mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
d1775a177f
Add an AEAD template that does hash-then-cipher (unlike authenc that does
cipher-then-hash). This is required for a number of Kerberos 5 encoding
types.
[!] Note that the net/sunrpc/auth_gss/ implementation gets a pair of
ciphers, one non-CTS and one CTS, using the former to do all the aligned
blocks and the latter to do the last two blocks if they aren't also
aligned. It may be necessary to do this here too for performance reasons -
but there are considerations both ways:
(1) firstly, there is an optimised assembly version of cts(cbc(aes)) on
x86_64 that should be used instead of having two ciphers;
(2) secondly, none of the hardware offload drivers seem to offer CTS
support (Intel QAT does not, for instance).
However, I don't know if it's possible to query the crypto API to find out
whether there's an optimised CTS algorithm available.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: "David S. Miller" <davem@davemloft.net>
cc: Chuck Lever <chuck.lever@oracle.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: linux-nfs@vger.kernel.org
cc: linux-crypto@vger.kernel.org
cc: netdev@vger.kernel.org
34 lines
747 B
C
34 lines
747 B
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Authenc: Simple AEAD wrapper for IPsec
|
|
*
|
|
* Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
|
|
*/
|
|
#ifndef _CRYPTO_AUTHENC_H
|
|
#define _CRYPTO_AUTHENC_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
enum {
|
|
CRYPTO_AUTHENC_KEYA_UNSPEC,
|
|
CRYPTO_AUTHENC_KEYA_PARAM,
|
|
};
|
|
|
|
struct crypto_authenc_key_param {
|
|
__be32 enckeylen;
|
|
};
|
|
|
|
struct crypto_authenc_keys {
|
|
const u8 *authkey;
|
|
const u8 *enckey;
|
|
|
|
unsigned int authkeylen;
|
|
unsigned int enckeylen;
|
|
};
|
|
|
|
int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
|
|
unsigned int keylen);
|
|
int crypto_krb5enc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
|
|
unsigned int keylen);
|
|
|
|
#endif /* _CRYPTO_AUTHENC_H */
|