crypto: remove some obsolete algorithms

PATCH In review Ard Biesheuvel 5 participants 11 messages Jan 21, 2021 – Jan 29, 2021

Subsystems (4)

Documentation Crypto API Arm STM32 Device mapper

lore

Share & tools

lore

Ard Biesheuvel

author

2021-01-21 13:09 UTC #0 lore raw

cover crypto: remove some obsolete algorithms

Remove a set of algorithms that are never used in the kernel, and are highly unlikely to be depended upon by user space either.

Cc Eric Biggers <[email protected]>

Cc Herbert Xu <[email protected]>

Ard Biesheuvel (5):
crypto: remove RIPE-MD 128 hash algorithm
crypto: remove RIPE-MD 256 hash algorithm
crypto: remove RIPE-MD 320 hash algorithm
crypto: remove Tiger 128/160/192 hash algorithms
crypto: remove Salsa20 stream cipher algorithm

 .../device-mapper/dm-integrity.rst            |    4 +-
 crypto/Kconfig                                |   62 -
 crypto/Makefile                               |    4 -
 crypto/ripemd.h                               |   14 -
 crypto/rmd128.c                               |  323 ----
 crypto/rmd256.c                               |  342 ----
 crypto/rmd320.c                               |  391 -----
 crypto/salsa20_generic.c                      |  212 ---
 crypto/tcrypt.c                               |   87 +-
 crypto/testmgr.c                              |   48 -
 crypto/testmgr.h                              | 1553 -----------------
 crypto/tgr192.c                               |  682 --------
 12 files changed, 3 insertions(+), 3719 deletions(-)
 delete mode 100644 crypto/rmd128.c
 delete mode 100644 crypto/rmd256.c
 delete mode 100644 crypto/rmd320.c
 delete mode 100644 crypto/salsa20_generic.c
 delete mode 100644 crypto/tgr192.c

Signature · 1 line

2.17.1

Ard Biesheuvel

author

2021-01-21 13:09 UTC #1 lore raw

PATCH 1/5 crypto: remove RIPE-MD 128 hash algorithm

RIPE-MD 128 is never referenced anywhere in the kernel, and unlikely to be depended upon by userspace via AF_ALG. So let's remove it.

Signed-off-by Ard Biesheuvel <[email protected]>

---
 crypto/Kconfig   |  13 -
 crypto/Makefile  |   1 -
 crypto/ripemd.h  |   3 -
 crypto/rmd128.c  | 323 --------------------
 crypto/tcrypt.c  |  18 +-
 crypto/testmgr.c |  12 -
 crypto/testmgr.h | 137 ---------
 7 files changed, 1 insertion(+), 506 deletions(-)

crypto/Kconfig +0 ~~-13~~

index 94f0fde06b94..a14da8290abb 100644
@@ -817,19 +817,6 @@ config CRYPTO_MICHAEL_MIC
 	  should not be used for other purposes because of the weakness
 	  of the algorithm.
 
-config CRYPTO_RMD128
-	tristate "RIPEMD-128 digest algorithm"
-	select CRYPTO_HASH
-	help
-	  RIPEMD-128 (ISO/IEC 10118-3:2004).
-
-	  RIPEMD-128 is a 128-bit cryptographic hash function. It should only
-	  be used as a secure replacement for RIPEMD. For other use cases,
-	  RIPEMD-160 should be used.
-
-	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
-	  See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
-
 config CRYPTO_RMD160
 	tristate "RIPEMD-160 digest algorithm"
 	select CRYPTO_HASH

crypto/Makefile +0 -1

index b279483fba50..c4d8f86a106c 100644
@@ -67,7 +67,6 @@ obj-$(CONFIG_CRYPTO_XCBC) += xcbc.o
 obj-$(CONFIG_CRYPTO_NULL2) += crypto_null.o
 obj-$(CONFIG_CRYPTO_MD4) += md4.o
 obj-$(CONFIG_CRYPTO_MD5) += md5.o
-obj-$(CONFIG_CRYPTO_RMD128) += rmd128.o
 obj-$(CONFIG_CRYPTO_RMD160) += rmd160.o
 obj-$(CONFIG_CRYPTO_RMD256) += rmd256.o
 obj-$(CONFIG_CRYPTO_RMD320) += rmd320.o

crypto/ripemd.h +0 -3

index 93edbf52197d..0f66e3c86a2b 100644
@@ -6,9 +6,6 @@
 #ifndef _CRYPTO_RMD_H
 #define _CRYPTO_RMD_H
 
