2019-05-27 14:55:01 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
/*
|
|
|
|
|
* Authenc: Simple AEAD wrapper for IPsec
|
|
|
|
|
*
|
2015-07-30 17:53:16 +08:00
|
|
|
* Copyright (c) 2007-2015 Herbert Xu <herbert@gondor.apana.org.au>
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
*/
|
|
|
|
|
|
2015-05-11 17:47:41 +08:00
|
|
|
#include <crypto/internal/aead.h>
|
2008-08-31 20:21:09 +08:00
|
|
|
#include <crypto/internal/hash.h>
|
2007-12-17 20:12:49 +08:00
|
|
|
#include <crypto/internal/skcipher.h>
|
2007-11-22 23:11:53 +08:00
|
|
|
#include <crypto/authenc.h>
|
2015-07-30 17:53:16 +08:00
|
|
|
#include <crypto/null.h>
|
2007-12-07 18:52:49 +08:00
|
|
|
#include <crypto/scatterwalk.h>
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
#include <linux/err.h>
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
|
#include <linux/module.h>
|
2007-11-22 23:11:53 +08:00
|
|
|
#include <linux/rtnetlink.h>
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
#include <linux/slab.h>
|
|
|
|
|
#include <linux/spinlock.h>
|
|
|
|
|
|
|
|
|
|
struct authenc_instance_ctx {
|
2009-08-05 17:35:34 +08:00
|
|
|
struct crypto_ahash_spawn auth;
|
2007-12-17 20:12:49 +08:00
|
|
|
struct crypto_skcipher_spawn enc;
|
2015-07-30 17:53:16 +08:00
|
|
|
unsigned int reqoff;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct crypto_authenc_ctx {
|
2009-08-05 17:35:34 +08:00
|
|
|
struct crypto_ahash *auth;
|
2016-07-12 13:17:34 +08:00
|
|
|
struct crypto_skcipher *enc;
|
2018-09-19 10:10:51 +08:00
|
|
|
struct crypto_sync_skcipher *null;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
};
|
|
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
struct authenc_request_ctx {
|
2015-07-30 17:53:16 +08:00
|
|
|
struct scatterlist src[2];
|
|
|
|
|
struct scatterlist dst[2];
|
2009-08-05 17:35:34 +08:00
|
|
|
char tail[];
|
|
|
|
|
};
|
|
|
|
|
|
2010-04-26 09:14:05 +08:00
|
|
|
static void authenc_request_complete(struct aead_request *req, int err)
|
|
|
|
|
{
|
|
|
|
|
if (err != -EINPROGRESS)
|
|
|
|
|
aead_request_complete(req, err);
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-15 19:49:30 +08:00
|
|
|
int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
|
|
|
|
|
unsigned int keylen)
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
{
|
2013-10-15 19:49:30 +08:00
|
|
|
struct rtattr *rta = (struct rtattr *)key;
|
2007-11-22 23:11:53 +08:00
|
|
|
struct crypto_authenc_key_param *param;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2007-12-10 10:55:21 +08:00
|
|
|
if (!RTA_OK(rta, keylen))
|
2013-10-15 19:49:30 +08:00
|
|
|
return -EINVAL;
|
2007-11-22 23:11:53 +08:00
|
|
|
if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
|
2013-10-15 19:49:30 +08:00
|
|
|
return -EINVAL;
|
crypto: authenc - fix parsing key with misaligned rta_len
Keys for "authenc" AEADs are formatted as an rtattr containing a 4-byte
'enckeylen', followed by an authentication key and an encryption key.
crypto_authenc_extractkeys() parses the key to find the inner keys.
However, it fails to consider the case where the rtattr's payload is
longer than 4 bytes but not 4-byte aligned, and where the key ends
before the next 4-byte aligned boundary. In this case, 'keylen -=
RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX. This
causes a buffer overread and crash during crypto_ahash_setkey().
Fix it by restricting the rtattr payload to the expected size.
Reproducer using AF_ALG:
#include <linux/if_alg.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>
int main()
{
int fd;
struct sockaddr_alg addr = {
.salg_type = "aead",
.salg_name = "authenc(hmac(sha256),cbc(aes))",
};
struct {
struct rtattr attr;
__be32 enckeylen;
char keys[1];
} __attribute__((packed)) key = {
.attr.rta_len = sizeof(key),
.attr.rta_type = 1 /* CRYPTO_AUTHENC_KEYA_PARAM */,
};
fd = socket(AF_ALG, SOCK_SEQPACKET, 0);
bind(fd, (void *)&addr, sizeof(addr));
setsockopt(fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key));
}
It caused:
BUG: unable to handle kernel paging request at ffff88007ffdc000
PGD 2e01067 P4D 2e01067 PUD 2e04067 PMD 2e05067 PTE 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 883 Comm: authenc Not tainted 4.20.0-rc1-00108-g00c9fe37a7f27 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
RIP: 0010:sha256_ni_transform+0xb3/0x330 arch/x86/crypto/sha256_ni_asm.S:155
[...]
