* [PATCH 0/2] crypto: remove aegis128 support
@ 2026-11-12 16:44 Ard Biesheuvel
2026-11-12 16:44 ` [PATCH 1/2] crypto: x86 - " Ard Biesheuvel
2026-11-12 16:44 ` [PATCH 2/2] crypto: " Ard Biesheuvel
0 siblings, 2 replies; 4+ messages in thread
From: Ard Biesheuvel @ 2026-11-12 16:44 UTC (permalink / raw)
To: linux-crypto
Cc: herbert, ebiggers, Ard Biesheuvel, Antonio Quartulli,
Ondrej Mosnáček
From: Ard Biesheuvel <ardb@kernel.org>
Remove aegis128 support, which has become obsolete.
Cc: Antonio Quartulli <antonio@mandelbit.com>
Cc: Ondrej Mosnáček <omosnacek@gmail.com>
Ard Biesheuvel (2):
crypto: x86 - remove aegis128 support
crypto: remove aegis128 support
arch/m68k/configs/amiga_defconfig | 1 -
arch/m68k/configs/apollo_defconfig | 1 -
arch/m68k/configs/atari_defconfig | 1 -
arch/m68k/configs/bvme6000_defconfig | 1 -
arch/m68k/configs/hp300_defconfig | 1 -
arch/m68k/configs/mac_defconfig | 1 -
arch/m68k/configs/multi_defconfig | 1 -
arch/m68k/configs/mvme147_defconfig | 1 -
arch/m68k/configs/mvme16x_defconfig | 1 -
arch/m68k/configs/q40_defconfig | 1 -
arch/m68k/configs/sun3_defconfig | 1 -
arch/m68k/configs/sun3x_defconfig | 1 -
arch/s390/configs/debug_defconfig | 1 -
arch/s390/configs/defconfig | 1 -
arch/x86/crypto/Kconfig | 11 -
arch/x86/crypto/Makefile | 3 -
arch/x86/crypto/aegis128-aesni-asm.S | 602 --------------------
arch/x86/crypto/aegis128-aesni-glue.c | 286 ----------
crypto/Kconfig | 17 -
crypto/Makefile | 20 -
crypto/aegis-neon.h | 17 -
crypto/aegis.h | 79 ---
crypto/aegis128-core.c | 577 -------------------
crypto/aegis128-neon-inner.c | 343 -----------
crypto/aegis128-neon.c | 60 --
crypto/tcrypt.c | 7 -
crypto/testmgr.c | 6 -
crypto/testmgr.h | 444 ---------------
28 files changed, 2486 deletions(-)
delete mode 100644 arch/x86/crypto/aegis128-aesni-asm.S
delete mode 100644 arch/x86/crypto/aegis128-aesni-glue.c
delete mode 100644 crypto/aegis-neon.h
delete mode 100644 crypto/aegis.h
delete mode 100644 crypto/aegis128-core.c
delete mode 100644 crypto/aegis128-neon-inner.c
delete mode 100644 crypto/aegis128-neon.c
--
2.56.0.567.gdb80ae8cd5-goog
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 1/2] crypto: x86 - remove aegis128 support
2026-11-12 16:44 [PATCH 0/2] crypto: remove aegis128 support Ard Biesheuvel
@ 2026-11-12 16:44 ` Ard Biesheuvel
2026-11-12 20:23 ` Eric Biggers
2026-11-12 16:44 ` [PATCH 2/2] crypto: " Ard Biesheuvel
1 sibling, 1 reply; 4+ messages in thread
From: Ard Biesheuvel @ 2026-11-12 16:44 UTC (permalink / raw)
To: linux-crypto
Cc: herbert, ebiggers, Ard Biesheuvel, Antonio Quartulli,
Ondrej Mosnáček
From: Ard Biesheuvel <ardb@kernel.org>
Even the people that are invested in Aegis appear to have lost interest
in aegis128: it did win the CAESAR competition but is no longer covered
by RFC 10032, which does list some other variants that competed as well.
So let's delete it.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/crypto/Kconfig | 11 -
arch/x86/crypto/Makefile | 3 -
arch/x86/crypto/aegis128-aesni-asm.S | 602 --------------------
arch/x86/crypto/aegis128-aesni-glue.c | 286 ----------
4 files changed, 902 deletions(-)
diff --git a/arch/x86/crypto/Kconfig b/arch/x86/crypto/Kconfig
index 20f5e2a17e45..7988d4aa1d6d 100644
--- a/arch/x86/crypto/Kconfig
+++ b/arch/x86/crypto/Kconfig
@@ -314,15 +314,4 @@ config CRYPTO_ARIA_GFNI_AVX512_X86_64
Processes 64 blocks in parallel.
-config CRYPTO_AEGIS128_AESNI_SSE2
- tristate "AEAD ciphers: AEGIS-128 (AES-NI/SSE4.1)"
- depends on 64BIT
- select CRYPTO_AEAD
- help
- AEGIS-128 AEAD algorithm
-
- Architecture: x86_64 using:
- - AES-NI (AES New Instructions)
- - SSE4.1 (Streaming SIMD Extensions 4.1)
-
endmenu
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index 09bdea45bc3e..dc1b819c27de 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -36,9 +36,6 @@ cast5-avx-x86_64-y := cast5-avx-x86_64-asm_64.o cast5_avx_glue.o
obj-$(CONFIG_CRYPTO_CAST6_AVX_X86_64) += cast6-avx-x86_64.o
cast6-avx-x86_64-y := cast6-avx-x86_64-asm_64.o cast6_avx_glue.o
-obj-$(CONFIG_CRYPTO_AEGIS128_AESNI_SSE2) += aegis128-aesni.o
-aegis128-aesni-y := aegis128-aesni-asm.o aegis128-aesni-glue.o
-
obj-$(CONFIG_CRYPTO_AES_NI_INTEL) += aesni-intel.o
aesni-intel-y := aesni-intel_glue.o \
aes-gcm-aesni-x86_64.o \
diff --git a/arch/x86/crypto/aegis128-aesni-asm.S b/arch/x86/crypto/aegis128-aesni-asm.S
deleted file mode 100644
index 7294dc0ee7ba..000000000000
--- a/arch/x86/crypto/aegis128-aesni-asm.S
+++ /dev/null
@@ -1,602 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * AES-NI + SSE4.1 implementation of AEGIS-128
- *
- * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved.
- * Copyright 2024 Google LLC
- */
-
-#include <linux/linkage.h>
-
-#define STATE0 %xmm0
-#define STATE1 %xmm1
-#define STATE2 %xmm2
-#define STATE3 %xmm3
-#define STATE4 %xmm4
-#define KEY %xmm5
-#define MSG %xmm5
-#define T0 %xmm6
-#define T1 %xmm7
-
-.section .rodata.cst16.aegis128_const, "aM", @progbits, 32
-.align 16
-.Laegis128_const_0:
- .byte 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d
- .byte 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62
-.Laegis128_const_1:
- .byte 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1
- .byte 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd
-
-.section .rodata.cst32.zeropad_mask, "aM", @progbits, 32
-.align 32
-.Lzeropad_mask:
- .octa 0xffffffffffffffffffffffffffffffff
- .octa 0
-
-.text
-
-/*
- * aegis128_update
- * input:
- * STATE[0-4] - input state
- * output:
- * STATE[0-4] - output state (shifted positions)
- * changed:
- * T0
- */
-.macro aegis128_update
- movdqa STATE4, T0
- aesenc STATE0, STATE4
- aesenc STATE1, STATE0
- aesenc STATE2, STATE1
- aesenc STATE3, STATE2
- aesenc T0, STATE3
-.endm
-
-/*
- * Load 1 <= LEN (%ecx) <= 15 bytes from the pointer SRC into the xmm register
- * MSG and zeroize any remaining bytes. Clobbers %rax, %rcx, and %r8.
- */
-.macro load_partial
- sub $8, %ecx /* LEN - 8 */
- jle .Lle8\@
-
- /* Load 9 <= LEN <= 15 bytes: */
- movq (SRC), MSG /* Load first 8 bytes */
- mov (SRC, %rcx), %rax /* Load last 8 bytes */
- neg %ecx
- shl $3, %ecx
- shr %cl, %rax /* Discard overlapping bytes */
- pinsrq $1, %rax, MSG
- jmp .Ldone\@
-
-.Lle8\@:
- add $4, %ecx /* LEN - 4 */
- jl .Llt4\@
-
- /* Load 4 <= LEN <= 8 bytes: */
- mov (SRC), %eax /* Load first 4 bytes */
- mov (SRC, %rcx), %r8d /* Load last 4 bytes */
- jmp .Lcombine\@
-
-.Llt4\@:
- /* Load 1 <= LEN <= 3 bytes: */
- add $2, %ecx /* LEN - 2 */
- movzbl (SRC), %eax /* Load first byte */
- jl .Lmovq\@
- movzwl (SRC, %rcx), %r8d /* Load last 2 bytes */
-.Lcombine\@:
- shl $3, %ecx
- shl %cl, %r8
- or %r8, %rax /* Combine the two parts */
-.Lmovq\@:
- movq %rax, MSG
-.Ldone\@:
-.endm
-
-/*
- * Store 1 <= LEN (%ecx) <= 15 bytes from the xmm register \msg to the pointer
- * DST. Clobbers %rax, %rcx, and %r8.
- */
-.macro store_partial msg
- sub $8, %ecx /* LEN - 8 */
- jl .Llt8\@
-
- /* Store 8 <= LEN <= 15 bytes: */
- pextrq $1, \msg, %rax
- mov %ecx, %r8d
- shl $3, %ecx
- ror %cl, %rax
- mov %rax, (DST, %r8) /* Store last LEN - 8 bytes */
- movq \msg, (DST) /* Store first 8 bytes */
- jmp .Ldone\@
-
-.Llt8\@:
- add $4, %ecx /* LEN - 4 */
- jl .Llt4\@
-
- /* Store 4 <= LEN <= 7 bytes: */
- pextrd $1, \msg, %eax
- mov %ecx, %r8d
- shl $3, %ecx
- ror %cl, %eax
- mov %eax, (DST, %r8) /* Store last LEN - 4 bytes */
- movd \msg, (DST) /* Store first 4 bytes */
- jmp .Ldone\@
-
-.Llt4\@:
- /* Store 1 <= LEN <= 3 bytes: */
- pextrb $0, \msg, 0(DST)
- cmp $-2, %ecx /* LEN - 4 == -2, i.e. LEN == 2? */
- jl .Ldone\@
- pextrb $1, \msg, 1(DST)
- je .Ldone\@
- pextrb $2, \msg, 2(DST)
-.Ldone\@:
-.endm
-
-/*
- * void aegis128_aesni_init(struct aegis_state *state,
- * const struct aegis_block *key,
- * const u8 iv[AEGIS128_NONCE_SIZE]);
- */
-SYM_FUNC_START(aegis128_aesni_init)
- .set STATEP, %rdi
- .set KEYP, %rsi
- .set IVP, %rdx
-
- /* load IV: */
- movdqu (IVP), T1
-
- /* load key: */
- movdqa (KEYP), KEY
- pxor KEY, T1
- movdqa T1, STATE0
- movdqa KEY, STATE3
- movdqa KEY, STATE4
-
- /* load the constants: */
- movdqa .Laegis128_const_0(%rip), STATE2
- movdqa .Laegis128_const_1(%rip), STATE1
- pxor STATE2, STATE3
- pxor STATE1, STATE4
-
- /* update 10 times with KEY / KEY xor IV: */
- aegis128_update; pxor KEY, STATE4
- aegis128_update; pxor T1, STATE3
- aegis128_update; pxor KEY, STATE2
- aegis128_update; pxor T1, STATE1
- aegis128_update; pxor KEY, STATE0
- aegis128_update; pxor T1, STATE4
- aegis128_update; pxor KEY, STATE3
- aegis128_update; pxor T1, STATE2
- aegis128_update; pxor KEY, STATE1
- aegis128_update; pxor T1, STATE0
-
- /* store the state: */
- movdqu STATE0, 0x00(STATEP)
- movdqu STATE1, 0x10(STATEP)
- movdqu STATE2, 0x20(STATEP)
- movdqu STATE3, 0x30(STATEP)
- movdqu STATE4, 0x40(STATEP)
- RET
-SYM_FUNC_END(aegis128_aesni_init)
-
-/*
- * void aegis128_aesni_ad(struct aegis_state *state, const u8 *data,
- * unsigned int len);
- *
- * len must be a multiple of 16.
