ansi_cprng.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * PRNG: Pseudo Random Number Generator
  4. * Based on NIST Recommended PRNG From ANSI X9.31 Appendix A.2.4 using
  5. * AES 128 cipher
  6. *
  7. * (C) Neil Horman <nhorman@tuxdriver.com>
  8. */
  9. #include <crypto/internal/cipher.h>
  10. #include <crypto/internal/rng.h>
  11. #include <linux/err.h>
  12. #include <linux/init.h>
  13. #include <linux/module.h>
  14. #include <linux/moduleparam.h>
  15. #include <linux/string.h>
  16. #define DEFAULT_PRNG_KEY "0123456789abcdef"
  17. #define DEFAULT_PRNG_KSZ 16
  18. #define DEFAULT_BLK_SZ 16
  19. #define DEFAULT_V_SEED "zaybxcwdveuftgsh"
  20. /*
  21. * Flags for the prng_context flags field
  22. */
  23. #define PRNG_FIXED_SIZE 0x1
  24. #define PRNG_NEED_RESET 0x2
  25. /*
  26. * Note: DT is our counter value
  27. * I is our intermediate value
  28. * V is our seed vector
  29. * See http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext.pdf
  30. * for implementation details
  31. */
  32. struct prng_context {
  33. spinlock_t prng_lock;
  34. unsigned char rand_data[DEFAULT_BLK_SZ];
  35. unsigned char last_rand_data[DEFAULT_BLK_SZ];
  36. unsigned char DT[DEFAULT_BLK_SZ];
  37. unsigned char I[DEFAULT_BLK_SZ];
  38. unsigned char V[DEFAULT_BLK_SZ];
  39. u32 rand_data_valid;
  40. struct crypto_cipher *tfm;
  41. u32 flags;
  42. };
  43. static int dbg;
  44. static void hexdump(char *note, unsigned char *buf, unsigned int len)
  45. {
  46. if (dbg) {
  47. printk(KERN_CRIT "%s", note);
  48. print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
  49. 16, 1,
  50. buf, len, false);
  51. }
  52. }
  53. #define dbgprint(format, args...) do {\
  54. if (dbg)\
  55. printk(format, ##args);\
  56. } while (0)
  57. static void xor_vectors(unsigned char *in1, unsigned char *in2,
  58. unsigned char *out, unsigned int size)
  59. {
  60. int i;
  61. for (i = 0; i < size; i++)
  62. out[i] = in1[i] ^ in2[i];
  63. }
  64. /*
  65. * Returns DEFAULT_BLK_SZ bytes of random data per call
  66. * returns 0 if generation succeeded, <0 if something went wrong
  67. */
  68. static int _get_more_prng_bytes(struct prng_context *ctx, int cont_test)
  69. {
  70. int i;
  71. unsigned char tmp[DEFAULT_BLK_SZ];
  72. unsigned char *output = NULL;
  73. dbgprint(KERN_CRIT "Calling _get_more_prng_bytes for context %p\n",
  74. ctx);
  75. hexdump("Input DT: ", ctx->DT, DEFAULT_BLK_SZ);
  76. hexdump("Input I: ", ctx->I, DEFAULT_BLK_SZ);
  77. hexdump("Input V: ", ctx->V, DEFAULT_BLK_SZ);
  78. /*
  79. * This algorithm is a 3 stage state machine
  80. */
  81. for (i = 0; i < 3; i++) {
  82. switch (i) {
  83. case 0:
  84. /*
  85. * Start by encrypting the counter value
  86. * This gives us an intermediate value I
  87. */
  88. memcpy(tmp, ctx->DT, DEFAULT_BLK_SZ);
  89. output = ctx->I;
  90. hexdump("tmp stage 0: ", tmp, DEFAULT_BLK_SZ);
  91. break;
  92. case 1:
  93. /*
  94. * Next xor I with our secret vector V
  95. * encrypt that result to obtain our
  96. * pseudo random data which we output
  97. */
  98. xor_vectors(ctx->I, ctx->V, tmp, DEFAULT_BLK_SZ);
  99. hexdump("tmp stage 1: ", tmp, DEFAULT_BLK_SZ);
  100. output = ctx->rand_data;
  101. break;
  102. case 2:
  103. /*
  104. * First check that we didn't produce the same
  105. * random data that we did last time around through this
  106. */
  107. if (!memcmp(ctx->rand_data, ctx->last_rand_data,
  108. DEFAULT_BLK_SZ)) {
  109. if (cont_test) {
  110. panic("cprng %p Failed repetition check!\n",
  111. ctx);
  112. }
  113. printk(KERN_ERR
  114. "ctx %p Failed repetition check!\n",
  115. ctx);
  116. ctx->flags |= PRNG_NEED_RESET;
  117. return -EINVAL;
  118. }
  119. memcpy(ctx->last_rand_data, ctx->rand_data,
  120. DEFAULT_BLK_SZ);
  121. /*
  122. * Lastly xor the random data with I
  123. * and encrypt that to obtain a new secret vector V
  124. */
  125. xor_vectors(ctx->rand_data, ctx->I, tmp,
  126. DEFAULT_BLK_SZ);
  127. output = ctx->V;
  128. hexdump("tmp stage 2: ", tmp, DEFAULT_BLK_SZ);
  129. break;
  130. }
  131. /* do the encryption */
  132. crypto_cipher_encrypt_one(ctx->tfm, output, tmp);
  133. }
  134. /*
  135. * Now update our DT value
  136. */
  137. for (i = DEFAULT_BLK_SZ - 1; i >= 0; i--) {
  138. ctx->DT[i] += 1;
  139. if (ctx->DT[i] != 0)
  140. break;
  141. }
  142. dbgprint("Returning new block for context %p\n", ctx);
  143. ctx->rand_data_valid = 0;
  144. hexdump("Output DT: ", ctx->DT, DEFAULT_BLK_SZ);
  145. hexdump("Output I: ", ctx->I, DEFAULT_BLK_SZ);
  146. hexdump("Output V: ", ctx->V, DEFAULT_BLK_SZ);
  147. hexdump("New Random Data: ", ctx->rand_data, DEFAULT_BLK_SZ);
  148. return 0;
  149. }
  150. /* Our exported functions */
  151. static int get_prng_bytes(char *buf, size_t nbytes, struct prng_context *ctx,
  152. int do_cont_test)
  153. {
  154. unsigned char *ptr = buf;
  155. unsigned int byte_count = (unsigned int)nbytes;
  156. int err;
  157. spin_lock_bh(&ctx->prng_lock);
  158. err = -EINVAL;
  159. if (ctx->flags & PRNG_NEED_RESET)
  160. goto done;
  161. /*
  162. * If the FIXED_SIZE flag is on, only return whole blocks of
  163. * pseudo random data
  164. */
  165. err = -EINVAL;
  166. if (ctx->flags & PRNG_FIXED_SIZE) {
  167. if (nbytes < DEFAULT_BLK_SZ)
  168. goto done;
  169. byte_count = DEFAULT_BLK_SZ;
  170. }
  171. /*
  172. * Return 0 in case of success as mandated by the kernel
  173. * crypto API interface definition.
  174. */
  175. err = 0;
  176. dbgprint(KERN_CRIT "getting %d random bytes for context %p\n",
  177. byte_count, ctx);
  178. remainder:
  179. if (ctx->rand_data_valid == DEFAULT_BLK_SZ) {
  180. if (_get_more_prng_bytes(ctx, do_cont_test) < 0) {
  181. memset(buf, 0, nbytes);
  182. err = -EINVAL;
  183. goto done;
  184. }
  185. }
  186. /*
  187. * Copy any data less than an entire block
  188. */
  189. if (byte_count < DEFAULT_BLK_SZ) {
  190. empty_rbuf:
  191. while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
  192. *ptr = ctx->rand_data[ctx->rand_data_valid];
  193. ptr++;
  194. byte_count--;
  195. ctx->rand_data_valid++;
  196. if (byte_count == 0)
  197. goto done;
  198. }
  199. }
  200. /*
  201. * Now copy whole blocks
  202. */
  203. for (; byte_count >= DEFAULT_BLK_SZ; byte_count -= DEFAULT_BLK_SZ) {
  204. if (ctx->rand_data_valid == DEFAULT_BLK_SZ) {
  205. if (_get_more_prng_bytes(ctx, do_cont_test) < 0) {
  206. memset(buf, 0, nbytes);
  207. err = -EINVAL;
  208. goto done;
  209. }
  210. }
  211. if (ctx->rand_data_valid > 0)
  212. goto empty_rbuf;
  213. memcpy(ptr, ctx->rand_data, DEFAULT_BLK_SZ);
  214. ctx->rand_data_valid += DEFAULT_BLK_SZ;
  215. ptr += DEFAULT_BLK_SZ;
  216. }
  217. /*
  218. * Now go back and get any remaining partial block
  219. */
  220. if (byte_count)
  221. goto remainder;
  222. done:
  223. spin_unlock_bh(&ctx->prng_lock);
  224. dbgprint(KERN_CRIT "returning %d from get_prng_bytes in context %p\n",
  225. err, ctx);
  226. return err;
  227. }
  228. static void free_prng_context(struct prng_context *ctx)
  229. {
  230. crypto_free_cipher(ctx->tfm);
  231. }
  232. static int reset_prng_context(struct prng_context *ctx,
  233. const unsigned char *key, size_t klen,
  234. const unsigned char *V, const unsigned char *DT)
  235. {
  236. int ret;
  237. const unsigned char *prng_key;
  238. spin_lock_bh(&ctx->prng_lock);
  239. ctx->flags |= PRNG_NEED_RESET;
  240. prng_key = (key != NULL) ? key : (unsigned char *)DEFAULT_PRNG_KEY;
  241. if (!key)
  242. klen = DEFAULT_PRNG_KSZ;
  243. if (V)
  244. memcpy(ctx->V, V, DEFAULT_BLK_SZ);
  245. else
  246. memcpy(ctx->V, DEFAULT_V_SEED, DEFAULT_BLK_SZ);
  247. if (DT)
  248. memcpy(ctx->DT, DT, DEFAULT_BLK_SZ);
  249. else
  250. memset(ctx->DT, 0, DEFAULT_BLK_SZ);
  251. memset(ctx->rand_data, 0, DEFAULT_BLK_SZ);
  252. memset(ctx->last_rand_data, 0, DEFAULT_BLK_SZ);
  253. ctx->rand_data_valid = DEFAULT_BLK_SZ;
  254. ret = crypto_cipher_setkey(ctx->tfm, prng_key, klen);
  255. if (ret) {
  256. dbgprint(KERN_CRIT "PRNG: setkey() failed flags=%x\n",
  257. crypto_cipher_get_flags(ctx->tfm));
  258. goto out;
  259. }
  260. ret = 0;
  261. ctx->flags &= ~PRNG_NEED_RESET;
  262. out:
  263. spin_unlock_bh(&ctx->prng_lock);
  264. return ret;
  265. }
  266. static int cprng_init(struct crypto_tfm *tfm)
  267. {
  268. struct prng_context *ctx = crypto_tfm_ctx(tfm);
  269. spin_lock_init(&ctx->prng_lock);
  270. ctx->tfm = crypto_alloc_cipher("aes", 0, 0);
  271. if (IS_ERR(ctx->tfm)) {
  272. dbgprint(KERN_CRIT "Failed to alloc tfm for context %p\n",
  273. ctx);
  274. return PTR_ERR(ctx->tfm);
  275. }
  276. if (reset_prng_context(ctx, NULL, DEFAULT_PRNG_KSZ, NULL, NULL) < 0)
  277. return -EINVAL;
  278. /*
  279. * after allocation, we should always force the user to reset
  280. * so they don't inadvertently use the insecure default values
  281. * without specifying them intentially
  282. */
  283. ctx->flags |= PRNG_NEED_RESET;
  284. return 0;
  285. }
  286. static void cprng_exit(struct crypto_tfm *tfm)
  287. {
  288. free_prng_context(crypto_tfm_ctx(tfm));
  289. }
  290. static int cprng_get_random(struct crypto_rng *tfm,
  291. const u8 *src, unsigned int slen,
  292. u8 *rdata, unsigned int dlen)
  293. {
  294. struct prng_context *prng = crypto_rng_ctx(tfm);
  295. return get_prng_bytes(rdata, dlen, prng, 0);
  296. }
  297. /*
  298. * This is the cprng_registered reset method the seed value is
  299. * interpreted as the tuple { V KEY DT}
  300. * V and KEY are required during reset, and DT is optional, detected
  301. * as being present by testing the length of the seed
  302. */
  303. static int cprng_reset(struct crypto_rng *tfm,
  304. const u8 *seed, unsigned int slen)
  305. {
  306. struct prng_context *prng = crypto_rng_ctx(tfm);
  307. const u8 *key = seed + DEFAULT_BLK_SZ;
  308. const u8 *dt = NULL;
  309. if (slen < DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ)
  310. return -EINVAL;
  311. if (slen >= (2 * DEFAULT_BLK_SZ + DEFAULT_PRNG_KSZ))
  312. dt = key + DEFAULT_PRNG_KSZ;
  313. reset_prng_context(prng, key, DEFAULT_PRNG_KSZ, seed, dt);
  314. if (prng->flags & PRNG_NEED_RESET)
  315. return -EINVAL;
  316. return 0;
  317. }
  318. #ifdef CONFIG_CRYPTO_FIPS
  319. static int fips_cprng_get_random(struct crypto_rng *tfm,
  320. const u8 *src, unsigned int slen,
  321. u8 *rdata, unsigned int dlen)
  322. {
  323. struct prng_context *prng = crypto_rng_ctx(tfm);
  324. return get_prng_bytes(rdata, dlen, prng, 1);
  325. }
  326. static int fips_cprng_reset(struct crypto_rng *tfm,
  327. const u8 *seed, unsigned int slen)
  328. {
  329. u8 rdata[DEFAULT_BLK_SZ];
  330. const u8 *key = seed + DEFAULT_BLK_SZ;
  331. int rc;
  332. struct prng_context *prng = crypto_rng_ctx(tfm);
  333. if (slen < DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ)
  334. return -EINVAL;
  335. /* fips strictly requires seed != key */
  336. if (!memcmp(seed, key, DEFAULT_PRNG_KSZ))
  337. return -EINVAL;
  338. rc = cprng_reset(tfm, seed, slen);
  339. if (!rc)
  340. goto out;
  341. /* this primes our continuity test */
  342. rc = get_prng_bytes(rdata, DEFAULT_BLK_SZ, prng, 0);
  343. prng->rand_data_valid = DEFAULT_BLK_SZ;
  344. out:
  345. return rc;
  346. }
  347. #endif
  348. static struct rng_alg rng_algs[] = { {
  349. .generate = cprng_get_random,
  350. .seed = cprng_reset,
  351. .seedsize = DEFAULT_PRNG_KSZ + 2 * DEFAULT_BLK_SZ,
  352. .base = {
  353. .cra_name = "stdrng",
  354. .cra_driver_name = "ansi_cprng",
  355. .cra_priority = 100,
  356. .cra_ctxsize = sizeof(struct prng_context),
  357. .cra_module = THIS_MODULE,
  358. .cra_init = cprng_init,
  359. .cra_exit = cprng_exit,
  360. }
  361. #ifdef CONFIG_CRYPTO_FIPS
  362. }, {
  363. .generate = fips_cprng_get_random,
  364. .seed = fips_cprng_reset,
  365. .seedsize = DEFAULT_PRNG_KSZ + 2 * DEFAULT_BLK_SZ,
  366. .base = {
  367. .cra_name = "fips(ansi_cprng)",
  368. .cra_driver_name = "fips_ansi_cprng",
  369. .cra_priority = 300,
  370. .cra_ctxsize = sizeof(struct prng_context),
  371. .cra_module = THIS_MODULE,
  372. .cra_init = cprng_init,
  373. .cra_exit = cprng_exit,
  374. }
  375. #endif
  376. } };
  377. /* Module initalization */
  378. static int __init prng_mod_init(void)
  379. {
  380. return crypto_register_rngs(rng_algs, ARRAY_SIZE(rng_algs));
  381. }
  382. static void __exit prng_mod_fini(void)
  383. {
  384. crypto_unregister_rngs(rng_algs, ARRAY_SIZE(rng_algs));
  385. }
  386. MODULE_LICENSE("GPL");
  387. MODULE_DESCRIPTION("Software Pseudo Random Number Generator");
  388. MODULE_AUTHOR("Neil Horman <nhorman@tuxdriver.com>");
  389. module_param(dbg, int, 0);
  390. MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");
  391. subsys_initcall(prng_mod_init);
  392. module_exit(prng_mod_fini);
  393. MODULE_ALIAS_CRYPTO("stdrng");
  394. MODULE_ALIAS_CRYPTO("ansi_cprng");
  395. MODULE_IMPORT_NS(CRYPTO_INTERNAL);