crypto/drbg.c

   1 /*
   2  * DRBG: Deterministic Random Bits Generator
   3  *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
   4  *       properties:
   5  *              * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
   6  *              * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   7  *              * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   8  *              * with and without prediction resistance
   9  *
  10  * Copyright Stephan Mueller <smueller@chronox.de>, 2014
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, and the entire permission notice in its entirety,
  17  *    including the disclaimer of warranties.
  18  * 2. Redistributions in binary form must reproduce the above copyright
  19  *    notice, this list of conditions and the following disclaimer in the
  20  *    documentation and/or other materials provided with the distribution.
  21  * 3. The name of the author may not be used to endorse or promote
  22  *    products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * ALTERNATIVELY, this product may be distributed under the terms of
  26  * the GNU General Public License, in which case the provisions of the GPL are
  27  * required INSTEAD OF the above restrictions.  (This clause is
  28  * necessary due to a potential bad interaction between the GPL and
  29  * the restrictions contained in a BSD-style copyright.)
  30  *
  31  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34  * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
  35  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41  * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42  * DAMAGE.
  43  *
  44  * DRBG Usage
  45  * ==========
  46  * The SP 800-90A DRBG allows the user to specify a personalization string
  47  * for initialization as well as an additional information string for each
  48  * random number request. The following code fragments show how a caller
  49  * uses the kernel crypto API to use the full functionality of the DRBG.
  50  *
  51  * Usage without any additional data
  52  * ---------------------------------
  53  * struct crypto_rng *drng;
  54  * int err;
  55  * char data[DATALEN];
  56  *
  57  * drng = crypto_alloc_rng(drng_name, 0, 0);
  58  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59  * crypto_free_rng(drng);
  60  *
  61  *
  62  * Usage with personalization string during initialization
  63  * -------------------------------------------------------
  64  * struct crypto_rng *drng;
  65  * int err;
  66  * char data[DATALEN];
  67  * struct drbg_string pers;
  68  * char personalization[11] = "some-string";
  69  *
  70  * drbg_string_fill(&pers, personalization, strlen(personalization));
  71  * drng = crypto_alloc_rng(drng_name, 0, 0);
  72  * // The reset completely re-initializes the DRBG with the provided
  73  * // personalization string
  74  * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76  * crypto_free_rng(drng);
  77  *
  78  *
  79  * Usage with additional information string during random number request
  80  * ---------------------------------------------------------------------
  81  * struct crypto_rng *drng;
  82  * int err;
  83  * char data[DATALEN];
  84  * char addtl_string[11] = "some-string";
  85  * string drbg_string addtl;
  86  *
  87  * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88  * drng = crypto_alloc_rng(drng_name, 0, 0);
  89  * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90  * // the same error codes.
  91  * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92  * crypto_free_rng(drng);
  93  *
  94  *
  95  * Usage with personalization and additional information strings
  96  * -------------------------------------------------------------
  97  * Just mix both scenarios above.
  98  */
  99
 100 #include <crypto/drbg.h>
 101 #include <linux/kernel.h>
 102
 103 /***************************************************************
 104  * Backend cipher definitions available to DRBG
 105  ***************************************************************/
 106
 107 /*
 108  * The order of the DRBG definitions here matter: every DRBG is registered
 109  * as stdrng. Each DRBG receives an increasing cra_priority values the later
 110  * they are defined in this array (see drbg_fill_array).
 111  *
 112  * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
 113  * the SHA256 / AES 256 over other ciphers. Thus, the favored
 114  * DRBGs are the latest entries in this array.
 115  */
 116 static const struct drbg_core drbg_cores[] = {
 117 #ifdef CONFIG_CRYPTO_DRBG_CTR
 118         {
 119                 .flags = DRBG_CTR | DRBG_STRENGTH128,
 120                 .statelen = 32, /* 256 bits as defined in 10.2.1 */
 121                 .blocklen_bytes = 16,
 122                 .cra_name = "ctr_aes128",
 123                 .backend_cra_name = "aes",
 124         }, {
 125                 .flags = DRBG_CTR | DRBG_STRENGTH192,
 126                 .statelen = 40, /* 320 bits as defined in 10.2.1 */
 127                 .blocklen_bytes = 16,
 128                 .cra_name = "ctr_aes192",
 129                 .backend_cra_name = "aes",
 130         }, {
 131                 .flags = DRBG_CTR | DRBG_STRENGTH256,
 132                 .statelen = 48, /* 384 bits as defined in 10.2.1 */
 133                 .blocklen_bytes = 16,
 134                 .cra_name = "ctr_aes256",
 135                 .backend_cra_name = "aes",
 136         },
 137 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 138 #ifdef CONFIG_CRYPTO_DRBG_HASH
 139         {
 140                 .flags = DRBG_HASH | DRBG_STRENGTH128,
 141                 .statelen = 55, /* 440 bits */
 142                 .blocklen_bytes = 20,
 143                 .cra_name = "sha1",
 144                 .backend_cra_name = "sha1",
 145         }, {
 146                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 147                 .statelen = 111, /* 888 bits */
 148                 .blocklen_bytes = 48,
 149                 .cra_name = "sha384",
 150                 .backend_cra_name = "sha384",
 151         }, {
 152                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 153                 .statelen = 111, /* 888 bits */
 154                 .blocklen_bytes = 64,
 155                 .cra_name = "sha512",
 156                 .backend_cra_name = "sha512",
 157         }, {
 158                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 159                 .statelen = 55, /* 440 bits */
 160                 .blocklen_bytes = 32,
 161                 .cra_name = "sha256",
 162                 .backend_cra_name = "sha256",
 163         },
 164 #endif /* CONFIG_CRYPTO_DRBG_HASH */
 165 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 166         {
 167                 .flags = DRBG_HMAC | DRBG_STRENGTH128,
 168                 .statelen = 20, /* block length of cipher */
 169                 .blocklen_bytes = 20,
 170                 .cra_name = "hmac_sha1",
 171                 .backend_cra_name = "hmac(sha1)",
 172         }, {
 173                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 174                 .statelen = 48, /* block length of cipher */
 175                 .blocklen_bytes = 48,
 176                 .cra_name = "hmac_sha384",
 177                 .backend_cra_name = "hmac(sha384)",
 178         }, {
 179                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 180                 .statelen = 64, /* block length of cipher */
 181                 .blocklen_bytes = 64,
 182                 .cra_name = "hmac_sha512",
 183                 .backend_cra_name = "hmac(sha512)",
 184         }, {
 185                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 186                 .statelen = 32, /* block length of cipher */
 187                 .blocklen_bytes = 32,
 188                 .cra_name = "hmac_sha256",
 189                 .backend_cra_name = "hmac(sha256)",
 190         },
 191 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 192 };
 193
 194 static int drbg_uninstantiate(struct drbg_state *drbg);
 195
 196 /******************************************************************
 197  * Generic helper functions
 198  ******************************************************************/
 199
 200 /*
 201  * Return strength of DRBG according to SP800-90A section 8.4
 202  *
 203  * @flags DRBG flags reference
 204  *
 205  * Return: normalized strength in *bytes* value or 32 as default
 206  *         to counter programming errors
 207  */
 208 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
 209 {
 210         switch (flags & DRBG_STRENGTH_MASK) {
 211         case DRBG_STRENGTH128:
 212                 return 16;
 213         case DRBG_STRENGTH192:
 214                 return 24;
 215         case DRBG_STRENGTH256:
 216                 return 32;
 217         default:
 218                 return 32;
 219         }
 220 }
 221
 222 /*
 223  * FIPS 140-2 continuous self test for the noise source
 224  * The test is performed on the noise source input data. Thus, the function
 225  * implicitly knows the size of the buffer to be equal to the security
 226  * strength.
 227  *
 228  * Note, this function disregards the nonce trailing the entropy data during
 229  * initial seeding.
 230  *
 231  * drbg->drbg_mutex must have been taken.
 232  *
 233  * @drbg DRBG handle
 234  * @entropy buffer of seed data to be checked
 235  *
 236  * return:
 237  *      0 on success
 238  *      -EAGAIN on when the CTRNG is not yet primed
 239  *      < 0 on error
 240  */
 241 static int drbg_fips_continuous_test(struct drbg_state *drbg,
 242                                      const unsigned char *entropy)
 243 {
 244         unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
 245         int ret = 0;
 246
 247         if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
 248                 return 0;
 249
 250         /* skip test if we test the overall system */
 251         if (list_empty(&drbg->test_data.list))
 252                 return 0;
 253         /* only perform test in FIPS mode */
 254         if (!fips_enabled)
 255                 return 0;
 256
 257         if (!drbg->fips_primed) {
 258                 /* Priming of FIPS test */
 259                 memcpy(drbg->prev, entropy, entropylen);
 260                 drbg->fips_primed = true;
 261                 /* priming: another round is needed */
 262                 return -EAGAIN;
 263         }
 264         ret = memcmp(drbg->prev, entropy, entropylen);
 265         if (!ret)
 266                 panic("DRBG continuous self test failed\n");
 267         memcpy(drbg->prev, entropy, entropylen);
 268
 269         /* the test shall pass when the two values are not equal */
 270         return 0;
 271 }
 272
 273 /*
 274  * Convert an integer into a byte representation of this integer.
 275  * The byte representation is big-endian
 276  *
 277  * @val value to be converted
 278  * @buf buffer holding the converted integer -- caller must ensure that
 279  *      buffer size is at least 32 bit
 280  */
 281 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
 282 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
 283 {
 284         struct s {
 285                 __be32 conv;
 286         };
 287         struct s *conversion = (struct s *) buf;
 288
 289         conversion->conv = cpu_to_be32(val);
 290 }
 291 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
 292
 293 /******************************************************************
 294  * CTR DRBG callback functions
 295  ******************************************************************/
 296
 297 #ifdef CONFIG_CRYPTO_DRBG_CTR
 298 #define CRYPTO_DRBG_CTR_STRING "CTR "
 299 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
 300 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
 301 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
 302 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
 303 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
 304 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
 305
 306 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
 307                                  const unsigned char *key);
 308 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
 309                           const struct drbg_string *in);
 310 static int drbg_init_sym_kernel(struct drbg_state *drbg);
 311 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
 312 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
 313                               u8 *inbuf, u32 inbuflen,
 314                               u8 *outbuf, u32 outlen);
 315 #define DRBG_CTR_NULL_LEN 128
 316 #define DRBG_OUTSCRATCHLEN DRBG_CTR_NULL_LEN
 317
 318 /* BCC function for CTR DRBG as defined in 10.4.3 */
 319 static int drbg_ctr_bcc(struct drbg_state *drbg,
 320                         unsigned char *out, const unsigned char *key,
 321                         struct list_head *in)
 322 {
 323         int ret = 0;
 324         struct drbg_string *curr = NULL;
 325         struct drbg_string data;
 326         short cnt = 0;
 327
 328         drbg_string_fill(&data, out, drbg_blocklen(drbg));
 329
 330         /* 10.4.3 step 2 / 4 */
 331         drbg_kcapi_symsetkey(drbg, key);
 332         list_for_each_entry(curr, in, list) {
 333                 const unsigned char *pos = curr->buf;
 334                 size_t len = curr->len;
 335                 /* 10.4.3 step 4.1 */
 336                 while (len) {
 337                         /* 10.4.3 step 4.2 */
 338                         if (drbg_blocklen(drbg) == cnt) {
 339                                 cnt = 0;
 340                                 ret = drbg_kcapi_sym(drbg, out, &data);
 341                                 if (ret)
 342                                         return ret;
 343                         }
 344                         out[cnt] ^= *pos;
 345                         pos++;
 346                         cnt++;
 347                         len--;
 348                 }
 349         }
 350         /* 10.4.3 step 4.2 for last block */
 351         if (cnt)
 352                 ret = drbg_kcapi_sym(drbg, out, &data);
 353
 354         return ret;
 355 }
 356
 357 /*
 358  * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
 359  * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
 360  * the scratchpad is used as follows:
 361  * drbg_ctr_update:
 362  *      temp
 363  *              start: drbg->scratchpad
 364  *              length: drbg_statelen(drbg) + drbg_blocklen(drbg)
 365  *                      note: the cipher writing into this variable works
 366  *                      blocklen-wise. Now, when the statelen is not a multiple
 367  *                      of blocklen, the generateion loop below "spills over"
 368  *                      by at most blocklen. Thus, we need to give sufficient
 369  *                      memory.
 370  *      df_data
 371  *              start: drbg->scratchpad +
 372  *                              drbg_statelen(drbg) + drbg_blocklen(drbg)
 373  *              length: drbg_statelen(drbg)
 374  *
 375  * drbg_ctr_df:
 376  *      pad
 377  *              start: df_data + drbg_statelen(drbg)
 378  *              length: drbg_blocklen(drbg)
 379  *      iv
 380  *              start: pad + drbg_blocklen(drbg)
 381  *              length: drbg_blocklen(drbg)
 382  *      temp
 383  *              start: iv + drbg_blocklen(drbg)
 384  *              length: drbg_satelen(drbg) + drbg_blocklen(drbg)
 385  *                      note: temp is the buffer that the BCC function operates
 386  *                      on. BCC operates blockwise. drbg_statelen(drbg)
 387  *                      is sufficient when the DRBG state length is a multiple
 388  *                      of the block size. For AES192 (and maybe other ciphers)
 389  *                      this is not correct and the length for temp is
 390  *                      insufficient (yes, that also means for such ciphers,
 391  *                      the final output of all BCC rounds are truncated).
 392  *                      Therefore, add drbg_blocklen(drbg) to cover all
 393  *                      possibilities.
 394  */
 395
 396 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
 397 static int drbg_ctr_df(struct drbg_state *drbg,
 398                        unsigned char *df_data, size_t bytes_to_return,
 399                        struct list_head *seedlist)
 400 {
 401         int ret = -EFAULT;
 402         unsigned char L_N[8];
 403         /* S3 is input */
 404         struct drbg_string S1, S2, S4, cipherin;
 405         LIST_HEAD(bcc_list);
 406         unsigned char *pad = df_data + drbg_statelen(drbg);
 407         unsigned char *iv = pad + drbg_blocklen(drbg);
 408         unsigned char *temp = iv + drbg_blocklen(drbg);
 409         size_t padlen = 0;
 410         unsigned int templen = 0;
 411         /* 10.4.2 step 7 */
 412         unsigned int i = 0;
 413         /* 10.4.2 step 8 */
 414         const unsigned char *K = (unsigned char *)
 415                            "\x00\x01\x02\x03\x04\x05\x06\x07"
 416                            "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 417                            "\x10\x11\x12\x13\x14\x15\x16\x17"
 418                            "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
 419         unsigned char *X;
 420         size_t generated_len = 0;
 421         size_t inputlen = 0;
 422         struct drbg_string *seed = NULL;
 423
 424         memset(pad, 0, drbg_blocklen(drbg));
 425         memset(iv, 0, drbg_blocklen(drbg));
 426
 427         /* 10.4.2 step 1 is implicit as we work byte-wise */
 428
 429         /* 10.4.2 step 2 */
 430         if ((512/8) < bytes_to_return)
 431                 return -EINVAL;
 432
 433         /* 10.4.2 step 2 -- calculate the entire length of all input data */
 434         list_for_each_entry(seed, seedlist, list)
 435                 inputlen += seed->len;
 436         drbg_cpu_to_be32(inputlen, &L_N[0]);
 437
 438         /* 10.4.2 step 3 */
 439         drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
 440
 441         /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
 442         padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
 443         /* wrap the padlen appropriately */
 444         if (padlen)
 445                 padlen = drbg_blocklen(drbg) - padlen;
 446         /*
 447          * pad / padlen contains the 0x80 byte and the following zero bytes.
 448          * As the calculated padlen value only covers the number of zero
 449          * bytes, this value has to be incremented by one for the 0x80 byte.
 450          */
 451         padlen++;
 452         pad[0] = 0x80;
 453
 454         /* 10.4.2 step 4 -- first fill the linked list and then order it */
 455         drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
 456         list_add_tail(&S1.list, &bcc_list);
 457         drbg_string_fill(&S2, L_N, sizeof(L_N));
 458         list_add_tail(&S2.list, &bcc_list);
 459         list_splice_tail(seedlist, &bcc_list);
 460         drbg_string_fill(&S4, pad, padlen);
 461         list_add_tail(&S4.list, &bcc_list);
 462
 463         /* 10.4.2 step 9 */
 464         while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
 465                 /*
 466                  * 10.4.2 step 9.1 - the padding is implicit as the buffer
 467                  * holds zeros after allocation -- even the increment of i
 468                  * is irrelevant as the increment remains within length of i
 469                  */
 470                 drbg_cpu_to_be32(i, iv);
 471                 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
 472                 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
 473                 if (ret)
 474                         goto out;
 475                 /* 10.4.2 step 9.3 */
 476                 i++;
 477                 templen += drbg_blocklen(drbg);
 478         }
 479
 480         /* 10.4.2 step 11 */
 481         X = temp + (drbg_keylen(drbg));
 482         drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
 483
 484         /* 10.4.2 step 12: overwriting of outval is implemented in next step */
 485
 486         /* 10.4.2 step 13 */
 487         drbg_kcapi_symsetkey(drbg, temp);
 488         while (generated_len < bytes_to_return) {
 489                 short blocklen = 0;
 490                 /*
 491                  * 10.4.2 step 13.1: the truncation of the key length is
 492                  * implicit as the key is only drbg_blocklen in size based on
 493                  * the implementation of the cipher function callback
 494                  */
 495                 ret = drbg_kcapi_sym(drbg, X, &cipherin);
 496                 if (ret)
 497                         goto out;
 498                 blocklen = (drbg_blocklen(drbg) <
 499                                 (bytes_to_return - generated_len)) ?
 500                             drbg_blocklen(drbg) :
 501                                 (bytes_to_return - generated_len);
 502                 /* 10.4.2 step 13.2 and 14 */
 503                 memcpy(df_data + generated_len, X, blocklen);
 504                 generated_len += blocklen;
 505         }
 506
 507         ret = 0;
 508
 509 out:
 510         memset(iv, 0, drbg_blocklen(drbg));
 511         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 512         memset(pad, 0, drbg_blocklen(drbg));
 513         return ret;
 514 }
 515
 516 /*
 517  * update function of CTR DRBG as defined in 10.2.1.2
 518  *
 519  * The reseed variable has an enhanced meaning compared to the update
 520  * functions of the other DRBGs as follows:
 521  * 0 => initial seed from initialization
 522  * 1 => reseed via drbg_seed
 523  * 2 => first invocation from drbg_ctr_update when addtl is present. In
 524  *      this case, the df_data scratchpad is not deleted so that it is
 525  *      available for another calls to prevent calling the DF function
 526  *      again.
 527  * 3 => second invocation from drbg_ctr_update. When the update function
 528  *      was called with addtl, the df_data memory already contains the
 529  *      DFed addtl information and we do not need to call DF again.
 530  */
 531 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
 532                            int reseed)
 533 {
 534         int ret = -EFAULT;
 535         /* 10.2.1.2 step 1 */
 536         unsigned char *temp = drbg->scratchpad;
 537         unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
 538                                  drbg_blocklen(drbg);
 539
 540         if (3 > reseed)
 541                 memset(df_data, 0, drbg_statelen(drbg));
 542
 543         if (!reseed) {
 544                 /*
 545                  * The DRBG uses the CTR mode of the underlying AES cipher. The
 546                  * CTR mode increments the counter value after the AES operation
 547                  * but SP800-90A requires that the counter is incremented before
 548                  * the AES operation. Hence, we increment it at the time we set
 549                  * it by one.
 550                  */
 551                 crypto_inc(drbg->V, drbg_blocklen(drbg));
 552
 553                 ret = crypto_skcipher_setkey(drbg->ctr_handle, drbg->C,
 554                                              drbg_keylen(drbg));
 555                 if (ret)
 556                         goto out;
 557         }
 558
 559         /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
 560         if (seed) {
 561                 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
 562                 if (ret)
 563                         goto out;
 564         }
 565
 566         ret = drbg_kcapi_sym_ctr(drbg, df_data, drbg_statelen(drbg),
 567                                  temp, drbg_statelen(drbg));
 568         if (ret)
 569                 return ret;
 570
 571         /* 10.2.1.2 step 5 */
 572         ret = crypto_skcipher_setkey(drbg->ctr_handle, temp,
 573                                      drbg_keylen(drbg));
 574         if (ret)
 575                 goto out;
 576         /* 10.2.1.2 step 6 */
 577         memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
 578         /* See above: increment counter by one to compensate timing of CTR op */
 579         crypto_inc(drbg->V, drbg_blocklen(drbg));
 580         ret = 0;
 581
 582 out:
 583         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 584         if (2 != reseed)
 585                 memset(df_data, 0, drbg_statelen(drbg));
 586         return ret;
 587 }
 588
 589 /*
 590  * scratchpad use: drbg_ctr_update is called independently from
 591  * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
 592  */
 593 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
 594 static int drbg_ctr_generate(struct drbg_state *drbg,
 595                              unsigned char *buf, unsigned int buflen,
 596                              struct list_head *addtl)
 597 {
 598         int ret;
 599         int len = min_t(int, buflen, INT_MAX);
 600
 601         /* 10.2.1.5.2 step 2 */
 602         if (addtl && !list_empty(addtl)) {
 603                 ret = drbg_ctr_update(drbg, addtl, 2);
 604                 if (ret)
 605                         return 0;
 606         }
 607
 608         /* 10.2.1.5.2 step 4.1 */
 609         ret = drbg_kcapi_sym_ctr(drbg, drbg->ctr_null_value, DRBG_CTR_NULL_LEN,
 610                                  buf, len);
 611         if (ret)
 612                 return ret;
 613
 614         /* 10.2.1.5.2 step 6 */
 615         ret = drbg_ctr_update(drbg, NULL, 3);
 616         if (ret)
 617                 len = ret;
 618
 619         return len;
 620 }
 621
 622 static const struct drbg_state_ops drbg_ctr_ops = {
 623         .update         = drbg_ctr_update,
 624         .generate       = drbg_ctr_generate,
 625         .crypto_init    = drbg_init_sym_kernel,
 626         .crypto_fini    = drbg_fini_sym_kernel,
 627 };
 628 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 629
 630 /******************************************************************
 631  * HMAC DRBG callback functions
 632  ******************************************************************/
 633
 634 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
 635 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
 636                            const struct list_head *in);
 637 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
 638                                   const unsigned char *key);
 639 static int drbg_init_hash_kernel(struct drbg_state *drbg);
 640 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
 641 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
 642
 643 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 644 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
 645 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
 646 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
 647 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
 648 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
 649 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
 650 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
 651 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
 652 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
 653
 654 /* update function of HMAC DRBG as defined in 10.1.2.2 */
 655 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 656                             int reseed)
 657 {
 658         int ret = -EFAULT;
 659         int i = 0;
 660         struct drbg_string seed1, seed2, vdata;
 661         LIST_HEAD(seedlist);
 662         LIST_HEAD(vdatalist);
 663
 664         if (!reseed) {
 665                 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
 666                 memset(drbg->V, 1, drbg_statelen(drbg));
 667                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 668         }
 669
 670         drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
 671         list_add_tail(&seed1.list, &seedlist);
 672         /* buffer of seed2 will be filled in for loop below with one byte */
 673         drbg_string_fill(&seed2, NULL, 1);
 674         list_add_tail(&seed2.list, &seedlist);
 675         /* input data of seed is allowed to be NULL at this point */
 676         if (seed)
 677                 list_splice_tail(seed, &seedlist);
 678
 679         drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
 680         list_add_tail(&vdata.list, &vdatalist);
 681         for (i = 2; 0 < i; i--) {
 682                 /* first round uses 0x0, second 0x1 */
 683                 unsigned char prefix = DRBG_PREFIX0;
 684                 if (1 == i)
 685                         prefix = DRBG_PREFIX1;
 686                 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
 687                 seed2.buf = &prefix;
 688                 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
 689                 if (ret)
 690                         return ret;
 691                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 692
 693                 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
 694                 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
 695                 if (ret)
 696                         return ret;
 697
 698                 /* 10.1.2.2 step 3 */
 699                 if (!seed)
 700                         return ret;
 701         }
 702
 703         return 0;
 704 }
 705
 706 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
 707 static int drbg_hmac_generate(struct drbg_state *drbg,
 708                               unsigned char *buf,
 709                               unsigned int buflen,
 710                               struct list_head *addtl)
 711 {
 712         int len = 0;
 713         int ret = 0;
 714         struct drbg_string data;
 715         LIST_HEAD(datalist);
 716
 717         /* 10.1.2.5 step 2 */
 718         if (addtl && !list_empty(addtl)) {
 719                 ret = drbg_hmac_update(drbg, addtl, 1);
 720                 if (ret)
 721                         return ret;
 722         }
 723
 724         drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
 725         list_add_tail(&data.list, &datalist);
 726         while (len < buflen) {
 727                 unsigned int outlen = 0;
 728                 /* 10.1.2.5 step 4.1 */
 729                 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
 730                 if (ret)
 731                         return ret;
 732                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 733                           drbg_blocklen(drbg) : (buflen - len);
 734
 735                 /* 10.1.2.5 step 4.2 */
 736                 memcpy(buf + len, drbg->V, outlen);
 737                 len += outlen;
 738         }
 739
 740         /* 10.1.2.5 step 6 */
 741         if (addtl && !list_empty(addtl))
 742                 ret = drbg_hmac_update(drbg, addtl, 1);
 743         else
 744                 ret = drbg_hmac_update(drbg, NULL, 1);
 745         if (ret)
 746                 return ret;
 747
 748         return len;
 749 }
 750
 751 static const struct drbg_state_ops drbg_hmac_ops = {
 752         .update         = drbg_hmac_update,
 753         .generate       = drbg_hmac_generate,
 754         .crypto_init    = drbg_init_hash_kernel,
 755         .crypto_fini    = drbg_fini_hash_kernel,
 756 };
 757 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 758
 759 /******************************************************************
 760  * Hash DRBG callback functions
 761  ******************************************************************/
 762
 763 #ifdef CONFIG_CRYPTO_DRBG_HASH
 764 #define CRYPTO_DRBG_HASH_STRING "HASH "
 765 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
 766 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
 767 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
 768 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
 769 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
 770 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
 771 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
 772 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
 773
 774 /*
 775  * Increment buffer
 776  *
 777  * @dst buffer to increment
 778  * @add value to add
 779  */
 780 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
 781                                 const unsigned char *add, size_t addlen)
 782 {
 783         /* implied: dstlen > addlen */
 784         unsigned char *dstptr;
 785         const unsigned char *addptr;
 786         unsigned int remainder = 0;
 787         size_t len = addlen;
 788
 789         dstptr = dst + (dstlen-1);
 790         addptr = add + (addlen-1);
 791         while (len) {
 792                 remainder += *dstptr + *addptr;
 793                 *dstptr = remainder & 0xff;
 794                 remainder >>= 8;
 795                 len--; dstptr--; addptr--;
 796         }
 797         len = dstlen - addlen;
 798         while (len && remainder > 0) {
 799                 remainder = *dstptr + 1;
 800                 *dstptr = remainder & 0xff;
 801                 remainder >>= 8;
 802                 len--; dstptr--;
 803         }
 804 }
 805
 806 /*
 807  * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
 808  * interlinked, the scratchpad is used as follows:
 809  * drbg_hash_update
 810  *      start: drbg->scratchpad
 811  *      length: drbg_statelen(drbg)
 812  * drbg_hash_df:
 813  *      start: drbg->scratchpad + drbg_statelen(drbg)
 814  *      length: drbg_blocklen(drbg)
 815  *
 816  * drbg_hash_process_addtl uses the scratchpad, but fully completes
 817  * before either of the functions mentioned before are invoked. Therefore,
 818  * drbg_hash_process_addtl does not need to be specifically considered.
