crypto: Make CRYPTO_CBC select CRYPTO_ECHAINIV

PATCH In review Thomas Egerer 3 participants 8 messages Jan 4, 2016 – Jan 11, 2016 Crypto API

Share & tools

Thomas Egerer

author

2016-01-04 18:56 UTC #0 lore raw

PATCH 1/1 crypto: Make CRYPTO_CBC select CRYPTO_ECHAINIV

Similar to CTR mode selecting CRYPTO_SEQIV, CBC mode requires echainiv and has to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].

[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html

Signed-off-by Thomas Egerer <[email protected]>

---
 crypto/Kconfig | 1 +
 1 file changed, 1 insertion(+)

Stephan Mueller

2016-01-04 20:10 UTC #1 lore raw

Am Montag, 4. Januar 2016, 19:56:59 schrieb Thomas Egerer:

Hi Thomas,

Quoted 7 lines

Similar to CTR mode selecting CRYPTO_SEQIV, CBC mode requires echainiv and has to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
Signed-off-by Thomas Egerer <[email protected]>

Please provide the patch inline as documented in
Documentation/SubmittingPatches

Quoted 3 lines

---
 crypto/Kconfig | 1 +
 1 file changed, 1 insertion(+)

Signature · 2 lines

Ciao
Stephan

Thomas Egerer

author

2016-01-04 20:43 UTC #2 lore raw

[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html

Signed-off-by Thomas Egerer <[email protected]>

---
crypto/Kconfig | 1 +

1 file changed, 1 insertion(+)

crypto/Kconfig +0 -0

index 7240821..893d93f 100644
@@ -284,6 +284,7 @@ comment "Block modes"

config CRYPTO_CBC
tristate "CBC support"
select CRYPTO_BLKCIPHER
+ select CRYPTO_ECHAINIV
select CRYPTO_MANAGER
help
CBC: Cipher Block Chaining mode

Signature · 1 line

2.6.4

Herbert Xu

maintainer

2016-01-08 09:49 UTC #3 lore raw

Quoted 7 lines · Thomas Egerer

Similar to CTR mode selecting CRYPTO_SEQIV, CBC mode requires echainiv and has to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
Signed-off-by Thomas Egerer <[email protected]>

Please patch net/ipvX/Kconfig instead as ECHAINIV is only used by IPsec.

Thanks,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Thomas Egerer

author

2016-01-10 20:16 UTC #4 lore raw

Quoted 11 lines · Herbert Xu

Quoted 7 lines · Thomas Egerer
Similar to CTR mode selecting CRYPTO_SEQIV, CBC mode requires echainiv and has to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1].
[1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html
Signed-off-by Thomas Egerer <[email protected]>
Please patch net/ipvX/Kconfig instead as ECHAINIV is only used by IPsec.

This does not seem right to me. By depending on CRYPTO_CBC in a particular Kconfig, I would expect the 'default algorithm for CBC' to be transitively selected with it. It's what CRYPTO_CTR does. There are a couple of places that use select CRYPTO_CBC but not CRYPTO_ECHAINIV (ext4, wusbcore, md to mention a few). Wouldn't these end up unusable too, if CBC-mode doesn't activate echainiv?

Cheers,
Thomas

Quoted 2 lines

Thanks,

Herbert Xu

maintainer

2016-01-11 03:34 UTC #5 lore raw

Quoted 10 lines · Thomas Egerer

Quoted 2 lines · Herbert Xu
Please patch net/ipvX/Kconfig instead as ECHAINIV is only used by IPsec.
This does not seem right to me. By depending on CRYPTO_CBC in a particular Kconfig, I would expect the 'default algorithm for CBC' to be transitively selected with it. It's what CRYPTO_CTR does. There are a couple of places that use select CRYPTO_CBC but not CRYPTO_ECHAINIV (ext4, wusbcore, md to mention a few). Wouldn't these end up unusable too, if CBC-mode doesn't activate echainiv?

All of those other users should work without echainiv so why would they need to select it?

Cheers,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Thomas Egerer

author

2016-01-11 10:36 UTC #6 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Quoted 11 lines · Herbert Xu

Quoted 5 lines · Thomas Egerer
Quoted 2 lines · Herbert Xu
Please patch net/ipvX/Kconfig instead as ECHAINIV is only used by IPsec.
This does not seem right to me. By depending on CRYPTO_CBC in a
particular
Quoted 1 line
Kconfig, I would expect the 'default algorithm for CBC' to be
transitively
Quoted 1 line
selected with it. It's what CRYPTO_CTR does. There are a couple of
places

Quoted 8 lines

Quoted 1 line
that use select CRYPTO_CBC but not CRYPTO_ECHAINIV (ext4, wusbcore,
md
Quoted 1 line
to mention a few). Wouldn't these end up unusable too, if CBC-mode
doesn't
Quoted 1 line
activate echainiv?
All of those other users should work without echainiv so why would they need to select it?

I was under the impression that ECHAINIV was the default IV generator for CBC. At least that's what the help text said. Upon further investigation I found that the default is either chainiv or eseqiv (according to crypto_default_geniv). In this case it's true, net/ipvx/Kconfig files need to be patched.

Quoted 1 line

Cheers,

- --
Sent from a mobile device. Please excuse my brevity. -----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI+BAEBCgAoBQJWk4WiIRxUaG9tYXMgRWdlcmVyIDxoYWtrZV8wMDdAZ214LmRl PgAKCRBit9TjYqwUxr2pD/0U0wcx2oOSpQNNfUKAI1hPmFx1PNI5m9HkozKS0rms rpg56qdI+zBUBu9Xka0wZI4/UUBDA7DXzI+6kfqDZ+viBJFpCErRK9Be7hRZ7MGi tq3BMg3xT6j6twxcDbpJV4qQPIjE/Y9/Mfgo1EuXVIctsLOAnSfRWXMp5X0zgwy8 1orhxFGyMCE2PRNQGgBSolJPHplVvioEGp9BcRMI+y4o5rBrjyWUG6AlwzMJTc89 QZ1XF8dKRymnpUiau84WcQsL6MG8y8ofZhLkbaoFFaa1jE1eu6DH2wSk3eiYX84o ky3OJHcWbo4VWfTx6MM7eZ1DVeTs3iQ8bF/OIpsR1fR+jI336xK8cM4f+TaMXKlJ pqe3oOv/tE4q6IUCnRsah1x1ipIjcReesr0vCyiMw03E2JP+duOp/RtGp3TX1/49 avJDHKC6Sgg3r8+MDUsyBnYxglYAvwaNmOnE09KLzqzfKapdqv3FGDC8titI3edZ 6RJPxBnbYBFnkqhUDZ0u6tE7SJSDUe6zd+0Ruod7dgilhr8XlI+bWawh5b/SmHjp i8pVDnEn30iTG/ogCduLsP4J0K3Oimb42fsXf3/vIoA/mZC7+uuIQJk6BxahW5Wq k3bhDSk/HGYGeTQ76vsqv+O9b33FiOgmcHrCrxjp1CtT3bQNHX6Od6glcFjOnugr fg==
=+i8R
-----END PGP SIGNATURE-----

Herbert Xu

maintainer

2016-01-11 10:38 UTC #7 lore raw

Quoted 2 lines · Thomas Egerer

I was under the impression that ECHAINIV was the default IV generator for CBC. At least that's what the help text said. Upon further investigation I found that the default is either chainiv or eseqiv (according to crypto_default_geniv). In this case it's true, net/ipvx/Kconfig files need to be patched.

Perhaps we also need to patch the help test. Only IPsec uses IV generation through echainiv/eseqiv.

Thanks,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt