SA2UL algorithms supported by the Linux kernel driver

[rmcelaya]

The table presented in [1] shows the different crypto algorithms supported by the SA2UL engine for the different device families. I have noticed, however, the sau2l Crypto API driver included in the upstream Linux kernel only supports the following ones (see [2]):

• Encryption:
  • AES CBC
  • AES EBC
  • DES3 CBC
  • DES3 ECB
• Encryption with authentication:
  • AUTHENC(HMAC-SHA1, CBC-AES)
  • AUTHENC(HMAC-SHA256, CBC-AES)
• Hashing:
  • SHA1
  • SHA256
  • SHA512

Some points:

• Are there any drivers, even if not integrated in the upstream kernel that provide the remaining algorithms (CMAC(AES), AES-GCM, HMAC etc) through the Crypto API? In case there aren't ,are there any plans to add all these algorithms to the already existing upstream sa2ul driver?
• Maybe it would make sense to include an overview of which of the algorithms supported by the hardware are also supported by the upstream driver and which not in the docs

[1] https://github.com/texasinstruments/processor-sdk-doc/blob/master/source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.rst
[2] https://github.com/torvalds/linux/blob/v7.0/drivers/crypto/sa2ul.c#L74-L84

[manorit2001]

Hi @rmcelaya ,

The following drivers exist in the old baseline, the plan is to move it to new baseline ( 6.18 LTS ) as well as upstream them cleanly, but for reference you can look at them here ->
https://github.com/TexasInstruments/ti-linux-kernel/blob/ti-linux-6.12.y/drivers/crypto/sa2ul.c

[rmcelaya]

Hi @manorit2001,

Really cool! I will check.

One related question:

This driver you're sharing from 6.12.y supports AES CMAC. Does this mean it also supports IPsec (XFRM) for Security Associations using AES CMAC? I understand this driver provides the AES CMAC method in the Linux Crypto API and IPsec will use it automatically. Is this the case, or does integrating the SA2UL with IPsec require any additional configuration

Additionally, do you think the support of all the algorithms in 6.12.y would work if applied to 6.6.y or would there be any incompatibilities?

Thanks!!

[manorit2001]

Hi @rmcelaya ,

This driver you're sharing from 6.12.y supports AES CMAC. Does this mean it also supports IPsec (XFRM) for Security Associations using AES CMAC? I understand this driver provides the AES CMAC method in the Linux Crypto API and IPsec will use it automatically. Is this the case, or does integrating the SA2UL with IPsec require any additional configuration

I haven't tried this end to end usage myself so honestly can't comment on this, though I would suspect yes (it's use sa2ul automatically) based on quick google searches, not sure about any other configurations required. Let us know if you are able to make it work ( or maybe a doc pr as well perhaps if you wish )

Additionally, do you think the support of all the algorithms in 6.12.y would work if applied to 6.6.y or would there be any incompatibilities?

From an sa2ul driver perspective, I think there are hardly any changes to it from a long time, so ideally rebases should be relatively easy though the crypto internal api and behaviours have been something of a dynamic thing so there is a chance things remain stable but you'd have to try only to know it.. also there are some fixups as well along with CMAC support in the driver to help with the existing race conditions in the driver too.

Thanks!!