1 /* 2 * DRBG: Deterministic Random Bits Generator 3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following 4 * properties: 5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores 6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 8 * * with and without prediction resistance 9 * 10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, and the entire permission notice in its entirety, 17 * including the disclaimer of warranties. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. The name of the author may not be used to endorse or promote 22 * products derived from this software without specific prior 23 * written permission. 24 * 25 * ALTERNATIVELY, this product may be distributed under the terms of 26 * the GNU General Public License, in which case the provisions of the GPL are 27 * required INSTEAD OF the above restrictions. (This clause is 28 * necessary due to a potential bad interaction between the GPL and 29 * the restrictions contained in a BSD-style copyright.) 30 * 31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 42 * DAMAGE. 43 * 44 * DRBG Usage 45 * ========== 46 * The SP 800-90A DRBG allows the user to specify a personalization string 47 * for initialization as well as an additional information string for each 48 * random number request. The following code fragments show how a caller 49 * uses the kernel crypto API to use the full functionality of the DRBG. 50 * 51 * Usage without any additional data 52 * --------------------------------- 53 * struct crypto_rng *drng; 54 * int err; 55 * char data[DATALEN]; 56 * 57 * drng = crypto_alloc_rng(drng_name, 0, 0); 58 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 59 * crypto_free_rng(drng); 60 * 61 * 62 * Usage with personalization string during initialization 63 * ------------------------------------------------------- 64 * struct crypto_rng *drng; 65 * int err; 66 * char data[DATALEN]; 67 * struct drbg_string pers; 68 * char personalization[11] = "some-string"; 69 * 70 * drbg_string_fill(&pers, personalization, strlen(personalization)); 71 * drng = crypto_alloc_rng(drng_name, 0, 0); 72 * // The reset completely re-initializes the DRBG with the provided 73 * // personalization string 74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization)); 75 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 76 * crypto_free_rng(drng); 77 * 78 * 79 * Usage with additional information string during random number request 80 * --------------------------------------------------------------------- 81 * struct crypto_rng *drng; 82 * int err; 83 * char data[DATALEN]; 84 * char addtl_string[11] = "some-string"; 85 * string drbg_string addtl; 86 * 87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string)); 88 * drng = crypto_alloc_rng(drng_name, 0, 0); 89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns 90 * // the same error codes. 91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl); 92 * crypto_free_rng(drng); 93 * 94 * 95 * Usage with personalization and additional information strings 96 * ------------------------------------------------------------- 97 * Just mix both scenarios above. 98 */ 99 100 #include <crypto/drbg.h> 101 #include <linux/kernel.h> 102 103 /*************************************************************** 104 * Backend cipher definitions available to DRBG 105 ***************************************************************/ 106 107 /* 108 * The order of the DRBG definitions here matter: every DRBG is registered 109 * as stdrng. Each DRBG receives an increasing cra_priority values the later 110 * they are defined in this array (see drbg_fill_array). 111 * 112 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and 113 * the SHA256 / AES 256 over other ciphers. Thus, the favored 114 * DRBGs are the latest entries in this array. 115 */ 116 static const struct drbg_core drbg_cores[] = { 117 #ifdef CONFIG_CRYPTO_DRBG_CTR 118 { 119 .flags = DRBG_CTR | DRBG_STRENGTH128, 120 .statelen = 32, /* 256 bits as defined in 10.2.1 */ 121 .blocklen_bytes = 16, 122 .cra_name = "ctr_aes128", 123 .backend_cra_name = "aes", 124 }, { 125 .flags = DRBG_CTR | DRBG_STRENGTH192, 126 .statelen = 40, /* 320 bits as defined in 10.2.1 */ 127 .blocklen_bytes = 16, 128 .cra_name = "ctr_aes192", 129 .backend_cra_name = "aes", 130 }, { 131 .flags = DRBG_CTR | DRBG_STRENGTH256, 132 .statelen = 48, /* 384 bits as defined in 10.2.1 */ 133 .blocklen_bytes = 16, 134 .cra_name = "ctr_aes256", 135 .backend_cra_name = "aes", 136 }, 137 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 138 #ifdef CONFIG_CRYPTO_DRBG_HASH 139 { 140 .flags = DRBG_HASH | DRBG_STRENGTH128, 141 .statelen = 55, /* 440 bits */ 142 .blocklen_bytes = 20, 143 .cra_name = "sha1", 144 .backend_cra_name = "sha1", 145 }, { 146 .flags = DRBG_HASH | DRBG_STRENGTH256, 147 .statelen = 111, /* 888 bits */ 148 .blocklen_bytes = 48, 149 .cra_name = "sha384", 150 .backend_cra_name = "sha384", 151 }, { 152 .flags = DRBG_HASH | DRBG_STRENGTH256, 153 .statelen = 111, /* 888 bits */ 154 .blocklen_bytes = 64, 155 .cra_name = "sha512", 156 .backend_cra_name = "sha512", 157 }, { 158 .flags = DRBG_HASH | DRBG_STRENGTH256, 159 .statelen = 55, /* 440 bits */ 160 .blocklen_bytes = 32, 161 .cra_name = "sha256", 162 .backend_cra_name = "sha256", 163 }, 164 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 165 #ifdef CONFIG_CRYPTO_DRBG_HMAC 166 { 167 .flags = DRBG_HMAC | DRBG_STRENGTH128, 168 .statelen = 20, /* block length of cipher */ 169 .blocklen_bytes = 20, 170 .cra_name = "hmac_sha1", 171 .backend_cra_name = "hmac(sha1)", 172 }, { 173 .flags = DRBG_HMAC | DRBG_STRENGTH256, 174 .statelen = 48, /* block length of cipher */ 175 .blocklen_bytes = 48, 176 .cra_name = "hmac_sha384", 177 .backend_cra_name = "hmac(sha384)", 178 }, { 179 .flags = DRBG_HMAC | DRBG_STRENGTH256, 180 .statelen = 64, /* block length of cipher */ 181 .blocklen_bytes = 64, 182 .cra_name = "hmac_sha512", 183 .backend_cra_name = "hmac(sha512)", 184 }, { 185 .flags = DRBG_HMAC | DRBG_STRENGTH256, 186 .statelen = 32, /* block length of cipher */ 187 .blocklen_bytes = 32, 188 .cra_name = "hmac_sha256", 189 .backend_cra_name = "hmac(sha256)", 190 }, 191 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 192 }; 193 194 static int drbg_uninstantiate(struct drbg_state *drbg); 195 196 /****************************************************************** 197 * Generic helper functions 198 ******************************************************************/ 199 200 /* 201 * Return strength of DRBG according to SP800-90A section 8.4 202 * 203 * @flags DRBG flags reference 204 * 205 * Return: normalized strength in *bytes* value or 32 as default 206 * to counter programming errors 207 */ 208 static inline unsigned short drbg_sec_strength(drbg_flag_t flags) 209 { 210 switch (flags & DRBG_STRENGTH_MASK) { 211 case DRBG_STRENGTH128: 212 return 16; 213 case DRBG_STRENGTH192: 214 return 24; 215 case DRBG_STRENGTH256: 216 return 32; 217 default: 218 return 32; 219 } 220 } 221 222 /* 223 * Convert an integer into a byte representation of this integer. 