Call Trace:
sha256_ni_finup+0x10/0x20 arch/x86/crypto/sha256_ssse3_glue.c:321
crypto_shash_finup+0x1a/0x30 crypto/shash.c:178
shash_digest_unaligned+0x45/0x60 crypto/shash.c:186
crypto_shash_digest+0x24/0x40 crypto/shash.c:202
hmac_setkey+0x135/0x1e0 crypto/hmac.c:66
crypto_shash_setkey+0x2b/0xb0 crypto/shash.c:66
shash_async_setkey+0x10/0x20 crypto/shash.c:223
crypto_ahash_setkey+0x2d/0xa0 crypto/ahash.c:202
crypto_authenc_setkey+0x68/0x100 crypto/authenc.c:96
crypto_aead_setkey+0x2a/0xc0 crypto/aead.c:62
aead_setkey+0xc/0x10 crypto/algif_aead.c:526
alg_setkey crypto/af_alg.c:223 [inline]
alg_setsockopt+0xfe/0x130 crypto/af_alg.c:256
__sys_setsockopt+0x6d/0xd0 net/socket.c:1902
__do_sys_setsockopt net/socket.c:1913 [inline]
__se_sys_setsockopt net/socket.c:1910 [inline]
__x64_sys_setsockopt+0x1f/0x30 net/socket.c:1910
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fixes: e236d4a89a2f ("[CRYPTO] authenc: Move enckeylen into key itself")
Cc: <stable@vger.kernel.org> # v2.6.25+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2018-12-17 15:23:22 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* RTA_OK() didn't align the rtattr's payload when validating that it
|
|
|
|
|
* fits in the buffer. Yet, the keys should start on the next 4-byte
|
|
|
|
|
* aligned boundary. To avoid confusion, require that the rtattr
|
|
|
|
|
* payload be exactly the param struct, which has a 4-byte aligned size.
|
|
|
|
|
*/
|
|
|
|
|
if (RTA_PAYLOAD(rta) != sizeof(*param))
|
2013-10-15 19:49:30 +08:00
|
|
|
return -EINVAL;
|
crypto: authenc - fix parsing key with misaligned rta_len
Keys for "authenc" AEADs are formatted as an rtattr containing a 4-byte
'enckeylen', followed by an authentication key and an encryption key.
crypto_authenc_extractkeys() parses the key to find the inner keys.
However, it fails to consider the case where the rtattr's payload is
longer than 4 bytes but not 4-byte aligned, and where the key ends
before the next 4-byte aligned boundary. In this case, 'keylen -=
RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX. This
causes a buffer overread and crash during crypto_ahash_setkey().
Fix it by restricting the rtattr payload to the expected size.
Reproducer using AF_ALG:
#include <linux/if_alg.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>
int main()
{
int fd;
struct sockaddr_alg addr = {
.salg_type = "aead",
.salg_name = "authenc(hmac(sha256),cbc(aes))",
};
struct {
struct rtattr attr;
__be32 enckeylen;
char keys[1];
} __attribute__((packed)) key = {
.attr.rta_len = sizeof(key),
.attr.rta_type = 1 /* CRYPTO_AUTHENC_KEYA_PARAM */,
};
fd = socket(AF_ALG, SOCK_SEQPACKET, 0);
bind(fd, (void *)&addr, sizeof(addr));
setsockopt(fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key));
}
It caused:
BUG: unable to handle kernel paging request at ffff88007ffdc000
PGD 2e01067 P4D 2e01067 PUD 2e04067 PMD 2e05067 PTE 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 883 Comm: authenc Not tainted 4.20.0-rc1-00108-g00c9fe37a7f27 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
RIP: 0010:sha256_ni_transform+0xb3/0x330 arch/x86/crypto/sha256_ni_asm.S:155
[...]
