1 /*
2 * DRBG: Deterministic Random Bits Generator
3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following
4 * properties:
5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
8 * * with and without prediction resistance
9 *
10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, and the entire permission notice in its entirety,
17 * including the disclaimer of warranties.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. The name of the author may not be used to endorse or promote
22 * products derived from this software without specific prior
23 * written permission.
24 *
25 * ALTERNATIVELY, this product may be distributed under the terms of
26 * the GNU General Public License, in which case the provisions of the GPL are
27 * required INSTEAD OF the above restrictions. (This clause is
28 * necessary due to a potential bad interaction between the GPL and
29 * the restrictions contained in a BSD-style copyright.)
30 *
31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
42 * DAMAGE.
43 *
44 * DRBG Usage
45 * ==========
46 * The SP 800-90A DRBG allows the user to specify a personalization string
47 * for initialization as well as an additional information string for each
48 * random number request. The following code fragments show how a caller
49 * uses the kernel crypto API to use the full functionality of the DRBG.
50 *
51 * Usage without any additional data
52 * ---------------------------------
53 * struct crypto_rng *drng;
54 * int err;
55 * char data[DATALEN];
56 *
57 * drng = crypto_alloc_rng(drng_name, 0, 0);
58 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
59 * crypto_free_rng(drng);
60 *
61 *
62 * Usage with personalization string during initialization
63 * -------------------------------------------------------
64 * struct crypto_rng *drng;
65 * int err;
66 * char data[DATALEN];
67 * struct drbg_string pers;
68 * char personalization[11] = "some-string";
69 *
70 * drbg_string_fill(&pers, personalization, strlen(personalization));
71 * drng = crypto_alloc_rng(drng_name, 0, 0);
72 * // The reset completely re-initializes the DRBG with the provided
73 * // personalization string
74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
75 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
76 * crypto_free_rng(drng);
77 *
78 *
79 * Usage with additional information string during random number request
80 * ---------------------------------------------------------------------
81 * struct crypto_rng *drng;
82 * int err;
83 * char data[DATALEN];
84 * char addtl_string[11] = "some-string";
85 * string drbg_string addtl;
86 *
87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
88 * drng = crypto_alloc_rng(drng_name, 0, 0);
89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns
90 * // the same error codes.
91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
92 * crypto_free_rng(drng);
93 *
94 *
95 * Usage with personalization and additional information strings
96 * -------------------------------------------------------------
97 * Just mix both scenarios above.
98 */
99
100 #include <crypto/drbg.h>
101 #include <crypto/internal/cipher.h>
102 #include <linux/kernel.h>
103
104 /***************************************************************
105 * Backend cipher definitions available to DRBG
106 ***************************************************************/
107
108 /*
109 * The order of the DRBG definitions here matter: every DRBG is registered
110 * as stdrng. Each DRBG receives an increasing cra_priority values the later
111 * they are defined in this array (see drbg_fill_array).
112 *
113 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
114 * the SHA256 / AES 256 over other ciphers. Thus, the favored
115 * DRBGs are the latest entries in this array.
116 */
117 static const struct drbg_core drbg_cores[] = {
118 #ifdef CONFIG_CRYPTO_DRBG_CTR
119 {
120 .flags = DRBG_CTR | DRBG_STRENGTH128,
121 .statelen = 32, /* 256 bits as defined in 10.2.1 */
122 .blocklen_bytes = 16,
123 .cra_name = "ctr_aes128",
124 .backend_cra_name = "aes",
125 }, {
126 .flags = DRBG_CTR | DRBG_STRENGTH192,
127 .statelen = 40, /* 320 bits as defined in 10.2.1 */
128 .blocklen_bytes = 16,
129 .cra_name = "ctr_aes192",
130 .backend_cra_name = "aes",
131 }, {
132 .flags = DRBG_CTR | DRBG_STRENGTH256,
133 .statelen = 48, /* 384 bits as defined in 10.2.1 */
134 .blocklen_bytes = 16,
135 .cra_name = "ctr_aes256",
136 .backend_cra_name = "aes",
137 },
138 #endif /* CONFIG_CRYPTO_DRBG_CTR */
139 #ifdef CONFIG_CRYPTO_DRBG_HASH
140 {
141 .flags = DRBG_HASH | DRBG_STRENGTH128,
142 .statelen = 55, /* 440 bits */
143 .blocklen_bytes = 20,
144 .cra_name = "sha1",
145 .backend_cra_name = "sha1",
146 }, {
147 .flags = DRBG_HASH | DRBG_STRENGTH256,
148 .statelen = 111, /* 888 bits */
149 .blocklen_bytes = 48,
150 .cra_name = "sha384",
151 .backend_cra_name = "sha384",
152 }, {
153 .flags = DRBG_HASH | DRBG_STRENGTH256,
154 .statelen = 111, /* 888 bits */
155 .blocklen_bytes = 64,
156 .cra_name = "sha512",
157 .backend_cra_name = "sha512",
158 }, {
159 .flags = DRBG_HASH | DRBG_STRENGTH256,
160 .statelen = 55, /* 440 bits */
161 .blocklen_bytes = 32,
162 .cra_name = "sha256",
163 .backend_cra_name = "sha256",
164 },
165 #endif /* CONFIG_CRYPTO_DRBG_HASH */
166 #ifdef CONFIG_CRYPTO_DRBG_HMAC
167 {
168 .flags = DRBG_HMAC | DRBG_STRENGTH128,
169 .statelen = 20, /* block length of cipher */
170 .blocklen_bytes = 20,
171 .cra_name = "hmac_sha1",
172 .backend_cra_name = "hmac(sha1)",
173 }, {
174 .flags = DRBG_HMAC | DRBG_STRENGTH256,
175 .statelen = 48, /* block length of cipher */
176 .blocklen_bytes = 48,
177 .cra_name = "hmac_sha384",
178 .backend_cra_name = "hmac(sha384)",
179 }, {
180 .flags = DRBG_HMAC | DRBG_STRENGTH256,
181 .statelen = 32, /* block length of cipher */
182 .blocklen_bytes = 32,
183 .cra_name = "hmac_sha256",
184 .backend_cra_name = "hmac(sha256)",
185 }, {
186 .flags = DRBG_HMAC | DRBG_STRENGTH256,
187 .statelen = 64, /* block length of cipher */
188 .blocklen_bytes = 64,
189 .cra_name = "hmac_sha512",
190 .backend_cra_name = "hmac(sha512)",
191 },
192 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
193 };
194
195 static int drbg_uninstantiate(struct drbg_state *drbg);
196
197 /******************************************************************
198 * Generic helper functions
199 ******************************************************************/
200
201 /*
202 * Return strength of DRBG according to SP800-90A section 8.4
203 *
204 * @flags DRBG flags reference
205 *
206 * Return: normalized strength in *bytes* value or 32 as default
207 * to counter programming errors
208 */
drbg_sec_strength(drbg_flag_t flags)209 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
210 {
211 switch (flags & DRBG_STRENGTH_MASK) {
212 case DRBG_STRENGTH128:
213 return 16;
214 case DRBG_STRENGTH192:
215 return 24;
216 case DRBG_STRENGTH256:
217 return 32;
218 default:
219 return 32;
220 }
221 }
222
223 /*
224 * FIPS 140-2 continuous self test for the noise source
225 * The test is performed on the noise source input data. Thus, the function
226 * implicitly knows the size of the buffer to be equal to the security
227 * strength.
228 *
229 * Note, this function disregards the nonce trailing the entropy data during
230 * initial seeding.
231 *
232 * drbg->drbg_mutex must have been taken.
233 *
234 * @drbg DRBG handle
235 * @entropy buffer of seed data to be checked
236 *
237 * return:
238 * 0 on success
239 * -EAGAIN on when the CTRNG is not yet primed
240 * < 0 on error
241 */
drbg_fips_continuous_test(struct drbg_state * drbg,const unsigned char * entropy)242 static int drbg_fips_continuous_test(struct drbg_state *drbg,
243 const unsigned char *entropy)
244 {
245 unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
246 int ret = 0;
247
248 if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
249 return 0;
250
251 /* skip test if we test the overall system */
252 if (list_empty(&drbg->test_data.list))
253 return 0;
254 /* only perform test in FIPS mode */
255 if (!fips_enabled)
256 return 0;
257
258 if (!drbg->fips_primed) {
259 /* Priming of FIPS test */
260 memcpy(drbg->prev, entropy, entropylen);
261 drbg->fips_primed = true;
262 /* priming: another round is needed */
263 return -EAGAIN;
264 }
265 ret = memcmp(drbg->prev, entropy, entropylen);
266 if (!ret)
267 panic("DRBG continuous self test failed\n");
268 memcpy(drbg->prev, entropy, entropylen);
269
270 /* the test shall pass when the two values are not equal */
271 return 0;
272 }
273
274 /*
275 * Convert an integer into a byte representation of this integer.
