• Ard Biesheuvel's avatar
    crypto: arm/aes - don't use IV buffer to return final keystream block · 1a20b966
    Ard Biesheuvel authored
    The ARM bit sliced AES core code uses the IV buffer to pass the final
    keystream block back to the glue code if the input is not a multiple of
    the block size, so that the asm code does not have to deal with anything
    except 16 byte blocks. This is done under the assumption that the outgoing
    IV is meaningless anyway in this case, given that chaining is no longer
    possible under these circumstances.
    
    However, as it turns out, the CCM driver does expect the IV to retain
    a value that is equal to the original IV except for the counter value,
    and even interprets byte zero as a length indicator, which may result
    in memory corruption if the IV is overwritten with something else.
    
    So use a separate buffer to return the final keystream block.
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    1a20b966
aes-neonbs-core.S 21.4 KB