Page MenuHomeFreeBSD

armv8crypto: Fix some edge cases in the AES-GCM implementation
ClosedPublic

Authored by markj on Fri, Feb 5, 2:25 PM.

Details

Summary
  • We only hash up to the first 16 bytes of the AAD.
  • When computing the digest during decryption, handle the case where len == trailer properly.

While here:

  • trailer is always smaller than AES_BLOCK_LEN, so remove a pair of unnecessary modulus operations.
  • Replace some byte-by-byte loops with memcpy() and memset() calls. In particular, zero the full block before copying a partial block into it since we do that elsewhere and it means that the memset() length is known at compile time.
Test Plan

Noticed when doing some refactoring, verified with cryptocheck.

Specifically, I used cryptocheck -d soft -a aes-gcm -z.

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.