Why AFALG engine no SW fallback in OpenSSL-3.0.0 and above?

[Neal-liu]

As indicated by the title, AFALG_NO_FALLBACK is not defined only in OpenSSL-1.x.x?

[cotequeiroz]

The fallback feature currently depends on very specific order of initialization (IIRC) that was reworked for OpenSSL 3.x.x.

The idea of a fallback was taken from the way the linux kernel does hardware crypto: there, some hardware may only do AES-128 & AES-256, so the driver would use a software fallback to do AES-192. There was a driver that I worked on that had problems doing small amount of data, and the fallback had to be used for that as well. I used the same idea in OpenSSL.

OpenSSL does not have a defined fallback mechanism, so I had to hack my way into doing it. The way I found to work was to use the ciphers that were already setup when the engine was initializing, and saving them for later. That depends on the order that the ciphers were initialized, with engines registering after the internal algorithms were already setup. That's why you can't, for example, use an engine as a fallback--kernel has a flag that will indicate that a cipher needs a fallback, so they are skipped when looking for fallbacks; OpenSSL does not.

OpenSSL changed the way it sets itself up in 3.0, so I need to figure out a new way to make it work again. I just can't find the time to do it.

[Neal-liu]

Thanks for your detail explanations. It's very clear.
I'm just wondering, have you consider upstream your AFALG engine to mainline OpenSSL?