Re: [PATCH] fscrypt: use AES library for v1 key derivation

[Eric Biggers]

On Sat, Mar 21, 2026 at 12:53:38AM -0700, Eric Biggers wrote:
> Convert the implementation of the v1 (original / deprecated) fscrypt
> per-file key derivation algorithm to use the AES library instead of an
> "ecb(aes)" crypto_skcipher.  This is much simpler.
> 
> While the AES library doesn't support AES-ECB directly yet, we can still
> simply call aes_encrypt() in a loop.  While that doesn't explicitly
> parallelize the AES encryptions, it doesn't really matter in this case,
> where a new key is used each time and only 16 to 64 bytes are encrypted.
> 
> In fact, a quick benchmark (AMD Ryzen 9 9950X) shows that this commit
> actually greatly improves performance, from ~7000 cycles per key derived
> to ~1500.  The times don't differ much between 32 bytes and 64 bytes
> either, so clearly the bottleneck is API stuff and key expansion.
> 
> Granted, performance of the v1 key derivation is no longer very
> relevant: most users have moved onto v2 encryption policies.  The v2 key
> derivation uses HKDF-SHA512 (which is ~3500 cycles on the same CPU).
> 
> Still, it's nice that the simpler solution is much faster as well.
> 
> Compatibility verified with xfstests generic/548.
> 
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
> 
> This patch is targeting fscrypt/for-next
> 
>  fs/crypto/Kconfig       |  2 +-
>  fs/crypto/keysetup_v1.c | 87 +++++++++++++----------------------------
>  2 files changed, 29 insertions(+), 60 deletions(-)

Applied to https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=for-next

- Eric