summaryrefslogtreecommitdiffstats
path: root/sys/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* spellingjsg2021-03-122-4/+4
|
* Add missing CVS tags.tobhe2020-07-2212-0/+12
| | | | ok patrick@
* don't try to expand alignment using __aligned(16) on local variables.deraadt2020-06-271-4/+2
| | | | | | that stops being normal C. the object type has to be sufficient, if it needed larger alignment such a type or a union should be used instead. (breaks landisk gcc, for one)
* kernel: use gettime(9)/getuptime(9) in lieu of time_second(9)/time_uptime(9)cheloha2020-06-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | time_second(9) and time_uptime(9) are widely used in the kernel to quickly get the system UTC or system uptime as a time_t. However, time_t is 64-bit everywhere, so it is not generally safe to use them on 32-bit platforms: you have a split-read problem if your hardware cannot perform atomic 64-bit reads. This patch replaces time_second(9) with gettime(9), a safer successor interface, throughout the kernel. Similarly, time_uptime(9) is replaced with getuptime(9). There is a performance cost on 32-bit platforms in exchange for eliminating the split-read problem: instead of two register reads you now have a lockless read loop to pull the values from the timehands. This is really not *too* bad in the grand scheme of things, but compared to what we were doing before it is several times slower. There is no performance cost on 64-bit (__LP64__) platforms. With input from visa@, dlg@, and tedu@. Several bugs squashed by visa@. ok kettenis@
* add constructions for wireguard.dlg2020-06-212-0/+174
| | | | | | from Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
* add hchacha20 for wireguard.dlg2020-06-211-0/+40
| | | | | | | | | | i think we should turn the chacha code into an actual c file at some point to reduce duplication of object code, but that can happen later. from Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
* curve25519 for wireguard.dlg2020-06-212-0/+933
| | | | | | via Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
* add blake2s for wireguard.dlg2020-06-212-0/+309
| | | | | | via Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
* rndvar.h not needed herederaadt2020-05-291-2/+1
|
* idgen32(9): use time_uptime(9) for rekey timestamps, not time_second(9)cheloha2020-04-151-2/+2
| | | | | | | | Timestamp contexts with a monotonic clock. time_second(9) can jump, stretching or truncating our rekey interval. time_uptime(9) will not jump around. ok djm@
* Break crypto_unregister() sanity check into two expressions, making itkrw2020-03-301-4/+6
| | | | | | clearer what is being checked. Original suggestion from kettenis@.
* Don't access past end of cc_alg[] when trying to avoidkrw2020-03-291-4/+4
| | | | | | | | unregistering an invalid algorithm. CID 1453298 ok kettenis@ (with suggested improvements to come)
* free(9) sizes.mpi2019-01-092-7/+7
| | | | ok visa@
* Add sizes for free().fcambus2018-05-311-6/+7
| | | | OK visa@
* Move some AES-related defines into xform.h to reduce duplication.visa2018-04-092-10/+10
| | | | | | gmac.c is left untouched for now to preserve layering. OK mikeb@, deraadt@
* Sync with the code in libcmikeb2018-01-051-2/+2
| | | | | | | | OK millert; original commit message by tedu@: memcpy from the right place. at this point, the used variable is not relevant. from Mark Karpilovskij. ok millert
* Fix the IPL and flags of the MP-safe crypto taskq. Now a sane IPLvisa2017-11-301-2/+2
| | | | | | | | is passed to the mutex implementation, and the queue actually runs without the kernel lock. Tested by dhill@ OK mikeb@, dhill@, kettenis@
* the userland crypto interface died long ago, can clean up the headertedu2017-08-101-36/+1
|
* make the AES-XTS mode a little more constant-time, though the AESdjm2017-05-311-5/+4
| | | | | | implementation that it depends on currently isn't. ok mikeb tom
* Revert MI AES-XTS code back to T-tables amid poor performancemikeb2017-05-172-8/+11
| | | | Suffered by many, the revert tested by stsp@.
* Switch 802.11 crypto over to the new AESmikeb2017-05-024-17/+17
| | | | OK stsp@
* Switch glxsb(4), VIA padlock and AES-NI drivers over to the new AESmikeb2017-05-021-0/+2
|
* Switch OCF and IPsec over to the new AESmikeb2017-05-025-47/+42
| | | | ok djm
* Constant time AES implementationmikeb2017-04-302-0/+922
| | | | | | | | | | This introduces a 32-bit constant time AES implementation from Thomas Pornin originally for BearSSL and then adjusted by Thomas and myself to fit OpenBSD kernel. One of the additional features is an API for encryption and decryption subkey expansion in the format specified by NIST in FIPS 197. Tested by myself and naddy@, ok djm@
* The kernel has to slightly different version of SipHash_Final but withflorian2017-04-121-4/+3
| | | | | | | | | | | | the same bug as just fixed in userland: ---------- SipHash_Final() was assuming the digest was 64-bit aligned, resulting in misaligned memory accesses with armv7 ramdisk -Os bsd.rd ping ok florian millert ---------- OK deraadt@
* Reduce the per-packet allocation costs for crypto operations (cryptop)patrick2017-02-073-32/+31
| | | | | | | | | | | | | | by pre-allocating two cryptodesc objects and storing them in an array instead of a linked list. If more than two cryptodesc objects are required use mallocarray to fetch them. Adapt the drivers to the new API. This change results in one pool-get per ESP packet instead of three. It also simplifies softraid crypto where more cryptodesc objects are allocated than used. From, with and ok markus@, ok bluhm@ "looks sane" mpi@
* The return code of crp_callback is never checked, so it is notbluhm2017-02-071-2/+2
| | | | | | | | useful to propagate the error. When an error occurs in an asynchronous network path, incrementing a counter is the right thing. There are four places where an error is not accounted, just add a comment for now. OK mpi@ visa@
* convert bcopy to memcpy. from david hilltedu2016-09-194-13/+13
|
* all pools have their ipl set via pool_setipl, so fold it into pool_init.dlg2016-09-151-7/+5
| | | | | | | | | | | | | | | | | | | | | | the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
* Remove variables 'm' and 'uio' that are only ever assigned totom2016-09-021-5/+1
| | | | | | (in swcr_authenc()) ok mikeb@, who pointed out that I'd missed uio
* Add a mechanism for dispatching mpsafe crypto operations. This adds a newkettenis2016-04-182-4/+19
| | | | | | | | CRYPTOCAP_F_MPSAFE flag that crypto implementations can set to indicate that their cc_process() implementation can safely run without holding the kernel lock. ok mikeb@
* Remove plain DES from the kernel crypto framework, including the cryptonaddy2015-12-107-168/+33
| | | | accelerator drivers. No longer used by anything. ok sthen@ mikeb@
* Cleanup gotos as suggested by jsing@ along with spaces and label namesmikeb2015-11-181-8/+7
|
* remove unused ARC4 support; ok mikeb@naddy2015-11-133-31/+20
|
* Remove unused non HMAC versions of MD5 and SHA1; ok mpi, deraadt, naddymikeb2015-11-134-70/+21
|
* remove a few unused definesmikeb2015-11-122-7/+3
|
* another define from the dsa eramikeb2015-11-121-2/+1
|
* spacingmikeb2015-11-121-2/+1
|
* Update copyright informationmikeb2015-11-073-7/+12
|
* Pass AES_GMAC context as a void pointer to cut down on casts in xform.cmikeb2015-11-073-28/+27
|
* Allow overriding ghash_update() with an optimized MD function. Usenaddy2015-11-072-6/+12
| | | | | this on amd64 to provide a version that uses the PCLMUL instruction on CPUs that support it but don't have AESNI. ok mikeb@
* Instead of multiplying with 0..1, extend the bit into a mask and do an AND.naddy2015-11-061-4/+4
| | | | The same technique was already used a few lines above. ok mikeb@
* Pass context as a void pointer to cut down on casts in xform.cmikeb2015-11-043-24/+24
|
* Remove two unused definesmikeb2015-11-031-3/+1
|
* Enable Chacha20-Poly1305 in the software crypto drivermikeb2015-11-031-1/+25
| | | | ok naddy, jsing, reyk
* Hook up Chacha20-Poly1305 to the OpenBSD Cryptographic Frameworkmikeb2015-11-033-6/+33
| | | | ok naddy, jsing
* Chacha20-Poly1305 AEAD construction as described in RFC7634 and RFC7539mikeb2015-11-032-0/+173
| | | | ok naddy, jsing
* Import Poly1305 Message Authentication Codemikeb2015-10-292-0/+326
| | | | | | | | Poly1305 is a one-time authenticator designed by Daniel J. Bernstein. This is a slightly adjusted public domain implementation by Andrew Moon found at https://github.com/floodyberry/poly1305-donna ok jsing, previous version ok djm, looked at by reyk@
* Use verbose defines instead of hardcoded values for clarity whenmikeb2015-10-271-7/+7
| | | | initializing hash objects. No binary or functional change.
* Sync chacha_ivsetup to the version in ssh so that we couldmikeb2015-10-271-4/+4
| | | | | | specify custom counter value when setting up Chacha context. ok reyk djm
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.