[PATCH 00/38] Fix and simplify the NIST DRBG implementation

[Eric Biggers]

This series is intended to be taken through the cryptodev tree.  It can
also be retrieved from:

    git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git drbg-v1

This series fixes and greatly simplifies crypto/drbg.c, i.e. the
kernel's implementation of NIST SP800-90A.  This code isn't normally
used, but it's sometimes used by people doing FIPS 140-3 certifications.

Note: this series is *not* meant to encourage using this code over
random.c.  In fact, my recent commit 65b3c2f627851639 made "normal"
systems stop using this code.  It's just that the reality is that this
is in the kernel tree, it's been there for many years, and people are
using it to get FIPS 140-3 certifications.  As long as that's the case,
it might as well be fixed up and simplified.  Another reason to simplify
this as much as possible is that for historical reasons it's accessible
to unprivileged users via AF_ALG (even though it shouldn't be).  So I do
think this is a clear step forwards, regardless of level of enthusiasm
for FIPS, especially considering the massively negative diffstat.

Patches 1-5 begin with some bug fixes.  Fixes for CTR_DRBG and HASH_DRBG
are included, despite that code being removed later in the series, so
that they can be backported (though that is likely unused code anyway).

Patches 6-11 do some initial cleanups.

Patches 12-17 clean up the museum of DRBG variants to just support the
HMAC-SHA512 DRBG only, dropping support for the others.  This is already
the default variant, it makes sense that it's the default, and it's
probably the only one actually being used on current kernels.  In any
case, supporting more than one is pretty pointless.  See the patches for
more details about why it makes sense to keep using this one.

Patches 18-33 contain many more cleanups, including switching from the
crypto_shash API to the crypto library.

Patch 34 is a significant one: it starts adding 32 bytes from
get_random_bytes() to every additional input string.  This is to work
around the forward secrecy bug described in Woodage & Shumow (2018)
(https://eprint.iacr.org/2018/349.pdf), and to ensure that random.c
reseeds are actually reflected in drbg.c.  Of course, for FIPS 140-3
this is irrelevant, but this is the right thing to do in practice, and
it should make drbg.c quite a bit more robust in practice.  (This isn't
particularly novel, either; BoringSSL does essentially this same thing.)

Patches 35-38 are some further cleanups, including some tweaks to when
the formal reseeding happens.

Note: while the primary goal of this series is to fix and simplify this
code, this series is also intended to preserve the FIPS 140-3
"certifiable" property of crypto/drbg.c.  I.e. after this series, it
should still be possible to get a FIPS 140-3 certification that covers
it.  In fact it should become quite a bit easier, since there will be
only one DRBG variant to worry about and the code will be much more
straightforward.  If there's anything I missed, let me know.

Eric Biggers (38):
  crypto: drbg - Fix returning success on failure in CTR_DRBG
  crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
  crypto: drbg - Fix ineffective sanity check
  crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
  crypto: drbg - Fix the fips_enabled priority boost
  crypto: drbg - Remove always-enabled symbol CRYPTO_DRBG_HMAC
  crypto: drbg - Remove broken commented-out code
  crypto: drbg - Remove unhelpful helper functions
  crypto: drbg - Remove obsolete FIPS 140-2 continuous test
  crypto: drbg - Fold include/crypto/drbg.h into crypto/drbg.c
  crypto: drbg - Remove import of crypto_cipher functions
  crypto: drbg - Remove support for CTR_DRBG
  crypto: drbg - Remove support for HASH_DRBG
  crypto: drbg - Flatten the DRBG menu
  crypto: testmgr - Add test for drbg_pr_hmac_sha512
  crypto: testmgr - Update test for drbg_nopr_hmac_sha512
  crypto: drbg - Remove support for HMAC-SHA256 and HMAC-SHA384
  crypto: drbg - Simplify algorithm registration
  crypto: drbg - De-virtualize drbg_state_ops
  crypto: drbg - Move fixed values into constants
  crypto: drbg - Embed V and C into struct drbg_state
  crypto: drbg - Use HMAC-SHA512 library API
  crypto: drbg - Remove drbg_core
  crypto: drbg - Install separate seed functions for pr and nopr
  crypto: drbg - Move module aliases to end of file
  crypto: drbg - Consolidate "instantiate" logic and remove
    drbg_state::C
  crypto: drbg - Eliminate use of 'drbg_string' and lists
  crypto: drbg - Simplify drbg_generate_long() and fold into caller
  crypto: drbg - Put rng_alg methods in logical order
  crypto: drbg - Fold drbg_instantiate() into drbg_kcapi_seed()
  crypto: drbg - Separate "reseed" case in drbg_kcapi_seed()
  crypto: drbg - Fold drbg_prepare_hrng() into drbg_kcapi_seed()
  crypto: drbg - Simplify "uninstantiate" logic
  crypto: drbg - Include get_random_bytes() output in additional input
  crypto: drbg - Change DRBG_MAX_REQUESTS to 4096
  crypto: drbg - Remove redundant reseeding based on random.c state
  crypto: drbg - Clean up generation code
  crypto: drbg - Clean up loop in drbg_hmac_update()

 Documentation/crypto/api-samples.rst          |    2 +-
 Documentation/crypto/userspace-if.rst         |    2 +-
 arch/m68k/configs/amiga_defconfig             |    2 -
 arch/m68k/configs/apollo_defconfig            |    2 -
 arch/m68k/configs/atari_defconfig             |    2 -
 arch/m68k/configs/bvme6000_defconfig          |    2 -
 arch/m68k/configs/hp300_defconfig             |    2 -
 arch/m68k/configs/mac_defconfig               |    2 -
 arch/m68k/configs/multi_defconfig             |    2 -
 arch/m68k/configs/mvme147_defconfig           |    2 -
 arch/m68k/configs/mvme16x_defconfig           |    2 -
 arch/m68k/configs/q40_defconfig               |    2 -
 arch/m68k/configs/sun3_defconfig              |    2 -
 arch/m68k/configs/sun3x_defconfig             |    2 -
 arch/mips/configs/decstation_64_defconfig     |    2 -
 arch/mips/configs/decstation_defconfig        |    2 -
 arch/mips/configs/decstation_r4k_defconfig    |    2 -
 crypto/Kconfig                                |   40 +-
 crypto/df_sp80090a.c                          |    8 +-
 crypto/drbg.c                                 | 1800 +++--------------
 crypto/testmgr.c                              |  143 +-
 crypto/testmgr.h                              | 1262 ++++--------
 drivers/crypto/xilinx/xilinx-trng.c           |    1 -
 include/crypto/df_sp80090a.h                  |   25 +
 include/crypto/drbg.h                         |  263 ---
 include/crypto/internal/drbg.h                |   54 -
 .../crypto/chacha20-s390/test-cipher.c        |    1 -
 27 files changed, 728 insertions(+), 2903 deletions(-)
 delete mode 100644 include/crypto/drbg.h
 delete mode 100644 include/crypto/internal/drbg.h


base-commit: c1f49dea2b8f335813d3b348fd39117fb8efb428
-- 
2.53.0