[PATCH 00/11] Stop pulling DRBG code into non-FIPS kernels

[Eric Biggers]

Most kernels have CRYPTO_FIPS=n but still include crypto/drbg.c and
everything it depends on, including crypto/jitterentropy.c.

This dependency bloat happens because some kernel code gets random bytes
from "stdrng" in the crypto_rng API instead of from get_random_bytes().
(This is apparently done for FIPS certification reasons.)  Then, that
pulls crypto/drbg.c to provide a "stdrng" implementation.

This series fixes the dependency bloat by making "stdrng" be used only
in FIPS mode, and get_random_bytes_wait() be used otherwise.

This series is targeting cryptodev/master.

Eric Biggers (11):
  crypto: rng - Add crypto_stdrng_get_bytes()
  crypto: dh - Use crypto_stdrng_get_bytes()
  crypto: ecc - Use crypto_stdrng_get_bytes()
  crypto: geniv - Use crypto_stdrng_get_bytes()
  crypto: hisilicon/hpre - Use crypto_stdrng_get_bytes()
  crypto: intel/keembay-ocs-ecc - Use crypto_stdrng_get_bytes()
  net: tipc: Use crypto_stdrng_get_bytes()
  crypto: rng - Unexport "default RNG" symbols
  crypto: rng - Make crypto_stdrng_get_bytes() use normal RNG in
    non-FIPS mode
  crypto: fips - Depend on CRYPTO_DRBG=y
  crypto: rng - Don't pull in DRBG when CRYPTO_FIPS=n

 crypto/Kconfig                                |  9 +------
 crypto/dh.c                                   |  8 +-----
 crypto/ecc.c                                  | 11 +++-----
 crypto/geniv.c                                |  8 +-----
 crypto/rng.c                                  | 23 ++++++++++++-----
 drivers/crypto/hisilicon/hpre/hpre_crypto.c   | 12 ++-------
 .../crypto/intel/keembay/keembay-ocs-ecc.c    | 17 +++----------
 include/crypto/rng.h                          | 25 ++++++++++++++++---
 net/tipc/crypto.c                             | 13 ++--------
 9 files changed, 53 insertions(+), 73 deletions(-)


base-commit: f9bbd547cfb98b1c5e535aab9b0671a2ff22453a
-- 
2.53.0