Page MenuHomeFreeBSD

Add support for including ESN in AES-NI crypto driver
ClosedPublic

Authored by jaz_semihalf.com on Nov 14 2019, 12:24 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Oct 9, 6:10 AM
Unknown Object (File)
Wed, Oct 8, 6:05 AM
Unknown Object (File)
Tue, Sep 30, 10:04 AM
Unknown Object (File)
Wed, Sep 24, 9:13 PM
Unknown Object (File)
Mon, Sep 22, 8:20 PM
Unknown Object (File)
Sun, Sep 21, 7:46 PM
Unknown Object (File)
Sep 15 2025, 9:16 AM
Unknown Object (File)
Sep 6 2025, 8:48 AM
Subscribers

Details

Summary

This patch adds support for IPSec ESN (Extended Sequence Numbers) in
encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode
(eg. AES-GCM).

For the encrypt and authenticate mode the ESN is stored in separate
crp_esn buffer because the high-order 32 bits of the sequence number are
appended after the Next Header (RFC 4303).

For the combined modes the high-order 32 bits of the sequence number
[e.g. RFC 4106, Chapter 5 AAD Construction] are part of crp_aad
(prepared by netipsec layer in case of ESN support enabled), therefore
non visible diff around combined modes.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

jaz_semihalf.com updated this revision to Diff 71770.

Align to new OCF

sys/crypto/aesni/aesni.c
256 ↗(On Diff #76980)

I'd probably just leave this spelled out in probesession.

873 ↗(On Diff #76980)

Woo, nice it was this easy to add!

This revision is now accepted and ready to land.Sep 24 2020, 10:18 PM
This revision was automatically updated to reflect the committed changes.