Page MenuHomeFreeBSD

cryptodev: Support ciphers with blocksize != ivsize
AbandonedPublic

Authored by cem on Mar 17 2018, 4:02 AM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 20 2023, 2:12 AM
Unknown Object (File)
Nov 25 2023, 1:11 AM
Unknown Object (File)
Nov 23 2023, 4:09 PM
Unknown Object (File)
Nov 23 2023, 3:41 PM
Unknown Object (File)
Nov 17 2023, 6:40 AM
Unknown Object (File)
Nov 17 2023, 1:30 AM
Unknown Object (File)
Aug 24 2023, 12:10 AM
Unknown Object (File)
Jul 6 2023, 6:08 AM
Subscribers
None

Details

Summary

For example, Chacha20 expects a 16 byte IV+nonce but is a stream cipher with
an effective input block size of a single byte.

This change is the bare minimum; some inefficiencies remain in
cryptosoft.c. I plan to address those once there is a cipher to test
them against.

Diff Detail

Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 15609
Build 15645: arc lint + arc unit

Event Timeline

The transform's ivsize is how large an IV is — not its blocksize. Match code with intent.

Summary of existing enc algs:

  • Skipjack, AES-ICM, Blowfish, CAST-128, Camellia, DES3, Rijndael128, DES: Identical IV and block size (no functional change).
  • AES-GCM: block len of 1, IV len of 12.
  • AES-XTS: block len of 16, IV len of 8.
  • NULL: block 4, IV 0

For all of these it seems like the supplied ivsize is correct, in the cases where it makes a difference.

Also, for Chacha20 (not yet added to OCF): block len 1, IV len 16 (IV + Nonce anyway).

Does this make sense?