1 /* 2 * DRBG: Deterministic Random Bits Generator 3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following 4 * properties: 5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores 6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores 8 * * with and without prediction resistance 9 * 10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, and the entire permission notice in its entirety, 17 * including the disclaimer of warranties. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. The name of the author may not be used to endorse or promote 22 * products derived from this software without specific prior 23 * written permission. 24 * 25 * ALTERNATIVELY, this product may be distributed under the terms of 26 * the GNU General Public License, in which case the provisions of the GPL are 27 * required INSTEAD OF the above restrictions. (This clause is 28 * necessary due to a potential bad interaction between the GPL and 29 * the restrictions contained in a BSD-style copyright.) 30 * 31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 42 * DAMAGE. 43 * 44 * DRBG Usage 45 * ========== 46 * The SP 800-90A DRBG allows the user to specify a personalization string 47 * for initialization as well as an additional information string for each 48 * random number request. The following code fragments show how a caller 49 * uses the kernel crypto API to use the full functionality of the DRBG. 50 * 51 * Usage without any additional data 52 * --------------------------------- 53 * struct crypto_rng *drng; 54 * int err; 55 * char data[DATALEN]; 56 * 57 * drng = crypto_alloc_rng(drng_name, 0, 0); 58 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 59 * crypto_free_rng(drng); 60 * 61 * 62 * Usage with personalization string during initialization 63 * ------------------------------------------------------- 64 * struct crypto_rng *drng; 65 * int err; 66 * char data[DATALEN]; 67 * struct drbg_string pers; 68 * char personalization[11] = "some-string"; 69 * 70 * drbg_string_fill(&pers, personalization, strlen(personalization)); 71 * drng = crypto_alloc_rng(drng_name, 0, 0); 72 * // The reset completely re-initializes the DRBG with the provided 73 * // personalization string 74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization)); 75 * err = crypto_rng_get_bytes(drng, &data, DATALEN); 76 * crypto_free_rng(drng); 77 * 78 * 79 * Usage with additional information string during random number request 80 * --------------------------------------------------------------------- 81 * struct crypto_rng *drng; 82 * int err; 83 * char data[DATALEN]; 84 * char addtl_string[11] = "some-string"; 85 * string drbg_string addtl; 86 * 87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string)); 88 * drng = crypto_alloc_rng(drng_name, 0, 0); 89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns 90 * // the same error codes. 91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl); 92 * crypto_free_rng(drng); 93 * 94 * 95 * Usage with personalization and additional information strings 96 * ------------------------------------------------------------- 97 * Just mix both scenarios above. 98 */ 99 100 #include <crypto/drbg.h> 101 #include <crypto/internal/cipher.h> 102 #include <linux/kernel.h> 103 104 /*************************************************************** 105 * Backend cipher definitions available to DRBG 106 ***************************************************************/ 107 108 /* 109 * The order of the DRBG definitions here matter: every DRBG is registered 110 * as stdrng. Each DRBG receives an increasing cra_priority values the later 111 * they are defined in this array (see drbg_fill_array). 112 * 113 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and 114 * the SHA256 / AES 256 over other ciphers. Thus, the favored 115 * DRBGs are the latest entries in this array. 116 */ 117 static const struct drbg_core drbg_cores[] = { 118 #ifdef CONFIG_CRYPTO_DRBG_CTR 119 { 120 .flags = DRBG_CTR | DRBG_STRENGTH128, 121 .statelen = 32, /* 256 bits as defined in 10.2.1 */ 122 .blocklen_bytes = 16, 123 .cra_name = "ctr_aes128", 124 .backend_cra_name = "aes", 125 }, { 126 .flags = DRBG_CTR | DRBG_STRENGTH192, 127 .statelen = 40, /* 320 bits as defined in 10.2.1 */ 128 .blocklen_bytes = 16, 129 .cra_name = "ctr_aes192", 130 .backend_cra_name = "aes", 131 }, { 132 .flags = DRBG_CTR | DRBG_STRENGTH256, 133 .statelen = 48, /* 384 bits as defined in 10.2.1 */ 134 .blocklen_bytes = 16, 135 .cra_name = "ctr_aes256", 136 .backend_cra_name = "aes", 137 }, 138 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 139 #ifdef CONFIG_CRYPTO_DRBG_HASH 140 { 141 .flags = DRBG_HASH | DRBG_STRENGTH128, 142 .statelen = 55, /* 440 bits */ 143 .blocklen_bytes = 20, 144 .cra_name = "sha1", 145 .backend_cra_name = "sha1", 146 }, { 147 .flags = DRBG_HASH | DRBG_STRENGTH256, 148 .statelen = 111, /* 888 bits */ 149 .blocklen_bytes = 48, 150 .cra_name = "sha384", 151 .backend_cra_name = "sha384", 152 }, { 153 .flags = DRBG_HASH | DRBG_STRENGTH256, 154 .statelen = 111, /* 888 bits */ 155 .blocklen_bytes = 64, 156 .cra_name = "sha512", 157 .backend_cra_name = "sha512", 158 }, { 159 .flags = DRBG_HASH | DRBG_STRENGTH256, 160 .statelen = 55, /* 440 bits */ 161 .blocklen_bytes = 32, 162 .cra_name = "sha256", 163 .backend_cra_name = "sha256", 164 }, 165 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 166 #ifdef CONFIG_CRYPTO_DRBG_HMAC 167 { 168 .flags = DRBG_HMAC | DRBG_STRENGTH128, 169 .statelen = 20, /* block length of cipher */ 170 .blocklen_bytes = 20, 171 .cra_name = "hmac_sha1", 172 .backend_cra_name = "hmac(sha1)", 173 }, { 174 .flags = DRBG_HMAC | DRBG_STRENGTH256, 175 .statelen = 48, /* block length of cipher */ 176 .blocklen_bytes = 48, 177 .cra_name = "hmac_sha384", 178 .backend_cra_name = "hmac(sha384)", 179 }, { 180 .flags = DRBG_HMAC | DRBG_STRENGTH256, 181 .statelen = 32, /* block length of cipher */ 182 .blocklen_bytes = 32, 183 .cra_name = "hmac_sha256", 184 .backend_cra_name = "hmac(sha256)", 185 }, { 186 .flags = DRBG_HMAC | DRBG_STRENGTH256, 187 .statelen = 64, /* block length of cipher */ 188 .blocklen_bytes = 64, 189 .cra_name = "hmac_sha512", 190 .backend_cra_name = "hmac(sha512)", 191 }, 192 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 193 }; 194 195 static int drbg_uninstantiate(struct drbg_state *drbg); 196 197 /****************************************************************** 198 * Generic helper functions 199 ******************************************************************/ 200 201 /* 202 * Return strength of DRBG according to SP800-90A section 8.4 203 * 204 * @flags DRBG flags reference 205 * 206 * Return: normalized strength in *bytes* value or 32 as default 207 * to counter programming errors 208 */ 209 static inline unsigned short drbg_sec_strength(drbg_flag_t flags) 210 { 211 switch (flags & DRBG_STRENGTH_MASK) { 212 case DRBG_STRENGTH128: 213 return 16; 214 case DRBG_STRENGTH192: 215 return 24; 216 case DRBG_STRENGTH256: 217 return 32; 218 default: 219 return 32; 220 } 221 } 222 223 /* 224 * FIPS 140-2 continuous self test for the noise source 225 * The test is performed on the noise source input data. Thus, the function 226 * implicitly knows the size of the buffer to be equal to the security 227 * strength. 228 * 229 * Note, this function disregards the nonce trailing the entropy data during 230 * initial seeding. 231 * 232 * drbg->drbg_mutex must have been taken. 233 * 234 * @drbg DRBG handle 235 * @entropy buffer of seed data to be checked 236 * 237 * return: 238 * 0 on success 239 * -EAGAIN on when the CTRNG is not yet primed 240 * < 0 on error 241 */ 242 static int drbg_fips_continuous_test(struct drbg_state *drbg, 243 const unsigned char *entropy) 244 { 245 unsigned short entropylen = drbg_sec_strength(drbg->core->flags); 246 int ret = 0; 247 248 if (!IS_ENABLED(CONFIG_CRYPTO_FIPS)) 249 return 0; 250 251 /* skip test if we test the overall system */ 252 if (list_empty(&drbg->test_data.list)) 253 return 0; 254 /* only perform test in FIPS mode */ 255 if (!fips_enabled) 256 return 0; 257 258 if (!drbg->fips_primed) { 259 /* Priming of FIPS test */ 260 memcpy(drbg->prev, entropy, entropylen); 261 drbg->fips_primed = true; 262 /* priming: another round is needed */ 263 return -EAGAIN; 264 } 265 ret = memcmp(drbg->prev, entropy, entropylen); 266 if (!ret) 267 panic("DRBG continuous self test failed\n"); 268 memcpy(drbg->prev, entropy, entropylen); 269 270 /* the test shall pass when the two values are not equal */ 271 return 0; 272 } 273 274 /* 275 * Convert an integer into a byte representation of this integer. 