CONFIG_CRYPTO_ESSIV: Encrypted Salt-Sector IV Generator

General informations

The Linux kernel configuration item CONFIG_CRYPTO_ESSIV has multiple definitions:

Encrypted Salt-Sector IV Generator found in crypto/Kconfig

The configuration item CONFIG_CRYPTO_ESSIV:

• prompt: Encrypted Salt-Sector IV Generator
• type: tristate
• depends on: (none)
• defined in crypto/Kconfig
• found in Linux kernels: 6.1–6.8, 6.9-rc+HEAD
• modules built: essiv

Help text

Encrypted Salt-Sector IV generator

This IV generator is used in some cases by fscrypt and/or dm-crypt. It uses the hash of the block encryption key as the symmetric key for a block encryption pass applied to the input IV, making low entropy IV sources more suitable for block encryption.

This driver implements a crypto API template that can be instantiated either as an skcipher or as an AEAD (depending on the type of the first template argument), and which defers encryption and decryption requests to the encapsulated cipher after applying ESSIV to the input IV. Note that in the AEAD case, it is assumed that the keys are presented in the same format used by the authenc template, and that the IV appears at the end of the authenticated associated data (AAD) region (which is how dm-crypt uses it.)

Note that the use of ESSIV is not recommended for new deployments, and so this only needs to be enabled when interoperability with existing encrypted volumes of filesystems is required, or when building for a particular system that requires it (e.g., when the SoC in question has accelerated CBC but not XTS, making CBC combined with ESSIV the only feasible mode for h/w accelerated block encryption)

ESSIV support for block encryption found in crypto/Kconfig

The configuration item CONFIG_CRYPTO_ESSIV:

• prompt: ESSIV support for block encryption
• type: tristate
• depends on: (none)
• defined in crypto/Kconfig
• found in Linux kernels: 5.4–5.19, 6.0, 6.0+HEAD
• modules built: essiv

Help text

Encrypted salt-sector initialization vector (ESSIV) is an IV generation method that is used in some cases by fscrypt and/or dm-crypt. It uses the hash of the block encryption key as the symmetric key for a block encryption pass applied to the input IV, making low entropy IV sources more suitable for block encryption.

This driver implements a crypto API template that can be instantiated either as an skcipher or as an AEAD (depending on the type of the first template argument), and which defers encryption and decryption requests to the encapsulated cipher after applying ESSIV to the input IV. Note that in the AEAD case, it is assumed that the keys are presented in the same format used by the authenc template, and that the IV appears at the end of the authenticated associated data (AAD) region (which is how dm-crypt uses it.)

Note that the use of ESSIV is not recommended for new deployments, and so this only needs to be enabled when interoperability with existing encrypted volumes of filesystems is required, or when building for a particular system that requires it (e.g., when the SoC in question has accelerated CBC but not XTS, making CBC combined with ESSIV the only feasible mode for h/w accelerated block encryption)

Hardware

LKDDb

Raw data from LKDDb:

• lkddb module essiv CONFIG_CRYPTO_ESSIV : crypto/Kconfig : "Encrypted Salt-Sector IV Generator" # in 5.4–5.19, 6.0–6.8, 6.9-rc+HEAD

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: