]> err.no Git - linux-2.6/log
linux-2.6
16 years ago[CRYPTO] aead: Add aead_geniv_alloc/aead_geniv_free
Herbert Xu [Wed, 12 Dec 2007 11:23:36 +0000 (19:23 +0800)]
[CRYPTO] aead: Add aead_geniv_alloc/aead_geniv_free

This patch creates the infrastructure to help the construction of IV
generator templates that wrap around AEAD algorithms by adding an IV
generator to them.  This is useful for AEAD algorithms with no built-in
IV generator or to replace their built-in generator.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aead: Allow algorithms with no givcrypt support
Herbert Xu [Wed, 12 Dec 2007 11:27:25 +0000 (19:27 +0800)]
[CRYPTO] aead: Allow algorithms with no givcrypt support

Some algorithms always require manual IV construction.  For instance,
the generic CCM algorithm requires the first byte of the IV to be manually
constructed.  Such algorithms are always used by other algorithms equipped
with their own IV generators and do not need IV generation per se.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aead: Add top-level givencrypt/givdecrypt calls
Herbert Xu [Sat, 8 Dec 2007 12:13:15 +0000 (20:13 +0800)]
[CRYPTO] aead: Add top-level givencrypt/givdecrypt calls

This patch finally makes the givencrypt/givdecrypt operations available
to users by adding crypto_aead_givencrypt and crypto_aead_givdecrypt.
A suite of helpers to allocate and fill in the request is also available.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Add givencrypt operation
Herbert Xu [Mon, 10 Dec 2007 08:20:24 +0000 (16:20 +0800)]
[CRYPTO] authenc: Add givencrypt operation

This patch implements the givencrypt function for authenc.  It simply
calls the givencrypt operation on the underlying cipher instead of encrypt.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aead: Add givcrypt operations
Herbert Xu [Mon, 10 Dec 2007 08:18:01 +0000 (16:18 +0800)]
[CRYPTO] aead: Add givcrypt operations

This patch adds the underlying givcrypt operations for aead and associated
support elements.  The rationale is identical to that of the skcipher
givcrypt operations, i.e., sometimes only the algorithm knows how the
IV should be generated.

A new request type aead_givcrypt_request is added which contains an
embedded aead_request structure with two new elements to support this
operation.  The new elements are seq and giv.  The seq field should
contain a strictly increasing 64-bit integer which may be used by
certain IV generators as an input value.  The giv field will be used
to store the generated IV.  It does not need to obey the alignment
requirements of the algorithm because it's not used during the operation.

The existing iv field must still be available as it will be used to store
intermediate IVs and the output IV if chaining is desired.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Add top-level givencrypt/givdecrypt calls
Herbert Xu [Sat, 1 Dec 2007 07:35:38 +0000 (18:35 +1100)]
[CRYPTO] skcipher: Add top-level givencrypt/givdecrypt calls

This patch finally makes the givencrypt/givdecrypt operations available
to users by adding crypto_skcipher_givencrypt and crypto_skcipher_givdecrypt.
A suite of helpers to allocate and fill in the request is also available.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] seqiv: Add Sequence Number IV Generator
Herbert Xu [Fri, 30 Nov 2007 10:38:37 +0000 (21:38 +1100)]
[CRYPTO] seqiv: Add Sequence Number IV Generator

This generator generates an IV based on a sequence number by xoring it
with a salt.  This algorithm is mainly useful for CTR and similar modes.

This patch also sets it as the default IV generator for ctr.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Remove crypto_spawn_ablkcipher
Herbert Xu [Sun, 2 Dec 2007 10:21:02 +0000 (21:21 +1100)]
[CRYPTO] skcipher: Remove crypto_spawn_ablkcipher

Now that gcm and authenc have been converted to crypto_spawn_skcipher,
this patch removes the obsolete crypto_spawn_ablkcipher function.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Use crypto_grab_skcipher
Herbert Xu [Fri, 7 Dec 2007 11:26:11 +0000 (19:26 +0800)]
[CRYPTO] gcm: Use crypto_grab_skcipher

This patch converts the gcm algorithm over to crypto_grab_skcipher
which is a prerequisite for IV generation.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Allow block cipher parameter
Herbert Xu [Fri, 7 Dec 2007 12:31:10 +0000 (20:31 +0800)]
[CRYPTO] gcm: Allow block cipher parameter

This patch adds the gcm_base template which takes a block cipher
parameter instead of cipher.  This allows the user to specify a
specific CTR implementation.

This also fixes a leak of the cipher algorithm that was previously
looked up but never freed.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Use crypto_grab_skcipher
Herbert Xu [Mon, 17 Dec 2007 12:12:49 +0000 (20:12 +0800)]
[CRYPTO] authenc: Use crypto_grab_skcipher

This patch converts the authenc algorithm over to crypto_grab_skcipher
which is a prerequisite for IV generation.

This patch also changes authenc to set its ASYNC status depending on
the ASYNC status of the underlying skcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Create default givcipher instances
Herbert Xu [Tue, 4 Dec 2007 01:46:48 +0000 (12:46 +1100)]
[CRYPTO] skcipher: Create default givcipher instances

This patch makes crypto_alloc_ablkcipher/crypto_grab_skcipher always
return algorithms that are capable of generating their own IVs through
givencrypt and givdecrypt.  Each algorithm may specify its default IV
generator through the geniv field.

For algorithms that do not set the geniv field, the blkcipher layer will
pick a default.  Currently it's chainiv for synchronous algorithms and
eseqiv for asynchronous algorithms.  Note that if these wrappers do not
work on an algorithm then that algorithm must specify its own geniv or
it can't be used at all.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] eseqiv: Add Encrypted Sequence Number IV Generator
Herbert Xu [Wed, 5 Dec 2007 01:10:53 +0000 (12:10 +1100)]
[CRYPTO] eseqiv: Add Encrypted Sequence Number IV Generator

This generator generates an IV based on a sequence number by xoring it
with a salt and then encrypting it with the same key as used to encrypt
the plain text.  This algorithm requires that the block size be equal
to the IV size.  It is mainly useful for CBC.

