Is it possible to build Veracrypt without AES_NI?

[gktrk]

Hi,

Is it possible to build Veracrypt without AES_NI support for old Intel CPUs? Putting -mno-aes in CFLAGS breaks the build as mentioned in this bug. Passing -DCRYPTOPP_DISABLE_AESNI so that CRYPTOPP_BOOL_AESNI_INTRINSICS_AVAILABLE is set to 0 doesn't seem to help either. What's the proper build flag to pass such that -mno-aes is honored?

Thanks,

[idrassi]

Hi @gktrk,

Passing -DCRYPTOPP_DISABLE_AESNI is the solution to your need. I have just run a build with these flags and there is no error. However, at runtime, the generated VeraCrypt binary can still use AES-NI if it is available on the CPU.

So, what is the issue you are encountering with -DCRYPTOPP_DISABLE_AESNI? Do you want to completely disable AES-NI even at runtime?

[idrassi]

@gktrk

I pushed a commit (https://github.com/veracrypt/VeraCrypt/commit/d417b2806c88cf06f4f3baa0064d6b1f9f22037d) that enables to completely remove AESNI support from generated VeraCrypt binary. Now, you can just set the environment variable DISABLE_AESNI to 1 and the Makefile will automatically set necessary defines to completely disable AESNI. You can also run make NOAESNI=1 to achieve the same result.

As you can see in the commit, when this variable is defined to 1, we set -DCRYPTOPP_DISABLE_AESNI but also we avoid setting -maes. Moreover, we don't check AESNI capability of the CPU in this case, we don't define TC_AES_HW_CPU and finally we avoid linking against Aes_hw_cpu.asm.

This change will be included in version 1.25.8 that should be released tomorrow.

[gktrk]

I put -mno-aes in my CFLAGS and 1.25.7 fails to compile as expected:

x86_64-pc-linux-gnu-gcc -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I/var/tmp/portage/app-crypt/veracrypt-1.25.7/work/VeraCrypt-VeraCrypt_1.25.7/src -I/var/tmp/portage/app-crypt/veracrypt-1.25.7/work/VeraCrypt-VeraCrypt_1.25.7/src/Crypto -I/var/tmp/portage/app-crypt/veracrypt-1.25.7/work/VeraCrypt-VeraCrypt_1.25.7/src/PKCS11 -O2 -fno-strict-aliasing   -D TC_ARCH_X64 -DTC_UNIX -DTC_LINUX -fdata-sections -ffunction-sections -fpie -Wall -msse2 -maes -mssse3 -mssse3 -msse4.1 -march=native -mtune=native -O2 -pipe -mno-aes -c ../Crypto/cpu.c -o ../Crypto/cpu.o
../Crypto/cpu.c:67:32: warning: argument 2 of type ‘uint32[4]’ {aka ‘unsigned int[4]’} with mismatched bound [-Warray-parameter=]
   67 | int CpuId(uint32 input, uint32 output[4])
      |                         ~~~~~~~^~~~~~~~~
In file included from ../Crypto/cpu.c:3:
../Crypto/cpu.h:236:33: note: previously declared as ‘uint32 *’ {aka ‘unsigned int *’}
  236 | int CpuId(uint32 input, uint32 *output);
      |                         ~~~~~~~~^~~~~~
In file included from ../Crypto/cpu.h:200,
                 from ../Crypto/cpu.c:3:
../Crypto/cpu.c: In function ‘TryAESNI’:
/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/include/wmmintrin.h:61:1: error: inlining failed in call to ‘always_inline’ ‘_mm_aesenc_si128’: target specific option mismatch
   61 | _mm_aesenc_si128 (__m128i __X, __m128i __Y)
      | ^~~~~~~~~~~~~~~~
../Crypto/cpu.c:257:28: note: called from here
  257 |                 ciphered = _mm_aesenc_si128(block, subkey);
      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../Crypto/cpu.h:200,
                 from ../Crypto/cpu.c:3:
/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/include/wmmintrin.h:61:1: error: inlining failed in call to ‘always_inline’ ‘_mm_aesenc_si128’: target specific option mismatch
   61 | _mm_aesenc_si128 (__m128i __X, __m128i __Y)
      | ^~~~~~~~~~~~~~~~
../Crypto/cpu.c:257:28: note: called from here
  257 |                 ciphered = _mm_aesenc_si128(block, subkey);
      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I applied your patch and passed NOAESNI=1, it compiled successfully. I'll wait for the next release instead of backporting this. Thanks for taking care of it quickly!

[idrassi]

Version 1.25.9 has been released and it contains the change mentioned earlier.