- */
-SYM_FUNC_START(aegis128_aesni_ad)
- .set STATEP, %rdi
- .set SRC, %rsi
- .set LEN, %edx
-
- test LEN, LEN
- jz .Lad_out
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
-.align 8
-.Lad_loop:
- movdqu 0x00(SRC), MSG
- aegis128_update
- pxor MSG, STATE4
- sub $0x10, LEN
- jz .Lad_out_1
-
- movdqu 0x10(SRC), MSG
- aegis128_update
- pxor MSG, STATE3
- sub $0x10, LEN
- jz .Lad_out_2
-
- movdqu 0x20(SRC), MSG
- aegis128_update
- pxor MSG, STATE2
- sub $0x10, LEN
- jz .Lad_out_3
-
- movdqu 0x30(SRC), MSG
- aegis128_update
- pxor MSG, STATE1
- sub $0x10, LEN
- jz .Lad_out_4
-
- movdqu 0x40(SRC), MSG
- aegis128_update
- pxor MSG, STATE0
- sub $0x10, LEN
- jz .Lad_out_0
-
- add $0x50, SRC
- jmp .Lad_loop
-
- /* store the state: */
-.Lad_out_0:
- movdqu STATE0, 0x00(STATEP)
- movdqu STATE1, 0x10(STATEP)
- movdqu STATE2, 0x20(STATEP)
- movdqu STATE3, 0x30(STATEP)
- movdqu STATE4, 0x40(STATEP)
- RET
-
-.Lad_out_1:
- movdqu STATE4, 0x00(STATEP)
- movdqu STATE0, 0x10(STATEP)
- movdqu STATE1, 0x20(STATEP)
- movdqu STATE2, 0x30(STATEP)
- movdqu STATE3, 0x40(STATEP)
- RET
-
-.Lad_out_2:
- movdqu STATE3, 0x00(STATEP)
- movdqu STATE4, 0x10(STATEP)
- movdqu STATE0, 0x20(STATEP)
- movdqu STATE1, 0x30(STATEP)
- movdqu STATE2, 0x40(STATEP)
- RET
-
-.Lad_out_3:
- movdqu STATE2, 0x00(STATEP)
- movdqu STATE3, 0x10(STATEP)
- movdqu STATE4, 0x20(STATEP)
- movdqu STATE0, 0x30(STATEP)
- movdqu STATE1, 0x40(STATEP)
- RET
-
-.Lad_out_4:
- movdqu STATE1, 0x00(STATEP)
- movdqu STATE2, 0x10(STATEP)
- movdqu STATE3, 0x20(STATEP)
- movdqu STATE4, 0x30(STATEP)
- movdqu STATE0, 0x40(STATEP)
-.Lad_out:
- RET
-SYM_FUNC_END(aegis128_aesni_ad)
-
-.macro encrypt_block s0 s1 s2 s3 s4 i
- movdqu (\i * 0x10)(SRC), MSG
- movdqa MSG, T0
- pxor \s1, T0
- pxor \s4, T0
- movdqa \s2, T1
- pand \s3, T1
- pxor T1, T0
- movdqu T0, (\i * 0x10)(DST)
-
- aegis128_update
- pxor MSG, \s4
-
- sub $0x10, LEN
- jz .Lenc_out_\i
-.endm
-
-/*
- * void aegis128_aesni_enc(struct aegis_state *state, const u8 *src, u8 *dst,
- * unsigned int len);
- *
- * len must be nonzero and a multiple of 16.
- */
-SYM_FUNC_START(aegis128_aesni_enc)
- .set STATEP, %rdi
- .set SRC, %rsi
- .set DST, %rdx
- .set LEN, %ecx
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
-.align 8
-.Lenc_loop:
- encrypt_block STATE0 STATE1 STATE2 STATE3 STATE4 0
- encrypt_block STATE4 STATE0 STATE1 STATE2 STATE3 1
- encrypt_block STATE3 STATE4 STATE0 STATE1 STATE2 2
- encrypt_block STATE2 STATE3 STATE4 STATE0 STATE1 3
- encrypt_block STATE1 STATE2 STATE3 STATE4 STATE0 4
-
- add $0x50, SRC
- add $0x50, DST
- jmp .Lenc_loop
-
- /* store the state: */
-.Lenc_out_0:
- movdqu STATE4, 0x00(STATEP)
- movdqu STATE0, 0x10(STATEP)
- movdqu STATE1, 0x20(STATEP)
- movdqu STATE2, 0x30(STATEP)
- movdqu STATE3, 0x40(STATEP)
- RET
-
-.Lenc_out_1:
- movdqu STATE3, 0x00(STATEP)
- movdqu STATE4, 0x10(STATEP)
- movdqu STATE0, 0x20(STATEP)
- movdqu STATE1, 0x30(STATEP)
- movdqu STATE2, 0x40(STATEP)
- RET
-
-.Lenc_out_2:
- movdqu STATE2, 0x00(STATEP)
- movdqu STATE3, 0x10(STATEP)
- movdqu STATE4, 0x20(STATEP)
- movdqu STATE0, 0x30(STATEP)
- movdqu STATE1, 0x40(STATEP)
- RET
-
-.Lenc_out_3:
- movdqu STATE1, 0x00(STATEP)
- movdqu STATE2, 0x10(STATEP)
- movdqu STATE3, 0x20(STATEP)
- movdqu STATE4, 0x30(STATEP)
- movdqu STATE0, 0x40(STATEP)
- RET
-
-.Lenc_out_4:
- movdqu STATE0, 0x00(STATEP)
- movdqu STATE1, 0x10(STATEP)
- movdqu STATE2, 0x20(STATEP)
- movdqu STATE3, 0x30(STATEP)
- movdqu STATE4, 0x40(STATEP)
-.Lenc_out:
- RET
-SYM_FUNC_END(aegis128_aesni_enc)
-
-/*
- * void aegis128_aesni_enc_tail(struct aegis_state *state, const u8 *src,
- * u8 *dst, unsigned int len);
- */
-SYM_FUNC_START(aegis128_aesni_enc_tail)
- .set STATEP, %rdi
- .set SRC, %rsi
- .set DST, %rdx
- .set LEN, %ecx /* {load,store}_partial rely on this being %ecx */
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
- /* encrypt message: */
- mov LEN, %r9d
- load_partial
-
- movdqa MSG, T0
- pxor STATE1, T0
- pxor STATE4, T0
- movdqa STATE2, T1
- pand STATE3, T1
- pxor T1, T0
-
- mov %r9d, LEN
- store_partial T0
-
- aegis128_update
- pxor MSG, STATE4
-
- /* store the state: */
- movdqu STATE4, 0x00(STATEP)
- movdqu STATE0, 0x10(STATEP)
- movdqu STATE1, 0x20(STATEP)
- movdqu STATE2, 0x30(STATEP)
- movdqu STATE3, 0x40(STATEP)
- RET
-SYM_FUNC_END(aegis128_aesni_enc_tail)
-
-.macro decrypt_block s0 s1 s2 s3 s4 i
- movdqu (\i * 0x10)(SRC), MSG
- pxor \s1, MSG
- pxor \s4, MSG
- movdqa \s2, T1
- pand \s3, T1
- pxor T1, MSG
- movdqu MSG, (\i * 0x10)(DST)
-
- aegis128_update
- pxor MSG, \s4
-
- sub $0x10, LEN
- jz .Ldec_out_\i
-.endm
-
-/*
- * void aegis128_aesni_dec(struct aegis_state *state, const u8 *src, u8 *dst,
- * unsigned int len);
- *
- * len must be nonzero and a multiple of 16.
- */
-SYM_FUNC_START(aegis128_aesni_dec)
- .set STATEP, %rdi
- .set SRC, %rsi
- .set DST, %rdx
- .set LEN, %ecx
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
-.align 8
-.Ldec_loop:
- decrypt_block STATE0 STATE1 STATE2 STATE3 STATE4 0
- decrypt_block STATE4 STATE0 STATE1 STATE2 STATE3 1
- decrypt_block STATE3 STATE4 STATE0 STATE1 STATE2 2
- decrypt_block STATE2 STATE3 STATE4 STATE0 STATE1 3
- decrypt_block STATE1 STATE2 STATE3 STATE4 STATE0 4
-
- add $0x50, SRC
- add $0x50, DST
- jmp .Ldec_loop
-
- /* store the state: */
-.Ldec_out_0:
- movdqu STATE4, 0x00(STATEP)
- movdqu STATE0, 0x10(STATEP)
- movdqu STATE1, 0x20(STATEP)
- movdqu STATE2, 0x30(STATEP)
- movdqu STATE3, 0x40(STATEP)
- RET
-
-.Ldec_out_1:
- movdqu STATE3, 0x00(STATEP)
- movdqu STATE4, 0x10(STATEP)
- movdqu STATE0, 0x20(STATEP)
- movdqu STATE1, 0x30(STATEP)
- movdqu STATE2, 0x40(STATEP)
- RET
-
-.Ldec_out_2:
- movdqu STATE2, 0x00(STATEP)
- movdqu STATE3, 0x10(STATEP)
- movdqu STATE4, 0x20(STATEP)
- movdqu STATE0, 0x30(STATEP)
- movdqu STATE1, 0x40(STATEP)
- RET
-
-.Ldec_out_3:
- movdqu STATE1, 0x00(STATEP)
- movdqu STATE2, 0x10(STATEP)
- movdqu STATE3, 0x20(STATEP)
- movdqu STATE4, 0x30(STATEP)
- movdqu STATE0, 0x40(STATEP)
- RET
-
-.Ldec_out_4:
- movdqu STATE0, 0x00(STATEP)
- movdqu STATE1, 0x10(STATEP)
- movdqu STATE2, 0x20(STATEP)
- movdqu STATE3, 0x30(STATEP)
- movdqu STATE4, 0x40(STATEP)
-.Ldec_out:
- RET
-SYM_FUNC_END(aegis128_aesni_dec)
-
-/*
- * void aegis128_aesni_dec_tail(struct aegis_state *state, const u8 *src,
- * u8 *dst, unsigned int len);
- */
-SYM_FUNC_START(aegis128_aesni_dec_tail)
- .set STATEP, %rdi
- .set SRC, %rsi
- .set DST, %rdx
- .set LEN, %ecx /* {load,store}_partial rely on this being %ecx */
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
- /* decrypt message: */
- mov LEN, %r9d
- load_partial
-
- pxor STATE1, MSG
- pxor STATE4, MSG
- movdqa STATE2, T1
- pand STATE3, T1
- pxor T1, MSG
-
- mov %r9d, LEN
- store_partial MSG
-
- /* mask with byte count: */
- lea .Lzeropad_mask+16(%rip), %rax
- sub %r9, %rax
- movdqu (%rax), T0
- pand T0, MSG
-
- aegis128_update
- pxor MSG, STATE4
-
- /* store the state: */
- movdqu STATE4, 0x00(STATEP)
- movdqu STATE0, 0x10(STATEP)
- movdqu STATE1, 0x20(STATEP)
- movdqu STATE2, 0x30(STATEP)
- movdqu STATE3, 0x40(STATEP)
- RET
-SYM_FUNC_END(aegis128_aesni_dec_tail)
-
-/*
- * void aegis128_aesni_final(struct aegis_state *state,
- * struct aegis_block *tag_xor,
- * unsigned int assoclen, unsigned int cryptlen);
- */
-SYM_FUNC_START(aegis128_aesni_final)
- .set STATEP, %rdi
- .set TAG_XOR, %rsi
- .set ASSOCLEN, %edx
- .set CRYPTLEN, %ecx
-
- /* load the state: */
- movdqu 0x00(STATEP), STATE0
- movdqu 0x10(STATEP), STATE1
- movdqu 0x20(STATEP), STATE2
- movdqu 0x30(STATEP), STATE3
- movdqu 0x40(STATEP), STATE4
-
- /* prepare length block: */
- movd ASSOCLEN, MSG
- pinsrd $2, CRYPTLEN, MSG
- psllq $3, MSG /* multiply by 8 (to get bit count) */
-
- pxor STATE3, MSG
-
- /* update state: */
- aegis128_update; pxor MSG, STATE4
- aegis128_update; pxor MSG, STATE3
- aegis128_update; pxor MSG, STATE2
- aegis128_update; pxor MSG, STATE1
- aegis128_update; pxor MSG, STATE0
- aegis128_update; pxor MSG, STATE4
- aegis128_update; pxor MSG, STATE3
-
- /* xor tag: */
- movdqu (TAG_XOR), MSG
-
- pxor STATE0, MSG
- pxor STATE1, MSG
- pxor STATE2, MSG
- pxor STATE3, MSG
- pxor STATE4, MSG
-
- movdqu MSG, (TAG_XOR)
- RET
-SYM_FUNC_END(aegis128_aesni_final)
diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c
deleted file mode 100644
index 09fc0b15b0e9..000000000000
--- a/arch/x86/crypto/aegis128-aesni-glue.c
+++ /dev/null
@@ -1,286 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * The AEGIS-128 Authenticated-Encryption Algorithm
- * Glue for AES-NI + SSE4.1 implementation
- *
- * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved.
