crypto: chacha - add XChaCha12 support
Eric Biggers authored
Now that the generic implementation of ChaCha20 has been refactored to
allow varying the number of rounds, add support for XChaCha12, which is
the XSalsa construction applied to ChaCha12.  ChaCha12 is one of the
three ciphers specified by the original ChaCha paper
(https://cr.yp.to/chacha/chacha-20080128.pdf

: "ChaCha, a variant of
Salsa20"), alongside ChaCha8 and ChaCha20.  ChaCha12 is faster than
ChaCha20 but has a lower, but still large, security margin.

We need XChaCha12 support so that it can be used in the Adiantum
encryption mode, which enables disk/file encryption on low-end mobile
devices where AES-XTS is too slow as the CPUs lack AES instructions.

We'd prefer XChaCha20 (the more popular variant), but it's too slow on
some of our target devices, so at least in some cases we do need the
XChaCha12-based version.  In more detail, the problem is that Adiantum
is still much slower than we're happy with, and encryption still has a
quite noticeable effect on the feel of low-end devices.  Users and
vendors push back hard against encryption that degrades the user
experience, which always risks encryption being disabled entirely.  So
we need to choose the fastest option that gives us a solid margin of
security, and here that's XChaCha12.  The best known attack on ChaCha
breaks only 7 rounds and has 2^235 time complexity, so ChaCha12's
security margin is still better than AES-256's.  Much has been learned
about cryptanalysis of ARX ciphers since Salsa20 was originally designed
in 2005, and it now seems we can be comfortable with a smaller number of
rounds.  The eSTREAM project also suggests the 12-round version of
Salsa20 as providing the best balance among the different variants:
combining very good performance with a "comfortable margin of security".

Note that it would be trivial to add vanilla ChaCha12 in addition to
XChaCha12.  However, it's unneeded for now and therefore is omitted.

As discussed in the patch that introduced XChaCha20 support, I
considered splitting the code into separate chacha-common, chacha20,
xchacha20, and xchacha12 modules, so that these algorithms could be
enabled/disabled independently.  However, since nearly all the code is
shared anyway, I ultimately decided there would have been little benefit
to the added complexity.
Reviewed-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: default avatarMartin Willi <martin@strongswan.org>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
aa762409
Name Last commit Last update
Documentation dt-bindings: crypto: Mention clocks for mxs-dcp
LICENSES Merge tag 'docs-4.20' of git://git.lwn.net/linux
arch crypto: chacha20-generic - refactor to allow varying number of rounds
block Merge tag 'for-linus-20181102' of git://git.kernel.dk/linux-block
certs export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()
crypto crypto: chacha - add XChaCha12 support
drivers crypto: chacha20-generic - refactor to allow varying number of rounds
firmware kbuild: remove all dummy assignments to obj-
fs crypto: drop mask=CRYPTO_ALG_ASYNC from 'shash' tfm allocations
include crypto: chacha - add XChaCha12 support
init memblock: stop using implicit alignment to SMP_CACHE_BYTES
ipc ipc: IPCMNI limit check for semmni
kernel padata: clean an indentation issue, remove extraneous space
lib crypto: chacha - add XChaCha12 support
mm memory_hotplug: cond_resched in __remove_pages
net crypto: drop mask=CRYPTO_ALG_ASYNC from 'shash' tfm allocations
samples Merge tag 'vfio-v4.20-rc1.v2' of git://github.com/awilliam/linux-vfio
scripts Merge tag 'kbuild-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
security crypto: drop mask=CRYPTO_ALG_ASYNC from 'shash' tfm allocations
sound Merge tag 'sound-fix-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
tools Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
usr initramfs: move gen_initramfs_list.sh from scripts/ to usr/
virt Revert "mm, mmu_notifier: annotate mmu notifiers with blockable invalidate callbacks"
.clang-format page cache: Convert find_get_pages_contig to XArray
.cocciconfig scripts: add Linux .cocciconfig for coccinelle
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README
Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.