Call Trace:
sha256_ni_finup+0x10/0x20 arch/x86/crypto/sha256_ssse3_glue.c:321
crypto_shash_finup+0x1a/0x30 crypto/shash.c:178
shash_digest_unaligned+0x45/0x60 crypto/shash.c:186
crypto_shash_digest+0x24/0x40 crypto/shash.c:202
hmac_setkey+0x135/0x1e0 crypto/hmac.c:66
crypto_shash_setkey+0x2b/0xb0 crypto/shash.c:66
shash_async_setkey+0x10/0x20 crypto/shash.c:223
crypto_ahash_setkey+0x2d/0xa0 crypto/ahash.c:202
crypto_authenc_setkey+0x68/0x100 crypto/authenc.c:96
crypto_aead_setkey+0x2a/0xc0 crypto/aead.c:62
aead_setkey+0xc/0x10 crypto/algif_aead.c:526
alg_setkey crypto/af_alg.c:223 [inline]
alg_setsockopt+0xfe/0x130 crypto/af_alg.c:256
__sys_setsockopt+0x6d/0xd0 net/socket.c:1902
__do_sys_setsockopt net/socket.c:1913 [inline]
__se_sys_setsockopt net/socket.c:1910 [inline]
__x64_sys_setsockopt+0x1f/0x30 net/socket.c:1910
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fixes: e236d4a89a2f ("[CRYPTO] authenc: Move enckeylen into key itself")
Cc: <stable@vger.kernel.org> # v2.6.25+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2018-12-17 15:23:22 +08:00
|
|
|
BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
|
2007-11-22 23:11:53 +08:00
|
|
|
|
|
|
|
|
param = RTA_DATA(rta);
|
2013-10-15 19:49:30 +08:00
|
|
|
keys->enckeylen = be32_to_cpu(param->enckeylen);
|
2007-11-22 23:11:53 +08:00
|
|
|
|
crypto: authenc - fix parsing key with misaligned rta_len
Keys for "authenc" AEADs are formatted as an rtattr containing a 4-byte
'enckeylen', followed by an authentication key and an encryption key.
crypto_authenc_extractkeys() parses the key to find the inner keys.
However, it fails to consider the case where the rtattr's payload is
longer than 4 bytes but not 4-byte aligned, and where the key ends
before the next 4-byte aligned boundary. In this case, 'keylen -=
RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX. This
causes a buffer overread and crash during crypto_ahash_setkey().
Fix it by restricting the rtattr payload to the expected size.
Reproducer using AF_ALG:
#include <linux/if_alg.h>
#include <linux/rtnetlink.h>
#include <sys/socket.h>
int main()
{
int fd;
struct sockaddr_alg addr = {
.salg_type = "aead",
.salg_name = "authenc(hmac(sha256),cbc(aes))",
};
struct {
struct rtattr attr;
__be32 enckeylen;
char keys[1];
} __attribute__((packed)) key = {
.attr.rta_len = sizeof(key),
.attr.rta_type = 1 /* CRYPTO_AUTHENC_KEYA_PARAM */,
};
fd = socket(AF_ALG, SOCK_SEQPACKET, 0);
bind(fd, (void *)&addr, sizeof(addr));
setsockopt(fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key));
}
It caused:
BUG: unable to handle kernel paging request at ffff88007ffdc000
PGD 2e01067 P4D 2e01067 PUD 2e04067 PMD 2e05067 PTE 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 883 Comm: authenc Not tainted 4.20.0-rc1-00108-g00c9fe37a7f27 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
RIP: 0010:sha256_ni_transform+0xb3/0x330 arch/x86/crypto/sha256_ni_asm.S:155
[...]
Call Trace:
sha256_ni_finup+0x10/0x20 arch/x86/crypto/sha256_ssse3_glue.c:321
crypto_shash_finup+0x1a/0x30 crypto/shash.c:178
shash_digest_unaligned+0x45/0x60 crypto/shash.c:186
crypto_shash_digest+0x24/0x40 crypto/shash.c:202
hmac_setkey+0x135/0x1e0 crypto/hmac.c:66
crypto_shash_setkey+0x2b/0xb0 crypto/shash.c:66
shash_async_setkey+0x10/0x20 crypto/shash.c:223
crypto_ahash_setkey+0x2d/0xa0 crypto/ahash.c:202
crypto_authenc_setkey+0x68/0x100 crypto/authenc.c:96
crypto_aead_setkey+0x2a/0xc0 crypto/aead.c:62
aead_setkey+0xc/0x10 crypto/algif_aead.c:526
alg_setkey crypto/af_alg.c:223 [inline]
alg_setsockopt+0xfe/0x130 crypto/af_alg.c:256
__sys_setsockopt+0x6d/0xd0 net/socket.c:1902
__do_sys_setsockopt net/socket.c:1913 [inline]
__se_sys_setsockopt net/socket.c:1910 [inline]
__x64_sys_setsockopt+0x1f/0x30 net/socket.c:1910
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fixes: e236d4a89a2f ("[CRYPTO] authenc: Move enckeylen into key itself")
Cc: <stable@vger.kernel.org> # v2.6.25+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2018-12-17 15:23:22 +08:00
|
|
|
key += rta->rta_len;
|
|
|
|
|
keylen -= rta->rta_len;
|
2007-11-22 23:11:53 +08:00
|
|
|
|
2013-10-15 19:49:30 +08:00
|
|
|
if (keylen < keys->enckeylen)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
keys->authkeylen = keylen - keys->enckeylen;
|
|
|
|
|
keys->authkey = key;
|
|
|
|
|
keys->enckey = key + keys->authkeylen;
|
2007-11-22 23:11:53 +08:00
|
|
|
|
2013-10-15 19:49:30 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(crypto_authenc_extractkeys);
|
|
|
|
|
|
|
|
|
|
static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
|
|
|
|
|
unsigned int keylen)
|
|
|
|
|
{
|
|
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
|
|
|
|
struct crypto_ahash *auth = ctx->auth;
|
2016-07-12 13:17:34 +08:00
|
|
|
struct crypto_skcipher *enc = ctx->enc;
|
2013-10-15 19:49:30 +08:00
|
|
|
struct crypto_authenc_keys keys;
|
|
|
|
|
int err = -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
|
crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN
The CRYPTO_TFM_RES_BAD_KEY_LEN flag was apparently meant as a way to
make the ->setkey() functions provide more information about errors.
However, no one actually checks for this flag, which makes it pointless.
Also, many algorithms fail to set this flag when given a bad length key.
Reviewing just the generic implementations, this is the case for
aes-fixed-time, cbcmac, echainiv, nhpoly1305, pcrypt, rfc3686, rfc4309,
rfc7539, rfc7539esp, salsa20, seqiv, and xcbc. But there are probably
many more in arch/*/crypto/ and drivers/crypto/.
Some algorithms can even set this flag when the key is the correct
length. For example, authenc and authencesn set it when the key payload
is malformed in any way (not just a bad length), the atmel-sha and ccree
drivers can set it if a memory allocation fails, and the chelsio driver
sets it for bad auth tag lengths, not just bad key lengths.
So even if someone actually wanted to start checking this flag (which
seems unlikely, since it's been unused for a long time), there would be
a lot of work needed to get it working correctly. But it would probably
be much better to go back to the drawing board and just define different
return values, like -EINVAL if the key is invalid for the algorithm vs.
-EKEYREJECTED if the key was rejected by a policy like "no weak keys".
That would be much simpler, less error-prone, and easier to test.
So just remove this flag.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2019-12-31 11:19:36 +08:00
|
|
|
goto out;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
crypto_ahash_clear_flags(auth, CRYPTO_TFM_REQ_MASK);
|
|
|
|
|
crypto_ahash_set_flags(auth, crypto_aead_get_flags(authenc) &
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
CRYPTO_TFM_REQ_MASK);
|
2013-10-15 19:49:30 +08:00
|
|
|
err = crypto_ahash_setkey(auth, keys.authkey, keys.authkeylen);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
|
|
|
|
goto out;
|
|
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
crypto_skcipher_clear_flags(enc, CRYPTO_TFM_REQ_MASK);
|
|
|
|
|
crypto_skcipher_set_flags(enc, crypto_aead_get_flags(authenc) &
|
|
|
|
|
CRYPTO_TFM_REQ_MASK);
|
|
|
|
|
err = crypto_skcipher_setkey(enc, keys.enckey, keys.enckeylen);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
out:
|
2018-04-03 14:39:00 +08:00
|
|
|
memzero_explicit(&keys, sizeof(keys));
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err)
|
|
|
|
|
{
|
|
|
|
|
struct aead_request *req = areq->data;
|
|
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst = aead_alg_instance(authenc);
|
|
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
2009-08-05 17:35:34 +08:00
|
|
|
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
|
2009-08-05 17:35:34 +08:00
|
|
|
|
|
|
|
|
if (err)
|
|
|
|
|
goto out;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
scatterwalk_map_and_copy(ahreq->result, req->dst,
|
|
|
|
|
req->assoclen + req->cryptlen,
|
2009-08-05 17:35:34 +08:00
|
|
|
crypto_aead_authsize(authenc), 1);
|
|
|
|
|
|
|
|
|
|
out:
|
|
|
|
|
aead_request_complete(req, err);
|
|
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags)
|
2009-08-05 17:35:34 +08:00
|
|
|
{
|
|
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst = aead_alg_instance(authenc);
|
2009-08-05 17:35:34 +08:00
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
2009-08-05 17:35:34 +08:00
|
|
|
struct crypto_ahash *auth = ctx->auth;
|
|
|
|
|
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
|
2009-08-05 17:35:34 +08:00
|
|
|
u8 *hash = areq_ctx->tail;
|
|
|
|
|
int err;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
hash = (u8 *)ALIGN((unsigned long)hash + crypto_ahash_alignmask(auth),
|
|
|
|
|
crypto_ahash_alignmask(auth) + 1);
|
|
|
|
|
|
|
|
|
|
ahash_request_set_tfm(ahreq, auth);
|
2015-07-30 17:53:16 +08:00
|
|
|
ahash_request_set_crypt(ahreq, req->dst, hash,
|
|
|
|
|
req->assoclen + req->cryptlen);
|
|
|
|
|
ahash_request_set_callback(ahreq, flags,
|
|
|
|
|
authenc_geniv_ahash_done, req);
|
2009-08-05 17:35:34 +08:00
|
|
|
|
|
|
|
|
err = crypto_ahash_digest(ahreq);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
2015-07-30 17:53:16 +08:00
|
|
|
return err;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
scatterwalk_map_and_copy(hash, req->dst, req->assoclen + req->cryptlen,
|
2007-12-02 15:49:21 +08:00
|
|
|
crypto_aead_authsize(authenc), 1);
|
2015-07-30 17:53:16 +08:00
|
|
|
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
|
|
|
|
|
int err)
|
|
|
|
|
{
|
2008-08-22 23:04:06 +08:00
|
|
|
struct aead_request *areq = req->data;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
if (err)
|
|
|
|
|
goto out;
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
err = crypto_authenc_genicv(areq, 0);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
out:
|
2010-04-26 09:14:05 +08:00
|
|
|
authenc_request_complete(areq, err);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static int crypto_authenc_copy_assoc(struct aead_request *req)
|
|
|
|
|
{
|
|
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
|
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
2018-09-19 10:10:51 +08:00
|
|
|
SYNC_SKCIPHER_REQUEST_ON_STACK(skreq, ctx->null);
|
2015-07-30 17:53:16 +08:00
|
|
|
|
2018-09-19 10:10:51 +08:00
|
|
|
skcipher_request_set_sync_tfm(skreq, ctx->null);
|
2016-07-12 13:17:34 +08:00
|
|
|
skcipher_request_set_callback(skreq, aead_request_flags(req),
|
|
|
|
|
NULL, NULL);
|
|
|
|
|
skcipher_request_set_crypt(skreq, req->src, req->dst, req->assoclen,
|
|
|
|
|
NULL);
|
|
|
|
|
|
|
|
|
|
return crypto_skcipher_encrypt(skreq);
|
2015-07-30 17:53:16 +08:00
|
|
|
}
|
|
|
|
|
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
static int crypto_authenc_encrypt(struct aead_request *req)
|
|
|
|
|
{
|
|
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst = aead_alg_instance(authenc);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
2010-03-03 22:41:08 +08:00
|
|
|
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
|
2016-07-12 13:17:34 +08:00
|
|
|
struct crypto_skcipher *enc = ctx->enc;
|
2007-12-10 16:20:24 +08:00
|
|
|
unsigned int cryptlen = req->cryptlen;
|
2016-07-12 13:17:34 +08:00
|
|
|
struct skcipher_request *skreq = (void *)(areq_ctx->tail +
|
|
|
|
|
ictx->reqoff);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct scatterlist *src, *dst;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
int err;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
src = scatterwalk_ffwd(areq_ctx->src, req->src, req->assoclen);
|
|
|
|
|
dst = src;
|
|
|
|
|
|
|
|
|
|
if (req->src != req->dst) {
|
|
|
|
|
err = crypto_authenc_copy_assoc(req);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
|
|
|
|
|
}
|
|
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
skcipher_request_set_tfm(skreq, enc);
|
|
|
|
|
skcipher_request_set_callback(skreq, aead_request_flags(req),
|
|
|
|
|
crypto_authenc_encrypt_done, req);
|
|
|
|
|
skcipher_request_set_crypt(skreq, src, dst, cryptlen, req->iv);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
err = crypto_skcipher_encrypt(skreq);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
return crypto_authenc_genicv(req, aead_request_flags(req));
|
2007-12-10 16:20:24 +08:00
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static int crypto_authenc_decrypt_tail(struct aead_request *req,
|
|
|
|
|
unsigned int flags)
|
2007-12-10 16:20:24 +08:00
|
|
|
{
|
2015-07-30 17:53:16 +08:00
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
|
|
|
|
struct aead_instance *inst = aead_alg_instance(authenc);
|
|
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
|
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
|
|
|
|
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
|
|
|
|
|
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
|
2016-07-12 13:17:34 +08:00
|
|
|
struct skcipher_request *skreq = (void *)(areq_ctx->tail +
|
|
|
|
|
ictx->reqoff);
|
2015-07-30 17:53:16 +08:00
|
|
|
unsigned int authsize = crypto_aead_authsize(authenc);
|
|
|
|
|
u8 *ihash = ahreq->result + authsize;
|
|
|
|
|
struct scatterlist *src, *dst;
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
scatterwalk_map_and_copy(ihash, req->src, ahreq->nbytes, authsize, 0);
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
if (crypto_memneq(ihash, ahreq->result, authsize))
|
|
|
|
|
return -EBADMSG;
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
src = scatterwalk_ffwd(areq_ctx->src, req->src, req->assoclen);
|
|
|
|
|
dst = src;
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2016-06-29 02:54:43 +08:00
|
|
|
if (req->src != req->dst)
|
2015-07-30 17:53:16 +08:00
|
|
|
dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
skcipher_request_set_tfm(skreq, ctx->enc);
|
2022-01-19 14:58:40 +08:00
|
|
|
skcipher_request_set_callback(skreq, flags,
|
2016-07-12 13:17:34 +08:00
|
|
|
req->base.complete, req->base.data);
|
|
|
|
|
skcipher_request_set_crypt(skreq, src, dst,
|
|
|
|
|
req->cryptlen - authsize, req->iv);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
return crypto_skcipher_decrypt(skreq);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static void authenc_verify_ahash_done(struct crypto_async_request *areq,
|
|
|
|
|
int err)
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
{
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_request *req = areq->data;
|
2009-08-05 17:35:34 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
if (err)
|
|
|
|
|
goto out;
|
2007-12-10 16:20:24 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
err = crypto_authenc_decrypt_tail(req, 0);
|
2009-08-05 17:35:34 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
out:
|
|
|
|
|
authenc_request_complete(req, err);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int crypto_authenc_decrypt(struct aead_request *req)
|
|
|
|
|
{
|
|
|
|
|
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
|
2007-12-04 17:04:21 +08:00
|
|
|
unsigned int authsize = crypto_aead_authsize(authenc);
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst = aead_alg_instance(authenc);
|
|
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
|
|
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
|
|
|
|
struct crypto_ahash *auth = ctx->auth;
|
|
|
|
|
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
|
|
|
|
|
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
|
|
|
|
|
u8 *hash = areq_ctx->tail;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
int err;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
hash = (u8 *)ALIGN((unsigned long)hash + crypto_ahash_alignmask(auth),
|
|
|
|
|
crypto_ahash_alignmask(auth) + 1);
|
2007-12-04 17:04:21 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
ahash_request_set_tfm(ahreq, auth);
|
|
|
|
|
ahash_request_set_crypt(ahreq, req->src, hash,
|
|
|
|
|
req->assoclen + req->cryptlen - authsize);
|
|
|
|
|
ahash_request_set_callback(ahreq, aead_request_flags(req),
|
|
|
|
|
authenc_verify_ahash_done, req);
|
|
|
|
|
|
|
|
|
|
err = crypto_ahash_digest(ahreq);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
return crypto_authenc_decrypt_tail(req, aead_request_flags(req));
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static int crypto_authenc_init_tfm(struct crypto_aead *tfm)
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
{
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst = aead_alg_instance(tfm);
|
|
|
|
|
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
