diff options
| author | Stephan Mueller <smueller@chronox.de> | 2016-06-14 07:34:13 +0200 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2016-06-15 17:07:53 +0800 |
| commit | 355912852115cd8aa4ad02c25182ae615ce925fb (patch) | |
| tree | f25c7201d6538cebae6a4d5ded1998a2164717de /crypto/Kconfig | |
| parent | e123be16120df6cdda4e1811a49326125f0aa4dd (diff) | |
| download | lwn-355912852115cd8aa4ad02c25182ae615ce925fb.tar.gz lwn-355912852115cd8aa4ad02c25182ae615ce925fb.zip | |
crypto: drbg - use CTR AES instead of ECB AES
The CTR DRBG derives its random data from the CTR that is encrypted with
AES.
This patch now changes the CTR DRBG implementation such that the
CTR AES mode is employed. This allows the use of steamlined CTR AES
implementation such as ctr-aes-aesni.
Unfortunately there are the following subtile changes we need to apply
when using the CTR AES mode:
- the CTR mode increments the counter after the cipher operation, but
the CTR DRBG requires the increment before the cipher op. Hence, the
crypto_inc is applied to the counter (drbg->V) once it is
recalculated.
- the CTR mode wants to encrypt data, but the CTR DRBG is interested in
the encrypted counter only. The full CTR mode is the XOR of the
encrypted counter with the plaintext data. To access the encrypted
counter, the patch uses a NULL data vector as plaintext to be
"encrypted".
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/Kconfig')
| -rw-r--r-- | crypto/Kconfig | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/crypto/Kconfig b/crypto/Kconfig index 1d33beb6a1ae..c903f1832f2c 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -1567,6 +1567,7 @@ config CRYPTO_DRBG_HASH config CRYPTO_DRBG_CTR bool "Enable CTR DRBG" select CRYPTO_AES + depends on CRYPTO_CTR help Enable the CTR DRBG variant as defined in NIST SP800-90A. |