Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1667266
| From | Eric Biggers <ebiggers3@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v4] fscrypt: Add support for AES-128-CBC |
| Date | 2017-06-15 22:50 +0200 |
| Message-ID | <tSJSi-7i5-31@gated-at.bofh.it> (permalink) |
| References | <tIbyy-6u4-21@gated-at.bofh.it> <tKaoF-7aM-13@gated-at.bofh.it> <tSJSh-7i5-13@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Jun 15, 2017 at 01:41:29PM -0700, Michael Halcrow wrote:
> > static int validate_user_key(struct fscrypt_info *crypt_info,
> > struct fscrypt_context *ctx, u8 *raw_key,
> > - const char *prefix)
> > + const char *prefix, int min_keysize)
> > {
> > char *description;
> > struct key *keyring_key;
> > @@ -111,50 +116,60 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
> > master_key = (struct fscrypt_key *)ukp->data;
> > BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE);
> >
> > - if (master_key->size != FS_AES_256_XTS_KEY_SIZE) {
> > + if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE
> > + || master_key->size % AES_BLOCK_SIZE != 0) {
>
> I suggest validating the provided key size directly against the mode.
> Else, it looks to me that this code will accept a 128-bit key for
> AES-256.
>
It's doing that already; min_keysize depends on the mode.
Eric
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [PATCH v4] fscrypt: Add support for AES-128-CBC Michael Halcrow <mhalcrow@google.com> - 2017-06-15 22:50 +0200
Re: [PATCH v4] fscrypt: Add support for AES-128-CBC Eric Biggers <ebiggers3@gmail.com> - 2017-06-15 22:50 +0200
Re: [PATCH v4] fscrypt: Add support for AES-128-CBC David Gstir <david@sigma-star.at> - 2017-06-16 09:40 +0200
[PATCH v5] fscrypt: Add support for AES-128-CBC David Gstir <david@sigma-star.at> - 2017-06-19 09:30 +0200
csiph-web