|
|
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(tfm);
|
2009-08-05 17:35:34 +08:00
|
|
|
struct crypto_ahash *auth;
|
2016-07-12 13:17:34 +08:00
|
|
|
struct crypto_skcipher *enc;
|
2018-09-19 10:10:51 +08:00
|
|
|
struct crypto_sync_skcipher *null;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
int err;
|
|
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
auth = crypto_spawn_ahash(&ictx->auth);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (IS_ERR(auth))
|
|
|
|
|
return PTR_ERR(auth);
|
|
|
|
|
|
2016-10-29 00:52:19 +08:00
|
|
|
enc = crypto_spawn_skcipher(&ictx->enc);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
err = PTR_ERR(enc);
|
|
|
|
|
if (IS_ERR(enc))
|
2009-08-05 17:35:34 +08:00
|
|
|
goto err_free_ahash;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2017-12-08 02:56:34 +08:00
|
|
|
null = crypto_get_default_null_skcipher();
|
2015-07-30 17:53:16 +08:00
|
|
|
err = PTR_ERR(null);
|
|
|
|
|
if (IS_ERR(null))
|
|
|
|
|
goto err_free_skcipher;
|
|
|
|
|
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
ctx->auth = auth;
|
|
|
|
|
ctx->enc = enc;
|
2015-07-30 17:53:16 +08:00
|
|
|
ctx->null = null;
|
2010-02-16 20:27:20 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
crypto_aead_set_reqsize(
|
|
|
|
|
tfm,
|
2015-05-11 17:47:53 +08:00
|
|
|
sizeof(struct authenc_request_ctx) +
|
2015-07-30 17:53:16 +08:00
|
|
|
ictx->reqoff +
|
2015-05-11 17:47:53 +08:00
|
|
|
max_t(unsigned int,
|
2015-07-30 17:53:16 +08:00
|
|
|
crypto_ahash_reqsize(auth) +
|
|
|
|
|
sizeof(struct ahash_request),
|
2016-07-12 13:17:34 +08:00
|
|
|
sizeof(struct skcipher_request) +
|
|
|
|
|
crypto_skcipher_reqsize(enc)));
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
err_free_skcipher:
|
2016-07-12 13:17:34 +08:00
|
|
|
crypto_free_skcipher(enc);
|
2009-08-05 17:35:34 +08:00
|
|
|
err_free_ahash:
|
|
|
|
|
crypto_free_ahash(auth);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static void crypto_authenc_exit_tfm(struct crypto_aead *tfm)
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
{
|
2015-07-30 17:53:16 +08:00
|
|
|
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(tfm);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2009-08-05 17:35:34 +08:00
|
|
|
crypto_free_ahash(ctx->auth);
|
2016-07-12 13:17:34 +08:00
|
|
|
crypto_free_skcipher(ctx->enc);
|
2017-12-08 02:56:34 +08:00
|
|
|
crypto_put_default_null_skcipher();
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
static void crypto_authenc_free(struct aead_instance *inst)
|
|
|
|
|
{
|
|
|
|
|
struct authenc_instance_ctx *ctx = aead_instance_ctx(inst);
|
|
|
|
|
|
|
|
|
|
crypto_drop_skcipher(&ctx->enc);
|
|
|
|
|
crypto_drop_ahash(&ctx->auth);
|
|
|
|
|
kfree(inst);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int crypto_authenc_create(struct crypto_template *tmpl,
|
|
|
|
|
struct rtattr **tb)
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
{
|
2020-01-03 11:58:45 +08:00
|
|
|
u32 mask;
|
2015-07-30 17:53:16 +08:00
|
|
|
struct aead_instance *inst;
|
2020-01-03 11:58:55 +08:00
|
|
|
struct authenc_instance_ctx *ctx;
|
2009-08-05 17:35:34 +08:00
|
|
|
struct hash_alg_common *auth;
|
|
|
|
|
struct crypto_alg *auth_base;
|
2016-07-12 13:17:34 +08:00
|
|
|
struct skcipher_alg *enc;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
int err;
|
|
|
|
|
|
2020-07-10 14:20:38 +08:00
|
|
|
err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
2020-01-03 11:58:45 +08:00
|
|
|
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
|
|
|
|
|
if (!inst)
|
2020-01-03 11:58:55 +08:00
|
|
|
return -ENOMEM;
|
2015-07-30 17:53:16 +08:00
|
|
|
ctx = aead_instance_ctx(inst);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2020-01-03 11:58:55 +08:00
|
|
|
err = crypto_grab_ahash(&ctx->auth, aead_crypto_instance(inst),
|
|
|
|
|
crypto_attr_alg_name(tb[1]), 0, mask);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
|
|
|
|
goto err_free_inst;
|
2020-01-03 11:58:55 +08:00
|
|
|
auth = crypto_spawn_ahash_alg(&ctx->auth);
|
|
|
|
|
auth_base = &auth->base;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2020-01-03 11:58:45 +08:00
|
|
|
err = crypto_grab_skcipher(&ctx->enc, aead_crypto_instance(inst),
|
2020-01-03 11:58:55 +08:00
|
|
|
crypto_attr_alg_name(tb[2]), 0, mask);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
if (err)
|
2020-01-03 11:58:55 +08:00
|
|
|
goto err_free_inst;
|
2016-07-12 13:17:34 +08:00
|
|
|
enc = crypto_spawn_skcipher_alg(&ctx->enc);
|
2007-12-17 20:12:49 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
ctx->reqoff = ALIGN(2 * auth->digestsize + auth_base->cra_alignmask,
|
|
|
|
|
auth_base->cra_alignmask + 1);
|
|
|
|
|
|
2007-12-17 20:12:49 +08:00
|
|
|
err = -ENAMETOOLONG;
|
2015-07-30 17:53:16 +08:00
|
|
|
if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
|
2016-07-12 13:17:34 +08:00
|
|
|
"authenc(%s,%s)", auth_base->cra_name,
|
|
|
|
|
enc->base.cra_name) >=
|
2007-12-17 20:12:49 +08:00
|
|
|
CRYPTO_MAX_ALG_NAME)
|
2020-01-03 11:58:55 +08:00
|
|
|
goto err_free_inst;
|
2007-12-17 20:12:49 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
|
2009-08-05 17:35:34 +08:00
|
|
|
"authenc(%s,%s)", auth_base->cra_driver_name,
|
2016-07-12 13:17:34 +08:00
|
|
|
enc->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
|
2020-01-03 11:58:55 +08:00
|
|
|
goto err_free_inst;
|
2007-12-17 20:12:49 +08:00
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
inst->alg.base.cra_priority = enc->base.cra_priority * 10 +
|
2015-07-30 17:53:16 +08:00
|
|
|
auth_base->cra_priority;
|
2016-07-12 13:17:34 +08:00
|
|
|
inst->alg.base.cra_blocksize = enc->base.cra_blocksize;
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->alg.base.cra_alignmask = auth_base->cra_alignmask |
|
2016-07-12 13:17:34 +08:00
|
|
|
enc->base.cra_alignmask;
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->alg.base.cra_ctxsize = sizeof(struct crypto_authenc_ctx);
|
|
|
|
|
|
2016-07-12 13:17:34 +08:00
|
|
|
inst->alg.ivsize = crypto_skcipher_alg_ivsize(enc);
|
|
|
|
|
inst->alg.chunksize = crypto_skcipher_alg_chunksize(enc);
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->alg.maxauthsize = auth->digestsize;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->alg.init = crypto_authenc_init_tfm;
|
|
|
|
|
inst->alg.exit = crypto_authenc_exit_tfm;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->alg.setkey = crypto_authenc_setkey;
|
|
|
|
|
inst->alg.encrypt = crypto_authenc_encrypt;
|
|
|
|
|
inst->alg.decrypt = crypto_authenc_decrypt;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
inst->free = crypto_authenc_free;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
|
2015-07-30 17:53:16 +08:00
|
|
|
err = aead_register_instance(tmpl, inst);
|
2020-01-03 11:58:55 +08:00
|
|
|
if (err) {
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
err_free_inst:
|
2020-01-03 11:58:55 +08:00
|
|
|
crypto_authenc_free(inst);
|
|
|
|
|
}
|
|
|
|
|
return err;
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct crypto_template crypto_authenc_tmpl = {
|
|
|
|
|
.name = "authenc",
|
2015-07-30 17:53:16 +08:00
|
|
|
.create = crypto_authenc_create,
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
.module = THIS_MODULE,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int __init crypto_authenc_module_init(void)
|
|
|
|
|
{
|
|
|
|
|
return crypto_register_template(&crypto_authenc_tmpl);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void __exit crypto_authenc_module_exit(void)
|
|
|
|
|
{
|
|
|
|
|
crypto_unregister_template(&crypto_authenc_tmpl);
|
|
|
|
|
}
|
|
|
|
|
|
2019-04-12 12:57:42 +08:00
|
|
|
subsys_initcall(crypto_authenc_module_init);
|
[CRYPTO] aead: Add authenc
This patch adds the authenc algorithm which constructs an AEAD algorithm
from an asynchronous block cipher and a hash. The construction is done
by concatenating the encrypted result from the cipher with the output
from the hash, as is used by the IPsec ESP protocol.
The authenc algorithm exists as a template with four parameters:
authenc(auth, authsize, enc, enckeylen).
The authentication algorithm, the authentication size (i.e., truncating
the output of the authentication algorithm), the encryption algorithm,
and the encryption key length. Both the size field and the key length
field are in bytes. For example, AES-128 with SHA1-HMAC would be
represented by
authenc(hmac(sha1), 12, cbc(aes), 16)
The key for the authenc algorithm is the concatenation of the keys for
the authentication algorithm with the encryption algorithm. For the
above example, if a key of length 36 bytes is given, then hmac(sha1)
would receive the first 20 bytes while the last 16 would be given to
cbc(aes).
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2007-08-30 16:24:15 +08:00
|
|
|
module_exit(crypto_authenc_module_exit);
|
|
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
|
MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
|
2014-11-25 08:32:38 +08:00
|
|
|
MODULE_ALIAS_CRYPTO("authenc");
|