]>
Commit | Line | Data |
---|---|---|
3e16f959 SM |
1 | /* |
2 | * DRBG based on NIST SP800-90A | |
3 | * | |
4 | * Copyright Stephan Mueller <smueller@chronox.de>, 2014 | |
5 | * | |
6 | * Redistribution and use in source and binary forms, with or without | |
7 | * modification, are permitted provided that the following conditions | |
8 | * are met: | |
9 | * 1. Redistributions of source code must retain the above copyright | |
10 | * notice, and the entire permission notice in its entirety, | |
11 | * including the disclaimer of warranties. | |
12 | * 2. Redistributions in binary form must reproduce the above copyright | |
13 | * notice, this list of conditions and the following disclaimer in the | |
14 | * documentation and/or other materials provided with the distribution. | |
15 | * 3. The name of the author may not be used to endorse or promote | |
16 | * products derived from this software without specific prior | |
17 | * written permission. | |
18 | * | |
19 | * ALTERNATIVELY, this product may be distributed under the terms of | |
20 | * the GNU General Public License, in which case the provisions of the GPL are | |
21 | * required INSTEAD OF the above restrictions. (This clause is | |
22 | * necessary due to a potential bad interaction between the GPL and | |
23 | * the restrictions contained in a BSD-style copyright.) | |
24 | * | |
25 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED | |
26 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | |
27 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF | |
28 | * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE | |
29 | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR | |
30 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT | |
31 | * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | |
32 | * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF | |
33 | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
34 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE | |
35 | * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH | |
36 | * DAMAGE. | |
37 | */ | |
38 | ||
39 | #ifndef _DRBG_H | |
40 | #define _DRBG_H | |
41 | ||
42 | ||
43 | #include <linux/random.h> | |
44 | #include <linux/scatterlist.h> | |
45 | #include <crypto/hash.h> | |
35591285 | 46 | #include <crypto/skcipher.h> |
3e16f959 SM |
47 | #include <linux/module.h> |
48 | #include <linux/crypto.h> | |
49 | #include <linux/slab.h> | |
50 | #include <crypto/internal/rng.h> | |
51 | #include <crypto/rng.h> | |
52 | #include <linux/fips.h> | |
76899a41 | 53 | #include <linux/mutex.h> |
8c987166 | 54 | #include <linux/list.h> |
4c787990 | 55 | #include <linux/workqueue.h> |
3e16f959 SM |
56 | |
57 | /* | |
58 | * Concatenation Helper and string operation helper | |
59 | * | |
60 | * SP800-90A requires the concatenation of different data. To avoid copying | |
61 | * buffers around or allocate additional memory, the following data structure | |
62 | * is used to point to the original memory with its size. In addition, it | |
63 | * is used to build a linked list. The linked list defines the concatenation | |
64 | * of individual buffers. The order of memory block referenced in that | |
65 | * linked list determines the order of concatenation. | |
66 | */ | |
67 | struct drbg_string { | |
68 | const unsigned char *buf; | |
69 | size_t len; | |
8c987166 | 70 | struct list_head list; |
3e16f959 SM |
71 | }; |
72 | ||
73 | static inline void drbg_string_fill(struct drbg_string *string, | |
74 | const unsigned char *buf, size_t len) | |
75 | { | |
76 | string->buf = buf; | |
77 | string->len = len; | |
8c987166 | 78 | INIT_LIST_HEAD(&string->list); |
3e16f959 SM |
79 | } |
80 | ||
81 | struct drbg_state; | |
82 | typedef uint32_t drbg_flag_t; | |
83 | ||
84 | struct drbg_core { | |
85 | drbg_flag_t flags; /* flags for the cipher */ | |
86 | __u8 statelen; /* maximum state length */ | |
3e16f959 SM |
87 | __u8 blocklen_bytes; /* block size of output in bytes */ |
88 | char cra_name[CRYPTO_MAX_ALG_NAME]; /* mapping to kernel crypto API */ | |
