Lines Matching +full:fips +full:- +full:140 +full:- +full:2
3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following
5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
18 * 2. Redistributions in binary form must reproduce the above copyright
29 * the restrictions contained in a BSD-style copyright.)
46 * The SP 800-90A DRBG allows the user to specify a personalization string
52 * ---------------------------------
63 * -------------------------------------------------------
68 * char personalization[11] = "some-string";
72 * // The reset completely re-initializes the DRBG with the provided
80 * ---------------------------------------------------------------------
84 * char addtl_string[11] = "some-string";
96 * -------------------------------------------------------------
202 * Return strength of DRBG according to SP800-90A section 8.4
224 * FIPS 140-2 continuous self test for the noise source
232 * drbg->drbg_mutex must have been taken.
239 * -EAGAIN on when the CTRNG is not yet primed
245 unsigned short entropylen = drbg_sec_strength(drbg->core->flags); in drbg_fips_continuous_test()
252 if (list_empty(&drbg->test_data.list)) in drbg_fips_continuous_test()
254 /* only perform test in FIPS mode */ in drbg_fips_continuous_test()
258 if (!drbg->fips_primed) { in drbg_fips_continuous_test()
259 /* Priming of FIPS test */ in drbg_fips_continuous_test()
260 memcpy(drbg->prev, entropy, entropylen); in drbg_fips_continuous_test()
261 drbg->fips_primed = true; in drbg_fips_continuous_test()
263 return -EAGAIN; in drbg_fips_continuous_test()
265 ret = memcmp(drbg->prev, entropy, entropylen); in drbg_fips_continuous_test()
268 memcpy(drbg->prev, entropy, entropylen); in drbg_fips_continuous_test()
276 * The byte representation is big-endian
279 * @buf buffer holding the converted integer -- caller must ensure that
290 conversion->conv = cpu_to_be32(val); in drbg_cpu_to_be32()
330 /* 10.4.3 step 2 / 4 */ in drbg_ctr_bcc()
333 const unsigned char *pos = curr->buf; in drbg_ctr_bcc()
334 size_t len = curr->len; in drbg_ctr_bcc()
347 len--; in drbg_ctr_bcc()
363 * start: drbg->scratchpad
366 * blocklen-wise. Now, when the statelen is not a multiple
371 * start: drbg->scratchpad +
396 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
401 int ret = -EFAULT; in drbg_ctr_df()
411 /* 10.4.2 step 7 */ in drbg_ctr_df()
413 /* 10.4.2 step 8 */ in drbg_ctr_df()
427 /* 10.4.2 step 1 is implicit as we work byte-wise */ in drbg_ctr_df()
429 /* 10.4.2 step 2 */ in drbg_ctr_df()
431 return -EINVAL; in drbg_ctr_df()
433 /* 10.4.2 step 2 -- calculate the entire length of all input data */ in drbg_ctr_df()
435 inputlen += seed->len; in drbg_ctr_df()
438 /* 10.4.2 step 3 */ in drbg_ctr_df()
441 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */ in drbg_ctr_df()
445 padlen = drbg_blocklen(drbg) - padlen; in drbg_ctr_df()
454 /* 10.4.2 step 4 -- first fill the linked list and then order it */ in drbg_ctr_df()
463 /* 10.4.2 step 9 */ in drbg_ctr_df()
466 * 10.4.2 step 9.1 - the padding is implicit as the buffer in drbg_ctr_df()
467 * holds zeros after allocation -- even the increment of i in drbg_ctr_df()
471 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */ in drbg_ctr_df()
475 /* 10.4.2 step 9.3 */ in drbg_ctr_df()
480 /* 10.4.2 step 11 */ in drbg_ctr_df()
484 /* 10.4.2 step 12: overwriting of outval is implemented in next step */ in drbg_ctr_df()
486 /* 10.4.2 step 13 */ in drbg_ctr_df()
491 * 10.4.2 step 13.1: the truncation of the key length is in drbg_ctr_df()