276 * The byte representation is big-endian 277 * 278 * @val value to be converted 279 * @buf buffer holding the converted integer -- caller must ensure that 280 * buffer size is at least 32 bit 281 */ 282 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR)) 283 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf) 284 { 285 struct s { 286 __be32 conv; 287 }; 288 struct s *conversion = (struct s *) buf; 289 290 conversion->conv = cpu_to_be32(val); 291 } 292 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */ 293 294 /****************************************************************** 295 * CTR DRBG callback functions 296 ******************************************************************/ 297 298 #ifdef CONFIG_CRYPTO_DRBG_CTR 299 #define CRYPTO_DRBG_CTR_STRING "CTR " 300 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256"); 301 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256"); 302 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192"); 303 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192"); 304 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128"); 305 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128"); 306 307 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 308 const unsigned char *key); 309 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 310 const struct drbg_string *in); 311 static int drbg_init_sym_kernel(struct drbg_state *drbg); 312 static int drbg_fini_sym_kernel(struct drbg_state *drbg); 313 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 314 u8 *inbuf, u32 inbuflen, 315 u8 *outbuf, u32 outlen); 316 #define DRBG_OUTSCRATCHLEN 256 317 318 /* BCC function for CTR DRBG as defined in 10.4.3 */ 319 static int drbg_ctr_bcc(struct drbg_state *drbg, 320 unsigned char *out, const unsigned char *key, 321 struct list_head *in) 322 { 323 int ret = 0; 324 struct drbg_string *curr = NULL; 325 struct drbg_string data; 326 short cnt = 0; 327 328 drbg_string_fill(&data, out, drbg_blocklen(drbg)); 329 330 /* 10.4.3 step 2 / 4 */ 331 drbg_kcapi_symsetkey(drbg, key); 332 list_for_each_entry(curr, in, list) { 333 const unsigned char *pos = curr->buf; 334 size_t len = curr->len; 335 /* 10.4.3 step 4.1 */ 336 while (len) { 337 /* 10.4.3 step 4.2 */ 338 if (drbg_blocklen(drbg) == cnt) { 339 cnt = 0; 340 ret = drbg_kcapi_sym(drbg, out, &data); 341 if (ret) 342 return ret; 343 } 344 out[cnt] ^= *pos; 345 pos++; 346 cnt++; 347 len--; 348 } 349 } 350 /* 10.4.3 step 4.2 for last block */ 351 if (cnt) 352 ret = drbg_kcapi_sym(drbg, out, &data); 353 354 return ret; 355 } 356 357 /* 358 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df 359 * (and drbg_ctr_bcc, but this function does not need any temporary buffers), 360 * the scratchpad is used as follows: 361 * drbg_ctr_update: 362 * temp 363 * start: drbg->scratchpad 364 * length: drbg_statelen(drbg) + drbg_blocklen(drbg) 365 * note: the cipher writing into this variable works 366 * blocklen-wise. Now, when the statelen is not a multiple 367 * of blocklen, the generateion loop below "spills over" 368 * by at most blocklen. Thus, we need to give sufficient 369 * memory. 370 * df_data 371 * start: drbg->scratchpad + 372 * drbg_statelen(drbg) + drbg_blocklen(drbg) 373 * length: drbg_statelen(drbg) 374 * 375 * drbg_ctr_df: 376 * pad 377 * start: df_data + drbg_statelen(drbg) 378 * length: drbg_blocklen(drbg) 379 * iv 380 * start: pad + drbg_blocklen(drbg) 381 * length: drbg_blocklen(drbg) 382 * temp 383 * start: iv + drbg_blocklen(drbg) 384 * length: drbg_satelen(drbg) + drbg_blocklen(drbg) 385 * note: temp is the buffer that the BCC function operates 386 * on. BCC operates blockwise. drbg_statelen(drbg) 387 * is sufficient when the DRBG state length is a multiple 388 * of the block size. For AES192 (and maybe other ciphers) 389 * this is not correct and the length for temp is 390 * insufficient (yes, that also means for such ciphers, 391 * the final output of all BCC rounds are truncated). 392 * Therefore, add drbg_blocklen(drbg) to cover all 393 * possibilities. 394 */ 395 396 /* Derivation Function for CTR DRBG as defined in 10.4.2 */ 397 static int drbg_ctr_df(struct drbg_state *drbg, 398 unsigned char *df_data, size_t bytes_to_return, 399 struct list_head *seedlist) 400 { 401 int ret = -EFAULT; 402 unsigned char L_N[8]; 403 /* S3 is input */ 404 struct drbg_string S1, S2, S4, cipherin; 405 LIST_HEAD(bcc_list); 406 unsigned char *pad = df_data + drbg_statelen(drbg); 407 unsigned char *iv = pad + drbg_blocklen(drbg); 408 unsigned char *temp = iv + drbg_blocklen(drbg); 409 size_t padlen = 0; 410 unsigned int templen = 0; 411 /* 10.4.2 step 7 */ 412 unsigned int i = 0; 413 /* 10.4.2 step 8 */ 414 const unsigned char *K = (unsigned char *) 415 "\x00\x01\x02\x03\x04\x05\x06\x07" 416 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" 417 "\x10\x11\x12\x13\x14\x15\x16\x17" 418 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"; 419 unsigned char *X; 420 size_t generated_len = 0; 421 size_t inputlen = 0; 422 struct drbg_string *seed = NULL; 423 424 memset(pad, 0, drbg_blocklen(drbg)); 425 memset(iv, 0, drbg_blocklen(drbg)); 426 427 /* 10.4.2 step 1 is implicit as we work byte-wise */ 428 429 /* 10.4.2 step 2 */ 430 if ((512/8) < bytes_to_return) 431 return -EINVAL; 432 433 /* 10.4.2 step 2 -- calculate the entire length of all input data */ 434 list_for_each_entry(seed, seedlist, list) 435 inputlen += seed->len; 436 drbg_cpu_to_be32(inputlen, &L_N[0]); 437 438 /* 10.4.2 step 3 */ 439 drbg_cpu_to_be32(bytes_to_return, &L_N[4]); 440 441 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */ 442 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg)); 443 /* wrap the padlen appropriately */ 444 if (padlen) 445 padlen = drbg_blocklen(drbg) - padlen; 446 /* 447 * pad / padlen contains the 0x80 byte and the following zero bytes. 448 * As the calculated padlen value only covers the number of zero 449 * bytes, this value has to be incremented by one for the 0x80 byte. 450 */ 451 padlen++; 452 pad[0] = 0x80; 453 454 /* 10.4.2 step 4 -- first fill the linked list and then order it */ 455 drbg_string_fill(&S1, iv, drbg_blocklen(drbg)); 456 list_add_tail(&S1.list, &bcc_list); 457 drbg_string_fill(&S2, L_N, sizeof(L_N)); 458 list_add_tail(&S2.list, &bcc_list); 459 list_splice_tail(seedlist, &bcc_list); 460 drbg_string_fill(&S4, pad, padlen); 461 list_add_tail(&S4.list, &bcc_list); 462 463 /* 10.4.2 step 9 */ 464 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) { 465 /* 466 * 10.4.2 step 9.1 - the padding is implicit as the buffer 467 * holds zeros after allocation -- even the increment of i 468 * is irrelevant as the increment remains within length of i 469 */ 470 drbg_cpu_to_be32(i, iv); 471 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */ 472 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list); 473 if (ret) 474 goto out; 475 /* 10.4.2 step 9.3 */ 476 i++; 477 templen += drbg_blocklen(drbg); 478 } 479 480 /* 10.4.2 step 11 */ 481 X = temp + (drbg_keylen(drbg)); 482 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg)); 483 484 /* 10.4.2 step 12: overwriting of outval is implemented in next step */ 485 486 /* 10.4.2 step 13 */ 487 drbg_kcapi_symsetkey(drbg, temp); 488 while (generated_len < bytes_to_return) { 489 short blocklen = 0; 490 /* 491 * 10.4.2 step 13.1: the truncation of the key length is 492 * implicit as the key is only drbg_blocklen in size based on 493 * the implementation of the cipher function callback 494 */ 495 ret = drbg_kcapi_sym(drbg, X, &cipherin); 496 if (ret) 497 goto out; 498 blocklen = (drbg_blocklen(drbg) < 499 (bytes_to_return - generated_len)) ? 500 drbg_blocklen(drbg) : 501 (bytes_to_return - generated_len); 502 /* 10.4.2 step 13.2 and 14 */ 503 memcpy(df_data + generated_len, X, blocklen); 504 generated_len += blocklen; 505 } 506 507 ret = 0; 508 509 out: 510 memset(iv, 0, drbg_blocklen(drbg)); 511 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 512 memset(pad, 0, drbg_blocklen(drbg)); 513 return ret; 514 } 515 516 /* 517 * update function of CTR DRBG as defined in 10.2.1.2 518 * 519 * The reseed variable has an enhanced meaning compared to the update 520 * functions of the other DRBGs as follows: 521 * 0 => initial seed from initialization 522 * 1 => reseed via drbg_seed 523 * 2 => first invocation from drbg_ctr_update when addtl is present. In 524 * this case, the df_data scratchpad is not deleted so that it is 525 * available for another calls to prevent calling the DF function 526 * again. 527 * 3 => second invocation from drbg_ctr_update. When the update function 528 * was called with addtl, the df_data memory already contains the 529 * DFed addtl information and we do not need to call DF again. 530 */ 531 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed, 532 int reseed) 533 { 534 int ret = -EFAULT; 535 /* 10.2.1.2 step 1 */ 536 unsigned char *temp = drbg->scratchpad; 537 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) + 538 drbg_blocklen(drbg); 539 540 if (3 > reseed) 541 memset(df_data, 0, drbg_statelen(drbg)); 542 543 if (!reseed) { 544 /* 545 * The DRBG uses the CTR mode of the underlying AES cipher. The 546 * CTR mode increments the counter value after the AES operation 547 * but SP800-90A requires that the counter is incremented before 548 * the AES operation. Hence, we increment it at the time we set 549 * it by one. 550 */ 551 crypto_inc(drbg->V, drbg_blocklen(drbg)); 552 553 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C, 554 drbg_keylen(drbg)); 555 if (ret) 556 goto out; 557 } 558 559 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */ 560 if (seed) { 561 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed); 562 if (ret) 563 goto out; 564 } 565 566 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg), 567 temp, drbg_statelen(drbg)); 568 if (ret) 569 return ret; 570 571 /* 10.2.1.2 step 5 */ 572 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp, 573 drbg_keylen(drbg)); 574 if (ret) 575 goto out; 576 /* 10.2.1.2 step 6 */ 577 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg)); 578 /* See above: increment counter by one to compensate timing of CTR op */ 579 crypto_inc(drbg->V, drbg_blocklen(drbg)); 580 ret = 0; 581 582 out: 583 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg)); 584 if (2 != reseed) 585 memset(df_data, 0, drbg_statelen(drbg)); 586 return ret; 587 } 588 589 /* 590 * scratchpad use: drbg_ctr_update is called independently from 591 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused 592 */ 593 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */ 594 static int drbg_ctr_generate(struct drbg_state *drbg, 595 unsigned char *buf, unsigned int buflen, 596 struct list_head *addtl) 597 { 598 int ret; 599 int len = min_t(int, buflen, INT_MAX); 600 601 /* 10.2.1.5.2 step 2 */ 602 if (addtl && !list_empty(addtl)) { 603 ret = drbg_ctr_update(drbg, addtl, 2); 604 if (ret) 605 return 0; 606 } 607 608 /* 10.2.1.5.2 step 4.1 */ 609 ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len); 610 if (ret) 611 return ret; 612 613 /* 10.2.1.5.2 step 6 */ 614 ret = drbg_ctr_update(drbg, NULL, 3); 615 if (ret) 616 len = ret; 617 618 return len; 619 } 620 621 static const struct drbg_state_ops drbg_ctr_ops = { 622 .update = drbg_ctr_update, 623 .generate = drbg_ctr_generate, 624 .crypto_init = drbg_init_sym_kernel, 625 .crypto_fini = drbg_fini_sym_kernel, 626 }; 627 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 628 629 /****************************************************************** 630 * HMAC DRBG callback functions 631 ******************************************************************/ 632 633 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 634 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 635 const struct list_head *in); 636 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 637 const unsigned char *key); 638 static int drbg_init_hash_kernel(struct drbg_state *drbg); 639 static int drbg_fini_hash_kernel(struct drbg_state *drbg); 640 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 641 642 #ifdef CONFIG_CRYPTO_DRBG_HMAC 643 #define CRYPTO_DRBG_HMAC_STRING "HMAC " 644 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512"); 645 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512"); 646 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384"); 647 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384"); 648 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256"); 649 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256"); 650 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1"); 651 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1"); 652 653 /* update function of HMAC DRBG as defined in 10.1.2.2 */ 654 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed, 655 int reseed) 656 { 657 int ret = -EFAULT; 658 int i = 0; 659 struct drbg_string seed1, seed2, vdata; 660 LIST_HEAD(seedlist); 661 LIST_HEAD(vdatalist); 662 663 if (!reseed) { 664 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */ 665 memset(drbg->V, 1, drbg_statelen(drbg)); 666 drbg_kcapi_hmacsetkey(drbg, drbg->C); 667 } 668 669 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg)); 670 list_add_tail(&seed1.list, &seedlist); 671 /* buffer of seed2 will be filled in for loop below with one byte */ 672 drbg_string_fill(&seed2, NULL, 1); 673 list_add_tail(&seed2.list, &seedlist); 674 /* input data of seed is allowed to be NULL at this point */ 675 if (seed) 676 list_splice_tail(seed, &seedlist); 677 678 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg)); 679 list_add_tail(&vdata.list, &vdatalist); 680 for (i = 2; 0 < i; i--) { 681 /* first round uses 0x0, second 0x1 */ 682 unsigned char prefix = DRBG_PREFIX0; 683 if (1 == i) 684 prefix = DRBG_PREFIX1; 685 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */ 686 seed2.buf = &prefix; 687 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist); 688 if (ret) 689 return ret; 690 drbg_kcapi_hmacsetkey(drbg, drbg->C); 691 692 /* 10.1.2.2 step 2 and 5 -- HMAC for V */ 693 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist); 694 if (ret) 695 return ret; 696 697 /* 10.1.2.2 step 3 */ 698 if (!seed) 699 return ret; 700 } 701 702 return 0; 703 } 704 705 /* generate function of HMAC DRBG as defined in 10.1.2.5 */ 706 static int drbg_hmac_generate(struct drbg_state *drbg, 707 unsigned char *buf, 708 unsigned int buflen, 709 struct list_head *addtl) 710 { 711 int len = 0; 712 int ret = 0; 713 struct drbg_string data; 714 LIST_HEAD(datalist); 715 716 /* 10.1.2.5 step 2 */ 717 if (addtl && !list_empty(addtl)) { 718 ret = drbg_hmac_update(drbg, addtl, 1); 719 if (ret) 720 return ret; 721 } 722 723 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg)); 724 list_add_tail(&data.list, &datalist); 725 while (len < buflen) { 726 unsigned int outlen = 0; 727 /* 10.1.2.5 step 4.1 */ 728 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist); 729 if (ret) 730 return ret; 731 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 732 drbg_blocklen(drbg) : (buflen - len); 733 734 /* 10.1.2.5 step 4.2 */ 735 memcpy(buf + len, drbg->V, outlen); 736 len += outlen; 737 } 738 739 /* 10.1.2.5 step 6 */ 740 if (addtl && !list_empty(addtl)) 741 ret = drbg_hmac_update(drbg, addtl, 1); 742 else 743 ret = drbg_hmac_update(drbg, NULL, 1); 744 if (ret) 745 return ret; 746 747 return len; 748 } 749 750 static const struct drbg_state_ops drbg_hmac_ops = { 751 .update = drbg_hmac_update, 752 .generate = drbg_hmac_generate, 753 .crypto_init = drbg_init_hash_kernel, 754 .crypto_fini = drbg_fini_hash_kernel, 755 }; 756 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 757 758 /****************************************************************** 759 * Hash DRBG callback functions 760 ******************************************************************/ 761 762 #ifdef CONFIG_CRYPTO_DRBG_HASH 763 #define CRYPTO_DRBG_HASH_STRING "HASH " 764 MODULE_ALIAS_CRYPTO("drbg_pr_sha512"); 765 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512"); 766 MODULE_ALIAS_CRYPTO("drbg_pr_sha384"); 767 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384"); 768 MODULE_ALIAS_CRYPTO("drbg_pr_sha256"); 769 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256"); 770 MODULE_ALIAS_CRYPTO("drbg_pr_sha1"); 771 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1"); 