1 /*
2 * DRBG: Deterministic Random Bits Generator
3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following
4 * properties:
5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
8 * * with and without prediction resistance
9 *
10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, and the entire permission notice in its entirety,
17 * including the disclaimer of warranties.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. The name of the author may not be used to endorse or promote
22 * products derived from this software without specific prior
23 * written permission.
24 *
25 * ALTERNATIVELY, this product may be distributed under the terms of
26 * the GNU General Public License, in which case the provisions of the GPL are
27 * required INSTEAD OF the above restrictions. (This clause is
28 * necessary due to a potential bad interaction between the GPL and
29 * the restrictions contained in a BSD-style copyright.)
30 *
31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
42 * DAMAGE.
43 *
44 * DRBG Usage
45 * ==========
46 * The SP 800-90A DRBG allows the user to specify a personalization string
47 * for initialization as well as an additional information string for each
48 * random number request. The following code fragments show how a caller
49 * uses the kernel crypto API to use the full functionality of the DRBG.
50 *
51 * Usage without any additional data
52 * ---------------------------------
53 * struct crypto_rng *drng;
54 * int err;
55 * char data[DATALEN];
56 *
57 * drng = crypto_alloc_rng(drng_name, 0, 0);
58 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
59 * crypto_free_rng(drng);
60 *
61 *
62 * Usage with personalization string during initialization
63 * -------------------------------------------------------
64 * struct crypto_rng *drng;
65 * int err;
66 * char data[DATALEN];
67 * struct drbg_string pers;
68 * char personalization[11] = "some-string";
69 *
70 * drbg_string_fill(&pers, personalization, strlen(personalization));
71 * drng = crypto_alloc_rng(drng_name, 0, 0);
72 * // The reset completely re-initializes the DRBG with the provided
73 * // personalization string
74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
75 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
76 * crypto_free_rng(drng);
77 *
78 *
79 * Usage with additional information string during random number request
80 * ---------------------------------------------------------------------
81 * struct crypto_rng *drng;
82 * int err;
83 * char data[DATALEN];
84 * char addtl_string[11] = "some-string";
85 * string drbg_string addtl;
86 *
87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
88 * drng = crypto_alloc_rng(drng_name, 0, 0);
89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns
90 * // the same error codes.
91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
92 * crypto_free_rng(drng);
93 *
94 *
95 * Usage with personalization and additional information strings
96 * -------------------------------------------------------------
97 * Just mix both scenarios above.
98 */
99
100 #include <crypto/drbg.h>
101 #include <crypto/internal/cipher.h>
102 #include <linux/kernel.h>
103 #include <linux/jiffies.h>
104
105 /***************************************************************
106 * Backend cipher definitions available to DRBG
107 ***************************************************************/
108
109 /*
110 * The order of the DRBG definitions here matter: every DRBG is registered
111 * as stdrng. Each DRBG receives an increasing cra_priority values the later
112 * they are defined in this array (see drbg_fill_array).
113 *
114 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and the
115 * HMAC-SHA512 / SHA256 / AES 256 over other ciphers. Thus, the
116 * favored DRBGs are the latest entries in this array.
117 */
118 static const struct drbg_core drbg_cores[] = {
119 #ifdef CONFIG_CRYPTO_DRBG_CTR
120 {
121 .flags = DRBG_CTR | DRBG_STRENGTH128,
122 .statelen = 32, /* 256 bits as defined in 10.2.1 */
123 .blocklen_bytes = 16,
124 .cra_name = "ctr_aes128",
125 .backend_cra_name = "aes",
126 }, {
127 .flags = DRBG_CTR | DRBG_STRENGTH192,
128 .statelen = 40, /* 320 bits as defined in 10.2.1 */
129 .blocklen_bytes = 16,
130 .cra_name = "ctr_aes192",
131 .backend_cra_name = "aes",
132 }, {
133 .flags = DRBG_CTR | DRBG_STRENGTH256,
134 .statelen = 48, /* 384 bits as defined in 10.2.1 */
135 .blocklen_bytes = 16,
136 .cra_name = "ctr_aes256",
137 .backend_cra_name = "aes",
138 },
139 #endif /* CONFIG_CRYPTO_DRBG_CTR */
140 #ifdef CONFIG_CRYPTO_DRBG_HASH
141 {
142 .flags = DRBG_HASH | DRBG_STRENGTH256,
143 .statelen = 111, /* 888 bits */
144 .blocklen_bytes = 48,
145 .cra_name = "sha384",
146 .backend_cra_name = "sha384",
147 }, {
148 .flags = DRBG_HASH | DRBG_STRENGTH256,
149 .statelen = 111, /* 888 bits */
150 .blocklen_bytes = 64,
151 .cra_name = "sha512",
152 .backend_cra_name = "sha512",
153 }, {
154 .flags = DRBG_HASH | DRBG_STRENGTH256,
155 .statelen = 55, /* 440 bits */
156 .blocklen_bytes = 32,
157 .cra_name = "sha256",
158 .backend_cra_name = "sha256",
159 },
160 #endif /* CONFIG_CRYPTO_DRBG_HASH */
161 #ifdef CONFIG_CRYPTO_DRBG_HMAC
162 {
163 .flags = DRBG_HMAC | DRBG_STRENGTH256,
164 .statelen = 48, /* block length of cipher */
165 .blocklen_bytes = 48,
166 .cra_name = "hmac_sha384",
167 .backend_cra_name = "hmac(sha384)",
168 }, {
169 .flags = DRBG_HMAC | DRBG_STRENGTH256,
170 .statelen = 32, /* block length of cipher */
171 .blocklen_bytes = 32,
172 .cra_name = "hmac_sha256",
173 .backend_cra_name = "hmac(sha256)",
174 }, {
175 .flags = DRBG_HMAC | DRBG_STRENGTH256,
176 .statelen = 64, /* block length of cipher */
177 .blocklen_bytes = 64,
178 .cra_name = "hmac_sha512",
179 .backend_cra_name = "hmac(sha512)",
180 },
181 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
182 };
183
184 static int drbg_uninstantiate(struct drbg_state *drbg);
185
186 /******************************************************************
187 * Generic helper functions
188 ******************************************************************/
189
190 /*
191 * Return strength of DRBG according to SP800-90A section 8.4
192 *
193 * @flags DRBG flags reference
194 *
195 * Return: normalized strength in *bytes* value or 32 as default
196 * to counter programming errors
197 */
drbg_sec_strength(drbg_flag_t flags)198 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
199 {
200 switch (flags & DRBG_STRENGTH_MASK) {
201 case DRBG_STRENGTH128:
202 return 16;
203 case DRBG_STRENGTH192:
204 return 24;
205 case DRBG_STRENGTH256:
206 return 32;
207 default:
208 return 32;
209 }
210 }
211
212 /*
213 * FIPS 140-2 continuous self test for the noise source
214 * The test is performed on the noise source input data. Thus, the function
215 * implicitly knows the size of the buffer to be equal to the security
216 * strength.
217 *
218 * Note, this function disregards the nonce trailing the entropy data during
219 * initial seeding.
220 *
221 * drbg->drbg_mutex must have been taken.
222 *
223 * @drbg DRBG handle
224 * @entropy buffer of seed data to be checked
225 *
226 * return:
227 * 0 on success
228 * -EAGAIN on when the CTRNG is not yet primed
229 * < 0 on error
230 */
drbg_fips_continuous_test(struct drbg_state * drbg,const unsigned char * entropy)231 static int drbg_fips_continuous_test(struct drbg_state *drbg,
232 const unsigned char *entropy)
233 {
234 unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
235 int ret = 0;
236
237 if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
238 return 0;
239
240 /* skip test if we test the overall system */
241 if (list_empty(&drbg->test_data.list))
242 return 0;
243 /* only perform test in FIPS mode */
244 if (!fips_enabled)
245 return 0;
246
247 if (!drbg->fips_primed) {
248 /* Priming of FIPS test */
249 memcpy(drbg->prev, entropy, entropylen);
250 drbg->fips_primed = true;
251 /* priming: another round is needed */
252 return -EAGAIN;
253 }
254 ret = memcmp(drbg->prev, entropy, entropylen);
255 if (!ret)
256 panic("DRBG continuous self test failed\n");
257 memcpy(drbg->prev, entropy, entropylen);
258
259 /* the test shall pass when the two values are not equal */
260 return 0;
261 }
262
263 /*
264 * Convert an integer into a byte representation of this integer.
265 * The byte representation is big-endian
266 *
267 * @val value to be converted
268 * @buf buffer holding the converted integer -- caller must ensure that
269 * buffer size is at least 32 bit
270 */
271 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
drbg_cpu_to_be32(__u32 val,unsigned char * buf)272 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
273 {
274 struct s {
275 __be32 conv;
276 };
277 struct s *conversion = (struct s *) buf;
278
279 conversion->conv = cpu_to_be32(val);
280 }
281 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
282
283 /******************************************************************
284 * CTR DRBG callback functions
285 ******************************************************************/
286
287 #ifdef CONFIG_CRYPTO_DRBG_CTR
288 #define CRYPTO_DRBG_CTR_STRING "CTR "
289 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
290 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
291 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
292 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
293 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
294 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
295
296 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
297 const unsigned char *key);
298 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
299 const struct drbg_string *in);
300 static int drbg_init_sym_kernel(struct drbg_state *drbg);
301 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
302 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
303 u8 *inbuf, u32 inbuflen,
304 u8 *outbuf, u32 outlen);
305 #define DRBG_OUTSCRATCHLEN 256
306
307 /* BCC function for CTR DRBG as defined in 10.4.3 */
drbg_ctr_bcc(struct drbg_state * drbg,unsigned char * out,const unsigned char * key,struct list_head * in)308 static int drbg_ctr_bcc(struct drbg_state *drbg,
309 unsigned char *out, const unsigned char *key,
310 struct list_head *in)
311 {
312 int ret = 0;
313 struct drbg_string *curr = NULL;
314 struct drbg_string data;
315 short cnt = 0;
316
317 drbg_string_fill(&data, out, drbg_blocklen(drbg));
318
319 /* 10.4.3 step 2 / 4 */
320 drbg_kcapi_symsetkey(drbg, key);
321 list_for_each_entry(curr, in, list) {
322 const unsigned char *pos = curr->buf;
323 size_t len = curr->len;
324 /* 10.4.3 step 4.1 */
325 while (len) {
326 /* 10.4.3 step 4.2 */
327 if (drbg_blocklen(drbg) == cnt) {
328 cnt = 0;
329 ret = drbg_kcapi_sym(drbg, out, &data);
330 if (ret)
331 return ret;
332 }
333 out[cnt] ^= *pos;
334 pos++;
335 cnt++;
336 len--;
337 }
338 }
339 /* 10.4.3 step 4.2 for last block */
340 if (cnt)
341 ret = drbg_kcapi_sym(drbg, out, &data);
342
343 return ret;
344 }
345
346 /*
347 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
348 * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
349 * the scratchpad is used as follows:
350 * drbg_ctr_update:
351 * temp
352 * start: drbg->scratchpad
353 * length: drbg_statelen(drbg) + drbg_blocklen(drbg)
354 * note: the cipher writing into this variable works
355 * blocklen-wise. Now, when the statelen is not a multiple
356 * of blocklen, the generateion loop below "spills over"
357 * by at most blocklen. Thus, we need to give sufficient
358 * memory.
359 * df_data
360 * start: drbg->scratchpad +
361 * drbg_statelen(drbg) + drbg_blocklen(drbg)
362 * length: drbg_statelen(drbg)
363 *
364 * drbg_ctr_df:
365 * pad
366 * start: df_data + drbg_statelen(drbg)
367 * length: drbg_blocklen(drbg)
368 * iv
369 * start: pad + drbg_blocklen(drbg)
370 * length: drbg_blocklen(drbg)
371 * temp
372 * start: iv + drbg_blocklen(drbg)
373 * length: drbg_satelen(drbg) + drbg_blocklen(drbg)
374 * note: temp is the buffer that the BCC function operates
375 * on. BCC operates blockwise. drbg_statelen(drbg)
376 * is sufficient when the DRBG state length is a multiple
377 * of the block size. For AES192 (and maybe other ciphers)
378 * this is not correct and the length for temp is
379 * insufficient (yes, that also means for such ciphers,
380 * the final output of all BCC rounds are truncated).
381 * Therefore, add drbg_blocklen(drbg) to cover all
382 * possibilities.
383 */
384
385 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
drbg_ctr_df(struct drbg_state * drbg,unsigned char * df_data,size_t bytes_to_return,struct list_head * seedlist)386 static int drbg_ctr_df(struct drbg_state *drbg,
387 unsigned char *df_data, size_t bytes_to_return,
388 struct list_head *seedlist)
389 {
390 int ret = -EFAULT;
391 unsigned char L_N[8];
392 /* S3 is input */
393 struct drbg_string S1, S2, S4, cipherin;
394 LIST_HEAD(bcc_list);
395 unsigned char *pad = df_data + drbg_statelen(drbg);
396 unsigned char *iv = pad + drbg_blocklen(drbg);
397 unsigned char *temp = iv + drbg_blocklen(drbg);
398 size_t padlen = 0;
399 unsigned int templen = 0;
400 /* 10.4.2 step 7 */
401 unsigned int i = 0;
402 /* 10.4.2 step 8 */
403 const unsigned char *K = (unsigned char *)
404 "\x00\x01\x02\x03\x04\x05\x06\x07"
405 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
406 "\x10\x11\x12\x13\x14\x15\x16\x17"
407 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
408 unsigned char *X;
409 size_t generated_len = 0;
410 size_t inputlen = 0;
411 struct drbg_string *seed = NULL;
412
413 memset(pad, 0, drbg_blocklen(drbg));
414 memset(iv, 0, drbg_blocklen(drbg));
415
416 /* 10.4.2 step 1 is implicit as we work byte-wise */
417
418 /* 10.4.2 step 2 */
419 if ((512/8) < bytes_to_return)
420 return -EINVAL;
421
422 /* 10.4.2 step 2 -- calculate the entire length of all input data */
423 list_for_each_entry(seed, seedlist, list)
424 inputlen += seed->len;
425 drbg_cpu_to_be32(inputlen, &L_N[0]);
426
427 /* 10.4.2 step 3 */
428 drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
429
430 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
431 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
432 /* wrap the padlen appropriately */
433 if (padlen)
434 padlen = drbg_blocklen(drbg) - padlen;
435 /*
436 * pad / padlen contains the 0x80 byte and the following zero bytes.
437 * As the calculated padlen value only covers the number of zero
438 * bytes, this value has to be incremented by one for the 0x80 byte.
439 */
440 padlen++;
441 pad[0] = 0x80;
442
443 /* 10.4.2 step 4 -- first fill the linked list and then order it */
444 drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
445 list_add_tail(&S1.list, &bcc_list);
446 drbg_string_fill(&S2, L_N, sizeof(L_N));
447 list_add_tail(&S2.list, &bcc_list);
448 list_splice_tail(seedlist, &bcc_list);
449 drbg_string_fill(&S4, pad, padlen);
450 list_add_tail(&S4.list, &bcc_list);
451
452 /* 10.4.2 step 9 */
453 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
454 /*
455 * 10.4.2 step 9.1 - the padding is implicit as the buffer
456 * holds zeros after allocation -- even the increment of i
457 * is irrelevant as the increment remains within length of i
458 */
459 drbg_cpu_to_be32(i, iv);
460 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
461 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
462 if (ret)
463 goto out;
464 /* 10.4.2 step 9.3 */
465 i++;
466 templen += drbg_blocklen(drbg);
467 }
468
469 /* 10.4.2 step 11 */
470 X = temp + (drbg_keylen(drbg));
471 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
472
473 /* 10.4.2 step 12: overwriting of outval is implemented in next step */
474
475 /* 10.4.2 step 13 */
476 drbg_kcapi_symsetkey(drbg, temp);
477 while (generated_len < bytes_to_return) {
478 short blocklen = 0;
479 /*
480 * 10.4.2 step 13.1: the truncation of the key length is
481 * implicit as the key is only drbg_blocklen in size based on
482 * the implementation of the cipher function callback
483 */
484 ret = drbg_kcapi_sym(drbg, X, &cipherin);
485 if (ret)
486 goto out;
487 blocklen = (drbg_blocklen(drbg) <
488 (bytes_to_return - generated_len)) ?
489 drbg_blocklen(drbg) :
490 (bytes_to_return - generated_len);
491 /* 10.4.2 step 13.2 and 14 */
492 memcpy(df_data + generated_len, X, blocklen);
493 generated_len += blocklen;
494 }
495
496 ret = 0;
497
498 out:
499 memset(iv, 0, drbg_blocklen(drbg));
500 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
501 memset(pad, 0, drbg_blocklen(drbg));
502 return ret;
503 }
504
505 /*
506 * update function of CTR DRBG as defined in 10.2.1.2
507 *
508 * The reseed variable has an enhanced meaning compared to the update
509 * functions of the other DRBGs as follows:
510 * 0 => initial seed from initialization
511 * 1 => reseed via drbg_seed
512 * 2 => first invocation from drbg_ctr_update when addtl is present. In
513 * this case, the df_data scratchpad is not deleted so that it is
514 * available for another calls to prevent calling the DF function
515 * again.
516 * 3 => second invocation from drbg_ctr_update. When the update function
517 * was called with addtl, the df_data memory already contains the
518 * DFed addtl information and we do not need to call DF again.
519 */
drbg_ctr_update(struct drbg_state * drbg,struct list_head * seed,int reseed)520 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
521 int reseed)
522 {
523 int ret = -EFAULT;
524 /* 10.2.1.2 step 1 */
525 unsigned char *temp = drbg->scratchpad;
526 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
527 drbg_blocklen(drbg);
528
529 if (3 > reseed)
530 memset(df_data, 0, drbg_statelen(drbg));
531
532 if (!reseed) {
533 /*
534 * The DRBG uses the CTR mode of the underlying AES cipher. The
535 * CTR mode increments the counter value after the AES operation
536 * but SP800-90A requires that the counter is incremented before
537 * the AES operation. Hence, we increment it at the time we set
538 * it by one.
539 */
540 crypto_inc(drbg->V, drbg_blocklen(drbg));
541
542 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
543 drbg_keylen(drbg));
544 if (ret)
545 goto out;
546 }
547
548 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
549 if (seed) {
550 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
551 if (ret)
552 goto out;
553 }
554
555 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
556 temp, drbg_statelen(drbg));
557 if (ret)
558 return ret;
559
560 /* 10.2.1.2 step 5 */
561 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
562 drbg_keylen(drbg));
563 if (ret)
564 goto out;
565 /* 10.2.1.2 step 6 */
566 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
567 /* See above: increment counter by one to compensate timing of CTR op */
568 crypto_inc(drbg->V, drbg_blocklen(drbg));
569 ret = 0;
570
571 out:
572 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
573 if (2 != reseed)
574 memset(df_data, 0, drbg_statelen(drbg));
575 return ret;
576 }
577
578 /*
579 * scratchpad use: drbg_ctr_update is called independently from
580 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
581 */
582 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
drbg_ctr_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)583 static int drbg_ctr_generate(struct drbg_state *drbg,
584 unsigned char *buf, unsigned int buflen,
585 struct list_head *addtl)
586 {
587 int ret;
588 int len = min_t(int, buflen, INT_MAX);
589
590 /* 10.2.1.5.2 step 2 */
591 if (addtl && !list_empty(addtl)) {
592 ret = drbg_ctr_update(drbg, addtl, 2);
593 if (ret)
594 return 0;
595 }
596
597 /* 10.2.1.5.2 step 4.1 */
598 ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len);
599 if (ret)
600 return ret;
601
602 /* 10.2.1.5.2 step 6 */
603 ret = drbg_ctr_update(drbg, NULL, 3);
604 if (ret)
605 len = ret;
606
607 return len;
608 }
609
610 static const struct drbg_state_ops drbg_ctr_ops = {
611 .update = drbg_ctr_update,
612 .generate = drbg_ctr_generate,
613 .crypto_init = drbg_init_sym_kernel,
614 .crypto_fini = drbg_fini_sym_kernel,
615 };
616 #endif /* CONFIG_CRYPTO_DRBG_CTR */
617
618 /******************************************************************
619 * HMAC DRBG callback functions
620 ******************************************************************/
621
622 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
623 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
624 const struct list_head *in);
625 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
626 const unsigned char *key);
627 static int drbg_init_hash_kernel(struct drbg_state *drbg);
628 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
629 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
630
631 #ifdef CONFIG_CRYPTO_DRBG_HMAC
632 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
633 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
634 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
635 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
636 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
637 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
638 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
639
640 /* update function of HMAC DRBG as defined in 10.1.2.2 */
drbg_hmac_update(struct drbg_state * drbg,struct list_head * seed,int reseed)641 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
642 int reseed)
643 {
644 int ret = -EFAULT;
645 int i = 0;
646 struct drbg_string seed1, seed2, vdata;
647 LIST_HEAD(seedlist);
648 LIST_HEAD(vdatalist);
649
650 if (!reseed) {
651 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
652 memset(drbg->V, 1, drbg_statelen(drbg));
653 drbg_kcapi_hmacsetkey(drbg, drbg->C);
654 }
655
656 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
657 list_add_tail(&seed1.list, &seedlist);
658 /* buffer of seed2 will be filled in for loop below with one byte */
659 drbg_string_fill(&seed2, NULL, 1);
660 list_add_tail(&seed2.list, &seedlist);
661 /* input data of seed is allowed to be NULL at this point */
662 if (seed)
663 list_splice_tail(seed, &seedlist);
664
665 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
666 list_add_tail(&vdata.list, &vdatalist);
667 for (i = 2; 0 < i; i--) {
668 /* first round uses 0x0, second 0x1 */
669 unsigned char prefix = DRBG_PREFIX0;
670 if (1 == i)
671 prefix = DRBG_PREFIX1;
672 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
673 seed2.buf = &prefix;
674 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
675 if (ret)
676 return ret;
677 drbg_kcapi_hmacsetkey(drbg, drbg->C);
678
679 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
680 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
681 if (ret)
682 return ret;
683
684 /* 10.1.2.2 step 3 */
685 if (!seed)
686 return ret;
687 }
688
689 return 0;
690 }
691
692 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
drbg_hmac_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)693 static int drbg_hmac_generate(struct drbg_state *drbg,
694 unsigned char *buf,
695 unsigned int buflen,
696 struct list_head *addtl)
697 {
698 int len = 0;
699 int ret = 0;
700 struct drbg_string data;
701 LIST_HEAD(datalist);
702
703 /* 10.1.2.5 step 2 */
704 if (addtl && !list_empty(addtl)) {
705 ret = drbg_hmac_update(drbg, addtl, 1);
706 if (ret)
707 return ret;
708 }
709
710 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
711 list_add_tail(&data.list, &datalist);
712 while (len < buflen) {
713 unsigned int outlen = 0;
714 /* 10.1.2.5 step 4.1 */
715 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
716 if (ret)
717 return ret;
718 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
719 drbg_blocklen(drbg) : (buflen - len);
720
721 /* 10.1.2.5 step 4.2 */
722 memcpy(buf + len, drbg->V, outlen);
723 len += outlen;
724 }
725
726 /* 10.1.2.5 step 6 */
727 if (addtl && !list_empty(addtl))
728 ret = drbg_hmac_update(drbg, addtl, 1);
729 else
730 ret = drbg_hmac_update(drbg, NULL, 1);
731 if (ret)
732 return ret;
733
734 return len;
735 }
736
737 static const struct drbg_state_ops drbg_hmac_ops = {
738 .update = drbg_hmac_update,
739 .generate = drbg_hmac_generate,
740 .crypto_init = drbg_init_hash_kernel,
741 .crypto_fini = drbg_fini_hash_kernel,
742 };
743 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
744
745 /******************************************************************
746 * Hash DRBG callback functions
747 ******************************************************************/
748
749 #ifdef CONFIG_CRYPTO_DRBG_HASH
750 #define CRYPTO_DRBG_HASH_STRING "HASH "
751 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
752 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
753 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
754 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
755 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
756 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
757
758 /*
759 * Increment buffer
760 *
761 * @dst buffer to increment
762 * @add value to add
763 */
drbg_add_buf(unsigned char * dst,size_t dstlen,const unsigned char * add,size_t addlen)764 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
765 const unsigned char *add, size_t addlen)
766 {
767 /* implied: dstlen > addlen */
768 unsigned char *dstptr;
769 const unsigned char *addptr;
770 unsigned int remainder = 0;
771 size_t len = addlen;
772
773 dstptr = dst + (dstlen-1);
774 addptr = add + (addlen-1);
775 while (len) {
776 remainder += *dstptr + *addptr;
777 *dstptr = remainder & 0xff;
778 remainder >>= 8;
779 len--; dstptr--; addptr--;
780 }
781 len = dstlen - addlen;
782 while (len && remainder > 0) {
783 remainder = *dstptr + 1;
784 *dstptr = remainder & 0xff;
785 remainder >>= 8;
786 len--; dstptr--;
787 }
788 }
789
790 /*
791 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
792 * interlinked, the scratchpad is used as follows:
793 * drbg_hash_update
794 * start: drbg->scratchpad
795 * length: drbg_statelen(drbg)
796 * drbg_hash_df:
797 * start: drbg->scratchpad + drbg_statelen(drbg)
798 * length: drbg_blocklen(drbg)
799 *
800 * drbg_hash_process_addtl uses the scratchpad, but fully completes
801 * before either of the functions mentioned before are invoked. Therefore,
802 * drbg_hash_process_addtl does not need to be specifically considered.
803 */
804
805 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
drbg_hash_df(struct drbg_state * drbg,unsigned char * outval,size_t outlen,struct list_head * entropylist)806 static int drbg_hash_df(struct drbg_state *drbg,
807 unsigned char *outval, size_t outlen,
808 struct list_head *entropylist)
809 {
810 int ret = 0;
811 size_t len = 0;
812 unsigned char input[5];
813 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
814 struct drbg_string data;
815
816 /* 10.4.1 step 3 */
817 input[0] = 1;
818 drbg_cpu_to_be32((outlen * 8), &input[1]);
819
820 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
821 drbg_string_fill(&data, input, 5);
822 list_add(&data.list, entropylist);
823
824 /* 10.4.1 step 4 */
825 while (len < outlen) {
826 short blocklen = 0;
827 /* 10.4.1 step 4.1 */
828 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
829 if (ret)
830 goto out;
831 /* 10.4.1 step 4.2 */
832 input[0]++;
833 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
834 drbg_blocklen(drbg) : (outlen - len);
835 memcpy(outval + len, tmp, blocklen);
836 len += blocklen;
837 }
838
839 out:
840 memset(tmp, 0, drbg_blocklen(drbg));
841 return ret;
842 }
843
844 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
drbg_hash_update(struct drbg_state * drbg,struct list_head * seed,int reseed)845 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
846 int reseed)
847 {
848 int ret = 0;
849 struct drbg_string data1, data2;
850 LIST_HEAD(datalist);
851 LIST_HEAD(datalist2);
852 unsigned char *V = drbg->scratchpad;
853 unsigned char prefix = DRBG_PREFIX1;
854
855 if (!seed)
856 return -EINVAL;
857
858 if (reseed) {
859 /* 10.1.1.3 step 1 */
860 memcpy(V, drbg->V, drbg_statelen(drbg));
861 drbg_string_fill(&data1, &prefix, 1);
862 list_add_tail(&data1.list, &datalist);
863 drbg_string_fill(&data2, V, drbg_statelen(drbg));
864 list_add_tail(&data2.list, &datalist);
865 }
866 list_splice_tail(seed, &datalist);
867
868 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
869 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
870 if (ret)
871 goto out;
872
873 /* 10.1.1.2 / 10.1.1.3 step 4 */
874 prefix = DRBG_PREFIX0;
875 drbg_string_fill(&data1, &prefix, 1);
876 list_add_tail(&data1.list, &datalist2);
877 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
878 list_add_tail(&data2.list, &datalist2);
879 /* 10.1.1.2 / 10.1.1.3 step 4 */
880 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
881
882 out:
883 memset(drbg->scratchpad, 0, drbg_statelen(drbg));
884 return ret;
885 }
886
887 /* processing of additional information string for Hash DRBG */
drbg_hash_process_addtl(struct drbg_state * drbg,struct list_head * addtl)888 static int drbg_hash_process_addtl(struct drbg_state *drbg,
889 struct list_head *addtl)
890 {
891 int ret = 0;
892 struct drbg_string data1, data2;
893 LIST_HEAD(datalist);
894 unsigned char prefix = DRBG_PREFIX2;
895
896 /* 10.1.1.4 step 2 */
897 if (!addtl || list_empty(addtl))
898 return 0;
899
900 /* 10.1.1.4 step 2a */
901 drbg_string_fill(&data1, &prefix, 1);
902 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
903 list_add_tail(&data1.list, &datalist);
904 list_add_tail(&data2.list, &datalist);
905 list_splice_tail(addtl, &datalist);
906 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
907 if (ret)
908 goto out;
909
910 /* 10.1.1.4 step 2b */
911 drbg_add_buf(drbg->V, drbg_statelen(drbg),
912 drbg->scratchpad, drbg_blocklen(drbg));
913
914 out:
915 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
916 return ret;
917 }
918
919 /* Hashgen defined in 10.1.1.4 */
drbg_hash_hashgen(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen)920 static int drbg_hash_hashgen(struct drbg_state *drbg,
921 unsigned char *buf,
922 unsigned int buflen)
923 {
924 int len = 0;
925 int ret = 0;
926 unsigned char *src = drbg->scratchpad;
927 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
928 struct drbg_string data;
929 LIST_HEAD(datalist);
930
931 /* 10.1.1.4 step hashgen 2 */
932 memcpy(src, drbg->V, drbg_statelen(drbg));
933
934 drbg_string_fill(&data, src, drbg_statelen(drbg));
935 list_add_tail(&data.list, &datalist);
936 while (len < buflen) {
937 unsigned int outlen = 0;
938 /* 10.1.1.4 step hashgen 4.1 */
939 ret = drbg_kcapi_hash(drbg, dst, &datalist);
940 if (ret) {
941 len = ret;
942 goto out;
943 }
944 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
945 drbg_blocklen(drbg) : (buflen - len);
946 /* 10.1.1.4 step hashgen 4.2 */
947 memcpy(buf + len, dst, outlen);
948 len += outlen;
949 /* 10.1.1.4 hashgen step 4.3 */
950 if (len < buflen)
951 crypto_inc(src, drbg_statelen(drbg));
952 }
953
954 out:
955 memset(drbg->scratchpad, 0,
956 (drbg_statelen(drbg) + drbg_blocklen(drbg)));
957 return len;
958 }
959
960 /* generate function for Hash DRBG as defined in 10.1.1.4 */
drbg_hash_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)961 static int drbg_hash_generate(struct drbg_state *drbg,
962 unsigned char *buf, unsigned int buflen,
963 struct list_head *addtl)
964 {
965 int len = 0;
966 int ret = 0;
967 union {
968 unsigned char req[8];
969 __be64 req_int;
970 } u;
971 unsigned char prefix = DRBG_PREFIX3;
972 struct drbg_string data1, data2;
973 LIST_HEAD(datalist);
974
975 /* 10.1.1.4 step 2 */
976 ret = drbg_hash_process_addtl(drbg, addtl);
977 if (ret)
978 return ret;
979 /* 10.1.1.4 step 3 */
980 len = drbg_hash_hashgen(drbg, buf, buflen);
981
982 /* this is the value H as documented in 10.1.1.4 */
983 /* 10.1.1.4 step 4 */
984 drbg_string_fill(&data1, &prefix, 1);
985 list_add_tail(&data1.list, &datalist);
986 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
987 list_add_tail(&data2.list, &datalist);
988 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
989 if (ret) {
990 len = ret;
991 goto out;
992 }
993
994 /* 10.1.1.4 step 5 */
995 drbg_add_buf(drbg->V, drbg_statelen(drbg),
996 drbg->scratchpad, drbg_blocklen(drbg));
997 drbg_add_buf(drbg->V, drbg_statelen(drbg),
998 drbg->C, drbg_statelen(drbg));
999 u.req_int = cpu_to_be64(drbg->reseed_ctr);
1000 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1001
1002 out:
1003 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1004 return len;
1005 }
1006
1007 /*
1008 * scratchpad usage: as update and generate are used isolated, both
1009 * can use the scratchpad
1010 */
1011 static const struct drbg_state_ops drbg_hash_ops = {
1012 .update = drbg_hash_update,
1013 .generate = drbg_hash_generate,
1014 .crypto_init = drbg_init_hash_kernel,
1015 .crypto_fini = drbg_fini_hash_kernel,
1016 };
1017 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1018
1019 /******************************************************************
1020 * Functions common for DRBG implementations
1021 ******************************************************************/
1022
__drbg_seed(struct drbg_state * drbg,struct list_head * seed,int reseed,enum drbg_seed_state new_seed_state)1023 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1024 int reseed, enum drbg_seed_state new_seed_state)
1025 {
1026 int ret = drbg->d_ops->update(drbg, seed, reseed);
1027
1028 if (ret)
1029 return ret;
1030
1031 drbg->seeded = new_seed_state;
1032 drbg->last_seed_time = jiffies;
1033 /* 10.1.1.2 / 10.1.1.3 step 5 */
1034 drbg->reseed_ctr = 1;
1035
1036 switch (drbg->seeded) {
1037 case DRBG_SEED_STATE_UNSEEDED:
1038 /* Impossible, but handle it to silence compiler warnings. */
1039 fallthrough;
1040 case DRBG_SEED_STATE_PARTIAL:
1041 /*
1042 * Require frequent reseeds until the seed source is
1043 * fully initialized.
1044 */
1045 drbg->reseed_threshold = 50;
1046 break;
1047
1048 case DRBG_SEED_STATE_FULL:
1049 /*
1050 * Seed source has become fully initialized, frequent
1051 * reseeds no longer required.
1052 */
1053 drbg->reseed_threshold = drbg_max_requests(drbg);
1054 break;
1055 }
1056
1057 return ret;
1058 }
1059
drbg_get_random_bytes(struct drbg_state * drbg,unsigned char * entropy,unsigned int entropylen)1060 static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1061 unsigned char *entropy,
1062 unsigned int entropylen)
1063 {
1064 int ret;
1065
1066 do {
1067 get_random_bytes(entropy, entropylen);
1068 ret = drbg_fips_continuous_test(drbg, entropy);
1069 if (ret && ret != -EAGAIN)
1070 return ret;
1071 } while (ret);
1072
1073 return 0;
1074 }
1075
drbg_seed_from_random(struct drbg_state * drbg)1076 static int drbg_seed_from_random(struct drbg_state *drbg)
1077 {
1078 struct drbg_string data;
1079 LIST_HEAD(seedlist);
1080 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1081 unsigned char entropy[32];
1082 int ret;
1083
1084 BUG_ON(!entropylen);
1085 BUG_ON(entropylen > sizeof(entropy));
1086
1087 drbg_string_fill(&data, entropy, entropylen);
1088 list_add_tail(&data.list, &seedlist);
1089
1090 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1091 if (ret)
1092 goto out;
1093
1094 ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
1095
1096 out:
1097 memzero_explicit(entropy, entropylen);
1098 return ret;
1099 }
1100
drbg_nopr_reseed_interval_elapsed(struct drbg_state * drbg)1101 static bool drbg_nopr_reseed_interval_elapsed(struct drbg_state *drbg)
1102 {
1103 unsigned long next_reseed;
1104
1105 /* Don't ever reseed from get_random_bytes() in test mode. */
1106 if (list_empty(&drbg->test_data.list))
1107 return false;
1108
1109 /*
1110 * Obtain fresh entropy for the nopr DRBGs after 300s have
1111 * elapsed in order to still achieve sort of partial
1112 * prediction resistance over the time domain at least. Note
1113 * that the period of 300s has been chosen to match the
1114 * CRNG_RESEED_INTERVAL of the get_random_bytes()' chacha
1115 * rngs.
1116 */
1117 next_reseed = drbg->last_seed_time + 300 * HZ;
1118 return time_after(jiffies, next_reseed);
1119 }
1120
1121 /*
1122 * Seeding or reseeding of the DRBG
1123 *
1124 * @drbg: DRBG state struct
1125 * @pers: personalization / additional information buffer
1126 * @reseed: 0 for initial seed process, 1 for reseeding
1127 *
1128 * return:
1129 * 0 on success
1130 * error value otherwise
1131 */
drbg_seed(struct drbg_state * drbg,struct drbg_string * pers,bool reseed)1132 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1133 bool reseed)
1134 {
1135 int ret;
1136 unsigned char entropy[((32 + 16) * 2)];
1137 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1138 struct drbg_string data1;
1139 LIST_HEAD(seedlist);
1140 enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
1141
1142 /* 9.1 / 9.2 / 9.3.1 step 3 */
1143 if (pers && pers->len > (drbg_max_addtl(drbg))) {
1144 pr_devel("DRBG: personalization string too long %zu\n",
1145 pers->len);
1146 return -EINVAL;
1147 }
1148
1149 if (list_empty(&drbg->test_data.list)) {
1150 drbg_string_fill(&data1, drbg->test_data.buf,
1151 drbg->test_data.len);
1152 pr_devel("DRBG: using test entropy\n");
1153 } else {
1154 /*
1155 * Gather entropy equal to the security strength of the DRBG.
1156 * With a derivation function, a nonce is required in addition
1157 * to the entropy. A nonce must be at least 1/2 of the security
1158 * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1159 * of the strength. The consideration of a nonce is only
1160 * applicable during initial seeding.
1161 */
1162 BUG_ON(!entropylen);
1163 if (!reseed)
1164 entropylen = ((entropylen + 1) / 2) * 3;
1165 BUG_ON((entropylen * 2) > sizeof(entropy));
1166
1167 /* Get seed from in-kernel /dev/urandom */
1168 if (!rng_is_initialized())
1169 new_seed_state = DRBG_SEED_STATE_PARTIAL;
1170
1171 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1172 if (ret)
1173 goto out;
1174
1175 if (!drbg->jent) {
1176 drbg_string_fill(&data1, entropy, entropylen);
1177 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1178 entropylen);
1179 } else {
1180 /*
1181 * Get seed from Jitter RNG, failures are
1182 * fatal only in FIPS mode.
1183 */
1184 ret = crypto_rng_get_bytes(drbg->jent,
1185 entropy + entropylen,
1186 entropylen);
1187 if (fips_enabled && ret) {
1188 pr_devel("DRBG: jent failed with %d\n", ret);
1189
1190 /*
1191 * Do not treat the transient failure of the
1192 * Jitter RNG as an error that needs to be
1193 * reported. The combined number of the
1194 * maximum reseed threshold times the maximum
1195 * number of Jitter RNG transient errors is
1196 * less than the reseed threshold required by
1197 * SP800-90A allowing us to treat the
1198 * transient errors as such.
1199 *
1200 * However, we mandate that at least the first
1201 * seeding operation must succeed with the
1202 * Jitter RNG.
1203 */
1204 if (!reseed || ret != -EAGAIN)
1205 goto out;
1206 }
1207
1208 drbg_string_fill(&data1, entropy, entropylen * 2);
1209 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1210 entropylen * 2);
1211 }
1212 }
1213 list_add_tail(&data1.list, &seedlist);
1214
1215 /*
1216 * concatenation of entropy with personalization str / addtl input)
1217 * the variable pers is directly handed in by the caller, so check its
1218 * contents whether it is appropriate
1219 */
1220 if (pers && pers->buf && 0 < pers->len) {
1221 list_add_tail(&pers->list, &seedlist);
1222 pr_devel("DRBG: using personalization string\n");
1223 }
1224
1225 if (!reseed) {
1226 memset(drbg->V, 0, drbg_statelen(drbg));
1227 memset(drbg->C, 0, drbg_statelen(drbg));
1228 }
1229
1230 ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
1231
1232 out:
1233 memzero_explicit(entropy, entropylen * 2);
1234
1235 return ret;
1236 }
1237
1238 /* Free all substructures in a DRBG state without the DRBG state structure */
drbg_dealloc_state(struct drbg_state * drbg)1239 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1240 {
1241 if (!drbg)
1242 return;
1243 kfree_sensitive(drbg->Vbuf);
1244 drbg->Vbuf = NULL;
1245 drbg->V = NULL;
1246 kfree_sensitive(drbg->Cbuf);
1247 drbg->Cbuf = NULL;
1248 drbg->C = NULL;
1249 kfree_sensitive(drbg->scratchpadbuf);
1250 drbg->scratchpadbuf = NULL;
1251 drbg->reseed_ctr = 0;
1252 drbg->d_ops = NULL;
1253 drbg->core = NULL;
1254 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1255 kfree_sensitive(drbg->prev);
1256 drbg->prev = NULL;
1257 drbg->fips_primed = false;
1258 }
1259 }
1260
1261 /*
1262 * Allocate all sub-structures for a DRBG state.
1263 * The DRBG state structure must already be allocated.
1264 */
drbg_alloc_state(struct drbg_state * drbg)1265 static inline int drbg_alloc_state(struct drbg_state *drbg)
1266 {
1267 int ret = -ENOMEM;
1268 unsigned int sb_size = 0;
1269
1270 switch (drbg->core->flags & DRBG_TYPE_MASK) {
1271 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1272 case DRBG_HMAC:
1273 drbg->d_ops = &drbg_hmac_ops;
1274 break;
1275 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1276 #ifdef CONFIG_CRYPTO_DRBG_HASH
1277 case DRBG_HASH:
1278 drbg->d_ops = &drbg_hash_ops;
1279 break;
1280 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1281 #ifdef CONFIG_CRYPTO_DRBG_CTR
1282 case DRBG_CTR:
1283 drbg->d_ops = &drbg_ctr_ops;
1284 break;
1285 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1286 default:
1287 ret = -EOPNOTSUPP;
1288 goto err;
1289 }
1290
1291 ret = drbg->d_ops->crypto_init(drbg);
1292 if (ret < 0)
1293 goto err;
1294
1295 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1296 if (!drbg->Vbuf) {
1297 ret = -ENOMEM;
1298 goto fini;
1299 }
1300 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1301 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1302 if (!drbg->Cbuf) {
1303 ret = -ENOMEM;
1304 goto fini;
1305 }
1306 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1307 /* scratchpad is only generated for CTR and Hash */
1308 if (drbg->core->flags & DRBG_HMAC)
1309 sb_size = 0;
1310 else if (drbg->core->flags & DRBG_CTR)
1311 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1312 drbg_statelen(drbg) + /* df_data */
1313 drbg_blocklen(drbg) + /* pad */
1314 drbg_blocklen(drbg) + /* iv */
1315 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1316 else
1317 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1318
1319 if (0 < sb_size) {
1320 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1321 if (!drbg->scratchpadbuf) {
1322 ret = -ENOMEM;
1323 goto fini;
1324 }
1325 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1326 }
1327
1328 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1329 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1330 GFP_KERNEL);
1331 if (!drbg->prev) {
1332 ret = -ENOMEM;
1333 goto fini;
1334 }
1335 drbg->fips_primed = false;
1336 }
1337
1338 return 0;
1339
1340 fini:
1341 drbg->d_ops->crypto_fini(drbg);
1342 err:
1343 drbg_dealloc_state(drbg);
1344 return ret;
1345 }
1346
1347 /*************************************************************************
1348 * DRBG interface functions
1349 *************************************************************************/
1350
1351 /*
1352 * DRBG generate function as required by SP800-90A - this function
1353 * generates random numbers
1354 *
1355 * @drbg DRBG state handle
1356 * @buf Buffer where to store the random numbers -- the buffer must already
1357 * be pre-allocated by caller
1358 * @buflen Length of output buffer - this value defines the number of random
1359 * bytes pulled from DRBG
1360 * @addtl Additional input that is mixed into state, may be NULL -- note
1361 * the entropy is pulled by the DRBG internally unconditionally
1362 * as defined in SP800-90A. The additional input is mixed into
1363 * the state in addition to the pulled entropy.
1364 *
1365 * return: 0 when all bytes are generated; < 0 in case of an error
1366 */
drbg_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct drbg_string * addtl)1367 static int drbg_generate(struct drbg_state *drbg,
1368 unsigned char *buf, unsigned int buflen,
1369 struct drbg_string *addtl)
1370 {
1371 int len = 0;
1372 LIST_HEAD(addtllist);
1373
1374 if (!drbg->core) {
1375 pr_devel("DRBG: not yet seeded\n");
1376 return -EINVAL;
1377 }
1378 if (0 == buflen || !buf) {
1379 pr_devel("DRBG: no output buffer provided\n");
1380 return -EINVAL;
1381 }
1382 if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1383 pr_devel("DRBG: wrong format of additional information\n");
1384 return -EINVAL;
1385 }
1386
1387 /* 9.3.1 step 2 */
1388 len = -EINVAL;
1389 if (buflen > (drbg_max_request_bytes(drbg))) {
1390 pr_devel("DRBG: requested random numbers too large %u\n",
1391 buflen);
1392 goto err;
1393 }
1394
1395 /* 9.3.1 step 3 is implicit with the chosen DRBG */
1396
1397 /* 9.3.1 step 4 */
1398 if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1399 pr_devel("DRBG: additional information string too long %zu\n",
1400 addtl->len);
1401 goto err;
1402 }
1403 /* 9.3.1 step 5 is implicit with the chosen DRBG */
1404
1405 /*
1406 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1407 * here. The spec is a bit convoluted here, we make it simpler.
1408 */
1409 if (drbg->reseed_threshold < drbg->reseed_ctr)
1410 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1411
1412 if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
1413 pr_devel("DRBG: reseeding before generation (prediction "
1414 "resistance: %s, state %s)\n",
1415 drbg->pr ? "true" : "false",
1416 (drbg->seeded == DRBG_SEED_STATE_FULL ?
1417 "seeded" : "unseeded"));
1418 /* 9.3.1 steps 7.1 through 7.3 */
1419 len = drbg_seed(drbg, addtl, true);
1420 if (len)
1421 goto err;
1422 /* 9.3.1 step 7.4 */
1423 addtl = NULL;
1424 } else if (rng_is_initialized() &&
1425 (drbg->seeded == DRBG_SEED_STATE_PARTIAL ||
1426 drbg_nopr_reseed_interval_elapsed(drbg))) {
1427 len = drbg_seed_from_random(drbg);
1428 if (len)
1429 goto err;
1430 }
1431
1432 if (addtl && 0 < addtl->len)
1433 list_add_tail(&addtl->list, &addtllist);
1434 /* 9.3.1 step 8 and 10 */
1435 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1436
1437 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1438 drbg->reseed_ctr++;
1439 if (0 >= len)
1440 goto err;
1441
1442 /*
1443 * Section 11.3.3 requires to re-perform self tests after some
1444 * generated random numbers. The chosen value after which self
1445 * test is performed is arbitrary, but it should be reasonable.
1446 * However, we do not perform the self tests because of the following
1447 * reasons: it is mathematically impossible that the initial self tests
1448 * were successfully and the following are not. If the initial would
1449 * pass and the following would not, the kernel integrity is violated.
1450 * In this case, the entire kernel operation is questionable and it
1451 * is unlikely that the integrity violation only affects the
1452 * correct operation of the DRBG.
1453 *
1454 * Albeit the following code is commented out, it is provided in
1455 * case somebody has a need to implement the test of 11.3.3.
1456 */
1457 #if 0
1458 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1459 int err = 0;
1460 pr_devel("DRBG: start to perform self test\n");
1461 if (drbg->core->flags & DRBG_HMAC)
1462 err = alg_test("drbg_pr_hmac_sha512",
1463 "drbg_pr_hmac_sha512", 0, 0);
1464 else if (drbg->core->flags & DRBG_CTR)
1465 err = alg_test("drbg_pr_ctr_aes256",
1466 "drbg_pr_ctr_aes256", 0, 0);
1467 else
1468 err = alg_test("drbg_pr_sha256",
1469 "drbg_pr_sha256", 0, 0);
1470 if (err) {
1471 pr_err("DRBG: periodical self test failed\n");
1472 /*
1473 * uninstantiate implies that from now on, only errors
1474 * are returned when reusing this DRBG cipher handle
1475 */
1476 drbg_uninstantiate(drbg);
1477 return 0;
1478 } else {
1479 pr_devel("DRBG: self test successful\n");
1480 }
1481 }
1482 #endif
1483
1484 /*
1485 * All operations were successful, return 0 as mandated by
1486 * the kernel crypto API interface.
1487 */
1488 len = 0;
1489 err:
1490 return len;
1491 }
1492
1493 /*
1494 * Wrapper around drbg_generate which can pull arbitrary long strings
1495 * from the DRBG without hitting the maximum request limitation.
1496 *
1497 * Parameters: see drbg_generate
1498 * Return codes: see drbg_generate -- if one drbg_generate request fails,
1499 * the entire drbg_generate_long request fails
1500 */
drbg_generate_long(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct drbg_string * addtl)1501 static int drbg_generate_long(struct drbg_state *drbg,
1502 unsigned char *buf, unsigned int buflen,
1503 struct drbg_string *addtl)
1504 {
1505 unsigned int len = 0;
1506 unsigned int slice = 0;
1507 do {
1508 int err = 0;
1509 unsigned int chunk = 0;
1510 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1511 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1512 mutex_lock(&drbg->drbg_mutex);
1513 err = drbg_generate(drbg, buf + len, chunk, addtl);
1514 mutex_unlock(&drbg->drbg_mutex);
1515 if (0 > err)
1516 return err;
1517 len += chunk;
1518 } while (slice > 0 && (len < buflen));
1519 return 0;
1520 }
1521
drbg_prepare_hrng(struct drbg_state * drbg)1522 static int drbg_prepare_hrng(struct drbg_state *drbg)
1523 {
1524 /* We do not need an HRNG in test mode. */
1525 if (list_empty(&drbg->test_data.list))
1526 return 0;
1527
1528 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1529 if (IS_ERR(drbg->jent)) {
1530 const int err = PTR_ERR(drbg->jent);
1531
1532 drbg->jent = NULL;
1533 if (fips_enabled)
1534 return err;
1535 pr_info("DRBG: Continuing without Jitter RNG\n");
1536 }
1537
1538 return 0;
1539 }
1540
1541 /*
1542 * DRBG instantiation function as required by SP800-90A - this function
1543 * sets up the DRBG handle, performs the initial seeding and all sanity
1544 * checks required by SP800-90A
1545 *
1546 * @drbg memory of state -- if NULL, new memory is allocated
1547 * @pers Personalization string that is mixed into state, may be NULL -- note
1548 * the entropy is pulled by the DRBG internally unconditionally
1549 * as defined in SP800-90A. The additional input is mixed into
1550 * the state in addition to the pulled entropy.
1551 * @coreref reference to core
1552 * @pr prediction resistance enabled
1553 *
1554 * return
1555 * 0 on success
1556 * error value otherwise
1557 */
drbg_instantiate(struct drbg_state * drbg,struct drbg_string * pers,int coreref,bool pr)1558 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1559 int coreref, bool pr)
1560 {
1561 int ret;
1562 bool reseed = true;
1563
1564 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1565 "%s\n", coreref, pr ? "enabled" : "disabled");
1566 mutex_lock(&drbg->drbg_mutex);
1567
1568 /* 9.1 step 1 is implicit with the selected DRBG type */
1569
1570 /*
1571 * 9.1 step 2 is implicit as caller can select prediction resistance
1572 * and the flag is copied into drbg->flags --
1573 * all DRBG types support prediction resistance
1574 */
1575
1576 /* 9.1 step 4 is implicit in drbg_sec_strength */
1577
1578 if (!drbg->core) {
1579 drbg->core = &drbg_cores[coreref];
1580 drbg->pr = pr;
1581 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1582 drbg->last_seed_time = 0;
1583 drbg->reseed_threshold = drbg_max_requests(drbg);
1584
1585 ret = drbg_alloc_state(drbg);
1586 if (ret)
1587 goto unlock;
1588
1589 ret = drbg_prepare_hrng(drbg);
1590 if (ret)
1591 goto free_everything;
1592
1593 reseed = false;
1594 }
1595
1596 ret = drbg_seed(drbg, pers, reseed);
1597
1598 if (ret && !reseed)
1599 goto free_everything;
1600
1601 mutex_unlock(&drbg->drbg_mutex);
1602 return ret;
1603
1604 unlock:
1605 mutex_unlock(&drbg->drbg_mutex);
1606 return ret;
1607
1608 free_everything:
1609 mutex_unlock(&drbg->drbg_mutex);
1610 drbg_uninstantiate(drbg);
1611 return ret;
1612 }
1613
1614 /*
1615 * DRBG uninstantiate function as required by SP800-90A - this function
1616 * frees all buffers and the DRBG handle
1617 *
1618 * @drbg DRBG state handle
1619 *
1620 * return
1621 * 0 on success
1622 */
drbg_uninstantiate(struct drbg_state * drbg)1623 static int drbg_uninstantiate(struct drbg_state *drbg)
1624 {
1625 if (!IS_ERR_OR_NULL(drbg->jent))
1626 crypto_free_rng(drbg->jent);
1627 drbg->jent = NULL;
1628
1629 if (drbg->d_ops)
1630 drbg->d_ops->crypto_fini(drbg);
1631 drbg_dealloc_state(drbg);
1632 /* no scrubbing of test_data -- this shall survive an uninstantiate */
1633 return 0;
1634 }
1635
1636 /*
1637 * Helper function for setting the test data in the DRBG
1638 *
1639 * @drbg DRBG state handle
1640 * @data test data
1641 * @len test data length
1642 */
drbg_kcapi_set_entropy(struct crypto_rng * tfm,const u8 * data,unsigned int len)1643 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1644 const u8 *data, unsigned int len)
1645 {
1646 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1647
1648 mutex_lock(&drbg->drbg_mutex);
1649 drbg_string_fill(&drbg->test_data, data, len);
1650 mutex_unlock(&drbg->drbg_mutex);
1651 }
1652
1653 /***************************************************************
1654 * Kernel crypto API cipher invocations requested by DRBG
1655 ***************************************************************/
1656
1657 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1658 struct sdesc {
1659 struct shash_desc shash;
1660 char ctx[];
1661 };
1662
drbg_init_hash_kernel(struct drbg_state * drbg)1663 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1664 {
1665 struct sdesc *sdesc;
1666 struct crypto_shash *tfm;
1667
1668 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1669 if (IS_ERR(tfm)) {
1670 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1671 drbg->core->backend_cra_name);
1672 return PTR_ERR(tfm);
1673 }
1674 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1675 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1676 GFP_KERNEL);
1677 if (!sdesc) {
1678 crypto_free_shash(tfm);
1679 return -ENOMEM;
1680 }
1681
1682 sdesc->shash.tfm = tfm;
1683 drbg->priv_data = sdesc;
1684
1685 return 0;
1686 }
1687
drbg_fini_hash_kernel(struct drbg_state * drbg)1688 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1689 {
1690 struct sdesc *sdesc = drbg->priv_data;
1691 if (sdesc) {
1692 crypto_free_shash(sdesc->shash.tfm);
1693 kfree_sensitive(sdesc);
1694 }
1695 drbg->priv_data = NULL;
1696 return 0;
1697 }
1698
drbg_kcapi_hmacsetkey(struct drbg_state * drbg,const unsigned char * key)1699 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1700 const unsigned char *key)
1701 {
1702 struct sdesc *sdesc = drbg->priv_data;
1703
1704 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1705 }
1706
drbg_kcapi_hash(struct drbg_state * drbg,unsigned char * outval,const struct list_head * in)1707 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1708 const struct list_head *in)
1709 {
1710 struct sdesc *sdesc = drbg->priv_data;
1711 struct drbg_string *input = NULL;
1712
1713 crypto_shash_init(&sdesc->shash);
1714 list_for_each_entry(input, in, list)
1715 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1716 return crypto_shash_final(&sdesc->shash, outval);
1717 }
1718 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1719
1720 #ifdef CONFIG_CRYPTO_DRBG_CTR
drbg_fini_sym_kernel(struct drbg_state * drbg)1721 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1722 {
1723 struct crypto_cipher *tfm =
1724 (struct crypto_cipher *)drbg->priv_data;
1725 if (tfm)
1726 crypto_free_cipher(tfm);
1727 drbg->priv_data = NULL;
1728
1729 if (drbg->ctr_handle)
1730 crypto_free_skcipher(drbg->ctr_handle);
1731 drbg->ctr_handle = NULL;
1732
1733 if (drbg->ctr_req)
1734 skcipher_request_free(drbg->ctr_req);
1735 drbg->ctr_req = NULL;
1736
1737 kfree(drbg->outscratchpadbuf);
1738 drbg->outscratchpadbuf = NULL;
1739
1740 return 0;
1741 }
1742
drbg_init_sym_kernel(struct drbg_state * drbg)1743 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1744 {
1745 struct crypto_cipher *tfm;
1746 struct crypto_skcipher *sk_tfm;
1747 struct skcipher_request *req;
1748 unsigned int alignmask;
1749 char ctr_name[CRYPTO_MAX_ALG_NAME];
1750
1751 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1752 if (IS_ERR(tfm)) {
1753 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1754 drbg->core->backend_cra_name);
1755 return PTR_ERR(tfm);
1756 }
1757 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1758 drbg->priv_data = tfm;
1759
1760 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1761 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1762 drbg_fini_sym_kernel(drbg);
1763 return -EINVAL;
1764 }
1765 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1766 if (IS_ERR(sk_tfm)) {
1767 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1768 ctr_name);
1769 drbg_fini_sym_kernel(drbg);
1770 return PTR_ERR(sk_tfm);
1771 }
1772 drbg->ctr_handle = sk_tfm;
1773 crypto_init_wait(&drbg->ctr_wait);
1774
1775 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1776 if (!req) {
1777 pr_info("DRBG: could not allocate request queue\n");
1778 drbg_fini_sym_kernel(drbg);
1779 return -ENOMEM;
1780 }
1781 drbg->ctr_req = req;
1782 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
1783 CRYPTO_TFM_REQ_MAY_SLEEP,
1784 crypto_req_done, &drbg->ctr_wait);
1785
1786 alignmask = crypto_skcipher_alignmask(sk_tfm);
1787 drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1788 GFP_KERNEL);
1789 if (!drbg->outscratchpadbuf) {
1790 drbg_fini_sym_kernel(drbg);
1791 return -ENOMEM;
1792 }
1793 drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1794 alignmask + 1);
1795
1796 sg_init_table(&drbg->sg_in, 1);
1797 sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1798
1799 return alignmask;
1800 }
1801
drbg_kcapi_symsetkey(struct drbg_state * drbg,const unsigned char * key)1802 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1803 const unsigned char *key)
1804 {
1805 struct crypto_cipher *tfm = drbg->priv_data;
1806
1807 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1808 }
1809
drbg_kcapi_sym(struct drbg_state * drbg,unsigned char * outval,const struct drbg_string * in)1810 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1811 const struct drbg_string *in)
1812 {
1813 struct crypto_cipher *tfm = drbg->priv_data;
1814
1815 /* there is only component in *in */
1816 BUG_ON(in->len < drbg_blocklen(drbg));
1817 crypto_cipher_encrypt_one(tfm, outval, in->buf);
1818 return 0;
1819 }
1820
drbg_kcapi_sym_ctr(struct drbg_state * drbg,u8 * inbuf,u32 inlen,u8 * outbuf,u32 outlen)1821 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1822 u8 *inbuf, u32 inlen,
1823 u8 *outbuf, u32 outlen)
1824 {
1825 struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out;
1826 u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN);
1827 int ret;
1828
1829 if (inbuf) {
1830 /* Use caller-provided input buffer */
1831 sg_set_buf(sg_in, inbuf, inlen);
1832 } else {
1833 /* Use scratchpad for in-place operation */
1834 inlen = scratchpad_use;
1835 memset(drbg->outscratchpad, 0, scratchpad_use);
1836 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
1837 }
1838
1839 while (outlen) {
1840 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1841
1842 /* Output buffer may not be valid for SGL, use scratchpad */
1843 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out,
1844 cryptlen, drbg->V);
1845 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req),
1846 &drbg->ctr_wait);
1847 if (ret)
1848 goto out;
1849
1850 crypto_init_wait(&drbg->ctr_wait);
1851
1852 memcpy(outbuf, drbg->outscratchpad, cryptlen);
1853 memzero_explicit(drbg->outscratchpad, cryptlen);
1854
1855 outlen -= cryptlen;
1856 outbuf += cryptlen;
1857 }
1858 ret = 0;
1859
1860 out:
1861 return ret;
1862 }
1863 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1864
1865 /***************************************************************
1866 * Kernel crypto API interface to register DRBG
1867 ***************************************************************/
1868
1869 /*
1870 * Look up the DRBG flags by given kernel crypto API cra_name
1871 * The code uses the drbg_cores definition to do this
1872 *
1873 * @cra_name kernel crypto API cra_name
1874 * @coreref reference to integer which is filled with the pointer to
1875 * the applicable core
1876 * @pr reference for setting prediction resistance
1877 *
1878 * return: flags
1879 */
drbg_convert_tfm_core(const char * cra_driver_name,int * coreref,bool * pr)1880 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1881 int *coreref, bool *pr)
1882 {
1883 int i = 0;
1884 size_t start = 0;
1885 int len = 0;
1886
1887 *pr = true;
1888 /* disassemble the names */
1889 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1890 start = 10;
1891 *pr = false;
1892 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1893 start = 8;
1894 } else {
1895 return;
1896 }
1897
1898 /* remove the first part */
1899 len = strlen(cra_driver_name) - start;
1900 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1901 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1902 len)) {
1903 *coreref = i;
1904 return;
1905 }
1906 }
1907 }
1908
drbg_kcapi_init(struct crypto_tfm * tfm)1909 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1910 {
1911 struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1912
1913 mutex_init(&drbg->drbg_mutex);
1914
1915 return 0;
1916 }
1917
drbg_kcapi_cleanup(struct crypto_tfm * tfm)1918 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1919 {
1920 drbg_uninstantiate(crypto_tfm_ctx(tfm));
1921 }
1922
1923 /*
1924 * Generate random numbers invoked by the kernel crypto API:
1925 * The API of the kernel crypto API is extended as follows:
1926 *
1927 * src is additional input supplied to the RNG.
1928 * slen is the length of src.
1929 * dst is the output buffer where random data is to be stored.
1930 * dlen is the length of dst.
1931 */
drbg_kcapi_random(struct crypto_rng * tfm,const u8 * src,unsigned int slen,u8 * dst,unsigned int dlen)1932 static int drbg_kcapi_random(struct crypto_rng *tfm,
1933 const u8 *src, unsigned int slen,
1934 u8 *dst, unsigned int dlen)
1935 {
1936 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1937 struct drbg_string *addtl = NULL;
1938 struct drbg_string string;
1939
1940 if (slen) {
1941 /* linked list variable is now local to allow modification */
1942 drbg_string_fill(&string, src, slen);
1943 addtl = &string;
1944 }
1945
1946 return drbg_generate_long(drbg, dst, dlen, addtl);
1947 }
1948
1949 /*
1950 * Seed the DRBG invoked by the kernel crypto API
1951 */
drbg_kcapi_seed(struct crypto_rng * tfm,const u8 * seed,unsigned int slen)1952 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1953 const u8 *seed, unsigned int slen)
1954 {
1955 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1956 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1957 bool pr = false;
1958 struct drbg_string string;
1959 struct drbg_string *seed_string = NULL;
1960 int coreref = 0;
1961
1962 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1963 &pr);
1964 if (0 < slen) {
1965 drbg_string_fill(&string, seed, slen);
1966 seed_string = &string;
1967 }
1968
1969 return drbg_instantiate(drbg, seed_string, coreref, pr);
1970 }
1971
1972 /***************************************************************
1973 * Kernel module: code to load the module
1974 ***************************************************************/
1975
1976 /*
1977 * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1978 * of the error handling.
1979 *
1980 * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1981 * as seed source of get_random_bytes does not fail.
1982 *
1983 * Note 2: There is no sensible way of testing the reseed counter
1984 * enforcement, so skip it.
1985 */
drbg_healthcheck_sanity(void)1986 static inline int __init drbg_healthcheck_sanity(void)
1987 {
1988 int len = 0;
1989 #define OUTBUFLEN 16
1990 unsigned char buf[OUTBUFLEN];
1991 struct drbg_state *drbg = NULL;
1992 int ret;
1993 int rc = -EFAULT;
1994 bool pr = false;
1995 int coreref = 0;
1996 struct drbg_string addtl;
1997 size_t max_addtllen, max_request_bytes;
1998
1999 /* only perform test in FIPS mode */
2000 if (!fips_enabled)
2001 return 0;
2002
2003 #ifdef CONFIG_CRYPTO_DRBG_CTR
2004 drbg_convert_tfm_core("drbg_nopr_ctr_aes256", &coreref, &pr);
2005 #endif
2006 #ifdef CONFIG_CRYPTO_DRBG_HASH
2007 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
2008 #endif
2009 #ifdef CONFIG_CRYPTO_DRBG_HMAC
2010 drbg_convert_tfm_core("drbg_nopr_hmac_sha512", &coreref, &pr);
2011 #endif
2012
2013 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
2014 if (!drbg)
2015 return -ENOMEM;
2016
2017 mutex_init(&drbg->drbg_mutex);
2018 drbg->core = &drbg_cores[coreref];
2019 drbg->reseed_threshold = drbg_max_requests(drbg);
2020
2021 /*
2022 * if the following tests fail, it is likely that there is a buffer
2023 * overflow as buf is much smaller than the requested or provided
2024 * string lengths -- in case the error handling does not succeed
2025 * we may get an OOPS. And we want to get an OOPS as this is a
2026 * grave bug.
2027 */
2028
2029 max_addtllen = drbg_max_addtl(drbg);
2030 max_request_bytes = drbg_max_request_bytes(drbg);
2031 drbg_string_fill(&addtl, buf, max_addtllen + 1);
2032 /* overflow addtllen with additonal info string */
2033 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
2034 BUG_ON(0 < len);
2035 /* overflow max_bits */
2036 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
2037 BUG_ON(0 < len);
2038
2039 /* overflow max addtllen with personalization string */
2040 ret = drbg_seed(drbg, &addtl, false);
2041 BUG_ON(0 == ret);
2042 /* all tests passed */
2043 rc = 0;
2044
2045 pr_devel("DRBG: Sanity tests for failure code paths successfully "
2046 "completed\n");
2047
2048 kfree(drbg);
2049 return rc;
2050 }
2051
2052 static struct rng_alg drbg_algs[22];
2053
2054 /*
2055 * Fill the array drbg_algs used to register the different DRBGs
2056 * with the kernel crypto API. To fill the array, the information
2057 * from drbg_cores[] is used.
2058 */
drbg_fill_array(struct rng_alg * alg,const struct drbg_core * core,int pr)2059 static inline void __init drbg_fill_array(struct rng_alg *alg,
2060 const struct drbg_core *core, int pr)
2061 {
2062 int pos = 0;
2063 static int priority = 200;
2064
2065 memcpy(alg->base.cra_name, "stdrng", 6);
2066 if (pr) {
2067 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
2068 pos = 8;
2069 } else {
2070 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
2071 pos = 10;
2072 }
2073 memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2074 strlen(core->cra_name));
2075
2076 alg->base.cra_priority = priority;
2077 priority++;
2078 /*
2079 * If FIPS mode enabled, the selected DRBG shall have the
2080 * highest cra_priority over other stdrng instances to ensure
2081 * it is selected.
2082 */
2083 if (fips_enabled)
2084 alg->base.cra_priority += 200;
2085
2086 alg->base.cra_ctxsize = sizeof(struct drbg_state);
2087 alg->base.cra_module = THIS_MODULE;
2088 alg->base.cra_init = drbg_kcapi_init;
2089 alg->base.cra_exit = drbg_kcapi_cleanup;
2090 alg->generate = drbg_kcapi_random;
2091 alg->seed = drbg_kcapi_seed;
2092 alg->set_ent = drbg_kcapi_set_entropy;
2093 alg->seedsize = 0;
2094 }
2095
drbg_init(void)2096 static int __init drbg_init(void)
2097 {
2098 unsigned int i = 0; /* pointer to drbg_algs */
2099 unsigned int j = 0; /* pointer to drbg_cores */
2100 int ret;
2101
2102 ret = drbg_healthcheck_sanity();
2103 if (ret)
2104 return ret;
2105
2106 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2107 pr_info("DRBG: Cannot register all DRBG types"
2108 "(slots needed: %zu, slots available: %zu)\n",
2109 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2110 return -EFAULT;
2111 }
2112
2113 /*
2114 * each DRBG definition can be used with PR and without PR, thus
2115 * we instantiate each DRBG in drbg_cores[] twice.
2116 *
2117 * As the order of placing them into the drbg_algs array matters
2118 * (the later DRBGs receive a higher cra_priority) we register the
2119 * prediction resistance DRBGs first as the should not be too
2120 * interesting.
2121 */
2122 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2123 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2124 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2125 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2126 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2127 }
2128
drbg_exit(void)2129 static void __exit drbg_exit(void)
2130 {
2131 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2132 }
2133
2134 subsys_initcall(drbg_init);
2135 module_exit(drbg_exit);
2136 #ifndef CRYPTO_DRBG_HASH_STRING
2137 #define CRYPTO_DRBG_HASH_STRING ""
2138 #endif
2139 #ifndef CRYPTO_DRBG_HMAC_STRING
2140 #define CRYPTO_DRBG_HMAC_STRING ""
2141 #endif
2142 #ifndef CRYPTO_DRBG_CTR_STRING
2143 #define CRYPTO_DRBG_CTR_STRING ""
2144 #endif
2145 MODULE_LICENSE("GPL");
2146 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2147 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2148 "using following cores: "
2149 CRYPTO_DRBG_HASH_STRING
2150 CRYPTO_DRBG_HMAC_STRING
2151 CRYPTO_DRBG_CTR_STRING);
2152 MODULE_ALIAS_CRYPTO("stdrng");
2153 MODULE_IMPORT_NS(CRYPTO_INTERNAL);
2154