- */
-
-#include <crypto/internal/aead.h>
-#include <crypto/internal/skcipher.h>
-#include <crypto/scatterwalk.h>
-#include <linux/module.h>
-#include <asm/fpu/api.h>
-#include <asm/cpu_device_id.h>
-
-#define AEGIS128_BLOCK_ALIGN 16
-#define AEGIS128_BLOCK_SIZE 16
-#define AEGIS128_NONCE_SIZE 16
-#define AEGIS128_STATE_BLOCKS 5
-#define AEGIS128_KEY_SIZE 16
-#define AEGIS128_MIN_AUTH_SIZE 8
-#define AEGIS128_MAX_AUTH_SIZE 16
-
-struct aegis_block {
- u8 bytes[AEGIS128_BLOCK_SIZE] __aligned(AEGIS128_BLOCK_ALIGN);
-};
-
-struct aegis_state {
- struct aegis_block blocks[AEGIS128_STATE_BLOCKS];
-};
-
-struct aegis_ctx {
- struct aegis_block key;
-};
-
-asmlinkage void aegis128_aesni_init(struct aegis_state *state,
- const struct aegis_block *key,
- const u8 iv[AEGIS128_NONCE_SIZE]);
-
-asmlinkage void aegis128_aesni_ad(struct aegis_state *state, const u8 *data,
- unsigned int len);
-
-asmlinkage void aegis128_aesni_enc(struct aegis_state *state, const u8 *src,
- u8 *dst, unsigned int len);
-
-asmlinkage void aegis128_aesni_dec(struct aegis_state *state, const u8 *src,
- u8 *dst, unsigned int len);
-
-asmlinkage void aegis128_aesni_enc_tail(struct aegis_state *state,
- const u8 *src, u8 *dst,
- unsigned int len);
-
-asmlinkage void aegis128_aesni_dec_tail(struct aegis_state *state,
- const u8 *src, u8 *dst,
- unsigned int len);
-
-asmlinkage void aegis128_aesni_final(struct aegis_state *state,
- struct aegis_block *tag_xor,
- unsigned int assoclen,
- unsigned int cryptlen);
-
-static void crypto_aegis128_aesni_process_ad(
- struct aegis_state *state, struct scatterlist *sg_src,
- unsigned int assoclen)
-{
- struct scatter_walk walk;
- struct aegis_block buf;
- unsigned int pos = 0;
-
- scatterwalk_start(&walk, sg_src);
- while (assoclen != 0) {
- unsigned int size = scatterwalk_next(&walk, assoclen);
- const u8 *src = walk.addr;
- unsigned int left = size;
-
- if (pos + size >= AEGIS128_BLOCK_SIZE) {
- if (pos > 0) {
- unsigned int fill = AEGIS128_BLOCK_SIZE - pos;
- memcpy(buf.bytes + pos, src, fill);
- aegis128_aesni_ad(state, buf.bytes,
- AEGIS128_BLOCK_SIZE);
- pos = 0;
- left -= fill;
- src += fill;
- }
-
- aegis128_aesni_ad(state, src,
- left & ~(AEGIS128_BLOCK_SIZE - 1));
- src += left & ~(AEGIS128_BLOCK_SIZE - 1);
- left &= AEGIS128_BLOCK_SIZE - 1;
- }
-
- memcpy(buf.bytes + pos, src, left);
- pos += left;
- assoclen -= size;
-
- scatterwalk_done_src(&walk, size);
- }
-
- if (pos > 0) {
- memset(buf.bytes + pos, 0, AEGIS128_BLOCK_SIZE - pos);
- aegis128_aesni_ad(state, buf.bytes, AEGIS128_BLOCK_SIZE);
- }
-}
-
-static __always_inline int
-crypto_aegis128_aesni_process_crypt(struct aegis_state *state,
- struct skcipher_walk *walk, bool enc)
-{
- int err = 0;
-
- while (walk->nbytes >= AEGIS128_BLOCK_SIZE) {
- if (enc)
- aegis128_aesni_enc(state, walk->src.virt.addr,
- walk->dst.virt.addr,
- round_down(walk->nbytes,
- AEGIS128_BLOCK_SIZE));
- else
- aegis128_aesni_dec(state, walk->src.virt.addr,
- walk->dst.virt.addr,
- round_down(walk->nbytes,
- AEGIS128_BLOCK_SIZE));
- kernel_fpu_end();
- err = skcipher_walk_done(walk,
- walk->nbytes % AEGIS128_BLOCK_SIZE);
- kernel_fpu_begin();
- }
-
- if (walk->nbytes) {
- if (enc)
- aegis128_aesni_enc_tail(state, walk->src.virt.addr,
- walk->dst.virt.addr,
- walk->nbytes);
- else
- aegis128_aesni_dec_tail(state, walk->src.virt.addr,
- walk->dst.virt.addr,
- walk->nbytes);
- kernel_fpu_end();
- err = skcipher_walk_done(walk, 0);
- kernel_fpu_begin();
- }
- return err;
-}
-
-static struct aegis_ctx *crypto_aegis128_aesni_ctx(struct crypto_aead *aead)
-{
- u8 *ctx = crypto_aead_ctx(aead);
- ctx = PTR_ALIGN(ctx, __alignof__(struct aegis_ctx));
- return (void *)ctx;
-}
-
-static int crypto_aegis128_aesni_setkey(struct crypto_aead *aead, const u8 *key,
- unsigned int keylen)
-{
- struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(aead);
-
- if (keylen != AEGIS128_KEY_SIZE)
- return -EINVAL;
-
- memcpy(ctx->key.bytes, key, AEGIS128_KEY_SIZE);
-
- return 0;
-}
-
-static int crypto_aegis128_aesni_setauthsize(struct crypto_aead *tfm,
- unsigned int authsize)
-{
- if (authsize > AEGIS128_MAX_AUTH_SIZE)
- return -EINVAL;
- if (authsize < AEGIS128_MIN_AUTH_SIZE)
- return -EINVAL;
- return 0;
-}
-
-static __always_inline int
-crypto_aegis128_aesni_crypt(struct aead_request *req,
- struct aegis_block *tag_xor,
- unsigned int cryptlen, bool enc)
-{
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm);
- struct skcipher_walk walk;
- struct aegis_state state;
- int err;
-
- if (enc)
- err = skcipher_walk_aead_encrypt(&walk, req, false);
- else
- err = skcipher_walk_aead_decrypt(&walk, req, false);
- if (err)
- return err;
-
- kernel_fpu_begin();
-
- aegis128_aesni_init(&state, &ctx->key, req->iv);
- crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen);
- err = crypto_aegis128_aesni_process_crypt(&state, &walk, enc);
- if (err == 0)
- aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
- kernel_fpu_end();
- return err;
-}
-
-static int crypto_aegis128_aesni_encrypt(struct aead_request *req)
-{
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- struct aegis_block tag = {};
- unsigned int authsize = crypto_aead_authsize(tfm);
- unsigned int cryptlen = req->cryptlen;
- int err;
-
- err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, true);
- if (err)
- return err;
-
- scatterwalk_map_and_copy(tag.bytes, req->dst,
- req->assoclen + cryptlen, authsize, 1);
- return 0;
-}
-
-static int crypto_aegis128_aesni_decrypt(struct aead_request *req)
-{
- static const struct aegis_block zeros = {};
-
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- struct aegis_block tag;
- unsigned int authsize = crypto_aead_authsize(tfm);
- unsigned int cryptlen = req->cryptlen - authsize;
- int err;
-
- scatterwalk_map_and_copy(tag.bytes, req->src,
- req->assoclen + cryptlen, authsize, 0);
-
- err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, false);
- if (err)
- return err;
-
- return crypto_memneq(tag.bytes, zeros.bytes, authsize) ? -EBADMSG : 0;
-}
-
-static struct aead_alg crypto_aegis128_aesni_alg = {
- .setkey = crypto_aegis128_aesni_setkey,
- .setauthsize = crypto_aegis128_aesni_setauthsize,
- .encrypt = crypto_aegis128_aesni_encrypt,
- .decrypt = crypto_aegis128_aesni_decrypt,
-
- .ivsize = AEGIS128_NONCE_SIZE,
- .maxauthsize = AEGIS128_MAX_AUTH_SIZE,
- .chunksize = AEGIS128_BLOCK_SIZE,
-
- .base = {
- .cra_blocksize = 1,
- .cra_ctxsize = sizeof(struct aegis_ctx) +
- __alignof__(struct aegis_ctx),
- .cra_priority = 400,
-
- .cra_name = "aegis128",
- .cra_driver_name = "aegis128-aesni",
-
- .cra_module = THIS_MODULE,
- }
-};
-
-static int __init crypto_aegis128_aesni_module_init(void)
-{
- if (!boot_cpu_has(X86_FEATURE_XMM4_1) ||
- !boot_cpu_has(X86_FEATURE_AES))
- return -ENODEV;
-
- return crypto_register_aead(&crypto_aegis128_aesni_alg);
-}
-
-static void __exit crypto_aegis128_aesni_module_exit(void)
-{
- crypto_unregister_aead(&crypto_aegis128_aesni_alg);
-}
-
-module_init(crypto_aegis128_aesni_module_init);
-module_exit(crypto_aegis128_aesni_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Ondrej Mosnacek <omosnacek@gmail.com>");
-MODULE_DESCRIPTION("AEGIS-128 AEAD algorithm -- AESNI+SSE4.1 implementation");
-MODULE_ALIAS_CRYPTO("aegis128");
-MODULE_ALIAS_CRYPTO("aegis128-aesni");
--
2.56.0.567.gdb80ae8cd5-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] crypto: remove aegis128 support
2026-11-12 16:44 [PATCH 0/2] crypto: remove aegis128 support Ard Biesheuvel
2026-11-12 16:44 ` [PATCH 1/2] crypto: x86 - " Ard Biesheuvel
@ 2026-11-12 16:44 ` Ard Biesheuvel
1 sibling, 0 replies; 4+ messages in thread
From: Ard Biesheuvel @ 2026-11-12 16:44 UTC (permalink / raw)
To: linux-crypto
Cc: herbert, ebiggers, Ard Biesheuvel, Antonio Quartulli,
Ondrej Mosnáček
From: Ard Biesheuvel <ardb@kernel.org>
Even the people that are invested in Aegis appear to have lost interest
in aegis128: it did win the CAESAR competition but is no longer covered
by RFC 10032, which does list some other variants that competed as well.
So let's delete it.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/m68k/configs/amiga_defconfig | 1 -
arch/m68k/configs/apollo_defconfig | 1 -
arch/m68k/configs/atari_defconfig | 1 -
arch/m68k/configs/bvme6000_defconfig | 1 -
arch/m68k/configs/hp300_defconfig | 1 -
arch/m68k/configs/mac_defconfig | 1 -
arch/m68k/configs/multi_defconfig | 1 -
arch/m68k/configs/mvme147_defconfig | 1 -
arch/m68k/configs/mvme16x_defconfig | 1 -
arch/m68k/configs/q40_defconfig | 1 -
arch/m68k/configs/sun3_defconfig | 1 -
arch/m68k/configs/sun3x_defconfig | 1 -
arch/s390/configs/debug_defconfig | 1 -
arch/s390/configs/defconfig | 1 -
crypto/Kconfig | 17 -
crypto/Makefile | 20 -
crypto/aegis-neon.h | 17 -
crypto/aegis.h | 79 ---
crypto/aegis128-core.c | 577 --------------------
crypto/aegis128-neon-inner.c | 343 ------------
crypto/aegis128-neon.c | 60 --
crypto/tcrypt.c | 7 -
crypto/testmgr.c | 6 -
crypto/testmgr.h | 444 ---------------
24 files changed, 1584 deletions(-)
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index e2d474e8cb8f..787defb894dd 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -531,7 +531,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 77669e31bb5a..8b8cea4643ed 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -485,7 +485,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 43ed1e317ae2..c36793ed8d49 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -510,7 +510,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 44c1a2228d5f..53bc0e1dcf8c 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -477,7 +477,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 7ab25377bfe8..9412fc91a831 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -487,7 +487,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 13f642884a94..1e092dd7c1f7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -506,7 +506,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 1bbd2aa653c0..fbfbd3644626 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -596,7 +596,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 3bfc36faf8d5..6209dacde6f4 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -477,7 +477,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 41ceed87c78a..a937c428d2d5 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -478,7 +478,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index af4b5c6e4655..fb2c07c194ae 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -496,7 +496,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 1140951fefe7..7ba77810a688 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -475,7 +475,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index bc9358e71ee0..0810c9fb3daf 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -475,7 +475,6 @@ CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=m
CONFIG_CRYPTO_RMD160=m
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index d44674b63715..2a1b312a04d2 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -805,7 +805,6 @@ CONFIG_CRYPTO_ADIANTUM=m
CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_CRYPTO_MD4=m
diff --git a/arch/s390/configs/defconfig b/arch/s390/configs/defconfig
index e00e252d4694..94d4646999b3 100644
--- a/arch/s390/configs/defconfig
+++ b/arch/s390/configs/defconfig
@@ -789,7 +789,6 @@ CONFIG_CRYPTO_ADIANTUM=m
CONFIG_CRYPTO_ARC4=m
CONFIG_CRYPTO_HCTR2=m
CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_AEGIS128=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_CRYPTO_MD4=m
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 981d5dc422d4..7bb06b817d55 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -743,23 +743,6 @@ endmenu
menu "AEAD (authenticated encryption with associated data) ciphers"
-config CRYPTO_AEGIS128
- tristate "AEGIS-128"
- select CRYPTO_AEAD
- select CRYPTO_LIB_AES # for AES S-box tables
- help
- AEGIS-128 AEAD algorithm
-
-config CRYPTO_AEGIS128_SIMD
- bool "AEGIS-128 (arm NEON, arm64 NEON)"
- depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
- default y
- help
- AEGIS-128 AEAD algorithm
-
- Architecture: arm or arm64 using:
- - NEON (Advanced SIMD) extension
-
config CRYPTO_CHACHA20POLY1305
tristate "ChaCha20-Poly1305"
select CRYPTO_CHACHA20
diff --git a/crypto/Makefile b/crypto/Makefile
index 33bb5ad595e8..4db99bba1048 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -96,26 +96,6 @@ obj-$(CONFIG_CRYPTO_ADIANTUM) += adiantum.o
obj-$(CONFIG_CRYPTO_GCM) += gcm.o
obj-$(CONFIG_CRYPTO_CCM) += ccm.o
obj-$(CONFIG_CRYPTO_CHACHA20POLY1305) += chacha20poly1305.o
-obj-$(CONFIG_CRYPTO_AEGIS128) += aegis128.o
-aegis128-y := aegis128-core.o
-
-CFLAGS_aegis128-neon-inner.o += $(CC_FLAGS_FPU)
-CFLAGS_REMOVE_aegis128-neon-inner.o += $(CC_FLAGS_NO_FPU)
-ifeq ($(ARCH),arm)
-CFLAGS_aegis128-neon-inner.o += -march=armv8-a -mfpu=crypto-neon-fp-armv8
-aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
-endif
-ifeq ($(ARCH),arm64)
-aegis128-cflags-y := -mcpu=generic+crypto
-aegis128-cflags-$(CONFIG_CC_IS_GCC) += -ffixed-q16 -ffixed-q17 -ffixed-q18 \
- -ffixed-q19 -ffixed-q20 -ffixed-q21 \
- -ffixed-q22 -ffixed-q23 -ffixed-q24 \
- -ffixed-q25 -ffixed-q26 -ffixed-q27 \
- -ffixed-q28 -ffixed-q29 -ffixed-q30 \
- -ffixed-q31
-CFLAGS_aegis128-neon-inner.o += $(aegis128-cflags-y)
-aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
-endif
obj-$(CONFIG_CRYPTO_PCRYPT) += pcrypt.o
obj-$(CONFIG_CRYPTO_CRYPTD) += cryptd.o
diff --git a/crypto/aegis-neon.h b/crypto/aegis-neon.h
deleted file mode 100644
index 61e5614b45de..000000000000
--- a/crypto/aegis-neon.h
+++ /dev/null
@@ -1,17 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#ifndef _AEGIS_NEON_H
-#define _AEGIS_NEON_H
-
-void crypto_aegis128_init_neon(void *state, const void *key, const void *iv);
-void crypto_aegis128_update_neon(void *state, const void *msg);
-void crypto_aegis128_encrypt_chunk_neon(void *state, void *dst, const void *src,
- unsigned int size);
-void crypto_aegis128_decrypt_chunk_neon(void *state, void *dst, const void *src,
- unsigned int size);
-int crypto_aegis128_final_neon(void *state, void *tag_xor,
- unsigned int assoclen,
- unsigned int cryptlen,
- unsigned int authsize);
-
-#endif
diff --git a/crypto/aegis.h b/crypto/aegis.h
deleted file mode 100644
index ffcf8e85ea69..000000000000
--- a/crypto/aegis.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- * AEGIS common definitions
- *
- * Copyright (c) 2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (c) 2018 Red Hat, Inc. All rights reserved.
