On Sat, Mar 21, 2026 at 12:53:38AM -0700, Eric Biggers wrote: > Convert the implementation of the v1 (original / deprecated) fscrypt > per-file key derivation algorithm to use the AES library instead of an > "ecb(aes)" crypto_skcipher. This is much simpler. > > While the AES library doesn't support AES-ECB directly yet, we can still > simply call aes_encrypt() in a loop. While that doesn't explicitly > parallelize the AES encryptions, it doesn't really matter in this case, > where a new key is used each time and only 16 to 64 bytes are encrypted. > > In fact, a quick benchmark (AMD Ryzen 9 9950X) shows that this commit > actually greatly improves performance, from ~7000 cycles per key derived > to ~1500. The times don't differ much between 32 bytes and 64 bytes > either, so clearly the bottleneck is API stuff and key expansion. > > Granted, performance of the v1 key derivation is no longer very > relevant: most users have moved onto v2 encryption policies. The v2 key > derivation uses HKDF-SHA512 (which is ~3500 cycles on the same CPU). > > Still, it's nice that the simpler solution is much faster as well. > > Compatibility verified with xfstests generic/548. > > Signed-off-by: Eric Biggers <[email protected]> > --- > > This patch is targeting fscrypt/for-next > > fs/crypto/Kconfig | 2 +- > fs/crypto/keysetup_v1.c | 87 +++++++++++++---------------------------- > 2 files changed, 29 insertions(+), 60 deletions(-)
Applied to https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=for-next - Eric
