Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
To:     Chuck Lever <chuck.lever@oracle.com>,
        Herbert Xu <herbert@gondor.apana.org.au>
cc:     dhowells@redhat.com, Scott Mayhew <smayhew@redhat.com>,
        Ard Biesheuvel <ardb@kernel.org>,
        Jeff Layton <jlayton@kernel.org>, linux-nfs@vger.kernel.org,
        linux-crypto@vger.kernel.org
Subject: Did the in-kernel Camellia or CMAC crypto implementation break?
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <380322.1681314997.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Wed, 12 Apr 2023 16:56:37 +0100
Message-ID: <380323.1681314997@warthog.procyon.org.uk>
Precedence: bulk

Hi Chuck, Herbert,

I was trying to bring my krb5 crypto lib patches up to date, but noticed t=
hat
the Camellia encryption selftests are failing (the key derivation tests wo=
rk,
but the crypto tests failed).

After some investigation that didn't get anywhere, I tried the sunrpc kuni=
t
tests that Chuck added - and those fail similarly (dmesg attached below). =
 I
tried the hardware accelerated version also and that has the same failure.

Note that Chuck and I implemented the kerberos Camellia routines
independently.

David
---
    KTAP version 1
    # Subtest: RFC 6803 suite
    1..3
        KTAP version 1
        # Subtest: RFC 6803 key derivation
        ok 1 Derive Kc subkey for camellia128-cts-cmac
        ok 2 Derive Ke subkey for camellia128-cts-cmac
        ok 3 Derive Ki subkey for camellia128-cts-cmac
        ok 4 Derive Kc subkey for camellia256-cts-cmac
        ok 5 Derive Ke subkey for camellia256-cts-cmac
        ok 6 Derive Ki subkey for camellia256-cts-cmac
    # RFC 6803 key derivation: pass:6 fail:0 skip:0 total:6
    ok 1 RFC 6803 key derivation
        KTAP version 1
        # Subtest: RFC 6803 checksum
        ok 1 camellia128-cts-cmac checksum test 1
        ok 2 camellia128-cts-cmac checksum test 2
        ok 3 camellia256-cts-cmac checksum test 3
        ok 4 camellia256-cts-cmac checksum test 4
    # RFC 6803 checksum: pass:4 fail:0 skip:0 total:4
    ok 2 RFC 6803 checksum
        KTAP version 1
        # Subtest: RFC 6803 encryption
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 135 (0x87)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -108 (0xffffffffffff=
ff94)

HMAC mismatch
        not ok 1 Encrypt empty plaintext with camellia128-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -49 (0xffffffffffffffcf)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -3 (0xffffffffffffff=
fd)

HMAC mismatch
        not ok 2 Encrypt 1 byte with camellia128-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -36 (0xffffffffffffffdc)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 44 (0x2c)

HMAC mismatch
        not ok 3 Encrypt 9 bytes with camellia128-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -58 (0xffffffffffffffc6)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -103 (0xffffffffffff=
ff99)

HMAC mismatch
        not ok 4 Encrypt 13 bytes with camellia128-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 160 (0xa0)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 95 (0x5f)

HMAC mismatch
        not ok 5 Encrypt 30 bytes with camellia128-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -150 (0xffffffffffffff6a)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 48 (0x30)

HMAC mismatch
        not ok 6 Encrypt empty plaintext with camellia256-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 24 (0x18)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 22 (0x16)

HMAC mismatch
        not ok 7 Encrypt 1 byte with camellia256-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 108 (0x6c)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -106 (0xffffffffffff=
ff96)

HMAC mismatch
        not ok 8 Encrypt 9 bytes with camellia256-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 64 (0x40)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -196 (0xffffffffffff=
ff3c)

HMAC mismatch
        not ok 9 Encrypt 13 bytes with camellia256-cts-cmac
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -238 (0xffffffffffffff12)

encrypted result mismatch
    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 168 (0xa8)

HMAC mismatch
        not ok 10 Encrypt 30 bytes with camellia256-cts-cmac
    # RFC 6803 encryption: pass:0 fail:10 skip:0 total:10
    not ok 3 RFC 6803 encryption
# RFC 6803 suite: pass:2 fail:1 skip:0 total:3
# Totals: pass:10 fail:10 skip:0 total:20
not ok 3 RFC 6803 suite