Nathan Huckleberry 6b2a51ff03 fscrypt: Add HCTR2 support for filename encryption
HCTR2 is a tweakable, length-preserving encryption mode that is intended
for use on CPUs with dedicated crypto instructions.  HCTR2 has the
property that a bitflip in the plaintext changes the entire ciphertext.
This property fixes a known weakness with filename encryption: when two
filenames in the same directory share a prefix of >= 16 bytes, with
AES-CTS-CBC their encrypted filenames share a common substring, leaking
information.  HCTR2 does not have this problem.

More information on HCTR2 can be found here: "Length-preserving
encryption with HCTR2": https://eprint.iacr.org/2021/1441.pdf

Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2022-06-10 16:40:18 +08:00
..
2022-05-24 19:55:07 -07:00
2022-05-29 15:39:04 +08:00
2021-06-13 17:02:46 -06:00
2022-04-20 11:16:43 -07:00
2020-12-10 12:40:07 -06:00
2022-05-24 19:55:07 -07:00
2020-09-04 11:32:10 +02:00
2022-05-26 20:52:24 -07:00
2020-07-09 08:14:01 +02:00
2020-10-14 16:09:32 -07:00
2020-12-15 12:13:39 -08:00
2021-03-25 11:51:23 -06:00