linux-kernel - [RFC] crypto: xts - limit accepted key length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20200302081629.17831-1-andrei.botila@oss.nxp.com>
Date:   Mon,  2 Mar 2020 10:16:29 +0200
From:   Andrei Botila <andrei.botila@....nxp.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>
Cc:     linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [RFC] crypto: xts - limit accepted key length

From: Andrei Botila <andrei.botila@....com>

Currently in XTS generic implementation the valid key length is
repesented by any length which is even. This is a deviation from
the XTS-AES standard (IEEE 1619-2007) which allows keys equal
to {2 x 16B, 2 x 32B} that correspond to underlying XTS-AES-{128, 256}
algorithm. XTS-AES-192 is not supported as mentioned in commit
b66ad0b7aa92 ("crypto: tcrypt - remove AES-XTS-192 speed tests")) or
any other length beside these two specified.

If this modification is accepted then other ciphers that use XTS mode
will have to be modified (camellia, cast6, serpent, twofish).

Signed-off-by: Andrei Botila <andrei.botila@....com>
---
 include/crypto/xts.h | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/crypto/xts.h b/include/crypto/xts.h
index 0f8dba69feb4..26e764a5ae46 100644
--- a/include/crypto/xts.h
+++ b/include/crypto/xts.h
@@ -4,6 +4,7 @@
 
 #include <crypto/b128ops.h>
 #include <crypto/internal/skcipher.h>
+#include <crypto/aes.h>
 #include <linux/fips.h>
 
 #define XTS_BLOCK_SIZE 16
@@ -12,10 +13,10 @@ static inline int xts_check_key(struct crypto_tfm *tfm,
 				const u8 *key, unsigned int keylen)
 {
 	/*
-	 * key consists of keys of equal size concatenated, therefore
-	 * the length must be even.
+	 * key consists of keys of equal size concatenated, possible
+	 * values are 32 or 64 bytes.
 	 */
-	if (keylen % 2)
+	if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE)
 		return -EINVAL;
 
 	/* ensure that the AES and tweak key are not identical */
@@ -29,10 +30,10 @@ static inline int xts_verify_key(struct crypto_skcipher *tfm,
 				 const u8 *key, unsigned int keylen)
 {
 	/*
-	 * key consists of keys of equal size concatenated, therefore
-	 * the length must be even.
+	 * key consists of keys of equal size concatenated, possible
+	 * values are 32 or 64 bytes.
 	 */
-	if (keylen % 2)
+	if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE)
 		return -EINVAL;
 
 	/* ensure that the AES and tweak key are not identical */
-- 
2.17.1