[PATCH] crypto: add optional continuous repetition test to entropy store based rngs
FIPS-140 requires that all random number generators implement continuous self tests in which each extracted block of data is compared against the last block for repetition. The ansi_cprng implements such a test, but it would be nice if the hw rng's did the same thing. Obviously its not something thats always needed, but it seems like it would be a nice feature to have on occasion. I've written the below patch which allows individual entropy stores to be flagged as desiring a continuous test to be run on them as is extracted. By default this option is off, but is enabled in the event that fips mode is selected during bootup. Neil Signed-off-by: Neil Horman nhor...@tuxdriver.com diff --git a/crypto/internal.h b/crypto/internal.h index fc76e1f..150d389 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -26,12 +26,6 @@ #include linux/rwsem.h #include linux/slab.h -#ifdef CONFIG_CRYPTO_FIPS -extern int fips_enabled; -#else -#define fips_enabled 0 -#endif - /* Crypto notification events. */ enum { CRYPTO_MSG_ALG_REQUEST, diff --git a/drivers/char/random.c b/drivers/char/random.c index 8c74448..fbdfc70 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -250,6 +250,8 @@ #include asm/irq.h #include asm/io.h +#include crypto/algapi.h + /* * Configuration information */ @@ -400,6 +402,7 @@ module_param(debug, bool, 0644); **/ struct entropy_store; +#define ENT_F_CONT_TEST 1 struct entropy_store { /* read-only data: */ struct poolinfo *poolinfo; @@ -413,6 +416,8 @@ struct entropy_store { unsigned add_ptr; int entropy_count; int input_rotate; + int flags; + __u8 *last_data; }; static __u32 input_pool_data[INPUT_POOL_WORDS]; @@ -424,7 +429,9 @@ static struct entropy_store input_pool = { .name = input, .limit = 1, .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock), - .pool = input_pool_data + .pool = input_pool_data, + .flags = 0, + .last_data = NULL }; static struct entropy_store blocking_pool = { @@ -433,7 +440,9 @@ static struct entropy_store blocking_pool = { .limit = 1, .pull = input_pool, .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock), - .pool = blocking_pool_data + .pool = blocking_pool_data, + .flags = 0, + .last_data = NULL }; static struct entropy_store nonblocking_pool = { @@ -441,7 +450,9 @@ static struct entropy_store nonblocking_pool = { .name = nonblocking, .pull = input_pool, .lock = __SPIN_LOCK_UNLOCKED(nonblocking_pool.lock), - .pool = nonblocking_pool_data + .pool = nonblocking_pool_data, + .flags = 0, + .last_data = NULL }; /* @@ -852,12 +863,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, { ssize_t ret = 0, i; __u8 tmp[EXTRACT_SIZE]; + unsigned long flags; xfer_secondary_pool(r, nbytes); nbytes = account(r, nbytes, min, reserved); while (nbytes) { extract_buf(r, tmp); + + if (r-flags ENT_F_CONT_TEST) { + spin_lock_irqsave(r-lock, flags); + if (!memcmp(tmp, r-last_data, EXTRACT_SIZE)) + panic(Hardware RNG duplicated output!\n); + memcpy(r-last_data, tmp, EXTRACT_SIZE); + spin_unlock_irqrestore(r-lock, flags); + } i = min_t(int, nbytes, EXTRACT_SIZE); memcpy(buf, tmp, i); nbytes -= i; @@ -940,6 +960,14 @@ static void init_std_data(struct entropy_store *r) now = ktime_get_real(); mix_pool_bytes(r, now, sizeof(now)); mix_pool_bytes(r, utsname(), sizeof(*(utsname(; + /* Enable continuous test in fips mode */ + if (fips_enabled) { + r-last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL); + if (r-last_data) + r-flags |= ENT_F_CONT_TEST; + else + panic(Could not alloc data for rng test\n); + } } static int rand_initialize(void) diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h index 0105454..88e9535 100644 --- a/include/crypto/algapi.h +++ b/include/crypto/algapi.h @@ -20,6 +20,12 @@ struct module; struct rtattr; struct seq_file; +#ifdef CONFIG_CRYPTO_FIPS +extern int fips_enabled; +#else +#define fips_enabled 0 +#endif + struct crypto_type { unsigned int (*ctxsize)(struct crypto_alg *alg, u32 type, u32 mask); unsigned int (*extsize)(struct crypto_alg *alg, -- To unsubscribe from this list: send the line unsubscribe linux-crypto in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] crypto: add optional continuous repetition test to entropy store based rngs
On Thu, 2009-06-04 at 15:50 -0400, Neil Horman wrote: FIPS-140 requires that all random number generators implement continuous self tests in which each extracted block of data is compared against the last block for repetition. The ansi_cprng implements such a test, but it would be nice if the hw rng's did the same thing. Obviously its not something thats always needed, but it seems like it would be a nice feature to have on occasion. I've written the below patch which allows individual entropy stores to be flagged as desiring a continuous test to be run on them as is extracted. By default this option is off, but is enabled in the event that fips mode is selected during bootup. Neil Signed-off-by: Neil Horman nhor...@tuxdriver.com diff --git a/crypto/internal.h b/crypto/internal.h index fc76e1f..150d389 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -26,12 +26,6 @@ #include linux/rwsem.h #include linux/slab.h -#ifdef CONFIG_CRYPTO_FIPS -extern int fips_enabled; -#else -#define fips_enabled 0 -#endif - /* Crypto notification events. */ enum { CRYPTO_MSG_ALG_REQUEST, diff --git a/drivers/char/random.c b/drivers/char/random.c index 8c74448..fbdfc70 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -250,6 +250,8 @@ #include asm/irq.h #include asm/io.h +#include crypto/algapi.h + I think we'd rather not make random.c incestuous with crypto/. /* * Configuration information */ @@ -400,6 +402,7 @@ module_param(debug, bool, 0644); **/ struct entropy_store; +#define ENT_F_CONT_TEST 1 struct entropy_store { /* read-only data: */ struct poolinfo *poolinfo; @@ -413,6 +416,8 @@ struct entropy_store { unsigned add_ptr; int entropy_count; int input_rotate; + int flags; + __u8 *last_data; }; static __u32 input_pool_data[INPUT_POOL_WORDS]; @@ -424,7 +429,9 @@ static struct entropy_store input_pool = { .name = input, .limit = 1, .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock), - .pool = input_pool_data + .pool = input_pool_data, + .flags = 0, + .last_data = NULL }; No need to null-initialize these things. static struct entropy_store blocking_pool = { @@ -433,7 +440,9 @@ static struct entropy_store blocking_pool = { .limit = 1, .pull = input_pool, .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock), - .pool = blocking_pool_data + .pool = blocking_pool_data, + .flags = 0, + .last_data = NULL }; static struct entropy_store nonblocking_pool = { @@ -441,7 +450,9 @@ static struct entropy_store nonblocking_pool = { .name = nonblocking, .pull = input_pool, .lock = __SPIN_LOCK_UNLOCKED(nonblocking_pool.lock), - .pool = nonblocking_pool_data + .pool = nonblocking_pool_data, + .flags = 0, + .last_data = NULL }; /* @@ -852,12 +863,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, { ssize_t ret = 0, i; __u8 tmp[EXTRACT_SIZE]; + unsigned long flags; xfer_secondary_pool(r, nbytes); nbytes = account(r, nbytes, min, reserved); while (nbytes) { extract_buf(r, tmp); + + if (r-flags ENT_F_CONT_TEST) { + spin_lock_irqsave(r-lock, flags); + if (!memcmp(tmp, r-last_data, EXTRACT_SIZE)) + panic(Hardware RNG duplicated output!\n); + memcpy(r-last_data, tmp, EXTRACT_SIZE); + spin_unlock_irqrestore(r-lock, flags); + } This should go in extract_buf. I think we can avoid adding flags to the pool struct by simply checking that last_data is not null. i = min_t(int, nbytes, EXTRACT_SIZE); memcpy(buf, tmp, i); nbytes -= i; @@ -940,6 +960,14 @@ static void init_std_data(struct entropy_store *r) now = ktime_get_real(); mix_pool_bytes(r, now, sizeof(now)); mix_pool_bytes(r, utsname(), sizeof(*(utsname(; + /* Enable continuous test in fips mode */ + if (fips_enabled) { + r-last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL); + if (r-last_data) + r-flags |= ENT_F_CONT_TEST; + else + panic(Could not alloc data for rng test\n); + } } static int rand_initialize(void) diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h index 0105454..88e9535 100644 --- a/include/crypto/algapi.h +++ b/include/crypto/algapi.h @@ -20,6 +20,12 @@ struct module; struct rtattr; struct seq_file; +#ifdef CONFIG_CRYPTO_FIPS +extern int fips_enabled; +#else +#define fips_enabled 0 +#endif + struct crypto_type { unsigned int (*ctxsize)(struct crypto_alg *alg, u32 type, u32 mask);
Re: [RFC PATCH] crypto: add buffer overflow checks to testmgr
On Friday 29 May 2009 18:10:55 Herbert Xu wrote: On Fri, May 29, 2009 at 11:32:54AM -0400, Jarod Wilson wrote: At present, its entirely possible to add a test vector to testmgr with an input longer than a page in length w/o specifying a .np option, and overflow the page of memory allocated to {a,}xbuf[0], silently corrupting memory. I know, because I've accidentally done it. :) While this doesn't currently happen in practice w/the existing code, due to all !np vectors being less than a 4k page in length (and the page allocation loop often returns contiguous pages anyway), explicit checks or a way to remove the 4k limit would be a good idea. A few ways to fix and/or work around this: 1) allocate some larger guaranteed contiguous buffers using __get_free_pages() or kmalloc and use them in the !np case 2) catch the PAGE_SIZE !np case and then do things similar to how they are done in the np case 3) catch the PAGE_SIZE !np case and simply exit with an error Since there currently aren't any test vectors that are actually larger than a page and not tagged np, option 1 seems like a waste of memory and option 2 sounds like unnecessary complexity, so I'd offer up option 3 as the most viable alternative right now. Signed-off-by: Jarod Wilson ja...@redhat.com I just posted exactly the same thing yesterday :) One note... This is actually causing some new compile warnings to be spit out, varies from arch to arch, dependent on page size... ppc64 with 64k pages is the worst offender: crypto/testmgr.c: In function 'test_nhash': crypto/testmgr.c:194: warning: comparison is always false due to limited range of data type crypto/testmgr.c: In function 'test_aead': crypto/testmgr.c:374: warning: comparison is always false due to limited range of data type crypto/testmgr.c:375: warning: comparison is always false due to limited range of data type crypto/testmgr.c: In function 'test_cipher': crypto/testmgr.c:676: warning: comparison is always false due to limited range of data type crypto/testmgr.c: In function 'test_skcipher': crypto/testmgr.c:771: warning: comparison is always false due to limited range of data type -- Jarod Wilson ja...@redhat.com -- To unsubscribe from this list: send the line unsubscribe linux-crypto in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] crypto: add optional continuous repetition test to entropy store based rngs
On Thu, Jun 04, 2009 at 03:14:10PM -0500, Matt Mackall wrote: On Thu, 2009-06-04 at 15:50 -0400, Neil Horman wrote: FIPS-140 requires that all random number generators implement continuous self tests in which each extracted block of data is compared against the last block for repetition. The ansi_cprng implements such a test, but it would be nice if the hw rng's did the same thing. Obviously its not something thats always needed, but it seems like it would be a nice feature to have on occasion. I've written the below patch which allows individual entropy stores to be flagged as desiring a continuous test to be run on them as is extracted. By default this option is off, but is enabled in the event that fips mode is selected during bootup. Neil Signed-off-by: Neil Horman nhor...@tuxdriver.com diff --git a/crypto/internal.h b/crypto/internal.h index fc76e1f..150d389 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -26,12 +26,6 @@ #include linux/rwsem.h #include linux/slab.h -#ifdef CONFIG_CRYPTO_FIPS -extern int fips_enabled; -#else -#define fips_enabled 0 -#endif - /* Crypto notification events. */ enum { CRYPTO_MSG_ALG_REQUEST, diff --git a/drivers/char/random.c b/drivers/char/random.c index 8c74448..fbdfc70 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -250,6 +250,8 @@ #include asm/irq.h #include asm/io.h +#include crypto/algapi.h + I think we'd rather not make random.c incestuous with crypto/. Not sure what to do about this. The intent is to provide the external reference to the fips_enabled flag (which is either defined as an extern in or #defined to 0 dependent on CONFIG_CRYPTO_FIPS). I can cut'n'paste the code block from the include file and put it in here, but that seems like a worse solution to me. Let me know your thoughts, and I can change this accordingly. As for the other comments, they all seem good to me, let me know what you want to do about the above, and I'll respin/repost the patch for you Thanks! Neil -- To unsubscribe from this list: send the line unsubscribe linux-crypto in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] crypto: add optional continuous repetition test to entropy store based rngs
On Thu, Jun 04, 2009 at 08:04:56PM -0400, Neil Horman wrote: Not sure what to do about this. The intent is to provide the external reference to the fips_enabled flag (which is either defined as an extern in or #defined to 0 dependent on CONFIG_CRYPTO_FIPS). I can cut'n'paste the code block from the include file and put it in here, but that seems like a worse solution to me. Let me know your thoughts, and I can change this accordingly. You can put the fips flag into its own header file, e.g., linux/fips.h. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmVHI~} herb...@gondor.apana.org.au Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line unsubscribe linux-crypto in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] crypto: add optional continuous repetition test to entropy store based rngs
On Fri, Jun 05, 2009 at 10:30:06AM +1000, Herbert Xu wrote: On Thu, Jun 04, 2009 at 08:04:56PM -0400, Neil Horman wrote: Not sure what to do about this. The intent is to provide the external reference to the fips_enabled flag (which is either defined as an extern in or #defined to 0 dependent on CONFIG_CRYPTO_FIPS). I can cut'n'paste the code block from the include file and put it in here, but that seems like a worse solution to me. Let me know your thoughts, and I can change this accordingly. You can put the fips flag into its own header file, e.g., linux/fips.h. Ok, that seems like a reasonable idea. new patch below Change Notes: 1) Moved fips_enabled flag into its own header, included in all the appropriate places 2) removed flags field from entropy store, keying continuous test on the non-null status of the last_data pointer FIPS-140 requires that all random number generators implement continuous self tests in which each extracted block of data is compared against the last block for repetition. The ansi_cprng implements such a test, but it would be nice if the hw rng's did the same thing. Obviously its not something thats always needed, but it seems like it would be a nice feature to have on occasion. I've written the below patch which allows individual entropy stores to be flagged as desiring a continuous test to be run on them as is extracted. By default this option is off, but is enabled in the event that fips mode is selected during bootup. Neil Signed-off-by: Neil Horman nhor...@tuxdriver.com crypto/internal.h |7 +-- drivers/char/random.c | 14 ++ include/linux/fips.h | 10 ++ 3 files changed, 25 insertions(+), 6 deletions(-) diff --git a/crypto/internal.h b/crypto/internal.h index fc76e1f..769b713 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -25,12 +25,7 @@ #include linux/notifier.h #include linux/rwsem.h #include linux/slab.h - -#ifdef CONFIG_CRYPTO_FIPS -extern int fips_enabled; -#else -#define fips_enabled 0 -#endif +#include linux/fips.h /* Crypto notification events. */ enum { diff --git a/drivers/char/random.c b/drivers/char/random.c index 8c74448..d8a9255 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -240,6 +240,7 @@ #include linux/spinlock.h #include linux/percpu.h #include linux/cryptohash.h +#include linux/fips.h #ifdef CONFIG_GENERIC_HARDIRQS # include linux/irq.h @@ -413,6 +414,7 @@ struct entropy_store { unsigned add_ptr; int entropy_count; int input_rotate; + __u8 *last_data; }; static __u32 input_pool_data[INPUT_POOL_WORDS]; @@ -852,12 +854,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, { ssize_t ret = 0, i; __u8 tmp[EXTRACT_SIZE]; + unsigned long flags; xfer_secondary_pool(r, nbytes); nbytes = account(r, nbytes, min, reserved); while (nbytes) { extract_buf(r, tmp); + + if (r-last_data) { + spin_lock_irqsave(r-lock, flags); + if (!memcmp(tmp, r-last_data, EXTRACT_SIZE)) + panic(Hardware RNG duplicated output!\n); + memcpy(r-last_data, tmp, EXTRACT_SIZE); + spin_unlock_irqrestore(r-lock, flags); + } i = min_t(int, nbytes, EXTRACT_SIZE); memcpy(buf, tmp, i); nbytes -= i; @@ -940,6 +951,9 @@ static void init_std_data(struct entropy_store *r) now = ktime_get_real(); mix_pool_bytes(r, now, sizeof(now)); mix_pool_bytes(r, utsname(), sizeof(*(utsname(; + /* Enable continuous test in fips mode */ + if (fips_enabled) + r-last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL); } static int rand_initialize(void) diff --git a/include/linux/fips.h b/include/linux/fips.h new file mode 100644 index 000..f8fb07b --- /dev/null +++ b/include/linux/fips.h @@ -0,0 +1,10 @@ +#ifndef _FIPS_H +#define _FIPS_H + +#ifdef CONFIG_CRYPTO_FIPS +extern int fips_enabled; +#else +#define fips_enabled 0 +#endif + +#endif Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmVHI~} herb...@gondor.apana.org.au Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line unsubscribe linux-crypto in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html