On Thu, Feb 14, 2019 at 09:14:13AM +0100, Ard Biesheuvel wrote: > On Thu, 14 Feb 2019 at 09:04, Eric Biggers <ebiggers@xxxxxxxxxx> wrote: > > > > From: Eric Biggers <ebiggers@xxxxxxxxxx> > > > > Make the arm64 ctr-aes-neon and ctr-aes-ce algorithms update the IV > > buffer to contain the next counter after processing a partial final > > block, rather than leave it as the last counter. This makes these > > algorithms pass the updated AES-CTR tests. > > > > Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> > > I take it this means we return an output IV even if the algorithm > could never proceed in a meaningful way, given that we throw away some > keystream bits that would be needed in that case. > > That means this change is strictly there to make the test framework > happy, even for cases that can never appear in reality. > > Wouldn't it be better not to set out_iv for input buffers whose size > is not a multiple of the block size? > See the explanation in patch 4 for why the tests test for this. It's not a super strong argument but this seems like the best thing to do. - Eric
