From: Milan Broz <gmazyland@gmail.com>
To: Herbert Xu <herbert@gondor.apana.org.au>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Horia Geanta <horia.geanta@nxp.com>,
"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
"dm-devel@redhat.com" <dm-devel@redhat.com>
Subject: Re: xts fuzz testing and lack of ciphertext stealing support
Date: Thu, 18 Jul 2019 09:40:11 +0200 [thread overview]
Message-ID: <36e78459-1594-6d19-0ab4-95b03a6de036@gmail.com> (raw)
In-Reply-To: <20190718072154.m2umem24x4grbf6w@gondor.apana.org.au>
On 18/07/2019 09:21, Herbert Xu wrote:
> On Thu, Jul 18, 2019 at 09:15:39AM +0200, Ard Biesheuvel wrote:
>>
>> Not just the generic implementation: there are numerous synchronous
>> and asynchronous implementations of xts(aes) in the kernel that would
>> have to be fixed, while there are no in-kernel users that actually
>> rely on CTS. Also, in the cbc case, we support CTS by wrapping it into
>> another template, i.e., cts(cbc(aes)).
>>
>> So retroactively redefining what xts(...) means seems like a bad idea
>> to me. If we want to support XTS ciphertext stealing for the benefit
>> of userland, let's do so via the existing cts template, and add
>> support for wrapping XTS to it.
>
> XTS without stealing should be renamed as XEX. Sure you can then
> wrap it inside cts to form xts but the end result needs to be called
> xts.
While I fully agree here from the technical point of view,
academically XEX, XEX* is a different mode.
It would create even more confusion.
Couldn't resist, but this is a nice example of what happens when academic,
standardization, and reality meets in one place :)
XTS is already implemented in gcrypt and OpenSSL.
IMO all the implementation should be exactly the same.
I agree with Herbert that the proper way is to implement ciphertext stealing.
Otherwise, it is just incomplete implementation, not a redefining XTS mode!
See the reference in generic code - the 3rd line - link to the IEEE standard.
We do not implement it properly - for more than 12 years!
Reality check - nobody in block layer needs ciphertext stealing, we are always
aligned to block. AF_ALG is a different story, though.
Milan
WARNING: multiple messages have this Message-ID (diff)
From: Milan Broz <gmazyland@gmail.com>
To: Herbert Xu <herbert@gondor.apana.org.au>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: "dm-devel@redhat.com" <dm-devel@redhat.com>,
"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
Horia Geanta <horia.geanta@nxp.com>
Subject: Re: xts fuzz testing and lack of ciphertext stealing support
Date: Thu, 18 Jul 2019 09:40:11 +0200 [thread overview]
Message-ID: <36e78459-1594-6d19-0ab4-95b03a6de036@gmail.com> (raw)
In-Reply-To: <20190718072154.m2umem24x4grbf6w@gondor.apana.org.au>
On 18/07/2019 09:21, Herbert Xu wrote:
> On Thu, Jul 18, 2019 at 09:15:39AM +0200, Ard Biesheuvel wrote:
>>
>> Not just the generic implementation: there are numerous synchronous
>> and asynchronous implementations of xts(aes) in the kernel that would
>> have to be fixed, while there are no in-kernel users that actually
>> rely on CTS. Also, in the cbc case, we support CTS by wrapping it into
>> another template, i.e., cts(cbc(aes)).
>>
>> So retroactively redefining what xts(...) means seems like a bad idea
>> to me. If we want to support XTS ciphertext stealing for the benefit
>> of userland, let's do so via the existing cts template, and add
>> support for wrapping XTS to it.
>
> XTS without stealing should be renamed as XEX. Sure you can then
> wrap it inside cts to form xts but the end result needs to be called
> xts.
While I fully agree here from the technical point of view,
academically XEX, XEX* is a different mode.
It would create even more confusion.
Couldn't resist, but this is a nice example of what happens when academic,
standardization, and reality meets in one place :)
XTS is already implemented in gcrypt and OpenSSL.
IMO all the implementation should be exactly the same.
I agree with Herbert that the proper way is to implement ciphertext stealing.
Otherwise, it is just incomplete implementation, not a redefining XTS mode!
See the reference in generic code - the 3rd line - link to the IEEE standard.
We do not implement it properly - for more than 12 years!
Reality check - nobody in block layer needs ciphertext stealing, we are always
aligned to block. AF_ALG is a different story, though.
Milan
next prev parent reply other threads:[~2019-07-18 7:40 UTC|newest]
Thread overview: 110+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-16 17:46 xts fuzz testing and lack of ciphertext stealing support Horia Geanta
2019-07-16 22:16 ` Eric Biggers
2019-07-17 17:09 ` Horia Geanta
2019-07-17 17:09 ` Horia Geanta
2019-07-17 17:28 ` Eric Biggers
2019-07-17 17:28 ` Eric Biggers
2019-07-17 18:08 ` Ard Biesheuvel
2019-07-18 6:52 ` Herbert Xu
2019-07-18 6:52 ` Herbert Xu
2019-07-18 7:15 ` Ard Biesheuvel
2019-07-18 7:15 ` Ard Biesheuvel
2019-07-18 7:21 ` Herbert Xu
2019-07-18 7:21 ` Herbert Xu
2019-07-18 7:28 ` Ard Biesheuvel
2019-07-18 7:28 ` Ard Biesheuvel
2019-07-18 7:50 ` Herbert Xu
2019-07-18 7:50 ` Herbert Xu
2019-07-18 7:40 ` Milan Broz [this message]
2019-07-18 7:40 ` Milan Broz
2019-07-18 10:40 ` Pascal Van Leeuwen
2019-07-18 11:19 ` Milan Broz
2019-07-18 11:19 ` Milan Broz
2019-07-18 15:27 ` Herbert Xu
2019-07-18 15:27 ` Herbert Xu
2019-07-20 6:58 ` [dm-devel] " Eric Biggers
2019-07-20 6:58 ` Eric Biggers
2019-07-20 7:35 ` [dm-devel] " Milan Broz
2019-07-20 7:35 ` Milan Broz
2019-07-20 10:13 ` Markus
2019-07-21 9:50 ` [dm-devel] " Ard Biesheuvel
2019-07-21 9:50 ` Ard Biesheuvel
2019-07-22 9:44 ` [dm-devel] " Pascal Van Leeuwen
2019-07-22 16:43 ` Ard Biesheuvel
2019-07-22 16:43 ` Ard Biesheuvel
2019-07-22 22:46 ` [dm-devel] " Pascal Van Leeuwen
2019-07-24 12:23 ` Pascal Van Leeuwen
2019-07-24 12:50 ` Pascal Van Leeuwen
2019-07-24 16:10 ` Pascal Van Leeuwen
2019-07-25 6:22 ` Ard Biesheuvel
2019-07-25 6:22 ` Ard Biesheuvel
2019-07-25 7:49 ` [dm-devel] " Pascal Van Leeuwen
2019-07-25 8:01 ` Ard Biesheuvel
2019-07-25 8:01 ` Ard Biesheuvel
2019-07-26 10:31 ` [dm-devel] " Pascal Van Leeuwen
2019-07-26 19:59 ` Horia Geanta
2019-07-26 19:59 ` Horia Geanta
2019-07-26 21:43 ` [dm-devel] " Pascal Van Leeuwen
2019-07-27 5:39 ` Ard Biesheuvel
2019-07-27 5:39 ` Ard Biesheuvel
2019-07-27 12:56 ` [dm-devel] " Pascal Van Leeuwen
2019-07-27 16:04 ` Milan Broz
2019-07-27 16:04 ` Milan Broz
2019-08-04 8:36 ` [dm-devel] " Ard Biesheuvel
2019-08-04 8:36 ` Ard Biesheuvel
[not found] ` <20f4832e-e3af-e3c2-d946-13bf8c367a60@nxp.com>
2019-08-07 15:51 ` [dm-devel] " Horia Geanta
2019-08-07 15:51 ` Horia Geanta
2019-08-07 20:57 ` [dm-devel] " Pascal Van Leeuwen
2019-08-08 14:50 ` Horia Geanta
2019-08-08 14:50 ` Horia Geanta
2019-08-09 8:35 ` [dm-devel] " Pascal Van Leeuwen
2019-08-08 13:43 ` Pascal Van Leeuwen
2019-08-08 18:01 ` Horia Geanta
2019-08-08 18:01 ` Horia Geanta
2019-08-09 2:48 ` [dm-devel] " Herbert Xu
2019-08-09 2:48 ` Herbert Xu
2019-08-09 6:45 ` [dm-devel] " Ard Biesheuvel
2019-08-09 6:45 ` Ard Biesheuvel
2019-08-09 7:44 ` [dm-devel] " Horia Geanta
2019-08-09 7:44 ` Horia Geanta
2019-08-09 17:49 ` [dm-devel] " Ard Biesheuvel
2019-08-09 17:49 ` Ard Biesheuvel
2019-08-09 20:57 ` [dm-devel] " Pascal Van Leeuwen
2019-08-10 4:39 ` Ard Biesheuvel
2019-08-10 4:39 ` Ard Biesheuvel
2019-08-11 11:12 ` [dm-devel] " Milan Broz
2019-08-11 11:12 ` Milan Broz
2019-08-11 20:34 ` [dm-devel] " Eric Biggers
2019-08-11 20:34 ` Eric Biggers
2019-08-11 21:39 ` [dm-devel] " Pascal Van Leeuwen
2019-08-11 21:29 ` Pascal Van Leeuwen
2019-08-12 4:51 ` Herbert Xu
2019-08-12 4:51 ` Herbert Xu
2019-08-11 21:15 ` [dm-devel] " Pascal Van Leeuwen
2019-08-11 22:24 ` Ard Biesheuvel
2019-08-11 22:24 ` Ard Biesheuvel
2019-08-12 1:04 ` [dm-devel] " Pascal Van Leeuwen
2019-07-18 15:29 ` Herbert Xu
2019-07-18 15:29 ` Herbert Xu
2019-07-18 15:43 ` Pascal Van Leeuwen
2019-07-18 15:51 ` Herbert Xu
2019-07-18 15:51 ` Herbert Xu
2019-07-18 16:19 ` Ard Biesheuvel
2019-07-18 16:19 ` Ard Biesheuvel
2019-07-18 16:22 ` Herbert Xu
2019-07-18 16:22 ` Herbert Xu
2019-07-18 17:03 ` Pascal Van Leeuwen
2019-07-19 5:34 ` Ard Biesheuvel
2019-07-19 5:34 ` Ard Biesheuvel
2019-07-19 7:29 ` Pascal Van Leeuwen
2019-07-19 17:14 ` Ard Biesheuvel
2019-07-19 17:14 ` Ard Biesheuvel
2019-07-19 20:07 ` Pascal Van Leeuwen
2019-07-19 7:29 ` Pascal Van Leeuwen
2019-07-18 17:03 ` Pascal Van Leeuwen
2019-07-18 16:35 ` Pascal Van Leeuwen
2019-07-19 1:47 ` Herbert Xu
2019-07-19 1:47 ` Herbert Xu
2019-07-18 16:35 ` Pascal Van Leeuwen
2019-07-18 15:43 ` Pascal Van Leeuwen
2019-07-18 10:40 ` Pascal Van Leeuwen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=36e78459-1594-6d19-0ab4-95b03a6de036@gmail.com \
--to=gmazyland@gmail.com \
--cc=ard.biesheuvel@linaro.org \
--cc=dm-devel@redhat.com \
--cc=herbert@gondor.apana.org.au \
--cc=horia.geanta@nxp.com \
--cc=linux-crypto@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.