[PATCH] crypto: Force panic on continuous CPRNG test failure when in FIPS mode
FIPS 140-2 specifies that all access to various cryptographic modules be
prevented in the event that any of the provided self tests fail on the various
implemented algorithms. The way this is currently done is by simply panicing the
box. We do this already for the various alg tests in testmgr.c, we should do it
in the case of a failure for the continuous test in the CPRNG as well. This
patch implements that change
Signed-off-by: Neil Horman nhor...@tuxdriver.com
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 0fac8ff..7eef5be 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -132,10 +132,20 @@ static int _get_more_prng_bytes(struct prng_context *ctx)
*/
if (!memcmp(ctx-rand_data, ctx-last_rand_data,
DEFAULT_BLK_SZ)) {
- printk(KERN_ERR
- ctx %p Failed repetition check!\n,
- ctx);
- ctx-flags |= PRNG_NEED_RESET;
+ if (fips_enabled) {
+ /* FIPS 140-2 requires that we disable
+* further use of crypto code if we fail
+* this test, easiest way to do that
+* is panic the box
+*/
+ panic(cprng %p failed continuity test,
+ ctx);
+ } else {
+ printk(KERN_ERR
+ ctx %p Failed repetition
check!\n,
+ ctx);
+ ctx-flags |= PRNG_NEED_RESET;
+ }
return -EINVAL;
}
memcpy(ctx-last_rand_data, ctx-rand_data,
--
To unsubscribe from this list: send the line unsubscribe linux-crypto in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH] crypto: force reset of cprng on allocation
pseudo RNGs provide predictable outputs based on input parateters {key, V, DT},
the idea behind them is that only the user should know what the inputs are.
While its nice to have default known values for testing purposes, it seems
dangerous to allow the use of those default values without some sort of safety
measure in place, lest an attacker easily guess the output of the cprng. This
patch forces the NEED_RESET flag on when allocating a cprng context, so that any
user is forced to reseed it before use. The defaults can still be used for
testing, but this will prevent their inadvertent use, and be more secure.
Signed-off-by: Neil Horman nhor...@redhat.com
ansi_cprng.c | 11 ++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index 7eef5be..d9c3971 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -348,7 +348,16 @@ static int cprng_init(struct crypto_tfm *tfm)
spin_lock_init(ctx-prng_lock);
- return reset_prng_context(ctx, NULL, DEFAULT_PRNG_KSZ, NULL, NULL);
+ if (reset_prng_context(ctx, NULL, DEFAULT_PRNG_KSZ, NULL, NULL) 0)
+ return -EINVAL;
+
+ /*
+* after allocation, we should always force the user to reset
+* so they don't inadvertently use the insecure default values
+* without specifying them intentially
+*/
+ ctx-flags |= PRNG_NEED_RESET;
+ return 0;
}
static void cprng_exit(struct crypto_tfm *tfm)
--
To unsubscribe from this list: send the line unsubscribe linux-crypto in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
