From patchwork Thu May 5 19:38:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nathan Huckleberry X-Patchwork-Id: 12840083 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCB2DC433EF for ; Thu, 5 May 2022 19:38:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1384958AbiEETmF (ORCPT ); Thu, 5 May 2022 15:42:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240224AbiEETmD (ORCPT ); Thu, 5 May 2022 15:42:03 -0400 Received: from mail-ua1-x94a.google.com (mail-ua1-x94a.google.com [IPv6:2607:f8b0:4864:20::94a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E60EA5D5F0 for ; Thu, 5 May 2022 12:38:22 -0700 (PDT) Received: by mail-ua1-x94a.google.com with SMTP id i4-20020ab04744000000b003520c239119so2261373uac.18 for ; Thu, 05 May 2022 12:38:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=sa3c+Mx0ChGa8+HFu4E6b4MOsKTY2yKe4Ubj9D93/40=; b=fmBbrk7tYEw2OFszTOe4iD3G9f29zs12+FeMKTLuaZXpvCWu0IIdD8UTpR4ldxuq+S fmfJLkCLGwyRLHvgYQx/QxL43uFCQC6PkG2HXkN9tGwzf0IRlPwXSviRT/SMTQeYVD9l eGL4BnRptgz4BUXuigD45L3YUoJUksoxbIM068ifKO59ISaa2ZuJKlOCL7Z/ELuKQfgp wGjF3BO2n6Kbomxd4Yazdv/LqLMgj4UV9WQ+GSZAS8AzkTZ/z+cnyz6ofKQS3Splvufo a8f8yCVAKHyXl6jsYSOsDg6WgrPsY5xv5Kl1qa1/ROTI3+YrFGWo15909ZXsGbt8CAEB VkRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=sa3c+Mx0ChGa8+HFu4E6b4MOsKTY2yKe4Ubj9D93/40=; b=H9yFtYsZGBAHZ64B2W/UrCRCEtt2JHSBrI31XfUptAb6UkbJH5OflcjoJ4a+YoiGLn Sk6G7gN+IsWaGchfdLMgQiJukMRNV8jjtAuW4IeNUTS2TcdHbKeAFKVMrHa17nviKLzR g2Ws7aGaqqAZLJMPypg8x2KjSuN+1aHXoIvzowIv0rTG6K4KKeX2lI52VeZzYQEh+KfH Gry9sfrnH+N1EJebGnITHmbOix/Ggeeu7mgKNpezeof0G9fbTdZ6XkrwlF5EGytC+Bh1 QtQl7gIgsAqH+yZcmsxsTXV2PfuWSp7R44X+/MIUHkEvZtbRiCoAIrYiD0fNup5EwTMR tSMw== X-Gm-Message-State: AOAM531WQMQMwb8cGYo+WOxGIWrVG56NaAr9C4Iq9McV6Dx6eJ1WfnKe JJivlSg1gT2joyWImkgUZMw9iAQQgg6SpLBLYheI/bVj/VwNee/Fv7BdJNbiWUj7uh9Xm1Cw1lE Q1ZzqWVFfeC2xJX0ArIwSsvDVU7F7OGI3heNXJvpxLKZvHmeZi+101wHIFwS9 X-Google-Smtp-Source: ABdhPJwfvXxAZLihi22KiG41uWO8BPKNgZ5RrhxCxOtzlCSELZJT3IyerlIRwqIpYnkezyKqE822RL3j5Q== X-Received: from nhuck.c.googlers.com ([fda3:e722:ac3:cc00:14:4d90:c0a8:39cc]) (user=nhuck job=sendgmr) by 2002:a05:6122:221f:b0:343:f3d4:87cb with SMTP id bb31-20020a056122221f00b00343f3d487cbmr8988000vkb.13.1651779502018; Thu, 05 May 2022 12:38:22 -0700 (PDT) Date: Thu, 5 May 2022 14:38:08 -0500 In-Reply-To: <20220505193809.579026-1-nhuck@google.com> Message-Id: <20220505193809.579026-2-nhuck@google.com> Mime-Version: 1.0 References: <20220505193809.579026-1-nhuck@google.com> X-Mailer: git-send-email 2.36.0.512.ge40c2bad7a-goog Subject: [RFC PATCH v2 1/2] fscrypt-crypt-util: add HCTR2 reference implementation From: Nathan Huckleberry To: fstests@vger.kernel.org Cc: Eric Biggers , Sami Tolvanen , Nathan Huckleberry Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org This patch adds a reference implementation of HCTR2 to the fscrypt testing utility. More information on HCTR2 can be found here: "Length-preserving encryption with HCTR2": https://ia.cr/2021/1441 Signed-off-by: Nathan Huckleberry --- common/encrypt | 2 + src/fscrypt-crypt-util.c | 338 ++++++++++++++++++++++++++++++++------- 2 files changed, 283 insertions(+), 57 deletions(-) diff --git a/common/encrypt b/common/encrypt index f90c4ef0..937bb914 100644 --- a/common/encrypt +++ b/common/encrypt @@ -767,6 +767,7 @@ FSCRYPT_MODE_AES_256_CTS=4 FSCRYPT_MODE_AES_128_CBC=5 FSCRYPT_MODE_AES_128_CTS=6 FSCRYPT_MODE_ADIANTUM=9 +FSCRYPT_MODE_AES_256_HCTR2=10 FSCRYPT_POLICY_FLAG_DIRECT_KEY=0x04 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64=0x08 @@ -785,6 +786,7 @@ _fscrypt_mode_name_to_num() AES-128-CBC-ESSIV) echo $FSCRYPT_MODE_AES_128_CBC ;; AES-128-CTS-CBC) echo $FSCRYPT_MODE_AES_128_CTS ;; Adiantum) echo $FSCRYPT_MODE_ADIANTUM ;; + AES-256-HCTR2) echo $FSCRYPT_MODE_AES_256_HCTR2 ;; *) _fail "Unknown fscrypt mode: $name" ;; esac } diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c index 03cc3c4a..1c1a6474 100644 --- a/src/fscrypt-crypt-util.c +++ b/src/fscrypt-crypt-util.c @@ -37,7 +37,8 @@ /* * Define to enable the tests of the crypto code in this file. If enabled, you * must link this program with OpenSSL (-lcrypto) v1.1.0 or later, and your - * kernel needs CONFIG_CRYPTO_USER_API_SKCIPHER=y and CONFIG_CRYPTO_ADIANTUM=y. + * kernel needs CONFIG_CRYPTO_USER_API_SKCIPHER=y, CONFIG_CRYPTO_ADIANTUM=y, and + * CONFIG_CRYPTO_HCTR2=y. */ #undef ENABLE_ALG_TESTS @@ -54,7 +55,8 @@ static void usage(FILE *fp) "resulting ciphertext (or plaintext) to stdout.\n" "\n" "CIPHER can be AES-256-XTS, AES-256-CTS-CBC, AES-128-CBC-ESSIV, AES-128-CTS-CBC,\n" -"or Adiantum. MASTER_KEY must be a hex string long enough for the cipher.\n" +"Adiantum, or AES-256-HCTR2. MASTER_KEY must be a hex string long enough for\n" +"the cipher.\n" "\n" "WARNING: this program is only meant for testing, not for \"real\" use!\n" "\n" @@ -268,7 +270,59 @@ static void rand_bytes(u8 *buf, size_t count) while (count--) *buf++ = rand(); } -#endif + +#include +#include +#define SOL_ALG 279 +static void af_alg_crypt(int algfd, int op, const u8 *key, size_t keylen, + const u8 *iv, size_t ivlen, + const u8 *src, u8 *dst, size_t datalen) +{ + size_t controllen = CMSG_SPACE(sizeof(int)) + + CMSG_SPACE(sizeof(struct af_alg_iv) + ivlen); + u8 *control = xmalloc(controllen); + struct iovec iov = { .iov_base = (u8 *)src, .iov_len = datalen }; + struct msghdr msg = { + .msg_iov = &iov, + .msg_iovlen = 1, + .msg_control = control, + .msg_controllen = controllen, + }; + struct cmsghdr *cmsg; + struct af_alg_iv *algiv; + int reqfd; + + memset(control, 0, controllen); + + cmsg = CMSG_FIRSTHDR(&msg); + cmsg->cmsg_len = CMSG_LEN(sizeof(int)); + cmsg->cmsg_level = SOL_ALG; + cmsg->cmsg_type = ALG_SET_OP; + *(int *)CMSG_DATA(cmsg) = op; + + cmsg = CMSG_NXTHDR(&msg, cmsg); + cmsg->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + ivlen); + cmsg->cmsg_level = SOL_ALG; + cmsg->cmsg_type = ALG_SET_IV; + algiv = (struct af_alg_iv *)CMSG_DATA(cmsg); + algiv->ivlen = ivlen; + memcpy(algiv->iv, iv, ivlen); + + if (setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, keylen) != 0) + die_errno("can't set key on AF_ALG socket"); + + reqfd = accept(algfd, NULL, NULL); + if (reqfd < 0) + die_errno("can't accept() AF_ALG socket"); + if (sendmsg(reqfd, &msg, 0) != datalen) + die_errno("can't sendmsg() AF_ALG request socket"); + if (xread(reqfd, dst, datalen) != datalen) + die("short read from AF_ALG request socket"); + close(reqfd); + + free(control); +} +#endif /* ENABLE_ALG_TESTS */ /*----------------------------------------------------------------------------* * Finite field arithmetic * @@ -293,7 +347,7 @@ typedef struct { } ble128; /* Multiply a GF(2^128) element by the polynomial 'x' */ -static inline void gf2_128_mul_x(ble128 *t) +static inline void gf2_128_mul_x_ble(ble128 *t) { u64 lo = le64_to_cpu(t->lo); u64 hi = le64_to_cpu(t->hi); @@ -302,6 +356,38 @@ static inline void gf2_128_mul_x(ble128 *t) t->lo = cpu_to_le64((lo << 1) ^ ((hi & (1ULL << 63)) ? 0x87 : 0)); } +static inline void gf2_128_mul_x_polyval(ble128 *t) +{ + u64 lo = le64_to_cpu(t->lo); + u64 hi = le64_to_cpu(t->hi); + + u64 lo_reducer = ((hi >> 63) & 1ULL) ? 1 : 0; + u64 hi_reducer = ((hi >> 63) & 1ULL) ? 0xc2ULL << 56 : 0; + + t->hi = cpu_to_le64(((hi << 1) | (lo >> 63)) ^ hi_reducer); + t->lo = cpu_to_le64((lo << 1) ^ lo_reducer); +} + +void gf2_128_mul_polyval(ble128 *r, const ble128 *b) +{ + ble128 p; + u64 lo = le64_to_cpu(b->lo); + u64 hi = le64_to_cpu(b->hi); + + memset(&p, 0, sizeof(p)); + for (int i = 0; i < 64; i++) { + if (lo & (1ULL << i)) + xor((u8 *)&p, (u8 *)&p, (u8 *)r, sizeof(p)); + gf2_128_mul_x_polyval(r); + } + for (int i = 0; i < 64; i++) { + if (hi & (1ULL << i)) + xor((u8 *)&p, (u8 *)&p, (u8 *)r, sizeof(p)); + gf2_128_mul_x_polyval(r); + } + memcpy(r, &p, sizeof(p)); +} + /*----------------------------------------------------------------------------* * Group arithmetic * *----------------------------------------------------------------------------*/ @@ -901,6 +987,41 @@ static void test_hkdf_sha512(void) } #endif /* ENABLE_ALG_TESTS */ +/*----------------------------------------------------------------------------* + * POLYVAL * + *----------------------------------------------------------------------------*/ + +#define POLYVAL_KEY_SIZE 16 +#define POLYVAL_BLOCK_SIZE 16 + +static void polyval_update(const u8 key[POLYVAL_KEY_SIZE], + const u8 *msg, size_t msglen, + u8 accumulator[POLYVAL_BLOCK_SIZE]) +{ + ble128 h; + // x^{-128} = x^127 + x^124 + x^121 + x^114 + 1 + static const ble128 inv128 = { + cpu_to_le64(1), + cpu_to_le64(0x9204ULL << 48) + }; + int nblocks = msglen / POLYVAL_BLOCK_SIZE; + int tail = msglen % POLYVAL_BLOCK_SIZE; + + memcpy(&h, key, sizeof(h)); + gf2_128_mul_polyval(&h, &inv128); + + while (nblocks > 0) { + xor(accumulator, accumulator, msg, POLYVAL_BLOCK_SIZE); + gf2_128_mul_polyval((ble128 *)accumulator, &h); + msg += POLYVAL_BLOCK_SIZE; + nblocks--; + } + if (tail) { + xor(accumulator, accumulator, msg, tail); + gf2_128_mul_polyval((ble128 *)accumulator, &h); + } +} + /*----------------------------------------------------------------------------* * AES encryption modes * *----------------------------------------------------------------------------*/ @@ -924,7 +1045,7 @@ static void aes_256_xts_crypt(const u8 key[2 * AES_256_KEY_SIZE], else aes_encrypt(&cipher_key, &dst[i], &dst[i]); xor(&dst[i], &dst[i], (const u8 *)&t, AES_BLOCK_SIZE); - gf2_128_mul_x(&t); + gf2_128_mul_x_ble(&t); } } @@ -1173,6 +1294,154 @@ static void aes_128_cts_cbc_decrypt(const u8 key[AES_128_KEY_SIZE], aes_cts_cbc_decrypt(key, AES_128_KEY_SIZE, iv, src, dst, nbytes); } +static void aes_256_xctr_crypt(const u8 key[AES_256_KEY_SIZE], + const u8 iv[AES_BLOCK_SIZE], const u8 *src, + u8 *dst, size_t nbytes) +{ + struct aes_key k; + union { + u8 bytes[AES_BLOCK_SIZE]; + __le64 ctr; + } blk; + size_t i; + + aes_setkey(&k, key, AES_256_KEY_SIZE); + + for (i = 0; i < nbytes; i += AES_BLOCK_SIZE) { + memcpy(blk.bytes, iv, AES_BLOCK_SIZE); + blk.ctr ^= cpu_to_le64((i / AES_BLOCK_SIZE) + 1); + aes_encrypt(&k, blk.bytes, blk.bytes); + xor(&dst[i], blk.bytes, &src[i], MIN(AES_BLOCK_SIZE, nbytes - i)); + } +} + +#define HCTR2_IV_SIZE 32 +static void aes_256_hctr2_crypt(const u8 key[AES_256_KEY_SIZE], + const u8 iv[HCTR2_IV_SIZE], const u8 *src, + u8 *dst, size_t nbytes, bool decrypting) +{ + struct aes_key k; + u8 hbar[AES_BLOCK_SIZE] = {0}; + u8 L[AES_BLOCK_SIZE] = {1}; + size_t bulk_bytes = nbytes - AES_BLOCK_SIZE; + size_t remainder = bulk_bytes % AES_BLOCK_SIZE; + le128 tweaklen_blk = { + .lo = cpu_to_le64(HCTR2_IV_SIZE * 8 * 2 + 2 + (remainder != 0)) + }; + u8 padded_block[POLYVAL_BLOCK_SIZE]; + u8 digest[POLYVAL_BLOCK_SIZE]; + const u8 *M = src; + const u8 *N = src + AES_BLOCK_SIZE; + u8 MM[AES_BLOCK_SIZE]; + u8 UU[AES_BLOCK_SIZE]; + u8 S[AES_BLOCK_SIZE]; + u8 *U = dst; + u8 *V = dst + AES_BLOCK_SIZE; + + ASSERT(nbytes >= AES_BLOCK_SIZE); + aes_setkey(&k, key, AES_256_KEY_SIZE); + + aes_encrypt(&k, hbar, hbar); + aes_encrypt(&k, L, L); + + memset(digest, 0, POLYVAL_BLOCK_SIZE); + polyval_update(hbar, (u8 *)&tweaklen_blk, POLYVAL_BLOCK_SIZE, digest); + polyval_update(hbar, iv, HCTR2_IV_SIZE, digest); + + polyval_update(hbar, N, bulk_bytes - remainder, digest); + if (remainder) { + memset(padded_block, 0, POLYVAL_BLOCK_SIZE); + memcpy(padded_block, N + bulk_bytes - remainder, remainder); + padded_block[remainder] = 0x01; + polyval_update(hbar, padded_block, POLYVAL_BLOCK_SIZE, digest); + } + + xor(MM, M, digest, AES_BLOCK_SIZE); + + if (decrypting) + aes_decrypt(&k, MM, UU); + else + aes_encrypt(&k, MM, UU); + + xor(S, MM, UU, AES_BLOCK_SIZE); + xor(S, L, S, AES_BLOCK_SIZE); + + aes_256_xctr_crypt(key, S, N, V, bulk_bytes); + + memset(digest, 0, POLYVAL_BLOCK_SIZE); + polyval_update(hbar, (u8 *)&tweaklen_blk, POLYVAL_BLOCK_SIZE, digest); + polyval_update(hbar, iv, HCTR2_IV_SIZE, digest); + + polyval_update(hbar, V, bulk_bytes - remainder, digest); + if (remainder) { + memset(padded_block, 0, POLYVAL_BLOCK_SIZE); + memcpy(padded_block, V + bulk_bytes - remainder, remainder); + padded_block[remainder] = 0x01; + polyval_update(hbar, padded_block, POLYVAL_BLOCK_SIZE, digest); + } + + xor(U, UU, digest, AES_BLOCK_SIZE); +} + +static void aes_256_hctr2_encrypt(const u8 key[AES_256_KEY_SIZE], + const u8 iv[HCTR2_IV_SIZE], const u8 *src, + u8 *dst, size_t nbytes) +{ + aes_256_hctr2_crypt(key, iv, src, dst, nbytes, false); +} + +static void aes_256_hctr2_decrypt(const u8 key[AES_256_KEY_SIZE], + const u8 iv[HCTR2_IV_SIZE], const u8 *src, + u8 *dst, size_t nbytes) +{ + aes_256_hctr2_crypt(key, iv, src, dst, nbytes, true); +} + +#ifdef ENABLE_ALG_TESTS +#include +#include +static void test_aes_256_hctr2(void) +{ + int algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); + struct sockaddr_alg addr = { + .salg_type = "skcipher", + .salg_name = "hctr2(aes)", + }; + unsigned long num_tests = NUM_ALG_TEST_ITERATIONS; + + if (algfd < 0) + die_errno("can't create AF_ALG socket"); + if (bind(algfd, (struct sockaddr *)&addr, sizeof(addr)) != 0) + die_errno("can't bind AF_ALG socket to HCTR2 algorithm"); + + while (num_tests--) { + u8 key[AES_256_KEY_SIZE]; + u8 iv[HCTR2_IV_SIZE]; + u8 ptext[4096]; + u8 ctext[sizeof(ptext)]; + u8 ref_ctext[sizeof(ptext)]; + u8 decrypted[sizeof(ptext)]; + const size_t datalen = 16 + (rand() % (sizeof(ptext) - 15)); + + rand_bytes(key, sizeof(key)); + rand_bytes(iv, sizeof(iv)); + rand_bytes(ptext, datalen); + memset(key, 0, sizeof(key)); + memset(iv, 0, sizeof(iv)); + memset(ptext, 0, datalen); + + aes_256_hctr2_encrypt(key, iv, ptext, ctext, datalen); + af_alg_crypt(algfd, ALG_OP_ENCRYPT, key, sizeof(key), + iv, sizeof(iv), ptext, ref_ctext, datalen); + ASSERT(memcmp(ctext, ref_ctext, datalen) == 0); + + aes_256_hctr2_decrypt(key, iv, ctext, decrypted, datalen); + ASSERT(memcmp(ptext, decrypted, datalen) == 0); + } + close(algfd); +} +#endif /* ENABLE_ALG_TESTS */ + /*----------------------------------------------------------------------------* * XChaCha12 stream cipher * *----------------------------------------------------------------------------*/ @@ -1500,58 +1769,6 @@ static void adiantum_decrypt(const u8 key[ADIANTUM_KEY_SIZE], } #ifdef ENABLE_ALG_TESTS -#include -#include -#define SOL_ALG 279 -static void af_alg_crypt(int algfd, int op, const u8 *key, size_t keylen, - const u8 *iv, size_t ivlen, - const u8 *src, u8 *dst, size_t datalen) -{ - size_t controllen = CMSG_SPACE(sizeof(int)) + - CMSG_SPACE(sizeof(struct af_alg_iv) + ivlen); - u8 *control = xmalloc(controllen); - struct iovec iov = { .iov_base = (u8 *)src, .iov_len = datalen }; - struct msghdr msg = { - .msg_iov = &iov, - .msg_iovlen = 1, - .msg_control = control, - .msg_controllen = controllen, - }; - struct cmsghdr *cmsg; - struct af_alg_iv *algiv; - int reqfd; - - memset(control, 0, controllen); - - cmsg = CMSG_FIRSTHDR(&msg); - cmsg->cmsg_len = CMSG_LEN(sizeof(int)); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_OP; - *(int *)CMSG_DATA(cmsg) = op; - - cmsg = CMSG_NXTHDR(&msg, cmsg); - cmsg->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + ivlen); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_IV; - algiv = (struct af_alg_iv *)CMSG_DATA(cmsg); - algiv->ivlen = ivlen; - memcpy(algiv->iv, iv, ivlen); - - if (setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, keylen) != 0) - die_errno("can't set key on AF_ALG socket"); - - reqfd = accept(algfd, NULL, NULL); - if (reqfd < 0) - die_errno("can't accept() AF_ALG socket"); - if (sendmsg(reqfd, &msg, 0) != datalen) - die_errno("can't sendmsg() AF_ALG request socket"); - if (xread(reqfd, dst, datalen) != datalen) - die("short read from AF_ALG request socket"); - close(reqfd); - - free(control); -} - static void test_adiantum(void) { int algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); @@ -1675,6 +1892,12 @@ static const struct fscrypt_cipher { .decrypt = aes_128_cts_cbc_decrypt, .keysize = AES_128_KEY_SIZE, .min_input_size = AES_BLOCK_SIZE, + }, { + .name = "AES-256-HCTR2", + .encrypt = aes_256_hctr2_encrypt, + .decrypt = aes_256_hctr2_decrypt, + .keysize = AES_256_KEY_SIZE, + .min_input_size = AES_BLOCK_SIZE, }, { .name = "Adiantum", .encrypt = adiantum_encrypt, @@ -1980,6 +2203,7 @@ int main(int argc, char *argv[]) test_aes_256_xts(); test_aes_256_cts_cbc(); test_adiantum(); + test_aes_256_hctr2(); #endif while ((c = getopt_long(argc, argv, "", longopts, NULL)) != -1) { From patchwork Thu May 5 19:38:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nathan Huckleberry X-Patchwork-Id: 12840084 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0576C433EF for ; Thu, 5 May 2022 19:38:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1385166AbiEETmJ (ORCPT ); Thu, 5 May 2022 15:42:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54726 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240224AbiEETmJ (ORCPT ); Thu, 5 May 2022 15:42:09 -0400 Received: from mail-yw1-x1149.google.com (mail-yw1-x1149.google.com [IPv6:2607:f8b0:4864:20::1149]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20B245D5F0 for ; Thu, 5 May 2022 12:38:29 -0700 (PDT) Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-2f7c322f770so46352567b3.20 for ; Thu, 05 May 2022 12:38:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=lQlP45DHkDNskXLx3b5+RlA38CXMVEY7+hpfZCUDyAI=; b=sWVotSrmvDcJU/drxd57OWO1ETBtWDCG0R4PkBhANs4jVeUK4UQF26kgUyiQSeh4kg Oiv3Q5pZrki3p6DGOZKul7T6PTeH4Tc1zkddtWLWLG6XusWPdrwmwq2PACgGVBT2DHRj hasLAFoldIcd/tahSrqx0QWjR6K9C+s+mR6RG12JysFGPc0Vmwf9/iAEcmc0V7+nitzp 0B6DFSNkzcQWCll4Ab1LziB/0GLfXBXtd9sHL3Cmox4LgH73NsL2at6Vv9rxRe6fLq6H M5DARk81skbjeqh3+37F44jWZxPry43tzAbKuJou0rb1rFTZU232mHfrF2aGz1XmeHIR jvvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=lQlP45DHkDNskXLx3b5+RlA38CXMVEY7+hpfZCUDyAI=; b=RLO1ui1Qz2dCX1WU4wjCiLOWOOD1WSTUgwIxe/rAg661VBmy5jNmWzZAGlxYhCk5V4 9QlMLDE/kK/+HpUlWIDa2nixZmmJVAaQ0mBZDK0OOHjZ67ot9dRXm7rzv2RMCuLQniFq F9y7B7BtzOXExo8YwXffsQrfiFyiuz5RIKc5kk0a/zF83utDHVRKpdh9wdbIOlBkdTN9 pf4CqEMBHQsVUHGRPKvmFBDqEUal3VsvCyUuzABCL8hBQu1Oyxa2n53ve3JaoIdQBrDk P6fEnACvWFVatyWcm3yT35Q6ltlmWfdugcvynmlgsCUMLWVl/upOraDlKy887dCK8Ufa KBOA== X-Gm-Message-State: AOAM531kGB6z2Z7yKtGZXsIxViHYJ5tTRbiYunEI73uEp1uO7w7jc1qI +/QrVTbUEgWs435KvlMwI4UKKn47T5hp8Ye9buk1eYJuqNvqKml4TENM02v3RzCa7uHmxlD8dji k/28LCVgaEHXNHzTUD83dzavw7WX1DTTlGE34VE37SxO26eS2LwIvJ857ZDWQ X-Google-Smtp-Source: ABdhPJy27FpVO9lfu7DrYy2nkn5t4F2BG2FPk2U9cYclYirGaKfNZmPLX0H5TCewdkgYMvbzELXW1JgjnQ== X-Received: from nhuck.c.googlers.com ([fda3:e722:ac3:cc00:14:4d90:c0a8:39cc]) (user=nhuck job=sendgmr) by 2002:a25:3fc3:0:b0:64a:2bf8:f4fd with SMTP id m186-20020a253fc3000000b0064a2bf8f4fdmr6107862yba.261.1651779508232; Thu, 05 May 2022 12:38:28 -0700 (PDT) Date: Thu, 5 May 2022 14:38:09 -0500 In-Reply-To: <20220505193809.579026-1-nhuck@google.com> Message-Id: <20220505193809.579026-3-nhuck@google.com> Mime-Version: 1.0 References: <20220505193809.579026-1-nhuck@google.com> X-Mailer: git-send-email 2.36.0.512.ge40c2bad7a-goog Subject: [RFC PATCH v2 2/2] generic: add tests for fscrypt policies with HCTR2 From: Nathan Huckleberry To: fstests@vger.kernel.org Cc: Eric Biggers , Sami Tolvanen , Nathan Huckleberry Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org This patch adds fscrypt policy tests for filename encryption using HCTR2. More information on HCTR2 can be found here: "Length-preserving encryption with HCTR2" https://ia.cr/2021/1441 Signed-off-by: Nathan Huckleberry --- tests/generic/900 | 24 ++++++++++++++++++++++++ tests/generic/900.out | 6 ++++++ tests/generic/901 | 26 ++++++++++++++++++++++++++ tests/generic/901.out | 6 ++++++ tests/generic/902 | 26 ++++++++++++++++++++++++++ tests/generic/902.out | 6 ++++++ 6 files changed, 94 insertions(+) create mode 100755 tests/generic/900 create mode 100644 tests/generic/900.out create mode 100755 tests/generic/901 create mode 100644 tests/generic/901.out create mode 100755 tests/generic/902 create mode 100644 tests/generic/902.out diff --git a/tests/generic/900 b/tests/generic/900 new file mode 100755 index 00000000..a3a9cead --- /dev/null +++ b/tests/generic/900 @@ -0,0 +1,24 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2022 Google LLC +# +# FS QA Test No. generic/900 +# +# Verify ciphertext for v2 encryption policies that use AES-256-XTS to encrypt +# file contents and AES-256-HCTR2 to encrypt file names. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +# Import common functions. +. ./common/filter +. ./common/encrypt + +# real QA test starts here +_supported_fs generic + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-HCTR2 v2 + +# success, all done +status=0 +exit diff --git a/tests/generic/900.out b/tests/generic/900.out new file mode 100644 index 00000000..2e5d1b27 --- /dev/null +++ b/tests/generic/900.out @@ -0,0 +1,6 @@ +QA output created by 900 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-HCTR2 + options: v2 diff --git a/tests/generic/901 b/tests/generic/901 new file mode 100755 index 00000000..7fc63d8f --- /dev/null +++ b/tests/generic/901 @@ -0,0 +1,26 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2022 Google LLC +# +# FS QA Test No. 901 +# +# Verify ciphertext for v2 encryption policies that use the IV_INO_LBLK_32 flag +# and use AES-256-XTS to encrypt file contents and AES-256-HCTR2 to encrypt +# file names. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +# Import common functions. +. ./common/filter +. ./common/encrypt + +# real QA test starts here +_supported_fs generic + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-HCTR2 \ + v2 iv_ino_lblk_32 + +# success, all done +status=0 +exit diff --git a/tests/generic/901.out b/tests/generic/901.out new file mode 100644 index 00000000..2a06addb --- /dev/null +++ b/tests/generic/901.out @@ -0,0 +1,6 @@ +QA output created by 901 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-HCTR2 + options: v2 iv_ino_lblk_32 diff --git a/tests/generic/902 b/tests/generic/902 new file mode 100755 index 00000000..82863d87 --- /dev/null +++ b/tests/generic/902 @@ -0,0 +1,26 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2022 Google LLC +# +# FS QA Test No. 902 +# +# Verify ciphertext for v2 encryption policies that use the IV_INO_LBLK_64 flag +# and use AES-256-XTS to encrypt file contents and AES-256-HCTR2 to encrypt +# file names. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +# Import common functions. +. ./common/filter +. ./common/encrypt + +# real QA test starts here +_supported_fs generic + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-HCTR2 \ + v2 iv_ino_lblk_64 + +# success, all done +status=0 +exit diff --git a/tests/generic/902.out b/tests/generic/902.out new file mode 100644 index 00000000..41df9f99 --- /dev/null +++ b/tests/generic/902.out @@ -0,0 +1,6 @@ +QA output created by 902 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-HCTR2 + options: v2 iv_ino_lblk_64