Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17f0f4a4 authored by Neil Horman's avatar Neil Horman Committed by Herbert Xu
Browse files

crypto: rng - RNG interface and implementation 



This patch adds a random number generator interface as well as a
cryptographic pseudo-random number generator based on AES.  It is
meant to be used in cases where a deterministic CPRNG is required.

One of the first applications will be as an input in the IPsec IV
generation process.

Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent ccb778e1

crypto/Kconfig

+16 −0
Original line number Diff line number Diff line
@@ -46,6 +46,10 @@ config CRYPTO_HASH 
	tristate

	select CRYPTO_ALGAPI



config CRYPTO_RNG

	tristate

	select CRYPTO_ALGAPI



config CRYPTO_MANAGER

	tristate "Cryptographic algorithm manager"

	select CRYPTO_AEAD
@@ -689,6 +693,18 @@ config CRYPTO_LZO 
	help

	  This is the LZO algorithm.



comment "Random Number Generation"



config CRYPTO_ANSI_CPRNG

	tristate "Pseudo Random Number Generation for Cryptographic modules"

	select CRYPTO_AES

	select CRYPTO_RNG

	select CRYPTO_FIPS

	help

	  This option enables the generic pseudo random number generator

	  for cryptographic modules.  Uses the Algorithm specified in

	  ANSI X9.31 A.2.4



source "drivers/crypto/Kconfig"



endif	# if CRYPTO

crypto/Makefile

+3 −1
Original line number Diff line number Diff line
@@ -73,7 +73,9 @@ obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += michael_mic.o 
obj-$(CONFIG_CRYPTO_CRC32C) += crc32c.o

obj-$(CONFIG_CRYPTO_AUTHENC) += authenc.o

obj-$(CONFIG_CRYPTO_LZO) += lzo.o



obj-$(CONFIG_CRYPTO_RNG) += rng.o

obj-$(CONFIG_CRYPTO_RNG) += krng.o

obj-$(CONFIG_CRYPTO_ANSI_CPRNG) += ansi_cprng.o

obj-$(CONFIG_CRYPTO_TEST) += tcrypt.o



#

crypto/ansi_cprng.c

0 → 100644
+417 −0
Original line number Diff line number Diff line 
/*

 * PRNG: Pseudo Random Number Generator

 *       Based on NIST Recommended PRNG From ANSI X9.31 Appendix A.2.4 using

 *       AES 128 cipher

 *

 *  (C) Neil Horman <nhorman@tuxdriver.com>

 *

 *  This program is free software; you can redistribute it and/or modify it

 *  under the terms of the GNU General Public License as published by the

 *  Free Software Foundation; either version 2 of the License, or (at your

 *  any later version.

 *

 *

 */



#include <crypto/internal/rng.h>

#include <linux/err.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/moduleparam.h>

#include <linux/string.h>



#include "internal.h"



#define DEFAULT_PRNG_KEY "0123456789abcdef"

#define DEFAULT_PRNG_KSZ 16

#define DEFAULT_BLK_SZ 16

#define DEFAULT_V_SEED "zaybxcwdveuftgsh"



/*

 * Flags for the prng_context flags field

 */



#define PRNG_FIXED_SIZE 0x1

#define PRNG_NEED_RESET 0x2



/*

 * Note: DT is our counter value

 *	 I is our intermediate value

 *	 V is our seed vector

 * See http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext.pdf

 * for implementation details

 */





struct prng_context {

	spinlock_t prng_lock;

	unsigned char rand_data[DEFAULT_BLK_SZ];

	unsigned char last_rand_data[DEFAULT_BLK_SZ];

	unsigned char DT[DEFAULT_BLK_SZ];

	unsigned char I[DEFAULT_BLK_SZ];

	unsigned char V[DEFAULT_BLK_SZ];

	u32 rand_data_valid;

	struct crypto_cipher *tfm;

	u32 flags;

};



static int dbg;



static void hexdump(char *note, unsigned char *buf, unsigned int len)

