Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     David Howells <dhowells@redhat.com>
CC:     Herbert Xu <herbert@gondor.apana.org.au>,
        Scott Mayhew <smayhew@redhat.com>,
        Ard Biesheuvel <ardb@kernel.org>,
        Jeff Layton <jlayton@kernel.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Subject: Re: Did the in-kernel Camellia or CMAC crypto implementation break?
Thread-Topic: Did the in-kernel Camellia or CMAC crypto implementation break?
Thread-Index: AQHZbVdnKpgTbK+uIEG+SaoLQMk4e68n5P8A
Date:   Wed, 12 Apr 2023 16:57:29 +0000
Message-ID: <48886D84-1A04-4B07-A666-BB56684E759F@oracle.com>
References: <380323.1681314997@warthog.procyon.org.uk>
In-Reply-To: <380323.1681314997@warthog.procyon.org.uk>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?O+RUVHfgtr36t5263vxPXThPKe2NqVUShENuJQZFc9VWR0XWlhNspkrC3zoU?=
 =?us-ascii?Q?QcZyPScolFaPptyXO93R/ipuLON0UDH4USabi/9SMIIUSbyeQ5mSsDfKJzg1?=
 =?us-ascii?Q?kdU7OCANGp3nAUdru3s6EJdN2pjE18V/Oai9coTVZ+6vKN7843DjTEWqmsvQ?=
 =?us-ascii?Q?IKLCqlXv6WQfqPs+IGe/35qYStDWFUNaB0YEiL3kK5XR1n206D5lVL2tOOpn?=
 =?us-ascii?Q?ea3zSKuCiBFjjtp25yXlB9+Wa2m6k/k0jb3rTFk35nBDSDWrewO1lQHYliIn?=
 =?us-ascii?Q?yoAX0kYiSq+tc+qx3lv6JRbDxks42mCpf50AX5rStuX42uYFQDzMoq7jK/Ti?=
 =?us-ascii?Q?ckNvGIog9g0dLtkyFPKo9MRdGXHqV6LNShPrqJ3kX+XzgloVCwwxvHjNBznL?=
 =?us-ascii?Q?5wodDtbx3paYgmpE0awrWZv5u1GaTnwC/qEZheENQzBRkJjOCSfg2mCYd/x0?=
 =?us-ascii?Q?ReoqKhoa/FBSaByTOPkloQ0y4OLWMZM/VRAvGC/3jW8quDAcQuhcnglW8IYj?=
 =?us-ascii?Q?89OgGY1oXz7Yax68fRXwXNT2dmQ1h7xYbJIH+/E0OC+2pgZCE6xEQuYUzpqI?=
 =?us-ascii?Q?uUZ9RkPkdqru9Mj5w7Yq7pxSzi9ST6wdr/kveOkBIzNHrmPwZvblkYG2Etsc?=
 =?us-ascii?Q?YUZZqR3oL/PTJ7O4nADVi0tSW9YPpempTgj5bV8AEUYn0BUj1q+zIGPS/40S?=
 =?us-ascii?Q?obU9I7JDlFFzvuoRTUiV2iQIvkUEhYHB65glfm0PuVrfN0JMzQOzoSsU1mxj?=
 =?us-ascii?Q?91gAvUumuf6f20orVLY/3nLlpZ7Y52r/ckCVEsszmUL/hErKFrNtqSFAgdWh?=
 =?us-ascii?Q?QYvlxSswqYw3ZB+9ToMwkPW/MWLnIEW40+Xu4rWZkvvN3VAC192tLWeiLfjs?=
 =?us-ascii?Q?aTKiZpT0de9F0yxdexR8mi3ncCc13s3PYo65sBuOAy+2DHZeU1hQq8090nDK?=
 =?us-ascii?Q?aKWsL4qTMVeBctFzUyvo+qzvLFL92S51QBFqBCvEw7QKdzHhXsxd+v2gZLLY?=
 =?us-ascii?Q?LGfzBxiIU7qMxvqemZkKQfG8F+FnL0TbdnmeApcuiDjEh/UfVGppATpEnePW?=
 =?us-ascii?Q?CK0y6GCkNd5eNeAskQmRSE1+ZnCtFbsP7ML+8nSR1XAjq8l7WKCkMX7S5NlJ?=
 =?us-ascii?Q?6iy9zYhZeV9KL+CijDWGvMPh7RoApv/BXyZvdLMGXX4N0zA1WTfE3tT2G30i?=
 =?us-ascii?Q?alSTen/b5rcnmQZELXavZMQQnY3qx3WXvMMrLJu8ZpcGvsDH+2LGOZBwvqm3?=
 =?us-ascii?Q?xbUp4fuPVMwCWf4t0hdEaJZ63qXltI4gjsm1nwkWDeKAkpQeqPo+6Pcf8a6p?=
 =?us-ascii?Q?3i1elQU5cg6P/m7cu7nKRfQ3VmQnY13APN49MUUkak6wwWZMxtFtwWRMcUST?=
 =?us-ascii?Q?mt7pVs/aY56MpbMPdVQY0VdxvdpCrX/cluaeOOlYf7XZ/0OqyyCMQ1S3Ni4v?=
 =?us-ascii?Q?uJnXR+08b8O++ykbNz7WIzOPxekpjNp9v1ZhNnLd6r67hOzth0JtJHucq5m5?=
 =?us-ascii?Q?AVinTG3pDLX7pxi2Y/3kvtK0bLNhv+hBq+cuW795L3u/4QmE3SOzGmGSydFF?=
 =?us-ascii?Q?50gje+l3ZFuvK7ljS0Y/HCrd+Hu1ofU8DCKtYsp4UeE2yDRFY6irML8M1mWn?=
 =?us-ascii?Q?GA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <E13F21CEBF1AE44EBA12ABBFF8F72B0A@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: q+5jYhex2RrkQuSAig/H486rC63e3VVWxcGd0YfW7Nr6oGQS7bCioDHoSiTmvyIy3qcKU84ejZKYpEl91dhxXAbVYFda+iDXbBYZ3KIQRmMjMEwFOlT8+udxnUr4inyPEz6ciK5Z1GWcOh8/hxfZw07TPw58Zx4fzLGXtyNRcYhENeO9JCvZZtaHAtZ4+6oXVdEgRJkIAtFaLlm4Ab01zuzhBDsbuzneJ6rYnl/VHYKsmLMzMnU+NQknFk3r6akpa9oiPDjaRGKgJhINJQU4ra6Xw7TUMdvhx36hJzZrCEJo/04SbpKA6FBBkSAymHwkvVtgFuwYedY5e0xeRsbc+Hl5QIJzTtvx9KR5Fk5sh1G9IncGG4wMRyVwWXkLbTGnrXdetMvj9tCcCXssDgXj0rRnGAHHewOkTYTss/GvVE7v3kQMywSTJvvBI11TW7YznfLcS9jQoXGjjfwnRaiimhHhh6TMe4g9wJTwPSgexJQ6dlAsJnY8LkZ0xCZapKDS1gPFwHIiGyj5fMDMksRyuUW1O84/1xU7/N8CoN+1a32rvjlBvPNcxfjlvTJvDc27gsHsQUfUBg1odMJpLMiy0/F1cMi86UAOVmg4yd905JGC/xAoQa9BrjOh9xDeZ6CH2SokTUCQ7siI7R+Q6K0E5E4sPKY6hEc/kGoB2vDiipItocd6eJusqFED+pB8ApwsD6rE7JSkWEHBOI2O0ZOnhUO3K1KlKZc1qSYnHfqPIU8jRI3Q0UjMXHAwWt1bm2emxWjm2Vv6AMYvM3yCfDsHJzGaxNdZ24e5Kike4PCiw71j2UEsgi4ZEmU/JMrWKKpXjUX+o0miywXSKqhsW5fjT0IIMXylgZtLMZsVWrjCj+B5qCIoNIpSYzq7mnuDX93Q
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b7303d03-24fe-4bfa-dda7-08db3b770023
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Apr 2023 16:57:29.2209
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: wwh/4r2FhQTCfkx+kGFfj5IGUxezXd8VQ3pVrEu4ZN5jwJc+fC/kpnWtYhv6/9XkideRLwCzzdVATipOzDhe2A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4669
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-12_08,2023-04-12_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0
 malwarescore=0 phishscore=0 bulkscore=0 adultscore=0 mlxscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304120147
X-Proofpoint-ORIG-GUID: nFPtJjMVyBnS4NSMiT4wmspn7Q4wX7sL
X-Proofpoint-GUID: nFPtJjMVyBnS4NSMiT4wmspn7Q4wX7sL
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Apr 12, 2023, at 11:56 AM, David Howells <dhowells@redhat.com> wrote:
>=20
> Hi Chuck, Herbert,
>=20
> I was trying to bring my krb5 crypto lib patches up to date, but noticed =
that
> the Camellia encryption selftests are failing (the key derivation tests w=
ork,
> but the crypto tests failed).
>=20
> After some investigation that didn't get anywhere, I tried the sunrpc kun=
it
> tests that Chuck added - and those fail similarly (dmesg attached below).=
  I
> tried the hardware accelerated version also and that has the same failure=
.