 819  */
 820
 821 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
 822 static int drbg_hash_df(struct drbg_state *drbg,
 823                         unsigned char *outval, size_t outlen,
 824                         struct list_head *entropylist)
 825 {
 826         int ret = 0;
 827         size_t len = 0;
 828         unsigned char input[5];
 829         unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
 830         struct drbg_string data;
 831
 832         /* 10.4.1 step 3 */
 833         input[0] = 1;
 834         drbg_cpu_to_be32((outlen * 8), &input[1]);
 835
 836         /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
 837         drbg_string_fill(&data, input, 5);
 838         list_add(&data.list, entropylist);
 839
 840         /* 10.4.1 step 4 */
 841         while (len < outlen) {
 842                 short blocklen = 0;
 843                 /* 10.4.1 step 4.1 */
 844                 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
 845                 if (ret)
 846                         goto out;
 847                 /* 10.4.1 step 4.2 */
 848                 input[0]++;
 849                 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
 850                             drbg_blocklen(drbg) : (outlen - len);
 851                 memcpy(outval + len, tmp, blocklen);
 852                 len += blocklen;
 853         }
 854
 855 out:
 856         memset(tmp, 0, drbg_blocklen(drbg));
 857         return ret;
 858 }
 859
 860 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
 861 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
 862                             int reseed)
 863 {
 864         int ret = 0;
 865         struct drbg_string data1, data2;
 866         LIST_HEAD(datalist);
 867         LIST_HEAD(datalist2);
 868         unsigned char *V = drbg->scratchpad;
 869         unsigned char prefix = DRBG_PREFIX1;
 870
 871         if (!seed)
 872                 return -EINVAL;
 873
 874         if (reseed) {
 875                 /* 10.1.1.3 step 1 */
 876                 memcpy(V, drbg->V, drbg_statelen(drbg));
 877                 drbg_string_fill(&data1, &prefix, 1);
 878                 list_add_tail(&data1.list, &datalist);
 879                 drbg_string_fill(&data2, V, drbg_statelen(drbg));
 880                 list_add_tail(&data2.list, &datalist);
 881         }
 882         list_splice_tail(seed, &datalist);
 883
 884         /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
 885         ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
 886         if (ret)
 887                 goto out;
 888
 889         /* 10.1.1.2 / 10.1.1.3 step 4  */
 890         prefix = DRBG_PREFIX0;
 891         drbg_string_fill(&data1, &prefix, 1);
 892         list_add_tail(&data1.list, &datalist2);
 893         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 894         list_add_tail(&data2.list, &datalist2);
 895         /* 10.1.1.2 / 10.1.1.3 step 4 */
 896         ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 897
 898 out:
 899         memset(drbg->scratchpad, 0, drbg_statelen(drbg));
 900         return ret;
 901 }
 902
 903 /* processing of additional information string for Hash DRBG */
 904 static int drbg_hash_process_addtl(struct drbg_state *drbg,
 905                                    struct list_head *addtl)
 906 {
 907         int ret = 0;
 908         struct drbg_string data1, data2;
 909         LIST_HEAD(datalist);
 910         unsigned char prefix = DRBG_PREFIX2;
 911
 912         /* 10.1.1.4 step 2 */
 913         if (!addtl || list_empty(addtl))
 914                 return 0;
 915
 916         /* 10.1.1.4 step 2a */
 917         drbg_string_fill(&data1, &prefix, 1);
 918         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 919         list_add_tail(&data1.list, &datalist);
 920         list_add_tail(&data2.list, &datalist);
 921         list_splice_tail(addtl, &datalist);
 922         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 923         if (ret)
 924                 goto out;
 925
 926         /* 10.1.1.4 step 2b */
 927         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 928                      drbg->scratchpad, drbg_blocklen(drbg));
 929
 930 out:
 931         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 932         return ret;
 933 }
 934
 935 /* Hashgen defined in 10.1.1.4 */
 936 static int drbg_hash_hashgen(struct drbg_state *drbg,
 937                              unsigned char *buf,
 938                              unsigned int buflen)
 939 {
 940         int len = 0;
 941         int ret = 0;
 942         unsigned char *src = drbg->scratchpad;
 943         unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
 944         struct drbg_string data;
 945         LIST_HEAD(datalist);
 946
 947         /* 10.1.1.4 step hashgen 2 */
 948         memcpy(src, drbg->V, drbg_statelen(drbg));
 949
 950         drbg_string_fill(&data, src, drbg_statelen(drbg));
 951         list_add_tail(&data.list, &datalist);
 952         while (len < buflen) {
 953                 unsigned int outlen = 0;
 954                 /* 10.1.1.4 step hashgen 4.1 */
 955                 ret = drbg_kcapi_hash(drbg, dst, &datalist);
 956                 if (ret) {
 957                         len = ret;
 958                         goto out;
 959                 }
 960                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 961                           drbg_blocklen(drbg) : (buflen - len);
 962                 /* 10.1.1.4 step hashgen 4.2 */
 963                 memcpy(buf + len, dst, outlen);
 964                 len += outlen;
 965                 /* 10.1.1.4 hashgen step 4.3 */
 966                 if (len < buflen)
 967                         crypto_inc(src, drbg_statelen(drbg));
 968         }
 969
 970 out:
 971         memset(drbg->scratchpad, 0,
 972                (drbg_statelen(drbg) + drbg_blocklen(drbg)));
 973         return len;
 974 }
 975
 976 /* generate function for Hash DRBG as defined in  10.1.1.4 */
 977 static int drbg_hash_generate(struct drbg_state *drbg,
 978                               unsigned char *buf, unsigned int buflen,
 979                               struct list_head *addtl)
 980 {
 981         int len = 0;
 982         int ret = 0;
 983         union {
 984                 unsigned char req[8];
 985                 __be64 req_int;
 986         } u;
 987         unsigned char prefix = DRBG_PREFIX3;
 988         struct drbg_string data1, data2;
 989         LIST_HEAD(datalist);
 990
 991         /* 10.1.1.4 step 2 */
 992         ret = drbg_hash_process_addtl(drbg, addtl);
 993         if (ret)
 994                 return ret;
 995         /* 10.1.1.4 step 3 */
 996         len = drbg_hash_hashgen(drbg, buf, buflen);
 997
 998         /* this is the value H as documented in 10.1.1.4 */
 999         /* 10.1.1.4 step 4 */
1000         drbg_string_fill(&data1, &prefix, 1);
1001         list_add_tail(&data1.list, &datalist);
1002         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
1003         list_add_tail(&data2.list, &datalist);
1004         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
1005         if (ret) {
1006                 len = ret;
1007                 goto out;
1008         }
1009
1010         /* 10.1.1.4 step 5 */
1011         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1012                      drbg->scratchpad, drbg_blocklen(drbg));
1013         drbg_add_buf(drbg->V, drbg_statelen(drbg),
1014                      drbg->C, drbg_statelen(drbg));
1015         u.req_int = cpu_to_be64(drbg->reseed_ctr);
1016         drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
1017
1018 out:
1019         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
1020         return len;
1021 }
1022
1023 /*
1024  * scratchpad usage: as update and generate are used isolated, both
1025  * can use the scratchpad
1026  */
1027 static const struct drbg_state_ops drbg_hash_ops = {
1028         .update         = drbg_hash_update,
1029         .generate       = drbg_hash_generate,
1030         .crypto_init    = drbg_init_hash_kernel,
1031         .crypto_fini    = drbg_fini_hash_kernel,
1032 };
1033 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1034
1035 /******************************************************************
1036  * Functions common for DRBG implementations
1037  ******************************************************************/
1038
1039 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1040                               int reseed, enum drbg_seed_state new_seed_state)
1041 {
1042         int ret = drbg->d_ops->update(drbg, seed, reseed);
1043
1044         if (ret)
1045                 return ret;
1046
1047         drbg->seeded = new_seed_state;
1048         /* 10.1.1.2 / 10.1.1.3 step 5 */
1049         drbg->reseed_ctr = 1;
1050
1051         switch (drbg->seeded) {
1052         case DRBG_SEED_STATE_UNSEEDED:
1053                 /* Impossible, but handle it to silence compiler warnings. */
1054         case DRBG_SEED_STATE_PARTIAL:
1055                 /*
1056                  * Require frequent reseeds until the seed source is
1057                  * fully initialized.
1058                  */
1059                 drbg->reseed_threshold = 50;
1060                 break;
1061
1062         case DRBG_SEED_STATE_FULL:
1063                 /*
1064                  * Seed source has become fully initialized, frequent
1065                  * reseeds no longer required.
1066                  */
1067                 drbg->reseed_threshold = drbg_max_requests(drbg);
1068                 break;
1069         }
1070
1071         return ret;
1072 }
1073
1074 static inline int drbg_get_random_bytes(struct drbg_state *drbg,
1075                                         unsigned char *entropy,
1076                                         unsigned int entropylen)
1077 {
1078         int ret;
1079
1080         do {
1081                 get_random_bytes(entropy, entropylen);
1082                 ret = drbg_fips_continuous_test(drbg, entropy);
1083                 if (ret && ret != -EAGAIN)
1084                         return ret;
1085         } while (ret);
1086
1087         return 0;
1088 }
1089
1090 static int drbg_seed_from_random(struct drbg_state *drbg)
1091 {
1092         struct drbg_string data;
1093         LIST_HEAD(seedlist);
1094         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1095         unsigned char entropy[32];
1096         int ret;
1097
1098         BUG_ON(!entropylen);
1099         BUG_ON(entropylen > sizeof(entropy));
1100
1101         drbg_string_fill(&data, entropy, entropylen);
1102         list_add_tail(&data.list, &seedlist);
1103
1104         ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1105         if (ret)
1106                 goto out;
1107
1108         ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
1109
1110 out:
1111         memzero_explicit(entropy, entropylen);
1112         return ret;
1113 }
1114
1115 /*
1116  * Seeding or reseeding of the DRBG
1117  *
1118  * @drbg: DRBG state struct
1119  * @pers: personalization / additional information buffer
1120  * @reseed: 0 for initial seed process, 1 for reseeding
1121  *
1122  * return:
1123  *      0 on success
1124  *      error value otherwise
1125  */
1126 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1127                      bool reseed)
1128 {
1129         int ret;
1130         unsigned char entropy[((32 + 16) * 2)];
1131         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1132         struct drbg_string data1;
1133         LIST_HEAD(seedlist);
1134         enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
1135
1136         /* 9.1 / 9.2 / 9.3.1 step 3 */
1137         if (pers && pers->len > (drbg_max_addtl(drbg))) {
1138                 pr_devel("DRBG: personalization string too long %zu\n",
1139                          pers->len);
1140                 return -EINVAL;
1141         }
1142
1143         if (list_empty(&drbg->test_data.list)) {
1144                 drbg_string_fill(&data1, drbg->test_data.buf,
1145                                  drbg->test_data.len);
1146                 pr_devel("DRBG: using test entropy\n");
1147         } else {
1148                 /*
1149                  * Gather entropy equal to the security strength of the DRBG.
1150                  * With a derivation function, a nonce is required in addition
1151                  * to the entropy. A nonce must be at least 1/2 of the security
1152                  * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1153                  * of the strength. The consideration of a nonce is only
1154                  * applicable during initial seeding.
1155                  */
1156                 BUG_ON(!entropylen);
1157                 if (!reseed)
1158                         entropylen = ((entropylen + 1) / 2) * 3;
1159                 BUG_ON((entropylen * 2) > sizeof(entropy));
1160
1161                 /* Get seed from in-kernel /dev/urandom */
1162                 if (!rng_is_initialized())
1163                         new_seed_state = DRBG_SEED_STATE_PARTIAL;
1164
1165                 ret = drbg_get_random_bytes(drbg, entropy, entropylen);
1166                 if (ret)
1167                         goto out;
1168
1169                 if (!drbg->jent) {
1170                         drbg_string_fill(&data1, entropy, entropylen);
1171                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1172                                  entropylen);
1173                 } else {
1174                         /* Get seed from Jitter RNG */
1175                         ret = crypto_rng_get_bytes(drbg->jent,
1176                                                    entropy + entropylen,
1177                                                    entropylen);
1178                         if (ret) {
1179                                 pr_devel("DRBG: jent failed with %d\n", ret);
1180
1181                                 /*
1182                                  * Do not treat the transient failure of the
1183                                  * Jitter RNG as an error that needs to be
1184                                  * reported. The combined number of the
1185                                  * maximum reseed threshold times the maximum
1186                                  * number of Jitter RNG transient errors is
1187                                  * less than the reseed threshold required by
1188                                  * SP800-90A allowing us to treat the
1189                                  * transient errors as such.
1190                                  *
1191                                  * However, we mandate that at least the first
1192                                  * seeding operation must succeed with the
1193                                  * Jitter RNG.
1194                                  */
1195                                 if (!reseed || ret != -EAGAIN)
1196                                         goto out;
1197                         }
1198
1199                         drbg_string_fill(&data1, entropy, entropylen * 2);
1200                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1201                                  entropylen * 2);
1202                 }
1203         }
1204         list_add_tail(&data1.list, &seedlist);
1205
1206         /*
1207          * concatenation of entropy with personalization str / addtl input)
1208          * the variable pers is directly handed in by the caller, so check its
1209          * contents whether it is appropriate
1210          */
1211         if (pers && pers->buf && 0 < pers->len) {
1212                 list_add_tail(&pers->list, &seedlist);
1213                 pr_devel("DRBG: using personalization string\n");
1214         }
1215
1216         if (!reseed) {
1217                 memset(drbg->V, 0, drbg_statelen(drbg));
1218                 memset(drbg->C, 0, drbg_statelen(drbg));
1219         }
1220
1221         ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
1222
1223 out:
1224         memzero_explicit(entropy, entropylen * 2);
1225
1226         return ret;
1227 }
1228
1229 /* Free all substructures in a DRBG state without the DRBG state structure */
1230 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1231 {
1232         if (!drbg)
1233                 return;
1234         kzfree(drbg->Vbuf);
1235         drbg->Vbuf = NULL;
1236         drbg->V = NULL;
1237         kzfree(drbg->Cbuf);
1238         drbg->Cbuf = NULL;
1239         drbg->C = NULL;
1240         kzfree(drbg->scratchpadbuf);
1241         drbg->scratchpadbuf = NULL;
1242         drbg->reseed_ctr = 0;
1243         drbg->d_ops = NULL;
1244         drbg->core = NULL;
1245         if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1246                 kzfree(drbg->prev);
1247                 drbg->prev = NULL;
1248                 drbg->fips_primed = false;
1249         }
1250 }
1251
1252 /*
1253  * Allocate all sub-structures for a DRBG state.
1254  * The DRBG state structure must already be allocated.
1255  */
1256 static inline int drbg_alloc_state(struct drbg_state *drbg)
1257 {
1258         int ret = -ENOMEM;
1259         unsigned int sb_size = 0;
1260
1261         switch (drbg->core->flags & DRBG_TYPE_MASK) {
1262 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1263         case DRBG_HMAC:
1264                 drbg->d_ops = &drbg_hmac_ops;
1265                 break;
1266 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1267 #ifdef CONFIG_CRYPTO_DRBG_HASH
1268         case DRBG_HASH:
1269                 drbg->d_ops = &drbg_hash_ops;
1270                 break;
1271 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1272 #ifdef CONFIG_CRYPTO_DRBG_CTR
1273         case DRBG_CTR:
1274                 drbg->d_ops = &drbg_ctr_ops;
1275                 break;
1276 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1277         default:
1278                 ret = -EOPNOTSUPP;
1279                 goto err;
1280         }
1281
1282         ret = drbg->d_ops->crypto_init(drbg);
1283         if (ret < 0)
1284                 goto err;
1285
1286         drbg->Vbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1287         if (!drbg->Vbuf) {
1288                 ret = -ENOMEM;
1289                 goto fini;
1290         }
1291         drbg->V = PTR_ALIGN(drbg->Vbuf, ret + 1);
1292         drbg->Cbuf = kmalloc(drbg_statelen(drbg) + ret, GFP_KERNEL);
1293         if (!drbg->Cbuf) {
1294                 ret = -ENOMEM;
1295                 goto fini;
1296         }
1297         drbg->C = PTR_ALIGN(drbg->Cbuf, ret + 1);
1298         /* scratchpad is only generated for CTR and Hash */
1299         if (drbg->core->flags & DRBG_HMAC)
1300                 sb_size = 0;
1301         else if (drbg->core->flags & DRBG_CTR)
1302                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1303                           drbg_statelen(drbg) + /* df_data */
1304                           drbg_blocklen(drbg) + /* pad */
1305                           drbg_blocklen(drbg) + /* iv */
1306                           drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1307         else
1308                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1309
1310         if (0 < sb_size) {
1311                 drbg->scratchpadbuf = kzalloc(sb_size + ret, GFP_KERNEL);
1312                 if (!drbg->scratchpadbuf) {
1313                         ret = -ENOMEM;
1314                         goto fini;
1315                 }
1316                 drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
1317         }
1318
1319         if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
1320                 drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
1321                                      GFP_KERNEL);
1322                 if (!drbg->prev)
1323                         goto fini;
1324                 drbg->fips_primed = false;
1325         }
1326
1327         return 0;
1328
1329 fini:
1330         drbg->d_ops->crypto_fini(drbg);
1331 err:
1332         drbg_dealloc_state(drbg);
1333         return ret;
1334 }
1335
1336 /*************************************************************************
1337  * DRBG interface functions
1338  *************************************************************************/
1339
1340 /*
1341  * DRBG generate function as required by SP800-90A - this function
1342  * generates random numbers
1343  *
1344  * @drbg DRBG state handle
1345  * @buf Buffer where to store the random numbers -- the buffer must already
1346  *      be pre-allocated by caller
1347  * @buflen Length of output buffer - this value defines the number of random
1348  *         bytes pulled from DRBG
1349  * @addtl Additional input that is mixed into state, may be NULL -- note
1350  *        the entropy is pulled by the DRBG internally unconditionally
1351  *        as defined in SP800-90A. The additional input is mixed into
1352  *        the state in addition to the pulled entropy.
1353  *
1354  * return: 0 when all bytes are generated; < 0 in case of an error
1355  */
1356 static int drbg_generate(struct drbg_state *drbg,
1357                          unsigned char *buf, unsigned int buflen,
1358                          struct drbg_string *addtl)
1359 {
1360         int len = 0;
1361         LIST_HEAD(addtllist);
1362
1363         if (!drbg->core) {
1364                 pr_devel("DRBG: not yet seeded\n");
1365                 return -EINVAL;
1366         }
1367         if (0 == buflen || !buf) {
1368                 pr_devel("DRBG: no output buffer provided\n");
1369                 return -EINVAL;
1370         }
1371         if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1372                 pr_devel("DRBG: wrong format of additional information\n");
1373                 return -EINVAL;
1374         }
1375
1376         /* 9.3.1 step 2 */
1377         len = -EINVAL;
1378         if (buflen > (drbg_max_request_bytes(drbg))) {
1379                 pr_devel("DRBG: requested random numbers too large %u\n",
1380                          buflen);
1381                 goto err;
1382         }
1383
1384         /* 9.3.1 step 3 is implicit with the chosen DRBG */
1385
1386         /* 9.3.1 step 4 */
1387         if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1388                 pr_devel("DRBG: additional information string too long %zu\n",
1389                          addtl->len);
1390                 goto err;
1391         }
1392         /* 9.3.1 step 5 is implicit with the chosen DRBG */
1393
1394         /*
1395          * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1396          * here. The spec is a bit convoluted here, we make it simpler.
1397          */
1398         if (drbg->reseed_threshold < drbg->reseed_ctr)
1399                 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1400
1401         if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
1402                 pr_devel("DRBG: reseeding before generation (prediction "
1403                          "resistance: %s, state %s)\n",
1404                          drbg->pr ? "true" : "false",
1405                          (drbg->seeded ==  DRBG_SEED_STATE_FULL ?
1406                           "seeded" : "unseeded"));
1407                 /* 9.3.1 steps 7.1 through 7.3 */
1408                 len = drbg_seed(drbg, addtl, true);
1409                 if (len)
1410                         goto err;
1411                 /* 9.3.1 step 7.4 */
1412                 addtl = NULL;
1413         } else if (rng_is_initialized() &&
1414                    drbg->seeded == DRBG_SEED_STATE_PARTIAL) {
1415                 len = drbg_seed_from_random(drbg);
1416                 if (len)
1417                         goto err;
1418         }
1419
1420         if (addtl && 0 < addtl->len)
1421                 list_add_tail(&addtl->list, &addtllist);
1422         /* 9.3.1 step 8 and 10 */
1423         len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1424
1425         /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1426         drbg->reseed_ctr++;
1427         if (0 >= len)
1428                 goto err;
1429
1430         /*
1431          * Section 11.3.3 requires to re-perform self tests after some
1432          * generated random numbers. The chosen value after which self
1433          * test is performed is arbitrary, but it should be reasonable.
1434          * However, we do not perform the self tests because of the following
1435          * reasons: it is mathematically impossible that the initial self tests
1436          * were successfully and the following are not. If the initial would
1437          * pass and the following would not, the kernel integrity is violated.
1438          * In this case, the entire kernel operation is questionable and it
1439          * is unlikely that the integrity violation only affects the
1440          * correct operation of the DRBG.
1441          *
1442          * Albeit the following code is commented out, it is provided in
1443          * case somebody has a need to implement the test of 11.3.3.
1444          */
1445 #if 0
1446         if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1447                 int err = 0;
1448                 pr_devel("DRBG: start to perform self test\n");
1449                 if (drbg->core->flags & DRBG_HMAC)
1450                         err = alg_test("drbg_pr_hmac_sha256",
1451                                        "drbg_pr_hmac_sha256", 0, 0);
1452                 else if (drbg->core->flags & DRBG_CTR)
1453                         err = alg_test("drbg_pr_ctr_aes128",
1454                                        "drbg_pr_ctr_aes128", 0, 0);
1455                 else
1456                         err = alg_test("drbg_pr_sha256",
1457                                        "drbg_pr_sha256", 0, 0);
1458                 if (err) {
1459                         pr_err("DRBG: periodical self test failed\n");
1460                         /*
1461                          * uninstantiate implies that from now on, only errors
1462                          * are returned when reusing this DRBG cipher handle
1463                          */
1464                         drbg_uninstantiate(drbg);
1465                         return 0;
1466                 } else {
1467                         pr_devel("DRBG: self test successful\n");
1468                 }
1469         }
1470 #endif
1471
1472         /*
1473          * All operations were successful, return 0 as mandated by
1474          * the kernel crypto API interface.
1475          */
1476         len = 0;
1477 err:
1478         return len;
1479 }
1480
1481 /*
1482  * Wrapper around drbg_generate which can pull arbitrary long strings
1483  * from the DRBG without hitting the maximum request limitation.
1484  *
1485  * Parameters: see drbg_generate
1486  * Return codes: see drbg_generate -- if one drbg_generate request fails,
1487  *               the entire drbg_generate_long request fails
1488  */
1489 static int drbg_generate_long(struct drbg_state *drbg,
1490                               unsigned char *buf, unsigned int buflen,
1491                               struct drbg_string *addtl)
1492 {
1493         unsigned int len = 0;
1494         unsigned int slice = 0;
1495         do {
1496                 int err = 0;
1497                 unsigned int chunk = 0;
1498                 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1499                 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1500                 mutex_lock(&drbg->drbg_mutex);
1501                 err = drbg_generate(drbg, buf + len, chunk, addtl);
1502                 mutex_unlock(&drbg->drbg_mutex);
1503                 if (0 > err)
1504                         return err;
1505                 len += chunk;
1506         } while (slice > 0 && (len < buflen));
1507         return 0;
1508 }
1509
1510 static int drbg_prepare_hrng(struct drbg_state *drbg)
1511 {
1512         /* We do not need an HRNG in test mode. */
1513         if (list_empty(&drbg->test_data.list))
1514                 return 0;
1515
1516         drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1517
1518         return 0;
1519 }
1520
1521 /*
1522  * DRBG instantiation function as required by SP800-90A - this function
1523  * sets up the DRBG handle, performs the initial seeding and all sanity
1524  * checks required by SP800-90A
1525  *
1526  * @drbg memory of state -- if NULL, new memory is allocated
1527  * @pers Personalization string that is mixed into state, may be NULL -- note
1528  *       the entropy is pulled by the DRBG internally unconditionally
1529  *       as defined in SP800-90A. The additional input is mixed into
1530  *       the state in addition to the pulled entropy.
1531  * @coreref reference to core
1532  * @pr prediction resistance enabled
1533  *
1534  * return
1535  *      0 on success
1536  *      error value otherwise
1537  */
1538 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1539                             int coreref, bool pr)
1540 {
1541         int ret;
1542         bool reseed = true;
1543
1544         pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1545                  "%s\n", coreref, pr ? "enabled" : "disabled");
1546         mutex_lock(&drbg->drbg_mutex);
1547
1548         /* 9.1 step 1 is implicit with the selected DRBG type */
1549
1550         /*
1551          * 9.1 step 2 is implicit as caller can select prediction resistance
1552          * and the flag is copied into drbg->flags --
1553          * all DRBG types support prediction resistance
1554          */
1555
1556         /* 9.1 step 4 is implicit in  drbg_sec_strength */
1557
1558         if (!drbg->core) {
1559                 drbg->core = &drbg_cores[coreref];
1560                 drbg->pr = pr;
1561                 drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
1562                 drbg->reseed_threshold = drbg_max_requests(drbg);
1563
1564                 ret = drbg_alloc_state(drbg);
1565                 if (ret)
1566                         goto unlock;
1567
1568                 ret = drbg_prepare_hrng(drbg);
1569                 if (ret)
1570                         goto free_everything;
1571
1572                 if (IS_ERR(drbg->jent)) {
1573                         ret = PTR_ERR(drbg->jent);
1574                         drbg->jent = NULL;
1575                         if (fips_enabled || ret != -ENOENT)
1576                                 goto free_everything;
1577                         pr_info("DRBG: Continuing without Jitter RNG\n");
1578                 }
1579
1580                 reseed = false;
1581         }
1582
1583         ret = drbg_seed(drbg, pers, reseed);
1584
1585         if (ret && !reseed)
1586                 goto free_everything;
1587
1588         mutex_unlock(&drbg->drbg_mutex);
1589         return ret;
1590
1591 unlock:
1592         mutex_unlock(&drbg->drbg_mutex);
1593         return ret;
1594
1595 free_everything:
1596         mutex_unlock(&drbg->drbg_mutex);
1597         drbg_uninstantiate(drbg);
1598         return ret;
1599 }
1600
1601 /*
1602  * DRBG uninstantiate function as required by SP800-90A - this function
1603  * frees all buffers and the DRBG handle
1604  *
1605  * @drbg DRBG state handle
1606  *
1607  * return
1608  *      0 on success
1609  */
1610 static int drbg_uninstantiate(struct drbg_state *drbg)
1611 {
1612         if (!IS_ERR_OR_NULL(drbg->jent))
1613                 crypto_free_rng(drbg->jent);
1614         drbg->jent = NULL;
1615
1616         if (drbg->d_ops)
1617                 drbg->d_ops->crypto_fini(drbg);
1618         drbg_dealloc_state(drbg);
1619         /* no scrubbing of test_data -- this shall survive an uninstantiate */
1620         return 0;
1621 }
1622
1623 /*
1624  * Helper function for setting the test data in the DRBG
1625  *
1626  * @drbg DRBG state handle
1627  * @data test data
1628  * @len test data length
1629  */
1630 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1631                                    const u8 *data, unsigned int len)
1632 {
1633         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1634
1635         mutex_lock(&drbg->drbg_mutex);
1636         drbg_string_fill(&drbg->test_data, data, len);
1637         mutex_unlock(&drbg->drbg_mutex);
1638 }
1639
1640 /***************************************************************
1641  * Kernel crypto API cipher invocations requested by DRBG
1642  ***************************************************************/
1643
1644 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1645 struct sdesc {
1646         struct shash_desc shash;
1647         char ctx[];
1648 };
1649
1650 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1651 {
1652         struct sdesc *sdesc;
1653         struct crypto_shash *tfm;
1654
1655         tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1656         if (IS_ERR(tfm)) {
1657                 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1658                                 drbg->core->backend_cra_name);
1659                 return PTR_ERR(tfm);
1660         }
1661         BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1662         sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1663                         GFP_KERNEL);
1664         if (!sdesc) {
1665                 crypto_free_shash(tfm);
1666                 return -ENOMEM;
1667         }
1668
1669         sdesc->shash.tfm = tfm;
1670         sdesc->shash.flags = 0;
1671         drbg->priv_data = sdesc;
1672
1673         return crypto_shash_alignmask(tfm);
1674 }
1675
1676 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1677 {
1678         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1679         if (sdesc) {
1680                 crypto_free_shash(sdesc->shash.tfm);
1681                 kzfree(sdesc);
1682         }
1683         drbg->priv_data = NULL;
1684         return 0;
1685 }
1686
1687 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1688                                   const unsigned char *key)
1689 {
1690         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1691
1692         crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1693 }
1694
1695 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1696                            const struct list_head *in)
1697 {
1698         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1699         struct drbg_string *input = NULL;
1700
1701         crypto_shash_init(&sdesc->shash);
1702         list_for_each_entry(input, in, list)
1703                 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1704         return crypto_shash_final(&sdesc->shash, outval);
1705 }
1706 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1707
1708 #ifdef CONFIG_CRYPTO_DRBG_CTR
1709 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1710 {
1711         struct crypto_cipher *tfm =
1712                 (struct crypto_cipher *)drbg->priv_data;
1713         if (tfm)
1714                 crypto_free_cipher(tfm);
1715         drbg->priv_data = NULL;
1716
1717         if (drbg->ctr_handle)
1718                 crypto_free_skcipher(drbg->ctr_handle);
1719         drbg->ctr_handle = NULL;
1720
1721         if (drbg->ctr_req)
1722                 skcipher_request_free(drbg->ctr_req);
1723         drbg->ctr_req = NULL;
1724
1725         kfree(drbg->ctr_null_value_buf);
1726         drbg->ctr_null_value = NULL;
1727
1728         kfree(drbg->outscratchpadbuf);
1729         drbg->outscratchpadbuf = NULL;
1730
1731         return 0;
1732 }
1733
1734 static void drbg_skcipher_cb(struct crypto_async_request *req, int error)
1735 {
1736         struct drbg_state *drbg = req->data;
1737
1738         if (error == -EINPROGRESS)
1739                 return;
1740         drbg->ctr_async_err = error;
1741         complete(&drbg->ctr_completion);
1742 }
1743
1744 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1745 {
1746         struct crypto_cipher *tfm;
1747         struct crypto_skcipher *sk_tfm;
1748         struct skcipher_request *req;
1749         unsigned int alignmask;
1750         char ctr_name[CRYPTO_MAX_ALG_NAME];
1751
1752         tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1753         if (IS_ERR(tfm)) {
1754                 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1755                                 drbg->core->backend_cra_name);
1756                 return PTR_ERR(tfm);
1757         }
1758         BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1759         drbg->priv_data = tfm;
1760
1761         if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
1762             drbg->core->backend_cra_name) >= CRYPTO_MAX_ALG_NAME) {
1763                 drbg_fini_sym_kernel(drbg);
1764                 return -EINVAL;
1765         }
1766         sk_tfm = crypto_alloc_skcipher(ctr_name, 0, 0);
1767         if (IS_ERR(sk_tfm)) {
1768                 pr_info("DRBG: could not allocate CTR cipher TFM handle: %s\n",
1769                                 ctr_name);
1770                 drbg_fini_sym_kernel(drbg);
1771                 return PTR_ERR(sk_tfm);
1772         }
1773         drbg->ctr_handle = sk_tfm;
1774         init_completion(&drbg->ctr_completion);
1775
1776         req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
1777         if (!req) {
1778                 pr_info("DRBG: could not allocate request queue\n");
1779                 drbg_fini_sym_kernel(drbg);
1780                 return -ENOMEM;
1781         }
1782         drbg->ctr_req = req;
1783         skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
1784                                         drbg_skcipher_cb, drbg);
1785
1786         alignmask = crypto_skcipher_alignmask(sk_tfm);
1787         drbg->ctr_null_value_buf = kzalloc(DRBG_CTR_NULL_LEN + alignmask,
1788                                            GFP_KERNEL);
1789         if (!drbg->ctr_null_value_buf) {
1790                 drbg_fini_sym_kernel(drbg);
1791                 return -ENOMEM;
1792         }
1793         drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf,
1794                                                alignmask + 1);
1795
1796         drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,
1797                                          GFP_KERNEL);
1798         if (!drbg->outscratchpadbuf) {
1799                 drbg_fini_sym_kernel(drbg);
1800                 return -ENOMEM;
1801         }
1802         drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,
1803                                               alignmask + 1);
1804
1805         return alignmask;
1806 }
1807
1808 static void drbg_kcapi_symsetkey(struct drbg_state *drbg,
1809                                  const unsigned char *key)
1810 {
1811         struct crypto_cipher *tfm =
1812                 (struct crypto_cipher *)drbg->priv_data;
1813
1814         crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1815 }
1816
1817 static int drbg_kcapi_sym(struct drbg_state *drbg, unsigned char *outval,
1818                           const struct drbg_string *in)
1819 {
1820         struct crypto_cipher *tfm =
1821                 (struct crypto_cipher *)drbg->priv_data;
1822
1823         /* there is only component in *in */
1824         BUG_ON(in->len < drbg_blocklen(drbg));
1825         crypto_cipher_encrypt_one(tfm, outval, in->buf);
1826         return 0;
1827 }
1828
1829 static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
1830                               u8 *inbuf, u32 inlen,
1831                               u8 *outbuf, u32 outlen)
1832 {
1833         struct scatterlist sg_in, sg_out;
1834         int ret;
1835
1836         sg_init_one(&sg_in, inbuf, inlen);
1837         sg_init_one(&sg_out, drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1838
1839         while (outlen) {
1840                 u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);
1841
1842                 /* Output buffer may not be valid for SGL, use scratchpad */
1843                 skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out,
1844                                            cryptlen, drbg->V);
1845                 ret = crypto_skcipher_encrypt(drbg->ctr_req);
1846                 switch (ret) {
1847                 case 0:
1848                         break;
1849                 case -EINPROGRESS:
1850                 case -EBUSY:
1851                         wait_for_completion(&drbg->ctr_completion);
1852                         if (!drbg->ctr_async_err) {
1853                                 reinit_completion(&drbg->ctr_completion);
1854                                 break;
1855                         }
1856                 default:
1857                         goto out;
1858                 }
1859                 init_completion(&drbg->ctr_completion);
1860
1861                 memcpy(outbuf, drbg->outscratchpad, cryptlen);
1862
1863                 outlen -= cryptlen;
1864                 outbuf += cryptlen;
1865         }
1866         ret = 0;
1867
1868 out:
1869         memzero_explicit(drbg->outscratchpad, DRBG_OUTSCRATCHLEN);
1870         return ret;
1871 }
1872 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1873
1874 /***************************************************************
1875  * Kernel crypto API interface to register DRBG
1876  ***************************************************************/
1877
1878 /*
1879  * Look up the DRBG flags by given kernel crypto API cra_name
1880  * The code uses the drbg_cores definition to do this
1881  *
1882  * @cra_name kernel crypto API cra_name
1883  * @coreref reference to integer which is filled with the pointer to
1884  *  the applicable core
1885  * @pr reference for setting prediction resistance
1886  *
1887  * return: flags
1888  */
1889 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1890                                          int *coreref, bool *pr)
1891 {
1892         int i = 0;
1893         size_t start = 0;
1894         int len = 0;
1895
1896         *pr = true;
1897         /* disassemble the names */
1898         if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1899                 start = 10;
1900                 *pr = false;
1901         } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1902                 start = 8;
1903         } else {
1904                 return;
1905         }
1906
1907         /* remove the first part */
1908         len = strlen(cra_driver_name) - start;
1909         for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1910                 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1911                             len)) {
1912                         *coreref = i;
1913                         return;
1914                 }
1915         }
1916 }
1917
1918 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1919 {
1920         struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1921
1922         mutex_init(&drbg->drbg_mutex);
1923
1924         return 0;
1925 }
1926
1927 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1928 {
1929         drbg_uninstantiate(crypto_tfm_ctx(tfm));
1930 }
1931
1932 /*
1933  * Generate random numbers invoked by the kernel crypto API:
1934  * The API of the kernel crypto API is extended as follows:
1935  *
1936  * src is additional input supplied to the RNG.
1937  * slen is the length of src.
1938  * dst is the output buffer where random data is to be stored.
1939  * dlen is the length of dst.
1940  */
1941 static int drbg_kcapi_random(struct crypto_rng *tfm,
1942                              const u8 *src, unsigned int slen,
1943                              u8 *dst, unsigned int dlen)
1944 {
1945         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1946         struct drbg_string *addtl = NULL;
1947         struct drbg_string string;
1948
1949         if (slen) {
1950                 /* linked list variable is now local to allow modification */
1951                 drbg_string_fill(&string, src, slen);
1952                 addtl = &string;
1953         }
1954
1955         return drbg_generate_long(drbg, dst, dlen, addtl);
1956 }
1957
1958 /*
1959  * Seed the DRBG invoked by the kernel crypto API
1960  */
1961 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1962                            const u8 *seed, unsigned int slen)
1963 {
1964         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1965         struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1966         bool pr = false;
1967         struct drbg_string string;
1968         struct drbg_string *seed_string = NULL;
1969         int coreref = 0;
1970
1971         drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1972                               &pr);
1973         if (0 < slen) {
1974                 drbg_string_fill(&string, seed, slen);
1975                 seed_string = &string;
1976         }
1977
1978         return drbg_instantiate(drbg, seed_string, coreref, pr);
1979 }
1980
1981 /***************************************************************
1982  * Kernel module: code to load the module
1983  ***************************************************************/
1984
1985 /*
1986  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1987  * of the error handling.
1988  *
1989  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1990  * as seed source of get_random_bytes does not fail.
1991  *
1992  * Note 2: There is no sensible way of testing the reseed counter
1993  * enforcement, so skip it.
1994  */
1995 static inline int __init drbg_healthcheck_sanity(void)
1996 {
1997         int len = 0;
1998 #define OUTBUFLEN 16
1999         unsigned char buf[OUTBUFLEN];
2000         struct drbg_state *drbg = NULL;
2001         int ret = -EFAULT;
2002         int rc = -EFAULT;
2003         bool pr = false;
2004         int coreref = 0;
2005         struct drbg_string addtl;
2006         size_t max_addtllen, max_request_bytes;
2007
2008         /* only perform test in FIPS mode */
2009         if (!fips_enabled)
2010                 return 0;
2011
2012 #ifdef CONFIG_CRYPTO_DRBG_CTR
2013         drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
2014 #elif defined CONFIG_CRYPTO_DRBG_HASH
2015         drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
2016 #else
2017         drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
2018 #endif
2019
2020         drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
2021         if (!drbg)
2022                 return -ENOMEM;
2023
2024         mutex_init(&drbg->drbg_mutex);
2025         drbg->core = &drbg_cores[coreref];
2026         drbg->reseed_threshold = drbg_max_requests(drbg);
2027
2028         /*
2029          * if the following tests fail, it is likely that there is a buffer
2030          * overflow as buf is much smaller than the requested or provided
2031          * string lengths -- in case the error handling does not succeed
2032          * we may get an OOPS. And we want to get an OOPS as this is a
2033          * grave bug.
2034          */
2035
2036         max_addtllen = drbg_max_addtl(drbg);
2037         max_request_bytes = drbg_max_request_bytes(drbg);
2038         drbg_string_fill(&addtl, buf, max_addtllen + 1);
2039         /* overflow addtllen with additonal info string */
2040         len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
2041         BUG_ON(0 < len);
2042         /* overflow max_bits */
2043         len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
2044         BUG_ON(0 < len);
2045
2046         /* overflow max addtllen with personalization string */
2047         ret = drbg_seed(drbg, &addtl, false);
2048         BUG_ON(0 == ret);
2049         /* all tests passed */
2050         rc = 0;
2051
2052         pr_devel("DRBG: Sanity tests for failure code paths successfully "
2053                  "completed\n");
2054
2055         kfree(drbg);
2056         return rc;
2057 }
2058
2059 static struct rng_alg drbg_algs[22];
2060
2061 /*
2062  * Fill the array drbg_algs used to register the different DRBGs
2063  * with the kernel crypto API. To fill the array, the information
2064  * from drbg_cores[] is used.
2065  */
2066 static inline void __init drbg_fill_array(struct rng_alg *alg,
2067                                           const struct drbg_core *core, int pr)
2068 {
2069         int pos = 0;
2070         static int priority = 200;
2071
2072         memcpy(alg->base.cra_name, "stdrng", 6);
2073         if (pr) {
2074                 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
2075                 pos = 8;
2076         } else {
2077                 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
2078                 pos = 10;
2079         }
2080         memcpy(alg->base.cra_driver_name + pos, core->cra_name,
2081                strlen(core->cra_name));
2082
2083         alg->base.cra_priority = priority;
2084         priority++;
2085         /*
2086          * If FIPS mode enabled, the selected DRBG shall have the
2087          * highest cra_priority over other stdrng instances to ensure
2088          * it is selected.
2089          */
2090         if (fips_enabled)
2091                 alg->base.cra_priority += 200;
2092
2093         alg->base.cra_ctxsize   = sizeof(struct drbg_state);
2094         alg->base.cra_module    = THIS_MODULE;
2095         alg->base.cra_init      = drbg_kcapi_init;
2096         alg->base.cra_exit      = drbg_kcapi_cleanup;
2097         alg->generate           = drbg_kcapi_random;
2098         alg->seed               = drbg_kcapi_seed;
2099         alg->set_ent            = drbg_kcapi_set_entropy;
2100         alg->seedsize           = 0;
2101 }
2102
2103 static int __init drbg_init(void)
2104 {
2105         unsigned int i = 0; /* pointer to drbg_algs */
2106         unsigned int j = 0; /* pointer to drbg_cores */
2107         int ret;
2108
2109         ret = drbg_healthcheck_sanity();
2110         if (ret)
2111                 return ret;
2112
2113         if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
2114                 pr_info("DRBG: Cannot register all DRBG types"
2115                         "(slots needed: %zu, slots available: %zu)\n",
2116                         ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
2117                 return -EFAULT;
2118         }
2119
2120         /*
2121          * each DRBG definition can be used with PR and without PR, thus
2122          * we instantiate each DRBG in drbg_cores[] twice.
2123          *
2124          * As the order of placing them into the drbg_algs array matters
2125          * (the later DRBGs receive a higher cra_priority) we register the
2126          * prediction resistance DRBGs first as the should not be too
2127          * interesting.
2128          */
2129         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2130                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
2131         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
2132                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
2133         return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2134 }
2135
2136 static void __exit drbg_exit(void)
2137 {
2138         crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
2139 }
2140
2141 module_init(drbg_init);
2142 module_exit(drbg_exit);
2143 #ifndef CRYPTO_DRBG_HASH_STRING
2144 #define CRYPTO_DRBG_HASH_STRING ""
2145 #endif
2146 #ifndef CRYPTO_DRBG_HMAC_STRING
2147 #define CRYPTO_DRBG_HMAC_STRING ""
2148 #endif
2149 #ifndef CRYPTO_DRBG_CTR_STRING
2150 #define CRYPTO_DRBG_CTR_STRING ""
2151 #endif
2152 MODULE_LICENSE("GPL");
2153 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
2154 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
2155                    "using following cores: "
2156                    CRYPTO_DRBG_HASH_STRING
2157                    CRYPTO_DRBG_HMAC_STRING
2158                    CRYPTO_DRBG_CTR_STRING);
2159 MODULE_ALIAS_CRYPTO("stdrng");