Re: [PATCH 02/33] lib/crypto: aes: Add ECB support

[Thomas Huth]

On 07/07/2026 07.34, Eric Biggers wrote:
> Add support for AES-ECB to the crypto library.
>
> This will be used to provide a streamlined implementation of the
> "ecb(aes)" crypto_skcipher algorithm.  fs/crypto/keysetup_v1.c will also
> use aes_ecb_encrypt() directly.
>
> As usual, the architecture-optimized AES-ECB code will be migrated into
> the library as well (using the hooks provided in this commit),
> eliminating lots of repetitive boilerplate code.
>
> ECB is obsolete of course, but we need this for parity with the
> traditional API and to support some odd users of ECB in the kernel.
>
> Initial test coverage is provided by the crypto_skcipher support added
> in a later commit.  I'm planning a KUnit test suite as well.
>
> Create a documentation file libcrypto-unauth-encryption.rst to hold the
> documentation for this and other unauthenticated encryption modes.
>
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
>   .../crypto/libcrypto-unauth-encryption.rst    | 28 ++++++++++
>   Documentation/crypto/libcrypto.rst            |  1 +
>   include/crypto/aes-ecb.h                      | 49 ++++++++++++++++
>   lib/crypto/Kconfig                            |  9 ++-
>   lib/crypto/aes.c                              | 56 +++++++++++++++++++
>   lib/crypto/tests/Kconfig                      |  1 +
>   6 files changed, 142 insertions(+), 2 deletions(-)
>   create mode 100644 Documentation/crypto/libcrypto-unauth-encryption.rst
>   create mode 100644 include/crypto/aes-ecb.h
>
> diff --git a/Documentation/crypto/libcrypto-unauth-encryption.rst b/Documentation/crypto/libcrypto-unauth-encryption.rst
> new file mode 100644
> index 000000000000..891c15279749
> --- /dev/null
> +++ b/Documentation/crypto/libcrypto-unauth-encryption.rst
> @@ -0,0 +1,28 @@
> +.. SPDX-License-Identifier: GPL-2.0-or-later
> +
> +Unauthenticated encryption
> +==========================
> +
> +Support for unauthenticated encryption and decryption, including bare stream
> +ciphers and other length-preserving algorithms such as block ciphers in XTS
> +mode.

This sentence no verb?

> +
> +- Support for legacy protocols that really should have chosen an authenticated
> +  mode (or even another primitive entirely) but didn't.
> +
> +- Internal components of authenticated modes.  For example, AES-CTR is used by
> +  AES-GCM and AES-CCM internally.
> +
> +- Storage encryption that cannot accommodate ciphertext expansion.  Usually
> +  AES-XTS is used for this.
> +
> +- Stream ciphers for key derivation and random number generation.
> +
> +Besides the above, these shouldn't be used.
> +
> +AES-ECB
> +-------
> +
> +Support for AES in the ECB mode of operation.
> +
> +.. kernel-doc:: include/crypto/aes-ecb.h
> diff --git a/Documentation/crypto/libcrypto.rst b/Documentation/crypto/libcrypto.rst
> index a1557d45b0e5..bbf5ca137910 100644
> --- a/Documentation/crypto/libcrypto.rst
> +++ b/Documentation/crypto/libcrypto.rst
> @@ -161,5 +161,6 @@ API documentation
>      libcrypto-blockcipher
>      libcrypto-hash
>      libcrypto-signature
> +   libcrypto-unauth-encryption
>      libcrypto-utils
>      sha3
> diff --git a/include/crypto/aes-ecb.h b/include/crypto/aes-ecb.h
> new file mode 100644
> index 000000000000..bfc56bdb082c
> --- /dev/null
> +++ b/include/crypto/aes-ecb.h
> @@ -0,0 +1,49 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * AES-ECB unauthenticated encryption and decryption
> + *
> + * Copyright 2026 Google LLC
> + */
> +#ifndef _CRYPTO_AES_ECB_H
> +#define _CRYPTO_AES_ECB_H
> +
> +#include <crypto/aes.h>
> +
> +/**
> + * aes_ecb_encrypt() - Encrypt data using AES-ECB
> + * @dst: The destination buffer.  Can be in-place or out-of-place.  For other
> + *	 overlaps the behavior is unspecified.
> + * @src: The source data
> + * @len: Number of bytes to encrypt.  Must be a multiple of AES_BLOCK_SIZE.
> + * @key: The key
> + *
> + * ECB mode is insecure by itself.  This function exists only for compatibility
> + * with legacy protocols and for internal use by other modes.
> + *
> + * This supports incremental encryption, but the length of each chunk must be a
> + * multiple of AES_BLOCK_SIZE.
> + *
> + * Context: Any context.
> + */
> +void aes_ecb_encrypt(u8 *dst, const u8 *src, size_t len, aes_encrypt_arg key);

Other similar functions like aes_encrypt() use the key as first argument ... 
so maybe do the same here, too, for consistency?

> +/**
> + * aes_ecb_decrypt() - Decrypt data using AES-ECB
> + * @dst: The destination buffer.  Can be in-place or out-of-place.  For other
> + *	 overlaps the behavior is unspecified.
> + * @src: The source data
> + * @len: Number of bytes to decrypt.  Must be a multiple of AES_BLOCK_SIZE.
> + * @key: The key
> + *
> + * ECB mode is insecure by itself.  This function exists only for compatibility
> + * with legacy protocols and for internal use by other modes.
> + *
> + * This supports incremental decryption, but the length of each chunk must be a
> + * multiple of AES_BLOCK_SIZE.
> + *
> + * Context: Any context.
> + */
> +void aes_ecb_decrypt(u8 *dst, const u8 *src, size_t len,
> +		     const struct aes_key *key);

dito

Apart from that, patch looks fine to me.

 Thomas