* [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations
@ 2018-09-16 3:18 Dmitry Eremin-Solenikov
2018-09-25 14:46 ` Akhil Goyal
0 siblings, 1 reply; 4+ messages in thread
From: Dmitry Eremin-Solenikov @ 2018-09-16 3:18 UTC (permalink / raw)
To: dev
IPsec requires truncated HMAC operations support. Extend OpenSSL crypto
PMD to support truncated HMAC operations necessary for IPsec.
Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>
---
Changes since V1:
- support all digest sizes from half of corresponding digest size up to
full length.
---
drivers/crypto/openssl/rte_openssl_pmd.c | 19 ++++++++--------
drivers/crypto/openssl/rte_openssl_pmd_ops.c | 24 ++++++++++----------
2 files changed, 22 insertions(+), 21 deletions(-)
diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c
index 7d263aba3bbd..c635f1e2493c 100644
--- a/drivers/crypto/openssl/rte_openssl_pmd.c
+++ b/drivers/crypto/openssl/rte_openssl_pmd.c
@@ -1509,15 +1509,7 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
srclen = op->sym->auth.data.length;
- if (sess->auth.operation == RTE_CRYPTO_AUTH_OP_VERIFY)
- dst = qp->temp_digest;
- else {
- dst = op->sym->auth.digest.data;
- if (dst == NULL)
- dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
- op->sym->auth.data.offset +
- op->sym->auth.data.length);
- }
+ dst = qp->temp_digest;
switch (sess->auth.mode) {
case OPENSSL_AUTH_AS_AUTH:
@@ -1540,6 +1532,15 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
sess->auth.digest_length) != 0) {
op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
}
+ } else {
+ uint8_t *auth_dst;
+
+ auth_dst = op->sym->auth.digest.data;
+ if (auth_dst == NULL)
+ auth_dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
+ op->sym->auth.data.offset +
+ op->sym->auth.data.length);
+ memcpy(auth_dst, dst, sess->auth.digest_length);
}
if (status != 0)
diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
index de2284390b12..6d3e21de404d 100644
--- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
+++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
@@ -26,9 +26,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 16,
+ .min = 8,
.max = 16,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
@@ -68,9 +68,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 20,
+ .min = 10,
.max = 20,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
@@ -110,9 +110,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 28,
+ .min = 14,
.max = 28,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
@@ -152,9 +152,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 32,
+ .min = 16,
.max = 32,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
@@ -194,9 +194,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 48,
+ .min = 24,
.max = 48,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
@@ -236,9 +236,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
.increment = 1
},
.digest_size = {
- .min = 64,
+ .min = 32,
.max = 64,
- .increment = 0
+ .increment = 1
},
.iv_size = { 0 }
}, }
--
2.18.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations
2018-09-16 3:18 [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations Dmitry Eremin-Solenikov
@ 2018-09-25 14:46 ` Akhil Goyal
2018-09-27 21:32 ` Dmitry Eremin-Solenikov
0 siblings, 1 reply; 4+ messages in thread
From: Akhil Goyal @ 2018-09-25 14:46 UTC (permalink / raw)
To: Dmitry Eremin-Solenikov, dev
On 9/16/2018 8:48 AM, Dmitry Eremin-Solenikov wrote:
> IPsec requires truncated HMAC operations support. Extend OpenSSL crypto
> PMD to support truncated HMAC operations necessary for IPsec.
>
> Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>
> ---
> Changes since V1:
> - support all digest sizes from half of corresponding digest size up to
> full length.
Why can't we extend this to digest size starting from 1 to full length?
Why is there a limitation for half of corresponding digest size?
>
> ---
> drivers/crypto/openssl/rte_openssl_pmd.c | 19 ++++++++--------
> drivers/crypto/openssl/rte_openssl_pmd_ops.c | 24 ++++++++++----------
> 2 files changed, 22 insertions(+), 21 deletions(-)
>
> diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c
> index 7d263aba3bbd..c635f1e2493c 100644
> --- a/drivers/crypto/openssl/rte_openssl_pmd.c
> +++ b/drivers/crypto/openssl/rte_openssl_pmd.c
> @@ -1509,15 +1509,7 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
>
> srclen = op->sym->auth.data.length;
>
> - if (sess->auth.operation == RTE_CRYPTO_AUTH_OP_VERIFY)
> - dst = qp->temp_digest;
> - else {
> - dst = op->sym->auth.digest.data;
> - if (dst == NULL)
> - dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
> - op->sym->auth.data.offset +
> - op->sym->auth.data.length);
> - }
> + dst = qp->temp_digest;
>
> switch (sess->auth.mode) {
> case OPENSSL_AUTH_AS_AUTH:
> @@ -1540,6 +1532,15 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
> sess->auth.digest_length) != 0) {
> op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
> }
> + } else {
> + uint8_t *auth_dst;
> +
> + auth_dst = op->sym->auth.digest.data;
> + if (auth_dst == NULL)
> + auth_dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
> + op->sym->auth.data.offset +
> + op->sym->auth.data.length);
> + memcpy(auth_dst, dst, sess->auth.digest_length);
> }
>
> if (status != 0)
> diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
> index de2284390b12..6d3e21de404d 100644
> --- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
> +++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
> @@ -26,9 +26,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 16,
> + .min = 8,
> .max = 16,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
> @@ -68,9 +68,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 20,
> + .min = 10,
> .max = 20,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
> @@ -110,9 +110,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 28,
> + .min = 14,
> .max = 28,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
> @@ -152,9 +152,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 32,
> + .min = 16,
> .max = 32,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
> @@ -194,9 +194,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 48,
> + .min = 24,
> .max = 48,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
> @@ -236,9 +236,9 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
> .increment = 1
> },
> .digest_size = {
> - .min = 64,
> + .min = 32,
> .max = 64,
> - .increment = 0
> + .increment = 1
> },
> .iv_size = { 0 }
> }, }
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations
2018-09-25 14:46 ` Akhil Goyal
@ 2018-09-27 21:32 ` Dmitry Eremin-Solenikov
2018-09-28 10:28 ` Akhil Goyal
0 siblings, 1 reply; 4+ messages in thread
From: Dmitry Eremin-Solenikov @ 2018-09-27 21:32 UTC (permalink / raw)
To: Akhil Goyal, dev
On 25/09/18 17:46, Akhil Goyal wrote:
>
>
> On 9/16/2018 8:48 AM, Dmitry Eremin-Solenikov wrote:
>> IPsec requires truncated HMAC operations support. Extend OpenSSL crypto
>> PMD to support truncated HMAC operations necessary for IPsec.
>>
>> Signed-off-by: Dmitry Eremin-Solenikov
>> <dmitry.ereminsolenikov@linaro.org>
>> ---
>> Changes since V1:
>> - support all digest sizes from half of corresponding digest size up to
>> full length.
> Why can't we extend this to digest size starting from 1 to full length?
> Why is there a limitation for half of corresponding digest size?
Mainly because there is little point in supporting such truncated
digests. It won't be cryptographically safe.
>>
>> ---
>> drivers/crypto/openssl/rte_openssl_pmd.c | 19 ++++++++--------
>> drivers/crypto/openssl/rte_openssl_pmd_ops.c | 24 ++++++++++----------
>> 2 files changed, 22 insertions(+), 21 deletions(-)
>>
>> diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c
>> b/drivers/crypto/openssl/rte_openssl_pmd.c
>> index 7d263aba3bbd..c635f1e2493c 100644
>> --- a/drivers/crypto/openssl/rte_openssl_pmd.c
>> +++ b/drivers/crypto/openssl/rte_openssl_pmd.c
>> @@ -1509,15 +1509,7 @@ process_openssl_auth_op(struct openssl_qp *qp,
>> struct rte_crypto_op *op,
>> srclen = op->sym->auth.data.length;
>> - if (sess->auth.operation == RTE_CRYPTO_AUTH_OP_VERIFY)
>> - dst = qp->temp_digest;
>> - else {
>> - dst = op->sym->auth.digest.data;
>> - if (dst == NULL)
>> - dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
>> - op->sym->auth.data.offset +
>> - op->sym->auth.data.length);
>> - }
>> + dst = qp->temp_digest;
>> switch (sess->auth.mode) {
>> case OPENSSL_AUTH_AS_AUTH:
>> @@ -1540,6 +1532,15 @@ process_openssl_auth_op(struct openssl_qp *qp,
>> struct rte_crypto_op *op,
>> sess->auth.digest_length) != 0) {
>> op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
>> }
>> + } else {
>> + uint8_t *auth_dst;
>> +
>> + auth_dst = op->sym->auth.digest.data;
>> + if (auth_dst == NULL)
>> + auth_dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
>> + op->sym->auth.data.offset +
>> + op->sym->auth.data.length);
>> + memcpy(auth_dst, dst, sess->auth.digest_length);
>> }
>> if (status != 0)
>> diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>> b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>> index de2284390b12..6d3e21de404d 100644
>> --- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>> +++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>> @@ -26,9 +26,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 16,
>> + .min = 8,
>> .max = 16,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>> @@ -68,9 +68,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 20,
>> + .min = 10,
>> .max = 20,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>> @@ -110,9 +110,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 28,
>> + .min = 14,
>> .max = 28,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>> @@ -152,9 +152,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 32,
>> + .min = 16,
>> .max = 32,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>> @@ -194,9 +194,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 48,
>> + .min = 24,
>> .max = 48,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>> @@ -236,9 +236,9 @@ static const struct rte_cryptodev_capabilities
>> openssl_pmd_capabilities[] = {
>> .increment = 1
>> },
>> .digest_size = {
>> - .min = 64,
>> + .min = 32,
>> .max = 64,
>> - .increment = 0
>> + .increment = 1
>> },
>> .iv_size = { 0 }
>> }, }
>
--
With best wishes
Dmitry
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations
2018-09-27 21:32 ` Dmitry Eremin-Solenikov
@ 2018-09-28 10:28 ` Akhil Goyal
0 siblings, 0 replies; 4+ messages in thread
From: Akhil Goyal @ 2018-09-28 10:28 UTC (permalink / raw)
To: Dmitry Eremin-Solenikov, dev
On 9/28/2018 3:02 AM, Dmitry Eremin-Solenikov wrote:
> On 25/09/18 17:46, Akhil Goyal wrote:
>>
>> On 9/16/2018 8:48 AM, Dmitry Eremin-Solenikov wrote:
>>> IPsec requires truncated HMAC operations support. Extend OpenSSL crypto
>>> PMD to support truncated HMAC operations necessary for IPsec.
>>>
>>> Signed-off-by: Dmitry Eremin-Solenikov
>>> <dmitry.ereminsolenikov@linaro.org>
>>> ---
>>> Changes since V1:
>>> - support all digest sizes from half of corresponding digest size up to
>>> full length.
>> Why can't we extend this to digest size starting from 1 to full length?
>> Why is there a limitation for half of corresponding digest size?
> Mainly because there is little point in supporting such truncated
> digests. It won't be cryptographically safe.
I believe we shall let the application decide the digest size and not
make this a limitation of PMD.
>
>>> ---
>>> drivers/crypto/openssl/rte_openssl_pmd.c | 19 ++++++++--------
>>> drivers/crypto/openssl/rte_openssl_pmd_ops.c | 24 ++++++++++----------
>>> 2 files changed, 22 insertions(+), 21 deletions(-)
>>>
>>> diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c
>>> b/drivers/crypto/openssl/rte_openssl_pmd.c
>>> index 7d263aba3bbd..c635f1e2493c 100644
>>> --- a/drivers/crypto/openssl/rte_openssl_pmd.c
>>> +++ b/drivers/crypto/openssl/rte_openssl_pmd.c
>>> @@ -1509,15 +1509,7 @@ process_openssl_auth_op(struct openssl_qp *qp,
>>> struct rte_crypto_op *op,
>>> srclen = op->sym->auth.data.length;
>>> - if (sess->auth.operation == RTE_CRYPTO_AUTH_OP_VERIFY)
>>> - dst = qp->temp_digest;
>>> - else {
>>> - dst = op->sym->auth.digest.data;
>>> - if (dst == NULL)
>>> - dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
>>> - op->sym->auth.data.offset +
>>> - op->sym->auth.data.length);
>>> - }
>>> + dst = qp->temp_digest;
>>> switch (sess->auth.mode) {
>>> case OPENSSL_AUTH_AS_AUTH:
>>> @@ -1540,6 +1532,15 @@ process_openssl_auth_op(struct openssl_qp *qp,
>>> struct rte_crypto_op *op,
>>> sess->auth.digest_length) != 0) {
>>> op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
>>> }
>>> + } else {
>>> + uint8_t *auth_dst;
>>> +
>>> + auth_dst = op->sym->auth.digest.data;
>>> + if (auth_dst == NULL)
>>> + auth_dst = rte_pktmbuf_mtod_offset(mbuf_dst, uint8_t *,
>>> + op->sym->auth.data.offset +
>>> + op->sym->auth.data.length);
>>> + memcpy(auth_dst, dst, sess->auth.digest_length);
>>> }
>>> if (status != 0)
>>> diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>>> b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>>> index de2284390b12..6d3e21de404d 100644
>>> --- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>>> +++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
>>> @@ -26,9 +26,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 16,
>>> + .min = 8,
>>> .max = 16,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>>> @@ -68,9 +68,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 20,
>>> + .min = 10,
>>> .max = 20,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>>> @@ -110,9 +110,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 28,
>>> + .min = 14,
>>> .max = 28,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>>> @@ -152,9 +152,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 32,
>>> + .min = 16,
>>> .max = 32,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>>> @@ -194,9 +194,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 48,
>>> + .min = 24,
>>> .max = 48,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>>> @@ -236,9 +236,9 @@ static const struct rte_cryptodev_capabilities
>>> openssl_pmd_capabilities[] = {
>>> .increment = 1
>>> },
>>> .digest_size = {
>>> - .min = 64,
>>> + .min = 32,
>>> .max = 64,
>>> - .increment = 0
>>> + .increment = 1
>>> },
>>> .iv_size = { 0 }
>>> }, }
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-09-28 10:28 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-16 3:18 [dpdk-dev] [PATCH v2] crypto/openssl: support truncated HMAC operations Dmitry Eremin-Solenikov
2018-09-25 14:46 ` Akhil Goyal
2018-09-27 21:32 ` Dmitry Eremin-Solenikov
2018-09-28 10:28 ` Akhil Goyal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).