It has one noteworthy property that for IPsec the IV happens to lie
just before the plain text so the IV generation simply increases the
number of encrypted blocks by one.  Therefore the cost of this generator
is entirely dependent on the speed of the underlying cipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Added skcipher_givcrypt_complete
Herbert Xu [Fri, 30 Nov 2007 09:17:28 +0000 (20:17 +1100)]
[CRYPTO] skcipher: Added skcipher_givcrypt_complete

This patch adds the helper skcipher_givcrypt_complete which should be
called when an ablkcipher algorithm has completed a givcrypt request.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] chainiv: Add chain IV generator
Herbert Xu [Tue, 27 Nov 2007 15:17:23 +0000 (23:17 +0800)]
[CRYPTO] chainiv: Add chain IV generator

The chain IV generator is the one we've been using in the IPsec stack.
It simply starts out with a random IV, then uses the last block of each
encrypted packet's cipher text as the IV for the next packet.

It can only be used by synchronous ciphers since we have to make sure
that we don't start the encryption of the next packet until the last
one has completed.

It does have the advantage of using very little CPU time since it doesn't
have to generate anything at all.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Add skcipher_geniv_alloc/skcipher_geniv_free
Herbert Xu [Wed, 5 Dec 2007 10:08:36 +0000 (21:08 +1100)]
[CRYPTO] skcipher: Add skcipher_geniv_alloc/skcipher_geniv_free

This patch creates the infrastructure to help the construction of givcipher
templates that wrap around existing blkcipher/ablkcipher algorithms by adding
an IV generator to them.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] cryptd: Use geniv of the underlying algorithm
Herbert Xu [Tue, 27 Nov 2007 13:15:31 +0000 (21:15 +0800)]
[CRYPTO] cryptd: Use geniv of the underlying algorithm

If the underlying algorithm specifies a specific geniv algorithm then
we should use it for the cryptd version as well.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Added geniv field
Herbert Xu [Tue, 27 Nov 2007 13:33:24 +0000 (21:33 +0800)]
[CRYPTO] skcipher: Added geniv field

This patch introduces the geniv field which indicates the default IV
generator for each algorithm.  It should point to a string that is not
freed as long as the algorithm is registered.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Add givcrypt operations and givcipher type
Herbert Xu [Mon, 17 Dec 2007 13:51:27 +0000 (21:51 +0800)]
[CRYPTO] skcipher: Add givcrypt operations and givcipher type

Different block cipher modes have different requirements for intialisation
vectors.  For example, CBC can use a simple randomly generated IV while
modes such as CTR must use an IV generation mechanisms that give a stronger
guarantee on the lack of collisions.  Furthermore, disk encryption modes
have their own IV generation algorithms.

Up until now IV generation has been left to the users of the symmetric
key cipher API.  This is inconvenient as the number of block cipher modes
increase because the user needs to be aware of which mode is supposed to
be paired with which IV generation algorithm.

Therefore it makes sense to integrate the IV generation into the crypto
API.  This patch takes the first step in that direction by creating two
new ablkcipher operations, givencrypt and givdecrypt that generates an
IV before performing the actual encryption or decryption.

The operations are currently not exposed to the user.  That will be done
once the underlying functionality has actually been implemented.

It also creates the underlying givcipher type.  Algorithms that directly
generate IVs would use it instead of ablkcipher.  All other algorithms
(including all existing ones) would generate a givcipher algorithm upon
registration.  This givcipher algorithm will be constructed from the geniv
string that's stored in every algorithm.  That string will locate a template
which is instantiated by the blkcipher/ablkcipher algorithm in question to
give a givcipher algorithm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] skcipher: Add crypto_grab_skcipher interface
Herbert Xu [Mon, 17 Dec 2007 12:07:31 +0000 (20:07 +0800)]
[CRYPTO] skcipher: Add crypto_grab_skcipher interface

Note: From now on the collective of ablkcipher/blkcipher/givcipher will
be known as skcipher, i.e., symmetric key cipher.  The name blkcipher has
always been much of a misnomer since it supports stream ciphers too.

This patch adds the function crypto_grab_skcipher as a new way of getting
an ablkcipher spawn.  The problem is that previously we did this in two
steps, first getting the algorithm and then calling crypto_init_spawn.

This meant that each spawn user had to be aware of what type and mask to
use for these two steps.  This is difficult and also presents a problem
when the type/mask changes as they're about to be for IV generators.

The new interface does both steps together just like crypto_alloc_ablkcipher.

As a side-effect this also allows us to be stronger on type enforcement
for spawns.  For now this is only done for ablkcipher but it's trivial
to extend for other types.

This patch also moves the type/mask logic for skcipher into the helpers
crypto_skcipher_type and crypto_skcipher_mask.

Finally this patch introduces the function crypto_require_sync to determine
whether the user is specifically requesting a sync algorithm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Add support for async ciphers
Herbert Xu [Mon, 17 Dec 2007 13:42:08 +0000 (21:42 +0800)]
[CRYPTO] gcm: Add support for async ciphers

This patch adds the necessary changes for GCM to be used with async
ciphers.  This would allow it to be used with hardware devices that
support CTR.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Refactor into ctr and rfc3686
Herbert Xu [Mon, 17 Dec 2007 13:34:32 +0000 (21:34 +0800)]
[CRYPTO] ctr: Refactor into ctr and rfc3686

As discussed previously, this patch moves the basic CTR functionality
into a chainable algorithm called ctr.  The IPsec-specific variant of
it is now placed on top with the name rfc3686.

So ctr(aes) gives a chainable cipher with IV size 16 while the IPsec
variant will be called rfc3686(ctr(aes)).  This patch also adjusts
gcm accordingly.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] blkcipher: Merge ablkcipher and blkcipher into one option/module
Herbert Xu [Tue, 27 Nov 2007 11:48:27 +0000 (19:48 +0800)]
[CRYPTO] blkcipher: Merge ablkcipher and blkcipher into one option/module

With the impending addition of the givcipher type, both blkcipher and
ablkcipher algorithms will use it to create givcipher objects.  As such
it no longer makes sense to split the system between ablkcipher and
blkcipher.  In particular, both ablkcipher.c and blkcipher.c would need
to use the givcipher type which has to reside in ablkcipher.c since it
shares much code with it.

This patch merges the two Kconfig options as well as the modules into one.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Fix request context alignment
Herbert Xu [Wed, 12 Dec 2007 11:16:38 +0000 (19:16 +0800)]
[CRYPTO] gcm: Fix request context alignment

This patch fixes the request context alignment so that it is actually
aligned to the value required by the algorithm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] api: Add crypto_attr_alg_name
Herbert Xu [Fri, 7 Dec 2007 12:18:17 +0000 (20:18 +0800)]
[CRYPTO] api: Add crypto_attr_alg_name

This patch adds a new helper crypto_attr_alg_name which is basically the
first half of crypto_attr_alg.  That is, it returns an algorithm name
parameter as a string without looking it up.  The caller can then look it
up immediately or defer it until later.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] api: Sanitise mask when allocating ablkcipher/hash
Herbert Xu [Sat, 1 Dec 2007 10:47:07 +0000 (21:47 +1100)]
[CRYPTO] api: Sanitise mask when allocating ablkcipher/hash

When allocating ablkcipher/hash objects, we use a mask that's wider than
the usual type mask.  This patch sanitises the mask supplied by the user
so we don't end up using a narrower mask which may lead to unintended
results.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Select HASH in Kconfig
Borislav Petkov [Fri, 14 Dec 2007 08:43:32 +0000 (16:43 +0800)]
[CRYPTO] authenc: Select HASH in Kconfig

i get here:

----
  LD      vmlinux
  SYSMAP  System.map
  SYSMAP  .tmp_System.map
  Building modules, stage 2.
  MODPOST 226 modules
ERROR: "crypto_hash_type" [crypto/authenc.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2
---

which fails because crypto_hash_type is declared in crypto/hash.c. You might wanna
fix it like so:

Signed-off-by: Borislav Petkov <bbpetkov@yahoo.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: Add __dev{init,exit} annotations
Adrian Bunk [Wed, 12 Dec 2007 02:42:41 +0000 (10:42 +0800)]
[CRYPTO] geode: Add __dev{init,exit} annotations

This patch adds __dev{init,exit} annotations.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Merge common hashing code
Herbert Xu [Mon, 10 Dec 2007 08:15:41 +0000 (16:15 +0800)]
[CRYPTO] authenc: Merge common hashing code

This patch merges the common hashing code between encryption and decryption.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Use RTA_OK to check length
Herbert Xu [Mon, 10 Dec 2007 02:55:21 +0000 (10:55 +0800)]
[CRYPTO] authenc: Use RTA_OK to check length

This patch changes setkey to use RTA_OK to check the validity of the
setkey request.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Fix typo in ivsize
Herbert Xu [Mon, 10 Dec 2007 02:54:44 +0000 (10:54 +0800)]
[CRYPTO] authenc: Fix typo in ivsize

The ivsize should be fetched from ablkcipher, not blkcipher.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] s390-aes: Use correct encrypt/decrypt function in fallback
Sebastian Siewior [Mon, 10 Dec 2007 07:49:41 +0000 (15:49 +0800)]
[CRYPTO] s390-aes: Use correct encrypt/decrypt function in fallback

crypto_blkcipher_decrypt is wrong because it does not care about
the IV.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: Use correct encrypt/decrypt function in fallback
Sebastian Siewior [Mon, 10 Dec 2007 07:48:17 +0000 (15:48 +0800)]
[CRYPTO] geode: Use correct encrypt/decrypt function in fallback

crypto_blkcipher_decrypt is wrong because it does not care about
the IV.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Added salsa20 speed test
Tan Swee Heng [Fri, 7 Dec 2007 09:17:43 +0000 (17:17 +0800)]
[CRYPTO] tcrypt: Added salsa20 speed test

This patch adds a simple speed test for salsa20.
Usage: modprobe tcrypt mode=206

Signed-of-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] lzo: Add LZO compression algorithm support
Zoltan Sogor [Fri, 7 Dec 2007 08:53:23 +0000 (16:53 +0800)]
[CRYPTO] lzo: Add LZO compression algorithm support

Add LZO compression algorithm support

Signed-off-by: Zoltan Sogor <weth@inf.u-szeged.hu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Add common compression tester function
Zoltan Sogor [Fri, 7 Dec 2007 08:48:11 +0000 (16:48 +0800)]
[CRYPTO] tcrypt: Add common compression tester function

Add common compression tester function
Modify deflate test case to use the common compressor test function

Signed-off-by: Zoltan Sogor <weth@inf.u-szeged.hu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Salsa20 large test vector
Tan Swee Heng [Fri, 7 Dec 2007 08:41:29 +0000 (16:41 +0800)]
[CRYPTO] tcrypt: Salsa20 large test vector

This is a large test vector for Salsa20 that crosses the 4096-bytes
page boundary.

Signed-off-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] salsa20_generic: Fix multi-page processing
Tan Swee Heng [Fri, 7 Dec 2007 08:38:45 +0000 (16:38 +0800)]
[CRYPTO] salsa20_generic: Fix multi-page processing

This patch fixes the multi-page processing bug that affects large test
vectors (the same bug that previously affected ctr.c).

There is an optimization for the case walk.nbytes == nbytes. Also we
now use crypto_xor() instead of adhoc XOR routines.

Signed-off-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Put abreq in private context instead of on stack
Herbert Xu [Thu, 6 Dec 2007 06:59:53 +0000 (14:59 +0800)]
[CRYPTO] gcm: Put abreq in private context instead of on stack

The abreq structure is currently allocated on the stack.  This is broken
if the underlying algorithm is asynchronous.  This patch changes it so
that it's taken from the private context instead which has been enlarged
accordingly.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] scatterwalk: Restore custom sg chaining for now
Herbert Xu [Wed, 5 Dec 2007 09:59:25 +0000 (20:59 +1100)]
[CRYPTO] scatterwalk: Restore custom sg chaining for now

Unfortunately the generic chaining hasn't been ported to all architectures
yet, and notably not s390.  So this patch restores the chainging that we've
been using previously which does work everywhere.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] scatterwalk: Move scatterwalk.h to linux/crypto
Herbert Xu [Fri, 7 Dec 2007 10:52:49 +0000 (18:52 +0800)]
[CRYPTO] scatterwalk: Move scatterwalk.h to linux/crypto

The scatterwalk infrastructure is used by algorithms so it needs to
move out of crypto for future users that may live in drivers/crypto
or asm/*/crypto.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aead: Return EBADMSG for ICV mismatch
Herbert Xu [Tue, 4 Dec 2007 09:07:27 +0000 (20:07 +1100)]
[CRYPTO] aead: Return EBADMSG for ICV mismatch

This patch changes gcm/authenc to return EBADMSG instead of EINVAL for
ICV mismatches.  This convention has already been adopted by IPsec.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: Fix ICV handling
Herbert Xu [Tue, 4 Dec 2007 08:17:50 +0000 (19:17 +1100)]
[CRYPTO] gcm: Fix ICV handling

The crypto_aead convention for ICVs is to include it directly in the
output.  If we decided to change this in future then we would make
the ICV (if the algorithm has an explicit one) available in the
request itself.

For now no algorithm needs this so this patch changes gcm to conform
to this convention.  It also adjusts the tcrypt aead tests to take
this into account.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Make gcm available as a standalone test
Herbert Xu [Sun, 2 Dec 2007 03:55:47 +0000 (14:55 +1100)]
[CRYPTO] tcrypt: Make gcm available as a standalone test

Currently the gcm(aes) tests have to be taken together with all other
ciphers.  This patch makes it available by itself at number 35.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Fix hash verification
Herbert Xu [Tue, 4 Dec 2007 09:04:21 +0000 (20:04 +1100)]
[CRYPTO] authenc: Fix hash verification

The previous code incorrectly included the hash in the verification which
also meant that we'd crash and burn when it comes to actually verifying
the hash since we'd go past the end of the SG list.

This patch fixes that by subtracting authsize from cryptlen at the start.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Move enckeylen into key itself
Herbert Xu [Thu, 22 Nov 2007 15:11:53 +0000 (23:11 +0800)]
[CRYPTO] authenc: Move enckeylen into key itself

Having enckeylen as a template parameter makes it a pain for hardware
devices that implement ciphers with many key sizes since each one would
have to be registered separately.

Since the authenc algorithm is mainly used for legacy purposes where its
key is going to be constructed out of two separate keys, we can in fact
embed this value into the key itself.

This patch does this by prepending an rtnetlink header to the key that
contains the encryption key length.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aead: Make authsize a run-time parameter
Herbert Xu [Sun, 2 Dec 2007 07:49:21 +0000 (18:49 +1100)]
[CRYPTO] aead: Make authsize a run-time parameter

As it is authsize is an algorithm paramter which cannot be changed at
run-time.  This is inconvenient because hardware that implements such
algorithms would have to register each authsize that they support
separately.

Since authsize is a property common to all AEAD algorithms, we can add
a function setauthsize that sets it at run-time, just like setkey.

This patch does exactly that and also changes authenc so that authsize
is no longer a parameter of its template.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] authenc: Use or instead of max on alignment masks
Herbert Xu [Thu, 22 Nov 2007 14:46:40 +0000 (22:46 +0800)]
[CRYPTO] authenc: Use or instead of max on alignment masks

Since alignment masks are always one less than a power of two, we can
use binary or to find their maximum.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[HWRNG] pasemi: Add missing wait argument to data_present
Kamalesh Babulal [Sat, 1 Dec 2007 01:52:35 +0000 (12:52 +1100)]
[HWRNG] pasemi: Add missing wait argument to data_present

drivers/char/hw_random/pasemi-rng.c: In function `pasemi_rng_data_present':
drivers/char/hw_random/pasemi-rng.c:53: error: `wait' undeclared (first use in this function)
drivers/char/hw_random/pasemi-rng.c:53: error: (Each undeclared identifier is reported only once
drivers/char/hw_random/pasemi-rng.c:53: error: for each function it appears in.)
drivers/char/hw_random/pasemi-rng.c: At top level:
drivers/char/hw_random/pasemi-rng.c:93: warning: initialization from incompatible pointer type

Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes_s390: Add fallback driver
Sebastian Siewior [Sat, 1 Dec 2007 01:47:37 +0000 (12:47 +1100)]
[CRYPTO] aes_s390: Add fallback driver

Some CPUs support only 128 bit keys in HW. This patch adds SW fallback
support for the other keys which may be required. The generic algorithm
(and the block mode) must be availble in case of a fallback.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Use print_hex_dump from linux/kernel.h
Denis Cheng [Fri, 30 Nov 2007 05:59:30 +0000 (16:59 +1100)]
[CRYPTO] tcrypt: Use print_hex_dump from linux/kernel.h

These utilities implemented in lib/hexdump.c are more handy, please use this.

Signed-off-by: Denis Cheng <crquan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: do not copy the IV too often
Sebastian Siewior [Fri, 30 Nov 2007 05:36:57 +0000 (16:36 +1100)]
[CRYPTO] geode: do not copy the IV too often

There is no reason to keep the IV in the private structre. Instead keep
just a pointer to make the patch smaller :)
This also remove a few memcpy()s

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: AES CBC test vectors from NIST SP800-38A
Jan Glauber [Fri, 30 Nov 2007 04:57:05 +0000 (15:57 +1100)]
[CRYPTO] tcrypt: AES CBC test vectors from NIST SP800-38A

Add test vectors to tcrypt for AES in CBC mode for key sizes 192 and 256.
The test vectors are copied from NIST SP800-38A.

Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: AES CTR large test vector
Tan Swee Heng [Thu, 29 Nov 2007 13:36:07 +0000 (00:36 +1100)]
[CRYPTO] tcrypt: AES CTR large test vector

This patch adds a large AES CTR mode test vector. The test vector is
4100 bytes in size. It was generated using a C++ program that called
Crypto++.

Note that this patch increases considerably the size of "struct
cipher_testvec" and hence the size of tcrypt.ko.

Signed-off-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Support for large test vectors
Tan Swee Heng [Thu, 29 Nov 2007 13:30:11 +0000 (00:30 +1100)]
[CRYPTO] tcrypt: Support for large test vectors

Currently the number of entries in a cipher test vector template is
limited by TVMEMSIZE/sizeof(struct cipher_testvec). This patch
circumvents the problem by pointing cipher_tv to each entry in the
template, rather than the template itself.

Signed-off-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Fix multi-page processing
Herbert Xu [Thu, 29 Nov 2007 13:23:53 +0000 (00:23 +1100)]
[CRYPTO] ctr: Fix multi-page processing

When the data spans across a page boundary, CTR may incorrectly process
a partial block in the middle because the blkcipher walking code may
supply partial blocks in the middle as long as the total length of the
supplied data is more than a block.  CTR is supposed to return any unused
partial block in that case to the walker.

This patch fixes this by doing exactly that, returning partial blocks to
the walker unless we received less than a block-worth of data to start
with.

This also allows us to optimise the bulk of the processing since we no
longer have to worry about partial blocks until the very end.

Thanks to Tan Swee Heng for fixes and actually testing this :)

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes-asm: Merge common glue code
Sebastian Siewior [Thu, 29 Nov 2007 13:15:11 +0000 (00:15 +1100)]
[CRYPTO] aes-asm: Merge common glue code

32 bit and 64 bit glue code is using (now) the same
piece code. This patch unifies them.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] gcm: New algorithm
Mikko Herranen [Mon, 26 Nov 2007 14:24:11 +0000 (22:24 +0800)]
[CRYPTO] gcm: New algorithm

Add GCM/GMAC support to cryptoapi.

GCM (Galois/Counter Mode) is an AEAD mode of operations for any block cipher
with a block size of 16.  The typical example is AES-GCM.

Signed-off-by: Mikko Herranen <mh1@iki.fi>
Reviewed-by: Mika Kukkonen <mika.kukkonen@nsn.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] tcrypt: Add aead support
Mikko Herranen [Mon, 26 Nov 2007 14:12:07 +0000 (22:12 +0800)]
[CRYPTO] tcrypt: Add aead support

Add AEAD support to tcrypt, needed by GCM.

Signed-off-by: Mikko Herranen <mh1@iki.fi>
Reviewed-by: Mika Kukkonen <mika.kukkonen@nsn.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Move more common code into camellia_setup_tail
Denys Vlasenko [Fri, 23 Nov 2007 13:21:03 +0000 (21:21 +0800)]
[CRYPTO] camellia: Move more common code into camellia_setup_tail

Analogously to camellia7 patch, move
"absorb kw2 to other subkeys" and "absorb kw4 to other subkeys"
code parts into camellia_setup_tail(). This further reduces
source and object code size at the cost of two brances
in key setup code.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Move common code into camellia_setup_tail
Denys Vlasenko [Fri, 23 Nov 2007 13:14:24 +0000 (21:14 +0800)]
[CRYPTO] camellia: Move common code into camellia_setup_tail

Move "key XOR is end of F-function" code part into
camellia_setup_tail(), it is sufficiently similar
between camellia_setup128 and camellia_setup256.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Merge encrypt/decrypt routines for all key lengths
Denys Vlasenko [Fri, 23 Nov 2007 13:10:03 +0000 (21:10 +0800)]
[CRYPTO] camellia: Merge encrypt/decrypt routines for all key lengths

unifies encrypt/decrypt routines for different key lengths.
This reduces module size by ~25%, with tiny (less than 1%)
speed impact.
Also collapses encrypt/decrypt into more readable
(visually shorter) form using macros.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Code shrink
Denys Vlasenko [Fri, 23 Nov 2007 13:05:55 +0000 (21:05 +0800)]
[CRYPTO] camellia: Code shrink

Remove unused macro params.
Use (u8)(expr) instead of (expr) & 0xff,
helps gcc to realize how to use simpler commands.
Move CAMELLIA_FLS macro closer to encrypt/decrypt routines.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Use crypto_inc and crypto_xor
Herbert Xu [Tue, 20 Nov 2007 12:32:56 +0000 (20:32 +0800)]
[CRYPTO] ctr: Use crypto_inc and crypto_xor

This patch replaces the custom inc/xor in CTR with the generic functions.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] pcbc: Use crypto_xor
Herbert Xu [Tue, 20 Nov 2007 09:49:49 +0000 (17:49 +0800)]
[CRYPTO] pcbc: Use crypto_xor

This patch replaces the custom xor in CBC with the generic crypto_xor.

It changes the operations for in-place encryption slightly to avoid
calling crypto_xor with tmpbuf since it is not necessarily aligned.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] cbc: Require block size to be a power of 2
Herbert Xu [Tue, 20 Nov 2007 09:36:00 +0000 (17:36 +0800)]
[CRYPTO] cbc: Require block size to be a power of 2

All common block ciphers have a block size that's a power of 2.  In fact,
all of our block ciphers obey this rule.

If we require this then CBC can be optimised to avoid an expensive divide
on in-place decryption.

I've also changed the saving of the first IV in the in-place decryption
case to the last IV because that lets us use walk->iv (which is already
aligned) for the xor operation where alignment is required.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] cbc: Use crypto_xor
Herbert Xu [Tue, 20 Nov 2007 09:33:39 +0000 (17:33 +0800)]
[CRYPTO] cbc: Use crypto_xor

This patch replaces the custom xor in CBC with the generic crypto_xor.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] api: Add crypto_inc and crypto_xor
Herbert Xu [Tue, 20 Nov 2007 09:26:06 +0000 (17:26 +0800)]
[CRYPTO] api: Add crypto_inc and crypto_xor

With the addition of more stream ciphers we need to curb the proliferation
of ad-hoc xor functions.  This patch creates a generic pair of functions,
crypto_inc and crypto_xor which does big-endian increment and exclusive or,
respectively.

For optimum performance, they both use u32 operations so alignment must be
as that of u32 even though the arguments are of type u8 *.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[HIFN]: Add support for using the random number generator
Patrick McHardy [Wed, 21 Nov 2007 04:51:52 +0000 (12:51 +0800)]
[HIFN]: Add support for using the random number generator

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[HIFN]: Improve PLL initialization
Patrick McHardy [Wed, 21 Nov 2007 04:47:13 +0000 (12:47 +0800)]
[HIFN]: Improve PLL initialization

The current PLL initalization has a number of deficiencies:

- uses fixed multiplier of 8, which overclocks the chip when using a
  reference clock that operates at frequencies above 33MHz. According
  to a comment in the BSD source, this is true for the external clock
  on almost all every board.

- writes to a reserved bit

- doesn't follow the initialization procedure specified in chapter
  6.11.1 of the HIFN hardware users guide

- doesn't allow to use the PCI clock

This patch adds a module parameter to specify the reference clock
(pci or external) and its frequency and uses that to calculate the
optimum multiplier to reach the maximal speed. By default it uses
the external clock and assumes a speed of 66MHz, which effectively
halfs the frequency currently used.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[HWRNG]: move status polling loop to data_present callbacks
Patrick McHardy [Wed, 21 Nov 2007 04:24:45 +0000 (12:24 +0800)]
[HWRNG]: move status polling loop to data_present callbacks

Handle waiting for new random within the drivers themselves, this allows to
use better suited timeouts for the individual rngs.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] salsa20: Salsa20 stream cipher
Tan Swee Heng [Fri, 23 Nov 2007 11:45:00 +0000 (19:45 +0800)]
[CRYPTO] salsa20: Salsa20 stream cipher

This patch implements the Salsa20 stream cipher using the blkcipher interface.

The core cipher code comes from Daniel Bernstein's submission to eSTREAM:
  http://www.ecrypt.eu.org/stream/svn/viewcvs.cgi/ecrypt/trunk/submissions/salsa20/full/ref/

The test vectors comes from:
  http://www.ecrypt.eu.org/stream/svn/viewcvs.cgi/ecrypt/trunk/submissions/salsa20/full/

It has been tested successfully with "modprobe tcrypt mode=34" on an
UML instance.

Signed-off-by: Tan Swee Heng <thesweeheng@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ablkcipher: Add distinct ABLKCIPHER type
Herbert Xu [Thu, 15 Nov 2007 14:36:07 +0000 (22:36 +0800)]
[CRYPTO] ablkcipher: Add distinct ABLKCIPHER type

Up until now we have ablkcipher algorithms have been identified as
type BLKCIPHER with the ASYNC bit set.  This is suboptimal because
ablkcipher refers to two things.  On the one hand it refers to the
top-level ablkcipher interface with requests.  On the other hand it
refers to and algorithm type underneath.

As it is you cannot request a synchronous block cipher algorithm
with the ablkcipher interface on top.  This is a problem because
we want to be able to eventually phase out the blkcipher top-level
interface.

This patch fixes this by making ABLKCIPHER its own type, just as
we have distinct types for HASH and DIGEST.  The type it associated
with the algorithm implementation only.

Which top-level interface is used for synchronous block ciphers is
then determined by the mask that's used.  If it's a specific mask
then the old blkcipher interface is given, otherwise we go with the
new ablkcipher interface.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] doc: Update api-intro.txt
Herbert Xu [Thu, 15 Nov 2007 11:00:06 +0000 (19:00 +0800)]
[CRYPTO] doc: Update api-intro.txt

This patch updates the list of transforms we support and clarifies that
the Block Ciphers interface in fact supports all ciphers including stream
ciphers.

It also removes the obsolete Configuration Notes section and adds the
linux-crypto mailing list as the primary bug reporting address.

Finally it documents the fact that setkey should only be called from
user context.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] scatterwalk: Use generic scatterlist chaining
Herbert Xu [Thu, 15 Nov 2007 04:08:45 +0000 (12:08 +0800)]
[CRYPTO] scatterwalk: Use generic scatterlist chaining

This patch converts the crypto scatterwalk code to use the generic
scatterlist chaining rather the version specific to crypto.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] hifn: Add missing includes
Andrew Morton [Tue, 13 Nov 2007 13:55:28 +0000 (21:55 +0800)]
[CRYPTO] hifn: Add missing includes

alpha:

drivers/crypto/hifn_795x.c: In function 'ablkcipher_walk_init':
drivers/crypto/hifn_795x.c:1231: error: implicit declaration of function 'sg_init_table'
drivers/crypto/hifn_795x.c:1243: error: implicit declaration of function 'sg_set_page'
drivers/crypto/hifn_795x.c: In function 'ablkcipher_walk_exit':
drivers/crypto/hifn_795x.c:1257: error: implicit declaration of function 'sg_page'
drivers/crypto/hifn_795x.c:1257: warning: passing argument 1 of '__free_pages' makes pointer from integer without a cast
drivers/crypto/hifn_795x.c: In function 'ablkcipher_add':
drivers/crypto/hifn_795x.c:1278: warning: passing argument 1 of 'kmap_atomic' makes pointer from integer without a cast
drivers/crypto/hifn_795x.c: In function 'ablkcipher_walk':
drivers/crypto/hifn_795x.c:1336: warning: passing argument 1 of 'kmap_atomic' makes pointer from integer without a cast
drivers/crypto/hifn_795x.c: In function 'hifn_setup_session':
drivers/crypto/hifn_795x.c:1465: warning: assignment makes pointer from integer without a cast
drivers/crypto/hifn_795x.c:1469: warning: assignment makes pointer from integer without a cast
drivers/crypto/hifn_795x.c:1472: warning: assignment makes pointer from integer without a cast
drivers/crypto/hifn_795x.c: In function 'ablkcipher_get':
drivers/crypto/hifn_795x.c:1593: warning: passing argument 1 of 'kmap_atomic' makes pointer from integer without a cast
{standard input}: Assembler messages:
{standard input}:7: Warning: setting incorrect section attributes for .got
drivers/crypto/hifn_795x.c: In function 'hifn_process_ready':
drivers/crypto/hifn_795x.c:1653: warning: passing argument 1 of 'kmap_atomic' makes pointer from integer without a cast
drivers/crypto/hifn_795x.c: In function 'hifn_probe':
drivers/crypto/hifn_795x.c:2438: error: 'DMA_32BIT_MASK' undeclared (first use in this function)
drivers/crypto/hifn_795x.c:2438: error: (Each undeclared identifier is reported only once
drivers/crypto/hifn_795x.c:2438: error: for each function it appears in.)
drivers/crypto/hifn_795x.c:2443: warning: format '%d' expects type 'int', but argument 4 has type 'long int'
drivers/crypto/hifn_795x.c:2443: warning: format '%d' expects type 'int', but argument 4 has type 'long int'

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] hifn: Make Kconfig option depend on PCI
Jan Glauber [Mon, 12 Nov 2007 13:56:38 +0000 (21:56 +0800)]
[CRYPTO] hifn: Make Kconfig option depend on PCI

The HIFN driver is currently selectable on s390 but wont compile.
Since it looks like HIFN needs PCI make the Kconfig dependent on PCI,
which is not available on s390.

Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>
Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] hifn: Schedule callback invocation to tasklet.
Evgeniy Polyakov [Sat, 10 Nov 2007 12:24:18 +0000 (20:24 +0800)]
[CRYPTO] hifn: Schedule callback invocation to tasklet.

This patch forces HIFN driver to invoke crypto request callbacks from
tasklet (softirq context) instead of hardirq context, since network
stack expects it to be called from bottom halves.

It is done by simply scheduling callback invocation via dedicated
tasklet. Workqueue solution was dropped because of tooo slow
rescheduling performance (7 times slower than tasklet, for mode details
one can check this link:
http://tservice.net.ru/~s0mbre/blog/devel/other/2007_11_09.html).

Driver passed all AES and DES tests in tcryt.c module.

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] sha256-generic: Extend sha256_generic.c to support SHA-224
Jonathan Lynch [Sat, 10 Nov 2007 12:08:25 +0000 (20:08 +0800)]
[CRYPTO] sha256-generic: Extend sha256_generic.c to support SHA-224

Resubmitting this patch which extends sha256_generic.c to support SHA-224 as
described in FIPS 180-2 and RFC 3874. HMAC-SHA-224 as described in RFC4231
is then supported through the hmac interface.

Patch includes test vectors for SHA-224 and HMAC-SHA-224.

SHA-224 chould be chosen as a hash algorithm when 112 bits of security
strength is required.

Patch generated against the 2.6.24-rc1 kernel and tested against
2.6.24-rc1-git14 which includes fix for scatter gather implementation for HMAC.

Signed-off-by: Jonathan Lynch <jonathan.lynch@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: Add fallback for unsupported modes
Sebastian Siewior [Sat, 10 Nov 2007 11:29:33 +0000 (19:29 +0800)]
[CRYPTO] geode: Add fallback for unsupported modes

The Geode AES crypto engine supports only 128 bit long key. This
patch adds fallback for other key sizes which are required by the
AES standard.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Acked-by: Jordan Crouse <jordan.crouse@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes-i586: Remove setkey
Sebastian Siewior [Sat, 10 Nov 2007 11:07:16 +0000 (19:07 +0800)]
[CRYPTO] aes-i586: Remove setkey

The setkey() function can be shared with the generic algorithm.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Remove default M
Sebastian Siewior [Thu, 8 Nov 2007 13:27:05 +0000 (21:27 +0800)]
[CRYPTO] ctr: Remove default M

NO other block mode is M by default.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes-x86-64: Remove setkey
Sebastian Siewior [Thu, 8 Nov 2007 13:25:04 +0000 (21:25 +0800)]
[CRYPTO] aes-x86-64: Remove setkey

The setkey() function can be shared with the generic algorithm.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes-generic: Make key generation exportable
Sebastian Siewior [Thu, 8 Nov 2007 13:20:30 +0000 (21:20 +0800)]
[CRYPTO] aes-generic: Make key generation exportable

This patch exports four tables and the set_key() routine. This ressources
can be shared by other AES implementations (aes-x86_64 for instance).
The decryption key has been turned around (deckey[0] is the first piece
of the key instead of deckey[keylen+20]). The encrypt/decrypt functions
are looking now identical (except they are using different tables and
key).

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes-generic: Coding style cleanup
Sebastian Siewior [Thu, 8 Nov 2007 12:39:26 +0000 (20:39 +0800)]
[CRYPTO] aes-generic: Coding style cleanup

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Add countersize
Joy Latten [Wed, 7 Nov 2007 14:59:47 +0000 (22:59 +0800)]
[CRYPTO] ctr: Add countersize

This patch adds countersize to CTR mode.
The template is now ctr(algo,noncesize,ivsize,countersize).

For example, ctr(aes,4,8,4) indicates the counterblock
will be composed of a salt/nonce that is 4 bytes, an iv
that is 8 bytes and the counter is 4 bytes.

When noncesize + ivsize < blocksize, CTR initializes the
last block - ivsize - noncesize portion of the block to
zero.  Otherwise the counter block is composed of the IV
(and nonce if necessary).

If noncesize + ivsize == blocksize, then this indicates that
user is passing in entire counterblock. Thus countersize
indicates the amount of bytes in counterblock to use as
the counter for incrementing. CTR will increment counter
portion by 1, and begin encryption with that value.

Note that CTR assumes the counter portion of the block that
will be incremented is stored in big endian.

Signed-off-by: Joy Latten <latten@austin.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: De-unrolling
Denys Vlasenko [Tue, 6 Nov 2007 14:15:19 +0000 (22:15 +0800)]
[CRYPTO] camellia: De-unrolling

Move huge unrolled pieces of code (3 screenfuls) at the end of
128/256 key setup routines into common camellia_setup_tail(),
convert it to loop there.
Loop is still unrolled six times, so performance hit is very small,
code size win is big.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Acked-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Code cleanup
Denys Vlasenko [Tue, 6 Nov 2007 14:13:40 +0000 (22:13 +0800)]
[CRYPTO] camellia: Code cleanup

Optimize GETU32 to use 4-byte memcpy (modern gcc will convert
such memcpy to single move instruction on i386).
Original GETU32 did four byte fetches, and shifted/XORed those.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Acked-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Code cleanup
Denys Vlasenko [Tue, 6 Nov 2007 14:05:36 +0000 (22:05 +0800)]
[CRYPTO] camellia: Code cleanup

Rename some macros to shorter names: CAMELLIA_RR8 -> ROR8,
making it easier to understand that it is just a right rotation,
nothing camellia-specific in it.
CAMELLIA_SUBKEY_L() -> SUBKEY_L() - just shorter.

