]>
git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/blob - crypto/ansi_cprng.c
2 * PRNG: Pseudo Random Number Generator
3 * Based on NIST Recommended PRNG From ANSI X9.31 Appendix A.2.4 using
6 * (C) Neil Horman <nhorman@tuxdriver.com>
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
16 #include <crypto/internal/rng.h>
17 #include <linux/err.h>
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/moduleparam.h>
21 #include <linux/string.h>
23 #define DEFAULT_PRNG_KEY "0123456789abcdef"
24 #define DEFAULT_PRNG_KSZ 16
25 #define DEFAULT_BLK_SZ 16
26 #define DEFAULT_V_SEED "zaybxcwdveuftgsh"
29 * Flags for the prng_context flags field
32 #define PRNG_FIXED_SIZE 0x1
33 #define PRNG_NEED_RESET 0x2
36 * Note: DT is our counter value
37 * I is our intermediate value
38 * V is our seed vector
39 * See http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext.pdf
40 * for implementation details
46 unsigned char rand_data
[DEFAULT_BLK_SZ
];
47 unsigned char last_rand_data
[DEFAULT_BLK_SZ
];
48 unsigned char DT
[DEFAULT_BLK_SZ
];
49 unsigned char I
[DEFAULT_BLK_SZ
];
50 unsigned char V
[DEFAULT_BLK_SZ
];
52 struct crypto_cipher
*tfm
;
58 static void hexdump(char *note
, unsigned char *buf
, unsigned int len
)
61 printk(KERN_CRIT
"%s", note
);
62 print_hex_dump(KERN_CONT
, "", DUMP_PREFIX_OFFSET
,
68 #define dbgprint(format, args...) do {\
70 printk(format, ##args);\
73 static void xor_vectors(unsigned char *in1
, unsigned char *in2
,
74 unsigned char *out
, unsigned int size
)
78 for (i
= 0; i
< size
; i
++)
79 out
[i
] = in1
[i
] ^ in2
[i
];
83 * Returns DEFAULT_BLK_SZ bytes of random data per call
84 * returns 0 if generation succeeded, <0 if something went wrong
86 static int _get_more_prng_bytes(struct prng_context
*ctx
, int cont_test
)
89 unsigned char tmp
[DEFAULT_BLK_SZ
];
90 unsigned char *output
= NULL
;
93 dbgprint(KERN_CRIT
"Calling _get_more_prng_bytes for context %p\n",
96 hexdump("Input DT: ", ctx
->DT
, DEFAULT_BLK_SZ
);
97 hexdump("Input I: ", ctx
->I
, DEFAULT_BLK_SZ
);
98 hexdump("Input V: ", ctx
->V
, DEFAULT_BLK_SZ
);
101 * This algorithm is a 3 stage state machine
103 for (i
= 0; i
< 3; i
++) {
108 * Start by encrypting the counter value
109 * This gives us an intermediate value I
111 memcpy(tmp
, ctx
->DT
, DEFAULT_BLK_SZ
);
113 hexdump("tmp stage 0: ", tmp
, DEFAULT_BLK_SZ
);
118 * Next xor I with our secret vector V
119 * encrypt that result to obtain our
120 * pseudo random data which we output
122 xor_vectors(ctx
->I
, ctx
->V
, tmp
, DEFAULT_BLK_SZ
);
123 hexdump("tmp stage 1: ", tmp
, DEFAULT_BLK_SZ
);
124 output
= ctx
->rand_data
;
128 * First check that we didn't produce the same
129 * random data that we did last time around through this
131 if (!memcmp(ctx
->rand_data
, ctx
->last_rand_data
,
134 panic("cprng %p Failed repetition check!\n",
139 "ctx %p Failed repetition check!\n",
142 ctx
->flags
|= PRNG_NEED_RESET
;
145 memcpy(ctx
->last_rand_data
, ctx
->rand_data
,
149 * Lastly xor the random data with I
150 * and encrypt that to obtain a new secret vector V
152 xor_vectors(ctx
->rand_data
, ctx
->I
, tmp
,
155 hexdump("tmp stage 2: ", tmp
, DEFAULT_BLK_SZ
);
160 /* do the encryption */
161 crypto_cipher_encrypt_one(ctx
->tfm
, output
, tmp
);
166 * Now update our DT value
168 for (i
= DEFAULT_BLK_SZ
- 1; i
>= 0; i
--) {
174 dbgprint("Returning new block for context %p\n", ctx
);
175 ctx
->rand_data_valid
= 0;
177 hexdump("Output DT: ", ctx
->DT
, DEFAULT_BLK_SZ
);
178 hexdump("Output I: ", ctx
->I
, DEFAULT_BLK_SZ
);
179 hexdump("Output V: ", ctx
->V
, DEFAULT_BLK_SZ
);
180 hexdump("New Random Data: ", ctx
->rand_data
, DEFAULT_BLK_SZ
);
185 /* Our exported functions */
186 static int get_prng_bytes(char *buf
, size_t nbytes
, struct prng_context
*ctx
,
189 unsigned char *ptr
= buf
;
190 unsigned int byte_count
= (unsigned int)nbytes
;
194 spin_lock_bh(&ctx
->prng_lock
);
197 if (ctx
->flags
& PRNG_NEED_RESET
)
201 * If the FIXED_SIZE flag is on, only return whole blocks of
205 if (ctx
->flags
& PRNG_FIXED_SIZE
) {
206 if (nbytes
< DEFAULT_BLK_SZ
)
208 byte_count
= DEFAULT_BLK_SZ
;
212 * Return 0 in case of success as mandated by the kernel
213 * crypto API interface definition.
