net/tls: Add support of AES128-CCM based ciphers

Added support for AES128-CCM based record encryption. AES128-CCM is similar to AES128-GCM. Both of them have same salt/iv/mac size. The notable difference between the two is that while invoking AES128-CCM operation, the salt||nonce (which is passed as IV) has to be prefixed with a hardcoded value '2'. Further, CCM implementation in kernel requires IV passed in crypto_aead_request() to be full '16' bytes. Therefore, the record structure 'struct tls_rec' has been modified to reserve '16' bytes for IV. This works for both GCM and CCM based cipher.

Vakul Garg committed 7 years ago

Commit f295b3a1 parent 6a23c0a4 files · +97 −31Browse files

Showing the changes to include/uapi/linux (1 of 4 files). Show all

Unified · Split

include/uapi/linux/tls.h+15−0

@@ -70,6 +70,13 @@ · 69 unmodified lines
70	#define TLS_CIPHER_AES_GCM_256_TAG_SIZE 16	70	#define TLS_CIPHER_AES_GCM_256_TAG_SIZE 16
71	#define TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE 8	71	#define TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE 8
72		72
		73	#define TLS_CIPHER_AES_CCM_128 53
		74	#define TLS_CIPHER_AES_CCM_128_IV_SIZE 8
		75	#define TLS_CIPHER_AES_CCM_128_KEY_SIZE 16
		76	#define TLS_CIPHER_AES_CCM_128_SALT_SIZE 4
		77	#define TLS_CIPHER_AES_CCM_128_TAG_SIZE 16
		78	#define TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE 8
		79
73	#define TLS_SET_RECORD_TYPE 1	80	#define TLS_SET_RECORD_TYPE 1
74	#define TLS_GET_RECORD_TYPE 2	81	#define TLS_GET_RECORD_TYPE 2
75		82
@@ -94,4 +101,12 @@ struct tls12_crypto_info_aes_gcm_256 { · 18 unmodified lines
94	unsigned char rec_seq[TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE];	101	unsigned char rec_seq[TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE];
95	};	102	};
96		103
		104	struct tls12_crypto_info_aes_ccm_128 {
		105	struct tls_crypto_info info;
		106	unsigned char iv[TLS_CIPHER_AES_CCM_128_IV_SIZE];
		107	unsigned char key[TLS_CIPHER_AES_CCM_128_KEY_SIZE];
		108	unsigned char salt[TLS_CIPHER_AES_CCM_128_SALT_SIZE];
		109	unsigned char rec_seq[TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE];
		110	};
		111
97	#endif /* _UAPI_LINUX_TLS_H */	112	#endif /* _UAPI_LINUX_TLS_H */