Page MenuHomeFreeBSD

crypto: Support Chacha20-Poly1305 with a nonce size of 8 bytes.
ClosedPublic

Authored by jhb on Sep 24 2021, 6:06 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Feb 18, 8:23 AM
Unknown Object (File)
Sat, Feb 3, 8:13 AM
Unknown Object (File)
Jan 1 2024, 5:51 AM
Unknown Object (File)
Dec 25 2023, 1:43 PM
Unknown Object (File)
Dec 23 2023, 3:58 AM
Unknown Object (File)
Dec 7 2023, 8:39 PM
Unknown Object (File)
Dec 2 2023, 7:05 PM
Unknown Object (File)
Sep 30 2023, 3:18 AM
Subscribers

Details

Summary

This is useful for WireGuard which uses a nonce of 8 bytes rather
than the 12 bytes used for IPsec and TLS.

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

jhb requested review of this revision.Sep 24 2021, 6:06 PM

Both ossl0 and cryptosoft0 pass cryptocheck tests with both nonce sizes. In addition, I have used the 8 byte nonce variant in a patch to the upstream Wireguard FreeBSD driver which passed its own tests as well as an interoperability test with the stock driver on another VM using WireGuard's own Chacha20-Poly1305 implementation.

Once this is merged this will need a __FreeBSD_version followup bump so WireGuard (and other potential consumers) can detect when the 8 byte nonce is supported.

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

TLS itself doesn't allow records larger than (roughly) 2^14 bytes, so
this does seem pretty harmless

This revision was not accepted when it landed; it landed in state Needs Review.Oct 6 2021, 9:11 PM
This revision was automatically updated to reflect the committed changes.