aboutsummaryrefslogtreecommitdiff
path: root/sys/modules/crypto
Commit message (Collapse)AuthorAgeFilesLines
* modules/crypto: reenable assembly optimized skein implementationEd Maste2020-10-101-8/+12
| | | | | | | | | | | | | | r366344 corrected the optimized amd64 skein assembly implementation, so we can now enable it again. Also add a dependency on this Makefile for the skein_block object, so that it will be rebuit (similar to r366362). PR: 248221 Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=366596
* modules/crypto: disable optimized assembly skein1024 implementationEd Maste2020-07-231-8/+8
| | | | | | | | | It is presumably broken in the same way as userland skein1024 (see r363454) PR: 248221 Notes: svn path=/head/; revision=363455
* Rename skein_block_asm.s to .S and assemble using Clang IASEd Maste2020-06-061-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Comparing the object files produced by GNU as 2.17.50 and Clang IAS shows many immaterial changes in strtab etc., and one material change in .text: 1bac: 4c 8b 4f 18 mov 0x18(%rdi),%r9 1bb0: eb 0e jmp 1bc0 <Skein1024_block_loop> - 1bb2: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) - 1bb9: 00 00 00 00 - 1bbd: 0f 1f 00 nopl (%rax) + 1bb2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) + 1bb9: 00 00 00 + 1bbc: 0f 1f 40 00 nopl 0x0(%rax) 0000000000001bc0 <Skein1024_block_loop>: Skein1024_block_loop(): 1bc0: 4c 8b 47 10 mov 0x10(%rdi),%r8 1bc4: 4c 03 85 c0 00 00 00 add 0xc0(%rbp),%r8 That is, GNU as and Clang's integrated assembler use different multi- byte NOPs for alignment (GNU as emits an 11 byte NOP + a 3 byte NOP, while Clang IAS emits a 10 byte NOP + a 4 byte NOP). Dependency cleanup hacks are not required, because we do not create .depend files from GNU as. Reviewed by: allanjude, arichardson, cem, tsoome Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D8434 Notes: svn path=/head/; revision=361853
* Also pass SKEIN_USE_ASM to the assembler, via AFLAGSEd Maste2020-06-051-1/+1
| | | | Notes: svn path=/head/; revision=361845
* Apply C SKEIN_LOOP setting only to skein_block.cEd Maste2020-06-051-1/+1
| | | | | | | | Otherwise if assembling skein_block_asm.s with Clang's integrated assembler we can pass conflicting SKEIN_LOOP settings (via CFLAGS and ACFLAGS). Notes: svn path=/head/; revision=361840
* Add opt_compat.h needed by r359374.John Baldwin2020-06-031-0/+1
| | | | | | | Reported by: kevans Notes: svn path=/head/; revision=361779
* Remove support for the Blowfish algorithm from OCF.John Baldwin2020-05-111-2/+0
| | | | | | | | | | | | It no longer has any in-kernel consumers. Reviewed by: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24772 Notes: svn path=/head/; revision=360931
* Remove support for the skipjack encryption algorithm.John Baldwin2020-05-111-1/+1
| | | | | | | | | | | | | This was removed from IPsec in r286100 and no longer has any in-tree consumers. Reviewed by: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24769 Notes: svn path=/head/; revision=360924
* Remove support for the cast128 encryption algorithm.John Baldwin2020-05-111-1/+1
| | | | | | | | | | | | It no longer has any in-tree consumers. Reviewed by: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24768 Notes: svn path=/head/; revision=360923
* Expose zlib's utility functions in Z_SOLO library when building kernel.Xin LI2019-08-071-1/+0
| | | | | | | | | | | | This allows kernel code to reuse zlib's implementation. PR: 229763 Reviewed by: Yoshihiro Ota <ota j email ne jp> Relnotes: yes Differential Revision: https://reviews.freebsd.org/D21156 Notes: svn path=/head/; revision=350670
* Allow Kernel to link in both legacy libkern/zlib and new sys/contrib/zlib,Xin LI2019-08-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | with an eventual goal to convert all legacl zlib callers to the new zlib version: * Move generic zlib shims that are not specific to zlib 1.0.4 to sys/dev/zlib. * Connect new zlib (1.2.11) to the zlib kernel module, currently built with Z_SOLO. * Prefix the legacy zlib (1.0.4) with 'zlib104_' namespace. * Convert sys/opencrypto/cryptodeflate.c to use new zlib. * Remove bundled zlib 1.2.3 from ZFS and adapt it to new zlib and make it depend on the zlib module. * Fix Z_SOLO build of new zlib. PR: 229763 Submitted by: Yoshihiro Ota <ota j email ne jp> Reviewed by: markm (sys/dev/zlib/zlib_kmod.c) Relnotes: yes Differential Revision: https://reviews.freebsd.org/D19706 Notes: svn path=/head/; revision=350496
* Add CBC-MAC authentication.Sean Eric Fagan2019-02-151-0/+2
| | | | | | | | | | | | | | | | This adds the CBC-MAC code to the kernel, but does not hook it up to anything (that comes in the next commit). https://tools.ietf.org/html/rfc3610 describes the algorithm. Note that this is a software-only implementation, which means it is fairly slow. Sponsored by: iXsystems Inc Differential Revision: https://reviews.freebsd.org/D18592 Notes: svn path=/head/; revision=344140
* Add xform-conforming auth_hash wrapper for Poly-1305Conrad Meyer2018-08-171-0/+22
| | | | | | | | | | | | The wrapper is a thin shim around libsodium's Poly-1305 implementation. For now, we just use the C algorithm and do not attempt to build the SSE-optimized variant for x86 processors. The algorithm support has not yet been plumbed through cryptodev, or added to cryptosoft. Notes: svn path=/head/; revision=337939
* Silence non-actionable warnings in vendor codeMatt Macy2018-05-191-2/+2
| | | | | | | | | We can't modify vendor code so there's no signal in warnings from it. Similarly -Waddress-of-packed-member is not useful on networking code as access to packed structures is fundamental to its operation. Notes: svn path=/head/; revision=333819
* blake2: Disable warnings (not just error) for code we will not modifyConrad Meyer2018-04-211-2/+2
| | | | | | | Leave libb2 pristine and silence the warnings for mjg. Notes: svn path=/head/; revision=332853
* opencrypto: Integrate Chacha20 algorithm into OCFConrad Meyer2018-03-291-0/+3
| | | | | | | | | | | Mostly this is a thin shim around existing code to integrate with enc_xform and cryptosoft (+ cryptodev). Expand the cryptodev buffer used to match that of Chacha20's native block size as a performance enhancement for chacha20_xform_crypt_multi. Notes: svn path=/head/; revision=331724
* Import Blake2 algorithms (blake2b, blake2s) from libb2Conrad Meyer2018-03-211-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The upstream repository is on github BLAKE2/libb2. Files landed in sys/contrib/libb2 are the unmodified upstream files, except for one difference: secure_zero_memory's contents have been replaced with explicit_bzero() only because the previous implementation broke powerpc link. Preferential use of explicit_bzero() is in progress upstream, so it is anticipated we will be able to drop this diff in the future. sys/crypto/blake2 contains the source files needed to port libb2 to our build system, a wrapped (limited) variant of the algorithm to match the API of our auth_transform softcrypto abstraction, incorporation into the Open Crypto Framework (OCF) cryptosoft(4) driver, as well as an x86 SSE/AVX accelerated OCF driver, blake2(4). Optimized variants of blake2 are compiled for a number of x86 machines (anything from SSE2 to AVX + XOP). On those machines, FPU context will need to be explicitly saved before using blake2(4)-provided algorithms directly. Use via cryptodev / OCF saves FPU state automatically, and use via the auth_transform softcrypto abstraction does not use FPU. The intent of the OCF driver is mostly to enable testing in userspace via /dev/crypto. ATF tests are added with published KAT test vectors to validate correctness. Reviewed by: jhb, markj Obtained from: github BLAKE2/libb2 Differential Revision: https://reviews.freebsd.org/D14662 Notes: svn path=/head/; revision=331312
* Increase loop unrolling for skein hashesAllan Jude2017-07-011-0/+4
| | | | | | | | | | | | | | | This patch was inspired by an opposite change made to shrink the code for the boot loader. On my i7-4770, it increases the skein1024 speed from 470 to 550 MB/s Reviewed by: sbruno MFC after: 1 month Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D7824 Notes: svn path=/head/; revision=320554
* sys/modules: normalize .CURDIR-relative paths to SRCTOPEnji Cooper2017-03-041-10/+10
| | | | | | | | | | | This simplifies make output/logic Tested with: `cd sys/modules; make ALL_MODULES=` on amd64 MFC after: 1 month Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314651
* Import the skein hashing algorithm, based on the threefish block cipherAllan Jude2016-05-291-0/+8
| | | | | | | | | | | | | | | | Connect it to userland (libmd, libcrypt, sbin/md5) and kernel (crypto.ko) Support for skein as a ZFS checksum algorithm was introduced in r289422 but is disconnected because FreeBSD lacked a Skein implementation. A further commit will enable it in ZFS. Reviewed by: cem Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D6166 Notes: svn path=/head/; revision=300921
* Replace sys/crypto/sha2/sha2.c with lib/libmd/sha512c.cAllan Jude2015-12-271-1/+1
| | | | | | | | | | | | | | | | | | | | | cperciva's libmd implementation is 5-30% faster The same was done for SHA256 previously in r263218 cperciva's implementation was lacking SHA-384 which I implemented, validated against OpenSSL and the NIST documentation Extend sbin/md5 to create sha384(1) Chase dependancies on sys/crypto/sha2/sha2.{c,h} and replace them with sha512{c.c,.h} Reviewed by: cperciva, des, delphij Approved by: secteam, bapt (mentor) MFC after: 2 weeks Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D3929 Notes: svn path=/head/; revision=292782
* Huge cleanup of random(4) code.Mark Murray2015-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * GENERAL - Update copyright. - Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set neither to ON, which means we want Fortuna - If there is no 'device random' in the kernel, there will be NO random(4) device in the kernel, and the KERN_ARND sysctl will return nothing. With RANDOM_DUMMY there will be a random(4) that always blocks. - Repair kern.arandom (KERN_ARND sysctl). The old version went through arc4random(9) and was a bit weird. - Adjust arc4random stirring a bit - the existing code looks a little suspect. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Redo read_random(9) so as to duplicate random(4)'s read internals. This makes it a first-class citizen rather than a hack. - Move stuff out of locked regions when it does not need to be there. - Trim RANDOM_DEBUG printfs. Some are excess to requirement, some behind boot verbose. - Use SYSINIT to sequence the startup. - Fix init/deinit sysctl stuff. - Make relevant sysctls also tunables. - Add different harvesting "styles" to allow for different requirements (direct, queue, fast). - Add harvesting of FFS atime events. This needs to be checked for weighing down the FS code. - Add harvesting of slab allocator events. This needs to be checked for weighing down the allocator code. - Fix the random(9) manpage. - Loadable modules are not present for now. These will be re-engineered when the dust settles. - Use macros for locks. - Fix comments. * src/share/man/... - Update the man pages. * src/etc/... - The startup/shutdown work is done in D2924. * src/UPDATING - Add UPDATING announcement. * src/sys/dev/random/build.sh - Add copyright. - Add libz for unit tests. * src/sys/dev/random/dummy.c - Remove; no longer needed. Functionality incorporated into randomdev.*. * live_entropy_sources.c live_entropy_sources.h - Remove; content moved. - move content to randomdev.[ch] and optimise. * src/sys/dev/random/random_adaptors.c src/sys/dev/random/random_adaptors.h - Remove; plugability is no longer used. Compile-time algorithm selection is the way to go. * src/sys/dev/random/random_harvestq.c src/sys/dev/random/random_harvestq.h - Add early (re)boot-time randomness caching. * src/sys/dev/random/randomdev_soft.c src/sys/dev/random/randomdev_soft.h - Remove; no longer needed. * src/sys/dev/random/uint128.h - Provide a fake uint128_t; if a real one ever arrived, we can use that instead. All that is needed here is N=0, N++, N==0, and some localised trickery is used to manufacture a 128-bit 0ULLL. * src/sys/dev/random/unit_test.c src/sys/dev/random/unit_test.h - Improve unit tests; previously the testing human needed clairvoyance; now the test will do a basic check of compressibility. Clairvoyant talent is still a good idea. - This is still a long way off a proper unit test. * src/sys/dev/random/fortuna.c src/sys/dev/random/fortuna.h - Improve messy union to just uint128_t. - Remove unneeded 'static struct fortuna_start_cache'. - Tighten up up arithmetic. - Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing. - Assert that locks are held correctly. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Turn into self-sufficient module (no longer requires randomdev_soft.[ch]) * src/sys/dev/random/yarrow.c src/sys/dev/random/yarrow.h - Improve messy union to just uint128_t. - Remove unneeded 'staic struct start_cache'. - Tighten up up arithmetic. - Provide a method to allow eternal junk to be introduced; harden it against blatant by compress/hashing. - Assert that locks are held correctly. - Fix the nasty pre- and post-read overloading by providing explictit functions to do these tasks. - Turn into self-sufficient module (no longer requires randomdev_soft.[ch]) - Fix some magic numbers elsewhere used as FAST and SLOW. Differential Revision: https://reviews.freebsd.org/D2025 Reviewed by: vsevolod,delphij,rwatson,trasz,jmg Approved by: so (delphij) Notes: svn path=/head/; revision=284959
* Add some new modes to OpenCrypto. These modes are AES-ICM (can be usedJohn-Mark Gurney2014-12-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for counter mode), and AES-GCM. Both of these modes have been added to the aesni module. Included is a set of tests to validate that the software and aesni module calculate the correct values. These use the NIST KAT test vectors. To run the test, you will need to install a soon to be committed port, nist-kat that will install the vectors. Using a port is necessary as the test vectors are around 25MB. All the man pages were updated. I have added a new man page, crypto.7, which includes a description of how to use each mode. All the new modes and some other AES modes are present. It would be good for someone else to go through and document the other modes. A new ioctl was added to support AEAD modes which AES-GCM is one of them. Without this ioctl, it is not possible to test AEAD modes from userland. Add a timing safe bcmp for use to compare MACs. Previously we were using bcmp which could leak timing info and result in the ability to forge messages. Add a minor optimization to the aesni module so that single segment mbufs don't get copied and instead are updated in place. The aesni module needs to be updated to support blocked IO so segmented mbufs don't have to be copied. We require that the IV be specified for all calls for both GCM and ICM. This is to ensure proper use of these functions. Obtained from: p4: //depot/projects/opencrypto Relnotes: yes Sponsored by: FreeBSD Foundation Sponsored by: NetGate Notes: svn path=/head/; revision=275732
* I clearly didn't test the modules... add sha256c.c to the variousJohn-Mark Gurney2014-03-161-1/+1
| | | | | | | modules that included sha2.c... Notes: svn path=/head/; revision=263219
* Add siphash.c. While here, sort.Marcel Moolenaar2014-03-061-2/+5
| | | | Notes: svn path=/head/; revision=262817
* Chase down cryptodeflate.c change from r259109.Alfred Perlstein2013-12-091-1/+1
| | | | Notes: svn path=/head/; revision=259114
* - For kernel compiled only with KDTRACE_HOOKS and not any lock debuggingAttilio Rao2013-11-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the inlined version of the releasing functions for mutex, rwlock and sxlock. Failing to do so skips the lockstat_probe_func invokation for unlocking. - As part of the LOCKSTAT support is inlined in mutex operation, for kernel compiled without lock debugging options, potentially every consumer must be compiled including opt_kdtrace.h. Fix this by moving KDTRACE_HOOKS into opt_global.h and remove the dependency by opt_kdtrace.h for all files, as now only KDTRACE_FRAMES is linked there and it is only used as a compile-time stub [0]. [0] immediately shows some new bug as DTRACE-derived support for debug in sfxge is broken and it was never really tested. As it was not including correctly opt_kdtrace.h before it was never enabled so it was kept broken for a while. Fix this by using a protection stub, leaving sfxge driver authors the responsibility for fixing it appropriately [1]. Sponsored by: EMC / Isilon storage division Discussed with: rstone [0] Reported by: rstone [1] Discussed with: philip Notes: svn path=/head/; revision=258541
* List low-level Blowfish ECB module in the SRCS. It looks like it was droppedIvan Voras2010-09-121-1/+1
| | | | | | | | | | by accident (and it would be inconvenient to implement it otherwise because it uses internal non-published headers). MFC after: 1 week Notes: svn path=/head/; revision=212496
* After adding an SDT provider for opencrypto in r199884 we should alsoBjoern A. Zeeb2010-01-071-1/+1
| | | | | | | | | | depend on opt_kdtrace.h for the module build. Submitted by: (Andre.Albsmeier siemens.com) MFC after: 3 days Notes: svn path=/head/; revision=201742
* Integrate the Camellia Block Cipher. For more information see RFC 4132George V. Neville-Neil2007-05-091-1/+2
| | | | | | | | | | and its bibliography. Submitted by: Tomoyuki Okazaki <okazaki at kick dot gr dot jp> MFC after: 1 month Notes: svn path=/head/; revision=169425
* catchup w/ crypto changesSam Leffler2007-03-211-2/+3
| | | | Notes: svn path=/head/; revision=167764
* This patch fixes a problem, which exists if you have IPSEC in your kernelWojciech A. Koszek2006-02-271-2/+0
| | | | | | | | | | | | | | and want to have crypto support loaded as KLD. By moving zlib to separate module and adding MODULE_DEPEND directives, it is possible to use such configuration without complication. Otherwise, since IPSEC is linked with zlib (just like crypto.ko) you'll get following error: interface zlib.1 already present in the KLD 'kernel'! Approved by: cognet (mentor) Notes: svn path=/head/; revision=156072
* just use crypto/rijndael, and nuke opencrypto/rindael.[ch].Hajimu UMEMOTO2005-03-111-2/+3
| | | | | | | | | the two became almost identical since latest KAME merge. Discussed with: sam Notes: svn path=/head/; revision=143423
* Push m_apply() and m_getptr() up into the colleciton of standard mbufBruce M Simpson2003-12-151-1/+1
| | | | | | | | | | | routines, and purge them from opencrypto. Reviewed by: sam Obtained from: NetBSD Sponsored by: spc.org Notes: svn path=/head/; revision=123557
* Module-ize the 'core' crypto stuff. This may still need to be compiledMark Murray2002-10-161-0/+20
into the kernel by default (if required), but other modules can now depend() on this. Fix inter-module dependancy. Earlier version OK'ed by: sam Notes: svn path=/head/; revision=105251
generated by cgit v1.3 (git 2.53.0) at 2026-04-01 21:48:43 +0000