- */
-
-#ifndef _CRYPTO_AEGIS_H
-#define _CRYPTO_AEGIS_H
-
-#include <crypto/aes.h>
-#include <linux/bitops.h>
-#include <linux/types.h>
-
-#define AEGIS_BLOCK_SIZE 16
-
-union aegis_block {
- __le64 words64[AEGIS_BLOCK_SIZE / sizeof(__le64)];
- __le32 words32[AEGIS_BLOCK_SIZE / sizeof(__le32)];
- u8 bytes[AEGIS_BLOCK_SIZE];
-};
-
-struct aegis_state;
-
-extern int aegis128_have_aes_insn;
-
-#define AEGIS_BLOCK_ALIGN (__alignof__(union aegis_block))
-#define AEGIS_ALIGNED(p) IS_ALIGNED((uintptr_t)p, AEGIS_BLOCK_ALIGN)
-
-bool crypto_aegis128_have_simd(void);
-void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg);
-void crypto_aegis128_init_simd(struct aegis_state *state,
- const union aegis_block *key,
- const u8 *iv);
-void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size);
-void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size);
-int crypto_aegis128_final_simd(struct aegis_state *state,
- union aegis_block *tag_xor,
- unsigned int assoclen,
- unsigned int cryptlen,
- unsigned int authsize);
-
-static __always_inline void crypto_aegis_block_xor(union aegis_block *dst,
- const union aegis_block *src)
-{
- dst->words64[0] ^= src->words64[0];
- dst->words64[1] ^= src->words64[1];
-}
-
-static __always_inline void crypto_aegis_block_and(union aegis_block *dst,
- const union aegis_block *src)
-{
- dst->words64[0] &= src->words64[0];
- dst->words64[1] &= src->words64[1];
-}
-
-static __always_inline void crypto_aegis_aesenc(union aegis_block *dst,
- const union aegis_block *src,
- const union aegis_block *key)
-{
- const u8 *s = src->bytes;
- const u32 *t = aes_enc_tab;
- u32 d0, d1, d2, d3;
-
- d0 = t[s[ 0]] ^ rol32(t[s[ 5]], 8) ^ rol32(t[s[10]], 16) ^ rol32(t[s[15]], 24);
- d1 = t[s[ 4]] ^ rol32(t[s[ 9]], 8) ^ rol32(t[s[14]], 16) ^ rol32(t[s[ 3]], 24);
- d2 = t[s[ 8]] ^ rol32(t[s[13]], 8) ^ rol32(t[s[ 2]], 16) ^ rol32(t[s[ 7]], 24);
- d3 = t[s[12]] ^ rol32(t[s[ 1]], 8) ^ rol32(t[s[ 6]], 16) ^ rol32(t[s[11]], 24);
-
- dst->words32[0] = cpu_to_le32(d0) ^ key->words32[0];
- dst->words32[1] = cpu_to_le32(d1) ^ key->words32[1];
- dst->words32[2] = cpu_to_le32(d2) ^ key->words32[2];
- dst->words32[3] = cpu_to_le32(d3) ^ key->words32[3];
-}
-
-#endif /* _CRYPTO_AEGIS_H */
diff --git a/crypto/aegis128-core.c b/crypto/aegis128-core.c
deleted file mode 100644
index ca80d861345d..000000000000
--- a/crypto/aegis128-core.c
+++ /dev/null
@@ -1,577 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * The AEGIS-128 Authenticated-Encryption Algorithm
- *
- * Copyright (c) 2017-2018 Ondrej Mosnacek <omosnacek@gmail.com>
- * Copyright (C) 2017-2018 Red Hat, Inc. All rights reserved.
- */
-
-#include <crypto/algapi.h>
-#include <crypto/internal/aead.h>
-#include <crypto/internal/simd.h>
-#include <crypto/internal/skcipher.h>
-#include <crypto/scatterwalk.h>
-#include <linux/err.h>
-#include <linux/init.h>
-#include <linux/jump_label.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/scatterlist.h>
-
-#include <asm/simd.h>
-
-#include "aegis.h"
-
-#define AEGIS128_NONCE_SIZE 16
-#define AEGIS128_STATE_BLOCKS 5
-#define AEGIS128_KEY_SIZE 16
-#define AEGIS128_MIN_AUTH_SIZE 8
-#define AEGIS128_MAX_AUTH_SIZE 16
-
-struct aegis_state {
- union aegis_block blocks[AEGIS128_STATE_BLOCKS];
-};
-
-struct aegis_ctx {
- union aegis_block key;
-};
-
-static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_simd);
-
-static const union aegis_block crypto_aegis_const[2] = {
- { .words64 = {
- cpu_to_le64(U64_C(0x0d08050302010100)),
- cpu_to_le64(U64_C(0x6279e99059372215)),
- } },
- { .words64 = {
- cpu_to_le64(U64_C(0xf12fc26d55183ddb)),
- cpu_to_le64(U64_C(0xdd28b57342311120)),
- } },
-};
-
-static bool aegis128_do_simd(void)
-{
-#ifdef CONFIG_CRYPTO_AEGIS128_SIMD
- if (static_branch_likely(&have_simd))
- return crypto_simd_usable();
-#endif
- return false;
-}
-
-static void crypto_aegis128_update(struct aegis_state *state)
-{
- union aegis_block tmp;
- unsigned int i;
-
- tmp = state->blocks[AEGIS128_STATE_BLOCKS - 1];
- for (i = AEGIS128_STATE_BLOCKS - 1; i > 0; i--)
- crypto_aegis_aesenc(&state->blocks[i], &state->blocks[i - 1],
- &state->blocks[i]);
- crypto_aegis_aesenc(&state->blocks[0], &tmp, &state->blocks[0]);
-}
-
-static void crypto_aegis128_update_a(struct aegis_state *state,
- const union aegis_block *msg,
- bool do_simd)
-{
- if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) && do_simd) {
- crypto_aegis128_update_simd(state, msg);
- return;
- }
-
- crypto_aegis128_update(state);
- crypto_aegis_block_xor(&state->blocks[0], msg);
-}
-
-static void crypto_aegis128_update_u(struct aegis_state *state, const void *msg,
- bool do_simd)
-{
- if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) && do_simd) {
- crypto_aegis128_update_simd(state, msg);
- return;
- }
-
- crypto_aegis128_update(state);
- crypto_xor(state->blocks[0].bytes, msg, AEGIS_BLOCK_SIZE);
-}
-
-static void crypto_aegis128_init(struct aegis_state *state,
- const union aegis_block *key,
- const u8 *iv)
-{
- union aegis_block key_iv;
- unsigned int i;
-
- key_iv = *key;
- crypto_xor(key_iv.bytes, iv, AEGIS_BLOCK_SIZE);
-
- state->blocks[0] = key_iv;
- state->blocks[1] = crypto_aegis_const[1];
- state->blocks[2] = crypto_aegis_const[0];
- state->blocks[3] = *key;
- state->blocks[4] = *key;
-
- crypto_aegis_block_xor(&state->blocks[3], &crypto_aegis_const[0]);
- crypto_aegis_block_xor(&state->blocks[4], &crypto_aegis_const[1]);
-
- for (i = 0; i < 5; i++) {
- crypto_aegis128_update_a(state, key, false);
- crypto_aegis128_update_a(state, &key_iv, false);
- }
-}
-
-static void crypto_aegis128_ad(struct aegis_state *state,
- const u8 *src, unsigned int size,
- bool do_simd)
-{
- if (AEGIS_ALIGNED(src)) {
- const union aegis_block *src_blk =
- (const union aegis_block *)src;
-
- while (size >= AEGIS_BLOCK_SIZE) {
- crypto_aegis128_update_a(state, src_blk, do_simd);
-
- size -= AEGIS_BLOCK_SIZE;
- src_blk++;
- }
- } else {
- while (size >= AEGIS_BLOCK_SIZE) {
- crypto_aegis128_update_u(state, src, do_simd);
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- }
- }
-}
-
-static void crypto_aegis128_wipe_chunk(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size)
-{
- memzero_explicit(dst, size);
-}
-
-static void crypto_aegis128_encrypt_chunk(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size)
-{
- union aegis_block tmp;
-
- if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
- while (size >= AEGIS_BLOCK_SIZE) {
- union aegis_block *dst_blk =
- (union aegis_block *)dst;
- const union aegis_block *src_blk =
- (const union aegis_block *)src;
-
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
- crypto_aegis_block_xor(&tmp, src_blk);
-
- crypto_aegis128_update_a(state, src_blk, false);
-
- *dst_blk = tmp;
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
- } else {
- while (size >= AEGIS_BLOCK_SIZE) {
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
- crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
-
- crypto_aegis128_update_u(state, src, false);
-
- memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
- }
-
- if (size > 0) {
- union aegis_block msg = {};
- memcpy(msg.bytes, src, size);
-
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
-
- crypto_aegis128_update_a(state, &msg, false);
-
- crypto_aegis_block_xor(&msg, &tmp);
-
- memcpy(dst, msg.bytes, size);
- }
-}
-
-static void crypto_aegis128_decrypt_chunk(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size)
-{
- union aegis_block tmp;
-
- if (AEGIS_ALIGNED(src) && AEGIS_ALIGNED(dst)) {
- while (size >= AEGIS_BLOCK_SIZE) {
- union aegis_block *dst_blk =
- (union aegis_block *)dst;
- const union aegis_block *src_blk =
- (const union aegis_block *)src;
-
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
- crypto_aegis_block_xor(&tmp, src_blk);
-
- crypto_aegis128_update_a(state, &tmp, false);
-
- *dst_blk = tmp;
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
- } else {
- while (size >= AEGIS_BLOCK_SIZE) {
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
- crypto_xor(tmp.bytes, src, AEGIS_BLOCK_SIZE);
-
- crypto_aegis128_update_a(state, &tmp, false);
-
- memcpy(dst, tmp.bytes, AEGIS_BLOCK_SIZE);
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
- }
-
- if (size > 0) {
- union aegis_block msg = {};
- memcpy(msg.bytes, src, size);
-
- tmp = state->blocks[2];
- crypto_aegis_block_and(&tmp, &state->blocks[3]);
- crypto_aegis_block_xor(&tmp, &state->blocks[4]);
- crypto_aegis_block_xor(&tmp, &state->blocks[1]);
- crypto_aegis_block_xor(&msg, &tmp);
-
- memset(msg.bytes + size, 0, AEGIS_BLOCK_SIZE - size);
-
- crypto_aegis128_update_a(state, &msg, false);
-
- memcpy(dst, msg.bytes, size);
- }
-}
-
-static void crypto_aegis128_process_ad(struct aegis_state *state,
- struct scatterlist *sg_src,
- unsigned int assoclen,
- bool do_simd)
-{
- struct scatter_walk walk;
- union aegis_block buf;
- unsigned int pos = 0;
-
- scatterwalk_start(&walk, sg_src);
- while (assoclen != 0) {
- unsigned int size = scatterwalk_next(&walk, assoclen);
- const u8 *src = walk.addr;
- unsigned int left = size;
-
- if (pos + size >= AEGIS_BLOCK_SIZE) {
- if (pos > 0) {
- unsigned int fill = AEGIS_BLOCK_SIZE - pos;
- memcpy(buf.bytes + pos, src, fill);
- crypto_aegis128_update_a(state, &buf, do_simd);
- pos = 0;
- left -= fill;
- src += fill;
- }
-
- crypto_aegis128_ad(state, src, left, do_simd);
- src += left & ~(AEGIS_BLOCK_SIZE - 1);
- left &= AEGIS_BLOCK_SIZE - 1;
- }
-
- memcpy(buf.bytes + pos, src, left);
-
- pos += left;
- assoclen -= size;
- scatterwalk_done_src(&walk, size);
- }
-
- if (pos > 0) {
- memset(buf.bytes + pos, 0, AEGIS_BLOCK_SIZE - pos);
- crypto_aegis128_update_a(state, &buf, do_simd);
- }
-}
-
-static __always_inline
-int crypto_aegis128_process_crypt(struct aegis_state *state,
- struct skcipher_walk *walk,
- void (*crypt)(struct aegis_state *state,
- u8 *dst,
- const u8 *src,
- unsigned int size))
-{
- int err = 0;
-
- while (walk->nbytes) {
- unsigned int nbytes = walk->nbytes;
-
- if (nbytes < walk->total)
- nbytes = round_down(nbytes, walk->stride);
-
- crypt(state, walk->dst.virt.addr, walk->src.virt.addr, nbytes);
-
