ROSCH
August 16, 2022, 2:27pm
1
hey guys,
how can i use the xchacha ciphers, poly1305 or adiantum with cryptsetup for full disk encryption ?
openwrt: latest master snapshot
lsmod | grep -i chacha
chacha_neon 32768 1 libchacha20poly1305
chacha20poly1305 20480 0
libchacha20poly1305 16384 1 wireguard,[permanent]
poly1305_arm 24576 1 libchacha20poly1305
grep -i chacha /proc/crypto
name : xchacha12
driver : xchacha12-neon
module : chacha_neon
name : xchacha20
driver : xchacha20-neon
module : chacha_neon
name : chacha20
driver : chacha20-neon
module : chacha_neon
name : xchacha12
driver : xchacha12-arm
module : chacha_neon
name : xchacha20
driver : xchacha20-arm
module : chacha_neon
name : chacha20
driver : chacha20-arm
module : chacha_neon
grep -i poly /proc/crypto
name : poly1305
driver : poly1305-neon
module : poly1305_arm
name : poly1305
driver : poly1305-arm
module : poly1305_arm
wireguard & openssl are already using them.
openssl speed -evp chacha20-poly1305
Doing chacha20-poly1305 for 3s on 16 size blocks: 8023661 chacha20-poly1305's in 2.97s
Doing chacha20-poly1305 for 3s on 64 size blocks: 4225973 chacha20-poly1305's in 2.94s
Doing chacha20-poly1305 for 3s on 256 size blocks: 2517239 chacha20-poly1305's in 2.86s
Doing chacha20-poly1305 for 3s on 1024 size blocks: 789042 chacha20-poly1305's in 2.98s
Doing chacha20-poly1305 for 3s on 8192 size blocks: 102964 chacha20-poly1305's in 2.97s
cryptsetup benchmark -c xchacha12
# Tests are approximate using memory only (no storage IO).
Cipher xchacha12 (with 256 bits key) is not available.
cryptsetup benchmark -c xchacha20,aes-adiantum-plain64
# Tests are approximate using memory only (no storage IO).
Cipher xchacha20,aes-adiantum-plain64 (with 256 bits key) is not available.
opened 09:11PM - 31 May 20 UTC
Hi, not sure if this is the proper place, let me know where to report it otherwi… se.
Using rpi-update I finally got a 5.x kernel (`5.4.42-v8+`, more precisely), and I was hoping to be able to use the Adiantum cipher for higher dm-crypt speed. However, it seems it's still not available, as:
```
# zgrep -i adiantum /proc/config.gz
# CONFIG_CRYPTO_ADIANTUM is not set
```
Furthermore, `find /lib/modules/|grep -i adiantum` finds nothing at all.
Could you please enable this? The difference in speed from the plain aes (non-accelerated on RPI boards) is quite high, about 3× according to various reports, so this would be useful (it also means 3× lower CPU usage for a given throughput).
Various links about it:
* https://forum.manjaro.org/t/enable-aes-adiantum-for-linux-rpi4-mainline/116038
* https://www.raspberrypi.org/forums/viewtopic.php?t=252980
I also tried to find the actual configs being used, but I'm not familiar with the raspbian build processes (I don't think they're in this repo per se, or at least not as a monolithic config file).
Thanks!
https://forums.raspberrypi.com/viewtopic.php?t=275542 https://archlinuxarm.org/forum/viewtopic.php?f=23&t=15074
hnyman
August 17, 2022, 4:50pm
2
ROSCH:
libchacha20poly1305
Regardig the crypto module itself, you can use menuconfig to modify kernel config to include those, and build it.
menu item: Kernel modules > Cryptographic API modules
menuconfig screenshot
.config - OpenWrt Configuration
> Kernel modules > Cryptographic API modules ────────────────────────────────────────────────────────────
┌──────────────────────────────────── Cryptographic API modules ─────────────────────────────────────┐
│ Arrow keys navigate the menu. <Enter> selects submenus ---> (or empty submenus ----). │
│ Highlighted letters are hotkeys. Pressing <Y> includes, <N> excludes, <M> modularizes features. │
│ Press <Esc><Esc> to exit, <?> for Help, </> for Search. Legend: [*] built-in [ ] excluded │
│ <M> module < > module capable │
│ ┌────────────────────────────────────────────────────────────────────────────────────────────────┐ │
│ │ -*- kmod-crypto-aead.................................. CryptoAPI AEAD support │ │
│ │ -*- kmod-crypto-arc4............................ ARC4 cipher CryptoAPI module │ │
│ │ < > kmod-crypto-authenc...................... Combined mode wrapper for IPsec │ │
│ │ < > kmod-crypto-cbc................... Cipher Block Chaining CryptoAPI module │ │
│ │ -*- kmod-crypto-ccm................... Support for Counter with CBC MAC (CCM) │ │
│ │ < > kmod-crypto-chacha20poly1305 │ │
│ │ -*- kmod-crypto-cmac │ │
│ │ -*- kmod-crypto-crc32c..................................... CRC32c CRC module │ │
│ │ -*- kmod-crypto-ctr............................ Counter Mode CryptoAPI module │ │
│ │ < > kmod-crypto-cts.................... Cipher Text Stealing CryptoAPI module │ │
│ │ < > kmod-crypto-deflate................. Deflate compression CryptoAPI module │ │
│ │ -*- kmod-crypto-des......................... DES/3DES cipher CryptoAPI module │ │
│ │ -*- kmod-crypto-ecb..................... Electronic CodeBook CryptoAPI module │ │
I have never tried to use those, so no special expertise...
1 Like
hnyman
August 17, 2022, 5:11pm
3
ROSCH:
adiantum
Adiantum seems to not be a selectable/installable kernel module (kmod).
But you can use "make kernel_menuconfig" to select it to be built-in:
.config - Linux/arm 5.10.136 Kernel Configuration
> Cryptographic API ─────────────────────────────────────────────────────────────────────────────────────────────────────
┌──────────────────────────────────────────────── Cryptographic API ─────────────────────────────────────────────────┐
│ Arrow keys navigate the menu. <Enter> selects submenus ---> (or empty submenus ----). Highlighted letters are │
│ hotkeys. Pressing <Y> includes, <N> excludes, <M> modularizes features. Press <Esc><Esc> to exit, <?> for Help, │
│ </> for Search. Legend: [*] built-in [ ] excluded <M> module < > module capable │
│ │
│ ┌─────────────────────^(-)───────────────────────────────────────────────────────────────────────────────────────┐ │
│ │ < > CBC support │ │
│ │ < > CFB support │ │
│ │ -*- CTR support │ │
│ │ < > CTS support │ │
│ │ < > ECB support │ │
│ │ < > LRW support │ │
│ │ < > OFB support │ │
│ │ < > PCBC support │ │
│ │ < > XTS support │ │
│ │ < > Key wrapping support │ │
│ │ < > Adiantum support │ │
│ │ < > ESSIV support for block encryption │ │
│ │ *** Hash modes *** │ │
│ │ < > CMAC support │ │
│ │ -*- HMAC support │ │
│ │ < > XCBC support │ │
│ │ < > VMAC support │ │
│ │ *** Digest *** │ │
1 Like