-#define RMD128_DIGEST_SIZE      16
-#define RMD128_BLOCK_SIZE       64
-
 #define RMD160_DIGEST_SIZE      20
 #define RMD160_BLOCK_SIZE       64

crypto/rmd128.c deleted +0 ~~-323~~

323 lines not on this page · raw message

crypto/tcrypt.c +1 ~~-17~~

index a4a11d2b57bd..bc9e2910f5c3 100644
@@ -71,7 +71,7 @@ static const char *check[] = {
 	"blowfish", "twofish", "serpent", "sha384", "sha512", "md4", "aes",
 	"cast6", "arc4", "michael_mic", "deflate", "crc32c", "tea", "xtea",
 	"khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
-	"camellia", "seed", "salsa20", "rmd128", "rmd160", "rmd256", "rmd320",
+	"camellia", "seed", "salsa20", "rmd160", "rmd256", "rmd320",
 	"lzo", "lzo-rle", "cts", "sha3-224", "sha3-256", "sha3-384",
 	"sha3-512", "streebog256", "streebog512",
 	NULL

@@ -1867,10 +1867,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("cts(cbc(aes))");
 		break;
 
-        case 39:
-		ret += tcrypt_test("rmd128");
-		break;
-
         case 40:
 		ret += tcrypt_test("rmd160");
 		break;

@@ -1955,10 +1951,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("xcbc(aes)");
 		break;
 
-	case 107:
-		ret += tcrypt_test("hmac(rmd128)");
-		break;
-
 	case 108:
 		ret += tcrypt_test("hmac(rmd160)");
 		break;

@@ -2409,10 +2401,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_hash_speed("sha224", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;
 		fallthrough;
-	case 314:
-		test_hash_speed("rmd128", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
 	case 315:
 		test_hash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;

@@ -2533,10 +2521,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_ahash_speed("sha224", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;
 		fallthrough;
-	case 414:
-		test_ahash_speed("rmd128", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
 	case 415:
 		test_ahash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;

crypto/testmgr.c +0 ~~-12~~

index a896d77e9611..f8a5cec614d6 100644
@@ -4957,12 +4957,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(hmac_md5_tv_template)
 		}
-	}, {
-		.alg = "hmac(rmd128)",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(hmac_rmd128_tv_template)
-		}
 	}, {
 		.alg = "hmac(rmd160)",
 		.test = alg_test_hash,

@@ -5275,12 +5269,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 				.aad_iv = 1,
 			}
 		}
-	}, {
-		.alg = "rmd128",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(rmd128_tv_template)
-		}
 	}, {
 		.alg = "rmd160",
 		.test = alg_test_hash,

crypto/testmgr.h +0 ~~-137~~

149 lines not on this page · raw message

Signature · 1 line

2.17.1

Ard Biesheuvel

author

2021-01-21 13:09 UTC #2 lore raw

PATCH 2/5 crypto: remove RIPE-MD 256 hash algorithm

In reply to Ard Biesheuvel

RIPE-MD 256 is never referenced anywhere in the kernel, and unlikely to be depended upon by userspace via AF_ALG. So let's remove it

Signed-off-by Ard Biesheuvel <[email protected]>

---
 crypto/Kconfig   |  12 -
 crypto/Makefile  |   1 -
 crypto/ripemd.h  |   3 -
 crypto/rmd256.c  | 342 --------------------
 crypto/tcrypt.c  |  14 +-
 crypto/testmgr.c |   6 -
 crypto/testmgr.h |  64 ----
 7 files changed, 1 insertion(+), 441 deletions(-)

crypto/Kconfig +0 ~~-12~~

index a14da8290abb..8e93dce161b0 100644
@@ -834,18 +834,6 @@ config CRYPTO_RMD160
 	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 	  See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 
-config CRYPTO_RMD256
-	tristate "RIPEMD-256 digest algorithm"
-	select CRYPTO_HASH
-	help
-	  RIPEMD-256 is an optional extension of RIPEMD-128 with a
-	  256 bit hash. It is intended for applications that require
-	  longer hash-results, without needing a larger security level
-	  (than RIPEMD-128).
-
-	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
-	  See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
-
 config CRYPTO_RMD320
 	tristate "RIPEMD-320 digest algorithm"
 	select CRYPTO_HASH

