cryptosoft: Fix support for variable tag lengths in AES-CCM.
ClosedPublic
Actions

Authored by jhb on Sep 24 2021, 6:05 PM.

Details

Reviewers

sef
markj
kithrup_mac.com

Commits

rG9039a0fae46e: cryptosoft: Fix support for variable tag lengths in AES-CCM.
rG4361c4eb6e36: cryptosoft: Fix support for variable tag lengths in AES-CCM.

Summary

The tag length is included as one of the values in the flags byte of
block 0 passed to CBC_MAC, so merely copying the first N bytes is
insufficient.

To avoid adding more sideband data to the CBC MAC software context,
pull the generation of block 0, the AAD length, and AAD padding out of
cbc_mac.c and into cryptosoft.c. This matches how GCM/GMAC are
handled where the length block is constructed in cryptosoft.c and
passed as an input to the Update callback. As a result, the CBC MAC
Update() routine is now much simpler and simply performs the
XOR-and-encrypt step on each input block.

While here, avoid a copy to the staging block in the Update routine
when one or more full blocks are passed as input to the Update
callback.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

jhb created this revision.Sep 24 2021, 6:05 PM

Herald added subscribers: ae, jmg, imp. · View Herald TranscriptSep 24 2021, 6:05 PM

jhb requested review of this revision.Sep 24 2021, 6:05 PM

Harbormaster completed remote builds in B41721: Diff 95654.Sep 24 2021, 6:05 PM

jhb added a parent revision: D32119: safexcel: Support truncated tags for AES-CCM..Sep 24 2021, 6:06 PM

jhb added a child revision: D32121: crypto: Test all of the AES-CCM KAT vectors..

jhb mentioned this in D32117: ccr: Support AES-CCM requests with truncated tags..Sep 24 2021, 6:16 PM

Tested via the AES-CCM NIST KAT vectors.

jhb added reviewers: sef, markj.Sep 27 2021, 9:41 PM

jhb added inline comments.Sep 27 2021, 9:44 PM

sys/dev/cxgbe/crypto/t4_crypto.c
1899	These are duplicated only to mimic cryptosoft.c. I should probably change ccr at some point to allocate an internal software crypto session and feed requests into that rather than duplicating the code here.
sys/opencrypto/cryptosoft.c
640	It is might be worth exposing some variant of these functions publicly as ccr, aesni, and safexcel all have their own routines to build b0 and the AAD length words (not counting that ccr duplicates these exact functions again in its software fallback). Public versions could perhaps take the crp as an argument rather than all the broken out fields.