drbg.c 60 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165
  1. /*
  2. * DRBG: Deterministic Random Bits Generator
  3. * Based on NIST Recommended DRBG from NIST SP800-90A with the following
  4. * properties:
  5. * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
  6. * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
  7. * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
  8. * * with and without prediction resistance
  9. *
  10. * Copyright Stephan Mueller <smueller@chronox.de>, 2014
  11. *
  12. * Redistribution and use in source and binary forms, with or without
  13. * modification, are permitted provided that the following conditions
  14. * are met:
  15. * 1. Redistributions of source code must retain the above copyright
  16. * notice, and the entire permission notice in its entirety,
  17. * including the disclaimer of warranties.
  18. * 2. Redistributions in binary form must reproduce the above copyright
  19. * notice, this list of conditions and the following disclaimer in the
  20. * documentation and/or other materials provided with the distribution.
  21. * 3. The name of the author may not be used to endorse or promote
  22. * products derived from this software without specific prior
  23. * written permission.
  24. *
  25. * ALTERNATIVELY, this product may be distributed under the terms of
  26. * the GNU General Public License, in which case the provisions of the GPL are
  27. * required INSTEAD OF the above restrictions. (This clause is
  28. * necessary due to a potential bad interaction between the GPL and
  29. * the restrictions contained in a BSD-style copyright.)
  30. *
  31. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32. * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34. * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
  35. * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37. * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38. * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41. * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42. * DAMAGE.
  43. *
  44. * DRBG Usage
  45. * ==========
  46. * The SP 800-90A DRBG allows the user to specify a personalization string
  47. * for initialization as well as an additional information string for each
  48. * random number request. The following code fragments show how a caller
  49. * uses the kernel crypto API to use the full functionality of the DRBG.
  50. *
  51. * Usage without any additional data
  52. * ---------------------------------
  53. * struct crypto_rng *drng;
  54. * int err;
  55. * char data[DATALEN];
  56. *
  57. * drng = crypto_alloc_rng(drng_name, 0, 0);
  58. * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59. * crypto_free_rng(drng);
  60. *
  61. *
  62. * Usage with personalization string during initialization
  63. * -------------------------------------------------------
  64. * struct crypto_rng *drng;
  65. * int err;
  66. * char data[DATALEN];
  67. * struct drbg_string pers;
  68. * char personalization[11] = "some-string";
  69. *
  70. * drbg_string_fill(&pers, personalization, strlen(personalization));
  71. * drng = crypto_alloc_rng(drng_name, 0, 0);
  72. * // The reset completely re-initializes the DRBG with the provided
  73. * // personalization string
  74. * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75. * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76. * crypto_free_rng(drng);
  77. *
  78. *
  79. * Usage with additional information string during random number request
  80. * ---------------------------------------------------------------------
  81. * struct crypto_rng *drng;
  82. * int err;
  83. * char data[DATALEN];
  84. * char addtl_string[11] = "some-string";
  85. * string drbg_string addtl;
  86. *
  87. * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88. * drng = crypto_alloc_rng(drng_name, 0, 0);
  89. * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90. * // the same error codes.
  91. * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92. * crypto_free_rng(drng);
  93. *
  94. *
  95. * Usage with personalization and additional information strings
  96. * -------------------------------------------------------------
  97. * Just mix both scenarios above.
  98. */
  99. #include <crypto/drbg.h>
  100. #include <crypto/internal/cipher.h>
  101. #include <linux/kernel.h>
  102. /***************************************************************
  103. * Backend cipher definitions available to DRBG
  104. ***************************************************************/
  105. /*
  106. * The order of the DRBG definitions here matter: every DRBG is registered
  107. * as stdrng. Each DRBG receives an increasing cra_priority values the later
  108. * they are defined in this array (see drbg_fill_array).
  109. *
  110. * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
  111. * the SHA256 / AES 256 over other ciphers. Thus, the favored
  112. * DRBGs are the latest entries in this array.
  113. */
  114. static const struct drbg_core drbg_cores[] = {
  115. #ifdef CONFIG_CRYPTO_DRBG_CTR
  116. {
  117. .flags = DRBG_CTR | DRBG_STRENGTH128,
  118. .statelen = 32, /* 256 bits as defined in 10.2.1 */
  119. .blocklen_bytes = 16,
  120. .cra_name = "ctr_aes128",
  121. .backend_cra_name = "aes",
  122. }, {
  123. .flags = DRBG_CTR | DRBG_STRENGTH192,
  124. .statelen = 40, /* 320 bits as defined in 10.2.1 */
  125. .blocklen_bytes = 16,
  126. .cra_name = "ctr_aes192",
  127. .backend_cra_name = "aes",
  128. }, {
  129. .flags = DRBG_CTR | DRBG_STRENGTH256,
  130. .statelen = 48, /* 384 bits as defined in 10.2.1 */
  131. .blocklen_bytes = 16,
  132. .cra_name = "ctr_aes256",
  133. .backend_cra_name = "aes",
  134. },
  135. #endif /* CONFIG_CRYPTO_DRBG_CTR */
  136. #ifdef CONFIG_CRYPTO_DRBG_HASH
  137. {
  138. .flags = DRBG_HASH | DRBG_STRENGTH128,
  139. .statelen = 55, /* 440 bits */
  140. .blocklen_bytes = 20,
  141. .cra_name = "sha1",
  142. .backend_cra_name = "sha1",
  143. }, {
  144. .flags = DRBG_HASH | DRBG_STRENGTH256,
  145. .statelen = 111, /* 888 bits */
  146. .blocklen_bytes = 48,
  147. .cra_name = "sha384",
  148. .backend_cra_name = "sha384",
  149. }, {
  150. .flags = DRBG_HASH | DRBG_STRENGTH256,
  151. .statelen = 111, /* 888 bits */
  152. .blocklen_bytes = 64,
  153. .cra_name = "sha512",
  154. .backend_cra_name = "sha512",
  155. }, {
  156. .flags = DRBG_HASH | DRBG_STRENGTH256,
  157. .statelen = 55, /* 440 bits */
  158. .blocklen_bytes = 32,
  159. .cra_name = "sha256",
  160. .backend_cra_name = "sha256",
  161. },
  162. #endif /* CONFIG_CRYPTO_DRBG_HASH */
  163. #ifdef CONFIG_CRYPTO_DRBG_HMAC
  164. {
  165. .flags = DRBG_HMAC | DRBG_STRENGTH128,
  166. .statelen = 20, /* block length of cipher */
  167. .blocklen_bytes = 20,
  168. .cra_name = "hmac_sha1",
  169. .backend_cra_name = "hmac(sha1)",
  170. }, {
  171. .flags = DRBG_HMAC | DRBG_STRENGTH256,
  172. .statelen = 48, /* block length of cipher */
  173. .blocklen_bytes = 48,
  174. .cra_name = "hmac_sha384",
  175. .backend_cra_name = "hmac(sha384)",
  176. }, {
  177. .flags = DRBG_HMAC | DRBG_STRENGTH256,
  178. .statelen = 64, /* block length of cipher */
  179. .blocklen_bytes = 64,
  180. .cra_name = "hmac_sha512",
  181. .backend_cra_name = "hmac(sha512)",
  182. }, {
  183. .flags = DRBG_HMAC | DRBG_STRENGTH256,
  184. .statelen = 32, /* block length of cipher */
  185. .blocklen_bytes = 32,
  186. .cra_name = "hmac_sha256",
  187. .backend_cra_name = "hmac(sha256)",
  188. },
  189. #endif /* CONFIG_CRYPTO_DRBG_HMAC */
  190. };
  191. static int drbg_uninstantiate(struct drbg_state *drbg);
  192. /******************************************************************
  193. * Generic helper functions
  194. ******************************************************************/
  195. /*
  196. * Return strength of DRBG according to SP800-90A section 8.4
  197. *
  198. * @flags DRBG flags reference
  199. *
  200. * Return: normalized strength in *bytes* value or 32 as default
  201. * to counter programming errors
  202. */
  203. static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
  204. {
  205. switch (flags & DRBG_STRENGTH_MASK) {
  206. case DRBG_STRENGTH128:
  207. return 16;
  208. case DRBG_STRENGTH192:
  209. return 24;
  210. case DRBG_STRENGTH256:
  211. return 32;
  212. default:
  213. return 32;
  214. }
  215. }
  216. /*
  217. * FIPS 140-2 continuous self test for the noise source
  218. * The test is performed on the noise source input data. Thus, the function
  219. * implicitly knows the size of the buffer to be equal to the security
  220. * strength.
  221. *
  222. * Note, this function disregards the nonce trailing the entropy data during
  223. * initial seeding.
  224. *
  225. * drbg->drbg_mutex must have been taken.
  226. *
  227. * @drbg DRBG handle
  228. * @entropy buffer of seed data to be checked
  229. *
  230. * return:
  231. * 0 on success
  232. * -EAGAIN on when the CTRNG is not yet primed
  233. * < 0 on error
  234. */
  235. static int drbg_fips_continuous_test(struct drbg_state *drbg,
  236. const unsigned char *entropy)
  237. {
  238. unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
  239. int ret = 0;
  240. if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
  241. return 0;
  242. /* skip test if we test the overall system */
  243. if (list_empty(&drbg->test_data.list))
  244. return 0;
  245. /* only perform test in FIPS mode */
  246. if (!fips_enabled)
  247. return 0;
  248. if (!drbg->fips_primed) {
  249. /* Priming of FIPS test */
  250. memcpy(drbg->prev, entropy, entropylen);
  251. drbg->fips_primed = true;
  252. /* priming: another round is needed */
  253. return -EAGAIN;
  254. }
  255. ret = memcmp(drbg->prev, entropy, entropylen);
  256. if (!ret)
  257. panic("DRBG continuous self test failed\n");
  258. memcpy(drbg->prev, entropy, entropylen);
  259. /* the test shall pass when the two values are not equal */
  260. return 0;
  261. }
  262. /*
  263. * Convert an integer into a byte representation of this integer.
