[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <32088.1459528276@warthog.procyon.org.uk>
Date: Fri, 01 Apr 2016 17:31:16 +0100
From: David Howells <dhowells@...hat.com>
To: Kirill Marinushkin <k.marinushkin@...il.com>
Cc: dhowells@...hat.com, keyrings@...r.kernel.org,
linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Security: Keys: Big keys stored encrypted
Kirill Marinushkin <k.marinushkin@...il.com> wrote:
> +enum {
> + ENC,
> + DEC,
> +};
"enum big_key_mode" and use it as a parameter type to big_key_crypt().
Also BIG_KEY_ENC, BIG_KEY_DEC. Please use prefixes consistently.
> +static const char *rng_name = "stdrng";
> +
> +/*
> + * Algorithm name for big_key data encryption
> + */
> +static const char *alg_name = "ecb(aes)";
Use const char arrays not const char pointers as that saves on a pointer
storage.
> +/*
> + * Aligned data length of big_key encryption
> + */
> +#define ALIGNED_LEN(l) (l + ENC_BLOCK_SIZE - l % ENC_BLOCK_SIZE)
Surely there's a crypto thing for this? The block size and key size ought to
be functions of the algorithm you select rather than being hardcoded.
> +static int gen_enckey(u8 *key)
big_key_gen_enckey().
> +{
> + int ret = -EINVAL;
> + struct crypto_rng *rng = NULL;
> +
> + rng = crypto_alloc_rng(rng_name, 0, 0);
> + if (IS_ERR(rng))
> + return -EFAULT;
> +
> + ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
> +
> + if (!ret)
> + ret = crypto_rng_get_bytes(rng, key, ENC_KEY_SIZE);
> +
> + if (rng)
rng can be NULL here?!
> +static int big_crypt(u8 op, u8 *data, size_t datalen, u8 *key)
big_key_crypt().
Powered by blists - more mailing lists