linux-kernel - Re: [PATCH] crypto: padlock-sha

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251118040244.GB3993@sol>
Date: Mon, 17 Nov 2025 20:02:44 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: Herbert Xu <herbert@...dor.apana.org.au>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	larryw3i <larryw3i@...h.net>, stable@...r.kernel.org,
	AlanSong-oc@...oxin.com, CobeChen@...oxin.com,
	GeorgeXue@...oxin.com, HansHu@...oxin.com, LeoLiu-oc@...oxin.com,
	TonyWWang-oc@...oxin.com, YunShen@...oxin.com
Subject: Re: [PATCH] crypto: padlock-sha - Disable broken driver

On Tue, Nov 18, 2025 at 11:34:50AM +0800, Herbert Xu wrote:
> On Sun, Nov 16, 2025 at 10:39:26AM -0800, Eric Biggers wrote:
> > This driver is known broken, as it computes the wrong SHA-1 and SHA-256
> > hashes.  Correctness needs to be the first priority for cryptographic
> > code.  Just disable it, allowing the standard (and actually correct)
> > SHA-1 and SHA-256 implementations to take priority.
> 
> ...
>  
> > diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
> > index a6688d54984c..16ea3e741350 100644
> > --- a/drivers/crypto/Kconfig
> > +++ b/drivers/crypto/Kconfig
> > @@ -38,11 +38,11 @@ config CRYPTO_DEV_PADLOCK_AES
> >  	  If unsure say M. The compiled module will be
> >  	  called padlock-aes.
> >  
> >  config CRYPTO_DEV_PADLOCK_SHA
> >  	tristate "PadLock driver for SHA1 and SHA256 algorithms"
> > -	depends on CRYPTO_DEV_PADLOCK
> > +	depends on CRYPTO_DEV_PADLOCK && BROKEN
> 
> It's only broken on ZHAOXIN, so this should be conditional on
> CPU_SUP_ZHAOXIN.
> 

I.e., it's apparently broken on at least every CPU that has this
hardware that's been released in the last 14 years.  How confident are
you that it still works on VIA CPUs from 2011 and earlier and is worth
maintaining for them?

- Eric