lkml.org 
[lkml]   [2022]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 187/237] crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
    Date
    From: Nicolai Stange <nstange@suse.de>

    commit 2bcd25443868aa8863779a6ebc6c9319633025d2 upstream.

    Currently, the DRBG implementation schedules asynchronous works from
    random_ready_callbacks for reseeding the DRBG instances with output from
    get_random_bytes() once the latter has sufficient entropy available.

    However, as the get_random_bytes() initialization state can get queried by
    means of rng_is_initialized() now, there is no real need for this
    asynchronous reseeding logic anymore and it's better to keep things simple
    by doing it synchronously when needed instead, i.e. from drbg_generate()
    once rng_is_initialized() has flipped to true.

    Of course, for this to work, drbg_generate() would need some means by which
    it can tell whether or not rng_is_initialized() has flipped to true since
    the last seeding from get_random_bytes(). Or equivalently, whether or not
    the last seed from get_random_bytes() has happened when
    rng_is_initialized() was still evaluating to false.

    As it currently stands, enum drbg_seed_state allows for the representation
    of two different DRBG seeding states: DRBG_SEED_STATE_UNSEEDED and
    DRBG_SEED_STATE_FULL. The former makes drbg_generate() to invoke a full
    reseeding operation involving both, the rather expensive jitterentropy as
    well as the get_random_bytes() randomness sources. The DRBG_SEED_STATE_FULL
    state on the other hand implies that no reseeding at all is required for a
    !->pr DRBG variant.

    Introduce the new DRBG_SEED_STATE_PARTIAL state to enum drbg_seed_state for
    representing the condition that a DRBG was being seeded when
    rng_is_initialized() had still been false. In particular, this new state
    implies that
    - the given DRBG instance has been fully seeded from the jitterentropy
    source (if enabled)
    - and drbg_generate() is supposed to reseed from get_random_bytes()
    *only* once rng_is_initialized() turns to true.

    Up to now, the __drbg_seed() helper used to set the given DRBG instance's
    ->seeded state to constant DRBG_SEED_STATE_FULL. Introduce a new argument
    allowing for the specification of the to be written ->seeded value instead.
    Make the first of its two callers, drbg_seed(), determine the appropriate
    value based on rng_is_initialized(). The remaining caller,
    drbg_async_seed(), is known to get invoked only once rng_is_initialized()
    is true, hence let it pass constant DRBG_SEED_STATE_FULL for the new
    argument to __drbg_seed().

    There is no change in behaviour, except for that the pr_devel() in
    drbg_generate() would now report "unseeded" for ->pr DRBG instances which
    had last been seeded when rng_is_initialized() was still evaluating to
    false.

    Signed-off-by: Nicolai Stange <nstange@suse.de>
    Reviewed-by: Stephan Müller <smueller@chronox.de>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    crypto/drbg.c | 12 ++++++++----
    include/crypto/drbg.h | 1 +
    2 files changed, 9 insertions(+), 4 deletions(-)

    --- a/crypto/drbg.c
    +++ b/crypto/drbg.c
    @@ -1037,14 +1037,14 @@ static const struct drbg_state_ops drbg_
    ******************************************************************/

    static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
    - int reseed)
    + int reseed, enum drbg_seed_state new_seed_state)
    {
    int ret = drbg->d_ops->update(drbg, seed, reseed);

    if (ret)
    return ret;

    - drbg->seeded = DRBG_SEED_STATE_FULL;
    + drbg->seeded = new_seed_state;
    /* 10.1.1.2 / 10.1.1.3 step 5 */
    drbg->reseed_ctr = 1;

    @@ -1094,7 +1094,7 @@ static void drbg_async_seed(struct work_
    */
    drbg->seeded = DRBG_SEED_STATE_UNSEEDED;

    - __drbg_seed(drbg, &seedlist, true);
    + __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);

    if (drbg->seeded == DRBG_SEED_STATE_FULL)
    drbg->reseed_threshold = drbg_max_requests(drbg);
    @@ -1124,6 +1124,7 @@ static int drbg_seed(struct drbg_state *
    unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
    struct drbg_string data1;
    LIST_HEAD(seedlist);
    + enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;

    /* 9.1 / 9.2 / 9.3.1 step 3 */
    if (pers && pers->len > (drbg_max_addtl(drbg))) {
    @@ -1151,6 +1152,9 @@ static int drbg_seed(struct drbg_state *
    BUG_ON((entropylen * 2) > sizeof(entropy));

    /* Get seed from in-kernel /dev/urandom */
    + if (!rng_is_initialized())
    + new_seed_state = DRBG_SEED_STATE_PARTIAL;
    +
    ret = drbg_get_random_bytes(drbg, entropy, entropylen);
    if (ret)
    goto out;
    @@ -1207,7 +1211,7 @@ static int drbg_seed(struct drbg_state *
    memset(drbg->C, 0, drbg_statelen(drbg));
    }

    - ret = __drbg_seed(drbg, &seedlist, reseed);
    + ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);

    out:
    memzero_explicit(entropy, entropylen * 2);
    --- a/include/crypto/drbg.h
    +++ b/include/crypto/drbg.h
    @@ -107,6 +107,7 @@ struct drbg_test_data {

    enum drbg_seed_state {
    DRBG_SEED_STATE_UNSEEDED,
    + DRBG_SEED_STATE_PARTIAL, /* Seeded with !rng_is_initialized() */
    DRBG_SEED_STATE_FULL,
    };


    \
     
     \ /
      Last update: 2022-06-23 19:46    [W:4.225 / U:0.432 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site