blob: edf3ce04e87ffb44b51fd614ab7e0adb1eca30cc [file] [log] [blame]
Stephan Mueller541af942014-05-31 15:44:17 +02001/*
2 * DRBG: Deterministic Random Bits Generator
3 * Based on NIST Recommended DRBG from NIST SP800-90A with the following
4 * properties:
5 * * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
6 * * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
7 * * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
8 * * with and without prediction resistance
9 *
10 * Copyright Stephan Mueller <smueller@chronox.de>, 2014
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, and the entire permission notice in its entirety,
17 * including the disclaimer of warranties.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. The name of the author may not be used to endorse or promote
22 * products derived from this software without specific prior
23 * written permission.
24 *
25 * ALTERNATIVELY, this product may be distributed under the terms of
26 * the GNU General Public License, in which case the provisions of the GPL are
27 * required INSTEAD OF the above restrictions. (This clause is
28 * necessary due to a potential bad interaction between the GPL and
29 * the restrictions contained in a BSD-style copyright.)
30 *
31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
32 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
34 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
35 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
37 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
38 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
39 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
41 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
42 * DAMAGE.
43 *
44 * DRBG Usage
45 * ==========
46 * The SP 800-90A DRBG allows the user to specify a personalization string
47 * for initialization as well as an additional information string for each
48 * random number request. The following code fragments show how a caller
49 * uses the kernel crypto API to use the full functionality of the DRBG.
50 *
51 * Usage without any additional data
52 * ---------------------------------
53 * struct crypto_rng *drng;
54 * int err;
55 * char data[DATALEN];
56 *
57 * drng = crypto_alloc_rng(drng_name, 0, 0);
58 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
59 * crypto_free_rng(drng);
60 *
61 *
62 * Usage with personalization string during initialization
63 * -------------------------------------------------------
64 * struct crypto_rng *drng;
65 * int err;
66 * char data[DATALEN];
67 * struct drbg_string pers;
68 * char personalization[11] = "some-string";
69 *
70 * drbg_string_fill(&pers, personalization, strlen(personalization));
71 * drng = crypto_alloc_rng(drng_name, 0, 0);
72 * // The reset completely re-initializes the DRBG with the provided
73 * // personalization string
74 * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
75 * err = crypto_rng_get_bytes(drng, &data, DATALEN);
76 * crypto_free_rng(drng);
77 *
78 *
79 * Usage with additional information string during random number request
80 * ---------------------------------------------------------------------
81 * struct crypto_rng *drng;
82 * int err;
83 * char data[DATALEN];
84 * char addtl_string[11] = "some-string";
85 * string drbg_string addtl;
86 *
87 * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
88 * drng = crypto_alloc_rng(drng_name, 0, 0);
89 * // The following call is a wrapper to crypto_rng_get_bytes() and returns
90 * // the same error codes.
91 * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
92 * crypto_free_rng(drng);
93 *
94 *
95 * Usage with personalization and additional information strings
96 * -------------------------------------------------------------
97 * Just mix both scenarios above.
98 */
99
100#include <crypto/drbg.h>
Stephan Mueller57225e62015-06-09 21:55:38 +0800101#include <linux/kernel.h>
Stephan Mueller541af942014-05-31 15:44:17 +0200102
Stephan Mueller541af942014-05-31 15:44:17 +0200103/***************************************************************
104 * Backend cipher definitions available to DRBG
105 ***************************************************************/
106
107/*
108 * The order of the DRBG definitions here matter: every DRBG is registered
109 * as stdrng. Each DRBG receives an increasing cra_priority values the later
110 * they are defined in this array (see drbg_fill_array).
111 *
112 * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
113 * the SHA256 / AES 256 over other ciphers. Thus, the favored
114 * DRBGs are the latest entries in this array.
115 */
116static const struct drbg_core drbg_cores[] = {
117#ifdef CONFIG_CRYPTO_DRBG_CTR
118 {
119 .flags = DRBG_CTR | DRBG_STRENGTH128,
120 .statelen = 32, /* 256 bits as defined in 10.2.1 */
Stephan Mueller541af942014-05-31 15:44:17 +0200121 .blocklen_bytes = 16,
122 .cra_name = "ctr_aes128",
Stephan Mueller04bcbfc2015-03-01 20:39:17 +0100123 .backend_cra_name = "aes",
Stephan Mueller541af942014-05-31 15:44:17 +0200124 }, {
125 .flags = DRBG_CTR | DRBG_STRENGTH192,
126 .statelen = 40, /* 320 bits as defined in 10.2.1 */
Stephan Mueller541af942014-05-31 15:44:17 +0200127 .blocklen_bytes = 16,
128 .cra_name = "ctr_aes192",
Stephan Mueller04bcbfc2015-03-01 20:39:17 +0100129 .backend_cra_name = "aes",
Stephan Mueller541af942014-05-31 15:44:17 +0200130 }, {
131 .flags = DRBG_CTR | DRBG_STRENGTH256,
132 .statelen = 48, /* 384 bits as defined in 10.2.1 */
Stephan Mueller541af942014-05-31 15:44:17 +0200133 .blocklen_bytes = 16,
134 .cra_name = "ctr_aes256",
Stephan Mueller04bcbfc2015-03-01 20:39:17 +0100135 .backend_cra_name = "aes",
Stephan Mueller541af942014-05-31 15:44:17 +0200136 },
137#endif /* CONFIG_CRYPTO_DRBG_CTR */
138#ifdef CONFIG_CRYPTO_DRBG_HASH
139 {
140 .flags = DRBG_HASH | DRBG_STRENGTH128,
141 .statelen = 55, /* 440 bits */
Stephan Mueller541af942014-05-31 15:44:17 +0200142 .blocklen_bytes = 20,
143 .cra_name = "sha1",
144 .backend_cra_name = "sha1",
145 }, {
146 .flags = DRBG_HASH | DRBG_STRENGTH256,
147 .statelen = 111, /* 888 bits */
Stephan Mueller541af942014-05-31 15:44:17 +0200148 .blocklen_bytes = 48,
149 .cra_name = "sha384",
150 .backend_cra_name = "sha384",
151 }, {
152 .flags = DRBG_HASH | DRBG_STRENGTH256,
153 .statelen = 111, /* 888 bits */
Stephan Mueller541af942014-05-31 15:44:17 +0200154 .blocklen_bytes = 64,
155 .cra_name = "sha512",
156 .backend_cra_name = "sha512",
157 }, {
158 .flags = DRBG_HASH | DRBG_STRENGTH256,
159 .statelen = 55, /* 440 bits */
Stephan Mueller541af942014-05-31 15:44:17 +0200160 .blocklen_bytes = 32,
161 .cra_name = "sha256",
162 .backend_cra_name = "sha256",
163 },
164#endif /* CONFIG_CRYPTO_DRBG_HASH */
165#ifdef CONFIG_CRYPTO_DRBG_HMAC
166 {
Stephan Mueller5b635e22014-07-06 02:26:37 +0200167 .flags = DRBG_HMAC | DRBG_STRENGTH128,
Stephan Mueller541af942014-05-31 15:44:17 +0200168 .statelen = 20, /* block length of cipher */
Stephan Mueller541af942014-05-31 15:44:17 +0200169 .blocklen_bytes = 20,
170 .cra_name = "hmac_sha1",
171 .backend_cra_name = "hmac(sha1)",
172 }, {
173 .flags = DRBG_HMAC | DRBG_STRENGTH256,
174 .statelen = 48, /* block length of cipher */
Stephan Mueller541af942014-05-31 15:44:17 +0200175 .blocklen_bytes = 48,
176 .cra_name = "hmac_sha384",
177 .backend_cra_name = "hmac(sha384)",
178 }, {
179 .flags = DRBG_HMAC | DRBG_STRENGTH256,
180 .statelen = 64, /* block length of cipher */
Stephan Mueller541af942014-05-31 15:44:17 +0200181 .blocklen_bytes = 64,
182 .cra_name = "hmac_sha512",
183 .backend_cra_name = "hmac(sha512)",
184 }, {
185 .flags = DRBG_HMAC | DRBG_STRENGTH256,
186 .statelen = 32, /* block length of cipher */
Stephan Mueller541af942014-05-31 15:44:17 +0200187 .blocklen_bytes = 32,
188 .cra_name = "hmac_sha256",
189 .backend_cra_name = "hmac(sha256)",
190 },
191#endif /* CONFIG_CRYPTO_DRBG_HMAC */
192};
193
Stephan Mueller57225e62015-06-09 21:55:38 +0800194static int drbg_uninstantiate(struct drbg_state *drbg);
195
Stephan Mueller541af942014-05-31 15:44:17 +0200196/******************************************************************
197 * Generic helper functions
198 ******************************************************************/
199
200/*
201 * Return strength of DRBG according to SP800-90A section 8.4
202 *
203 * @flags DRBG flags reference
204 *
205 * Return: normalized strength in *bytes* value or 32 as default
206 * to counter programming errors
207 */
208static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
209{
210 switch (flags & DRBG_STRENGTH_MASK) {
211 case DRBG_STRENGTH128:
212 return 16;
213 case DRBG_STRENGTH192:
214 return 24;
215 case DRBG_STRENGTH256:
216 return 32;
217 default:
218 return 32;
219 }
220}
221
222/*
Stephan Mueller541af942014-05-31 15:44:17 +0200223 * Convert an integer into a byte representation of this integer.
224 * The byte representation is big-endian
225 *
Stephan Mueller541af942014-05-31 15:44:17 +0200226 * @val value to be converted
Stephan Mueller72f3e002014-08-17 17:37:34 +0200227 * @buf buffer holding the converted integer -- caller must ensure that
228 * buffer size is at least 32 bit
Stephan Mueller541af942014-05-31 15:44:17 +0200229 */
230#if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
Stephan Mueller72f3e002014-08-17 17:37:34 +0200231static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
Stephan Mueller541af942014-05-31 15:44:17 +0200232{
Stephan Mueller72f3e002014-08-17 17:37:34 +0200233 struct s {
Stephan Mueller7c8ae032014-08-26 09:32:24 +0200234 __be32 conv;
Stephan Mueller72f3e002014-08-17 17:37:34 +0200235 };
236 struct s *conversion = (struct s *) buf;
Stephan Mueller541af942014-05-31 15:44:17 +0200237
Stephan Mueller72f3e002014-08-17 17:37:34 +0200238 conversion->conv = cpu_to_be32(val);
Stephan Mueller541af942014-05-31 15:44:17 +0200239}
Stephan Mueller541af942014-05-31 15:44:17 +0200240#endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
241
242/******************************************************************
243 * CTR DRBG callback functions
244 ******************************************************************/
245
246#ifdef CONFIG_CRYPTO_DRBG_CTR
Stephan Muellere25e47e2014-07-06 02:23:03 +0200247#define CRYPTO_DRBG_CTR_STRING "CTR "
Stephan Mueller0653a7c2014-11-25 09:28:43 +0100248MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
249MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
250MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
251MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
252MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
253MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
Stephan Mueller62b62b62014-11-04 03:08:09 +0100254
Stephan Muellered494d42016-05-31 13:11:57 +0200255static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
256 const unsigned char *key);
257static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
258 const struct drbg_string *in);
Stephan Mueller541af942014-05-31 15:44:17 +0200259static int drbg_init_sym_kernel(struct drbg_state *drbg);
260static int drbg_fini_sym_kernel(struct drbg_state *drbg);
Stephan Muellera07203f2016-06-14 07:35:37 +0200261static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
262 u8 *inbuf, u32 inbuflen,
263 u8 *outbuf, u32 outlen);
264#define DRBG_CTR_NULL_LEN 128
Stephan Mueller541af942014-05-31 15:44:17 +0200265
266/* BCC function for CTR DRBG as defined in 10.4.3 */
267static int drbg_ctr_bcc(struct drbg_state *drbg,
268 unsigned char *out, const unsigned char *key,
Stephan Mueller8c987162014-06-28 21:58:24 +0200269 struct list_head *in)
Stephan Mueller541af942014-05-31 15:44:17 +0200270{
Stephan Mueller8c987162014-06-28 21:58:24 +0200271 int ret = 0;
272 struct drbg_string *curr = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +0200273 struct drbg_string data;
Stephan Mueller8c987162014-06-28 21:58:24 +0200274 short cnt = 0;
Stephan Mueller541af942014-05-31 15:44:17 +0200275
276 drbg_string_fill(&data, out, drbg_blocklen(drbg));
277
Stephan Mueller541af942014-05-31 15:44:17 +0200278 /* 10.4.3 step 2 / 4 */
Stephan Muellered494d42016-05-31 13:11:57 +0200279 drbg_kcapi_symsetkey(drbg, key);
Stephan Mueller8c987162014-06-28 21:58:24 +0200280 list_for_each_entry(curr, in, list) {
281 const unsigned char *pos = curr->buf;
282 size_t len = curr->len;
Stephan Mueller541af942014-05-31 15:44:17 +0200283 /* 10.4.3 step 4.1 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200284 while (len) {
285 /* 10.4.3 step 4.2 */
286 if (drbg_blocklen(drbg) == cnt) {
287 cnt = 0;
Stephan Muellered494d42016-05-31 13:11:57 +0200288 ret = drbg_kcapi_sym(drbg, out, &data);
Stephan Mueller8c987162014-06-28 21:58:24 +0200289 if (ret)
290 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +0200291 }
Stephan Mueller8c987162014-06-28 21:58:24 +0200292 out[cnt] ^= *pos;
293 pos++;
294 cnt++;
295 len--;
Stephan Mueller541af942014-05-31 15:44:17 +0200296 }
Stephan Mueller541af942014-05-31 15:44:17 +0200297 }
Stephan Mueller8c987162014-06-28 21:58:24 +0200298 /* 10.4.3 step 4.2 for last block */
299 if (cnt)
Stephan Muellered494d42016-05-31 13:11:57 +0200300 ret = drbg_kcapi_sym(drbg, out, &data);
Stephan Mueller8c987162014-06-28 21:58:24 +0200301
302 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +0200303}
304
305/*
306 * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
307 * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
308 * the scratchpad is used as follows:
309 * drbg_ctr_update:
310 * temp
311 * start: drbg->scratchpad
312 * length: drbg_statelen(drbg) + drbg_blocklen(drbg)
313 * note: the cipher writing into this variable works
314 * blocklen-wise. Now, when the statelen is not a multiple
315 * of blocklen, the generateion loop below "spills over"
316 * by at most blocklen. Thus, we need to give sufficient
317 * memory.
318 * df_data
319 * start: drbg->scratchpad +
320 * drbg_statelen(drbg) + drbg_blocklen(drbg)
321 * length: drbg_statelen(drbg)
322 *
323 * drbg_ctr_df:
324 * pad
325 * start: df_data + drbg_statelen(drbg)
326 * length: drbg_blocklen(drbg)
327 * iv
328 * start: pad + drbg_blocklen(drbg)
329 * length: drbg_blocklen(drbg)
330 * temp
331 * start: iv + drbg_blocklen(drbg)
Stephan Mueller8fecaad2014-07-01 17:08:48 +0200332 * length: drbg_satelen(drbg) + drbg_blocklen(drbg)
333 * note: temp is the buffer that the BCC function operates
334 * on. BCC operates blockwise. drbg_statelen(drbg)
335 * is sufficient when the DRBG state length is a multiple
336 * of the block size. For AES192 (and maybe other ciphers)
337 * this is not correct and the length for temp is
338 * insufficient (yes, that also means for such ciphers,
339 * the final output of all BCC rounds are truncated).
340 * Therefore, add drbg_blocklen(drbg) to cover all
341 * possibilities.
Stephan Mueller541af942014-05-31 15:44:17 +0200342 */
343
344/* Derivation Function for CTR DRBG as defined in 10.4.2 */
345static int drbg_ctr_df(struct drbg_state *drbg,
346 unsigned char *df_data, size_t bytes_to_return,
Stephan Mueller8c987162014-06-28 21:58:24 +0200347 struct list_head *seedlist)
Stephan Mueller541af942014-05-31 15:44:17 +0200348{
349 int ret = -EFAULT;
350 unsigned char L_N[8];
351 /* S3 is input */
352 struct drbg_string S1, S2, S4, cipherin;
Stephan Mueller8c987162014-06-28 21:58:24 +0200353 LIST_HEAD(bcc_list);
Stephan Mueller541af942014-05-31 15:44:17 +0200354 unsigned char *pad = df_data + drbg_statelen(drbg);
355 unsigned char *iv = pad + drbg_blocklen(drbg);
356 unsigned char *temp = iv + drbg_blocklen(drbg);
357 size_t padlen = 0;
358 unsigned int templen = 0;
359 /* 10.4.2 step 7 */
360 unsigned int i = 0;
361 /* 10.4.2 step 8 */
362 const unsigned char *K = (unsigned char *)
363 "\x00\x01\x02\x03\x04\x05\x06\x07"
364 "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
365 "\x10\x11\x12\x13\x14\x15\x16\x17"
366 "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
367 unsigned char *X;
368 size_t generated_len = 0;
369 size_t inputlen = 0;
Stephan Mueller8c987162014-06-28 21:58:24 +0200370 struct drbg_string *seed = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +0200371
372 memset(pad, 0, drbg_blocklen(drbg));
373 memset(iv, 0, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200374
375 /* 10.4.2 step 1 is implicit as we work byte-wise */
376
377 /* 10.4.2 step 2 */
378 if ((512/8) < bytes_to_return)
379 return -EINVAL;
380
381 /* 10.4.2 step 2 -- calculate the entire length of all input data */
Stephan Mueller8c987162014-06-28 21:58:24 +0200382 list_for_each_entry(seed, seedlist, list)
383 inputlen += seed->len;
Stephan Mueller72f3e002014-08-17 17:37:34 +0200384 drbg_cpu_to_be32(inputlen, &L_N[0]);
Stephan Mueller541af942014-05-31 15:44:17 +0200385
386 /* 10.4.2 step 3 */
Stephan Mueller72f3e002014-08-17 17:37:34 +0200387 drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
Stephan Mueller541af942014-05-31 15:44:17 +0200388
389 /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
390 padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
391 /* wrap the padlen appropriately */
392 if (padlen)
393 padlen = drbg_blocklen(drbg) - padlen;
394 /*
395 * pad / padlen contains the 0x80 byte and the following zero bytes.
396 * As the calculated padlen value only covers the number of zero
397 * bytes, this value has to be incremented by one for the 0x80 byte.
398 */
399 padlen++;
400 pad[0] = 0x80;
401
402 /* 10.4.2 step 4 -- first fill the linked list and then order it */
403 drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200404 list_add_tail(&S1.list, &bcc_list);
Stephan Mueller541af942014-05-31 15:44:17 +0200405 drbg_string_fill(&S2, L_N, sizeof(L_N));
Stephan Mueller8c987162014-06-28 21:58:24 +0200406 list_add_tail(&S2.list, &bcc_list);
407 list_splice_tail(seedlist, &bcc_list);
Stephan Mueller541af942014-05-31 15:44:17 +0200408 drbg_string_fill(&S4, pad, padlen);
Stephan Mueller8c987162014-06-28 21:58:24 +0200409 list_add_tail(&S4.list, &bcc_list);
Stephan Mueller541af942014-05-31 15:44:17 +0200410
411 /* 10.4.2 step 9 */
412 while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
413 /*
414 * 10.4.2 step 9.1 - the padding is implicit as the buffer
415 * holds zeros after allocation -- even the increment of i
416 * is irrelevant as the increment remains within length of i
417 */
Stephan Mueller72f3e002014-08-17 17:37:34 +0200418 drbg_cpu_to_be32(i, iv);
Stephan Mueller541af942014-05-31 15:44:17 +0200419 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
Stephan Mueller8c987162014-06-28 21:58:24 +0200420 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
Stephan Mueller541af942014-05-31 15:44:17 +0200421 if (ret)
422 goto out;
423 /* 10.4.2 step 9.3 */
424 i++;
425 templen += drbg_blocklen(drbg);
426 }
427
428 /* 10.4.2 step 11 */
429 X = temp + (drbg_keylen(drbg));
430 drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
431
432 /* 10.4.2 step 12: overwriting of outval is implemented in next step */
433
434 /* 10.4.2 step 13 */
Stephan Muellered494d42016-05-31 13:11:57 +0200435 drbg_kcapi_symsetkey(drbg, temp);
Stephan Mueller541af942014-05-31 15:44:17 +0200436 while (generated_len < bytes_to_return) {
437 short blocklen = 0;
438 /*
439 * 10.4.2 step 13.1: the truncation of the key length is
440 * implicit as the key is only drbg_blocklen in size based on
441 * the implementation of the cipher function callback
442 */
Stephan Muellered494d42016-05-31 13:11:57 +0200443 ret = drbg_kcapi_sym(drbg, X, &cipherin);
Stephan Mueller541af942014-05-31 15:44:17 +0200444 if (ret)
445 goto out;
446 blocklen = (drbg_blocklen(drbg) <
447 (bytes_to_return - generated_len)) ?
448 drbg_blocklen(drbg) :
449 (bytes_to_return - generated_len);
450 /* 10.4.2 step 13.2 and 14 */
451 memcpy(df_data + generated_len, X, blocklen);
452 generated_len += blocklen;
453 }
454
455 ret = 0;
456
457out:
Herbert Xu1471f092015-01-05 10:44:09 +1100458 memset(iv, 0, drbg_blocklen(drbg));
Stephan Mueller8e0498d2015-04-17 14:54:08 +0200459 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
Herbert Xu1471f092015-01-05 10:44:09 +1100460 memset(pad, 0, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200461 return ret;
462}
463
Stephan Mueller72e7c252014-07-06 02:24:35 +0200464/*
465 * update function of CTR DRBG as defined in 10.2.1.2
466 *
467 * The reseed variable has an enhanced meaning compared to the update
468 * functions of the other DRBGs as follows:
469 * 0 => initial seed from initialization
470 * 1 => reseed via drbg_seed
471 * 2 => first invocation from drbg_ctr_update when addtl is present. In
472 * this case, the df_data scratchpad is not deleted so that it is
473 * available for another calls to prevent calling the DF function
474 * again.
475 * 3 => second invocation from drbg_ctr_update. When the update function
476 * was called with addtl, the df_data memory already contains the
477 * DFed addtl information and we do not need to call DF again.
478 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200479static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
480 int reseed)
Stephan Mueller541af942014-05-31 15:44:17 +0200481{
482 int ret = -EFAULT;
483 /* 10.2.1.2 step 1 */
484 unsigned char *temp = drbg->scratchpad;
485 unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
486 drbg_blocklen(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +0200487
Stephan Mueller72e7c252014-07-06 02:24:35 +0200488 if (3 > reseed)
489 memset(df_data, 0, drbg_statelen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200490
Stephan Mueller35591282016-06-14 07:34:13 +0200491 if (!reseed) {
492 /*
493 * The DRBG uses the CTR mode of the underlying AES cipher. The
494 * CTR mode increments the counter value after the AES operation
495 * but SP800-90A requires that the counter is incremented before
496 * the AES operation. Hence, we increment it at the time we set
497 * it by one.
498 */
499 crypto_inc(drbg->V, drbg_blocklen(drbg));
500
501 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
502 drbg_keylen(drbg));
503 if (ret)
504 goto out;
505 }
506
Stephan Mueller541af942014-05-31 15:44:17 +0200507 /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200508 if (seed) {
509 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
Stephan Mueller541af942014-05-31 15:44:17 +0200510 if (ret)
511 goto out;
512 }
513
Stephan Muellera07203f2016-06-14 07:35:37 +0200514 ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
515 temp, drbg_statelen(drbg));
Stephan Mueller35591282016-06-14 07:34:13 +0200516 if (ret)
517 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +0200518
Stephan Mueller541af942014-05-31 15:44:17 +0200519 /* 10.2.1.2 step 5 */
Stephan Mueller103eb3f2016-06-14 07:36:06 +0200520 ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
Stephan Mueller35591282016-06-14 07:34:13 +0200521 drbg_keylen(drbg));
522 if (ret)
523 goto out;
Stephan Mueller541af942014-05-31 15:44:17 +0200524 /* 10.2.1.2 step 6 */
525 memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
Stephan Mueller35591282016-06-14 07:34:13 +0200526 /* See above: increment counter by one to compensate timing of CTR op */
527 crypto_inc(drbg->V, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200528 ret = 0;
529
530out:
Herbert Xu1471f092015-01-05 10:44:09 +1100531 memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
Stephan Mueller72e7c252014-07-06 02:24:35 +0200532 if (2 != reseed)
Herbert Xu1471f092015-01-05 10:44:09 +1100533 memset(df_data, 0, drbg_statelen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200534 return ret;
535}
536
537/*
538 * scratchpad use: drbg_ctr_update is called independently from
539 * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
540 */
541/* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
542static int drbg_ctr_generate(struct drbg_state *drbg,
543 unsigned char *buf, unsigned int buflen,
Stephan Mueller27e4de22014-07-06 02:25:36 +0200544 struct list_head *addtl)
Stephan Mueller541af942014-05-31 15:44:17 +0200545{
Stephan Mueller35591282016-06-14 07:34:13 +0200546 int ret;
547 int len = min_t(int, buflen, INT_MAX);
Stephan Mueller541af942014-05-31 15:44:17 +0200548
Stephan Mueller541af942014-05-31 15:44:17 +0200549 /* 10.2.1.5.2 step 2 */
Stephan Mueller27e4de22014-07-06 02:25:36 +0200550 if (addtl && !list_empty(addtl)) {
551 ret = drbg_ctr_update(drbg, addtl, 2);
Stephan Mueller541af942014-05-31 15:44:17 +0200552 if (ret)
553 return 0;
554 }
555
556 /* 10.2.1.5.2 step 4.1 */
Stephan Muellera07203f2016-06-14 07:35:37 +0200557 ret = drbg_kcapi_sym_ctr(drbg, drbg->ctr_null_value, DRBG_CTR_NULL_LEN,
558 buf, len);
Stephan Mueller35591282016-06-14 07:34:13 +0200559 if (ret)
560 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +0200561
Stephan Mueller72e7c252014-07-06 02:24:35 +0200562 /* 10.2.1.5.2 step 6 */
563 ret = drbg_ctr_update(drbg, NULL, 3);
Stephan Mueller541af942014-05-31 15:44:17 +0200564 if (ret)
565 len = ret;
566
Stephan Mueller541af942014-05-31 15:44:17 +0200567 return len;
568}
569
Julia Lawalle4bc02a2015-12-07 21:36:57 +0100570static const struct drbg_state_ops drbg_ctr_ops = {
Stephan Mueller541af942014-05-31 15:44:17 +0200571 .update = drbg_ctr_update,
572 .generate = drbg_ctr_generate,
573 .crypto_init = drbg_init_sym_kernel,
574 .crypto_fini = drbg_fini_sym_kernel,
575};
576#endif /* CONFIG_CRYPTO_DRBG_CTR */
577
578/******************************************************************
579 * HMAC DRBG callback functions
580 ******************************************************************/
581
582#if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200583static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
584 const struct list_head *in);
585static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
586 const unsigned char *key);
Stephan Mueller541af942014-05-31 15:44:17 +0200587static int drbg_init_hash_kernel(struct drbg_state *drbg);
588static int drbg_fini_hash_kernel(struct drbg_state *drbg);
589#endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
590
591#ifdef CONFIG_CRYPTO_DRBG_HMAC
Stephan Muellere25e47e2014-07-06 02:23:03 +0200592#define CRYPTO_DRBG_HMAC_STRING "HMAC "
Stephan Mueller0653a7c2014-11-25 09:28:43 +0100593MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
594MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
595MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
596MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
597MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
598MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
599MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
600MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
Stephan Mueller62b62b62014-11-04 03:08:09 +0100601
Stephan Mueller541af942014-05-31 15:44:17 +0200602/* update function of HMAC DRBG as defined in 10.1.2.2 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200603static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
604 int reseed)
Stephan Mueller541af942014-05-31 15:44:17 +0200605{
606 int ret = -EFAULT;
607 int i = 0;
Stephan Mueller8c987162014-06-28 21:58:24 +0200608 struct drbg_string seed1, seed2, vdata;
609 LIST_HEAD(seedlist);
610 LIST_HEAD(vdatalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200611
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200612 if (!reseed) {
Stephan Muellerf072f0e2014-08-17 17:38:58 +0200613 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
Stephan Mueller541af942014-05-31 15:44:17 +0200614 memset(drbg->V, 1, drbg_statelen(drbg));
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200615 drbg_kcapi_hmacsetkey(drbg, drbg->C);
616 }
Stephan Mueller541af942014-05-31 15:44:17 +0200617
618 drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200619 list_add_tail(&seed1.list, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +0200620 /* buffer of seed2 will be filled in for loop below with one byte */
621 drbg_string_fill(&seed2, NULL, 1);
Stephan Mueller8c987162014-06-28 21:58:24 +0200622 list_add_tail(&seed2.list, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +0200623 /* input data of seed is allowed to be NULL at this point */
Stephan Mueller8c987162014-06-28 21:58:24 +0200624 if (seed)
625 list_splice_tail(seed, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +0200626
Stephan Mueller8c987162014-06-28 21:58:24 +0200627 drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
628 list_add_tail(&vdata.list, &vdatalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200629 for (i = 2; 0 < i; i--) {
630 /* first round uses 0x0, second 0x1 */
631 unsigned char prefix = DRBG_PREFIX0;
632 if (1 == i)
633 prefix = DRBG_PREFIX1;
634 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
635 seed2.buf = &prefix;
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200636 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +0200637 if (ret)
638 return ret;
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200639 drbg_kcapi_hmacsetkey(drbg, drbg->C);
Stephan Mueller541af942014-05-31 15:44:17 +0200640
641 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200642 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200643 if (ret)
644 return ret;
645
646 /* 10.1.2.2 step 3 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200647 if (!seed)
Stephan Mueller541af942014-05-31 15:44:17 +0200648 return ret;
649 }
650
651 return 0;
652}
653
654/* generate function of HMAC DRBG as defined in 10.1.2.5 */
655static int drbg_hmac_generate(struct drbg_state *drbg,
656 unsigned char *buf,
657 unsigned int buflen,
Stephan Mueller27e4de22014-07-06 02:25:36 +0200658 struct list_head *addtl)
Stephan Mueller541af942014-05-31 15:44:17 +0200659{
660 int len = 0;
661 int ret = 0;
662 struct drbg_string data;
Stephan Mueller8c987162014-06-28 21:58:24 +0200663 LIST_HEAD(datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200664
665 /* 10.1.2.5 step 2 */
Stephan Mueller27e4de22014-07-06 02:25:36 +0200666 if (addtl && !list_empty(addtl)) {
667 ret = drbg_hmac_update(drbg, addtl, 1);
Stephan Mueller541af942014-05-31 15:44:17 +0200668 if (ret)
669 return ret;
670 }
671
672 drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200673 list_add_tail(&data.list, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200674 while (len < buflen) {
675 unsigned int outlen = 0;
676 /* 10.1.2.5 step 4.1 */
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200677 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200678 if (ret)
679 return ret;
680 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
681 drbg_blocklen(drbg) : (buflen - len);
Stephan Mueller541af942014-05-31 15:44:17 +0200682
683 /* 10.1.2.5 step 4.2 */
684 memcpy(buf + len, drbg->V, outlen);
685 len += outlen;
686 }
687
688 /* 10.1.2.5 step 6 */
Stephan Mueller27e4de22014-07-06 02:25:36 +0200689 if (addtl && !list_empty(addtl))
690 ret = drbg_hmac_update(drbg, addtl, 1);
691 else
Stephan Mueller8c987162014-06-28 21:58:24 +0200692 ret = drbg_hmac_update(drbg, NULL, 1);
Stephan Mueller541af942014-05-31 15:44:17 +0200693 if (ret)
694 return ret;
695
696 return len;
697}
698
Julia Lawalle4bc02a2015-12-07 21:36:57 +0100699static const struct drbg_state_ops drbg_hmac_ops = {
Stephan Mueller541af942014-05-31 15:44:17 +0200700 .update = drbg_hmac_update,
701 .generate = drbg_hmac_generate,
702 .crypto_init = drbg_init_hash_kernel,
703 .crypto_fini = drbg_fini_hash_kernel,
Stephan Mueller541af942014-05-31 15:44:17 +0200704};
705#endif /* CONFIG_CRYPTO_DRBG_HMAC */
706
707/******************************************************************
708 * Hash DRBG callback functions
709 ******************************************************************/
710
711#ifdef CONFIG_CRYPTO_DRBG_HASH
Stephan Muellere25e47e2014-07-06 02:23:03 +0200712#define CRYPTO_DRBG_HASH_STRING "HASH "
Stephan Mueller0653a7c2014-11-25 09:28:43 +0100713MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
714MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
715MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
716MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
717MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
718MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
719MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
720MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
Stephan Mueller62b62b62014-11-04 03:08:09 +0100721
Stephan Mueller541af942014-05-31 15:44:17 +0200722/*
Stephan Mueller41a84982014-10-14 21:50:13 +0200723 * Increment buffer
724 *
725 * @dst buffer to increment
726 * @add value to add
727 */
728static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
729 const unsigned char *add, size_t addlen)
730{
731 /* implied: dstlen > addlen */
732 unsigned char *dstptr;
733 const unsigned char *addptr;
734 unsigned int remainder = 0;
735 size_t len = addlen;
736
737 dstptr = dst + (dstlen-1);
738 addptr = add + (addlen-1);
739 while (len) {
740 remainder += *dstptr + *addptr;
741 *dstptr = remainder & 0xff;
742 remainder >>= 8;
743 len--; dstptr--; addptr--;
744 }
745 len = dstlen - addlen;
746 while (len && remainder > 0) {
747 remainder = *dstptr + 1;
748 *dstptr = remainder & 0xff;
749 remainder >>= 8;
750 len--; dstptr--;
751 }
752}
753
754/*
Stephan Mueller541af942014-05-31 15:44:17 +0200755 * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
756 * interlinked, the scratchpad is used as follows:
757 * drbg_hash_update
758 * start: drbg->scratchpad
759 * length: drbg_statelen(drbg)
760 * drbg_hash_df:
761 * start: drbg->scratchpad + drbg_statelen(drbg)
762 * length: drbg_blocklen(drbg)
763 *
764 * drbg_hash_process_addtl uses the scratchpad, but fully completes
765 * before either of the functions mentioned before are invoked. Therefore,
766 * drbg_hash_process_addtl does not need to be specifically considered.
767 */
768
769/* Derivation Function for Hash DRBG as defined in 10.4.1 */
770static int drbg_hash_df(struct drbg_state *drbg,
771 unsigned char *outval, size_t outlen,
Stephan Mueller8c987162014-06-28 21:58:24 +0200772 struct list_head *entropylist)
Stephan Mueller541af942014-05-31 15:44:17 +0200773{
774 int ret = 0;
775 size_t len = 0;
776 unsigned char input[5];
777 unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
Stephan Mueller8c987162014-06-28 21:58:24 +0200778 struct drbg_string data;
Stephan Mueller541af942014-05-31 15:44:17 +0200779
Stephan Mueller541af942014-05-31 15:44:17 +0200780 /* 10.4.1 step 3 */
781 input[0] = 1;
Stephan Mueller72f3e002014-08-17 17:37:34 +0200782 drbg_cpu_to_be32((outlen * 8), &input[1]);
Stephan Mueller541af942014-05-31 15:44:17 +0200783
784 /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
Stephan Mueller8c987162014-06-28 21:58:24 +0200785 drbg_string_fill(&data, input, 5);
786 list_add(&data.list, entropylist);
Stephan Mueller541af942014-05-31 15:44:17 +0200787
788 /* 10.4.1 step 4 */
789 while (len < outlen) {
790 short blocklen = 0;
791 /* 10.4.1 step 4.1 */
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200792 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
Stephan Mueller541af942014-05-31 15:44:17 +0200793 if (ret)
794 goto out;
795 /* 10.4.1 step 4.2 */
796 input[0]++;
797 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
798 drbg_blocklen(drbg) : (outlen - len);
799 memcpy(outval + len, tmp, blocklen);
800 len += blocklen;
801 }
802
803out:
Herbert Xu1471f092015-01-05 10:44:09 +1100804 memset(tmp, 0, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200805 return ret;
806}
807
808/* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200809static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
Stephan Mueller541af942014-05-31 15:44:17 +0200810 int reseed)
811{
812 int ret = 0;
813 struct drbg_string data1, data2;
Stephan Mueller8c987162014-06-28 21:58:24 +0200814 LIST_HEAD(datalist);
815 LIST_HEAD(datalist2);
Stephan Mueller541af942014-05-31 15:44:17 +0200816 unsigned char *V = drbg->scratchpad;
817 unsigned char prefix = DRBG_PREFIX1;
818
Stephan Mueller541af942014-05-31 15:44:17 +0200819 if (!seed)
820 return -EINVAL;
821
822 if (reseed) {
823 /* 10.1.1.3 step 1 */
824 memcpy(V, drbg->V, drbg_statelen(drbg));
825 drbg_string_fill(&data1, &prefix, 1);
Stephan Mueller8c987162014-06-28 21:58:24 +0200826 list_add_tail(&data1.list, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200827 drbg_string_fill(&data2, V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200828 list_add_tail(&data2.list, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200829 }
Stephan Mueller8c987162014-06-28 21:58:24 +0200830 list_splice_tail(seed, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200831
832 /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200833 ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200834 if (ret)
835 goto out;
836
837 /* 10.1.1.2 / 10.1.1.3 step 4 */
838 prefix = DRBG_PREFIX0;
839 drbg_string_fill(&data1, &prefix, 1);
Stephan Mueller8c987162014-06-28 21:58:24 +0200840 list_add_tail(&data1.list, &datalist2);
Stephan Mueller541af942014-05-31 15:44:17 +0200841 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200842 list_add_tail(&data2.list, &datalist2);
Stephan Mueller541af942014-05-31 15:44:17 +0200843 /* 10.1.1.2 / 10.1.1.3 step 4 */
Stephan Mueller8c987162014-06-28 21:58:24 +0200844 ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
Stephan Mueller541af942014-05-31 15:44:17 +0200845
846out:
Herbert Xu1471f092015-01-05 10:44:09 +1100847 memset(drbg->scratchpad, 0, drbg_statelen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200848 return ret;
849}
850
851/* processing of additional information string for Hash DRBG */
852static int drbg_hash_process_addtl(struct drbg_state *drbg,
Stephan Mueller27e4de22014-07-06 02:25:36 +0200853 struct list_head *addtl)
Stephan Mueller541af942014-05-31 15:44:17 +0200854{
855 int ret = 0;
856 struct drbg_string data1, data2;
Stephan Mueller8c987162014-06-28 21:58:24 +0200857 LIST_HEAD(datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200858 unsigned char prefix = DRBG_PREFIX2;
859
Stephan Mueller541af942014-05-31 15:44:17 +0200860 /* 10.1.1.4 step 2 */
Stephan Mueller27e4de22014-07-06 02:25:36 +0200861 if (!addtl || list_empty(addtl))
Stephan Mueller541af942014-05-31 15:44:17 +0200862 return 0;
863
864 /* 10.1.1.4 step 2a */
865 drbg_string_fill(&data1, &prefix, 1);
866 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200867 list_add_tail(&data1.list, &datalist);
868 list_add_tail(&data2.list, &datalist);
Stephan Mueller27e4de22014-07-06 02:25:36 +0200869 list_splice_tail(addtl, &datalist);
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200870 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200871 if (ret)
872 goto out;
873
874 /* 10.1.1.4 step 2b */
875 drbg_add_buf(drbg->V, drbg_statelen(drbg),
876 drbg->scratchpad, drbg_blocklen(drbg));
877
878out:
Herbert Xu1471f092015-01-05 10:44:09 +1100879 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200880 return ret;
881}
882
883/* Hashgen defined in 10.1.1.4 */
884static int drbg_hash_hashgen(struct drbg_state *drbg,
885 unsigned char *buf,
886 unsigned int buflen)
887{
888 int len = 0;
889 int ret = 0;
890 unsigned char *src = drbg->scratchpad;
891 unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
892 struct drbg_string data;
Stephan Mueller8c987162014-06-28 21:58:24 +0200893 LIST_HEAD(datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200894
Stephan Mueller541af942014-05-31 15:44:17 +0200895 /* 10.1.1.4 step hashgen 2 */
896 memcpy(src, drbg->V, drbg_statelen(drbg));
897
898 drbg_string_fill(&data, src, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200899 list_add_tail(&data.list, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200900 while (len < buflen) {
901 unsigned int outlen = 0;
902 /* 10.1.1.4 step hashgen 4.1 */
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200903 ret = drbg_kcapi_hash(drbg, dst, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200904 if (ret) {
905 len = ret;
906 goto out;
907 }
908 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
909 drbg_blocklen(drbg) : (buflen - len);
Stephan Mueller541af942014-05-31 15:44:17 +0200910 /* 10.1.1.4 step hashgen 4.2 */
911 memcpy(buf + len, dst, outlen);
912 len += outlen;
913 /* 10.1.1.4 hashgen step 4.3 */
914 if (len < buflen)
Stephan Mueller41a84982014-10-14 21:50:13 +0200915 crypto_inc(src, drbg_statelen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200916 }
917
918out:
Herbert Xu1471f092015-01-05 10:44:09 +1100919 memset(drbg->scratchpad, 0,
Stephan Mueller541af942014-05-31 15:44:17 +0200920 (drbg_statelen(drbg) + drbg_blocklen(drbg)));
921 return len;
922}
923
924/* generate function for Hash DRBG as defined in 10.1.1.4 */
925static int drbg_hash_generate(struct drbg_state *drbg,
926 unsigned char *buf, unsigned int buflen,
Stephan Mueller27e4de22014-07-06 02:25:36 +0200927 struct list_head *addtl)
Stephan Mueller541af942014-05-31 15:44:17 +0200928{
929 int len = 0;
930 int ret = 0;
Stephan Mueller72f3e002014-08-17 17:37:34 +0200931 union {
932 unsigned char req[8];
Stephan Mueller7c8ae032014-08-26 09:32:24 +0200933 __be64 req_int;
Stephan Mueller72f3e002014-08-17 17:37:34 +0200934 } u;
Stephan Mueller541af942014-05-31 15:44:17 +0200935 unsigned char prefix = DRBG_PREFIX3;
936 struct drbg_string data1, data2;
Stephan Mueller8c987162014-06-28 21:58:24 +0200937 LIST_HEAD(datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200938
939 /* 10.1.1.4 step 2 */
940 ret = drbg_hash_process_addtl(drbg, addtl);
941 if (ret)
942 return ret;
943 /* 10.1.1.4 step 3 */
944 len = drbg_hash_hashgen(drbg, buf, buflen);
945
946 /* this is the value H as documented in 10.1.1.4 */
Stephan Mueller541af942014-05-31 15:44:17 +0200947 /* 10.1.1.4 step 4 */
948 drbg_string_fill(&data1, &prefix, 1);
Stephan Mueller8c987162014-06-28 21:58:24 +0200949 list_add_tail(&data1.list, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200950 drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
Stephan Mueller8c987162014-06-28 21:58:24 +0200951 list_add_tail(&data2.list, &datalist);
Stephan Mueller4218ebe2016-03-28 16:47:55 +0200952 ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
Stephan Mueller541af942014-05-31 15:44:17 +0200953 if (ret) {
954 len = ret;
955 goto out;
956 }
957
958 /* 10.1.1.4 step 5 */
959 drbg_add_buf(drbg->V, drbg_statelen(drbg),
960 drbg->scratchpad, drbg_blocklen(drbg));
961 drbg_add_buf(drbg->V, drbg_statelen(drbg),
962 drbg->C, drbg_statelen(drbg));
Stephan Mueller72f3e002014-08-17 17:37:34 +0200963 u.req_int = cpu_to_be64(drbg->reseed_ctr);
964 drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
Stephan Mueller541af942014-05-31 15:44:17 +0200965
966out:
Herbert Xu1471f092015-01-05 10:44:09 +1100967 memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
Stephan Mueller541af942014-05-31 15:44:17 +0200968 return len;
969}
970
971/*
972 * scratchpad usage: as update and generate are used isolated, both
973 * can use the scratchpad
974 */
Julia Lawalle4bc02a2015-12-07 21:36:57 +0100975static const struct drbg_state_ops drbg_hash_ops = {
Stephan Mueller541af942014-05-31 15:44:17 +0200976 .update = drbg_hash_update,
977 .generate = drbg_hash_generate,
978 .crypto_init = drbg_init_hash_kernel,
979 .crypto_fini = drbg_fini_hash_kernel,
980};
981#endif /* CONFIG_CRYPTO_DRBG_HASH */
982
983/******************************************************************
984 * Functions common for DRBG implementations
985 ******************************************************************/
986
Stephan Mueller3d6a5f72015-05-25 15:09:14 +0200987static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
988 int reseed)
989{
990 int ret = drbg->d_ops->update(drbg, seed, reseed);
991
992 if (ret)
993 return ret;
994
995 drbg->seeded = true;
996 /* 10.1.1.2 / 10.1.1.3 step 5 */
997 drbg->reseed_ctr = 1;
998
999 return ret;
1000}
1001
Stephan Mueller4c787992015-05-25 15:09:36 +02001002static void drbg_async_seed(struct work_struct *work)
1003{
1004 struct drbg_string data;
1005 LIST_HEAD(seedlist);
1006 struct drbg_state *drbg = container_of(work, struct drbg_state,
1007 seed_work);
Stephan Mueller57225e62015-06-09 21:55:38 +08001008 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1009 unsigned char entropy[32];
Stephan Mueller4c787992015-05-25 15:09:36 +02001010
Stephan Mueller57225e62015-06-09 21:55:38 +08001011 BUG_ON(!entropylen);
1012 BUG_ON(entropylen > sizeof(entropy));
1013 get_random_bytes(entropy, entropylen);
Stephan Mueller4c787992015-05-25 15:09:36 +02001014
Stephan Mueller57225e62015-06-09 21:55:38 +08001015 drbg_string_fill(&data, entropy, entropylen);
Stephan Mueller4c787992015-05-25 15:09:36 +02001016 list_add_tail(&data.list, &seedlist);
Stephan Mueller57225e62015-06-09 21:55:38 +08001017
Stephan Mueller4c787992015-05-25 15:09:36 +02001018 mutex_lock(&drbg->drbg_mutex);
Stephan Mueller57225e62015-06-09 21:55:38 +08001019
1020 /* If nonblocking pool is initialized, deactivate Jitter RNG */
1021 crypto_free_rng(drbg->jent);
1022 drbg->jent = NULL;
1023
1024 /* Set seeded to false so that if __drbg_seed fails the
1025 * next generate call will trigger a reseed.
1026 */
1027 drbg->seeded = false;
1028
1029 __drbg_seed(drbg, &seedlist, true);
1030
Stephan Mueller42ea5072015-06-10 03:33:37 +02001031 if (drbg->seeded)
1032 drbg->reseed_threshold = drbg_max_requests(drbg);
1033
Stephan Mueller4c787992015-05-25 15:09:36 +02001034 mutex_unlock(&drbg->drbg_mutex);
Stephan Mueller57225e62015-06-09 21:55:38 +08001035
1036 memzero_explicit(entropy, entropylen);
Stephan Mueller4c787992015-05-25 15:09:36 +02001037}
1038
Stephan Mueller541af942014-05-31 15:44:17 +02001039/*
1040 * Seeding or reseeding of the DRBG
1041 *
1042 * @drbg: DRBG state struct
1043 * @pers: personalization / additional information buffer
1044 * @reseed: 0 for initial seed process, 1 for reseeding
1045 *
1046 * return:
1047 * 0 on success
1048 * error value otherwise
1049 */
1050static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1051 bool reseed)
1052{
Stephan Mueller57225e62015-06-09 21:55:38 +08001053 int ret;
1054 unsigned char entropy[((32 + 16) * 2)];
1055 unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
Stephan Mueller541af942014-05-31 15:44:17 +02001056 struct drbg_string data1;
Stephan Mueller8c987162014-06-28 21:58:24 +02001057 LIST_HEAD(seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +02001058
1059 /* 9.1 / 9.2 / 9.3.1 step 3 */
1060 if (pers && pers->len > (drbg_max_addtl(drbg))) {
Stephan Muellera9089572014-07-06 02:24:03 +02001061 pr_devel("DRBG: personalization string too long %zu\n",
Stephan Mueller541af942014-05-31 15:44:17 +02001062 pers->len);
1063 return -EINVAL;
1064 }
1065
Herbert Xu8fded592015-04-21 10:46:41 +08001066 if (list_empty(&drbg->test_data.list)) {
1067 drbg_string_fill(&data1, drbg->test_data.buf,
1068 drbg->test_data.len);
Stephan Mueller541af942014-05-31 15:44:17 +02001069 pr_devel("DRBG: using test entropy\n");
1070 } else {
Stephan Mueller57225e62015-06-09 21:55:38 +08001071 /*
1072 * Gather entropy equal to the security strength of the DRBG.
1073 * With a derivation function, a nonce is required in addition
1074 * to the entropy. A nonce must be at least 1/2 of the security
1075 * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1076 * of the strength. The consideration of a nonce is only
1077 * applicable during initial seeding.
1078 */
1079 BUG_ON(!entropylen);
1080 if (!reseed)
1081 entropylen = ((entropylen + 1) / 2) * 3;
1082 BUG_ON((entropylen * 2) > sizeof(entropy));
Stephan Muellerb8ec5ba2015-05-25 15:09:59 +02001083
Stephan Mueller57225e62015-06-09 21:55:38 +08001084 /* Get seed from in-kernel /dev/urandom */
1085 get_random_bytes(entropy, entropylen);
1086
1087 if (!drbg->jent) {
1088 drbg_string_fill(&data1, entropy, entropylen);
1089 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1090 entropylen);
Stephan Muellerb8ec5ba2015-05-25 15:09:59 +02001091 } else {
Stephan Mueller57225e62015-06-09 21:55:38 +08001092 /* Get seed from Jitter RNG */
1093 ret = crypto_rng_get_bytes(drbg->jent,
1094 entropy + entropylen,
1095 entropylen);
1096 if (ret) {
1097 pr_devel("DRBG: jent failed with %d\n", ret);
1098 return ret;
1099 }
1100
1101 drbg_string_fill(&data1, entropy, entropylen * 2);
1102 pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1103 entropylen * 2);
Stephan Muellerb8ec5ba2015-05-25 15:09:59 +02001104 }
Stephan Mueller541af942014-05-31 15:44:17 +02001105 }
Stephan Mueller8c987162014-06-28 21:58:24 +02001106 list_add_tail(&data1.list, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +02001107
1108 /*
1109 * concatenation of entropy with personalization str / addtl input)
1110 * the variable pers is directly handed in by the caller, so check its
1111 * contents whether it is appropriate
1112 */
Stephan Mueller8c987162014-06-28 21:58:24 +02001113 if (pers && pers->buf && 0 < pers->len) {
1114 list_add_tail(&pers->list, &seedlist);
Stephan Mueller541af942014-05-31 15:44:17 +02001115 pr_devel("DRBG: using personalization string\n");
1116 }
1117
Stephan Muellere6c02442014-08-17 17:39:31 +02001118 if (!reseed) {
1119 memset(drbg->V, 0, drbg_statelen(drbg));
1120 memset(drbg->C, 0, drbg_statelen(drbg));
1121 }
1122
Stephan Mueller3d6a5f72015-05-25 15:09:14 +02001123 ret = __drbg_seed(drbg, &seedlist, reseed);
1124
Stephan Mueller57225e62015-06-09 21:55:38 +08001125 memzero_explicit(entropy, entropylen * 2);
Stephan Mueller541af942014-05-31 15:44:17 +02001126
Stephan Mueller541af942014-05-31 15:44:17 +02001127 return ret;
1128}
1129
1130/* Free all substructures in a DRBG state without the DRBG state structure */
1131static inline void drbg_dealloc_state(struct drbg_state *drbg)
1132{
1133 if (!drbg)
1134 return;
Stephan Mueller46f64f62014-08-17 17:37:59 +02001135 kzfree(drbg->V);
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001136 drbg->Vbuf = NULL;
Stephan Mueller46f64f62014-08-17 17:37:59 +02001137 kzfree(drbg->C);
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001138 drbg->Cbuf = NULL;
1139 kzfree(drbg->scratchpadbuf);
1140 drbg->scratchpadbuf = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +02001141 drbg->reseed_ctr = 0;
Herbert Xu2a57e422015-04-20 11:29:15 +08001142 drbg->d_ops = NULL;
1143 drbg->core = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +02001144}
1145
1146/*
1147 * Allocate all sub-structures for a DRBG state.
1148 * The DRBG state structure must already be allocated.
1149 */
1150static inline int drbg_alloc_state(struct drbg_state *drbg)
1151{
1152 int ret = -ENOMEM;
1153 unsigned int sb_size = 0;
1154
Herbert Xu2a57e422015-04-20 11:29:15 +08001155 switch (drbg->core->flags & DRBG_TYPE_MASK) {
1156#ifdef CONFIG_CRYPTO_DRBG_HMAC
1157 case DRBG_HMAC:
1158 drbg->d_ops = &drbg_hmac_ops;
1159 break;
1160#endif /* CONFIG_CRYPTO_DRBG_HMAC */
1161#ifdef CONFIG_CRYPTO_DRBG_HASH
1162 case DRBG_HASH:
1163 drbg->d_ops = &drbg_hash_ops;
1164 break;
1165#endif /* CONFIG_CRYPTO_DRBG_HASH */
1166#ifdef CONFIG_CRYPTO_DRBG_CTR
1167 case DRBG_CTR:
1168 drbg->d_ops = &drbg_ctr_ops;
1169 break;
1170#endif /* CONFIG_CRYPTO_DRBG_CTR */
1171 default:
1172 ret = -EOPNOTSUPP;
1173 goto err;
1174 }
1175
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001176 ret = drbg->d_ops->crypto_init(drbg);
1177 if (ret < 0)
Stephan Mueller541af942014-05-31 15:44:17 +02001178 goto err;
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001179
1180 drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1181 if (!drbg->Vbuf)
1182 goto fini;
1183 drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1184 drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1185 if (!drbg->Cbuf)
1186 goto fini;
1187 drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
Stephan Mueller541af942014-05-31 15:44:17 +02001188 /* scratchpad is only generated for CTR and Hash */
1189 if (drbg->core->flags & DRBG_HMAC)
1190 sb_size = 0;
1191 else if (drbg->core->flags & DRBG_CTR)
1192 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1193 drbg_statelen(drbg) + /* df_data */
1194 drbg_blocklen(drbg) + /* pad */
1195 drbg_blocklen(drbg) + /* iv */
Stephan Mueller8fecaad2014-07-01 17:08:48 +02001196 drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
Stephan Mueller541af942014-05-31 15:44:17 +02001197 else
1198 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1199
1200 if (0 < sb_size) {
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001201 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1202 if (!drbg->scratchpadbuf)
1203 goto fini;
1204 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
Stephan Mueller541af942014-05-31 15:44:17 +02001205 }
Stephan Mueller3d6a5f72015-05-25 15:09:14 +02001206
Stephan Mueller541af942014-05-31 15:44:17 +02001207 return 0;
1208
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001209fini:
1210 drbg->d_ops->crypto_fini(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +02001211err:
1212 drbg_dealloc_state(drbg);
1213 return ret;
1214}
1215
Stephan Mueller541af942014-05-31 15:44:17 +02001216/*************************************************************************
1217 * DRBG interface functions
1218 *************************************************************************/
1219
1220/*
1221 * DRBG generate function as required by SP800-90A - this function
1222 * generates random numbers
1223 *
1224 * @drbg DRBG state handle
1225 * @buf Buffer where to store the random numbers -- the buffer must already
1226 * be pre-allocated by caller
1227 * @buflen Length of output buffer - this value defines the number of random
1228 * bytes pulled from DRBG
1229 * @addtl Additional input that is mixed into state, may be NULL -- note
1230 * the entropy is pulled by the DRBG internally unconditionally
1231 * as defined in SP800-90A. The additional input is mixed into
1232 * the state in addition to the pulled entropy.
1233 *
Stephan Muellercde001e2015-03-06 08:26:31 +01001234 * return: 0 when all bytes are generated; < 0 in case of an error
Stephan Mueller541af942014-05-31 15:44:17 +02001235 */
1236static int drbg_generate(struct drbg_state *drbg,
1237 unsigned char *buf, unsigned int buflen,
1238 struct drbg_string *addtl)
1239{
1240 int len = 0;
Stephan Mueller27e4de22014-07-06 02:25:36 +02001241 LIST_HEAD(addtllist);
Stephan Mueller541af942014-05-31 15:44:17 +02001242
Herbert Xu2a57e422015-04-20 11:29:15 +08001243 if (!drbg->core) {
1244 pr_devel("DRBG: not yet seeded\n");
1245 return -EINVAL;
1246 }
Stephan Mueller541af942014-05-31 15:44:17 +02001247 if (0 == buflen || !buf) {
1248 pr_devel("DRBG: no output buffer provided\n");
1249 return -EINVAL;
1250 }
1251 if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1252 pr_devel("DRBG: wrong format of additional information\n");
1253 return -EINVAL;
1254 }
1255
Stephan Mueller541af942014-05-31 15:44:17 +02001256 /* 9.3.1 step 2 */
1257 len = -EINVAL;
Stephan Mueller76899a42015-04-18 19:36:17 +02001258 if (buflen > (drbg_max_request_bytes(drbg))) {
Stephan Mueller541af942014-05-31 15:44:17 +02001259 pr_devel("DRBG: requested random numbers too large %u\n",
1260 buflen);
1261 goto err;
1262 }
1263
1264 /* 9.3.1 step 3 is implicit with the chosen DRBG */
1265
1266 /* 9.3.1 step 4 */
Stephan Mueller76899a42015-04-18 19:36:17 +02001267 if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
Stephan Mueller541af942014-05-31 15:44:17 +02001268 pr_devel("DRBG: additional information string too long %zu\n",
1269 addtl->len);
1270 goto err;
1271 }
1272 /* 9.3.1 step 5 is implicit with the chosen DRBG */
1273
1274 /*
1275 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1276 * here. The spec is a bit convoluted here, we make it simpler.
1277 */
Stephan Mueller42ea5072015-06-10 03:33:37 +02001278 if (drbg->reseed_threshold < drbg->reseed_ctr)
Stephan Mueller76899a42015-04-18 19:36:17 +02001279 drbg->seeded = false;
Stephan Mueller541af942014-05-31 15:44:17 +02001280
Stephan Mueller76899a42015-04-18 19:36:17 +02001281 if (drbg->pr || !drbg->seeded) {
Stephan Mueller541af942014-05-31 15:44:17 +02001282 pr_devel("DRBG: reseeding before generation (prediction "
1283 "resistance: %s, state %s)\n",
1284 drbg->pr ? "true" : "false",
1285 drbg->seeded ? "seeded" : "unseeded");
1286 /* 9.3.1 steps 7.1 through 7.3 */
Stephan Mueller76899a42015-04-18 19:36:17 +02001287 len = drbg_seed(drbg, addtl, true);
Stephan Mueller541af942014-05-31 15:44:17 +02001288 if (len)
1289 goto err;
1290 /* 9.3.1 step 7.4 */
1291 addtl = NULL;
1292 }
Stephan Mueller27e4de22014-07-06 02:25:36 +02001293
Stephan Mueller27e4de22014-07-06 02:25:36 +02001294 if (addtl && 0 < addtl->len)
1295 list_add_tail(&addtl->list, &addtllist);
Stephan Mueller541af942014-05-31 15:44:17 +02001296 /* 9.3.1 step 8 and 10 */
Stephan Mueller76899a42015-04-18 19:36:17 +02001297 len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
Stephan Mueller541af942014-05-31 15:44:17 +02001298
1299 /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
Stephan Mueller76899a42015-04-18 19:36:17 +02001300 drbg->reseed_ctr++;
Stephan Mueller541af942014-05-31 15:44:17 +02001301 if (0 >= len)
1302 goto err;
1303
1304 /*
1305 * Section 11.3.3 requires to re-perform self tests after some
1306 * generated random numbers. The chosen value after which self
1307 * test is performed is arbitrary, but it should be reasonable.
1308 * However, we do not perform the self tests because of the following
1309 * reasons: it is mathematically impossible that the initial self tests
1310 * were successfully and the following are not. If the initial would
1311 * pass and the following would not, the kernel integrity is violated.
1312 * In this case, the entire kernel operation is questionable and it
1313 * is unlikely that the integrity violation only affects the
1314 * correct operation of the DRBG.
1315 *
1316 * Albeit the following code is commented out, it is provided in
1317 * case somebody has a need to implement the test of 11.3.3.
1318 */
1319#if 0
Stephan Mueller76899a42015-04-18 19:36:17 +02001320 if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
Stephan Mueller541af942014-05-31 15:44:17 +02001321 int err = 0;
1322 pr_devel("DRBG: start to perform self test\n");
1323 if (drbg->core->flags & DRBG_HMAC)
1324 err = alg_test("drbg_pr_hmac_sha256",
1325 "drbg_pr_hmac_sha256", 0, 0);
1326 else if (drbg->core->flags & DRBG_CTR)
1327 err = alg_test("drbg_pr_ctr_aes128",
1328 "drbg_pr_ctr_aes128", 0, 0);
1329 else
1330 err = alg_test("drbg_pr_sha256",
1331 "drbg_pr_sha256", 0, 0);
1332 if (err) {
1333 pr_err("DRBG: periodical self test failed\n");
1334 /*
1335 * uninstantiate implies that from now on, only errors
1336 * are returned when reusing this DRBG cipher handle
1337 */
1338 drbg_uninstantiate(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +02001339 return 0;
1340 } else {
1341 pr_devel("DRBG: self test successful\n");
1342 }
1343 }
1344#endif
1345
Stephan Muellercde001e2015-03-06 08:26:31 +01001346 /*
1347 * All operations were successful, return 0 as mandated by
1348 * the kernel crypto API interface.
1349 */
1350 len = 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001351err:
Stephan Mueller541af942014-05-31 15:44:17 +02001352 return len;
1353}
1354
1355/*
1356 * Wrapper around drbg_generate which can pull arbitrary long strings
1357 * from the DRBG without hitting the maximum request limitation.
1358 *
1359 * Parameters: see drbg_generate
1360 * Return codes: see drbg_generate -- if one drbg_generate request fails,
1361 * the entire drbg_generate_long request fails
1362 */
1363static int drbg_generate_long(struct drbg_state *drbg,
1364 unsigned char *buf, unsigned int buflen,
1365 struct drbg_string *addtl)
1366{
Stephan Mueller082eb102015-04-18 19:35:45 +02001367 unsigned int len = 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001368 unsigned int slice = 0;
1369 do {
Stephan Mueller082eb102015-04-18 19:35:45 +02001370 int err = 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001371 unsigned int chunk = 0;
1372 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1373 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
Stephan Mueller76899a42015-04-18 19:36:17 +02001374 mutex_lock(&drbg->drbg_mutex);
Stephan Mueller082eb102015-04-18 19:35:45 +02001375 err = drbg_generate(drbg, buf + len, chunk, addtl);
Stephan Mueller76899a42015-04-18 19:36:17 +02001376 mutex_unlock(&drbg->drbg_mutex);
Stephan Mueller082eb102015-04-18 19:35:45 +02001377 if (0 > err)
1378 return err;
1379 len += chunk;
Stephan Muellerce5481d2014-07-31 21:47:33 +02001380 } while (slice > 0 && (len < buflen));
Stephan Mueller082eb102015-04-18 19:35:45 +02001381 return 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001382}
1383
Stephan Mueller57225e62015-06-09 21:55:38 +08001384static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
1385{
1386 struct drbg_state *drbg = container_of(rdy, struct drbg_state,
1387 random_ready);
1388
1389 schedule_work(&drbg->seed_work);
1390}
1391
1392static int drbg_prepare_hrng(struct drbg_state *drbg)
1393{
1394 int err;
1395
1396 /* We do not need an HRNG in test mode. */
1397 if (list_empty(&drbg->test_data.list))
1398 return 0;
1399
1400 INIT_WORK(&drbg->seed_work, drbg_async_seed);
1401
1402 drbg->random_ready.owner = THIS_MODULE;
1403 drbg->random_ready.func = drbg_schedule_async_seed;
1404
1405 err = add_random_ready_callback(&drbg->random_ready);
1406
1407 switch (err) {
1408 case 0:
1409 break;
1410
1411 case -EALREADY:
1412 err = 0;
1413 /* fall through */
1414
1415 default:
1416 drbg->random_ready.func = NULL;
1417 return err;
1418 }
1419
1420 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1421
Stephan Mueller42ea5072015-06-10 03:33:37 +02001422 /*
1423 * Require frequent reseeds until the seed source is fully
1424 * initialized.
1425 */
1426 drbg->reseed_threshold = 50;
1427
Stephan Mueller57225e62015-06-09 21:55:38 +08001428 return err;
1429}
1430
Stephan Mueller541af942014-05-31 15:44:17 +02001431/*
1432 * DRBG instantiation function as required by SP800-90A - this function
1433 * sets up the DRBG handle, performs the initial seeding and all sanity
1434 * checks required by SP800-90A
1435 *
1436 * @drbg memory of state -- if NULL, new memory is allocated
1437 * @pers Personalization string that is mixed into state, may be NULL -- note
1438 * the entropy is pulled by the DRBG internally unconditionally
1439 * as defined in SP800-90A. The additional input is mixed into
1440 * the state in addition to the pulled entropy.
1441 * @coreref reference to core
1442 * @pr prediction resistance enabled
1443 *
1444 * return
1445 * 0 on success
1446 * error value otherwise
1447 */
1448static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1449 int coreref, bool pr)
1450{
Herbert Xu2a57e422015-04-20 11:29:15 +08001451 int ret;
1452 bool reseed = true;
Stephan Mueller541af942014-05-31 15:44:17 +02001453
1454 pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1455 "%s\n", coreref, pr ? "enabled" : "disabled");
Stephan Mueller76899a42015-04-18 19:36:17 +02001456 mutex_lock(&drbg->drbg_mutex);
Stephan Mueller541af942014-05-31 15:44:17 +02001457
1458 /* 9.1 step 1 is implicit with the selected DRBG type */
1459
1460 /*
1461 * 9.1 step 2 is implicit as caller can select prediction resistance
1462 * and the flag is copied into drbg->flags --
1463 * all DRBG types support prediction resistance
1464 */
1465
1466 /* 9.1 step 4 is implicit in drbg_sec_strength */
1467
Herbert Xu2a57e422015-04-20 11:29:15 +08001468 if (!drbg->core) {
1469 drbg->core = &drbg_cores[coreref];
1470 drbg->pr = pr;
1471 drbg->seeded = false;
Stephan Mueller42ea5072015-06-10 03:33:37 +02001472 drbg->reseed_threshold = drbg_max_requests(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +02001473
Herbert Xu2a57e422015-04-20 11:29:15 +08001474 ret = drbg_alloc_state(drbg);
1475 if (ret)
1476 goto unlock;
1477
Stephan Mueller57225e62015-06-09 21:55:38 +08001478 ret = drbg_prepare_hrng(drbg);
1479 if (ret)
1480 goto free_everything;
1481
1482 if (IS_ERR(drbg->jent)) {
1483 ret = PTR_ERR(drbg->jent);
1484 drbg->jent = NULL;
1485 if (fips_enabled || ret != -ENOENT)
1486 goto free_everything;
1487 pr_info("DRBG: Continuing without Jitter RNG\n");
1488 }
1489
Herbert Xu2a57e422015-04-20 11:29:15 +08001490 reseed = false;
1491 }
1492
1493 ret = drbg_seed(drbg, pers, reseed);
1494
Stephan Mueller57225e62015-06-09 21:55:38 +08001495 if (ret && !reseed)
1496 goto free_everything;
Stephan Mueller541af942014-05-31 15:44:17 +02001497
Stephan Mueller76899a42015-04-18 19:36:17 +02001498 mutex_unlock(&drbg->drbg_mutex);
Herbert Xu2a57e422015-04-20 11:29:15 +08001499 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +02001500
Stephan Mueller76899a42015-04-18 19:36:17 +02001501unlock:
1502 mutex_unlock(&drbg->drbg_mutex);
Stephan Mueller541af942014-05-31 15:44:17 +02001503 return ret;
Stephan Mueller57225e62015-06-09 21:55:38 +08001504
1505free_everything:
1506 mutex_unlock(&drbg->drbg_mutex);
1507 drbg_uninstantiate(drbg);
1508 return ret;
Stephan Mueller541af942014-05-31 15:44:17 +02001509}
1510
1511/*
1512 * DRBG uninstantiate function as required by SP800-90A - this function
1513 * frees all buffers and the DRBG handle
1514 *
1515 * @drbg DRBG state handle
1516 *
1517 * return
1518 * 0 on success
1519 */
1520static int drbg_uninstantiate(struct drbg_state *drbg)
1521{
Stephan Mueller57225e62015-06-09 21:55:38 +08001522 if (drbg->random_ready.func) {
1523 del_random_ready_callback(&drbg->random_ready);
1524 cancel_work_sync(&drbg->seed_work);
1525 crypto_free_rng(drbg->jent);
1526 drbg->jent = NULL;
1527 }
1528
Herbert Xu2a57e422015-04-20 11:29:15 +08001529 if (drbg->d_ops)
1530 drbg->d_ops->crypto_fini(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +02001531 drbg_dealloc_state(drbg);
1532 /* no scrubbing of test_data -- this shall survive an uninstantiate */
Stephan Mueller541af942014-05-31 15:44:17 +02001533 return 0;
1534}
1535
1536/*
1537 * Helper function for setting the test data in the DRBG
1538 *
1539 * @drbg DRBG state handle
Herbert Xu8fded592015-04-21 10:46:41 +08001540 * @data test data
1541 * @len test data length
Stephan Mueller541af942014-05-31 15:44:17 +02001542 */
Herbert Xu8fded592015-04-21 10:46:41 +08001543static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1544 const u8 *data, unsigned int len)
Stephan Mueller541af942014-05-31 15:44:17 +02001545{
Herbert Xu8fded592015-04-21 10:46:41 +08001546 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1547
1548 mutex_lock(&drbg->drbg_mutex);
1549 drbg_string_fill(&drbg->test_data, data, len);
Stephan Mueller76899a42015-04-18 19:36:17 +02001550 mutex_unlock(&drbg->drbg_mutex);
Stephan Mueller541af942014-05-31 15:44:17 +02001551}
1552
1553/***************************************************************
1554 * Kernel crypto API cipher invocations requested by DRBG
1555 ***************************************************************/
1556
1557#if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1558struct sdesc {
1559 struct shash_desc shash;
1560 char ctx[];
1561};
1562
1563static int drbg_init_hash_kernel(struct drbg_state *drbg)
1564{
1565 struct sdesc *sdesc;
1566 struct crypto_shash *tfm;
1567
1568 tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1569 if (IS_ERR(tfm)) {
Sergey Senozhatsky593dfbd2015-06-10 22:27:48 +09001570 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1571 drbg->core->backend_cra_name);
Stephan Mueller541af942014-05-31 15:44:17 +02001572 return PTR_ERR(tfm);
1573 }
1574 BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1575 sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1576 GFP_KERNEL);
1577 if (!sdesc) {
1578 crypto_free_shash(tfm);
1579 return -ENOMEM;
1580 }
1581
1582 sdesc->shash.tfm = tfm;
1583 sdesc->shash.flags = 0;
1584 drbg->priv_data = sdesc;
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001585
1586 return crypto_shash_alignmask(tfm);
Stephan Mueller541af942014-05-31 15:44:17 +02001587}
1588
1589static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1590{
1591 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1592 if (sdesc) {
1593 crypto_free_shash(sdesc->shash.tfm);
1594 kzfree(sdesc);
1595 }
1596 drbg->priv_data = NULL;
1597 return 0;
1598}
1599
Stephan Mueller4218ebe2016-03-28 16:47:55 +02001600static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1601 const unsigned char *key)
1602{
1603 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1604
1605 crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1606}
1607
1608static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1609 const struct list_head *in)
Stephan Mueller541af942014-05-31 15:44:17 +02001610{
1611 struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
Stephan Mueller8c987162014-06-28 21:58:24 +02001612 struct drbg_string *input = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +02001613
Stephan Mueller541af942014-05-31 15:44:17 +02001614 crypto_shash_init(&sdesc->shash);
Stephan Mueller8c987162014-06-28 21:58:24 +02001615 list_for_each_entry(input, in, list)
1616 crypto_shash_update(&sdesc->shash, input->buf, input->len);
Stephan Mueller541af942014-05-31 15:44:17 +02001617 return crypto_shash_final(&sdesc->shash, outval);
1618}
1619#endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1620
1621#ifdef CONFIG_CRYPTO_DRBG_CTR
Stephan Mueller35591282016-06-14 07:34:13 +02001622static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1623{
1624 struct crypto_cipher *tfm =
1625 (struct crypto_cipher *)drbg->priv_data;
1626 if (tfm)
1627 crypto_free_cipher(tfm);
1628 drbg->priv_data = NULL;
1629
1630 if (drbg->ctr_handle)
1631 crypto_free_skcipher(drbg->ctr_handle);
1632 drbg->ctr_handle = NULL;
1633
1634 if (drbg->ctr_req)
Wu Fengguang88f1d312016-06-15 19:13:25 +08001635 skcipher_request_free(drbg->ctr_req);
Stephan Mueller35591282016-06-14 07:34:13 +02001636 drbg->ctr_req = NULL;
1637
1638 kfree(drbg->ctr_null_value_buf);
1639 drbg->ctr_null_value = NULL;
1640
1641 return 0;
1642}
1643
1644static void drbg_skcipher_cb(struct crypto_async_request *req, int error)
1645{
1646 struct drbg_state *drbg = req->data;
1647
1648 if (error == -EINPROGRESS)
1649 return;
1650 drbg->ctr_async_err = error;
1651 complete(&drbg->ctr_completion);
1652}
1653
Stephan Mueller541af942014-05-31 15:44:17 +02001654static int drbg_init_sym_kernel(struct drbg_state *drbg)
1655{
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001656 struct crypto_cipher *tfm;
Stephan Mueller35591282016-06-14 07:34:13 +02001657 struct crypto_skcipher *sk_tfm;
1658 struct skcipher_request *req;
1659 unsigned int alignmask;
1660 char ctr_name[CRYPTO_MAX_ALG_NAME];
Stephan Mueller541af942014-05-31 15:44:17 +02001661
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001662 tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
Stephan Mueller541af942014-05-31 15:44:17 +02001663 if (IS_ERR(tfm)) {
Sergey Senozhatsky593dfbd2015-06-10 22:27:48 +09001664 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1665 drbg->core->backend_cra_name);
Stephan Mueller541af942014-05-31 15:44:17 +02001666 return PTR_ERR(tfm);
1667 }
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001668 BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
Stephan Mueller541af942014-05-31 15:44:17 +02001669 drbg->priv_data = tfm;
Stephan Mueller541af942014-05-31 15:44:17 +02001670
Stephan Mueller35591282016-06-14 07:34:13 +02001671 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1672 drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1673 drbg_fini_sym_kernel(drbg);
1674 return -EINVAL;
1675 }
1676 sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1677 if (IS_ERR(sk_tfm)) {
1678 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1679 ctr_name);
1680 drbg_fini_sym_kernel(drbg);
1681 return PTR_ERR(sk_tfm);
1682 }
1683 drbg->ctr_handle = sk_tfm;
1684
1685 req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1686 if (!req) {
1687 pr_info("DRBG: could not allocate request queue\n");
1688 drbg_fini_sym_kernel(drbg);
Dan Carpenter01ac9452016-06-17 12:16:19 +03001689 return -ENOMEM;
Stephan Mueller35591282016-06-14 07:34:13 +02001690 }
1691 drbg->ctr_req = req;
1692 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
1693 drbg_skcipher_cb, drbg);
1694
1695 alignmask = crypto_skcipher_alignmask(sk_tfm);
1696 drbg->ctr_null_value_buf = kzalloc(DRBG_CTR_NULL_LEN + alignmask,
1697 GFP_KERNEL);
1698 if (!drbg->ctr_null_value_buf) {
1699 drbg_fini_sym_kernel(drbg);
1700 return -ENOMEM;
1701 }
1702 drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf,
1703 alignmask + 1);
1704
Stephan Mueller3cfc3b92016-06-14 07:35:13 +02001705 return alignmask;
Stephan Mueller541af942014-05-31 15:44:17 +02001706}
1707
Stephan Muellered494d42016-05-31 13:11:57 +02001708static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1709 const unsigned char *key)
Stephan Mueller541af942014-05-31 15:44:17 +02001710{
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001711 struct crypto_cipher *tfm =
1712 (struct crypto_cipher *)drbg->priv_data;
Stephan Mueller541af942014-05-31 15:44:17 +02001713
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001714 crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
Stephan Muellered494d42016-05-31 13:11:57 +02001715}
1716
1717static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1718 const struct drbg_string *in)
1719{
1720 struct crypto_cipher *tfm =
1721 (struct crypto_cipher *)drbg->priv_data;
1722
Stephan Mueller541af942014-05-31 15:44:17 +02001723 /* there is only component in *in */
Stephan Mueller04bcbfc2015-03-01 20:39:17 +01001724 BUG_ON(in->len < drbg_blocklen(drbg));
1725 crypto_cipher_encrypt_one(tfm, outval, in->buf);
1726 return 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001727}
Stephan Mueller35591282016-06-14 07:34:13 +02001728
Stephan Muellera07203f2016-06-14 07:35:37 +02001729static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1730 u8 *inbuf, u32 inlen,
1731 u8 *outbuf, u32 outlen)
Stephan Mueller35591282016-06-14 07:34:13 +02001732{
1733 struct scatterlist sg_in;
1734
Stephan Muellera07203f2016-06-14 07:35:37 +02001735 sg_init_one(&sg_in, inbuf, inlen);
Stephan Mueller35591282016-06-14 07:34:13 +02001736
1737 while (outlen) {
Stephan Muellera07203f2016-06-14 07:35:37 +02001738 u32 cryptlen = min_t(u32, inlen, outlen);
Stephan Mueller35591282016-06-14 07:34:13 +02001739 struct scatterlist sg_out;
1740 int ret;
1741
1742 sg_init_one(&sg_out, outbuf, cryptlen);
1743 skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out,
1744 cryptlen, drbg->V);
1745 ret = crypto_skcipher_encrypt(drbg->ctr_req);
1746 switch (ret) {
1747 case 0:
1748 break;
1749 case -EINPROGRESS:
1750 case -EBUSY:
1751 ret = wait_for_completion_interruptible(
1752 &drbg->ctr_completion);
1753 if (!ret && !drbg->ctr_async_err) {
1754 reinit_completion(&drbg->ctr_completion);
1755 break;
1756 }
1757 default:
1758 return ret;
1759 }
1760 init_completion(&drbg->ctr_completion);
1761
1762 outlen -= cryptlen;
1763 }
1764
1765 return 0;
1766}
Stephan Mueller541af942014-05-31 15:44:17 +02001767#endif /* CONFIG_CRYPTO_DRBG_CTR */
1768
1769/***************************************************************
1770 * Kernel crypto API interface to register DRBG
1771 ***************************************************************/
1772
1773/*
1774 * Look up the DRBG flags by given kernel crypto API cra_name
1775 * The code uses the drbg_cores definition to do this
1776 *
1777 * @cra_name kernel crypto API cra_name
1778 * @coreref reference to integer which is filled with the pointer to
1779 * the applicable core
1780 * @pr reference for setting prediction resistance
1781 *
1782 * return: flags
1783 */
1784static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1785 int *coreref, bool *pr)
1786{
1787 int i = 0;
1788 size_t start = 0;
1789 int len = 0;
1790
1791 *pr = true;
1792 /* disassemble the names */
1793 if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1794 start = 10;
1795 *pr = false;
1796 } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1797 start = 8;
1798 } else {
1799 return;
1800 }
1801
1802 /* remove the first part */
1803 len = strlen(cra_driver_name) - start;
1804 for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1805 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1806 len)) {
1807 *coreref = i;
1808 return;
1809 }
1810 }
1811}
1812
1813static int drbg_kcapi_init(struct crypto_tfm *tfm)
1814{
1815 struct drbg_state *drbg = crypto_tfm_ctx(tfm);
Stephan Mueller541af942014-05-31 15:44:17 +02001816
Stephan Mueller76899a42015-04-18 19:36:17 +02001817 mutex_init(&drbg->drbg_mutex);
Herbert Xu2a57e422015-04-20 11:29:15 +08001818
1819 return 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001820}
1821
1822static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1823{
1824 drbg_uninstantiate(crypto_tfm_ctx(tfm));
1825}
1826
1827/*
1828 * Generate random numbers invoked by the kernel crypto API:
1829 * The API of the kernel crypto API is extended as follows:
1830 *
Herbert Xu8fded592015-04-21 10:46:41 +08001831 * src is additional input supplied to the RNG.
1832 * slen is the length of src.
1833 * dst is the output buffer where random data is to be stored.
1834 * dlen is the length of dst.
Stephan Mueller541af942014-05-31 15:44:17 +02001835 */
Herbert Xu8fded592015-04-21 10:46:41 +08001836static int drbg_kcapi_random(struct crypto_rng *tfm,
1837 const u8 *src, unsigned int slen,
1838 u8 *dst, unsigned int dlen)
Stephan Mueller541af942014-05-31 15:44:17 +02001839{
1840 struct drbg_state *drbg = crypto_rng_ctx(tfm);
Herbert Xu8fded592015-04-21 10:46:41 +08001841 struct drbg_string *addtl = NULL;
1842 struct drbg_string string;
1843
1844 if (slen) {
Stephan Mueller8c987162014-06-28 21:58:24 +02001845 /* linked list variable is now local to allow modification */
Herbert Xu8fded592015-04-21 10:46:41 +08001846 drbg_string_fill(&string, src, slen);
1847 addtl = &string;
Stephan Mueller541af942014-05-31 15:44:17 +02001848 }
Herbert Xu8fded592015-04-21 10:46:41 +08001849
1850 return drbg_generate_long(drbg, dst, dlen, addtl);
Stephan Mueller541af942014-05-31 15:44:17 +02001851}
1852
1853/*
Herbert Xu2a57e422015-04-20 11:29:15 +08001854 * Seed the DRBG invoked by the kernel crypto API
Stephan Mueller541af942014-05-31 15:44:17 +02001855 */
Herbert Xu8fded592015-04-21 10:46:41 +08001856static int drbg_kcapi_seed(struct crypto_rng *tfm,
1857 const u8 *seed, unsigned int slen)
Stephan Mueller541af942014-05-31 15:44:17 +02001858{
1859 struct drbg_state *drbg = crypto_rng_ctx(tfm);
1860 struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1861 bool pr = false;
Herbert Xu8fded592015-04-21 10:46:41 +08001862 struct drbg_string string;
1863 struct drbg_string *seed_string = NULL;
Stephan Mueller541af942014-05-31 15:44:17 +02001864 int coreref = 0;
1865
Stephan Mueller541af942014-05-31 15:44:17 +02001866 drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1867 &pr);
1868 if (0 < slen) {
Herbert Xu8fded592015-04-21 10:46:41 +08001869 drbg_string_fill(&string, seed, slen);
1870 seed_string = &string;
Stephan Mueller541af942014-05-31 15:44:17 +02001871 }
Herbert Xu8fded592015-04-21 10:46:41 +08001872
1873 return drbg_instantiate(drbg, seed_string, coreref, pr);
Stephan Mueller541af942014-05-31 15:44:17 +02001874}
1875
1876/***************************************************************
1877 * Kernel module: code to load the module
1878 ***************************************************************/
1879
1880/*
1881 * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1882 * of the error handling.
1883 *
1884 * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1885 * as seed source of get_random_bytes does not fail.
1886 *
1887 * Note 2: There is no sensible way of testing the reseed counter
1888 * enforcement, so skip it.
1889 */
1890static inline int __init drbg_healthcheck_sanity(void)
1891{
Stephan Mueller541af942014-05-31 15:44:17 +02001892 int len = 0;
1893#define OUTBUFLEN 16
1894 unsigned char buf[OUTBUFLEN];
1895 struct drbg_state *drbg = NULL;
1896 int ret = -EFAULT;
1897 int rc = -EFAULT;
1898 bool pr = false;
1899 int coreref = 0;
1900 struct drbg_string addtl;
1901 size_t max_addtllen, max_request_bytes;
1902
1903 /* only perform test in FIPS mode */
1904 if (!fips_enabled)
1905 return 0;
1906
1907#ifdef CONFIG_CRYPTO_DRBG_CTR
1908 drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
Stephan Muellere25e47e2014-07-06 02:23:03 +02001909#elif defined CONFIG_CRYPTO_DRBG_HASH
Stephan Mueller541af942014-05-31 15:44:17 +02001910 drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
1911#else
1912 drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
1913#endif
1914
1915 drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
1916 if (!drbg)
1917 return -ENOMEM;
1918
Herbert Xue11a7542015-04-20 11:26:48 +08001919 mutex_init(&drbg->drbg_mutex);
Stephan Muellerd89a6712016-08-09 21:02:36 +02001920 drbg->core = &drbg_cores[coreref];
1921 drbg->reseed_threshold = drbg_max_requests(drbg);
Herbert Xue11a7542015-04-20 11:26:48 +08001922
Stephan Mueller541af942014-05-31 15:44:17 +02001923 /*
1924 * if the following tests fail, it is likely that there is a buffer
1925 * overflow as buf is much smaller than the requested or provided
1926 * string lengths -- in case the error handling does not succeed
1927 * we may get an OOPS. And we want to get an OOPS as this is a
1928 * grave bug.
1929 */
1930
Stephan Mueller541af942014-05-31 15:44:17 +02001931 max_addtllen = drbg_max_addtl(drbg);
1932 max_request_bytes = drbg_max_request_bytes(drbg);
1933 drbg_string_fill(&addtl, buf, max_addtllen + 1);
1934 /* overflow addtllen with additonal info string */
1935 len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
1936 BUG_ON(0 < len);
1937 /* overflow max_bits */
1938 len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
1939 BUG_ON(0 < len);
Stephan Mueller541af942014-05-31 15:44:17 +02001940
1941 /* overflow max addtllen with personalization string */
Stephan Muellerd89a6712016-08-09 21:02:36 +02001942 ret = drbg_seed(drbg, &addtl, false);
Stephan Mueller541af942014-05-31 15:44:17 +02001943 BUG_ON(0 == ret);
Stephan Mueller541af942014-05-31 15:44:17 +02001944 /* all tests passed */
1945 rc = 0;
1946
1947 pr_devel("DRBG: Sanity tests for failure code paths successfully "
1948 "completed\n");
1949
Stephan Muellerd89a6712016-08-09 21:02:36 +02001950 kfree(drbg);
Stephan Mueller541af942014-05-31 15:44:17 +02001951 return rc;
Stephan Mueller541af942014-05-31 15:44:17 +02001952}
1953
Herbert Xu8fded592015-04-21 10:46:41 +08001954static struct rng_alg drbg_algs[22];
Stephan Mueller541af942014-05-31 15:44:17 +02001955
1956/*
1957 * Fill the array drbg_algs used to register the different DRBGs
1958 * with the kernel crypto API. To fill the array, the information
1959 * from drbg_cores[] is used.
1960 */
Herbert Xu8fded592015-04-21 10:46:41 +08001961static inline void __init drbg_fill_array(struct rng_alg *alg,
Stephan Mueller541af942014-05-31 15:44:17 +02001962 const struct drbg_core *core, int pr)
1963{
1964 int pos = 0;
Herbert Xu51ee14222015-06-03 14:49:28 +08001965 static int priority = 200;
Stephan Mueller541af942014-05-31 15:44:17 +02001966
Herbert Xu8fded592015-04-21 10:46:41 +08001967 memcpy(alg->base.cra_name, "stdrng", 6);
Stephan Mueller541af942014-05-31 15:44:17 +02001968 if (pr) {
Herbert Xu8fded592015-04-21 10:46:41 +08001969 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
Stephan Mueller541af942014-05-31 15:44:17 +02001970 pos = 8;
1971 } else {
Herbert Xu8fded592015-04-21 10:46:41 +08001972 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
Stephan Mueller541af942014-05-31 15:44:17 +02001973 pos = 10;
1974 }
Herbert Xu8fded592015-04-21 10:46:41 +08001975 memcpy(alg->base.cra_driver_name + pos, core->cra_name,
Stephan Mueller541af942014-05-31 15:44:17 +02001976 strlen(core->cra_name));
1977
Herbert Xu8fded592015-04-21 10:46:41 +08001978 alg->base.cra_priority = priority;
Stephan Mueller541af942014-05-31 15:44:17 +02001979 priority++;
1980 /*
1981 * If FIPS mode enabled, the selected DRBG shall have the
1982 * highest cra_priority over other stdrng instances to ensure
1983 * it is selected.
1984 */
1985 if (fips_enabled)
Herbert Xu8fded592015-04-21 10:46:41 +08001986 alg->base.cra_priority += 200;
Stephan Mueller541af942014-05-31 15:44:17 +02001987
Herbert Xu8fded592015-04-21 10:46:41 +08001988 alg->base.cra_ctxsize = sizeof(struct drbg_state);
1989 alg->base.cra_module = THIS_MODULE;
1990 alg->base.cra_init = drbg_kcapi_init;
1991 alg->base.cra_exit = drbg_kcapi_cleanup;
1992 alg->generate = drbg_kcapi_random;
1993 alg->seed = drbg_kcapi_seed;
1994 alg->set_ent = drbg_kcapi_set_entropy;
1995 alg->seedsize = 0;
Stephan Mueller541af942014-05-31 15:44:17 +02001996}
1997
1998static int __init drbg_init(void)
1999{
2000 unsigned int i = 0; /* pointer to drbg_algs */
2001 unsigned int j = 0; /* pointer to drbg_cores */
2002 int ret = -EFAULT;
2003
2004 ret = drbg_healthcheck_sanity();
2005 if (ret)
2006 return ret;
2007
2008 if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2009 pr_info("DRBG: Cannot register all DRBG types"
Stephan Muellera9089572014-07-06 02:24:03 +02002010 "(slots needed: %zu, slots available: %zu)\n",
Stephan Mueller541af942014-05-31 15:44:17 +02002011 ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2012 return ret;
2013 }
2014
2015 /*
2016 * each DRBG definition can be used with PR and without PR, thus
2017 * we instantiate each DRBG in drbg_cores[] twice.
2018 *
2019 * As the order of placing them into the drbg_algs array matters
2020 * (the later DRBGs receive a higher cra_priority) we register the
2021 * prediction resistance DRBGs first as the should not be too
2022 * interesting.
2023 */
2024 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2025 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2026 for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2027 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
Herbert Xu8fded592015-04-21 10:46:41 +08002028 return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
Stephan Mueller541af942014-05-31 15:44:17 +02002029}
2030
Fengguang Wu96956ae2014-07-10 16:52:04 +08002031static void __exit drbg_exit(void)
Stephan Mueller541af942014-05-31 15:44:17 +02002032{
Herbert Xu8fded592015-04-21 10:46:41 +08002033 crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
Stephan Mueller541af942014-05-31 15:44:17 +02002034}
2035
2036module_init(drbg_init);
2037module_exit(drbg_exit);
Stephan Muellere25e47e2014-07-06 02:23:03 +02002038#ifndef CRYPTO_DRBG_HASH_STRING
2039#define CRYPTO_DRBG_HASH_STRING ""
2040#endif
2041#ifndef CRYPTO_DRBG_HMAC_STRING
2042#define CRYPTO_DRBG_HMAC_STRING ""
2043#endif
2044#ifndef CRYPTO_DRBG_CTR_STRING
2045#define CRYPTO_DRBG_CTR_STRING ""
2046#endif
Stephan Mueller541af942014-05-31 15:44:17 +02002047MODULE_LICENSE("GPL");
2048MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
Stephan Muellere25e47e2014-07-06 02:23:03 +02002049MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2050 "using following cores: "
2051 CRYPTO_DRBG_HASH_STRING
2052 CRYPTO_DRBG_HMAC_STRING
2053 CRYPTO_DRBG_CTR_STRING);
Herbert Xu51ee14222015-06-03 14:49:28 +08002054MODULE_ALIAS_CRYPTO("stdrng");