- err = skcipher_walk_done(walk, walk->nbytes - nbytes);
- }
- return err;
-}
-
-static void crypto_aegis128_final(struct aegis_state *state,
- union aegis_block *tag_xor,
- u64 assoclen, u64 cryptlen)
-{
- u64 assocbits = assoclen * 8;
- u64 cryptbits = cryptlen * 8;
-
- union aegis_block tmp;
- unsigned int i;
-
- tmp.words64[0] = cpu_to_le64(assocbits);
- tmp.words64[1] = cpu_to_le64(cryptbits);
-
- crypto_aegis_block_xor(&tmp, &state->blocks[3]);
-
- for (i = 0; i < 7; i++)
- crypto_aegis128_update_a(state, &tmp, false);
-
- for (i = 0; i < AEGIS128_STATE_BLOCKS; i++)
- crypto_aegis_block_xor(tag_xor, &state->blocks[i]);
-}
-
-static int crypto_aegis128_setkey(struct crypto_aead *aead, const u8 *key,
- unsigned int keylen)
-{
- struct aegis_ctx *ctx = crypto_aead_ctx(aead);
-
- if (keylen != AEGIS128_KEY_SIZE)
- return -EINVAL;
-
- memcpy(ctx->key.bytes, key, AEGIS128_KEY_SIZE);
- return 0;
-}
-
-static int crypto_aegis128_setauthsize(struct crypto_aead *tfm,
- unsigned int authsize)
-{
- if (authsize > AEGIS128_MAX_AUTH_SIZE)
- return -EINVAL;
- if (authsize < AEGIS128_MIN_AUTH_SIZE)
- return -EINVAL;
- return 0;
-}
-
-static int crypto_aegis128_encrypt_generic(struct aead_request *req)
-{
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- union aegis_block tag = {};
- unsigned int authsize = crypto_aead_authsize(tfm);
- struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
- unsigned int cryptlen = req->cryptlen;
- struct skcipher_walk walk;
- struct aegis_state state;
-
- skcipher_walk_aead_encrypt(&walk, req, false);
- crypto_aegis128_init(&state, &ctx->key, req->iv);
- crypto_aegis128_process_ad(&state, req->src, req->assoclen, false);
- crypto_aegis128_process_crypt(&state, &walk,
- crypto_aegis128_encrypt_chunk);
- crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
-
- scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen,
- authsize, 1);
- return 0;
-}
-
-static int crypto_aegis128_decrypt_generic(struct aead_request *req)
-{
- static const u8 zeros[AEGIS128_MAX_AUTH_SIZE] = {};
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- union aegis_block tag;
- unsigned int authsize = crypto_aead_authsize(tfm);
- unsigned int cryptlen = req->cryptlen - authsize;
- struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
- struct skcipher_walk walk;
- struct aegis_state state;
-
- scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen,
- authsize, 0);
-
- skcipher_walk_aead_decrypt(&walk, req, false);
- crypto_aegis128_init(&state, &ctx->key, req->iv);
- crypto_aegis128_process_ad(&state, req->src, req->assoclen, false);
- crypto_aegis128_process_crypt(&state, &walk,
- crypto_aegis128_decrypt_chunk);
- crypto_aegis128_final(&state, &tag, req->assoclen, cryptlen);
-
- if (unlikely(crypto_memneq(tag.bytes, zeros, authsize))) {
- /*
- * From Chapter 4. 'Security Analysis' of the AEGIS spec [0]
- *
- * "3. If verification fails, the decrypted plaintext and the
- * wrong authentication tag should not be given as output."
- *
- * [0] https://competitions.cr.yp.to/round3/aegisv11.pdf
- */
- skcipher_walk_aead_decrypt(&walk, req, false);
- crypto_aegis128_process_crypt(NULL, &walk,
- crypto_aegis128_wipe_chunk);
- memzero_explicit(&tag, sizeof(tag));
- return -EBADMSG;
- }
- return 0;
-}
-
-static int crypto_aegis128_encrypt_simd(struct aead_request *req)
-{
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- union aegis_block tag = {};
- unsigned int authsize = crypto_aead_authsize(tfm);
- struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
- unsigned int cryptlen = req->cryptlen;
- struct skcipher_walk walk;
- struct aegis_state state;
-
- if (!aegis128_do_simd())
- return crypto_aegis128_encrypt_generic(req);
-
- skcipher_walk_aead_encrypt(&walk, req, false);
- crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
- crypto_aegis128_process_ad(&state, req->src, req->assoclen, true);
- crypto_aegis128_process_crypt(&state, &walk,
- crypto_aegis128_encrypt_chunk_simd);
- crypto_aegis128_final_simd(&state, &tag, req->assoclen, cryptlen, 0);
-
- scatterwalk_map_and_copy(tag.bytes, req->dst, req->assoclen + cryptlen,
- authsize, 1);
- return 0;
-}
-
-static int crypto_aegis128_decrypt_simd(struct aead_request *req)
-{
- struct crypto_aead *tfm = crypto_aead_reqtfm(req);
- union aegis_block tag;
- unsigned int authsize = crypto_aead_authsize(tfm);
- unsigned int cryptlen = req->cryptlen - authsize;
- struct aegis_ctx *ctx = crypto_aead_ctx(tfm);
- struct skcipher_walk walk;
- struct aegis_state state;
-
- if (!aegis128_do_simd())
- return crypto_aegis128_decrypt_generic(req);
-
- scatterwalk_map_and_copy(tag.bytes, req->src, req->assoclen + cryptlen,
- authsize, 0);
-
- skcipher_walk_aead_decrypt(&walk, req, false);
- crypto_aegis128_init_simd(&state, &ctx->key, req->iv);
- crypto_aegis128_process_ad(&state, req->src, req->assoclen, true);
- crypto_aegis128_process_crypt(&state, &walk,
- crypto_aegis128_decrypt_chunk_simd);
-
- if (unlikely(crypto_aegis128_final_simd(&state, &tag, req->assoclen,
- cryptlen, authsize))) {
- skcipher_walk_aead_decrypt(&walk, req, false);
- crypto_aegis128_process_crypt(NULL, &walk,
- crypto_aegis128_wipe_chunk);
- return -EBADMSG;
- }
- return 0;
-}
-
-static struct aead_alg crypto_aegis128_alg_generic = {
- .setkey = crypto_aegis128_setkey,
- .setauthsize = crypto_aegis128_setauthsize,
- .encrypt = crypto_aegis128_encrypt_generic,
- .decrypt = crypto_aegis128_decrypt_generic,
-
- .ivsize = AEGIS128_NONCE_SIZE,
- .maxauthsize = AEGIS128_MAX_AUTH_SIZE,
- .chunksize = AEGIS_BLOCK_SIZE,
-
- .base.cra_blocksize = 1,
- .base.cra_ctxsize = sizeof(struct aegis_ctx),
- .base.cra_priority = 100,
- .base.cra_name = "aegis128",
- .base.cra_driver_name = "aegis128-generic",
- .base.cra_module = THIS_MODULE,
-};
-
-static struct aead_alg crypto_aegis128_alg_simd = {
- .setkey = crypto_aegis128_setkey,
- .setauthsize = crypto_aegis128_setauthsize,
- .encrypt = crypto_aegis128_encrypt_simd,
- .decrypt = crypto_aegis128_decrypt_simd,
-
- .ivsize = AEGIS128_NONCE_SIZE,
- .maxauthsize = AEGIS128_MAX_AUTH_SIZE,
- .chunksize = AEGIS_BLOCK_SIZE,
-
- .base.cra_blocksize = 1,
- .base.cra_ctxsize = sizeof(struct aegis_ctx),
- .base.cra_priority = 200,
- .base.cra_name = "aegis128",
- .base.cra_driver_name = "aegis128-simd",
- .base.cra_module = THIS_MODULE,
-};
-
-static int __init crypto_aegis128_module_init(void)
-{
- int ret;
-
- ret = crypto_register_aead(&crypto_aegis128_alg_generic);
- if (ret)
- return ret;
-
- if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) &&
- crypto_aegis128_have_simd()) {
- ret = crypto_register_aead(&crypto_aegis128_alg_simd);
- if (ret) {
- crypto_unregister_aead(&crypto_aegis128_alg_generic);
- return ret;
- }
- static_branch_enable(&have_simd);
- }
- return 0;
-}
-
-static void __exit crypto_aegis128_module_exit(void)
-{
- if (IS_ENABLED(CONFIG_CRYPTO_AEGIS128_SIMD) &&
- crypto_aegis128_have_simd())
- crypto_unregister_aead(&crypto_aegis128_alg_simd);
-
- crypto_unregister_aead(&crypto_aegis128_alg_generic);
-}
-
-module_init(crypto_aegis128_module_init);
-module_exit(crypto_aegis128_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Ondrej Mosnacek <omosnacek@gmail.com>");
-MODULE_DESCRIPTION("AEGIS-128 AEAD algorithm");
-MODULE_ALIAS_CRYPTO("aegis128");
-MODULE_ALIAS_CRYPTO("aegis128-generic");
-MODULE_ALIAS_CRYPTO("aegis128-simd");
diff --git a/crypto/aegis128-neon-inner.c b/crypto/aegis128-neon-inner.c
deleted file mode 100644
index 56b534eeb680..000000000000
--- a/crypto/aegis128-neon-inner.c
+++ /dev/null
@@ -1,343 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2019 Linaro, Ltd. <ard.biesheuvel@linaro.org>
- */
-
-#include <asm/neon-intrinsics.h>
-
-#ifdef CONFIG_ARM64
-#define AES_ROUND "aese %0.16b, %1.16b \n\t aesmc %0.16b, %0.16b"
-#else
-#define AES_ROUND "aese.8 %q0, %q1 \n\t aesmc.8 %q0, %q0"
-#endif
-
-#define AEGIS_BLOCK_SIZE 16
-
-#include <stddef.h>
-#include "aegis-neon.h"
-
-extern int aegis128_have_aes_insn;
-
-void *memcpy(void *dest, const void *src, size_t n);
-
-struct aegis128_state {
- uint8x16_t v[5];
-};
-
-extern const uint8_t crypto_aes_sbox[];
-
-static struct aegis128_state aegis128_load_state_neon(const void *state)
-{
- return (struct aegis128_state){ {
- vld1q_u8(state),
- vld1q_u8(state + 16),
- vld1q_u8(state + 32),
- vld1q_u8(state + 48),
- vld1q_u8(state + 64)
- } };
-}
-
-static void aegis128_save_state_neon(struct aegis128_state st, void *state)
-{
- vst1q_u8(state, st.v[0]);
- vst1q_u8(state + 16, st.v[1]);
- vst1q_u8(state + 32, st.v[2]);
- vst1q_u8(state + 48, st.v[3]);
- vst1q_u8(state + 64, st.v[4]);
-}
-
-static inline __attribute__((always_inline))
-uint8x16_t aegis_aes_round(uint8x16_t w)
-{
- uint8x16_t z = {};
-
-#ifdef CONFIG_ARM64
- if (!__builtin_expect(aegis128_have_aes_insn, 1)) {
- static const uint8_t shift_rows[] = {
- 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3,
- 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb,
- };
- static const uint8_t ror32by8[] = {
- 0x1, 0x2, 0x3, 0x0, 0x5, 0x6, 0x7, 0x4,
- 0x9, 0xa, 0xb, 0x8, 0xd, 0xe, 0xf, 0xc,
- };
- uint8x16_t v;
-
- // shift rows
- w = vqtbl1q_u8(w, vld1q_u8(shift_rows));
-
- // sub bytes
-#ifndef CONFIG_CC_IS_GCC
- v = vqtbl4q_u8(vld1q_u8_x4(crypto_aes_sbox), w);
- v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0x40), w - 0x40);
- v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0x80), w - 0x80);
- v = vqtbx4q_u8(v, vld1q_u8_x4(crypto_aes_sbox + 0xc0), w - 0xc0);
-#else
- asm("tbl %0.16b, {v16.16b-v19.16b}, %1.16b" : "=w"(v) : "w"(w));
- w -= 0x40;
- asm("tbx %0.16b, {v20.16b-v23.16b}, %1.16b" : "+w"(v) : "w"(w));
- w -= 0x40;
- asm("tbx %0.16b, {v24.16b-v27.16b}, %1.16b" : "+w"(v) : "w"(w));
- w -= 0x40;
- asm("tbx %0.16b, {v28.16b-v31.16b}, %1.16b" : "+w"(v) : "w"(w));
-#endif
-
- // mix columns
- w = (v << 1) ^ (uint8x16_t)(((int8x16_t)v >> 7) & 0x1b);
- w ^= (uint8x16_t)vrev32q_u16((uint16x8_t)v);
- w ^= vqtbl1q_u8(v ^ w, vld1q_u8(ror32by8));
-
- return w;
- }
-#endif
-
- /*
- * We use inline asm here instead of the vaeseq_u8/vaesmcq_u8 intrinsics
- * to force the compiler to issue the aese/aesmc instructions in pairs.
