[PATCH v5 10/10] crypto: eip93 - Simplify the check for a valid AES key
Thomas Huth <[email protected]>
| Newsgroups | org.kernel.vger.linux-crypto,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Thomas Huth <[email protected]> eip93_aead_setkey() currently uses aes_expandkey() to check for a valid AES key, but then does not use the crypto_aes_ctx afterwards anymore, i.e. this is just a wasteful way of checking the key length, and thus aes_check_keylen() should be used instead. This also fixes a potential leak of sensitive data via the stack, since this function forgot to zeroize crypto_aes_ctx before returning to the caller. Suggested-by: Antoine Tenart <[email protected]> Signed-off-by: Thomas Huth <[email protected]> --- drivers/crypto/inside-secure/eip93/eip93-aead.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/crypto/inside-secure/eip93/eip93-aead.c b/drivers/crypto/inside-secure/eip93/eip93-aead.c index 2bbd0af7b0e0e..0b7a899b14d76 100644 --- a/drivers/crypto/inside-secure/eip93/eip93-aead.c +++ b/drivers/crypto/inside-secure/eip93/eip93-aead.c @@ -92,7 +92,6 @@ static int eip93_aead_setkey(struct crypto_aead *ctfm, const u8 *key, struct crypto_tfm *tfm = crypto_aead_tfm(ctfm); struct eip93_crypto_ctx *ctx = crypto_tfm_ctx(tfm); struct crypto_authenc_keys keys; - struct crypto_aes_ctx aes; struct sa_record *sa_record = ctx->sa_record; u32 nonce = 0; int ret; @@ -126,7 +125,7 @@ static int eip93_aead_setkey(struct crypto_aead *ctfm, const u8 *key, break; case EIP93_ALG_AES: - ret = aes_expandkey(&aes, keys.enckey, keys.enckeylen); + ret = aes_check_keylen(keys.enckeylen); if (ret) return ret; -- 2.55.0