From 60e9a0f5bec2e93c6e8fd462850676f488aa51c8 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 2 Aug 2026 15:24:06 -0700
Subject: lib/crypto: fips: Split fips.h into fips-aes.h and fips-sha.h

In preparation for adding FIPS self-tests for AES encryption modes,
split fips.h into separate files for the AES and SHA test vectors.

They are still generated by the same script, but this keeps things a bit
more organized.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260802222408.91757-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 scripts/crypto/gen-fips-testvecs.py | 93 ++++++++++++++++++++++++-------------
 1 file changed, 62 insertions(+), 31 deletions(-)

(limited to 'scripts')

diff --git a/scripts/crypto/gen-fips-testvecs.py b/scripts/crypto/gen-fips-testvecs.py
index 9f18bcb97412..aa6c0a81fbf8 100755
--- a/scripts/crypto/gen-fips-testvecs.py
+++ b/scripts/crypto/gen-fips-testvecs.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
-# Script that generates lib/crypto/fips.h
+# Script that generates lib/crypto/fips-aes.h and lib/crypto/fips-sha.h
 #
 # Requires that python-cryptography be installed.
 #
@@ -12,35 +12,66 @@ import cryptography.hazmat.primitives.cmac
 import hashlib
 import hmac
 
-fips_test_data = b"fips test data\0\0"
-fips_test_key = b"fips test key\0\0\0"
 
-def print_static_u8_array_definition(name, value):
-    print('')
-    print(f'static const u8 {name}[] __initconst __maybe_unused = {{')
+def print_static_u8_array_definition(file, name, value):
+    print("", file=file)
+    print(f"static const u8 {name}[] __initconst __maybe_unused = {{", file=file)
     for i in range(0, len(value), 8):
-        line = '\t' + ''.join(f'0x{b:02x}, ' for b in value[i:i+8])
-        print(f'{line.rstrip()}')
-    print('};')
-
-print('/* SPDX-License-Identifier: GPL-2.0-or-later */')
-print(f'/* This file was generated by: gen-fips-testvecs.py */')
-print()
-print('#include <linux/fips.h>')
-
-print_static_u8_array_definition("fips_test_data", fips_test_data)
-print_static_u8_array_definition("fips_test_key", fips_test_key)
-
-for alg in 'sha1', 'sha256', 'sha512':
-    ctx = hmac.new(fips_test_key, digestmod=alg)
-    ctx.update(fips_test_data)
-    print_static_u8_array_definition(f'fips_test_hmac_{alg}_value', ctx.digest())
-
-print_static_u8_array_definition(f'fips_test_sha3_256_value',
-                                 hashlib.sha3_256(fips_test_data).digest())
-
-aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_key)
-aes_cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
-aes_cmac.update(fips_test_data)
-print_static_u8_array_definition('fips_test_aes_cmac_value',
-                                 aes_cmac.finalize())
+        line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 8])
+        print(f"{line.rstrip()}", file=file)
+    print("};", file=file)
+
+
+def print_header(file):
+    print("/* SPDX-License-Identifier: GPL-2.0-or-later */", file=file)
+    print("/* This file was generated by: gen-fips-testvecs.py */", file=file)
+    print("/* clang-format off */", file=file)
+    print("", file=file)
+    print("#include <linux/fips.h>", file=file)
+
+
+def gen_aes_test_data(file):
+    fips_test_data = b"fips test data\0\0"
+    fips_test_key = b"fips test key\0\0\0"
+
+    print_header(file)
+    print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+    print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
+
+    aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_key)
+    aes_cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
+    aes_cmac.update(fips_test_data)
+    print_static_u8_array_definition(
+        file, "fips_test_aes_cmac_value", aes_cmac.finalize()
+    )
+
+
+def gen_sha_test_data(file):
+    fips_test_data = b"fips test data\0\0"
+    fips_test_key = b"fips test key\0\0\0"
+
+    print_header(file)
+    print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+    print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
+
+    for alg in "sha1", "sha256", "sha512":
+        ctx = hmac.new(fips_test_key, digestmod=alg)
+        ctx.update(fips_test_data)
+        print_static_u8_array_definition(
+            file, f"fips_test_hmac_{alg}_value", ctx.digest()
+        )
+
+    print_static_u8_array_definition(
+        file, "fips_test_sha3_256_value", hashlib.sha3_256(fips_test_data).digest()
+    )
+
+
+filename = "lib/crypto/fips-aes.h"
+with open(filename, "w") as file:
+    print(f"Generating {filename}")
+    gen_aes_test_data(file)
+
+filename = "lib/crypto/fips-sha.h"
+with open(filename, "w") as file:
+    print(f"Generating {filename}")
+    gen_sha_test_data(file)
-- 
cgit v1.2.3


From e967fa98f7618e98b50b3d49a1768deba8981a98 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 2 Aug 2026 15:24:07 -0700
Subject: lib/crypto: aes: Add FIPS self-tests for unauthenticated modes

Upcoming changes will wire up architecture-optimized implementations of
ECB, CBC, CBC-CTS, CTR, and XTS.  FIPS labs can consider such designs to
meet the threshold for separate self-tests to be needed.

The inverse direction of the block cipher also needs to be exercised,
which the existing CMAC self-test doesn't do.

Therefore, add FIPS self-tests for encryption and decryption in these
modes as well as the "bare" AES.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260802222408.91757-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/aes.c                    | 176 +++++++++++++++++++++++++++++++++++-
 lib/crypto/fips-aes.h               |  39 ++++++++
 scripts/crypto/gen-fips-testvecs.py |  48 ++++++++++
 3 files changed, 258 insertions(+), 5 deletions(-)

(limited to 'scripts')

diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index 617c913d512e..e9119f82b0cc 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c
@@ -522,6 +522,26 @@ void aes_decrypt(const struct aes_key *key, u8 out[AES_BLOCK_SIZE],
 }
 EXPORT_SYMBOL(aes_decrypt);
 
+/* FIPS cryptographic algorithm self-test for "bare" AES */
+static void __init aes_fips_test(void)
+{
+	struct aes_key key;
+	u8 data[AES_BLOCK_SIZE];
+
+	if (aes_preparekey(&key, fips_test_key, sizeof(fips_test_key)) != 0)
+		panic("aes: FIPS self-test failed (preparekey)\n");
+
+	aes_encrypt(&key, data, fips_test_data);
+	if (memcmp(fips_test_aes_ecb_ctext, data, sizeof(data)) != 0)
+		panic("aes: FIPS self-test failed (wrong ciphertext)\n");
+
+	aes_decrypt(&key, data, data);
+	if (memcmp(fips_test_data, data, sizeof(data)) != 0)
+		panic("aes: FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CBC_MACS)
 
 #ifndef aes_cbcmac_blocks_arch
@@ -797,7 +817,31 @@ void aes_ecb_decrypt(u8 *dst, const u8 *src, size_t len,
 		aes_decrypt(key, &dst[i], &src[i]);
 }
 EXPORT_SYMBOL_GPL(aes_ecb_decrypt);
-#endif /* CONFIG_CRYPTO_LIB_AES_ECB */
+
+/* FIPS cryptographic algorithm self-test for AES-ECB */
+static void __init aes_ecb_fips_test(void)
+{
+	struct aes_key key;
+	u8 data[sizeof(fips_test_data)];
+
+	if (aes_preparekey(&key, fips_test_key, sizeof(fips_test_key)) != 0)
+		panic("aes: ECB FIPS self-test failed (preparekey)\n");
+
+	aes_ecb_encrypt(data, fips_test_data, sizeof(data), &key);
+	if (memcmp(fips_test_aes_ecb_ctext, data, sizeof(data)) != 0)
+		panic("aes: ECB FIPS self-test failed (wrong ciphertext)\n");
+
+	aes_ecb_decrypt(data, data, sizeof(data), &key);
+	if (memcmp(fips_test_data, data, sizeof(data)) != 0)
+		panic("aes: ECB FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+#else /* CONFIG_CRYPTO_LIB_AES_ECB */
+static inline void aes_ecb_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_ECB */
 
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CBC)
 /*
@@ -983,7 +1027,66 @@ void aes_cbc_cts_decrypt(u8 *dst, const u8 *src, size_t len,
 	crypto_xor(pad, iv, AES_BLOCK_SIZE); /* P[n - 1] */
 }
 EXPORT_SYMBOL_GPL(aes_cbc_cts_decrypt);
-#endif /* CONFIG_CRYPTO_LIB_AES_CBC */
+
+/* FIPS cryptographic algorithm self-test for AES-CBC */
+static void __init aes_cbc_fips_test(void)
+{
+	struct aes_key key;
+	u8 iv[AES_BLOCK_SIZE];
+	u8 data[sizeof(fips_test_data)];
+
+	if (aes_preparekey(&key, fips_test_key, sizeof(fips_test_key)) != 0)
+		panic("aes: CBC FIPS self-test failed (preparekey)\n");
+
+	memcpy(iv, fips_test_iv, sizeof(iv));
+	aes_cbc_encrypt(data, fips_test_data, sizeof(data), iv, &key);
+	if (memcmp(fips_test_aes_cbc_ctext, data, sizeof(data)) != 0)
+		panic("aes: CBC FIPS self-test failed (wrong ciphertext)\n");
+
+	memcpy(iv, fips_test_iv, sizeof(iv));
+	aes_cbc_decrypt(data, data, sizeof(data), iv, &key);
+	if (memcmp(fips_test_data, data, sizeof(data)) != 0)
+		panic("aes: CBC FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+
+/* FIPS cryptographic algorithm self-test for AES-CBC-CTS */
+static void __init aes_cbc_cts_fips_test(void)
+{
+	struct aes_key key;
+	u8 iv[AES_BLOCK_SIZE];
+	const size_t data_len = 2 * AES_BLOCK_SIZE;
+	u8 ptext[2 * AES_BLOCK_SIZE];
+	u8 data[2 * AES_BLOCK_SIZE];
+
+	/* ptext = fips_test_data || fips_test_data */
+	memcpy(ptext, fips_test_data, AES_BLOCK_SIZE);
+	memcpy(&ptext[AES_BLOCK_SIZE], ptext, AES_BLOCK_SIZE);
+
+	if (aes_preparekey(&key, fips_test_key, sizeof(fips_test_key)) != 0)
+		panic("aes: CBC-CTS FIPS self-test failed (preparekey)\n");
+
+	memcpy(iv, fips_test_iv, sizeof(iv));
+	aes_cbc_cts_encrypt(data, ptext, data_len, iv, &key);
+	if (memcmp(fips_test_aes_cbc_cts_ctext, data, data_len) != 0)
+		panic("aes: CBC-CTS FIPS self-test failed (wrong ciphertext)\n");
+
+	memcpy(iv, fips_test_iv, sizeof(iv));
+	aes_cbc_cts_decrypt(data, data, data_len, iv, &key);
+	if (memcmp(ptext, data, data_len) != 0)
+		panic("aes: CBC-CTS FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+#else /* CONFIG_CRYPTO_LIB_AES_CBC */
+static inline void aes_cbc_fips_test(void)
+{
+}
+static inline void aes_cbc_cts_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_CBC */
 
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CTR)
 /*
@@ -1078,7 +1181,34 @@ void aes_xctr(u8 *dst, const u8 *src, size_t len, u64 *ctr,
 	memzero_explicit(aes_input, sizeof(aes_input));
 }
 EXPORT_SYMBOL_GPL(aes_xctr);
-#endif /* CONFIG_CRYPTO_LIB_AES_CTR */
+
+/* FIPS cryptographic algorithm self-test for AES-CTR */
+static void __init aes_ctr_fips_test(void)
+{
+	struct aes_enckey key;
+	u8 ctr[AES_BLOCK_SIZE];
+	u8 data[sizeof(fips_test_data)];
+
+	if (aes_prepareenckey(&key, fips_test_key, sizeof(fips_test_key)) != 0)
+		panic("aes: CTR FIPS self-test failed (preparekey)\n");
+
+	memcpy(ctr, fips_test_iv, sizeof(ctr));
+	aes_ctr(data, fips_test_data, sizeof(data), ctr, &key);
+	if (memcmp(fips_test_aes_ctr_ctext, data, sizeof(data)) != 0)
+		panic("aes: CTR FIPS self-test failed (wrong ciphertext)\n");
+
+	memcpy(ctr, fips_test_iv, sizeof(ctr));
+	aes_ctr(data, data, sizeof(data), ctr, &key);
+	if (memcmp(fips_test_data, data, sizeof(data)) != 0)
+		panic("aes: CTR FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+#else /* CONFIG_CRYPTO_LIB_AES_CTR */
+static inline void aes_ctr_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_CTR */
 
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_XTS)
 int aes_xts_preparekey(struct aes_xts_key *key, const u8 *in_key,
@@ -1307,7 +1437,36 @@ void aes_xts_decrypt(u8 *dst, const u8 *src, size_t len,
 	aes_xts_decrypt_nocts(dst, src, len, tweak, key, cont);
 }
 EXPORT_SYMBOL_GPL(aes_xts_decrypt);
-#endif /* CONFIG_CRYPTO_LIB_AES_XTS */
+
+/* FIPS cryptographic algorithm self-test for AES-XTS */
+static void __init aes_xts_fips_test(void)
+{
+	struct aes_xts_key *key __free(kfree_sensitive) = kmalloc_obj(*key);
+	u8 tweak[AES_BLOCK_SIZE];
+	u8 data[sizeof(fips_test_data)];
+
+	if (key == NULL)
+		panic("aes: XTS FIPS self-test failed (kmalloc)\n");
+
+	if (aes_xts_preparekey(key, fips_test_xts_key,
+			       sizeof(fips_test_xts_key), 0) != 0)
+		panic("aes: XTS FIPS self-test failed (preparekey)\n");
+
+	memcpy(tweak, fips_test_iv, sizeof(tweak));
+	aes_xts_encrypt(data, fips_test_data, sizeof(data), tweak, key, false);
+	if (memcmp(fips_test_aes_xts_ctext, data, sizeof(data)) != 0)
+		panic("aes: XTS FIPS self-test failed (wrong ciphertext)\n");
+
+	memcpy(tweak, fips_test_iv, sizeof(tweak));
+	aes_xts_decrypt(data, data, sizeof(data), tweak, key, false);
+	if (memcmp(fips_test_data, data, sizeof(data)) != 0)
+		panic("aes: XTS FIPS self-test failed (wrong plaintext)\n");
+}
+#else /* CONFIG_CRYPTO_LIB_AES_XTS */
+static inline void aes_xts_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_XTS */
 
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_GCM)
 /*
@@ -1905,8 +2064,15 @@ static int __init aes_mod_init(void)
 #ifdef aes_mod_init_arch
 	aes_mod_init_arch();
 #endif
-	if (fips_enabled)
+	if (fips_enabled) {
+		aes_fips_test();
 		aes_cmac_fips_test();
+		aes_ecb_fips_test();
+		aes_cbc_fips_test();
+		aes_cbc_cts_fips_test();
+		aes_ctr_fips_test();
+		aes_xts_fips_test();
+	}
 	return 0;
 }
 subsys_initcall(aes_mod_init);
diff --git a/lib/crypto/fips-aes.h b/lib/crypto/fips-aes.h
index b257cb216871..cfacf5d98e07 100644
--- a/lib/crypto/fips-aes.h
+++ b/lib/crypto/fips-aes.h
@@ -9,12 +9,51 @@ static const u8 fips_test_data[] __initconst __maybe_unused = {
 	0x74, 0x20, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
 };
 
+static const u8 fips_test_iv[] __initconst __maybe_unused = {
+	0x66, 0x69, 0x70, 0x73, 0x20, 0x74, 0x65, 0x73,
+	0x74, 0x20, 0x69, 0x76, 0x00, 0x00, 0x00, 0x00,
+};
+
 static const u8 fips_test_key[] __initconst __maybe_unused = {
 	0x66, 0x69, 0x70, 0x73, 0x20, 0x74, 0x65, 0x73,
 	0x74, 0x20, 0x6b, 0x65, 0x79, 0x00, 0x00, 0x00,
 };
 
+static const u8 fips_test_xts_key[] __initconst __maybe_unused = {
+	0x6b, 0x65, 0x79, 0x31, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x6b, 0x65, 0x79, 0x32, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
 static const u8 fips_test_aes_cmac_value[] __initconst __maybe_unused = {
 	0xc5, 0x88, 0x28, 0x55, 0xd7, 0x2c, 0x00, 0xb6,
 	0x6a, 0xa7, 0xfc, 0x82, 0x90, 0x81, 0xcf, 0x18,
 };
+
+static const u8 fips_test_aes_ecb_ctext[] __initconst __maybe_unused = {
+	0x47, 0x76, 0x48, 0xaf, 0x1b, 0xd8, 0x4c, 0xe6,
+	0xb5, 0xa7, 0x20, 0x8d, 0x64, 0x88, 0xbc, 0x3f,
+};
+
+static const u8 fips_test_aes_cbc_ctext[] __initconst __maybe_unused = {
+	0xc8, 0x7d, 0x7c, 0x25, 0xba, 0x15, 0xf7, 0xe1,
+	0x08, 0xa0, 0xd0, 0x7a, 0x20, 0x37, 0xaf, 0x5e,
+};
+
+static const u8 fips_test_aes_cbc_cts_ctext[] __initconst __maybe_unused = {
+	0x36, 0x8e, 0x37, 0xb4, 0x78, 0xe2, 0x88, 0x59,
+	0xd5, 0xe8, 0x17, 0x65, 0x5c, 0xa1, 0x25, 0xe6,
+	0xc8, 0x7d, 0x7c, 0x25, 0xba, 0x15, 0xf7, 0xe1,
+	0x08, 0xa0, 0xd0, 0x7a, 0x20, 0x37, 0xaf, 0x5e,
+};
+
+static const u8 fips_test_aes_ctr_ctext[] __initconst __maybe_unused = {
+	0x95, 0xf4, 0xf4, 0x7a, 0xc8, 0xa2, 0x53, 0x73,
+	0x53, 0x8f, 0x95, 0xfc, 0x18, 0xfe, 0x58, 0x2f,
+};
+
+static const u8 fips_test_aes_xts_ctext[] __initconst __maybe_unused = {
+	0xd4, 0x51, 0x7f, 0x01, 0x14, 0x91, 0x16, 0x29,
+	0x26, 0xbe, 0xec, 0x9b, 0x90, 0xed, 0x59, 0x30,
+};
diff --git a/scripts/crypto/gen-fips-testvecs.py b/scripts/crypto/gen-fips-testvecs.py
index aa6c0a81fbf8..a79eaf081c26 100755
--- a/scripts/crypto/gen-fips-testvecs.py
+++ b/scripts/crypto/gen-fips-testvecs.py
@@ -32,19 +32,67 @@ def print_header(file):
 
 def gen_aes_test_data(file):
     fips_test_data = b"fips test data\0\0"
+    fips_test_iv = b"fips test iv\0\0\0\0"
     fips_test_key = b"fips test key\0\0\0"
+    fips_test_xts_key = b"key1" + (b"\0" * 12) + b"key2" + (b"\0" * 12)
 
     print_header(file)
     print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+    print_static_u8_array_definition(file, "fips_test_iv", fips_test_iv)
     print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
+    print_static_u8_array_definition(file, "fips_test_xts_key", fips_test_xts_key)
 
     aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_key)
+
+    # AES-CMAC
     aes_cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
     aes_cmac.update(fips_test_data)
     print_static_u8_array_definition(
         file, "fips_test_aes_cmac_value", aes_cmac.finalize()
     )
 
+    # AES-ECB
+    cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+        aes, cryptography.hazmat.primitives.ciphers.modes.ECB()
+    )
+    encryptor = cipher.encryptor()
+    ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+    print_static_u8_array_definition(file, "fips_test_aes_ecb_ctext", ctext)
+
+    # AES-CBC
+    cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+        aes, cryptography.hazmat.primitives.ciphers.modes.CBC(fips_test_iv)
+    )
+    encryptor = cipher.encryptor()
+    ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+    print_static_u8_array_definition(file, "fips_test_aes_cbc_ctext", ctext)
+
+    # AES-CBC-CTS
+    cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+        aes, cryptography.hazmat.primitives.ciphers.modes.CBC(fips_test_iv)
+    )
+    encryptor = cipher.encryptor()
+    ctext = encryptor.update(fips_test_data * 2) + encryptor.finalize()
+    ctext = ctext[16:32] + ctext[0:16]
+    print_static_u8_array_definition(file, "fips_test_aes_cbc_cts_ctext", ctext)
+
+    # AES-CTR
+    cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+        aes, cryptography.hazmat.primitives.ciphers.modes.CTR(fips_test_iv)
+    )
+    encryptor = cipher.encryptor()
+    ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+    print_static_u8_array_definition(file, "fips_test_aes_ctr_ctext", ctext)
+
+    # AES-XTS
+    cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+        cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_xts_key),
+        cryptography.hazmat.primitives.ciphers.modes.XTS(fips_test_iv),
+    )
+    encryptor = cipher.encryptor()
+    ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+    print_static_u8_array_definition(file, "fips_test_aes_xts_ctext", ctext)
+
 
 def gen_sha_test_data(file):
     fips_test_data = b"fips test data\0\0"
-- 
cgit v1.2.3


From fbdb43c0007b37e574fa0ca76afd13bed96db8f6 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 2 Aug 2026 15:24:08 -0700
Subject: lib/crypto: aes: Add FIPS self-tests for GCM and CCM

Upcoming changes will wire up architecture-optimized implementations of
GCM and CCM.  FIPS labs can consider such designs to meet the threshold
for separate self-tests to be needed.

Therefore, add FIPS self-tests for encryption and decryption in these
modes.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260802222408.91757-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/aes.c                    | 81 ++++++++++++++++++++++++++++++++-----
 lib/crypto/fips-aes.h               | 19 +++++++++
 scripts/crypto/gen-fips-testvecs.py | 23 +++++++++++
 3 files changed, 113 insertions(+), 10 deletions(-)

(limited to 'scripts')

diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index e9119f82b0cc..41aaa82cb1a1 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c
@@ -737,14 +737,7 @@ void aes_cbcmac_final(struct aes_cbcmac_ctx *ctx, u8 out[AES_BLOCK_SIZE])
 }
 EXPORT_SYMBOL_NS_GPL(aes_cbcmac_final, "CRYPTO_INTERNAL");
 
-/*
- * FIPS cryptographic algorithm self-test for AES-CMAC.  As per the FIPS 140-3
- * Implementation Guidance, a cryptographic algorithm self-test for at least one
- * of AES-GCM, AES-CCM, AES-CMAC, or AES-GMAC is required if any of those modes
- * is implemented.  This fulfills that requirement via AES-CMAC.
- *
- * This is just for FIPS.  The full tests are in the KUnit test suite.
- */
+/* FIPS cryptographic algorithm self-test for AES-CMAC */
 static void __init aes_cmac_fips_test(void)
 {
 	struct aes_cmac_key key;
@@ -1745,7 +1738,37 @@ int aes_gcm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
 }
 EXPORT_SYMBOL_GPL(aes_gcm_decrypt);
 
-#endif /* CONFIG_CRYPTO_LIB_AES_GCM */
+/* FIPS cryptographic algorithm self-test for AES-GCM */
+static void __init aes_gcm_fips_test(void)
+{
+	const size_t data_len = sizeof(fips_test_data);
+	u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE];
+	struct aes_gcm_key key;
+	int err;
+
+	if (aes_gcm_preparekey(&key, fips_test_key, sizeof(fips_test_key),
+			       AES_BLOCK_SIZE) != 0)
+		panic("aes: GCM FIPS self-test failed (preparekey)\n");
+
+	aes_gcm_encrypt(buf, fips_test_data, data_len, &buf[data_len],
+			fips_test_ad, sizeof(fips_test_ad), fips_test_iv, &key);
+	if (memcmp(fips_test_aes_gcm_ctext_and_tag, buf, sizeof(buf)) != 0)
+		panic("aes: GCM FIPS self-test failed (wrong ciphertext and/or tag)\n");
+
+	err = aes_gcm_decrypt(buf, buf, data_len, &buf[data_len], fips_test_ad,
+			      sizeof(fips_test_ad), fips_test_iv, &key);
+	if (err != 0)
+		panic("aes: GCM FIPS self-test failed (decryption failed)\n");
+	if (memcmp(fips_test_data, buf, data_len) != 0)
+		panic("aes: GCM FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+#else /* CONFIG_CRYPTO_LIB_AES_GCM */
+static inline void aes_gcm_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_GCM */
 
 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CCM)
 int aes_ccm_preparekey(struct aes_ccm_key *key, const u8 *in_key,
@@ -2057,7 +2080,43 @@ int aes_ccm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
 	return err;
 }
 EXPORT_SYMBOL_GPL(aes_ccm_decrypt);
-#endif /* CONFIG_CRYPTO_LIB_AES_CCM */
+
+/* FIPS cryptographic algorithm self-test for AES-CCM */
+static void __init aes_ccm_fips_test(void)
+{
+	const size_t data_len = sizeof(fips_test_data);
+	const size_t nonce_len = 13;
+	u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE];
+	struct aes_ccm_key key;
+	int err;
+
+	if (aes_ccm_preparekey(&key, fips_test_key, sizeof(fips_test_key),
+			       AES_BLOCK_SIZE) != 0)
+		panic("aes: CCM FIPS self-test failed (preparekey)\n");
+
+	err = aes_ccm_encrypt(buf, fips_test_data, data_len, &buf[data_len],
+			      fips_test_ad, sizeof(fips_test_ad), fips_test_iv,
+			      nonce_len, &key);
+	if (err != 0)
+		panic("aes: CCM FIPS self-test failed (encryption failed)\n");
+	if (memcmp(fips_test_aes_ccm_ctext_and_tag, buf, sizeof(buf)) != 0)
+		panic("aes: CCM FIPS self-test failed (wrong ciphertext and/or tag)\n");
+
+	err = aes_ccm_decrypt(buf, buf, data_len, &buf[data_len], fips_test_ad,
+			      sizeof(fips_test_ad), fips_test_iv, nonce_len,
+			      &key);
+	if (err != 0)
+		panic("aes: CCM FIPS self-test failed (decryption failed)\n");
+	if (memcmp(fips_test_data, buf, data_len) != 0)
+		panic("aes: CCM FIPS self-test failed (wrong plaintext)\n");
+
+	memzero_explicit(&key, sizeof(key));
+}
+#else /* CONFIG_CRYPTO_LIB_AES_CCM */
+static inline void aes_ccm_fips_test(void)
+{
+}
+#endif /* !CONFIG_CRYPTO_LIB_AES_CCM */
 
 static int __init aes_mod_init(void)
 {
@@ -2072,6 +2131,8 @@ static int __init aes_mod_init(void)
 		aes_cbc_cts_fips_test();
 		aes_ctr_fips_test();
 		aes_xts_fips_test();
+		aes_gcm_fips_test();
+		aes_ccm_fips_test();
 	}
 	return 0;
 }
diff --git a/lib/crypto/fips-aes.h b/lib/crypto/fips-aes.h
index cfacf5d98e07..2a1746606533 100644
--- a/lib/crypto/fips-aes.h
+++ b/lib/crypto/fips-aes.h
@@ -9,6 +9,11 @@ static const u8 fips_test_data[] __initconst __maybe_unused = {
 	0x74, 0x20, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
 };
 
