On 17 October 2016 at 10:23, Johannes Berg <johan...@sipsolutions.net> wrote:
>> Apologies for going back and forth on this, but it appears there may
>> be another way to deal with this.
>> First of all, we only need this handling for the authenticated data,
> Are you sure b_0/j_0 aren't needed? We pass those
> to aead_request_set_crypt(), and I wasn't sure what that really did
> internally, perhaps like the internal data.
They are the IV, which is a fixed length parameter of the algorithm.
In contrast, the AAD could be of arbitrary length (from the POV of
the crypto API) so it uses scatterlists.
> Testing with that on the stack does seem to work, in fact.
> Surely we need zero for GMAC though, since we also put that into the sg
> list. Thus for GMAC we definitely need 20+16 bytes, and since I round
> up to a cacheline (at least on SMP) it doesn't really matter that we
> could get 36 instead of the 48 I have now.
>> and only for CCM and GCM, not CMAC (which does not use scatterlists
>> at all, it simply calls the AES cipher directly)
> I didn't modify CMAC, I think, only GMAC, which also uses scatterlists.
Ah ok, I misread the patch.
>> So that leaves a fixed 20 bytes for GCM and fixed 32 bytes for CCM,
> and 36 for GMAC :)
Yes. But as I replied, setting the req size is not supported atm,
although it is reasonable to demand a way to allocate additional data
in the request specifically for this issue. So let's proceed with the
aead_request_alloc/free patch, but I would like to propose something
on the API side to address this particular issue