@@ -141,9 +141,8 @@ However, these ioctls have some limitations:
141141 CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1
142142 to your kernel command line. However, this has a performance cost.
143143
144- - Secret keys might still exist in CPU registers, in crypto
145- accelerator hardware (if used by the crypto API to implement any of
146- the algorithms), or in other places not explicitly considered here.
144+ - Secret keys might still exist in CPU registers or in other places
145+ not explicitly considered here.
147146
148147Limitations of v1 policies
149148~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -375,9 +374,12 @@ the work is done by XChaCha12, which is much faster than AES when AES
375374acceleration is unavailable. For more information about Adiantum, see
376375`the Adiantum paper <https://eprint.iacr.org/2018/720.pdf >`_.
377376
378- The (AES-128-CBC-ESSIV, AES-128-CTS-CBC) pair exists only to support
379- systems whose only form of AES acceleration is an off-CPU crypto
380- accelerator such as CAAM or CESA that does not support XTS.
377+ The (AES-128-CBC-ESSIV, AES-128-CTS-CBC) pair was added to try to
378+ provide a more efficient option for systems that lack AES instructions
379+ in the CPU but do have a non-inline crypto engine such as CAAM or CESA
380+ that supports AES-CBC (and not AES-XTS). This is deprecated. It has
381+ been shown that just doing AES on the CPU is actually faster.
382+ Moreover, Adiantum is faster still and is recommended on such systems.
381383
382384The remaining mode pairs are the "national pride ciphers":
383385
@@ -1231,22 +1233,13 @@ this by validating all top-level encryption policies prior to access.
12311233Inline encryption support
12321234=========================
12331235
1234- By default, fscrypt uses the kernel crypto API for all cryptographic
1235- operations (other than HKDF, which fscrypt partially implements
1236- itself). The kernel crypto API supports hardware crypto accelerators,
1237- but only ones that work in the traditional way where all inputs and
1238- outputs (e.g. plaintexts and ciphertexts) are in memory. fscrypt can
1239- take advantage of such hardware, but the traditional acceleration
1240- model isn't particularly efficient and fscrypt hasn't been optimized
1241- for it.
1242-
1243- Instead, many newer systems (especially mobile SoCs) have *inline
1244- encryption hardware * that can encrypt/decrypt data while it is on its
1245- way to/from the storage device. Linux supports inline encryption
1246- through a set of extensions to the block layer called *blk-crypto *.
1247- blk-crypto allows filesystems to attach encryption contexts to bios
1248- (I/O requests) to specify how the data will be encrypted or decrypted
1249- in-line. For more information about blk-crypto, see
1236+ Many newer systems (especially mobile SoCs) have *inline encryption
1237+ hardware * that can encrypt/decrypt data while it is on its way to/from
1238+ the storage device. Linux supports inline encryption through a set of
1239+ extensions to the block layer called *blk-crypto *. blk-crypto allows
1240+ filesystems to attach encryption contexts to bios (I/O requests) to
1241+ specify how the data will be encrypted or decrypted in-line. For more
1242+ information about blk-crypto, see
12501243:ref: `Documentation/block/inline-encryption.rst <inline_encryption >`.
12511244
12521245On supported filesystems (currently ext4 and f2fs), fscrypt can use
0 commit comments