+static const u8 fips_test_ad[] __initconst __maybe_unused = {
+	0x66, 0x69, 0x70, 0x73, 0x20, 0x74, 0x65, 0x73,
+	0x74, 0x20, 0x61, 0x64, 0x00, 0x00, 0x00, 0x00,
+};
+
 static const u8 fips_test_iv[] __initconst __maybe_unused = {
 	0x66, 0x69, 0x70, 0x73, 0x20, 0x74, 0x65, 0x73,
 	0x74, 0x20, 0x69, 0x76, 0x00, 0x00, 0x00, 0x00,
@@ -57,3 +62,17 @@ static const u8 fips_test_aes_xts_ctext[] __initconst __maybe_unused = {
 	0xd4, 0x51, 0x7f, 0x01, 0x14, 0x91, 0x16, 0x29,
 	0x26, 0xbe, 0xec, 0x9b, 0x90, 0xed, 0x59, 0x30,
 };
+
+static const u8 fips_test_aes_gcm_ctext_and_tag[] __initconst __maybe_unused = {
+	0x12, 0x0c, 0x5d, 0x03, 0x32, 0x93, 0x13, 0x44,
+	0x06, 0x35, 0x26, 0x9d, 0xe0, 0xea, 0xbc, 0xe2,
+	0x30, 0xa9, 0xa4, 0x15, 0xc5, 0x3d, 0xb3, 0xf9,
+	0x30, 0x82, 0xdf, 0x9c, 0xd8, 0xc4, 0x3f, 0x2f,
+};
+
+static const u8 fips_test_aes_ccm_ctext_and_tag[] __initconst __maybe_unused = {
+	0x11, 0x8e, 0x01, 0xcb, 0xb5, 0x22, 0x6d, 0xb4,
+	0x66, 0x98, 0x97, 0x1d, 0x35, 0x53, 0x78, 0xdd,
+	0xd1, 0xc5, 0xff, 0xb6, 0x90, 0xcf, 0xb1, 0xf2,
+	0x87, 0x99, 0xd6, 0x1e, 0xd5, 0xd1, 0xed, 0x63,
+};
diff --git a/scripts/crypto/gen-fips-testvecs.py b/scripts/crypto/gen-fips-testvecs.py
index a79eaf081c26..b8c8a78cb8a8 100755
--- a/scripts/crypto/gen-fips-testvecs.py
+++ b/scripts/crypto/gen-fips-testvecs.py
@@ -8,6 +8,7 @@
 # Copyright 2025 Google LLC
 
 import cryptography.hazmat.primitives.ciphers
+import cryptography.hazmat.primitives.ciphers.aead
 import cryptography.hazmat.primitives.cmac
 import hashlib
 import hmac
@@ -32,12 +33,14 @@ def print_header(file):
 
 def gen_aes_test_data(file):
     fips_test_data = b"fips test data\0\0"
+    fips_test_ad = b"fips test ad\0\0\0\0"
     fips_test_iv = b"fips test iv\0\0\0\0"
     fips_test_key = b"fips test key\0\0\0"
     fips_test_xts_key = b"key1" + (b"\0" * 12) + b"key2" + (b"\0" * 12)
 
     print_header(file)
     print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+    print_static_u8_array_definition(file, "fips_test_ad", fips_test_ad)
     print_static_u8_array_definition(file, "fips_test_iv", fips_test_iv)
     print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
     print_static_u8_array_definition(file, "fips_test_xts_key", fips_test_xts_key)
@@ -93,6 +96,26 @@ def gen_aes_test_data(file):
     ctext = encryptor.update(fips_test_data) + encryptor.finalize()
     print_static_u8_array_definition(file, "fips_test_aes_xts_ctext", ctext)
 
+    # AES-GCM
+    cipher = cryptography.hazmat.primitives.ciphers.aead.AESGCM(fips_test_key)
+    ct_and_tag = cipher.encrypt(
+        nonce=fips_test_iv[:12], data=fips_test_data, associated_data=fips_test_ad
+    )
+    print_static_u8_array_definition(
+        file, "fips_test_aes_gcm_ctext_and_tag", ct_and_tag
+    )
+
+    # AES-CCM
+    cipher = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
+        fips_test_key, tag_length=16
+    )
+    ct_and_tag = cipher.encrypt(
+        nonce=fips_test_iv[:13], data=fips_test_data, associated_data=fips_test_ad
+    )
+    print_static_u8_array_definition(
+        file, "fips_test_aes_ccm_ctext_and_tag", ct_and_tag
+    )
+
 
 def gen_sha_test_data(file):
     fips_test_data = b"fips test data\0\0"
-- 
cgit v1.2.3


From 2aeef50ecadca2fea0c96abed49452ff9b582b48 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 2 Aug 2026 16:30:04 -0700
Subject: lib/crypto: tests: Add KUnit test suite for AES-CCM

Add a KUnit test suite for the AES-CCM library API.

It consists of:

- All the shared test cases from aead-test-template.h.  These include
  extensive consistency tests, a "Monte-Carlo test", and a benchmark.

- Tests against hardcoded AES-CCM test vectors from external sources.

- Tests for CCM-specific message length validation.

To generate the expected aes_ccm_monte_carlo_checksum[] value, add a
script gen-aead-testvecs.py which computes it using python-cryptography.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260802233005.161467-5-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/.kunitconfig             |   1 +
 lib/crypto/tests/Kconfig            |   9 +
 lib/crypto/tests/Makefile           |   1 +
 lib/crypto/tests/aes_ccm_kunit.c    | 356 ++++++++++++++++++++++++++++++++++++
 scripts/crypto/gen-aead-testvecs.py |  60 ++++++
 5 files changed, 427 insertions(+)
 create mode 100644 lib/crypto/tests/aes_ccm_kunit.c
 create mode 100755 scripts/crypto/gen-aead-testvecs.py

(limited to 'scripts')

diff --git a/lib/crypto/.kunitconfig b/lib/crypto/.kunitconfig
index 3efc854a2c08..f0237e602f28 100644
--- a/lib/crypto/.kunitconfig
+++ b/lib/crypto/.kunitconfig
@@ -3,6 +3,7 @@ CONFIG_KUNIT=y
 CONFIG_CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT=y
 
 CONFIG_CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST=y
+CONFIG_CRYPTO_LIB_AES_CCM_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_BLAKE2B_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_BLAKE2S_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_CHACHA20POLY1305_KUNIT_TEST=y
diff --git a/lib/crypto/tests/Kconfig b/lib/crypto/tests/Kconfig
index bc084dde424f..320236e996b1 100644
--- a/lib/crypto/tests/Kconfig
+++ b/lib/crypto/tests/Kconfig
@@ -9,6 +9,15 @@ config CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST
 	  KUnit tests for the AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC message
 	  authentication codes.
 
+config CRYPTO_LIB_AES_CCM_KUNIT_TEST
+	tristate "KUnit tests for AES-CCM" if !KUNIT_ALL_TESTS
+	depends on KUNIT && CRYPTO_LIB_AES_CCM
+	default KUNIT_ALL_TESTS
+	select CRYPTO_LIB_BENCHMARK_VISIBLE
+	# This test uses BLAKE2s, but that's always built-in.
+	help
+	  KUnit tests for the AES-CCM authenticated encryption algorithm.
+
 config CRYPTO_LIB_BLAKE2B_KUNIT_TEST
 	tristate "KUnit tests for BLAKE2b" if !KUNIT_ALL_TESTS
 	depends on KUNIT && CRYPTO_LIB_BLAKE2B
diff --git a/lib/crypto/tests/Makefile b/lib/crypto/tests/Makefile
index a739413500b6..085852ba008b 100644
--- a/lib/crypto/tests/Makefile
+++ b/lib/crypto/tests/Makefile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 obj-$(CONFIG_CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST) += aes_cbc_macs_kunit.o
+obj-$(CONFIG_CRYPTO_LIB_AES_CCM_KUNIT_TEST) += aes_ccm_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_BLAKE2B_KUNIT_TEST) += blake2b_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_BLAKE2S_KUNIT_TEST) += blake2s_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_CHACHA20POLY1305_KUNIT_TEST) += chacha20poly1305_kunit.o
diff --git a/lib/crypto/tests/aes_ccm_kunit.c b/lib/crypto/tests/aes_ccm_kunit.c
new file mode 100644
index 000000000000..e8f2b3446017
--- /dev/null
+++ b/lib/crypto/tests/aes_ccm_kunit.c
@@ -0,0 +1,356 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * KUnit test suite for AES-CCM
+ *
+ * Copyright 2026 Google LLC
+ */
+#include <crypto/aes-ccm.h>
+#include <crypto/blake2s.h>
+#include "test-utils.h"
+
+/* AES-CCM test vectors from external sources */
+static const struct aes_ccm_testvec {
+	const char *name;
+	const char *key;
+	size_t key_len;
+	const char *nonce;
+	size_t nonce_len;
+	const char *ad;
+	size_t ad_len;
+	const char *ptext;
+	const char *ctext;
+	size_t data_len;
+	const char *tag;
+	size_t tag_len;
+} aes_ccm_testvecs[] = {
+	{
+		.name = "RFC 3610 Packet Vector #1",
+		.key = "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+		       "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf",
+		.key_len = 16,
+		.nonce = "\x00\x00\x00\x03\x02\x01\x00\xa0"
+			 "\xa1\xa2\xa3\xa4\xa5",
+		.nonce_len = 13,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07",
+		.ad_len = 8,
+		.ptext = "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+			 "\x10\x11\x12\x13\x14\x15\x16\x17"
+			 "\x18\x19\x1a\x1b\x1c\x1d\x1e",
+		.ctext = "\x58\x8c\x97\x9a\x61\xc6\x63\xd2"
+			 "\xf0\x66\xd0\xc2\xc0\xf9\x89\x80"
+			 "\x6d\x5f\x6b\x61\xda\xc3\x84",
+		.data_len = 23,
+		.tag = "\x17\xe8\xd1\x2c\xfd\xf9\x26\xe0",
+		.tag_len = 8,
+	},
+	{
+		.name = "RFC 3610 Packet Vector #5",
+		.key = "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+		       "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf",
+		.key_len = 16,
+		.nonce = "\x00\x00\x00\x07\x06\x05\x04\xa0"
+			 "\xa1\xa2\xa3\xa4\xa5",
+		.nonce_len = 13,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07"
+		      "\x08\x09\x0a\x0b",
+		.ad_len = 12,
+		.ptext = "\x0c\x0d\x0e\x0f\x10\x11\x12\x13"
+			 "\x14\x15\x16\x17\x18\x19\x1a\x1b"
+			 "\x1c\x1d\x1e\x1f",
+		.ctext = "\xdc\xf1\xfb\x7b\x5d\x9e\x23\xfb"
+			 "\x9d\x4e\x13\x12\x53\x65\x8a\xd8"
+			 "\x6e\xbd\xca\x3e",
+		.data_len = 20,
+		.tag = "\x51\xe8\x3f\x07\x7d\x9c\x2d\x93",
+		.tag_len = 8,
+	},
+	{
+		.name = "RFC 3610 Packet Vector #9",
+		.key = "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+		       "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf",
+		.key_len = 16,
+		.nonce = "\x00\x00\x00\x0b\x0a\x09\x08\xa0"
+			 "\xa1\xa2\xa3\xa4\xa5",
+		.nonce_len = 13,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07",
+		.ad_len = 8,
+		.ptext = "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+			 "\x10\x11\x12\x13\x14\x15\x16\x17"
+			 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+			 "\x20",
+		.ctext = "\x82\x53\x1a\x60\xcc\x24\x94\x5a"
+			 "\x4b\x82\x79\x18\x1a\xb5\xc8\x4d"
+			 "\xf2\x1c\xe7\xf9\xb7\x3f\x42\xe1"
+			 "\x97",
+		.data_len = 25,
+		.tag = "\xea\x9c\x07\xe5\x6b\x5e\xb1\x7e"
+		       "\x5f\x4e",
+		.tag_len = 10,
+	},
+	{
+		.name = "NIST SP 800-38C Example 1",
+		.key = "\x40\x41\x42\x43\x44\x45\x46\x47"
+		       "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f",
+		.key_len = 16,
+		.nonce = "\x10\x11\x12\x13\x14\x15\x16",
+		.nonce_len = 7,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07",
+		.ad_len = 8,
+		.ptext = "\x20\x21\x22\x23",
+		.ctext = "\x71\x62\x01\x5b",
+		.data_len = 4,
+		.tag = "\x4d\xac\x25\x5d",
+		.tag_len = 4,
+	},
+	{
+		.name = "NIST SP 800-38C Example 2",
+		.key = "\x40\x41\x42\x43\x44\x45\x46\x47"
+		       "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f",
+		.key_len = 16,
+		.nonce = "\x10\x11\x12\x13\x14\x15\x16\x17",
+		.nonce_len = 8,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07"
+		      "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+		.ad_len = 16,
+		.ptext = "\x20\x21\x22\x23\x24\x25\x26\x27"
+			 "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f",
+		.ctext = "\xd2\xa1\xf0\xe0\x51\xea\x5f\x62"
+			 "\x08\x1a\x77\x92\x07\x3d\x59\x3d",
+		.data_len = 16,
+		.tag = "\x1f\xc6\x4f\xbf\xac\xcd",
+		.tag_len = 6,
+	},
+	{
+		.name = "NIST SP 800-38C Example 3",
+		.key = "\x40\x41\x42\x43\x44\x45\x46\x47"
+		       "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f",
+		.key_len = 16,
+		.nonce = "\x10\x11\x12\x13\x14\x15\x16\x17"
+			 "\x18\x19\x1a\x1b",
+		.nonce_len = 12,
+		.ad = "\x00\x01\x02\x03\x04\x05\x06\x07"
+		      "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+		      "\x10\x11\x12\x13",
+		.ad_len = 20,
+		.ptext = "\x20\x21\x22\x23\x24\x25\x26\x27"
+			 "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+			 "\x30\x31\x32\x33\x34\x35\x36\x37",
+		.ctext = "\xe3\xb2\x01\xa9\xf5\xb7\x1a\x7a"
+			 "\x9b\x1c\xea\xec\xcd\x97\xe7\x0b"
+			 "\x61\x76\xaa\xd9\xa4\x42\x8a\xa5",
+		.data_len = 24,
+		.tag = "\x48\x43\x92\xfb\xc1\xb0\x99\x51",
+		.tag_len = 8,
+	},
+};
+
+static void test_aes_ccm_one_test_vector(struct kunit *test,
+					 const struct aes_ccm_testvec *tv)
+{
+	u8 *ctext = alloc_buf(test, tv->data_len);
+	u8 *decrypted = alloc_buf(test, tv->data_len);
+	u8 *tag = alloc_buf(test, tv->tag_len);
+	struct aes_ccm_key key;
+	int err;
+
+	err = aes_ccm_preparekey(&key, tv->key, tv->key_len, tv->tag_len);
+	KUNIT_ASSERT_EQ_MSG(test, 0, err, "Failed to prepare key for %s",
+			    tv->name);
+
+	err = aes_ccm_encrypt(ctext, tv->ptext, tv->data_len, tag, tv->ad,
+			      tv->ad_len, tv->nonce, tv->nonce_len, &key);
+	KUNIT_ASSERT_EQ_MSG(test, 0, err, "Encryption failed for %s", tv->name);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tv->ctext, ctext, tv->data_len,
+			       "Wrong ciphertext for %s", tv->name);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tag, tv->tag, tv->tag_len,
+			       "Wrong tag for %s", tv->name);
+
+	err = aes_ccm_decrypt(decrypted, ctext, tv->data_len, tag, tv->ad,
+			      tv->ad_len, tv->nonce, tv->nonce_len, &key);
+	KUNIT_ASSERT_EQ_MSG(test, 0, err, "Decryption failed for %s", tv->name);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tv->ptext, decrypted, tv->data_len,
+			       "Wrong plaintext for %s", tv->name);
+}
+
+static void test_aes_ccm_test_vectors(struct kunit *test)
+{
+	for (size_t i = 0; i < ARRAY_SIZE(aes_ccm_testvecs); i++)
+		test_aes_ccm_one_test_vector(test, &aes_ccm_testvecs[i]);
+}
+
+/*
+ * Test NIST SP 800-38C Example 4, which uses a deterministically-generated
+ * 65536-byte associated data string.
+ */
+static void test_aes_ccm_nist_sp800_38c_example4(struct kunit *test)
+{
+	struct aes_ccm_testvec tv = {
