• Mathias Krause's avatar
    crypto: aesni - fix "by8" variant for 128 bit keys · 0b1e95b2
    Mathias Krause authored
    The "by8" counter mode optimization is broken for 128 bit keys with
    input data longer than 128 bytes. It uses the wrong key material for
    en- and decryption.
    
    The key registers xkey0, xkey4, xkey8 and xkey12 need to be preserved
    in case we're handling more than 128 bytes of input data -- they won't
    get reloaded after the initial load. They must therefore be (a) loaded
    on the first iteration and (b) be preserved for the latter ones. The
    implementation for 128 bit keys does not comply with (a) nor (b).
    
    Fix this by bringing the implementation back to its original source
    and correctly load the key registers and preserve their values by
    *not* re-using the registers for other purposes.
    
    Kudos to James for reporting the issue and providing a test case
    showing the discrepancies.
    Reported-by: default avatarJames Yonan <james@openvpn.net>
    Cc: Chandramouli Narayanan <mouli@linux.intel.com>
    Cc: <stable@vger.kernel.org> # v3.18
    Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    0b1e95b2
aes_ctrby8_avx-x86_64.S 12.2 KB