- 18 Jan, 2019 21 commits
-
-
Eric Biggers authored
Some "gcm(aes)" decryption test vectors don't exactly match any of the encryption test vectors with input and result swapped. In preparation for removing the AEAD decryption test vectors and testing AEAD decryption using the encryption test vectors, add these to the encryption test vectors, so we don't lose any test coverage. In the case of the chunked test vector, I truncated the last scatterlist element to the end of the plaintext. Signed-off-by:
Eric Biggers <ebiggers@google.com> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au>
-
Eric Biggers authored
Some "ccm(aes)" decryption test vectors don't exactly match any of the encryption test vectors with input and result swapped. In preparation for removing the AEAD decryption test vectors and testing AEAD decryption using the encryption test vectors, add these to the encryption test vectors, so we don't lose any test coverage. Signed-off-by:
-
Eric Biggers authored
In preparation for unifying the AEAD encryption and decryption test vectors, skip AEAD test vectors with the 'novrfy' (verification failure expected) flag set when testing encryption rather than decryption. These test vectors only make sense for decryption. Signed-off-by:
-
Eric Biggers authored
sk_alloc() already sets sock::sk_family to PF_ALG which is passed as the 'family' argument, so there's no need to set it again. Signed-off-by:
-
Eric Biggers authored
af_alg_count_tsgl() iterates through a list without modifying it, so use list_for_each_entry() rather than list_for_each_entry_safe(). Also make the pointers 'const' to make it clearer that nothing is modified. No actual change in behavior. Signed-off-by:
-
Eric Biggers authored
Some exported functions in af_alg.c aren't used outside of that file. Therefore, un-export them and make them 'static'. Signed-off-by:
-
Eric Biggers authored
crypto_cfg_mutex in crypto_user_stat.c is unused. Remove it. Cc: Corentin Labbe <clabbe@baylibre.com> Signed-off-by:
-
Eric Biggers authored
Fix an unaligned memory access in tgr192_transform() by using the unaligned access helpers. Fixes: 06ace7a9 ("[CRYPTO] Use standard byte order macros wherever possible") Signed-off-by:
-
Eric Biggers authored
Add missing static keywords to fix the following sparse warnings: arch/x86/crypto/aesni-intel_glue.c:197:24: warning: symbol 'aesni_gcm_tfm_sse' was not declared. Should it be static? arch/x86/crypto/aesni-intel_glue.c:246:24: warning: symbol 'aesni_gcm_tfm_avx_gen2' was not declared. Should it be static? arch/x86/crypto/aesni-intel_glue.c:291:24: warning: symbol 'aesni_gcm_tfm_avx_gen4' was not declared. Should it be static? I also made the affected structures 'const', and adjusted the indentation in the struct definition to not be insane. Cc: Dave Watson <davejwatson@fb.com> Signed-off-by: -
Eric Biggers authored
Move the declaration of crypto_nlsk into internal/cryptouser.h. This fixes the following sparse warning: crypto/crypto_user_base.c:41:13: warning: symbol 'crypto_nlsk' was not declared. Should it be static? Cc: Corentin Labbe <clabbe@baylibre.com> Signed-off-by: -
Eric Biggers authored
The crc32c context is in CPU endianness, whereas the final digest is little endian. alg_test_crc32c() got this mixed up. Fix it. The test passes both before and after, but this patch fixes the following sparse warning: crypto/testmgr.c:1912:24: warning: cast to restricted __le32 Signed-off-by: -
Eric Biggers authored
streebog_uint512::qword needs to be __le64, not u64. This fixes a large number of sparse warnings: crypto/streebog_generic.c:25:9: warning: incorrect type in initializer (different base types) crypto/streebog_generic.c:25:9: expected unsigned long long crypto/streebog_generic.c:25:9: got restricted __le64 [usertype] [omitted many similar warnings] No actual change in behavior. Cc: Vitaly Chikunov <vt@altlinux.org> Signed-off-by: -
Eric Biggers authored
Include internal/rsa.h in rsa-pkcs1pad.c to get the declaration of rsa_pkcs1pad_tmpl. This fixes the following sparse warning: crypto/rsa-pkcs1pad.c:698:24: warning: symbol 'rsa_pkcs1pad_tmpl' was not declared. Should it be static? Cc: Andrzej Zaborowski <andrew.zaborowski@intel.com> Signed-off-by: -