  264. * The byte representation is big-endian
  265. *
  266. * @val value to be converted
  267. * @buf buffer holding the converted integer -- caller must ensure that
  268. * buffer size is at least 32 bit
  269. */
  270. #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
  271. static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
  272. {
  273. struct s {
  274. __be32 conv;
  275. };
  276. struct s *conversion = (struct s *) buf;
  277. conversion->conv = cpu_to_be32(val);
  278. }
  279. #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
  280. /******************************************************************
  281. * CTR DRBG callback functions
  282. ******************************************************************/
  283. #ifdef CONFIG_CRYPTO_DRBG_CTR
  284. #define CRYPTO_DRBG_CTR_STRING "CTR "
  285. MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
  286. MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
  287. MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
  288. MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
  289. MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
  290. MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
  291. static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
  292. const unsigned char *key);
  293. static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
  294. const struct drbg_string *in);
  295. static int drbg_init_sym_kernel(struct drbg_state *drbg);
  296. static int drbg_fini_sym_kernel(struct drbg_state *drbg);
  297. static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
  298. u8 *inbuf, u32 inbuflen,
  299. u8 *outbuf, u32 outlen);
  300. #define DRBG_OUTSCRATCHLEN 256
  301. /* BCC function for CTR DRBG as defined in 10.4.3 */
  302. static int drbg_ctr_bcc(struct drbg_state *drbg,
  303. unsigned char *out, const unsigned char *key,
  304. struct list_head *in)
  305. {
  306. int ret = 0;
  307. struct drbg_string *curr = NULL;
  308. struct drbg_string data;
  309. short cnt = 0;
  310. drbg_string_fill(&data, out, drbg_blocklen(drbg));
  311. /* 10.4.3 step 2 / 4 */
  312. drbg_kcapi_symsetkey(drbg, key);
  313. list_for_each_entry(curr, in, list) {
  314. const unsigned char *pos = curr->buf;
  315. size_t len = curr->len;
  316. /* 10.4.3 step 4.1 */
  317. while (len) {
  318. /* 10.4.3 step 4.2 */
  319. if (drbg_blocklen(drbg) == cnt) {
  320. cnt = 0;
  321. ret = drbg_kcapi_sym(drbg, out, &data);
  322. if (ret)
  323. return ret;
  324. }
  325. out[cnt] ^= *pos;
  326. pos++;
  327. cnt++;
  328. len--;
  329. }
  330. }
  331. /* 10.4.3 step 4.2 for last block */
  332. if (cnt)
  333. ret = drbg_kcapi_sym(drbg, out, &data);
  334. return ret;
  335. }
  336. /*
  337. * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
  338. * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
  339. * the scratchpad is used as follows:
  340. * drbg_ctr_update:
  341. * temp
  342. * start: drbg->scratchpad
  343. * length: drbg_statelen(drbg) + drbg_blocklen(drbg)
  344. * note: the cipher writing into this variable works
  345. * blocklen-wise. Now, when the statelen is not a multiple
  346. * of blocklen, the generateion loop below "spills over"
  347. * by at most blocklen. Thus, we need to give sufficient
  348. * memory.
  349. * df_data
  350. * start: drbg->scratchpad +
  351. * drbg_statelen(drbg) + drbg_blocklen(drbg)
  352. * length: drbg_statelen(drbg)
  353. *
  354. * drbg_ctr_df:
  355. * pad
  356. * start: df_data + drbg_statelen(drbg)
  357. * length: drbg_blocklen(drbg)
  358. * iv
  359. * start: pad + drbg_blocklen(drbg)
  360. * length: drbg_blocklen(drbg)
  361. * temp
  362. * start: iv + drbg_blocklen(drbg)
  363. * length: drbg_satelen(drbg) + drbg_blocklen(drbg)
  364. * note: temp is the buffer that the BCC function operates
  365. * on. BCC operates blockwise. drbg_statelen(drbg)
  366. * is sufficient when the DRBG state length is a multiple
  367. * of the block size. For AES192 (and maybe other ciphers)
  368. * this is not correct and the length for temp is
  369. * insufficient (yes, that also means for such ciphers,
  370. * the final output of all BCC rounds are truncated).
  371. * Therefore, add drbg_blocklen(drbg) to cover all
  372. * possibilities.
  373. */
  374. /* Derivation Function for CTR DRBG as defined in 10.4.2 */
  375. static int drbg_ctr_df(struct drbg_state *drbg,
  376. unsigned char *df_data, size_t bytes_to_return,
  377. struct list_head *seedlist)
  378. {
  379. int ret = -EFAULT;
  380. unsigned char L_N[8];
  381. /* S3 is input */
  382. struct drbg_string S1, S2, S4, cipherin;
  383. LIST_HEAD(bcc_list);
  384. unsigned char *pad = df_data + drbg_statelen(drbg);
  385. unsigned char *iv = pad + drbg_blocklen(drbg);
  386. unsigned char *temp = iv + drbg_blocklen(drbg);
  387. size_t padlen = 0;
  388. unsigned int templen = 0;
  389. /* 10.4.2 step 7 */
  390. unsigned int i = 0;
  391. /* 10.4.2 step 8 */
  392. const unsigned char *K = (unsigned char *)
  393. "\x00\x01\x02\x03\x04\x05\x06\x07"
  394. "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
  395. "\x10\x11\x12\x13\x14\x15\x16\x17"
  396. "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
  397. unsigned char *X;
  398. size_t generated_len = 0;
  399. size_t inputlen = 0;
  400. struct drbg_string *seed = NULL;
  401. memset(pad, 0, drbg_blocklen(drbg));
  402. memset(iv, 0, drbg_blocklen(drbg));
  403. /* 10.4.2 step 1 is implicit as we work byte-wise */
  404. /* 10.4.2 step 2 */
  405. if ((512/8) < bytes_to_return)
  406. return -EINVAL;
  407. /* 10.4.2 step 2 -- calculate the entire length of all input data */
  408. list_for_each_entry(seed, seedlist, list)
  409. inputlen += seed->len;
  410. drbg_cpu_to_be32(inputlen, &L_N[0]);
  411. /* 10.4.2 step 3 */
  412. drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
  413. /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
  414. padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
  415. /* wrap the padlen appropriately */
  416. if (padlen)
  417. padlen = drbg_blocklen(drbg) - padlen;
  418. /*
  419. * pad / padlen contains the 0x80 byte and the following zero bytes.
  420. * As the calculated padlen value only covers the number of zero
  421. * bytes, this value has to be incremented by one for the 0x80 byte.
  422. */
  423. padlen++;
  424. pad[0] = 0x80;
  425. /* 10.4.2 step 4 -- first fill the linked list and then order it */
  426. drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
  427. list_add_tail(&S1.list, &bcc_list);
  428. drbg_string_fill(&S2, L_N, sizeof(L_N));
  429. list_add_tail(&S2.list, &bcc_list);
  430. list_splice_tail(seedlist, &bcc_list);
  431. drbg_string_fill(&S4, pad, padlen);
  432. list_add_tail(&S4.list, &bcc_list);
  433. /* 10.4.2 step 9 */
  434. while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
  435. /*
  436. * 10.4.2 step 9.1 - the padding is implicit as the buffer
  437. * holds zeros after allocation -- even the increment of i
  438. * is irrelevant as the increment remains within length of i
  439. */
  440. drbg_cpu_to_be32(i, iv);
  441. /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
  442. ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
  443. if (ret)
  444. goto out;
  445. /* 10.4.2 step 9.3 */
  446. i++;
  447. templen += drbg_blocklen(drbg);
  448. }
  449. /* 10.4.2 step 11 */
  450. X = temp + (drbg_keylen(drbg));
  451. drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
  452. /* 10.4.2 step 12: overwriting of outval is implemented in next step */
  453. /* 10.4.2 step 13 */
  454. drbg_kcapi_symsetkey(drbg, temp);
  455. while (generated_len < bytes_to_return) {
  456. short blocklen = 0;
  457. /*
  458. * 10.4.2 step 13.1: the truncation of the key length is
  459. * implicit as the key is only drbg_blocklen in size based on
  460. * the implementation of the cipher function callback
  461. */
  462. ret = drbg_kcapi_sym(drbg, X, &cipherin);
  463. if (ret)
  464. goto out;
  465. blocklen = (drbg_blocklen(drbg) <
  466. (bytes_to_return - generated_len)) ?
  467. drbg_blocklen(drbg) :
  468. (bytes_to_return - generated_len);
  469. /* 10.4.2 step 13.2 and 14 */
  470. memcpy(df_data + generated_len, X, blocklen);
  471. generated_len += blocklen;
  472. }
  473. ret = 0;
  474. out:
  475. memset(iv, 0, drbg_blocklen(drbg));
  476. memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
  477. memset(pad, 0, drbg_blocklen(drbg));
  478. return ret;
  479. }
  480. /*
  481. * update function of CTR DRBG as defined in 10.2.1.2
  482. *
  483. * The reseed variable has an enhanced meaning compared to the update
  484. * functions of the other DRBGs as follows:
  485. * 0 => initial seed from initialization
  486. * 1 => reseed via drbg_seed
  487. * 2 => first invocation from drbg_ctr_update when addtl is present. In
  488. * this case, the df_data scratchpad is not deleted so that it is
  489. * available for another calls to prevent calling the DF function
  490. * again.
  491. * 3 => second invocation from drbg_ctr_update. When the update function
  492. * was called with addtl, the df_data memory already contains the
  493. * DFed addtl information and we do not need to call DF again.
  494. */
  495. static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
  496. int reseed)
  497. {
  498. int ret = -EFAULT;
  499. /* 10.2.1.2 step 1 */
  500. unsigned char *temp = drbg->scratchpad;
  501. unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
  502. drbg_blocklen(drbg);
  503. if (3 > reseed)
  504. memset(df_data, 0, drbg_statelen(drbg));
  505. if (!reseed) {
  506. /*
  507. * The DRBG uses the CTR mode of the underlying AES cipher. The
  508. * CTR mode increments the counter value after the AES operation
  509. * but SP800-90A requires that the counter is incremented before
  510. * the AES operation. Hence, we increment it at the time we set
  511. * it by one.
  512. */
  513. crypto_inc(drbg->V, drbg_blocklen(drbg));
  514. ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
  515. drbg_keylen(drbg));
  516. if (ret)
  517. goto out;
  518. }
  519. /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
  520. if (seed) {
  521. ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
  522. if (ret)
  523. goto out;
  524. }
  525. ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
  526. temp, drbg_statelen(drbg));
  527. if (ret)
  528. return ret;
  529. /* 10.2.1.2 step 5 */
  530. ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
  531. drbg_keylen(drbg));
  532. if (ret)
  533. goto out;
  534. /* 10.2.1.2 step 6 */
  535. memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
  536. /* See above: increment counter by one to compensate timing of CTR op */
  537. crypto_inc(drbg->V, drbg_blocklen(drbg));
  538. ret = 0;
  539. out:
  540. memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
  541. if (2 != reseed)
  542. memset(df_data, 0, drbg_statelen(drbg));
  543. return ret;
  544. }
  545. /*
  546. * scratchpad use: drbg_ctr_update is called independently from
  547. * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
  548. */
  549. /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
  550. static int drbg_ctr_generate(struct drbg_state *drbg,
  551. unsigned char *buf, unsigned int buflen,
  552. struct list_head *addtl)
  553. {
  554. int ret;
  555. int len = min_t(int, buflen, INT_MAX);
  556. /* 10.2.1.5.2 step 2 */
  557. if (addtl && !list_empty(addtl)) {
  558. ret = drbg_ctr_update(drbg, addtl, 2);
  559. if (ret)
  560. return 0;
  561. }
  562. /* 10.2.1.5.2 step 4.1 */
  563. ret = drbg_kcapi_sym_ctr(drbg, NULL, 0, buf, len);
  564. if (ret)
  565. return ret;
  566. /* 10.2.1.5.2 step 6 */
  567. ret = drbg_ctr_update(drbg, NULL, 3);
  568. if (ret)
  569. len = ret;
  570. return len;
  571. }
  572. static const struct drbg_state_ops drbg_ctr_ops = {
  573. .update = drbg_ctr_update,
  574. .generate = drbg_ctr_generate,
  575. .crypto_init = drbg_init_sym_kernel,
  576. .crypto_fini = drbg_fini_sym_kernel,
  577. };
  578. #endif /* CONFIG_CRYPTO_DRBG_CTR */
  579. /******************************************************************
  580. * HMAC DRBG callback functions
  581. ******************************************************************/
  582. #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
  583. static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
  584. const struct list_head *in);
  585. static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
  586. const unsigned char *key);
  587. static int drbg_init_hash_kernel(struct drbg_state *drbg);
  588. static int drbg_fini_hash_kernel(struct drbg_state *drbg);
  589. #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
  590. #ifdef CONFIG_CRYPTO_DRBG_HMAC
  591. #define CRYPTO_DRBG_HMAC_STRING "HMAC "
  592. MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
  593. MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
  594. MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
  595. MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
  596. MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
  597. MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
  598. MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
  599. MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
  600. /* update function of HMAC DRBG as defined in 10.1.2.2 */
  601. static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
  602. int reseed)
  603. {
  604. int ret = -EFAULT;
  605. int i = 0;
  606. struct drbg_string seed1, seed2, vdata;
  607. LIST_HEAD(seedlist);
  608. LIST_HEAD(vdatalist);
  609. if (!reseed) {
  610. /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
  611. memset(drbg->V, 1, drbg_statelen(drbg));
  612. drbg_kcapi_hmacsetkey(drbg, drbg->C);
  613. }
  614. drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
  615. list_add_tail(&seed1.list, &seedlist);
  616. /* buffer of seed2 will be filled in for loop below with one byte */
  617. drbg_string_fill(&seed2, NULL, 1);
  618. list_add_tail(&seed2.list, &seedlist);
  619. /* input data of seed is allowed to be NULL at this point */
  620. if (seed)
  621. list_splice_tail(seed, &seedlist);
  622. drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
  623. list_add_tail(&vdata.list, &vdatalist);
  624. for (i = 2; 0 < i; i--) {
  625. /* first round uses 0x0, second 0x1 */
  626. unsigned char prefix = DRBG_PREFIX0;
  627. if (1 == i)
  628. prefix = DRBG_PREFIX1;
  629. /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
  630. seed2.buf = &prefix;
  631. ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
  632. if (ret)
  633. return ret;
  634. drbg_kcapi_hmacsetkey(drbg, drbg->C);
  635. /* 10.1.2.2 step 2 and 5 -- HMAC for V */
  636. ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
  637. if (ret)
  638. return ret;
  639. /* 10.1.2.2 step 3 */
  640. if (!seed)
  641. return ret;
  642. }
  643. return 0;
  644. }
  645. /* generate function of HMAC DRBG as defined in 10.1.2.5 */
  646. static int drbg_hmac_generate(struct drbg_state *drbg,
  647. unsigned char *buf,
  648. unsigned int buflen,
  649. struct list_head *addtl)
  650. {
  651. int len = 0;
  652. int ret = 0;
  653. struct drbg_string data;
  654. LIST_HEAD(datalist);
  655. /* 10.1.2.5 step 2 */
  656. if (addtl && !list_empty(addtl)) {
  657. ret = drbg_hmac_update(drbg, addtl, 1);
  658. if (ret)
  659. return ret;
  660. }
  661. drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
  662. list_add_tail(&data.list, &datalist);
  663. while (len < buflen) {
  664. unsigned int outlen = 0;
  665. /* 10.1.2.5 step 4.1 */
  666. ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
  667. if (ret)
  668. return ret;
  669. outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
  670. drbg_blocklen(drbg) : (buflen - len);
  671. /* 10.1.2.5 step 4.2 */
  672. memcpy(buf + len, drbg->V, outlen);
  673. len += outlen;
  674. }
  675. /* 10.1.2.5 step 6 */
  676. if (addtl && !list_empty(addtl))
  677. ret = drbg_hmac_update(drbg, addtl, 1);
  678. else
  679. ret = drbg_hmac_update(drbg, NULL, 1);
  680. if (ret)
  681. return ret;
  682. return len;
  683. }
  684. static const struct drbg_state_ops drbg_hmac_ops = {
  685. .update = drbg_hmac_update,
  686. .generate = drbg_hmac_generate,
  687. .crypto_init = drbg_init_hash_kernel,
  688. .crypto_fini = drbg_fini_hash_kernel,
  689. };
  690. #endif /* CONFIG_CRYPTO_DRBG_HMAC */
  691. /******************************************************************
  692. * Hash DRBG callback functions
  693. ******************************************************************/
  694. #ifdef CONFIG_CRYPTO_DRBG_HASH
  695. #define CRYPTO_DRBG_HASH_STRING "HASH "
  696. MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
  697. MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
  698. MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
  699. MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
  700. MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
  701. MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
  702. MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
  703. MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
  704. /*
  705. * Increment buffer
  706. *
  707. * @dst buffer to increment
  708. * @add value to add
  709. */
  710. static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
  711. const unsigned char *add, size_t addlen)
  712. {
  713. /* implied: dstlen > addlen */
  714. unsigned char *dstptr;
  715. const unsigned char *addptr;
  716. unsigned int remainder = 0;
  717. size_t len = addlen;
  718. dstptr = dst + (dstlen-1);
  719. addptr = add + (addlen-1);
  720. while (len) {
  721. remainder += *dstptr + *addptr;
  722. *dstptr = remainder & 0xff;
  723. remainder >>= 8;
  724. len--; dstptr--; addptr--;
  725. }
  726. len = dstlen - addlen;
  727. while (len && remainder > 0) {
  728. remainder = *dstptr + 1;
  729. *dstptr = remainder & 0xff;
  730. remainder >>= 8;
  731. len--; dstptr--;
  732. }
  733. }
  734. /*
  735. * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
  736. * interlinked, the scratchpad is used as follows:
  737. * drbg_hash_update
  738. * start: drbg->scratchpad
  739. * length: drbg_statelen(drbg)
  740. * drbg_hash_df:
  741. * start: drbg->scratchpad + drbg_statelen(drbg)
  742. * length: drbg_blocklen(drbg)
  743. *
  744. * drbg_hash_process_addtl uses the scratchpad, but fully completes
  745. * before either of the functions mentioned before are invoked. Therefore,
  746. * drbg_hash_process_addtl does not need to be specifically considered.
  747. */
  748. /* Derivation Function for Hash DRBG as defined in 10.4.1 */
  749. static int drbg_hash_df(struct drbg_state *drbg,
  750. unsigned char *outval, size_t outlen,
  751. struct list_head *entropylist)
  752. {
  753. int ret = 0;
  754. size_t len = 0;
  755. unsigned char input[5];
  756. unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
  757. struct drbg_string data;
  758. /* 10.4.1 step 3 */
  759. input[0] = 1;
  760. drbg_cpu_to_be32((outlen * 8), &input[1]);
  761. /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
  762. drbg_string_fill(&data, input, 5);
  763. list_add(&data.list, entropylist);
  764. /* 10.4.1 step 4 */
  765. while (len < outlen) {
  766. short blocklen = 0;
  767. /* 10.4.1 step 4.1 */
  768. ret = drbg_kcapi_hash(drbg, tmp, entropylist);
  769. if (ret)
  770. goto out;
  771. /* 10.4.1 step 4.2 */
  772. input[0]++;
  773. blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
  774. drbg_blocklen(drbg) : (outlen - len);
  775. memcpy(outval + len, tmp, blocklen);
  776. len += blocklen;
  777. }
  778. out:
  779. memset(tmp, 0, drbg_blocklen(drbg));
  780. return ret;
  781. }
  782. /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
  783. static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
  784. int reseed)
  785. {
  786. int ret = 0;
  787. struct drbg_string data1, data2;
  788. LIST_HEAD(datalist);
  789. LIST_HEAD(datalist2);
  790. unsigned char *V = drbg->scratchpad;
  791. unsigned char prefix = DRBG_PREFIX1;
  792. if (!seed)
  793. return -EINVAL;
  794. if (reseed) {
  795. /* 10.1.1.3 step 1 */
  796. memcpy(V, drbg->V, drbg_statelen(drbg));
  797. drbg_string_fill(&data1, &prefix, 1);
  798. list_add_tail(&data1.list, &datalist);
  799. drbg_string_fill(&data2, V, drbg_statelen(drbg));
  800. list_add_tail(&data2.list, &datalist);
  801. }
  802. list_splice_tail(seed, &datalist);
  803. /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
  804. ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
  805. if (ret)
  806. goto out;
  807. /* 10.1.1.2 / 10.1.1.3 step 4 */
  808. prefix = DRBG_PREFIX0;
  809. drbg_string_fill(&data1, &prefix, 1);
  810. list_add_tail(&data1.list, &datalist2);
  811. drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
  812. list_add_tail(&data2.list, &datalist2);
  813. /* 10.1.1.2 / 10.1.1.3 step 4 */
  814. ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
  815. out:
  816. memset(drbg->scratchpad, 0, drbg_statelen(drbg));
  817. return ret;
  818. }
  819. /* processing of additional information string for Hash DRBG */
  820. static int drbg_hash_process_addtl(struct drbg_state *drbg,
  821. struct list_head *addtl)
  822. {
  823. int ret = 0;
  824. struct drbg_string data1, data2;
  825. LIST_HEAD(datalist);
  826. unsigned char prefix = DRBG_PREFIX2;
  827. /* 10.1.1.4 step 2 */
  828. if (!addtl || list_empty(addtl))
  829. return 0;
  830. /* 10.1.1.4 step 2a */
  831. drbg_string_fill(&data1, &prefix, 1);
  832. drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
  833. list_add_tail(&data1.list, &datalist);
  834. list_add_tail(&data2.list, &datalist);
  835. list_splice_tail(addtl, &datalist);
  836. ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
  837. if (ret)
  838. goto out;
  839. /* 10.1.1.4 step 2b */
  840. drbg_add_buf(drbg->V, drbg_statelen(drbg),
  841. drbg->scratchpad, drbg_blocklen(drbg));
  842. out:
  843. memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
  844. return ret;
  845. }
  846. /* Hashgen defined in 10.1.1.4 */
  847. static int drbg_hash_hashgen(struct drbg_state *drbg,
  848. unsigned char *buf,
  849. unsigned int buflen)
  850. {
  851. int len = 0;
  852. int ret = 0;
  853. unsigned char *src = drbg->scratchpad;
  854. unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
  855. struct drbg_string data;
  856. LIST_HEAD(datalist);
  857. /* 10.1.1.4 step hashgen 2 */
  858. memcpy(src, drbg->V, drbg_statelen(drbg));
  859. drbg_string_fill(&data, src, drbg_statelen(drbg));
  860. list_add_tail(&data.list, &datalist);
  861. while (len < buflen) {
  862. unsigned int outlen = 0;
  863. /* 10.1.1.4 step hashgen 4.1 */
  864. ret = drbg_kcapi_hash(drbg, dst, &datalist);
  865. if (ret) {
  866. len = ret;
  867. goto out;
  868. }
  869. outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
  870. drbg_blocklen(drbg) : (buflen - len);
  871. /* 10.1.1.4 step hashgen 4.2 */
  872. memcpy(buf + len, dst, outlen);
  873. len += outlen;
  874. /* 10.1.1.4 hashgen step 4.3 */
  875. if (len < buflen)
  876. crypto_inc(src, drbg_statelen(drbg));
  877. }
  878. out:
  879. memset(drbg->scratchpad, 0,
  880. (drbg_statelen(drbg) + drbg_blocklen(drbg)));
  881. return len;
  882. }
  883. /* generate function for Hash DRBG as defined in 10.1.1.4 */
  884. static int drbg_hash_generate(struct drbg_state *drbg,
  885. unsigned char *buf, unsigned int buflen,
  886. struct list_head *addtl)
  887. {
  888. int len = 0;
  889. int ret = 0;
  890. union {
  891. unsigned char req[8];
  892. __be64 req_int;
  893. } u;
  894. unsigned char prefix = DRBG_PREFIX3;
  895. struct drbg_string data1, data2;
  896. LIST_HEAD(datalist);
  897. /* 10.1.1.4 step 2 */
  898. ret = drbg_hash_process_addtl(drbg, addtl);
  899. if (ret)
  900. return ret;
  901. /* 10.1.1.4 step 3 */
  902. len = drbg_hash_hashgen(drbg, buf, buflen);
  903. /* this is the value H as documented in 10.1.1.4 */
  904. /* 10.1.1.4 step 4 */
  905. drbg_string_fill(&data1, &prefix, 1);
  906. list_add_tail(&data1.list, &datalist);
  907. drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
  908. list_add_tail(&data2.list, &datalist);
  909. ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
  910. if (ret) {
  911. len = ret;
  912. goto out;
  913. }
  914. /* 10.1.1.4 step 5 */
  915. drbg_add_buf(drbg->V, drbg_statelen(drbg),
  916. drbg->scratchpad, drbg_blocklen(drbg));
  917. drbg_add_buf(drbg->V, drbg_statelen(drbg),
  918. drbg->C, drbg_statelen(drbg));
  919. u.req_int = cpu_to_be64(drbg->reseed_ctr);
  920. drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
  921. out:
  922. memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
  923. return len;
  924. }
  925. /*
  926. * scratchpad usage: as update and generate are used isolated, both
  927. * can use the scratchpad
  928. */
  929. static const struct drbg_state_ops drbg_hash_ops = {
  930. .update = drbg_hash_update,
  931. .generate = drbg_hash_generate,
  932. .crypto_init = drbg_init_hash_kernel,
  933. .crypto_fini = drbg_fini_hash_kernel,
  934. };
  935. #endif /* CONFIG_CRYPTO_DRBG_HASH */
  936. /******************************************************************
  937. * Functions common for DRBG implementations
  938. ******************************************************************/
  939. static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
  940. int reseed)
  941. {
  942. int ret = drbg->d_ops->update(drbg, seed, reseed);
  943. if (ret)
  944. return ret;
  945. drbg->seeded = true;
  946. /* 10.1.1.2 / 10.1.1.3 step 5 */
  947. drbg->reseed_ctr = 1;
  948. return ret;
  949. }
  950. static inline int drbg_get_random_bytes(struct drbg_state *drbg,
  951. unsigned char *entropy,
  952. unsigned int entropylen)
  953. {
  954. int ret;
  955. do {
  956. get_random_bytes(entropy, entropylen);
  957. ret = drbg_fips_continuous_test(drbg, entropy);
  958. if (ret && ret != -EAGAIN)
  959. return ret;
  960. } while (ret);
  961. return 0;
  962. }
  963. static void drbg_async_seed(struct work_struct *work)
  964. {
  965. struct drbg_string data;
  966. LIST_HEAD(seedlist);
  967. struct drbg_state *drbg = container_of(work, struct drbg_state,
  968. seed_work);
  969. unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
  970. unsigned char entropy[32];
  971. int ret;
  972. BUG_ON(!entropylen);
  973. BUG_ON(entropylen > sizeof(entropy));
  974. drbg_string_fill(&data, entropy, entropylen);
  975. list_add_tail(&data.list, &seedlist);
  976. mutex_lock(&drbg->drbg_mutex);
  977. ret = drbg_get_random_bytes(drbg, entropy, entropylen);
  978. if (ret)
  979. goto unlock;
  980. /* Set seeded to false so that if __drbg_seed fails the
  981. * next generate call will trigger a reseed.
  982. */
  983. drbg->seeded = false;
  984. __drbg_seed(drbg, &seedlist, true);
  985. if (drbg->seeded)
  986. drbg->reseed_threshold = drbg_max_requests(drbg);
  987. unlock:
  988. mutex_unlock(&drbg->drbg_mutex);
  989. memzero_explicit(entropy, entropylen);
  990. }
  991. /*
  992. * Seeding or reseeding of the DRBG
  993. *
  994. * @drbg: DRBG state struct
  995. * @pers: personalization / additional information buffer
  996. * @reseed: 0 for initial seed process, 1 for reseeding
  997. *
  998. * return:
  999. * 0 on success
  1000. * error value otherwise
  1001. */
  1002. static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
  1003. bool reseed)
  1004. {
  1005. int ret;
  1006. unsigned char entropy[((32 + 16) * 2)];
  1007. unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
  1008. struct drbg_string data1;
  1009. LIST_HEAD(seedlist);
  1010. /* 9.1 / 9.2 / 9.3.1 step 3 */
  1011. if (pers && pers->len > (drbg_max_addtl(drbg))) {
  1012. pr_devel("DRBG: personalization string too long %zu\n",
  1013. pers->len);
  1014. return -EINVAL;
  1015. }
  1016. if (list_empty(&drbg->test_data.list)) {
  1017. drbg_string_fill(&data1, drbg->test_data.buf,
  1018. drbg->test_data.len);
  1019. pr_devel("DRBG: using test entropy\n");
  1020. } else {
  1021. /*
  1022. * Gather entropy equal to the security strength of the DRBG.
  1023. * With a derivation function, a nonce is required in addition
  1024. * to the entropy. A nonce must be at least 1/2 of the security
  1025. * strength of the DRBG in size. Thus, entropy + nonce is 3/2
  1026. * of the strength. The consideration of a nonce is only
  1027. * applicable during initial seeding.
  1028. */
  1029. BUG_ON(!entropylen);
  1030. if (!reseed)
  1031. entropylen = ((entropylen + 1) / 2) * 3;
  1032. BUG_ON((entropylen * 2) > sizeof(entropy));
  1033. /* Get seed from in-kernel /dev/urandom */
  1034. ret = drbg_get_random_bytes(drbg, entropy, entropylen);
  1035. if (ret)
  1036. goto out;
  1037. if (!drbg->jent) {
  1038. drbg_string_fill(&data1, entropy, entropylen);
  1039. pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
  1040. entropylen);
  1041. } else {
  1042. /* Get seed from Jitter RNG */
  1043. ret = crypto_rng_get_bytes(drbg->jent,
  1044. entropy + entropylen,
  1045. entropylen);
  1046. if (ret) {
  1047. pr_devel("DRBG: jent failed with %d\n", ret);
  1048. /*
  1049. * Do not treat the transient failure of the
  1050. * Jitter RNG as an error that needs to be
  1051. * reported. The combined number of the
  1052. * maximum reseed threshold times the maximum
  1053. * number of Jitter RNG transient errors is
  1054. * less than the reseed threshold required by
  1055. * SP800-90A allowing us to treat the
  1056. * transient errors as such.
  1057. *
  1058. * However, we mandate that at least the first
  1059. * seeding operation must succeed with the
  1060. * Jitter RNG.
  1061. */
  1062. if (!reseed || ret != -EAGAIN)
  1063. goto out;
  1064. }
  1065. drbg_string_fill(&data1, entropy, entropylen * 2);
  1066. pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
  1067. entropylen * 2);
  1068. }
  1069. }
  1070. list_add_tail(&data1.list, &seedlist);
  1071. /*
  1072. * concatenation of entropy with personalization str / addtl input)
  1073. * the variable pers is directly handed in by the caller, so check its
  1074. * contents whether it is appropriate
  1075. */
  1076. if (pers && pers->buf && 0 < pers->len) {
  1077. list_add_tail(&pers->list, &seedlist);
  1078. pr_devel("DRBG: using personalization string\n");
  1079. }
  1080. if (!reseed) {
  1081. memset(drbg->V, 0, drbg_statelen(drbg));
  1082. memset(drbg->C, 0, drbg_statelen(drbg));
  1083. }
  1084. ret = __drbg_seed(drbg, &seedlist, reseed);
  1085. out:
  1086. memzero_explicit(entropy, entropylen * 2);
  1087. return ret;
  1088. }
  1089. /* Free all substructures in a DRBG state without the DRBG state structure */
  1090. static inline void drbg_dealloc_state(struct drbg_state *drbg)
  1091. {
  1092. if (!drbg)
  1093. return;
  1094. kfree_sensitive(drbg->Vbuf);
  1095. drbg->Vbuf = NULL;
  1096. drbg->V = NULL;
  1097. kfree_sensitive(drbg->Cbuf);
  1098. drbg->Cbuf = NULL;
  1099. drbg->C = NULL;
  1100. kfree_sensitive(drbg->scratchpadbuf);
  1101. drbg->scratchpadbuf = NULL;
  1102. drbg->reseed_ctr = 0;
  1103. drbg->d_ops = NULL;
  1104. drbg->core = NULL;
  1105. if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
  1106. kfree_sensitive(drbg->prev);
  1107. drbg->prev = NULL;
  1108. drbg->fips_primed = false;
  1109. }
  1110. }
  1111. /*
  1112. * Allocate all sub-structures for a DRBG state.
  1113. * The DRBG state structure must already be allocated.
  1114. */
  1115. static inline int drbg_alloc_state(struct drbg_state *drbg)
  1116. {
  1117. int ret = -ENOMEM;
  1118. unsigned int sb_size = 0;
  1119. switch (drbg->core->flags & DRBG_TYPE_MASK) {
  1120. #ifdef CONFIG_CRYPTO_DRBG_HMAC
  1121. case DRBG_HMAC:
  1122. drbg->d_ops = &drbg_hmac_ops;
  1123. break;
  1124. #endif /* CONFIG_CRYPTO_DRBG_HMAC */
  1125. #ifdef CONFIG_CRYPTO_DRBG_HASH
  1126. case DRBG_HASH:
  1127. drbg->d_ops = &drbg_hash_ops;
  1128. break;
  1129. #endif /* CONFIG_CRYPTO_DRBG_HASH */
  1130. #ifdef CONFIG_CRYPTO_DRBG_CTR
  1131. case DRBG_CTR:
  1132. drbg->d_ops = &drbg_ctr_ops;
  1133. break;
  1134. #endif /* CONFIG_CRYPTO_DRBG_CTR */
  1135. default:
  1136. ret = -EOPNOTSUPP;
  1137. goto err;
  1138. }
  1139. ret = drbg->d_ops->crypto_init(drbg);
  1140. if (ret < 0)
  1141. goto err;
  1142. drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
  1143. if (!drbg->Vbuf) {
  1144. ret = -ENOMEM;
  1145. goto fini;
  1146. }
  1147. drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
  1148. drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
  1149. if (!drbg->Cbuf) {
  1150. ret = -ENOMEM;
  1151. goto fini;
  1152. }
  1153. drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
  1154. /* scratchpad is only generated for CTR and Hash */
  1155. if (drbg->core->flags & DRBG_HMAC)
  1156. sb_size = 0;
  1157. else if (drbg->core->flags & DRBG_CTR)
  1158. sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
  1159. drbg_statelen(drbg) + /* df_data */
  1160. drbg_blocklen(drbg) + /* pad */
  1161. drbg_blocklen(drbg) + /* iv */
  1162. drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
  1163. else
  1164. sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
  1165. if (0 < sb_size) {
  1166. drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
  1167. if (!drbg->scratchpadbuf) {
  1168. ret = -ENOMEM;
  1169. goto fini;
  1170. }
  1171. drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
  1172. }
  1173. if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
  1174. drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
  1175. GFP_KERNEL);
  1176. if (!drbg->prev) {
  1177. ret = -ENOMEM;
  1178. goto fini;
  1179. }
  1180. drbg->fips_primed = false;
  1181. }
  1182. return 0;
  1183. fini:
  1184. drbg->d_ops->crypto_fini(drbg);
  1185. err:
  1186. drbg_dealloc_state(drbg);
  1187. return ret;
  1188. }
  1189. /*************************************************************************
  1190. * DRBG interface functions
  1191. *************************************************************************/
  1192. /*
  1193. * DRBG generate function as required by SP800-90A - this function
  1194. * generates random numbers
  1195. *
  1196. * @drbg DRBG state handle
  1197. * @buf Buffer where to store the random numbers -- the buffer must already
  1198. * be pre-allocated by caller
  1199. * @buflen Length of output buffer - this value defines the number of random
  1200. * bytes pulled from DRBG
  1201. * @addtl Additional input that is mixed into state, may be NULL -- note
  1202. * the entropy is pulled by the DRBG internally unconditionally
  1203. * as defined in SP800-90A. The additional input is mixed into
  1204. * the state in addition to the pulled entropy.
  1205. *
  1206. * return: 0 when all bytes are generated; < 0 in case of an error
  1207. */
  1208. static int drbg_generate(struct drbg_state *drbg,
  1209. unsigned char *buf, unsigned int buflen,
  1210. struct drbg_string *addtl)
  1211. {
  1212. int len = 0;
  1213. LIST_HEAD(addtllist);
  1214. if (!drbg->core) {
  1215. pr_devel("DRBG: not yet seeded\n");
  1216. return -EINVAL;
  1217. }
  1218. if (0 == buflen || !buf) {
  1219. pr_devel("DRBG: no output buffer provided\n");
  1220. return -EINVAL;
  1221. }
  1222. if (addtl && NULL == addtl->buf && 0 < addtl->len) {
  1223. pr_devel("DRBG: wrong format of additional information\n");
  1224. return -EINVAL;
  1225. }
  1226. /* 9.3.1 step 2 */
  1227. len = -EINVAL;
  1228. if (buflen > (drbg_max_request_bytes(drbg))) {
  1229. pr_devel("DRBG: requested random numbers too large %u\n",
  1230. buflen);
  1231. goto err;
  1232. }
  1233. /* 9.3.1 step 3 is implicit with the chosen DRBG */
  1234. /* 9.3.1 step 4 */
  1235. if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
  1236. pr_devel("DRBG: additional information string too long %zu\n",
  1237. addtl->len);
  1238. goto err;
  1239. }
  1240. /* 9.3.1 step 5 is implicit with the chosen DRBG */
  1241. /*
  1242. * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
  1243. * here. The spec is a bit convoluted here, we make it simpler.
  1244. */
  1245. if (drbg->reseed_threshold < drbg->reseed_ctr)
  1246. drbg->seeded = false;
  1247. if (drbg->pr || !drbg->seeded) {
  1248. pr_devel("DRBG: reseeding before generation (prediction "
  1249. "resistance: %s, state %s)\n",
  1250. drbg->pr ? "true" : "false",
  1251. drbg->seeded ? "seeded" : "unseeded");
  1252. /* 9.3.1 steps 7.1 through 7.3 */
  1253. len = drbg_seed(drbg, addtl, true);
  1254. if (len)
  1255. goto err;
  1256. /* 9.3.1 step 7.4 */
  1257. addtl = NULL;
  1258. }
  1259. if (addtl && 0 < addtl->len)
  1260. list_add_tail(&addtl->list, &addtllist);
  1261. /* 9.3.1 step 8 and 10 */
  1262. len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
  1263. /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
  1264. drbg->reseed_ctr++;
  1265. if (0 >= len)
  1266. goto err;
  1267. /*
  1268. * Section 11.3.3 requires to re-perform self tests after some
  1269. * generated random numbers. The chosen value after which self
  1270. * test is performed is arbitrary, but it should be reasonable.
  1271. * However, we do not perform the self tests because of the following
  1272. * reasons: it is mathematically impossible that the initial self tests
  1273. * were successfully and the following are not. If the initial would
  1274. * pass and the following would not, the kernel integrity is violated.
  1275. * In this case, the entire kernel operation is questionable and it
  1276. * is unlikely that the integrity violation only affects the
  1277. * correct operation of the DRBG.
  1278. *
  1279. * Albeit the following code is commented out, it is provided in
  1280. * case somebody has a need to implement the test of 11.3.3.
  1281. */
  1282. #if 0
  1283. if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
  1284. int err = 0;
  1285. pr_devel("DRBG: start to perform self test\n");
  1286. if (drbg->core->flags & DRBG_HMAC)
  1287. err = alg_test("drbg_pr_hmac_sha256",
  1288. "drbg_pr_hmac_sha256", 0, 0);
  1289. else if (drbg->core->flags & DRBG_CTR)
  1290. err = alg_test("drbg_pr_ctr_aes128",
  1291. "drbg_pr_ctr_aes128", 0, 0);
  1292. else
  1293. err = alg_test("drbg_pr_sha256",
  1294. "drbg_pr_sha256", 0, 0);
  1295. if (err) {
  1296. pr_err("DRBG: periodical self test failed\n");
  1297. /*
  1298. * uninstantiate implies that from now on, only errors
  1299. * are returned when reusing this DRBG cipher handle
  1300. */
  1301. drbg_uninstantiate(drbg);
  1302. return 0;
  1303. } else {
  1304. pr_devel("DRBG: self test successful\n");
  1305. }
  1306. }
  1307. #endif
  1308. /*
  1309. * All operations were successful, return 0 as mandated by
  1310. * the kernel crypto API interface.
  1311. */
  1312. len = 0;
  1313. err:
  1314. return len;
  1315. }
  1316. /*
  1317. * Wrapper around drbg_generate which can pull arbitrary long strings
  1318. * from the DRBG without hitting the maximum request limitation.
  1319. *
  1320. * Parameters: see drbg_generate
  1321. * Return codes: see drbg_generate -- if one drbg_generate request fails,
  1322. * the entire drbg_generate_long request fails
  1323. */
  1324. static int drbg_generate_long(struct drbg_state *drbg,
  1325. unsigned char *buf, unsigned int buflen,
  1326. struct drbg_string *addtl)
  1327. {
  1328. unsigned int len = 0;
  1329. unsigned int slice = 0;
  1330. do {
  1331. int err = 0;
  1332. unsigned int chunk = 0;
  1333. slice = ((buflen - len) / drbg_max_request_bytes(drbg));
  1334. chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
  1335. mutex_lock(&drbg->drbg_mutex);
  1336. err = drbg_generate(drbg, buf + len, chunk, addtl);
  1337. mutex_unlock(&drbg->drbg_mutex);
  1338. if (0 > err)
  1339. return err;
  1340. len += chunk;
  1341. } while (slice > 0 && (len < buflen));
  1342. return 0;
  1343. }
  1344. static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
  1345. {
  1346. struct drbg_state *drbg = container_of(rdy, struct drbg_state,
  1347. random_ready);
  1348. schedule_work(&drbg->seed_work);
  1349. }
  1350. static int drbg_prepare_hrng(struct drbg_state *drbg)
  1351. {
  1352. int err;
  1353. /* We do not need an HRNG in test mode. */
  1354. if (list_empty(&drbg->test_data.list))
  1355. return 0;
  1356. drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
  1357. INIT_WORK(&drbg->seed_work, drbg_async_seed);
  1358. drbg->random_ready.owner = THIS_MODULE;
  1359. drbg->random_ready.func = drbg_schedule_async_seed;
  1360. err = add_random_ready_callback(&drbg->random_ready);
  1361. switch (err) {
  1362. case 0:
  1363. break;
  1364. case -EALREADY:
  1365. err = 0;
  1366. fallthrough;
  1367. default:
  1368. drbg->random_ready.func = NULL;
  1369. return err;
  1370. }
  1371. /*
  1372. * Require frequent reseeds until the seed source is fully
  1373. * initialized.
  1374. */
  1375. drbg->reseed_threshold = 50;
  1376. return err;
  1377. }
  1378. /*
  1379. * DRBG instantiation function as required by SP800-90A - this function
  1380. * sets up the DRBG handle, performs the initial seeding and all sanity
  1381. * checks required by SP800-90A
  1382. *
  1383. * @drbg memory of state -- if NULL, new memory is allocated
  1384. * @pers Personalization string that is mixed into state, may be NULL -- note
  1385. * the entropy is pulled by the DRBG internally unconditionally
  1386. * as defined in SP800-90A. The additional input is mixed into
  1387. * the state in addition to the pulled entropy.
  1388. * @coreref reference to core
  1389. * @pr prediction resistance enabled
  1390. *
  1391. * return
  1392. * 0 on success
  1393. * error value otherwise
  1394. */
  1395. static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
  1396. int coreref, bool pr)
  1397. {
  1398. int ret;
  1399. bool reseed = true;
  1400. pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
  1401. "%s\n", coreref, pr ? "enabled" : "disabled");
  1402. mutex_lock(&drbg->drbg_mutex);
  1403. /* 9.1 step 1 is implicit with the selected DRBG type */
  1404. /*
  1405. * 9.1 step 2 is implicit as caller can select prediction resistance
  1406. * and the flag is copied into drbg->flags --
  1407. * all DRBG types support prediction resistance
  1408. */
  1409. /* 9.1 step 4 is implicit in drbg_sec_strength */
  1410. if (!drbg->core) {
  1411. drbg->core = &drbg_cores[coreref];
  1412. drbg->pr = pr;
  1413. drbg->seeded = false;
  1414. drbg->reseed_threshold = drbg_max_requests(drbg);
  1415. ret = drbg_alloc_state(drbg);
  1416. if (ret)
  1417. goto unlock;
  1418. ret = drbg_prepare_hrng(drbg);
  1419. if (ret)
  1420. goto free_everything;
  1421. if (IS_ERR(drbg->jent)) {
  1422. ret = PTR_ERR(drbg->jent);
  1423. drbg->jent = NULL;
  1424. if (fips_enabled || ret != -ENOENT)
  1425. goto free_everything;
  1426. pr_info("DRBG: Continuing without Jitter RNG\n");
  1427. }
  1428. reseed = false;
  1429. }
  1430. ret = drbg_seed(drbg, pers, reseed);
  1431. if (ret && !reseed)
  1432. goto free_everything;
  1433. mutex_unlock(&drbg->drbg_mutex);
  1434. return ret;
  1435. unlock:
  1436. mutex_unlock(&drbg->drbg_mutex);
  1437. return ret;
  1438. free_everything:
  1439. mutex_unlock(&drbg->drbg_mutex);
  1440. drbg_uninstantiate(drbg);
  1441. return ret;
  1442. }
  1443. /*
  1444. * DRBG uninstantiate function as required by SP800-90A - this function
  1445. * frees all buffers and the DRBG handle
  1446. *
  1447. * @drbg DRBG state handle
  1448. *
  1449. * return
  1450. * 0 on success
  1451. */
  1452. static int drbg_uninstantiate(struct drbg_state *drbg)
  1453. {
  1454. if (drbg->random_ready.func) {
  1455. del_random_ready_callback(&drbg->random_ready);
  1456. cancel_work_sync(&drbg->seed_work);
  1457. }
  1458. if (!IS_ERR_OR_NULL(drbg->jent))
  1459. crypto_free_rng(drbg->jent);
  1460. drbg->jent = NULL;
  1461. if (drbg->d_ops)
  1462. drbg->d_ops->crypto_fini(drbg);
  1463. drbg_dealloc_state(drbg);
  1464. /* no scrubbing of test_data -- this shall survive an uninstantiate */
  1465. return 0;
  1466. }
  1467. /*
  1468. * Helper function for setting the test data in the DRBG
  1469. *
  1470. * @drbg DRBG state handle
  1471. * @data test data
  1472. * @len test data length
  1473. */
  1474. static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
  1475. const u8 *data, unsigned int len)
  1476. {
  1477. struct drbg_state *drbg = crypto_rng_ctx(tfm);
  1478. mutex_lock(&drbg->drbg_mutex);
  1479. drbg_string_fill(&drbg->test_data, data, len);
  1480. mutex_unlock(&drbg->drbg_mutex);
  1481. }
  1482. /***************************************************************
  1483. * Kernel crypto API cipher invocations requested by DRBG
  1484. ***************************************************************/
  1485. #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
  1486. struct sdesc {
  1487. struct shash_desc shash;
  1488. char ctx[];
  1489. };
  1490. static int drbg_init_hash_kernel(struct drbg_state *drbg)
  1491. {
  1492. struct sdesc *sdesc;
  1493. struct crypto_shash *tfm;
  1494. tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
  1495. if (IS_ERR(tfm)) {
  1496. pr_info("DRBG: could not allocate digest TFM handle: %s\n",
  1497. drbg->core->backend_cra_name);
  1498. return PTR_ERR(tfm);
  1499. }
  1500. BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
  1501. sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
  1502. GFP_KERNEL);
  1503. if (!sdesc) {
  1504. crypto_free_shash(tfm);
  1505. return -ENOMEM;
  1506. }
  1507. sdesc->shash.tfm = tfm;
  1508. drbg->priv_data = sdesc;
  1509. return crypto_shash_alignmask(tfm);
  1510. }
  1511. static int drbg_fini_hash_kernel(struct drbg_state *drbg)
  1512. {
  1513. struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
  1514. if (sdesc) {
  1515. crypto_free_shash(sdesc->shash.tfm);
  1516. kfree_sensitive(sdesc);
  1517. }
  1518. drbg->priv_data = NULL;
  1519. return 0;
  1520. }
  1521. static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
  1522. const unsigned char *key)
  1523. {
  1524. struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
  1525. crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
  1526. }
  1527. static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
  1528. const struct list_head *in)
  1529. {
  1530. struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
  1531. struct drbg_string *input = NULL;
  1532. crypto_shash_init(&sdesc->shash);
  1533. list_for_each_entry(input, in, list)
  1534. crypto_shash_update(&sdesc->shash, input->buf, input->len);
  1535. return crypto_shash_final(&sdesc->shash, outval);
  1536. }
  1537. #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
  1538. #ifdef CONFIG_CRYPTO_DRBG_CTR
  1539. static int drbg_fini_sym_kernel(struct drbg_state *drbg)
  1540. {
  1541. struct crypto_cipher *tfm =
  1542. (struct crypto_cipher *)drbg->priv_data;
  1543. if (tfm)
  1544. crypto_free_cipher(tfm);
  1545. drbg->priv_data = NULL;
  1546. if (drbg->ctr_handle)
  1547. crypto_free_skcipher(drbg->ctr_handle);
  1548. drbg->ctr_handle = NULL;
  1549. if (drbg->ctr_req)
  1550. skcipher_request_free(drbg->ctr_req);
  1551. drbg->ctr_req = NULL;
  1552. kfree(drbg->outscratchpadbuf);
  1553. drbg->outscratchpadbuf = NULL;
  1554. return 0;
  1555. }
  1556. static int drbg_init_sym_kernel(struct drbg_state *drbg)
  1557. {
  1558. struct crypto_cipher *tfm;
  1559. struct crypto_skcipher *sk_tfm;
  1560. struct skcipher_request *req;
  1561. unsigned int alignmask;
  1562. char ctr_name[CRYPTO_MAX_ALG_NAME];
  1563. tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
  1564. if (IS_ERR(tfm)) {
  1565. pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
  1566. drbg->core->backend_cra_name);
  1567. return PTR_ERR(tfm);
  1568. }
  1569. BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
  1570. drbg->priv_data = tfm;
  1571. if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
  1572. drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
  1573. drbg_fini_sym_kernel(drbg);
  1574. return -EINVAL;
  1575. }
  1576. sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
  1577. if (IS_ERR(sk_tfm)) {
  1578. pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
  1579. ctr_name);
  1580. drbg_fini_sym_kernel(drbg);
  1581. return PTR_ERR(sk_tfm);
  1582. }
  1583. drbg->ctr_handle = sk_tfm;
  1584. crypto_init_wait(&drbg->ctr_wait);
  1585. req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
  1586. if (!req) {
  1587. pr_info("DRBG: could not allocate request queue\n");
  1588. drbg_fini_sym_kernel(drbg);
  1589. return -ENOMEM;
  1590. }
  1591. drbg->ctr_req = req;
  1592. skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
  1593. CRYPTO_TFM_REQ_MAY_SLEEP,
  1594. crypto_req_done, &drbg->ctr_wait);
  1595. alignmask = crypto_skcipher_alignmask(sk_tfm);
  1596. drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
  1597. GFP_KERNEL);
  1598. if (!drbg->outscratchpadbuf) {
  1599. drbg_fini_sym_kernel(drbg);
  1600. return -ENOMEM;
  1601. }
  1602. drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
  1603. alignmask + 1);
  1604. sg_init_table(&drbg->sg_in, 1);
  1605. sg_init_one(&drbg->sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
  1606. return alignmask;
  1607. }
  1608. static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
  1609. const unsigned char *key)
  1610. {
  1611. struct crypto_cipher *tfm =
  1612. (struct crypto_cipher *)drbg->priv_data;
  1613. crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
  1614. }
  1615. static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
  1616. const struct drbg_string *in)
  1617. {
  1618. struct crypto_cipher *tfm =
  1619. (struct crypto_cipher *)drbg->priv_data;
  1620. /* there is only component in *in */
  1621. BUG_ON(in->len < drbg_blocklen(drbg));
  1622. crypto_cipher_encrypt_one(tfm, outval, in->buf);
  1623. return 0;
  1624. }
  1625. static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
  1626. u8 *inbuf, u32 inlen,
  1627. u8 *outbuf, u32 outlen)
  1628. {
  1629. struct scatterlist *sg_in = &drbg->sg_in, *sg_out = &drbg->sg_out;
  1630. u32 scratchpad_use = min_t(u32, outlen, DRBG_OUTSCRATCHLEN);
  1631. int ret;
  1632. if (inbuf) {
  1633. /* Use caller-provided input buffer */
  1634. sg_set_buf(sg_in, inbuf, inlen);
  1635. } else {
  1636. /* Use scratchpad for in-place operation */
  1637. inlen = scratchpad_use;
  1638. memset(drbg->outscratchpad, 0, scratchpad_use);
  1639. sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
  1640. }
  1641. while (outlen) {
  1642. u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
  1643. /* Output buffer may not be valid for SGL, use scratchpad */
  1644. skcipher_request_set_crypt(drbg->ctr_req, sg_in, sg_out,
  1645. cryptlen, drbg->V);
  1646. ret = crypto_wait_req(crypto_skcipher_encrypt(drbg->ctr_req),
  1647. &drbg->ctr_wait);
  1648. if (ret)
  1649. goto out;
  1650. crypto_init_wait(&drbg->ctr_wait);
  1651. memcpy(outbuf, drbg->outscratchpad, cryptlen);
  1652. memzero_explicit(drbg->outscratchpad, cryptlen);
  1653. outlen -= cryptlen;
  1654. outbuf += cryptlen;
  1655. }
  1656. ret = 0;
  1657. out:
  1658. return ret;
  1659. }
  1660. #endif /* CONFIG_CRYPTO_DRBG_CTR */
  1661. /***************************************************************
  1662. * Kernel crypto API interface to register DRBG
  1663. ***************************************************************/
  1664. /*
  1665. * Look up the DRBG flags by given kernel crypto API cra_name
  1666. * The code uses the drbg_cores definition to do this
  1667. *
  1668. * @cra_name kernel crypto API cra_name
  1669. * @coreref reference to integer which is filled with the pointer to
  1670. * the applicable core
  1671. * @pr reference for setting prediction resistance
  1672. *
  1673. * return: flags
  1674. */
  1675. static inline void drbg_convert_tfm_core(const char *cra_driver_name,
  1676. int *coreref, bool *pr)
  1677. {
  1678. int i = 0;
  1679. size_t start = 0;
  1680. int len = 0;
  1681. *pr = true;
  1682. /* disassemble the names */
  1683. if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
  1684. start = 10;
  1685. *pr = false;
  1686. } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
  1687. start = 8;
  1688. } else {
  1689. return;
  1690. }
  1691. /* remove the first part */
  1692. len = strlen(cra_driver_name) - start;
  1693. for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
  1694. if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
  1695. len)) {
  1696. *coreref = i;
  1697. return;
  1698. }
  1699. }
  1700. }
  1701. static int drbg_kcapi_init(struct crypto_tfm *tfm)
  1702. {
  1703. struct drbg_state *drbg = crypto_tfm_ctx(tfm);
  1704. mutex_init(&drbg->drbg_mutex);
  1705. return 0;
  1706. }
  1707. static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
  1708. {
  1709. drbg_uninstantiate(crypto_tfm_ctx(tfm));
  1710. }
  1711. /*
  1712. * Generate random numbers invoked by the kernel crypto API:
  1713. * The API of the kernel crypto API is extended as follows:
  1714. *
  1715. * src is additional input supplied to the RNG.
  1716. * slen is the length of src.
  1717. * dst is the output buffer where random data is to be stored.
  1718. * dlen is the length of dst.
  1719. */
  1720. static int drbg_kcapi_random(struct crypto_rng *tfm,
  1721. const u8 *src, unsigned int slen,
  1722. u8 *dst, unsigned int dlen)
  1723. {
  1724. struct drbg_state *drbg = crypto_rng_ctx(tfm);
  1725. struct drbg_string *addtl = NULL;
  1726. struct drbg_string string;
  1727. if (slen) {
  1728. /* linked list variable is now local to allow modification */
  1729. drbg_string_fill(&string, src, slen);
  1730. addtl = &string;
  1731. }
  1732. return drbg_generate_long(drbg, dst, dlen, addtl);
  1733. }
  1734. /*
  1735. * Seed the DRBG invoked by the kernel crypto API
  1736. */
  1737. static int drbg_kcapi_seed(struct crypto_rng *tfm,
  1738. const u8 *seed, unsigned int slen)
  1739. {
  1740. struct drbg_state *drbg = crypto_rng_ctx(tfm);
  1741. struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
  1742. bool pr = false;
  1743. struct drbg_string string;
  1744. struct drbg_string *seed_string = NULL;
  1745. int coreref = 0;
  1746. drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
  1747. &pr);
  1748. if (0 < slen) {
  1749. drbg_string_fill(&string, seed, slen);
  1750. seed_string = &string;
  1751. }
  1752. return drbg_instantiate(drbg, seed_string, coreref, pr);
  1753. }
  1754. /***************************************************************
  1755. * Kernel module: code to load the module
  1756. ***************************************************************/
  1757. /*
  1758. * Tests as defined in 11.3.2 in addition to the cipher tests: testing
  1759. * of the error handling.
  1760. *
  1761. * Note: testing of failing seed source as defined in 11.3.2 is not applicable
  1762. * as seed source of get_random_bytes does not fail.
  1763. *
  1764. * Note 2: There is no sensible way of testing the reseed counter
  1765. * enforcement, so skip it.
  1766. */
  1767. static inline int __init drbg_healthcheck_sanity(void)
  1768. {
  1769. int len = 0;
  1770. #define OUTBUFLEN 16
  1771. unsigned char buf[OUTBUFLEN];
  1772. struct drbg_state *drbg = NULL;
  1773. int ret = -EFAULT;
  1774. int rc = -EFAULT;
  1775. bool pr = false;
  1776. int coreref = 0;
  1777. struct drbg_string addtl;
  1778. size_t max_addtllen, max_request_bytes;
  1779. /* only perform test in FIPS mode */
  1780. if (!fips_enabled)
  1781. return 0;
  1782. #ifdef CONFIG_CRYPTO_DRBG_CTR
  1783. drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
  1784. #elif defined CONFIG_CRYPTO_DRBG_HASH
  1785. drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
  1786. #else
  1787. drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
  1788. #endif
  1789. drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
  1790. if (!drbg)
  1791. return -ENOMEM;
  1792. mutex_init(&drbg->drbg_mutex);
  1793. drbg->core = &drbg_cores[coreref];
  1794. drbg->reseed_threshold = drbg_max_requests(drbg);
  1795. /*
  1796. * if the following tests fail, it is likely that there is a buffer
  1797. * overflow as buf is much smaller than the requested or provided
  1798. * string lengths -- in case the error handling does not succeed
  1799. * we may get an OOPS. And we want to get an OOPS as this is a
  1800. * grave bug.
  1801. */
  1802. max_addtllen = drbg_max_addtl(drbg);
  1803. max_request_bytes = drbg_max_request_bytes(drbg);
  1804. drbg_string_fill(&addtl, buf, max_addtllen + 1);
  1805. /* overflow addtllen with additonal info string */
  1806. len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
  1807. BUG_ON(0 < len);
  1808. /* overflow max_bits */
  1809. len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
  1810. BUG_ON(0 < len);
  1811. /* overflow max addtllen with personalization string */
  1812. ret = drbg_seed(drbg, &addtl, false);
  1813. BUG_ON(0 == ret);
  1814. /* all tests passed */
  1815. rc = 0;
  1816. pr_devel("DRBG: Sanity tests for failure code paths successfully "
  1817. "completed\n");
  1818. kfree(drbg);
  1819. return rc;
  1820. }
  1821. static struct rng_alg drbg_algs[22];
  1822. /*
  1823. * Fill the array drbg_algs used to register the different DRBGs
  1824. * with the kernel crypto API. To fill the array, the information
  1825. * from drbg_cores[] is used.
  1826. */
  1827. static inline void __init drbg_fill_array(struct rng_alg *alg,
  1828. const struct drbg_core *core, int pr)
  1829. {
  1830. int pos = 0;
  1831. static int priority = 200;
  1832. memcpy(alg->base.cra_name, "stdrng", 6);
  1833. if (pr) {
  1834. memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
  1835. pos = 8;
  1836. } else {
  1837. memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
  1838. pos = 10;
  1839. }
  1840. memcpy(alg->base.cra_driver_name + pos, core->cra_name,
  1841. strlen(core->cra_name));
  1842. alg->base.cra_priority = priority;
  1843. priority++;
  1844. /*
  1845. * If FIPS mode enabled, the selected DRBG shall have the
  1846. * highest cra_priority over other stdrng instances to ensure
  1847. * it is selected.
  1848. */
  1849. if (fips_enabled)
  1850. alg->base.cra_priority += 200;
  1851. alg->base.cra_ctxsize = sizeof(struct drbg_state);
  1852. alg->base.cra_module = THIS_MODULE;
  1853. alg->base.cra_init = drbg_kcapi_init;
  1854. alg->base.cra_exit = drbg_kcapi_cleanup;
  1855. alg->generate = drbg_kcapi_random;
  1856. alg->seed = drbg_kcapi_seed;
  1857. alg->set_ent = drbg_kcapi_set_entropy;
  1858. alg->seedsize = 0;
  1859. }
  1860. static int __init drbg_init(void)
  1861. {
  1862. unsigned int i = 0; /* pointer to drbg_algs */
  1863. unsigned int j = 0; /* pointer to drbg_cores */
  1864. int ret;
  1865. ret = drbg_healthcheck_sanity();
  1866. if (ret)
  1867. return ret;
  1868. if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
  1869. pr_info("DRBG: Cannot register all DRBG types"
  1870. "(slots needed: %zu, slots available: %zu)\n",
  1871. ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
  1872. return -EFAULT;
  1873. }
  1874. /*
  1875. * each DRBG definition can be used with PR and without PR, thus
  1876. * we instantiate each DRBG in drbg_cores[] twice.
  1877. *
  1878. * As the order of placing them into the drbg_algs array matters
  1879. * (the later DRBGs receive a higher cra_priority) we register the
  1880. * prediction resistance DRBGs first as the should not be too
  1881. * interesting.
  1882. */
  1883. for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
  1884. drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
  1885. for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
  1886. drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
  1887. return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
  1888. }
  1889. static void __exit drbg_exit(void)
  1890. {
  1891. crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
  1892. }
  1893. subsys_initcall(drbg_init);
  1894. module_exit(drbg_exit);
  1895. #ifndef CRYPTO_DRBG_HASH_STRING
  1896. #define CRYPTO_DRBG_HASH_STRING ""
  1897. #endif
  1898. #ifndef CRYPTO_DRBG_HMAC_STRING
  1899. #define CRYPTO_DRBG_HMAC_STRING ""
  1900. #endif
  1901. #ifndef CRYPTO_DRBG_CTR_STRING
  1902. #define CRYPTO_DRBG_CTR_STRING ""
  1903. #endif
  1904. MODULE_LICENSE("GPL");
  1905. MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
  1906. MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
  1907. "using following cores: "
  1908. CRYPTO_DRBG_HASH_STRING
  1909. CRYPTO_DRBG_HMAC_STRING
  1910. CRYPTO_DRBG_CTR_STRING);
  1911. MODULE_ALIAS_CRYPTO("stdrng");
  1912. MODULE_IMPORT_NS(CRYPTO_INTERNAL);