crypto: des3_ede: permit weak keys unless REQ_WEAK_KEY set

PATCH Jarod Wilson 3 participants 7 messages Dec 5, 2008 – Dec 17, 2008 2 messages not in the archive Crypto API

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Jarod Wilson

author

2008-12-05 15:00 UTC #1 lore raw

Quoted 10 lines · Jarod Wilson

While its a slightly insane to bypass the key1 == key2 || key2 == key3 check in triple-des, since it reduces it to the same strength as des, some folks do need to do this from time to time for backwards compatibility with des.
My own case is FIPS CAVS test vectors. Many triple-des test vectors use a single key, replicated 3x. In order to get the expected results, des3_ede_setkey() needs to honor the weak key flag.

Quoted 4 lines

Also adds a warning when a weak key is rejected, otherwise, you silently get back a bogus result.
Signed-off-by Jarod Wilson <[email protected]>

v2: make CRYPTO_TFM_REQ_WEAK_KEY flag usage consistent w/rest of crypto subsystem, per comments from Herbert in Red Hat bugzilla #474394.

---
 crypto/des_generic.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

crypto/des_generic.c +2 -1

index 5d0e458..9002073 100644
@@ -868,7 +868,8 @@ static int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
 	u32 *flags = &tfm->crt_flags;
 
 	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))))
+		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+		     (*flags & CRYPTO_TFM_REQ_WEAK_KEY))
 	{
 		*flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED;
 		return -EINVAL;

Signature · 2 lines

Jarod Wilson
[email protected]

Herbert Xu

maintainer

2008-12-05 15:24 UTC #2 lore raw

crypto/des_generic.c static int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key, · line 874

Quoted 7 lines · Jarod Wilson

crypto/des_generic.c +2 -1

 	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))))
+		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+		     (*flags & CRYPTO_TFM_REQ_WEAK_KEY))
 	{
 		*flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED;

This should be changed to RES_WEAK_KEY.

Thanks,

Signature · 4 lines

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Jarod Wilson

author

2008-12-06 05:44 UTC #3 lore raw

Quoted 9 lines · Jarod Wilson

While its a slightly insane to bypass the key1 == key2 || key2 == key3 check in triple-des, since it reduces it to the same strength as des, some folks do need to do this from time to time for backwards compatibility with des.
My own case is FIPS CAVS test vectors. Many triple-des test vectors use a single key, replicated 3x. In order to get the expected results, des3_ede_setkey() needs to honor the weak key flag.

v2: make CRYPTO_TFM_REQ_WEAK_KEY flag usage consistent w/rest of crypto subsystem, per comments from Herbert in Red Hat bugzilla #474394.

v3: set more appropriate RES flag, also per Herbert.

Signed-off-by Jarod Wilson <[email protected]>

---
 crypto/des_generic.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

crypto/des_generic.c +3 -2

index 5d0e458..5bd3ee3 100644
@@ -868,9 +868,10 @@ static int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
 	u32 *flags = &tfm->crt_flags;
 
 	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))))
+		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+		     (*flags & CRYPTO_TFM_REQ_WEAK_KEY))
 	{
-		*flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED;
+		*flags |= CRYPTO_TFM_RES_WEAK_KEY;
 		return -EINVAL;
 	}

Signature · 2 lines

Jarod Wilson
[email protected]

Neil Horman

Acked-by

2008-12-06 20:19 UTC #4 lore raw

Quoted 32 lines · Jarod Wilson

Quoted 9 lines · Jarod Wilson
While its a slightly insane to bypass the key1 == key2 || key2 == key3 check in triple-des, since it reduces it to the same strength as des, some folks do need to do this from time to time for backwards compatibility with des.
My own case is FIPS CAVS test vectors. Many triple-des test vectors use a single key, replicated 3x. In order to get the expected results, des3_ede_setkey() needs to honor the weak key flag.
v2: make CRYPTO_TFM_REQ_WEAK_KEY flag usage consistent w/rest of crypto subsystem, per comments from Herbert in Red Hat bugzilla #474394.
v3: set more appropriate RES flag, also per Herbert.
Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/des_generic.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
crypto/des_generic.c +0 -0
index 5d0e458..5bd3ee3 100644
@@ -868,9 +868,10 @@ static int des3_ede_setkey(struct crypto_tfm *tfm, 
 const u8 *key,
 	u32 *flags = &tfm->crt_flags;

crypto/des_generic.c static int des3_ede_setkey(struct crypto_tfm *tfm, · line 877

Quoted 10 lines

crypto/des_generic.c +3 -2

 
 	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))))
+		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+		     (*flags & CRYPTO_TFM_REQ_WEAK_KEY))
 	{
-		*flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED;
+		*flags |= CRYPTO_TFM_RES_WEAK_KEY;
 		return -EINVAL;
 	}

Looks good to me. Thanks Jarod!

Acked-by Neil Horman <[email protected]>

Herbert Xu

maintainer

2008-12-07 11:38 UTC #5 lore raw

In reply to Jarod Wilson

Quoted 2 lines · Jarod Wilson

v3: set more appropriate RES flag, also per Herbert.

BTW, please maintain the patch description as you would in the first submission. This makes it much easier for me to apply the patch. Feel free to summarise changes elsewhere in the email.

Quoted 1 line

Signed-off-by Jarod Wilson <[email protected]>

I tried to apply it but I get

$ git apply ~/p
fatal: corrupt patch at line 29
$ patch -s -p1 < ~/p
patch: **** malformed patch at line 29: u8 *key,

Please fix it up and resubmit.

Thanks,

Signature · 4 lines

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

A message that is not in the archive (sent off-list or not yet received): [email protected]

While its a slightly insane to bypass the key1 == key2 || key2 == key3 check in triple-des, since it reduces it to the same strength as des, some folks do need to do this from time to time for backwards compatibility with des.

My own case is FIPS CAVS test vectors. Many triple-des test vectors use a single key, replicated 3x. In order to get the expected results, des3_ede_setkey() needs to only reject weak keys if the CRYPTO_TFM_REQ_WEAK_KEY flag is set.

Also sets a more appropriate RES flag when a weak key is found.

This time, hopefully without unintended line wrapping...

Signed-off-by Jarod Wilson <[email protected]>

---
 crypto/des_generic.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

crypto/des_generic.c +3 -2

index 5d0e458..5bd3ee3 100644
@@ -868,9 +868,10 @@ static int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
 	u32 *flags = &tfm->crt_flags;
 
 	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))))
+		     !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
+		     (*flags & CRYPTO_TFM_REQ_WEAK_KEY))
 	{
-		*flags |= CRYPTO_TFM_RES_BAD_KEY_SCHED;
+		*flags |= CRYPTO_TFM_RES_WEAK_KEY;
 		return -EINVAL;
 	}

Signature · 2 lines

Jarod Wilson
[email protected]

Herbert Xu

maintainer

2008-12-17 05:51 UTC #8 lore raw

Quoted 10 lines · Jarod Wilson

While its a slightly insane to bypass the key1 == key2 || key2 == key3 check in triple-des, since it reduces it to the same strength as des, some folks do need to do this from time to time for backwards compatibility with des.
My own case is FIPS CAVS test vectors. Many triple-des test vectors use a single key, replicated 3x. In order to get the expected results, des3_ede_setkey() needs to only reject weak keys if the CRYPTO_TFM_REQ_WEAK_KEY flag is set.

Quoted 5 lines

Also sets a more appropriate RES flag when a weak key is found.
This time, hopefully without unintended line wrapping...
Signed-off-by Jarod Wilson <[email protected]>

Patch applied. Thanks Jarod!

Signature · 4 lines

Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt