| Message ID | 20221018200422.179372-1-ardb@kernel.org |
|---|---|
| Headers | show |
| Series | crypto: Add GCM-AES implementation to lib/crypto | expand |
On Tue, Oct 18, 2022 at 2:04 PM Ard Biesheuvel <ardb@kernel.org> wrote: > > Provide a generic library implementation of GCM-AES which can be used Every place else in the world, this is called AES-GCM. Can we stick with the convention?
On Tue, 18 Oct 2022 at 22:11, Jason A. Donenfeld <Jason@zx2c4.com> wrote: > > On Tue, Oct 18, 2022 at 2:04 PM Ard Biesheuvel <ardb@kernel.org> wrote: > > > > Provide a generic library implementation of GCM-AES which can be used > > Every place else in the world, this is called AES-GCM. Can we stick > with the convention? Good point, I'll change that next time around.
Provide a generic library implementation of GCM-AES which can be used really early during boot, e.g., to communicate with the security coprocessor on SEV-SNP virtual machines to bring up secondary cores. This is needed because the crypto API is not available yet this early. We cannot rely on special instructions for AES or polynomial multiplication, which are arch specific and rely on in-kernel SIMD infrastructure. Instead, add a generic C implementation that combines the existing C implementations of AES and multiplication in GF(2^128). To reduce the risk of forgery attacks, replace data dependent table lookups and conditional branches in the used gf128mul routine with constant-time equivalents. The AES library has already been robustified to some extent to prevent known-plaintext timing attacks on the key, but we call it with interrupts disabled to make it a bit more robust. (Note that in SEV-SNP context, the VMM is untrusted, and is able to inject interrupts arbitrarily, and potentially maliciously.) Changes since v2: - move gf128mul to lib/crypto - add patch #2 to make gf128mul_lle constant time - fix kerneldoc headers and drop them from the .h file Changes since v1: - rename gcm to gcmaes to reflect that GCM is also used in combination with other symmetric ciphers (Jason) - add Nikunj's Tested-by Ard Biesheuvel (3): crypto: move gf128mul library into lib/crypto crypto: gf128mul - make gf128mul_lle time invariant crypto: gcmaes - Provide minimal library implementation arch/x86/crypto/aesni-intel_glue.c | 24 +- crypto/Kconfig | 3 - crypto/Makefile | 1 - include/crypto/gcm.h | 22 + lib/crypto/Kconfig | 9 + lib/crypto/Makefile | 5 + lib/crypto/gcmaes.c | 720 ++++++++++++++++++++ {crypto => lib/crypto}/gf128mul.c | 58 +- 8 files changed, 807 insertions(+), 35 deletions(-) create mode 100644 lib/crypto/gcmaes.c rename {crypto => lib/crypto}/gf128mul.c (87%)