Re: [RFC PATCH v4 1/2] fscrypt-crypt-util: add HCTR2 implementation

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Jun 01, 2022 at 12:18:10AM -0700, Nathan Huckleberry wrote:
> diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c
[...]
> +void gf2_128_mul_polyval(ble128 *r, const ble128 *b)
> +{

This function should be static.

> +/*----------------------------------------------------------------------------*
> + *                                 POLYVAL                                     *
> + *----------------------------------------------------------------------------*/

This could use a link to a specification, similar to the other more "unusual"
algorithms in this file.  Try:

		git grep -A1 'Reference:' src/fscrypt-crypt-util.c

Likewise for HCTR2.  The commit message has a link to the HCTR2 paper, but it
should be in the code itself too.  

> +static void polyval_update(const u8 key[POLYVAL_KEY_SIZE],
> +			   const u8 *msg, size_t msglen,
> +			   u8 accumulator[POLYVAL_BLOCK_SIZE])
> +{
> +	ble128 h;
> +	ble128 aligned_accumulator;
> +	size_t chunk_size;
> +	// x^{-128} = x^127 + x^124 + x^121 + x^114 + 1
> +	static const ble128 inv128 = {
> +		cpu_to_le64(1),
> +		cpu_to_le64(0x9204ULL << 48)
> +	};
> +
> +	memcpy(&h, key, POLYVAL_BLOCK_SIZE);
> +	memcpy(&aligned_accumulator, accumulator, POLYVAL_BLOCK_SIZE);
> +	gf2_128_mul_polyval(&h, &inv128);
> +
> +	while (msglen > 0) {
> +		chunk_size = MIN(POLYVAL_BLOCK_SIZE, msglen);
> +		xor((u8 *)&aligned_accumulator, (u8 *)&aligned_accumulator, msg,
> +		    chunk_size);
> +		gf2_128_mul_polyval(&aligned_accumulator, &h);
> +		msg += chunk_size;
> +		msglen -= chunk_size;
> +	}

The partial block support is unnecessary, so POLYVAL_BLOCK_SIZE could be used
instead of chunk_size, and an assertion ASSERT(msglen % POLYVAL_BLOCK_SIZE ==
0) could be added.  See poly1305() in the same file which works similarly.

Otherwise this looks good, thanks!

- Eric