• Eric Biggers's avatar
    crypto: doc - improve the skcipher API example code · 03d66cfa
    Eric Biggers authored
    Rewrite the skcipher API example, changing it to encrypt a buffer with
    AES-256-XTS.  This addresses various problems with the previous example:
    
    - It requests a specific driver "cbc-aes-aesni", which is unusual.
      Normally users ask for "cbc(aes)", not a specific driver.
    
    - It encrypts only a single AES block.  For the reader, that doesn't
      clearly distinguish the "skcipher" API from the "cipher" API.
    
    - Showing how to encrypt something with bare CBC is arguably a poor
      choice of example, as it doesn't follow modern crypto trends.  Now,
      usually authenticated encryption is recommended, in which case the
      user would use the AEAD API, not skcipher.  Disk encryption is still a
      legitimate use for skcipher, but for that usually XTS is recommended.
    
    - Many other bugs and poor coding practices, such as not setting
      CRYPTO_TFM_REQ_MAY_SLEEP, unnecessarily allocating a heap buffer for
      the IV, unnecessary NULL checks, using a pointless wrapper struct, and
      forgetting to set an error code in one case.
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Acked-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    03d66cfa
api-samples.rst 5.68 KB