[PATCH 00/11] libcrypto: Provide more __cleanup functions for zeroizing data

[Thomas Huth <thuth@redhat.com>]

Code that uses crypto-related structures (containing keys or context data)
should zeroize their local structures on the stack after use to avoid
leaking this sensitive material via the stack when the function returns.
Using the __cleanup() marker is a very elegant way to assert that the
data is zeroized without having to painfully verify that each early return
in a function might miss it.

Thus this series introduces zeroization functions for many crypto-related
structures that can be used with __cleanup(). The series focuses on the
introduction of the functions - most call sights will be adjusted to use
these new functions in separate patch series later (since each subsystem
needs separate review from the corresponding maintainer). However, I
already included the two "safexcel" patches, since they already got ack'ed
by the maintainer Antoine, so I think they should be fine to go via the
libcrypto tree.

Note there is one minor ugliness in patch 10: Since sha2.h is also used
in the x86 purgatory code, and that code ships with its own implementation
of string functions, we have to compile the purgatory.c file with
-D__NO_FORTIFY now to be able to include <linux/string.h> in sha2.h.
I hope that solution is OK (especially since the sha256.c file in the
same folder gets that treatment already, too), if not - I'm certainly
open for other suggestions here!

Thomas Huth (11):
  lib/crypto: aes: Provide a wrapper function for zeroizing
    crypto_aes_ctx
  crypto: safexcel - Simplify the check for a valid AES key
  crypto: safexcel - zeroize crypto_aes_ctx with
    __cleanup(aes_zeroize_ctx)
  lib/crypto: aes: Provide functions for zeroizing aes_key and
    aes_enckey
  lib/crypto: aes: Use aes_zeroize_*key() instead of memzero_explicit()
  lib/crypto: md5: Provide a function for zeroizing hmac_md5_ctx
    structures
  lib/crypto: md5: Use hmac_md5_zeroize_ctx() instead of
    memzero_explicit()
  lib/crypto: sha1: Provide a wrapper for zeroizing hmac_sha1_ctx
  lib/crypto: sha1: Use hmac_sha1_zeroize_ctx() instead of
    memzero_explicit()
  x86/purgatory: Compile purgatory.c with -D__NO_FORTIFY
  lib/crypto: sha2: Provide wrappers for zeroizing SHA2 hmac_sha*_ctx
    structures

 arch/x86/purgatory/Makefile                   |  1 +
 .../crypto/inside-secure/safexcel_cipher.c    | 16 ++----
 drivers/crypto/inside-secure/safexcel_hash.c  |  3 +-
 include/crypto/aes.h                          | 40 +++++++++++++
 include/crypto/md5.h                          | 15 +++++
 include/crypto/sha1.h                         | 17 ++++++
 include/crypto/sha2.h                         | 57 +++++++++++++++++++
 lib/crypto/aes.c                              | 10 ++--
 lib/crypto/md5.c                              |  2 +-
 lib/crypto/sha1.c                             |  2 +-
 10 files changed, 143 insertions(+), 20 deletions(-)

-- 
2.55.0