- * This is much faster on many cores, where the instruction pair can
- * execute in a single cycle.
- */
- asm(AES_ROUND : "+w"(w) : "w"(z));
- return w;
-}
-
-static inline __attribute__((always_inline))
-struct aegis128_state aegis128_update_neon(struct aegis128_state st,
- uint8x16_t m)
-{
- m ^= aegis_aes_round(st.v[4]);
- st.v[4] ^= aegis_aes_round(st.v[3]);
- st.v[3] ^= aegis_aes_round(st.v[2]);
- st.v[2] ^= aegis_aes_round(st.v[1]);
- st.v[1] ^= aegis_aes_round(st.v[0]);
- st.v[0] ^= m;
-
- return st;
-}
-
-static inline __attribute__((always_inline))
-void preload_sbox(void)
-{
- if (!IS_ENABLED(CONFIG_ARM64) ||
- !IS_ENABLED(CONFIG_CC_IS_GCC) ||
- __builtin_expect(aegis128_have_aes_insn, 1))
- return;
-
- asm("ld1 {v16.16b-v19.16b}, [%0], #64 \n\t"
- "ld1 {v20.16b-v23.16b}, [%0], #64 \n\t"
- "ld1 {v24.16b-v27.16b}, [%0], #64 \n\t"
- "ld1 {v28.16b-v31.16b}, [%0] \n\t"
- :: "r"(crypto_aes_sbox));
-}
-
-void crypto_aegis128_init_neon(void *state, const void *key, const void *iv)
-{
- static const uint8_t const0[] = {
- 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d,
- 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62,
- };
- static const uint8_t const1[] = {
- 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1,
- 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd,
- };
- uint8x16_t k = vld1q_u8(key);
- uint8x16_t kiv = k ^ vld1q_u8(iv);
- struct aegis128_state st = {{
- kiv,
- vld1q_u8(const1),
- vld1q_u8(const0),
- k ^ vld1q_u8(const0),
- k ^ vld1q_u8(const1),
- }};
- int i;
-
- preload_sbox();
-
- for (i = 0; i < 5; i++) {
- st = aegis128_update_neon(st, k);
- st = aegis128_update_neon(st, kiv);
- }
- aegis128_save_state_neon(st, state);
-}
-
-void crypto_aegis128_update_neon(void *state, const void *msg)
-{
- struct aegis128_state st = aegis128_load_state_neon(state);
-
- preload_sbox();
-
- st = aegis128_update_neon(st, vld1q_u8(msg));
-
- aegis128_save_state_neon(st, state);
-}
-
-#ifdef CONFIG_ARM
-/*
- * AArch32 does not provide these intrinsics natively because it does not
- * implement the underlying instructions. AArch32 only provides 64-bit
- * wide vtbl.8/vtbx.8 instruction, so use those instead.
- */
-static uint8x16_t vqtbl1q_u8(uint8x16_t a, uint8x16_t b)
-{
- union {
- uint8x16_t val;
- uint8x8x2_t pair;
- } __a = { a };
-
- return vcombine_u8(vtbl2_u8(__a.pair, vget_low_u8(b)),
- vtbl2_u8(__a.pair, vget_high_u8(b)));
-}
-
-static uint8x16_t vqtbx1q_u8(uint8x16_t v, uint8x16_t a, uint8x16_t b)
-{
- union {
- uint8x16_t val;
- uint8x8x2_t pair;
- } __a = { a };
-
- return vcombine_u8(vtbx2_u8(vget_low_u8(v), __a.pair, vget_low_u8(b)),
- vtbx2_u8(vget_high_u8(v), __a.pair, vget_high_u8(b)));
-}
-
-static int8_t vminvq_s8(int8x16_t v)
-{
- int8x8_t s = vpmin_s8(vget_low_s8(v), vget_high_s8(v));
-
- s = vpmin_s8(s, s);
- s = vpmin_s8(s, s);
- s = vpmin_s8(s, s);
-
- return vget_lane_s8(s, 0);
-}
-#endif
-
-static const uint8_t permute[] __aligned(64) = {
- -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
- 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
- -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-};
-
-void crypto_aegis128_encrypt_chunk_neon(void *state, void *dst, const void *src,
- unsigned int size)
-{
- struct aegis128_state st = aegis128_load_state_neon(state);
- const int short_input = size < AEGIS_BLOCK_SIZE;
- uint8x16_t msg;
-
- preload_sbox();
-
- while (size >= AEGIS_BLOCK_SIZE) {
- uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
-
- msg = vld1q_u8(src);
- st = aegis128_update_neon(st, msg);
- msg ^= s;
- vst1q_u8(dst, msg);
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
-
- if (size > 0) {
- uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
- uint8_t buf[AEGIS_BLOCK_SIZE];
- const void *in = src;
- void *out = dst;
- uint8x16_t m;
-
- if (__builtin_expect(short_input, 0))
- in = out = memcpy(buf + AEGIS_BLOCK_SIZE - size, src, size);
-
- m = vqtbl1q_u8(vld1q_u8(in + size - AEGIS_BLOCK_SIZE),
- vld1q_u8(permute + 32 - size));
-
- st = aegis128_update_neon(st, m);
-
- vst1q_u8(out + size - AEGIS_BLOCK_SIZE,
- vqtbl1q_u8(m ^ s, vld1q_u8(permute + size)));
-
- if (__builtin_expect(short_input, 0))
- memcpy(dst, out, size);
- else
- vst1q_u8(out - AEGIS_BLOCK_SIZE, msg);
- }
-
- aegis128_save_state_neon(st, state);
-}
-
-void crypto_aegis128_decrypt_chunk_neon(void *state, void *dst, const void *src,
- unsigned int size)
-{
- struct aegis128_state st = aegis128_load_state_neon(state);
- const int short_input = size < AEGIS_BLOCK_SIZE;
- uint8x16_t msg;
-
- preload_sbox();
-
- while (size >= AEGIS_BLOCK_SIZE) {
- msg = vld1q_u8(src) ^ st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
- st = aegis128_update_neon(st, msg);
- vst1q_u8(dst, msg);
-
- size -= AEGIS_BLOCK_SIZE;
- src += AEGIS_BLOCK_SIZE;
- dst += AEGIS_BLOCK_SIZE;
- }
-
- if (size > 0) {
- uint8x16_t s = st.v[1] ^ (st.v[2] & st.v[3]) ^ st.v[4];
- uint8_t buf[AEGIS_BLOCK_SIZE];
- const void *in = src;
- void *out = dst;
- uint8x16_t m;
-
- if (__builtin_expect(short_input, 0))
- in = out = memcpy(buf + AEGIS_BLOCK_SIZE - size, src, size);
-
- m = s ^ vqtbx1q_u8(s, vld1q_u8(in + size - AEGIS_BLOCK_SIZE),
- vld1q_u8(permute + 32 - size));
-
- st = aegis128_update_neon(st, m);
-
- vst1q_u8(out + size - AEGIS_BLOCK_SIZE,
- vqtbl1q_u8(m, vld1q_u8(permute + size)));
-
- if (__builtin_expect(short_input, 0))
- memcpy(dst, out, size);
- else
- vst1q_u8(out - AEGIS_BLOCK_SIZE, msg);
- }
-
- aegis128_save_state_neon(st, state);
-}
-
-int crypto_aegis128_final_neon(void *state, void *tag_xor,
- unsigned int assoclen,
- unsigned int cryptlen,
- unsigned int authsize)
-{
- struct aegis128_state st = aegis128_load_state_neon(state);
- uint8x16_t v;
- int i;
-
- preload_sbox();
-
- v = st.v[3] ^ (uint8x16_t)vcombine_u64(vmov_n_u64(8ULL * assoclen),
- vmov_n_u64(8ULL * cryptlen));
-
- for (i = 0; i < 7; i++)
- st = aegis128_update_neon(st, v);
-
- v = st.v[0] ^ st.v[1] ^ st.v[2] ^ st.v[3] ^ st.v[4];
-
- if (authsize > 0) {
- v = vqtbl1q_u8(~vceqq_u8(v, vld1q_u8(tag_xor)),
- vld1q_u8(permute + authsize));
-
- return vminvq_s8((int8x16_t)v);
- }
-
- vst1q_u8(tag_xor, v);
- return 0;
-}
diff --git a/crypto/aegis128-neon.c b/crypto/aegis128-neon.c
deleted file mode 100644
index b41807e63bd3..000000000000
--- a/crypto/aegis128-neon.c
+++ /dev/null
@@ -1,60 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2019 Linaro Ltd <ard.biesheuvel@linaro.org>
- */
-
-#include <asm/cpufeature.h>
-#include <asm/simd.h>
-
-#include "aegis.h"
-#include "aegis-neon.h"
-
-int aegis128_have_aes_insn __ro_after_init;
-
-bool crypto_aegis128_have_simd(void)
-{
- if (cpu_have_feature(cpu_feature(AES))) {
- aegis128_have_aes_insn = 1;
- return true;
- }
- return IS_ENABLED(CONFIG_ARM64);
-}
-
-void crypto_aegis128_init_simd(struct aegis_state *state,
- const union aegis_block *key,
- const u8 *iv)
-{
- scoped_ksimd()
- crypto_aegis128_init_neon(state, key, iv);
-}
-
-void crypto_aegis128_update_simd(struct aegis_state *state, const void *msg)
-{
- scoped_ksimd()
- crypto_aegis128_update_neon(state, msg);
-}
-
-void crypto_aegis128_encrypt_chunk_simd(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size)
-{
- scoped_ksimd()
- crypto_aegis128_encrypt_chunk_neon(state, dst, src, size);
-}
-
-void crypto_aegis128_decrypt_chunk_simd(struct aegis_state *state, u8 *dst,
- const u8 *src, unsigned int size)
-{
- scoped_ksimd()
- crypto_aegis128_decrypt_chunk_neon(state, dst, src, size);
-}
-
-int crypto_aegis128_final_simd(struct aegis_state *state,
- union aegis_block *tag_xor,
- unsigned int assoclen,
- unsigned int cryptlen,
- unsigned int authsize)
-{
- scoped_ksimd()
- return crypto_aegis128_final_neon(state, tag_xor, assoclen,
- cryptlen, authsize);
-}
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index e6834bdde9b9..7820fe01cd3a 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -2138,13 +2138,6 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
speed_template_16_24_32);
break;
- case 221:
- test_aead_speed("aegis128", ENCRYPT, sec,
- NULL, 0, 16, 8, speed_template_16);
- test_aead_speed("aegis128", DECRYPT, sec,
- NULL, 0, 16, 8, speed_template_16);
- break;
-
case 222:
test_aead_speed("gcm(sm4)", ENCRYPT, sec,
NULL, 0, 16, 8, speed_template_16);
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 9419d61d0602..ce6f3171626c 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4062,12 +4062,6 @@ static const struct alg_test_desc alg_test_descs[] = {
.suite = {
.cipher = __VECS(adiantum_xchacha20_aes_tv_template)
},
- }, {
- .alg = "aegis128",
- .test = alg_test_aead,
- .suite = {
- .aead = __VECS(aegis128_tv_template)
- }
}, {
.alg = "authenc(hmac(md5),cbc(aes))",
.generic_driver = "authenc(hmac-md5-lib,cbc(aes-lib))",
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index 0ee15a8fae27..40aa7a2f044b 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -23311,450 +23311,6 @@ static const struct aead_testvec rfc7539esp_tv_template[] = {
},
};
-/*
- * AEGIS-128 test vectors - generated via reference implementation from
- * SUPERCOP (https://bench.cr.yp.to/supercop.html):
- *
- * https://bench.cr.yp.to/supercop/supercop-20170228.tar.xz
- * (see crypto_aead/aegis128/)
- */
-static const struct aead_testvec aegis128_tv_template[] = {
- {
- .key = "\x0f\xc9\x8e\x67\x44\x9e\xaa\x86"
- "\x20\x36\x2c\x24\xfe\xc9\x30\x81",
- .klen = 16,
- .iv = "\x1e\x92\x1c\xcf\x88\x3d\x54\x0d"
- "\x40\x6d\x59\x48\xfc\x92\x61\x03",
- .assoc = "",
- .alen = 0,
- .ptext = "",
- .plen = 0,
- .ctext = "\x07\xa5\x11\xf2\x9d\x40\xb8\x6d"
- "\xda\xb8\x12\x34\x4c\x53\xd9\x72",
- .clen = 16,
- }, {
- .key = "\x4b\xed\xc8\x07\x54\x1a\x52\xa2"
- "\xa1\x10\xde\xb5\xf8\xed\xf3\x87",
- .klen = 16,
- .iv = "\x5a\xb7\x56\x6e\x98\xb9\xfd\x29"
- "\xc1\x47\x0b\xda\xf6\xb6\x23\x09",
- .assoc = "",
- .alen = 0,
- .ptext = "\x79",
- .plen = 1,
- .ctext = "\x9e\x78\x52\xae\xcb\x9e\xe4\xd3"
- "\x9a\xd7\x5d\xd7\xaa\x9a\xe9\x5a"
- "\xcc",
- .clen = 17,
- }, {
- .key = "\x88\x12\x01\xa6\x64\x96\xfb\xbe"
- "\x22\xea\x90\x47\xf2\x11\xb5\x8e",
- .klen = 16,
- .iv = "\x97\xdb\x90\x0e\xa8\x35\xa5\x45"
- "\x42\x21\xbd\x6b\xf0\xda\xe6\x0f",
- .assoc = "",
- .alen = 0,
- .ptext = "\xb5\x6e\xad\xdd\x30\x72\xfa\x53"
- "\x82\x8e\x16\xb4\xed\x6d\x47",
- .plen = 15,
- .ctext = "\xc3\x80\x83\x04\x5f\xaa\x61\xc7"
- "\xca\xdd\x6f\xac\x85\x08\xb5\x35"
- "\x2b\xc2\x3e\x0b\x1b\x39\x37\x2b"
- "\x7a\x21\x16\xb3\xe6\x67\x66",
- .clen = 31,
- }, {
- .key = "\xc4\x37\x3b\x45\x74\x11\xa4\xda"
- "\xa2\xc5\x42\xd8\xec\x36\x78\x94",
- .klen = 16,
- .iv = "\xd3\x00\xc9\xad\xb8\xb0\x4e\x61"
- "\xc3\xfb\x6f\xfd\xea\xff\xa9\x15",
- .assoc = "",
- .alen = 0,
- .ptext = "\xf2\x92\xe6\x7d\x40\xee\xa3\x6f"
- "\x03\x68\xc8\x45\xe7\x91\x0a\x18",
- .plen = 16,
- .ctext = "\x23\x25\x30\xe5\x6a\xb6\x36\x7d"
- "\x38\xfd\x3a\xd2\xc2\x58\xa9\x11"
- "\x1e\xa8\x30\x9c\x16\xa4\xdb\x65"
- "\x51\x10\x16\x27\x70\x9b\x64\x29",
- .clen = 32,
- }, {
- .key = "\x01\x5c\x75\xe5\x84\x8d\x4d\xf6"
- "\x23\x9f\xf4\x6a\xe6\x5a\x3b\x9a",
- .klen = 16,
- .iv = "\x10\x25\x03\x4c\xc8\x2c\xf7\x7d"
- "\x44\xd5\x21\x8e\xe4\x23\x6b\x1c",
- .assoc = "",
- .alen = 0,
- .ptext = "\x2e\xb7\x20\x1c\x50\x6a\x4b\x8b"
- "\x84\x42\x7a\xd7\xe1\xb5\xcd\x1f"
- "\xd3",
- .plen = 17,
- .ctext = "\x2a\x8d\x56\x91\xc6\xf3\x56\xa5"
- "\x1f\xf0\x89\x2e\x13\xad\xe6\xf6"
- "\x46\x80\xb1\x0e\x18\x30\x40\x97"
- "\x03\xdf\x64\x3c\xbe\x93\x9e\xc9"
- "\x3b",
- .clen = 33,
- }, {
- .key = "\x3d\x80\xae\x84\x94\x09\xf6\x12"
- "\xa4\x79\xa6\xfb\xe0\x7f\xfd\xa0",
- .klen = 16,
- .iv = "\x4c\x49\x3d\xec\xd8\xa8\xa0\x98"
- "\xc5\xb0\xd3\x1f\xde\x48\x2e\x22",
- .assoc = "",
- .alen = 0,
- .ptext = "\x6b\xdc\x5a\xbb\x60\xe5\xf4\xa6"
- "\x05\x1d\x2c\x68\xdb\xda\x8f\x25"
- "\xfe\x8d\x45\x19\x1e\xc0\x0b\x99"
- "\x88\x11\x39\x12\x1c\x3a\xbb",
- .plen = 31,
- .ctext = "\x4e\xf6\xfa\x13\xde\x43\x63\x4c"
- "\xe2\x04\x3e\xe4\x85\x14\xb6\x3f"
- "\xb1\x8f\x4c\xdb\x41\xa2\x14\x99"
- "\xf5\x53\x0f\x73\x86\x7e\x97\xa1"
- "\x4b\x56\x5b\x94\xce\xcd\x74\xcd"
- "\x75\xc4\x53\x01\x89\x45\x59",
- .clen = 47,
- }, {
- .key = "\x7a\xa5\xe8\x23\xa4\x84\x9e\x2d"
- "\x25\x53\x58\x8c\xda\xa3\xc0\xa6",
- .klen = 16,
- .iv = "\x89\x6e\x77\x8b\xe8\x23\x49\xb4"
- "\x45\x8a\x85\xb1\xd8\x6c\xf1\x28",
- .assoc = "",
- .alen = 0,
- .ptext = "\xa7\x00\x93\x5b\x70\x61\x9d\xc2"
- "\x86\xf7\xde\xfa\xd5\xfe\x52\x2b"
- "\x28\x50\x51\x9d\x24\x60\x8d\xb3"
- "\x49\x3e\x17\xea\xf6\x99\x5a\xdd",
- .plen = 32,
- .ctext = "\xa4\x9a\xb7\xfd\xa0\xd4\xd6\x47"
- "\x95\xf4\x58\x38\x14\x83\x27\x01"
- "\x4c\xed\x32\x2c\xf7\xd6\x31\xf7"
- "\x38\x1b\x2c\xc9\xb6\x31\xce\xaa"
- "\xa5\x3c\x1a\x18\x5c\xce\xb9\xdf"
- "\x51\x52\x77\xf2\x5e\x85\x80\x41",
- .clen = 48,
- }, {
- .key = "\xb6\xca\x22\xc3\xb4\x00\x47\x49"
- "\xa6\x2d\x0a\x1e\xd4\xc7\x83\xad",
- .klen = 16,
- .iv = "\xc5\x93\xb0\x2a\xf8\x9f\xf1\xd0"
- "\xc6\x64\x37\x42\xd2\x90\xb3\x2e",
- .assoc = "\xd5",
- .alen = 1,
- .ptext = "",
- .plen = 0,
- .ctext = "\xfb\xd4\x83\x71\x9e\x63\xad\x60"
- "\xb9\xf9\xeb\x34\x52\x49\xcf\xb7",
- .clen = 16,
- }, {
- .key = "\xf3\xee\x5c\x62\xc4\x7c\xf0\x65"
- "\x27\x08\xbd\xaf\xce\xec\x45\xb3",
- .klen = 16,
- .iv = "\x02\xb8\xea\xca\x09\x1b\x9a\xec"
- "\x47\x3e\xe9\xd4\xcc\xb5\x76\x34",
- .assoc = "\x11\x81\x78\x32\x4d\xb9\x44\x73"
- "\x68\x75\x16\xf8\xcb\x7e\xa7",
- .alen = 15,
- .ptext = "",
- .plen = 0,
- .ctext = "\x0c\xaf\x2e\x96\xf6\x97\x08\x71"
- "\x7d\x3a\x84\xc4\x44\x57\x77\x7e",
- .clen = 16,
- }, {
- .key = "\x2f\x13\x95\x01\xd5\xf7\x99\x81"
- "\xa8\xe2\x6f\x41\xc8\x10\x08\xb9",
- .klen = 16,
- .iv = "\x3f\xdc\x24\x69\x19\x96\x43\x08"
- "\xc8\x18\x9b\x65\xc6\xd9\x39\x3b",
- .assoc = "\x4e\xa5\xb2\xd1\x5d\x35\xed\x8f"
- "\xe8\x4f\xc8\x89\xc5\xa2\x69\xbc",
- .alen = 16,
- .ptext = "",
- .plen = 0,
- .ctext = "\xc7\x87\x09\x3b\xc7\x19\x74\x22"
- "\x22\xa5\x67\x10\xb2\x36\xb3\x45",
- .clen = 16,
- }, {
- .key = "\x6c\x38\xcf\xa1\xe5\x73\x41\x9d"
- "\x29\xbc\x21\xd2\xc2\x35\xcb\xbf",
- .klen = 16,
- .iv = "\x7b\x01\x5d\x08\x29\x12\xec\x24"
- "\x49\xf3\x4d\xf7\xc0\xfe\xfb\x41",
- .assoc = "\x8a\xca\xec\x70\x6d\xb1\x96\xab"
- "\x69\x29\x7a\x1b\xbf\xc7\x2c\xc2"
- "\x07",
- .alen = 17,
- .ptext = "",
- .plen = 0,
- .ctext = "\x02\xc6\x3b\x46\x65\xb2\xef\x91"
- "\x31\xf0\x45\x48\x8a\x2a\xed\xe4",
- .clen = 16,
- }, {
- .key = "\xa8\x5c\x09\x40\xf5\xef\xea\xb8"
- "\xaa\x96\xd3\x64\xbc\x59\x8d\xc6",
- .klen = 16,
- .iv = "\xb8\x26\x97\xa8\x39\x8e\x94\x3f"
- "\xca\xcd\xff\x88\xba\x22\xbe\x47",
- .assoc = "\xc7\xef\x26\x10\x7d\x2c\x3f\xc6"
- "\xea\x03\x2c\xac\xb9\xeb\xef\xc9"
- "\x31\x6b\x08\x12\xfc\xd8\x37\x2d"
- "\xe0\x17\x3a\x2e\x83\x5c\x8f",
- .alen = 31,
- .ptext = "",
- .plen = 0,
- .ctext = "\x20\x85\xa8\xd0\x91\x48\x85\xf3"
- "\x5a\x16\xc0\x57\x68\x47\xdd\xcb",
- .clen = 16,
- }, {
- .key = "\xe5\x81\x42\xdf\x05\x6a\x93\xd4"
- "\x2b\x70\x85\xf5\xb6\x7d\x50\xcc",
- .klen = 16,
- .iv = "\xf4\x4a\xd1\x47\x49\x09\x3d\x5b"
- "\x4b\xa7\xb1\x19\xb4\x46\x81\x4d",
- .assoc = "\x03\x14\x5f\xaf\x8d\xa8\xe7\xe2"
- "\x6b\xde\xde\x3e\xb3\x10\xb1\xcf"
- "\x5c\x2d\x14\x96\x01\x78\xb9\x47"
- "\xa1\x44\x19\x06\x5d\xbb\x2e\x2f",
- .alen = 32,
- .ptext = "",
- .plen = 0,
- .ctext = "\x6a\xf8\x8d\x9c\x42\x75\x35\x79"
- "\xc1\x96\xbd\x31\x6e\x69\x1b\x50",
- .clen = 16,
- }, {
- .key = "\x22\xa6\x7c\x7f\x15\xe6\x3c\xf0"
- "\xac\x4b\x37\x86\xb0\xa2\x13\xd2",
- .klen = 16,
- .iv = "\x31\x6f\x0b\xe6\x59\x85\xe6\x77"
- "\xcc\x81\x63\xab\xae\x6b\x43\x54",
- .assoc = "\x40",
- .alen = 1,
- .ptext = "\x4f",
- .plen = 1,
- .ctext = "\x01\x24\xb1\xba\xf6\xd3\xdf\x83"
- "\x70\x45\xe3\x2a\x9d\x5c\x63\x98"
- "\x39",
- .clen = 17,
- }, {
- .key = "\x5e\xcb\xb6\x1e\x25\x62\xe4\x0c"
- "\x2d\x25\xe9\x18\xaa\xc6\xd5\xd8",
- .klen = 16,
- .iv = "\x6d\x94\x44\x86\x69\x00\x8f\x93"
- "\x4d\x5b\x15\x3c\xa8\x8f\x06\x5a",
- .assoc = "\x7c\x5d\xd3\xee\xad\x9f\x39\x1a"
- "\x6d\x92\x42\x61\xa7\x58\x37",
- .alen = 15,
- .ptext = "\x8b\x26\x61\x55\xf1\x3e\xe3\xa1"
- "\x8d\xc8\x6e\x85\xa5\x21\x67",
- .plen = 15,
- .ctext = "\x18\x78\xc2\x6e\xe1\xf7\xe6\x8a"
- "\xca\x0e\x62\x00\xa8\x21\xb5\x21"
- "\x3d\x36\xdb\xf7\xcc\x31\x94\x9c"
- "\x98\xbd\x71\x7a\xef\xa4\xfa",
- .clen = 31,
- }, {
- .key = "\x9b\xef\xf0\xbd\x35\xdd\x8d\x28"
- "\xad\xff\x9b\xa9\xa4\xeb\x98\xdf",
- .klen = 16,
- .iv = "\xaa\xb8\x7e\x25\x79\x7c\x37\xaf"
- "\xce\x36\xc7\xce\xa2\xb4\xc9\x60",
- .assoc = "\xb9\x82\x0c\x8d\xbd\x1b\xe2\x36"
- "\xee\x6c\xf4\xf2\xa1\x7d\xf9\xe2",
- .alen = 16,
- .ptext = "\xc8\x4b\x9b\xf5\x01\xba\x8c\xbd"
- "\x0e\xa3\x21\x16\x9f\x46\x2a\x63",
- .plen = 16,
- .ctext = "\xea\xd1\x81\x75\xb4\x13\x1d\x86"
- "\xd4\x17\x26\xe5\xd6\x89\x39\x04"
- "\xa9\x6c\xca\xac\x40\x73\xb2\x4c"
- "\x9c\xb9\x0e\x79\x4c\x40\x65\xc6",
- .clen = 32,
- }, {
- .key = "\xd7\x14\x29\x5d\x45\x59\x36\x44"
- "\x2e\xd9\x4d\x3b\x9e\x0f\x5b\xe5",
- .klen = 16,
- .iv = "\xe6\xdd\xb8\xc4\x89\xf8\xe0\xca"
- "\x4f\x10\x7a\x5f\x9c\xd8\x8b\x66",
- .assoc = "\xf5\xa6\x46\x2c\xce\x97\x8a\x51"
- "\x6f\x46\xa6\x83\x9b\xa1\xbc\xe8"
- "\x05",
- .alen = 17,
- .ptext = "\x05\x70\xd5\x94\x12\x36\x35\xd8"
- "\x8f\x7d\xd3\xa8\x99\x6a\xed\x69"
- "\xd0",
- .plen = 17,
- .ctext = "\xf4\xb2\x84\xd1\x81\xfa\x98\x1c"
- "\x38\x2d\x69\x90\x1c\x71\x38\x98"
- "\x9f\xe1\x19\x3b\x63\x91\xaf\x6e"
- "\x4b\x07\x2c\xac\x53\xc5\xd5\xfe"
- "\x93",
- .clen = 33,
- }, {
- .key = "\x14\x39\x63\xfc\x56\xd5\xdf\x5f"
- "\xaf\xb3\xff\xcc\x98\x33\x1d\xeb",
- .klen = 16,
- .iv = "\x23\x02\xf1\x64\x9a\x73\x89\xe6"
- "\xd0\xea\x2c\xf1\x96\xfc\x4e\x6d",
- .assoc = "\x32\xcb\x80\xcc\xde\x12\x33\x6d"
- "\xf0\x20\x58\x15\x95\xc6\x7f\xee"
- "\x2f\xf9\x4e\x2c\x1b\x98\x43\xc7"
- "\x68\x28\x73\x40\x9f\x96\x4a",
- .alen = 31,
- .ptext = "\x41\x94\x0e\x33\x22\xb1\xdd\xf4"
- "\x10\x57\x85\x39\x93\x8f\xaf\x70"
- "\xfa\xa9\xd0\x4d\x5c\x40\x23\xcd"
- "\x98\x34\xab\x37\x56\xae\x32",
- .plen = 31,
- .ctext = "\xa0\xe7\x0a\x60\xe7\xb8\x8a\xdb"
- "\x94\xd3\x93\xf2\x41\x86\x16\xdd"
- "\x4c\xe8\xe7\xe0\x62\x48\x89\x40"
- "\xc0\x49\x9b\x63\x32\xec\x8b\xdb"
- "\xdc\xa6\xea\x2c\xc2\x7f\xf5\x04"
- "\xcb\xe5\x47\xbb\xa7\xd1\x9d",
- .clen = 47,
- }, {
- .key = "\x50\x5d\x9d\x9b\x66\x50\x88\x7b"
- "\x30\x8e\xb1\x5e\x92\x58\xe0\xf1",
- .klen = 16,
- .iv = "\x5f\x27\x2b\x03\xaa\xef\x32\x02"
- "\x50\xc4\xde\x82\x90\x21\x11\x73",
- .assoc = "\x6e\xf0\xba\x6b\xee\x8e\xdc\x89"
- "\x71\xfb\x0a\xa6\x8f\xea\x41\xf4"
- "\x5a\xbb\x59\xb0\x20\x38\xc5\xe0"
- "\x29\x56\x52\x19\x79\xf5\xe9\x37",
- .alen = 32,
- .ptext = "\x7e\xb9\x48\xd3\x32\x2d\x86\x10"
- "\x91\x31\x37\xcb\x8d\xb3\x72\x76"
- "\x24\x6b\xdc\xd1\x61\xe0\xa5\xe7"
- "\x5a\x61\x8a\x0f\x30\x0d\xd1\xec",
- .plen = 32,
- .ctext = "\x62\xdc\x2d\x68\x2d\x71\xbb\x33"
- "\x13\xdf\xc0\x46\xf6\x61\x94\xa7"
- "\x60\xd3\xd4\xca\xd9\xbe\x82\xf3"
- "\xf1\x5b\xa0\xfa\x15\xba\xda\xea"
- "\x87\x68\x47\x08\x5d\xdd\x83\xb0"
- "\x60\xf4\x93\x20\xdf\x34\x8f\xea",
- .clen = 48,
- }, {
- .key = "\x8d\x82\xd6\x3b\x76\xcc\x30\x97"
- "\xb1\x68\x63\xef\x8c\x7c\xa3\xf7",
- .klen = 16,
- .iv = "\x9c\x4b\x65\xa2\xba\x6b\xdb\x1e"
- "\xd1\x9e\x90\x13\x8a\x45\xd3\x79",
- .assoc = "\xab\x14\xf3\x0a\xfe\x0a\x85\xa5"
- "\xf2\xd5\xbc\x38\x89\x0e\x04\xfb"
- "\x84\x7d\x65\x34\x25\xd8\x47\xfa"
- "\xeb\x83\x31\xf1\x54\x54\x89\x0d"
- "\x9d",
- .alen = 33,
- .ptext = "\xba\xde\x82\x72\x42\xa9\x2f\x2c"
- "\x12\x0b\xe9\x5c\x87\xd7\x35\x7c"
- "\x4f\x2e\xe8\x55\x66\x80\x27\x00"
- "\x1b\x8f\x68\xe7\x0a\x6c\x71\xc3"
- "\x21\x78\x55\x9d\x9c\x65\x7b\xcd"
- "\x0a\x34\x97\xff\x47\x37\xb0\x2a"
- "\x80\x0d\x19\x98\x33\xa9\x7a\xe3"
- "\x2e\x4c\xc6\xf3\x8c\x88\x42\x01"
- "\xbd",
- .plen = 65,
- .ctext = "\x84\xc5\x21\xab\xe1\xeb\xbb\x6d"
- "\xaa\x2a\xaf\xeb\x3b\x3b\x69\xe7"
- "\x2c\x47\xef\x9d\xb7\x53\x36\xb7"
- "\xb6\xf5\xe5\xa8\xc9\x9e\x02\xd7"
- "\x83\x88\xc2\xbd\x2f\xf9\x10\xc0"
- "\xf5\xa1\x6e\xd3\x97\x64\x82\xa3"
- "\xfb\xda\x2c\xb1\x94\xa1\x58\x32"
- "\xe8\xd4\x39\xfc\x9e\x26\xf9\xf1"
- "\x61\xe6\xae\x07\xf2\xe0\xa7\x44"
- "\x96\x28\x3b\xee\x6b\xc6\x16\x31"
- "\x3f",
- .clen = 81,
- }, {
- .key = "\xc9\xa7\x10\xda\x86\x48\xd9\xb3"
- "\x32\x42\x15\x80\x85\xa1\x65\xfe",
- .klen = 16,
- .iv = "\xd8\x70\x9f\x42\xca\xe6\x83\x3a"
- "\x52\x79\x42\xa5\x84\x6a\x96\x7f",
- .assoc = "\xe8\x39\x2d\xaa\x0e\x85\x2d\xc1"
- "\x72\xaf\x6e\xc9\x82\x33\xc7\x01"
- "\xaf\x40\x70\xb8\x2a\x78\xc9\x14"
- "\xac\xb1\x10\xca\x2e\xb3\x28\xe4"
- "\xac\xfa\x58\x7f\xe5\x73\x09\x8c"
- "\x1d\x40\x87\x8c\xd9\x75\xc0\x55"
- "\xa2\xda\x07\xd1\xc2\xa9\xd1\xbb"
- "\x09\x4f\x77\x62\x88\x2d\xf2\x68"
- "\x54",
- .alen = 65,
- .ptext = "\xf7\x02\xbb\x11\x52\x24\xd8\x48"
- "\x93\xe6\x9b\xee\x81\xfc\xf7\x82"
- "\x79\xf0\xf3\xd9\x6c\x20\xa9\x1a"
- "\xdc\xbc\x47\xc0\xe4\xcb\x10\x99"
- "\x2f",
- .plen = 33,
- .ctext = "\x8f\x23\x47\xfb\xf2\xac\x23\x83"
- "\x77\x09\xac\x74\xef\xd2\x56\xae"
- "\x20\x7b\x7b\xca\x45\x8e\xc8\xc2"
- "\x50\xbd\xc7\x44\x1c\x54\x98\xd8"
- "\x1f\xd0\x9a\x79\xaa\xf9\xe1\xb3"
- "\xb4\x98\x5a\x9b\xe4\x4d\xbf\x4e"
- "\x39",
- .clen = 49,
- }, {
- .key = "\x06\xcc\x4a\x79\x96\xc3\x82\xcf"
- "\xb3\x1c\xc7\x12\x7f\xc5\x28\x04",
- .klen = 16,
- .iv = "\x15\x95\xd8\xe1\xda\x62\x2c\x56"
- "\xd3\x53\xf4\x36\x7e\x8e\x59\x85",
- .assoc = "\x24\x5e\x67\x49\x1e\x01\xd6\xdd"
- "\xf3\x89\x20\x5b\x7c\x57\x89\x07",
- .alen = 16,
- .ptext = "\x33\x27\xf5\xb1\x62\xa0\x80\x63"
- "\x14\xc0\x4d\x7f\x7b\x20\xba\x89",
- .plen = 16,
- .ctext = "\x42\xc3\x58\xfb\x29\xe2\x4a\x56"
- "\xf1\xf5\xe1\x51\x55\x4b\x0a\x45"
- "\x46\xb5\x8d\xac\xb6\x34\xd8\x8b"
- "\xde\x20\x59\x77\xc1\x74\x90",
- .clen = 31,
- }, {
- .key = "\x42\xf0\x84\x19\xa6\x3f\x2b\xea"
- "\x34\xf6\x79\xa3\x79\xe9\xeb\x0a",
- .klen = 16,
- .iv = "\x51\xb9\x12\x80\xea\xde\xd5\x71"
- "\x54\x2d\xa6\xc8\x78\xb2\x1b\x8c",
- .assoc = "\x61\x83\xa0\xe8\x2e\x7d\x7f\xf8"
- "\x74\x63\xd2\xec\x76\x7c\x4c\x0d",
- .alen = 16,
- .ptext = "\x70\x4c\x2f\x50\x72\x1c\x29\x7f"
- "\x95\x9a\xff\x10\x75\x45\x7d\x8f",
- .plen = 16,
- .ctext = "\xb2\xfb\xf6\x97\x69\x7a\xe9\xec"
- "\xe2\x94\xa1\x8b\xa0\x2b\x60\x72"
- "\x1d\x04\xdd\x6a\xef\x46\x8f\x68"
- "\xe9\xe0\x17\x45\x70\x12",
- .clen = 30,
- }, {
- .key = "\x7f\x15\xbd\xb8\xb6\xba\xd3\x06"
- "\xb5\xd1\x2b\x35\x73\x0e\xad\x10",
- .klen = 16,
- .iv = "\x8e\xde\x4c\x20\xfa\x59\x7e\x8d"
- "\xd5\x07\x58\x59\x72\xd7\xde\x92",
- .assoc = "\x9d\xa7\xda\x88\x3e\xf8\x28\x14"
- "\xf5\x3e\x85\x7d\x70\xa0\x0f\x13",
- .alen = 16,
- .ptext = "\xac\x70\x69\xef\x82\x97\xd2\x9b"
- "\x15\x74\xb1\xa2\x6f\x69\x3f\x95",
- .plen = 16,
- .ctext = "\x47\xda\x54\x42\x51\x72\xc4\x8b"
- "\xf5\x57\x0f\x2f\x49\x0e\x11\x3b"
- "\x78\x93\xec\xfc\xf4\xff\xe1\x2d",
- .clen = 24,
- },
-};
-
static const struct drbg_testvec drbg_nopr_hmac_sha512_tv_template[] = {
/*
* Borrowed from the first applicable test vector from ACVP:
--
2.56.0.567.gdb80ae8cd5-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] crypto: x86 - remove aegis128 support
2026-11-12 16:44 ` [PATCH 1/2] crypto: x86 - " Ard Biesheuvel
@ 2026-11-12 20:23 ` Eric Biggers
0 siblings, 0 replies; 4+ messages in thread
From: Eric Biggers @ 2026-11-12 20:23 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: linux-crypto, herbert, Ard Biesheuvel, Antonio Quartulli,
Ondrej Mosnáček, dm-devel, Milan Broz
On Thu, Nov 12, 2026 at 05:44:17PM +0100, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
>
> Even the people that are invested in Aegis appear to have lost interest
> in aegis128: it did win the CAESAR competition but is no longer covered
> by RFC 10032, which does list some other variants that competed as well.
>
> So let's delete it.
>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
AEGIS-128 might be used by dm-crypt, e.g. if anyone passed
'-c aegis128-random' to cryptsetup. I added dm-devel and Milan Broz to
Cc to comment on the feasibility of removing it.
But clearly AEGIS-128 is a mistake. It has a hardcoded amount of
parallelism that is much too small for current CPUs. That was very
clear when I looked into optimizing it with AVX-512: it just does not
work, and it uses only a quarter of the CPU's resources.
That's resulted in AES-GCM now being much faster, as well as the people
promoting AEGIS having abandoned AEGIS-128 and now advocating entirely
for other variants like AEGIS-128X4 instead (despite that unfortunately
still having a hardcoded amount of parallelism).
AEGIS-128 doesn't fare super well on the nonce front either, with it not
being nonce-misuse-resistant, and its 128-bit nonce being only an
incremental upgrade over AES-GCM's 96-bit nonce. (Compare to
XChaCha20Poly1305's or XAES-256-GCM's 192-bit nonce, or to AES-GCM-SIV
which is nonce-misuse-resistant.)
So yes, this seems to have become yet another odd legacy thing that
doesn't really make sense to use. If anyone does use it, it is likely
mainly because the kernel's existing, already-highly-optimized
XChaCha20Poly1305 code hasn't yet been wired up to dm-crypt, or because
they relied on outdated information about AEGIS-128's performance.
- Eric
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-11-12 20:23 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-12 16:44 [PATCH 0/2] crypto: remove aegis128 support Ard Biesheuvel
2026-11-12 16:44 ` [PATCH 1/2] crypto: x86 - " Ard Biesheuvel
2026-11-12 20:23 ` Eric Biggers
2026-11-12 16:44 ` [PATCH 2/2] crypto: " Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox