diff options
| author | Jason A. Donenfeld <Jason@zx2c4.com> | 2020-05-11 23:51:01 +0200 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2020-06-02 18:22:31 +0200 |
| commit | 521fd61c84a19b31dfbaa8dde3d2577e4e115d12 (patch) | |
| tree | 7b7ab3cf346080b9cb2a1ab022330bed3b7e1f99 /security/keys/Kconfig | |
| parent | KEYS: Replace zero-length array with flexible-array (diff) | |
| download | linux-521fd61c84a19b31dfbaa8dde3d2577e4e115d12.tar.xz linux-521fd61c84a19b31dfbaa8dde3d2577e4e115d12.zip | |
security/keys: rewrite big_key crypto to use library interface
A while back, I noticed that the crypto and crypto API usage in big_keys
were entirely broken in multiple ways, so I rewrote it. Now, I'm
rewriting it again, but this time using the simpler ChaCha20Poly1305
library function. This makes the file considerably more simple; the
diffstat alone should justify this commit. It also should be faster,
since it no longer requires a mutex around the "aead api object" (nor
allocations), allowing us to encrypt multiple items in parallel. We also
benefit from being able to pass any type of pointer, so we can get rid
of the ridiculously complex custom page allocator that big_key really
doesn't need.
[DH: Change the select CRYPTO_LIB_CHACHA20POLY1305 to a depends on as
select doesn't propagate and the build can end up with an =y dependending
on some =m pieces.
The depends on CRYPTO also had to be removed otherwise the configurator
complains about a recursive dependency.]
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: kernel-hardening@lists.openwall.com
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'security/keys/Kconfig')
| -rw-r--r-- | security/keys/Kconfig | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/security/keys/Kconfig b/security/keys/Kconfig index 47c041563d41..8153ea01d7bb 100644 --- a/security/keys/Kconfig +++ b/security/keys/Kconfig @@ -60,9 +60,7 @@ config BIG_KEYS bool "Large payload keys" depends on KEYS depends on TMPFS - select CRYPTO - select CRYPTO_AES - select CRYPTO_GCM + depends on CRYPTO_LIB_CHACHA20POLY1305 = y help This option provides support for holding large keys within the kernel (for example Kerberos ticket caches). The data may be stored out to |