[PATCH v2 00/13] Library APIs for AES encryption modes

[Eric Biggers <ebiggers@kernel.org>]

This series can also be retrieved from:

    git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git aes-modes-v2

This series adds library APIs for almost all AES encryption modes that
are used in the kernel, both authenticated and unauthenticated: AES-ECB,
AES-CBC, AES-CBC-CTS, AES-CTR, AES-XCTR, AES-XTS, AES-GCM, and AES-CCM.

Patches 2-7 add the library APIs, and patches 8-13 wire them up to the
traditional crypto API (with just priority 110 for now).  I'm planning
to take these through libcrypto-next for 7.3.

Proof-of-concept patches that convert users of the traditional crypto
API to use the new library APIs can be found in patches 14-33 of the v1
series
(https://lore.kernel.org/linux-crypto/20260707053503.209874-1-ebiggers@kernel.org/).
Those additional patches are intended for 7.4 or later.

Apologies for the large patch series, but it ended up being easiest to
handle all the AES modes at once rather than try to do them one by one.
This ensures a consistent design for them, which is really important.
Additionally, the arch-optimized AES code tends to intermingle different
modes, and many depend on each other anyway.

But as a result, to keep this series manageable it doesn't include the
usual KUnit tests or the integration of the architecture-optimized code.
Those will be sent separately in follow-up series.

Changed in v2:
- Reduced the series to just the patches targeting 7.3.
- Made lots of documentation and comment improvements.
- Made CRYPTO_AES select the library kconfig options correctly.
- Adjusted the parameter order of some functions for better consistency:
  aes_ccm_init(), aes_{ccm,gcm}_encrypt(), aes_{ccm,gcm}_decrypt().
- Made the CCM implementation support ad_len up to 2^64 - 1, as per the
  spec, instead of artifically capping it at 2^32.
- Made the CCM implementation check for incorrect call order, making it
  consistent with the GCM implementation.
- Optimized how aes_ccm_init() validates data_len.
- Made the GCM implementation check for the maximum ad_len.
- Made aes_{gcm,ccm}_decrypt_final() return an error code if either of
  the lengths was incorrect, instead of just warning.
- Shared more code between encryption and decryption for GCM and CCM in
  crypto/aes.c.
- Removed unnecessary casts in inc_be128_ctr().
- Avoided memset() with dst == NULL.
- Lots of other small cleanups.

Eric Biggers (13):
  crypto: xts - Split out __xts_verify_key() helper
  lib/crypto: aes: Add ECB support
  lib/crypto: aes: Add CBC and CBC-CTS support
  lib/crypto: aes: Add CTR and XCTR support
  lib/crypto: aes: Add XTS support
  lib/crypto: aes: Add GCM support
  lib/crypto: aes: Add CCM support
  crypto: aes - Add ECB support using library
  crypto: aes - Add CBC and CBC-CTS support using library
  crypto: aes - Add CTR and XCTR support using library
  crypto: aes - Add XTS support using library
  crypto: aes - Add GCM support using library
  crypto: aes - Add CCM support using library

 .../crypto/libcrypto-auth-encryption.rst      |   20 +
 .../crypto/libcrypto-unauth-encryption.rst    |   49 +
 Documentation/crypto/libcrypto.rst            |    2 +
 crypto/Kconfig                                |   11 +
 crypto/aes.c                                  |  892 ++++++++++++-
 include/crypto/aes-cbc.h                      |   77 ++
 include/crypto/aes-ccm.h                      |  266 ++++
 include/crypto/aes-ctr.h                      |   65 +
 include/crypto/aes-ecb.h                      |   49 +
 include/crypto/aes-gcm.h                      |  260 ++++
 include/crypto/aes-xts.h                      |   94 ++
 include/crypto/gcm.h                          |    4 +-
 include/crypto/xts.h                          |   18 +-
 lib/crypto/Kconfig                            |   40 +
 lib/crypto/aes.c                              | 1163 +++++++++++++++++
 lib/crypto/tests/Kconfig                      |    6 +
 16 files changed, 3009 insertions(+), 7 deletions(-)
 create mode 100644 Documentation/crypto/libcrypto-auth-encryption.rst
 create mode 100644 Documentation/crypto/libcrypto-unauth-encryption.rst
 create mode 100644 include/crypto/aes-cbc.h
 create mode 100644 include/crypto/aes-ccm.h
 create mode 100644 include/crypto/aes-ctr.h
 create mode 100644 include/crypto/aes-ecb.h
 create mode 100644 include/crypto/aes-gcm.h
 create mode 100644 include/crypto/aes-xts.h


base-commit: e073f1238ecaea366f53e98724c40b31856da56a
-- 
2.55.0