MFC r344140,r344141,r344142,r344143,r344388,r344547r344140:Add CBC-MAC authentication.r344141:Add AES-CCM encryption, and plumb into OCF.r344142:Pasting in a source control line missed the l
MFC r344140,r344141,r344142,r344143,r344388,r344547r344140:Add CBC-MAC authentication.r344141:Add AES-CCM encryption, and plumb into OCF.r344142:Pasting in a source control line missed the last quote. Fixed.r344143:Fix another issue from r344141, having to do with size of a shift amount.This did not show up in my testing.r344388:It turns out that setting the IV length is necessary with CCM in OpenSSL.This adds that back.r344547:Fix another bug introduced during the review process of r344140:the tag wasn't being computed properly due to chaning a >= comparisonto an == comparison.
show more ...
Add xform-conforming auth_hash wrapper for Poly-1305The wrapper is a thin shim around libsodium's Poly-1305 implementation. Fornow, we just use the C algorithm and do not attempt to build theSSE
Add xform-conforming auth_hash wrapper for Poly-1305The wrapper is a thin shim around libsodium's Poly-1305 implementation. Fornow, we just use the C algorithm and do not attempt to build theSSE-optimized variant for x86 processors.The algorithm support has not yet been plumbed through cryptodev, or addedto cryptosoft.
Silence non-actionable warnings in vendor codeWe can't modify vendor code so there's no signal in warnings from it.Similarly -Waddress-of-packed-member is not useful on networking codeas access t
Silence non-actionable warnings in vendor codeWe can't modify vendor code so there's no signal in warnings from it.Similarly -Waddress-of-packed-member is not useful on networking codeas access to packed structures is fundamental to its operation.
blake2: Disable warnings (not just error) for code we will not modifyLeave libb2 pristine and silence the warnings for mjg.
opencrypto: Integrate Chacha20 algorithm into OCFMostly this is a thin shim around existing code to integrate with enc_xformand cryptosoft (+ cryptodev).Expand the cryptodev buffer used to match
opencrypto: Integrate Chacha20 algorithm into OCFMostly this is a thin shim around existing code to integrate with enc_xformand cryptosoft (+ cryptodev).Expand the cryptodev buffer used to match that of Chacha20's native blocksize as a performance enhancement for chacha20_xform_crypt_multi.
Import Blake2 algorithms (blake2b, blake2s) from libb2The upstream repository is on github BLAKE2/libb2. Files landed insys/contrib/libb2 are the unmodified upstream files, except for onediffere
Import Blake2 algorithms (blake2b, blake2s) from libb2The upstream repository is on github BLAKE2/libb2. Files landed insys/contrib/libb2 are the unmodified upstream files, except for onedifference: secure_zero_memory's contents have been replaced withexplicit_bzero() only because the previous implementation broke powerpclink. Preferential use of explicit_bzero() is in progress upstream, soit is anticipated we will be able to drop this diff in the future.sys/crypto/blake2 contains the source files needed to port libb2 to ourbuild system, a wrapped (limited) variant of the algorithm to match the APIof our auth_transform softcrypto abstraction, incorporation into the OpenCrypto Framework (OCF) cryptosoft(4) driver, as well as an x86 SSE/AVXaccelerated OCF driver, blake2(4).Optimized variants of blake2 are compiled for a number of x86 machines(anything from SSE2 to AVX + XOP). On those machines, FPU context will needto be explicitly saved before using blake2(4)-provided algorithms directly.Use via cryptodev / OCF saves FPU state automatically, and use via theauth_transform softcrypto abstraction does not use FPU.The intent of the OCF driver is mostly to enable testing in userspace via/dev/crypto. ATF tests are added with published KAT test vectors tovalidate correctness.Reviewed by: jhb, markjObtained from: github BLAKE2/libb2Differential Revision: https://reviews.freebsd.org/D14662
Increase loop unrolling for skein hashesThis patch was inspired by an opposite change made to shrink the codefor the boot loader.On my i7-4770, it increases the skein1024 speed from 470 to 550 M
Increase loop unrolling for skein hashesThis patch was inspired by an opposite change made to shrink the codefor the boot loader.On my i7-4770, it increases the skein1024 speed from 470 to 550 MB/sReviewed by: sbrunoMFC after: 1 monthSponsored by: ScaleEngine Inc.Differential Revision: https://reviews.freebsd.org/D7824
sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon
Import the skein hashing algorithm, based on the threefish block cipherConnect it to userland (libmd, libcrypt, sbin/md5) and kernel (crypto.ko)Support for skein as a ZFS checksum algorithm was i
Import the skein hashing algorithm, based on the threefish block cipherConnect it to userland (libmd, libcrypt, sbin/md5) and kernel (crypto.ko)Support for skein as a ZFS checksum algorithm was introduced in r289422but is disconnected because FreeBSD lacked a Skein implementation.A further commit will enable it in ZFS.Reviewed by: cemSponsored by: ScaleEngine Inc.Differential Revision: https://reviews.freebsd.org/D6166
