Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 23 May 2019 13:05:59 -0700
From:   Eric Biggers <ebiggers@kernel.org>
To:     Pascal Van Leeuwen <pvanleeuwen@insidesecure.com>
Cc:     "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Subject: Re: another testmgr question
Message-ID: <20190523200557.GA248378@gmail.com>
References: <AM6PR09MB3523CED0B1587FCBDE4095A0D2010@AM6PR09MB3523.eurprd09.prod.outlook.com>
 <20190523185833.GA243994@google.com>
 <AM6PR09MB3523749B0306103E8D2D8315D2010@AM6PR09MB3523.eurprd09.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AM6PR09MB3523749B0306103E8D2D8315D2010@AM6PR09MB3523.eurprd09.prod.outlook.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

On Thu, May 23, 2019 at 01:07:25PM +0000, Pascal Van Leeuwen wrote:
> Eric,
>
> I'm running into some trouble with some random vectors that do *zero*
> length operations. Now you can go all formal about how the API does
> not explictly disallow this, but how much sense does it really make
> to essentially encrypt, hash or authenticate absolutely *nothing*?
>
> It makes so little sense that we never bothered to support it in any
> of our hardware developed over the past two decades ... and no
> customer has ever complained about this, to the best of my knowledge.
>
> Can't you just remove those zero length tests?
>

For hashes this is absolutely a valid case.  Try this:

$ touch file
$ sha256sum file
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  file

That shows the SHA-256 digest of the empty message.

For AEADs it's a valid case too.  You still get an authenticated ciphertext even
if the plaintext and/or AAD are empty, telling you that the (plaintext, AAD)
pair is authentically from someone with the key.

It's really only skciphers (length preserving encryption) where it's
questionable, since for those an empty input can only map to an empty output.

Regardless of what we do, I think it's really important that the behavior is
*consistent*, so users see the same behavior no matter what implementation of
the algorithm is used.

Allowing empty messages works out naturally for most skcipher implementations,
and it also conceptually simplifies the length restrictions of the API (e.g. for
most block cipher modes: just need nbytes % blocksize == 0, as opposed to that
*and* nbytes != 0).  So that seems to be how we ended up with it.

If we do change this, IMO we need to make it the behavior for all
implementations, not make it implementation-defined.

Note that it's not necessary that your *hardware* supports empty messages, since
you can simply do this in the driver instead:

	if (req->cryptlen == 0)
		return 0;

- Eric