lkml.org 
[lkml]   [2016]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 1/3] random: replace non-blocking pool with a Chacha20-based CRNG
    Date
    Am Dienstag, 3. Mai 2016, 11:36:12 schrieb Stephan Mueller:

    Hi Ted,

    > > +
    > > +static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
    > > +{
    > > + ssize_t ret = 0, i;
    > > + __u8 tmp[CHACHA20_BLOCK_SIZE];
    > > + int large_request = (nbytes > 256);
    > > +
    > > + while (nbytes) {
    > > + if (large_request && need_resched()) {
    > > + if (signal_pending(current)) {
    > > + if (ret == 0)
    > > + ret = -ERESTARTSYS;
    > > + break;
    > > + }
    > > + schedule();
    > > + }
    > > +
    > > + extract_crng(tmp);
    > > + i = min_t(int, nbytes, CHACHA20_BLOCK_SIZE);
    > > + if (copy_to_user(buf, tmp, i)) {
    > > + ret = -EFAULT;
    > > + break;
    > > + }
    > > +
    > > + nbytes -= i;
    > > + buf += i;
    > > + ret += i;
    > > + }
    > > +
    > > + /* Wipe data just written to memory */
    > > + memzero_explicit(tmp, sizeof(tmp));
    >
    > Would it make sense to add another chacha20_block() call here at the end?
    > Note, the one thing about the SP800-90A DRBG I really like is the enhanced
    > backward secrecy support which is implemented by "updating" the internal
    > state (the key / state) used for one or more random number generation
    > rounds after one request for random numbers is satisfied.
    >
    > This means that even if the state becomes known or the subsequent caller
    > manages to deduce the state of the RNG to some degree of confidence, he
    > cannot backtrack the already generated random numbers.
    >
    > I see that the ChaCha20 RNG implicitly updates its state while it operates.
    > But for the last round of the RNG, there is no more shuffling of the
    > internal state. As one round is 64 bytes in size and many callers just want
    > 16 or 32 bytes (as seen during testing), a lot of callers trigger only one
    > round of the RNG.

    After doing some performance tests, I see that we reach a performance of north
    of 200 MB/s on my system (compare that to 12 MB/s for the SHA-1 version).

    Thus, I would assume adding another call to chacha20_block should not hurt.

    Ciao
    Stephan

    \
     
     \ /
      Last update: 2016-05-04 08:41    [W:3.562 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site