16c2ecbffSGreg TuckerIntel(R) Intelligent Storage Acceleration Library Crypto Version 26c2ecbffSGreg Tucker================================================================ 36c2ecbffSGreg Tucker 4d9287370SPablo de Lara 5d9287370SPablo de Lara[](https://scan.coverity.com/projects/intel-isa-l-crypto) 6d9287370SPablo de Lara[](https://securityscorecards.dev/viewer/?uri=github.com/intel/isa-l_crypto) 7d9287370SPablo de Lara 86c2ecbffSGreg TuckerISA-L_crypto is a collection of optimized low-level functions targeting storage 96c2ecbffSGreg Tuckerapplications. ISA-L_crypto includes: 106c2ecbffSGreg Tucker 116c2ecbffSGreg Tucker* Multi-buffer hashes - run multiple hash jobs together on one core for much 126c2ecbffSGreg Tucker better throughput than single-buffer versions. 13036540e1Sjiaqizho - SHA1, SHA256, SHA512, MD5, SM3 146c2ecbffSGreg Tucker 156c2ecbffSGreg Tucker* Multi-hash - Get the performance of multi-buffer hashing with a single-buffer 167d7df375SPablo de Lara interface. Specification ref : [Multi-Hash white paper](https://raw.githubusercontent.com/wiki/intel/isa-l_crypto/pdf/multi-hash-paper.pdf) 176c2ecbffSGreg Tucker 186c2ecbffSGreg Tucker* Multi-hash + murmur - run both together. 196c2ecbffSGreg Tucker 206c2ecbffSGreg Tucker* AES - block ciphers 216c2ecbffSGreg Tucker - XTS, GCM, CBC 226c2ecbffSGreg Tucker 2388cd97e2SXiaodong Liu* Rolling hash - Hash input in a window which moves through the input 2488cd97e2SXiaodong Liu 25ab9fc1bdSGreg TuckerAlso see: 26daf84a40SGreg Tucker* [ISA-L_crypto for updates](https://github.com/intel/isa-l_crypto). 27daf84a40SGreg Tucker* For non-crypto ISA-L see [isa-l on github](https://github.com/intel/isa-l). 28daf84a40SGreg Tucker* The [github wiki](https://github.com/intel/isa-l/wiki) covering isa-l and 29ab9fc1bdSGreg Tucker isa-l crypto. 30ab9fc1bdSGreg Tucker* [Contributing](CONTRIBUTING.md). 312c5887edSGreg Tucker* [Security Policy](SECURITY.md). 32faac8c3bSPablo de Lara* [FIPS Mode](FIPS.md). 336c2ecbffSGreg Tucker 346c2ecbffSGreg TuckerBuilding ISA-L 357fbc0c89SGreg Tucker-------------- 366c2ecbffSGreg Tucker 377fbc0c89SGreg Tucker### Prerequisites 386c2ecbffSGreg Tucker 398319ad33SJerry Yux86_64: 40d28f1034SPablo de Lara* Assembler: nasm v2.14.01 or later 41*9b7a2b84SMarcel Cornu* Compiler: gcc, clang, icc or MSVC (Visual Studio 2019 or later). 42ab9fc1bdSGreg Tucker* Make: GNU 'make' or 'nmake' (Windows). 43ab9fc1bdSGreg Tucker* Optional: Building with autotools requires autoconf/automake packages. 447fbc0c89SGreg Tucker 458319ad33SJerry Yuaarch64: 4608297dc3SDaniel Hu* Assembler: gas v2.34 or later. 478319ad33SJerry Yu* Compiler: gcc v8 or later. 4808297dc3SDaniel Hu* For gas v2.24~v2.34, sve2 instructions are not supported. To workaround it, sve2 optimization should be disabled by 4908297dc3SDaniel Hu * ./configure --disable-sve2 5008297dc3SDaniel Hu * make -f Makefile.unx DEFINES+=-DNO_SVE2=1 518319ad33SJerry Yu 527fbc0c89SGreg Tucker### Autotools 537fbc0c89SGreg TuckerTo build and install the library with autotools it is usually sufficient to run: 546c2ecbffSGreg Tucker 556c2ecbffSGreg Tucker ./autogen.sh 566c2ecbffSGreg Tucker ./configure 576c2ecbffSGreg Tucker make 586c2ecbffSGreg Tucker sudo make install 596c2ecbffSGreg Tucker 607fbc0c89SGreg Tucker### Makefile 617fbc0c89SGreg TuckerTo use a standard makefile run: 626c2ecbffSGreg Tucker 637fbc0c89SGreg Tucker make -f Makefile.unx 646c2ecbffSGreg Tucker 657fbc0c89SGreg Tucker### Windows 666c2ecbffSGreg TuckerOn Windows use nmake to build dll and static lib: 676c2ecbffSGreg Tucker 686c2ecbffSGreg Tucker nmake -f Makefile.nmake 696c2ecbffSGreg Tucker 707fbc0c89SGreg Tucker### Other make targets 