From: Michael Brown <mcb30@ipxe.org>
Date: Wed, 29 Jul 2026 16:41:45 +0000 (+0100)
Subject: [crypto] Add confidentiality flag for cipher algorithms
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fipxe.git

[crypto] Add confidentiality flag for cipher algorithms

Add a flag that indicates whether or not a cipher is capable of
providing confidentiality.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/crypto/aes.c b/src/crypto/aes.c
index c98361474..c68ed34d0 100644
--- a/src/crypto/aes.c
+++ b/src/crypto/aes.c
@@ -793,6 +793,7 @@ struct cipher_algorithm aes_algorithm = {
 	.blocksize = AES_BLOCKSIZE,
 	.alignsize = 0,
 	.authsize = 0,
+	.confidential = 1,
 	.setkey = aes_setkey,
 	.setiv = cipher_null_setiv,
 	.encrypt = aes_encrypt,
diff --git a/src/crypto/arc4.c b/src/crypto/arc4.c
index 2866688eb..384fd4b5b 100644
--- a/src/crypto/arc4.c
+++ b/src/crypto/arc4.c
@@ -126,6 +126,7 @@ struct cipher_algorithm arc4_algorithm = {
 	.blocksize = 1,
 	.alignsize = 1,
 	.authsize = 0,
+	.confidential = 1,
 	.setkey = arc4_setkey,
 	.setiv = cipher_null_setiv,
 	.encrypt = arc4_xor,
diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c
index d0f6a1a99..c3a1edd99 100644
--- a/src/crypto/crypto_null.c
+++ b/src/crypto/crypto_null.c
@@ -97,6 +97,7 @@ struct cipher_algorithm cipher_null = {
 	.blocksize = 1,
 	.alignsize = 1,
 	.authsize = 0,
+	.confidential = 0,
 	.setkey = cipher_null_setkey,
 	.setiv = cipher_null_setiv,
 	.encrypt = cipher_null_encrypt,
diff --git a/src/crypto/des.c b/src/crypto/des.c
index 938643e1b..685c417bb 100644
--- a/src/crypto/des.c
+++ b/src/crypto/des.c
@@ -687,6 +687,7 @@ struct cipher_algorithm des_algorithm = {
 	.blocksize = DES_BLOCKSIZE,
 	.alignsize = 0,
 	.authsize = 0,
+	.confidential = 1,
 	.setkey = des_setkey,
 	.setiv = cipher_null_setiv,
 	.encrypt = des_encrypt,
diff --git a/src/include/ipxe/cbc.h b/src/include/ipxe/cbc.h
index ddc9c5986..b980169cd 100644
--- a/src/include/ipxe/cbc.h
+++ b/src/include/ipxe/cbc.h
@@ -45,6 +45,7 @@ struct cipher_algorithm _cbc_cipher = {					\
 	.blocksize	= _blocksize,					\
 	.alignsize	= _blocksize,					\
 	.authsize	= 0,						\
+	.confidential	= 1,						\
 	.setkey		= cbc_setkey,					\
 	.setiv		= cbc_setiv,					\
 	.encrypt	= cbc_encrypt,					\
diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h
index 72f4b7376..d9d758643 100644
--- a/src/include/ipxe/crypto.h
+++ b/src/include/ipxe/crypto.h
@@ -80,6 +80,8 @@ struct cipher_algorithm {
 	size_t alignsize;
 	/** Authentication tag size */
 	size_t authsize;
+	/** Cipher is capable of providing confidentiality */
+	int confidential;
 	/** Set key
 	 *
 	 * @v cipher	Cipher algorithm
diff --git a/src/include/ipxe/ecb.h b/src/include/ipxe/ecb.h
index 791ab067c..20090bd68 100644
--- a/src/include/ipxe/ecb.h
+++ b/src/include/ipxe/ecb.h
@@ -36,6 +36,7 @@ struct cipher_algorithm _ecb_cipher = {					\
 	.blocksize	= _blocksize,					\
 	.alignsize	= _blocksize,					\
 	.authsize	= 0,						\
+	.confidential	= 1,						\
 	.setkey		= ecb_setkey,					\
 	.setiv		= cipher_null_setiv,				\
 	.encrypt	= ecb_encrypt,					\
diff --git a/src/include/ipxe/gcm.h b/src/include/ipxe/gcm.h
index 9976a4d82..ac60deb53 100644
--- a/src/include/ipxe/gcm.h
+++ b/src/include/ipxe/gcm.h
@@ -95,6 +95,7 @@ struct cipher_algorithm _gcm_cipher = {					\
 	.blocksize	= 1,						\
 	.alignsize	= sizeof ( union gcm_block ),			\
 	.authsize	= sizeof ( union gcm_block ),			\
+	.confidential	= 1,						\
 	.setkey		= gcm_setkey,					\
 	.setiv		= gcm_setiv,					\
 	.encrypt	= gcm_encrypt,					\
diff --git a/src/tests/cipher_test.c b/src/tests/cipher_test.c
index 68108cef6..f87503214 100644
--- a/src/tests/cipher_test.c
+++ b/src/tests/cipher_test.c
@@ -182,6 +182,7 @@ void cipher_okx ( struct cipher_test *test, const char *file,
 	okx ( cipher->blocksize != 0, file, line );
 	okx ( ( len % cipher->blocksize ) == 0, file, line );
 	okx ( ( cipher->alignsize % cipher->blocksize ) == 0, file, line );
+	okx ( cipher->confidential, file, line );
 
 	/* Report encryption test result */
 	cipher_encrypt_okx ( test, file, line );