Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CAE9cyGTQZXW-6YsmHu3mGSHonTztBszqaYske7PKgz0pWHxQKA@mail.gmail.com>
In-Reply-To: <CAE9cyGTQZXW-6YsmHu3mGSHonTztBszqaYske7PKgz0pWHxQKA@mail.gmail.com>
From:   Ard Biesheuvel <ardb@kernel.org>
Date:   Tue, 11 May 2021 17:48:16 +0200
Message-ID: <CAMj1kXHOVRDAt7-C8UKi=5=MAgQ9kQz=HUtiuK_gt7ch_i950w@mail.gmail.com>
Subject: Re: or should block size for xts.c set to 1 instead of AES block size?
To:     Kestrel seventyfour <kestrelseventyfour@gmail.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Eric Biggers <ebiggers@kernel.org>
Cc:     Linux Crypto Mailing List <linux-crypto@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, 7 May 2021 at 08:12, Kestrel seventyfour
<kestrelseventyfour@gmail.com> wrote:
>
> Hi,
>
> one more thought, shouldn't the block size for generic xts set to 1 in
> order to reflect that any input size length is allowed to the
> algorithm?
>

I think this was discussed at some point on the list, and Herbert
seemed to suggest that 1 was a better choice than AES_BLOCK_SIZE.
You'd have to set the chunksize, though, to ensure that the input is
presented in the right granularity, i.e., to ensure that the skcipher
walk layer never presents less than chunksize bytes unless it is the
end of the input.

However, this is a flag day change, so you'd need to update all
implementations at the same time. Otherwise, the extended tests (which
compare accelerated implementations with xts(ecb(aes-generic))) will
start failing on the cra_blocksize mismatch.