772 773 /* 774 * Increment buffer 775 * 776 * @dst buffer to increment 777 * @add value to add 778 */ 779 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen, 780 const unsigned char *add, size_t addlen) 781 { 782 /* implied: dstlen > addlen */ 783 unsigned char *dstptr; 784 const unsigned char *addptr; 785 unsigned int remainder = 0; 786 size_t len = addlen; 787 788 dstptr = dst + (dstlen-1); 789 addptr = add + (addlen-1); 790 while (len) { 791 remainder += *dstptr + *addptr; 792 *dstptr = remainder & 0xff; 793 remainder >>= 8; 794 len--; dstptr--; addptr--; 795 } 796 len = dstlen - addlen; 797 while (len && remainder > 0) { 798 remainder = *dstptr + 1; 799 *dstptr = remainder & 0xff; 800 remainder >>= 8; 801 len--; dstptr--; 802 } 803 } 804 805 /* 806 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used 807 * interlinked, the scratchpad is used as follows: 808 * drbg_hash_update 809 * start: drbg->scratchpad 810 * length: drbg_statelen(drbg) 811 * drbg_hash_df: 812 * start: drbg->scratchpad + drbg_statelen(drbg) 813 * length: drbg_blocklen(drbg) 814 * 815 * drbg_hash_process_addtl uses the scratchpad, but fully completes 816 * before either of the functions mentioned before are invoked. Therefore, 817 * drbg_hash_process_addtl does not need to be specifically considered. 818 */ 819 820 /* Derivation Function for Hash DRBG as defined in 10.4.1 */ 821 static int drbg_hash_df(struct drbg_state *drbg, 822 unsigned char *outval, size_t outlen, 823 struct list_head *entropylist) 824 { 825 int ret = 0; 826 size_t len = 0; 827 unsigned char input[5]; 828 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg); 829 struct drbg_string data; 830 831 /* 10.4.1 step 3 */ 832 input[0] = 1; 833 drbg_cpu_to_be32((outlen * 8), &input[1]); 834 835 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */ 836 drbg_string_fill(&data, input, 5); 837 list_add(&data.list, entropylist); 838 839 /* 10.4.1 step 4 */ 840 while (len < outlen) { 841 short blocklen = 0; 842 /* 10.4.1 step 4.1 */ 843 ret = drbg_kcapi_hash(drbg, tmp, entropylist); 844 if (ret) 845 goto out; 846 /* 10.4.1 step 4.2 */ 847 input[0]++; 848 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ? 849 drbg_blocklen(drbg) : (outlen - len); 850 memcpy(outval + len, tmp, blocklen); 851 len += blocklen; 852 } 853 854 out: 855 memset(tmp, 0, drbg_blocklen(drbg)); 856 return ret; 857 } 858 859 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */ 860 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed, 861 int reseed) 862 { 863 int ret = 0; 864 struct drbg_string data1, data2; 865 LIST_HEAD(datalist); 866 LIST_HEAD(datalist2); 867 unsigned char *V = drbg->scratchpad; 868 unsigned char prefix = DRBG_PREFIX1; 869 870 if (!seed) 871 return -EINVAL; 872 873 if (reseed) { 874 /* 10.1.1.3 step 1 */ 875 memcpy(V, drbg->V, drbg_statelen(drbg)); 876 drbg_string_fill(&data1, &prefix, 1); 877 list_add_tail(&data1.list, &datalist); 878 drbg_string_fill(&data2, V, drbg_statelen(drbg)); 879 list_add_tail(&data2.list, &datalist); 880 } 881 list_splice_tail(seed, &datalist); 882 883 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */ 884 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist); 885 if (ret) 886 goto out; 887 888 /* 10.1.1.2 / 10.1.1.3 step 4 */ 889 prefix = DRBG_PREFIX0; 890 drbg_string_fill(&data1, &prefix, 1); 891 list_add_tail(&data1.list, &datalist2); 892 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 893 list_add_tail(&data2.list, &datalist2); 894 /* 10.1.1.2 / 10.1.1.3 step 4 */ 895 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2); 896 897 out: 898 memset(drbg->scratchpad, 0, drbg_statelen(drbg)); 899 return ret; 900 } 901 902 /* processing of additional information string for Hash DRBG */ 903 static int drbg_hash_process_addtl(struct drbg_state *drbg, 904 struct list_head *addtl) 905 { 906 int ret = 0; 907 struct drbg_string data1, data2; 908 LIST_HEAD(datalist); 909 unsigned char prefix = DRBG_PREFIX2; 910 911 /* 10.1.1.4 step 2 */ 912 if (!addtl || list_empty(addtl)) 913 return 0; 914 915 /* 10.1.1.4 step 2a */ 916 drbg_string_fill(&data1, &prefix, 1); 917 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 918 list_add_tail(&data1.list, &datalist); 919 list_add_tail(&data2.list, &datalist); 920 list_splice_tail(addtl, &datalist); 921 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 922 if (ret) 923 goto out; 924 925 /* 10.1.1.4 step 2b */ 926 drbg_add_buf(drbg->V, drbg_statelen(drbg), 927 drbg->scratchpad, drbg_blocklen(drbg)); 928 929 out: 930 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 931 return ret; 932 } 933 934 /* Hashgen defined in 10.1.1.4 */ 935 static int drbg_hash_hashgen(struct drbg_state *drbg, 936 unsigned char *buf, 937 unsigned int buflen) 938 { 939 int len = 0; 940 int ret = 0; 941 unsigned char *src = drbg->scratchpad; 942 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg); 943 struct drbg_string data; 944 LIST_HEAD(datalist); 945 946 /* 10.1.1.4 step hashgen 2 */ 947 memcpy(src, drbg->V, drbg_statelen(drbg)); 948 949 drbg_string_fill(&data, src, drbg_statelen(drbg)); 950 list_add_tail(&data.list, &datalist); 951 while (len < buflen) { 952 unsigned int outlen = 0; 953 /* 10.1.1.4 step hashgen 4.1 */ 954 ret = drbg_kcapi_hash(drbg, dst, &datalist); 955 if (ret) { 956 len = ret; 957 goto out; 958 } 959 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? 960 drbg_blocklen(drbg) : (buflen - len); 961 /* 10.1.1.4 step hashgen 4.2 */ 962 memcpy(buf + len, dst, outlen); 963 len += outlen; 964 /* 10.1.1.4 hashgen step 4.3 */ 965 if (len < buflen) 966 crypto_inc(src, drbg_statelen(drbg)); 967 } 968 969 out: 970 memset(drbg->scratchpad, 0, 971 (drbg_statelen(drbg) + drbg_blocklen(drbg))); 972 return len; 973 } 974 975 /* generate function for Hash DRBG as defined in 10.1.1.4 */ 976 static int drbg_hash_generate(struct drbg_state *drbg, 977 unsigned char *buf, unsigned int buflen, 978 struct list_head *addtl) 979 { 980 int len = 0; 981 int ret = 0; 982 union { 983 unsigned char req[8]; 984 __be64 req_int; 985 } u; 986 unsigned char prefix = DRBG_PREFIX3; 987 struct drbg_string data1, data2; 988 LIST_HEAD(datalist); 989 990 /* 10.1.1.4 step 2 */ 991 ret = drbg_hash_process_addtl(drbg, addtl); 992 if (ret) 993 return ret; 994 /* 10.1.1.4 step 3 */ 995 len = drbg_hash_hashgen(drbg, buf, buflen); 996 997 /* this is the value H as documented in 10.1.1.4 */ 998 /* 10.1.1.4 step 4 */ 999 drbg_string_fill(&data1, &prefix, 1); 1000 list_add_tail(&data1.list, &datalist); 1001 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); 1002 list_add_tail(&data2.list, &datalist); 1003 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); 1004 if (ret) { 1005 len = ret; 1006 goto out; 1007 } 1008 1009 /* 10.1.1.4 step 5 */ 1010 drbg_add_buf(drbg->V, drbg_statelen(drbg), 1011 drbg->scratchpad, drbg_blocklen(drbg)); 1012 drbg_add_buf(drbg->V, drbg_statelen(drbg), 1013 drbg->C, drbg_statelen(drbg)); 1014 u.req_int = cpu_to_be64(drbg->reseed_ctr); 1015 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8); 1016 1017 out: 1018 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); 1019 return len; 1020 } 1021 1022 /* 1023 * scratchpad usage: as update and generate are used isolated, both 1024 * can use the scratchpad 1025 */ 1026 static const struct drbg_state_ops drbg_hash_ops = { 1027 .update = drbg_hash_update, 1028 .generate = drbg_hash_generate, 1029 .crypto_init = drbg_init_hash_kernel, 1030 .crypto_fini = drbg_fini_hash_kernel, 1031 }; 1032 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 1033 1034 /****************************************************************** 1035 * Functions common for DRBG implementations 1036 ******************************************************************/ 1037 1038 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed, 1039 int reseed) 1040 { 1041 int ret = drbg->d_ops->update(drbg, seed, reseed); 1042 1043 if (ret) 1044 return ret; 1045 1046 drbg->seeded = true; 1047 /* 10.1.1.2 / 10.1.1.3 step 5 */ 1048 drbg->reseed_ctr = 1; 1049 1050 return ret; 1051 } 1052 1053 static inline int drbg_get_random_bytes(struct drbg_state *drbg, 1054 unsigned char *entropy, 1055 unsigned int entropylen) 1056 { 1057 int ret; 1058 1059 do { 1060 get_random_bytes(entropy, entropylen); 1061 ret = drbg_fips_continuous_test(drbg, entropy); 1062 if (ret && ret != -EAGAIN) 1063 return ret; 1064 } while (ret); 1065 1066 return 0; 1067 } 1068 1069 static void drbg_async_seed(struct work_struct *work) 1070 { 1071 struct drbg_string data; 1072 LIST_HEAD(seedlist); 1073 struct drbg_state *drbg = container_of(work, struct drbg_state, 1074 seed_work); 1075 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1076 unsigned char entropy[32]; 1077 int ret; 1078 1079 BUG_ON(!entropylen); 1080 BUG_ON(entropylen > sizeof(entropy)); 1081 1082 drbg_string_fill(&data, entropy, entropylen); 1083 list_add_tail(&data.list, &seedlist); 1084 1085 mutex_lock(&drbg->drbg_mutex); 1086 1087 ret = drbg_get_random_bytes(drbg, entropy, entropylen); 1088 if (ret) 1089 goto unlock; 1090 1091 /* Set seeded to false so that if __drbg_seed fails the 1092 * next generate call will trigger a reseed. 1093 */ 1094 drbg->seeded = false; 1095 1096 __drbg_seed(drbg, &seedlist, true); 1097 1098 if (drbg->seeded) 1099 drbg->reseed_threshold = drbg_max_requests(drbg); 1100 1101 unlock: 1102 mutex_unlock(&drbg->drbg_mutex); 1103 1104 memzero_explicit(entropy, entropylen); 1105 } 1106 1107 /* 1108 * Seeding or reseeding of the DRBG 1109 * 1110 * @drbg: DRBG state struct 1111 * @pers: personalization / additional information buffer 1112 * @reseed: 0 for initial seed process, 1 for reseeding 1113 * 1114 * return: 1115 * 0 on success 1116 * error value otherwise 1117 */ 1118 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers, 1119 bool reseed) 1120 { 1121 int ret; 1122 unsigned char entropy[((32 + 16) * 2)]; 1123 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); 1124 struct drbg_string data1; 1125 LIST_HEAD(seedlist); 1126 1127 /* 9.1 / 9.2 / 9.3.1 step 3 */ 1128 if (pers && pers->len > (drbg_max_addtl(drbg))) { 1129 pr_devel("DRBG: personalization string too long %zu\n", 1130 pers->len); 1131 return -EINVAL; 1132 } 1133 1134 if (list_empty(&drbg->test_data.list)) { 1135 drbg_string_fill(&data1, drbg->test_data.buf, 1136 drbg->test_data.len); 1137 pr_devel("DRBG: using test entropy\n"); 1138 } else { 1139 /* 1140 * Gather entropy equal to the security strength of the DRBG. 1141 * With a derivation function, a nonce is required in addition 1142 * to the entropy. A nonce must be at least 1/2 of the security 1143 * strength of the DRBG in size. Thus, entropy + nonce is 3/2 1144 * of the strength. The consideration of a nonce is only 1145 * applicable during initial seeding. 1146 */ 1147 BUG_ON(!entropylen); 1148 if (!reseed) 1149 entropylen = ((entropylen + 1) / 2) * 3; 1150 BUG_ON((entropylen * 2) > sizeof(entropy)); 1151 1152 /* Get seed from in-kernel /dev/urandom */ 1153 ret = drbg_get_random_bytes(drbg, entropy, entropylen); 1154 if (ret) 1155 goto out; 1156 1157 if (!drbg->jent) { 1158 drbg_string_fill(&data1, entropy, entropylen); 1159 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1160 entropylen); 1161 } else { 1162 /* Get seed from Jitter RNG */ 1163 ret = crypto_rng_get_bytes(drbg->jent, 1164 entropy + entropylen, 1165 entropylen); 1166 if (ret) { 1167 pr_devel("DRBG: jent failed with %d\n", ret); 1168 1169 /* 1170 * Do not treat the transient failure of the 1171 * Jitter RNG as an error that needs to be 1172 * reported. The combined number of the 1173 * maximum reseed threshold times the maximum 1174 * number of Jitter RNG transient errors is 1175 * less than the reseed threshold required by 1176 * SP800-90A allowing us to treat the 1177 * transient errors as such. 1178 * 1179 * However, we mandate that at least the first 1180 * seeding operation must succeed with the 1181 * Jitter RNG. 1182 */ 1183 if (!reseed || ret != -EAGAIN) 1184 goto out; 1185 } 1186 1187 drbg_string_fill(&data1, entropy, entropylen * 2); 1188 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n", 1189 entropylen * 2); 1190 } 1191 } 1192 list_add_tail(&data1.list, &seedlist); 1193 1194 /* 1195 * concatenation of entropy with personalization str / addtl input) 1196 * the variable pers is directly handed in by the caller, so check its 1197 * contents whether it is appropriate 1198 */ 1199 if (pers && pers->buf && 0 < pers->len) { 1200 list_add_tail(&pers->list, &seedlist); 1201 pr_devel("DRBG: using personalization string\n"); 1202 } 1203 1204 if (!reseed) { 1205 memset(drbg->V, 0, drbg_statelen(drbg)); 1206 memset(drbg->C, 0, drbg_statelen(drbg)); 1207 } 1208 1209 ret = __drbg_seed(drbg, &seedlist, reseed); 1210 1211 out: 1212 memzero_explicit(entropy, entropylen * 2); 1213 1214 return ret; 1215 } 1216 1217 /* Free all substructures in a DRBG state without the DRBG state structure */ 1218 static inline void drbg_dealloc_state(struct drbg_state *drbg) 1219 { 1220 if (!drbg) 1221 return; 1222 kfree_sensitive(drbg->Vbuf); 1223 drbg->Vbuf = NULL; 1224 drbg->V = NULL; 1225 kfree_sensitive(drbg->Cbuf); 1226 drbg->Cbuf = NULL; 1227 drbg->C = NULL; 1228 kfree_sensitive(drbg->scratchpadbuf); 1229 drbg->scratchpadbuf = NULL; 1230 drbg->reseed_ctr = 0; 1231 drbg->d_ops = NULL; 1232 drbg->core = NULL; 1233 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) { 1234 kfree_sensitive(drbg->prev); 1235 drbg->prev = NULL; 1236 drbg->fips_primed = false; 1237 } 1238 } 1239 1240 /* 1241 * Allocate all sub-structures for a DRBG state. 1242 * The DRBG state structure must already be allocated. 1243 */ 1244 static inline int drbg_alloc_state(struct drbg_state *drbg) 1245 { 1246 int ret = -ENOMEM; 1247 unsigned int sb_size = 0; 1248 1249 switch (drbg->core->flags & DRBG_TYPE_MASK) { 1250 #ifdef CONFIG_CRYPTO_DRBG_HMAC 1251 case DRBG_HMAC: 1252 drbg->d_ops = &drbg_hmac_ops; 1253 break; 1254 #endif /* CONFIG_CRYPTO_DRBG_HMAC */ 1255 #ifdef CONFIG_CRYPTO_DRBG_HASH 1256 case DRBG_HASH: 1257 drbg->d_ops = &drbg_hash_ops; 1258 break; 1259 #endif /* CONFIG_CRYPTO_DRBG_HASH */ 1260 #ifdef CONFIG_CRYPTO_DRBG_CTR 1261 case DRBG_CTR: 1262 drbg->d_ops = &drbg_ctr_ops; 1263 break; 1264 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1265 default: 1266 ret = -EOPNOTSUPP; 1267 goto err; 1268 } 1269 1270 ret = drbg->d_ops->crypto_init(drbg); 1271 if (ret < 0) 1272 goto err; 1273 1274 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1275 if (!drbg->Vbuf) { 1276 ret = -ENOMEM; 1277 goto fini; 1278 } 1279 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1); 1280 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); 1281 if (!drbg->Cbuf) { 1282 ret = -ENOMEM; 1283 goto fini; 1284 } 1285 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1); 1286 /* scratchpad is only generated for CTR and Hash */ 1287 if (drbg->core->flags & DRBG_HMAC) 1288 sb_size = 0; 1289 else if (drbg->core->flags & DRBG_CTR) 1290 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */ 1291 drbg_statelen(drbg) + /* df_data */ 1292 drbg_blocklen(drbg) + /* pad */ 1293 drbg_blocklen(drbg) + /* iv */ 1294 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */ 1295 else 1296 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg); 1297 1298 if (0 < sb_size) { 1299 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL); 1300 if (!drbg->scratchpadbuf) { 1301 ret = -ENOMEM; 1302 goto fini; 1303 } 1304 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1); 1305 } 1306 1307 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) { 1308 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags), 1309 GFP_KERNEL); 1310 if (!drbg->prev) { 1311 ret = -ENOMEM; 1312 goto fini; 1313 } 1314 drbg->fips_primed = false; 1315 } 1316 1317 return 0; 1318 1319 fini: 1320 drbg->d_ops->crypto_fini(drbg); 1321 err: 1322 drbg_dealloc_state(drbg); 1323 return ret; 1324 } 1325 1326 /************************************************************************* 1327 * DRBG interface functions 1328 *************************************************************************/ 1329 1330 /* 1331 * DRBG generate function as required by SP800-90A - this function 1332 * generates random numbers 1333 * 1334 * @drbg DRBG state handle 1335 * @buf Buffer where to store the random numbers -- the buffer must already 1336 * be pre-allocated by caller 1337 * @buflen Length of output buffer - this value defines the number of random 1338 * bytes pulled from DRBG 1339 * @addtl Additional input that is mixed into state, may be NULL -- note 1340 * the entropy is pulled by the DRBG internally unconditionally 1341 * as defined in SP800-90A. The additional input is mixed into 1342 * the state in addition to the pulled entropy. 1343 * 1344 * return: 0 when all bytes are generated; < 0 in case of an error 1345 */ 1346 static int drbg_generate(struct drbg_state *drbg, 1347 unsigned char *buf, unsigned int buflen, 1348 struct drbg_string *addtl) 1349 { 1350 int len = 0; 1351 LIST_HEAD(addtllist); 1352 1353 if (!drbg->core) { 1354 pr_devel("DRBG: not yet seeded\n"); 1355 return -EINVAL; 1356 } 1357 if (0 == buflen || !buf) { 1358 pr_devel("DRBG: no output buffer provided\n"); 1359 return -EINVAL; 1360 } 1361 if (addtl && NULL == addtl->buf && 0 < addtl->len) { 1362 pr_devel("DRBG: wrong format of additional information\n"); 1363 return -EINVAL; 1364 } 1365 1366 /* 9.3.1 step 2 */ 1367 len = -EINVAL; 1368 if (buflen > (drbg_max_request_bytes(drbg))) { 1369 pr_devel("DRBG: requested random numbers too large %u\n", 1370 buflen); 1371 goto err; 1372 } 1373 1374 /* 9.3.1 step 3 is implicit with the chosen DRBG */ 1375 1376 /* 9.3.1 step 4 */ 1377 if (addtl && addtl->len > (drbg_max_addtl(drbg))) { 1378 pr_devel("DRBG: additional information string too long %zu\n", 1379 addtl->len); 1380 goto err; 1381 } 1382 /* 9.3.1 step 5 is implicit with the chosen DRBG */ 1383 1384 /* 1385 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented 1386 * here. The spec is a bit convoluted here, we make it simpler. 1387 */ 1388 if (drbg->reseed_threshold < drbg->reseed_ctr) 1389 drbg->seeded = false; 1390 1391 if (drbg->pr || !drbg->seeded) { 1392 pr_devel("DRBG: reseeding before generation (prediction " 1393 "resistance: %s, state %s)\n", 1394 drbg->pr ? "true" : "false", 1395 drbg->seeded ? "seeded" : "unseeded"); 1396 /* 9.3.1 steps 7.1 through 7.3 */ 1397 len = drbg_seed(drbg, addtl, true); 1398 if (len) 1399 goto err; 1400 /* 9.3.1 step 7.4 */ 1401 addtl = NULL; 1402 } 1403 1404 if (addtl && 0 < addtl->len) 1405 list_add_tail(&addtl->list, &addtllist); 1406 /* 9.3.1 step 8 and 10 */ 1407 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist); 1408 1409 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */ 1410 drbg->reseed_ctr++; 1411 if (0 >= len) 1412 goto err; 1413 1414 /* 1415 * Section 11.3.3 requires to re-perform self tests after some 1416 * generated random numbers. The chosen value after which self 1417 * test is performed is arbitrary, but it should be reasonable. 1418 * However, we do not perform the self tests because of the following 1419 * reasons: it is mathematically impossible that the initial self tests 1420 * were successfully and the following are not. If the initial would 1421 * pass and the following would not, the kernel integrity is violated. 1422 * In this case, the entire kernel operation is questionable and it 1423 * is unlikely that the integrity violation only affects the 1424 * correct operation of the DRBG. 1425 * 1426 * Albeit the following code is commented out, it is provided in 1427 * case somebody has a need to implement the test of 11.3.3. 1428 */ 1429 #if 0 1430 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) { 1431 int err = 0; 1432 pr_devel("DRBG: start to perform self test\n"); 1433 if (drbg->core->flags & DRBG_HMAC) 1434 err = alg_test("drbg_pr_hmac_sha256", 1435 "drbg_pr_hmac_sha256", 0, 0); 1436 else if (drbg->core->flags & DRBG_CTR) 1437 err = alg_test("drbg_pr_ctr_aes128", 1438 "drbg_pr_ctr_aes128", 0, 0); 1439 else 1440 err = alg_test("drbg_pr_sha256", 1441 "drbg_pr_sha256", 0, 0); 1442 if (err) { 1443 pr_err("DRBG: periodical self test failed\n"); 1444 /* 1445 * uninstantiate implies that from now on, only errors 1446 * are returned when reusing this DRBG cipher handle 1447 */ 1448 drbg_uninstantiate(drbg); 1449 return 0; 1450 } else { 1451 pr_devel("DRBG: self test successful\n"); 1452 } 1453 } 1454 #endif 1455 1456 /* 1457 * All operations were successful, return 0 as mandated by 1458 * the kernel crypto API interface. 1459 */ 1460 len = 0; 1461 err: 1462 return len; 1463 } 1464 1465 /* 1466 * Wrapper around drbg_generate which can pull arbitrary long strings 1467 * from the DRBG without hitting the maximum request limitation. 1468 * 1469 * Parameters: see drbg_generate 1470 * Return codes: see drbg_generate -- if one drbg_generate request fails, 1471 * the entire drbg_generate_long request fails 1472 */ 1473 static int drbg_generate_long(struct drbg_state *drbg, 1474 unsigned char *buf, unsigned int buflen, 1475 struct drbg_string *addtl) 1476 { 1477 unsigned int len = 0; 1478 unsigned int slice = 0; 1479 do { 1480 int err = 0; 1481 unsigned int chunk = 0; 1482 slice = ((buflen - len) / drbg_max_request_bytes(drbg)); 1483 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len); 1484 mutex_lock(&drbg->drbg_mutex); 1485 err = drbg_generate(drbg, buf + len, chunk, addtl); 1486 mutex_unlock(&drbg->drbg_mutex); 1487 if (0 > err) 1488 return err; 1489 len += chunk; 1490 } while (slice > 0 && (len < buflen)); 1491 return 0; 1492 } 1493 1494 static void drbg_schedule_async_seed(struct random_ready_callback *rdy) 1495 { 1496 struct drbg_state *drbg = container_of(rdy, struct drbg_state, 1497 random_ready); 1498 1499 schedule_work(&drbg->seed_work); 1500 } 1501 1502 static int drbg_prepare_hrng(struct drbg_state *drbg) 1503 { 1504 int err; 1505 1506 /* We do not need an HRNG in test mode. */ 1507 if (list_empty(&drbg->test_data.list)) 1508 return 0; 1509 1510 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); 1511 1512 INIT_WORK(&drbg->seed_work, drbg_async_seed); 1513 1514 drbg->random_ready.owner = THIS_MODULE; 1515 drbg->random_ready.func = drbg_schedule_async_seed; 1516 1517 err = add_random_ready_callback(&drbg->random_ready); 1518 1519 switch (err) { 1520 case 0: 1521 break; 1522 1523 case -EALREADY: 1524 err = 0; 1525 fallthrough; 1526 1527 default: 1528 drbg->random_ready.func = NULL; 1529 return err; 1530 } 1531 1532 /* 1533 * Require frequent reseeds until the seed source is fully 1534 * initialized. 1535 */ 1536 drbg->reseed_threshold = 50; 1537 1538 return err; 1539 } 1540 1541 /* 1542 * DRBG instantiation function as required by SP800-90A - this function 1543 * sets up the DRBG handle, performs the initial seeding and all sanity 1544 * checks required by SP800-90A 1545 * 1546 * @drbg memory of state -- if NULL, new memory is allocated 1547 * @pers Personalization string that is mixed into state, may be NULL -- note 1548 * the entropy is pulled by the DRBG internally unconditionally 1549 * as defined in SP800-90A. The additional input is mixed into 1550 * the state in addition to the pulled entropy. 1551 * @coreref reference to core 1552 * @pr prediction resistance enabled 1553 * 1554 * return 1555 * 0 on success 1556 * error value otherwise 1557 */ 1558 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, 1559 int coreref, bool pr) 1560 { 1561 int ret; 1562 bool reseed = true; 1563 1564 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance " 1565 "%s\n", coreref, pr ? "enabled" : "disabled"); 1566 mutex_lock(&drbg->drbg_mutex); 1567 1568 /* 9.1 step 1 is implicit with the selected DRBG type */ 1569 1570 /* 1571 * 9.1 step 2 is implicit as caller can select prediction resistance 1572 * and the flag is copied into drbg->flags -- 1573 * all DRBG types support prediction resistance 1574 */ 1575 1576 /* 9.1 step 4 is implicit in drbg_sec_strength */ 1577 1578 if (!drbg->core) { 1579 drbg->core = &drbg_cores[coreref]; 1580 drbg->pr = pr; 1581 drbg->seeded = false; 1582 drbg->reseed_threshold = drbg_max_requests(drbg); 1583 1584 ret = drbg_alloc_state(drbg); 1585 if (ret) 1586 goto unlock; 1587 1588 ret = drbg_prepare_hrng(drbg); 1589 if (ret) 1590 goto free_everything; 1591 1592 if (IS_ERR(drbg->jent)) { 1593 ret = PTR_ERR(drbg->jent); 1594 drbg->jent = NULL; 1595 if (fips_enabled || ret != -ENOENT) 1596 goto free_everything; 1597 pr_info("DRBG: Continuing without Jitter RNG\n"); 1598 } 1599 1600 reseed = false; 1601 } 1602 1603 ret = drbg_seed(drbg, pers, reseed); 1604 1605 if (ret && !reseed) 1606 goto free_everything; 1607 1608 mutex_unlock(&drbg->drbg_mutex); 1609 return ret; 1610 1611 unlock: 1612 mutex_unlock(&drbg->drbg_mutex); 1613 return ret; 1614 1615 free_everything: 1616 mutex_unlock(&drbg->drbg_mutex); 1617 drbg_uninstantiate(drbg); 1618 return ret; 1619 } 1620 1621 /* 1622 * DRBG uninstantiate function as required by SP800-90A - this function 1623 * frees all buffers and the DRBG handle 1624 * 1625 * @drbg DRBG state handle 1626 * 1627 * return 1628 * 0 on success 1629 */ 1630 static int drbg_uninstantiate(struct drbg_state *drbg) 1631 { 1632 if (drbg->random_ready.func) { 1633 del_random_ready_callback(&drbg->random_ready); 1634 cancel_work_sync(&drbg->seed_work); 1635 } 1636 1637 if (!IS_ERR_OR_NULL(drbg->jent)) 1638 crypto_free_rng(drbg->jent); 1639 drbg->jent = NULL; 1640 1641 if (drbg->d_ops) 1642 drbg->d_ops->crypto_fini(drbg); 1643 drbg_dealloc_state(drbg); 1644 /* no scrubbing of test_data -- this shall survive an uninstantiate */ 1645 return 0; 1646 } 1647 1648 /* 1649 * Helper function for setting the test data in the DRBG 1650 * 1651 * @drbg DRBG state handle 1652 * @data test data 1653 * @len test data length 1654 */ 1655 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm, 1656 const u8 *data, unsigned int len) 1657 { 1658 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1659 1660 mutex_lock(&drbg->drbg_mutex); 1661 drbg_string_fill(&drbg->test_data, data, len); 1662 mutex_unlock(&drbg->drbg_mutex); 1663 } 1664 1665 /*************************************************************** 1666 * Kernel crypto API cipher invocations requested by DRBG 1667 ***************************************************************/ 1668 1669 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC) 1670 struct sdesc { 1671 struct shash_desc shash; 1672 char ctx[]; 1673 }; 1674 1675 static int drbg_init_hash_kernel(struct drbg_state *drbg) 1676 { 1677 struct sdesc *sdesc; 1678 struct crypto_shash *tfm; 1679 1680 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0); 1681 if (IS_ERR(tfm)) { 1682 pr_info("DRBG: could not allocate digest TFM handle: %s\n", 1683 drbg->core->backend_cra_name); 1684 return PTR_ERR(tfm); 1685 } 1686 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm)); 1687 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm), 1688 GFP_KERNEL); 1689 if (!sdesc) { 1690 crypto_free_shash(tfm); 1691 return -ENOMEM; 1692 } 1693 1694 sdesc->shash.tfm = tfm; 1695 drbg->priv_data = sdesc; 1696 1697 return crypto_shash_alignmask(tfm); 1698 } 1699 1700 static int drbg_fini_hash_kernel(struct drbg_state *drbg) 1701 { 1702 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1703 if (sdesc) { 1704 crypto_free_shash(sdesc->shash.tfm); 1705 kfree_sensitive(sdesc); 1706 } 1707 drbg->priv_data = NULL; 1708 return 0; 1709 } 1710 1711 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg, 1712 const unsigned char *key) 1713 { 1714 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1715 1716 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg)); 1717 } 1718 1719 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval, 1720 const struct list_head *in) 1721 { 1722 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; 1723 struct drbg_string *input = NULL; 1724 1725 crypto_shash_init(&sdesc->shash); 1726 list_for_each_entry(input, in, list) 1727 crypto_shash_update(&sdesc->shash, input->buf, input->len); 1728 return crypto_shash_final(&sdesc->shash, outval); 1729 } 1730 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */ 1731 1732 #ifdef CONFIG_CRYPTO_DRBG_CTR 1733 static int drbg_fini_sym_kernel(struct drbg_state *drbg) 1734 { 1735 struct crypto_cipher *tfm = 1736 (struct crypto_cipher *)drbg->priv_data; 1737 if (tfm) 1738 crypto_free_cipher(tfm); 1739 drbg->priv_data = NULL; 1740 1741 if (drbg->ctr_handle) 1742 crypto_free_skcipher(drbg->ctr_handle); 1743 drbg->ctr_handle = NULL; 1744 1745 if (drbg->ctr_req) 1746 skcipher_request_free(drbg->ctr_req); 1747 drbg->ctr_req = NULL; 1748 1749 kfree(drbg->outscratchpadbuf); 1750 drbg->outscratchpadbuf = NULL; 1751 1752 return 0; 1753 } 1754 1755 static int drbg_init_sym_kernel(struct drbg_state *drbg) 1756 { 1757 struct crypto_cipher *tfm; 1758 struct crypto_skcipher *sk_tfm; 1759 struct skcipher_request *req; 1760 unsigned int alignmask; 1761 char ctr_name[CRYPTO_MAX_ALG_NAME]; 1762 1763 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0); 1764 if (IS_ERR(tfm)) { 1765 pr_info("DRBG: could not allocate cipher TFM handle: %s\n", 1766 drbg->core->backend_cra_name); 1767 return PTR_ERR(tfm); 1768 } 1769 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm)); 1770 drbg->priv_data = tfm; 1771 1772 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", 1773 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) { 1774 drbg_fini_sym_kernel(drbg); 1775 return -EINVAL; 1776 } 1777 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0); 1778 if (IS_ERR(sk_tfm)) { 1779 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n", 1780 ctr_name); 1781 drbg_fini_sym_kernel(drbg); 1782 return PTR_ERR(sk_tfm); 1783 } 1784 drbg->ctr_handle = sk_tfm; 1785 crypto_init_wait(&drbg->ctr_wait); 1786 1787 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL); 1788 if (!req) { 1789 pr_info("DRBG: could not allocate request queue\n"); 1790 drbg_fini_sym_kernel(drbg); 1791 return -ENOMEM; 1792 } 1793 drbg->ctr_req = req; 1794 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | 1795 CRYPTO_TFM_REQ_MAY_SLEEP, 1796 crypto_req_done, &drbg->ctr_wait); 1797 1798 alignmask = crypto_skcipher_alignmask(sk_tfm); 1799 drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask, 1800 GFP_KERNEL); 1801 if (!drbg->outscratchpadbuf) { 1802 drbg_fini_sym_kernel(drbg); 1803 return -ENOMEM; 1804 } 1805 drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf, 1806 alignmask + 1); 1807 1808 sg_init_table(&drbg->sg_in, 1); 1809 sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN); 1810 1811 return alignmask; 1812 } 1813 1814 static void drbg_kcapi_symsetkey(struct drbg_state *drbg, 1815 const unsigned char *key) 1816 { 1817 struct crypto_cipher *tfm = 1818 (struct crypto_cipher *)drbg->priv_data; 1819 1820 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg))); 1821 } 1822 1823 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval, 1824 const struct drbg_string *in) 1825 { 1826 struct crypto_cipher *tfm = 1827 (struct crypto_cipher *)drbg->priv_data; 1828 1829 /* there is only component in *in */ 1830 BUG_ON(in->len < drbg_blocklen(drbg)); 1831 crypto_cipher_encrypt_one(tfm, outval, in->buf); 1832 return 0; 1833 } 1834 1835 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 1836 u8 *inbuf, u32 inlen, 1837 u8 *outbuf, u32 outlen) 1838 { 1839 struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out; 1840 u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN); 1841 int ret; 1842 1843 if (inbuf) { 1844 /* Use caller-provided input buffer */ 1845 sg_set_buf(sg_in, inbuf, inlen); 1846 } else { 1847 /* Use scratchpad for in-place operation */ 1848 inlen = scratchpad_use; 1849 memset(drbg->outscratchpad, 0, scratchpad_use); 1850 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use); 1851 } 1852 1853 while (outlen) { 1854 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN); 1855 1856 /* Output buffer may not be valid for SGL, use scratchpad */ 1857 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out, 1858 cryptlen, drbg->V); 1859 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req), 1860 &drbg->ctr_wait); 1861 if (ret) 1862 goto out; 1863 1864 crypto_init_wait(&drbg->ctr_wait); 1865 1866 memcpy(outbuf, drbg->outscratchpad, cryptlen); 1867 memzero_explicit(drbg->outscratchpad, cryptlen); 1868 1869 outlen -= cryptlen; 1870 outbuf += cryptlen; 1871 } 1872 ret = 0; 1873 1874 out: 1875 return ret; 1876 } 1877 #endif /* CONFIG_CRYPTO_DRBG_CTR */ 1878 1879 /*************************************************************** 1880 * Kernel crypto API interface to register DRBG 1881 ***************************************************************/ 1882 1883 /* 1884 * Look up the DRBG flags by given kernel crypto API cra_name 1885 * The code uses the drbg_cores definition to do this 1886 * 1887 * @cra_name kernel crypto API cra_name 1888 * @coreref reference to integer which is filled with the pointer to 1889 * the applicable core 1890 * @pr reference for setting prediction resistance 1891 * 1892 * return: flags 1893 */ 1894 static inline void drbg_convert_tfm_core(const char *cra_driver_name, 1895 int *coreref, bool *pr) 1896 { 1897 int i = 0; 1898 size_t start = 0; 1899 int len = 0; 1900 1901 *pr = true; 1902 /* disassemble the names */ 1903 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) { 1904 start = 10; 1905 *pr = false; 1906 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) { 1907 start = 8; 1908 } else { 1909 return; 1910 } 1911 1912 /* remove the first part */ 1913 len = strlen(cra_driver_name) - start; 1914 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) { 1915 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name, 1916 len)) { 1917 *coreref = i; 1918 return; 1919 } 1920 } 1921 } 1922 1923 static int drbg_kcapi_init(struct crypto_tfm *tfm) 1924 { 1925 struct drbg_state *drbg = crypto_tfm_ctx(tfm); 1926 1927 mutex_init(&drbg->drbg_mutex); 1928 1929 return 0; 1930 } 1931 1932 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm) 1933 { 1934 drbg_uninstantiate(crypto_tfm_ctx(tfm)); 1935 } 1936 1937 /* 1938 * Generate random numbers invoked by the kernel crypto API: 1939 * The API of the kernel crypto API is extended as follows: 1940 * 1941 * src is additional input supplied to the RNG. 1942 * slen is the length of src. 1943 * dst is the output buffer where random data is to be stored. 1944 * dlen is the length of dst. 1945 */ 1946 static int drbg_kcapi_random(struct crypto_rng *tfm, 1947 const u8 *src, unsigned int slen, 1948 u8 *dst, unsigned int dlen) 1949 { 1950 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1951 struct drbg_string *addtl = NULL; 1952 struct drbg_string string; 1953 1954 if (slen) { 1955 /* linked list variable is now local to allow modification */ 1956 drbg_string_fill(&string, src, slen); 1957 addtl = &string; 1958 } 1959 1960 return drbg_generate_long(drbg, dst, dlen, addtl); 1961 } 1962 1963 /* 1964 * Seed the DRBG invoked by the kernel crypto API 1965 */ 1966 static int drbg_kcapi_seed(struct crypto_rng *tfm, 1967 const u8 *seed, unsigned int slen) 1968 { 1969 struct drbg_state *drbg = crypto_rng_ctx(tfm); 1970 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm); 1971 bool pr = false; 1972 struct drbg_string string; 1973 struct drbg_string *seed_string = NULL; 1974 int coreref = 0; 1975 1976 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref, 1977 &pr); 1978 if (0 < slen) { 1979 drbg_string_fill(&string, seed, slen); 1980 seed_string = &string; 1981 } 1982 1983 return drbg_instantiate(drbg, seed_string, coreref, pr); 1984 } 1985 1986 /*************************************************************** 1987 * Kernel module: code to load the module 1988 ***************************************************************/ 1989 1990 /* 1991 * Tests as defined in 11.3.2 in addition to the cipher tests: testing 1992 * of the error handling. 1993 * 1994 * Note: testing of failing seed source as defined in 11.3.2 is not applicable 1995 * as seed source of get_random_bytes does not fail. 1996 * 1997 * Note 2: There is no sensible way of testing the reseed counter 1998 * enforcement, so skip it. 1999 */ 2000 static inline int __init drbg_healthcheck_sanity(void) 2001 { 2002 int len = 0; 2003 #define OUTBUFLEN 16 2004 unsigned char buf[OUTBUFLEN]; 2005 struct drbg_state *drbg = NULL; 2006 int ret = -EFAULT; 2007 int rc = -EFAULT; 2008 bool pr = false; 2009 int coreref = 0; 2010 struct drbg_string addtl; 2011 size_t max_addtllen, max_request_bytes; 2012 2013 /* only perform test in FIPS mode */ 2014 if (!fips_enabled) 2015 return 0; 2016 2017 #ifdef CONFIG_CRYPTO_DRBG_CTR 2018 drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr); 2019 #elif defined CONFIG_CRYPTO_DRBG_HASH 2020 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr); 2021 #else 2022 drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr); 2023 #endif 2024 2025 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL); 2026 if (!drbg) 2027 return -ENOMEM; 2028 2029 mutex_init(&drbg->drbg_mutex); 2030 drbg->core = &drbg_cores[coreref]; 2031 drbg->reseed_threshold = drbg_max_requests(drbg); 2032 2033 /* 2034 * if the following tests fail, it is likely that there is a buffer 2035 * overflow as buf is much smaller than the requested or provided 2036 * string lengths -- in case the error handling does not succeed 2037 * we may get an OOPS. And we want to get an OOPS as this is a 2038 * grave bug. 2039 */ 2040 2041 max_addtllen = drbg_max_addtl(drbg); 2042 max_request_bytes = drbg_max_request_bytes(drbg); 2043 drbg_string_fill(&addtl, buf, max_addtllen + 1); 2044 /* overflow addtllen with additonal info string */ 2045 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl); 2046 BUG_ON(0 < len); 2047 /* overflow max_bits */ 2048 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL); 2049 BUG_ON(0 < len); 2050 2051 /* overflow max addtllen with personalization string */ 2052 ret = drbg_seed(drbg, &addtl, false); 2053 BUG_ON(0 == ret); 2054 /* all tests passed */ 2055 rc = 0; 2056 2057 pr_devel("DRBG: Sanity tests for failure code paths successfully " 2058 "completed\n"); 2059 2060 kfree(drbg); 2061 return rc; 2062 } 2063 2064 static struct rng_alg drbg_algs[22]; 2065 2066 /* 2067 * Fill the array drbg_algs used to register the different DRBGs 2068 * with the kernel crypto API. To fill the array, the information 2069 * from drbg_cores[] is used. 2070 */ 2071 static inline void __init drbg_fill_array(struct rng_alg *alg, 2072 const struct drbg_core *core, int pr) 2073 { 2074 int pos = 0; 2075 static int priority = 200; 2076 2077 memcpy(alg->base.cra_name, "stdrng", 6); 2078 if (pr) { 2079 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8); 2080 pos = 8; 2081 } else { 2082 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10); 2083 pos = 10; 2084 } 2085 memcpy(alg->base.cra_driver_name + pos, core->cra_name, 2086 strlen(core->cra_name)); 2087 2088 alg->base.cra_priority = priority; 2089 priority++; 2090 /* 2091 * If FIPS mode enabled, the selected DRBG shall have the 2092 * highest cra_priority over other stdrng instances to ensure 2093 * it is selected. 2094 */ 2095 if (fips_enabled) 2096 alg->base.cra_priority += 200; 2097 2098 alg->base.cra_ctxsize = sizeof(struct drbg_state); 2099 alg->base.cra_module = THIS_MODULE; 2100 alg->base.cra_init = drbg_kcapi_init; 2101 alg->base.cra_exit = drbg_kcapi_cleanup; 2102 alg->generate = drbg_kcapi_random; 2103 alg->seed = drbg_kcapi_seed; 2104 alg->set_ent = drbg_kcapi_set_entropy; 2105 alg->seedsize = 0; 2106 } 2107 2108 static int __init drbg_init(void) 2109 { 2110 unsigned int i = 0; /* pointer to drbg_algs */ 2111 unsigned int j = 0; /* pointer to drbg_cores */ 2112 int ret; 2113 2114 ret = drbg_healthcheck_sanity(); 2115 if (ret) 2116 return ret; 2117 2118 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) { 2119 pr_info("DRBG: Cannot register all DRBG types" 2120 "(slots needed: %zu, slots available: %zu)\n", 2121 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs)); 2122 return -EFAULT; 2123 } 2124 2125 /* 2126 * each DRBG definition can be used with PR and without PR, thus 2127 * we instantiate each DRBG in drbg_cores[] twice. 2128 * 2129 * As the order of placing them into the drbg_algs array matters 2130 * (the later DRBGs receive a higher cra_priority) we register the 2131 * prediction resistance DRBGs first as the should not be too 2132 * interesting. 2133 */ 2134 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2135 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1); 2136 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++) 2137 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0); 2138 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2139 } 2140 2141 static void __exit drbg_exit(void) 2142 { 2143 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); 2144 } 2145 2146 subsys_initcall(drbg_init); 2147 module_exit(drbg_exit); 2148 #ifndef CRYPTO_DRBG_HASH_STRING 2149 #define CRYPTO_DRBG_HASH_STRING "" 2150 #endif 2151 #ifndef CRYPTO_DRBG_HMAC_STRING 2152 #define CRYPTO_DRBG_HMAC_STRING "" 2153 #endif 2154 #ifndef CRYPTO_DRBG_CTR_STRING 2155 #define CRYPTO_DRBG_CTR_STRING "" 2156 #endif 2157 MODULE_LICENSE("GPL"); 2158 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); 2159 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) " 2160 "using following cores: " 2161 CRYPTO_DRBG_HASH_STRING 2162 CRYPTO_DRBG_HMAC_STRING 2163 CRYPTO_DRBG_CTR_STRING); 2164 MODULE_ALIAS_CRYPTO("stdrng"); 2165 MODULE_IMPORT_NS(CRYPTO_INTERNAL); 2166