ocf-linux, Splitting large buffers into chunks < MAX_DATA_LEN - encryption

Question

I am using ocf-linux in an openwrt application and have run into OCF CRYPTO_MAX_DATA_LEN (64K-1) and E2BIG errors in CRYPTO_AES_CBC mode.
As a consequence, I need to split the input buffer into chunks < MAX_DATA_LEN and process chunks individually and assemble the resultant plaintext / ciphertext chunks into a large output buffer.
Google has sparse results and no code regarding this issue. Wikipedia indicates this is possible by feeding the previous iv to the next block operation:
https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher-block_chaining_.28CBC.29
QUESTIONS/POINT:
Is this possible using ocf-linux?
Has anyone run into / solved this issue and have (pseudo) code = (best practice) to share to save me re-inventing the = wheel?
3 - Can anyone see any issues with my code, below?
My current decrypt function (working for size < MAX_DATA_LEN) follows:
What I am observing is incorrect decrypted data for all but the first chunk with the initial iv. I suspect that subsequent iv's from the previous block are somehow incorrect, despite using the algorithm from wikipedia.
#define AES_CHUNK_SIZE 0xFFE0
#define IV_SIZE 128 // bits
int aes_decrypt(struct cryptodev_ctx* ctx, const void* iv, const void* ciphertext, void* plaintext, size_t size)
{
struct crypt_op cryp;
void* p;
/* check plaintext and ciphertext alignment */
if (ctx->alignmask) {
p = (void*)(((unsigned long)plaintext + ctx->alignmask) & ~ctx->alignmask);
if (plaintext != p) {
DebugPrintf( DEBUG_ERR, "%s: plaintext is not aligned\n", __func__);
return ERROR;
}
p = (void*)(((unsigned long)ciphertext + ctx->alignmask) & ~ctx->alignmask);
if (ciphertext != p) {
DebugPrintf( DEBUG_ERR, "%s: ciphertext is not aligned\n", __func__);
return ERROR;
}
}
memset(&cryp, 0, sizeof(cryp));
/* Decrypt ciphertext to plaintext */
cryp.ses = ctx->sess.ses;
cryp.len = size;
cryp.src = (void*)ciphertext;
cryp.dst = plaintext;
cryp.iv = (void*)iv;
cryp.op = COP_DECRYPT;
if ( size <= CRYPTO_MAX_DATA_LEN ) {
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
DebugPrintf( DEBUG_ERR, "%s: ioctl(CIOCCRYPT)\n", __func__);
return ERROR;
}
} else {
unsigned int i, remainder;
cryp.len = AES_CHUNK_SIZE;
remainder = size % AES_CHUNK_SIZE;
char byte;
DebugPrintf( DEBUG_ERR, "%s: Decrypting large block AES_CHUNK_SIZE: %x size: %x remainder: %x\n",
__func__,
(unsigned int) AES_CHUNK_SIZE,
(unsigned int) size,
remainder );
for (i = 0; i < (size / AES_CHUNK_SIZE); i++) {
DebugPrintf( DEBUG_ERR, "%s: Decrypting chunk: %x\n", __func__, i );
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
DebugPrintf( DEBUG_ERR, "%s: ioctl(CIOCCRYPT)\n", __func__);
return ERROR;
}
// Print first 32 bytes of decrypted chunk data
DebugPrintf( DEBUG_ERROR, "Decrypted data, Section offset: %x\n", (unsigned int) (AES_CHUNK_SIZE * i) );
for (int j = 0; j < 32 ; j++) {
byte = cryp.dst[AES_CHUNK_SIZE * i + j];
DebugPrintf( DEBUG_ERROR, "%x ", byte);
}
DebugPrintf( DEBUG_ERROR, "\n" );
cryp.src += AES_CHUNK_SIZE;
cryp.dst += AES_CHUNK_SIZE;
cryp.iv = cryp.src - (IV_SIZE / 8);
}
if ( remainder ) {
DebugPrintf( DEBUG_ERR, "%s: Decrypting last chunk: %x\n", __func__, i );
cryp.len = remainder;
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
DebugPrintf( DEBUG_ERR, "%s: ioctl(CIOCCRYPT)\n", __func__);
return ERROR;
}
DebugPrintf( DEBUG_ERROR, "Decrypted data, Section offset: %x\n", (unsigned int) (AES_CHUNK_SIZE * i) );
for (int j = 0; j < 32 ; j++) {
byte = cryp.dst[AES_CHUNK_SIZE * i + j];
DebugPrintf( DEBUG_ERROR, "%x ", byte);
}
DebugPrintf( DEBUG_ERROR, "\n" );
}
}
}
return OK;
}

Answer 1

Solved: The problem was that the ciphertext and plaintext buffers were the same and plaintext block n overwrote ciphertext n, including the IV required to decrypt block n+1. Working code follows:
I would appreciate feedback on how to eliminate the second IV copy.
int aes_decrypt(struct cryptodev_ctx* ctx, const void* iv, const void* ciphertext, void* plaintext, size_t size)
{
struct crypt_op cryp;
void* p;
/* check plaintext and ciphertext alignment */
if (ctx->alignmask) {
p = (void*)(((unsigned long)plaintext + ctx->alignmask) & ~ctx->alignmask);
if (plaintext != p) {
return ERROR;
}
p = (void*)(((unsigned long)ciphertext + ctx->alignmask) & ~ctx->alignmask);
if (ciphertext != p) {
return ERROR;
}
}
memset(&cryp, 0, sizeof(cryp));
/* Decrypt ciphertext to plaintext */
cryp.ses = ctx->sess.ses;
cryp.len = size;
cryp.src = (void*)ciphertext;
cryp.dst = plaintext;
cryp.iv = (void*)iv;
cryp.op = COP_DECRYPT;
if ( size <= CRYPTO_MAX_DATA_LEN ) {
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
return ERROR;
}
} else {
unsigned int i, remainder;
cryp.len = AES_CHUNK_SIZE;
remainder = size % AES_CHUNK_SIZE;
char this_iv[IV_SIZE / 8];
char next_iv[IV_SIZE / 8];
for (i = 0; i < (size / AES_CHUNK_SIZE); i++) {
// For case where ciphertext and plaintext use same buffer (ciphertext overwritten by plaintext)
// need to copy the last block of ciphertext from CHUNK n
// to use as IV for chunk n + 1
memcpy( next_iv, cryp.src + AES_CHUNK_SIZE - (IV_SIZE / 8), IV_SIZE / 8);
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
return ERROR;
}
cryp.src += AES_CHUNK_SIZE;
cryp.dst += AES_CHUNK_SIZE;
memcpy( this_iv, next_iv, IV_SIZE / 8);
cryp.iv = (void*) &this_iv;
}
if ( remainder ) {
cryp.len = remainder;
if (ioctl(ctx->cfd, CIOCCRYPT, &cryp)) {
return ERROR;
}
}
}
return OK;
}
Regards;
Bill Ross

Answer 2

In any mode other than ECB, the IV should always be fresh for every different invocation of encryption. Otherwise, IV would be guessable from the ciphertext, and security of the encryption compromised.
If while encryption, the IV for the current block coincides with one for another block, security will be weaken, hence the length limit.