• Eric Biggers's avatar
    fscrypt: add Adiantum support · 8094c3ce
    Eric Biggers authored
    Add support for the Adiantum encryption mode to fscrypt.  Adiantum is a
    tweakable, length-preserving encryption mode with security provably
    reducible to that of XChaCha12 and AES-256, subject to a security bound.
    It's also a true wide-block mode, unlike XTS.  See the paper
    "Adiantum: length-preserving encryption for entry-level processors"
    (https://eprint.iacr.org/2018/720.pdf) for more details.  Also see
    commit 059c2a4d ("crypto: adiantum - add Adiantum support").
    
    On sufficiently long messages, Adiantum's bottlenecks are XChaCha12 and
    the NH hash function.  These algorithms are fast even on processors
    without dedicated crypto instructions.  Adiantum makes it feasible to
    enable storage encryption on low-end mobile devices that lack AES
    instructions; currently such devices are unencrypted.  On ARM Cortex-A7,
    on 4096-byte messages Adiantum encryption is about 4 times faster than
    AES-256-XTS encryption; decryption is about 5 times faster.
    
    In fscrypt, Adiantum is suitable for encrypting both file contents and
    names.  With filenames, it fixes a known weakness: when two filenames in
    a directory share a common prefix of >= 16 bytes, with CTS-CBC their
    encrypted filenames share a common prefix too, leaking information.
    Adiantum does not have this problem.
    
    Since Adiantum also accepts long tweaks (IVs), it's also safe to use the
    master key directly for Adiantum encryption rather than deriving
    per-file keys, provided that the per-file nonce is included in the IVs
    and the master key isn't used for any other encryption mode.  This
    configuration saves memory and improves performance.  A new fscrypt
    policy flag is added to allow users to opt-in to this configuration.
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    8094c3ce
fscrypt_private.h 4.51 KB