Received: by 2002:ac0:946b:0:0:0:0:0 with SMTP id j40csp2678900imj; Mon, 11 Feb 2019 06:55:48 -0800 (PST) X-Google-Smtp-Source: AHgI3IZ1S+ovRjFMD5hkcrV5bWtWjvT0RiFjgBVRI4ot2EP24CSKrUqx8hvBf5VdHTxjjlyYoYj6 X-Received: by 2002:a65:528c:: with SMTP id y12mr19274620pgp.317.1549896948502; Mon, 11 Feb 2019 06:55:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549896948; cv=none; d=google.com; s=arc-20160816; b=CLe+G3UTi8QDqRP444wID2b1wuKUEz/f2R3OXd0kGaxUR587AlsjRciVsQONTvhvVL C8I4LmR+RIPHyGDnmks3Mm/o5DwNBI7snpSYzA5ENiof949ZgLbnxiAHS+g4JONOsiGE SvLataJ9f36i3h9079vBH6/1ETWK/SZBAgsZaWyQ+haZcZWSngaBveJwWn7o+EbCrS6S xmcoA15ApIegWz0P+8Q2KwRa/WXzEheq9Q/jQrb0dxHa81EAGGHMItA4mFVMlNe45rim wt/Fr9UTCLNtdrEvJJVSGu081TfXR2eM4gXziAyt1I9Kb4O2oGubkWs2HR909ex7tx0w S83A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=IC3XmEZYI+gaMnbB5CzazOwjYH7/0TtHj/gqcBlI7R4=; b=w5LMIz0KXmiv0aOdTLernWBv0Soh3MW799XGL0o/EfCi9H9nqjSMy1lTDoRQupe0dM mZApXG3zS8cs2pICpF51Z0se5IjELwcmrJfsboSPnP/piaB/WEZVodSymO1tS6DKhHwe wCFJdIO8Ekk3wP/8s2jXVmw6I1QsILhMxcCr2xGVDe4GW+YYZXMLLmpQOdK+YeffDT33 L7vQp6SACgP35WkpwCoKAo9muHVjDQJLFqnrNYnURnXrbtV6BLo3zgY6drsq37nFdknk LjqnlSrUSMxeGtFMnkF6N1cyusU87mrhG6HYxbUsEoZR36Q4vGqXJR7B/gPrLlvvgMLD /JuA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=mUnHYB93; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w32si9500359pga.337.2019.02.11.06.55.32; Mon, 11 Feb 2019 06:55:48 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=mUnHYB93; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388842AbfBKOye (ORCPT + 99 others); Mon, 11 Feb 2019 09:54:34 -0500 Received: from mail.kernel.org ([198.145.29.99]:41262 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731431AbfBKOyc (ORCPT ); Mon, 11 Feb 2019 09:54:32 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B5F8620855; Mon, 11 Feb 2019 14:54:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1549896871; bh=RT0q7TJ67SBYtK/DRkzvKZbak8V4RUl5TiyWCKXRptg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mUnHYB93rT68NZh7oG6+xEmUePD5Kr9tmIvn4CQfdgif//cFDdUGUvDt1TA+1a2oQ yCahU6soav0WJDnmAhf06ZTwxd6b3zCdQSUBvJsdgeoul8lyQtL7kOKsOWLV1w4SjF uiOMDIjWS+ilhs/FFAGBUDkhJxiRDTGnIHRVGIAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ard Biesheuvel , Eric Biggers , Herbert Xu , Sasha Levin Subject: [PATCH 4.14 016/205] crypto: aes_ti - disable interrupts while accessing S-box Date: Mon, 11 Feb 2019 15:16:54 +0100 Message-Id: <20190211141828.215276093@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190211141827.214852402@linuxfoundation.org> References: <20190211141827.214852402@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 0a6a40c2a8c184a2fb467efacfb1cd338d719e0b ] In the "aes-fixed-time" AES implementation, disable interrupts while accessing the S-box, in order to make cache-timing attacks more difficult. Previously it was possible for the CPU to be interrupted while the S-box was loaded into L1 cache, potentially evicting the cachelines and causing later table lookups to be time-variant. In tests I did on x86 and ARM, this doesn't affect performance significantly. Responsiveness is potentially a concern, but interrupts are only disabled for a single AES block. Note that even after this change, the implementation still isn't necessarily guaranteed to be constant-time; see https://cr.yp.to/antiforgery/cachetiming-20050414.pdf for a discussion of the many difficulties involved in writing truly constant-time AES software. But it's valuable to make such attacks more difficult. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- crypto/Kconfig | 3 ++- crypto/aes_ti.c | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/crypto/Kconfig b/crypto/Kconfig index 5579eb88d460..84f99f8eca4b 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -930,7 +930,8 @@ config CRYPTO_AES_TI 8 for decryption), this implementation only uses just two S-boxes of 256 bytes each, and attempts to eliminate data dependent latencies by prefetching the entire table into the cache at the start of each - block. + block. Interrupts are also disabled to avoid races where cachelines + are evicted when the CPU is interrupted to do something else. config CRYPTO_AES_586 tristate "AES cipher algorithms (i586)" diff --git a/crypto/aes_ti.c b/crypto/aes_ti.c index 03023b2290e8..1ff9785b30f5 100644 --- a/crypto/aes_ti.c +++ b/crypto/aes_ti.c @@ -269,6 +269,7 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) const u32 *rkp = ctx->key_enc + 4; int rounds = 6 + ctx->key_length / 4; u32 st0[4], st1[4]; + unsigned long flags; int round; st0[0] = ctx->key_enc[0] ^ get_unaligned_le32(in); @@ -276,6 +277,12 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) st0[2] = ctx->key_enc[2] ^ get_unaligned_le32(in + 8); st0[3] = ctx->key_enc[3] ^ get_unaligned_le32(in + 12); + /* + * Temporarily disable interrupts to avoid races where cachelines are + * evicted when the CPU is interrupted to do something else. + */ + local_irq_save(flags); + st0[0] ^= __aesti_sbox[ 0] ^ __aesti_sbox[128]; st0[1] ^= __aesti_sbox[32] ^ __aesti_sbox[160]; st0[2] ^= __aesti_sbox[64] ^ __aesti_sbox[192]; @@ -300,6 +307,8 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) put_unaligned_le32(subshift(st1, 1) ^ rkp[5], out + 4); put_unaligned_le32(subshift(st1, 2) ^ rkp[6], out + 8); put_unaligned_le32(subshift(st1, 3) ^ rkp[7], out + 12); + + local_irq_restore(flags); } static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) @@ -308,6 +317,7 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) const u32 *rkp = ctx->key_dec + 4; int rounds = 6 + ctx->key_length / 4; u32 st0[4], st1[4]; + unsigned long flags; int round; st0[0] = ctx->key_dec[0] ^ get_unaligned_le32(in); @@ -315,6 +325,12 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) st0[2] = ctx->key_dec[2] ^ get_unaligned_le32(in + 8); st0[3] = ctx->key_dec[3] ^ get_unaligned_le32(in + 12); + /* + * Temporarily disable interrupts to avoid races where cachelines are + * evicted when the CPU is interrupted to do something else. + */ + local_irq_save(flags); + st0[0] ^= __aesti_inv_sbox[ 0] ^ __aesti_inv_sbox[128]; st0[1] ^= __aesti_inv_sbox[32] ^ __aesti_inv_sbox[160]; st0[2] ^= __aesti_inv_sbox[64] ^ __aesti_inv_sbox[192]; @@ -339,6 +355,8 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) put_unaligned_le32(inv_subshift(st1, 1) ^ rkp[5], out + 4); put_unaligned_le32(inv_subshift(st1, 2) ^ rkp[6], out + 8); put_unaligned_le32(inv_subshift(st1, 3) ^ rkp[7], out + 12); + + local_irq_restore(flags); } static struct crypto_alg aes_alg = { -- 2.19.1