crypto/Makefile +0 -1

index c4d8f86a106c..946e821f1874 100644
@@ -68,7 +68,6 @@ obj-$(CONFIG_CRYPTO_NULL2) += crypto_null.o
 obj-$(CONFIG_CRYPTO_MD4) += md4.o
 obj-$(CONFIG_CRYPTO_MD5) += md5.o
 obj-$(CONFIG_CRYPTO_RMD160) += rmd160.o
-obj-$(CONFIG_CRYPTO_RMD256) += rmd256.o
 obj-$(CONFIG_CRYPTO_RMD320) += rmd320.o
 obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o
 obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o

crypto/ripemd.h +0 -3

index 0f66e3c86a2b..a19c3c27a466 100644
@@ -9,9 +9,6 @@
 #define RMD160_DIGEST_SIZE      20
 #define RMD160_BLOCK_SIZE       64
 
-#define RMD256_DIGEST_SIZE      32
-#define RMD256_BLOCK_SIZE       64
-
 #define RMD320_DIGEST_SIZE      40
 #define RMD320_BLOCK_SIZE       64

crypto/rmd256.c deleted +0 ~~-342~~

342 lines not on this page · raw message

crypto/tcrypt.c +1 ~~-13~~

index bc9e2910f5c3..3fb842cb2c67 100644
@@ -71,7 +71,7 @@ static const char *check[] = {
 	"blowfish", "twofish", "serpent", "sha384", "sha512", "md4", "aes",
 	"cast6", "arc4", "michael_mic", "deflate", "crc32c", "tea", "xtea",
 	"khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
-	"camellia", "seed", "salsa20", "rmd160", "rmd256", "rmd320",
+	"camellia", "seed", "salsa20", "rmd160", "rmd320",
 	"lzo", "lzo-rle", "cts", "sha3-224", "sha3-256", "sha3-384",
 	"sha3-512", "streebog256", "streebog512",
 	NULL

@@ -1871,10 +1871,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("rmd160");
 		break;
 
-	case 41:
-		ret += tcrypt_test("rmd256");
-		break;
-
 	case 42:
 		ret += tcrypt_test("rmd320");
 		break;

@@ -2405,10 +2401,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_hash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;
 		fallthrough;
-	case 316:
-		test_hash_speed("rmd256", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
 	case 317:
 		test_hash_speed("rmd320", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;

@@ -2525,10 +2517,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_ahash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;
 		fallthrough;
-	case 416:
-		test_ahash_speed("rmd256", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
 	case 417:
 		test_ahash_speed("rmd320", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;

crypto/testmgr.c +0 -6

index f8a5cec614d6..c35de56fc25a 100644
@@ -5275,12 +5275,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(rmd160_tv_template)
 		}
-	}, {
-		.alg = "rmd256",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(rmd256_tv_template)
-		}
 	}, {
 		.alg = "rmd320",
 		.test = alg_test_hash,

crypto/testmgr.h +0 ~~-64~~

70 lines not on this page · raw message

Signature · 1 line

2.17.1

Ard Biesheuvel

author

2021-01-21 13:09 UTC #3 lore raw

PATCH 3/5 crypto: remove RIPE-MD 320 hash algorithm

In reply to Ard Biesheuvel

RIPE-MD 320 is never referenced anywhere in the kernel, and unlikely to be depended upon by userspace via AF_ALG. So let's remove it

Signed-off-by Ard Biesheuvel <[email protected]>

---
 crypto/Kconfig   |  12 -
 crypto/ripemd.h  |   8 -
 crypto/rmd320.c  | 391 --------------------
 crypto/tcrypt.c  |  14 +-
 crypto/testmgr.c |   6 -
 crypto/testmgr.h |  64 ----
 6 files changed, 1 insertion(+), 494 deletions(-)

crypto/Kconfig +0 ~~-12~~

index 8e93dce161b0..a32e25cca2b4 100644
@@ -834,18 +834,6 @@ config CRYPTO_RMD160
 	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 	  See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 
-config CRYPTO_RMD320
-	tristate "RIPEMD-320 digest algorithm"
-	select CRYPTO_HASH
-	help
-	  RIPEMD-320 is an optional extension of RIPEMD-160 with a
-	  320 bit hash. It is intended for applications that require
-	  longer hash-results, without needing a larger security level
-	  (than RIPEMD-160).
-
-	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
-	  See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
-
 config CRYPTO_SHA1
 	tristate "SHA1 digest algorithm"
 	select CRYPTO_HASH

crypto/ripemd.h +0 -8

index a19c3c27a466..b977785e2a62 100644
@@ -9,20 +9,12 @@
 #define RMD160_DIGEST_SIZE      20
 #define RMD160_BLOCK_SIZE       64
 
-#define RMD320_DIGEST_SIZE      40
-#define RMD320_BLOCK_SIZE       64
-
 /* initial values  */
 #define RMD_H0  0x67452301UL
 #define RMD_H1  0xefcdab89UL
 #define RMD_H2  0x98badcfeUL
 #define RMD_H3  0x10325476UL
 #define RMD_H4  0xc3d2e1f0UL
-#define RMD_H5  0x76543210UL
-#define RMD_H6  0xfedcba98UL
-#define RMD_H7  0x89abcdefUL
-#define RMD_H8  0x01234567UL
-#define RMD_H9  0x3c2d1e0fUL
 
 /* constants */
 #define RMD_K1  0x00000000UL

crypto/rmd320.c deleted +0 ~~-391~~

391 lines not on this page · raw message

crypto/tcrypt.c +1 ~~-13~~

index 3fb842cb2c67..a231df72ca7d 100644
@@ -71,7 +71,7 @@ static const char *check[] = {
 	"blowfish", "twofish", "serpent", "sha384", "sha512", "md4", "aes",
 	"cast6", "arc4", "michael_mic", "deflate", "crc32c", "tea", "xtea",
 	"khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
-	"camellia", "seed", "salsa20", "rmd160", "rmd320",
+	"camellia", "seed", "salsa20", "rmd160",
 	"lzo", "lzo-rle", "cts", "sha3-224", "sha3-256", "sha3-384",
 	"sha3-512", "streebog256", "streebog512",
 	NULL

@@ -1871,10 +1871,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("rmd160");
 		break;
 
-	case 42:
-		ret += tcrypt_test("rmd320");
-		break;
-
 	case 43:
 		ret += tcrypt_test("ecb(seed)");
 		break;

@@ -2401,10 +2397,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_hash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;
 		fallthrough;
-	case 317:
-		test_hash_speed("rmd320", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
 	case 318:
 		klen = 16;
 		test_hash_speed("ghash", sec, generic_hash_speed_template);

@@ -2517,10 +2509,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_ahash_speed("rmd160", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;
 		fallthrough;
-	case 417:
-		test_ahash_speed("rmd320", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
 	case 418:
 		test_ahash_speed("sha3-224", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;

crypto/testmgr.c +0 -6

index c35de56fc25a..d12cec6ab003 100644
@@ -5275,12 +5275,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(rmd160_tv_template)
 		}
-	}, {
-		.alg = "rmd320",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(rmd320_tv_template)
-		}
 	}, {
 		.alg = "rsa",
 		.test = alg_test_akcipher,

crypto/testmgr.h +0 ~~-64~~

70 lines not on this page · raw message

Signature · 1 line

2.17.1

Ard Biesheuvel

author

2021-01-21 13:09 UTC #4 lore raw

PATCH 4/5 crypto: remove Tiger 128/160/192 hash algorithms

In reply to Ard Biesheuvel

Tiger is never referenced anywhere in the kernel, and unlikely to be depended upon by userspace via AF_ALG. So let's remove it.

Signed-off-by Ard Biesheuvel <[email protected]>

---
 crypto/Kconfig   |  13 -
 crypto/Makefile  |   1 -
 crypto/tcrypt.c  |  36 --
 crypto/testmgr.c |  18 -
 crypto/testmgr.h | 126 ----
 crypto/tgr192.c  | 682 --------------------
 6 files changed, 876 deletions(-)

crypto/Kconfig +0 ~~-13~~

index a32e25cca2b4..8d25d689a705 100644
@@ -1009,19 +1009,6 @@ config CRYPTO_STREEBOG
 	  https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
 	  https://tools.ietf.org/html/rfc6986
 