224 * The byte representation is big-endian 225 * 226 * @val value to be converted 227 * @buf buffer holding the converted integer -- caller must ensure that 228 * buffer size is at least 32 bit 229 */ 230 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR)) 231 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf) 232 { 233 struct s { 234 __be32 conv; 235 }; 236 struct s *conversion = (struct s *) buf; 237 238 conversion->conv = cpu_to_be32(val); 239 } 240 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */ 241 242 /****************************************************************** 243 * CTR DRBG callback functions 244 ******************************************************************/ 245 246 #ifdef CONFIG_CRYPTO_DRBG_CTR 247 #define CRYPTO_DRBG_CTR_STRING "CTR " 248 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256"); 249 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256"); 250 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192"); 251 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192"); 252 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128"); 253 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128"); 254 255 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 256 const unsigned char *key); 257 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 258 const struct drbg_string *in); 259 static int drbg_init_sym_kernel(struct drbg_state *drbg); 260 static int drbg_fini_sym_kernel(struct drbg_state *drbg); 261 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 262 u8 *inbuf, u32 inbuflen, 263 u8 *outbuf, u32 outlen); 264 #define DRBG_CTR_NULL_LEN 128 265 266 /* BCC function for CTR DRBG as defined in 10.4.3 */ 267 static int drbg_ctr_bcc(struct drbg_state *drbg, 268 unsigned char *out, const unsigned char *key, 269 struct list_head *in) 270 { 271 int ret = 0; 272 struct drbg_string *curr = NULL; 273 struct drbg_string data; 274 short cnt = 0; 275 276 drbg_string_fill(&data, out, drbg_blocklen(drbg)); 277 278 /* 10.4.3 step 2 / 4 */ 279 drbg_kcapi_symsetkey(drbg, key); 280 list_for_each_entry(curr, in, list) { 281 const unsigned char *pos = curr->buf; 282 size_t len = curr->len; 283 /* 10.4.3 step 4.1 */ 284 while (len) { 285 /* 10.4.3 step 4.2 */ 286 if (drbg_blocklen(drbg) == cnt) { 287 cnt = 0; 288 ret = drbg_kcapi_sym(drbg, out, &data); 289 if (ret) 290 return ret; 291 } 292 out[cnt] ^= *pos; 293 pos++; 294 cnt++; 295 len--; 296 } 297 } 298 /* 10.4.3 step 4.2 for last block */ 299 if (cnt) 300 ret = drbg_kcapi_sym(drbg, out, &data); 301 302 return ret; 303 } 304 305 /* 306 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df 307 * (and drbg_ctr_bcc, but this function does not need any temporary buffers), 308 * the scratchpad is used as follows: 309 * drbg_ctr_update: 310 * temp 311 * start: drbg->scratchpad 312 * length: drbg_statelen(drbg) + drbg_blocklen(drbg) 313 * note: the cipher writing into this variable works 314 * blocklen-wise. Now, when the statelen is not a multiple 315 * of blocklen, the generateion loop below "spills over" 316 * by at most blocklen. Thus, we need to give sufficient 317 * memory. 318 * df_data 319 * start: drbg->scratchpad + 320 * drbg_statelen(drbg) + drbg_blocklen(drbg) 321 * length: drbg_statelen(drbg) 322 * 323 * drbg_ctr_df: 324 * pad 325 * start: df_data + drbg_statelen(drbg) 326 * length: drbg_blocklen(drbg) 327 * iv 328 * start: pad + drbg_blocklen(drbg) 329 * length: drbg_blocklen(drbg) 330 * temp 331 * start: iv + drbg_blocklen(drbg) 332 * length: drbg_satelen(drbg) + drbg_blocklen(drbg) 333 * note: temp is the buffer that the BCC function operates 334 * on. BCC operates blockwise. drbg_statelen(drbg) 335 * is sufficient when the DRBG state length is a multiple 336 * of the block size. For AES192 (and maybe other ciphers) 337 * this is not correct and the length for temp is 338 * insufficient (yes, that also means for such ciphers, 339 * the final output of all BCC rounds are truncated). 340 * Therefore, add drbg_blocklen(drbg) to cover all 341 * possibilities. 342 */ 343 344 /* Derivation Function for CTR DRBG as defined in 10.4.2 */ 345 static int drbg_ctr_df(struct drbg_state *drbg, 346 unsigned char *df_data, size_t bytes_to_return, 347 struct list_head *seedlist) 348 { 349 int ret = -EFAULT; 350 unsigned char L_N[8]; 351 /* S3 is input */ 352 struct drbg_string S1, S2, S4, cipherin; 353 LIST_HEAD(bcc_list); 354 unsigned char *pad = df_data + drbg_statelen(drbg); 355 unsigned char *iv = pad + drbg_blocklen(drbg); 356 unsigned char *temp = iv + drbg_blocklen(drbg); 357 size_t padlen = 0; 358 unsigned int templen = 0; 359 /* 10.4.2 step 7 */ 360 unsigned int i = 0; 361 /* 10.4.2 step 8 */ 362 const unsigned char *K = (unsigned char *) 363 "\x00\x01\x02\x03\x04\x05\x06\x07" 364 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" 365 "\x10\x11\x12\x13\x14\x15\x16\x17" 366 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"; 367 unsigned char *X; 368 size_t generated_len = 0; 369 size_t inputlen = 0; 370 struct drbg_string *seed = NULL; 371 372 memset(pad, 0, drbg_blocklen(drbg)); 373 memset(iv, 0, drbg_blocklen(drbg)); 374 375 /* 10.4.2 step 1 is implicit as we work byte-wise */ 376 377 /* 10.4.2 step 2 */ 378 if ((512/8) < bytes_to_return) 379 return -EINVAL; 380 381 /* 10.4.2 step 2 -- calculate the entire length of all input data */ 382 list_for_each_entry(seed, seedlist, list) 383 inputlen += seed->len; 384 drbg_cpu_to_be32(inputlen, &L_N[0]); 385 386 /* 10.4.2 step 3 */ 387 drbg_cpu_to_be32(bytes_to_return, &L_N[4]); 388 389 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */ 390 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg)); 391 /* wrap the padlen appropriately */ 392 if (padlen) 393 padlen = drbg_blocklen(drbg) - padlen; 394 /* 395 * pad / padlen contains the 0x80 byte and the following zero bytes. 396 * As the calculated padlen value only covers the number of zero 397 * bytes, this value has to be incremented by one for the 0x80 byte. 398 */ 399 padlen++; 400 pad[0] = 0x80; 401 402 /* 10.4.2 step 4 -- first fill the linked list and then order it */ 403 drbg_string_fill(&S1, iv, drbg_blocklen(drbg)); 404 list_add_tail(&S1.list, &bcc_list); 405 drbg_string_fill(&S2, L_N, sizeof(L_N)); 406 list_add_tail(&S2.list, &bcc_list); 407 list_splice_tail(seedlist, &bcc_list); 408 drbg_string_fill(&S4, pad, padlen); 409 list_add_tail(&S4.list, &bcc_list); 410 411 /* 10.4.2 step 9 */ 412 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) { 413 /* 414 * 10.4.2 step 9.1 - the padding is implicit as the buffer 415 * holds zeros after allocation -- even the increment of i 416 * is irrelevant as the increment remains within length of i 417 */ 418 drbg_cpu_to_be32(i, iv); 419 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */ 420 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list); 421 if (ret) 422 goto out; 423 /* 10.4.2 step 9.3 */ 424 i++; 425 templen += drbg_blocklen(drbg); 426 } 427 428 /* 10.4.2 step 11 */ 429 X = temp + (drbg_keylen(drbg)); 430 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg)); 431 432 /* 10.4.2 step 12: overwriting of outval is implemented in next step */ 433 434 /* 10.4.2 step 13 */ 435 drbg_kcapi_symsetkey(drbg, temp); 436 while (generated_len < bytes_to_return) { 437 short blocklen = 0; 438 /* 439 * 10.4.2 step 13.1: the truncation of the key length is 440 * implicit as the key is only drbg_blocklen in size based on 441 * the implementation of the cipher function callback 442 */ 443 ret = drbg_kcapi_sym(drbg, X, &cipherin); 444 if (ret) 445 goto out; 446 blocklen = (drbg_blocklen(drbg) < 447 (bytes_to_return - generated_len)) ? 448 drbg_blocklen(drbg) : 449 (bytes_to_return - generated_len); 450 /* 10.4.2 step 13.2 and 14 */ 451 memcpy(df_data + generated_len, X, blocklen); 452 generated_len += blocklen; 453 } 454 455 ret = 0; 456 457 out: 458 memset(iv, 0, drbg_blocklen(drbg)); 459 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 460 memset(pad, 0, drbg_blocklen(drbg)); 461 return ret; 462 } 463 464 /* 465 * update function of CTR DRBG as defined in 10.2.1.2 466 * 467 * The reseed variable has an enhanced meaning compared to the update 468 * functions of the other DRBGs as follows: 469 * 0 => initial seed from initialization 470 * 1 => reseed via drbg_seed 471 * 2 => first invocation from drbg_ctr_update when addtl is present. In 472 * this case, the df_data scratchpad is not deleted so that it is 473 * available for another calls to prevent calling the DF function 474 * again. 475 * 3 => second invocation from drbg_ctr_update. When the update function 476 * was called with addtl, the df_data memory already contains the 477 * DFed addtl information and we do not need to call DF again. 478 */ 479 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed, 480 int reseed) 481 { 482 int ret = -EFAULT; 483 /* 10.2.1.2 step 1 */ 484 unsigned char *temp = drbg->scratchpad; 485 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) + 486 drbg_blocklen(drbg); 487 488 if (3 > reseed) 489 memset(df_data, 0, drbg_statelen(drbg)); 490 491 if (!reseed) { 492 /* 493 * The DRBG uses the CTR mode of the underlying AES cipher. The 494 * CTR mode increments the counter value after the AES operation 495 * but SP800-90A requires that the counter is incremented before 496 * the AES operation. Hence, we increment it at the time we set 497 * it by one. 498 */ 499 crypto_inc(drbg->V, drbg_blocklen(drbg)); 500 501 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C, 502 drbg_keylen(drbg)); 503 if (ret) 504 goto out; 505 } 506 507 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */ 508 if (seed) { 509 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed); 510 if (ret) 511 goto out; 512 } 513 514 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg), 515 temp, drbg_statelen(drbg)); 516 if (ret) 517 return ret; 518 519 /* 10.2.1.2 step 5 */ 520 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp, 521 drbg_keylen(drbg)); 522 if (ret) 523 goto out; 524 /* 10.2.1.2 step 6 */ 525 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg)); 526 /* See above: increment counter by one to compensate timing of CTR op */ 527 crypto_inc(drbg->V, drbg_blocklen(drbg)); 528 ret = 0; 529 530 out: 531 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 532 if (2 != reseed) 533 memset(df_data, 0, drbg_statelen(drbg)); 534 return ret; 535 } 536 537 /* 538 * scratchpad use: drbg_ctr_update is called independently from 539 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused 540 */ 541 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */ 542 static int drbg_ctr_generate(struct drbg_state *drbg, 543 unsigned char *buf, unsigned int buflen, 544 struct list_head *addtl) 545 { 546 int ret; 547 int len = min_t(int, buflen, INT_MAX); 548 549 /* 10.2.1.5.2 step 2 */ 550 if (addtl && !list_empty(addtl)) { 551 ret = drbg_ctr_update(drbg, addtl, 2); 552 if (ret) 553 return 0; 554 } 555 556 /* 10.2.1.5.2 step 4.1 */ 557 ret = drbg_kcapi_sym_ctr(drbg, drbg->ctr_null_value, DRBG_CTR_NULL_LEN, 558 buf, len); 559 if (ret) 560 return ret; 561 562 /* 10.2.1.5.2 step 6 */ 563 ret = drbg_ctr_update(drbg, NULL, 3); 564 if (ret) 565 len = ret; 566 567 return len; 568 } 569 570 static const struct drbg_state_ops drbg_ctr_ops = { 571 .update = drbg_ctr_update, 572 .generate = drbg_ctr_generate, 573 .crypto_init = drbg_init_sym_kernel, 574 .crypto_fini = drbg_fini_sym_kernel, 575 }; 576 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 577 578 /****************************************************************** 579 * HMAC DRBG callback functions 580 ******************************************************************/ 581 582 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 583 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 584 const struct list_head *in); 585 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 586 const unsigned char *key); 587 static int drbg_init_hash_kernel(struct drbg_state *drbg); 588 static int drbg_fini_hash_kernel(struct drbg_state *drbg); 589 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 590 591 #ifdef CONFIG_CRYPTO_DRBG_HMAC 592 #define CRYPTO_DRBG_HMAC_STRING "HMAC " 593 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512"); 594 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512"); 595 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384"); 596 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384"); 597 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256"); 598 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256"); 599 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1"); 600 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1"); 601 602 /* update function of HMAC DRBG as defined in 10.1.2.2 */ 603 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed, 604 int reseed) 605 { 606 int ret = -EFAULT; 607 int i = 0; 608 struct drbg_string seed1, seed2, vdata; 609 LIST_HEAD(seedlist); 610 LIST_HEAD(vdatalist); 611 612 if (!reseed) { 613 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */ 614 memset(drbg->V, 1, drbg_statelen(drbg)); 615 drbg_kcapi_hmacsetkey(drbg, drbg->C); 616 } 617 618 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg)); 619 list_add_tail(&seed1.list, &seedlist); 620 /* buffer of seed2 will be filled in for loop below with one byte */ 621 drbg_string_fill(&seed2, NULL, 1); 622 list_add_tail(&seed2.list, &seedlist); 623 /* input data of seed is allowed to be NULL at this point */ 624 if (seed) 625 list_splice_tail(seed, &seedlist); 626 627 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg)); 628 list_add_tail(&vdata.list, &vdatalist); 629 for (i = 2; 0 < i; i--) { 630 /* first round uses 0x0, second 0x1 */ 631 unsigned char prefix = DRBG_PREFIX0; 632 if (1 == i) 633 prefix = DRBG_PREFIX1; 634 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */ 635 seed2.buf = &prefix; 636 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist); 637 if (ret) 638 return ret; 639 drbg_kcapi_hmacsetkey(drbg, drbg->C); 640 641 /* 10.1.2.2 step 2 and 5 -- HMAC for V */ 642 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist); 643 if (ret) 644 return ret; 645 646 /* 10.1.2.2 step 3 */ 647 if (!seed) 648 return ret; 649 } 650 651 return 0; 652 } 653 654 /* generate function of HMAC DRBG as defined in 10.1.2.5 */ 655 static int drbg_hmac_generate(struct drbg_state *drbg, 656 unsigned char *buf, 657 unsigned int buflen, 658 struct list_head *addtl) 659 { 660 int len = 0; 661 int ret = 0; 662 struct drbg_string data; 663 LIST_HEAD(datalist); 664 665 /* 10.1.2.5 step 2 */ 666 if (addtl && !list_empty(addtl)) { 667 ret = drbg_hmac_update(drbg, addtl, 1); 668 if (ret) 669 return ret; 670 } 671 672 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg)); 673 list_add_tail(&data.list, &datalist); 674 while (len < buflen) { 675 unsigned int outlen = 0; 676 /* 10.1.2.5 step 4.1 */ 677 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist); 678 if (ret) 679 return ret; 680 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 681 drbg_blocklen(drbg) : (buflen - len); 682 683 /* 10.1.2.5 step 4.2 */ 684 memcpy(buf + len, drbg->V, outlen); 685 len += outlen; 686 } 687 688 /* 10.1.2.5 step 6 */ 689 if (addtl && !list_empty(addtl)) 690 ret = drbg_hmac_update(drbg, addtl, 1); 691 else 692 ret = drbg_hmac_update(drbg, NULL, 1); 693 if (ret) 694 return ret; 695 696 return len; 697 } 698 699 static const struct drbg_state_ops drbg_hmac_ops = { 700 .update = drbg_hmac_update, 701 .generate = drbg_hmac_generate, 702 .crypto_init = drbg_init_hash_kernel, 703 .crypto_fini = drbg_fini_hash_kernel, 704 }; 705 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 706 707 /****************************************************************** 708 * Hash DRBG callback functions 709 ******************************************************************/ 710 711 #ifdef CONFIG_CRYPTO_DRBG_HASH 712 #define CRYPTO_DRBG_HASH_STRING "HASH " 713 MODULE_ALIAS_CRYPTO("drbg_pr_sha512"); 714 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512"); 715 MODULE_ALIAS_CRYPTO("drbg_pr_sha384"); 716 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384"); 717 MODULE_ALIAS_CRYPTO("drbg_pr_sha256"); 718 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256"); 719 MODULE_ALIAS_CRYPTO("drbg_pr_sha1"); 720 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1"); 721 722 /* 723 * Increment buffer 724 * 725 * @dst buffer to increment 726 * @add value to add 727 */ 728 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen, 729 const unsigned char *add, size_t addlen) 730 { 731 /* implied: dstlen > addlen */ 732 unsigned char *dstptr; 733 const unsigned char *addptr; 734 unsigned int remainder = 0; 735 size_t len = addlen; 736 737 dstptr = dst + (dstlen-1); 738 addptr = add + (addlen-1); 739 while (len) { 740 remainder += *dstptr + *addptr; 741 *dstptr = remainder & 0xff; 742 remainder >>= 8; 743 len--; dstptr--; addptr--; 744 } 745 len = dstlen - addlen; 746 while (len && remainder > 0) { 747 remainder = *dstptr + 1; 748 *dstptr = remainder & 0xff; 749 remainder >>= 8; 750 len--; dstptr--; 751 } 752 } 753 754 /* 755 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used 756 * interlinked, the scratchpad is used as follows: 757 * drbg_hash_update 758 * start: drbg->scratchpad 759 * length: drbg_statelen(drbg) 760 * drbg_hash_df: 761 * start: drbg->scratchpad + drbg_statelen(drbg) 762 * length: drbg_blocklen(drbg) 763 * 764 * drbg_hash_process_addtl uses the scratchpad, but fully completes 765 * before either of the functions mentioned before are invoked. Therefore, 766 * drbg_hash_process_addtl does not need to be specifically considered. 767 */ 768 769 /* Derivation Function for Hash DRBG as defined in 10.4.1 */ 770 static int drbg_hash_df(struct drbg_state *drbg, 771 unsigned char *outval, size_t outlen, 772 struct list_head *entropylist) 773 { 774 int ret = 0; 775 size_t len = 0; 776 unsigned char input[5]; 777 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg); 778 struct drbg_string data; 779 780 /* 10.4.1 step 3 */ 781 input[0] = 1; 782 drbg_cpu_to_be32((outlen * 8), &input[1]); 783 784 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */ 785 drbg_string_fill(&data, input, 5); 786 list_add(&data.list, entropylist); 787 788 /* 10.4.1 step 4 */ 789 while (len < outlen) { 790 short blocklen = 0; 791 /* 10.4.1 step 4.1 */ 792 ret = drbg_kcapi_hash(drbg, tmp, entropylist); 793 if (ret) 794 goto out; 795 /* 10.4.1 step 4.2 */ 796 input[0]++; 797 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ? 798 drbg_blocklen(drbg) : (outlen - len); 799 memcpy(outval + len, tmp, blocklen); 800 len += blocklen; 801 } 802 803 out: 804 memset(tmp, 0, drbg_blocklen(drbg)); 805 return ret; 806 } 807 808 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */ 809 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed, 810 int reseed) 811 { 812 int ret = 0; 813 struct drbg_string data1, data2; 814 LIST_HEAD(datalist); 815 LIST_HEAD(datalist2); 816 unsigned char *V = drbg->scratchpad; 817 unsigned char prefix = DRBG_PREFIX1; 818 819 if (!seed) 820 return -EINVAL; 821 822 if (reseed) { 823 /* 10.1.1.3 step 1 */ 824 memcpy(V, drbg->V, drbg_statelen(drbg)); 825 drbg_string_fill(&data1, &prefix, 1); 826 list_add_tail(&data1.list, &datalist); 827 drbg_string_fill(&data2, V, drbg_statelen(drbg)); 828 list_add_tail(&data2.list, &datalist); 829 } 830 list_splice_tail(seed, &datalist); 831 832 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */ 833 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist); 834 if (ret) 835 goto out; 836 837 /* 10.1.1.2 / 10.1.1.3 step 4 */ 838 prefix = DRBG_PREFIX0; 839 drbg_string_fill(&data1, &prefix, 1); 840 list_add_tail(&data1.list, &datalist2); 841 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 842 list_add_tail(&data2.list, &datalist2); 843 /* 10.1.1.2 / 10.1.1.3 step 4 */ 844 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2); 845 846 out: 847 memset(drbg->scratchpad, 0, drbg_statelen(drbg)); 848 return ret; 849 } 850 851 /* processing of additional information string for Hash DRBG */ 852 static int drbg_hash_process_addtl(struct drbg_state *drbg, 853 struct list_head *addtl) 854 { 855 int ret = 0; 856 struct drbg_string data1, data2; 857 LIST_HEAD(datalist); 858 unsigned char prefix = DRBG_PREFIX2; 859 860 /* 10.1.1.4 step 2 */ 861 if (!addtl || list_empty(addtl)) 862 return 0; 863 864 /* 10.1.1.4 step 2a */ 865 drbg_string_fill(&data1, &prefix, 1); 866 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 867 list_add_tail(&data1.list, &datalist); 868 list_add_tail(&data2.list, &datalist); 869 list_splice_tail(addtl, &datalist); 870 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 871 if (ret) 872 goto out; 873 874 /* 10.1.1.4 step 2b */ 875 drbg_add_buf(drbg->V, drbg_statelen(drbg), 876 drbg->scratchpad, drbg_blocklen(drbg)); 877 878 out: 879 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 880 return ret; 881 } 882 883 /* Hashgen defined in 10.1.1.4 */ 884 static int drbg_hash_hashgen(struct drbg_state *drbg, 885 unsigned char *buf, 886 unsigned int buflen) 887 { 888 int len = 0; 889 int ret = 0; 890 unsigned char *src = drbg->scratchpad; 891 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg); 892 struct drbg_string data; 893 LIST_HEAD(datalist); 894 895 /* 10.1.1.4 step hashgen 2 */ 896 memcpy(src, drbg->V, drbg_statelen(drbg)); 897 898 drbg_string_fill(&data, src, drbg_statelen(drbg)); 899 list_add_tail(&data.list, &datalist); 900 while (len < buflen) { 901 unsigned int outlen = 0; 902 /* 10.1.1.4 step hashgen 4.1 */ 903 ret = drbg_kcapi_hash(drbg, dst, &datalist); 904 if (ret) { 905 len = ret; 906 goto out; 907 } 908 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 909 drbg_blocklen(drbg) : (buflen - len); 910 /* 10.1.1.4 step hashgen 4.2 */ 911 memcpy(buf + len, dst, outlen); 912 len += outlen; 913 /* 10.1.1.4 hashgen step 4.3 */ 914 if (len < buflen) 915 crypto_inc(src, drbg_statelen(drbg)); 916 } 917 918 out: 919 memset(drbg->scratchpad, 0, 920 (drbg_statelen(drbg) + drbg_blocklen(drbg))); 921 return len; 922 } 923 924 /* generate function for Hash DRBG as defined in 10.1.1.4 */ 925 static int drbg_hash_generate(struct drbg_state *drbg, 926 unsigned char *buf, unsigned int buflen, 927 struct list_head *addtl) 928 { 929 int len = 0; 930 int ret = 0; 931 union { 932 unsigned char req[8]; 933 __be64 req_int; 934 } u; 935 unsigned char prefix = DRBG_PREFIX3; 936 struct drbg_string data1, data2; 937 LIST_HEAD(datalist); 938 939 /* 10.1.1.4 step 2 */ 940 ret = drbg_hash_process_addtl(drbg, addtl); 941 if (ret) 942 return ret; 943 /* 10.1.1.4 step 3 */ 944 len = drbg_hash_hashgen(drbg, buf, buflen); 945 946 /* this is the value H as documented in 10.1.1.4 */ 947 /* 10.1.1.4 step 4 */ 948 drbg_string_fill(&data1, &prefix, 1); 949 list_add_tail(&data1.list, &datalist); 950 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 951 list_add_tail(&data2.list, &datalist); 952 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 953 if (ret) { 954 len = ret; 955 goto out; 956 } 957 958 /* 10.1.1.4 step 5 */ 959 drbg_add_buf(drbg->V, drbg_statelen(drbg), 960 drbg->scratchpad, drbg_blocklen(drbg)); 961 drbg_add_buf(drbg->V, drbg_statelen(drbg), 962 drbg->C, drbg_statelen(drbg)); 963 u.req_int = cpu_to_be64(drbg->reseed_ctr); 964 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8); 965 966 out: 967 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 968 return len; 969 } 970 971 /* 972 * scratchpad usage: as update and generate are used isolated, both 973 * can use the scratchpad 974 */ 975 static const struct drbg_state_ops drbg_hash_ops = { 976 .update = drbg_hash_update, 977 .generate = drbg_hash_generate, 978 .crypto_init = drbg_init_hash_kernel, 979 .crypto_fini = drbg_fini_hash_kernel, 980 }; 981 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 982 983 /****************************************************************** 984 * Functions common for DRBG implementations 985 ******************************************************************/ 986 987 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed, 988 int reseed) 989 { 990 int ret = drbg->d_ops->update(drbg, seed, reseed); 991 992 if (ret) 993 return ret; 994 995 drbg->seeded = true; 996 /* 10.1.1.2 / 10.1.1.3 step 5 */ 997 drbg->reseed_ctr = 1; 998 999 return ret; 1000 } 1001 1002 static void drbg_async_seed(struct work_struct *work) 1003 { 1004 struct drbg_string data; 1005 LIST_HEAD(seedlist); 1006 struct drbg_state *drbg = container_of(work, struct drbg_state, 1007 seed_work); 1008 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1009 unsigned char entropy[32]; 1010 1011 BUG_ON(!entropylen); 1012 BUG_ON(entropylen > sizeof(entropy)); 1013 get_random_bytes(entropy, entropylen); 1014 1015 drbg_string_fill(&data, entropy, entropylen); 1016 list_add_tail(&data.list, &seedlist); 1017 1018 mutex_lock(&drbg->drbg_mutex); 1019 1020 /* If nonblocking pool is initialized, deactivate Jitter RNG */ 1021 crypto_free_rng(drbg->jent); 1022 drbg->jent = NULL; 1023 1024 /* Set seeded to false so that if __drbg_seed fails the 1025 * next generate call will trigger a reseed. 