mirror_zfs/module/icp
Rob Norris 7f05fface3 gcm_avx_init: zero the ghash state after hashing the IV
IVs != 96 bits get hashed with GHASH to bring them to 96 bits. Any call
to GHASH will mix the ghash state in gcm_ghash. This is expected to be
zero at first use in an encrypt or decrypt operation, so it needs to be
zeroed after using GHASH in setup.

gcm_init() does this, but gcm_avx_init() zeroed it before setup, not
after, resulting in incorrect encrypt/decrypt results when using AVX GCM
with an IV != 96 bits.

OpenZFS _always_ uses a 96 bit IV (ZIO_DATA_IV_LEN) so this will never
have been hit in any real-world use, which is extremely fortunate, as we
would have incorrectly-encrypted data on-disk. Still, as long as we have
this code here we should make sure it's correct.

Thanks-to: Joel Low <joel@joelsplace.sg>
Sponsored-by: https://despairlabs.com/sponsor/
Signed-off-by: Rob Norris <robn@despairlabs.com>
Reviewed-by: Tony Hutter <hutter2@llnl.gov>
Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de>
Reviewed-by: Attila Fülöp <attila@fueloep.org>
2025-02-25 17:31:08 -08:00
..
algs gcm_avx_init: zero the ghash state after hashing the IV 2025-02-25 17:31:08 -08:00
api Cleanup: Remove unnecessary explicit casts of pointers from allocators 2023-01-12 15:59:12 -08:00
asm-aarch64 Fix: FreeBSD Arm64 does not build currently 2024-04-19 10:15:38 -07:00
asm-arm/sha2 module/icp/asm-arm/sha2: enable non-SIMD asm kernels on armv5/6 2023-12-05 12:01:09 -08:00
asm-ppc64 powerpc64: Support ELFv2 asm on Big Endian 2023-04-27 12:49:21 -07:00
asm-x86_64 Restore ASMABI and other Unify work 2023-03-06 15:24:05 -08:00
core icp: remove digest entry points 2024-05-31 15:13:16 -07:00
include icp: remove unused headers 2024-05-31 15:13:51 -07:00
io icp: remove skein module 2024-05-31 15:13:39 -07:00
spi Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
illumos-crypto.c icp: remove redundant FreeBSD check 2024-05-31 15:13:59 -07:00