-config CRYPTO_TGR192
-	tristate "Tiger digest algorithms"
-	select CRYPTO_HASH
-	help
-	  Tiger hash algorithm 192, 160 and 128-bit hashes
-
-	  Tiger is a hash function optimized for 64-bit processors while
-	  still having decent performance on 32-bit processors.
-	  Tiger was developed by Ross Anderson and Eli Biham.
-
-	  See also:
-	  <https://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
-
 config CRYPTO_WP512
 	tristate "Whirlpool digest algorithms"
 	select CRYPTO_HASH

crypto/Makefile +0 -1

index 946e821f1874..6b9622f21f7f 100644
@@ -77,7 +77,6 @@ obj-$(CONFIG_CRYPTO_SM3) += sm3_generic.o
 obj-$(CONFIG_CRYPTO_STREEBOG) += streebog_generic.o
 obj-$(CONFIG_CRYPTO_WP512) += wp512.o
 CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns)  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
-obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o
 obj-$(CONFIG_CRYPTO_BLAKE2B) += blake2b_generic.o
 obj-$(CONFIG_CRYPTO_BLAKE2S) += blake2s_generic.o
 obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o

crypto/tcrypt.c +0 ~~-36~~

index a231df72ca7d..696c44ef465e 100644
@@ -1815,18 +1815,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("cbc(anubis)");
 		break;
 
-	case 27:
-		ret += tcrypt_test("tgr192");
-		break;
-
-	case 28:
-		ret += tcrypt_test("tgr160");
-		break;
-
-	case 29:
-		ret += tcrypt_test("tgr128");
-		break;
-
 	case 30:
 		ret += tcrypt_test("ecb(xeta)");
 		break;

@@ -2377,18 +2365,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_hash_speed("wp512", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;
 		fallthrough;
-	case 310:
-		test_hash_speed("tgr128", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
-	case 311:
-		test_hash_speed("tgr160", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
-	case 312:
-		test_hash_speed("tgr192", sec, generic_hash_speed_template);
-		if (mode > 300 && mode < 400) break;
-		fallthrough;
 	case 313:
 		test_hash_speed("sha224", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;

@@ -2489,18 +2465,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_ahash_speed("wp512", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;
 		fallthrough;
-	case 410:
-		test_ahash_speed("tgr128", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
-	case 411:
-		test_ahash_speed("tgr160", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
-	case 412:
-		test_ahash_speed("tgr192", sec, generic_hash_speed_template);
-		if (mode > 400 && mode < 500) break;
-		fallthrough;
 	case 413:
 		test_ahash_speed("sha224", sec, generic_hash_speed_template);
 		if (mode > 400 && mode < 500) break;

crypto/testmgr.c +0 ~~-18~~

index d12cec6ab003..b87802ffb554 100644
@@ -5375,24 +5375,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.hash = __VECS(streebog512_tv_template)
 		}
-	}, {
-		.alg = "tgr128",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(tgr128_tv_template)
-		}
-	}, {
-		.alg = "tgr160",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(tgr160_tv_template)
-		}
-	}, {
-		.alg = "tgr192",
-		.test = alg_test_hash,
-		.suite = {
-			.hash = __VECS(tgr192_tv_template)
-		}
 	}, {
 		.alg = "vmac64(aes)",
 		.test = alg_test_hash,

crypto/testmgr.h +0 ~~-126~~

132 lines not on this page · raw message

crypto/tgr192.c deleted +0 ~~-682~~

682 lines not on this page · raw message

Signature · 1 line

2.17.1

Ard Biesheuvel

author

2021-01-21 13:10 UTC #5 lore raw

PATCH 5/5 crypto: remove Salsa20 stream cipher algorithm

In reply to Ard Biesheuvel

Salsa20 is not used anywhere in the kernel, is not suitable for disk encryption, and widely considered to have been superseded by ChaCha20. So let's remove it.

Signed-off-by Ard Biesheuvel <[email protected]>

---
 Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
 crypto/Kconfig                                           |   12 -
 crypto/Makefile                                          |    1 -
 crypto/salsa20_generic.c                                 |  212 ----
 crypto/tcrypt.c                                          |   11 +-
 crypto/testmgr.c                                         |    6 -
 crypto/testmgr.h                                         | 1162 --------------------
 7 files changed, 3 insertions(+), 1405 deletions(-)

Documentation/admin-guide/device-mapper/dm-integrity.rst +2 -2

index 4e6f504474ac..d56112e2e354 100644
@@ -143,8 +143,8 @@ recalculate
 journal_crypt:algorithm(:key)	(the key is optional)
 	Encrypt the journal using given algorithm to make sure that the
 	attacker can't read the journal. You can use a block cipher here
-	(such as "cbc(aes)") or a stream cipher (for example "chacha20",
-	"salsa20" or "ctr(aes)").
+	(such as "cbc(aes)") or a stream cipher (for example "chacha20"
+	or "ctr(aes)").
 
