Skip to contentSkip to conversation

crypto: ccm - preserve the IV buffer

PATCH In review Romain Izard 3 participants 3 messages Oct 31, 2017 – Nov 3, 2017 Crypto API

lore
Share & tools
lore

Romain Izard

author
#0 lore raw

PATCH 1/1 crypto: ccm - preserve the IV buffer

The IV buffer used during CCM operations is used twice, during both the hashing step and the ciphering step.

When using a hardware accelerator that updates the contents of the IV buffer at the end of ciphering operations, the value will be modified. In the decryption case, the subsequent setup of the hashing algorithm will interpret the updated IV instead of the original value, which can lead to out-of-bounds writes.

Reuse the idata buffer, only used in the hashing step, to preserve the IV's value during the ciphering step in the decryption case.

Signed-off-by Romain Izard <[email protected]>
---
 crypto/ccm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/ccm.c +3 -1
index 1ce37ae0ce56..0a083342ec8c 100644
@@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
 	unsigned int cryptlen = req->cryptlen;
 	u8 *authtag = pctx->auth_tag;
 	u8 *odata = pctx->odata;
-	u8 *iv = req->iv;
+	u8 *iv = pctx->idata;
 	int err;
 
 	cryptlen -= authsize;

@@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
 	if (req->src != req->dst)
 		dst = pctx->dst;
 
+	memcpy(iv, req->iv, 16);
+
 	skcipher_request_set_tfm(skreq, ctx->ctr);
 	skcipher_request_set_callback(skreq, pctx->flags,
 				      crypto_ccm_decrypt_done, req);
Signature · 1 line
2.14.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 32 lines · Romain Izard

The IV buffer used during CCM operations is used twice, during both the hashing step and the ciphering step.

When using a hardware accelerator that updates the contents of the IV buffer at the end of ciphering operations, the value will be modified. In the decryption case, the subsequent setup of the hashing algorithm will interpret the updated IV instead of the original value, which can lead to out-of-bounds writes.

Reuse the idata buffer, only used in the hashing step, to preserve the IV's value during the ciphering step in the decryption case.

Signed-off-by Romain Izard <[email protected]>
---
  crypto/ccm.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
crypto/ccm.c +1 -1
index 1ce37ae0ce56..0a083342ec8c 100644
@@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
  	unsigned int cryptlen = req->cryptlen;
  	u8 *authtag = pctx->auth_tag;
  	u8 *odata = pctx->odata;
-	u8 *iv = req->iv;
+	u8 *iv = pctx->idata;
  	int err;
 
  	cryptlen -= authsize;

crypto/ccm.c static int crypto_ccm_decrypt(struct aead_request *req) · line 386

Quoted 8 lines
crypto/ccm.c +2 -0
@@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
  	if (req->src != req->dst)
  		dst = pctx->dst;
 
+	memcpy(iv, req->iv, 16);
+
  	skcipher_request_set_tfm(skreq, ctx->ctr);
  	skcipher_request_set_callback(skreq, pctx->flags,
  				      crypto_ccm_decrypt_done, req);
Reviewed-by Tudor Ambarus <[email protected]>
maintainer
#2 lore raw
In reply to Romain Izard
Quoted 9 lines · Romain Izard

The IV buffer used during CCM operations is used twice, during both the hashing step and the ciphering step.

When using a hardware accelerator that updates the contents of the IV buffer at the end of ciphering operations, the value will be modified. In the decryption case, the subsequent setup of the hashing algorithm will interpret the updated IV instead of the original value, which can lead to out-of-bounds writes.

Quoted 4 lines

Reuse the idata buffer, only used in the hashing step, to preserve the IV's value during the ciphering step in the decryption case.

Signed-off-by Romain Izard <[email protected]>

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt