From mboxrd@z Thu Jan 1 00:00:00 1970 From: Milan Broz Subject: Re: [RFC PATCH v2] md/dm-crypt - reuse eboiv skcipher for IV generation Date: Wed, 7 Aug 2019 10:08:58 +0200 Message-ID: References: <20190807055022.15551-1-ard.biesheuvel@linaro.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20190807055022.15551-1-ard.biesheuvel@linaro.org> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com To: Ard Biesheuvel , linux-crypto@vger.kernel.org Cc: ebiggers@kernel.org, snitzer@redhat.com, dm-devel@redhat.com, herbert@gondor.apana.org.au, agk@redhat.com List-Id: dm-devel.ids On 07/08/2019 07:50, Ard Biesheuvel wrote: > Instead of instantiating a separate cipher to perform the encryption > needed to produce the IV, reuse the skcipher used for the block data > and invoke it one additional time for each block to encrypt a zero > vector and use the output as the IV. > > For CBC mode, this is equivalent to using the bare block cipher, but > without the risk of ending up with a non-time invariant implementation > of AES when the skcipher itself is time variant (e.g., arm64 without > Crypto Extensions has a NEON based time invariant implementation of > cbc(aes) but no time invariant implementation of the core cipher other > than aes-ti, which is not enabled by default) > > This approach is a compromise between dm-crypt API flexibility and > reducing dependence on parts of the crypto API that should not usually > be exposed to other subsystems, such as the bare cipher API. > > Signed-off-by: Ard Biesheuvel Yes, this is a good idea, I'll test it. Thanks! Milan