lkml.org 
[lkml]   [2022]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 098/237] random: ensure early RDSEED goes through mixer on init
    Date
    From: "Jason A. Donenfeld" <Jason@zx2c4.com>

    commit a02cf3d0dd77244fd5333ac48d78871de459ae6d upstream.

    Continuing the reasoning of "random: use RDSEED instead of RDRAND in
    entropy extraction" from this series, at init time we also don't want to
    be xoring RDSEED directly into the crng. Instead it's safer to put it
    into our entropy collector and then re-extract it, so that it goes
    through a hash function with preimage resistance. As a matter of hygiene,
    we also order these now so that the RDSEED byte are hashed in first,
    followed by the bytes that are likely more predictable (e.g. utsname()).

    Cc: Theodore Ts'o <tytso@mit.edu>
    Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
    Reviewed-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/random.c | 16 +++++-----------
    1 file changed, 5 insertions(+), 11 deletions(-)

    --- a/drivers/char/random.c
    +++ b/drivers/char/random.c
    @@ -1208,24 +1208,18 @@ int __init rand_initialize(void)
    bool arch_init = true;
    unsigned long rv;

    - mix_pool_bytes(&now, sizeof(now));
    for (i = BLAKE2S_BLOCK_SIZE; i > 0; i -= sizeof(rv)) {
    - if (!arch_get_random_seed_long(&rv) &&
    - !arch_get_random_long(&rv))
    - rv = random_get_entropy();
    - mix_pool_bytes(&rv, sizeof(rv));
    - }
    - mix_pool_bytes(utsname(), sizeof(*(utsname())));
    -
    - extract_entropy(&primary_crng.state[4], sizeof(u32) * 12);
    - for (i = 4; i < 16; i++) {
    if (!arch_get_random_seed_long_early(&rv) &&
    !arch_get_random_long_early(&rv)) {
    rv = random_get_entropy();
    arch_init = false;
    }
    - primary_crng.state[i] ^= rv;
    + mix_pool_bytes(&rv, sizeof(rv));
    }
    + mix_pool_bytes(&now, sizeof(now));
    + mix_pool_bytes(utsname(), sizeof(*(utsname())));
    +
    + extract_entropy(&primary_crng.state[4], sizeof(u32) * 12);
    if (arch_init && trust_cpu && crng_init < 2) {
    invalidate_batched_entropy();
    crng_init = 2;

    \
     
     \ /
      Last update: 2022-06-23 19:35    [W:4.203 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site