linux-kernel - Re: [PATCH] crypto: aesni: add setkey for driver-gcm-aes-aesni

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150120040356.GA11419@gondor.apana.org.au>
Date:	Tue, 20 Jan 2015 15:03:56 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Stephan Mueller <smueller@...onox.de>
Cc:	Tadeusz Struk <tadeusz.struk@...el.com>,
	linux-crypto@...r.kernel.org, 'LKML' <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] crypto: aesni: add setkey for driver-gcm-aes-aesni

On Tue, Jan 20, 2015 at 04:54:44AM +0100, Stephan Mueller wrote:
>
> How would the fail manifest itself? If algif_aead would be present, user 
> space could use the __driver implementation regardless of a setkey or 
> authsize callback by simply calling encrypt/decrypt. Would the error be 
> limited to that caller only?

For user-space it'll never fail.  However, for kernel users such
as IPsec it'll fail if the interrupt occurs while in a thread
that's already using the FPU.

But you're right, we probably shouldn't allow these algorithms to
be directly exported to user-space at all, even when they do possess
a setkey function.  In fact, we should ban them from other places
where they might be used too, such as through IPsec.

I'll try to write something up to do this

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/