02 Oct, 2016
2 commits
-
Add a guard to 'state' buffer and warn if its consistency after
call to crypto_ahash_export() changes, so that any write that
goes beyond advertised statesize (and thus causing potential
memory corruption [1]) is more visible.[1] https://marc.info/?l=linux-crypto-vger&m=147467656516085
Signed-off-by: Jan Stancek
Cc: Herbert Xu
Cc: Marcelo Cerri
Signed-off-by: Herbert Xu -
The cipher block size for GCM is 16 bytes, and thus the CTR transform
used in crypto_gcm_setkey() will also expect a 16-byte IV. However,
the code currently reserves only 8 bytes for the IV, causing
an out-of-bounds access in the CTR transform. This patch fixes
the issue by setting the size of the IV buffer to 16 bytes.Fixes: 84c911523020 ("[CRYPTO] gcm: Add support for async ciphers")
Signed-off-by: Ondrej Mosnacek
Signed-off-by: Herbert Xu
13 Sep, 2016
1 commit
-
Remove unneeded variables and assignments.
Signed-off-by: Masahiro Yamada
Signed-off-by: Herbert Xu
07 Sep, 2016
3 commits
-
Right now attempting to read an empty hash simply returns zeroed
bytes, this patch corrects this by calling the digest function
using an empty input.Reported-by: Russell King - ARM Linux
Signed-off-by: Herbert Xu -
The current crypto engine allow only ablkcipher_request to be enqueued.
Thus denying any use of it for hardware that also handle hash algo.This patch modify the API for allowing to enqueue ciphers and hash.
Since omap-aes/omap-des are the only users, this patch also convert them
to the new cryptoengine API.Signed-off-by: Corentin Labbe
Signed-off-by: Herbert Xu -
This patch move the whole crypto engine API to its own header
crypto/engine.h.Signed-off-by: Corentin Labbe
Signed-off-by: Herbert Xu
31 Aug, 2016
2 commits
-
In FIPS mode, additional restrictions may apply. If these restrictions
are violated, the kernel will panic(). This patch allows test vectors
for symmetric ciphers to be marked as to be skipped in FIPS mode.Together with the patch, the XTS test vectors where the AES key is
identical to the tweak key is disabled in FIPS mode. This test vector
violates the FIPS requirement that both keys must be different.Reported-by: Tapas Sarangi
Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
This patch fixes an unused label warning triggered when the macro
XOR_SELECT_TEMPLATE is not set.Fixes: 39457acda913 ("crypto: xor - skip speed test if the xor...")
Reported-by: Stephen Rothwell
Suggested-by: Stephen Rothwell
Signed-off-by: Herbert Xu
24 Aug, 2016
3 commits
-
With a public notification, NIST now allows the use of RSA keys with a
modulus >= 2048 bits. The new rule allows any modulus size >= 2048 bits
provided that either 2048 or 3072 bits are supported at least so that
the entire RSA implementation can be CAVS tested.This patch fixes the inability to boot the kernel in FIPS mode, because
certs/x509.genkey defines a 4096 bit RSA key per default. This key causes
the RSA signature verification to fail in FIPS mode without the patch
below.Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
Fix to return a negative error code from the error handling
case instead of 0.Signed-off-by: Wei Yongjun
Acked-by: Stephan Mueller
Signed-off-by: Herbert Xu -
If the architecture selected the xor function with XOR_SELECT_TEMPLATE
the speed result of the do_xor_speed benchmark is of limited value.
The speed measurement increases the bootup time a little, which can
makes a difference for kernels used in container like virtual machines.Signed-off-by: Martin Schwidefsky
Signed-off-by: Herbert Xu
16 Aug, 2016
2 commits
-
When calling the DRBG health test in FIPS mode, the Jitter RNG is not
yet present in the kernel crypto API which will cause the instantiation
to fail and thus the health test to fail.As the health tests cover the enforcement of various thresholds, invoke
the functions that are supposed to enforce the thresholds directly.This patch also saves precious seed.
Reported-by: Tapas Sarangi
Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
The sentence 'Based on' is misspelled, respell it.
Signed-off-by: LABBE Corentin
Signed-off-by: Herbert Xu
09 Aug, 2016
2 commits
-
"if (!ret == template[i].fail)" is confusing to compilers (gcc5):
crypto/testmgr.c: In function '__test_aead':
crypto/testmgr.c:531:12: warning: logical not is only applied to the
left hand side of comparison [-Wlogical-not-parentheses]
if (!ret == template[i].fail) {
^Let there be 'if (template[i].fail == !ret) '.
Signed-off-by: Yanjiang Jin
Signed-off-by: Herbert Xu -
The optimised crc32c implementation depends on VMX (aka. Altivec)
instructions, so the kernel must be built with Altivec support in order
for the crc32c code to build.Fixes: 6dd7a82cc54e ("crypto: powerpc - Add POWER8 optimised crc32c")
Acked-by: Anton Blanchard
Signed-off-by: Michael Ellerman
Signed-off-by: Herbert Xu
08 Aug, 2016
1 commit
-
On 32-bit (e.g. with m68k-linux-gnu-gcc-4.1):
crypto/sha3_generic.c:27: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:28: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:29: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:29: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:31: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:31: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:32: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:32: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:32: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:33: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:33: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:34: warning: integer constant is too large for ‘long’ type
crypto/sha3_generic.c:34: warning: integer constant is too large for ‘long’ typeFixes: 53964b9ee63b7075 ("crypto: sha3 - Add SHA-3 hash algorithm")
Signed-off-by: Geert Uytterhoeven
Signed-off-by: Herbert Xu
28 Jul, 2016
1 commit
-
Pull random driver updates from Ted Ts'o:
"A number of improvements for the /dev/random driver; the most
important is the use of a ChaCha20-based CRNG for /dev/urandom, which
is faster, more efficient, and easier to make scalable for
silly/abusive userspace programs that want to read from /dev/urandom
in a tight loop on NUMA systems.This set of patches also improves entropy gathering on VM's running on
Microsoft Azure, and will take advantage of a hw random number
generator (if present) to initialize the /dev/urandom pool"(It turns out that the random tree hadn't been in linux-next this time
around, because it had been dropped earlier as being too quiet. Oh
well).* tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
random: strengthen input validation for RNDADDTOENTCNT
random: add backtracking protection to the CRNG
random: make /dev/urandom scalable for silly userspace programs
random: replace non-blocking pool with a Chacha20-based CRNG
random: properly align get_random_int_hash
random: add interrupt callback to VMBus IRQ handler
random: print a warning for the first ten uninitialized random users
random: initialize the non-blocking pool via add_hwgenerator_randomness()
27 Jul, 2016
1 commit
-
Pull crypto updates from Herbert Xu:
"Here is the crypto update for 4.8:API:
- first part of skcipher low-level conversions
- add KPP (Key-agreement Protocol Primitives) interface.Algorithms:
- fix IPsec/cryptd reordering issues that affects aesni
- RSA no longer does explicit leading zero removal
- add SHA3
- add DH
- add ECDH
- improve DRBG performance by not doing CTR by handDrivers:
- add x86 AVX2 multibuffer SHA256/512
- add POWER8 optimised crc32c
- add xts support to vmx
- add DH support to qat
- add RSA support to caam
- add Layerscape support to caam
- add SEC1 AEAD support to talitos
- improve performance by chaining requests in marvell/cesa
- add support for Araneus Alea I USB RNG
- add support for Broadcom BCM5301 RNG
- add support for Amlogic Meson RNG
- add support Broadcom NSP SoC RNG"* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (180 commits)
crypto: vmx - Fix aes_p8_xts_decrypt build failure
crypto: vmx - Ignore generated files
crypto: vmx - Adding support for XTS
crypto: vmx - Adding asm subroutines for XTS
crypto: skcipher - add comment for skcipher_alg->base
crypto: testmgr - Print akcipher algorithm name
crypto: marvell - Fix wrong flag used for GFP in mv_cesa_dma_add_iv_op
crypto: nx - off by one bug in nx_of_update_msc()
crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct
crypto: scatterwalk - Inline start/map/done
crypto: scatterwalk - Remove unnecessary BUG in scatterwalk_start
crypto: scatterwalk - Remove unnecessary advance in scatterwalk_pagedone
crypto: scatterwalk - Fix test in scatterwalk_done
crypto: api - Optimise away crypto_yield when hard preemption is on
crypto: scatterwalk - add no-copy support to copychunks
crypto: scatterwalk - Remove scatterwalk_bytes_sglen
crypto: omap - Stop using crypto scatterwalk_bytes_sglen
crypto: skcipher - Remove top-level givcipher interface
crypto: user - Remove crypto_lookup_skcipher call
crypto: cts - Convert to skcipher
...
23 Jul, 2016
1 commit
-
Pull crypto fixes from Herbert Xu:
"This fixes a sporadic build failure in the qat driver as well as a
memory corruption bug in rsa-pkcs1pad"* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct
crypto: qat - make qat_asym_algs.o depend on asn1 headers
22 Jul, 2016
1 commit
-
To allow for child request context the struct akcipher_request child_req
needs to be at the end of the structure.Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu
21 Jul, 2016
1 commit
-
Merge the crypto tree to resolve conflict in qat Makefile.
19 Jul, 2016
2 commits
-
When an akcipher test fails, we don't know which algorithm failed
because the name is not printed. This patch fixes this.Signed-off-by: Herbert Xu
-
To allow for child request context the struct akcipher_request child_req
needs to be at the end of the structure.Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu
18 Jul, 2016
17 commits
-
This patch inlines the functions scatterwalk_start, scatterwalk_map
and scatterwalk_done as they're all tiny and mostly used by the block
cipher walker.Signed-off-by: Herbert Xu
-
Nothing bad will happen even if sg->length is zero, so there is
no point in keeping this BUG_ON in scatterwalk_start.Signed-off-by: Herbert Xu
-
The offset advance in scatterwalk_pagedone not only is unnecessary,
but it was also buggy when it was needed by scatterwalk_copychunks.
As the latter has long ago been fixed to call scatterwalk_advance
directly, we can remove this unnecessary offset adjustment.Signed-off-by: Herbert Xu
-
When there is more data to be processed, the current test in
scatterwalk_done may prevent us from calling pagedone even when
we should.In particular, if we're on an SG entry spanning multiple pages
where the last page is not a full page, we will incorrectly skip
calling pagedone on the second last page.This patch fixes this by adding a separate test for whether we've
reached the end of a page.Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu -
The function ablkcipher_done_slow is pretty much identical to
scatterwalk_copychunks except that it doesn't actually copy as
the processing hasn't been completed yet.This patch allows scatterwalk_copychunks to be used in this case
by specifying out == 2.Signed-off-by: Herbert Xu
-
This patch removes the now unused scatterwalk_bytes_sglen. Anyone
using this out-of-tree should switch over to sg_nents_for_len.Signed-off-by: Herbert Xu
-
This patch removes the old crypto_grab_skcipher helper and replaces
it with crypto_grab_skcipher2.As this is the final entry point into givcipher this patch also
removes all traces of the top-level givcipher interface, including
all implicit IV generators such as chainiv.The bottom-level givcipher interface remains until the drivers
using it are converted.Signed-off-by: Herbert Xu
-
As there are no more kernel users of built-in IV generators we
can remove the special lookup for skciphers.Signed-off-by: Herbert Xu
-
This patch converts cts over to the skcipher interface. It also
optimises the implementation to use one CBC operation for all but
the last block, which is then processed separately.Signed-off-by: Herbert Xu
-
The default null blkcipher is no longer used and can now be removed.
Signed-off-by: Herbert Xu
-
The blkcipher null object is no longer used and can now be removed.
Signed-off-by: Herbert Xu
-
This patch replaces use of the obsolete blkcipher with skcipher.
Signed-off-by: Herbert Xu
-
This patch replaces use of the obsolete blkcipher with skcipher.
Signed-off-by: Herbert Xu
-
This patch adds an skcipher null object alongside the existing
null blkcipher so that IV generators using it can switch over
to skcipher.Signed-off-by: Herbert Xu
-
This patch converts chacha20poly1305 to use the new skcipher
interface as opposed to ablkcipher.It also fixes a buglet where we may end up with an async poly1305
when the user asks for a async algorithm. This shouldn't be a
problem yet as there aren't any async implementations of poly1305
out there.Signed-off-by: Herbert Xu
-
This patch converts gcm to use the new skcipher interface as opposed
to ablkcipher.Signed-off-by: Herbert Xu
-
This patch converts ccm to use the new skcipher interface as opposed
to ablkcipher.Signed-off-by: Herbert Xu