Ah, I see Scott is Cc'd. Yes, Scott reported this to me yesterday.


> Note that Chuck and I implemented the kerberos Camellia routines
> independently.

Yes, but we implemented the same unit tests (from RFC 6803).


> David
> ---
>    KTAP version 1
>    # Subtest: RFC 6803 suite
>    1..3
>        KTAP version 1
>        # Subtest: RFC 6803 key derivation
>        ok 1 Derive Kc subkey for camellia128-cts-cmac
>        ok 2 Derive Ke subkey for camellia128-cts-cmac
>        ok 3 Derive Ki subkey for camellia128-cts-cmac
>        ok 4 Derive Kc subkey for camellia256-cts-cmac
>        ok 5 Derive Ke subkey for camellia256-cts-cmac
>        ok 6 Derive Ki subkey for camellia256-cts-cmac
>    # RFC 6803 key derivation: pass:6 fail:0 skip:0 total:6
>    ok 1 RFC 6803 key derivation
>        KTAP version 1
>        # Subtest: RFC 6803 checksum
>        ok 1 camellia128-cts-cmac checksum test 1
>        ok 2 camellia128-cts-cmac checksum test 2
>        ok 3 camellia256-cts-cmac checksum test 3
>        ok 4 camellia256-cts-cmac checksum test 4
>    # RFC 6803 checksum: pass:4 fail:0 skip:0 total:4
>    ok 2 RFC 6803 checksum
>        KTAP version 1
>        # Subtest: RFC 6803 encryption
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 135 (0x87)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -108 (0xfffffffffffff=
f94)
>=20
> HMAC mismatch
>        not ok 1 Encrypt empty plaintext with camellia128-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -49 (0xffffffffffffffcf)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -3 (0xfffffffffffffff=
d)
>=20
> HMAC mismatch
>        not ok 2 Encrypt 1 byte with camellia128-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -36 (0xffffffffffffffdc)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 44 (0x2c)
>=20
> HMAC mismatch
>        not ok 3 Encrypt 9 bytes with camellia128-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -58 (0xffffffffffffffc6)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -103 (0xfffffffffffff=
f99)
>=20
> HMAC mismatch
>        not ok 4 Encrypt 13 bytes with camellia128-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 160 (0xa0)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 95 (0x5f)
>=20
> HMAC mismatch
>        not ok 5 Encrypt 30 bytes with camellia128-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -150 (0xffffffffffffff6a)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 48 (0x30)
>=20
> HMAC mismatch
>        not ok 6 Encrypt empty plaintext with camellia256-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 24 (0x18)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 22 (0x16)
>=20
> HMAC mismatch
>        not ok 7 Encrypt 1 byte with camellia256-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 108 (0x6c)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -106 (0xfffffffffffff=
f96)
>=20
> HMAC mismatch
>        not ok 8 Encrypt 9 bytes with camellia256-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D 64 (0x40)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D -196 (0xfffffffffffff=
f3c)
>=20
> HMAC mismatch
>        not ok 9 Encrypt 13 bytes with camellia256-cts-cmac
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1389
>    Expected memcmp(param->expected_result->data, buf.head[0].iov_base, bu=
f.len) =3D=3D 0, but
>        memcmp(param->expected_result->data, buf.head[0].iov_base, buf.len=
) =3D=3D -238 (0xffffffffffffff12)
>=20
> encrypted result mismatch
>    # RFC 6803 encryption: EXPECTATION FAILED at net/sunrpc/auth_gss/gss_k=
rb5_test.c:1393
>    Expected memcmp(param->expected_result->data + (param->expected_result=
->len - checksum.len), checksum.data, checksum.len) =3D=3D 0, but
>        memcmp(param->expected_result->data + (param->expected_result->len=
 - checksum.len), checksum.data, checksum.len) =3D=3D 168 (0xa8)
>=20
> HMAC mismatch
>        not ok 10 Encrypt 30 bytes with camellia256-cts-cmac
>    # RFC 6803 encryption: pass:0 fail:10 skip:0 total:10
>    not ok 3 RFC 6803 encryption
> # RFC 6803 suite: pass:2 fail:1 skip:0 total:3
> # Totals: pass:10 fail:10 skip:0 total:20
> not ok 3 RFC 6803 suite
>=20

--
Chuck Lever