499 (bytes_to_return - generated_len)) ? in drbg_ctr_df()
501 (bytes_to_return - generated_len); in drbg_ctr_df()
502 /* 10.4.2 step 13.2 and 14 */ in drbg_ctr_df()
523 * 2 => first invocation from drbg_ctr_update when addtl is present. In
534 int ret = -EFAULT; in drbg_ctr_update()
536 unsigned char *temp = drbg->scratchpad; in drbg_ctr_update()
537 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) + in drbg_ctr_update()
547 * but SP800-90A requires that the counter is incremented before in drbg_ctr_update()
551 crypto_inc(drbg->V, drbg_blocklen(drbg)); in drbg_ctr_update()
553 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C, in drbg_ctr_update()
559 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */ in drbg_ctr_update()
572 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp, in drbg_ctr_update()
577 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg)); in drbg_ctr_update()
579 crypto_inc(drbg->V, drbg_blocklen(drbg)); in drbg_ctr_update()
584 if (2 != reseed) in drbg_ctr_update()
593 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
601 /* 10.2.1.5.2 step 2 */ in drbg_ctr_generate()
603 ret = drbg_ctr_update(drbg, addtl, 2); in drbg_ctr_generate()
608 /* 10.2.1.5.2 step 4.1 */ in drbg_ctr_generate()
613 /* 10.2.1.5.2 step 6 */ in drbg_ctr_generate()
657 int ret = -EFAULT; in drbg_hmac_update()
664 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */ in drbg_hmac_update()
665 memset(drbg->V, 1, drbg_statelen(drbg)); in drbg_hmac_update()
666 drbg_kcapi_hmacsetkey(drbg, drbg->C); in drbg_hmac_update()
669 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg)); in drbg_hmac_update()
678 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg)); in drbg_hmac_update()
680 for (i = 2; 0 < i; i--) { in drbg_hmac_update()
685 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */ in drbg_hmac_update()
687 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist); in drbg_hmac_update()
690 drbg_kcapi_hmacsetkey(drbg, drbg->C); in drbg_hmac_update()
692 /* 10.1.2.2 step 2 and 5 -- HMAC for V */ in drbg_hmac_update()
693 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist); in drbg_hmac_update()
716 /* 10.1.2.5 step 2 */ in drbg_hmac_generate()
723 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg)); in drbg_hmac_generate()
728 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist); in drbg_hmac_generate()
731 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? in drbg_hmac_generate()
732 drbg_blocklen(drbg) : (buflen - len); in drbg_hmac_generate()
735 memcpy(buf + len, drbg->V, outlen); in drbg_hmac_generate()
788 dstptr = dst + (dstlen-1); in drbg_add_buf()
789 addptr = add + (addlen-1); in drbg_add_buf()
794 len--; dstptr--; addptr--; in drbg_add_buf()
796 len = dstlen - addlen; in drbg_add_buf()
801 len--; dstptr--; in drbg_add_buf()
809 * start: drbg->scratchpad
812 * start: drbg->scratchpad + drbg_statelen(drbg)
828 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg); in drbg_hash_df()
835 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */ in drbg_hash_df()
848 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ? in drbg_hash_df()
849 drbg_blocklen(drbg) : (outlen - len); in drbg_hash_df()
867 unsigned char *V = drbg->scratchpad; in drbg_hash_update()
871 return -EINVAL; in drbg_hash_update()
875 memcpy(V, drbg->V, drbg_statelen(drbg)); in drbg_hash_update()
883 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */ in drbg_hash_update()
884 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist); in drbg_hash_update()
892 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); in drbg_hash_update()
895 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2); in drbg_hash_update()
898 memset(drbg->scratchpad, 0, drbg_statelen(drbg)); in drbg_hash_update()
911 /* 10.1.1.4 step 2 */ in drbg_hash_process_addtl()
915 /* 10.1.1.4 step 2a */ in drbg_hash_process_addtl()
917 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); in drbg_hash_process_addtl()
921 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); in drbg_hash_process_addtl()
925 /* 10.1.1.4 step 2b */ in drbg_hash_process_addtl()
926 drbg_add_buf(drbg->V, drbg_statelen(drbg), in drbg_hash_process_addtl()
927 drbg->scratchpad, drbg_blocklen(drbg)); in drbg_hash_process_addtl()
930 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); in drbg_hash_process_addtl()
941 unsigned char *src = drbg->scratchpad; in drbg_hash_hashgen()
942 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg); in drbg_hash_hashgen()
946 /* 10.1.1.4 step hashgen 2 */ in drbg_hash_hashgen()
947 memcpy(src, drbg->V, drbg_statelen(drbg)); in drbg_hash_hashgen()
959 outlen = (drbg_blocklen(drbg) < (buflen - len)) ? in drbg_hash_hashgen()
960 drbg_blocklen(drbg) : (buflen - len); in drbg_hash_hashgen()
970 memset(drbg->scratchpad, 0, in drbg_hash_hashgen()
990 /* 10.1.1.4 step 2 */ in drbg_hash_generate()
1001 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg)); in drbg_hash_generate()
1003 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist); in drbg_hash_generate()
1010 drbg_add_buf(drbg->V, drbg_statelen(drbg), in drbg_hash_generate()
1011 drbg->scratchpad, drbg_blocklen(drbg)); in drbg_hash_generate()
1012 drbg_add_buf(drbg->V, drbg_statelen(drbg), in drbg_hash_generate()
1013 drbg->C, drbg_statelen(drbg)); in drbg_hash_generate()
1014 u.req_int = cpu_to_be64(drbg->reseed_ctr); in drbg_hash_generate()
1015 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8); in drbg_hash_generate()
1018 memset(drbg->scratchpad, 0, drbg_blocklen(drbg)); in drbg_hash_generate()
1041 int ret = drbg->d_ops->update(drbg, seed, reseed); in __drbg_seed()
1046 drbg->seeded = true; in __drbg_seed()
1048 drbg->reseed_ctr = 1; in __drbg_seed()
1062 if (ret && ret != -EAGAIN) in drbg_get_random_bytes()
1075 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); in drbg_async_seed()
1085 mutex_lock(&drbg->drbg_mutex); in drbg_async_seed()
1094 drbg->seeded = false; in drbg_async_seed()
1098 if (drbg->seeded) in drbg_async_seed()
1099 drbg->reseed_threshold = drbg_max_requests(drbg); in drbg_async_seed()
1102 mutex_unlock(&drbg->drbg_mutex); in drbg_async_seed()
1122 unsigned char entropy[((32 + 16) * 2)]; in drbg_seed()
1123 unsigned int entropylen = drbg_sec_strength(drbg->core->flags); in drbg_seed()
1128 if (pers && pers->len > (drbg_max_addtl(drbg))) { in drbg_seed()
1130 pers->len); in drbg_seed()
1131 return -EINVAL; in drbg_seed()
1134 if (list_empty(&drbg->test_data.list)) { in drbg_seed()
1135 drbg_string_fill(&data1, drbg->test_data.buf, in drbg_seed()
1136 drbg->test_data.len); in drbg_seed()
1142 * to the entropy. A nonce must be at least 1/2 of the security in drbg_seed()
1143 * strength of the DRBG in size. Thus, entropy + nonce is 3/2 in drbg_seed()
1149 entropylen = ((entropylen + 1) / 2) * 3; in drbg_seed()
1150 BUG_ON((entropylen * 2) > sizeof(entropy)); in drbg_seed()
1152 /* Get seed from in-kernel /dev/urandom */ in drbg_seed()
1157 if (!drbg->jent) { in drbg_seed()
1163 ret = crypto_rng_get_bytes(drbg->jent, in drbg_seed()
1176 * SP800-90A allowing us to treat the in drbg_seed()
1183 if (!reseed || ret != -EAGAIN) in drbg_seed()
1187 drbg_string_fill(&data1, entropy, entropylen * 2); in drbg_seed()
1189 entropylen * 2); in drbg_seed()
1199 if (pers && pers->buf && 0 < pers->len) { in drbg_seed()
1200 list_add_tail(&pers->list, &seedlist); in drbg_seed()
1205 memset(drbg->V, 0, drbg_statelen(drbg)); in drbg_seed()
1206 memset(drbg->C, 0, drbg_statelen(drbg)); in drbg_seed()
1212 memzero_explicit(entropy, entropylen * 2); in drbg_seed()
1222 kfree_sensitive(drbg->Vbuf); in drbg_dealloc_state()
1223 drbg->Vbuf = NULL; in drbg_dealloc_state()
1224 drbg->V = NULL; in drbg_dealloc_state()
1225 kfree_sensitive(drbg->Cbuf); in drbg_dealloc_state()
1226 drbg->Cbuf = NULL; in drbg_dealloc_state()
1227 drbg->C = NULL; in drbg_dealloc_state()
1228 kfree_sensitive(drbg->scratchpadbuf); in drbg_dealloc_state()
1229 drbg->scratchpadbuf = NULL; in drbg_dealloc_state()
1230 drbg->reseed_ctr = 0; in drbg_dealloc_state()
1231 drbg->d_ops = NULL; in drbg_dealloc_state()
1232 drbg->core = NULL; in drbg_dealloc_state()
1234 kfree_sensitive(drbg->prev); in drbg_dealloc_state()
1235 drbg->prev = NULL; in drbg_dealloc_state()
1236 drbg->fips_primed = false; in drbg_dealloc_state()
1241 * Allocate all sub-structures for a DRBG state.
1246 int ret = -ENOMEM; in drbg_alloc_state()
1249 switch (drbg->core->flags & DRBG_TYPE_MASK) { in drbg_alloc_state()
1252 drbg->d_ops = &drbg_hmac_ops; in drbg_alloc_state()
1257 drbg->d_ops = &drbg_hash_ops; in drbg_alloc_state()
1262 drbg->d_ops = &drbg_ctr_ops; in drbg_alloc_state()
1266 ret = -EOPNOTSUPP; in drbg_alloc_state()
1270 ret = drbg->d_ops->crypto_init(drbg); in drbg_alloc_state()
1274 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); in drbg_alloc_state()
1275 if (!drbg->Vbuf) { in drbg_alloc_state()
1276 ret = -ENOMEM; in drbg_alloc_state()
1279 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1); in drbg_alloc_state()
1280 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL); in drbg_alloc_state()
1281 if (!drbg->Cbuf) { in drbg_alloc_state()
1282 ret = -ENOMEM; in drbg_alloc_state()
1285 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1); in drbg_alloc_state()
1287 if (drbg->core->flags & DRBG_HMAC) in drbg_alloc_state()
1289 else if (drbg->core->flags & DRBG_CTR) in drbg_alloc_state()
1299 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL); in drbg_alloc_state()
1300 if (!drbg->scratchpadbuf) { in drbg_alloc_state()
1301 ret = -ENOMEM; in drbg_alloc_state()
1304 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1); in drbg_alloc_state()
1308 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags), in drbg_alloc_state()
1310 if (!drbg->prev) { in drbg_alloc_state()
1311 ret = -ENOMEM; in drbg_alloc_state()
1314 drbg->fips_primed = false; in drbg_alloc_state()
1320 drbg->d_ops->crypto_fini(drbg); in drbg_alloc_state()
1331 * DRBG generate function as required by SP800-90A - this function
1335 * @buf Buffer where to store the random numbers -- the buffer must already
1336 * be pre-allocated by caller
1337 * @buflen Length of output buffer - this value defines the number of random
1339 * @addtl Additional input that is mixed into state, may be NULL -- note
1341 * as defined in SP800-90A. The additional input is mixed into
1353 if (!drbg->core) { in drbg_generate()
1355 return -EINVAL; in drbg_generate()
1359 return -EINVAL; in drbg_generate()
1361 if (addtl && NULL == addtl->buf && 0 < addtl->len) { in drbg_generate()
1363 return -EINVAL; in drbg_generate()
1366 /* 9.3.1 step 2 */ in drbg_generate()
1367 len = -EINVAL; in drbg_generate()
1377 if (addtl && addtl->len > (drbg_max_addtl(drbg))) { in drbg_generate()
1379 addtl->len); in drbg_generate()
1385 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented in drbg_generate()
1388 if (drbg->reseed_threshold < drbg->reseed_ctr) in drbg_generate()
1389 drbg->seeded = false; in drbg_generate()
1391 if (drbg->pr || !drbg->seeded) { in drbg_generate()
1394 drbg->pr ? "true" : "false", in drbg_generate()
1395 drbg->seeded ? "seeded" : "unseeded"); in drbg_generate()
1404 if (addtl && 0 < addtl->len) in drbg_generate()
1405 list_add_tail(&addtl->list, &addtllist); in drbg_generate()
1407 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist); in drbg_generate()
1409 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */ in drbg_generate()
1410 drbg->reseed_ctr++; in drbg_generate()
1415 * Section 11.3.3 requires to re-perform self tests after some in drbg_generate()
1430 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) { in drbg_generate()
1433 if (drbg->core->flags & DRBG_HMAC) in drbg_generate()
1436 else if (drbg->core->flags & DRBG_CTR) in drbg_generate()
1470 * Return codes: see drbg_generate -- if one drbg_generate request fails,
1482 slice = ((buflen - len) / drbg_max_request_bytes(drbg)); in drbg_generate_long()
1483 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len); in drbg_generate_long()
1484 mutex_lock(&drbg->drbg_mutex); in drbg_generate_long()
1486 mutex_unlock(&drbg->drbg_mutex); in drbg_generate_long()
1499 schedule_work(&drbg->seed_work); in drbg_schedule_async_seed()
1507 if (list_empty(&drbg->test_data.list)) in drbg_prepare_hrng()
1510 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); in drbg_prepare_hrng()
1512 INIT_WORK(&drbg->seed_work, drbg_async_seed); in drbg_prepare_hrng()
1514 drbg->random_ready.owner = THIS_MODULE; in drbg_prepare_hrng()
1515 drbg->random_ready.func = drbg_schedule_async_seed; in drbg_prepare_hrng()
1517 err = add_random_ready_callback(&drbg->random_ready); in drbg_prepare_hrng()
1523 case -EALREADY: in drbg_prepare_hrng()
1528 drbg->random_ready.func = NULL; in drbg_prepare_hrng()
1536 drbg->reseed_threshold = 50; in drbg_prepare_hrng()
1542 * DRBG instantiation function as required by SP800-90A - this function
1544 * checks required by SP800-90A
1546 * @drbg memory of state -- if NULL, new memory is allocated
1547 * @pers Personalization string that is mixed into state, may be NULL -- note
1549 * as defined in SP800-90A. The additional input is mixed into
1566 mutex_lock(&drbg->drbg_mutex); in drbg_instantiate()
1571 * 9.1 step 2 is implicit as caller can select prediction resistance in drbg_instantiate()
1572 * and the flag is copied into drbg->flags -- in drbg_instantiate()
1578 if (!drbg->core) { in drbg_instantiate()
1579 drbg->core = &drbg_cores[coreref]; in drbg_instantiate()
1580 drbg->pr = pr; in drbg_instantiate()
1581 drbg->seeded = false; in drbg_instantiate()
1582 drbg->reseed_threshold = drbg_max_requests(drbg); in drbg_instantiate()
1592 if (IS_ERR(drbg->jent)) { in drbg_instantiate()
1593 ret = PTR_ERR(drbg->jent); in drbg_instantiate()
1594 drbg->jent = NULL; in drbg_instantiate()
1595 if (fips_enabled || ret != -ENOENT) in drbg_instantiate()
1608 mutex_unlock(&drbg->drbg_mutex); in drbg_instantiate()
1612 mutex_unlock(&drbg->drbg_mutex); in drbg_instantiate()
1616 mutex_unlock(&drbg->drbg_mutex); in drbg_instantiate()
1622 * DRBG uninstantiate function as required by SP800-90A - this function
1632 if (drbg->random_ready.func) { in drbg_uninstantiate()
1633 del_random_ready_callback(&drbg->random_ready); in drbg_uninstantiate()
1634 cancel_work_sync(&drbg->seed_work); in drbg_uninstantiate()
1637 if (!IS_ERR_OR_NULL(drbg->jent)) in drbg_uninstantiate()
1638 crypto_free_rng(drbg->jent); in drbg_uninstantiate()
1639 drbg->jent = NULL; in drbg_uninstantiate()
1641 if (drbg->d_ops) in drbg_uninstantiate()
1642 drbg->d_ops->crypto_fini(drbg); in drbg_uninstantiate()
1644 /* no scrubbing of test_data -- this shall survive an uninstantiate */ in drbg_uninstantiate()
1660 mutex_lock(&drbg->drbg_mutex); in drbg_kcapi_set_entropy()
1661 drbg_string_fill(&drbg->test_data, data, len); in drbg_kcapi_set_entropy()
1662 mutex_unlock(&drbg->drbg_mutex); in drbg_kcapi_set_entropy()
1680 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0); in drbg_init_hash_kernel()
1683 drbg->core->backend_cra_name); in drbg_init_hash_kernel()
1691 return -ENOMEM; in drbg_init_hash_kernel()
1694 sdesc->shash.tfm = tfm; in drbg_init_hash_kernel()
1695 drbg->priv_data = sdesc; in drbg_init_hash_kernel()
1702 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; in drbg_fini_hash_kernel()
1704 crypto_free_shash(sdesc->shash.tfm); in drbg_fini_hash_kernel()
1707 drbg->priv_data = NULL; in drbg_fini_hash_kernel()
1714 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; in drbg_kcapi_hmacsetkey()
1716 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg)); in drbg_kcapi_hmacsetkey()
1722 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data; in drbg_kcapi_hash()
1725 crypto_shash_init(&sdesc->shash); in drbg_kcapi_hash()
1727 crypto_shash_update(&sdesc->shash, input->buf, input->len); in drbg_kcapi_hash()
1728 return crypto_shash_final(&sdesc->shash, outval); in drbg_kcapi_hash()
1736 (struct crypto_cipher *)drbg->priv_data; in drbg_fini_sym_kernel()
1739 drbg->priv_data = NULL; in drbg_fini_sym_kernel()
1741 if (drbg->ctr_handle) in drbg_fini_sym_kernel()
1742 crypto_free_skcipher(drbg->ctr_handle); in drbg_fini_sym_kernel()
1743 drbg->ctr_handle = NULL; in drbg_fini_sym_kernel()
1745 if (drbg->ctr_req) in drbg_fini_sym_kernel()
1746 skcipher_request_free(drbg->ctr_req); in drbg_fini_sym_kernel()
1747 drbg->ctr_req = NULL; in drbg_fini_sym_kernel()
1749 kfree(drbg->outscratchpadbuf); in drbg_fini_sym_kernel()
1750 drbg->outscratchpadbuf = NULL; in drbg_fini_sym_kernel()
1763 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0); in drbg_init_sym_kernel()
1766 drbg->core->backend_cra_name); in drbg_init_sym_kernel()
1770 drbg->priv_data = tfm; in drbg_init_sym_kernel()
1773 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) { in drbg_init_sym_kernel()
1775 return -EINVAL; in drbg_init_sym_kernel()
1784 drbg->ctr_handle = sk_tfm; in drbg_init_sym_kernel()
1785 crypto_init_wait(&drbg->ctr_wait); in drbg_init_sym_kernel()
1791 return -ENOMEM; in drbg_init_sym_kernel()
1793 drbg->ctr_req = req; in drbg_init_sym_kernel()
1796 crypto_req_done, &drbg->ctr_wait); in drbg_init_sym_kernel()
1799 drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask, in drbg_init_sym_kernel()
1801 if (!drbg->outscratchpadbuf) { in drbg_init_sym_kernel()
1803 return -ENOMEM; in drbg_init_sym_kernel()
1805 drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf, in drbg_init_sym_kernel()
1808 sg_init_table(&drbg->sg_in, 1); in drbg_init_sym_kernel()
1809 sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN); in drbg_init_sym_kernel()
1818 (struct crypto_cipher *)drbg->priv_data; in drbg_kcapi_symsetkey()
1827 (struct crypto_cipher *)drbg->priv_data; in drbg_kcapi_sym()
1830 BUG_ON(in->len < drbg_blocklen(drbg)); in drbg_kcapi_sym()
1831 crypto_cipher_encrypt_one(tfm, outval, in->buf); in drbg_kcapi_sym()
1839 struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out; in drbg_kcapi_sym_ctr()
1844 /* Use caller-provided input buffer */ in drbg_kcapi_sym_ctr()
1847 /* Use scratchpad for in-place operation */ in drbg_kcapi_sym_ctr()
1849 memset(drbg->outscratchpad, 0, scratchpad_use); in drbg_kcapi_sym_ctr()
1850 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use); in drbg_kcapi_sym_ctr()
1857 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out, in drbg_kcapi_sym_ctr()
1858 cryptlen, drbg->V); in drbg_kcapi_sym_ctr()
1859 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req), in drbg_kcapi_sym_ctr()
1860 &drbg->ctr_wait); in drbg_kcapi_sym_ctr()
1864 crypto_init_wait(&drbg->ctr_wait); in drbg_kcapi_sym_ctr()
1866 memcpy(outbuf, drbg->outscratchpad, cryptlen); in drbg_kcapi_sym_ctr()
1867 memzero_explicit(drbg->outscratchpad, cryptlen); in drbg_kcapi_sym_ctr()
1869 outlen -= cryptlen; in drbg_kcapi_sym_ctr()
1913 len = strlen(cra_driver_name) - start; in drbg_convert_tfm_core()
1927 mutex_init(&drbg->drbg_mutex); in drbg_kcapi_init()
1991 * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1994 * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1997 * Note 2: There is no sensible way of testing the reseed counter
2006 int ret = -EFAULT; in drbg_healthcheck_sanity()
2007 int rc = -EFAULT; in drbg_healthcheck_sanity()
2013 /* only perform test in FIPS mode */ in drbg_healthcheck_sanity()
2027 return -ENOMEM; in drbg_healthcheck_sanity()
2029 mutex_init(&drbg->drbg_mutex); in drbg_healthcheck_sanity()
2030 drbg->core = &drbg_cores[coreref]; in drbg_healthcheck_sanity()
2031 drbg->reseed_threshold = drbg_max_requests(drbg); in drbg_healthcheck_sanity()
2036 * string lengths -- in case the error handling does not succeed in drbg_healthcheck_sanity()
2077 memcpy(alg->base.cra_name, "stdrng", 6); in drbg_fill_array()
2079 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8); in drbg_fill_array()
2082 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10); in drbg_fill_array()
2085 memcpy(alg->base.cra_driver_name + pos, core->cra_name, in drbg_fill_array()
2086 strlen(core->cra_name)); in drbg_fill_array()
2088 alg->base.cra_priority = priority; in drbg_fill_array()
2091 * If FIPS mode enabled, the selected DRBG shall have the in drbg_fill_array()
2096 alg->base.cra_priority += 200; in drbg_fill_array()
2098 alg->base.cra_ctxsize = sizeof(struct drbg_state); in drbg_fill_array()
2099 alg->base.cra_module = THIS_MODULE; in drbg_fill_array()
2100 alg->base.cra_init = drbg_kcapi_init; in drbg_fill_array()
2101 alg->base.cra_exit = drbg_kcapi_cleanup; in drbg_fill_array()
2102 alg->generate = drbg_kcapi_random; in drbg_fill_array()
2103 alg->seed = drbg_kcapi_seed; in drbg_fill_array()
2104 alg->set_ent = drbg_kcapi_set_entropy; in drbg_fill_array()
2105 alg->seedsize = 0; in drbg_fill_array()
2118 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) { in drbg_init()
2121 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs)); in drbg_init()
2122 return -EFAULT; in drbg_init()
2138 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); in drbg_init()
2143 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2)); in drbg_exit()
2159 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "