Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 17 May 2019 09:33:46 +0200
From:   Sascha Hauer <s.hauer@pengutronix.de>
To:     Horia Geanta <horia.geanta@nxp.com>
Cc:     Fabio Estevam <festevam@gmail.com>,
        "open list:HARDWARE RANDOM NUMBER GENERATOR CORE" 
        <linux-crypto@vger.kernel.org>,
        Sascha Hauer <kernel@pengutronix.de>
Subject: Re: ctr(aes) broken in CAAM driver
Message-ID: <20190517073346.2rdy5pz73hwonw5b@pengutronix.de>
References: <20190515130746.cvhkxxffrmmynfq3@pengutronix.de>
 <CAOMZO5CJvcipPNY6TXnwwET2fc=zaP3Dj3HPT-zfZpzfqHkeHQ@mail.gmail.com>
 <20190515132225.oczgouglycuhqo4l@pengutronix.de>
 <VI1PR0402MB3485ED478A2A3E0087E81F7C98090@VI1PR0402MB3485.eurprd04.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <VI1PR0402MB3485ED478A2A3E0087E81F7C98090@VI1PR0402MB3485.eurprd04.prod.outlook.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

On Wed, May 15, 2019 at 01:35:16PM +0000, Horia Geanta wrote:
> On 5/15/2019 4:22 PM, Sascha Hauer wrote:
> > Hi Fabio,
> > 
> > On Wed, May 15, 2019 at 10:17:19AM -0300, Fabio Estevam wrote:
> >> Hi Sascha,
> >>
> >> On Wed, May 15, 2019 at 10:09 AM Sascha Hauer <s.hauer@pengutronix.de> wrote:
> >>>
> >>> Hi,
> >>>
> >>> ctr(aes) is broken in current kernel (v5.1+). It may have been broken
> >>> for longer, but the crypto tests now check for a correct output IV. The
> >>> testmgr answers with:
> >>>
> >>> alg: skcipher: ctr-aes-caam encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
> >>>
> >>> output IV is this, which is the last 16 bytes of the encrypted message:
> >>> 00000000: 1e 03 1d da 2f be 03 d1 79 21 70 a0 f3 00 9c ee
> >>>
> >>> It should look like this instead, which is input IV + 4:
> >>> 00000000: f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd ff 03
> >>>
> >>> I have no idea how to fix this as I don't know how to get the output IV
> >>> back from the CAAM. Any ideas?
> >>
> >> Is this problem similar to this one?
> >> https://www.mail-archive.com/linux-crypto@vger.kernel.org/msg37512.html
> > 
> > Different algo, different hardware, but yes, it seems to be the same
> > type of failure.
> > 
> For talitos, the problem is the lack of IV update.
> 
> For caam, the problem is incorrect IV update (output IV is equal to last
> ciphertext block, which is correect for cbc, but not for ctr mode).
> 
> I am working at a fix, but it takes longer since I would like to program the
> accelerator to the save the IV (and not do counter increment in SW, which
> created problems for many other implementations).

Thanks for working on it. I'd be glad to test it once you have
something.

Thanks
 Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |