Page MenuHomeFreeBSD

cryptodev: Support ciphers with blocksize != ivsize
AbandonedPublic

Authored by cem on Mar 17 2018, 4:02 AM.
Tags
None
Referenced Files
F136443877: D14716.id40371.diff
Mon, Nov 17, 8:05 PM
Unknown Object (File)
Mon, Nov 17, 7:56 AM
Unknown Object (File)
Sun, Nov 16, 7:17 PM
Unknown Object (File)
Sat, Oct 25, 6:25 PM
Unknown Object (File)
Sat, Oct 25, 6:25 PM
Unknown Object (File)
Sat, Oct 25, 12:06 PM
Unknown Object (File)
Aug 14 2025, 11:48 PM
Unknown Object (File)
Jul 26 2025, 9:48 PM
Subscribers
None

Details

Summary

For example, Chacha20 expects a 16 byte IV+nonce but is a stream cipher with
an effective input block size of a single byte.

This change is the bare minimum; some inefficiencies remain in
cryptosoft.c. I plan to address those once there is a cipher to test
them against.

Diff Detail

Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 15609
Build 15645: arc lint + arc unit

Event Timeline

The transform's ivsize is how large an IV is — not its blocksize. Match code with intent.

Summary of existing enc algs:

  • Skipjack, AES-ICM, Blowfish, CAST-128, Camellia, DES3, Rijndael128, DES: Identical IV and block size (no functional change).
  • AES-GCM: block len of 1, IV len of 12.
  • AES-XTS: block len of 16, IV len of 8.
  • NULL: block 4, IV 0

For all of these it seems like the supplied ivsize is correct, in the cases where it makes a difference.

Also, for Chacha20 (not yet added to OCF): block len 1, IV len 16 (IV + Nonce anyway).

Does this make sense?