Skip to content

Simplify native code configurations and aes_ctr_set_key #3019

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
torben-hansen wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Simplify native code configurations and aes_ctr_set_key #3019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion crypto/fipsmodule/aes/aes_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -428,7 +428,8 @@ TEST(AESTest, ABI) {
block_counts = {0, 1, 8};
}

if (bsaes_capable()) {
#if defined(BSAES)
if (vpaes_capable()) {
ASSERT_EQ(vpaes_set_encrypt_key(kKey, bits, &key), 0);
CHECK_ABI(vpaes_encrypt_key_to_bsaes, &key, &key);
for (size_t blocks : block_counts) {
Expand All @@ -446,6 +447,7 @@ TEST(AESTest, ABI) {
block, AES_DECRYPT);
}
}
#endif

if (vpaes_capable()) {
ASSERT_EQ(CHECK_ABI(vpaes_set_encrypt_key, kKey, bits, &key), 0);
Expand Down
33 changes: 13 additions & 20 deletions crypto/fipsmodule/aes/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,58 +29,51 @@ extern "C" {

#if !defined(OPENSSL_NO_ASM)

#if defined(OPENSSL_X86_64)
OPENSSL_INLINE int avx512_xts_available(void) {
return (CRYPTO_is_VAES_capable() &&
CRYPTO_is_VBMI2_capable() &&
CRYPTO_is_AVX512_capable() &&
CRYPTO_is_VPCLMULQDQ_capable());
}
#endif

#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
#define HWAES
#define HWAES_ECB

#define VPAES
#define VPAES_CBC
OPENSSL_INLINE int hwaes_capable(void) { return CRYPTO_is_AESNI_capable(); }
OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_SSSE3_capable(); }

#define VPAES
#if defined(OPENSSL_X86_64)
#define VPAES_CTR32
#define HWAES_XTS
OPENSSL_INLINE int hwaes_xts_available(void) {
return CRYPTO_is_AESNI_capable();
}
OPENSSL_INLINE int avx512_xts_available(void) {
return (CRYPTO_is_VAES_capable() &&
CRYPTO_is_VBMI2_capable() &&
CRYPTO_is_AVX512_capable() &&
CRYPTO_is_VPCLMULQDQ_capable());
}
#endif
#define VPAES_CBC
OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_SSSE3_capable(); }

#elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
#define HWAES
#define VPAES
#define VPAES_CTR32

OPENSSL_INLINE int hwaes_capable(void) { return CRYPTO_is_ARMv8_AES_capable(); }
OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }

#if defined(OPENSSL_ARM)
#define BSAES
#define VPAES
#define VPAES_CTR32
OPENSSL_INLINE int bsaes_capable(void) { return CRYPTO_is_NEON_capable(); }
OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
#endif

#if defined(OPENSSL_AARCH64)
#define VPAES
#define VPAES_CBC
#define VPAES_CTR32
#define HWAES_XTS
OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
OPENSSL_INLINE int hwaes_xts_available(void) {
// same as hwaes_capable()
return CRYPTO_is_ARMv8_AES_capable();
}
#endif

#elif defined(OPENSSL_PPC64LE)

#define HWAES

OPENSSL_INLINE int hwaes_capable(void) {
Expand Down
31 changes: 20 additions & 11 deletions crypto/fipsmodule/cipher/e_aes.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,8 +160,7 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
if (mode == EVP_CIPH_CBC_MODE) {
dat->stream.cbc = aes_hw_cbc_encrypt;
}
} else if (bsaes_capable() && mode == EVP_CIPH_CBC_MODE) {
assert(vpaes_capable());
} else if (vpaes_capable() && mode == EVP_CIPH_CBC_MODE) {
ret = vpaes_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
if (ret == 0) {
vpaes_decrypt_key_to_bsaes(&dat->ks.ks, &dat->ks.ks);
Expand Down Expand Up @@ -206,7 +205,7 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
#endif
if (mode == EVP_CIPH_CTR_MODE) {
#if defined(BSAES)
assert(bsaes_capable());
assert(vpaes_capable());
dat->stream.ctr = vpaes_ctr32_encrypt_blocks_with_bsaes;
#elif defined(VPAES_CTR32)
dat->stream.ctr = vpaes_ctr32_encrypt_blocks;
Expand Down Expand Up @@ -288,7 +287,8 @@ ctr128_f aes_ctr_set_key(AES_KEY *aes_key, GCM128_KEY *gcm_key,
block128_f *out_block, const uint8_t *key,
size_t key_bytes) {
// This function assumes the key length was previously validated.
assert(key_bytes == 128 / 8 || key_bytes == 192 / 8 || key_bytes == 256 / 8);
assert(key_bytes == 16 || key_bytes == 24 || key_bytes == 32);

if (hwaes_capable()) {
aes_hw_set_encrypt_key(key, (int)key_bytes * 8, aes_key);
if (gcm_key != NULL) {
Expand All @@ -300,23 +300,32 @@ ctr128_f aes_ctr_set_key(AES_KEY *aes_key, GCM128_KEY *gcm_key,
return aes_hw_ctr32_encrypt_blocks_wrapper;

@github-actions github-actions Bot Feb 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: use of undeclared identifier 'aes_hw_ctr32_encrypt_blocks_wrapper'; did you mean 'aes_hw_ctr32_encrypt_blocks'? [clang-diagnostic-error]

Suggested change
return aes_hw_ctr32_encrypt_blocks_wrapper;
return aes_hw_ctr32_encrypt_blocks;
Additional context

crypto/fipsmodule/aes/internal.h:96: 'aes_hw_ctr32_encrypt_blocks' declared here

void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
     ^

}

if (vpaes_capable()) {

#if defined(BSAES)
if (vpaes_capable()) {
vpaes_set_encrypt_key(key, (int)key_bytes * 8, aes_key);
if (out_block) {
*out_block = vpaes_encrypt_wrapper;
}
if (gcm_key != NULL) {
CRYPTO_gcm128_init_key(gcm_key, aes_key, vpaes_encrypt_wrapper, 0);
}
#if defined(BSAES)
assert(bsaes_capable());
return vpaes_ctr32_encrypt_blocks_with_bsaes;
#elif defined(VPAES_CTR32)
return vpaes_ctr32_encrypt_blocks_wrapper;
#else
return NULL;
}
#endif

#if defined(VPAES_CTR32)
if (vpaes_capable()) {
vpaes_set_encrypt_key(key, (int)key_bytes * 8, aes_key);
if (out_block) {
*out_block = vpaes_encrypt_wrapper;

@github-actions github-actions Bot Feb 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: use of undeclared identifier 'vpaes_encrypt_wrapper' [clang-diagnostic-error]

      *out_block = vpaes_encrypt_wrapper;
                   ^

}
if (gcm_key != NULL) {
CRYPTO_gcm128_init_key(gcm_key, aes_key, vpaes_encrypt_wrapper, 0);

@github-actions github-actions Bot Feb 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: use of undeclared identifier 'vpaes_encrypt_wrapper' [clang-diagnostic-error]

      CRYPTO_gcm128_init_key(gcm_key, aes_key, vpaes_encrypt_wrapper, 0);
                                               ^

}
return vpaes_ctr32_encrypt_blocks_wrapper;

@github-actions github-actions Bot Feb 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: use of undeclared identifier 'vpaes_ctr32_encrypt_blocks_wrapper'; did you mean 'vpaes_ctr32_encrypt_blocks'? [clang-diagnostic-error]

Suggested change
return vpaes_ctr32_encrypt_blocks_wrapper;
return vpaes_ctr32_encrypt_blocks;
Additional context

crypto/fipsmodule/aes/internal.h:240: 'vpaes_ctr32_encrypt_blocks' declared here

void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
     ^

}
#endif

aes_nohw_set_encrypt_key(key, (int)key_bytes * 8, aes_key);
if (gcm_key != NULL) {
Expand Down
Loading