net/tls: Add support of AES128-CCM based ciphers

Added support for AES128-CCM based record encryption. AES128-CCM is similar to AES128-GCM. Both of them have same salt/iv/mac size. The notable difference between the two is that while invoking AES128-CCM operation, the salt||nonce (which is passed as IV) has to be prefixed with a hardcoded value '2'. Further, CCM implementation in kernel requires IV passed in crypto_aead_request() to be full '16' bytes. Therefore, the record structure 'struct tls_rec' has been modified to reserve '16' bytes for IV. This works for both GCM and CCM based cipher.

Vakul Garg committed 7 years ago

Commit f295b3a1 parent 6a23c0a4 files · +97 −31Browse files

Showing the changes to include/uapi/linux (1 of 4 files). Show all

Unified · Split

include/uapi/linux/tls.h+15−0

@@ -70,6 +70,13 @@ · 69 unmodified lines
70	70	#define TLS_CIPHER_AES_GCM_256_TAG_SIZE 16
71	71	#define TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE 8
72	72
	73	+#define TLS_CIPHER_AES_CCM_128 53
	74	+#define TLS_CIPHER_AES_CCM_128_IV_SIZE 8
	75	+#define TLS_CIPHER_AES_CCM_128_KEY_SIZE 16
	76	+#define TLS_CIPHER_AES_CCM_128_SALT_SIZE 4
	77	+#define TLS_CIPHER_AES_CCM_128_TAG_SIZE 16
	78	+#define TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE 8
	79	+
73	80	#define TLS_SET_RECORD_TYPE 1
74	81	#define TLS_GET_RECORD_TYPE 2
75	82
@@ -94,4 +101,12 @@ struct tls12_crypto_info_aes_gcm_256 { · 18 unmodified lines
94	101	unsigned char rec_seq[TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE];
95	102	};
96	103
	104	+struct tls12_crypto_info_aes_ccm_128 {
	105	+ struct tls_crypto_info info;
	106	+ unsigned char iv[TLS_CIPHER_AES_CCM_128_IV_SIZE];
	107	+ unsigned char key[TLS_CIPHER_AES_CCM_128_KEY_SIZE];
	108	+ unsigned char salt[TLS_CIPHER_AES_CCM_128_SALT_SIZE];
	109	+ unsigned char rec_seq[TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE];
	110	+};
	111	+
97	112	#endif /* _UAPI_LINUX_TLS_H */