From patchwork Thu Dec 1 12:58:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tianjia Zhang X-Patchwork-Id: 28362 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp247429wrr; Thu, 1 Dec 2022 05:03:18 -0800 (PST) X-Google-Smtp-Source: AA0mqf5UWZ2y7OtVeWmap4s+oipecy/ly6krr8y9qGVREwzE1XONDKBssiOlysudtvUZ4PV0Udi1 X-Received: by 2002:a17:90b:3c0a:b0:212:510b:5851 with SMTP id pb10-20020a17090b3c0a00b00212510b5851mr68736624pjb.57.1669899797636; Thu, 01 Dec 2022 05:03:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669899797; cv=none; d=google.com; s=arc-20160816; b=v0PXOW7cGnug7MDKB8IAXIC5A3csJIKcLJfmIuADO4HWDiP+/9FbZbWkRzjkdqDutl nBXhGyAx08EoZtdyrjfCV7ZMUWJrFyWoo+5S6A5mJe6xPgIr6pS4WbGUqSbexh3GETBR osHkRuC30PHUUjJFTfbiSAhln1chp5fsbih9+r9QTJhBp3sHMBWvJPGIhxu1U4vRdY7F tzsOx+3Us8kxsAMQkw5e4Inas92cEQgoduh4X02C69prtiwDWdJ2PTpd/fJPx0uUfseS b+YsNP6AfabyD/J2LRPQ5QHyhvni4Q4B9DhB8iJn6HKuiwgXUCYMWrEVG+Ml/6UyuvLz Ci/A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=LD8GrOOvFGeHRzpCXIZY+UVItCBhxRNDV41MEJnzsE4=; b=KYYYzC1VgddTZMNpjZ0f1Q56bCdmDXosOX1eajdaqKuH7qd4H2DqBf+DN+M9gYmfPF wZWLCZFoC6QEhtkGtm+wD8U7Y3NlvuRzJmSIzQ+A4pTrvR6YXLscDkjp6hGBxAWnvZQA CROQXZ3Y6mfZQlc0PzG4U5UgtLTr4aMT+1k0IRpc/neBjjEzPyKdf0uwTtPeCKk28cvD z/6LitcDoapLazOuCzfOW++FpjVMhCfv+za/X8qOKDKZkw9GVeOsukCUd4e+0M42RyM/ FyYqsLmOHj9au8p/Xk8Dub8BQeRQAFY4ZcOpWXI8IPSEorzkck90NTLscDh1M/rQEKgi qwQQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y17-20020a170903011100b00179c921918esi4104666plc.17.2022.12.01.05.02.39; Thu, 01 Dec 2022 05:03:17 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231321AbiLAM6e (ORCPT + 99 others); Thu, 1 Dec 2022 07:58:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39374 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231272AbiLAM6a (ORCPT ); Thu, 1 Dec 2022 07:58:30 -0500 Received: from out30-1.freemail.mail.aliyun.com (out30-1.freemail.mail.aliyun.com [115.124.30.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1505856EF6; Thu, 1 Dec 2022 04:58:28 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R131e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046050;MF=tianjia.zhang@linux.alibaba.com;NM=1;PH=DS;RN=12;SR=0;TI=SMTPD_---0VW8qK3K_1669899504; Received: from localhost(mailfrom:tianjia.zhang@linux.alibaba.com fp:SMTPD_---0VW8qK3K_1669899504) by smtp.aliyun-inc.com; Thu, 01 Dec 2022 20:58:25 +0800 From: Tianjia Zhang To: Eric Biggers , "Theodore Y. Ts o" , Jaegeuk Kim , Jonathan Corbet , Jens Axboe , Ard Biesheuvel , Bagas Sanjaya , linux-fscrypt@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org Cc: Tianjia Zhang Subject: [PATCH v4 2/2] fscrypt: Add SM4 XTS/CTS symmetric algorithm support Date: Thu, 1 Dec 2022 20:58:19 +0800 Message-Id: <20221201125819.36932-3-tianjia.zhang@linux.alibaba.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) In-Reply-To: <20221201125819.36932-1-tianjia.zhang@linux.alibaba.com> References: <20221201125819.36932-1-tianjia.zhang@linux.alibaba.com> MIME-Version: 1.0 X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS, UNPARSEABLE_RELAY,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751016850575990149?= X-GMAIL-MSGID: =?utf-8?q?1751016850575990149?= Add support for XTS and CTS mode variant of SM4 algorithm, in similar fashion to SM2 and SM3. The former is used to encrypt file contents, while the latter (SM4-CBC-CTS) is used to encrypt filenames. SM4 is a symmetric algorithm widely used in China, and is even mandatory algorithm in some special scenarios. We need to provide these users with the ability to encrypt files or disks using SM4-XTS. Signed-off-by: Tianjia Zhang --- Documentation/filesystems/fscrypt.rst | 1 + fs/crypto/keysetup.c | 15 +++++++++++++++ fs/crypto/policy.c | 5 +++++ include/uapi/linux/fscrypt.h | 2 ++ 4 files changed, 23 insertions(+) diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst index 5ba5817c17c2..c0784ec05553 100644 --- a/Documentation/filesystems/fscrypt.rst +++ b/Documentation/filesystems/fscrypt.rst @@ -338,6 +338,7 @@ Currently, the following pairs of encryption modes are supported: - AES-128-CBC for contents and AES-128-CTS-CBC for filenames - Adiantum for both contents and filenames - AES-256-XTS for contents and AES-256-HCTR2 for filenames (v2 policies only) +- SM4-XTS for contents and SM4-CTS-CBC for filenames (v2 policies only) If unsure, you should use the (AES-256-XTS, AES-256-CTS-CBC) pair. diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c index f7407071a952..24e55c95abc3 100644 --- a/fs/crypto/keysetup.c +++ b/fs/crypto/keysetup.c @@ -44,6 +44,21 @@ struct fscrypt_mode fscrypt_modes[] = { .security_strength = 16, .ivsize = 16, }, + [FSCRYPT_MODE_SM4_XTS] = { + .friendly_name = "SM4-XTS", + .cipher_str = "xts(sm4)", + .keysize = 32, + .security_strength = 16, + .ivsize = 16, + .blk_crypto_mode = BLK_ENCRYPTION_MODE_SM4_XTS, + }, + [FSCRYPT_MODE_SM4_CTS] = { + .friendly_name = "SM4-CTS", + .cipher_str = "cts(cbc(sm4))", + .keysize = 16, + .security_strength = 16, + .ivsize = 16, + }, [FSCRYPT_MODE_ADIANTUM] = { .friendly_name = "Adiantum", .cipher_str = "adiantum(xchacha12,aes)", diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c index 46757c3052ef..ec19066128e5 100644 --- a/fs/crypto/policy.c +++ b/fs/crypto/policy.c @@ -83,6 +83,11 @@ static bool fscrypt_valid_enc_modes_v2(u32 contents_mode, u32 filenames_mode) if (contents_mode == FSCRYPT_MODE_AES_256_XTS && filenames_mode == FSCRYPT_MODE_AES_256_HCTR2) return true; + + if (contents_mode == FSCRYPT_MODE_SM4_XTS && + filenames_mode == FSCRYPT_MODE_SM4_CTS) + return true; + return fscrypt_valid_enc_modes_v1(contents_mode, filenames_mode); } diff --git a/include/uapi/linux/fscrypt.h b/include/uapi/linux/fscrypt.h index a756b29afcc2..47dbd1994bfe 100644 --- a/include/uapi/linux/fscrypt.h +++ b/include/uapi/linux/fscrypt.h @@ -26,6 +26,8 @@ #define FSCRYPT_MODE_AES_256_CTS 4 #define FSCRYPT_MODE_AES_128_CBC 5 #define FSCRYPT_MODE_AES_128_CTS 6 +#define FSCRYPT_MODE_SM4_XTS 7 +#define FSCRYPT_MODE_SM4_CTS 8 #define FSCRYPT_MODE_ADIANTUM 9 #define FSCRYPT_MODE_AES_256_HCTR2 10 /* If adding a mode number > 10, update FSCRYPT_MODE_MAX in fscrypt_private.h */