{

	if (dbg) {

		printk(KERN_CRIT "%s", note);

		print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,

				16, 1,

				buf, len, false);

	}

}



#define dbgprint(format, args...) do {\

if (dbg)\

	printk(format, ##args);\

} while (0)



static void xor_vectors(unsigned char *in1, unsigned char *in2,

			unsigned char *out, unsigned int size)

{

	int i;



	for (i = 0; i < size; i++)

		out[i] = in1[i] ^ in2[i];



}

/*

 * Returns DEFAULT_BLK_SZ bytes of random data per call

 * returns 0 if generation succeded, <0 if something went wrong

 */

static int _get_more_prng_bytes(struct prng_context *ctx)

{

	int i;

	unsigned char tmp[DEFAULT_BLK_SZ];

	unsigned char *output = NULL;





	dbgprint(KERN_CRIT "Calling _get_more_prng_bytes for context %p\n",

		ctx);



	hexdump("Input DT: ", ctx->DT, DEFAULT_BLK_SZ);

	hexdump("Input I: ", ctx->I, DEFAULT_BLK_SZ);

	hexdump("Input V: ", ctx->V, DEFAULT_BLK_SZ);



	/*

	 * This algorithm is a 3 stage state machine

	 */

	for (i = 0; i < 3; i++) {



		switch (i) {

		case 0:

			/*

			 * Start by encrypting the counter value

			 * This gives us an intermediate value I

			 */

			memcpy(tmp, ctx->DT, DEFAULT_BLK_SZ);

			output = ctx->I;

			hexdump("tmp stage 0: ", tmp, DEFAULT_BLK_SZ);

			break;

		case 1:



			/*

			 * Next xor I with our secret vector V

			 * encrypt that result to obtain our

			 * pseudo random data which we output

			 */

			xor_vectors(ctx->I, ctx->V, tmp, DEFAULT_BLK_SZ);

			hexdump("tmp stage 1: ", tmp, DEFAULT_BLK_SZ);

			output = ctx->rand_data;

			break;

		case 2:

			/*

			 * First check that we didn't produce the same

			 * random data that we did last time around through this

			 */

			if (!memcmp(ctx->rand_data, ctx->last_rand_data,

					DEFAULT_BLK_SZ)) {

				printk(KERN_ERR

					"ctx %p Failed repetition check!\n",

					ctx);

				ctx->flags |= PRNG_NEED_RESET;

				return -EINVAL;

			}

			memcpy(ctx->last_rand_data, ctx->rand_data,

				DEFAULT_BLK_SZ);



			/*

			 * Lastly xor the random data with I

			 * and encrypt that to obtain a new secret vector V

			 */

			xor_vectors(ctx->rand_data, ctx->I, tmp,

				DEFAULT_BLK_SZ);

			output = ctx->V;

			hexdump("tmp stage 2: ", tmp, DEFAULT_BLK_SZ);

			break;

		}





		/* do the encryption */

		crypto_cipher_encrypt_one(ctx->tfm, output, tmp);



	}



	/*

	 * Now update our DT value

	 */

	for (i = 0; i < DEFAULT_BLK_SZ; i++) {

		ctx->DT[i] += 1;

		if (ctx->DT[i] != 0)

			break;

	}



	dbgprint("Returning new block for context %p\n", ctx);

	ctx->rand_data_valid = 0;



	hexdump("Output DT: ", ctx->DT, DEFAULT_BLK_SZ);

	hexdump("Output I: ", ctx->I, DEFAULT_BLK_SZ);

	hexdump("Output V: ", ctx->V, DEFAULT_BLK_SZ);

	hexdump("New Random Data: ", ctx->rand_data, DEFAULT_BLK_SZ);



	return 0;

}



/* Our exported functions */

static int get_prng_bytes(char *buf, size_t nbytes, struct prng_context *ctx)

{

	unsigned long flags;

	unsigned char *ptr = buf;

	unsigned int byte_count = (unsigned int)nbytes;

	int err;





	if (nbytes < 0)

		return -EINVAL;



	spin_lock_irqsave(&ctx->prng_lock, flags);



	err = -EINVAL;

	if (ctx->flags & PRNG_NEED_RESET)

		goto done;



	/*

	 * If the FIXED_SIZE flag is on, only return whole blocks of

	 * pseudo random data

	 */

	err = -EINVAL;

	if (ctx->flags & PRNG_FIXED_SIZE) {

		if (nbytes < DEFAULT_BLK_SZ)

			goto done;

		byte_count = DEFAULT_BLK_SZ;

	}



	err = byte_count;



	dbgprint(KERN_CRIT "getting %d random bytes for context %p\n",

		byte_count, ctx);





remainder:

	if (ctx->rand_data_valid == DEFAULT_BLK_SZ) {

		if (_get_more_prng_bytes(ctx) < 0) {

			memset(buf, 0, nbytes);

			err = -EINVAL;

			goto done;

		}

	}



	/*

	 * Copy up to the next whole block size

	 */

	if (byte_count < DEFAULT_BLK_SZ) {

		for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;

			ctx->rand_data_valid++) {

			*ptr = ctx->rand_data[ctx->rand_data_valid];

			ptr++;

			byte_count--;

			if (byte_count == 0)

				goto done;

		}

	}



	/*

	 * Now copy whole blocks

	 */

	for (; byte_count >= DEFAULT_BLK_SZ; byte_count -= DEFAULT_BLK_SZ) {

		if (_get_more_prng_bytes(ctx) < 0) {

			memset(buf, 0, nbytes);

			err = -EINVAL;

			goto done;

		}

		memcpy(ptr, ctx->rand_data, DEFAULT_BLK_SZ);

		ctx->rand_data_valid += DEFAULT_BLK_SZ;

		ptr += DEFAULT_BLK_SZ;

	}



	/*

	 * Now copy any extra partial data

	 */

	if (byte_count)

		goto remainder;



done:

	spin_unlock_irqrestore(&ctx->prng_lock, flags);

	dbgprint(KERN_CRIT "returning %d from get_prng_bytes in context %p\n",

		err, ctx);

	return err;

}



static void free_prng_context(struct prng_context *ctx)

{

	crypto_free_cipher(ctx->tfm);

}



static int reset_prng_context(struct prng_context *ctx,

			      unsigned char *key, size_t klen,

			      unsigned char *V, unsigned char *DT)

{

	int ret;

	int rc = -EINVAL;

	unsigned char *prng_key;



	spin_lock(&ctx->prng_lock);

	ctx->flags |= PRNG_NEED_RESET;



	prng_key = (key != NULL) ? key : (unsigned char *)DEFAULT_PRNG_KEY;



	if (!key)

		klen = DEFAULT_PRNG_KSZ;



	if (V)

		memcpy(ctx->V, V, DEFAULT_BLK_SZ);

	else

		memcpy(ctx->V, DEFAULT_V_SEED, DEFAULT_BLK_SZ);



	if (DT)

		memcpy(ctx->DT, DT, DEFAULT_BLK_SZ);

	else

		memset(ctx->DT, 0, DEFAULT_BLK_SZ);



	memset(ctx->rand_data, 0, DEFAULT_BLK_SZ);

	memset(ctx->last_rand_data, 0, DEFAULT_BLK_SZ);



	if (ctx->tfm)

		crypto_free_cipher(ctx->tfm);



	ctx->tfm = crypto_alloc_cipher("aes", 0, 0);

	if (IS_ERR(ctx->tfm)) {

		dbgprint(KERN_CRIT "Failed to alloc tfm for context %p\n",

			ctx);

		ctx->tfm = NULL;

		goto out;

	}



	ctx->rand_data_valid = DEFAULT_BLK_SZ;



	ret = crypto_cipher_setkey(ctx->tfm, prng_key, klen);

	if (ret) {

		dbgprint(KERN_CRIT "PRNG: setkey() failed flags=%x\n",

			crypto_cipher_get_flags(ctx->tfm));

		crypto_free_cipher(ctx->tfm);

		goto out;

	}



	rc = 0;

	ctx->flags &= ~PRNG_NEED_RESET;

out:

	spin_unlock(&ctx->prng_lock);



	return rc;



}



static int cprng_init(struct crypto_tfm *tfm)

{

	struct prng_context *ctx = crypto_tfm_ctx(tfm);



	spin_lock_init(&ctx->prng_lock);



	return reset_prng_context(ctx, NULL, DEFAULT_PRNG_KSZ, NULL, NULL);

}



static void cprng_exit(struct crypto_tfm *tfm)

{

	free_prng_context(crypto_tfm_ctx(tfm));

}



static int cprng_get_random(struct crypto_rng *tfm, u8 *rdata,

			    unsigned int dlen)

{

	struct prng_context *prng = crypto_rng_ctx(tfm);



	return get_prng_bytes(rdata, dlen, prng);

}



static int cprng_reset(struct crypto_rng *tfm, u8 *seed, unsigned int slen)

{

	struct prng_context *prng = crypto_rng_ctx(tfm);

	u8 *key = seed + DEFAULT_PRNG_KSZ;



	if (slen < DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ)

		return -EINVAL;



	reset_prng_context(prng, key, DEFAULT_PRNG_KSZ, seed, NULL);



	if (prng->flags & PRNG_NEED_RESET)

		return -EINVAL;

	return 0;

}



static struct crypto_alg rng_alg = {

	.cra_name		= "stdrng",

	.cra_driver_name	= "ansi_cprng",

	.cra_priority		= 100,

	.cra_flags		= CRYPTO_ALG_TYPE_RNG,

	.cra_ctxsize		= sizeof(struct prng_context),

	.cra_type		= &crypto_rng_type,

	.cra_module		= THIS_MODULE,

	.cra_list		= LIST_HEAD_INIT(rng_alg.cra_list),

	.cra_init		= cprng_init,

	.cra_exit		= cprng_exit,

	.cra_u			= {

		.rng = {

			.rng_make_random	= cprng_get_random,

			.rng_reset		= cprng_reset,

			.seedsize = DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ,

		}

	}

};





/* Module initalization */

static int __init prng_mod_init(void)

{

	int ret = 0;



	if (fips_enabled)

		rng_alg.cra_priority += 200;



	ret = crypto_register_alg(&rng_alg);



	if (ret)

		goto out;

out:

	return 0;

}



static void __exit prng_mod_fini(void)

{

	crypto_unregister_alg(&rng_alg);

	return;

}



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Software Pseudo Random Number Generator");

MODULE_AUTHOR("Neil Horman <nhorman@tuxdriver.com>");

module_param(dbg, int, 0);

MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");

module_init(prng_mod_init);

module_exit(prng_mod_fini);

MODULE_ALIAS("stdrng");

crypto/krng.c

0 → 100644
+66 −0
Original line number Diff line number Diff line 
/*

 * RNG implementation using standard kernel RNG.

 *

 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the

 * Free Software Foundation; either version 2 of the License, or (at your

 * any later version.

 *

 */



#include <crypto/internal/rng.h>

#include <linux/err.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/random.h>



static int krng_get_random(struct crypto_rng *tfm, u8 *rdata, unsigned int dlen)

{

	get_random_bytes(rdata, dlen);

	return 0;

}



static int krng_reset(struct crypto_rng *tfm, u8 *seed, unsigned int slen)

{

	return 0;

}



static struct crypto_alg krng_alg = {

	.cra_name		= "stdrng",

	.cra_driver_name	= "krng",

	.cra_priority		= 200,

	.cra_flags		= CRYPTO_ALG_TYPE_RNG,

	.cra_ctxsize		= 0,

	.cra_type		= &crypto_rng_type,

	.cra_module		= THIS_MODULE,

	.cra_list		= LIST_HEAD_INIT(krng_alg.cra_list),

	.cra_u			= {

		.rng = {

			.rng_make_random	= krng_get_random,

			.rng_reset		= krng_reset,

			.seedsize		= 0,

		}

	}

};





/* Module initalization */

static int __init krng_mod_init(void)

{

	return crypto_register_alg(&krng_alg);

}



static void __exit krng_mod_fini(void)

{

	crypto_unregister_alg(&krng_alg);

	return;

}



module_init(krng_mod_init);

module_exit(krng_mod_fini);



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Kernel Random Number Generator");

MODULE_ALIAS("stdrng");

crypto/rng.c

0 → 100644
+126 −0
Original line number Diff line number Diff line 
/*

 * Cryptographic API.

 *

 * RNG operations.

 *

 * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the Free

 * Software Foundation; either version 2 of the License, or (at your option)

 * any later version.

 *

 */



#include <asm/atomic.h>

#include <crypto/internal/rng.h>

#include <linux/err.h>

#include <linux/module.h>

#include <linux/mutex.h>

#include <linux/random.h>

#include <linux/seq_file.h>

#include <linux/string.h>



static DEFINE_MUTEX(crypto_default_rng_lock);

struct crypto_rng *crypto_default_rng;

EXPORT_SYMBOL_GPL(crypto_default_rng);

static int crypto_default_rng_refcnt;



static int rngapi_reset(struct crypto_rng *tfm, u8 *seed, unsigned int slen)

{

	u8 *buf = NULL;

	int err;



	if (!seed && slen) {

		buf = kmalloc(slen, GFP_KERNEL);

		if (!buf)

			return -ENOMEM;



		get_random_bytes(buf, slen);

		seed = buf;

	}



	err = crypto_rng_alg(tfm)->rng_reset(tfm, seed, slen);



	kfree(buf);

	return err;

}



static int crypto_init_rng_ops(struct crypto_tfm *tfm, u32 type, u32 mask)

{

	struct rng_alg *alg = &tfm->__crt_alg->cra_rng;

	struct rng_tfm *ops = &tfm->crt_rng;



	ops->rng_gen_random = alg->rng_make_random;

	ops->rng_reset = rngapi_reset;



	return 0;

}



static void crypto_rng_show(struct seq_file *m, struct crypto_alg *alg)

	__attribute__ ((unused));

static void crypto_rng_show(struct seq_file *m, struct crypto_alg *alg)

{

	seq_printf(m, "type         : rng\n");

	seq_printf(m, "seedsize     : %u\n", alg->cra_rng.seedsize);

}



static unsigned int crypto_rng_ctxsize(struct crypto_alg *alg, u32 type,

				       u32 mask)

{

	return alg->cra_ctxsize;

}



const struct crypto_type crypto_rng_type = {

	.ctxsize = crypto_rng_ctxsize,

	.init = crypto_init_rng_ops,

#ifdef CONFIG_PROC_FS

	.show = crypto_rng_show,

#endif

};

EXPORT_SYMBOL_GPL(crypto_rng_type);



int crypto_get_default_rng(void)

{

	struct crypto_rng *rng;

	int err;



	mutex_lock(&crypto_default_rng_lock);

	if (!crypto_default_rng) {

		rng = crypto_alloc_rng("stdrng", 0, 0);

		err = PTR_ERR(rng);

		if (IS_ERR(rng))

			goto unlock;



		err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));

		if (err) {

			crypto_free_rng(rng);

			goto unlock;

		}



		crypto_default_rng = rng;

	}



	crypto_default_rng_refcnt++;

	err = 0;



unlock:

	mutex_unlock(&crypto_default_rng_lock);



	return err;

}

EXPORT_SYMBOL_GPL(crypto_get_default_rng);



void crypto_put_default_rng(void)

{

	mutex_lock(&crypto_default_rng_lock);

	if (!--crypto_default_rng_refcnt) {

		crypto_free_rng(crypto_default_rng);

		crypto_default_rng = NULL;

	}

	mutex_unlock(&crypto_default_rng_lock);

}

EXPORT_SYMBOL_GPL(crypto_put_default_rng);



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Random Number Genertor");