217 dbgprint(KERN_CRIT
"getting %d random bytes for context %p\n",
222 if (ctx
->rand_data_valid
== DEFAULT_BLK_SZ
) {
223 if (_get_more_prng_bytes(ctx
, do_cont_test
) < 0) {
224 memset(buf
, 0, nbytes
);
231 * Copy any data less than an entire block
233 if (byte_count
< DEFAULT_BLK_SZ
) {
235 while (ctx
->rand_data_valid
< DEFAULT_BLK_SZ
) {
236 *ptr
= ctx
->rand_data
[ctx
->rand_data_valid
];
239 ctx
->rand_data_valid
++;
246 * Now copy whole blocks
248 for (; byte_count
>= DEFAULT_BLK_SZ
; byte_count
-= DEFAULT_BLK_SZ
) {
249 if (ctx
->rand_data_valid
== DEFAULT_BLK_SZ
) {
250 if (_get_more_prng_bytes(ctx
, do_cont_test
) < 0) {
251 memset(buf
, 0, nbytes
);
256 if (ctx
->rand_data_valid
> 0)
258 memcpy(ptr
, ctx
->rand_data
, DEFAULT_BLK_SZ
);
259 ctx
->rand_data_valid
+= DEFAULT_BLK_SZ
;
260 ptr
+= DEFAULT_BLK_SZ
;
264 * Now go back and get any remaining partial block
270 spin_unlock_bh(&ctx
->prng_lock
);
271 dbgprint(KERN_CRIT
"returning %d from get_prng_bytes in context %p\n",
276 static void free_prng_context(struct prng_context
*ctx
)
278 crypto_free_cipher(ctx
->tfm
);
281 static int reset_prng_context(struct prng_context
*ctx
,
282 const unsigned char *key
, size_t klen
,
283 const unsigned char *V
, const unsigned char *DT
)
286 const unsigned char *prng_key
;
288 spin_lock_bh(&ctx
->prng_lock
);
289 ctx
->flags
|= PRNG_NEED_RESET
;
291 prng_key
= (key
!= NULL
) ? key
: (unsigned char *)DEFAULT_PRNG_KEY
;
294 klen
= DEFAULT_PRNG_KSZ
;
297 memcpy(ctx
->V
, V
, DEFAULT_BLK_SZ
);
299 memcpy(ctx
->V
, DEFAULT_V_SEED
, DEFAULT_BLK_SZ
);
302 memcpy(ctx
->DT
, DT
, DEFAULT_BLK_SZ
);
304 memset(ctx
->DT
, 0, DEFAULT_BLK_SZ
);
306 memset(ctx
->rand_data
, 0, DEFAULT_BLK_SZ
);
307 memset(ctx
->last_rand_data
, 0, DEFAULT_BLK_SZ
);
309 ctx
->rand_data_valid
= DEFAULT_BLK_SZ
;
311 ret
= crypto_cipher_setkey(ctx
->tfm
, prng_key
, klen
);
313 dbgprint(KERN_CRIT
"PRNG: setkey() failed flags=%x\n",
314 crypto_cipher_get_flags(ctx
->tfm
));
319 ctx
->flags
&= ~PRNG_NEED_RESET
;
321 spin_unlock_bh(&ctx
->prng_lock
);
325 static int cprng_init(struct crypto_tfm
*tfm
)
327 struct prng_context
*ctx
= crypto_tfm_ctx(tfm
);
329 spin_lock_init(&ctx
->prng_lock
);
330 ctx
->tfm
= crypto_alloc_cipher("aes", 0, 0);
331 if (IS_ERR(ctx
->tfm
)) {
332 dbgprint(KERN_CRIT
"Failed to alloc tfm for context %p\n",
334 return PTR_ERR(ctx
->tfm
);
337 if (reset_prng_context(ctx
, NULL
, DEFAULT_PRNG_KSZ
, NULL
, NULL
) < 0)
341 * after allocation, we should always force the user to reset
342 * so they don't inadvertently use the insecure default values
343 * without specifying them intentially
345 ctx
->flags
|= PRNG_NEED_RESET
;
349 static void cprng_exit(struct crypto_tfm
*tfm
)
351 free_prng_context(crypto_tfm_ctx(tfm
));
354 static int cprng_get_random(struct crypto_rng
*tfm
,
355 const u8
*src
, unsigned int slen
,
356 u8
*rdata
, unsigned int dlen
)
358 struct prng_context
*prng
= crypto_rng_ctx(tfm
);
360 return get_prng_bytes(rdata
, dlen
, prng
, 0);
364 * This is the cprng_registered reset method the seed value is
365 * interpreted as the tuple { V KEY DT}
366 * V and KEY are required during reset, and DT is optional, detected
367 * as being present by testing the length of the seed
369 static int cprng_reset(struct crypto_rng
*tfm
,
370 const u8
*seed
, unsigned int slen
)
372 struct prng_context
*prng
= crypto_rng_ctx(tfm
);
373 const u8
*key
= seed
+ DEFAULT_BLK_SZ
;
376 if (slen
< DEFAULT_PRNG_KSZ
+ DEFAULT_BLK_SZ
)
379 if (slen
>= (2 * DEFAULT_BLK_SZ
+ DEFAULT_PRNG_KSZ
))
380 dt
= key
+ DEFAULT_PRNG_KSZ
;
382 reset_prng_context(prng
, key
, DEFAULT_PRNG_KSZ
, seed
, dt
);
384 if (prng
->flags
& PRNG_NEED_RESET
)
389 #ifdef CONFIG_CRYPTO_FIPS
390 static int fips_cprng_get_random(struct crypto_rng
*tfm
,
391 const u8
*src
, unsigned int slen
,
392 u8
*rdata
, unsigned int dlen
)
394 struct prng_context
*prng
= crypto_rng_ctx(tfm
);
396 return get_prng_bytes(rdata
, dlen
, prng
, 1);
399 static int fips_cprng_reset(struct crypto_rng
*tfm
,
400 const u8
*seed
, unsigned int slen
)
402 u8 rdata
[DEFAULT_BLK_SZ
];
403 const u8
*key
= seed
+ DEFAULT_BLK_SZ
;
406 struct prng_context
*prng
= crypto_rng_ctx(tfm
);
408 if (slen
< DEFAULT_PRNG_KSZ
+ DEFAULT_BLK_SZ
)
411 /* fips strictly requires seed != key */
412 if (!memcmp(seed
, key
, DEFAULT_PRNG_KSZ
))
415 rc
= cprng_reset(tfm
, seed
, slen
);
420 /* this primes our continuity test */
421 rc
= get_prng_bytes(rdata
, DEFAULT_BLK_SZ
, prng
, 0);
422 prng
->rand_data_valid
= DEFAULT_BLK_SZ
;
429 static struct rng_alg rng_algs
[] = { {
430 .generate
= cprng_get_random
,
432 .seedsize
= DEFAULT_PRNG_KSZ
+ 2 * DEFAULT_BLK_SZ
,
434 .cra_name
= "stdrng",
435 .cra_driver_name
= "ansi_cprng",
437 .cra_ctxsize
= sizeof(struct prng_context
),
438 .cra_module
= THIS_MODULE
,
439 .cra_init
= cprng_init
,
440 .cra_exit
= cprng_exit
,
442 #ifdef CONFIG_CRYPTO_FIPS
444 .generate
= fips_cprng_get_random
,
445 .seed
= fips_cprng_reset
,
446 .seedsize
= DEFAULT_PRNG_KSZ
+ 2 * DEFAULT_BLK_SZ
,
448 .cra_name
= "fips(ansi_cprng)",
449 .cra_driver_name
= "fips_ansi_cprng",
451 .cra_ctxsize
= sizeof(struct prng_context
),
452 .cra_module
= THIS_MODULE
,
453 .cra_init
= cprng_init
,
454 .cra_exit
= cprng_exit
,
459 /* Module initalization */
460 static int __init
prng_mod_init(void)
462 return crypto_register_rngs(rng_algs
, ARRAY_SIZE(rng_algs
));
465 static void __exit
prng_mod_fini(void)
467 crypto_unregister_rngs(rng_algs
, ARRAY_SIZE(rng_algs
));
470 MODULE_LICENSE("GPL");
471 MODULE_DESCRIPTION("Software Pseudo Random Number Generator");
472 MODULE_AUTHOR("Neil Horman <nhorman@tuxdriver.com>");
473 module_param(dbg
, int, 0);
474 MODULE_PARM_DESC(dbg
, "Boolean to enable debugging (0/1 == off/on)");
475 subsys_initcall(prng_mod_init
);
476 module_exit(prng_mod_fini
);
477 MODULE_ALIAS_CRYPTO("stdrng");
478 MODULE_ALIAS_CRYPTO("ansi_cprng");