[PATCH v3 03/13] lib/crypto: aes-gcm: Provide functions for zeroizing aes_gcm* structures
From: Thomas Huth <hidden>
Date: 2026-09-10 12:42:03
Also in:
lkml
Subsystem:
crypto api, crypto library, library code, the rest · Maintainers:
Herbert Xu, "David S. Miller", Eric Biggers, Jason A. Donenfeld, Ard Biesheuvel, Andrew Morton, Linus Torvalds
In certain cases crypto code needs to zeroize their local aes_gcm_key or aes_gcm_ctx structures after use to avoid leaking sensitive material. Provide aes_gcm_zeroize_key() and aes_gcm_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/aes.c with calls to the new helper functions. Signed-off-by: Thomas Huth <redacted> --- include/crypto/aes-gcm.h | 22 ++++++++++++++++++++-- lib/crypto/aes.c | 8 +++----- 2 files changed, 23 insertions(+), 7 deletions(-)
diff --git a/include/crypto/aes-gcm.h b/include/crypto/aes-gcm.h
index 2aee62f019891..a81b00fd8e27f 100644
--- a/include/crypto/aes-gcm.h
+++ b/include/crypto/aes-gcm.h@@ -21,6 +21,15 @@ struct aes_gcm_key { size_t authtag_len; /* Length of authentication tags in bytes */ }; +/** + * aes_gcm_zeroize_key() - Zeroize an aes_gcm_key structure + * @key: The aes_gcm_key to zeroize + */ +static inline void aes_gcm_zeroize_key(struct aes_gcm_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_gcm_ctx - Context for incrementally en/decrypting a message */
@@ -58,6 +67,15 @@ struct aes_gcm_ctx { u64 data_len; }; +/** + * aes_gcm_zeroize_ctx() - Zeroize an aes_gcm_ctx structure + * @ctx: The aes_gcm_ctx to zeroize + */ +static inline void aes_gcm_zeroize_ctx(struct aes_gcm_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * aes_gcm_preparekey() - Prepare a key for AES-GCM encryption and decryption * @key: (output) The key structure to initialize
@@ -66,8 +84,8 @@ struct aes_gcm_ctx { * @authtag_len: Length of the authentication tag in bytes: * 4, 8, 12, 13, 14, 15, or 16. 16 is recommended. * - * Users should use memzero_explicit() to zeroize the key struct at the end of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_gcm_zeroize_key() to zeroize the key struct at the end + * of its lifetime. (But if this function fails, zeroization is unnecessary.) * * Context: Any context. * Return:
diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index 34ef5deca0a79..0cb5d7355926e 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c@@ -1670,7 +1670,7 @@ void aes_gcm_encrypt_final(struct aes_gcm_ctx *ctx, u8 *authtag) ghash_final(&ctx->ghash, ctx->ctr); /* Use ctr as temp buffer */ crypto_xor_cpy(authtag, ctx->ctr, ctx->j0_enc, ctx->key->authtag_len); - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(aes_gcm_encrypt_final);
@@ -1697,7 +1697,7 @@ int aes_gcm_decrypt_final(struct aes_gcm_ctx *ctx, const u8 *authtag) -EBADMSG : 0; out: - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); return err; } EXPORT_SYMBOL_GPL(aes_gcm_decrypt_final);
@@ -1742,7 +1742,7 @@ static void __init aes_gcm_fips_test(void) { const size_t data_len = sizeof(fips_test_data); u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE]; - struct aes_gcm_key key; + struct aes_gcm_key key __cleanup(aes_gcm_zeroize_key); int err; if (aes_gcm_preparekey(&key, fips_test_key, sizeof(fips_test_key),
@@ -1760,8 +1760,6 @@ static void __init aes_gcm_fips_test(void) panic("aes: GCM FIPS self-test failed (decryption failed)\n"); if (memcmp(fips_test_data, buf, data_len) != 0) panic("aes: GCM FIPS self-test failed (wrong plaintext)\n"); - - memzero_explicit(&key, sizeof(key)); } #else /* CONFIG_CRYPTO_LIB_AES_GCM */ static inline void aes_gcm_fips_test(void)
--
2.55.0