From: Eric Biggers <ebiggers@kernel.org>
To: Denis Kenzior <denkenz@gmail.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Marcel Holtmann <marcel@holtmann.org>,
"open list:HARDWARE RANDOM NUMBER GENERATOR CORE"
<linux-crypto@vger.kernel.org>,
Herbert Xu <herbert@gondor.apana.org.au>,
Johannes Berg <johannes@sipsolutions.net>,
"open list:NFC SUBSYSTEM" <linux-wireless@vger.kernel.org>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [RFC PATCH 0/3] move WEP implementation to skcipher interface
Date: Fri, 7 Jun 2019 14:41:20 -0700 [thread overview]
Message-ID: <20190607214120.GE648@sol.localdomain> (raw)
In-Reply-To: <d394b421-799d-2019-fcf0-97ba0b2abb5f@gmail.com>
On Fri, Jun 07, 2019 at 04:28:59PM -0500, Denis Kenzior wrote:
> Hi Eric,
>
> On 06/07/2019 04:15 PM, Eric Biggers wrote:
> > On Fri, Jun 07, 2019 at 03:45:45PM -0500, Denis Kenzior wrote:
> > > Hi Ard,
> > >
> > > >
> > > > Ah ok, good to know. That does imply that the driver is not entirely
> > > > broken, which is good news I suppose.
> > > >
> > >
> > > Not entirely, but we did have to resort to using multiple sockets, otherwise
> > > parallel encrypt/decrypt operations on the socket would result in invalid
> > > behavior. Probably due to the issue Eric already pointed out.
> > >
> > > No such issue with any other ciphers that we use.
> > >
> > > Regards,
> > > -Denis
> >
> > Okay, that sucks, so we do have to keep "ecb(arc4)" in the crypto API then. And
> > we can't fix its name to be just "arc4". It's odd that someone would choose to
> > use AF_ALG over writing a 20 line arc4_crypt() in userspace, but whatever.
> >
> > Yes, "ecb(arc4)" isn't currently thread safe. ARC4 uses a single key whereas
> > modern stream ciphers use a key + IV. To comply with the crypto API it would
> > have to copy the key to a stack buffer for each encryption/decryption. But it
> > doesn't; it just updates the key instead, making it non thread safe. If users
> > are actually relying on that, we'll have to settle for adding a mutex instead.
>
> Well the issue isn't even about being thread safe. We run a single thread
> in iwd. The details are a bit fuzzy now due to time elapsed, but if I
> recall correctly, even behavior like:
>
> fd = socket();
> bind(fd, ecb(arc4));
> setsockopt(fd, ...key...);
>
> sendmsg(fd, OP_ENCRYPT, ...);
> sendmsg(fd, OP_DECRYPT, ...);
> sendmsg(fd, OP_ENCRYPT, ...);
>
> would produce different (incorrect) encrypted results compared to
>
> sendmsg(fd, OP_ENCRYPT, ...)
> sendmsg(fd, OP_ENCRYPT, ...)
>
That's because currently each operation uses the next bytes from the keystream,
and a new keystream is started only by setsockopt(..., ALG_SET_KEY, ...).
There's no difference between ARC4 encryption and decryption; both just XOR the
keystream with the data. Are you saying you expected each encryption to be a
continuation of the previous encryption, but decryptions to be independent?
- Eric
next prev parent reply other threads:[~2019-06-07 21:41 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-07 14:49 [RFC PATCH 0/3] move WEP implementation to skcipher interface Ard Biesheuvel
2019-06-07 14:49 ` [RFC PATCH 1/3] net/mac80211: switch to skcipher interface for arc4 Ard Biesheuvel
2019-06-07 14:49 ` [RFC PATCH 2/3] lib80211/tkip: " Ard Biesheuvel
2019-06-07 14:49 ` [RFC PATCH 3/3] lib80211/wep: " Ard Biesheuvel
2019-06-07 17:59 ` [RFC PATCH 0/3] move WEP implementation to skcipher interface Eric Biggers
2019-06-07 18:08 ` Ard Biesheuvel
2019-06-07 20:24 ` Marcel Holtmann
2019-06-07 20:27 ` Ard Biesheuvel
2019-06-07 20:45 ` Denis Kenzior
2019-06-07 21:15 ` Eric Biggers
2019-06-07 21:28 ` Denis Kenzior
2019-06-07 21:41 ` Eric Biggers [this message]
2019-06-07 21:54 ` Denis Kenzior
2019-06-07 22:40 ` Eric Biggers
2019-06-07 22:47 ` Denis Kenzior
2019-06-08 13:03 ` Sandy Harris
2019-06-08 14:37 ` Ard Biesheuvel
2019-06-08 15:51 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190607214120.GE648@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=ard.biesheuvel@linaro.org \
--cc=davem@davemloft.net \
--cc=denkenz@gmail.com \
--cc=herbert@gondor.apana.org.au \
--cc=johannes@sipsolutions.net \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).