]>
git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - include/crypto/drbg.h
2 * DRBG based on NIST SP800-90A
4 * Copyright Stephan Mueller <smueller@chronox.de>, 2014
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, and the entire permission notice in its entirety,
11 * including the disclaimer of warranties.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote
16 * products derived from this software without specific prior
19 * ALTERNATIVELY, this product may be distributed under the terms of
20 * the GNU General Public License, in which case the provisions of the GPL are
21 * required INSTEAD OF the above restrictions. (This clause is
22 * necessary due to a potential bad interaction between the GPL and
23 * the restrictions contained in a BSD-style copyright.)
25 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
26 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
28 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
29 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
31 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
32 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
35 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
43 #include <linux/random.h>
44 #include <linux/scatterlist.h>
45 #include <crypto/hash.h>
46 #include <linux/module.h>
47 #include <linux/crypto.h>
48 #include <linux/slab.h>
49 #include <crypto/internal/rng.h>
50 #include <crypto/rng.h>
51 #include <linux/fips.h>
52 #include <linux/spinlock.h>
53 #include <linux/list.h>
56 * Concatenation Helper and string operation helper
58 * SP800-90A requires the concatenation of different data. To avoid copying
59 * buffers around or allocate additional memory, the following data structure
60 * is used to point to the original memory with its size. In addition, it
61 * is used to build a linked list. The linked list defines the concatenation
62 * of individual buffers. The order of memory block referenced in that
63 * linked list determines the order of concatenation.
66 const unsigned char *buf
;
68 struct list_head list
;
71 static inline void drbg_string_fill(struct drbg_string
*string
,
72 const unsigned char *buf
, size_t len
)
76 INIT_LIST_HEAD(&string
->list
);
80 typedef uint32_t drbg_flag_t
;
83 drbg_flag_t flags
; /* flags for the cipher */
84 __u8 statelen
; /* maximum state length */
86 * maximum length of personalization string or additional input
87 * string -- exponent for base 2
90 /* maximum bits per RNG request -- exponent for base 2*/
92 /* maximum number of requests -- exponent for base 2 */
94 __u8 blocklen_bytes
; /* block size of output in bytes */
95 char cra_name
[CRYPTO_MAX_ALG_NAME
]; /* mapping to kernel crypto API */
96 /* kernel crypto API backend cipher name */
97 char backend_cra_name
[CRYPTO_MAX_ALG_NAME
];
100 struct drbg_state_ops
{
101 int (*update
)(struct drbg_state
*drbg
, struct list_head
*seed
,
103 int (*generate
)(struct drbg_state
*drbg
,
104 unsigned char *buf
, unsigned int buflen
,
105 struct list_head
*addtl
);
106 int (*crypto_init
)(struct drbg_state
*drbg
);
107 int (*crypto_fini
)(struct drbg_state
*drbg
);
111 struct drbg_test_data
{
112 struct drbg_string
*testentropy
; /* TEST PARAMETER: test entropy */
116 spinlock_t drbg_lock
; /* lock around DRBG */
117 unsigned char *V
; /* internal state 10.1.1.1 1a) */
118 /* hash: static value 10.1.1.1 1b) hmac / ctr: key */
120 /* Number of RNG requests since last reseed -- 10.1.1.1 1c) */
122 /* some memory the DRBG can use for its operation */
123 unsigned char *scratchpad
;
124 void *priv_data
; /* Cipher handle */
125 bool seeded
; /* DRBG fully seeded? */
126 bool pr
; /* Prediction resistance enabled? */
127 #ifdef CONFIG_CRYPTO_FIPS
128 bool fips_primed
; /* Continuous test primed? */
129 unsigned char *prev
; /* FIPS 140-2 continuous test value */
131 const struct drbg_state_ops
*d_ops
;
132 const struct drbg_core
*core
;
133 struct drbg_test_data
*test_data
;
136 static inline __u8
drbg_statelen(struct drbg_state
*drbg
)
138 if (drbg
&& drbg
->core
)
139 return drbg
->core
->statelen
;
143 static inline __u8
drbg_blocklen(struct drbg_state
*drbg
)
145 if (drbg
&& drbg
->core
)
146 return drbg
->core
->blocklen_bytes
;
150 static inline __u8
drbg_keylen(struct drbg_state
*drbg
)
152 if (drbg
&& drbg
->core
)
153 return (drbg
->core
->statelen
- drbg
->core
->blocklen_bytes
);
157 static inline size_t drbg_max_request_bytes(struct drbg_state
*drbg
)
159 /* max_bits is in bits, but buflen is in bytes */
160 return (1 << (drbg
->core
->max_bits
- 3));
163 static inline size_t drbg_max_addtl(struct drbg_state
*drbg
)
165 #if (__BITS_PER_LONG == 32)
167 * SP800-90A allows smaller maximum numbers to be returned -- we
168 * return SIZE_MAX - 1 to allow the verification of the enforcement
169 * of this value in drbg_healthcheck_sanity.
171 return (SIZE_MAX
- 1);
173 return (1UL<<(drbg
->core
->max_addtllen
));
177 static inline size_t drbg_max_requests(struct drbg_state
*drbg
)
179 #if (__BITS_PER_LONG == 32)
182 return (1UL<<(drbg
->core
->max_req
));
187 * kernel crypto API input data structure for DRBG generate in case dlen
191 unsigned char *outbuf
; /* output buffer for random numbers */
192 unsigned int outlen
; /* size of output buffer */
193 struct drbg_string
*addtl
; /* additional information string */
194 struct drbg_test_data
*test_data
; /* test data */
198 * This is a wrapper to the kernel crypto API function of
199 * crypto_rng_get_bytes() to allow the caller to provide additional data.
201 * @drng DRBG handle -- see crypto_rng_get_bytes
202 * @outbuf output buffer -- see crypto_rng_get_bytes
203 * @outlen length of output buffer -- see crypto_rng_get_bytes
204 * @addtl_input additional information string input buffer
205 * @addtllen length of additional information string buffer
208 * see crypto_rng_get_bytes
210 static inline int crypto_drbg_get_bytes_addtl(struct crypto_rng
*drng
,
211 unsigned char *outbuf
, unsigned int outlen
,
212 struct drbg_string
*addtl
)
215 struct drbg_gen genbuf
;
216 genbuf
.outbuf
= outbuf
;
217 genbuf
.outlen
= outlen
;
218 genbuf
.addtl
= addtl
;
219 genbuf
.test_data
= NULL
;
220 ret
= crypto_rng_get_bytes(drng
, (u8
*)&genbuf
, 0);
227 * This is a wrapper to the kernel crypto API function of
228 * crypto_rng_get_bytes() to allow the caller to provide additional data and
229 * allow furnishing of test_data
231 * @drng DRBG handle -- see crypto_rng_get_bytes
232 * @outbuf output buffer -- see crypto_rng_get_bytes
233 * @outlen length of output buffer -- see crypto_rng_get_bytes
234 * @addtl_input additional information string input buffer
235 * @addtllen length of additional information string buffer
236 * @test_data filled test data
239 * see crypto_rng_get_bytes
241 static inline int crypto_drbg_get_bytes_addtl_test(struct crypto_rng
*drng
,
242 unsigned char *outbuf
, unsigned int outlen
,
243 struct drbg_string
*addtl
,
244 struct drbg_test_data
*test_data
)
247 struct drbg_gen genbuf
;
248 genbuf
.outbuf
= outbuf
;
249 genbuf
.outlen
= outlen
;
250 genbuf
.addtl
= addtl
;
251 genbuf
.test_data
= test_data
;
252 ret
= crypto_rng_get_bytes(drng
, (u8
*)&genbuf
, 0);
259 * This is a wrapper to the kernel crypto API function of
260 * crypto_rng_reset() to allow the caller to provide test_data
262 * @drng DRBG handle -- see crypto_rng_reset
263 * @pers personalization string input buffer
264 * @perslen length of additional information string buffer
265 * @test_data filled test data
268 * see crypto_rng_reset
270 static inline int crypto_drbg_reset_test(struct crypto_rng
*drng
,
271 struct drbg_string
*pers
,
272 struct drbg_test_data
*test_data
)
275 struct drbg_gen genbuf
;
276 genbuf
.outbuf
= NULL
;
279 genbuf
.test_data
= test_data
;
280 ret
= crypto_rng_reset(drng
, (u8
*)&genbuf
, 0);
284 /* DRBG type flags */
285 #define DRBG_CTR ((drbg_flag_t)1<<0)
286 #define DRBG_HMAC ((drbg_flag_t)1<<1)
287 #define DRBG_HASH ((drbg_flag_t)1<<2)
288 #define DRBG_TYPE_MASK (DRBG_CTR | DRBG_HMAC | DRBG_HASH)
289 /* DRBG strength flags */
290 #define DRBG_STRENGTH128 ((drbg_flag_t)1<<3)
291 #define DRBG_STRENGTH192 ((drbg_flag_t)1<<4)
292 #define DRBG_STRENGTH256 ((drbg_flag_t)1<<5)
293 #define DRBG_STRENGTH_MASK (DRBG_STRENGTH128 | DRBG_STRENGTH192 | \