fscrypt: use AES library for v1 key derivation
Subsystems (2)
Eric Biggers
maintainerPATCH 1/1 fscrypt: use AES library for v1 key derivation
Convert the implementation of the v1 (original / deprecated) fscrypt per-file key derivation algorithm to use the AES library instead of an "ecb(aes)" crypto_skcipher. This is much simpler.
While the AES library doesn't support AES-ECB directly yet, we can still simply call aes_encrypt() in a loop. While that doesn't explicitly parallelize the AES encryptions, it doesn't really matter in this case, where a new key is used each time and only 16 to 64 bytes are encrypted.
In fact, a quick benchmark (AMD Ryzen 9 9950X) shows that this commit actually greatly improves performance, from ~7000 cycles per key derived to ~1500. The times don't differ much between 32 bytes and 64 bytes either, so clearly the bottleneck is API stuff and key expansion.
Granted, performance of the v1 key derivation is no longer very
relevant: most users have moved onto v2 encryption policies. The v2 key derivation uses HKDF-SHA512 (which is ~3500 cycles on the same CPU).
Still, it's nice that the simpler solution is much faster as well.
Compatibility verified with xfstests generic/548.
---
This patch is targeting fscrypt/for-next
fs/crypto/Kconfig | 2 +- fs/crypto/keysetup_v1.c | 87 +++++++++++++---------------------------- 2 files changed, 29 insertions(+), 60 deletions(-)
fs/crypto/Kconfig +1 -1
@@ -1,10 +1,11 @@ # SPDX-License-Identifier: GPL-2.0-only config FS_ENCRYPTION bool "FS Encryption (Per-file encryption)" select CRYPTO select CRYPTO_SKCIPHER + select CRYPTO_LIB_AES select CRYPTO_LIB_SHA256 select CRYPTO_LIB_SHA512 select KEYS help Enable encryption of files and directories. This
@@ -28,11 +29,10 @@ config FS_ENCRYPTION config FS_ENCRYPTION_ALGS tristate select CRYPTO_AES select CRYPTO_CBC select CRYPTO_CTS - select CRYPTO_ECB select CRYPTO_XTS config FS_ENCRYPTION_INLINE_CRYPT bool "Enable fscrypt to use inline crypto" depends on FS_ENCRYPTION && BLK_INLINE_ENCRYPTION
fs/crypto/keysetup_v1.c +28 -59
125 lines not on this page · raw message
base-commit: 4377a22d84f726f0a650927edf75cdc0698baf06
Signature · 1 line
2.53.0
Quoted 22 lines · Eric Biggers
Convert the implementation of the v1 (original / deprecated) fscrypt per-file key derivation algorithm to use the AES library instead of an "ecb(aes)"
crypto_skcipher. This is much simpler.While the AES library doesn't support AES-ECB directly yet, we can still simply call
aes_encrypt()in a loop. While that doesn't explicitly parallelize the AES encryptions, it doesn't really matter in this case, where a new key is used each time and only 16 to 64 bytes are encrypted.In fact, a quick benchmark (AMD Ryzen 9 9950X) shows that this commit actually greatly improves performance, from ~7000 cycles per key derived to ~1500. The times don't differ much between 32 bytes and 64 bytes either, so clearly the bottleneck is API stuff and key expansion.
Granted, performance of the v1 key derivation is no longer very
relevant: most users have moved onto v2 encryption policies. The v2 key derivation uses HKDF-SHA512 (which is ~3500 cycles on the same CPU).Still, it's nice that the simpler solution is much faster as well.
Compatibility verified with xfstests generic/548.
Quoted 8 lines
Signed-off-by Eric Biggers <[email protected]>---
This patch is targeting fscrypt/for-next
fs/crypto/Kconfig | 2 +- fs/crypto/keysetup_v1.c | 87 +++++++++++++---------------------------- 2 files changed, 29 insertions(+), 60 deletions(-)
Applied to https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=for-next
- Eric