linux-toradex.git/crypto/rsa-pkcs1pad.c, branch v4.9.48

crypto: rsa-pkcs1pad - use constant time memory comparison for MACs

2017-07-15T10:16:16+00:00

commit fec17cb2231733174e039ad9054fa16bb358e2ec upstream.

Otherwise, we enable all sorts of forgeries via timing attack.

Signed-off-by: Jason A. Donenfeld 
Suggested-by: Stephan Müller 
Cc: Herbert Xu 
Cc: linux-crypto@vger.kernel.org
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: rsa-pkcs1pad - Handle leading zero for decryption

2016-09-22T09:42:08+00:00

As the software RSA implementation now produces fixed-length
output, we need to eliminate leading zeros in the calling code
instead.

This patch does just that for pkcs1pad decryption while signature
verification was fixed in an earlier patch.

Fixes: 9b45b7bba3d2 ("crypto: rsa - Generate fixed-length output")
Reported-by: Mat Martineau 
Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - fix rsa-pkcs1pad request struct

2016-07-19T04:01:47+00:00

To allow for child request context the struct akcipher_request child_req
needs to be at the end of the structure.

Signed-off-by: Tadeusz Struk 
Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Fix regression from leading zeros

2016-07-03T07:44:56+00:00

As the software RSA implementation now produces fixed-length
output, we need to eliminate leading zeros in the calling code
instead.

This patch does just that for pkcs1pad signature verification.

Fixes: 9b45b7bba3d2 ("crypto: rsa - Generate fixed-length output")
Reported-by: Stephan Mueller 
Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Avoid copying output when possible

2016-07-01T15:45:20+00:00

In the vast majority of cases (2^-32 on 32-bit and 2^-64 on 64-bit)
cases, the result from encryption/signing will require no padding.

This patch makes these two operations write their output directly
to the final destination.  Only in the exceedingly rare cases where
fixup is needed to we copy it out and back to add the leading zeroes.

This patch also makes use of the crypto_akcipher_set_crypt API
instead of writing the akcipher request directly.

Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Move key size check to setkey

2016-07-01T15:45:20+00:00

Rather than repeatedly checking the key size on each operation,
we should be checking it once when the key is set.

Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Always use GFP_KERNEL

2016-07-01T15:45:19+00:00

We don't currently support using akcipher in atomic contexts,
so GFP_KERNEL should always be used.

Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Remove bogus page splitting

2016-07-01T15:45:19+00:00

The helper pkcs1pad_sg_set_buf tries to split a buffer that crosses
a page boundary into two SG entries.  This is unnecessary.  This
patch removes that.

Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - Require hash to be present

2016-07-01T15:45:19+00:00

The only user of rsa-pkcs1pad always uses the hash so there is
no reason to support the case of not having a hash.

This patch also changes the digest info lookup so that it is
only done once during template instantiation rather than on each
operation.

Signed-off-by: Herbert Xu

crypto: rsa-pkcs1pad - fix dst len

2016-04-15T14:13:55+00:00

The output buffer length has to be at least as big as the key_size.
It is then updated to the actual output size by the implementation.

Cc: 
Signed-off-by: Tadeusz Struk 
Signed-off-by: Herbert Xu