summaryrefslogtreecommitdiffstats
path: root/crypto/curve25519-generic.c
diff options
context:
space:
mode:
authorNathan Huckleberry <nhuck@google.com>2022-05-20 20:14:55 +0200
committerHerbert Xu <herbert@gondor.apana.org.au>2022-06-10 10:40:17 +0200
commit7ff554ced7c7d7cf77586e07474e8633e011e2d0 (patch)
tree3b9b6864e6017646f744d52e6b4cbf905080c13a /crypto/curve25519-generic.c
parentcrypto: polyval - Add POLYVAL support (diff)
downloadlinux-7ff554ced7c7d7cf77586e07474e8633e011e2d0.tar.xz
linux-7ff554ced7c7d7cf77586e07474e8633e011e2d0.zip
crypto: hctr2 - Add HCTR2 support
Add support for HCTR2 as a template. HCTR2 is a length-preserving encryption mode that is efficient on processors with instructions to accelerate AES and carryless multiplication, e.g. x86 processors with AES-NI and CLMUL, and ARM processors with the ARMv8 Crypto Extensions. As a length-preserving encryption mode, HCTR2 is suitable for applications such as storage encryption where ciphertext expansion is not possible, and thus authenticated encryption cannot be used. Currently, such applications usually use XTS, or in some cases Adiantum. XTS has the disadvantage that it is a narrow-block mode: a bitflip will only change 16 bytes in the resulting ciphertext or plaintext. This reveals more information to an attacker than necessary. HCTR2 is a wide-block mode, so it provides a stronger security property: a bitflip will change the entire message. HCTR2 is somewhat similar to Adiantum, which is also a wide-block mode. However, HCTR2 is designed to take advantage of existing crypto instructions, while Adiantum targets devices without such hardware support. Adiantum is also designed with longer messages in mind, while HCTR2 is designed to be efficient even on short messages. HCTR2 requires POLYVAL and XCTR as components. More information on HCTR2 can be found here: "Length-preserving encryption with HCTR2": https://eprint.iacr.org/2021/1441.pdf Signed-off-by: Nathan Huckleberry <nhuck@google.com> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/curve25519-generic.c')
0 files changed, 0 insertions, 0 deletions