+		.name = "NIST SP 800-38C Example 4",
+		.key_len = 16,
+		.nonce_len = 13,
+		.ad_len = 65536,
+		.ctext = "\x69\x91\x5d\xad\x1e\x84\xc6\x37"
+			 "\x6a\x68\xc2\x96\x7e\x4d\xab\x61"
+			 "\x5a\xe0\xfd\x1f\xae\xc4\x4c\xc4"
+			 "\x84\x82\x85\x29\x46\x3c\xcf\x72",
+		.data_len = 32,
+		.tag = "\xb4\xac\x6b\xec\x93\xe8\x59\x8e"
+		       "\x7f\x0d\xad\xbc\xea\x5b",
+		.tag_len = 14,
+	};
+	u8 *key, *nonce, *ad, *ptext;
+
+	key = alloc_buf(test, tv.key_len);
+	for (size_t i = 0; i < tv.key_len; i++)
+		key[i] = 0x40 + i;
+
+	nonce = alloc_guarded_buf(test, tv.nonce_len);
+	for (size_t i = 0; i < tv.nonce_len; i++)
+		nonce[i] = 0x10 + i;
+
+	ad = alloc_guarded_buf(test, tv.ad_len);
+	for (size_t i = 0; i < tv.ad_len; i++)
+		ad[i] = (u8)i;
+
+	ptext = alloc_guarded_buf(test, tv.data_len);
+	for (size_t i = 0; i < tv.data_len; i++)
+		ptext[i] = 0x20 + i;
+
+	tv.key = key;
+	tv.nonce = nonce;
+	tv.ad = ad;
+	tv.ptext = ptext;
+
+	test_aes_ccm_one_test_vector(test, &tv);
+}
+
+static const size_t aes_ccm_valid_key_lens[] = { 16, 24, 32 };
+#define AEAD_MAX_KEY_LEN 32
+#define AEAD_VALID_KEY_LENS aes_ccm_valid_key_lens
+
+static const size_t aes_ccm_valid_nonce_lens[] = { 7, 8, 9, 10, 11, 12, 13 };
+#define AEAD_MAX_NONCE_LEN 13
+#define AEAD_VALID_NONCE_LENS aes_ccm_valid_nonce_lens
+
+static const size_t aes_ccm_valid_tag_lens[] = { 4, 6, 8, 10, 12, 14, 16 };
+#define AEAD_MAX_TAG_LEN 16
+#define AEAD_VALID_TAG_LENS aes_ccm_valid_tag_lens
+
+#define AEAD_KEY aes_ccm_key
+#define AEAD_CTX aes_ccm_ctx
+#define AEAD_PREPAREKEY aes_ccm_preparekey
+#define AEAD_ENCRYPT aes_ccm_encrypt
+#define AEAD_DECRYPT aes_ccm_decrypt
+
+#define AEAD_INIT aes_ccm_init
+#define AEAD_AUTH_UPDATE aes_ccm_auth_update
+#define AEAD_ENCRYPT_UPDATE aes_ccm_encrypt_update
+#define AEAD_DECRYPT_UPDATE aes_ccm_decrypt_update
+#define AEAD_ENCRYPT_FINAL aes_ccm_encrypt_final
+#define AEAD_DECRYPT_FINAL aes_ccm_decrypt_final
+
+/* This value was generated by gen-aead-testvecs.py. */
+static const u8 aes_ccm_monte_carlo_checksum[BLAKE2S_HASH_SIZE] = {
+	0x70, 0x1c, 0xde, 0xa4, 0xe2, 0x03, 0x50, 0xb2, 0xf5, 0x9e, 0x61,
+	0x66, 0xe4, 0xe5, 0x13, 0x1a, 0x00, 0x95, 0x34, 0x03, 0xb7, 0x61,
+	0x2c, 0xdb, 0xc3, 0x15, 0x36, 0x84, 0x93, 0x7f, 0xb4, 0x5b,
+};
+#define AEAD_MONTE_CARLO_CHECKSUM aes_ccm_monte_carlo_checksum
+
+#include "aead-test-template.h"
+
+/*
+ * Test that for each AES-CCM nonce length, the message length is validated
+ * against the correct corresponding maximum message length.
+ */
+static void test_aes_ccm_data_len_too_large(struct kunit *test)
+{
+	static const struct {
+		size_t nonce_len;
+		u64 max_data_len;
+	} lens[] = {
+		/* clang-format off */
+		{ 7, 0xffffffffffffffff }, /* U64_MAX */
+		{ 8, 0xffffffffffffff },
+		{ 9, 0xffffffffffff },
+		{ 10, 0xffffffffff },
+		{ 11, 0xffffffff },
+		{ 12, 0xffffff },
+		{ 13, 0xffff },
+		/* clang-format on */
+	};
+	u8 nonce[13] = {};
+	u8 raw_key[AES_KEYSIZE_256] = {};
+	int err;
+	struct aes_ccm_key *key = alloc_buf(test, sizeof(*key));
+	struct aes_ccm_ctx ctx;
+
+	err = aes_ccm_preparekey(key, raw_key, sizeof(raw_key), 16);
+	KUNIT_ASSERT_EQ(test, 0, err);
+
+	for (size_t i = 0; i < ARRAY_SIZE(lens); i++) {
+		size_t nonce_len = lens[i].nonce_len;
+		u64 max_data_len = lens[i].max_data_len;
+
+		/* data_len <= max_data_len should be accepted. */
+		err = aes_ccm_init(&ctx, 0, 0, nonce, nonce_len, key);
+		KUNIT_ASSERT_EQ_MSG(
+			test, 0, err,
+			"data_len=0 wasn't accepted with nonce_len=%zu",
+			nonce_len);
+		err = aes_ccm_init(&ctx, max_data_len, 0, nonce, nonce_len,
+				   key);
+		KUNIT_ASSERT_EQ_MSG(
+			test, 0, err,
+			"data_len=%llu wasn't accepted with nonce_len=%zu",
+			max_data_len, nonce_len);
+
+		/* data_len > max_data_len should be rejected. */
+		if (max_data_len == U64_MAX)
+			continue;
+		err = aes_ccm_init(&ctx, max_data_len + 1, 0, nonce, nonce_len,
+				   key);
+		KUNIT_ASSERT_EQ_MSG(
+			test, -EOVERFLOW, err,
+			"data_len=%llu wasn't rejected with -EOVERFLOW with nonce_len=%zu (aes_ccm_init)",
+			max_data_len + 1, nonce_len);
+		if (max_data_len + 1 <= SIZE_MAX) {
+			err = aes_ccm_encrypt(NULL, NULL, max_data_len + 1,
+					      NULL, NULL, 0, nonce, nonce_len,
+					      key);
+			KUNIT_ASSERT_EQ_MSG(
+				test, -EOVERFLOW, err,
+				"data_len=%llu wasn't rejected with -EOVERFLOW with nonce_len=%zu (aes_ccm_encrypt)",
+				max_data_len + 1, nonce_len);
+			err = aes_ccm_decrypt(NULL, NULL, max_data_len + 1,
+					      NULL, NULL, 0, nonce, nonce_len,
+					      key);
+			KUNIT_ASSERT_EQ_MSG(
+				test, -EOVERFLOW, err,
+				"data_len=%llu wasn't rejected with -EOVERFLOW with nonce_len=%zu (aes_ccm_decrypt)",
+				max_data_len + 1, nonce_len);
+		}
+		err = aes_ccm_init(&ctx, U64_MAX, 0, nonce, nonce_len, key);
+		KUNIT_ASSERT_EQ_MSG(
+			test, -EOVERFLOW, err,
+			"data_len=U64_MAX wasn't rejected with -EOVERFLOW with nonce_len=%zu (aes_ccm_init)",
+			nonce_len);
+	}
+}
+
+static struct kunit_case aes_ccm_test_cases[] = {
+	KUNIT_CASE(test_aes_ccm_test_vectors),
+	KUNIT_CASE(test_aes_ccm_nist_sp800_38c_example4),
+	KUNIT_CASE(test_aes_ccm_data_len_too_large),
+	AEAD_KUNIT_CASES,
+	{},
+};
+
+static struct kunit_suite aes_ccm_test_suite = {
+	.name = "aes_ccm",
+	.test_cases = aes_ccm_test_cases,
+};
+kunit_test_suite(aes_ccm_test_suite);
+
+MODULE_DESCRIPTION("KUnit tests and benchmark for AES-CCM");
+MODULE_LICENSE("GPL");
diff --git a/scripts/crypto/gen-aead-testvecs.py b/scripts/crypto/gen-aead-testvecs.py
new file mode 100755
index 000000000000..048043735819
--- /dev/null
+++ b/scripts/crypto/gen-aead-testvecs.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Script that generates known-good data used in the AEAD tests.
+#
+# Requires that python-cryptography be installed.
+#
+# Copyright 2026 Google LLC
+
+import hashlib
+import sys
+import cryptography.hazmat.primitives.ciphers.aead
+
+
+# Deterministically generate 'length' random bytes.
+def rand_bytes(length):
+    seed = length
+    out = []
+    for _ in range(length):
+        seed = (seed * 25214903917 + 11) % 2**48
+        out.append((seed >> 16) % 256)
+    return bytes(out)
+
+
+# Deterministically generate many different AEAD inputs using exactly the same
+# method that the test uses; encrypt them using an independent implementation of
+# the algorithm; compute the checksum of all the resulting (ciphertext, authtag)
+# pairs concatenated to each other; and print the checksum as a C struct.
+def gen_monte_carlo_checksum(alg):
+    blake2s = hashlib.blake2s()
+    for data_len in range(1025):
+        ad_len = data_len % 293
+        pt = rand_bytes(data_len)
+        ad = rand_bytes(ad_len)
+        if alg == "aes-ccm":
+            key_len = [16, 24, 32][data_len % 3]
+            key = rand_bytes(key_len)
+            nonce = rand_bytes([7, 8, 9, 10, 11, 12, 13][data_len % 7])
+            tag_len = [4, 6, 8, 10, 12, 14, 16][data_len % 7]
+            ccm = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
+                key, tag_length=tag_len
+            )
+            ct_and_tag = ccm.encrypt(nonce, pt, ad)
+
+        blake2s.update(ct_and_tag)
+
+    name = f"{alg.replace('-', '_')}_monte_carlo_checksum"
+    value = blake2s.digest()
+    print(f"static const u8 {name}[BLAKE2S_HASH_SIZE] = {{")
+    for i in range(0, len(value), 11):
+        line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 11])
+        print(f"{line.rstrip()}")
+    print("};")
+
+
+if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm"):
+    sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm]\n")
+    sys.exit(1)
+
+gen_monte_carlo_checksum(sys.argv[1])
-- 
cgit v1.2.3


From b09bd2d92ee1bbbf6db4533d5d9d2a7b39ae48c4 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 2 Aug 2026 16:30:05 -0700
Subject: lib/crypto: tests: Add KUnit test suite for AES-GCM

Add a KUnit test suite for the AES-GCM library API.

It consists of:

- All the shared test cases from aead-test-template.h.  These include
  extensive consistency tests, a "Monte-Carlo test", and a benchmark.

- Tests against hardcoded AES-GCM test vectors from external sources.

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20260802233005.161467-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/.kunitconfig             |   1 +
 lib/crypto/tests/Kconfig            |   9 +
 lib/crypto/tests/Makefile           |   1 +
 lib/crypto/tests/aes_gcm_kunit.c    | 472 ++++++++++++++++++++++++++++++++++++
 scripts/crypto/gen-aead-testvecs.py |  13 +-
 5 files changed, 494 insertions(+), 2 deletions(-)
 create mode 100644 lib/crypto/tests/aes_gcm_kunit.c

(limited to 'scripts')

diff --git a/lib/crypto/.kunitconfig b/lib/crypto/.kunitconfig
index f0237e602f28..60e0a77f9889 100644
--- a/lib/crypto/.kunitconfig
+++ b/lib/crypto/.kunitconfig
@@ -4,6 +4,7 @@ CONFIG_CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT=y
 
 CONFIG_CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_AES_CCM_KUNIT_TEST=y
+CONFIG_CRYPTO_LIB_AES_GCM_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_BLAKE2B_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_BLAKE2S_KUNIT_TEST=y
 CONFIG_CRYPTO_LIB_CHACHA20POLY1305_KUNIT_TEST=y
diff --git a/lib/crypto/tests/Kconfig b/lib/crypto/tests/Kconfig
index 320236e996b1..e121114624da 100644
--- a/lib/crypto/tests/Kconfig
+++ b/lib/crypto/tests/Kconfig
@@ -18,6 +18,15 @@ config CRYPTO_LIB_AES_CCM_KUNIT_TEST
 	help
 	  KUnit tests for the AES-CCM authenticated encryption algorithm.
 
+config CRYPTO_LIB_AES_GCM_KUNIT_TEST
+	tristate "KUnit tests for AES-GCM" if !KUNIT_ALL_TESTS
+	depends on KUNIT && CRYPTO_LIB_AES_GCM
+	default KUNIT_ALL_TESTS
+	select CRYPTO_LIB_BENCHMARK_VISIBLE
+	# This test uses BLAKE2s, but that's always built-in.
+	help
+	  KUnit tests for the AES-GCM authenticated encryption algorithm.
+
 config CRYPTO_LIB_BLAKE2B_KUNIT_TEST
 	tristate "KUnit tests for BLAKE2b" if !KUNIT_ALL_TESTS
 	depends on KUNIT && CRYPTO_LIB_BLAKE2B
diff --git a/lib/crypto/tests/Makefile b/lib/crypto/tests/Makefile
index 085852ba008b..c97c1d78784a 100644
--- a/lib/crypto/tests/Makefile
+++ b/lib/crypto/tests/Makefile
@@ -2,6 +2,7 @@
 
 obj-$(CONFIG_CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST) += aes_cbc_macs_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_AES_CCM_KUNIT_TEST) += aes_ccm_kunit.o
+obj-$(CONFIG_CRYPTO_LIB_AES_GCM_KUNIT_TEST) += aes_gcm_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_BLAKE2B_KUNIT_TEST) += blake2b_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_BLAKE2S_KUNIT_TEST) += blake2s_kunit.o
 obj-$(CONFIG_CRYPTO_LIB_CHACHA20POLY1305_KUNIT_TEST) += chacha20poly1305_kunit.o
diff --git a/lib/crypto/tests/aes_gcm_kunit.c b/lib/crypto/tests/aes_gcm_kunit.c
new file mode 100644
index 000000000000..6959d86b316a
--- /dev/null
+++ b/lib/crypto/tests/aes_gcm_kunit.c
@@ -0,0 +1,472 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * KUnit test suite for AES-GCM
+ *
+ * Copyright 2026 Google LLC
+ */
+#include <crypto/aes-gcm.h>
+#include <crypto/blake2s.h>
+#include "test-utils.h"
+
+/* The kernel's AES-GCM implementation supports only 12-byte nonces. */
+#define AES_GCM_NONCE_LEN 12
+
+/*
+ * AES-GCM test vectors from the original paper "The Galois/Counter Mode of
+ * Operation (GCM)" by McGrew & Viega.  Vectors with nonce lengths other than 12
+ * bytes are excluded.
+ */
+static const struct aes_gcm_testvec {
+	const char *name;
+	const char *key;
+	size_t key_len;
+	const char *nonce;
+	size_t nonce_len;
+	const char *ad;
+	size_t ad_len;
+	const char *ptext;
+	const char *ctext;
+	size_t data_len;
+	const char *tag;
+	size_t tag_len;
+} aes_gcm_testvecs[] = {
+	/* AES-128 Test Vectors */
+	{
+		.name = "McGrew & Viega Test Case 1",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 16,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "",
+		.ctext = "",
+		.data_len = 0,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\x58\xe2\xfc\xce\xfa\x7e\x30\x61"
+		       "\x36\x7f\x1d\x57\xa4\xe7\x45\x5a",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 2",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 16,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.ctext = "\x03\x88\xda\xce\x60\xb6\xa3\x92"
+			 "\xf3\x28\xc2\xb9\x71\xb2\xfe\x78",
+		.data_len = 16,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\xab\x6e\x47\xd4\x2c\xec\x13\xbd"
+		       "\xf5\x3a\x67\xb2\x12\x57\xbd\xdf",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 3",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
+		.key_len = 16,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55",
+		.ctext = "\x42\x83\x1e\xc2\x21\x77\x74\x24"
+			 "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
+			 "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
+			 "\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
+			 "\x21\xd5\x14\xb2\x54\x66\x93\x1c"
+			 "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
+			 "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
+			 "\x3d\x58\xe0\x91\x47\x3f\x59\x85",
+		.data_len = 64,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\x4d\x5c\x2a\xf3\x27\xcd\x64\xa6"
+		       "\x2c\xf3\x5a\xbd\x2b\xa6\xfa\xb4",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 4",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
+		.key_len = 16,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39",
+		.ctext = "\x42\x83\x1e\xc2\x21\x77\x74\x24"
+			 "\x4b\x72\x21\xb7\x84\xd0\xd4\x9c"
+			 "\xe3\xaa\x21\x2f\x2c\x02\xa4\xe0"
+			 "\x35\xc1\x7e\x23\x29\xac\xa1\x2e"
+			 "\x21\xd5\x14\xb2\x54\x66\x93\x1c"
+			 "\x7d\x8f\x6a\x5a\xac\x84\xaa\x05"
+			 "\x1b\xa3\x0b\x39\x6a\x0a\xac\x97"
+			 "\x3d\x58\xe0\x91",
+		.data_len = 60,
+		.ad = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xab\xad\xda\xd2",
+		.ad_len = 20,
+		.tag = "\x5b\xc9\x4f\xbc\x32\x21\xa5\xdb"
+		       "\x94\xfa\xe9\x5a\xe7\x12\x1a\x47",
+		.tag_len = 16,
+	},
+
+	/* AES-192 Test Vectors */
+	{
+		.name = "McGrew & Viega Test Case 7",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 24,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "",
+		.ctext = "",
+		.data_len = 0,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\xcd\x33\xb2\x8a\xc7\x73\xf7\x4b"
+		       "\xa0\x0e\xd1\xf3\x12\x57\x24\x35",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 8",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 24,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.ctext = "\x98\xe7\x24\x7c\x07\xf0\xfe\x41"
+			 "\x1c\x26\x7e\x43\x84\xb0\xf6\x00",
+		.data_len = 16,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\x2f\xf5\x8d\x80\x03\x39\x27\xab"
+		       "\x8e\xf4\xd4\x58\x75\x14\xf0\xfb",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 9",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
+		       "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
+		.key_len = 24,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55",
+		.ctext = "\x39\x80\xca\x0b\x3c\x00\xe8\x41"
+			 "\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
+			 "\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
+			 "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
+			 "\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
+			 "\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
+			 "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
+			 "\xcc\xda\x27\x10\xac\xad\xe2\x56",
+		.data_len = 64,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\x99\x24\xa7\xc8\x58\x73\x36\xbf"
+		       "\xb1\x18\x02\x4d\xb8\x67\x4a\x14",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 10",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
+		       "\xfe\xff\xe9\x92\x86\x65\x73\x1c",
+		.key_len = 24,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39",
+		.ctext = "\x39\x80\xca\x0b\x3c\x00\xe8\x41"
+			 "\xeb\x06\xfa\xc4\x87\x2a\x27\x57"
+			 "\x85\x9e\x1c\xea\xa6\xef\xd9\x84"
+			 "\x62\x85\x93\xb4\x0c\xa1\xe1\x9c"
+			 "\x7d\x77\x3d\x00\xc1\x44\xc5\x25"
+			 "\xac\x61\x9d\x18\xc8\x4a\x3f\x47"
+			 "\x18\xe2\x44\x8b\x2f\xe3\x24\xd9"
+			 "\xcc\xda\x27\x10",
+		.data_len = 60,
+		.ad = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xab\xad\xda\xd2",
+		.ad_len = 20,
+		.tag = "\x25\x19\x49\x8e\x80\xf1\x47\x8f"
+		       "\x37\xba\x55\xbd\x6d\x27\x61\x8c",
+		.tag_len = 16,
+	},
+
+	/* AES-256 Test Vectors */
+	{
+		.name = "McGrew & Viega Test Case 13",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 32,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "",
+		.ctext = "",
+		.data_len = 0,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\x53\x0f\x8a\xfb\xc7\x45\x36\xb9"
+		       "\xa9\x63\xb4\xf1\xc4\xcb\x73\x8b",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 14",
+		.key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00"
+		       "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.key_len = 32,
+		.nonce = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00",
+		.nonce_len = 12,
+		.ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+			 "\x00\x00\x00\x00\x00\x00\x00\x00",
+		.ctext = "\xce\xa7\x40\x3d\x4d\x60\x6b\x6e"
+			 "\x07\x4e\xc5\xd3\xba\xf3\x9d\x18",
+		.data_len = 16,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\xd0\xd1\xc8\xa7\x99\x99\x6b\xf0"
+		       "\x26\x5b\x98\xb5\xd4\x8a\xb9\x19",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 15",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
+		       "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
+		.key_len = 32,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39\x1a\xaf\xd2\x55",
+		.ctext = "\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
+			 "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
+			 "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
+			 "\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
+			 "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
+			 "\xa7\xb0\x8b\x10\x56\x82\x88\x38"
+			 "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
+			 "\xbc\xc9\xf6\x62\x89\x80\x15\xad",
+		.data_len = 64,
+		.ad = "",
+		.ad_len = 0,
+		.tag = "\xb0\x94\xda\xc5\xd9\x34\x71\xbd"
+		       "\xec\x1a\x50\x22\x70\xe3\xcc\x6c",
+		.tag_len = 16,
+	},
+	{
+		.name = "McGrew & Viega Test Case 16",
+		.key = "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08"
+		       "\xfe\xff\xe9\x92\x86\x65\x73\x1c"
+		       "\x6d\x6a\x8f\x94\x67\x30\x83\x08",
+		.key_len = 32,
+		.nonce = "\xca\xfe\xba\xbe\xfa\xce\xdb\xad"
+			 "\xde\xca\xf8\x88",
+		.nonce_len = 12,
+		.ptext = "\xd9\x31\x32\x25\xf8\x84\x06\xe5"
+			 "\xa5\x59\x09\xc5\xaf\xf5\x26\x9a"
+			 "\x86\xa7\xa9\x53\x15\x34\xf7\xda"
+			 "\x2e\x4c\x30\x3d\x8a\x31\x8a\x72"
+			 "\x1c\x3c\x0c\x95\x95\x68\x09\x53"
+			 "\x2f\xcf\x0e\x24\x49\xa6\xb5\x25"
+			 "\xb1\x6a\xed\xf5\xaa\x0d\xe6\x57"
+			 "\xba\x63\x7b\x39",
+		.ctext = "\x52\x2d\xc1\xf0\x99\x56\x7d\x07"
+			 "\xf4\x7f\x37\xa3\x2a\x84\x42\x7d"
+			 "\x64\x3a\x8c\xdc\xbf\xe5\xc0\xc9"
+			 "\x75\x98\xa2\xbd\x25\x55\xd1\xaa"
+			 "\x8c\xb0\x8e\x48\x59\x0d\xbb\x3d"
+			 "\xa7\xb0\x8b\x10\x56\x82\x88\x38"
+			 "\xc5\xf6\x1e\x63\x93\xba\x7a\x0a"
+			 "\xbc\xc9\xf6\x62",
+		.data_len = 60,
+		.ad = "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xfe\xed\xfa\xce\xde\xad\xbe\xef"
+		      "\xab\xad\xda\xd2",
+		.ad_len = 20,
+		.tag = "\x76\xfc\x6e\xce\x0f\x4e\x17\x68"
+		       "\xcd\xdf\x88\x53\xbb\x2d\x55\x1b",
+		.tag_len = 16,
+	},
+};
+
+static void test_aes_gcm_one_test_vector(struct kunit *test,
+					 const struct aes_gcm_testvec *tv)
+{
+	u8 *ctext = alloc_buf(test, tv->data_len);
+	u8 *decrypted = alloc_buf(test, tv->data_len);
+	u8 *tag = alloc_buf(test, tv->tag_len);
+	struct aes_gcm_key key;
+	int err;
+
+	KUNIT_ASSERT_EQ(test, AES_GCM_NONCE_LEN, tv->nonce_len);
+
+	err = aes_gcm_preparekey(&key, tv->key, tv->key_len, tv->tag_len);
+	KUNIT_ASSERT_EQ_MSG(test, 0, err, "Failed to prepare key for %s",
+			    tv->name);
+
+	aes_gcm_encrypt(ctext, tv->ptext, tv->data_len, tag, tv->ad, tv->ad_len,
+			tv->nonce, &key);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tv->ctext, ctext, tv->data_len,
+			       "Wrong ciphertext for %s", tv->name);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tag, tv->tag, tv->tag_len,
+			       "Wrong tag for %s", tv->name);
+
+	err = aes_gcm_decrypt(decrypted, ctext, tv->data_len, tag, tv->ad,
+			      tv->ad_len, tv->nonce, &key);
+	KUNIT_ASSERT_EQ_MSG(test, 0, err, "Decryption failed for %s", tv->name);
+	KUNIT_ASSERT_MEMEQ_MSG(test, tv->ptext, decrypted, tv->data_len,
+			       "Wrong plaintext for %s", tv->name);
+}
+
+static void test_aes_gcm_test_vectors(struct kunit *test)
+{
+	for (size_t i = 0; i < ARRAY_SIZE(aes_gcm_testvecs); i++)
+		test_aes_gcm_one_test_vector(test, &aes_gcm_testvecs[i]);
+}
+
+static int aes_gcm_init_test(struct aes_gcm_ctx *ctx, u64 data_len, u64 ad_len,
+			     const u8 *nonce, size_t nonce_len,
+			     const struct aes_gcm_key *key)
+{
+	if (nonce_len != AES_GCM_NONCE_LEN)
+		return -EINVAL;
+	/*
+	 * Ignore data_len and ad_len.  Incremental AES-GCM doesn't need them at
+	 * initialization time.
+	 */
+	aes_gcm_init(ctx, nonce, key);
+	return 0;
+}
+
+static int aes_gcm_encrypt_test(u8 *dst, const u8 *src, size_t data_len,
+				u8 *authtag, const u8 *ad, size_t ad_len,
+				const u8 *nonce, size_t nonce_len,
+				const struct aes_gcm_key *key)
+{
+	if (nonce_len != AES_GCM_NONCE_LEN)
+		return -EINVAL;
+	/* aes_gcm_encrypt() returns void. */
+	aes_gcm_encrypt(dst, src, data_len, authtag, ad, ad_len, nonce, key);
+	return 0;
+}
+
+static int aes_gcm_decrypt_test(u8 *dst, const u8 *src, size_t data_len,
+				const u8 *authtag, const u8 *ad, size_t ad_len,
+				const u8 *nonce, size_t nonce_len,
+				const struct aes_gcm_key *key)
+{
+	if (nonce_len != AES_GCM_NONCE_LEN)
+		return -EINVAL;
+	return aes_gcm_decrypt(dst, src, data_len, authtag, ad, ad_len, nonce,
+			       key);
+}
+
+static const size_t aes_gcm_valid_key_lens[] = { 16, 24, 32 };
+#define AEAD_MAX_KEY_LEN 32
+#define AEAD_VALID_KEY_LENS aes_gcm_valid_key_lens
+
+static const size_t aes_gcm_valid_nonce_lens[] = { AES_GCM_NONCE_LEN };
+#define AEAD_MAX_NONCE_LEN AES_GCM_NONCE_LEN
+#define AEAD_VALID_NONCE_LENS aes_gcm_valid_nonce_lens
+
+static const size_t aes_gcm_valid_tag_lens[] = { 4, 8, 12, 13, 14, 15, 16 };
+#define AEAD_MAX_TAG_LEN 16
+#define AEAD_VALID_TAG_LENS aes_gcm_valid_tag_lens
+
+#define AEAD_KEY aes_gcm_key
+#define AEAD_CTX aes_gcm_ctx
+#define AEAD_PREPAREKEY aes_gcm_preparekey
+#define AEAD_ENCRYPT aes_gcm_encrypt_test
+#define AEAD_DECRYPT aes_gcm_decrypt_test
+
+#define AEAD_INIT aes_gcm_init_test
+#define AEAD_AUTH_UPDATE aes_gcm_auth_update
+#define AEAD_ENCRYPT_UPDATE aes_gcm_encrypt_update
+#define AEAD_DECRYPT_UPDATE aes_gcm_decrypt_update
+#define AEAD_ENCRYPT_FINAL aes_gcm_encrypt_final
+#define AEAD_DECRYPT_FINAL aes_gcm_decrypt_final
+
+/* This value was generated by gen-aead-testvecs.py. */
+static const u8 aes_gcm_monte_carlo_checksum[BLAKE2S_HASH_SIZE] = {
+	0x6d, 0xd0, 0x6e, 0x6b, 0xde, 0x3e, 0x92, 0x9f, 0xae, 0x1f, 0xf1,
+	0x84, 0x99, 0x5a, 0x9e, 0x7b, 0xfe, 0x20, 0x9e, 0x22, 0x7c, 0x5f,
+	0x15, 0xb3, 0x59, 0x89, 0xd0, 0xb7, 0x74, 0x5d, 0xd2, 0xa5,
+};
+#define AEAD_MONTE_CARLO_CHECKSUM aes_gcm_monte_carlo_checksum
+
+#include "aead-test-template.h"
+
+static struct kunit_case aes_gcm_test_cases[] = {
+	KUNIT_CASE(test_aes_gcm_test_vectors),
+	AEAD_KUNIT_CASES,
+	{},
+};
+
+static struct kunit_suite aes_gcm_test_suite = {
+	.name = "aes_gcm",
+	.test_cases = aes_gcm_test_cases,
+};
+kunit_test_suite(aes_gcm_test_suite);
+
+MODULE_DESCRIPTION("KUnit tests and benchmark for AES-GCM");
+MODULE_LICENSE("GPL");
diff --git a/scripts/crypto/gen-aead-testvecs.py b/scripts/crypto/gen-aead-testvecs.py
index 048043735819..d77d646f75b5 100755
--- a/scripts/crypto/gen-aead-testvecs.py
+++ b/scripts/crypto/gen-aead-testvecs.py
@@ -41,6 +41,15 @@ def gen_monte_carlo_checksum(alg):
                 key, tag_length=tag_len
             )
             ct_and_tag = ccm.encrypt(nonce, pt, ad)
+        elif alg == "aes-gcm":
+            key_len = [16, 24, 32][data_len % 3]
+            key = rand_bytes(key_len)
+            nonce = rand_bytes(12)
+            tag_len = [4, 8, 12, 13, 14, 15, 16][data_len % 7]
+            gcm = cryptography.hazmat.primitives.ciphers.aead.AESGCM(key)
+            # python-cryptography supports only 16-byte GCM tags.  However, in
+            # GCM, shorter tags are simply truncated.  Do that below.
+            ct_and_tag = gcm.encrypt(nonce, pt, ad)[: data_len + tag_len]
 
         blake2s.update(ct_and_tag)
 
@@ -53,8 +62,8 @@ def gen_monte_carlo_checksum(alg):
     print("};")
 
 
-if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm"):
-    sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm]\n")
+if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm", "aes-gcm"):
+    sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm|aes-gcm]\n")
     sys.exit(1)
 
 gen_monte_carlo_checksum(sys.argv[1])
-- 
cgit v1.2.3