[gnutls-devel] GnuTLS | Allow registering ciphers with higher priority (!1404)

[Read-only notification of GnuTLS library development activities]

Merge request https://gitlab.com/gnutls/gnutls/-/merge_requests/1404 was reviewed by Daiki Ueno

--
  
Daiki Ueno started a new discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531104041

> +	/* Set PT buffer to be filled by kernel */
> +	iov[1].iov_base = plain;
> +	iov[1].iov_len = plain_size;

```suggestion:-0+0
	iov[1].iov_len = kcapi_aead_outbuflen_dec(ctx->handle,
						  encr_size - tag_size,
						  auth_size,
						  tag_size) - auth_size;
```

--
  
Daiki Ueno started a new discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531104044

> +	/* Set CT buffer to be filled by kernel */
> +	iov[1].iov_base = encr;
> +	iov[1].iov_len = plain_size + tag_size;

```suggestion:-0+0
	iov[1].iov_len = kcapi_aead_outbuflen_enc(ctx->handle,
						  plain_size,
						  auth_size,
						  tag_size) - auth_size;
```

--
  
Daiki Ueno started a new discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531104045

> +	}
> +
> +	ctx->ccm = !strncmp(gnutls_aead_map[algorithm], "ccm", 3);

As we only support a couple of CCM ciphers, I'd suggest just use a `switch` rather than string comparison, something like:
```c
switch (algorithm) {
case GNUTLS_CIPHER_AES_128_CCM:
case GNUTLS_CIPHER_AES_256_CCM:
...
}
```

--
  
Daiki Ueno started a new discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531104046

> +	struct kcapi_ctx *ctx = _ctx;
> +
> +	if (kcapi_cipher_encrypt(ctx->handle, src, src_size, ctx->iv,

>From my experiment, `src_size` needs to be exactly the block size for CBC (or perhaps there might be an alignment issue). I haven't tried but maybe you could rewrite this (and `afalg_cipher_decrypt`) either in the following ways:
- loop over `src_size`, by the block size retrieved with `kcapi_cipher_blocksize`,
- use the stream API in a similar way to AEAD: https://www.chronox.de/libkcapi/html/ch03s06.html

@smuellerDD thoughts?


-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20210317/98cd7f15/attachment.html>