Complete list of AF_ALG algorithms used by iwd

Complete list of AF_ALG algorithms used by iwd

[Eric Biggers]

With AF_ALG being on its way out due to its frequent vulnerabilities,
iwd will need to be fixed to follow the standard practice of using
userspace crypto code (for example, libcrypto) instead.  In the mean
time, AF_ALG is at least going to need to be hardened by removing
unnecessary functionality, for example unnecessary algorithms.

Based on the iwd and libell source code, it appears iwd is relying on
the following algorithm names from AF_ALG.  Please confirm that this
list is correct and that these are the ones we need to keep for iwd:

    cmac(aes)
    hmac(md5)
    hmac(sha1)
    hmac(sha224)
    hmac(sha256)
    hmac(sha384)
    hmac(sha512)
    md4
    md5
    sha1
    sha224
    sha256
    sha384
    sha512
    ecb(aes)
    cbc(aes)
    ctr(aes)
    ecb(des)
    cbc(des)
    cbc(des3_ede)

Also, does iwd always hold CAP_NET_ADMIN?  We're also considering adding
a privilege check to AF_ALG.  (It's TBD whether it would be
unconditional or controlled by a sysctl.)

- Eric

Re: Complete list of AF_ALG algorithms used by iwd

[James Prestwood]

Hi Eric,

On 5/3/26 9:50 PM, Eric Biggers wrote:
> With AF_ALG being on its way out due to its frequent vulnerabilities,
> iwd will need to be fixed to follow the standard practice of using
> userspace crypto code (for example, libcrypto) instead.  In the mean
> time, AF_ALG is at least going to need to be hardened by removing
> unnecessary functionality, for example unnecessary algorithms.
>
> Based on the iwd and libell source code, it appears iwd is relying on
> the following algorithm names from AF_ALG.  Please confirm that this
> list is correct and that these are the ones we need to keep for iwd:
>
>      cmac(aes)
>      hmac(md5)
>      hmac(sha1)
>      hmac(sha224)
>      hmac(sha256)
>      hmac(sha384)
>      hmac(sha512)
>      md4
>      md5
>      sha1
>      sha224
>      sha256
>      sha384
>      sha512
>      ecb(aes)
>      cbc(aes)
>      ctr(aes)
>      ecb(des)
>      cbc(des)
>      cbc(des3_ede)

This looks correct from IWD's standpoint, but ELL does support 
additional checksums:

- sha3-224
- sha3-256
- sha3-384
- sha3-512
- hmac(sha3-224)
- hmac(sha3-256)
- hmac(sha3-384)
- hmac(sha3-512)

Marcel may be able to comment on what projects are using these, if any.

>
> Also, does iwd always hold CAP_NET_ADMIN?  We're also considering adding
> a privilege check to AF_ALG.  (It's TBD whether it would be
> unconditional or controlled by a sysctl.)

Yes we require CAP_NET_ADMIN:

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/iwd.service.in#n15


Thanks,

James

>
> - Eric