d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto/aesni_mb: support large HMAC key sizes

Browse Source 
Add support for SHAx-HMAC key sizes larger than the block size.
For these sizes, the input key is digested with the non-HMAC
version of the algorithm and used as the key.

Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Acked-by: Marko Kovacevic <marko.kovacevic@intel.com>
This commit is contained in:
Pablo de Lara 2018-08-14 01:38:48 +01:00 committed by Akhil Goyal
parent 035ecca5ea
commit d0fe8c48a4
4 changed files with 138 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
drivers/crypto/aesni_mb/aesni_mb_ops.h
View File

@ -11,6 +11,15 @@
#include <intel-ipsec-mb.h>
/*
* IMB_VERSION_NUM macro was introduced in version Multi-buffer 0.50,
* so if macro is not defined, it means that the version is 0.49.
*/
#if !defined(IMB_VERSION_NUM)
#define IMB_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + (c))
#define IMB_VERSION_NUM IMB_VERSION(0, 49, 0)
#endif
enum aesni_mb_vector_mode {
RTE_AESNI_MB_NOT_SUPPORTED = 0,
RTE_AESNI_MB_SSE,
@ -88,6 +97,16 @@ struct aesni_mb_op_fns {
/**< AES CMAC key expansions */
} keyexp;
/**< Key expansion functions */
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
struct {
hash_fn_t sha1;
hash_fn_t sha224;
hash_fn_t sha256;
hash_fn_t sha384;
hash_fn_t sha512;
} multi_block;
/** multi block hash functions */
#endif
} aux;
/**< Auxiliary functions */
};
@ -104,7 +123,13 @@ static const struct aesni_mb_op_fns job_ops[] = {
},
.keyexp = {
NULL
},
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.multi_block = {
NULL
}
#endif
}
},
[RTE_AESNI_MB_SSE] = {
@ -131,7 +156,16 @@ static const struct aesni_mb_op_fns job_ops[] = {
aes_xcbc_expand_key_sse,
aes_cmac_subkey_gen_sse,
aes_keyexp_128_enc_sse
},
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.multi_block = {
sha1_sse,
sha224_sse,
sha256_sse,
sha384_sse,
sha512_sse
}
#endif
}
},
[RTE_AESNI_MB_AVX] = {
@ -158,7 +192,16 @@ static const struct aesni_mb_op_fns job_ops[] = {
aes_xcbc_expand_key_avx,
aes_cmac_subkey_gen_avx,
aes_keyexp_128_enc_avx
},
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.multi_block = {
sha1_avx,
sha224_avx,
sha256_avx,
sha384_avx,
sha512_avx
}
#endif
}
},
[RTE_AESNI_MB_AVX2] = {
@ -185,7 +228,16 @@ static const struct aesni_mb_op_fns job_ops[] = {
aes_xcbc_expand_key_avx2,
aes_cmac_subkey_gen_avx2,
aes_keyexp_128_enc_avx2
},
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.multi_block = {
sha1_avx2,
sha224_avx2,
sha256_avx2,
sha384_avx2,
sha512_avx2
}
#endif
}
},
[RTE_AESNI_MB_AVX512] = {
@ -212,7 +264,16 @@ static const struct aesni_mb_op_fns job_ops[] = {
aes_xcbc_expand_key_avx512,
aes_cmac_subkey_gen_avx512,
aes_keyexp_128_enc_avx512
},
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.multi_block = {
sha1_avx512,
sha224_avx512,
sha256_avx512,
sha384_avx512,
sha512_avx512
}
#endif
}
}
};