276 * The byte representation is big-endian
277 *
278 * @val value to be converted
279 * @buf buffer holding the converted integer -- caller must ensure that
280 * buffer size is at least 32 bit
281 */
282 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
drbg_cpu_to_be32(__u32 val,unsigned char * buf)283 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
284 {
285 struct s {
286 __be32 conv;
287 };
288 struct s *conversion = (struct s *) buf;
289
290 conversion->conv = cpu_to_be32(val);
291 }
292 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
293
294 /******************************************************************
295 * CTR DRBG callback functions
296 ******************************************************************/
297
298 #ifdef CONFIG_CRYPTO_DRBG_CTR
299 #define CRYPTO_DRBG_CTR_STRING "CTR "
300 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
301 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
302 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
303 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
304 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
305 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
306
307 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
308 const unsigned char *key);
309 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
310 const struct drbg_string *in);
311 static int drbg_init_sym_kernel(struct drbg_state *drbg);
312 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
313 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
314 u8 *inbuf, u32 inbuflen,
315 u8 *outbuf, u32 outlen);
316 #define DRBG_OUTSCRATCHLEN 256
317
318 /* BCC function for CTR DRBG as defined in 10.4.3 */
drbg_ctr_bcc(struct drbg_state * drbg,unsigned char * out,const unsigned char * key,struct list_head * in)319 static int drbg_ctr_bcc(struct drbg_state *drbg,
320 unsigned char *out, const unsigned char *key,
321 struct list_head *in)
322 {
323 int ret = 0;
324 struct drbg_string *curr = NULL;
325 struct drbg_string data;
326 short cnt = 0;
327
328 drbg_string_fill(&data, out, drbg_blocklen(drbg));
329
330 /* 10.4.3 step 2 / 4 */
331 drbg_kcapi_symsetkey(drbg, key);
332 list_for_each_entry(curr, in, list) {
333 const unsigned char *pos = curr->buf;
334 size_t len = curr->len;
335 /* 10.4.3 step 4.1 */
336 while (len) {
337 /* 10.4.3 step 4.2 */
338 if (drbg_blocklen(drbg) == cnt) {
339 cnt = 0;
340 ret = drbg_kcapi_sym(drbg, out, &data);
341 if (ret)
342 return ret;
343 }
344 out[cnt] ^= *pos;
345 pos++;
346 cnt++;
347 len--;
348 }
349 }
350 /* 10.4.3 step 4.2 for last block */
351 if (cnt)
352 ret = drbg_kcapi_sym(drbg, out, &data);
353
354 return ret;
355 }
356
357 /*
358 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
359 * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
360 * the scratchpad is used as follows:
361 * drbg_ctr_update:
362 * temp
363 * start: drbg->scratchpad
364 * length: drbg_statelen(drbg) + drbg_blocklen(drbg)
365 * note: the cipher writing into this variable works
366 * blocklen-wise. Now, when the statelen is not a multiple
367 * of blocklen, the generateion loop below "spills over"
368 * by at most blocklen. Thus, we need to give sufficient
369 * memory.
370 * df_data
371 * start: drbg->scratchpad +
372 * drbg_statelen(drbg) + drbg_blocklen(drbg)
373 * length: drbg_statelen(drbg)
374 *
375 * drbg_ctr_df:
376 * pad
377 * start: df_data + drbg_statelen(drbg)
378 * length: drbg_blocklen(drbg)
379 * iv
380 * start: pad + drbg_blocklen(drbg)
381 * length: drbg_blocklen(drbg)
382 * temp
383 * start: iv + drbg_blocklen(drbg)
384 * length: drbg_satelen(drbg) + drbg_blocklen(drbg)
385 * note: temp is the buffer that the BCC function operates
386 * on. BCC operates blockwise. drbg_statelen(drbg)
387 * is sufficient when the DRBG state length is a multiple
388 * of the block size. For AES192 (and maybe other ciphers)
389 * this is not correct and the length for temp is
390 * insufficient (yes, that also means for such ciphers,
391 * the final output of all BCC rounds are truncated).
392 * Therefore, add drbg_blocklen(drbg) to cover all
393 * possibilities.
394 */
395
396 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
drbg_ctr_df(struct drbg_state * drbg,unsigned char * df_data,size_t bytes_to_return,struct list_head * seedlist)397 static int drbg_ctr_df(struct drbg_state *drbg,
398 unsigned char *df_data, size_t bytes_to_return,
399 struct list_head *seedlist)
400 {
401 int ret = -EFAULT;
402 unsigned char L_N[8];
403 /* S3 is input */
404 struct drbg_string S1, S2, S4, cipherin;
405 LIST_HEAD(bcc_list);
406 unsigned char *pad = df_data + drbg_statelen(drbg);
407 unsigned char *iv = pad + drbg_blocklen(drbg);
408 unsigned char *temp = iv + drbg_blocklen(drbg);
409 size_t padlen = 0;
410 unsigned int templen = 0;
411 /* 10.4.2 step 7 */
412 unsigned int i = 0;
413 /* 10.4.2 step 8 */
414 const unsigned char *K = (unsigned char *)
415 "\x00\x01\x02\x03\x04\x05\x06\x07"
416 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
417 "\x10\x11\x12\x13\x14\x15\x16\x17"
418 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
419 unsigned char *X;
420 size_t generated_len = 0;
421 size_t inputlen = 0;
422 struct drbg_string *seed = NULL;
423
424 memset(pad, 0, drbg_blocklen(drbg));
425 memset(iv, 0, drbg_blocklen(drbg));
426
427 /* 10.4.2 step 1 is implicit as we work byte-wise */
428
429 /* 10.4.2 step 2 */
430 if ((512/8) < bytes_to_return)
431 return -EINVAL;
432
433 /* 10.4.2 step 2 -- calculate the entire length of all input data */
434 list_for_each_entry(seed, seedlist, list)
435 inputlen += seed->len;
436 drbg_cpu_to_be32(inputlen, &L_N[0]);
437
438 /* 10.4.2 step 3 */
439 drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
440
441 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
442 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
443 /* wrap the padlen appropriately */
444 if (padlen)
445 padlen = drbg_blocklen(drbg) - padlen;
446 /*
447 * pad / padlen contains the 0x80 byte and the following zero bytes.
448 * As the calculated padlen value only covers the number of zero
449 * bytes, this value has to be incremented by one for the 0x80 byte.
450 */
451 padlen++;
452 pad[0] = 0x80;
453
454 /* 10.4.2 step 4 -- first fill the linked list and then order it */
455 drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
456 list_add_tail(&S1.list, &bcc_list);
457 drbg_string_fill(&S2, L_N, sizeof(L_N));
458 list_add_tail(&S2.list, &bcc_list);
459 list_splice_tail(seedlist, &bcc_list);
460 drbg_string_fill(&S4, pad, padlen);
461 list_add_tail(&S4.list, &bcc_list);
462
463 /* 10.4.2 step 9 */
464 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
465 /*
466 * 10.4.2 step 9.1 - the padding is implicit as the buffer
467 * holds zeros after allocation -- even the increment of i
468 * is irrelevant as the increment remains within length of i
469 */
470 drbg_cpu_to_be32(i, iv);
471 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
472 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
473 if (ret)
474 goto out;
475 /* 10.4.2 step 9.3 */
476 i++;
477 templen += drbg_blocklen(drbg);
478 }
479
480 /* 10.4.2 step 11 */
481 X = temp + (drbg_keylen(drbg));
482 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
483
484 /* 10.4.2 step 12: overwriting of outval is implemented in next step */
485
486 /* 10.4.2 step 13 */
487 drbg_kcapi_symsetkey(drbg, temp);
488 while (generated_len < bytes_to_return) {
489 short blocklen = 0;
490 /*
491 * 10.4.2 step 13.1: the truncation of the key length is
492 * implicit as the key is only drbg_blocklen in size based on
493 * the implementation of the cipher function callback
494 */
495 ret = drbg_kcapi_sym(drbg, X, &cipherin);
496 if (ret)
497 goto out;
498 blocklen = (drbg_blocklen(drbg) <
499 (bytes_to_return - generated_len)) ?
500 drbg_blocklen(drbg) :
501 (bytes_to_return - generated_len);
502 /* 10.4.2 step 13.2 and 14 */
503 memcpy(df_data + generated_len, X, blocklen);
504 generated_len += blocklen;
505 }
506
507 ret = 0;
508
509 out:
510 memset(iv, 0, drbg_blocklen(drbg));
511 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
512 memset(pad, 0, drbg_blocklen(drbg));
513 return ret;
514 }
515
516 /*
517 * update function of CTR DRBG as defined in 10.2.1.2
518 *
519 * The reseed variable has an enhanced meaning compared to the update
520 * functions of the other DRBGs as follows:
521 * 0 => initial seed from initialization
522 * 1 => reseed via drbg_seed
523 * 2 => first invocation from drbg_ctr_update when addtl is present. In
524 * this case, the df_data scratchpad is not deleted so that it is
525 * available for another calls to prevent calling the DF function
526 * again.
527 * 3 => second invocation from drbg_ctr_update. When the update function
528 * was called with addtl, the df_data memory already contains the
529 * DFed addtl information and we do not need to call DF again.
530 */
drbg_ctr_update(struct drbg_state * drbg,struct list_head * seed,int reseed)531 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
532 int reseed)
533 {
534 int ret = -EFAULT;
535 /* 10.2.1.2 step 1 */
536 unsigned char *temp = drbg->scratchpad;
537 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
538 drbg_blocklen(drbg);
539
540 if (3 > reseed)
541 memset(df_data, 0, drbg_statelen(drbg));
542
543 if (!reseed) {
544 /*
545 * The DRBG uses the CTR mode of the underlying AES cipher. The
546 * CTR mode increments the counter value after the AES operation
547 * but SP800-90A requires that the counter is incremented before
548 * the AES operation. Hence, we increment it at the time we set
549 * it by one.
550 */
551 crypto_inc(drbg->V, drbg_blocklen(drbg));
552
553 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
554 drbg_keylen(drbg));
555 if (ret)
556 goto out;
557 }
558
559 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
560 if (seed) {
561 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
562 if (ret)
563 goto out;
564 }
565
566 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
567 temp, drbg_statelen(drbg));
568 if (ret)
569 return ret;
570
571 /* 10.2.1.2 step 5 */
572 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
573 drbg_keylen(drbg));
574 if (ret)
575 goto out;
576 /* 10.2.1.2 step 6 */
577 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
578 /* See above: increment counter by one to compensate timing of CTR op */
579 crypto_inc(drbg->V, drbg_blocklen(drbg));
580 ret = 0;
581
582 out:
583 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
584 if (2 != reseed)
585 memset(df_data, 0, drbg_statelen(drbg));
586 return ret;
587 }
588
589 /*
590 * scratchpad use: drbg_ctr_update is called independently from
591 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
592 */
593 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
drbg_ctr_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)594 static int drbg_ctr_generate(struct drbg_state *drbg,
595 unsigned char *buf, unsigned int buflen,
596 struct list_head *addtl)
597 {
598 int ret;
599 int len = min_t(int, buflen, INT_MAX);
600
601 /* 10.2.1.5.2 step 2 */
602 if (addtl && !list_empty(addtl)) {
603 ret = drbg_ctr_update(drbg, addtl, 2);
604 if (ret)
605 return 0;
606 }
607
608 /* 10.2.1.5.2 step 4.1 */
609 ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len);
610 if (ret)
611 return ret;
612
613 /* 10.2.1.5.2 step 6 */
614 ret = drbg_ctr_update(drbg, NULL, 3);
615 if (ret)
616 len = ret;
617
618 return len;
619 }
620
621 static const struct drbg_state_ops drbg_ctr_ops = {
622 .update = drbg_ctr_update,
623 .generate = drbg_ctr_generate,
624 .crypto_init = drbg_init_sym_kernel,
625 .crypto_fini = drbg_fini_sym_kernel,
626 };
627 #endif /* CONFIG_CRYPTO_DRBG_CTR */
628
629 /******************************************************************
630 * HMAC DRBG callback functions
631 ******************************************************************/
632
633 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
634 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
635 const struct list_head *in);
636 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
637 const unsigned char *key);
638 static int drbg_init_hash_kernel(struct drbg_state *drbg);
639 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
640 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
641
642 #ifdef CONFIG_CRYPTO_DRBG_HMAC
643 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
644 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
645 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
646 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
647 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
648 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
649 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
650 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
651 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
652
653 /* update function of HMAC DRBG as defined in 10.1.2.2 */
drbg_hmac_update(struct drbg_state * drbg,struct list_head * seed,int reseed)654 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
655 int reseed)
656 {
657 int ret = -EFAULT;
658 int i = 0;
659 struct drbg_string seed1, seed2, vdata;
660 LIST_HEAD(seedlist);
661 LIST_HEAD(vdatalist);
662
663 if (!reseed) {
664 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
665 memset(drbg->V, 1, drbg_statelen(drbg));
666 drbg_kcapi_hmacsetkey(drbg, drbg->C);
667 }
668
669 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
670 list_add_tail(&seed1.list, &seedlist);
671 /* buffer of seed2 will be filled in for loop below with one byte */
672 drbg_string_fill(&seed2, NULL, 1);
673 list_add_tail(&seed2.list, &seedlist);
674 /* input data of seed is allowed to be NULL at this point */
675 if (seed)
676 list_splice_tail(seed, &seedlist);
677
678 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
679 list_add_tail(&vdata.list, &vdatalist);
680 for (i = 2; 0 < i; i--) {
681 /* first round uses 0x0, second 0x1 */
682 unsigned char prefix = DRBG_PREFIX0;
683 if (1 == i)
684 prefix = DRBG_PREFIX1;
685 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
686 seed2.buf = &prefix;
687 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
688 if (ret)
689 return ret;
690 drbg_kcapi_hmacsetkey(drbg, drbg->C);
691
692 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
693 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
694 if (ret)
695 return ret;
696
697 /* 10.1.2.2 step 3 */
698 if (!seed)
699 return ret;
700 }
701
702 return 0;
703 }
704
705 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
drbg_hmac_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)706 static int drbg_hmac_generate(struct drbg_state *drbg,
707 unsigned char *buf,
708 unsigned int buflen,
709 struct list_head *addtl)
710 {
711 int len = 0;
712 int ret = 0;
713 struct drbg_string data;
714 LIST_HEAD(datalist);
715
716 /* 10.1.2.5 step 2 */
717 if (addtl && !list_empty(addtl)) {
718 ret = drbg_hmac_update(drbg, addtl, 1);
719 if (ret)
720 return ret;
721 }
722
723 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
724 list_add_tail(&data.list, &datalist);
725 while (len < buflen) {
726 unsigned int outlen = 0;
727 /* 10.1.2.5 step 4.1 */
728 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
729 if (ret)
730 return ret;
731 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
732 drbg_blocklen(drbg) : (buflen - len);
733
734 /* 10.1.2.5 step 4.2 */
735 memcpy(buf + len, drbg->V, outlen);
736 len += outlen;
737 }
738
739 /* 10.1.2.5 step 6 */
740 if (addtl && !list_empty(addtl))
741 ret = drbg_hmac_update(drbg, addtl, 1);
742 else
743 ret = drbg_hmac_update(drbg, NULL, 1);
744 if (ret)
745 return ret;
746
747 return len;
748 }
749
750 static const struct drbg_state_ops drbg_hmac_ops = {
751 .update = drbg_hmac_update,
752 .generate = drbg_hmac_generate,
753 .crypto_init = drbg_init_hash_kernel,
754 .crypto_fini = drbg_fini_hash_kernel,
755 };
756 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
757
758 /******************************************************************
759 * Hash DRBG callback functions
760 ******************************************************************/
761
762 #ifdef CONFIG_CRYPTO_DRBG_HASH
763 #define CRYPTO_DRBG_HASH_STRING "HASH "
764 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
765 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
766 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
767 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
768 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
769 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
770 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
771 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
772
773 /*
774 * Increment buffer
775 *
776 * @dst buffer to increment
777 * @add value to add
778 */
drbg_add_buf(unsigned char * dst,size_t dstlen,const unsigned char * add,size_t addlen)779 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
780 const unsigned char *add, size_t addlen)
781 {
782 /* implied: dstlen > addlen */
783 unsigned char *dstptr;
784 const unsigned char *addptr;
785 unsigned int remainder = 0;
786 size_t len = addlen;
787
788 dstptr = dst + (dstlen-1);
789 addptr = add + (addlen-1);
790 while (len) {
791 remainder += *dstptr + *addptr;
792 *dstptr = remainder & 0xff;
793 remainder >>= 8;
794 len--; dstptr--; addptr--;
795 }
796 len = dstlen - addlen;
797 while (len && remainder > 0) {
798 remainder = *dstptr + 1;
799 *dstptr = remainder & 0xff;
800 remainder >>= 8;
801 len--; dstptr--;
802 }
803 }
804
805 /*
806 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
807 * interlinked, the scratchpad is used as follows:
808 * drbg_hash_update
809 * start: drbg->scratchpad
810 * length: drbg_statelen(drbg)
811 * drbg_hash_df:
812 * start: drbg->scratchpad + drbg_statelen(drbg)
813 * length: drbg_blocklen(drbg)
814 *
815 * drbg_hash_process_addtl uses the scratchpad, but fully completes
816 * before either of the functions mentioned before are invoked. Therefore,
817 * drbg_hash_process_addtl does not need to be specifically considered.
818 */
819
820 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
drbg_hash_df(struct drbg_state * drbg,unsigned char * outval,size_t outlen,struct list_head * entropylist)821 static int drbg_hash_df(struct drbg_state *drbg,
822 unsigned char *outval, size_t outlen,
823 struct list_head *entropylist)
824 {
825 int ret = 0;
826 size_t len = 0;
827 unsigned char input[5];
828 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
829 struct drbg_string data;
830
831 /* 10.4.1 step 3 */
832 input[0] = 1;
833 drbg_cpu_to_be32((outlen * 8), &input[1]);
834
835 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
836 drbg_string_fill(&data, input, 5);
837 list_add(&data.list, entropylist);
838
839 /* 10.4.1 step 4 */
840 while (len < outlen) {
841 short blocklen = 0;
842 /* 10.4.1 step 4.1 */
843 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
844 if (ret)
845 goto out;
846 /* 10.4.1 step 4.2 */
847 input[0]++;
848 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
849 drbg_blocklen(drbg) : (outlen - len);
850 memcpy(outval + len, tmp, blocklen);
851 len += blocklen;
852 }
853
854 out:
855 memset(tmp, 0, drbg_blocklen(drbg));
856 return ret;
857 }
858
859 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
drbg_hash_update(struct drbg_state * drbg,struct list_head * seed,int reseed)860 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
861 int reseed)
862 {
863 int ret = 0;
864 struct drbg_string data1, data2;
865 LIST_HEAD(datalist);
866 LIST_HEAD(datalist2);
867 unsigned char *V = drbg->scratchpad;
868 unsigned char prefix = DRBG_PREFIX1;
869
870 if (!seed)
871 return -EINVAL;
872
873 if (reseed) {
874 /* 10.1.1.3 step 1 */
875 memcpy(V, drbg->V, drbg_statelen(drbg));
876 drbg_string_fill(&data1, &prefix, 1);
877 list_add_tail(&data1.list, &datalist);
878 drbg_string_fill(&data2, V, drbg_statelen(drbg));
879 list_add_tail(&data2.list, &datalist);
880 }
881 list_splice_tail(seed, &datalist);
882
883 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
884 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
885 if (ret)
886 goto out;
887
888 /* 10.1.1.2 / 10.1.1.3 step 4 */
889 prefix = DRBG_PREFIX0;
890 drbg_string_fill(&data1, &prefix, 1);
891 list_add_tail(&data1.list, &datalist2);
892 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
893 list_add_tail(&data2.list, &datalist2);
894 /* 10.1.1.2 / 10.1.1.3 step 4 */
895 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
896
897 out:
898 memset(drbg->scratchpad, 0, drbg_statelen(drbg));
899 return ret;
900 }
901
902 /* processing of additional information string for Hash DRBG */
drbg_hash_process_addtl(struct drbg_state * drbg,struct list_head * addtl)903 static int drbg_hash_process_addtl(struct drbg_state *drbg,
904 struct list_head *addtl)
905 {
906 int ret = 0;
907 struct drbg_string data1, data2;
908 LIST_HEAD(datalist);
909 unsigned char prefix = DRBG_PREFIX2;
910
911 /* 10.1.1.4 step 2 */
912 if (!addtl || list_empty(addtl))
913 return 0;
914
915 /* 10.1.1.4 step 2a */
916 drbg_string_fill(&data1, &prefix, 1);
917 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
918 list_add_tail(&data1.list, &datalist);
919 list_add_tail(&data2.list, &datalist);
920 list_splice_tail(addtl, &datalist);
921 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
922 if (ret)
923 goto out;
924
925 /* 10.1.1.4 step 2b */
926 drbg_add_buf(drbg->V, drbg_statelen(drbg),
927 drbg->scratchpad, drbg_blocklen(drbg));
928
929 out:
930 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
931 return ret;
932 }
933
934 /* Hashgen defined in 10.1.1.4 */
drbg_hash_hashgen(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen)935 static int drbg_hash_hashgen(struct drbg_state *drbg,
936 unsigned char *buf,
937 unsigned int buflen)
938 {
939 int len = 0;
940 int ret = 0;
941 unsigned char *src = drbg->scratchpad;
942 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
943 struct drbg_string data;
944 LIST_HEAD(datalist);
945
946 /* 10.1.1.4 step hashgen 2 */
947 memcpy(src, drbg->V, drbg_statelen(drbg));
948
949 drbg_string_fill(&data, src, drbg_statelen(drbg));
950 list_add_tail(&data.list, &datalist);
951 while (len < buflen) {
952 unsigned int outlen = 0;
953 /* 10.1.1.4 step hashgen 4.1 */
954 ret = drbg_kcapi_hash(drbg, dst, &datalist);
955 if (ret) {
956 len = ret;
957 goto out;
958 }
959 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
960 drbg_blocklen(drbg) : (buflen - len);
961 /* 10.1.1.4 step hashgen 4.2 */
962 memcpy(buf + len, dst, outlen);
963 len += outlen;
964 /* 10.1.1.4 hashgen step 4.3 */
965 if (len < buflen)
966 crypto_inc(src, drbg_statelen(drbg));
967 }
968
969 out:
970 memset(drbg->scratchpad, 0,
971 (drbg_statelen(drbg) + drbg_blocklen(drbg)));
972 return len;
973 }
974
975 /* generate function for Hash DRBG as defined in 10.1.1.4 */
drbg_hash_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct list_head * addtl)976 static int drbg_hash_generate(struct drbg_state *drbg,
977 unsigned char *buf, unsigned int buflen,
978 struct list_head *addtl)
979 {
980 int len = 0;
981 int ret = 0;
982 union {
983 unsigned char req[8];
984 __be64 req_int;
985 } u;
986 unsigned char prefix = DRBG_PREFIX3;
987 struct drbg_string data1, data2;
988 LIST_HEAD(datalist);
989
990 /* 10.1.1.4 step 2 */
991 ret = drbg_hash_process_addtl(drbg, addtl);
992 if (ret)
993 return ret;
994 /* 10.1.1.4 step 3 */
995 len = drbg_hash_hashgen(drbg, buf, buflen);
996
997 /* this is the value H as documented in 10.1.1.4 */
998 /* 10.1.1.4 step 4 */
999 drbg_string_fill(&data1, &prefix, 1);
1000 list_add_tail(&data1.list, &datalist);
1001 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
1002 list_add_tail(&data2.list, &datalist);
1003 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
1004 if (ret) {
1005 len = ret;
1006 goto out;
1007 }
1008
1009 /* 10.1.1.4 step 5 */
1010 drbg_add_buf(drbg->V, drbg_statelen(drbg),
1011 drbg->scratchpad, drbg_blocklen(drbg));
1012 drbg_add_buf(drbg->V, drbg_statelen(drbg),
1013 drbg->C, drbg_statelen(drbg));
1014 u.req_int = cpu_to_be64(drbg->reseed_ctr);
1015 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1016
1017 out:
1018 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1019 return len;
1020 }
1021
1022 /*
1023 * scratchpad usage: as update and generate are used isolated, both
1024 * can use the scratchpad
1025 */
1026 static const struct drbg_state_ops drbg_hash_ops = {
1027 .update = drbg_hash_update,
1028 .generate = drbg_hash_generate,
1029 .crypto_init = drbg_init_hash_kernel,
1030 .crypto_fini = drbg_fini_hash_kernel,
1031 };
1032 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1033
1034 /******************************************************************
1035 * Functions common for DRBG implementations
1036 ******************************************************************/
1037
__drbg_seed(struct drbg_state * drbg,struct list_head * seed,int reseed)1038 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1039 int reseed)
1040 {
1041 int ret = drbg->d_ops->update(drbg, seed, reseed);
1042
1043 if (ret)
1044 return ret;
1045
1046 drbg->seeded = true;
1047 /* 10.1.1.2 / 10.1.1.3 step 5 */
1048 drbg->reseed_ctr = 1;
1049
1050 return ret;
1051 }
1052
drbg_get_random_bytes(struct drbg_state * drbg,unsigned char * entropy,unsigned int entropylen)1053 static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1054 unsigned char *entropy,
1055 unsigned int entropylen)
1056 {
1057 int ret;
1058
1059 do {
1060 get_random_bytes(entropy, entropylen);
1061 ret = drbg_fips_continuous_test(drbg, entropy);
1062 if (ret && ret != -EAGAIN)
1063 return ret;
1064 } while (ret);
1065
1066 return 0;
1067 }
1068
drbg_async_seed(struct work_struct * work)1069 static void drbg_async_seed(struct work_struct *work)
1070 {
1071 struct drbg_string data;
1072 LIST_HEAD(seedlist);
1073 struct drbg_state *drbg = container_of(work, struct drbg_state,
1074 seed_work);
1075 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1076 unsigned char entropy[32];
1077 int ret;
1078
1079 BUG_ON(!entropylen);
1080 BUG_ON(entropylen > sizeof(entropy));
1081
1082 drbg_string_fill(&data, entropy, entropylen);
1083 list_add_tail(&data.list, &seedlist);
1084
1085 mutex_lock(&drbg->drbg_mutex);
1086
1087 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1088 if (ret)
1089 goto unlock;
1090
1091 /* Set seeded to false so that if __drbg_seed fails the
1092 * next generate call will trigger a reseed.
1093 */
1094 drbg->seeded = false;
1095
1096 __drbg_seed(drbg, &seedlist, true);
1097
1098 if (drbg->seeded)
1099 drbg->reseed_threshold = drbg_max_requests(drbg);
1100
1101 unlock:
1102 mutex_unlock(&drbg->drbg_mutex);
1103
1104 memzero_explicit(entropy, entropylen);
1105 }
1106
1107 /*
1108 * Seeding or reseeding of the DRBG
1109 *
1110 * @drbg: DRBG state struct
1111 * @pers: personalization / additional information buffer
1112 * @reseed: 0 for initial seed process, 1 for reseeding
1113 *
1114 * return:
1115 * 0 on success
1116 * error value otherwise
1117 */
drbg_seed(struct drbg_state * drbg,struct drbg_string * pers,bool reseed)1118 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1119 bool reseed)
1120 {
1121 int ret;
1122 unsigned char entropy[((32 + 16) * 2)];
1123 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1124 struct drbg_string data1;
1125 LIST_HEAD(seedlist);
1126
1127 /* 9.1 / 9.2 / 9.3.1 step 3 */
1128 if (pers && pers->len > (drbg_max_addtl(drbg))) {
1129 pr_devel("DRBG: personalization string too long %zu\n",
1130 pers->len);
1131 return -EINVAL;
1132 }
1133
1134 if (list_empty(&drbg->test_data.list)) {
1135 drbg_string_fill(&data1, drbg->test_data.buf,
1136 drbg->test_data.len);
1137 pr_devel("DRBG: using test entropy\n");
1138 } else {
1139 /*
1140 * Gather entropy equal to the security strength of the DRBG.
1141 * With a derivation function, a nonce is required in addition
1142 * to the entropy. A nonce must be at least 1/2 of the security
1143 * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1144 * of the strength. The consideration of a nonce is only
1145 * applicable during initial seeding.
1146 */
1147 BUG_ON(!entropylen);
1148 if (!reseed)
1149 entropylen = ((entropylen + 1) / 2) * 3;
1150 BUG_ON((entropylen * 2) > sizeof(entropy));
1151
1152 /* Get seed from in-kernel /dev/urandom */
1153 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1154 if (ret)
1155 goto out;
1156
1157 if (!drbg->jent) {
1158 drbg_string_fill(&data1, entropy, entropylen);
1159 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1160 entropylen);
1161 } else {
1162 /* Get seed from Jitter RNG */
1163 ret = crypto_rng_get_bytes(drbg->jent,
1164 entropy + entropylen,
1165 entropylen);
1166 if (ret) {
1167 pr_devel("DRBG: jent failed with %d\n", ret);
1168
1169 /*
1170 * Do not treat the transient failure of the
1171 * Jitter RNG as an error that needs to be
1172 * reported. The combined number of the
1173 * maximum reseed threshold times the maximum
1174 * number of Jitter RNG transient errors is
1175 * less than the reseed threshold required by
1176 * SP800-90A allowing us to treat the
1177 * transient errors as such.
1178 *
1179 * However, we mandate that at least the first
1180 * seeding operation must succeed with the
1181 * Jitter RNG.
1182 */
1183 if (!reseed || ret != -EAGAIN)
1184 goto out;
1185 }
1186
1187 drbg_string_fill(&data1, entropy, entropylen * 2);
1188 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1189 entropylen * 2);
1190 }
1191 }
1192 list_add_tail(&data1.list, &seedlist);
1193
1194 /*
1195 * concatenation of entropy with personalization str / addtl input)
1196 * the variable pers is directly handed in by the caller, so check its
1197 * contents whether it is appropriate
1198 */
1199 if (pers && pers->buf && 0 < pers->len) {
1200 list_add_tail(&pers->list, &seedlist);
1201 pr_devel("DRBG: using personalization string\n");
1202 }
1203
1204 if (!reseed) {
1205 memset(drbg->V, 0, drbg_statelen(drbg));
1206 memset(drbg->C, 0, drbg_statelen(drbg));
1207 }
1208
1209 ret = __drbg_seed(drbg, &seedlist, reseed);
1210
1211 out:
1212 memzero_explicit(entropy, entropylen * 2);
1213
1214 return ret;
1215 }
1216
1217 /* Free all substructures in a DRBG state without the DRBG state structure */
drbg_dealloc_state(struct drbg_state * drbg)1218 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1219 {
1220 if (!drbg)
1221 return;
1222 kfree_sensitive(drbg->Vbuf);
1223 drbg->Vbuf = NULL;
1224 drbg->V = NULL;
1225 kfree_sensitive(drbg->Cbuf);
1226 drbg->Cbuf = NULL;
1227 drbg->C = NULL;
1228 kfree_sensitive(drbg->scratchpadbuf);
1229 drbg->scratchpadbuf = NULL;
1230 drbg->reseed_ctr = 0;
1231 drbg->d_ops = NULL;
1232 drbg->core = NULL;
1233 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1234 kfree_sensitive(drbg->prev);
1235 drbg->prev = NULL;
1236 drbg->fips_primed = false;
1237 }
1238 }
1239
1240 /*
1241 * Allocate all sub-structures for a DRBG state.
1242 * The DRBG state structure must already be allocated.
1243 */
drbg_alloc_state(struct drbg_state * drbg)1244 static inline int drbg_alloc_state(struct drbg_state *drbg)
1245 {
1246 int ret = -ENOMEM;
1247 unsigned int sb_size = 0;
1248
1249 switch (drbg->core->flags & DRBG_TYPE_MASK) {
1250 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1251 case DRBG_HMAC:
1252 drbg->d_ops = &drbg_hmac_ops;
1253 break;
1254 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1255 #ifdef CONFIG_CRYPTO_DRBG_HASH
1256 case DRBG_HASH:
1257 drbg->d_ops = &drbg_hash_ops;
1258 break;
1259 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1260 #ifdef CONFIG_CRYPTO_DRBG_CTR
1261 case DRBG_CTR:
1262 drbg->d_ops = &drbg_ctr_ops;
1263 break;
1264 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1265 default:
1266 ret = -EOPNOTSUPP;
1267 goto err;
1268 }
1269
1270 ret = drbg->d_ops->crypto_init(drbg);
1271 if (ret < 0)
1272 goto err;
1273
1274 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1275 if (!drbg->Vbuf) {
1276 ret = -ENOMEM;
1277 goto fini;
1278 }
1279 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1280 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1281 if (!drbg->Cbuf) {
1282 ret = -ENOMEM;
1283 goto fini;
1284 }
1285 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1286 /* scratchpad is only generated for CTR and Hash */
1287 if (drbg->core->flags & DRBG_HMAC)
1288 sb_size = 0;
1289 else if (drbg->core->flags & DRBG_CTR)
1290 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1291 drbg_statelen(drbg) + /* df_data */
1292 drbg_blocklen(drbg) + /* pad */
1293 drbg_blocklen(drbg) + /* iv */
1294 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1295 else
1296 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1297
1298 if (0 < sb_size) {
1299 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1300 if (!drbg->scratchpadbuf) {
1301 ret = -ENOMEM;
1302 goto fini;
1303 }
1304 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1305 }
1306
1307 if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1308 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1309 GFP_KERNEL);
1310 if (!drbg->prev) {
1311 ret = -ENOMEM;
1312 goto fini;
1313 }
1314 drbg->fips_primed = false;
1315 }
1316
1317 return 0;
1318
1319 fini:
1320 drbg->d_ops->crypto_fini(drbg);
1321 err:
1322 drbg_dealloc_state(drbg);
1323 return ret;
1324 }
1325
1326 /*************************************************************************
1327 * DRBG interface functions
1328 *************************************************************************/
1329
1330 /*
1331 * DRBG generate function as required by SP800-90A - this function
1332 * generates random numbers
1333 *
1334 * @drbg DRBG state handle
1335 * @buf Buffer where to store the random numbers -- the buffer must already
1336 * be pre-allocated by caller
1337 * @buflen Length of output buffer - this value defines the number of random
1338 * bytes pulled from DRBG
1339 * @addtl Additional input that is mixed into state, may be NULL -- note
1340 * the entropy is pulled by the DRBG internally unconditionally
1341 * as defined in SP800-90A. The additional input is mixed into
1342 * the state in addition to the pulled entropy.
1343 *
1344 * return: 0 when all bytes are generated; < 0 in case of an error
1345 */
drbg_generate(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct drbg_string * addtl)1346 static int drbg_generate(struct drbg_state *drbg,
1347 unsigned char *buf, unsigned int buflen,
1348 struct drbg_string *addtl)
1349 {
1350 int len = 0;
1351 LIST_HEAD(addtllist);
1352
1353 if (!drbg->core) {
1354 pr_devel("DRBG: not yet seeded\n");
1355 return -EINVAL;
1356 }
1357 if (0 == buflen || !buf) {
1358 pr_devel("DRBG: no output buffer provided\n");
1359 return -EINVAL;
1360 }
1361 if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1362 pr_devel("DRBG: wrong format of additional information\n");
1363 return -EINVAL;
1364 }
1365
1366 /* 9.3.1 step 2 */
1367 len = -EINVAL;
1368 if (buflen > (drbg_max_request_bytes(drbg))) {
1369 pr_devel("DRBG: requested random numbers too large %u\n",
1370 buflen);
1371 goto err;
1372 }
1373
1374 /* 9.3.1 step 3 is implicit with the chosen DRBG */
1375
1376 /* 9.3.1 step 4 */
1377 if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1378 pr_devel("DRBG: additional information string too long %zu\n",
1379 addtl->len);
1380 goto err;
1381 }
1382 /* 9.3.1 step 5 is implicit with the chosen DRBG */
1383
1384 /*
1385 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1386 * here. The spec is a bit convoluted here, we make it simpler.
1387 */
1388 if (drbg->reseed_threshold < drbg->reseed_ctr)
1389 drbg->seeded = false;
1390
1391 if (drbg->pr || !drbg->seeded) {
1392 pr_devel("DRBG: reseeding before generation (prediction "
1393 "resistance: %s, state %s)\n",
1394 drbg->pr ? "true" : "false",
1395 drbg->seeded ? "seeded" : "unseeded");
1396 /* 9.3.1 steps 7.1 through 7.3 */
1397 len = drbg_seed(drbg, addtl, true);
1398 if (len)
1399 goto err;
1400 /* 9.3.1 step 7.4 */
1401 addtl = NULL;
1402 }
1403
1404 if (addtl && 0 < addtl->len)
1405 list_add_tail(&addtl->list, &addtllist);
1406 /* 9.3.1 step 8 and 10 */
1407 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1408
1409 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1410 drbg->reseed_ctr++;
1411 if (0 >= len)
1412 goto err;
1413
1414 /*
1415 * Section 11.3.3 requires to re-perform self tests after some
1416 * generated random numbers. The chosen value after which self
1417 * test is performed is arbitrary, but it should be reasonable.
1418 * However, we do not perform the self tests because of the following
1419 * reasons: it is mathematically impossible that the initial self tests
1420 * were successfully and the following are not. If the initial would
1421 * pass and the following would not, the kernel integrity is violated.
1422 * In this case, the entire kernel operation is questionable and it
1423 * is unlikely that the integrity violation only affects the
1424 * correct operation of the DRBG.
1425 *
1426 * Albeit the following code is commented out, it is provided in
1427 * case somebody has a need to implement the test of 11.3.3.
1428 */
1429 #if 0
1430 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1431 int err = 0;
1432 pr_devel("DRBG: start to perform self test\n");
1433 if (drbg->core->flags & DRBG_HMAC)
1434 err = alg_test("drbg_pr_hmac_sha256",
1435 "drbg_pr_hmac_sha256", 0, 0);
1436 else if (drbg->core->flags & DRBG_CTR)
1437 err = alg_test("drbg_pr_ctr_aes128",
1438 "drbg_pr_ctr_aes128", 0, 0);
1439 else
1440 err = alg_test("drbg_pr_sha256",
1441 "drbg_pr_sha256", 0, 0);
1442 if (err) {
1443 pr_err("DRBG: periodical self test failed\n");
1444 /*
1445 * uninstantiate implies that from now on, only errors
1446 * are returned when reusing this DRBG cipher handle
1447 */
1448 drbg_uninstantiate(drbg);
1449 return 0;
1450 } else {
1451 pr_devel("DRBG: self test successful\n");
1452 }
1453 }
1454 #endif
1455
1456 /*
1457 * All operations were successful, return 0 as mandated by
1458 * the kernel crypto API interface.
1459 */
1460 len = 0;
1461 err:
1462 return len;
1463 }
1464
1465 /*
1466 * Wrapper around drbg_generate which can pull arbitrary long strings
1467 * from the DRBG without hitting the maximum request limitation.
1468 *
1469 * Parameters: see drbg_generate
1470 * Return codes: see drbg_generate -- if one drbg_generate request fails,
1471 * the entire drbg_generate_long request fails
1472 */
drbg_generate_long(struct drbg_state * drbg,unsigned char * buf,unsigned int buflen,struct drbg_string * addtl)1473 static int drbg_generate_long(struct drbg_state *drbg,
1474 unsigned char *buf, unsigned int buflen,
1475 struct drbg_string *addtl)
1476 {
1477 unsigned int len = 0;
1478 unsigned int slice = 0;
1479 do {
1480 int err = 0;
1481 unsigned int chunk = 0;
1482 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1483 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1484 mutex_lock(&drbg->drbg_mutex);
1485 err = drbg_generate(drbg, buf + len, chunk, addtl);
1486 mutex_unlock(&drbg->drbg_mutex);
1487 if (0 > err)
1488 return err;
1489 len += chunk;
1490 } while (slice > 0 && (len < buflen));
1491 return 0;
1492 }
1493
drbg_schedule_async_seed(struct random_ready_callback * rdy)1494 static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
1495 {
1496 struct drbg_state *drbg = container_of(rdy, struct drbg_state,
1497 random_ready);
1498
1499 schedule_work(&drbg->seed_work);
1500 }
1501
drbg_prepare_hrng(struct drbg_state * drbg)1502 static int drbg_prepare_hrng(struct drbg_state *drbg)
1503 {
1504 int err;
1505
1506 /* We do not need an HRNG in test mode. */
1507 if (list_empty(&drbg->test_data.list))
1508 return 0;
1509
1510 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1511
1512 INIT_WORK(&drbg->seed_work, drbg_async_seed);
1513
1514 drbg->random_ready.owner = THIS_MODULE;
1515 drbg->random_ready.func = drbg_schedule_async_seed;
1516
1517 err = add_random_ready_callback(&drbg->random_ready);
1518
1519 switch (err) {
1520 case 0:
1521 break;
1522
1523 case -EALREADY:
1524 err = 0;
1525 fallthrough;
1526
1527 default:
1528 drbg->random_ready.func = NULL;
1529 return err;
1530 }
1531
1532 /*
1533 * Require frequent reseeds until the seed source is fully
1534 * initialized.
1535 */
1536 drbg->reseed_threshold = 50;
1537
1538 return err;
1539 }
1540
1541 /*
1542 * DRBG instantiation function as required by SP800-90A - this function
1543 * sets up the DRBG handle, performs the initial seeding and all sanity
1544 * checks required by SP800-90A
1545 *
1546 * @drbg memory of state -- if NULL, new memory is allocated
1547 * @pers Personalization string that is mixed into state, may be NULL -- note
1548 * the entropy is pulled by the DRBG internally unconditionally
1549 * as defined in SP800-90A. The additional input is mixed into
1550 * the state in addition to the pulled entropy.
1551 * @coreref reference to core
1552 * @pr prediction resistance enabled
1553 *
1554 * return
1555 * 0 on success
1556 * error value otherwise
1557 */
drbg_instantiate(struct drbg_state * drbg,struct drbg_string * pers,int coreref,bool pr)1558 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1559 int coreref, bool pr)
1560 {
1561 int ret;
1562 bool reseed = true;
1563
1564 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1565 "%s\n", coreref, pr ? "enabled" : "disabled");
1566 mutex_lock(&drbg->drbg_mutex);
1567
1568 /* 9.1 step 1 is implicit with the selected DRBG type */
1569
1570 /*
1571 * 9.1 step 2 is implicit as caller can select prediction resistance
1572 * and the flag is copied into drbg->flags --
1573 * all DRBG types support prediction resistance
1574 */
1575
1576 /* 9.1 step 4 is implicit in drbg_sec_strength */
1577
1578 if (!drbg->core) {
1579 drbg->core = &drbg_cores[coreref];
1580 drbg->pr = pr;
1581 drbg->seeded = false;
1582 drbg->reseed_threshold = drbg_max_requests(drbg);
1583
1584 ret = drbg_alloc_state(drbg);
1585 if (ret)
1586 goto unlock;
1587
1588 ret = drbg_prepare_hrng(drbg);
1589 if (ret)
1590 goto free_everything;
1591
1592 if (IS_ERR(drbg->jent)) {
1593 ret = PTR_ERR(drbg->jent);
1594 drbg->jent = NULL;
1595 if (fips_enabled || ret != -ENOENT)
1596 goto free_everything;
1597 pr_info("DRBG: Continuing without Jitter RNG\n");
1598 }
1599
1600 reseed = false;
1601 }
1602
1603 ret = drbg_seed(drbg, pers, reseed);
1604
1605 if (ret && !reseed)
1606 goto free_everything;
1607
1608 mutex_unlock(&drbg->drbg_mutex);
1609 return ret;
1610
1611 unlock:
1612 mutex_unlock(&drbg->drbg_mutex);
1613 return ret;
1614
1615 free_everything:
1616 mutex_unlock(&drbg->drbg_mutex);
1617 drbg_uninstantiate(drbg);
1618 return ret;
1619 }
1620
1621 /*
1622 * DRBG uninstantiate function as required by SP800-90A - this function
1623 * frees all buffers and the DRBG handle
1624 *
1625 * @drbg DRBG state handle
1626 *
1627 * return
1628 * 0 on success
1629 */
drbg_uninstantiate(struct drbg_state * drbg)1630 static int drbg_uninstantiate(struct drbg_state *drbg)
1631 {
1632 if (drbg->random_ready.func) {
1633 del_random_ready_callback(&drbg->random_ready);
1634 cancel_work_sync(&drbg->seed_work);
1635 }
1636
1637 if (!IS_ERR_OR_NULL(drbg->jent))
1638 crypto_free_rng(drbg->jent);
1639 drbg->jent = NULL;
1640
1641 if (drbg->d_ops)
1642 drbg->d_ops->crypto_fini(drbg);
1643 drbg_dealloc_state(drbg);
1644 /* no scrubbing of test_data -- this shall survive an uninstantiate */
1645 return 0;
1646 }
1647
1648 /*
1649 * Helper function for setting the test data in the DRBG
1650 *
1651 * @drbg DRBG state handle
1652 * @data test data
1653 * @len test data length
1654 */
drbg_kcapi_set_entropy(struct crypto_rng * tfm,const u8 * data,unsigned int len)1655 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1656 const u8 *data, unsigned int len)
1657 {
1658 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1659
1660 mutex_lock(&drbg->drbg_mutex);
1661 drbg_string_fill(&drbg->test_data, data, len);
1662 mutex_unlock(&drbg->drbg_mutex);
1663 }
1664
1665 /***************************************************************
1666 * Kernel crypto API cipher invocations requested by DRBG
1667 ***************************************************************/
1668
1669 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1670 struct sdesc {
1671 struct shash_desc shash;
1672 char ctx[];
1673 };
1674
drbg_init_hash_kernel(struct drbg_state * drbg)1675 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1676 {
1677 struct sdesc *sdesc;
1678 struct crypto_shash *tfm;
1679
1680 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1681 if (IS_ERR(tfm)) {
1682 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1683 drbg->core->backend_cra_name);
1684 return PTR_ERR(tfm);
1685 }
1686 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1687 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1688 GFP_KERNEL);
1689 if (!sdesc) {
1690 crypto_free_shash(tfm);
1691 return -ENOMEM;
1692 }
1693
1694 sdesc->shash.tfm = tfm;
1695 drbg->priv_data = sdesc;
1696
1697 return crypto_shash_alignmask(tfm);
1698 }
1699
drbg_fini_hash_kernel(struct drbg_state * drbg)1700 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1701 {
1702 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1703 if (sdesc) {
1704 crypto_free_shash(sdesc->shash.tfm);
1705 kfree_sensitive(sdesc);
1706 }
1707 drbg->priv_data = NULL;
1708 return 0;
1709 }
1710
drbg_kcapi_hmacsetkey(struct drbg_state * drbg,const unsigned char * key)1711 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1712 const unsigned char *key)
1713 {
1714 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1715
1716 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1717 }
1718
drbg_kcapi_hash(struct drbg_state * drbg,unsigned char * outval,const struct list_head * in)1719 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1720 const struct list_head *in)
1721 {
1722 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1723 struct drbg_string *input = NULL;
1724
1725 crypto_shash_init(&sdesc->shash);
1726 list_for_each_entry(input, in, list)
1727 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1728 return crypto_shash_final(&sdesc->shash, outval);
1729 }
1730 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1731
1732 #ifdef CONFIG_CRYPTO_DRBG_CTR
drbg_fini_sym_kernel(struct drbg_state * drbg)1733 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1734 {
1735 struct crypto_cipher *tfm =
1736 (struct crypto_cipher *)drbg->priv_data;
1737 if (tfm)
1738 crypto_free_cipher(tfm);
1739 drbg->priv_data = NULL;
1740
1741 if (drbg->ctr_handle)
1742 crypto_free_skcipher(drbg->ctr_handle);
1743 drbg->ctr_handle = NULL;
1744
1745 if (drbg->ctr_req)
1746 skcipher_request_free(drbg->ctr_req);
1747 drbg->ctr_req = NULL;
1748
1749 kfree(drbg->outscratchpadbuf);
1750 drbg->outscratchpadbuf = NULL;
1751
1752 return 0;
1753 }
1754
drbg_init_sym_kernel(struct drbg_state * drbg)1755 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1756 {
1757 struct crypto_cipher *tfm;
1758 struct crypto_skcipher *sk_tfm;
1759 struct skcipher_request *req;
1760 unsigned int alignmask;
1761 char ctr_name[CRYPTO_MAX_ALG_NAME];
1762
1763 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1764 if (IS_ERR(tfm)) {
1765 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1766 drbg->core->backend_cra_name);
1767 return PTR_ERR(tfm);
1768 }
1769 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1770 drbg->priv_data = tfm;
1771
1772 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1773 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1774 drbg_fini_sym_kernel(drbg);
1775 return -EINVAL;
1776 }
1777 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1778 if (IS_ERR(sk_tfm)) {
1779 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1780 ctr_name);
1781 drbg_fini_sym_kernel(drbg);
1782 return PTR_ERR(sk_tfm);
1783 }
1784 drbg->ctr_handle = sk_tfm;
1785 crypto_init_wait(&drbg->ctr_wait);
1786
1787 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1788 if (!req) {
1789 pr_info("DRBG: could not allocate request queue\n");
1790 drbg_fini_sym_kernel(drbg);
1791 return -ENOMEM;
1792 }
1793 drbg->ctr_req = req;
1794 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
1795 CRYPTO_TFM_REQ_MAY_SLEEP,
1796 crypto_req_done, &drbg->ctr_wait);
1797
1798 alignmask = crypto_skcipher_alignmask(sk_tfm);
1799 drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1800 GFP_KERNEL);
1801 if (!drbg->outscratchpadbuf) {
1802 drbg_fini_sym_kernel(drbg);
1803 return -ENOMEM;
1804 }
1805 drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1806 alignmask + 1);
1807
1808 sg_init_table(&drbg->sg_in, 1);
1809 sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1810
1811 return alignmask;
1812 }
1813
drbg_kcapi_symsetkey(struct drbg_state * drbg,const unsigned char * key)1814 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1815 const unsigned char *key)
1816 {
1817 struct crypto_cipher *tfm =
1818 (struct crypto_cipher *)drbg->priv_data;
1819
1820 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1821 }
1822
drbg_kcapi_sym(struct drbg_state * drbg,unsigned char * outval,const struct drbg_string * in)1823 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1824 const struct drbg_string *in)
1825 {
1826 struct crypto_cipher *tfm =
1827 (struct crypto_cipher *)drbg->priv_data;
1828
1829 /* there is only component in *in */
1830 BUG_ON(in->len < drbg_blocklen(drbg));
1831 crypto_cipher_encrypt_one(tfm, outval, in->buf);
1832 return 0;
1833 }
1834
drbg_kcapi_sym_ctr(struct drbg_state * drbg,u8 * inbuf,u32 inlen,u8 * outbuf,u32 outlen)1835 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1836 u8 *inbuf, u32 inlen,
1837 u8 *outbuf, u32 outlen)
1838 {
1839 struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out;
1840 u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN);
1841 int ret;
1842
1843 if (inbuf) {
1844 /* Use caller-provided input buffer */
1845 sg_set_buf(sg_in, inbuf, inlen);
1846 } else {
1847 /* Use scratchpad for in-place operation */
1848 inlen = scratchpad_use;
1849 memset(drbg->outscratchpad, 0, scratchpad_use);
1850 sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
1851 }
1852
1853 while (outlen) {
1854 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1855
1856 /* Output buffer may not be valid for SGL, use scratchpad */
1857 skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out,
1858 cryptlen, drbg->V);
1859 ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req),
1860 &drbg->ctr_wait);
1861 if (ret)
1862 goto out;
1863
1864 crypto_init_wait(&drbg->ctr_wait);
1865
1866 memcpy(outbuf, drbg->outscratchpad, cryptlen);
1867 memzero_explicit(drbg->outscratchpad, cryptlen);
1868
1869 outlen -= cryptlen;
1870 outbuf += cryptlen;
1871 }
1872 ret = 0;
1873
1874 out:
1875 return ret;
1876 }
1877 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1878
1879 /***************************************************************
1880 * Kernel crypto API interface to register DRBG
1881 ***************************************************************/
1882
1883 /*
1884 * Look up the DRBG flags by given kernel crypto API cra_name
1885 * The code uses the drbg_cores definition to do this
1886 *
1887 * @cra_name kernel crypto API cra_name
1888 * @coreref reference to integer which is filled with the pointer to
1889 * the applicable core
1890 * @pr reference for setting prediction resistance
1891 *
1892 * return: flags
1893 */
drbg_convert_tfm_core(const char * cra_driver_name,int * coreref,bool * pr)1894 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1895 int *coreref, bool *pr)
1896 {
1897 int i = 0;
1898 size_t start = 0;
1899 int len = 0;
1900
1901 *pr = true;
1902 /* disassemble the names */
1903 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1904 start = 10;
1905 *pr = false;
1906 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1907 start = 8;
1908 } else {
1909 return;
1910 }
1911
1912 /* remove the first part */
1913 len = strlen(cra_driver_name) - start;
1914 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1915 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1916 len)) {
1917 *coreref = i;
1918 return;
1919 }
1920 }
1921 }
1922
drbg_kcapi_init(struct crypto_tfm * tfm)1923 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1924 {
1925 struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1926
1927 mutex_init(&drbg->drbg_mutex);
1928
1929 return 0;
1930 }
1931
drbg_kcapi_cleanup(struct crypto_tfm * tfm)1932 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1933 {
1934 drbg_uninstantiate(crypto_tfm_ctx(tfm));
1935 }
1936
1937 /*
1938 * Generate random numbers invoked by the kernel crypto API:
1939 * The API of the kernel crypto API is extended as follows:
1940 *
1941 * src is additional input supplied to the RNG.
1942 * slen is the length of src.
1943 * dst is the output buffer where random data is to be stored.
1944 * dlen is the length of dst.
1945 */
drbg_kcapi_random(struct crypto_rng * tfm,const u8 * src,unsigned int slen,u8 * dst,unsigned int dlen)1946 static int drbg_kcapi_random(struct crypto_rng *tfm,
1947 const u8 *src, unsigned int slen,
1948 u8 *dst, unsigned int dlen)
1949 {
1950 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1951 struct drbg_string *addtl = NULL;
1952 struct drbg_string string;
1953
1954 if (slen) {
1955 /* linked list variable is now local to allow modification */
1956 drbg_string_fill(&string, src, slen);
1957 addtl = &string;
1958 }
1959
1960 return drbg_generate_long(drbg, dst, dlen, addtl);
1961 }
1962
1963 /*
1964 * Seed the DRBG invoked by the kernel crypto API
1965 */
drbg_kcapi_seed(struct crypto_rng * tfm,const u8 * seed,unsigned int slen)1966 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1967 const u8 *seed, unsigned int slen)
1968 {
1969 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1970 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1971 bool pr = false;
1972 struct drbg_string string;
1973 struct drbg_string *seed_string = NULL;
1974 int coreref = 0;
1975
1976 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1977 &pr);
1978 if (0 < slen) {
1979 drbg_string_fill(&string, seed, slen);
1980 seed_string = &string;
1981 }
1982
1983 return drbg_instantiate(drbg, seed_string, coreref, pr);
1984 }
1985
1986 /***************************************************************
1987 * Kernel module: code to load the module
1988 ***************************************************************/
1989
1990 /*
1991 * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1992 * of the error handling.
1993 *
1994 * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1995 * as seed source of get_random_bytes does not fail.
1996 *
1997 * Note 2: There is no sensible way of testing the reseed counter
1998 * enforcement, so skip it.
1999 */
drbg_healthcheck_sanity(void)2000 static inline int __init drbg_healthcheck_sanity(void)
2001 {
2002 int len = 0;
2003 #define OUTBUFLEN 16
2004 unsigned char buf[OUTBUFLEN];
2005 struct drbg_state *drbg = NULL;
2006 int ret = -EFAULT;
2007 int rc = -EFAULT;
2008 bool pr = false;
2009 int coreref = 0;
2010 struct drbg_string addtl;
2011 size_t max_addtllen, max_request_bytes;
2012
2013 /* only perform test in FIPS mode */
2014 if (!fips_enabled)
2015 return 0;
2016
2017 #ifdef CONFIG_CRYPTO_DRBG_CTR
2018 drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
2019 #elif defined CONFIG_CRYPTO_DRBG_HASH
2020 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
2021 #else
2022 drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
2023 #endif
2024
2025 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
2026 if (!drbg)
2027 return -ENOMEM;
2028
2029 mutex_init(&drbg->drbg_mutex);
2030 drbg->core = &drbg_cores[coreref];
2031 drbg->reseed_threshold = drbg_max_requests(drbg);
2032
2033 /*
2034 * if the following tests fail, it is likely that there is a buffer
2035 * overflow as buf is much smaller than the requested or provided
2036 * string lengths -- in case the error handling does not succeed
2037 * we may get an OOPS. And we want to get an OOPS as this is a
2038 * grave bug.
2039 */
2040
2041 max_addtllen = drbg_max_addtl(drbg);
2042 max_request_bytes = drbg_max_request_bytes(drbg);
2043 drbg_string_fill(&addtl, buf, max_addtllen + 1);
2044 /* overflow addtllen with additonal info string */
2045 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
2046 BUG_ON(0 < len);
2047 /* overflow max_bits */
2048 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
2049 BUG_ON(0 < len);
2050
2051 /* overflow max addtllen with personalization string */
2052 ret = drbg_seed(drbg, &addtl, false);
2053 BUG_ON(0 == ret);
2054 /* all tests passed */
2055 rc = 0;
2056
2057 pr_devel("DRBG: Sanity tests for failure code paths successfully "
2058 "completed\n");
2059
2060 kfree(drbg);
2061 return rc;
2062 }
2063
2064 static struct rng_alg drbg_algs[22];
2065
2066 /*
2067 * Fill the array drbg_algs used to register the different DRBGs
2068 * with the kernel crypto API. To fill the array, the information
2069 * from drbg_cores[] is used.
2070 */
drbg_fill_array(struct rng_alg * alg,const struct drbg_core * core,int pr)2071 static inline void __init drbg_fill_array(struct rng_alg *alg,
2072 const struct drbg_core *core, int pr)
2073 {
2074 int pos = 0;
2075 static int priority = 200;
2076
2077 memcpy(alg->base.cra_name, "stdrng", 6);
2078 if (pr) {
2079 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
2080 pos = 8;
2081 } else {
2082 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
2083 pos = 10;
2084 }
2085 memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2086 strlen(core->cra_name));
2087
2088 alg->base.cra_priority = priority;
2089 priority++;
2090 /*
2091 * If FIPS mode enabled, the selected DRBG shall have the
2092 * highest cra_priority over other stdrng instances to ensure
2093 * it is selected.
2094 */
2095 if (fips_enabled)
2096 alg->base.cra_priority += 200;
2097
2098 alg->base.cra_ctxsize = sizeof(struct drbg_state);
2099 alg->base.cra_module = THIS_MODULE;
2100 alg->base.cra_init = drbg_kcapi_init;
2101 alg->base.cra_exit = drbg_kcapi_cleanup;
2102 alg->generate = drbg_kcapi_random;
2103 alg->seed = drbg_kcapi_seed;
2104 alg->set_ent = drbg_kcapi_set_entropy;
2105 alg->seedsize = 0;
2106 }
2107
drbg_init(void)2108 static int __init drbg_init(void)
2109 {
2110 unsigned int i = 0; /* pointer to drbg_algs */
2111 unsigned int j = 0; /* pointer to drbg_cores */
2112 int ret;
2113
2114 ret = drbg_healthcheck_sanity();
2115 if (ret)
2116 return ret;
2117
2118 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2119 pr_info("DRBG: Cannot register all DRBG types"
2120 "(slots needed: %zu, slots available: %zu)\n",
2121 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2122 return -EFAULT;
2123 }
2124
2125 /*
2126 * each DRBG definition can be used with PR and without PR, thus
2127 * we instantiate each DRBG in drbg_cores[] twice.
2128 *
2129 * As the order of placing them into the drbg_algs array matters
2130 * (the later DRBGs receive a higher cra_priority) we register the
2131 * prediction resistance DRBGs first as the should not be too
2132 * interesting.
2133 */
2134 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2135 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2136 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2137 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2138 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2139 }
2140
drbg_exit(void)2141 static void __exit drbg_exit(void)
2142 {
2143 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2144 }
2145
2146 subsys_initcall(drbg_init);
2147 module_exit(drbg_exit);
2148 #ifndef CRYPTO_DRBG_HASH_STRING
2149 #define CRYPTO_DRBG_HASH_STRING ""
2150 #endif
2151 #ifndef CRYPTO_DRBG_HMAC_STRING
2152 #define CRYPTO_DRBG_HMAC_STRING ""
2153 #endif
2154 #ifndef CRYPTO_DRBG_CTR_STRING
2155 #define CRYPTO_DRBG_CTR_STRING ""
2156 #endif
2157 MODULE_LICENSE("GPL");
2158 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2159 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2160 "using following cores: "
2161 CRYPTO_DRBG_HASH_STRING
2162 CRYPTO_DRBG_HMAC_STRING
2163 CRYPTO_DRBG_CTR_STRING);
2164 MODULE_ALIAS_CRYPTO("stdrng");
2165 MODULE_IMPORT_NS(CRYPTO_INTERNAL);
2166
