]> git.baikalelectronics.ru Git - kernel.git/commit
crypto: skcipher - Copy iv from desc even for 0-len walks
authorJason A. Donenfeld <Jason@zx2c4.com>
Sun, 6 Dec 2015 01:51:37 +0000 (02:51 +0100)
committerHerbert Xu <herbert@gondor.apana.org.au>
Wed, 9 Dec 2015 12:16:22 +0000 (20:16 +0800)
commitcdf64db3850c533f6db8974eacc16e5241e20b5e
tree0f7b5b7b5528cad419ffc19a3d29a82d61ae2935
parent1effd24b204f8ebf070bbf5c74024cdf08d9b62e
crypto: skcipher - Copy iv from desc even for 0-len walks

Some ciphers actually support encrypting zero length plaintexts. For
example, many AEAD modes support this. The resulting ciphertext for
those winds up being only the authentication tag, which is a result of
the key, the iv, the additional data, and the fact that the plaintext
had zero length. The blkcipher constructors won't copy the IV to the
right place, however, when using a zero length input, resulting in
some significant problems when ciphers call their initialization
routines, only to find that the ->iv parameter is uninitialized. One
such example of this would be using chacha20poly1305 with a zero length
input, which then calls chacha20, which calls the key setup routine,
which eventually OOPSes due to the uninitialized ->iv member.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto/ablkcipher.c
crypto/blkcipher.c