1 /* 2 * DRBG: Deterministic Random Bits Generator 3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following 4 * properties: 5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores 6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 8 * * with and without prediction resistance 9 * 10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, and the entire permission notice in its entirety, 17 * including the disclaimer of warranties. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. The name of the author may not be used to endorse or promote 22 * products derived from this software without specific prior 23 * written permission. 24 * 25 * ALTERNATIVELY, this product may be distributed under the terms of 26 * the GNU General Public License, in which case the provisions of the GPL are 27 * required INSTEAD OF the above restrictions. (This clause is 28 * necessary due to a potential bad interaction between the GPL and 29 * the restrictions contained in a BSD-style copyright.) 30 * 31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 42 * DAMAGE. 43 * 44 * DRBG Usage 45 * ========== 46 * The SP 800-90A DRBG allows the user to specify a personalization string 47 * for initialization as well as an additional information string for each 48 * random number request. The following code fragments show how a caller 49 * uses the kernel crypto API to use the full functionality of the DRBG. 50 * 51 * Usage without any additional data 52 * --------------------------------- 53 * struct crypto_rng *drng; 54 * int err; 55 * char data[DATALEN]; 56 * 57 * drng = crypto_alloc_rng(drng_name, 0, 0); 58 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 59 * crypto_free_rng(drng); 60 * 61 * 62 * Usage with personalization string during initialization 63 * ------------------------------------------------------- 64 * struct crypto_rng *drng; 65 * int err; 66 * char data[DATALEN]; 67 * struct drbg_string pers; 68 * char personalization[11] = "some-string"; 69 * 70 * drbg_string_fill(&pers, personalization, strlen(personalization)); 71 * drng = crypto_alloc_rng(drng_name, 0, 0); 72 * // The reset completely re-initializes the DRBG with the provided 73 * // personalization string 74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization)); 75 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 76 * crypto_free_rng(drng); 77 * 78 * 79 * Usage with additional information string during random number request 80 * --------------------------------------------------------------------- 81 * struct crypto_rng *drng; 82 * int err; 83 * char data[DATALEN]; 84 * char addtl_string[11] = "some-string"; 85 * string drbg_string addtl; 86 * 87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string)); 88 * drng = crypto_alloc_rng(drng_name, 0, 0); 89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns 90 * // the same error codes. 91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl); 92 * crypto_free_rng(drng); 93 * 94 * 95 * Usage with personalization and additional information strings 96 * ------------------------------------------------------------- 97 * Just mix both scenarios above. 98 */ 99 100 #include <crypto/drbg.h> 101 #include <linux/kernel.h> 102 103 /*************************************************************** 104 * Backend cipher definitions available to DRBG 105 ***************************************************************/ 106 107 /* 108 * The order of the DRBG definitions here matter: every DRBG is registered 109 * as stdrng. Each DRBG receives an increasing cra_priority values the later 110 * they are defined in this array (see drbg_fill_array). 111 * 112 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and 113 * the SHA256 / AES 256 over other ciphers. Thus, the favored 114 * DRBGs are the latest entries in this array. 115 */ 116 static const struct drbg_core drbg_cores[] = { 117 #ifdef CONFIG_CRYPTO_DRBG_CTR 118 { 119 .flags = DRBG_CTR | DRBG_STRENGTH128, 120 .statelen = 32, /* 256 bits as defined in 10.2.1 */ 121 .blocklen_bytes = 16, 122 .cra_name = "ctr_aes128", 123 .backend_cra_name = "aes", 124 }, { 125 .flags = DRBG_CTR | DRBG_STRENGTH192, 126 .statelen = 40, /* 320 bits as defined in 10.2.1 */ 127 .blocklen_bytes = 16, 128 .cra_name = "ctr_aes192", 129 .backend_cra_name = "aes", 130 }, { 131 .flags = DRBG_CTR | DRBG_STRENGTH256, 132 .statelen = 48, /* 384 bits as defined in 10.2.1 */ 133 .blocklen_bytes = 16, 134 .cra_name = "ctr_aes256", 135 .backend_cra_name = "aes", 136 }, 137 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 138 #ifdef CONFIG_CRYPTO_DRBG_HASH 139 { 140 .flags = DRBG_HASH | DRBG_STRENGTH128, 141 .statelen = 55, /* 440 bits */ 142 .blocklen_bytes = 20, 143 .cra_name = "sha1", 144 .backend_cra_name = "sha1", 145 }, { 146 .flags = DRBG_HASH | DRBG_STRENGTH256, 147 .statelen = 111, /* 888 bits */ 148 .blocklen_bytes = 48, 149 .cra_name = "sha384", 150 .backend_cra_name = "sha384", 151 }, { 152 .flags = DRBG_HASH | DRBG_STRENGTH256, 153 .statelen = 111, /* 888 bits */ 154 .blocklen_bytes = 64, 155 .cra_name = "sha512", 156 .backend_cra_name = "sha512", 157 }, { 158 .flags = DRBG_HASH | DRBG_STRENGTH256, 159 .statelen = 55, /* 440 bits */ 160 .blocklen_bytes = 32, 161 .cra_name = "sha256", 162 .backend_cra_name = "sha256", 163 }, 164 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 165 #ifdef CONFIG_CRYPTO_DRBG_HMAC 166 { 167 .flags = DRBG_HMAC | DRBG_STRENGTH128, 168 .statelen = 20, /* block length of cipher */ 169 .blocklen_bytes = 20, 170 .cra_name = "hmac_sha1", 171 .backend_cra_name = "hmac(sha1)", 172 }, { 173 .flags = DRBG_HMAC | DRBG_STRENGTH256, 174 .statelen = 48, /* block length of cipher */ 175 .blocklen_bytes = 48, 176 .cra_name = "hmac_sha384", 177 .backend_cra_name = "hmac(sha384)", 178 }, { 179 .flags = DRBG_HMAC | DRBG_STRENGTH256, 180 .statelen = 64, /* block length of cipher */ 181 .blocklen_bytes = 64, 182 .cra_name = "hmac_sha512", 183 .backend_cra_name = "hmac(sha512)", 184 }, { 185 .flags = DRBG_HMAC | DRBG_STRENGTH256, 186 .statelen = 32, /* block length of cipher */ 187 .blocklen_bytes = 32, 188 .cra_name = "hmac_sha256", 189 .backend_cra_name = "hmac(sha256)", 190 }, 191 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 192 }; 193 194 static int drbg_uninstantiate(struct drbg_state *drbg); 195 196 /****************************************************************** 197 * Generic helper functions 198 ******************************************************************/ 199 200 /* 201 * Return strength of DRBG according to SP800-90A section 8.4 202 * 203 * @flags DRBG flags reference 204 * 205 * Return: normalized strength in *bytes* value or 32 as default 206 * to counter programming errors 207 */ 208 static inline unsigned short drbg_sec_strength(drbg_flag_t flags) 209 { 210 switch (flags & DRBG_STRENGTH_MASK) { 211 case DRBG_STRENGTH128: 212 return 16; 213 case DRBG_STRENGTH192: 214 return 24; 215 case DRBG_STRENGTH256: 216 return 32; 217 default: 218 return 32; 219 } 220 } 221 222 /* 223 * FIPS 140-2 continuous self test for the noise source 224 * The test is performed on the noise source input data. Thus, the function 225 * implicitly knows the size of the buffer to be equal to the security 226 * strength. 227 * 228 * Note, this function disregards the nonce trailing the entropy data during 229 * initial seeding. 230 * 231 * drbg->drbg_mutex must have been taken. 232 * 233 * @drbg DRBG handle 234 * @entropy buffer of seed data to be checked 235 * 236 * return: 237 * 0 on success 238 * -EAGAIN on when the CTRNG is not yet primed 239 * < 0 on error 240 */ 241 static int drbg_fips_continuous_test(struct drbg_state *drbg, 242 const unsigned char *entropy) 243 { 244 unsigned short entropylen = drbg_sec_strength(drbg->core->flags); 245 int ret = 0; 246 247 if (!IS_ENABLED(CONFIG_CRYPTO_FIPS)) 248 return 0; 249 250 /* skip test if we test the overall system */ 251 if (list_empty(&drbg->test_data.list)) 252 return 0; 253 /* only perform test in FIPS mode */ 254 if (!fips_enabled) 255 return 0; 256 257 if (!drbg->fips_primed) { 258 /* Priming of FIPS test */ 259 memcpy(drbg->prev, entropy, entropylen); 260 drbg->fips_primed = true; 261 /* priming: another round is needed */ 262 return -EAGAIN; 263 } 264 ret = memcmp(drbg->prev, entropy, entropylen); 265 if (!ret) 266 panic("DRBG continuous self test failed\n"); 267 memcpy(drbg->prev, entropy, entropylen); 268 269 /* the test shall pass when the two values are not equal */ 270 return 0; 271 } 272 273 /* 274 * Convert an integer into a byte representation of this integer. 275 * The byte representation is big-endian 276 * 277 * @val value to be converted 278 * @buf buffer holding the converted integer -- caller must ensure that 279 * buffer size is at least 32 bit 280 */ 281 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR)) 282 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf) 283 { 284 struct s { 285 __be32 conv; 286 }; 287 struct s *conversion = (struct s *) buf; 288 289 conversion->conv = cpu_to_be32(val); 290 } 291 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */ 292 293 /****************************************************************** 294 * CTR DRBG callback functions 295 ******************************************************************/ 296 297 #ifdef CONFIG_CRYPTO_DRBG_CTR 298 #define CRYPTO_DRBG_CTR_STRING "CTR " 299 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256"); 300 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256"); 301 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192"); 302 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192"); 303 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128"); 304 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128"); 305 306 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 307 const unsigned char *key); 308 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 309 const struct drbg_string *in); 310 static int drbg_init_sym_kernel(struct drbg_state *drbg); 311 static int drbg_fini_sym_kernel(struct drbg_state *drbg); 312 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 313 u8 *inbuf, u32 inbuflen, 314 u8 *outbuf, u32 outlen); 315 #define DRBG_OUTSCRATCHLEN 256 316 317 /* BCC function for CTR DRBG as defined in 10.4.3 */ 318 static int drbg_ctr_bcc(struct drbg_state *drbg, 319 unsigned char *out, const unsigned char *key, 320 struct list_head *in) 321 { 322 int ret = 0; 323 struct drbg_string *curr = NULL; 324 struct drbg_string data; 325 short cnt = 0; 326 327 drbg_string_fill(&data, out, drbg_blocklen(drbg)); 328 329 /* 10.4.3 step 2 / 4 */ 330 drbg_kcapi_symsetkey(drbg, key); 331 list_for_each_entry(curr, in, list) { 332 const unsigned char *pos = curr->buf; 333 size_t len = curr->len; 334 /* 10.4.3 step 4.1 */ 335 while (len) { 336 /* 10.4.3 step 4.2 */ 337 if (drbg_blocklen(drbg) == cnt) { 338 cnt = 0; 339 ret = drbg_kcapi_sym(drbg, out, &data); 340 if (ret) 341 return ret; 342 } 343 out[cnt] ^= *pos; 344 pos++; 345 cnt++; 346 len--; 347 } 348 } 349 /* 10.4.3 step 4.2 for last block */ 350 if (cnt) 351 ret = drbg_kcapi_sym(drbg, out, &data); 352 353 return ret; 354 } 355 356 /* 357 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df 358 * (and drbg_ctr_bcc, but this function does not need any temporary buffers), 359 * the scratchpad is used as follows: 360 * drbg_ctr_update: 361 * temp 362 * start: drbg->scratchpad 363 * length: drbg_statelen(drbg) + drbg_blocklen(drbg) 364 * note: the cipher writing into this variable works 365 * blocklen-wise. Now, when the statelen is not a multiple 366 * of blocklen, the generateion loop below "spills over" 367 * by at most blocklen. Thus, we need to give sufficient 368 * memory. 369 * df_data 370 * start: drbg->scratchpad + 371 * drbg_statelen(drbg) + drbg_blocklen(drbg) 372 * length: drbg_statelen(drbg) 373 * 374 * drbg_ctr_df: 375 * pad 376 * start: df_data + drbg_statelen(drbg) 377 * length: drbg_blocklen(drbg) 378 * iv 379 * start: pad + drbg_blocklen(drbg) 380 * length: drbg_blocklen(drbg) 381 * temp 382 * start: iv + drbg_blocklen(drbg) 383 * length: drbg_satelen(drbg) + drbg_blocklen(drbg) 384 * note: temp is the buffer that the BCC function operates 385 * on. BCC operates blockwise. drbg_statelen(drbg) 386 * is sufficient when the DRBG state length is a multiple 387 * of the block size. For AES192 (and maybe other ciphers) 388 * this is not correct and the length for temp is 389 * insufficient (yes, that also means for such ciphers, 390 * the final output of all BCC rounds are truncated). 391 * Therefore, add drbg_blocklen(drbg) to cover all 392 * possibilities. 393 */ 394 395 /* Derivation Function for CTR DRBG as defined in 10.4.2 */ 396 static int drbg_ctr_df(struct drbg_state *drbg, 397 unsigned char *df_data, size_t bytes_to_return, 398 struct list_head *seedlist) 399 { 400 int ret = -EFAULT; 401 unsigned char L_N[8]; 402 /* S3 is input */ 403 struct drbg_string S1, S2, S4, cipherin; 404 LIST_HEAD(bcc_list); 405 unsigned char *pad = df_data + drbg_statelen(drbg); 406 unsigned char *iv = pad + drbg_blocklen(drbg); 407 unsigned char *temp = iv + drbg_blocklen(drbg); 408 size_t padlen = 0; 409 unsigned int templen = 0; 410 /* 10.4.2 step 7 */ 411 unsigned int i = 0; 412 /* 10.4.2 step 8 */ 413 const unsigned char *K = (unsigned char *) 414 "\x00\x01\x02\x03\x04\x05\x06\x07" 415 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" 416 "\x10\x11\x12\x13\x14\x15\x16\x17" 417 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"; 418 unsigned char *X; 419 size_t generated_len = 0; 420 size_t inputlen = 0; 421 struct drbg_string *seed = NULL; 422 423 memset(pad, 0, drbg_blocklen(drbg)); 424 memset(iv, 0, drbg_blocklen(drbg)); 425 426 /* 10.4.2 step 1 is implicit as we work byte-wise */ 427 428 /* 10.4.2 step 2 */ 429 if ((512/8) < bytes_to_return) 430 return -EINVAL; 431 432 /* 10.4.2 step 2 -- calculate the entire length of all input data */ 433 list_for_each_entry(seed, seedlist, list) 434 inputlen += seed->len; 435 drbg_cpu_to_be32(inputlen, &L_N[0]); 436 437 /* 10.4.2 step 3 */ 438 drbg_cpu_to_be32(bytes_to_return, &L_N[4]); 439 440 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */ 441 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg)); 442 /* wrap the padlen appropriately */ 443 if (padlen) 444 padlen = drbg_blocklen(drbg) - padlen; 445 /* 446 * pad / padlen contains the 0x80 byte and the following zero bytes. 447 * As the calculated padlen value only covers the number of zero 448 * bytes, this value has to be incremented by one for the 0x80 byte. 449 */ 450 padlen++; 451 pad[0] = 0x80; 452 453 /* 10.4.2 step 4 -- first fill the linked list and then order it */ 454 drbg_string_fill(&S1, iv, drbg_blocklen(drbg)); 455 list_add_tail(&S1.list, &bcc_list); 456 drbg_string_fill(&S2, L_N, sizeof(L_N)); 457 list_add_tail(&S2.list, &bcc_list); 458 list_splice_tail(seedlist, &bcc_list); 459 drbg_string_fill(&S4, pad, padlen); 460 list_add_tail(&S4.list, &bcc_list); 461 462 /* 10.4.2 step 9 */ 463 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) { 464 /* 465 * 10.4.2 step 9.1 - the padding is implicit as the buffer 466 * holds zeros after allocation -- even the increment of i 467 * is irrelevant as the increment remains within length of i 468 */ 469 drbg_cpu_to_be32(i, iv); 470 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */ 471 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list); 472 if (ret) 473 goto out; 474 /* 10.4.2 step 9.3 */ 475 i++; 476 templen += drbg_blocklen(drbg); 477 } 478 479 /* 10.4.2 step 11 */ 480 X = temp + (drbg_keylen(drbg)); 481 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg)); 482 483 /* 10.4.2 step 12: overwriting of outval is implemented in next step */ 484 485 /* 10.4.2 step 13 */ 486 drbg_kcapi_symsetkey(drbg, temp); 487 while (generated_len < bytes_to_return) { 488 short blocklen = 0; 489 /* 490 * 10.4.2 step 13.1: the truncation of the key length is 491 * implicit as the key is only drbg_blocklen in size based on 492 * the implementation of the cipher function callback 493 */ 494 ret = drbg_kcapi_sym(drbg, X, &cipherin); 495 if (ret) 496 goto out; 497 blocklen = (drbg_blocklen(drbg) < 498 (bytes_to_return - generated_len)) ? 499 drbg_blocklen(drbg) : 500 (bytes_to_return - generated_len); 501 /* 10.4.2 step 13.2 and 14 */ 502 memcpy(df_data + generated_len, X, blocklen); 503 generated_len += blocklen; 504 } 505 506 ret = 0; 507 508 out: 509 memset(iv, 0, drbg_blocklen(drbg)); 510 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 511 memset(pad, 0, drbg_blocklen(drbg)); 512 return ret; 513 } 514 515 /* 516 * update function of CTR DRBG as defined in 10.2.1.2 517 * 518 * The reseed variable has an enhanced meaning compared to the update 519 * functions of the other DRBGs as follows: 520 * 0 => initial seed from initialization 521 * 1 => reseed via drbg_seed 522 * 2 => first invocation from drbg_ctr_update when addtl is present. In 523 * this case, the df_data scratchpad is not deleted so that it is 524 * available for another calls to prevent calling the DF function 525 * again. 526 * 3 => second invocation from drbg_ctr_update. When the update function 527 * was called with addtl, the df_data memory already contains the 528 * DFed addtl information and we do not need to call DF again. 529 */ 530 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed, 531 int reseed) 532 { 533 int ret = -EFAULT; 534 /* 10.2.1.2 step 1 */ 535 unsigned char *temp = drbg->scratchpad; 536 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) + 537 drbg_blocklen(drbg); 538 539 if (3 > reseed) 540 memset(df_data, 0, drbg_statelen(drbg)); 541 542 if (!reseed) { 543 /* 544 * The DRBG uses the CTR mode of the underlying AES cipher. The 545 * CTR mode increments the counter value after the AES operation 546 * but SP800-90A requires that the counter is incremented before 547 * the AES operation. Hence, we increment it at the time we set 548 * it by one. 549 */ 550 crypto_inc(drbg->V, drbg_blocklen(drbg)); 551 552 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C, 553 drbg_keylen(drbg)); 554 if (ret) 555 goto out; 556 } 557 558 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */ 559 if (seed) { 560 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed); 561 if (ret) 562 goto out; 563 } 564 565 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg), 566 temp, drbg_statelen(drbg)); 567 if (ret) 568 return ret; 569 570 /* 10.2.1.2 step 5 */ 571 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp, 572 drbg_keylen(drbg)); 573 if (ret) 574 goto out; 575 /* 10.2.1.2 step 6 */ 576 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg)); 577 /* See above: increment counter by one to compensate timing of CTR op */ 578 crypto_inc(drbg->V, drbg_blocklen(drbg)); 579 ret = 0; 580 581 out: 582 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 583 if (2 != reseed) 584 memset(df_data, 0, drbg_statelen(drbg)); 585 return ret; 586 } 587 588 /* 589 * scratchpad use: drbg_ctr_update is called independently from 590 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused 591 */ 592 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */ 593 static int drbg_ctr_generate(struct drbg_state *drbg, 594 unsigned char *buf, unsigned int buflen, 595 struct list_head *addtl) 596 { 597 int ret; 598 int len = min_t(int, buflen, INT_MAX); 599 600 /* 10.2.1.5.2 step 2 */ 601 if (addtl && !list_empty(addtl)) { 602 ret = drbg_ctr_update(drbg, addtl, 2); 603 if (ret) 604 return 0; 605 } 606 607 /* 10.2.1.5.2 step 4.1 */ 608 ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len); 609 if (ret) 610 return ret; 611 612 /* 10.2.1.5.2 step 6 */ 613 ret = drbg_ctr_update(drbg, NULL, 3); 614 if (ret) 615 len = ret; 616 617 return len; 618 } 619 620 static const struct drbg_state_ops drbg_ctr_ops = { 621 .update = drbg_ctr_update, 622 .generate = drbg_ctr_generate, 623 .crypto_init = drbg_init_sym_kernel, 624 .crypto_fini = drbg_fini_sym_kernel, 625 }; 626 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 627 628 /****************************************************************** 629 * HMAC DRBG callback functions 630 ******************************************************************/ 631 632 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 633 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 634 const struct list_head *in); 635 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 636 const unsigned char *key); 637 static int drbg_init_hash_kernel(struct drbg_state *drbg); 638 static int drbg_fini_hash_kernel(struct drbg_state *drbg); 639 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 640 641 #ifdef CONFIG_CRYPTO_DRBG_HMAC 642 #define CRYPTO_DRBG_HMAC_STRING "HMAC " 643 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512"); 644 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512"); 645 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384"); 646 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384"); 647 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256"); 648 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256"); 649 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1"); 650 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1"); 651 652 /* update function of HMAC DRBG as defined in 10.1.2.2 */ 653 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed, 654 int reseed) 655 { 656 int ret = -EFAULT; 657 int i = 0; 658 struct drbg_string seed1, seed2, vdata; 659 LIST_HEAD(seedlist); 660 LIST_HEAD(vdatalist); 661 662 if (!reseed) { 663 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */ 664 memset(drbg->V, 1, drbg_statelen(drbg)); 665 drbg_kcapi_hmacsetkey(drbg, drbg->C); 666 } 667 668 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg)); 669 list_add_tail(&seed1.list, &seedlist); 670 /* buffer of seed2 will be filled in for loop below with one byte */ 671 drbg_string_fill(&seed2, NULL, 1); 672 list_add_tail(&seed2.list, &seedlist); 673 /* input data of seed is allowed to be NULL at this point */ 674 if (seed) 675 list_splice_tail(seed, &seedlist); 676 677 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg)); 678 list_add_tail(&vdata.list, &vdatalist); 679 for (i = 2; 0 < i; i--) { 680 /* first round uses 0x0, second 0x1 */ 681 unsigned char prefix = DRBG_PREFIX0; 682 if (1 == i) 683 prefix = DRBG_PREFIX1; 684 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */ 685 seed2.buf = &prefix; 686 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist); 687 if (ret) 688 return ret; 689 drbg_kcapi_hmacsetkey(drbg, drbg->C); 690 691 /* 10.1.2.2 step 2 and 5 -- HMAC for V */ 692 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist); 693 if (ret) 694 return ret; 695 696 /* 10.1.2.2 step 3 */ 697 if (!seed) 698 return ret; 699 } 700 701 return 0; 702 } 703 704 /* generate function of HMAC DRBG as defined in 10.1.2.5 */ 705 static int drbg_hmac_generate(struct drbg_state *drbg, 706 unsigned char *buf, 707 unsigned int buflen, 708 struct list_head *addtl) 709 { 710 int len = 0; 711 int ret = 0; 712 struct drbg_string data; 713 LIST_HEAD(datalist); 714 715 /* 10.1.2.5 step 2 */ 716 if (addtl && !list_empty(addtl)) { 717 ret = drbg_hmac_update(drbg, addtl, 1); 718 if (ret) 719 return ret; 720 } 721 722 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg)); 723 list_add_tail(&data.list, &datalist); 724 while (len < buflen) { 725 unsigned int outlen = 0; 726 /* 10.1.2.5 step 4.1 */ 727 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist); 728 if (ret) 729 return ret; 730 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 731 drbg_blocklen(drbg) : (buflen - len); 732 733 /* 10.1.2.5 step 4.2 */ 734 memcpy(buf + len, drbg->V, outlen); 735 len += outlen; 736 } 737 738 /* 10.1.2.5 step 6 */ 739 if (addtl && !list_empty(addtl)) 740 ret = drbg_hmac_update(drbg, addtl, 1); 741 else 742 ret = drbg_hmac_update(drbg, NULL, 1); 743 if (ret) 744 return ret; 745 746 return len; 747 } 748 749 static const struct drbg_state_ops drbg_hmac_ops = { 750 .update = drbg_hmac_update, 751 .generate = drbg_hmac_generate, 752 .crypto_init = drbg_init_hash_kernel, 753 .crypto_fini = drbg_fini_hash_kernel, 754 }; 755 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 756 757 /****************************************************************** 758 * Hash DRBG callback functions 759 ******************************************************************/ 760 761 #ifdef CONFIG_CRYPTO_DRBG_HASH 762 #define CRYPTO_DRBG_HASH_STRING "HASH " 763 MODULE_ALIAS_CRYPTO("drbg_pr_sha512"); 764 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512"); 765 MODULE_ALIAS_CRYPTO("drbg_pr_sha384"); 766 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384"); 767 MODULE_ALIAS_CRYPTO("drbg_pr_sha256"); 768 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256"); 769 MODULE_ALIAS_CRYPTO("drbg_pr_sha1"); 770 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1"); 771 772 /* 773 * Increment buffer 774 * 775 * @dst buffer to increment 776 * @add value to add 777 */ 778 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen, 779 const unsigned char *add, size_t addlen) 780 { 781 /* implied: dstlen > addlen */ 782 unsigned char *dstptr; 783 const unsigned char *addptr; 784 unsigned int remainder = 0; 785 size_t len = addlen; 786 787 dstptr = dst + (dstlen-1); 788 addptr = add + (addlen-1); 789 while (len) { 790 remainder += *dstptr + *addptr; 791 *dstptr = remainder & 0xff; 792 remainder >>= 8; 793 len--; dstptr--; addptr--; 794 } 795 len = dstlen - addlen; 796 while (len && remainder > 0) { 797 remainder = *dstptr + 1; 798 *dstptr = remainder & 0xff; 799 remainder >>= 8; 800 len--; dstptr--; 801 } 802 } 803 804 /* 805 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used 806 * interlinked, the scratchpad is used as follows: 807 * drbg_hash_update 808 * start: drbg->scratchpad 809 * length: drbg_statelen(drbg) 810 * drbg_hash_df: 811 * start: drbg->scratchpad + drbg_statelen(drbg) 812 * length: drbg_blocklen(drbg) 813 * 814 * drbg_hash_process_addtl uses the scratchpad, but fully completes 815 * before either of the functions mentioned before are invoked. Therefore, 816 * drbg_hash_process_addtl does not need to be specifically considered. 817 */ 818 819 /* Derivation Function for Hash DRBG as defined in 10.4.1 */ 820 static int drbg_hash_df(struct drbg_state *drbg, 821 unsigned char *outval, size_t outlen, 822 struct list_head *entropylist) 823 { 824 int ret = 0; 825 size_t len = 0; 826 unsigned char input[5]; 827 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg); 828 struct drbg_string data; 829 830 /* 10.4.1 step 3 */ 831 input[0] = 1; 832 drbg_cpu_to_be32((outlen * 8), &input[1]); 833 834 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */ 835 drbg_string_fill(&data, input, 5); 836 list_add(&data.list, entropylist); 837 838 /* 10.4.1 step 4 */ 839 while (len < outlen) { 840 short blocklen = 0; 841 /* 10.4.1 step 4.1 */ 842 ret = drbg_kcapi_hash(drbg, tmp, entropylist); 843 if (ret) 844 goto out; 845 /* 10.4.1 step 4.2 */ 846 input[0]++; 847 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ? 848 drbg_blocklen(drbg) : (outlen - len); 849 memcpy(outval + len, tmp, blocklen); 850 len += blocklen; 851 } 852 853 out: 854 memset(tmp, 0, drbg_blocklen(drbg)); 855 return ret; 856 } 857 858 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */ 859 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed, 860 int reseed) 861 { 862 int ret = 0; 863 struct drbg_string data1, data2; 864 LIST_HEAD(datalist); 865 LIST_HEAD(datalist2); 866 unsigned char *V = drbg->scratchpad; 867 unsigned char prefix = DRBG_PREFIX1; 868 869 if (!seed) 870 return -EINVAL; 871 872 if (reseed) { 873 /* 10.1.1.3 step 1 */ 874 memcpy(V, drbg->V, drbg_statelen(drbg)); 875 drbg_string_fill(&data1, &prefix, 1); 876 list_add_tail(&data1.list, &datalist); 877 drbg_string_fill(&data2, V, drbg_statelen(drbg)); 878 list_add_tail(&data2.list, &datalist); 879 } 880 list_splice_tail(seed, &datalist); 881 882 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */ 883 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist); 884 if (ret) 885 goto out; 886 887 /* 10.1.1.2 / 10.1.1.3 step 4 */ 888 prefix = DRBG_PREFIX0; 889 drbg_string_fill(&data1, &prefix, 1); 890 list_add_tail(&data1.list, &datalist2); 891 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 892 list_add_tail(&data2.list, &datalist2); 893 /* 10.1.1.2 / 10.1.1.3 step 4 */ 894 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2); 895 896 out: 897 memset(drbg->scratchpad, 0, drbg_statelen(drbg)); 898 return ret; 899 } 900 901 /* processing of additional information string for Hash DRBG */ 902 static int drbg_hash_process_addtl(struct drbg_state *drbg, 903 struct list_head *addtl) 904 { 905 int ret = 0; 906 struct drbg_string data1, data2; 907 LIST_HEAD(datalist); 908 unsigned char prefix = DRBG_PREFIX2; 909 910 /* 10.1.1.4 step 2 */ 911 if (!addtl || list_empty(addtl)) 912 return 0; 913 914 /* 10.1.1.4 step 2a */ 915 drbg_string_fill(&data1, &prefix, 1); 916 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 917 list_add_tail(&data1.list, &datalist); 918 list_add_tail(&data2.list, &datalist); 919 list_splice_tail(addtl, &datalist); 920 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 921 if (ret) 922 goto out; 923 924 /* 10.1.1.4 step 2b */ 925 drbg_add_buf(drbg->V, drbg_statelen(drbg), 926 drbg->scratchpad, drbg_blocklen(drbg)); 927 928 out: 929 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 930 return ret; 931 } 932 933 /* Hashgen defined in 10.1.1.4 */ 934 static int drbg_hash_hashgen(struct drbg_state *drbg, 935 unsigned char *buf, 936 unsigned int buflen) 937 { 938 int len = 0; 939 int ret = 0; 940 unsigned char *src = drbg->scratchpad; 941 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg); 942 struct drbg_string data; 943 LIST_HEAD(datalist); 944 945 /* 10.1.1.4 step hashgen 2 */ 946 memcpy(src, drbg->V, drbg_statelen(drbg)); 947 948 drbg_string_fill(&data, src, drbg_statelen(drbg)); 949 list_add_tail(&data.list, &datalist); 950 while (len < buflen) { 951 unsigned int outlen = 0; 952 /* 10.1.1.4 step hashgen 4.1 */ 953 ret = drbg_kcapi_hash(drbg, dst, &datalist); 954 if (ret) { 955 len = ret; 956 goto out; 957 } 958 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 959 drbg_blocklen(drbg) : (buflen - len); 960 /* 10.1.1.4 step hashgen 4.2 */ 961 memcpy(buf + len, dst, outlen); 962 len += outlen; 963 /* 10.1.1.4 hashgen step 4.3 */ 964 if (len < buflen) 965 crypto_inc(src, drbg_statelen(drbg)); 966 } 967 968 out: 969 memset(drbg->scratchpad, 0, 970 (drbg_statelen(drbg) + drbg_blocklen(drbg))); 971 return len; 972 } 973 974 /* generate function for Hash DRBG as defined in 10.1.1.4 */ 975 static int drbg_hash_generate(struct drbg_state *drbg, 976 unsigned char *buf, unsigned int buflen, 977 struct list_head *addtl) 978 { 979 int len = 0; 980 int ret = 0; 981 union { 982 unsigned char req[8]; 983 __be64 req_int; 984 } u; 985 unsigned char prefix = DRBG_PREFIX3; 986 struct drbg_string data1, data2; 987 LIST_HEAD(datalist); 988 989 /* 10.1.1.4 step 2 */ 990 ret = drbg_hash_process_addtl(drbg, addtl); 991 if (ret) 992 return ret; 993 /* 10.1.1.4 step 3 */ 994 len = drbg_hash_hashgen(drbg, buf, buflen); 995 996 /* this is the value H as documented in 10.1.1.4 */ 997 /* 10.1.1.4 step 4 */ 998 drbg_string_fill(&data1, &prefix, 1); 999 list_add_tail(&data1.list, &datalist); 1000 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 1001 list_add_tail(&data2.list, &datalist); 1002 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 1003 if (ret) { 1004 len = ret; 1005 goto out; 1006 } 1007 1008 /* 10.1.1.4 step 5 */ 1009 drbg_add_buf(drbg->V, drbg_statelen(drbg), 1010 drbg->scratchpad, drbg_blocklen(drbg)); 1011 drbg_add_buf(drbg->V, drbg_statelen(drbg), 1012 drbg->C, drbg_statelen(drbg)); 1013 u.req_int = cpu_to_be64(drbg->reseed_ctr); 1014 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8); 1015 1016 out: 1017 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 1018 return len; 1019 } 1020 1021 /* 1022 * scratchpad usage: as update and generate are used isolated, both 1023 * can use the scratchpad 1024 */ 1025 static const struct drbg_state_ops drbg_hash_ops = { 1026 .update = drbg_hash_update, 1027 .generate = drbg_hash_generate, 1028 .crypto_init = drbg_init_hash_kernel, 1029 .crypto_fini = drbg_fini_hash_kernel, 1030 }; 1031 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 1032 1033 /****************************************************************** 1034 * Functions common for DRBG implementations 1035 ******************************************************************/ 1036 1037 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed, 1038 int reseed) 1039 { 1040 int ret = drbg->d_ops->update(drbg, seed, reseed); 1041 1042 if (ret) 1043 return ret; 1044 1045 drbg->seeded = true; 1046 /* 10.1.1.2 / 10.1.1.3 step 5 */ 1047 drbg->reseed_ctr = 1; 1048 1049 return ret; 1050 } 1051 1052 static inline int drbg_get_random_bytes(struct drbg_state *drbg, 1053 unsigned char *entropy, 1054 unsigned int entropylen) 1055 { 1056 int ret; 1057 1058 do { 1059 get_random_bytes(entropy, entropylen); 1060 ret = drbg_fips_continuous_test(drbg, entropy); 1061 if (ret && ret != -EAGAIN) 1062 return ret; 1063 } while (ret); 1064 1065 return 0; 1066 } 1067 1068 static void drbg_async_seed(struct work_struct *work) 1069 { 1070 struct drbg_string data; 1071 LIST_HEAD(seedlist); 1072 struct drbg_state *drbg = container_of(work, struct drbg_state, 1073 seed_work); 1074 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1075 unsigned char entropy[32]; 1076 int ret; 1077 1078 BUG_ON(!entropylen); 1079 BUG_ON(entropylen > sizeof(entropy)); 1080 1081 drbg_string_fill(&data, entropy, entropylen); 1082 list_add_tail(&data.list, &seedlist); 1083 1084 mutex_lock(&drbg->drbg_mutex); 1085 1086 ret = drbg_get_random_bytes(drbg, entropy, entropylen); 1087 if (ret) 1088 goto unlock; 1089 1090 /* Set seeded to false so that if __drbg_seed fails the 1091 * next generate call will trigger a reseed. 1092 */ 1093 drbg->seeded = false; 1094 1095 __drbg_seed(drbg, &seedlist, true); 1096 1097 if (drbg->seeded) 1098 drbg->reseed_threshold = drbg_max_requests(drbg); 1099 1100 unlock: 1101 mutex_unlock(&drbg->drbg_mutex); 1102 1103 memzero_explicit(entropy, entropylen); 1104 } 1105 1106 /* 1107 * Seeding or reseeding of the DRBG 1108 * 1109 * @drbg: DRBG state struct 1110 * @pers: personalization / additional information buffer 1111 * @reseed: 0 for initial seed process, 1 for reseeding 1112 * 1113 * return: 1114 * 0 on success 1115 * error value otherwise 1116 */ 1117 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers, 1118 bool reseed) 1119 { 1120 int ret; 1121 unsigned char entropy[((32 + 16) * 2)]; 1122 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1123 struct drbg_string data1; 1124 LIST_HEAD(seedlist); 1125 1126 /* 9.1 / 9.2 / 9.3.1 step 3 */ 1127 if (pers && pers->len > (drbg_max_addtl(drbg))) { 1128 pr_devel("DRBG: personalization string too long %zu\n", 1129 pers->len); 1130 return -EINVAL; 1131 } 1132 1133 if (list_empty(&drbg->test_data.list)) { 1134 drbg_string_fill(&data1, drbg->test_data.buf, 1135 drbg->test_data.len); 1136 pr_devel("DRBG: using test entropy\n"); 1137 } else { 1138 /* 1139 * Gather entropy equal to the security strength of the DRBG. 1140 * With a derivation function, a nonce is required in addition 1141 * to the entropy. A nonce must be at least 1/2 of the security 1142 * strength of the DRBG in size. Thus, entropy + nonce is 3/2 1143 * of the strength. The consideration of a nonce is only 1144 * applicable during initial seeding. 1145 */ 1146 BUG_ON(!entropylen); 1147 if (!reseed) 1148 entropylen = ((entropylen + 1) / 2) * 3; 1149 BUG_ON((entropylen * 2) > sizeof(entropy)); 1150 1151 /* Get seed from in-kernel /dev/urandom */ 1152 ret = drbg_get_random_bytes(drbg, entropy, entropylen); 1153 if (ret) 1154 goto out; 1155 1156 if (!drbg->jent) { 1157 drbg_string_fill(&data1, entropy, entropylen); 1158 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1159 entropylen); 1160 } else { 1161 /* Get seed from Jitter RNG */ 1162 ret = crypto_rng_get_bytes(drbg->jent, 1163 entropy + entropylen, 1164 entropylen); 1165 if (ret) { 1166 pr_devel("DRBG: jent failed with %d\n", ret); 1167 1168 /* 1169 * Do not treat the transient failure of the 1170 * Jitter RNG as an error that needs to be 1171 * reported. The combined number of the 1172 * maximum reseed threshold times the maximum 1173 * number of Jitter RNG transient errors is 1174 * less than the reseed threshold required by 1175 * SP800-90A allowing us to treat the 1176 * transient errors as such. 1177 * 1178 * However, we mandate that at least the first 1179 * seeding operation must succeed with the 1180 * Jitter RNG. 1181 */ 1182 if (!reseed || ret != -EAGAIN) 1183 goto out; 1184 } 1185 1186 drbg_string_fill(&data1, entropy, entropylen * 2); 1187 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1188 entropylen * 2); 1189 } 1190 } 1191 list_add_tail(&data1.list, &seedlist); 1192 1193 /* 1194 * concatenation of entropy with personalization str / addtl input) 1195 * the variable pers is directly handed in by the caller, so check its 1196 * contents whether it is appropriate 1197 */ 1198 if (pers && pers->buf && 0 < pers->len) { 1199 list_add_tail(&pers->list, &seedlist); 1200 pr_devel("DRBG: using personalization string\n"); 1201 } 1202 1203 if (!reseed) { 1204 memset(drbg->V, 0, drbg_statelen(drbg)); 1205 memset(drbg->C, 0, drbg_statelen(drbg)); 1206 } 1207 1208 ret = __drbg_seed(drbg, &seedlist, reseed); 1209 1210 out: 1211 memzero_explicit(entropy, entropylen * 2); 1212 1213 return ret; 1214 } 1215 1216 /* Free all substructures in a DRBG state without the DRBG state structure */ 1217 static inline void drbg_dealloc_state(struct drbg_state *drbg) 1218 { 1219 if (!drbg) 1220 return; 1221 kfree_sensitive(drbg->Vbuf); 1222 drbg->Vbuf = NULL; 1223 drbg->V = NULL; 1224 kfree_sensitive(drbg->Cbuf); 1225 drbg->Cbuf = NULL; 1226 drbg->C = NULL; 1227 kfree_sensitive(drbg->scratchpadbuf); 1228 drbg->scratchpadbuf = NULL; 1229 drbg->reseed_ctr = 0; 1230 drbg->d_ops = NULL; 1231 drbg->core = NULL; 1232 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) { 1233 kfree_sensitive(drbg->prev); 1234 drbg->prev = NULL; 1235 drbg->fips_primed = false; 1236 } 1237 } 1238 1239 /* 1240 * Allocate all sub-structures for a DRBG state. 1241 * The DRBG state structure must already be allocated. 1242 */ 1243 static inline int drbg_alloc_state(struct drbg_state *drbg) 1244 { 1245 int ret = -ENOMEM; 1246 unsigned int sb_size = 0; 1247 1248 switch (drbg->core->flags & DRBG_TYPE_MASK) { 1249 #ifdef CONFIG_CRYPTO_DRBG_HMAC 1250 case DRBG_HMAC: 1251 drbg->d_ops = &drbg_hmac_ops; 1252 break; 1253 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 1254 #ifdef CONFIG_CRYPTO_DRBG_HASH 1255 case DRBG_HASH: 1256 drbg->d_ops = &drbg_hash_ops; 1257 break; 1258 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 1259 #ifdef CONFIG_CRYPTO_DRBG_CTR 1260 case DRBG_CTR: 1261 drbg->d_ops = &drbg_ctr_ops; 1262 break; 1263 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1264 default: 1265 ret = -EOPNOTSUPP; 1266 goto err; 1267 } 1268 1269 ret = drbg->d_ops->crypto_init(drbg); 1270 if (ret < 0) 1271 goto err; 1272 1273 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1274 if (!drbg->Vbuf) { 1275 ret = -ENOMEM; 1276 goto fini; 1277 } 1278 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1); 1279 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1280 if (!drbg->Cbuf) { 1281 ret = -ENOMEM; 1282 goto fini; 1283 } 1284 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1); 1285 /* scratchpad is only generated for CTR and Hash */ 1286 if (drbg->core->flags & DRBG_HMAC) 1287 sb_size = 0; 1288 else if (drbg->core->flags & DRBG_CTR) 1289 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */ 1290 drbg_statelen(drbg) + /* df_data */ 1291 drbg_blocklen(drbg) + /* pad */ 1292 drbg_blocklen(drbg) + /* iv */ 1293 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */ 1294 else 1295 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg); 1296 1297 if (0 < sb_size) { 1298 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL); 1299 if (!drbg->scratchpadbuf) { 1300 ret = -ENOMEM; 1301 goto fini; 1302 } 1303 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1); 1304 } 1305 1306 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) { 1307 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags), 1308 GFP_KERNEL); 1309 if (!drbg->prev) { 1310 ret = -ENOMEM; 1311 goto fini; 1312 } 1313 drbg->fips_primed = false; 1314 } 1315 1316 return 0; 1317 1318 fini: 1319 drbg->d_ops->crypto_fini(drbg); 1320 err: 1321 drbg_dealloc_state(drbg); 1322 return ret; 1323 } 1324 1325 /************************************************************************* 1326 * DRBG interface functions 1327 *************************************************************************/ 1328 1329 /* 1330 * DRBG generate function as required by SP800-90A - this function 1331 * generates random numbers 1332 * 1333 * @drbg DRBG state handle 1334 * @buf Buffer where to store the random numbers -- the buffer must already 1335 * be pre-allocated by caller 1336 * @buflen Length of output buffer - this value defines the number of random 1337 * bytes pulled from DRBG 1338 * @addtl Additional input that is mixed into state, may be NULL -- note 1339 * the entropy is pulled by the DRBG internally unconditionally 1340 * as defined in SP800-90A. The additional input is mixed into 1341 * the state in addition to the pulled entropy. 1342 * 1343 * return: 0 when all bytes are generated; < 0 in case of an error 1344 */ 1345 static int drbg_generate(struct drbg_state *drbg, 1346 unsigned char *buf, unsigned int buflen, 1347 struct drbg_string *addtl) 1348 { 1349 int len = 0; 1350 LIST_HEAD(addtllist); 1351 1352 if (!drbg->core) { 1353 pr_devel("DRBG: not yet seeded\n"); 1354 return -EINVAL; 1355 } 1356 if (0 == buflen || !buf) { 1357 pr_devel("DRBG: no output buffer provided\n"); 1358 return -EINVAL; 1359 } 1360 if (addtl && NULL == addtl->buf && 0 < addtl->len) { 1361 pr_devel("DRBG: wrong format of additional information\n"); 1362 return -EINVAL; 1363 } 1364 1365 /* 9.3.1 step 2 */ 1366 len = -EINVAL; 1367 if (buflen > (drbg_max_request_bytes(drbg))) { 1368 pr_devel("DRBG: requested random numbers too large %u\n", 1369 buflen); 1370 goto err; 1371 } 1372 1373 /* 9.3.1 step 3 is implicit with the chosen DRBG */ 1374 1375 /* 9.3.1 step 4 */ 1376 if (addtl && addtl->len > (drbg_max_addtl(drbg))) { 1377 pr_devel("DRBG: additional information string too long %zu\n", 1378 addtl->len); 1379 goto err; 1380 } 1381 /* 9.3.1 step 5 is implicit with the chosen DRBG */ 1382 1383 /* 1384 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented 1385 * here. The spec is a bit convoluted here, we make it simpler. 1386 */ 1387 if (drbg->reseed_threshold < drbg->reseed_ctr) 1388 drbg->seeded = false; 1389 1390 if (drbg->pr || !drbg->seeded) { 1391 pr_devel("DRBG: reseeding before generation (prediction " 1392 "resistance: %s, state %s)\n", 1393 drbg->pr ? "true" : "false", 1394 drbg->seeded ? "seeded" : "unseeded"); 1395 /* 9.3.1 steps 7.1 through 7.3 */ 1396 len = drbg_seed(drbg, addtl, true); 1397 if (len) 1398 goto err; 1399 /* 9.3.1 step 7.4 */ 1400 addtl = NULL; 1401 } 1402 1403 if (addtl && 0 < addtl->len) 1404 list_add_tail(&addtl->list, &addtllist); 1405 /* 9.3.1 step 8 and 10 */ 1406 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist); 1407 1408 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */ 1409 drbg->reseed_ctr++; 1410 if (0 >= len) 1411 goto err; 1412 1413 /* 1414 * Section 11.3.3 requires to re-perform self tests after some 1415 * generated random numbers. The chosen value after which self 1416 * test is performed is arbitrary, but it should be reasonable. 1417 * However, we do not perform the self tests because of the following 1418 * reasons: it is mathematically impossible that the initial self tests 1419 * were successfully and the following are not. If the initial would 1420 * pass and the following would not, the kernel integrity is violated. 1421 * In this case, the entire kernel operation is questionable and it 1422 * is unlikely that the integrity violation only affects the 1423 * correct operation of the DRBG. 1424 * 1425 * Albeit the following code is commented out, it is provided in 1426 * case somebody has a need to implement the test of 11.3.3. 1427 */ 1428 #if 0 1429 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) { 1430 int err = 0; 1431 pr_devel("DRBG: start to perform self test\n"); 1432 if (drbg->core->flags & DRBG_HMAC) 1433 err = alg_test("drbg_pr_hmac_sha256", 1434 "drbg_pr_hmac_sha256", 0, 0); 1435 else if (drbg->core->flags & DRBG_CTR) 1436 err = alg_test("drbg_pr_ctr_aes128", 1437 "drbg_pr_ctr_aes128", 0, 0); 1438 else 1439 err = alg_test("drbg_pr_sha256", 1440 "drbg_pr_sha256", 0, 0); 1441 if (err) { 1442 pr_err("DRBG: periodical self test failed\n"); 1443 /* 1444 * uninstantiate implies that from now on, only errors 1445 * are returned when reusing this DRBG cipher handle 1446 */ 1447 drbg_uninstantiate(drbg); 1448 return 0; 1449 } else { 1450 pr_devel("DRBG: self test successful\n"); 1451 } 1452 } 1453 #endif 1454 1455 /* 1456 * All operations were successful, return 0 as mandated by 1457 * the kernel crypto API interface. 1458 */ 1459 len = 0; 1460 err: 1461 return len; 1462 } 1463 1464 /* 1465 * Wrapper around drbg_generate which can pull arbitrary long strings 1466 * from the DRBG without hitting the maximum request limitation. 1467 * 1468 * Parameters: see drbg_generate 1469 * Return codes: see drbg_generate -- if one drbg_generate request fails, 1470 * the entire drbg_generate_long request fails 1471 */ 1472 static int drbg_generate_long(struct drbg_state *drbg, 1473 unsigned char *buf, unsigned int buflen, 1474 struct drbg_string *addtl) 1475 { 1476 unsigned int len = 0; 1477 unsigned int slice = 0; 1478 do { 1479 int err = 0; 1480 unsigned int chunk = 0; 1481 slice = ((buflen - len) / drbg_max_request_bytes(drbg)); 1482 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len); 1483 mutex_lock(&drbg->drbg_mutex); 1484 err = drbg_generate(drbg, buf + len, chunk, addtl); 1485 mutex_unlock(&drbg->drbg_mutex); 1486 if (0 > err) 1487 return err; 1488 len += chunk; 1489 } while (slice > 0 && (len < buflen)); 1490 return 0; 1491 } 1492 1493 static void drbg_schedule_async_seed(struct random_ready_callback *rdy) 1494 { 1495 struct drbg_state *drbg = container_of(rdy, struct drbg_state, 1496 random_ready); 1497 1498 schedule_work(&drbg->seed_work); 1499 } 1500 1501 static int drbg_prepare_hrng(struct drbg_state *drbg) 1502 { 1503 int err; 1504 1505 /* We do not need an HRNG in test mode. */ 1506 if (list_empty(&drbg->test_data.list)) 1507 return 0; 1508 1509 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); 1510 1511 INIT_WORK(&drbg->seed_work, drbg_async_seed); 1512 1513 drbg->random_ready.owner = THIS_MODULE; 1514 drbg->random_ready.func = drbg_schedule_async_seed; 1515 1516 err = add_random_ready_callback(&drbg->random_ready); 1517 1518 switch (err) { 1519 case 0: 1520 break; 1521 1522 case -EALREADY: 1523 err = 0; 1524 fallthrough; 1525 1526 default: 1527 drbg->random_ready.func = NULL; 1528 return err; 1529 } 1530 1531 /* 1532 * Require frequent reseeds until the seed source is fully 1533 * initialized. 1534 */ 1535 drbg->reseed_threshold = 50; 1536 1537 return err; 1538 } 1539 1540 /* 1541 * DRBG instantiation function as required by SP800-90A - this function 1542 * sets up the DRBG handle, performs the initial seeding and all sanity 1543 * checks required by SP800-90A 1544 * 1545 * @drbg memory of state -- if NULL, new memory is allocated 1546 * @pers Personalization string that is mixed into state, may be NULL -- note 1547 * the entropy is pulled by the DRBG internally unconditionally 1548 * as defined in SP800-90A. The additional input is mixed into 1549 * the state in addition to the pulled entropy. 1550 * @coreref reference to core 1551 * @pr prediction resistance enabled 1552 * 1553 * return 1554 * 0 on success 1555 * error value otherwise 1556 */ 1557 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, 1558 int coreref, bool pr) 1559 { 1560 int ret; 1561 bool reseed = true; 1562 1563 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance " 1564 "%s\n", coreref, pr ? "enabled" : "disabled"); 1565 mutex_lock(&drbg->drbg_mutex); 1566 1567 /* 9.1 step 1 is implicit with the selected DRBG type */ 1568 1569 /* 1570 * 9.1 step 2 is implicit as caller can select prediction resistance 1571 * and the flag is copied into drbg->flags -- 1572 * all DRBG types support prediction resistance 1573 */ 1574 1575 /* 9.1 step 4 is implicit in drbg_sec_strength */ 1576 1577 if (!drbg->core) { 1578 drbg->core = &drbg_cores[coreref]; 1579 drbg->pr = pr; 1580 drbg->seeded = false; 1581 drbg->reseed_threshold = drbg_max_requests(drbg); 1582 1583 ret = drbg_alloc_state(drbg); 1584 if (ret) 1585 goto unlock; 1586 1587 ret = drbg_prepare_hrng(drbg); 1588 if (ret) 1589 goto free_everything; 1590 1591 if (IS_ERR(drbg->jent)) { 1592 ret = PTR_ERR(drbg->jent); 1593 drbg->jent = NULL; 1594 if (fips_enabled || ret != -ENOENT) 1595 goto free_everything; 1596 pr_info("DRBG: Continuing without Jitter RNG\n"); 1597 } 1598 1599 reseed = false; 1600 } 1601 1602 ret = drbg_seed(drbg, pers, reseed); 1603 1604 if (ret && !reseed) 1605 goto free_everything; 1606 1607 mutex_unlock(&drbg->drbg_mutex); 1608 return ret; 1609 1610 unlock: 1611 mutex_unlock(&drbg->drbg_mutex); 1612 return ret; 1613 1614 free_everything: 1615 mutex_unlock(&drbg->drbg_mutex); 1616 drbg_uninstantiate(drbg); 1617 return ret; 1618 } 1619 1620 /* 1621 * DRBG uninstantiate function as required by SP800-90A - this function 1622 * frees all buffers and the DRBG handle 1623 * 1624 * @drbg DRBG state handle 1625 * 1626 * return 1627 * 0 on success 1628 */ 1629 static int drbg_uninstantiate(struct drbg_state *drbg) 1630 { 1631 if (drbg->random_ready.func) { 1632 del_random_ready_callback(&drbg->random_ready); 1633 cancel_work_sync(&drbg->seed_work); 1634 } 1635 1636 if (!IS_ERR_OR_NULL(drbg->jent)) 1637 crypto_free_rng(drbg->jent); 1638 drbg->jent = NULL; 1639 1640 if (drbg->d_ops) 1641 drbg->d_ops->crypto_fini(drbg); 1642 drbg_dealloc_state(drbg); 1643 /* no scrubbing of test_data -- this shall survive an uninstantiate */ 1644 return 0; 1645 } 1646 1647 /* 1648 * Helper function for setting the test data in the DRBG 1649 * 1650 * @drbg DRBG state handle 1651 * @data test data 1652 * @len test data length 1653 */ 1654 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm, 1655 const u8 *data, unsigned int len) 1656 { 1657 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1658 1659 mutex_lock(&drbg->drbg_mutex); 1660 drbg_string_fill(&drbg->test_data, data, len); 1661 mutex_unlock(&drbg->drbg_mutex); 1662 } 1663 1664 /*************************************************************** 1665 * Kernel crypto API cipher invocations requested by DRBG 1666 ***************************************************************/ 1667 1668 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 1669 struct sdesc { 1670 struct shash_desc shash; 1671 char ctx[]; 1672 }; 1673 1674 static int drbg_init_hash_kernel(struct drbg_state *drbg) 1675 { 1676 struct sdesc *sdesc; 1677 struct crypto_shash *tfm; 1678 1679 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0); 1680 if (IS_ERR(tfm)) { 1681 pr_info("DRBG: could not allocate digest TFM handle: %s\n", 1682 drbg->core->backend_cra_name); 1683 return PTR_ERR(tfm); 1684 } 1685 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm)); 1686 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm), 1687 GFP_KERNEL); 1688 if (!sdesc) { 1689 crypto_free_shash(tfm); 1690 return -ENOMEM; 1691 } 1692 1693 sdesc->shash.tfm = tfm; 1694 drbg->priv_data = sdesc; 1695 1696 return crypto_shash_alignmask(tfm); 1697 } 1698 1699 static int drbg_fini_hash_kernel(struct drbg_state *drbg) 1700 { 1701 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1702 if (sdesc) { 1703 crypto_free_shash(sdesc->shash.tfm); 1704 kfree_sensitive(sdesc); 1705 } 1706 drbg->priv_data = NULL; 1707 return 0; 1708 } 1709 1710 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 1711 const unsigned char *key) 1712 { 1713 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1714 1715 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg)); 1716 } 1717 1718 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 1719 const struct list_head *in) 1720 { 1721 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1722 struct drbg_string *input = NULL; 1723 1724 crypto_shash_init(&sdesc->shash); 1725 list_for_each_entry(input, in, list) 1726 crypto_shash_update(&sdesc->shash, input->buf, input->len); 1727 return crypto_shash_final(&sdesc->shash, outval); 1728 } 1729 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 1730 1731 #ifdef CONFIG_CRYPTO_DRBG_CTR 1732 static int drbg_fini_sym_kernel(struct drbg_state *drbg) 1733 { 1734 struct crypto_cipher *tfm = 1735 (struct crypto_cipher *)drbg->priv_data; 1736 if (tfm) 1737 crypto_free_cipher(tfm); 1738 drbg->priv_data = NULL; 1739 1740 if (drbg->ctr_handle) 1741 crypto_free_skcipher(drbg->ctr_handle); 1742 drbg->ctr_handle = NULL; 1743 1744 if (drbg->ctr_req) 1745 skcipher_request_free(drbg->ctr_req); 1746 drbg->ctr_req = NULL; 1747 1748 kfree(drbg->outscratchpadbuf); 1749 drbg->outscratchpadbuf = NULL; 1750 1751 return 0; 1752 } 1753 1754 static int drbg_init_sym_kernel(struct drbg_state *drbg) 1755 { 1756 struct crypto_cipher *tfm; 1757 struct crypto_skcipher *sk_tfm; 1758 struct skcipher_request *req; 1759 unsigned int alignmask; 1760 char ctr_name[CRYPTO_MAX_ALG_NAME]; 1761 1762 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0); 1763 if (IS_ERR(tfm)) { 1764 pr_info("DRBG: could not allocate cipher TFM handle: %s\n", 1765 drbg->core->backend_cra_name); 1766 return PTR_ERR(tfm); 1767 } 1768 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm)); 1769 drbg->priv_data = tfm; 1770 1771 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", 1772 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) { 1773 drbg_fini_sym_kernel(drbg); 1774 return -EINVAL; 1775 } 1776 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0); 1777 if (IS_ERR(sk_tfm)) { 1778 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n", 1779 ctr_name); 1780 drbg_fini_sym_kernel(drbg); 1781 return PTR_ERR(sk_tfm); 1782 } 1783 drbg->ctr_handle = sk_tfm; 1784 crypto_init_wait(&drbg->ctr_wait); 1785 1786 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL); 1787 if (!req) { 1788 pr_info("DRBG: could not allocate request queue\n"); 1789 drbg_fini_sym_kernel(drbg); 1790 return -ENOMEM; 1791 } 1792 drbg->ctr_req = req; 1793 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | 1794 CRYPTO_TFM_REQ_MAY_SLEEP, 1795 crypto_req_done, &drbg->ctr_wait); 1796 1797 alignmask = crypto_skcipher_alignmask(sk_tfm); 1798 drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask, 1799 GFP_KERNEL); 1800 if (!drbg->outscratchpadbuf) { 1801 drbg_fini_sym_kernel(drbg); 1802 return -ENOMEM; 1803 } 1804 drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf, 1805 alignmask + 1); 1806 1807 sg_init_table(&drbg->sg_in, 1); 1808 sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN); 1809 1810 return alignmask; 1811 } 1812 1813 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 1814 const unsigned char *key) 1815 { 1816 struct crypto_cipher *tfm = 1817 (struct crypto_cipher *)drbg->priv_data; 1818 1819 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg))); 1820 } 1821 1822 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 1823 const struct drbg_string *in) 1824 { 1825 struct crypto_cipher *tfm = 1826 (struct crypto_cipher *)drbg->priv_data; 1827 1828 /* there is only component in *in */ 1829 BUG_ON(in->len < drbg_blocklen(drbg)); 1830 crypto_cipher_encrypt_one(tfm, outval, in->buf); 1831 return 0; 1832 } 1833 1834 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 1835 u8 *inbuf, u32 inlen, 1836 u8 *outbuf, u32 outlen) 1837 { 1838 struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out; 1839 u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN); 1840 int ret; 1841 1842 if (inbuf) { 1843 /* Use caller-provided input buffer */ 1844 sg_set_buf(sg_in, inbuf, inlen); 1845 } else { 1846 /* Use scratchpad for in-place operation */ 1847 inlen = scratchpad_use; 1848 memset(drbg->outscratchpad, 0, scratchpad_use); 1849 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use); 1850 } 1851 1852 while (outlen) { 1853 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN); 1854 1855 /* Output buffer may not be valid for SGL, use scratchpad */ 1856 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out, 1857 cryptlen, drbg->V); 1858 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req), 1859 &drbg->ctr_wait); 1860 if (ret) 1861 goto out; 1862 1863 crypto_init_wait(&drbg->ctr_wait); 1864 1865 memcpy(outbuf, drbg->outscratchpad, cryptlen); 1866 memzero_explicit(drbg->outscratchpad, cryptlen); 1867 1868 outlen -= cryptlen; 1869 outbuf += cryptlen; 1870 } 1871 ret = 0; 1872 1873 out: 1874 return ret; 1875 } 1876 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1877 1878 /*************************************************************** 1879 * Kernel crypto API interface to register DRBG 1880 ***************************************************************/ 1881 1882 /* 1883 * Look up the DRBG flags by given kernel crypto API cra_name 1884 * The code uses the drbg_cores definition to do this 1885 * 1886 * @cra_name kernel crypto API cra_name 1887 * @coreref reference to integer which is filled with the pointer to 1888 * the applicable core 1889 * @pr reference for setting prediction resistance 1890 * 1891 * return: flags 1892 */ 1893 static inline void drbg_convert_tfm_core(const char *cra_driver_name, 1894 int *coreref, bool *pr) 1895 { 1896 int i = 0; 1897 size_t start = 0; 1898 int len = 0; 1899 1900 *pr = true; 1901 /* disassemble the names */ 1902 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) { 1903 start = 10; 1904 *pr = false; 1905 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) { 1906 start = 8; 1907 } else { 1908 return; 1909 } 1910 1911 /* remove the first part */ 1912 len = strlen(cra_driver_name) - start; 1913 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) { 1914 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name, 1915 len)) { 1916 *coreref = i; 1917 return; 1918 } 1919 } 1920 } 1921 1922 static int drbg_kcapi_init(struct crypto_tfm *tfm) 1923 { 1924 struct drbg_state *drbg = crypto_tfm_ctx(tfm); 1925 1926 mutex_init(&drbg->drbg_mutex); 1927 1928 return 0; 1929 } 1930 1931 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm) 1932 { 1933 drbg_uninstantiate(crypto_tfm_ctx(tfm)); 1934 } 1935 1936 /* 1937 * Generate random numbers invoked by the kernel crypto API: 1938 * The API of the kernel crypto API is extended as follows: 1939 * 1940 * src is additional input supplied to the RNG. 1941 * slen is the length of src. 1942 * dst is the output buffer where random data is to be stored. 1943 * dlen is the length of dst. 1944 */ 1945 static int drbg_kcapi_random(struct crypto_rng *tfm, 1946 const u8 *src, unsigned int slen, 1947 u8 *dst, unsigned int dlen) 1948 { 1949 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1950 struct drbg_string *addtl = NULL; 1951 struct drbg_string string; 1952 1953 if (slen) { 1954 /* linked list variable is now local to allow modification */ 1955 drbg_string_fill(&string, src, slen); 1956 addtl = &string; 1957 } 1958 1959 return drbg_generate_long(drbg, dst, dlen, addtl); 1960 } 1961 1962 /* 1963 * Seed the DRBG invoked by the kernel crypto API 1964 */ 1965 static int drbg_kcapi_seed(struct crypto_rng *tfm, 1966 const u8 *seed, unsigned int slen) 1967 { 1968 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1969 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm); 1970 bool pr = false; 1971 struct drbg_string string; 1972 struct drbg_string *seed_string = NULL; 1973 int coreref = 0; 1974 1975 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref, 1976 &pr); 1977 if (0 < slen) { 1978 drbg_string_fill(&string, seed, slen); 1979 seed_string = &string; 1980 } 1981 1982 return drbg_instantiate(drbg, seed_string, coreref, pr); 1983 } 1984 1985 /*************************************************************** 1986 * Kernel module: code to load the module 1987 ***************************************************************/ 1988 1989 /* 1990 * Tests as defined in 11.3.2 in addition to the cipher tests: testing 1991 * of the error handling. 1992 * 1993 * Note: testing of failing seed source as defined in 11.3.2 is not applicable 1994 * as seed source of get_random_bytes does not fail. 1995 * 1996 * Note 2: There is no sensible way of testing the reseed counter 1997 * enforcement, so skip it. 1998 */ 1999 static inline int __init drbg_healthcheck_sanity(void) 2000 { 2001 int len = 0; 2002 #define OUTBUFLEN 16 2003 unsigned char buf[OUTBUFLEN]; 2004 struct drbg_state *drbg = NULL; 2005 int ret = -EFAULT; 2006 int rc = -EFAULT; 2007 bool pr = false; 2008 int coreref = 0; 2009 struct drbg_string addtl; 2010 size_t max_addtllen, max_request_bytes; 2011 2012 /* only perform test in FIPS mode */ 2013 if (!fips_enabled) 2014 return 0; 2015 2016 #ifdef CONFIG_CRYPTO_DRBG_CTR 2017 drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr); 2018 #elif defined CONFIG_CRYPTO_DRBG_HASH 2019 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr); 2020 #else 2021 drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr); 2022 #endif 2023 2024 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL); 2025 if (!drbg) 2026 return -ENOMEM; 2027 2028 mutex_init(&drbg->drbg_mutex); 2029 drbg->core = &drbg_cores[coreref]; 2030 drbg->reseed_threshold = drbg_max_requests(drbg); 2031 2032 /* 2033 * if the following tests fail, it is likely that there is a buffer 2034 * overflow as buf is much smaller than the requested or provided 2035 * string lengths -- in case the error handling does not succeed 2036 * we may get an OOPS. And we want to get an OOPS as this is a 2037 * grave bug. 2038 */ 2039 2040 max_addtllen = drbg_max_addtl(drbg); 2041 max_request_bytes = drbg_max_request_bytes(drbg); 2042 drbg_string_fill(&addtl, buf, max_addtllen + 1); 2043 /* overflow addtllen with additonal info string */ 2044 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl); 2045 BUG_ON(0 < len); 2046 /* overflow max_bits */ 2047 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL); 2048 BUG_ON(0 < len); 2049 2050 /* overflow max addtllen with personalization string */ 2051 ret = drbg_seed(drbg, &addtl, false); 2052 BUG_ON(0 == ret); 2053 /* all tests passed */ 2054 rc = 0; 2055 2056 pr_devel("DRBG: Sanity tests for failure code paths successfully " 2057 "completed\n"); 2058 2059 kfree(drbg); 2060 return rc; 2061 } 2062 2063 static struct rng_alg drbg_algs[22]; 2064 2065 /* 2066 * Fill the array drbg_algs used to register the different DRBGs 2067 * with the kernel crypto API. To fill the array, the information 2068 * from drbg_cores[] is used. 2069 */ 2070 static inline void __init drbg_fill_array(struct rng_alg *alg, 2071 const struct drbg_core *core, int pr) 2072 { 2073 int pos = 0; 2074 static int priority = 200; 2075 2076 memcpy(alg->base.cra_name, "stdrng", 6); 2077 if (pr) { 2078 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8); 2079 pos = 8; 2080 } else { 2081 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10); 2082 pos = 10; 2083 } 2084 memcpy(alg->base.cra_driver_name + pos, core->cra_name, 2085 strlen(core->cra_name)); 2086 2087 alg->base.cra_priority = priority; 2088 priority++; 2089 /* 2090 * If FIPS mode enabled, the selected DRBG shall have the 2091 * highest cra_priority over other stdrng instances to ensure 2092 * it is selected. 2093 */ 2094 if (fips_enabled) 2095 alg->base.cra_priority += 200; 2096 2097 alg->base.cra_ctxsize = sizeof(struct drbg_state); 2098 alg->base.cra_module = THIS_MODULE; 2099 alg->base.cra_init = drbg_kcapi_init; 2100 alg->base.cra_exit = drbg_kcapi_cleanup; 2101 alg->generate = drbg_kcapi_random; 2102 alg->seed = drbg_kcapi_seed; 2103 alg->set_ent = drbg_kcapi_set_entropy; 2104 alg->seedsize = 0; 2105 } 2106 2107 static int __init drbg_init(void) 2108 { 2109 unsigned int i = 0; /* pointer to drbg_algs */ 2110 unsigned int j = 0; /* pointer to drbg_cores */ 2111 int ret; 2112 2113 ret = drbg_healthcheck_sanity(); 2114 if (ret) 2115 return ret; 2116 2117 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) { 2118 pr_info("DRBG: Cannot register all DRBG types" 2119 "(slots needed: %zu, slots available: %zu)\n", 2120 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs)); 2121 return -EFAULT; 2122 } 2123 2124 /* 2125 * each DRBG definition can be used with PR and without PR, thus 2126 * we instantiate each DRBG in drbg_cores[] twice. 2127 * 2128 * As the order of placing them into the drbg_algs array matters 2129 * (the later DRBGs receive a higher cra_priority) we register the 2130 * prediction resistance DRBGs first as the should not be too 2131 * interesting. 2132 */ 2133 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2134 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1); 2135 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2136 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0); 2137 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2138 } 2139 2140 static void __exit drbg_exit(void) 2141 { 2142 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2143 } 2144 2145 subsys_initcall(drbg_init); 2146 module_exit(drbg_exit); 2147 #ifndef CRYPTO_DRBG_HASH_STRING 2148 #define CRYPTO_DRBG_HASH_STRING "" 2149 #endif 2150 #ifndef CRYPTO_DRBG_HMAC_STRING 2151 #define CRYPTO_DRBG_HMAC_STRING "" 2152 #endif 2153 #ifndef CRYPTO_DRBG_CTR_STRING 2154 #define CRYPTO_DRBG_CTR_STRING "" 2155 #endif 2156 MODULE_LICENSE("GPL"); 2157 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); 2158 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) " 2159 "using following cores: " 2160 CRYPTO_DRBG_HASH_STRING 2161 CRYPTO_DRBG_HMAC_STRING 2162 CRYPTO_DRBG_CTR_STRING); 2163 MODULE_ALIAS_CRYPTO("stdrng"); 2164