 	The journal contains history of last writes to the block device,
 	an attacker reading the journal could see the last sector numbers

crypto/Kconfig +0 ~~-12~~

index 8d25d689a705..9779c7f7531f 100644
@@ -1400,18 +1400,6 @@ config CRYPTO_KHAZAD
 	  See also:
 	  <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
 
-config CRYPTO_SALSA20
-	tristate "Salsa20 stream cipher algorithm"
-	select CRYPTO_SKCIPHER
-	help
-	  Salsa20 stream cipher algorithm.
-
-	  Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
-	  Stream Cipher Project. See <https://www.ecrypt.eu.org/stream/>
-
-	  The Salsa20 stream cipher algorithm is designed by Daniel J.
-	  Bernstein <[email protected]>. See <https://cr.yp.to/snuffle.html>
-
 config CRYPTO_CHACHA20
 	tristate "ChaCha stream cipher algorithms"
 	select CRYPTO_LIB_CHACHA_GENERIC

crypto/Makefile +0 -1

index 6b9622f21f7f..cf23affb1678 100644
@@ -138,7 +138,6 @@ obj-$(CONFIG_CRYPTO_TEA) += tea.o
 obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o
 obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o
 obj-$(CONFIG_CRYPTO_SEED) += seed.o
-obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o
 obj-$(CONFIG_CRYPTO_CHACHA20) += chacha_generic.o
 obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o
 obj-$(CONFIG_CRYPTO_DEFLATE) += deflate.o

crypto/salsa20_generic.c deleted +0 ~~-212~~

212 lines not on this page · raw message

crypto/tcrypt.c +1 ~~-10~~

index 696c44ef465e..2877b88cfa45 100644
@@ -71,7 +71,7 @@ static const char *check[] = {
 	"blowfish", "twofish", "serpent", "sha384", "sha512", "md4", "aes",
 	"cast6", "arc4", "michael_mic", "deflate", "crc32c", "tea", "xtea",
 	"khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
-	"camellia", "seed", "salsa20", "rmd160",
+	"camellia", "seed", "rmd160",
 	"lzo", "lzo-rle", "cts", "sha3-224", "sha3-256", "sha3-384",
 	"sha3-512", "streebog256", "streebog512",
 	NULL

@@ -1835,10 +1835,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("sha224");
 		break;
 
-	case 34:
-		ret += tcrypt_test("salsa20");
-		break;
-
 	case 35:
 		ret += tcrypt_test("gcm(aes)");
 		break;

@@ -2153,11 +2149,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 				speed_template_32_48_64);
 		break;
 
-	case 206:
-		test_cipher_speed("salsa20", ENCRYPT, sec, NULL, 0,
-				  speed_template_16_32);
-		break;
-
 	case 207:
 		test_cipher_speed("ecb(serpent)", ENCRYPT, sec, NULL, 0,
 				  speed_template_16_32);

crypto/testmgr.c +0 -6

index b87802ffb554..1a4103b1b202 100644
@@ -5282,12 +5282,6 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.akcipher = __VECS(rsa_tv_template)
 		}
-	}, {
-		.alg = "salsa20",
-		.test = alg_test_skcipher,
-		.suite = {
-			.cipher = __VECS(salsa20_stream_tv_template)
-		}
 	}, {
 		.alg = "sha1",
 		.test = alg_test_hash,

crypto/testmgr.h +0 ~~-1162~~

1,168 lines not on this page · raw message

Signature · 1 line

2.17.1

Eric Biggers

2021-01-21 18:06 UTC #6 lore raw

Re: [PATCH 5/5] crypto: remove Salsa20 stream cipher algorithm

Quoted 20 lines · Ard Biesheuvel

Salsa20 is not used anywhere in the kernel, is not suitable for disk encryption, and widely considered to have been superseded by ChaCha20. So let's remove it.
Signed-off-by Ard Biesheuvel <[email protected]>
---
 Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
 crypto/Kconfig                                           |   12 -
 crypto/Makefile                                          |    1 -
 crypto/salsa20_generic.c                                 |  212 ----
 crypto/tcrypt.c                                          |   11 +-
 crypto/testmgr.c                                         |    6 -
 crypto/testmgr.h                                         | 1162 --------------------
 7 files changed, 3 insertions(+), 1405 deletions(-)
Documentation/admin-guide/device-mapper/dm-integrity.rst +0 -0
index 4e6f504474ac..d56112e2e354 100644

Documentation/admin-guide/device-mapper/dm-integrity.rst recalculate · line 147

Quoted 7 lines

Documentation/admin-guide/device-mapper/dm-integrity.rst +2 -2

@@ -143,8 +143,8 @@ recalculate
 journal_crypt:algorithm(:key)	(the key is optional)
 	Encrypt the journal using given algorithm to make sure that the
 	attacker can't read the journal. You can use a block cipher here
-	(such as "cbc(aes)") or a stream cipher (for example "chacha20",
-	"salsa20" or "ctr(aes)").
+	(such as "cbc(aes)") or a stream cipher (for example "chacha20"
+	or "ctr(aes)").

