Page MenuHomeFreeBSD

ossl: Add support for ETA mode
ClosedPublic

Authored by kd on Sep 24 2021, 11:38 AM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Mar 5, 7:32 AM
Unknown Object (File)
Tue, Feb 25, 1:14 AM
Unknown Object (File)
Fri, Feb 21, 11:31 PM
Unknown Object (File)
Wed, Feb 12, 9:44 PM
Unknown Object (File)
Wed, Feb 12, 6:53 AM
Unknown Object (File)
Thu, Feb 6, 6:26 AM
Unknown Object (File)
Feb 1 2025, 1:33 PM
Unknown Object (File)
Feb 1 2025, 1:32 PM
Subscribers

Details

Summary

With the support for AES-CBC we can now handle ETA requests.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

kd requested review of this revision.Sep 24 2021, 11:38 AM
kd created this revision.
jhb added inline comments.
sys/crypto/openssl/ossl.c
176

I don't think ETA makes sense for CHACHA20. I would perhaps require sc->has_aes as the only likely candidates for ETA use (AES-CBC, AES-CTR, and AES-XTS) will all need has_aes

This revision is now accepted and ready to land.Nov 4 2021, 9:02 PM

Don't allow for creating ETA sessions witch CHACHA20 used as a cipher.

This revision now requires review to proceed.Nov 5 2021, 8:52 AM
sys/crypto/openssl/ossl.c
176

Good point. Since we have AEAD of CHACH20+POLY1305 you're right that it doesn't make sense to try to use it for ETA.
I inverted part of this logic instead, checking just for sc->has_aes here would still allow someone to create an ETA session with CHACHA20 as the cipher.

This revision is now accepted and ready to land.Nov 5 2021, 5:01 PM
This revision was automatically updated to reflect the committed changes.