| Message ID | 20201213143929.7088-1-ardb@kernel.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] crypto: arm/chacha-neon - add missing counter increment | expand |
On Sun, Dec 13, 2020 at 03:39:29PM +0100, Ard Biesheuvel wrote: > This violates the skcipher API, which requires that the output IV is suitable > for handling more input as long as the preceding input has been presented in > round multiples of the block size. This part doesn't seem to be true, since the chacha implementations don't implement the "output IV" thing. It's only cbc and ctr that do (or at least those are the only algorithms it's tested for). - Eric
On Sun, Dec 13, 2020 at 06:23:06PM -0800, Eric Biggers wrote: > > This part doesn't seem to be true, since the chacha implementations don't > implement the "output IV" thing. It's only cbc and ctr that do (or at least > those are the only algorithms it's tested for). If this algorithm can be used through algif_skcipher then it will be making use of the output IV. Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
On Mon, Dec 14, 2020 at 01:25:20PM +1100, Herbert Xu wrote: > On Sun, Dec 13, 2020 at 06:23:06PM -0800, Eric Biggers wrote: > > > > This part doesn't seem to be true, since the chacha implementations don't > > implement the "output IV" thing. It's only cbc and ctr that do (or at least > > those are the only algorithms it's tested for). > > If this algorithm can be used through algif_skcipher then it will > be making use of the output IV. > That doesn't make sense, given that most algorithms don't implement it... - Eric
On Mon, Dec 14, 2020 at 12:39:29PM -0800, Eric Biggers wrote: > > That doesn't make sense, given that most algorithms don't implement it... It doesn't matter for chacha, but it's still true for the Crypto API in general. Yes I know that lots of algorithms get it wrong, but it is on my list of things to fix. Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
On Sun, Dec 13, 2020 at 03:39:29PM +0100, Ard Biesheuvel wrote: > Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block > size multiples") refactored the chacha block handling in the glue code in > a way that may result in the counter increment to be omitted when calling > chacha_block_xor_neon() to process a full block. This violates the skcipher > API, which requires that the output IV is suitable for handling more input > as long as the preceding input has been presented in round multiples of the > block size. Also, the same code is exposed via the chacha library interface > whose callers may actually rely on this increment to occur even for final > blocks that are smaller than the chacha block size. > > So increment the counter after calling chacha_block_xor_neon(). > > Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples") > Reported-by: Eric Biggers <ebiggers@kernel.org> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org> > --- > v2: - use ++ instead of += 1 > - make note in the commit log of the fact that the library API needs the > increment to occur in all cases, not only for final blocks whose size > is exactly the block size > > arch/arm/crypto/chacha-glue.c | 1 + > 1 file changed, 1 insertion(+) Patch applied. Thanks. -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
diff --git a/arch/arm/crypto/chacha-glue.c b/arch/arm/crypto/chacha-glue.c index 7b5cf8430c6d..cdde8fd01f8f 100644 --- a/arch/arm/crypto/chacha-glue.c +++ b/arch/arm/crypto/chacha-glue.c @@ -60,6 +60,7 @@ static void chacha_doneon(u32 *state, u8 *dst, const u8 *src, chacha_block_xor_neon(state, d, s, nrounds); if (d != dst) memcpy(dst, buf, bytes); + state[12]++; } }
Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples") refactored the chacha block handling in the glue code in a way that may result in the counter increment to be omitted when calling chacha_block_xor_neon() to process a full block. This violates the skcipher API, which requires that the output IV is suitable for handling more input as long as the preceding input has been presented in round multiples of the block size. Also, the same code is exposed via the chacha library interface whose callers may actually rely on this increment to occur even for final blocks that are smaller than the chacha block size. So increment the counter after calling chacha_block_xor_neon(). Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples") Reported-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> --- v2: - use ++ instead of += 1 - make note in the commit log of the fact that the library API needs the increment to occur in all cases, not only for final blocks whose size is exactly the block size arch/arm/crypto/chacha-glue.c | 1 + 1 file changed, 1 insertion(+)