "Cannot allocate cipher string"; + return -ENOMEM; + } + cc->key_parts = cc->tfms_count; /* Allocate cipher */ @@ -2445,21 +2451,10 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key /* Alloc AEAD, can be used only in new format. */ if (crypt_integrity_aead(cc)) { - ret = crypt_ctr_auth_cipher(cc, cipher_api); - if (ret < 0) { - ti->error = "Invalid AEAD cipher spec"; - return -ENOMEM; - } cc->iv_size = crypto_aead_ivsize(any_tfm_aead(cc)); } else cc->iv_size = crypto_skcipher_ivsize(any_tfm(cc)); - ret = crypt_ctr_blkdev_cipher(cc); - if (ret < 0) { - ti->error = "Cannot allocate cipher string"; - return -ENOMEM; - } - return 0; } From patchwork Wed Jun 26 20:40:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167857 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413657ilk; Wed, 26 Jun 2019 13:41:00 -0700 (PDT) X-Google-Smtp-Source: APXvYqw+qzBKo8Bq2PvABW/VbIesALVzT/77ZuT+4M4/DqVlZta5gFmp8sB/2aBG/5vOHD5uurHG X-Received: by 2002:a17:902:8490:: with SMTP id c16mr34675plo.1.1561581660437; Wed, 26 Jun 2019 13:41:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581660; cv=none; d=google.com; s=arc-20160816; b=AcX/XfzkBYNBxbS58UHmXK3hbj+Z4HfXmRpOXat+FPXsM8DR7wDFzIRnvBaRvncCvW LJu10h0skveclroyeKXVOdPUK1FVTOQohvSiCFK2ilhxwMNCsA5uRw0jCSYZvDo+eJjs aj2Hw3+jwcAL27ck/iDzYTYrj7lCW89jSnVgbQOIwzkaLP/qYBcuSy21Xz6jsP+d8NzH ZGP9nK3Df14rKmzsdAR6xoshyaqa8KF/JS+Ds659WsNxe/DZ/i/jtZsrRosd9rkIrSso py2VL3oSMI4iZdvtjD8/fFHc6j3hpea7Ni/0bh+Fr+amUpFnhkQUaqLlMecgtYW7egi5 apmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=0C30waaUNG8lCVZnBPnYOmd0NAF2K1blMYiYZG3BUfY=; b=jd42CX8dAIz25dQ2HhREObn+uEouK3vCAIRFyUN7OGQOC8W6i2RG0DU/eBNHbA9unH GvndbsLVcSpYujy5qEXphex/dfQFg+0tglDulsf9zbhS8WI/L7BydjmHY1lnCrFH0JbI vAGVb/+zUoNfphIbp2B6OjBjYvNGg6yeFOUMWPheGinDRQAJttxE0pQ6qsd73D9DG2VG ZjRQ50VYcYnWGDBiz1bfVEfyY818fhNQTgjtSKIhAaWY2DiVyMdAA/tpJ0F7o7Ihprvr 01XeMXqUJvdsBa/+eIUBpQN1lr7wJh7P/HGae+3PK/hhxyts4BvToMIQWfGhOieWs3is KzVw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=UhWez6BJ; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.41.00; Wed, 26 Jun 2019 13:41:00 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=UhWez6BJ; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726445AbfFZUk7 (ORCPT + 3 others); Wed, 26 Jun 2019 16:40:59 -0400 Received: from mail-wm1-f68.google.com ([209.85.128.68]:53768 "EHLO mail-wm1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726437AbfFZUk6 (ORCPT ); Wed, 26 Jun 2019 16:40:58 -0400 Received: by mail-wm1-f68.google.com with SMTP id x15so3467362wmj.3 for ; Wed, 26 Jun 2019 13:40:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=0C30waaUNG8lCVZnBPnYOmd0NAF2K1blMYiYZG3BUfY=; b=UhWez6BJR0XgvoCPp4LGIQKgJn0VKmqLrrSHkCmadW6BTDkBqaNTq8yt0Lwk8VOSOA 8p+3wzi5NrgCGK1IrACbiOpxUMcU/f9kxEhGazMxP2nCWetVyRvd/97UWLYxutba615z qC65JTBE9fIl39xzAN/WCX0q/HISTsZTYoEpaT8UZDn+W4jFwmXBkgdFIBAPHZr1eDd4 cFdTKnjgIMwADiCwX94KsSGjPwHrf6NGuduvncSmoW3c8qcKS5PrA1fjoCi/HxSldXAK lPms3TyWljPb8BV/jF7YWTEjMQYX3JVw9wmrp5CkiIT/heEZAjhhU+0K6O98jJzN6ncY zoIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0C30waaUNG8lCVZnBPnYOmd0NAF2K1blMYiYZG3BUfY=; b=DP+OGDmFZ3ZOlxOUlHMAohU0fkj0gkotd7Jw3XJb9TmKZbwFuhLU88kwt7h33eUQPe +nY8wHEQQMYoZWyKDBRGVm1t3wWKYybGjilnUuCAoim8h/1YBvpJmQa+WBPa8VxBsCzl AlkKsa4uSD2bftP5pnCQdkLupw+hVGdwE4qFhR6qziGjeR/XCOLDrWCqm09RHhQ67H67 /u8znp9j9fPm3lt/6ugEGFvaSHhs3HUydlRGgkUtP55BVP7iwEAy4C3BVv/5M2P8skp6 HAWG86GDLdYJobMDMr1U25idGgjU2tdanmTdacw5LnOwaDMUamPI69lCQkqJcJo6AmoH Avzg== X-Gm-Message-State: APjAAAWfFp3S1GLCtHpVoUupPJ1uqmMr+hfccG8DssKV26m9owCDq65I IVnyLyzxnJn+0bqJBUu3vQ/l1V65LT57Mg== X-Received: by 2002:a1c:1d8d:: with SMTP id d135mr503480wmd.54.1561581656506; Wed, 26 Jun 2019 13:40:56 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:55 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 4/7] md: dm-crypt: switch to ESSIV crypto API template Date: Wed, 26 Jun 2019 22:40:44 +0200 Message-Id: <20190626204047.32131-5-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Replace the explicit ESSIV handling in the dm-crypt driver with calls into the crypto API, which now possesses the capability to perform this processing within the crypto subsystem. Signed-off-by: Ard Biesheuvel --- drivers/md/Kconfig | 1 + drivers/md/dm-crypt.c | 200 ++++---------------- 2 files changed, 36 insertions(+), 165 deletions(-) -- 2.20.1 diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index 45254b3ef715..30ca87cf25db 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -271,6 +271,7 @@ config DM_CRYPT depends on BLK_DEV_DM select CRYPTO select CRYPTO_CBC + select CRYPTO_ESSIV ---help--- This device-mapper target allows you to create a device that transparently encrypts the data on it. You'll need to activate diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index f001f1104cb5..e26a09c2d1a6 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -98,11 +98,6 @@ struct crypt_iv_operations { struct dm_crypt_request *dmreq); }; -struct iv_essiv_private { - struct crypto_shash *hash_tfm; - u8 *salt; -}; - struct iv_benbi_private { int shift; }; @@ -155,7 +150,6 @@ struct crypt_config { const struct crypt_iv_operations *iv_gen_ops; union { - struct iv_essiv_private essiv; struct iv_benbi_private benbi; struct iv_lmk_private lmk; struct iv_tcw_private tcw; @@ -165,8 +159,6 @@ struct crypt_config { unsigned short int sector_size; unsigned char sector_shift; - /* ESSIV: struct crypto_cipher *essiv_tfm */ - void *iv_private; union { struct crypto_skcipher **tfms; struct crypto_aead **tfms_aead; @@ -323,157 +315,15 @@ static int crypt_iv_plain64be_gen(struct crypt_config *cc, u8 *iv, return 0; } -/* Initialise ESSIV - compute salt but no local memory allocations */ -static int crypt_iv_essiv_init(struct crypt_config *cc) -{ - struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; - SHASH_DESC_ON_STACK(desc, essiv->hash_tfm); - struct crypto_cipher *essiv_tfm; - int err; - - desc->tfm = essiv->hash_tfm; - - err = crypto_shash_digest(desc, cc->key, cc->key_size, essiv->salt); - shash_desc_zero(desc); - if (err) - return err; - - essiv_tfm = cc->iv_private; - - err = crypto_cipher_setkey(essiv_tfm, essiv->salt, - crypto_shash_digestsize(essiv->hash_tfm)); - if (err) - return err; - - return 0; -} - -/* Wipe salt and reset key derived from volume key */ -static int crypt_iv_essiv_wipe(struct crypt_config *cc) -{ - struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; - unsigned salt_size = crypto_shash_digestsize(essiv->hash_tfm); - struct crypto_cipher *essiv_tfm; - int r, err = 0; - - memset(essiv->salt, 0, salt_size); - - essiv_tfm = cc->iv_private; - r = crypto_cipher_setkey(essiv_tfm, essiv->salt, salt_size); - if (r) - err = r; - - return err; -} - -/* Allocate the cipher for ESSIV */ -static struct crypto_cipher *alloc_essiv_cipher(struct crypt_config *cc, - struct dm_target *ti, - const u8 *salt, - unsigned int saltsize) -{ - struct crypto_cipher *essiv_tfm; - int err; - - /* Setup the essiv_tfm with the given salt */ - essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, 0); - if (IS_ERR(essiv_tfm)) { - ti->error = "Error allocating crypto tfm for ESSIV"; - return essiv_tfm; - } - - if (crypto_cipher_blocksize(essiv_tfm) != cc->iv_size) { - ti->error = "Block size of ESSIV cipher does " - "not match IV size of block cipher"; - crypto_free_cipher(essiv_tfm); - return ERR_PTR(-EINVAL); - } - - err = crypto_cipher_setkey(essiv_tfm, salt, saltsize); - if (err) { - ti->error = "Failed to set key for ESSIV cipher"; - crypto_free_cipher(essiv_tfm); - return ERR_PTR(err); - } - - return essiv_tfm; -} - -static void crypt_iv_essiv_dtr(struct crypt_config *cc) -{ - struct crypto_cipher *essiv_tfm; - struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; - - crypto_free_shash(essiv->hash_tfm); - essiv->hash_tfm = NULL; - - kzfree(essiv->salt); - essiv->salt = NULL; - - essiv_tfm = cc->iv_private; - - if (essiv_tfm) - crypto_free_cipher(essiv_tfm); - - cc->iv_private = NULL; -} - -static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti, - const char *opts) -{ - struct crypto_cipher *essiv_tfm = NULL; - struct crypto_shash *hash_tfm = NULL; - u8 *salt = NULL; - int err; - - if (!opts) { - ti->error = "Digest algorithm missing for ESSIV mode"; - return -EINVAL; - } - - /* Allocate hash algorithm */ - hash_tfm = crypto_alloc_shash(opts, 0, 0); - if (IS_ERR(hash_tfm)) { - ti->error = "Error initializing ESSIV hash"; - err = PTR_ERR(hash_tfm); - goto bad; - } - - salt = kzalloc(crypto_shash_digestsize(hash_tfm), GFP_KERNEL); - if (!salt) { - ti->error = "Error kmallocing salt storage in ESSIV"; - err = -ENOMEM; - goto bad; - } - - cc->iv_gen_private.essiv.salt = salt; - cc->iv_gen_private.essiv.hash_tfm = hash_tfm; - - essiv_tfm = alloc_essiv_cipher(cc, ti, salt, - crypto_shash_digestsize(hash_tfm)); - if (IS_ERR(essiv_tfm)) { - crypt_iv_essiv_dtr(cc); - return PTR_ERR(essiv_tfm); - } - cc->iv_private = essiv_tfm; - - return 0; - -bad: - if (hash_tfm && !IS_ERR(hash_tfm)) - crypto_free_shash(hash_tfm); - kfree(salt); - return err; -} - static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { - struct crypto_cipher *essiv_tfm = cc->iv_private; - + /* + * ESSIV encryption of the IV is now handled by the crypto API, + * so just pass the plain sector number here. + */ memset(iv, 0, cc->iv_size); *(__le64 *)iv = cpu_to_le64(dmreq->iv_sector); - crypto_cipher_encrypt_one(essiv_tfm, iv, iv); return 0; } @@ -854,10 +704,6 @@ static const struct crypt_iv_operations crypt_iv_plain64be_ops = { }; static const struct crypt_iv_operations crypt_iv_essiv_ops = { - .ctr = crypt_iv_essiv_ctr, - .dtr = crypt_iv_essiv_dtr, - .init = crypt_iv_essiv_init, - .wipe = crypt_iv_essiv_wipe, .generator = crypt_iv_essiv_gen }; @@ -2397,7 +2243,7 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key char **ivmode, char **ivopts) { struct crypt_config *cc = ti->private; - char *tmp, *cipher_api; + char *tmp, *cipher_api, buf[CRYPTO_MAX_ALG_NAME]; int ret = -EINVAL; cc->tfms_count = 1; @@ -2435,9 +2281,19 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key } ret = crypt_ctr_blkdev_cipher(cc, cipher_api); - if (ret < 0) { - ti->error = "Cannot allocate cipher string"; - return -ENOMEM; + if (ret < 0) + goto bad_mem; + + if (*ivmode && !strcmp(*ivmode, "essiv")) { + if (!*ivopts) { + ti->error = "Digest algorithm missing for ESSIV mode"; + return -EINVAL; + } + ret = snprintf(buf, CRYPTO_MAX_ALG_NAME, "essiv(%s,%s,%s)", + cipher_api, cc->cipher, *ivopts); + if (ret < 0 || ret >= CRYPTO_MAX_ALG_NAME) + goto bad_mem; + cipher_api = buf; } cc->key_parts = cc->tfms_count; @@ -2456,6 +2312,9 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key cc->iv_size = crypto_skcipher_ivsize(any_tfm(cc)); return 0; +bad_mem: + ti->error = "Cannot allocate cipher string"; + return -ENOMEM; } static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key, @@ -2515,9 +2374,20 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key if (!cipher_api) goto bad_mem; - ret = snprintf(cipher_api, CRYPTO_MAX_ALG_NAME, - "%s(%s)", chainmode, cipher); - if (ret < 0) { + if (*ivmode && !strcmp(*ivmode, "essiv")) { + if (!*ivopts) { + ti->error = "Digest algorithm missing for ESSIV mode"; + kfree(cipher_api); + return -EINVAL; + } + ret = snprintf(cipher_api, CRYPTO_MAX_ALG_NAME, + "essiv(%s(%s),%s,%s)", chainmode, cipher, + cipher, *ivopts); + } else { + ret = snprintf(cipher_api, CRYPTO_MAX_ALG_NAME, + "%s(%s)", chainmode, cipher); + } + if (ret < 0 || ret >= CRYPTO_MAX_ALG_NAME) { kfree(cipher_api); goto bad_mem; } From patchwork Wed Jun 26 20:40:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167858 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413688ilk; Wed, 26 Jun 2019 13:41:02 -0700 (PDT) X-Google-Smtp-Source: APXvYqztiJ/i7BeMmEJYtVVHAdjvKl824cH5EJL0m8v3zIcC8mTzifsEsktACgWO0wt+JJXO4Xhu X-Received: by 2002:a65:63d1:: with SMTP id n17mr4911852pgv.382.1561581661841; Wed, 26 Jun 2019 13:41:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581661; cv=none; d=google.com; s=arc-20160816; b=mVcL45poqBaeapxIwv0Uz4cEdzaR9BCe9lU27y+8t6kN3IFcAFHDcODDw/kLwsI4Q5 1wOrc9FXKYs/dJOzCHp2x4vqGpgLTcIhscluDvQ+Rh8c2OJ2JmERJteXeMiCZRVf7Mqd /8Uwii58TEsq7Yi0v3gcmwgckVTch0/UlZ4TmHFoCXyzyRubwQjifQrJNFSa+ShWW4vF SwsuwM6C2kyOVIm8dikSZrNlt22Pu67E2jkpxwpbhXmlF9K0yyPXFSpQiolItQPSWgGq cyIvCzJHE7XWqJHs8kI+wURdOS/Mer9/Jd25oIiEDNTcgBqY0Fuztdd6r2z+65bHBiHA qaZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=MLaZzAvT/8eVVuD4nlFoDPN31bViUGFEyHqNk0s5eAg=; b=nwICDqrFQxEGGWbhArGlXyJ0mJQ6HjXNZhzb+/WH8e7K2T1o1g39KHPeswVYRzbIRt xFFCr/JLtpFSLbaQMZCk1/1rmgrLJFR9/l3gTHQ8JNq/OY0Yq+N2orCqXC1KqtfD0BGN bQjMSVlMaSAdvpeqjKr8AUhNzZJSFfBLOggrVoFK7S2BuVMKQUDnpaQI8RSDDcWK2Hlu GbzXVshGmjV1zNJDmTBnBBfoyfLdeQiPBymVkEupKKwvUYJxJOZU7nuEiibVm/cRNPtU EFloLAowgLqJVZqHFu0Zx5Uu/yu7NR30goliwIrGeWPGryjb4uKS/dqrNY9dboPAZlkC NVsA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=vAcgW426; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.41.01; Wed, 26 Jun 2019 13:41:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=vAcgW426; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726437AbfFZUlB (ORCPT + 3 others); Wed, 26 Jun 2019 16:41:01 -0400 Received: from mail-wr1-f66.google.com ([209.85.221.66]:41001 "EHLO mail-wr1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726293AbfFZUlA (ORCPT ); Wed, 26 Jun 2019 16:41:00 -0400 Received: by mail-wr1-f66.google.com with SMTP id c2so4258568wrm.8 for ; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=MLaZzAvT/8eVVuD4nlFoDPN31bViUGFEyHqNk0s5eAg=; b=vAcgW426+s/waAy6AV4OSUkKsoJrGz8ekwedzX+MSXivHsN3v3fs+EVYhZoxMvHwOG Mzk/B7n5GgYBAfdbHqlmQZf+z+znzczbvlyadvOIr6u+/zt9td8BGbZFFSA1H9ieuN09 DOwUZmWa42JzJkYnzKC1JelqH+1kmTFZ5v2j8Ysxz8wfKQdrysi4VqmFiMT983O6SEa/ EM/tOP8nF4CRX+JEQgU2Sh0BTp1YwId9uddUdv63gQejmBYciFFEJyqPEkuN7moyytJe twfmSptS4Rk0r1UGel10ro09fHrWbdnx1VZneEAReb72pk+7g08yb1cZNOuJ3rAPf60L TvVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=MLaZzAvT/8eVVuD4nlFoDPN31bViUGFEyHqNk0s5eAg=; b=WU+GYPUY+zHQXWnys669d23bkm0Rv6k7RIG0f65CZT70EQvkfyLhRqD1ExAIfY87Wm N3uWj6zKIqZ2eeTK5fQd5MDEn46sKi+8/VPoQ8FyyqE1oaScaZ6n1wAQsME+v6Ho6wIq pFdOIfJAwg5T7z+DMWUwOymgKgUQdDTMnrOAyeEnRf9I5VXZeYWP91i00BOATflvsgEO JG+e3EGJSnw0AzbYmQ+jL5araaV38qlChLi5J26z0RLj4/aGo5q2BUV4/O+bDIuuTxZi oN1Nn8fh5tMFk0Whk3CIhwW6GIpX8gLgSOjHz03X4rqnXsMjzIJKT+uT5UvMvQLfptk4 VVkg== X-Gm-Message-State: APjAAAWT8K5QpV4BqWiIy2GAdoCAr9jbOeeXO0YRJ4CTq2I6zUZ3lkt3 rkhaPj1Y7SBfi1vjjOcwodsUv16qPOo7bg== X-Received: by 2002:a5d:6ccc:: with SMTP id c12mr4983762wrc.57.1561581657743; Wed, 26 Jun 2019 13:40:57 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:57 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 5/7] crypto: essiv - add test vector for essiv(cbc(aes), aes, sha256) Date: Wed, 26 Jun 2019 22:40:45 +0200 Message-Id: <20190626204047.32131-6-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Add a test vector for the ESSIV mode that is the most widely used, i.e., using cbc(aes) and sha256. Signed-off-by: Ard Biesheuvel --- crypto/tcrypt.c | 9 + crypto/testmgr.c | 6 + crypto/testmgr.h | 213 ++++++++++++++++++++ 3 files changed, 228 insertions(+) -- 2.20.1 diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c index ad78ab5b93cb..f990a209197e 100644 --- a/crypto/tcrypt.c +++ b/crypto/tcrypt.c @@ -2327,6 +2327,15 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb) 0, speed_template_32); break; + case 220: + test_acipher_speed("essiv(cbc(aes),aes,sha256)", + ENCRYPT, sec, NULL, 0, + speed_template_16_24_32); + test_acipher_speed("essiv(cbc(aes),aes,sha256)", + DECRYPT, sec, NULL, 0, + speed_template_16_24_32); + break; + case 300: if (alg) { test_hash_speed(alg, sec, generic_hash_speed_template); diff --git a/crypto/testmgr.c b/crypto/testmgr.c index 658a7eeebab2..23703f3e9cbb 100644 --- a/crypto/testmgr.c +++ b/crypto/testmgr.c @@ -4253,6 +4253,12 @@ static const struct alg_test_desc alg_test_descs[] = { .suite = { .akcipher = __VECS(ecrdsa_tv_template) } + }, { + .alg = "essiv(cbc(aes),aes,sha256)", + .test = alg_test_skcipher, + .suite = { + .cipher = __VECS(essiv_aes_cbc_tv_template) + } }, { .alg = "gcm(aes)", .