* [PATCH v2] crypto: arm/chacha-neon - add missing counter increment
@ 2020-12-13 14:39 Ard Biesheuvel
2020-12-14 2:23 ` Eric Biggers
2021-01-02 22:06 ` Herbert Xu
0 siblings, 2 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2020-12-13 14:39 UTC (permalink / raw)
To: linux-crypto; +Cc: herbert, ebiggers, Ard Biesheuvel
Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block
size multiples") refactored the chacha block handling in the glue code in
a way that may result in the counter increment to be omitted when calling
chacha_block_xor_neon() to process a full block. This violates the skcipher
API, which requires that the output IV is suitable for handling more input
as long as the preceding input has been presented in round multiples of the
block size. Also, the same code is exposed via the chacha library interface
whose callers may actually rely on this increment to occur even for final
blocks that are smaller than the chacha block size.
So increment the counter after calling chacha_block_xor_neon().
Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples")
Reported-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
v2: - use ++ instead of += 1
- make note in the commit log of the fact that the library API needs the
increment to occur in all cases, not only for final blocks whose size
is exactly the block size
arch/arm/crypto/chacha-glue.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/crypto/chacha-glue.c b/arch/arm/crypto/chacha-glue.c
index 7b5cf8430c6d..cdde8fd01f8f 100644
--- a/arch/arm/crypto/chacha-glue.c
+++ b/arch/arm/crypto/chacha-glue.c
@@ -60,6 +60,7 @@ static void chacha_doneon(u32 *state, u8 *dst, const u8 *src,
chacha_block_xor_neon(state, d, s, nrounds);
if (d != dst)
memcpy(dst, buf, bytes);
+ state[12]++;
}
}
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] crypto: arm/chacha-neon - add missing counter increment
2020-12-13 14:39 [PATCH v2] crypto: arm/chacha-neon - add missing counter increment Ard Biesheuvel
@ 2020-12-14 2:23 ` Eric Biggers
2020-12-14 2:25 ` Herbert Xu
2021-01-02 22:06 ` Herbert Xu
1 sibling, 1 reply; 6+ messages in thread
From: Eric Biggers @ 2020-12-14 2:23 UTC (permalink / raw)
To: Ard Biesheuvel; +Cc: linux-crypto, herbert
On Sun, Dec 13, 2020 at 03:39:29PM +0100, Ard Biesheuvel wrote:
> This violates the skcipher API, which requires that the output IV is suitable
> for handling more input as long as the preceding input has been presented in
> round multiples of the block size.
This part doesn't seem to be true, since the chacha implementations don't
implement the "output IV" thing. It's only cbc and ctr that do (or at least
those are the only algorithms it's tested for).
- Eric
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] crypto: arm/chacha-neon - add missing counter increment
2020-12-14 2:23 ` Eric Biggers
@ 2020-12-14 2:25 ` Herbert Xu
2020-12-14 20:39 ` Eric Biggers
0 siblings, 1 reply; 6+ messages in thread
From: Herbert Xu @ 2020-12-14 2:25 UTC (permalink / raw)
To: Eric Biggers; +Cc: Ard Biesheuvel, linux-crypto
On Sun, Dec 13, 2020 at 06:23:06PM -0800, Eric Biggers wrote:
>
> This part doesn't seem to be true, since the chacha implementations don't
> implement the "output IV" thing. It's only cbc and ctr that do (or at least
> those are the only algorithms it's tested for).
If this algorithm can be used through algif_skcipher then it will
be making use of the output IV.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] crypto: arm/chacha-neon - add missing counter increment
2020-12-14 2:25 ` Herbert Xu
@ 2020-12-14 20:39 ` Eric Biggers
2020-12-23 8:53 ` Herbert Xu
0 siblings, 1 reply; 6+ messages in thread
From: Eric Biggers @ 2020-12-14 20:39 UTC (permalink / raw)
To: Herbert Xu; +Cc: Ard Biesheuvel, linux-crypto
On Mon, Dec 14, 2020 at 01:25:20PM +1100, Herbert Xu wrote:
> On Sun, Dec 13, 2020 at 06:23:06PM -0800, Eric Biggers wrote:
> >
> > This part doesn't seem to be true, since the chacha implementations don't
> > implement the "output IV" thing. It's only cbc and ctr that do (or at least
> > those are the only algorithms it's tested for).
>
> If this algorithm can be used through algif_skcipher then it will
> be making use of the output IV.
>
That doesn't make sense, given that most algorithms don't implement it...
- Eric
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] crypto: arm/chacha-neon - add missing counter increment
2020-12-13 14:39 [PATCH v2] crypto: arm/chacha-neon - add missing counter increment Ard Biesheuvel
2020-12-14 2:23 ` Eric Biggers
@ 2021-01-02 22:06 ` Herbert Xu
1 sibling, 0 replies; 6+ messages in thread
From: Herbert Xu @ 2021-01-02 22:06 UTC (permalink / raw)
To: Ard Biesheuvel; +Cc: linux-crypto, ebiggers
On Sun, Dec 13, 2020 at 03:39:29PM +0100, Ard Biesheuvel wrote:
> Commit 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block
> size multiples") refactored the chacha block handling in the glue code in
> a way that may result in the counter increment to be omitted when calling
> chacha_block_xor_neon() to process a full block. This violates the skcipher
> API, which requires that the output IV is suitable for handling more input
> as long as the preceding input has been presented in round multiples of the
> block size. Also, the same code is exposed via the chacha library interface
> whose callers may actually rely on this increment to occur even for final
> blocks that are smaller than the chacha block size.
>
> So increment the counter after calling chacha_block_xor_neon().
>
> Fixes: 86cd97ec4b943af3 ("crypto: arm/chacha-neon - optimize for non-block size multiples")
> Reported-by: Eric Biggers <ebiggers@kernel.org>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> v2: - use ++ instead of += 1
> - make note in the commit log of the fact that the library API needs the
> increment to occur in all cases, not only for final blocks whose size
> is exactly the block size
>
> arch/arm/crypto/chacha-glue.c | 1 +
> 1 file changed, 1 insertion(+)
Patch applied. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-02 22:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-13 14:39 [PATCH v2] crypto: arm/chacha-neon - add missing counter increment Ard Biesheuvel
2020-12-14 2:23 ` Eric Biggers
2020-12-14 2:25 ` Herbert Xu
2020-12-14 20:39 ` Eric Biggers
2020-12-23 8:53 ` Herbert Xu
2021-01-02 22:06 ` Herbert Xu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.