Parameterised Cryptographic Algorithms in Linux
Herbert Xu

Previous Interface

Cipher, digest and compress.

CBC/ECB hard-coded into cipher API.

Stubs available for CFB/CTR.

Ciphers exported single-block interface.

Extended to support ECB and CBC.

HMAC hard-coded in digest API.

Problems

Async crypto requires SG Cipher interface.

Cipher interface is getting crowded:

Single block interface.

Multi-block interface with ECB and CBC.

SG interface for ECB and CBC.

It gets worse with more chaining methods.

Problems

Hard-coded HMAC => Hard to offload.

New MAC algorithms, e.g., AES-XCBC-MAC.

How to set parameters for algorithms:

Key size built into API => Hard to offload.

Window bits for deflate compression. One size does not fit all.

Parameterised Algorithms

Template + Parameter => Algorithm.

Templates: cbc, hmac, deflate, aes.

Paramters: aes, sha1, “11,15”, 256.

Algorithms:

cbc(aes) – AES with CBC.

hmac(sha1) – SHA1 with HMAC.

deflate(11,15) – deflate 11/15, comp/decomp.

aes(256) – AES with 256-bit key.

Parameterised Algorithms

CBC and ECB are now templates:

Takes cipher algorithm as parameter, e.g., aes.

Produces block cipher algorithm.

Block cipher algorithms provide SG interface only.

Multi-block cipher interface to be phased out.

New block chaining algorithms: Add a template.

Parameterised Algorithms

HMAC becomes a template:

Takes digest algorithm as parameter, e.g., sha1.

Produces digest algorithm (with setkey).

Offloaded independently from parameter, e.g., offload sha1 but not hmac(sha1).

AES-XCBC-MAC written as a template (xcbc-mac):

Takes block cipher as parameter.

cbc(aes) would give xcbc-mac(cbc(aes)).

Algorithm Selection

Best algorithm used by default.

Selection by priority, or wrapper algorithm.

Select specific algorithm using unique name:

C implementation of AES is “aes-generic”.

i586 assembly version of AES is “aes-i586”.

Templates will have unique names too:

AES with generic CBC would be “cbc-generic(aes)”.

We could have “cbc-i586(aes)”, etc.

Algorithm Resolution

Instances of templates created dynamically.

Recursive construction, e.g., xcbc-mac(cbc(aes)).

Borrow concept of IPsec SA resolution:

Make larvals to stop others from building.

Tell resolution manager (can be a user-space daemon for more complex constructions).

The manager constructs asynchronously.

Notify all larval users when done.

Current Status

Parameterised algorithm support with templates.

New block cipher type created.

Old block cipher interface deprecated.

HMAC template created.

All kernel users converted to use new interface.

Algorithm selection/resolution support added.

Type-checking done at compile time.

Future Direction

Queueing facility for async crypto.

Reference implementation for async crypto.

Add async support to relevant usersxr:

IPsec

dm-crypt

User-space access to crypto API.

Asymmetric crypto.

2006-08-20T21:42:05