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)", diff --git a/crypto/testmgr.h b/crypto/testmgr.h index 1fdae5993bc3..cca3561b0135 100644 --- a/crypto/testmgr.h +++ b/crypto/testmgr.h @@ -33575,4 +33575,217 @@ static const struct comp_testvec zstd_decomp_tv_template[] = { "functions.", }, }; + +/* based on aes_cbc_tv_template */ +static const struct cipher_testvec essiv_aes_cbc_tv_template[] = { + { + .key = "\x06\xa9\x21\x40\x36\xb8\xa1\x5b" + "\x51\x2e\x03\xd5\x34\x12\x00\x06", + .klen = 16, + .iv = "\x3d\xaf\xba\x42\x9d\x9e\xb4\x30" + "\x00\x00\x00\x00\x00\x00\x00\x00", + .ptext = "Single block msg", + .ctext = "\xfa\x59\xe7\x5f\x41\x56\x65\xc3" + "\x36\xca\x6b\x72\x10\x9f\x8c\xd4", + .len = 16, + }, { + .key = "\xc2\x86\x69\x6d\x88\x7c\x9a\xa0" + "\x61\x1b\xbb\x3e\x20\x25\xa4\x5a", + .klen = 16, + .iv = "\x56\x2e\x17\x99\x6d\x09\x3d\x28" + "\x00\x00\x00\x00\x00\x00\x00\x00", + .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07" + "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" + "\x10\x11\x12\x13\x14\x15\x16\x17" + "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f", + .ctext = "\xc8\x59\x9a\xfe\x79\xe6\x7b\x20" + "\x06\x7d\x55\x0a\x5e\xc7\xb5\xa7" + "\x0b\x9c\x80\xd2\x15\xa1\xb8\x6d" + "\xc6\xab\x7b\x65\xd9\xfd\x88\xeb", + .len = 32, + }, { + .key = "\x8e\x73\xb0\xf7\xda\x0e\x64\x52" + "\xc8\x10\xf3\x2b\x80\x90\x79\xe5" + "\x62\xf8\xea\xd2\x52\x2c\x6b\x7b", + .klen = 24, + .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" + "\x00\x00\x00\x00\x00\x00\x00\x00", + .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96" + "\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c" + "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11" + "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17" + "\xad\x2b\x41\x7b\xe6\x6c\x37\x10", + .ctext = "\x96\x6d\xa9\x7a\x42\xe6\x01\xc7" + "\x17\xfc\xa7\x41\xd3\x38\x0b\xe5" + "\x51\x48\xf7\x7e\x5e\x26\xa9\xfe" + "\x45\x72\x1c\xd9\xde\xab\xf3\x4d" + "\x39\x47\xc5\x4f\x97\x3a\x55\x63" + "\x80\x29\x64\x4c\x33\xe8\x21\x8a" + "\x6a\xef\x6b\x6a\x8f\x43\xc0\xcb" + "\xf0\xf3\x6e\x74\x54\x44\x92\x44", + .len = 64, + }, { + .key = "\x60\x3d\xeb\x10\x15\xca\x71\xbe" + "\x2b\x73\xae\xf0\x85\x7d\x77\x81" + "\x1f\x35\x2c\x07\x3b\x61\x08\xd7" + "\x2d\x98\x10\xa3\x09\x14\xdf\xf4", + .klen = 32, + .iv = "\x00\x01\x02\x03\x04\x05\x06\x07" + "\x00\x00\x00\x00\x00\x00\x00\x00", + .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96" + "\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c" + "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11" + "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17" + "\xad\x2b\x41\x7b\xe6\x6c\x37\x10", + .ctext = "\x24\x52\xf1\x48\x74\xd0\xa7\x93" + "\x75\x9b\x63\x46\xc0\x1c\x1e\x17" + "\x4d\xdc\x5b\x3a\x27\x93\x2a\x63" + "\xf7\xf1\xc7\xb3\x54\x56\x5b\x50" + "\xa3\x31\xa5\x8b\xd6\xfd\xb6\x3c" + "\x8b\xf6\xf2\x45\x05\x0c\xc8\xbb" + "\x32\x0b\x26\x1c\xe9\x8b\x02\xc0" + "\xb2\x6f\x37\xa7\x5b\xa8\xa9\x42", + .len = 64, + }, { + .key = "\xC9\x83\xA6\xC9\xEC\x0F\x32\x55" + "\x0F\x32\x55\x78\x9B\xBE\x78\x9B" + "\xBE\xE1\x04\x27\xE1\x04\x27\x4A" + "\x6D\x90\x4A\x6D\x90\xB3\xD6\xF9", + .klen = 32, + .iv = "\xE7\x82\x1D\xB8\x53\x11\xAC\x47" + "\x00\x00\x00\x00\x00\x00\x00\x00", + .ptext = "\x50\xB9\x22\xAE\x17\x80\x0C\x75" + "\xDE\x47\xD3\x3C\xA5\x0E\x9A\x03" + "\x6C\xF8\x61\xCA\x33\xBF\x28\x91" + "\x1D\x86\xEF\x58\xE4\x4D\xB6\x1F" + "\xAB\x14\x7D\x09\x72\xDB\x44\xD0" + "\x39\xA2\x0B\x97\x00\x69\xF5\x5E" + "\xC7\x30\xBC\x25\x8E\x1A\x83\xEC" + "\x55\xE1\x4A\xB3\x1C\xA8\x11\x7A" + "\x06\x6F\xD8\x41\xCD\x36\x9F\x08" + "\x94\xFD\x66\xF2\x5B\xC4\x2D\xB9" + "\x22\x8B\x17\x80\xE9\x52\xDE\x47" + "\xB0\x19\xA5\x0E\x77\x03\x6C\xD5" + "\x3E\xCA\x33\x9C\x05\x91\xFA\x63" + "\xEF\x58\xC1\x2A\xB6\x1F\x88\x14" + "\x7D\xE6\x4F\xDB\x44\xAD\x16\xA2" + "\x0B\x74\x00\x69\xD2\x3B\xC7\x30" + "\x99\x02\x8E\xF7\x60\xEC\x55\xBE" + "\x27\xB3\x1C\x85\x11\x7A\xE3\x4C" + "\xD8\x41\xAA\x13\x9F\x08\x71\xFD" + "\x66\xCF\x38\xC4\x2D\x96\x22\x8B" + "\xF4\x5D\xE9\x52\xBB\x24\xB0\x19" + "\x82\x0E\x77\xE0\x49\xD5\x3E\xA7" + "\x10\x9C\x05\x6E\xFA\x63\xCC\x35" + "\xC1\x2A\x93\x1F\x88\xF1\x5A\xE6" + "\x4F\xB8\x21\xAD\x16\x7F\x0B\x74" + "\xDD\x46\xD2\x3B\xA4\x0D\x99\x02" + "\x6B\xF7\x60\xC9\x32\xBE\x27\x90" + "\x1C\x85\xEE\x57\xE3\x4C\xB5\x1E" + "\xAA\x13\x7C\x08\x71\xDA\x43\xCF" + "\x38\xA1\x0A\x96\xFF\x68\xF4\x5D" + "\xC6\x2F\xBB\x24\x8D\x19\x82\xEB" + "\x54\xE0\x49\xB2\x1B\xA7\x10\x79" + "\x05\x6E\xD7\x40\xCC\x35\x9E\x07" + "\x93\xFC\x65\xF1\x5A\xC3\x2C\xB8" + "\x21\x8A\x16\x7F\xE8\x51\xDD\x46" + "\xAF\x18\xA4\x0D\x76\x02\x6B\xD4" + "\x3D\xC9\x32\x9B\x04\x90\xF9\x62" + "\xEE\x57\xC0\x29\xB5\x1E\x87\x13" + "\x7C\xE5\x4E\xDA\x43\xAC\x15\xA1" + "\x0A\x73\xFF\x68\xD1\x3A\xC6\x2F" + "\x98\x01\x8D\xF6\x5F\xEB\x54\xBD" + "\x26\xB2\x1B\x84\x10\x79\xE2\x4B" + "\xD7\x40\xA9\x12\x9E\x07\x70\xFC" + "\x65\xCE\x37\xC3\x2C\x95\x21\x8A" + "\xF3\x5C\xE8\x51\xBA\x23\xAF\x18" + "\x81\x0D\x76\xDF\x48\xD4\x3D\xA6" + "\x0F\x9B\x04\x6D\xF9\x62\xCB\x34" + "\xC0\x29\x92\x1E\x87\xF0\x59\xE5" + "\x4E\xB7\x20\xAC\x15\x7E\x0A\x73" + "\xDC\x45\xD1\x3A\xA3\x0C\x98\x01" + "\x6A\xF6\x5F\xC8\x31\xBD\x26\x8F" + "\x1B\x84\xED\x56\xE2\x4B\xB4\x1D" + "\xA9\x12\x7B\x07\x70\xD9\x42\xCE" + "\x37\xA0\x09\x95\xFE\x67\xF3\x5C" + "\xC5\x2E\xBA\x23\x8C\x18\x81\xEA" + "\x53\xDF\x48\xB1\x1A\xA6\x0F\x78" + "\x04\x6D\xD6\x3F\xCB\x34\x9D\x06" + "\x92\xFB\x64\xF0\x59\xC2\x2B\xB7" + "\x20\x89\x15\x7E\xE7\x50\xDC\x45" + "\xAE\x17\xA3\x0C\x75\x01\x6A\xD3" + "\x3C\xC8\x31\x9A\x03\x8F\xF8\x61" + "\xED\x56\xBF\x28\xB4\x1D\x86\x12", + .ctext = "\x97\x7f\x69\x0f\x0f\x34\xa6\x33" + "\x66\x49\x7e\xd0\x4d\x1b\xc9\x64" + "\xf9\x61\x95\x98\x11\x00\x88\xf8" + "\x2e\x88\x01\x0f\x2b\xe1\xae\x3e" + "\xfe\xd6\x47\x30\x11\x68\x7d\x99" + "\xad\x69\x6a\xe8\x41\x5f\x1e\x16" + "\x00\x3a\x47\xdf\x8e\x7d\x23\x1c" + "\x19\x5b\x32\x76\x60\x03\x05\xc1" + "\xa0\xff\xcf\xcc\x74\x39\x46\x63" + "\xfe\x5f\xa6\x35\xa7\xb4\xc1\xf9" + "\x4b\x5e\x38\xcc\x8c\xc1\xa2\xcf" + "\x9a\xc3\xae\x55\x42\x46\x93\xd9" + "\xbd\x22\xd3\x8a\x19\x96\xc3\xb3" + "\x7d\x03\x18\xf9\x45\x09\x9c\xc8" + "\x90\xf3\x22\xb3\x25\x83\x9a\x75" + "\xbb\x04\x48\x97\x3a\x63\x08\x04" + "\xa0\x69\xf6\x52\xd4\x89\x93\x69" + "\xb4\x33\xa2\x16\x58\xec\x4b\x26" + "\x76\x54\x10\x0b\x6e\x53\x1e\xbc" + "\x16\x18\x42\xb1\xb1\xd3\x4b\xda" + "\x06\x9f\x8b\x77\xf7\xab\xd6\xed" + "\xa3\x1d\x90\xda\x49\x38\x20\xb8" + "\x6c\xee\xae\x3e\xae\x6c\x03\xb8" + "\x0b\xed\xc8\xaa\x0e\xc5\x1f\x90" + "\x60\xe2\xec\x1b\x76\xd0\xcf\xda" + "\x29\x1b\xb8\x5a\xbc\xf4\xba\x13" + "\x91\xa6\xcb\x83\x3f\xeb\xe9\x7b" + "\x03\xba\x40\x9e\xe6\x7a\xb2\x4a" + "\x73\x49\xfc\xed\xfb\x55\xa4\x24" + "\xc7\xa4\xd7\x4b\xf5\xf7\x16\x62" + "\x80\xd3\x19\x31\x52\x25\xa8\x69" + "\xda\x9a\x87\xf5\xf2\xee\x5d\x61" + "\xc1\x12\x72\x3e\x52\x26\x45\x3a" + "\xd8\x9d\x57\xfa\x14\xe2\x9b\x2f" + "\xd4\xaa\x5e\x31\xf4\x84\x89\xa4" + "\xe3\x0e\xb0\x58\x41\x75\x6a\xcb" + "\x30\x01\x98\x90\x15\x80\xf5\x27" + "\x92\x13\x81\xf0\x1c\x1e\xfc\xb1" + "\x33\xf7\x63\xb0\x67\xec\x2e\x5c" + "\x85\xe3\x5b\xd0\x43\x8a\xb8\x5f" + "\x44\x9f\xec\x19\xc9\x8f\xde\xdf" + "\x79\xef\xf8\xee\x14\x87\xb3\x34" + "\x76\x00\x3a\x9b\xc7\xed\xb1\x3d" + "\xef\x07\xb0\xe4\xfd\x68\x9e\xeb" + "\xc2\xb4\x1a\x85\x9a\x7d\x11\x88" + "\xf8\xab\x43\x55\x2b\x8a\x4f\x60" + "\x85\x9a\xf4\xba\xae\x48\x81\xeb" + "\x93\x07\x97\x9e\xde\x2a\xfc\x4e" + "\x31\xde\xaa\x44\xf7\x2a\xc3\xee" + "\x60\xa2\x98\x2c\x0a\x88\x50\xc5" + "\x6d\x89\xd3\xe4\xb6\xa7\xf4\xb0" + "\xcf\x0e\x89\xe3\x5e\x8f\x82\xf4" + "\x9d\xd1\xa9\x51\x50\x8a\xd2\x18" + "\x07\xb2\xaa\x3b\x7f\x58\x9b\xf4" + "\xb7\x24\x39\xd3\x66\x2f\x1e\xc0" + "\x11\xa3\x56\x56\x2a\x10\x73\xbc" + "\xe1\x23\xbf\xa9\x37\x07\x9c\xc3" + "\xb2\xc9\xa8\x1c\x5b\x5c\x58\xa4" + "\x77\x02\x26\xad\xc3\x40\x11\x53" + "\x93\x68\x72\xde\x05\x8b\x10\xbc" + "\xa6\xd4\x1b\xd9\x27\xd8\x16\x12" + "\x61\x2b\x31\x2a\x44\x87\x96\x58", + .len = 496, + }, +}; + #endif /* _CRYPTO_TESTMGR_H */ From patchwork Wed Jun 26 20:40:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167859 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413707ilk; Wed, 26 Jun 2019 13:41:03 -0700 (PDT) X-Google-Smtp-Source: APXvYqyX0IoYT5Ovpghrf65+mtqI9EDU75yhMEtZKlFu8XG9frt+dmWPYf+eIOqs71QG3YiTR3Vo X-Received: by 2002:a17:902:7247:: with SMTP id c7mr52441pll.202.1561581663115; Wed, 26 Jun 2019 13:41:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581663; cv=none; d=google.com; s=arc-20160816; b=Z4LJSgMgPbgKXSNaUOnOW8lyOM5EarDvIETj7xQA7uCYssKXdFqvKt7JEEwtwPTUK7 xMj9FzMPidWK7XJ1GN2W/2D8QWb0UL7sM+C0hqTCHPw9woNBQ23a2etsEiTjevrjJjE7 jrmMril+41jJPiGWcaXSCUZq8ELZPsOv6nUkQ4fX/fTER/jzJX+/7eOsZmk0zIDoQjxS OIUwd5m80pAGgKx4KT9qE6T3mtp4p0+XP0O5OJ8vwv7XQUgHpbez/1MfrrWIsu8Wp5Ng gbIO1xXrJR0zrRpDMWQJDVS6GMZTuATnLu83IC9LAex+mOA2G7YvwpRD7Lr+Jrf02Rx0 /fHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=20kar+4njHVQnk3Y1QM9bnnvyr2Y5wWcvH/MhU3+4M0=; b=TBBKrNBeh6y9R/4x7GXGqMZFgWBjv2swx3ZB1ZOLh3QhXgU9Ch1aJBVZDwOHAWY1va J+Zdnh/rwXAheSQAyPS5u5qR6OtxsbrpcCLOCNjGLF4OOP+G6PNCXoNbPYsDreumKDGj HPO+4ySMxZ3r/+UWclmPThpPuNu37nsLpD/PGW8MX/Z7q7wrLg5DKAei/pLg0n6Munxb NTEhh/TFG9g+v4zK82e4JUx2i2MBM+LFVqqXw2m/rGIph306Vk1Z1k5nBecDztfJXJJK RjVmilQrcKkcoJaSC35u/Cb7Vgt9fOHV0Oy9wevVN3+URsk4IYMU9FXjzckmYjIL2Dhf gbwQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="gcjRn8/B"; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.41.02; Wed, 26 Jun 2019 13:41:03 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="gcjRn8/B"; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726463AbfFZUlC (ORCPT + 3 others); Wed, 26 Jun 2019 16:41:02 -0400 Received: from mail-wr1-f65.google.com ([209.85.221.65]:44333 "EHLO mail-wr1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726447AbfFZUlB (ORCPT ); Wed, 26 Jun 2019 16:41:01 -0400 Received: by mail-wr1-f65.google.com with SMTP id r16so4242334wrl.11 for ; Wed, 26 Jun 2019 13:40:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=20kar+4njHVQnk3Y1QM9bnnvyr2Y5wWcvH/MhU3+4M0=; b=gcjRn8/B7+5aQ7YY8vCzFyDndiyD+sJvN1BG7BVcIVeM2yB+q7MxyySMZJUh0F5jRQ deTbyo8sMVcb2nqJjeyCnYod1uPPzhmkp8DgjzrkbTfCZbVi43Z/YFd9oogs5cJt2d/O GIESa5XwQ1NhyUlmB+lyxFL5e610pWTr3ArdpDWG+pDkC07X4KswbDBiZGBFf0J1ztRu Jd9l17ozkQlkovDv5vg6mEFWhzvyu9R26RjhxTJpQhyPDzBKAvED5nI1E2vLcGBqShK0 VLauin1Tg5lSDWS6Jo4P2gwc4qCCd4GdJUnhwD5Ts1PfdY0MOH+snKf26MAwFR/u3MMu Mb1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=20kar+4njHVQnk3Y1QM9bnnvyr2Y5wWcvH/MhU3+4M0=; b=LfPsN7Hy/a0SldH3YC4qMoCJxJ4fGPkC1sGsrNGOWgI0hHyG71hXJJDcpRG6OxLw1j qauZokoUOgmwPs16WxV8cZHP0y/J1PQL/5SH1sK6DTZgYQEdWUhZigyAb2Rl5cZpxCIB KIexQTATw7ampsTHZLFdQihSkEcPPAGXzXnXfQDKEZoffMPftBLUNwzBen7QC5LfFSL+ 5ZGKd26PJV18rYrhkrKbNRlJ+4gK7jjFL6A6TcOpADdA1iVOJUQ57pZrPkvzpD5dCco6 42Dp/s9qxWfNutoJJBquktOtbn4/caQw+t+hGap9W9ESB4NGh+fFbp9GeagW+++K7rnb 0QEw== X-Gm-Message-State: APjAAAUf5adKi3ZWX1dMYhzEbL1q2XjDqdULRouVEMoIsaC4g5aLd28P GV9eEUyERqRwyapFzbMF/dMSvTtHymwLSw== X-Received: by 2002:a5d:5702:: with SMTP id a2mr5328790wrv.89.1561581658767; Wed, 26 Jun 2019 13:40:58 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:58 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 6/7] crypto: arm64/aes-cts-cbc - factor out CBC en/decryption of a walk Date: Wed, 26 Jun 2019 22:40:46 +0200 Message-Id: <20190626204047.32131-7-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org The plain CBC driver and the CTS one share some code that iterates over a scatterwalk and invokes the CBC asm code to do the processing. The upcoming ESSIV/CBC mode will clone that pattern for the third time, so let's factor it out first. Signed-off-by: Ard Biesheuvel --- arch/arm64/crypto/aes-glue.c | 82 ++++++++++---------- 1 file changed, 40 insertions(+), 42 deletions(-) -- 2.20.1 diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c index f0ceb545bd1e..11b85ce02d7a 100644 --- a/arch/arm64/crypto/aes-glue.c +++ b/arch/arm64/crypto/aes-glue.c @@ -185,46 +185,64 @@ static int ecb_decrypt(struct skcipher_request *req) return err; } -static int cbc_encrypt(struct skcipher_request *req) +static int cbc_encrypt_walk(struct skcipher_request *req, + struct skcipher_walk *walk) { struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); struct crypto_aes_ctx *ctx = crypto_skcipher_ctx(tfm); - int err, rounds = 6 + ctx->key_length / 4; - struct skcipher_walk walk; + int err = 0, rounds = 6 + ctx->key_length / 4; unsigned int blocks; - err = skcipher_walk_virt(&walk, req, false); - - while ((blocks = (walk.nbytes / AES_BLOCK_SIZE))) { + while ((blocks = (walk->nbytes / AES_BLOCK_SIZE))) { kernel_neon_begin(); - aes_cbc_encrypt(walk.dst.virt.addr, walk.src.virt.addr, - ctx->key_enc, rounds, blocks, walk.iv); + aes_cbc_encrypt(walk->dst.virt.addr, walk->src.virt.addr, + ctx->key_enc, rounds, blocks, walk->iv); kernel_neon_end(); - err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE); + err = skcipher_walk_done(walk, walk->nbytes % AES_BLOCK_SIZE); } return err; } -static int cbc_decrypt(struct skcipher_request *req) +static int cbc_encrypt(struct skcipher_request *req) { - struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); - struct crypto_aes_ctx *ctx = crypto_skcipher_ctx(tfm); - int err, rounds = 6 + ctx->key_length / 4; struct skcipher_walk walk; - unsigned int blocks; + int err; err = skcipher_walk_virt(&walk, req, false); + if (err) + return err; + return cbc_encrypt_walk(req, &walk); +} - while ((blocks = (walk.nbytes / AES_BLOCK_SIZE))) { +static int cbc_decrypt_walk(struct skcipher_request *req, + struct skcipher_walk *walk) +{ + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); + struct crypto_aes_ctx *ctx = crypto_skcipher_ctx(tfm); + int err = 0, rounds = 6 + ctx->key_length / 4; + unsigned int blocks; + + while ((blocks = (walk->nbytes / AES_BLOCK_SIZE))) { kernel_neon_begin(); - aes_cbc_decrypt(walk.dst.virt.addr, walk.src.virt.addr, - ctx->key_dec, rounds, blocks, walk.iv); + aes_cbc_decrypt(walk->dst.virt.addr, walk->src.virt.addr, + ctx->key_dec, rounds, blocks, walk->iv); kernel_neon_end(); - err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE); + err = skcipher_walk_done(walk, walk->nbytes % AES_BLOCK_SIZE); } return err; } +static int cbc_decrypt(struct skcipher_request *req) +{ + struct skcipher_walk walk; + int err; + + err = skcipher_walk_virt(&walk, req, false); + if (err) + return err; + return cbc_decrypt_walk(req, &walk); +} + static int cts_cbc_init_tfm(struct crypto_skcipher *tfm) { crypto_skcipher_set_reqsize(tfm, sizeof(struct cts_cbc_req_ctx)); @@ -250,22 +268,12 @@ static int cts_cbc_encrypt(struct skcipher_request *req) } if (cbc_blocks > 0) { - unsigned int blocks; - skcipher_request_set_crypt(&rctx->subreq, req->src, req->dst, cbc_blocks * AES_BLOCK_SIZE, req->iv); - err = skcipher_walk_virt(&walk, &rctx->subreq, false); - - while ((blocks = (walk.nbytes / AES_BLOCK_SIZE))) { - kernel_neon_begin(); - aes_cbc_encrypt(walk.dst.virt.addr, walk.src.virt.addr, - ctx->key_enc, rounds, blocks, walk.iv); - kernel_neon_end(); - err = skcipher_walk_done(&walk, - walk.nbytes % AES_BLOCK_SIZE); - } + err = skcipher_walk_virt(&walk, &rctx->subreq, false) ?: + cbc_encrypt_walk(&rctx->subreq, &walk); if (err) return err; @@ -315,22 +323,12 @@ static int cts_cbc_decrypt(struct skcipher_request *req) } if (cbc_blocks > 0) { - unsigned int blocks; - skcipher_request_set_crypt(&rctx->subreq, req->src, req->dst, cbc_blocks * AES_BLOCK_SIZE, req->iv); - err = skcipher_walk_virt(&walk, &rctx->subreq, false); - - while ((blocks = (walk.nbytes / AES_BLOCK_SIZE))) { - kernel_neon_begin(); - aes_cbc_decrypt(walk.dst.virt.addr, walk.src.virt.addr, - ctx->key_dec, rounds, blocks, walk.iv); - kernel_neon_end(); - err = skcipher_walk_done(&walk, - walk.nbytes % AES_BLOCK_SIZE); - } + err = skcipher_walk_virt(&walk, &rctx->subreq, false) ?: + cbc_decrypt_walk(&rctx->subreq, &walk); if (err) return err; From patchwork Wed Jun 26 20:40:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 167860 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1413732ilk; Wed, 26 Jun 2019 13:41:04 -0700 (PDT) X-Google-Smtp-Source: APXvYqxic9FDqmPpE7FeqXk9RuVBkPamLrXtpnHWJ991zaO31GJeZSECpNsQgpBpe5bX+bnN4cvb X-Received: by 2002:a17:90a:3ae8:: with SMTP id b95mr1229615pjc.68.1561581664319; Wed, 26 Jun 2019 13:41:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561581664; cv=none; d=google.com; s=arc-20160816; b=JcDl+brjCPAWu0/f6egbBbEs3BvswOCqh9Icd0cZtA08tlzkvjU7IGc0vw7fKu6at4 bb8YTRR7xc7vLy4TJWHTA/iQlVCXCkPJtmiwtUiZaVgXcgQDvVIkHjtAiI5ecw331fdK 56XdG6iPO7GdsxcKCKhF5YXor4k2Db+7aA6grC/IrzEeURKAHB4VZPsti0avwse/kN9T 6iHqUOLdp7fT+urpIhyod/C/KDtxsH6D6zy0/QEZ1X2bUVdsNrySRwSaVJRtn/6pM9kt W2jHALJibIXCoWly1fe6jGAGaup7OHU6DFMDxXw51cmGFeXFleOpYOQtUmMHievsLTAy GoVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=yO2dqQ4f2XXgbvC5iZQKPFNlYr8NCwruImNQuvOoii8=; b=X/ncXjJU+M78+9FwrmUHJrRidgjBrB9MdKMbiA4l+ipaIm1uXVwO5m8EioSfA9g4VN O8ZnJXLVKAGUTcfe4DC0g9ObUDOdey1yZP3pQ3FJG7UuVMCO7H31/5iGac3XPZyS5yMC MIe55HCVaHA2JL+9SdkONQPq5yJeN0Jc2Auik5FHBTQX381Q13XRpEjEBowjgg6b4tBL BU18ElRfgZQeI279IqPdSQndDc9l1pfL46P+QGu4CEBJDL47cgAlj8mHzFhdnkFHv653 9gyWQtdILwphjZMwBXTrQqZJw7T45ZaDsLB6W8+A6RYpxeSLPV02X7AGes8aZi4wtH7h 1iJw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=GScmWhmT; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j14si194913pfe.183.2019.06.26.13.41.04; Wed, 26 Jun 2019 13:41:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=GScmWhmT; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726441AbfFZUlD (ORCPT + 3 others); Wed, 26 Jun 2019 16:41:03 -0400 Received: from mail-wm1-f67.google.com ([209.85.128.67]:52383 "EHLO mail-wm1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726431AbfFZUlD (ORCPT ); Wed, 26 Jun 2019 16:41:03 -0400 Received: by mail-wm1-f67.google.com with SMTP id s3so3467328wms.2 for ; Wed, 26 Jun 2019 13:41:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=yO2dqQ4f2XXgbvC5iZQKPFNlYr8NCwruImNQuvOoii8=; b=GScmWhmTBq066DEGk0o8rO/pffUh6QsZx3suexwCza9UMRMMQKHK9wOk69aw3L7iaR y5yMFGIhhDtSeVlgb6sObmg6sRMGbjXnPo0c3gRaXccely1BwA6ce6+b+RKDgd4BKS5d AzuSrZLF8S1RS6UMHiWzoP63jiU6jY8KBSjZ3D8naV8hotWnzY2/SakXs0Ed1Aybigoa 92EHp/hJo8xKsmVRctMb7AFcagwUzQCYxRPYvdyk9I2IDj/bneUigoH1jMkP9+3ggHMt qheubFqIXsEegGl0R7ZxA7GGC9k6GUP9FXQeSuYym2J2QXQijFj33lrwcyAIFiWPsHuQ lclw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=yO2dqQ4f2XXgbvC5iZQKPFNlYr8NCwruImNQuvOoii8=; b=nzK5zhawJlLkpI9953xGJeCOCRhAsAhT/q/nMZ3cemsXJ6ITXdt6eundR9St8i0/Hk 40JnEDlltabqD+RwUcDEOJHXg2oxE7EuPb+0BJ+iI5+HS2c0y0UQUS4xFnZhHTG/2KfD 7MFaPBPpIB/IcXs6/PPc+U4pwxNJqB+gsdfpIUslEKCkMOK3axEPugfAhhbo2VVPMoth zk/3U3T56IoWYOXFggbwnnr4X8P9LzcRaZD5b9GqzlQq/GliF6zIYF5dGaFWMsQiq3Oe 4xX+Qe12umWZLtCPVwM4MdOkQUOo8hcUqAXGMS3EBBgUfcA6fDlFTHm93MvVfbZwD1kw UslQ== X-Gm-Message-State: APjAAAUGXuvfpfWY0rI9qtws15MqY0IHwgWF73dtCF0Cdp1pmNByrYND +qxWrk6uDWT9CrIUEQZO8Yk995L1NowkOA== X-Received: by 2002:a1c:6a06:: with SMTP id f6mr495077wmc.159.1561581660135; Wed, 26 Jun 2019 13:41:00 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:9c7f:f574:ee94:7dec]) by smtp.gmail.com with ESMTPSA id 32sm35164587wra.35.2019.06.26.13.40.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 13:40:59 -0700 (PDT) From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Herbert Xu , Eric Biggers , dm-devel@redhat.com, linux-fscrypt@vger.kernel.org, Gilad Ben-Yossef , Milan Broz Subject: [PATCH v5 7/7] crypto: arm64/aes - implement accelerated ESSIV/CBC mode Date: Wed, 26 Jun 2019 22:40:47 +0200 Message-Id: <20190626204047.32131-8-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190626204047.32131-1-ard.biesheuvel@linaro.org> References: <20190626204047.32131-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Add an accelerated version of the 'essiv(cbc(aes),aes,sha256' skcipher, which is used by fscrypt, and in some cases, by dm-crypt. This avoids a separate call into the AES cipher for every invocation. Signed-off-by: Ard Biesheuvel --- arch/arm64/crypto/aes-glue.c | 123 ++++++++++++++++++++ arch/arm64/crypto/aes-modes.S | 29 ++++- 2 files changed, 151 insertions(+), 1 deletion(-) -- 2.20.1 diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c index 11b85ce02d7a..7097739e7cd9 100644 --- a/arch/arm64/crypto/aes-glue.c +++ b/arch/arm64/crypto/aes-glue.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -34,6 +35,8 @@ #define aes_cbc_decrypt ce_aes_cbc_decrypt #define aes_cbc_cts_encrypt ce_aes_cbc_cts_encrypt #define aes_cbc_cts_decrypt ce_aes_cbc_cts_decrypt +#define aes_essiv_cbc_encrypt ce_aes_essiv_cbc_encrypt +#define aes_essiv_cbc_decrypt ce_aes_essiv_cbc_decrypt #define aes_ctr_encrypt ce_aes_ctr_encrypt #define aes_xts_encrypt ce_aes_xts_encrypt #define aes_xts_decrypt ce_aes_xts_decrypt @@ -50,6 +53,8 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 Crypto Extensions"); #define aes_cbc_decrypt neon_aes_cbc_decrypt #define aes_cbc_cts_encrypt neon_aes_cbc_cts_encrypt #define aes_cbc_cts_decrypt neon_aes_cbc_cts_decrypt +#define aes_essiv_cbc_encrypt neon_aes_essiv_cbc_encrypt +#define aes_essiv_cbc_decrypt neon_aes_essiv_cbc_decrypt #define aes_ctr_encrypt neon_aes_ctr_encrypt #define aes_xts_encrypt neon_aes_xts_encrypt #define aes_xts_decrypt neon_aes_xts_decrypt @@ -93,6 +98,13 @@ asmlinkage void aes_xts_decrypt(u8 out[], u8 const in[], u32 const rk1[], int rounds, int blocks, u32 const rk2[], u8 iv[], int first); +asmlinkage void aes_essiv_cbc_encrypt(u8 out[], u8 const in[], u32 const rk1[], + int rounds, int blocks, u8 iv[], + u32 const rk2[]); +asmlinkage void aes_essiv_cbc_decrypt(u8 out[], u8 const in[], u32 const rk1[], + int rounds, int blocks, u8 iv[], + u32 const rk2[]); + asmlinkage void aes_mac_update(u8 const in[], u32 const rk[], int rounds, int blocks, u8 dg[], int enc_before, int enc_after); @@ -108,6 +120,12 @@ struct crypto_aes_xts_ctx { struct crypto_aes_ctx __aligned(8) key2; }; +struct crypto_aes_essiv_cbc_ctx { + struct crypto_aes_ctx key1; + struct crypto_aes_ctx __aligned(8) key2; + struct crypto_shash *hash; +}; + struct mac_tfm_ctx { struct crypto_aes_ctx key; u8 __aligned(8) consts[]; @@ -145,6 +163,31 @@ static int xts_set_key(struct crypto_skcipher *tfm, const u8 *in_key, return -EINVAL; } +static int essiv_cbc_set_key(struct crypto_skcipher *tfm, const u8 *in_key, + unsigned int key_len) +{ + struct crypto_aes_essiv_cbc_ctx *ctx = crypto_skcipher_ctx(tfm); + SHASH_DESC_ON_STACK(desc, ctx->hash); + u8 digest[SHA256_DIGEST_SIZE]; + int ret; + + ret = aes_expandkey(&ctx->key1, in_key, key_len); + if (ret) + goto out; + + desc->tfm = ctx->hash; + crypto_shash_digest(desc, in_key, key_len, digest); + + ret = aes_expandkey(&ctx->key2, digest, sizeof(digest)); + if (ret) + goto out; + + return 0; +out: + crypto_skcipher_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); + return -EINVAL; +} + static int ecb_encrypt(struct skcipher_request *req) { struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); @@ -359,6 +402,68 @@ static int cts_cbc_decrypt(struct skcipher_request *req) return skcipher_walk_done(&walk, 0); } +static int essiv_cbc_init_tfm(struct crypto_skcipher *tfm) +{ + struct crypto_aes_essiv_cbc_ctx *ctx = crypto_skcipher_ctx(tfm); + + ctx->hash = crypto_alloc_shash("sha256", 0, 0); + if (IS_ERR(ctx->hash)) + return PTR_ERR(ctx->hash); + + return 0; +} + +static void essiv_cbc_exit_tfm(struct crypto_skcipher *tfm) +{ + struct crypto_aes_essiv_cbc_ctx *ctx = crypto_skcipher_ctx(tfm); + + crypto_free_shash(ctx->hash); +} + +static int essiv_cbc_encrypt(struct skcipher_request *req) +{ + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); + struct crypto_aes_essiv_cbc_ctx *ctx = crypto_skcipher_ctx(tfm); + int err, rounds = 6 + ctx->key1.key_length / 4; + struct skcipher_walk walk; + unsigned int blocks; + + err = skcipher_walk_virt(&walk, req, false); + + blocks = walk.nbytes / AES_BLOCK_SIZE; + if (blocks) { + kernel_neon_begin(); + aes_essiv_cbc_encrypt(walk.dst.virt.addr, walk.src.virt.addr, + ctx->key1.key_enc, rounds, blocks, + req->iv, ctx->key2.key_enc); + kernel_neon_end(); + err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE); + } + return err ?: cbc_encrypt_walk(req, &walk); +} + +static int essiv_cbc_decrypt(struct skcipher_request *req) +{ + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); + struct crypto_aes_essiv_cbc_ctx *ctx = crypto_skcipher_ctx(tfm); + int err, rounds = 6 + ctx->key1.key_length / 4; + struct skcipher_walk walk; + unsigned int blocks; + + err = skcipher_walk_virt(&walk, req, false); + + blocks = walk.nbytes / AES_BLOCK_SIZE; + if (blocks) { + kernel_neon_begin(); + aes_essiv_cbc_decrypt(walk.dst.virt.addr, walk.src.virt.addr, + ctx->key1.key_dec, rounds, blocks, + req->iv, ctx->key2.key_enc); + kernel_neon_end(); + err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE); + } + return err ?: cbc_decrypt_walk(req, &walk); +} + static int ctr_encrypt(struct skcipher_request *req) { struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); @@ -502,6 +607,24 @@ static struct skcipher_alg aes_algs[] = { { .encrypt = cts_cbc_encrypt, .decrypt = cts_cbc_decrypt, .init = cts_cbc_init_tfm, +}, { + .base = { + .cra_name = "__essiv(cbc(aes),aes,sha256)", + .cra_driver_name = "__essiv-cbc-aes-sha256-" MODE, + .cra_priority = PRIO + 1, + .cra_flags = CRYPTO_ALG_INTERNAL, + .cra_blocksize = AES_BLOCK_SIZE, + .cra_ctxsize = sizeof(struct crypto_aes_essiv_cbc_ctx), + .cra_module = THIS_MODULE, + }, + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, + .ivsize = AES_BLOCK_SIZE, + .setkey = essiv_cbc_set_key, + .encrypt = essiv_cbc_encrypt, + .decrypt = essiv_cbc_decrypt, + .init = essiv_cbc_init_tfm, + .exit = essiv_cbc_exit_tfm, }, { .base = { .cra_name = "__ctr(aes)", diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S index 4c7ce231963c..2ef3d7244ea8 100644 --- a/arch/arm64/crypto/aes-modes.S +++ b/arch/arm64/crypto/aes-modes.S @@ -91,10 +91,25 @@ AES_ENDPROC(aes_ecb_decrypt) * int blocks, u8 iv[]) * aes_cbc_decrypt(u8 out[], u8 const in[], u8 const rk[], int rounds, * int blocks, u8 iv[]) + * aes_essiv_cbc_encrypt(u8 out[], u8 const in[], u32 const rk1[], + * int rounds, int blocks, u8 iv[], + * u32 const rk2[]); + * aes_essiv_cbc_decrypt(u8 out[], u8 const in[], u32 const rk1[], + * int rounds, int blocks, u8 iv[], + * u32 const rk2[]); */ +AES_ENTRY(aes_essiv_cbc_encrypt) + ld1 {v4.16b}, [x5] /* get iv */ + + mov w8, #14 /* AES-256: 14 rounds */ + enc_prepare w8, x6, x7 + encrypt_block v4, w8, x6, x7, w9 + b .Lessivcbcencstart + AES_ENTRY(aes_cbc_encrypt) ld1 {v4.16b}, [x5] /* get iv */ +.Lessivcbcencstart: enc_prepare w3, x2, x6 .Lcbcencloop4x: @@ -126,13 +141,25 @@ AES_ENTRY(aes_cbc_encrypt) st1 {v4.16b}, [x5] /* return iv */ ret AES_ENDPROC(aes_cbc_encrypt) +AES_ENDPROC(aes_essiv_cbc_encrypt) +AES_ENTRY(aes_essiv_cbc_decrypt) + stp x29, x30, [sp, #-16]! + mov x29, sp + + ld1 {v7.16b}, [x5] /* get iv */ + + mov w8, #14 /* AES-256: 14 rounds */ + enc_prepare w8, x6, x7 + encrypt_block v7, w8, x6, x7, w9 + b .Lessivcbcdecstart AES_ENTRY(aes_cbc_decrypt) stp x29, x30, [sp, #-16]! mov x29, sp ld1 {v7.16b}, [x5] /* get iv */ +.Lessivcbcdecstart: dec_prepare w3, x2, x6 .LcbcdecloopNx: @@ -168,6 +195,7 @@ AES_ENTRY(aes_cbc_decrypt) ldp x29, x30, [sp], #16 ret AES_ENDPROC(aes_cbc_decrypt) +AES_ENDPROC(aes_essiv_cbc_decrypt) /* @@ -247,7 +275,6 @@ AES_ENDPROC(aes_cbc_cts_decrypt) .byte 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff .previous - /* * aes_ctr_encrypt(u8 out[], u8 const in[], u8 const rk[], int rounds, * int blocks, u8 ctr[])