Slightly simplify method/cipher/MAC definitions

13 files changed, 94 insertions, 207 deletions

diff --git a/src/config.c b/src/config.c
index 9f8fab7..5e5c131 100644
--- a/src/config.c
+++ b/src/config.c
@@ -488,10 +488,10 @@ static void configure_method_parameters(fastd_context_t *ctx, fastd_config_t *co
 		const fastd_method_t *method = fastd_method_get_by_name(method_name->str);
 
 		conf->max_packet_size = max_size_t(conf->max_packet_size, method->max_packet_size(ctx));
-		conf->min_encrypt_head_space = max_size_t(conf->min_encrypt_head_space, method->min_encrypt_head_space(ctx));
-		conf->min_decrypt_head_space = max_size_t(conf->min_decrypt_head_space, method->min_decrypt_head_space(ctx));
-		conf->min_encrypt_tail_space = max_size_t(conf->min_encrypt_tail_space, method->min_encrypt_tail_space(ctx));
-		conf->min_decrypt_tail_space = max_size_t(conf->min_decrypt_tail_space, method->min_decrypt_tail_space(ctx));
+		conf->min_encrypt_head_space = max_size_t(conf->min_encrypt_head_space, method->min_encrypt_head_space);
+		conf->min_decrypt_head_space = max_size_t(conf->min_decrypt_head_space, method->min_decrypt_head_space);
+		conf->min_encrypt_tail_space = max_size_t(conf->min_encrypt_tail_space, method->min_encrypt_tail_space);
+		conf->min_decrypt_tail_space = max_size_t(conf->min_decrypt_tail_space, method->min_decrypt_tail_space);
 	}
 
 	conf->min_encrypt_head_space = alignto(conf->min_encrypt_head_space, 16);
diff --git a/src/crypto/cipher/aes128_ctr/nacl/cipher_aes128_ctr_nacl.c b/src/crypto/cipher/aes128_ctr/nacl/cipher_aes128_ctr_nacl.c
index 5cb4bc7..7c75b7d 100644
--- a/src/crypto/cipher/aes128_ctr/nacl/cipher_aes128_ctr_nacl.c
+++ b/src/crypto/cipher/aes128_ctr/nacl/cipher_aes128_ctr_nacl.c
@@ -37,10 +37,6 @@ static fastd_cipher_context_t* aes128_ctr_initialize(fastd_context_t *ctx UNUSED
 	return NULL;
 }
 
-static size_t aes128_ctr_key_length(fastd_context_t *ctx UNUSED, const fastd_cipher_context_t *cctx UNUSED) {
-	return 16;
-}
-
 static fastd_cipher_state_t* aes128_ctr_init_state(fastd_context_t *ctx, const fastd_cipher_context_t *cctx UNUSED, const uint8_t *key) {
 	fastd_block128_t k;
 	memcpy(k.b, key, sizeof(fastd_block128_t));
@@ -55,10 +51,6 @@ static fastd_cipher_state_t* aes128_ctr_init_state(fastd_context_t *ctx, const f
 	return state;
 }
 
-static size_t aes128_ctr_iv_length(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state UNUSED) {
-	return 16;
-}
-
 static bool aes128_ctr_crypt(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state, fastd_block128_t *out, const fastd_block128_t *in, size_t len, const uint8_t *iv) {
 	crypto_stream_aes128ctr_xor_afternm(out->b, in->b, len, iv, state->d);
 	return true;
@@ -76,13 +68,12 @@ static void aes128_ctr_free(fastd_context_t *ctx UNUSED, fastd_cipher_context_t
 
 const fastd_cipher_t fastd_cipher_aes128_ctr_nacl = {
 	.name = "nacl",
+	.key_length = 16,
+	.iv_length = 16,
 
 	.initialize = aes128_ctr_initialize,
-
-	.key_length = aes128_ctr_key_length,
 	.init_state = aes128_ctr_init_state,
 
-	.iv_length = aes128_ctr_iv_length,
 	.crypt = aes128_ctr_crypt,
 
 	.free_state = aes128_ctr_free_state,
diff --git a/src/crypto/cipher/blowfish_ctr/builtin/blowfish_ctr.c b/src/crypto/cipher/blowfish_ctr/builtin/blowfish_ctr.c
index d874e72..d657694 100644
--- a/src/crypto/cipher/blowfish_ctr/builtin/blowfish_ctr.c
+++ b/src/crypto/cipher/blowfish_ctr/builtin/blowfish_ctr.c
@@ -179,10 +179,6 @@ static fastd_cipher_context_t* blowfish_ctr_initialize(fastd_context_t *ctx UNUS
 	return NULL;
 }
 
-static size_t blowfish_ctr_key_length(fastd_context_t *ctx UNUSED, const fastd_cipher_context_t *cctx UNUSED) {
-	return 56;
-}
-
 
 static inline void bf_ntohl(uint32_t *v, size_t len) {
 	size_t i;
@@ -243,10 +239,6 @@ static fastd_cipher_state_t* blowfish_ctr_init_state(fastd_context_t *ctx UNUSED
 	return state;
 }
 
-static size_t blowfish_ctr_iv_length(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state UNUSED) {
-	return 8;
-}
-
 static bool blowfish_ctr_crypt(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state, fastd_block128_t *out, const fastd_block128_t *in, size_t len, const uint8_t *iv) {
 	register uint32_t ctr[2];
 	register uint32_t block[2];
@@ -283,13 +275,12 @@ static void blowfish_ctr_free(fastd_context_t *ctx UNUSED, fastd_cipher_context_
 
 const fastd_cipher_t fastd_cipher_blowfish_ctr_builtin = {
 	.name = "builtin",
+	.key_length = 56,
+	.iv_length = 8,
 
 	.initialize = blowfish_ctr_initialize,
-
-	.key_length = blowfish_ctr_key_length,
 	.init_state = blowfish_ctr_init_state,
 
-	.iv_length = blowfish_ctr_iv_length,
 	.crypt = blowfish_ctr_crypt,
 
 	.free_state = blowfish_ctr_free_state,
diff --git a/src/crypto/cipher/null/memcpy/null_memcpy.c b/src/crypto/cipher/null/memcpy/null_memcpy.c
index e3b86ca..c260ffb 100644
--- a/src/crypto/cipher/null/memcpy/null_memcpy.c
+++ b/src/crypto/cipher/null/memcpy/null_memcpy.c
@@ -31,19 +31,10 @@ static fastd_cipher_context_t* null_initialize(fastd_context_t *ctx UNUSED) {
 	return NULL;
 }
 
-static size_t null_key_length(fastd_context_t *ctx UNUSED, const fastd_cipher_context_t *cctx UNUSED) {
-	return 0;
-}
-
-
 static fastd_cipher_state_t* null_init_state(fastd_context_t *ctx UNUSED, const fastd_cipher_context_t *cctx UNUSED, const uint8_t *key UNUSED) {
 	return NULL;
 }
 
-static size_t null_iv_length(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state UNUSED) {
-	return 0;
-}
-
 static bool null_memcpy(fastd_context_t *ctx UNUSED, const fastd_cipher_state_t *state UNUSED, fastd_block128_t *out, const fastd_block128_t *in, size_t len, const uint8_t *iv UNUSED) {
 	memcpy(out, in, len);
 	return true;
@@ -57,13 +48,12 @@ static void null_free(fastd_context_t *ctx UNUSED, fastd_cipher_context_t *cctx
 
 const fastd_cipher_t fastd_cipher_null_memcpy = {
 	.name = "memcpy",
+	.key_length = 0,
+	.iv_length = 0,
 
 	.initialize = null_initialize,
-
-	.key_length = null_key_length,
 	.init_state = null_init_state,
 
-	.iv_length = null_iv_length,
 	.crypt = null_memcpy,
 
 	.free_state = null_free_state,
diff --git a/src/crypto/mac/ghash/builtin/ghash_builtin.c b/src/crypto/mac/ghash/builtin/ghash_builtin.c
index a243b2a..8793627 100644
--- a/src/crypto/mac/ghash/builtin/ghash_builtin.c
+++ b/src/crypto/mac/ghash/builtin/ghash_builtin.c
@@ -65,10 +65,6 @@ static fastd_mac_context_t* ghash_initialize(fastd_context_t *ctx UNUSED) {
 	return NULL;
 }
 
-static size_t ghash_key_length(fastd_context_t *ctx UNUSED, const fastd_mac_context_t *cctx UNUSED) {
-	return sizeof(fastd_block128_t);
-}
-
 static fastd_mac_state_t* ghash_init_state(fastd_context_t *ctx UNUSED, const fastd_mac_context_t *mctx UNUSED, const uint8_t *key) {
 	fastd_mac_state_t *state = malloc(sizeof(fastd_mac_state_t));
 
@@ -137,10 +133,9 @@ static void ghash_free(fastd_context_t *ctx UNUSED, fastd_mac_context_t *mctx UN
 
 const fastd_mac_t fastd_mac_ghash_builtin = {
 	.name = "builtin",
+	.key_length = sizeof(fastd_block128_t),
 
 	.initialize = ghash_initialize,
-
-	.key_length = ghash_key_length,
 	.init_state = ghash_init_state,
 
 	.hash = ghash_hash,
diff --git a/src/fastd.h b/src/fastd.h
index 5354871..2536e71 100644
--- a/src/fastd.h
+++ b/src/fastd.h
@@ -82,10 +82,10 @@ struct fastd_method {
 	bool (*provides)(const char *name);
 
 	size_t (*max_packet_size)(fastd_context_t *ctx);
-	size_t (*min_encrypt_head_space)(fastd_context_t *ctx);
-	size_t (*min_decrypt_head_space)(fastd_context_t *ctx);
-	size_t (*min_encrypt_tail_space)(fastd_context_t *ctx);
-	size_t (*min_decrypt_tail_space)(fastd_context_t *ctx);
+	size_t min_encrypt_head_space;
+	size_t min_decrypt_head_space;
+	size_t min_encrypt_tail_space;
+	size_t min_decrypt_tail_space;
 
 	size_t (*key_length)(fastd_context_t *ctx, const char *name);
 	fastd_method_session_state_t* (*session_init)(fastd_context_t *ctx, const char *name, const uint8_t *secret, bool initiator);
@@ -102,13 +102,12 @@ struct fastd_method {
 
 struct fastd_cipher {
 	const char *name;
+	size_t key_length;
+	size_t iv_length;
 
 	fastd_cipher_context_t* (*initialize)(fastd_context_t *ctx);
-
-	size_t (*key_length)(fastd_context_t *ctx, const fastd_cipher_context_t *cctx);
 	fastd_cipher_state_t* (*init_state)(fastd_context_t *ctx, const fastd_cipher_context_t *cctx, const uint8_t *key);
 
-	size_t (*iv_length)(fastd_context_t *ctx, const fastd_cipher_state_t *state);
 	bool (*crypt)(fastd_context_t *ctx, const fastd_cipher_state_t *state, fastd_block128_t *out, const fastd_block128_t *in, size_t len, const uint8_t *iv);
 
 	void (*free_state)(fastd_context_t *ctx, fastd_cipher_state_t *state);
@@ -117,10 +116,9 @@ struct fastd_cipher {
 
 struct fastd_mac {
 	const char *name;
+	size_t key_length;
 
 	fastd_mac_context_t* (*initialize)(fastd_context_t *ctx);
-
-	size_t (*key_length)(fastd_context_t *ctx, const fastd_mac_context_t *mctx);
 	fastd_mac_state_t* (*init_state)(fastd_context_t *ctx, const fastd_mac_context_t *mctx, const uint8_t *key);
 
 	bool (*hash)(fastd_context_t *ctx, const fastd_mac_state_t *state, fastd_block128_t *out, const fastd_block128_t *in, size_t n_blocks);
diff --git a/src/methods/cipher_test/cipher_test.c b/src/methods/cipher_test/cipher_test.c
index 9f0b600..050e2a5 100644
--- a/src/methods/cipher_test/cipher_test.c
+++ b/src/methods/cipher_test/cipher_test.c
@@ -34,7 +34,6 @@ struct fastd_method_session_state {
 	const fastd_cipher_t *cipher;
 	const fastd_cipher_context_t *cipher_ctx;
 	fastd_cipher_state_t *cipher_state;
-	size_t ivlen;
 };
 
 
@@ -70,22 +69,13 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 }
 
 
-static size_t method_min_head_space(fastd_context_t *ctx UNUSED) {
-	return 0;
-}
-
-static size_t method_min_tail_space(fastd_context_t *ctx UNUSED) {
-	return (sizeof(fastd_block128_t)-1);
-}
-
-
 static size_t method_key_length(fastd_context_t *ctx, const char *name) {
 	const fastd_cipher_t *cipher = NULL;
 	const fastd_cipher_context_t *cctx;
 	if (!cipher_get(ctx, name, &cipher, &cctx))
 		exit_bug(ctx, "cipher-test: can't get cipher key length");
 
-	return cipher->key_length(ctx, cctx);
+	return cipher->key_length;
 }
 
 static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, const char *name, const uint8_t *secret, bool initiator) {
@@ -97,7 +87,6 @@ static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, c
 		exit_bug(ctx, "cipher-test: can't instanciate cipher");
 
 	session->cipher_state = session->cipher->init_state(ctx, session->cipher_ctx, secret);
-	session->ivlen = session->cipher->iv_length(ctx, session->cipher_state);
 
 	pr_warn(ctx, "using cipher-test method; this method must be used for testing and benchmarks only");
 
@@ -134,11 +123,11 @@ static bool method_encrypt(fastd_context_t *ctx, fastd_peer_t *peer UNUSED, fast
 	if (tail_len)
 		memset(in.data+in.len, 0, tail_len);
 
-	uint8_t nonce[session->ivlen];
-	if (session->ivlen) {
-		memset(nonce, 0, session->ivlen);
-		memcpy(nonce, session->common.send_nonce, min_size_t(COMMON_NONCEBYTES, session->ivlen));
-		nonce[session->ivlen-1] = 1;
+	uint8_t nonce[session->cipher->iv_length];
+	if (session->cipher->iv_length) {
+		memset(nonce, 0, session->cipher->iv_length);
+		memcpy(nonce, session->common.send_nonce, min_size_t(COMMON_NONCEBYTES, session->cipher->iv_length));
+		nonce[session->cipher->iv_length-1] = 1;
 	}
 
 	int n_blocks = block_count(in.len, sizeof(fastd_block128_t));
@@ -177,11 +166,11 @@ static bool method_decrypt(fastd_context_t *ctx, fastd_peer_t *peer, fastd_metho
 	if (common_nonce[COMMON_NONCEBYTES]) /* flags */
 		return false;
 
-	uint8_t nonce[session->ivlen];
-	if (session->ivlen) {
-		memset(nonce, 0, session->ivlen);
-		memcpy(nonce, common_nonce, min_size_t(COMMON_NONCEBYTES, session->ivlen));
-		nonce[session->ivlen-1] = 1;
+	uint8_t nonce[session->cipher->iv_length];
+	if (session->cipher->iv_length) {
+		memset(nonce, 0, session->cipher->iv_length);
+		memcpy(nonce, common_nonce, min_size_t(COMMON_NONCEBYTES, session->cipher->iv_length));
+		nonce[session->cipher->iv_length-1] = 1;
 	}
 
 	int64_t age;
@@ -219,10 +208,10 @@ const fastd_method_t fastd_method_cipher_test = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_head_space,
-	.min_decrypt_head_space = method_min_head_space,
-	.min_encrypt_tail_space = method_min_tail_space,
-	.min_decrypt_tail_space = method_min_tail_space,
+	.min_encrypt_head_space = 0,
+	.min_decrypt_head_space = 0,
+	.min_encrypt_tail_space = sizeof(fastd_block128_t)-1,
+	.min_decrypt_tail_space = sizeof(fastd_block128_t)-1,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/methods/generic_gcm/generic_gcm.c b/src/methods/generic_gcm/generic_gcm.c
index 9c31ec4..a35a6c9 100644
--- a/src/methods/generic_gcm/generic_gcm.c
+++ b/src/methods/generic_gcm/generic_gcm.c
@@ -34,7 +34,6 @@ struct fastd_method_session_state {
 	const fastd_cipher_t *cipher;
 	const fastd_cipher_context_t *cipher_ctx;
 	fastd_cipher_state_t *cipher_state;
-	size_t ivlen;
 
 	const fastd_mac_t *ghash;
 	const fastd_mac_context_t *ghash_ctx;
@@ -77,30 +76,13 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 }
 
 
-static size_t method_min_encrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return sizeof(fastd_block128_t);
-}
-
-static size_t method_min_decrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return 0;
-}
-
-static size_t method_min_encrypt_tail_space(fastd_context_t *ctx UNUSED) {
-	return (sizeof(fastd_block128_t)-1);
-}
-
-static size_t method_min_decrypt_tail_space(fastd_context_t *ctx UNUSED) {
-	return (2*sizeof(fastd_block128_t)-1);
-}
-
-
 static size_t method_key_length(fastd_context_t *ctx, const char *name) {
 	const fastd_cipher_t *cipher = NULL;
 	const fastd_cipher_context_t *cctx;
 	if (!cipher_get(ctx, name, &cipher, &cctx))
 		exit_bug(ctx, "generic-gcm: can't get cipher key length");
 
-	return cipher->key_length(ctx, cctx);
+	return cipher->key_length;
 }
 
 static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, const char *name, const uint8_t *secret, bool initiator) {
@@ -116,12 +98,11 @@ static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, c
 	static const fastd_block128_t zeroblock = {};
 	fastd_block128_t H;
 
-	session->ivlen = session->cipher->iv_length(ctx, session->cipher_state);
-	if (session->ivlen <= COMMON_NONCEBYTES)
+	if (session->cipher->iv_length <= COMMON_NONCEBYTES)
 		exit_bug(ctx, "generic-gcm: iv_length to small");
 
-	uint8_t zeroiv[session->ivlen];
-	memset(zeroiv, 0, session->ivlen);
+	uint8_t zeroiv[session->cipher->iv_length];
+	memset(zeroiv, 0, session->cipher->iv_length);
 
 	session->cipher->crypt(ctx, session->cipher_state, &H, &zeroblock, sizeof(fastd_block128_t), zeroiv);
 
@@ -185,10 +166,10 @@ static bool method_encrypt(fastd_context_t *ctx, fastd_peer_t *peer UNUSED, fast
 	if (tail_len)
 		memset(in.data+in.len, 0, tail_len);
 
-	uint8_t nonce[session->ivlen];
-	memset(nonce, 0, session->ivlen);
+	uint8_t nonce[session->cipher->iv_length];
+	memset(nonce, 0, session->cipher->iv_length);
 	memcpy(nonce, session->common.send_nonce, COMMON_NONCEBYTES);
-	nonce[session->ivlen-1] = 1;
+	nonce[session->cipher->iv_length-1] = 1;
 
 	int n_blocks = block_count(in.len, sizeof(fastd_block128_t));
 
@@ -238,10 +219,10 @@ static bool method_decrypt(fastd_context_t *ctx, fastd_peer_t *peer, fastd_metho
 	if (((const uint8_t*)in.data)[COMMON_NONCEBYTES]) /* flags */
 		return false;
 
-	uint8_t nonce[session->ivlen];
-	memset(nonce, 0, session->ivlen);
+	uint8_t nonce[session->cipher->iv_length];
+	memset(nonce, 0, session->cipher->iv_length);
 	memcpy(nonce, in.data, COMMON_NONCEBYTES);
-	nonce[session->ivlen-1] = 1;
+	nonce[session->cipher->iv_length-1] = 1;
 
 	int64_t age;
 	if (!fastd_method_is_nonce_valid(ctx, &session->common, nonce, &age))
@@ -290,10 +271,10 @@ const fastd_method_t fastd_method_generic_gcm = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_encrypt_head_space,
-	.min_decrypt_head_space = method_min_decrypt_head_space,
-	.min_encrypt_tail_space = method_min_encrypt_tail_space,
-	.min_decrypt_tail_space = method_min_decrypt_tail_space,
+	.min_encrypt_head_space = sizeof(fastd_block128_t),
+	.min_decrypt_head_space = 0,
+	.min_encrypt_tail_space = sizeof(fastd_block128_t)-1,
+	.min_decrypt_tail_space = 2*sizeof(fastd_block128_t)-1,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/methods/generic_gmac/generic_gmac.c b/src/methods/generic_gmac/generic_gmac.c
index c3ad0e6..71ee898 100644
--- a/src/methods/generic_gmac/generic_gmac.c
+++ b/src/methods/generic_gmac/generic_gmac.c
@@ -36,12 +36,10 @@ struct fastd_method_session_state {
 	const fastd_cipher_t *cipher;
 	const fastd_cipher_context_t *cipher_ctx;
 	fastd_cipher_state_t *cipher_state;
-	size_t ivlen;
 
 	const fastd_cipher_t *gmac_cipher;
 	const fastd_cipher_context_t *gmac_cipher_ctx;
 	fastd_cipher_state_t *gmac_cipher_state;
-	size_t gmac_ivlen;
 
 	const fastd_mac_t *ghash;
 	const fastd_mac_context_t *ghash_ctx;
@@ -93,19 +91,6 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 }
 
 
-static size_t method_min_head_space(fastd_context_t *ctx UNUSED) {
-	return 0;
-}
-
-static size_t method_min_encrypt_tail_space(fastd_context_t *ctx UNUSED) {
-	return (sizeof(fastd_block128_t)-1);
-}
-
-static size_t method_min_decrypt_tail_space(fastd_context_t *ctx UNUSED) {
-	return (2*sizeof(fastd_block128_t)-1);
-}
-
-
 static size_t method_key_length(fastd_context_t *ctx, const char *name) {
 	const fastd_cipher_t *cipher = NULL;
 	const fastd_cipher_context_t *cctx;
@@ -116,7 +101,7 @@ static size_t method_key_length(fastd_context_t *ctx, const char *name) {
 	if (!cipher_get(ctx, name, &cipher, &cctx, &gmac_cipher, &gmac_cctx))
 		exit_bug(ctx, "generic-gmac: can't get cipher key length");
 
-	return cipher->key_length(ctx, cctx) + gmac_cipher->key_length(ctx, gmac_cctx);
+	return cipher->key_length + gmac_cipher->key_length;
 }
 
 static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, const char *name, const uint8_t *secret, bool initiator) {
@@ -128,19 +113,17 @@ static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, c
 		exit_bug(ctx, "generic-gmac: can't instanciate cipher");
 
 	session->cipher_state = session->cipher->init_state(ctx, session->cipher_ctx, secret);
-	session->ivlen = session->cipher->iv_length(ctx, session->cipher_state);
-	if (session->ivlen && session->ivlen <= COMMON_NONCEBYTES)
+	if (session->cipher->iv_length && session->cipher->iv_length <= COMMON_NONCEBYTES)
 		exit_bug(ctx, "generic-gmac: iv_length to small");
 
-	session->gmac_cipher_state = session->gmac_cipher->init_state(ctx, session->gmac_cipher_ctx, secret + session->cipher->key_length(ctx, session->cipher_ctx));
-	session->gmac_ivlen = session->gmac_cipher->iv_length(ctx, session->gmac_cipher_state);
-	if (session->gmac_ivlen <= COMMON_NONCEBYTES)
-		exit_bug(ctx, "generic-gmac: gmac cipher iv_length to small");
+	session->gmac_cipher_state = session->gmac_cipher->init_state(ctx, session->gmac_cipher_ctx, secret + session->cipher->key_length);
+	if (session->gmac_cipher->iv_length <= COMMON_NONCEBYTES)
+		exit_bug(ctx, "generic-gmac: GMAC cipher iv_length to small");
 
 	fastd_block128_t H;
 
-	uint8_t zeroiv[session->gmac_ivlen];
-	memset(zeroiv, 0, session->gmac_ivlen);
+	uint8_t zeroiv[session->gmac_cipher->iv_length];
+	memset(zeroiv, 0, session->gmac_cipher->iv_length);
 
 	session->gmac_cipher->crypt(ctx, session->gmac_cipher_state, &H, &ZERO_BLOCK, sizeof(fastd_block128_t), zeroiv);
 
@@ -201,19 +184,19 @@ static bool method_encrypt(fastd_context_t *ctx, fastd_peer_t *peer UNUSED, fast
 	fastd_block128_t *outblocks = out->data;
 	fastd_block128_t sig;
 
-	uint8_t gmac_nonce[session->gmac_ivlen];
-	memset(gmac_nonce, 0, session->gmac_ivlen);
+	uint8_t gmac_nonce[session->gmac_cipher->iv_length];
+	memset(gmac_nonce, 0, session->gmac_cipher->iv_length);
 	memcpy(gmac_nonce, session->common.send_nonce, COMMON_NONCEBYTES);
-	gmac_nonce[session->gmac_ivlen-1] = 1;
+	gmac_nonce[session->gmac_cipher->iv_length-1] = 1;
 
 	bool ok = session->gmac_cipher->crypt(ctx, session->gmac_cipher_state, outblocks, &ZERO_BLOCK, sizeof(fastd_block128_t), gmac_nonce);
 
 	if (ok) {
-		uint8_t nonce[session->ivlen];
-		if (session->ivlen) {
-			memset(nonce, 0, session->ivlen);
+		uint8_t nonce[session->cipher->iv_length];
+		if (session->cipher->iv_length) {
+			memset(nonce, 0, session->cipher->iv_length);
 			memcpy(nonce, session->common.send_nonce, COMMON_NONCEBYTES);
-			nonce[session->ivlen-1] = 1;
+			nonce[session->cipher->iv_length-1] = 1;
 		}
 
 		ok = session->cipher->crypt(ctx, session->cipher_state, outblocks+1, inblocks, n_blocks*sizeof(fastd_block128_t), nonce);
@@ -263,16 +246,16 @@ static bool method_decrypt(fastd_context_t *ctx, fastd_peer_t *peer, fastd_metho
 	if (!fastd_method_is_nonce_valid(ctx, &session->common, common_nonce, &age))
 		return false;
 
-	uint8_t gmac_nonce[session->gmac_ivlen];
-	memset(gmac_nonce, 0, session->gmac_ivlen);
+	uint8_t gmac_nonce[session->gmac_cipher->iv_length];
+	memset(gmac_nonce, 0, session->gmac_cipher->iv_length);
 	memcpy(gmac_nonce, common_nonce, COMMON_NONCEBYTES);
-	gmac_nonce[session->gmac_ivlen-1] = 1;
+	gmac_nonce[session->gmac_cipher->iv_length-1] = 1;
 
-	uint8_t nonce[session->ivlen];
-	if (session->ivlen) {
-		memset(nonce, 0, session->ivlen);
+	uint8_t nonce[session->cipher->iv_length];
+	if (session->cipher->iv_length) {
+		memset(nonce, 0, session->cipher->iv_length);
 		memcpy(nonce, common_nonce, COMMON_NONCEBYTES);
-		nonce[session->ivlen-1] = 1;
+		nonce[session->cipher->iv_length-1] = 1;
 	}
 
 	fastd_buffer_push_head(ctx, &in, COMMON_HEADBYTES);
@@ -321,10 +304,10 @@ const fastd_method_t fastd_method_generic_gmac = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_head_space,
-	.min_decrypt_head_space = method_min_head_space,
-	.min_encrypt_tail_space = method_min_encrypt_tail_space,
-	.min_decrypt_tail_space = method_min_decrypt_tail_space,
+	.min_encrypt_head_space = 0,
+	.min_decrypt_head_space = 0,
+	.min_encrypt_tail_space = sizeof(fastd_block128_t)-1,
+	.min_decrypt_tail_space = 2*sizeof(fastd_block128_t)-1,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/methods/generic_poly1305/generic_poly1305.c b/src/methods/generic_poly1305/generic_poly1305.c
index fdad118..588e294 100644
--- a/src/methods/generic_poly1305/generic_poly1305.c
+++ b/src/methods/generic_poly1305/generic_poly1305.c
@@ -30,7 +30,7 @@
 #include <crypto_onetimeauth_poly1305.h>
 
 
-#define AUTHBLOCKS (block_count(crypto_onetimeauth_poly1305_KEYBYTES, sizeof(fastd_block128_t)))
+#define AUTHBLOCKS 2
 
 
 struct fastd_method_session_state {
@@ -39,7 +39,6 @@ struct fastd_method_session_state {
 	const fastd_cipher_t *cipher;
 	const fastd_cipher_context_t *cipher_ctx;
 	fastd_cipher_state_t *cipher_state;
-	size_t ivlen;
 };
 
 
@@ -74,26 +73,13 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 	return (fastd_max_packet_size(ctx) + COMMON_HEADBYTES + crypto_onetimeauth_poly1305_BYTES);
 }
 
-static size_t method_min_encrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return AUTHBLOCKS*sizeof(fastd_block128_t);
-}
-
-static size_t method_min_decrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return AUTHBLOCKS*sizeof(fastd_block128_t) - crypto_onetimeauth_poly1305_BYTES;
-}
-
-static size_t method_min_tail_space(fastd_context_t *ctx UNUSED) {
-	return (sizeof(fastd_block128_t)-1);
-}
-
-
 static size_t method_key_length(fastd_context_t *ctx, const char *name) {
 	const fastd_cipher_t *cipher = NULL;
 	const fastd_cipher_context_t *cctx;
 	if (!cipher_get(ctx, name, &cipher, &cctx))
 		exit_bug(ctx, "generic-poly1305: can't get cipher key length");
 
-	return cipher->key_length(ctx, cctx);
+	return cipher->key_length;
 }
 
 static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, const char *name, const uint8_t *secret, bool initiator) {
@@ -106,8 +92,7 @@ static fastd_method_session_state_t* method_session_init(fastd_context_t *ctx, c
 
 	session->cipher_state = session->cipher->init_state(ctx, session->cipher_ctx, secret);
 
-	session->ivlen = session->cipher->iv_length(ctx, session->cipher_state);
-	if (session->ivlen <= COMMON_NONCEBYTES)
+	if (session->cipher->iv_length <= COMMON_NONCEBYTES)
 		exit_bug(ctx, "generic-poly1305: iv_length to small");
 
 	return session;
@@ -146,10 +131,10 @@ static bool method_encrypt(fastd_context_t *ctx, fastd_peer_t *peer UNUSED, fast
 	if (tail_len)
 		memset(in.data+in.len, 0, tail_len);
 
-	uint8_t nonce[session->ivlen];
-	memset(nonce, 0, session->ivlen);
+	uint8_t nonce[session->cipher->iv_length];
+	memset(nonce, 0, session->cipher->iv_length);
 	memcpy(nonce, session->common.send_nonce, COMMON_NONCEBYTES);
-	nonce[session->ivlen-1] = 1;
+	nonce[session->cipher->iv_length-1] = 1;
 
 	int n_blocks = block_count(in.len, sizeof(fastd_block128_t));
 
@@ -193,10 +178,10 @@ static bool method_decrypt(fastd_context_t *ctx, fastd_peer_t *peer, fastd_metho
 	if (((const uint8_t*)in.data)[COMMON_NONCEBYTES]) /* flags */
 		return false;
 
-	uint8_t nonce[session->ivlen];
-	memset(nonce, 0, session->ivlen);
+	uint8_t nonce[session->cipher->iv_length];
+	memset(nonce, 0, session->cipher->iv_length);
 	memcpy(nonce, in.data, COMMON_NONCEBYTES);
-	nonce[session->ivlen-1] = 1;
+	nonce[session->cipher->iv_length-1] = 1;
 
 	int64_t age;
 	if (!fastd_method_is_nonce_valid(ctx, &session->common, nonce, &age))
@@ -255,10 +240,10 @@ const fastd_method_t fastd_method_generic_poly1305 = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_encrypt_head_space,
-	.min_decrypt_head_space = method_min_decrypt_head_space,
-	.min_encrypt_tail_space = method_min_tail_space,
-	.min_decrypt_tail_space = method_min_tail_space,
+	.min_encrypt_head_space = AUTHBLOCKS*sizeof(fastd_block128_t),
+	.min_decrypt_head_space = AUTHBLOCKS*sizeof(fastd_block128_t) - crypto_onetimeauth_poly1305_BYTES,
+	.min_encrypt_tail_space = sizeof(fastd_block128_t)-1,
+	.min_decrypt_tail_space = sizeof(fastd_block128_t)-1,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/methods/null/null.c b/src/methods/null/null.c
index 6874124..1b50cfb 100644
--- a/src/methods/null/null.c
+++ b/src/methods/null/null.c
@@ -41,10 +41,6 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 	return fastd_max_packet_size(ctx);
 }
 
-static size_t method_min_head_tail_space(fastd_context_t *ctx UNUSED) {
-	return 0;
-}
-
 static size_t method_key_length(fastd_context_t *ctx UNUSED, const char *name UNUSED) {
 	return 0;
 }
@@ -91,10 +87,10 @@ const fastd_method_t fastd_method_null = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_head_tail_space,
-	.min_decrypt_head_space = method_min_head_tail_space,
-	.min_encrypt_tail_space = method_min_head_tail_space,
-	.min_decrypt_tail_space = method_min_head_tail_space,
+	.min_encrypt_head_space = 0,
+	.min_decrypt_head_space = 0,
+	.min_encrypt_tail_space = 0,
+	.min_decrypt_tail_space = 0,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/methods/xsalsa20_poly1305/xsalsa20_poly1305.c b/src/methods/xsalsa20_poly1305/xsalsa20_poly1305.c
index 01c623a..f55db76 100644
--- a/src/methods/xsalsa20_poly1305/xsalsa20_poly1305.c
+++ b/src/methods/xsalsa20_poly1305/xsalsa20_poly1305.c
@@ -45,18 +45,6 @@ static size_t method_max_packet_size(fastd_context_t *ctx) {
 	return (fastd_max_packet_size(ctx) + COMMON_HEADBYTES + crypto_secretbox_xsalsa20poly1305_ZEROBYTES - crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES);
 }
 
-static size_t method_min_encrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return crypto_secretbox_xsalsa20poly1305_ZEROBYTES;
-}
-
-static size_t method_min_decrypt_head_space(fastd_context_t *ctx UNUSED) {
-	return (crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES - COMMON_HEADBYTES);
-}
-
-static size_t method_min_tail_space(fastd_context_t *ctx UNUSED) {
-	return 0;
-}
-
 
 static size_t method_key_length(fastd_context_t *ctx UNUSED, const char *name UNUSED) {
 	return crypto_secretbox_xsalsa20poly1305_KEYBYTES;
@@ -173,10 +161,10 @@ const fastd_method_t fastd_method_xsalsa20_poly1305 = {
 	.provides = method_provides,
 
 	.max_packet_size = method_max_packet_size,
-	.min_encrypt_head_space = method_min_encrypt_head_space,
-	.min_decrypt_head_space = method_min_decrypt_head_space,
-	.min_encrypt_tail_space = method_min_tail_space,
-	.min_decrypt_tail_space = method_min_tail_space,
+	.min_encrypt_head_space = crypto_secretbox_xsalsa20poly1305_ZEROBYTES,
+	.min_decrypt_head_space = crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES - COMMON_HEADBYTES,
+	.min_encrypt_tail_space = 0,
+	.min_decrypt_tail_space = 0,
 
 	.key_length = method_key_length,
 	.session_init = method_session_init,
diff --git a/src/protocols/ec25519_fhmqvc/ec25519_fhmqvc.c b/src/protocols/ec25519_fhmqvc/ec25519_fhmqvc.c
index 8b79d64..0b3b049 100644
--- a/src/protocols/ec25519_fhmqvc/ec25519_fhmqvc.c
+++ b/src/protocols/ec25519_fhmqvc/ec25519_fhmqvc.c
@@ -180,7 +180,7 @@ static void protocol_send(fastd_context_t *ctx, fastd_peer_t *peer, fastd_buffer
 }
 
 void fastd_protocol_ec25519_fhmqvc_send_empty(fastd_context_t *ctx, fastd_peer_t *peer, protocol_session_t *session) {
-	session_send(ctx, peer, fastd_buffer_alloc(ctx, 0, alignto(session->method->min_encrypt_head_space(ctx), 8), session->method->min_encrypt_tail_space(ctx)), session);
+	session_send(ctx, peer, fastd_buffer_alloc(ctx, 0, alignto(session->method->min_encrypt_head_space, 8), session->method->min_encrypt_tail_space), session);
 }
 
 const fastd_protocol_t fastd_protocol_ec25519_fhmqvc = {