Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cfc69065 authored by Eric Biggers's avatar Eric Biggers Committed by Greg Kroah-Hartman
Browse files

random: initialize ChaCha20 constants with correct endianness 



commit a181e0fdb2164268274453b5b291589edbb9b22d upstream.

On big endian CPUs, the ChaCha20-based CRNG is using the wrong
endianness for the ChaCha20 constants.

This doesn't matter cryptographically, but technically it means it's not
ChaCha20 anymore.  Fix it to always use the standard constants.

Cc: linux-crypto@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Acked-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 922d082e

drivers/char/random.c

+2 −2
Original line number Diff line number Diff line
@@ -816,7 +816,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng) 


static void crng_initialize_secondary(struct crng_state *crng)

{

	memcpy(&crng->state[0], "expand 32-byte k", 16);

	chacha_init_consts(crng->state);

	_get_random_bytes(&crng->state[4], sizeof(__u32) * 12);

	crng_init_try_arch(crng);

	crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
@@ -824,7 +824,7 @@ static void crng_initialize_secondary(struct crng_state *crng) 


static void __init crng_initialize_primary(struct crng_state *crng)

{

	memcpy(&crng->state[0], "expand 32-byte k", 16);

	chacha_init_consts(crng->state);

	_extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);

	if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) {

		invalidate_batched_entropy();

include/crypto/chacha.h

+8 −0
Original line number Diff line number Diff line
@@ -51,4 +51,12 @@ int crypto_chacha12_setkey(struct crypto_skcipher *tfm, const u8 *key, 
int crypto_chacha_crypt(struct skcipher_request *req);

int crypto_xchacha_crypt(struct skcipher_request *req);



static inline void chacha_init_consts(u32 *state)

{

	state[0]  = 0x61707865; /* "expa" */

	state[1]  = 0x3320646e; /* "nd 3" */

	state[2]  = 0x79622d32; /* "2-by" */

	state[3]  = 0x6b206574; /* "te k" */

}



#endif /* _CRYPTO_CHACHA_H */