59
drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c
View File

@ -16,7 +16,7 @@
#define AES_CCM_DIGEST_MIN_LEN 4
#define AES_CCM_DIGEST_MAX_LEN 16
#define HMAC_MAX_BLOCK_SIZE 128
static uint8_t cryptodev_driver_id;
typedef void (*hash_one_block_t)(const void *data, void *digest);
@ -104,6 +104,8 @@ aesni_mb_set_session_auth_parameters(const struct aesni_mb_op_fns *mb_ops,
const struct rte_crypto_sym_xform *xform)
{
hash_one_block_t hash_oneblock_fn;
unsigned int key_larger_block_size = 0;
uint8_t hashed_key[HMAC_MAX_BLOCK_SIZE] = { 0 };
if (xform == NULL) {
sess->auth.algo = NULL_HASH;
@ -182,22 +184,67 @@ aesni_mb_set_session_auth_parameters(const struct aesni_mb_op_fns *mb_ops,
case RTE_CRYPTO_AUTH_SHA1_HMAC:
sess->auth.algo = SHA1;
hash_oneblock_fn = mb_ops->aux.one_block.sha1;
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
if (xform->auth.key.length > get_auth_algo_blocksize(SHA1)) {
mb_ops->aux.multi_block.sha1(
xform->auth.key.data,
xform->auth.key.length,
hashed_key);
key_larger_block_size = 1;
}
#endif
break;
case RTE_CRYPTO_AUTH_SHA224_HMAC:
sess->auth.algo = SHA_224;
hash_oneblock_fn = mb_ops->aux.one_block.sha224;
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
if (xform->auth.key.length > get_auth_algo_blocksize(SHA_224)) {
mb_ops->aux.multi_block.sha224(
xform->auth.key.data,
xform->auth.key.length,
hashed_key);
key_larger_block_size = 1;
}
#endif
break;
case RTE_CRYPTO_AUTH_SHA256_HMAC:
sess->auth.algo = SHA_256;
hash_oneblock_fn = mb_ops->aux.one_block.sha256;
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
if (xform->auth.key.length > get_auth_algo_blocksize(SHA_256)) {
mb_ops->aux.multi_block.sha256(
xform->auth.key.data,
xform->auth.key.length,
hashed_key);
key_larger_block_size = 1;
}
#endif
break;
case RTE_CRYPTO_AUTH_SHA384_HMAC:
sess->auth.algo = SHA_384;
hash_oneblock_fn = mb_ops->aux.one_block.sha384;
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
if (xform->auth.key.length > get_auth_algo_blocksize(SHA_384)) {
mb_ops->aux.multi_block.sha384(
xform->auth.key.data,
xform->auth.key.length,
hashed_key);
key_larger_block_size = 1;
}
#endif
break;
case RTE_CRYPTO_AUTH_SHA512_HMAC:
sess->auth.algo = SHA_512;
hash_oneblock_fn = mb_ops->aux.one_block.sha512;
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
if (xform->auth.key.length > get_auth_algo_blocksize(SHA_512)) {
mb_ops->aux.multi_block.sha512(
xform->auth.key.data,
xform->auth.key.length,
hashed_key);
key_larger_block_size = 1;
}
#endif
break;
default:
AESNI_MB_LOG(ERR, "Unsupported authentication algorithm selection");
@ -225,11 +272,19 @@ aesni_mb_set_session_auth_parameters(const struct aesni_mb_op_fns *mb_ops,
sess->auth.gen_digest_len = sess->auth.req_digest_len;
/* Calculate Authentication precomputes */
calculate_auth_precomputes(hash_oneblock_fn,
if (key_larger_block_size) {
calculate_auth_precomputes(hash_oneblock_fn,
sess->auth.pads.inner, sess->auth.pads.outer,
hashed_key,
xform->auth.key.length,
get_auth_algo_blocksize(sess->auth.algo));
} else {
calculate_auth_precomputes(hash_oneblock_fn,
sess->auth.pads.inner, sess->auth.pads.outer,
xform->auth.key.data,
xform->auth.key.length,
get_auth_algo_blocksize(sess->auth.algo));
}
return 0;
}

20
drivers/crypto/aesni_mb/rte_aesni_mb_pmd_ops.c
View File

@ -48,7 +48,11 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
.block_size = 64,
.key_size = {
.min = 1,
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.max = 65535,
#else
.max = 64,
#endif
.increment = 1
},
.digest_size = {
@ -75,7 +79,11 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
.block_size = 64,
.key_size = {
.min = 1,
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.max = 65535,
#else
.max = 64,
#endif
.increment = 1
},
.digest_size = {
@ -102,7 +110,11 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
.block_size = 64,
.key_size = {
.min = 1,
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.max = 65535,
#else
.max = 64,
#endif
.increment = 1
},
.digest_size = {
@ -129,7 +141,11 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
.block_size = 128,
.key_size = {
.min = 1,
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.max = 65535,
#else
.max = 128,
#endif
.increment = 1
},
.digest_size = {
@ -156,7 +172,11 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
.block_size = 128,
.key_size = {
.min = 1,
#if IMB_VERSION_NUM >= IMB_VERSION(0, 50, 0)
.max = 65535,
#else
.max = 128,
#endif
.increment = 1
},
.digest_size = {

9
drivers/crypto/aesni_mb/rte_aesni_mb_pmd_private.h
View File

@ -7,15 +7,6 @@
#include "aesni_mb_ops.h"
/*
* IMB_VERSION_NUM macro was introduced in version Multi-buffer 0.50,
* so if macro is not defined, it means that the version is 0.49.
*/
#if !defined(IMB_VERSION_NUM)
#define IMB_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + (c))
#define IMB_VERSION_NUM IMB_VERSION(0, 49, 0)
#endif
#define CRYPTODEV_NAME_AESNI_MB_PMD crypto_aesni_mb
/**< AES-NI Multi buffer PMD device name */