crypto: aegis - fix handling chunked inputs
authorEric Biggers <ebiggers@google.com>
Fri, 1 Feb 2019 07:51:36 +0000 (23:51 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Mar 2019 19:09:54 +0000 (20:09 +0100)
commit4c152af938cec61614955a631b8f70278428ac34
tree767bcd9b95f4b4a9505430f803e5d7dbab761a33
parent736807d6915735c0e8f6ac5bae45e9ce04fe8c50
crypto: aegis - fix handling chunked inputs

commit 0f533e67d26f228ea5dfdacc8a4bdeb487af5208 upstream.

The generic AEGIS implementations all fail the improved AEAD tests
because they produce the wrong result with some data layouts.  The issue
is that they assume that if the skcipher_walk API gives 'nbytes' not
aligned to the walksize (a.k.a. walk.stride), then it is the end of the
data.  In fact, this can happen before the end.  Fix them.

Fixes: f606a88e5823 ("crypto: aegis - Add generic AEGIS AEAD implementations")
Cc: <stable@vger.kernel.org> # v4.18+
Cc: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto/aegis128.c
crypto/aegis128l.c
crypto/aegis256.c