| Message ID | 20211025092525.12805-4-nstange@suse.de (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Herbert Xu |
| Headers | show |
| Series | crypto: DRBG - improve 'nopr' reseeding | expand |
Am Montag, 25. Oktober 2021, 11:25:22 CEST schrieb Nicolai Stange: Hi Nicolai, > Since commit 42ea507fae1a ("crypto: drbg - reseed often if seedsource is > degraded"), the maximum seed lifetime represented by ->reseed_threshold > gets temporarily lowered if the get_random_bytes() source cannot provide > sufficient entropy yet, as is common during boot, and restored back to > the original value again once that has changed. > > More specifically, if the add_random_ready_callback() invoked from > drbg_prepare_hrng() in the course of DRBG instantiation does not return > -EALREADY, that is, if get_random_bytes() has not been fully initialized > at this point yet, drbg_prepare_hrng() will lower ->reseed_threshold > to a value of 50. The drbg_async_seed() scheduled from said > random_ready_callback will eventually restore the original value. > > A future patch will replace the random_ready_callback based notification > mechanism and thus, there will be no add_random_ready_callback() return > value anymore which could get compared to -EALREADY. > > However, there's __drbg_seed() which gets invoked in the course of both, > the DRBG instantiation as well as the eventual reseeding from > get_random_bytes() in aforementioned drbg_async_seed(), if any. Moreover, > it knows about the get_random_bytes() initialization state by the time the > seed data had been obtained from it: the new_seed_state argument introduced > with the previous patch would get set to DRBG_SEED_STATE_PARTIAL in case > get_random_bytes() had not been fully initialized yet and to > DRBG_SEED_STATE_FULL otherwise. Thus, __drbg_seed() provides a convenient > alternative for managing that ->reseed_threshold lowering and restoring at > a central place. > > Move all ->reseed_threshold adjustment code from drbg_prepare_hrng() and > drbg_async_seed() respectively to __drbg_seed(). Make __drbg_seed() > lower the ->reseed_threshold to 50 in case its new_seed_state argument > equals DRBG_SEED_STATE_PARTIAL and let it restore the original value > otherwise. > > There is no change in behaviour. > > Signed-off-by: Nicolai Stange <nstange@suse.de> Reviewed-by: Stephan Müller <smueller@chronox.de> Ciao Stephan
diff --git a/crypto/drbg.c b/crypto/drbg.c index 55fe8caf569a..6aad210f101a 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1047,6 +1047,27 @@ static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed, /* 10.1.1.2 / 10.1.1.3 step 5 */ drbg->reseed_ctr = 1; + switch (drbg->seeded) { + case DRBG_SEED_STATE_UNSEEDED: + /* Impossible, but handle it to silence compiler warnings. */ + fallthrough; + case DRBG_SEED_STATE_PARTIAL: + /* + * Require frequent reseeds until the seed source is + * fully initialized. + */ + drbg->reseed_threshold = 50; + break; + + case DRBG_SEED_STATE_FULL: + /* + * Seed source has become fully initialized, frequent + * reseeds no longer required. + */ + drbg->reseed_threshold = drbg_max_requests(drbg); + break; + } + return ret; } @@ -1095,9 +1116,6 @@ static void drbg_async_seed(struct work_struct *work) __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL); - if (drbg->seeded == DRBG_SEED_STATE_FULL) - drbg->reseed_threshold = drbg_max_requests(drbg); - unlock: mutex_unlock(&drbg->drbg_mutex); @@ -1534,12 +1552,6 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) return err; } - /* - * Require frequent reseeds until the seed source is fully - * initialized. - */ - drbg->reseed_threshold = 50; - return err; }
Since commit 42ea507fae1a ("crypto: drbg - reseed often if seedsource is degraded"), the maximum seed lifetime represented by ->reseed_threshold gets temporarily lowered if the get_random_bytes() source cannot provide sufficient entropy yet, as is common during boot, and restored back to the original value again once that has changed. More specifically, if the add_random_ready_callback() invoked from drbg_prepare_hrng() in the course of DRBG instantiation does not return -EALREADY, that is, if get_random_bytes() has not been fully initialized at this point yet, drbg_prepare_hrng() will lower ->reseed_threshold to a value of 50. The drbg_async_seed() scheduled from said random_ready_callback will eventually restore the original value. A future patch will replace the random_ready_callback based notification mechanism and thus, there will be no add_random_ready_callback() return value anymore which could get compared to -EALREADY. However, there's __drbg_seed() which gets invoked in the course of both, the DRBG instantiation as well as the eventual reseeding from get_random_bytes() in aforementioned drbg_async_seed(), if any. Moreover, it knows about the get_random_bytes() initialization state by the time the seed data had been obtained from it: the new_seed_state argument introduced with the previous patch would get set to DRBG_SEED_STATE_PARTIAL in case get_random_bytes() had not been fully initialized yet and to DRBG_SEED_STATE_FULL otherwise. Thus, __drbg_seed() provides a convenient alternative for managing that ->reseed_threshold lowering and restoring at a central place. Move all ->reseed_threshold adjustment code from drbg_prepare_hrng() and drbg_async_seed() respectively to __drbg_seed(). Make __drbg_seed() lower the ->reseed_threshold to 50 in case its new_seed_state argument equals DRBG_SEED_STATE_PARTIAL and let it restore the original value otherwise. There is no change in behaviour. Signed-off-by: Nicolai Stange <nstange@suse.de> --- crypto/drbg.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)