Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Pascal Van Leeuwen <pvanleeuwen@verimatrix.com>
To:     Eric Biggers <ebiggers@kernel.org>,
        Milan Broz <gmazyland@gmail.com>
CC:     Ard Biesheuvel <ard.biesheuvel@linaro.org>,
        "dm-devel@redhat.com" <dm-devel@redhat.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Horia Geanta <horia.geanta@nxp.com>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Subject: RE: [dm-devel] xts fuzz testing and lack of ciphertext stealing
 support
Thread-Topic: [dm-devel] xts fuzz testing and lack of ciphertext stealing
 support
Thread-Index: AQHVO/5l0aVU4O6KC0WgPIqEsMQCDqbzPYWAgAAwjTCAAIUtAIACADgAgACcyQCAABGx8A==
Date:   Sun, 11 Aug 2019 21:39:46 +0000
Message-ID: <MN2PR20MB29731377CA325722EDD6582ACAD00@MN2PR20MB2973.namprd20.prod.outlook.com>
References: <VI1PR0402MB34856F03FCE57AB62FC2257998D40@VI1PR0402MB3485.eurprd04.prod.outlook.com>
 <MN2PR20MB2973127E4C159A8F5CFDD0C9CAD70@MN2PR20MB2973.namprd20.prod.outlook.com>
 <VI1PR0402MB3485689B4B65C879BC1D137398D70@VI1PR0402MB3485.eurprd04.prod.outlook.com>
 <20190809024821.GA7186@gondor.apana.org.au>
 <CAKv+Gu9hk=PGpsAWWOU61VrA3mVQd10LudA1qg0LbiX7DG9RjA@mail.gmail.com>
 <VI1PR0402MB3485F94AECC495F133F6B3D798D60@VI1PR0402MB3485.eurprd04.prod.outlook.com>
 <CAKv+Gu-_WObNm+ySXDWjhqe2YPzajX83MofuF-WKPSdLg5t4Ew@mail.gmail.com>
 <MN2PR20MB297361CA3C29C236D6D8F6F4CAD60@MN2PR20MB2973.namprd20.prod.outlook.com>
 <CAKv+Gu-xWxZ58tzyYoH_jDKfJoM+KzOWWpzCeHEmOXQ39Bv15g@mail.gmail.com>
 <d6d0b155-476b-d495-3418-4b171003cdd7@gmail.com>
 <20190811203406.GA17421@sol.localdomain>
In-Reply-To: <20190811203406.GA17421@sol.localdomain>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: verimatrix.com does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: a87a6c93-21b6-4ebb-bc87-08d71ea46ded
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Aug 2019 21:39:46.3011
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: dcb260f9-022d-4495-8602-eae51035a0d0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: wK6lDT5NjJ+dGKkXOM+0x+/SPH+DxQOeUy0AdYcr1e5nD6tQzCEUXqIeWrIkg4U7D1dqKCaU5m3Wl6ERK5T1P+fpXLRf/4zguOXjM/4Sjeo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR20MB2702
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

> -----Original Message-----
> From: Eric Biggers <ebiggers@kernel.org>
> Sent: Sunday, August 11, 2019 10:34 PM
> To: Milan Broz <gmazyland@gmail.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Pascal Van Leeuwen
> <pvanleeuwen@verimatrix.com>; dm-devel@redhat.com; Herbert Xu <herbert@go=
ndor.apana.org.au>;
> Horia Geanta <horia.geanta@nxp.com>; linux-crypto@vger.kernel.org
> Subject: Re: [dm-devel] xts fuzz testing and lack of ciphertext stealing =
support
>=20
> On Sun, Aug 11, 2019 at 01:12:56PM +0200, Milan Broz wrote:
> > On 10/08/2019 06:39, Ard Biesheuvel wrote:
> > > Truncated IVs are a huge issue, since we already expose the correct
> > > API via AF_ALG (without any restrictions on how many of the IV bits
> > > are populated), and apparently, if your AF_ALG request for xts(aes)
> > > happens to be fulfilled by the CAAM driver and your implementation
> > > uses more than 64 bits for the IV, the top bits get truncated silentl=
y
> > > and your data might get eaten.
> >
> > Actually, I think we have already serious problem with in in kernel (no=
 AF_ALG needed).
> >
> > I do not have the hardware, but please could you check that dm-crypt bi=
g-endian IV
> > (plain64be) produces the same output on CAAM?
> >
> > It is 64bit IV, but big-endian and we use size of cipher block (16bytes=
) here,
> > so the first 8 bytes are zero in this case.
> >
> > I would expect data corruption in comparison to generic implementation,
> > if it supports only the first 64bit...
> >
> > Try this:
> >
> > # create small null device of 8 sectors,  we use zeroes as fixed cipher=
text
> > dmsetup create zero --table "0 8 zero"
> >
> > # create crypt device on top of it (with some key), using plain64be IV
> > dmsetup create crypt --table "0 8 crypt aes-xts-plain64be
> e8cfa3dbfe373b536be43c5637387786c01be00ba5f730aacb039e86f3eb72f3 0 /dev/m=
apper/zero 0"
> >
> > # and compare it with and without your driver, this is what I get here:
> > # sha256sum /dev/mapper/crypt
> > 532f71198d0d84d823b8e410738c6f43bc3e149d844dd6d37fa5b36d150501e1  /dev/=
mapper/crypt
> > # dmsetup remove crypt
> >
> > You can try little-endian version (plain64), this should always work ev=
en with CAAM
> > dmsetup create crypt --table "0 8 crypt aes-xts-plain64
> e8cfa3dbfe373b536be43c5637387786c01be00ba5f730aacb039e86f3eb72f3 0 /dev/m=
apper/zero 0"
> >
> > # sha256sum /dev/mapper/crypt
> > f17abd27dedee4e539758eabdb6c15fa619464b509cf55f16433e6a25da42857  /dev/=
mapper/crypt
> > # dmsetup remove crypt
> >
> > # dmsetup remove zero
> >
> >
> > If you get different plaintext in the first case, your driver is actual=
ly creating
> > data corruption in this configuration and it should be fixed!
> > (Only the first sector must be the same, because it has IV =3D=3D 0.)
> >
> > Milan
> >
> > p.s.
> > If you ask why we have this IV, it was added per request to allow map s=
ome chipset-based
> > encrypted drives directly. I guess it is used for some data forensic th=
ings.
> >
>=20
> Also, if the CAAM driver is really truncating the IV for "xts(aes)", it s=
hould
> already be failing the extra crypto self-tests, since the fuzz testing in
> test_skcipher_vs_generic_impl() uses random IVs.
>=20
> - Eric
>
Yes, good point. Although that is only seen during development and not=20
during "normal" use ...


Regards,
Pascal van Leeuwen
Silicon IP Architect, Multi-Protocol Engines @ Verimatrix
www.insidesecure.com