Move be32 <-> cpu conversions out of en/decrypt128/256 and into
camellia_en/decrypt - no reason to have that code duplicated twice.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Acked-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] camellia: Code cleanup
Denys Vlasenko [Tue, 6 Nov 2007 14:01:20 +0000 (22:01 +0800)]
[CRYPTO] camellia: Code cleanup

Move code blocks around so that related pieces are closer together:
e.g. CAMELLIA_ROUNDSM macro does not need to be separated
from the rest of the code by huge array of constants.

Remove unused macros (COPY4WORD, SWAP4WORD, XOR4WORD[2])

Drop SUBL(), SUBR() macros which only obscure things.
Same for CAMELLIA_SP1110() macro and KEY_TABLE_TYPE typedef.

Remove useless comments:
/* encryption */ -- well it's obvious enough already!
void camellia_encrypt128(...)

Combine swap with copying at the beginning/end of encrypt/decrypt.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Acked-by: Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] twofish: Do not unroll big stuff in twofish key setup
Denys Vlasenko [Fri, 26 Oct 2007 08:22:57 +0000 (16:22 +0800)]
[CRYPTO] twofish: Do not unroll big stuff in twofish key setup

Currently twofish cipher key setup code
has unrolled loops - approximately 70-100
instructions are repeated 40 times.

As a result, twofish module is the biggest module
in crypto/*.

Unrolling produces x2.5 more code (+18k on i386), and speeds up key
setup by 7%:

unrolled: twofish_setkey/sec: 41128
    loop: twofish_setkey/sec: 38148
CALC_K256: ~100 insns each
CALC_K192: ~90 insns
   CALC_K: ~70 insns

Attached patch removes this unrolling.

$ size */twofish_common.o
   text    data     bss     dec     hex filename
  37920       0       0   37920    9420 crypto.org/twofish_common.o
  13209       0       0   13209    3399 crypto/twofish_common.o

Run tested (modprobe tcrypt reports ok). Please apply.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: move defines into a headerfile
Sebastian Siewior [Sun, 21 Oct 2007 08:21:25 +0000 (16:21 +0800)]
[CRYPTO] geode: move defines into a headerfile

This patch moves macros in geode-aes.c into geode-aes.h.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: relax in busy loop and care about return value
Sebastian Siewior [Sun, 21 Oct 2007 08:18:12 +0000 (16:18 +0800)]
[CRYPTO] geode: relax in busy loop and care about return value

The code waits in a busy loop until the hardware finishes the encryption
or decryption process. This wants a cpu_relax() :)
The busy loop finishes either if the encryption is done or if the counter
is zero. If the latter is true than the hardware failed. Since this
should not happen, leave sith a BUG().

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: use consistent IV copy
Sebastian Siewior [Sun, 21 Oct 2007 08:04:23 +0000 (16:04 +0800)]
[CRYPTO] geode: use consistent IV copy

It is enough if the IV is copied before and after the while loop.
With DM-Crypt is seems not be required to save the IV after encrytion
because a new one is used in the request (dunno about other users).
It is not save to load the IV within while loop and not save afterwards
because we mill end up with the wrong IV if the request goes consists
of more than one page.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] aes: Move common defines into a header file
Sebastian Siewior [Wed, 17 Oct 2007 15:18:57 +0000 (23:18 +0800)]
[CRYPTO] aes: Move common defines into a header file

This three defines are used in all AES related hardware.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] geode: remove alias
Sebastian Siewior [Mon, 15 Oct 2007 14:09:47 +0000 (22:09 +0800)]
[CRYPTO] geode: remove alias

alias isn't required because the module provides PCI ids.

Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] hifn_795x: Detect weak keys
Evgeniy Polyakov [Thu, 11 Oct 2007 11:58:16 +0000 (19:58 +0800)]
[CRYPTO] hifn_795x: Detect weak keys

HIFN driver update to use DES weak key checks (exported in this patch).

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] des: Create header file for common macros
Evgeniy Polyakov [Thu, 11 Oct 2007 11:48:58 +0000 (19:48 +0800)]
[CRYPTO] des: Create header file for common macros

This patch creates include/crypto/des.h for common macros shared between
DES implementations.

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] hifn_795x: HIFN 795x driver
Evgeniy Polyakov [Fri, 26 Oct 2007 13:31:14 +0000 (21:31 +0800)]
[CRYPTO] hifn_795x: HIFN 795x driver

This is a driver for HIFN 795x crypto accelerator chips.

It passed all tests for AES, DES and DES3_EDE except weak test for DES,
since hardware can not determine weak keys.

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
16 years ago[CRYPTO] ctr: Add CTR (Counter) block cipher mode
Joy Latten [Tue, 23 Oct 2007 00:50:32 +0000 (08:50 +0800)]
[CRYPTO] ctr: Add CTR (Counter) block cipher mode

This patch implements CTR mode for IPsec.
It is based off of RFC 3686.

Please note:
1. CTR turns a block cipher into a stream cipher.
Encryption is done in blocks, however the last block
may be a partial block.

A "counter block" is encrypted, creating a keystream
that is xor'ed with the plaintext. The counter portion
of the counter block is incremented after each block
of plaintext is encrypted.
Decryption is performed in same manner.

2. The CTR counterblock is composed of,
        nonce + IV + counter

The size of the counterblock is equivalent to the
blocksize of the cipher.
        sizeof(nonce) + sizeof(IV) + sizeof(counter) = blocksize

The CTR template requires the name of the cipher
algorithm, the sizeof the nonce, and the sizeof the iv.
        ctr(cipher,sizeof_nonce,sizeof_iv)

So for example,
        ctr(aes,4,8)
specifies the counterblock will be composed of 4 bytes
from a nonce, 8 bytes from the iv, and 4 bytes for counter
since aes has a blocksize of 16 bytes.

3. The counter portion of the counter block is stored
in big endian for conformance to rfc 3686.

Signed-off-by: Joy Latten <latten@austin.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>