You should check with the dm-integrity maintainers how likely it is that people are using salsa20 with dm-integrity. It's possible that people are using it, especially since the documentation says that dm-integrity can use a stream cipher and specifically gives salsa20 as an example.

- Eric

Ard Biesheuvel

author

2021-01-21 18:11 UTC #7 lore raw

Re: [dm-devel] [PATCH 5/5] crypto: remove Salsa20 stream cipher algorithm

Quoted 26 lines · Eric Biggers

Quoted 24 lines · Ard Biesheuvel

Salsa20 is not used anywhere in the kernel, is not suitable for disk encryption, and widely considered to have been superseded by ChaCha20. So let's remove it.

Signed-off-by Ard Biesheuvel <[email protected]>

---
 Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
 crypto/Kconfig                                           |   12 -
 crypto/Makefile                                          |    1 -
 crypto/salsa20_generic.c                                 |  212 ----
 crypto/tcrypt.c                                          |   11 +-
 crypto/testmgr.c                                         |    6 -
 crypto/testmgr.h                                         | 1162 --------------------
 7 files changed, 3 insertions(+), 1405 deletions(-)

Documentation/admin-guide/device-mapper/dm-integrity.rst +0 -1

index 4e6f504474ac..d56112e2e354 100644
@@ -143,8 +143,8 @@ recalculate
 journal_crypt:algorithm(:key)        (the key is optional)
      Encrypt the journal using given algorithm to make sure that the
      attacker can't read the journal. You can use a block cipher here
-     (such as "cbc(aes)") or a stream cipher (for example "chacha20",

Quoted 9 lines

Documentation/admin-guide/device-mapper/dm-integrity.rst recalculate · line 147
Quoted 3 lines
Documentation/admin-guide/device-mapper/dm-integrity.rst +2 -1
-     "salsa20" or "ctr(aes)").
+     (such as "cbc(aes)") or a stream cipher (for example "chacha20"
+     or "ctr(aes)").
You should check with the dm-integrity maintainers how likely it is that people are using salsa20 with dm-integrity. It's possible that people are using it, especially since the documentation says that dm-integrity can use a stream cipher and specifically gives salsa20 as an example.

Good point - cc'ed them now.

Mike Snitzer

Acked-by

2021-01-21 18:20 UTC #8 lore raw

Re: [dm-devel] [PATCH 5/5] crypto: remove Salsa20 stream cipher algorithm

Quoted 37 lines · Ard Biesheuvel

Quoted 26 lines · Eric Biggers
Quoted 24 lines · Ard Biesheuvel
Salsa20 is not used anywhere in the kernel, is not suitable for disk encryption, and widely considered to have been superseded by ChaCha20. So let's remove it.
Signed-off-by Ard Biesheuvel <[email protected]>
---
 Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
 crypto/Kconfig                                           |   12 -
 crypto/Makefile                                          |    1 -
 crypto/salsa20_generic.c                                 |  212 ----
 crypto/tcrypt.c                                          |   11 +-
 crypto/testmgr.c                                         |    6 -
 crypto/testmgr.h                                         | 1162 --------------------
 7 files changed, 3 insertions(+), 1405 deletions(-)
Documentation/admin-guide/device-mapper/dm-integrity.rst +0 -1
index 4e6f504474ac..d56112e2e354 100644
@@ -143,8 +143,8 @@ recalculate
 journal_crypt:algorithm(:key)        (the key is optional)
      Encrypt the journal using given algorithm to make sure that the
      attacker can't read the journal. You can use a block cipher here
-     (such as "cbc(aes)") or a stream cipher (for example "chacha20",
Quoted 9 lines
Documentation/admin-guide/device-mapper/dm-integrity.rst recalculate · line 147
Quoted 3 lines
Documentation/admin-guide/device-mapper/dm-integrity.rst +2 -1
-     "salsa20" or "ctr(aes)").
+     (such as "cbc(aes)") or a stream cipher (for example "chacha20"
+     or "ctr(aes)").
You should check with the dm-integrity maintainers how likely it is that people are using salsa20 with dm-integrity. It's possible that people are using it, especially since the documentation says that dm-integrity can use a stream cipher and specifically gives salsa20 as an example.

