kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/crypto: Improve AEAD en-/decryption functions

Browse Source 
Rename "Authenticated Encryption with Associated Data" (AEAD)
encryption/decryption functions and change the result type. This makes
the functions easier extendable. In addition, it's now possible to use
the functions as following:

`encrypt(decrypt(data)) == decrypt(encrypt(data) == data`

Add more AES and SHA related constants and use them whenever possible.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2024-10-14 18:25:22 +00:00
committed by Steffen Eiden
parent f1b94abefa
commit 4cd7e8fd9a
6 changed files with 249 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pv/src/req.rs
+8 -7
View File
@@ -4,8 +4,8 @@
use crate::assert_size;
use crate::crypto::{
decrypt_aes_gcm, derive_aes256_gcm_key, encrypt_aes_gcm, gen_ec_key, hash, random_array,
AesGcmResult, SymKey, SymKeyType, AES_256_GCM_TAG_SIZE,
decrypt_aead, derive_aes256_gcm_key, encrypt_aead, gen_ec_key, hash, random_array,
AeadEncryptionResult, SymKey, SymKeyType,
};
use crate::misc::to_u32;
use crate::request::Confidential;
@@ -108,7 +108,7 @@ impl Encrypt for Keyslot {
) -> Result<()> {
let derived_key = derive_aes256_gcm_key(priv_key, &self.0)?;
let mut wrpk_and_kst =
encrypt_aes_gcm(&derived_key.into(), &[0; 12], &[], prot_key)?.data();
encrypt_aead(&derived_key.into(), &[0; 12], &[], prot_key)?.into_buf();
let phk: EcPubKeyCoord = self.0.as_ref().try_into()?;
to.reserve(80);
@@ -258,8 +258,8 @@ impl ReqEncrCtx {
/// # Errors
///
/// This function will return an error if the data could not be encrypted by OpenSSL.
pub(crate) fn encrypt_aead(&self, aad: &[u8], conf: &[u8]) -> Result<AesGcmResult> {
encrypt_aes_gcm(&self.prot_key, &self.iv, aad, conf)
pub(crate) fn encrypt_aead(&self, aad: &[u8], conf: &[u8]) -> Result<AeadEncryptionResult> {
encrypt_aead(&self.prot_key, &self.iv, aad, conf)
}
/// Returns a reference to the request protection key of this [`ReqEncrCtx`].
@@ -439,7 +439,7 @@ pub(crate) struct BinReqValues<'a> {
len: usize,
}
impl<'a> BinReqValues<'a> {
pub(crate) const TAG_LEN: usize = AES_256_GCM_TAG_SIZE;
pub(crate) const TAG_LEN: usize = SymKeyType::AES_256_GCM_TAG_LEN;
/// Get the locations from this request.
///
@@ -492,7 +492,8 @@ impl<'a> BinReqValues<'a> {
/// Decrypts the encrypted area with the provided key
pub(crate) fn decrypt(&self, key: &SymKey) -> Result<Confidential<Vec<u8>>> {
decrypt_aes_gcm(key, self.iv, self.aad, self.encr, self.tag)
let result = decrypt_aead(key, self.iv, self.aad, self.encr, self.tag)?;
Ok(result.into_plain())
}
/// Returns a reference to the request dependent authenticated area of this [`BinReqValues`]