Replace sys/crypto/sha2/sha2.c with lib/libmd/sha512c.ccperciva's libmd implementation is 5-30% fasterThe same was done for SHA256 previously in r263218cperciva's implementation was lacking SHA
Replace sys/crypto/sha2/sha2.c with lib/libmd/sha512c.ccperciva's libmd implementation is 5-30% fasterThe same was done for SHA256 previously in r263218cperciva's implementation was lacking SHA-384 which I implemented, validated against OpenSSL and the NIST documentationExtend sbin/md5 to create sha384(1)Chase dependancies on sys/crypto/sha2/sha2.{c,h} and replace them with sha512{c.c,.h}Reviewed by: cperciva, des, delphijApproved by: secteam, bapt (mentor)MFC after: 2 weeksSponsored by: ScaleEngine Inc.Differential Revision: https://reviews.freebsd.org/D3929
Huge cleanup of random(4) code.* GENERAL- Update copyright.- Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set neither to ON, which means we want Fortuna- If there is no 'device rand
Huge cleanup of random(4) code.* GENERAL- Update copyright.- Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set neither to ON, which means we want Fortuna- If there is no 'device random' in the kernel, there will be NO random(4) device in the kernel, and the KERN_ARND sysctl will return nothing. With RANDOM_DUMMY there will be a random(4) that always blocks.- Repair kern.arandom (KERN_ARND sysctl). The old version went through arc4random(9) and was a bit weird.- Adjust arc4random stirring a bit - the existing code looks a little suspect.- Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks.- Redo read_random(9) so as to duplicate random(4)'s read internals. This makes it a first-class citizen rather than a hack.- Move stuff out of locked regions when it does not need to be there.- Trim RANDOM_DEBUG printfs. Some are excess to requirement, some behind boot verbose.- Use SYSINIT to sequence the startup.- Fix init/deinit sysctl stuff.- Make relevant sysctls also tunables.- Add different harvesting "styles" to allow for different requirements (direct, queue, fast).- Add harvesting of FFS atime events. This needs to be checked for weighing down the FS code.- Add harvesting of slab allocator events. This needs to be checked for weighing down the allocator code.- Fix the random(9) manpage.- Loadable modules are not present for now. These will be re-engineered when the dust settles.- Use macros for locks.- Fix comments.* src/share/man/...- Update the man pages.* src/etc/...- The startup/shutdown work is done in D2924.* src/UPDATING- Add UPDATING announcement.* src/sys/dev/random/build.sh- Add copyright.- Add libz for unit tests.* src/sys/dev/random/dummy.c- Remove; no longer needed. Functionality incorporated into randomdev.*.* live_entropy_sources.c live_entropy_sources.h- Remove; content moved.- move content to randomdev.[ch] and optimise.* src/sys/dev/random/random_adaptors.c src/sys/dev/random/random_adaptors.h- Remove; plugability is no longer used. Compile-time algorithm selection is the way to go.* src/sys/dev/random/random_harvestq.c src/sys/dev/random/random_harvestq.h- Add early (re)boot-time randomness caching.* src/sys/dev/random/randomdev_soft.c src/sys/dev/random/randomdev_soft.h- Remove; no longer needed.* src/sys/dev/random/uint128.h- Provide a fake uint128_t; if a real one ever arrived, we can use that instead. All that is needed here is N=0, N++, N==0, and some localised trickery is used to manufacture a 128-bit 0ULLL.* src/sys/dev/random/unit_test.c src/sys/dev/random/unit_test.h- Improve unit tests; previously the testing human needed clairvoyance; now the test will do a basic check of compressibility. Clairvoyant talent is still a good idea.- This is still a long way off a proper unit test.* src/sys/dev/random/fortuna.c src/sys/dev/random/fortuna.h- Improve messy union to just uint128_t.- Remove unneeded 'static struct fortuna_start_cache'.- Tighten up up arithmetic.- Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing.- Assert that locks are held correctly.- Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks.- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])* src/sys/dev/random/yarrow.c src/sys/dev/random/yarrow.h- Improve messy union to just uint128_t.- Remove unneeded 'staic struct start_cache'.- Tighten up up arithmetic.- Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing.- Assert that locks are held correctly.- Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks.- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])- Fix some magic numbers elsewhere used as FAST and SLOW.Differential Revision: https://reviews.freebsd.org/D2025Reviewed by: vsevolod,delphij,rwatson,trasz,jmgApproved by: so (delphij)
Add some new modes to OpenCrypto. These modes are AES-ICM (can be usedfor counter mode), and AES-GCM. Both of these modes have been added tothe aesni module.Included is a set of tests to valida
Add some new modes to OpenCrypto. These modes are AES-ICM (can be usedfor counter mode), and AES-GCM. Both of these modes have been added tothe aesni module.Included is a set of tests to validate that the software and aesnimodule calculate the correct values. These use the NIST KAT testvectors. To run the test, you will need to install a soon to becommitted port, nist-kat that will install the vectors. Using a portis necessary as the test vectors are around 25MB.All the man pages were updated. I have added a new man page, crypto.7,which includes a description of how to use each mode. All the new modesand some other AES modes are present. It would be good for someoneelse to go through and document the other modes.A new ioctl was added to support AEAD modes which AES-GCM is one of them.Without this ioctl, it is not possible to test AEAD modes from userland.Add a timing safe bcmp for use to compare MACs. Previously we were usingbcmp which could leak timing info and result in the ability to forgemessages.Add a minor optimization to the aesni module so that single segmentmbufs don't get copied and instead are updated in place. The aesnimodule needs to be updated to support blocked IO so segmented mbufsdon't have to be copied.We require that the IV be specified for all calls for both GCM and ICM.This is to ensure proper use of these functions.Obtained from: p4: //depot/projects/opencryptoRelnotes: yesSponsored by: FreeBSD FoundationSponsored by: NetGate
I clearly didn't test the modules... add sha256c.c to the variousmodules that included sha2.c...
Add siphash.c. While here, sort.
Chase down cryptodeflate.c change from r259109.
- For kernel compiled only with KDTRACE_HOOKS and not any lock debugging option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the in
- For kernel compiled only with KDTRACE_HOOKS and not any lock debugging option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the inlined version of the releasing functions for mutex, rwlock and sxlock. Failing to do so skips the lockstat_probe_func invokation for unlocking.- As part of the LOCKSTAT support is inlined in mutex operation, for kernel compiled without lock debugging options, potentially every consumer must be compiled including opt_kdtrace.h. Fix this by moving KDTRACE_HOOKS into opt_global.h and remove the dependency by opt_kdtrace.h for all files, as now only KDTRACE_FRAMES is linked there and it is only used as a compile-time stub [0].[0] immediately shows some new bug as DTRACE-derived support for debugin sfxge is broken and it was never really tested. As it was notincluding correctly opt_kdtrace.h before it was never enabled so itwas kept broken for a while. Fix this by using a protection stub,leaving sfxge driver authors the responsibility for fixing itappropriately [1].Sponsored by: EMC / Isilon storage divisionDiscussed with: rstone[0] Reported by: rstone[1] Discussed with: philip
List low-level Blowfish ECB module in the SRCS. It looks like it was droppedby accident (and it would be inconvenient to implement it otherwise because ituses internal non-published headers).MFC
List low-level Blowfish ECB module in the SRCS. It looks like it was droppedby accident (and it would be inconvenient to implement it otherwise because ituses internal non-published headers).MFC after: 1 week
After adding an SDT provider for opencrypto in r199884 we should alsodepend on opt_kdtrace.h for the module build.Submitted by: (Andre.Albsmeier siemens.com)MFC after: 3 days
Integrate the Camellia Block Cipher. For more information see RFC 4132and its bibliography.Submitted by: Tomoyuki Okazaki <okazaki at kick dot gr dot jp>MFC after: 1 month
catchup w/ crypto changes
This patch fixes a problem, which exists if you have IPSEC in your kerneland want to have crypto support loaded as KLD. By moving zlib to separatemodule and adding MODULE_DEPEND directives, it is p
This patch fixes a problem, which exists if you have IPSEC in your kerneland want to have crypto support loaded as KLD. By moving zlib to separatemodule and adding MODULE_DEPEND directives, it is possible to use suchconfiguration without complication. Otherwise, since IPSEC is linked withzlib (just like crypto.ko) you'll get following error: interface zlib.1 already present in the KLD 'kernel'!Approved by: cognet (mentor)
just use crypto/rijndael, and nuke opencrypto/rindael.[ch].the two became almost identical since latest KAME merge.Discussed with: sam
Push m_apply() and m_getptr() up into the colleciton of standard mbufroutines, and purge them from opencrypto.Reviewed by: samObtained from: NetBSDSponsored by: spc.org
Module-ize the 'core' crypto stuff. This may still need to be compiledinto the kernel by default (if required), but other modules can nowdepend() on this.Fix inter-module dependancy.Earlier ver
Module-ize the 'core' crypto stuff. This may still need to be compiledinto the kernel by default (if required), but other modules can nowdepend() on this.Fix inter-module dependancy.Earlier version OK'ed by: sam