prng.c (e82a82c19f4272ea5437cc76e5711b98e2ee6223) prng.c (0177db01adf26cf9c5dfe1feaf17087de4b9e40e)
1/*
2 * Copyright IBM Corp. 2006, 2015
3 * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
4 * Harald Freudenberger <freude@de.ibm.com>
5 * Driver for the s390 pseudo random number generator
6 */
7
8#define KMSG_COMPONENT "prng"

--- 121 unchanged lines hidden (view full) ---

130 *p ^= get_tod_clock_fast();
131 }
132 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
133 if (n < sizeof(hash))
134 h = hash;
135 else
136 h = ebuf;
137 /* generate sha256 from this page */
1/*
2 * Copyright IBM Corp. 2006, 2015
3 * Author(s): Jan Glauber <jan.glauber@de.ibm.com>
4 * Harald Freudenberger <freude@de.ibm.com>
5 * Driver for the s390 pseudo random number generator
6 */
7
8#define KMSG_COMPONENT "prng"

--- 121 unchanged lines hidden (view full) ---

130 *p ^= get_tod_clock_fast();
131 }
132 n = (nbytes < sizeof(hash)) ? nbytes : sizeof(hash);
133 if (n < sizeof(hash))
134 h = hash;
135 else
136 h = ebuf;
137 /* generate sha256 from this page */
138 if (cpacf_kimd(CPACF_KIMD_SHA_256, h,
139 pg, PAGE_SIZE) != PAGE_SIZE) {
140 prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
141 ret = -EIO;
142 goto out;
143 }
138 cpacf_kimd(CPACF_KIMD_SHA_256, h, pg, PAGE_SIZE);
144 if (n < sizeof(hash))
145 memcpy(ebuf, hash, n);
146 ret += n;
147 ebuf += n;
148 nbytes -= n;
149 }
150
139 if (n < sizeof(hash))
140 memcpy(ebuf, hash, n);
141 ret += n;
142 ebuf += n;
143 nbytes -= n;
144 }
145
151out:
152 free_page((unsigned long)pg);
153 return ret;
154}
155
156
157/*** tdes functions ***/
158
159static void prng_tdes_add_entropy(void)
160{
161 __u64 entropy[4];
162 unsigned int i;
146 free_page((unsigned long)pg);
147 return ret;
148}
149
150
151/*** tdes functions ***/
152
153static void prng_tdes_add_entropy(void)
154{
155 __u64 entropy[4];
156 unsigned int i;
163 int ret;
164
165 for (i = 0; i < 16; i++) {
157
158 for (i = 0; i < 16; i++) {
166 ret = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
167 (char *)entropy, (char *)entropy,
168 sizeof(entropy));
169 BUG_ON(ret < 0 || ret != sizeof(entropy));
159 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
160 (char *) entropy, (char *) entropy,
161 sizeof(entropy));
170 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
171 }
172}
173
174
175static void prng_tdes_seed(int nbytes)
176{
177 char buf[16];

--- 120 unchanged lines hidden (view full) ---

298 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
299 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
300 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
301 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
302 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
303 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
304 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
305
162 memcpy(prng_data->prngws.parm_block, entropy, sizeof(entropy));
163 }
164}
165
166
167static void prng_tdes_seed(int nbytes)
168{
169 char buf[16];

--- 120 unchanged lines hidden (view full) ---

290 0x19, 0x14, 0x09, 0xf9, 0x2f, 0x39, 0xb3, 0x67,
291 0x0d, 0x8d, 0xbf, 0xb6, 0x35, 0xd8, 0xe6, 0xa3,
292 0x69, 0x32, 0xd8, 0x10, 0x33, 0xd1, 0x44, 0x8d,
293 0x63, 0xb4, 0x03, 0xdd, 0xf8, 0x8e, 0x12, 0x1b,
294 0x6e, 0x81, 0x9a, 0xc3, 0x81, 0x22, 0x6c, 0x13,
295 0x21, 0xe4, 0xb0, 0x86, 0x44, 0xf6, 0x72, 0x7c,
296 0x36, 0x8c, 0x5a, 0x9f, 0x7a, 0x4b, 0x3e, 0xe2 };
297
306 int ret = 0;
307 u8 buf[sizeof(random)];
308 struct ppno_ws_s ws;
309
310 memset(&ws, 0, sizeof(ws));
311
312 /* initial seed */
298 u8 buf[sizeof(random)];
299 struct ppno_ws_s ws;
300
301 memset(&ws, 0, sizeof(ws));
302
303 /* initial seed */
313 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, &ws, NULL, 0,
314 seed, sizeof(seed));
315 if (ret < 0) {
316 pr_err("The prng self test seed operation for the "
317 "SHA-512 mode failed with rc=%d\n", ret);
318 prng_errorflag = PRNG_SELFTEST_FAILED;
319 return -EIO;
320 }
304 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
305 &ws, NULL, 0, seed, sizeof(seed));
321
322 /* check working states V and C */
323 if (memcmp(ws.V, V0, sizeof(V0)) != 0
324 || memcmp(ws.C, C0, sizeof(C0)) != 0) {
325 pr_err("The prng self test state test "
326 "for the SHA-512 mode failed\n");
327 prng_errorflag = PRNG_SELFTEST_FAILED;
328 return -EIO;
329 }
330
331 /* generate random bytes */
306
307 /* check working states V and C */
308 if (memcmp(ws.V, V0, sizeof(V0)) != 0
309 || memcmp(ws.C, C0, sizeof(C0)) != 0) {
310 pr_err("The prng self test state test "
311 "for the SHA-512 mode failed\n");
312 prng_errorflag = PRNG_SELFTEST_FAILED;
313 return -EIO;
314 }
315
316 /* generate random bytes */
332 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
333 &ws, buf, sizeof(buf), NULL, 0);
334 if (ret < 0) {
335 pr_err("The prng self test generate operation for "
336 "the SHA-512 mode failed with rc=%d\n", ret);
337 prng_errorflag = PRNG_SELFTEST_FAILED;
338 return -EIO;
339 }
340 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
341 &ws, buf, sizeof(buf), NULL, 0);
342 if (ret < 0) {
343 pr_err("The prng self test generate operation for "
344 "the SHA-512 mode failed with rc=%d\n", ret);
345 prng_errorflag = PRNG_SELFTEST_FAILED;
346 return -EIO;
347 }
317 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
318 &ws, buf, sizeof(buf), NULL, 0);
319 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
320 &ws, buf, sizeof(buf), NULL, 0);
348
349 /* check against expected data */
350 if (memcmp(buf, random, sizeof(random)) != 0) {
351 pr_err("The prng self test data test "
352 "for the SHA-512 mode failed\n");
353 prng_errorflag = PRNG_SELFTEST_FAILED;
354 return -EIO;
355 }

--- 31 unchanged lines hidden (view full) ---

387 /* generate initial seed bytestring, first 48 bytes of entropy */
388 ret = generate_entropy(seed, 48);
389 if (ret != 48)
390 goto outfree;
391 /* followed by 16 bytes of unique nonce */
392 get_tod_clock_ext(seed + 48);
393
394 /* initial seed of the ppno drng */
321
322 /* check against expected data */
323 if (memcmp(buf, random, sizeof(random)) != 0) {
324 pr_err("The prng self test data test "
325 "for the SHA-512 mode failed\n");
326 prng_errorflag = PRNG_SELFTEST_FAILED;
327 return -EIO;
328 }

--- 31 unchanged lines hidden (view full) ---

360 /* generate initial seed bytestring, first 48 bytes of entropy */
361 ret = generate_entropy(seed, 48);
362 if (ret != 48)
363 goto outfree;
364 /* followed by 16 bytes of unique nonce */
365 get_tod_clock_ext(seed + 48);
366
367 /* initial seed of the ppno drng */
395 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
396 &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
397 if (ret < 0) {
398 prng_errorflag = PRNG_SEED_FAILED;
399 ret = -EIO;
400 goto outfree;
401 }
368 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
369 &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
402
403 /* if fips mode is enabled, generate a first block of random
404 bytes for the FIPS 140-2 Conditional Self Test */
405 if (fips_enabled) {
406 prng_data->prev = prng_data->buf + prng_chunk_size;
370
371 /* if fips mode is enabled, generate a first block of random
372 bytes for the FIPS 140-2 Conditional Self Test */
373 if (fips_enabled) {
374 prng_data->prev = prng_data->buf + prng_chunk_size;
407 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
408 &prng_data->ppnows,
409 prng_data->prev, prng_chunk_size, NULL, 0);
410 if (ret < 0 || ret != prng_chunk_size) {
411 prng_errorflag = PRNG_GEN_FAILED;
412 ret = -EIO;
413 goto outfree;
414 }
375 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
376 &prng_data->ppnows,
377 prng_data->prev, prng_chunk_size, NULL, 0);
415 }
416
417 return 0;
418
419outfree:
420 kfree(prng_data);
421 return ret;
422}

--- 12 unchanged lines hidden (view full) ---

435 u8 seed[32];
436
437 /* generate 32 bytes of fresh entropy */
438 ret = generate_entropy(seed, sizeof(seed));
439 if (ret != sizeof(seed))
440 return ret;
441
442 /* do a reseed of the ppno drng with this bytestring */
378 }
379
380 return 0;
381
382outfree:
383 kfree(prng_data);
384 return ret;
385}

--- 12 unchanged lines hidden (view full) ---

398 u8 seed[32];
399
400 /* generate 32 bytes of fresh entropy */
401 ret = generate_entropy(seed, sizeof(seed));
402 if (ret != sizeof(seed))
403 return ret;
404
405 /* do a reseed of the ppno drng with this bytestring */
443 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
444 &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
445 if (ret) {
446 prng_errorflag = PRNG_RESEED_FAILED;
447 return -EIO;
448 }
406 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
407 &prng_data->ppnows, NULL, 0, seed, sizeof(seed));
449
450 return 0;
451}
452
453
454static int prng_sha512_generate(u8 *buf, size_t nbytes)
455{
456 int ret;
457
458 /* reseed needed ? */
459 if (prng_data->ppnows.reseed_counter > prng_reseed_limit) {
460 ret = prng_sha512_reseed();
461 if (ret)
462 return ret;
463 }
464
465 /* PPNO generate */
408
409 return 0;
410}
411
412
413static int prng_sha512_generate(u8 *buf, size_t nbytes)
414{
415 int ret;
416
417 /* reseed needed ? */
418 if (prng_data->ppnows.reseed_counter > prng_reseed_limit) {
419 ret = prng_sha512_reseed();
420 if (ret)
421 return ret;
422 }
423
424 /* PPNO generate */
466 ret = cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
467 &prng_data->ppnows, buf, nbytes, NULL, 0);
468 if (ret < 0 || ret != nbytes) {
469 prng_errorflag = PRNG_GEN_FAILED;
470 return -EIO;
471 }
425 cpacf_ppno(CPACF_PPNO_SHA512_DRNG_GEN,
426 &prng_data->ppnows, buf, nbytes, NULL, 0);
472
473 /* FIPS 140-2 Conditional Self Test */
474 if (fips_enabled) {
475 if (!memcmp(prng_data->prev, buf, nbytes)) {
476 prng_errorflag = PRNG_GEN_FAILED;
477 return -EILSEQ;
478 }
479 memcpy(prng_data->prev, buf, nbytes);

--- 9 unchanged lines hidden (view full) ---

489{
490 return nonseekable_open(inode, file);
491}
492
493
494static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
495 size_t nbytes, loff_t *ppos)
496{
427
428 /* FIPS 140-2 Conditional Self Test */
429 if (fips_enabled) {
430 if (!memcmp(prng_data->prev, buf, nbytes)) {
431 prng_errorflag = PRNG_GEN_FAILED;
432 return -EILSEQ;
433 }
434 memcpy(prng_data->prev, buf, nbytes);

--- 9 unchanged lines hidden (view full) ---

444{
445 return nonseekable_open(inode, file);
446}
447
448
449static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
450 size_t nbytes, loff_t *ppos)
451{
497 int chunk, n, tmp, ret = 0;
452 int chunk, n, ret = 0;
498
499 /* lock prng_data struct */
500 if (mutex_lock_interruptible(&prng_data->mutex))
501 return -ERESTARTSYS;
502
503 while (nbytes) {
504 if (need_resched()) {
505 if (signal_pending(current)) {

--- 34 unchanged lines hidden (view full) ---

540 * buffer with timestamps does not improve security, since
541 * successive stckf have nearly constant offsets.
542 * If an attacker knows the first timestamp it would be
543 * trivial to guess the additional values. One timestamp
544 * is therefore enough and still guarantees unique input values.
545 *
546 * Note: you can still get strict X9.17 conformity by setting
547 * prng_chunk_size to 8 bytes.
453
454 /* lock prng_data struct */
455 if (mutex_lock_interruptible(&prng_data->mutex))
456 return -ERESTARTSYS;
457
458 while (nbytes) {
459 if (need_resched()) {
460 if (signal_pending(current)) {

--- 34 unchanged lines hidden (view full) ---

495 * buffer with timestamps does not improve security, since
496 * successive stckf have nearly constant offsets.
497 * If an attacker knows the first timestamp it would be
498 * trivial to guess the additional values. One timestamp
499 * is therefore enough and still guarantees unique input values.
500 *
501 * Note: you can still get strict X9.17 conformity by setting
502 * prng_chunk_size to 8 bytes.
548 */
549 tmp = cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
550 prng_data->buf, prng_data->buf, n);
551 if (tmp < 0 || tmp != n) {
552 ret = -EIO;
553 break;
554 }
503 */
504 cpacf_kmc(CPACF_KMC_PRNG, prng_data->prngws.parm_block,
505 prng_data->buf, prng_data->buf, n);
555
556 prng_data->prngws.byte_counter += n;
557 prng_data->prngws.reseed_counter += n;
558
559 if (copy_to_user(ubuf, prng_data->buf, chunk))
560 return -EFAULT;
561
562 nbytes -= chunk;

--- 349 unchanged lines hidden --- 		506
507 prng_data->prngws.byte_counter += n;
508 prng_data->prngws.reseed_counter += n;
509
510 if (copy_to_user(ubuf, prng_data->buf, chunk))
511 return -EFAULT;
512
513 nbytes -= chunk;

--- 349 unchanged lines hidden ---