linux-kernel - Re: [BUGFIX] crypto: Fix ctr(aes) testing by specifying geniv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Aug 2009 23:02:41 +1000
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Huang Ying <ying.huang@...el.com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>
Subject: Re: [BUGFIX] crypto: Fix ctr(aes) testing by specifying geniv

On Thu, Aug 13, 2009 at 11:12:53PM +1000, Herbert Xu wrote:
> 
> Actually we can't use seqiv on raw counter mode because it cannot
> guarantee IV uniqueness.  I think reverting to chainiv is the safer
> option.

In fact this is needed by all stream ciphers, not just ctr.

commit 63b5ac286d5d7f668da537cc53a552578f7674a2
Author: Herbert Xu <herbert@...dor.apana.org.au>
Date:   Fri Aug 14 22:55:35 2009 +1000

    crypto: blkcipher - Do not use eseqiv on stream ciphers
    
    Recently we switched to using eseqiv on SMP machines in preference
    over chainiv.  However, eseqiv does not support stream ciphers so
    they should still default to chainiv.
    
    This patch applies the same check as done by eseqiv to weed out
    the stream ciphers.  In particular, all algorithms where the IV
    size is not equal to the block size will now default to chainiv.
    
    Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>

diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 03fb5fa..f6f0833 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -183,6 +183,12 @@ EXPORT_SYMBOL_GPL(crypto_givcipher_type);
 
 const char *crypto_default_geniv(const struct crypto_alg *alg)
 {
+	if (((alg->cra_flags & CRYPTO_ALG_TYPE_MASK) ==
+	     CRYPTO_ALG_TYPE_BLKCIPHER ? alg->cra_blkcipher.ivsize :
+					 alg->cra_ablkcipher.ivsize) !=
+	    alg->cra_blocksize)
+		return "chainiv";
+
 	return alg->cra_flags & CRYPTO_ALG_ASYNC ?
 	       "eseqiv" : skcipher_default_geniv;
 }

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/