[lkml]   [2014]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subjectcrypto: zeroization of sensitive data in af_alg
Hi Herbert,

while working on the AF_ALG interface, I saw no active zeroizations of memory
that may hold sensitive data that is maintained outside the kernel crypto API
cipher handles. I think the following memory segments fall under that

* message digest

* IV

* plaintext / ciphertext handed in by consumer

* ciphertext / plaintext that is send back to the consumer

May I ask whether such zeroizations are present? At least I did not find it.
If we conclude that there is a need for adding such zeroizations, I checked
the code for the appropriate locations:

I think I found the location for the first one: hash_sock_destruct that should
be enhanced with a memset(0) of ctx->result. I have a patch ready which is
tested and works.

For the IV, I think I found the spot as well: skcipher_sock_destruct. This
function should be enhanced with a memset(0) of ctx->iv. Again, I have a patch
ready which is tested and works.

However, I am failing to find the right spot to add a zeroization for the
latter one, i.e. the code that handles the pages send in by the user or the
pages that are returned by the crypto API. Initially I thought
skcipher_pull_sgl is a good spot for the symmetric ciphers as it evicts the
used pages out of the scope of the kernel crypto API. I added a
clear_page(sg_page(sg+1)) as well as memset(sg_page(sg+1), 0, plen) right
before the put_page call. All that I got in return was a BUG() from the memory
management layer.

Then I tried the same in af_alg_free_sg() as this function is used by
algif_hash.c -- with the same result.

That makes me wonder: where should such a zeroization call be added?



 \ /
  Last update: 2014-11-10 09:21    [W:0.071 / U:5.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site