WSL2-Linux-Kernel/lib/crypto
Ard Biesheuvel 520af5da66 crypto: lib/aesgcm - Provide minimal library implementation
Implement a minimal library version of AES-GCM based on the existing
library implementations of AES and multiplication in GF(2^128). Using
these primitives, GCM can be implemented in a straight-forward manner.

GCM has a couple of sharp edges, i.e., the amount of input data
processed with the same initialization vector (IV) should be capped to
protect the counter from 32-bit rollover (or carry), and the size of the
authentication tag should be fixed for a given key. [0]

The former concern is addressed trivially, given that the function call
API uses 32-bit signed types for the input lengths. It is still up to
the caller to avoid IV reuse in general, but this is not something we
can police at the implementation level.

As for the latter concern, let's make the authentication tag size part
of the key schedule, and only permit it to be configured as part of the
key expansion routine.

Note that table based AES implementations are susceptible to known
plaintext timing attacks on the encryption key. The AES library already
attempts to mitigate this to some extent, but given that the counter
mode encryption used by GCM operates exclusively on known plaintext by
construction (the IV and therefore the initial counter value are known
to an attacker), let's take some extra care to mitigate this, by calling
the AES library with interrupts disabled.

[0] https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-38d.pdf

Link: https://lore.kernel.org/all/c6fb9b25-a4b6-2e4a-2dd1-63adda055a49@amd.com/
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Nikunj A Dadhania <nikunj@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2022-11-11 18:14:59 +08:00
..
Kconfig crypto: lib/aesgcm - Provide minimal library implementation 2022-11-11 18:14:59 +08:00
Makefile crypto: lib/aesgcm - Provide minimal library implementation 2022-11-11 18:14:59 +08:00
aes.c crypto: aes - helper function to validate key length for AES algorithms 2019-08-09 15:11:43 +10:00
aesgcm.c crypto: lib/aesgcm - Provide minimal library implementation 2022-11-11 18:14:59 +08:00
arc4.c crypto: arc4 - refactor arc4 core code into separate library 2019-06-20 14:18:33 +08:00
blake2s-generic.c lib/crypto: blake2s: include as built-in 2022-01-07 00:25:25 +01:00
blake2s-selftest.c crypto: lib/blake2s - reduce stack frame usage in self test 2022-06-30 15:56:56 +08:00
blake2s.c crypto: blake2s - remove shash module 2022-06-10 16:43:49 +08:00
chacha.c crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c 2021-04-22 17:31:29 +10:00
chacha20poly1305-selftest.c crypto: arm64/chacha - correctly walk through blocks 2020-03-20 14:35:27 +11:00
chacha20poly1305.c crypto: lib - rename 'mod_init' & 'mod_exit' functions to be module-specific 2021-07-16 15:49:36 +08:00
curve25519-fiat32.c crypto: lib/curve25519 - work around Clang stack spilling issue 2019-11-17 09:02:43 +08:00
curve25519-generic.c crypto: curve25519 - Fix selftest build error 2020-01-16 15:18:13 +08:00
curve25519-hacl64.c crypto: curve25519 - generic C library implementations 2019-11-17 09:02:43 +08:00
curve25519-selftest.c crypto: lib/curve25519 - re-add selftests 2019-12-27 18:18:03 +08:00
curve25519.c crypto: lib - rename 'mod_init' & 'mod_exit' functions to be module-specific 2021-07-16 15:49:36 +08:00
des.c crypto: des - split off DES library from generic DES cipher driver 2019-08-22 14:57:33 +10:00
gf128mul.c crypto: lib/gf128mul - make gf128mul_lle time invariant 2022-11-11 18:14:59 +08:00
libchacha.c crypto: chacha - move existing library code into lib/crypto 2019-11-17 09:02:39 +08:00
memneq.c crypto: lib - remove __HAVE_ARCH_CRYPTO_MEMNEQ 2022-08-19 18:39:34 +08:00
poly1305-donna32.c crypto: poly1305 - fix poly1305_core_setkey() declaration 2021-04-02 18:28:12 +11:00
poly1305-donna64.c crypto: poly1305 - fix poly1305_core_setkey() declaration 2021-04-02 18:28:12 +11:00
poly1305.c crypto: poly1305 - fix poly1305_core_setkey() declaration 2021-04-02 18:28:12 +11:00
sha1.c crypto: lib - add module license to libsha1 2022-07-20 15:28:07 +08:00
sha256.c crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
utils.c crypto: lib - move __crypto_xor into utils 2022-08-19 18:39:34 +08:00