From: Thomas Huth <thuth@redhat.com>
To: Eric Biggers <ebiggers@kernel.org>,
"Jason A. Donenfeld" <Jason@zx2c4.com>,
Ard Biesheuvel <ardb@kernel.org>
Cc: x86@kernel.org, Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 05/11] lib/crypto: aes: Use aes_zeroize_*key() instead of memzero_explicit()
Date: Thu, 13 Aug 2026 15:49:43 +0200 [thread overview]
Message-ID: <20260813134953.979481-6-thuth@redhat.com> (raw)
In-Reply-To: <20260813134953.979481-1-thuth@redhat.com>
From: Thomas Huth <thuth@redhat.com>
It's only cosmetics here, but since we have the new aes_zeroize_key()
and aes_zeroize_enckey() functions anyway, we can also use them here.
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
lib/crypto/aes.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index f1549839b3de0..07c1d912ac365 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c
@@ -539,7 +539,7 @@ static void __init aes_fips_test(void)
if (memcmp(fips_test_data, data, sizeof(data)) != 0)
panic("aes: FIPS self-test failed (wrong plaintext)\n");
- memzero_explicit(&key, sizeof(key));
+ aes_zeroize_key(&key);
}
#if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CBC_MACS)
@@ -827,7 +827,7 @@ static void __init aes_ecb_fips_test(void)
if (memcmp(fips_test_data, data, sizeof(data)) != 0)
panic("aes: ECB FIPS self-test failed (wrong plaintext)\n");
- memzero_explicit(&key, sizeof(key));
+ aes_zeroize_key(&key);
}
#else /* CONFIG_CRYPTO_LIB_AES_ECB */
static inline void aes_ecb_fips_test(void)
@@ -1040,7 +1040,7 @@ static void __init aes_cbc_fips_test(void)
if (memcmp(fips_test_data, data, sizeof(data)) != 0)
panic("aes: CBC FIPS self-test failed (wrong plaintext)\n");
- memzero_explicit(&key, sizeof(key));
+ aes_zeroize_key(&key);
}
/* FIPS cryptographic algorithm self-test for AES-CBC-CTS */
@@ -1069,7 +1069,7 @@ static void __init aes_cbc_cts_fips_test(void)
if (memcmp(ptext, data, data_len) != 0)
panic("aes: CBC-CTS FIPS self-test failed (wrong plaintext)\n");
- memzero_explicit(&key, sizeof(key));
+ aes_zeroize_key(&key);
}
#else /* CONFIG_CRYPTO_LIB_AES_CBC */
static inline void aes_cbc_fips_test(void)
@@ -1194,7 +1194,7 @@ static void __init aes_ctr_fips_test(void)
if (memcmp(fips_test_data, data, sizeof(data)) != 0)
panic("aes: CTR FIPS self-test failed (wrong plaintext)\n");
- memzero_explicit(&key, sizeof(key));
+ aes_zeroize_enckey(&key);
}
#else /* CONFIG_CRYPTO_LIB_AES_CTR */
static inline void aes_ctr_fips_test(void)
--
2.55.0
next prev parent reply other threads:[~2026-08-13 13:50 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 13:49 [PATCH 00/11] libcrypto: Provide more __cleanup functions for zeroizing data Thomas Huth
2026-08-13 13:49 ` [PATCH 01/11] lib/crypto: aes: Provide a wrapper function for zeroizing crypto_aes_ctx Thomas Huth
2026-08-13 13:49 ` [PATCH 02/11] crypto: safexcel - Simplify the check for a valid AES key Thomas Huth
2026-08-13 13:49 ` [PATCH 03/11] crypto: safexcel - zeroize crypto_aes_ctx with __cleanup(aes_zeroize_ctx) Thomas Huth
2026-08-13 13:49 ` [PATCH 04/11] lib/crypto: aes: Provide functions for zeroizing aes_key and aes_enckey Thomas Huth
2026-08-13 13:49 ` Thomas Huth [this message]
2026-08-13 13:49 ` [PATCH 06/11] lib/crypto: md5: Provide a function for zeroizing hmac_md5_ctx structures Thomas Huth
2026-08-13 13:49 ` [PATCH 07/11] lib/crypto: md5: Use hmac_md5_zeroize_ctx() instead of memzero_explicit() Thomas Huth
2026-08-13 13:49 ` [PATCH 08/11] lib/crypto: sha1: Provide a wrapper for zeroizing hmac_sha1_ctx Thomas Huth
2026-08-13 13:49 ` [PATCH 09/11] lib/crypto: sha1: Use hmac_sha1_zeroize_ctx() instead of memzero_explicit() Thomas Huth
2026-08-13 13:49 ` [PATCH 10/11] x86/purgatory: Compile purgatory.c with -D__NO_FORTIFY Thomas Huth
2026-08-13 13:49 ` [PATCH 11/11] lib/crypto: sha2: Provide wrappers for zeroizing SHA2 hmac_sha*_ctx structures Thomas Huth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260813134953.979481-6-thuth@redhat.com \
--to=thuth@redhat.com \
--cc=Jason@zx2c4.com \
--cc=ardb@kernel.org \
--cc=davem@davemloft.net \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.