Changes in cts.c

7202e65b - crypto: cts - Only access common skcipher fields on spawn

Tue, 03 Oct 2023 03:43:28 +0000

crypto: cts - Only access common skcipher fields on spawnAs skcipher spawns may be of the type lskcipher, only the commonfields may be accessed. This was already the case but use thecorrect helpers to make this more obvious.Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

255e48eb - crypto: api - Use data directly in completion function

Wed, 08 Feb 2023 05:58:44 +0000

crypto: api - Use data directly in completion functionThis patch does the final flag day conversion of all completionfunctions which are now all contained in the Crypto API.Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

7bcb2c99 - crypto: algapi - use common mechanism for inheriting flags

Fri, 10 Jul 2020 06:20:38 +0000

crypto: algapi - use common mechanism for inheriting flagsThe flag CRYPTO_ALG_ASYNC is "inherited" in the sense that when atemplate is instantiated, the template will have CRYPTO_ALG_ASYNC set ifany of the algorithms it uses has CRYPTO_ALG_ASYNC set.We'd like to add a second flag (CRYPTO_ALG_ALLOCATES_MEMORY) that gets"inherited" in the same way. This is difficult because the handling ofCRYPTO_ALG_ASYNC is hardcoded everywhere. Address this by: - Add CRYPTO_ALG_INHERITED_FLAGS, which contains the set of flags that have these inheritance semantics. - Add crypto_algt_inherited_mask(), for use by template ->create() methods. It returns any of these flags that the user asked to be unset and thus must be passed in the 'mask' to crypto_grab_*(). - Also modify crypto_check_attr_type() to handle computing the 'mask' so that most templates can just use this. - Make crypto_grab_*() propagate these flags to the template instance being created so that templates don't have to do this themselves.Make crypto/simd.c propagate these flags too, since it "wraps" anotheralgorithm, similar to a template.Based on a patch by Mikulas Patocka (https://lore.kernel.org/r/alpine.LRH.2.02.2006301414580.30526@file01.intranet.prod.int.rdu2.redhat.com).Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

3ff2bab8 - crypto: cts - simplify error handling in crypto_cts_create()

Wed, 26 Feb 2020 04:59:17 +0000

crypto: cts - simplify error handling in crypto_cts_create()Simplify the error handling in crypto_cts_create() by taking advantageof crypto_grab_skcipher() now handling an ERR_PTR() name and by takingadvantage of crypto_drop_skcipher() now accepting (as a no-op) a spawnthat hasn't been grabbed yet.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

b9f76ddd - crypto: skcipher - pass instance to crypto_grab_skcipher()

Fri, 03 Jan 2020 03:58:45 +0000

crypto: skcipher - pass instance to crypto_grab_skcipher()Initializing a crypto_skcipher_spawn currently requires:1. Set spawn->base.inst to point to the instance.2. Call crypto_grab_skcipher().But there's no reason for these steps to be separate, and in fact thisunneeded complication has caused at least one bug, the one fixed bycommit 6db43410179b ("crypto: adiantum - initialize crypto_spawn::inst")So just make crypto_grab_skcipher() take the instance as an argument.To keep the function calls from getting too unwieldy due to this extraargument, also introduce a 'mask' variable into the affected placeswhich weren't already using one.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

af5034e8 - crypto: remove propagation of CRYPTO_TFM_RES_* flags

Tue, 31 Dec 2019 03:19:38 +0000

crypto: remove propagation of CRYPTO_TFM_RES_* flagsThe CRYPTO_TFM_RES_* flags were apparently meant as a way to make the->setkey() functions provide more information about errors. But theseflags weren't actually being used or tested, and in many cases theyweren't being set correctly anyway. So they've now been removed.Also, if someone ever actually needs to start better distinguishing->setkey() errors (which is somewhat unlikely, as this has been unneededfor a long time), we'd be much better off just defining different returnvalues, like -EINVAL if the key is invalid for the algorithm vs.-EKEYREJECTED if the key was rejected by a policy like "no weak keys".That would be much simpler, less error-prone, and easier to test.So just remove CRYPTO_TFM_RES_MASK and all the unneeded logic thatpropagates these flags around.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

c4741b23 - crypto: run initcalls for generic implementations earlier

Fri, 12 Apr 2019 04:57:42 +0000

crypto: run initcalls for generic implementations earlierUse subsys_initcall for registration of all templates and genericalgorithm implementations, rather than module_init. Then changecryptomgr to use arch_initcall, to place it before the subsys_initcalls.This is needed so that when both a generic and optimized implementationof an algorithm are built into the kernel (not loadable modules), thegeneric implementation is registered before the optimized one.Otherwise, the self-tests for the optimized implementation are unable toallocate the generic implementation for the new comparison fuzz tests.Note that on arm, a side effect of this change is that self-tests forgeneric implementations may run before the unaligned access handler hasbeen installed. So, unaligned accesses will crash the kernel. This isarguably a good thing as it makes it easier to detect that type of bug.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

c31a8719 - crypto: cts - don't support empty messages

Sun, 31 Mar 2019 20:04:20 +0000

crypto: cts - don't support empty messagesMy patches to make testmgr fuzz algorithms against their genericimplementation detected that the arm64 implementations of"cts(cbc(aes))" handle empty messages differently from the cts template.Namely, the arm64 implementations forbids (with -EINVAL) all messagesshorter than the block size, including the empty message; but the ctstemplate permits empty messages as a special case.No user should be CTS-encrypting/decrypting empty messages, but we needto keep the behavior consistent. Unfortunately, as noted in the sourceof OpenSSL's CTS implementation [1], there's no common specification forCTS. This makes it somewhat debatable what the behavior should be.However, all CTS specifications seem to agree that messages shorter thanthe block size are not allowed, and OpenSSL follows this in both CTSconventions it implements. It would also simplify the user-visiblesemantics to have empty messages no longer be a special case.Therefore, make the cts template return -EINVAL on *all* messagesshorter than the block size, including the empty message.[1] https://github.com/openssl/openssl/blob/master/crypto/modes/cts128.cSigned-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

6650c4de - crypto: remove several VLAs

Mon, 09 Apr 2018 13:54:47 +0000

crypto: remove several VLAsWe avoid various VLAs[1] by using constant expressions for block sizeand alignment mask.[1] http://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.comSigned-off-by: Salvatore Mesoraca Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

4e5b0ad5 - crypto: remove redundant backlog checks on EBUSY

Wed, 18 Oct 2017 07:00:36 +0000

crypto: remove redundant backlog checks on EBUSYNow that -EBUSY return code only indicates backlog queueingwe can safely remove the now redundant check for theCRYPTO_TFM_REQ_MAY_BACKLOG flag when -EBUSY is returned.Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

db91af0f - crypto: algapi - make crypto_xor() and crypto_inc() alignment agnostic

Sun, 05 Feb 2017 10:06:12 +0000

crypto: algapi - make crypto_xor() and crypto_inc() alignment agnosticInstead of unconditionally forcing 4 byte alignment for all genericchaining modes that rely on crypto_xor() or crypto_inc() (which mayresult in unnecessary copying of data when the underlying hardwarecan perform unaligned accesses efficiently), make those functionsdeal with unaligned input explicitly, but only if the Kconfig symbolHAVE_EFFICIENT_UNALIGNED_ACCESS is set. This will allow us to dropthe alignmasks from the CBC, CMAC, CTR, CTS, PCBC and SEQIV drivers.For crypto_inc(), this simply involves making the 4-byte strideconditional on HAVE_EFFICIENT_UNALIGNED_ACCESS being set, given thatit typically operates on 16 byte buffers.For crypto_xor(), an algorithm is implemented that simply runs throughthe input using the largest strides possible if unaligned accesses areallowed. If they are not, an optimal sequence of memory accesses isemitted that takes the relative alignment of the input buffers intoaccount, e.g., if the relative misalignment of dst and src is 4 bytes,the entire xor operation will be completed using 4 byte loads and stores(modulo unaligned bits at the start and end). Note that all expressionsinvolving misalign are simply eliminated by the compiler whenHAVE_EFFICIENT_UNALIGNED_ACCESS is defined.Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

d8c34b94 - crypto: Replaced gcc specific attributes with macros from compiler.h

Sat, 31 Dec 2016 15:56:23 +0000

crypto: Replaced gcc specific attributes with macros from compiler.hContinuing from this commit: 52f5684c8e1e("kernel: use macros from compiler.h instead of __attribute__((...))")I submitted 4 total patches. They are part of task I've taken up toincrease compiler portability in the kernel. I've cleaned up thesubsystems under /kernel /mm /block and /security, this patch targets/crypto.There is which provides macros for various gcc specificconstructs. Eg: __weak for __attribute__((weak)). I've cleaned allinstances of gcc specific attributes with the right macros for the cryptosubsystem.I had to make one additional change into compiler-gcc.h for the case whenone wants to use this: __attribute__((aligned) and not specify an alignmentfactor. From the gcc docs, this will result in the largest alignment forthat data type on the target machine so I've named the macro__aligned_largest. Please advise if another name is more appropriate.Signed-off-by: Gideon Israel Dsouza Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

60425a8b - crypto: skcipher - Get rid of crypto_spawn_skcipher2()

Fri, 28 Oct 2016 16:52:19 +0000

crypto: skcipher - Get rid of crypto_spawn_skcipher2()Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-levelgivcipher interface"), crypto_spawn_skcipher2() andcrypto_spawn_skcipher() are equivalent. So switch callers ofcrypto_spawn_skcipher2() to crypto_spawn_skcipher() and remove it.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

a35528ec - crypto: skcipher - Get rid of crypto_grab_skcipher2()

Fri, 28 Oct 2016 16:51:13 +0000

crypto: skcipher - Get rid of crypto_grab_skcipher2()Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-levelgivcipher interface"), crypto_grab_skcipher2() andcrypto_grab_skcipher() are equivalent. So switch callers ofcrypto_grab_skcipher2() to crypto_grab_skcipher() and remove it.Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

0605c41c - crypto: cts - Convert to skcipher

Tue, 12 Jul 2016 05:17:48 +0000

crypto: cts - Convert to skcipherThis patch converts cts over to the skcipher interface. It alsooptimises the implementation to use one CBC operation for all butthe last block, which is then processed separately.Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

988dc017 - crypto: cts - Weed out non-CBC algorithms

Fri, 16 Jan 2015 08:38:17 +0000

crypto: cts - Weed out non-CBC algorithmsThe cts algorithm as currently implemented assumes the underlyingis a CBC-mode algorithm. So this patch adds a check for that toeliminate bogus combinations of cts with non-CBC modes.Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

0c5c8e64 - crypto: cts - Remove bogus use of seqiv

Fri, 16 Jan 2015 07:09:21 +0000

crypto: cts - Remove bogus use of seqivThe seqiv generator is completely inappropriate for cts as it'sdesigned for IPsec algorithms. Since cts users do not actuallyuse the IV generator we can just fall back to the default.Signed-off-by: Herbert Xu Acked-by: Maciej ?enczykowski List of files: /linux-6.15/crypto/cts.c

4943ba16 - crypto: include crypto- module prefix in template

Tue, 25 Nov 2014 00:32:38 +0000

crypto: include crypto- module prefix in templateThis adds the module loading prefix "crypto-" to the template lookupas well.For example, attempting to load 'vfat(blowfish)' via AF_ALG now correctlyincludes the "crypto-" prefix at every level, correctly rejecting "vfat": net-pf-38 algif-hash crypto-vfat(blowfish) crypto-vfat(blowfish)-all crypto-vfatReported-by: Mathias Krause Signed-off-by: Kees Cook Acked-by: Mathias Krause Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c

7185ad26 - crypto: memzero_explicit - make sure to clear out sensitive data

Sun, 07 Sep 2014 21:23:38 +0000

crypto: memzero_explicit - make sure to clear out sensitive dataRecently, in commit 13aa93c70e71 ("random: add and use memzero_explicit()for clearing data"), we have found that GCC may optimize some memset()cases away when it detects a stack variable is not being used anymoreand going out of scope. This can happen, for example, in cases when weare clearing out sensitive information such as keying material or anye.g. intermediate results from crypto computations, etc.With the help of Coccinelle, we can figure out and fix such occurencesin the crypto subsytem as well. Julia Lawall provided the followingCoccinelle program: @@ type T; identifier x; @@ T x; ... when exists when any -memset +memzero_explicit (&x, -0, ...) ... when != x when strict @@ type T; identifier x; @@ T x[...]; ... when exists when any -memset +memzero_explicit (x, -0, ...) ... when != x when strictTherefore, make use of the drop-in replacement memzero_explicit() forexactly such cases instead of using memset().Signed-off-by: Daniel Borkmann Cc: Julia Lawall Cc: Herbert Xu Cc: Theodore Ts'o Cc: Hannes Frederic Sowa Acked-by: Hannes Frederic Sowa Acked-by: Herbert Xu Signed-off-by: Theodore Ts'o List of files: /linux-6.15/crypto/cts.c

3e8afe35 - crypto: use ERR_CAST

Tue, 22 Jan 2013 11:29:26 +0000

crypto: use ERR_CASTReplace PTR_ERR followed by ERR_PTR by ERR_CAST, to be more concise.The semantic patch that makes this change is as follows:(http://coccinelle.lip6.fr/)// @@expression err,x;@@- err = PTR_ERR(x); if (IS_ERR(x))- return ERR_PTR(err);+ return ERR_CAST(x);// Signed-off-by: Julia Lawall Signed-off-by: Herbert Xu List of files: /linux-6.15/crypto/cts.c