1026 */ 1027 drbg->seeded = false; 1028 1029 __drbg_seed(drbg, &seedlist, true); 1030 1031 if (drbg->seeded) 1032 drbg->reseed_threshold = drbg_max_requests(drbg); 1033 1034 mutex_unlock(&drbg->drbg_mutex); 1035 1036 memzero_explicit(entropy, entropylen); 1037 } 1038 1039 /* 1040 * Seeding or reseeding of the DRBG 1041 * 1042 * @drbg: DRBG state struct 1043 * @pers: personalization / additional information buffer 1044 * @reseed: 0 for initial seed process, 1 for reseeding 1045 * 1046 * return: 1047 * 0 on success 1048 * error value otherwise 1049 */ 1050 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers, 1051 bool reseed) 1052 { 1053 int ret; 1054 unsigned char entropy[((32 + 16) * 2)]; 1055 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1056 struct drbg_string data1; 1057 LIST_HEAD(seedlist); 1058 1059 /* 9.1 / 9.2 / 9.3.1 step 3 */ 1060 if (pers && pers->len > (drbg_max_addtl(drbg))) { 1061 pr_devel("DRBG: personalization string too long %zu\n", 1062 pers->len); 1063 return -EINVAL; 1064 } 1065 1066 if (list_empty(&drbg->test_data.list)) { 1067 drbg_string_fill(&data1, drbg->test_data.buf, 1068 drbg->test_data.len); 1069 pr_devel("DRBG: using test entropy\n"); 1070 } else { 1071 /* 1072 * Gather entropy equal to the security strength of the DRBG. 1073 * With a derivation function, a nonce is required in addition 1074 * to the entropy. A nonce must be at least 1/2 of the security 1075 * strength of the DRBG in size. Thus, entropy + nonce is 3/2 1076 * of the strength. The consideration of a nonce is only 1077 * applicable during initial seeding. 1078 */ 1079 BUG_ON(!entropylen); 1080 if (!reseed) 1081 entropylen = ((entropylen + 1) / 2) * 3; 1082 BUG_ON((entropylen * 2) > sizeof(entropy)); 1083 1084 /* Get seed from in-kernel /dev/urandom */ 1085 get_random_bytes(entropy, entropylen); 1086 1087 if (!drbg->jent) { 1088 drbg_string_fill(&data1, entropy, entropylen); 1089 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1090 entropylen); 1091 } else { 1092 /* Get seed from Jitter RNG */ 1093 ret = crypto_rng_get_bytes(drbg->jent, 1094 entropy + entropylen, 1095 entropylen); 1096 if (ret) { 1097 pr_devel("DRBG: jent failed with %d\n", ret); 1098 return ret; 1099 } 1100 1101 drbg_string_fill(&data1, entropy, entropylen * 2); 1102 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1103 entropylen * 2); 1104 } 1105 } 1106 list_add_tail(&data1.list, &seedlist); 1107 1108 /* 1109 * concatenation of entropy with personalization str / addtl input) 1110 * the variable pers is directly handed in by the caller, so check its 1111 * contents whether it is appropriate 1112 */ 1113 if (pers && pers->buf && 0 < pers->len) { 1114 list_add_tail(&pers->list, &seedlist); 1115 pr_devel("DRBG: using personalization string\n"); 1116 } 1117 1118 if (!reseed) { 1119 memset(drbg->V, 0, drbg_statelen(drbg)); 1120 memset(drbg->C, 0, drbg_statelen(drbg)); 1121 } 1122 1123 ret = __drbg_seed(drbg, &seedlist, reseed); 1124 1125 memzero_explicit(entropy, entropylen * 2); 1126 1127 return ret; 1128 } 1129 1130 /* Free all substructures in a DRBG state without the DRBG state structure */ 1131 static inline void drbg_dealloc_state(struct drbg_state *drbg) 1132 { 1133 if (!drbg) 1134 return; 1135 kzfree(drbg->V); 1136 drbg->Vbuf = NULL; 1137 kzfree(drbg->C); 1138 drbg->Cbuf = NULL; 1139 kzfree(drbg->scratchpadbuf); 1140 drbg->scratchpadbuf = NULL; 1141 drbg->reseed_ctr = 0; 1142 drbg->d_ops = NULL; 1143 drbg->core = NULL; 1144 } 1145 1146 /* 1147 * Allocate all sub-structures for a DRBG state. 1148 * The DRBG state structure must already be allocated. 1149 */ 1150 static inline int drbg_alloc_state(struct drbg_state *drbg) 1151 { 1152 int ret = -ENOMEM; 1153 unsigned int sb_size = 0; 1154 1155 switch (drbg->core->flags & DRBG_TYPE_MASK) { 1156 #ifdef CONFIG_CRYPTO_DRBG_HMAC 1157 case DRBG_HMAC: 1158 drbg->d_ops = &drbg_hmac_ops; 1159 break; 1160 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 1161 #ifdef CONFIG_CRYPTO_DRBG_HASH 1162 case DRBG_HASH: 1163 drbg->d_ops = &drbg_hash_ops; 1164 break; 1165 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 1166 #ifdef CONFIG_CRYPTO_DRBG_CTR 1167 case DRBG_CTR: 1168 drbg->d_ops = &drbg_ctr_ops; 1169 break; 1170 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1171 default: 1172 ret = -EOPNOTSUPP; 1173 goto err; 1174 } 1175 1176 ret = drbg->d_ops->crypto_init(drbg); 1177 if (ret < 0) 1178 goto err; 1179 1180 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1181 if (!drbg->Vbuf) { 1182 ret = -ENOMEM; 1183 goto fini; 1184 } 1185 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1); 1186 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1187 if (!drbg->Cbuf) { 1188 ret = -ENOMEM; 1189 goto fini; 1190 } 1191 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1); 1192 /* scratchpad is only generated for CTR and Hash */ 1193 if (drbg->core->flags & DRBG_HMAC) 1194 sb_size = 0; 1195 else if (drbg->core->flags & DRBG_CTR) 1196 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */ 1197 drbg_statelen(drbg) + /* df_data */ 1198 drbg_blocklen(drbg) + /* pad */ 1199 drbg_blocklen(drbg) + /* iv */ 1200 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */ 1201 else 1202 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg); 1203 1204 if (0 < sb_size) { 1205 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL); 1206 if (!drbg->scratchpadbuf) { 1207 ret = -ENOMEM; 1208 goto fini; 1209 } 1210 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1); 1211 } 1212 1213 return 0; 1214 1215 fini: 1216 drbg->d_ops->crypto_fini(drbg); 1217 err: 1218 drbg_dealloc_state(drbg); 1219 return ret; 1220 } 1221 1222 /************************************************************************* 1223 * DRBG interface functions 1224 *************************************************************************/ 1225 1226 /* 1227 * DRBG generate function as required by SP800-90A - this function 1228 * generates random numbers 1229 * 1230 * @drbg DRBG state handle 1231 * @buf Buffer where to store the random numbers -- the buffer must already 1232 * be pre-allocated by caller 1233 * @buflen Length of output buffer - this value defines the number of random 1234 * bytes pulled from DRBG 1235 * @addtl Additional input that is mixed into state, may be NULL -- note 1236 * the entropy is pulled by the DRBG internally unconditionally 1237 * as defined in SP800-90A. The additional input is mixed into 1238 * the state in addition to the pulled entropy. 1239 * 1240 * return: 0 when all bytes are generated; < 0 in case of an error 1241 */ 1242 static int drbg_generate(struct drbg_state *drbg, 1243 unsigned char *buf, unsigned int buflen, 1244 struct drbg_string *addtl) 1245 { 1246 int len = 0; 1247 LIST_HEAD(addtllist); 1248 1249 if (!drbg->core) { 1250 pr_devel("DRBG: not yet seeded\n"); 1251 return -EINVAL; 1252 } 1253 if (0 == buflen || !buf) { 1254 pr_devel("DRBG: no output buffer provided\n"); 1255 return -EINVAL; 1256 } 1257 if (addtl && NULL == addtl->buf && 0 < addtl->len) { 1258 pr_devel("DRBG: wrong format of additional information\n"); 1259 return -EINVAL; 1260 } 1261 1262 /* 9.3.1 step 2 */ 1263 len = -EINVAL; 1264 if (buflen > (drbg_max_request_bytes(drbg))) { 1265 pr_devel("DRBG: requested random numbers too large %u\n", 1266 buflen); 1267 goto err; 1268 } 1269 1270 /* 9.3.1 step 3 is implicit with the chosen DRBG */ 1271 1272 /* 9.3.1 step 4 */ 1273 if (addtl && addtl->len > (drbg_max_addtl(drbg))) { 1274 pr_devel("DRBG: additional information string too long %zu\n", 1275 addtl->len); 1276 goto err; 1277 } 1278 /* 9.3.1 step 5 is implicit with the chosen DRBG */ 1279 1280 /* 1281 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented 1282 * here. The spec is a bit convoluted here, we make it simpler. 1283 */ 1284 if (drbg->reseed_threshold < drbg->reseed_ctr) 1285 drbg->seeded = false; 1286 1287 if (drbg->pr || !drbg->seeded) { 1288 pr_devel("DRBG: reseeding before generation (prediction " 1289 "resistance: %s, state %s)\n", 1290 drbg->pr ? "true" : "false", 1291 drbg->seeded ? "seeded" : "unseeded"); 1292 /* 9.3.1 steps 7.1 through 7.3 */ 1293 len = drbg_seed(drbg, addtl, true); 1294 if (len) 1295 goto err; 1296 /* 9.3.1 step 7.4 */ 1297 addtl = NULL; 1298 } 1299 1300 if (addtl && 0 < addtl->len) 1301 list_add_tail(&addtl->list, &addtllist); 1302 /* 9.3.1 step 8 and 10 */ 1303 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist); 1304 1305 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */ 1306 drbg->reseed_ctr++; 1307 if (0 >= len) 1308 goto err; 1309 1310 /* 1311 * Section 11.3.3 requires to re-perform self tests after some 1312 * generated random numbers. The chosen value after which self 1313 * test is performed is arbitrary, but it should be reasonable. 1314 * However, we do not perform the self tests because of the following 1315 * reasons: it is mathematically impossible that the initial self tests 1316 * were successfully and the following are not. If the initial would 1317 * pass and the following would not, the kernel integrity is violated. 1318 * In this case, the entire kernel operation is questionable and it 1319 * is unlikely that the integrity violation only affects the 1320 * correct operation of the DRBG. 1321 * 1322 * Albeit the following code is commented out, it is provided in 1323 * case somebody has a need to implement the test of 11.3.3. 1324 */ 1325 #if 0 1326 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) { 1327 int err = 0; 1328 pr_devel("DRBG: start to perform self test\n"); 1329 if (drbg->core->flags & DRBG_HMAC) 1330 err = alg_test("drbg_pr_hmac_sha256", 1331 "drbg_pr_hmac_sha256", 0, 0); 1332 else if (drbg->core->flags & DRBG_CTR) 1333 err = alg_test("drbg_pr_ctr_aes128", 1334 "drbg_pr_ctr_aes128", 0, 0); 1335 else 1336 err = alg_test("drbg_pr_sha256", 1337 "drbg_pr_sha256", 0, 0); 1338 if (err) { 1339 pr_err("DRBG: periodical self test failed\n"); 1340 /* 1341 * uninstantiate implies that from now on, only errors 1342 * are returned when reusing this DRBG cipher handle 1343 */ 1344 drbg_uninstantiate(drbg); 1345 return 0; 1346 } else { 1347 pr_devel("DRBG: self test successful\n"); 1348 } 1349 } 1350 #endif 1351 1352 /* 1353 * All operations were successful, return 0 as mandated by 1354 * the kernel crypto API interface. 1355 */ 1356 len = 0; 1357 err: 1358 return len; 1359 } 1360 1361 /* 1362 * Wrapper around drbg_generate which can pull arbitrary long strings 1363 * from the DRBG without hitting the maximum request limitation. 1364 * 1365 * Parameters: see drbg_generate 1366 * Return codes: see drbg_generate -- if one drbg_generate request fails, 1367 * the entire drbg_generate_long request fails 1368 */ 1369 static int drbg_generate_long(struct drbg_state *drbg, 1370 unsigned char *buf, unsigned int buflen, 1371 struct drbg_string *addtl) 1372 { 1373 unsigned int len = 0; 1374 unsigned int slice = 0; 1375 do { 1376 int err = 0; 1377 unsigned int chunk = 0; 1378 slice = ((buflen - len) / drbg_max_request_bytes(drbg)); 1379 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len); 1380 mutex_lock(&drbg->drbg_mutex); 1381 err = drbg_generate(drbg, buf + len, chunk, addtl); 1382 mutex_unlock(&drbg->drbg_mutex); 1383 if (0 > err) 1384 return err; 1385 len += chunk; 1386 } while (slice > 0 && (len < buflen)); 1387 return 0; 1388 } 1389 1390 static void drbg_schedule_async_seed(struct random_ready_callback *rdy) 1391 { 1392 struct drbg_state *drbg = container_of(rdy, struct drbg_state, 1393 random_ready); 1394 1395 schedule_work(&drbg->seed_work); 1396 } 1397 1398 static int drbg_prepare_hrng(struct drbg_state *drbg) 1399 { 1400 int err; 1401 1402 /* We do not need an HRNG in test mode. */ 1403 if (list_empty(&drbg->test_data.list)) 1404 return 0; 1405 1406 INIT_WORK(&drbg->seed_work, drbg_async_seed); 1407 1408 drbg->random_ready.owner = THIS_MODULE; 1409 drbg->random_ready.func = drbg_schedule_async_seed; 1410 1411 err = add_random_ready_callback(&drbg->random_ready); 1412 1413 switch (err) { 1414 case 0: 1415 break; 1416 1417 case -EALREADY: 1418 err = 0; 1419 /* fall through */ 1420 1421 default: 1422 drbg->random_ready.func = NULL; 1423 return err; 1424 } 1425 1426 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); 1427 1428 /* 1429 * Require frequent reseeds until the seed source is fully 1430 * initialized. 1431 */ 1432 drbg->reseed_threshold = 50; 1433 1434 return err; 1435 } 1436 1437 /* 1438 * DRBG instantiation function as required by SP800-90A - this function 1439 * sets up the DRBG handle, performs the initial seeding and all sanity 1440 * checks required by SP800-90A 1441 * 1442 * @drbg memory of state -- if NULL, new memory is allocated 1443 * @pers Personalization string that is mixed into state, may be NULL -- note 1444 * the entropy is pulled by the DRBG internally unconditionally 1445 * as defined in SP800-90A. The additional input is mixed into 1446 * the state in addition to the pulled entropy. 1447 * @coreref reference to core 1448 * @pr prediction resistance enabled 1449 * 1450 * return 1451 * 0 on success 1452 * error value otherwise 1453 */ 1454 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, 1455 int coreref, bool pr) 1456 { 1457 int ret; 1458 bool reseed = true; 1459 1460 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance " 1461 "%s\n", coreref, pr ? "enabled" : "disabled"); 1462 mutex_lock(&drbg->drbg_mutex); 1463 1464 /* 9.1 step 1 is implicit with the selected DRBG type */ 1465 1466 /* 1467 * 9.1 step 2 is implicit as caller can select prediction resistance 1468 * and the flag is copied into drbg->flags -- 1469 * all DRBG types support prediction resistance 1470 */ 1471 1472 /* 9.1 step 4 is implicit in drbg_sec_strength */ 1473 1474 if (!drbg->core) { 1475 drbg->core = &drbg_cores[coreref]; 1476 drbg->pr = pr; 1477 drbg->seeded = false; 1478 drbg->reseed_threshold = drbg_max_requests(drbg); 1479 1480 ret = drbg_alloc_state(drbg); 1481 if (ret) 1482 goto unlock; 1483 1484 ret = drbg_prepare_hrng(drbg); 1485 if (ret) 1486 goto free_everything; 1487 1488 if (IS_ERR(drbg->jent)) { 1489 ret = PTR_ERR(drbg->jent); 1490 drbg->jent = NULL; 1491 if (fips_enabled || ret != -ENOENT) 1492 goto free_everything; 1493 pr_info("DRBG: Continuing without Jitter RNG\n"); 1494 } 1495 1496 reseed = false; 1497 } 1498 1499 ret = drbg_seed(drbg, pers, reseed); 1500 1501 if (ret && !reseed) 1502 goto free_everything; 1503 1504 mutex_unlock(&drbg->drbg_mutex); 1505 return ret; 1506 1507 unlock: 1508 mutex_unlock(&drbg->drbg_mutex); 1509 return ret; 1510 1511 free_everything: 1512 mutex_unlock(&drbg->drbg_mutex); 1513 drbg_uninstantiate(drbg); 1514 return ret; 1515 } 1516 1517 /* 1518 * DRBG uninstantiate function as required by SP800-90A - this function 1519 * frees all buffers and the DRBG handle 1520 * 1521 * @drbg DRBG state handle 1522 * 1523 * return 1524 * 0 on success 1525 */ 1526 static int drbg_uninstantiate(struct drbg_state *drbg) 1527 { 1528 if (drbg->random_ready.func) { 1529 del_random_ready_callback(&drbg->random_ready); 1530 cancel_work_sync(&drbg->seed_work); 1531 crypto_free_rng(drbg->jent); 1532 drbg->jent = NULL; 1533 } 1534 1535 if (drbg->d_ops) 1536 drbg->d_ops->crypto_fini(drbg); 1537 drbg_dealloc_state(drbg); 1538 /* no scrubbing of test_data -- this shall survive an uninstantiate */ 1539 return 0; 1540 } 1541 1542 /* 1543 * Helper function for setting the test data in the DRBG 1544 * 1545 * @drbg DRBG state handle 1546 * @data test data 1547 * @len test data length 1548 */ 1549 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm, 1550 const u8 *data, unsigned int len) 1551 { 1552 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1553 1554 mutex_lock(&drbg->drbg_mutex); 1555 drbg_string_fill(&drbg->test_data, data, len); 1556 mutex_unlock(&drbg->drbg_mutex); 1557 } 1558 1559 /*************************************************************** 1560 * Kernel crypto API cipher invocations requested by DRBG 1561 ***************************************************************/ 1562 1563 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 1564 struct sdesc { 1565 struct shash_desc shash; 1566 char ctx[]; 1567 }; 1568 1569 static int drbg_init_hash_kernel(struct drbg_state *drbg) 1570 { 1571 struct sdesc *sdesc; 1572 struct crypto_shash *tfm; 1573 1574 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0); 1575 if (IS_ERR(tfm)) { 1576 pr_info("DRBG: could not allocate digest TFM handle: %s\n", 1577 drbg->core->backend_cra_name); 1578 return PTR_ERR(tfm); 1579 } 1580 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm)); 1581 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm), 1582 GFP_KERNEL); 1583 if (!sdesc) { 1584 crypto_free_shash(tfm); 1585 return -ENOMEM; 1586 } 1587 1588 sdesc->shash.tfm = tfm; 1589 sdesc->shash.flags = 0; 1590 drbg->priv_data = sdesc; 1591 1592 return crypto_shash_alignmask(tfm); 1593 } 1594 1595 static int drbg_fini_hash_kernel(struct drbg_state *drbg) 1596 { 1597 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1598 if (sdesc) { 1599 crypto_free_shash(sdesc->shash.tfm); 1600 kzfree(sdesc); 1601 } 1602 drbg->priv_data = NULL; 1603 return 0; 1604 } 1605 1606 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 1607 const unsigned char *key) 1608 { 1609 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1610 1611 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg)); 1612 } 1613 1614 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 1615 const struct list_head *in) 1616 { 1617 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1618 struct drbg_string *input = NULL; 1619 1620 crypto_shash_init(&sdesc->shash); 1621 list_for_each_entry(input, in, list) 1622 crypto_shash_update(&sdesc->shash, input->buf, input->len); 1623 return crypto_shash_final(&sdesc->shash, outval); 1624 } 1625 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 1626 1627 #ifdef CONFIG_CRYPTO_DRBG_CTR 1628 static int drbg_fini_sym_kernel(struct drbg_state *drbg) 1629 { 1630 struct crypto_cipher *tfm = 1631 (struct crypto_cipher *)drbg->priv_data; 1632 if (tfm) 1633 crypto_free_cipher(tfm); 1634 drbg->priv_data = NULL; 1635 1636 if (drbg->ctr_handle) 1637 crypto_free_skcipher(drbg->ctr_handle); 1638 drbg->ctr_handle = NULL; 1639 1640 if (drbg->ctr_req) 1641 skcipher_request_free(drbg->ctr_req); 1642 drbg->ctr_req = NULL; 1643 1644 kfree(drbg->ctr_null_value_buf); 1645 drbg->ctr_null_value = NULL; 1646 1647 return 0; 1648 } 1649 1650 static void drbg_skcipher_cb(struct crypto_async_request *req, int error) 1651 { 1652 struct drbg_state *drbg = req->data; 1653 1654 if (error == -EINPROGRESS) 1655 return; 1656 drbg->ctr_async_err = error; 1657 complete(&drbg->ctr_completion); 1658 } 1659 1660 static int drbg_init_sym_kernel(struct drbg_state *drbg) 1661 { 1662 struct crypto_cipher *tfm; 1663 struct crypto_skcipher *sk_tfm; 1664 struct skcipher_request *req; 1665 unsigned int alignmask; 1666 char ctr_name[CRYPTO_MAX_ALG_NAME]; 1667 1668 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0); 1669 if (IS_ERR(tfm)) { 1670 pr_info("DRBG: could not allocate cipher TFM handle: %s\n", 1671 drbg->core->backend_cra_name); 1672 return PTR_ERR(tfm); 1673 } 1674 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm)); 1675 drbg->priv_data = tfm; 1676 1677 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", 1678 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) { 1679 drbg_fini_sym_kernel(drbg); 1680 return -EINVAL; 1681 } 1682 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0); 1683 if (IS_ERR(sk_tfm)) { 1684 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n", 1685 ctr_name); 1686 drbg_fini_sym_kernel(drbg); 1687 return PTR_ERR(sk_tfm); 1688 } 1689 drbg->ctr_handle = sk_tfm; 1690 1691 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL); 1692 if (!req) { 1693 pr_info("DRBG: could not allocate request queue\n"); 1694 drbg_fini_sym_kernel(drbg); 1695 return -ENOMEM; 1696 } 1697 drbg->ctr_req = req; 1698 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 1699 drbg_skcipher_cb, drbg); 1700 1701 alignmask = crypto_skcipher_alignmask(sk_tfm); 1702 drbg->ctr_null_value_buf = kzalloc(DRBG_CTR_NULL_LEN + alignmask, 1703 GFP_KERNEL); 1704 if (!drbg->ctr_null_value_buf) { 1705 drbg_fini_sym_kernel(drbg); 1706 return -ENOMEM; 1707 } 1708 drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf, 1709 alignmask + 1); 1710 1711 return alignmask; 1712 } 1713 1714 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 1715 const unsigned char *key) 1716 { 1717 struct crypto_cipher *tfm = 1718 (struct crypto_cipher *)drbg->priv_data; 1719 1720 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg))); 1721 } 1722 1723 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 1724 const struct drbg_string *in) 1725 { 1726 struct crypto_cipher *tfm = 1727 (struct crypto_cipher *)drbg->priv_data; 1728 1729 /* there is only component in *in */ 1730 BUG_ON(in->len < drbg_blocklen(drbg)); 1731 crypto_cipher_encrypt_one(tfm, outval, in->buf); 1732 return 0; 1733 } 1734 1735 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 1736 u8 *inbuf, u32 inlen, 1737 u8 *outbuf, u32 outlen) 1738 { 1739 struct scatterlist sg_in; 1740 1741 sg_init_one(&sg_in, inbuf, inlen); 1742 1743 while (outlen) { 1744 u32 cryptlen = min_t(u32, inlen, outlen); 1745 struct scatterlist sg_out; 1746 int ret; 1747 1748 sg_init_one(&sg_out, outbuf, cryptlen); 1749 skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out, 1750 cryptlen, drbg->V); 1751 ret = crypto_skcipher_encrypt(drbg->ctr_req); 1752 switch (ret) { 1753 case 0: 1754 break; 1755 case -EINPROGRESS: 1756 case -EBUSY: 1757 ret = wait_for_completion_interruptible( 1758 &drbg->ctr_completion); 1759 if (!ret && !drbg->ctr_async_err) { 1760 reinit_completion(&drbg->ctr_completion); 1761 break; 1762 } 1763 default: 1764 return ret; 1765 } 1766 init_completion(&drbg->ctr_completion); 1767 1768 outlen -= cryptlen; 1769 } 1770 1771 return 0; 1772 } 1773 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1774 1775 /*************************************************************** 1776 * Kernel crypto API interface to register DRBG 1777 ***************************************************************/ 1778 1779 /* 1780 * Look up the DRBG flags by given kernel crypto API cra_name 1781 * The code uses the drbg_cores definition to do this 1782 * 1783 * @cra_name kernel crypto API cra_name 1784 * @coreref reference to integer which is filled with the pointer to 1785 * the applicable core 1786 * @pr reference for setting prediction resistance 1787 * 1788 * return: flags 1789 */ 1790 static inline void drbg_convert_tfm_core(const char *cra_driver_name, 1791 int *coreref, bool *pr) 1792 { 1793 int i = 0; 1794 size_t start = 0; 1795 int len = 0; 1796 1797 *pr = true; 1798 /* disassemble the names */ 1799 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) { 1800 start = 10; 1801 *pr = false; 1802 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) { 1803 start = 8; 1804 } else { 1805 return; 1806 } 1807 1808 /* remove the first part */ 1809 len = strlen(cra_driver_name) - start; 1810 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) { 1811 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name, 1812 len)) { 1813 *coreref = i; 1814 return; 1815 } 1816 } 1817 } 1818 1819 static int drbg_kcapi_init(struct crypto_tfm *tfm) 1820 { 1821 struct drbg_state *drbg = crypto_tfm_ctx(tfm); 1822 1823 mutex_init(&drbg->drbg_mutex); 1824 1825 return 0; 1826 } 1827 1828 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm) 1829 { 1830 drbg_uninstantiate(crypto_tfm_ctx(tfm)); 1831 } 1832 1833 /* 1834 * Generate random numbers invoked by the kernel crypto API: 1835 * The API of the kernel crypto API is extended as follows: 1836 * 1837 * src is additional input supplied to the RNG. 1838 * slen is the length of src. 1839 * dst is the output buffer where random data is to be stored. 1840 * dlen is the length of dst. 1841 */ 1842 static int drbg_kcapi_random(struct crypto_rng *tfm, 1843 const u8 *src, unsigned int slen, 1844 u8 *dst, unsigned int dlen) 1845 { 1846 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1847 struct drbg_string *addtl = NULL; 1848 struct drbg_string string; 1849 1850 if (slen) { 1851 /* linked list variable is now local to allow modification */ 1852 drbg_string_fill(&string, src, slen); 1853 addtl = &string; 1854 } 1855 1856 return drbg_generate_long(drbg, dst, dlen, addtl); 1857 } 1858 1859 /* 1860 * Seed the DRBG invoked by the kernel crypto API 1861 */ 1862 static int drbg_kcapi_seed(struct crypto_rng *tfm, 1863 const u8 *seed, unsigned int slen) 1864 { 1865 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1866 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm); 1867 bool pr = false; 1868 struct drbg_string string; 1869 struct drbg_string *seed_string = NULL; 1870 int coreref = 0; 1871 1872 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref, 1873 &pr); 1874 if (0 < slen) { 1875 drbg_string_fill(&string, seed, slen); 1876 seed_string = &string; 1877 } 1878 1879 return drbg_instantiate(drbg, seed_string, coreref, pr); 1880 } 1881 1882 /*************************************************************** 1883 * Kernel module: code to load the module 1884 ***************************************************************/ 1885 1886 /* 1887 * Tests as defined in 11.3.2 in addition to the cipher tests: testing 1888 * of the error handling. 1889 * 1890 * Note: testing of failing seed source as defined in 11.3.2 is not applicable 1891 * as seed source of get_random_bytes does not fail. 1892 * 1893 * Note 2: There is no sensible way of testing the reseed counter 1894 * enforcement, so skip it. 1895 */ 1896 static inline int __init drbg_healthcheck_sanity(void) 1897 { 1898 int len = 0; 1899 #define OUTBUFLEN 16 1900 unsigned char buf[OUTBUFLEN]; 1901 struct drbg_state *drbg = NULL; 1902 int ret = -EFAULT; 1903 int rc = -EFAULT; 1904 bool pr = false; 1905 int coreref = 0; 1906 struct drbg_string addtl; 1907 size_t max_addtllen, max_request_bytes; 1908 1909 /* only perform test in FIPS mode */ 1910 if (!fips_enabled) 1911 return 0; 1912 1913 #ifdef CONFIG_CRYPTO_DRBG_CTR 1914 drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr); 1915 #elif defined CONFIG_CRYPTO_DRBG_HASH 1916 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr); 1917 #else 1918 drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr); 1919 #endif 1920 1921 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL); 1922 if (!drbg) 1923 return -ENOMEM; 1924 1925 mutex_init(&drbg->drbg_mutex); 1926 drbg->core = &drbg_cores[coreref]; 1927 drbg->reseed_threshold = drbg_max_requests(drbg); 1928 1929 /* 1930 * if the following tests fail, it is likely that there is a buffer 1931 * overflow as buf is much smaller than the requested or provided 1932 * string lengths -- in case the error handling does not succeed 1933 * we may get an OOPS. And we want to get an OOPS as this is a 1934 * grave bug. 1935 */ 1936 1937 max_addtllen = drbg_max_addtl(drbg); 1938 max_request_bytes = drbg_max_request_bytes(drbg); 1939 drbg_string_fill(&addtl, buf, max_addtllen + 1); 1940 /* overflow addtllen with additonal info string */ 1941 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl); 1942 BUG_ON(0 < len); 1943 /* overflow max_bits */ 1944 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL); 1945 BUG_ON(0 < len); 1946 1947 /* overflow max addtllen with personalization string */ 1948 ret = drbg_seed(drbg, &addtl, false); 1949 BUG_ON(0 == ret); 1950 /* all tests passed */ 1951 rc = 0; 1952 1953 pr_devel("DRBG: Sanity tests for failure code paths successfully " 1954 "completed\n"); 1955 1956 kfree(drbg); 1957 return rc; 1958 } 1959 1960 static struct rng_alg drbg_algs[22]; 1961 1962 /* 1963 * Fill the array drbg_algs used to register the different DRBGs 1964 * with the kernel crypto API. To fill the array, the information 1965 * from drbg_cores[] is used. 1966 */ 1967 static inline void __init drbg_fill_array(struct rng_alg *alg, 1968 const struct drbg_core *core, int pr) 1969 { 1970 int pos = 0; 1971 static int priority = 200; 1972 1973 memcpy(alg->base.cra_name, "stdrng", 6); 1974 if (pr) { 1975 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8); 1976 pos = 8; 1977 } else { 1978 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10); 1979 pos = 10; 1980 } 1981 memcpy(alg->base.cra_driver_name + pos, core->cra_name, 1982 strlen(core->cra_name)); 1983 1984 alg->base.cra_priority = priority; 1985 priority++; 1986 /* 1987 * If FIPS mode enabled, the selected DRBG shall have the 1988 * highest cra_priority over other stdrng instances to ensure 1989 * it is selected. 1990 */ 1991 if (fips_enabled) 1992 alg->base.cra_priority += 200; 1993 1994 alg->base.cra_ctxsize = sizeof(struct drbg_state); 1995 alg->base.cra_module = THIS_MODULE; 1996 alg->base.cra_init = drbg_kcapi_init; 1997 alg->base.cra_exit = drbg_kcapi_cleanup; 1998 alg->generate = drbg_kcapi_random; 1999 alg->seed = drbg_kcapi_seed; 2000 alg->set_ent = drbg_kcapi_set_entropy; 2001 alg->seedsize = 0; 2002 } 2003 2004 static int __init drbg_init(void) 2005 { 2006 unsigned int i = 0; /* pointer to drbg_algs */ 2007 unsigned int j = 0; /* pointer to drbg_cores */ 2008 int ret; 2009 2010 ret = drbg_healthcheck_sanity(); 2011 if (ret) 2012 return ret; 2013 2014 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) { 2015 pr_info("DRBG: Cannot register all DRBG types" 2016 "(slots needed: %zu, slots available: %zu)\n", 2017 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs)); 2018 return -EFAULT; 2019 } 2020 2021 /* 2022 * each DRBG definition can be used with PR and without PR, thus 2023 * we instantiate each DRBG in drbg_cores[] twice. 2024 * 2025 * As the order of placing them into the drbg_algs array matters 2026 * (the later DRBGs receive a higher cra_priority) we register the 2027 * prediction resistance DRBGs first as the should not be too 2028 * interesting. 2029 */ 2030 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2031 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1); 2032 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2033 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0); 2034 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2035 } 2036 2037 static void __exit drbg_exit(void) 2038 { 2039 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2040 } 2041 2042 module_init(drbg_init); 2043 module_exit(drbg_exit); 2044 #ifndef CRYPTO_DRBG_HASH_STRING 2045 #define CRYPTO_DRBG_HASH_STRING "" 2046 #endif 2047 #ifndef CRYPTO_DRBG_HMAC_STRING 2048 #define CRYPTO_DRBG_HMAC_STRING "" 2049 #endif 2050 #ifndef CRYPTO_DRBG_CTR_STRING 2051 #define CRYPTO_DRBG_CTR_STRING "" 2052 #endif 2053 MODULE_LICENSE("GPL"); 2054 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); 2055 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) " 2056 "using following cores: " 2057 CRYPTO_DRBG_HASH_STRING 2058 CRYPTO_DRBG_HMAC_STRING 2059 CRYPTO_DRBG_CTR_STRING); 2060 MODULE_ALIAS_CRYPTO("stdrng"); 2061