Page MenuHomeFreeBSD

crypto: Support Chacha20-Poly1305 with a nonce size of 8 bytes.
ClosedPublic

Authored by jhb on Sep 24 2021, 6:06 PM.
Tags
None
Referenced Files
F132423819: D32122.id95657.diff
Thu, Oct 16, 7:49 PM
Unknown Object (File)
Tue, Oct 14, 10:07 AM
Unknown Object (File)
Fri, Oct 10, 11:17 AM
Unknown Object (File)
Thu, Oct 9, 4:13 AM
Unknown Object (File)
Wed, Oct 8, 2:43 PM
Unknown Object (File)
Thu, Oct 2, 4:56 AM
Unknown Object (File)
Wed, Sep 24, 3:28 PM
Unknown Object (File)
Tue, Sep 23, 2:34 PM
Subscribers

Details

Summary

This is useful for WireGuard which uses a nonce of 8 bytes rather
than the 12 bytes used for IPsec and TLS.

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

jhb requested review of this revision.Sep 24 2021, 6:06 PM

Both ossl0 and cryptosoft0 pass cryptocheck tests with both nonce sizes. In addition, I have used the 8 byte nonce variant in a patch to the upstream Wireguard FreeBSD driver which passed its own tests as well as an interoperability test with the stock driver on another VM using WireGuard's own Chacha20-Poly1305 implementation.

Once this is merged this will need a __FreeBSD_version followup bump so WireGuard (and other potential consumers) can detect when the 8 byte nonce is supported.

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

TLS itself doesn't allow records larger than (roughly) 2^14 bytes, so
this does seem pretty harmless

This revision was not accepted when it landed; it landed in state Needs Review.Oct 6 2021, 9:11 PM
This revision was automatically updated to reflect the committed changes.