Eric Biggers authored
In gcm_hash_len(), use be128 rather than u128. This fixes the following sparse warnings: crypto/gcm.c:252:19: warning: incorrect type in assignment (different base types) crypto/gcm.c:252:19: expected unsigned long long [usertype] a crypto/gcm.c:252:19: got restricted __be64 [usertype] crypto/gcm.c:253:19: warning: incorrect type in assignment (different base types) crypto/gcm.c:253:19: expected unsigned long long [usertype] b crypto/gcm.c:253:19: got restricted __be64 [usertype] No actual change in behavior. Signed-off-by: -
YueHaibing authored
Fixes gcc '-Wunused-but-set-variable' warning: drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req': drivers/crypto/bcm/cipher.c:720:15: warning: variable 'chunk_start' set but not used [-Wunused-but-set-variable] drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback': drivers/crypto/bcm/cipher.c:1679:31: warning: variable 'areq' set but not used [-Wunused-but-set-variable] drivers/crypto/bcm/cipher.c:1678:22: warning: variable 'ctx' set but not used [-Wunused-but-set-variable] Fixes: 9d12ba86 ("crypto: brcm - Add Broadcom SPU driver") Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Reviewed-by:
Raveendra Padasalagi <raveendra.padasalagi@broadcom.com> Signed-off-by:
-
Vitaly Chikunov authored
Before this, if akcipher_testvec have `public_key_vec' set to true (i.e. having a public key) only sign/encrypt test is performed, but verify/decrypt test is skipped. With a public key we could do encrypt and verify, but to sign and decrypt a private key is required. This logic is correct for encrypt/decrypt tests (decrypt is skipped if no private key). But incorrect for sign/verify tests - sign is performed no matter if there is no private key, but verify is skipped if there is a public key. Rework `test_akcipher_one' to arrange tests properly depending on value of `public_key_vec` and `siggen_sigver_test'. No tests were missed since there is only one sign/verify test (which have `siggen_sigver_test' set to true) and it has a private key, but future tests could benefit from this improvement. Signed-off-by:
Vitaly Chikunov <vt@altlinux.org> Signed-off-by:
-
Eric Biggers authored
crypto_init_shash_ops_async() only gives the ahash tfm non-NULL ->export() and ->import() if the underlying shash alg has these non-NULL. This doesn't make sense because when an shash algorithm is registered, shash_prepare_alg() sets a default ->export() and ->import() if the implementor didn't provide them. And elsewhere it's assumed that all shash algs and ahash tfms have non-NULL ->export() and ->import(). Therefore, remove these unnecessary, always-true conditions. Signed-off-by:
-
Eric Biggers authored
Prevent registering shash algorithms that implement ->export() but not ->import(), or ->import() but not ->export(). Such cases don't make sense and could confuse the check that shash_prepare_alg() does for just ->export(). I don't believe this affects any existing algorithms; this is just preventing future mistakes. Signed-off-by:
-
Eric Biggers authored
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key. For example, in gcm.c, if the kzalloc() fails due to lack of memory, then the CTR part of GCM will have the new key but GHASH will not. It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails, to prevent the tfm from being used until a new key is set. [Cc stable mainly because when introducing the NEED_KEY flag I changed AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.] Fixes: dc26c17f ("crypto: aead - prevent using AEADs without setting key") Cc: <stable@vger.kernel.org> # v4.16+ Signed-off-by:
-
Eric Biggers authored
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key. For example, in lrw.c, if gf128mul_init_64k_bbe() fails due to lack of memory, then priv::table will be left NULL. After that, encryption with that tfm will cause a NULL pointer dereference. It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a key, to prevent the tfm from being used until a new key is set. [Cc stable mainly because when introducing the NEED_KEY flag I changed AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.] Fixes: f8d33fac ("crypto: skcipher - prevent using skciphers without setting key") Cc: <stable@vger.kernel.org> # v4.16+ Signed-off-by:
-
Eric Biggers authored
Some algorithms have a ->setkey() method that is not atomic, in the sense that setting a key can fail after changes were already made to the tfm context. In this case, if a key was already set the tfm can end up in a state that corresponds to neither the old key nor the new key. It's not feasible to make all ->setkey() methods atomic, especially ones that have to key multiple sub-tfms. Therefore, make the crypto API set CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a key, to prevent the tfm from being used until a new key is set. Note: we can't set CRYPTO_TFM_NEED_KEY for OPTIONAL_KEY algorithms, so ->setkey() for those must nevertheless be atomic. That's fine for now since only the crc32 and crc32c algorithms set OPTIONAL_KEY, and it's not intended that OPTIONAL_KEY be used much. [Cc stable mainly because when introducing the NEED_KEY flag I changed AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG previously didn't have this problem. So these "incompletely keyed" states became theoretically accessible via AF_ALG -- though, the opportunities for causing real mischief seem pretty limited.] Fixes: 9fa68f62 ("crypto: hash - prevent using keyed hashes without setting key") Cc: stable@vger.kernel.org Signed-off-by:
-
- 11 Jan, 2019 19 commits
-
-
Eric Biggers authored
It took me a while to notice the bug where the adiantum template left crypto_spawn::inst == NULL, because this only caused problems in certain cases where algorithms are dynamically loaded/unloaded. More improvements are needed, but for now make crypto_init_spawn() reject this case and WARN(), so this type of bug will be noticed immediately in the future. Note: I checked all callers and the adiantum template was the only place that had this wrong. So this WARN shouldn't trigger anymore. Signed-off-by:
-
Eric Biggers authored
Now that all "blkcipher" templates have been converted to "skcipher", crypto_alloc_instance() is no longer used. And it's not useful any longer as it creates an old-style weakly typed instance rather than a new-style strongly typed instance. So remove it, and now that the name is freed up rename crypto_alloc_instance2() to crypto_alloc_instance(). Signed-off-by:
-
Eric Biggers authored
Convert the "ecb-cipher_null" algorithm from the deprecated "blkcipher" API to the "skcipher" API. Signed-off-by:
-
Eric Biggers authored
Convert the "ecb(arc4)" algorithm from the deprecated "blkcipher" API to the "skcipher" API. (Note that this is really a stream cipher and not a block cipher in ECB mode as the name implies, but that's a problem for another day...) Signed-off-by:
-
Eric Biggers authored
The PCBC template just wraps a single block cipher algorithm, so simplify it by converting it to use skcipher_alloc_instance_simple(). Signed-off-by:
-
Eric Biggers authored
Following commit 944585a6 ("crypto: x86/aes-ni - remove special handling of AES in PCBC mode"), it's no longer needed for the PCBC template to support wrapping a cipher that has the CRYPTO_ALG_INTERNAL flag set. Thus, remove this now-unused functionality to make PCBC consistent with the other single block cipher templates. Signed-off-by:
-
Eric Biggers authored
The OFB template just wraps a single block cipher algorithm, so simplify it by converting it to use skcipher_alloc_instance_simple(). Cc: Gilad Ben-Yossef <gilad@benyossef.com> Signed-off-by:
-
Eric Biggers authored
Convert the keywrap template from the deprecated "blkcipher" API to the "skcipher" API, taking advantage of skcipher_alloc_instance_simple() to simplify it considerably. Cc: Stephan Mueller <smueller@chronox.de> Signed-off-by:
Stephan Mueller <smueller@chronox.de> Signed-off-by:
-
Eric Biggers authored
Convert the ECB template from the deprecated "blkcipher" API to the "skcipher" API, taking advantage of skcipher_alloc_instance_simple() to simplify it considerably. Signed-off-by:
-
Eric Biggers authored
Convert the CTR template from the deprecated "blkcipher" API to the "skcipher" API, taking advantage of skcipher_alloc_instance_simple() to simplify it considerably. Signed-off-by:
-
Eric Biggers authored
The CFB template just wraps a single block cipher algorithm, so simplify it by converting it to use skcipher_alloc_instance_simple(). Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
-
Eric Biggers authored
The CBC template just wraps a single block cipher algorithm, so simplify it by converting it to use skcipher_alloc_instance_simple(). Signed-off-by:
-
Eric Biggers authored
The majority of skcipher templates (including both the existing ones and the ones remaining to be converted from the "blkcipher" API) just wrap a single block cipher algorithm. This includes cbc, cfb, ctr, ecb, kw, ofb, and pcbc. Add a helper function skcipher_alloc_instance_simple() that handles allocating an skcipher instance for this common case. Signed-off-by:
-
Eric Biggers authored
The memcpy()s in the PCBC implementation use walk->iv as both the source and destination, which has undefined behavior. These memcpy()'s are actually unneeded, because walk->iv is already used to hold the previous plaintext block XOR'd with the previous ciphertext block. Thus, walk->iv is already updated to its final value. So remove the broken and unnecessary memcpy()s. Fixes: 91652be5 ("[CRYPTO] pcbc: Add Propagated CBC template") Cc: <stable@vger.kernel.org> # v2.6.21+ Cc: David Howells <dhowells@redhat.com> Signed-off-by:
-
Eric Biggers authored
Fix multiple bugs in the OFB implementation: 1. It stored the per-request state 'cnt' in the tfm context, which can be used by multiple threads concurrently (e.g. via AF_ALG). 2. It didn't support messages not a multiple of the block cipher size, despite being a stream cipher. 3. It didn't set cra_blocksize to 1 to indicate it is a stream cipher. To fix these, set the 'chunksize' property to the cipher block size to guarantee that when walking through the scatterlist, a partial block can only occur at the end. Then change the implementation to XOR a block at a time at first, then XOR the partial block at the end if needed. This is the same way CTR and CFB are implemented. As a bonus, this also improves performance in most cases over the current approach. Fixes: e497c518 ("crypto: ofb - add output feedback mode") Cc: <stable@vger.kernel.org> # v4.20+ Cc: Gilad Ben-Yossef <gilad@benyossef.com> Signed-off-by:
Gilad Ben-Yossef <gilad@benyossef.com> Signed-off-by:
-
Eric Biggers authored
The memcpy() in crypto_cfb_decrypt_inplace() uses walk->iv as both the source and destination, which has undefined behavior. It is unneeded because walk->iv is already used to hold the previous ciphertext block; thus, walk->iv is already updated to its final value. So, remove it. Also, note that in-place decryption is the only case where the previous ciphertext block is not directly available. Therefore, as a related cleanup I also updated crypto_cfb_encrypt_segment() to directly use the previous ciphertext block rather than save it into walk->iv. This makes it consistent with in-place encryption and out-of-place decryption; now only in-place decryption is different, because it has to be. Fixes: a7d85e06 ("crypto: cfb - add support for Cipher FeedBack mode") Cc: <stable@vger.kernel.org> # v4.17+ Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
-
Eric Biggers authored
Like some other block cipher mode implementations, the CFB implementation assumes that while walking through the scatterlist, a partial block does not occur until the end. But the walk is incorrectly being done with a blocksize of 1, as 'cra_blocksize' is set to 1 (since CFB is a stream cipher) but no 'chunksize' is set. This bug causes incorrect encryption/decryption for some scatterlist layouts. Fix it by setting the 'chunksize'. Also extend the CFB test vectors to cover this bug as well as cases where the message length is not a multiple of the block size. Fixes: a7d85e06 ("crypto: cfb - add support for Cipher FeedBack mode") Cc: <stable@vger.kernel.org> # v4.17+ Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
-
Colin Ian King authored
A statement is indented with spaces and not indented enough, fix this replacing spaces with a tab. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
haco authored
Fix typo "plcmul" to "pclmul" Signed-off-by:
Huaxuan Mao <minhaco@msn.com> Signed-off-by:
-