89 | /* kernel crypto API backend cipher name */ | |
90 | char backend_cra_name[CRYPTO_MAX_ALG_NAME]; | |
91 | }; | |
92 | ||
93 | struct drbg_state_ops { | |
8c987166 | 94 | int (*update)(struct drbg_state *drbg, struct list_head *seed, |
3e16f959 SM |
95 | int reseed); |
96 | int (*generate)(struct drbg_state *drbg, | |
97 | unsigned char *buf, unsigned int buflen, | |
27e4de2b | 98 | struct list_head *addtl); |
3e16f959 SM |
99 | int (*crypto_init)(struct drbg_state *drbg); |
100 | int (*crypto_fini)(struct drbg_state *drbg); | |
101 | ||
102 | }; | |
103 | ||
104 | struct drbg_test_data { | |
105 | struct drbg_string *testentropy; /* TEST PARAMETER: test entropy */ | |
106 | }; | |
107 | ||
108 | struct drbg_state { | |
76899a41 | 109 | struct mutex drbg_mutex; /* lock around DRBG */ |
3e16f959 | 110 | unsigned char *V; /* internal state 10.1.1.1 1a) */ |
3cfc3b97 | 111 | unsigned char *Vbuf; |
3e16f959 SM |
112 | /* hash: static value 10.1.1.1 1b) hmac / ctr: key */ |
113 | unsigned char *C; | |
3cfc3b97 | 114 | unsigned char *Cbuf; |
3e16f959 SM |
115 | /* Number of RNG requests since last reseed -- 10.1.1.1 1c) */ |
116 | size_t reseed_ctr; | |
42ea507f | 117 | size_t reseed_threshold; |
3e16f959 SM |
118 | /* some memory the DRBG can use for its operation */ |
119 | unsigned char *scratchpad; | |
3cfc3b97 | 120 | unsigned char *scratchpadbuf; |
3e16f959 | 121 | void *priv_data; /* Cipher handle */ |
35591285 SM |
122 | |
123 | struct crypto_skcipher *ctr_handle; /* CTR mode cipher handle */ | |
124 | struct skcipher_request *ctr_req; /* CTR mode request handle */ | |
51029812 SM |
125 | __u8 *outscratchpadbuf; /* CTR mode output scratchpad */ |
126 | __u8 *outscratchpad; /* CTR mode aligned outbuf */ | |
85a2dea4 | 127 | struct crypto_wait ctr_wait; /* CTR mode async wait obj */ |
cf862cbc | 128 | struct scatterlist sg_in, sg_out; /* CTR mode SGLs */ |
35591285 | 129 | |
3e16f959 SM |
130 | bool seeded; /* DRBG fully seeded? */ |
131 | bool pr; /* Prediction resistance enabled? */ | |
db07cd26 SM |
132 | bool fips_primed; /* Continuous test primed? */ |
133 | unsigned char *prev; /* FIPS 140-2 continuous test value */ | |
4c787990 | 134 | struct work_struct seed_work; /* asynchronous seeding support */ |
b8ec5ba4 | 135 | struct crypto_rng *jent; |
3e16f959 SM |
136 | const struct drbg_state_ops *d_ops; |
137 | const struct drbg_core *core; | |
8fded592 | 138 | struct drbg_string test_data; |
57225e67 | 139 | struct random_ready_callback random_ready; |
3e16f959 SM |
140 | }; |
141 | ||
142 | static inline __u8 drbg_statelen(struct drbg_state *drbg) | |
143 | { | |
144 | if (drbg && drbg->core) | |
145 | return drbg->core->statelen; | |
146 | return 0; | |
147 | } | |
148 | ||
149 | static inline __u8 drbg_blocklen(struct drbg_state *drbg) | |
150 | { | |
151 | if (drbg && drbg->core) | |
152 | return drbg->core->blocklen_bytes; | |
153 | return 0; | |
154 | } | |
155 | ||
156 | static inline __u8 drbg_keylen(struct drbg_state *drbg) | |
157 | { | |
158 | if (drbg && drbg->core) | |
159 | return (drbg->core->statelen - drbg->core->blocklen_bytes); | |
160 | return 0; | |
161 | } | |
162 | ||
163 | static inline size_t drbg_max_request_bytes(struct drbg_state *drbg) | |
164 | { | |
05c81ccd SM |
165 | /* SP800-90A requires the limit 2**19 bits, but we return bytes */ |
166 | return (1 << 16); | |
3e16f959 SM |
167 | } |
168 | ||
169 | static inline size_t drbg_max_addtl(struct drbg_state *drbg) | |
170 | { | |
05c81ccd | 171 | /* SP800-90A requires 2**35 bytes additional info str / pers str */ |
b9347aff SM |
172 | #if (__BITS_PER_LONG == 32) |
173 | /* | |
174 | * SP800-90A allows smaller maximum numbers to be returned -- we | |
175 | * return SIZE_MAX - 1 to allow the verification of the enforcement | |
176 | * of this value in drbg_healthcheck_sanity. | |
177 | */ | |
178 | return (SIZE_MAX - 1); | |
179 | #else | |
05c81ccd | 180 | return (1UL<<35); |
b9347aff | 181 | #endif |
3e16f959 SM |
182 | } |
183 | ||
184 | static inline size_t drbg_max_requests(struct drbg_state *drbg) | |
185 | { | |
05c81ccd | 186 | /* SP800-90A requires 2**48 maximum requests before reseeding */ |
b9347aff SM |
187 | #if (__BITS_PER_LONG == 32) |
188 | return SIZE_MAX; | |
189 | #else | |
05c81ccd | 190 | return (1UL<<48); |
b9347aff | 191 | #endif |
3e16f959 SM |
192 | } |
193 | ||
3e16f959 SM |
194 | /* |
195 | * This is a wrapper to the kernel crypto API function of | |
8fded592 | 196 | * crypto_rng_generate() to allow the caller to provide additional data. |
3e16f959 SM |
197 | * |
198 | * @drng DRBG handle -- see crypto_rng_get_bytes | |
199 | * @outbuf output buffer -- see crypto_rng_get_bytes | |
200 | * @outlen length of output buffer -- see crypto_rng_get_bytes | |
201 | * @addtl_input additional information string input buffer | |
202 | * @addtllen length of additional information string buffer | |
203 | * | |
204 | * return | |
205 | * see crypto_rng_get_bytes | |
206 | */ | |
207 | static inline int crypto_drbg_get_bytes_addtl(struct crypto_rng *drng, | |
208 | unsigned char *outbuf, unsigned int outlen, | |
209 | struct drbg_string *addtl) | |
210 | { | |
8fded592 HX |
211 | return crypto_rng_generate(drng, addtl->buf, addtl->len, |
212 | outbuf, outlen); | |
3e16f959 SM |
213 | } |
214 | ||
215 | /* | |
216 | * TEST code | |
217 | * | |
218 | * This is a wrapper to the kernel crypto API function of | |
8fded592 | 219 | * crypto_rng_generate() to allow the caller to provide additional data and |
3e16f959 SM |
220 | * allow furnishing of test_data |
221 | * | |
222 | * @drng DRBG handle -- see crypto_rng_get_bytes | |
223 | * @outbuf output buffer -- see crypto_rng_get_bytes | |
224 | * @outlen length of output buffer -- see crypto_rng_get_bytes | |
225 | * @addtl_input additional information string input buffer | |
226 | * @addtllen length of additional information string buffer | |
227 | * @test_data filled test data | |
228 | * | |
229 | * return | |
230 | * see crypto_rng_get_bytes | |
231 | */ | |
232 | static inline int crypto_drbg_get_bytes_addtl_test(struct crypto_rng *drng, | |
233 | unsigned char *outbuf, unsigned int outlen, | |
234 | struct drbg_string *addtl, | |
235 | struct drbg_test_data *test_data) | |
236 | { | |
8fded592 HX |
237 | crypto_rng_set_entropy(drng, test_data->testentropy->buf, |
238 | test_data->testentropy->len); | |
239 | return crypto_rng_generate(drng, addtl->buf, addtl->len, | |
240 | outbuf, outlen); | |
3e16f959 SM |
241 | } |
242 | ||
243 | /* | |
244 | * TEST code | |
245 | * | |
246 | * This is a wrapper to the kernel crypto API function of | |
247 | * crypto_rng_reset() to allow the caller to provide test_data | |
248 | * | |
249 | * @drng DRBG handle -- see crypto_rng_reset | |
250 | * @pers personalization string input buffer | |
251 | * @perslen length of additional information string buffer | |
252 | * @test_data filled test data | |
253 | * | |
254 | * return | |
255 | * see crypto_rng_reset | |
256 | */ | |
257 | static inline int crypto_drbg_reset_test(struct crypto_rng *drng, | |
258 | struct drbg_string *pers, | |
259 | struct drbg_test_data *test_data) | |
260 | { | |
8fded592 HX |
261 | crypto_rng_set_entropy(drng, test_data->testentropy->buf, |
262 | test_data->testentropy->len); | |
263 | return crypto_rng_reset(drng, pers->buf, pers->len); | |
3e16f959 SM |
264 | } |
265 | ||
266 | /* DRBG type flags */ | |
267 | #define DRBG_CTR ((drbg_flag_t)1<<0) | |
268 | #define DRBG_HMAC ((drbg_flag_t)1<<1) | |
269 | #define DRBG_HASH ((drbg_flag_t)1<<2) | |
270 | #define DRBG_TYPE_MASK (DRBG_CTR | DRBG_HMAC | DRBG_HASH) | |
271 | /* DRBG strength flags */ | |
272 | #define DRBG_STRENGTH128 ((drbg_flag_t)1<<3) | |
273 | #define DRBG_STRENGTH192 ((drbg_flag_t)1<<4) | |
274 | #define DRBG_STRENGTH256 ((drbg_flag_t)1<<5) | |
275 | #define DRBG_STRENGTH_MASK (DRBG_STRENGTH128 | DRBG_STRENGTH192 | \ | |
276 | DRBG_STRENGTH256) | |
277 | ||
278 | enum drbg_prefixes { | |
279 | DRBG_PREFIX0 = 0x00, | |
280 | DRBG_PREFIX1, | |
281 | DRBG_PREFIX2, | |
282 | DRBG_PREFIX3 | |
283 | }; | |
284 | ||
285 | #endif /* _DRBG_H */ |