crypto: x86/aes-gcm - simplify GCM hash subkey derivation
Subsystems (2)
PATCH 1/1 crypto: x86/aes-gcm - simplify GCM hash subkey derivation
From: Eric Biggers <[email protected]>
Remove a redundant expansion of the AES key, and utilize the zero page. Also rename rfc4106_set_hash_subkey() to aes_gcm_derive_hash_subkey() because it's used for both versions of AES-GCM, not just RFC4106.
--- arch/x86/crypto/aesni-intel_glue.c | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-)
arch/x86/crypto/aesni-intel_glue.c +7 -19
@@ -38,11 +38,10 @@#define AESNI_ALIGN 16#define AESNI_ALIGN_ATTR __attribute__ ((__aligned__(AESNI_ALIGN)))#define AES_BLOCK_MASK (~(AES_BLOCK_SIZE - 1)) -#define RFC4106_HASH_SUBKEY_SIZE 16#define AESNI_ALIGN_EXTRA ((AESNI_ALIGN - 1) & ~(CRYPTO_MINALIGN - 1))#define CRYPTO_AES_CTX_SIZE (sizeof(struct crypto_aes_ctx) + AESNI_ALIGN_EXTRA)#define XTS_AES_CTX_SIZE (sizeof(struct aesni_xts_ctx) + AESNI_ALIGN_EXTRA)/* This data is stored at the end of the crypto_tfm struct.
@@ -588,27 +587,14 @@ static int xctr_crypt(struct skcipher_request *req) err =skcipher_walk_done (&walk, nbytes); }return err; } -static int -rfc4106_set_hash_subkey (u8 *hash_subkey,const u8 *key,unsigned int key_len) +static int aes_gcm_derive_hash_subkey (const struct crypto_aes_ctx *aes_key, +u8 hash_subkey[AES_BLOCK_SIZE ]) { -struct crypto_aes_ctx ctx; -int ret; - - ret =aes_expandkey (&ctx, key, key_len); -if (ret) -return ret; - -/* Clear the data in the hash sub key container to zero.*/ -/* We want to cipher all zeros to create the hash sub key. */ -memset (hash_subkey,0 ,RFC4106_HASH_SUBKEY_SIZE ); - -aes_encrypt (&ctx, hash_subkey, hash_subkey); - -memzero_explicit (&ctx,sizeof (ctx)); +aes_encrypt (aes_key, hash_subkey,page_address (ZERO_PAGE (0 )));return 0 ; }static int common_rfc4106_set_key (struct crypto_aead *aead,const u8 *key,unsigned int key_len)
@@ -622,11 +608,12 @@ static int common_rfc4106_set_key(struct crypto_aead *aead, const u8 *key, key_len -=4 ;memcpy (ctx->nonce, key + key_len,sizeof (ctx->nonce));return aes_set_key_common (&ctx->aes_key_expanded, key, key_len) ?: -rfc4106_set_hash_subkey (ctx->hash_subkey, key, key_len); +aes_gcm_derive_hash_subkey (&ctx->aes_key_expanded, + ctx->hash_subkey); }/* This is the Integrity Check Value (aka the authentication tag) length and can * be 8, 12 or 16 bytes long. */ static int common_rfc4106_set_authsize(struct crypto_aead *aead,
@@ -1328,11 +1315,12 @@ static int generic_gcmaes_set_key(struct crypto_aead *aead, const u8 *key, unsigned int key_len) {struct generic_gcmaes_ctx *ctx =generic_gcmaes_ctx_get (aead);return aes_set_key_common (&ctx->aes_key_expanded, key, key_len) ?: -rfc4106_set_hash_subkey (ctx->hash_subkey, key, key_len); +aes_gcm_derive_hash_subkey (&ctx->aes_key_expanded, + ctx->hash_subkey); }static int generic_gcmaes_encrypt (struct aead_request *req) {struct crypto_aead *tfm =crypto_aead_reqtfm (req);
base-commit: 543ea178fbfadeaf79e15766ac989f3351349f02
Signature · 1 line
2.44.0
arch/x86/crypto/aesni-intel_glue.c static int xctr_crypt(struct skcipher_request *req) · line 595
Quoted 1 line · Eric Biggers
arch/x86/crypto/aesni-intel_glue.c +1
-0+aes_encrypt (aes_key, hash_subkey,page_address (ZERO_PAGE (0 )));
Actually, page_address(ZERO_PAGE(0)) expands into a surprisingly large number of instructions. Using empty_zero_page directly would avoid this, but there's little precedent for doing that. For now, I think just using something like 'static const u8 zeroes[16]' is the way to go for small buffers like this.
- Eric
Herbert Xu
maintainerQuoted 7 lines · Eric Biggers
Quoted 1 line · Eric Biggers
+
aes_encrypt(aes_key, hash_subkey, page_address(ZERO_PAGE(0)));Actually, page_address(ZERO_PAGE(0)) expands into a surprisingly large number of instructions. Using
empty_zero_pagedirectly would avoid this, but there's little precedent for doing that. For now, I think just using something like 'static const u8 zeroes[16]' is the way to go for small buffers like this.
Yes it's not worth the effort given the small size. But still it looks like lib/raid6 could benefit from using a shared zero page too.
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt