crypto: xts - drop xts_check_key()

xts_check_key() is obsoleted by xts_verify_key(). Over time XTS crypto
drivers adopted the newer xts_verify_key() variant, but xts_check_key()
is still used by a number of drivers. Switch drivers to use the newer
xts_verify_key() and make a couple of cleanups. This allows us to drop
xts_check_key() completely and avoid redundancy.

Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index a279b7d..29dc827 100644 (file)
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -474,7 +474,7 @@ static int xts_paes_set_key(struct crypto_skcipher *tfm, const u8 *in_key,
                return rc;
 
        /*
-        * xts_check_key verifies the key length is not odd and makes
+        * xts_verify_key verifies the key length is not odd and makes
         * sure that the two keys are not the same. This can be done
         * on the two protected keys as well
         */

diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index 063394c..e90e4a6 100644 (file)
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -1879,7 +1879,7 @@ static int atmel_aes_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
        struct atmel_aes_xts_ctx *ctx = crypto_skcipher_ctx(tfm);
        int err;
 
-       err = xts_check_key(crypto_skcipher_tfm(tfm), key, keylen);
+       err = xts_verify_key(tfm, key, keylen);
        if (err)
                return err;
 

diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
index 51c66af..f6f41e3 100644 (file)
--- a/drivers/crypto/axis/artpec6_crypto.c
+++ b/drivers/crypto/axis/artpec6_crypto.c
@@ -1621,7 +1621,7 @@ artpec6_crypto_xts_set_key(struct crypto_skcipher *cipher, const u8 *key,
                crypto_skcipher_ctx(cipher);
        int ret;
 
-       ret = xts_check_key(&cipher->base, key, keylen);
+       ret = xts_verify_key(cipher, key, keylen);
        if (ret)
                return ret;
 

diff --git a/drivers/crypto/cavium/cpt/cptvf_algs.c b/drivers/crypto/cavium/cpt/cptvf_algs.c
index 9eca0c3..0b38c26 100644 (file)
--- a/drivers/crypto/cavium/cpt/cptvf_algs.c
+++ b/drivers/crypto/cavium/cpt/cptvf_algs.c
@@ -232,13 +232,12 @@ static int cvm_decrypt(struct skcipher_request *req)
 static int cvm_xts_setkey(struct crypto_skcipher *cipher, const u8 *key,
                   u32 keylen)
 {
-       struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
-       struct cvm_enc_ctx *ctx = crypto_tfm_ctx(tfm);
+       struct cvm_enc_ctx *ctx = crypto_skcipher_ctx(cipher);
        int err;
        const u8 *key1 = key;
        const u8 *key2 = key + (keylen / 2);
 
-       err = xts_check_key(tfm, key, keylen);
+       err = xts_verify_key(cipher, key, keylen);
        if (err)
                return err;
        ctx->key_len = keylen;
@@ -289,8 +288,7 @@ static int cvm_validate_keylen(struct cvm_enc_ctx *ctx, u32 keylen)
 static int cvm_setkey(struct crypto_skcipher *cipher, const u8 *key,
                      u32 keylen, u8 cipher_type)
 {
-       struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
-       struct cvm_enc_ctx *ctx = crypto_tfm_ctx(tfm);
+       struct cvm_enc_ctx *ctx = crypto_skcipher_ctx(cipher);
 
        ctx->cipher_type = cipher_type;
        if (!cvm_validate_keylen(ctx, keylen)) {

diff --git a/drivers/crypto/cavium/nitrox/nitrox_skcipher.c b/drivers/crypto/cavium/nitrox/nitrox_skcipher.c
index 248b4ff..138261d 100644 (file)
--- a/drivers/crypto/cavium/nitrox/nitrox_skcipher.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_skcipher.c
@@ -337,12 +337,11 @@ static int nitrox_3des_decrypt(struct skcipher_request *skreq)
 static int nitrox_aes_xts_setkey(struct crypto_skcipher *cipher,
                                 const u8 *key, unsigned int keylen)
 {
-       struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
-       struct nitrox_crypto_ctx *nctx = crypto_tfm_ctx(tfm);
+       struct nitrox_crypto_ctx *nctx = crypto_skcipher_ctx(cipher);
        struct flexi_crypto_context *fctx;
        int aes_keylen, ret;
 
-       ret = xts_check_key(tfm, key, keylen);
+       ret = xts_verify_key(cipher, key, keylen);
        if (ret)
                return ret;
 
@@ -362,8 +361,7 @@ static int nitrox_aes_xts_setkey(struct crypto_skcipher *cipher,
 static int nitrox_aes_ctr_rfc3686_setkey(struct crypto_skcipher *cipher,
                                         const u8 *key, unsigned int keylen)
 {
-       struct crypto_tfm *tfm = crypto_skcipher_tfm(cipher);
-       struct nitrox_crypto_ctx *nctx = crypto_tfm_ctx(tfm);
+       struct nitrox_crypto_ctx *nctx = crypto_skcipher_ctx(cipher);
        struct flexi_crypto_context *fctx;
        int aes_keylen;
 

diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
index 309da63..2cd44d7 100644 (file)
--- a/drivers/crypto/ccree/cc_cipher.c
+++ b/drivers/crypto/ccree/cc_cipher.c
@@ -460,7 +460,7 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
        }
 
        if (ctx_p->cipher_mode == DRV_CIPHER_XTS &&
-           xts_check_key(tfm, key, keylen)) {
+           xts_verify_key(sktfm, key, keylen)) {
                dev_dbg(dev, "weak XTS key");
                return -EINVAL;
        }

diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
index 80ba77c..83493dd 100644 (file)
--- a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
+++ b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
@@ -398,7 +398,7 @@ static int otx_cpt_skcipher_xts_setkey(struct crypto_skcipher *tfm,
        const u8 *key1 = key;
        int ret;
 
-       ret = xts_check_key(crypto_skcipher_tfm(tfm), key, keylen);
+       ret = xts_verify_key(tfm, key, keylen);
        if (ret)
                return ret;
        ctx->key_len = keylen;

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
index 30b4236..443202c 100644 (file)
--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
@@ -412,7 +412,7 @@ static int otx2_cpt_skcipher_xts_setkey(struct crypto_skcipher *tfm,
        const u8 *key1 = key;
        int ret;
 
-       ret = xts_check_key(crypto_skcipher_tfm(tfm), key, keylen);
+       ret = xts_verify_key(tfm, key, keylen);
        if (ret)
                return ret;
        ctx->key_len = keylen;

diff --git a/include/crypto/xts.h b/include/crypto/xts.h
index a233c10..15b16c4 100644 (file)
--- a/include/crypto/xts.h
+++ b/include/crypto/xts.h
@@ -8,23 +8,6 @@
 
 #define XTS_BLOCK_SIZE 16
 
-static inline int xts_check_key(struct crypto_tfm *tfm,
-                               const u8 *key, unsigned int keylen)
-{
-       /*
-        * key consists of keys of equal size concatenated, therefore
-        * the length must be even.
-        */
-       if (keylen % 2)
-               return -EINVAL;
-
-       /* ensure that the AES and tweak key are not identical */
-       if (fips_enabled && !crypto_memneq(key, key + (keylen / 2), keylen / 2))
-               return -EINVAL;
-
-       return 0;
-}
-
 static inline int xts_verify_key(struct crypto_skcipher *tfm,
                                 const u8 *key, unsigned int keylen)
 {
@@ -42,7 +25,10 @@ static inline int xts_verify_key(struct crypto_skcipher *tfm,
        if (fips_enabled && keylen != 32 && keylen != 64)
                return -EINVAL;
 
-       /* ensure that the AES and tweak key are not identical */
+       /*
+        * Ensure that the AES and tweak key are not identical when
+        * in FIPS mode or the FORBID_WEAK_KEYS flag is set.
+        */
        if ((fips_enabled || (crypto_skcipher_get_flags(tfm) &
                              CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) &&
            !crypto_memneq(key, key + (keylen / 2), keylen / 2))