github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: eip93 - Simplify the check for a valid AES key

Browse Source 
eip93_aead_setkey() currently uses aes_expandkey() to check for a valid
AES key, but then does not use the crypto_aes_ctx afterwards anymore,
i.e. this is just a wasteful way of checking the key length, and thus
aes_check_keylen() should be used instead.
This also fixes a potential leak of sensitive data via the stack, since
this function forgot to zeroize crypto_aes_ctx before returning to the
caller.

Suggested-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Thomas Huth 2026-08-10 11:30:05 +02:00 committed by Herbert Xu
parent 001c53ae35
commit e1df9bb6dc
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/crypto/inside-secure/eip93/eip93-aead.c
View File

@ -92,7 +92,6 @@ static int eip93_aead_setkey(struct crypto_aead *ctfm, const u8 *key,
struct crypto_tfm *tfm = crypto_aead_tfm(ctfm);
struct eip93_crypto_ctx *ctx = crypto_tfm_ctx(tfm);
struct crypto_authenc_keys keys;
struct crypto_aes_ctx aes;
struct sa_record *sa_record = ctx->sa_record;
u32 nonce = 0;
int ret;
@ -126,7 +125,7 @@ static int eip93_aead_setkey(struct crypto_aead *ctfm, const u8 *key,
break;
case EIP93_ALG_AES:
ret = aes_expandkey(&aes, keys.enckey, keys.enckeylen);
ret = aes_check_keylen(keys.enckeylen);
if (ret)
return ret;