github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-25 01:05:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

lib/crypto: aes-gcm: Provide functions for zeroizing aes_gcm* structures

Browse Source 
In certain cases crypto code needs to zeroize their local aes_gcm_key
or aes_gcm_ctx structures after use to avoid leaking sensitive material.
Provide aes_gcm_zeroize_key() and aes_gcm_zeroize_ctx() helper functions
that e.g. can be used with __cleanup() to automatically zeroize the
structures when they go out of scope.

While we're at it, replace the related memzero_explicit() calls in
lib/crypto/aes.c with calls to the new helper functions.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Link: https://patch.msgid.link/20260916095022.604354-4-thuth@redhat.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
This commit is contained in:
Thomas Huth 2026-09-16 11:50:05 +02:00 committed by Eric Biggers
parent bde4dcd6ca
commit f0bcf2d3ef
2 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
include/crypto/aes-gcm.h
View File

@ -21,6 +21,15 @@ struct aes_gcm_key {
size_t authtag_len; /* Length of authentication tags in bytes */
};
/**
* aes_gcm_zeroize_key() - Zeroize an aes_gcm_key structure
* @key: The aes_gcm_key to zeroize
*/
static inline void aes_gcm_zeroize_key(struct aes_gcm_key *key)
{
memzero_explicit(key, sizeof(*key));
}
/**
* struct aes_gcm_ctx - Context for incrementally en/decrypting a message
*/
@ -58,6 +67,15 @@ struct aes_gcm_ctx {
u64 data_len;
};
/**
* aes_gcm_zeroize_ctx() - Zeroize an aes_gcm_ctx structure
* @ctx: The aes_gcm_ctx to zeroize
*/
static inline void aes_gcm_zeroize_ctx(struct aes_gcm_ctx *ctx)
{
memzero_explicit(ctx, sizeof(*ctx));
}
/**
* aes_gcm_preparekey() - Prepare a key for AES-GCM encryption and decryption
* @key: (output) The key structure to initialize
@ -66,8 +84,8 @@ struct aes_gcm_ctx {
* @authtag_len: Length of the authentication tag in bytes:
* 4, 8, 12, 13, 14, 15, or 16. 16 is recommended.
*
* Users should use memzero_explicit() to zeroize the key struct at the end of
* its lifetime. (But if this function fails, zeroization is unnecessary.)
* Users should use aes_gcm_zeroize_key() to zeroize the key struct at the end
* of its lifetime. (But if this function fails, zeroization is unnecessary.)
*
* Context: Any context.
* Return:

8
lib/crypto/aes.c
View File

@ -1670,7 +1670,7 @@ void aes_gcm_encrypt_final(struct aes_gcm_ctx *ctx, u8 *authtag)
ghash_final(&ctx->ghash, ctx->ctr); /* Use ctr as temp buffer */
crypto_xor_cpy(authtag, ctx->ctr, ctx->j0_enc, ctx->key->authtag_len);
memzero_explicit(ctx, sizeof(*ctx));
aes_gcm_zeroize_ctx(ctx);
}
EXPORT_SYMBOL_GPL(aes_gcm_encrypt_final);
@ -1697,7 +1697,7 @@ int aes_gcm_decrypt_final(struct aes_gcm_ctx *ctx, const u8 *authtag)
-EBADMSG :
0;
out:
memzero_explicit(ctx, sizeof(*ctx));
aes_gcm_zeroize_ctx(ctx);
return err;
}
EXPORT_SYMBOL_GPL(aes_gcm_decrypt_final);
@ -1742,7 +1742,7 @@ static void __init aes_gcm_fips_test(void)
{
const size_t data_len = sizeof(fips_test_data);
u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE];
struct aes_gcm_key key;
struct aes_gcm_key key __cleanup(aes_gcm_zeroize_key);
int err;
if (aes_gcm_preparekey(&key, fips_test_key, sizeof(fips_test_key),
@ -1760,8 +1760,6 @@ static void __init aes_gcm_fips_test(void)
panic("aes: GCM FIPS self-test failed (decryption failed)\n");
if (memcmp(fips_test_data, buf, data_len) != 0)
panic("aes: GCM FIPS self-test failed (wrong plaintext)\n");
memzero_explicit(&key, sizeof(key));
}
#else /* CONFIG_CRYPTO_LIB_AES_GCM */
static inline void aes_gcm_fips_test(void)