Quoted 2 lines

Good point - cc'ed them now.

No problem here, if others don't find utility in salsa20 then dm-integrity certainly isn't the hold-out.

Acked-by Mike Snitzer <[email protected]>

Mike

--
dm-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/dm-devel

Milan Broz

2021-01-21 18:27 UTC #9 lore raw

Re: [dm-devel] [PATCH 5/5] crypto: remove Salsa20 stream cipher algorithm

In reply to Ard Biesheuvel

Quoted 37 lines · Ard Biesheuvel

Quoted 26 lines · Eric Biggers
Quoted 24 lines · Ard Biesheuvel
Salsa20 is not used anywhere in the kernel, is not suitable for disk encryption, and widely considered to have been superseded by ChaCha20. So let's remove it.
Signed-off-by Ard Biesheuvel <[email protected]>
---
 Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
 crypto/Kconfig                                           |   12 -
 crypto/Makefile                                          |    1 -
 crypto/salsa20_generic.c                                 |  212 ----
 crypto/tcrypt.c                                          |   11 +-
 crypto/testmgr.c                                         |    6 -
 crypto/testmgr.h                                         | 1162 --------------------
 7 files changed, 3 insertions(+), 1405 deletions(-)
Documentation/admin-guide/device-mapper/dm-integrity.rst +0 -1
index 4e6f504474ac..d56112e2e354 100644
@@ -143,8 +143,8 @@ recalculate
 journal_crypt:algorithm(:key)        (the key is optional)
      Encrypt the journal using given algorithm to make sure that the
      attacker can't read the journal. You can use a block cipher here
-     (such as "cbc(aes)") or a stream cipher (for example "chacha20",
Quoted 9 lines
Documentation/admin-guide/device-mapper/dm-integrity.rst recalculate · line 147
Quoted 3 lines
Documentation/admin-guide/device-mapper/dm-integrity.rst +2 -1
-     "salsa20" or "ctr(aes)").
+     (such as "cbc(aes)") or a stream cipher (for example "chacha20"
+     or "ctr(aes)").
You should check with the dm-integrity maintainers how likely it is that people are using salsa20 with dm-integrity. It's possible that people are using it, especially since the documentation says that dm-integrity can use a stream cipher and specifically gives salsa20 as an example.

Quoted 1 line

Good point - cc'ed them now.

I would say - just remove it. I do not see any users, we do not even test this combination in userspace testsuite. It is just an example in doc.

Quoted 1 line

From my POV these stream crypto ciphers should be never used there (but cc to Mikulas, it was his patch :-)

Milan

--
dm-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/dm-devel

Herbert Xu

maintainer

2021-01-29 05:11 UTC #10 lore raw

In reply to Ard Biesheuvel

Quoted 23 lines · Ard Biesheuvel

Remove a set of algorithms that are never used in the kernel, and are highly unlikely to be depended upon by user space either.
Cc Eric Biggers <[email protected]>
Cc Herbert Xu <[email protected]>
Ard Biesheuvel (5):
crypto: remove RIPE-MD 128 hash algorithm
crypto: remove RIPE-MD 256 hash algorithm
crypto: remove RIPE-MD 320 hash algorithm
crypto: remove Tiger 128/160/192 hash algorithms
crypto: remove Salsa20 stream cipher algorithm
 .../device-mapper/dm-integrity.rst            |    4 +-
 crypto/Kconfig                                |   62 -
 crypto/Makefile                               |    4 -
 crypto/ripemd.h                               |   14 -
 crypto/rmd128.c                               |  323 ----
 crypto/rmd256.c                               |  342 ----
 crypto/rmd320.c                               |  391 -----
 crypto/salsa20_generic.c                      |  212 ---
 crypto/tcrypt.c                               |   87 +-
 crypto/testmgr.c                              |   48 -

Quoted 8 lines

 crypto/testmgr.h                              | 1553 -----------------
 crypto/tgr192.c                               |  682 --------
 12 files changed, 3 insertions(+), 3719 deletions(-)
 delete mode 100644 crypto/rmd128.c
 delete mode 100644 crypto/rmd256.c
 delete mode 100644 crypto/rmd320.c
 delete mode 100644 crypto/salsa20_generic.c
 delete mode 100644 crypto/tgr192.c

All applied. Thanks.

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt