lkml.org 
[lkml]   [2019]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    SubjectRe: [PATCH] KEYS: asym_tpm: Switch to get_random_bytes()
    On Thu, 17 Oct 2019 at 00:40, James Bottomley
    <James.Bottomley@hansenpartnership.com> wrote:
    >
    > On Wed, 2019-10-16 at 19:25 +0300, Jarkko Sakkinen wrote:
    > > On Wed, Oct 16, 2019 at 08:34:12AM -0400, James Bottomley wrote:
    > > > reversible ciphers are generally frowned upon in random number
    > > > generation, that's why the krng uses chacha20. In general I think
    > > > we shouldn't try to code our own mixing and instead should get the
    > > > krng to do it for us using whatever the algorithm du jour that the
    > > > crypto guys have blessed is. That's why I proposed adding the TPM
    > > > output to the krng as entropy input and then taking the output of
    > > > the krng.
    > >
    > > It is already registered as hwrng. What else?
    >
    > It only contributes entropy once at start of OS.
    >

    Why not just configure quality parameter of TPM hwrng as follows? It
    would automatically initiate a kthread during hwrng_init() to feed
    entropy from TPM to kernel random numbers pool (see:
    drivers/char/hw_random/core.c +142).

    diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
    index 3d6d394..fcc3817 100644
    --- a/drivers/char/tpm/tpm-chip.c
    +++ b/drivers/char/tpm/tpm-chip.c
    @@ -548,6 +548,7 @@ static int tpm_add_hwrng(struct tpm_chip *chip)
    "tpm-rng-%d", chip->dev_num);
    chip->hwrng.name = chip->hwrng_name;
    chip->hwrng.read = tpm_hwrng_read;
    + chip->hwrng.quality = 1024; /* Here we assume TPM provides
    full entropy */
    return hwrng_register(&chip->hwrng);

    }
    > > Was the issue that it is only used as seed when the rng is init'd
    > > first? I haven't at this point gone to the internals of krng.
    >
    > Basically it was similar to your xor patch except I got the kernel rng
    > to do the mixing, so it would use the chacha20 cipher at the moment
    > until they decide that's unsafe and change it to something else:
    >
    > https://lore.kernel.org/linux-crypto/1570227068.17537.4.camel@HansenPartnership.com/
    >
    > It uses add_hwgenerator_randomness() to do the mixing. It also has an
    > unmixed source so that read of the TPM hwrng device works as expected.

    Above suggestion is something similar to yours but utilizing the
    framework already provided via hwrng core.

    -Sumit

    >
    > James
    >
    >
    >
    >
    >

    \
     
     \ /
      Last update: 2019-10-17 14:53    [W:4.227 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site