717fbc0c89SGreg TuckerOther targets include: 727fbc0c89SGreg Tucker* `make check` : create and run tests 737fbc0c89SGreg Tucker* `make tests` : create additional unit tests 747fbc0c89SGreg Tucker* `make perfs` : create included performance tests 757fbc0c89SGreg Tucker* `make ex` : build examples 767fd405e9SGreg Tucker* `make doc` : build API manual 77070644e4SPablo de Lara 78070644e4SPablo de LaraAlgorithm recommendations 79070644e4SPablo de Lara------------------------- 80070644e4SPablo de Lara 81070644e4SPablo de LaraLegacy or to be avoided algorithms listed in the table below are implemented 82070644e4SPablo de Larain the library in order to support legacy applications. Please use corresponding 83070644e4SPablo de Laraalternative algorithms instead. 84070644e4SPablo de Lara``` 85070644e4SPablo de Lara+----------------------------------------------------+ 86070644e4SPablo de Lara| # | Algorithm | Recommendation | Alternative | 87070644e4SPablo de Lara|---+----------------+----------------+--------------| 88070644e4SPablo de Lara| 1 | MD5 integrity | Legacy | SHA256 | 89070644e4SPablo de Lara|---+----------------+----------------+--------------| 90070644e4SPablo de Lara| 2 | SHA1 integrity | Avoid | SHA256 | 91070644e4SPablo de Lara+----------------------------------------------------+ 92070644e4SPablo de Lara``` 93070644e4SPablo de LaraIntel(R) Intelligent Storage Acceleration for Crypto Library depends on C library and 94070644e4SPablo de Larait is recommended to use its latest version. 95070644e4SPablo de Lara 96070644e4SPablo de LaraApplications using the Intel(R) Intelligent Storage Acceleration for Crypto Library rely on 97070644e4SPablo de LaraOperating System to provide process isolation. 98070644e4SPablo de LaraAs the result, it is recommended to use latest Operating System patches and 99070644e4SPablo de Larasecurity updates. 10053d9fcc0SPablo de Lara 10153d9fcc0SPablo de LaraDLL Injection Attack 10253d9fcc0SPablo de Lara-------------------- 10353d9fcc0SPablo de Lara 10453d9fcc0SPablo de Lara### Problem 10553d9fcc0SPablo de Lara 10653d9fcc0SPablo de LaraThe Windows OS has an insecure predefined search order and set of defaults when trying to locate a resource. If the resource location is not specified by the software, an attacker need only place a malicious version in one of the locations Windows will search, and it will be loaded instead. Although this weakness can occur with any resource, it is especially common with DLL files. 10753d9fcc0SPablo de Lara 10853d9fcc0SPablo de Lara### Solutions 10953d9fcc0SPablo de Lara 11053d9fcc0SPablo de LaraApplications using libisal_crypto DLL library may need to apply one of the solutions to prevent from DLL injection attack. 11153d9fcc0SPablo de Lara 11253d9fcc0SPablo de LaraTwo solutions are available: 11353d9fcc0SPablo de Lara- Using a Fully Qualified Path is the most secure way to load a DLL 11453d9fcc0SPablo de Lara- Signature verification of the DLL 11553d9fcc0SPablo de Lara 11653d9fcc0SPablo de Lara### Resources and Solution Details 11753d9fcc0SPablo de Lara 11853d9fcc0SPablo de Lara- Security remarks section of LoadLibraryEx documentation by Microsoft: <https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa#security-remarks> 11953d9fcc0SPablo de Lara- Microsoft Dynamic Link Library Security article: <https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security> 12053d9fcc0SPablo de Lara- Hijack Execution Flow: DLL Search Order Hijacking: <https://attack.mitre.org/techniques/T1574/001> 12153d9fcc0SPablo de Lara- Hijack Execution Flow: DLL Side-Loading: <https://attack.mitre.org/techniques/T1574/002> 122
){kind=link}
){kind=link}