nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

crypto: drbg - add async seeding operation

Browse source 
The async seeding operation is triggered during initalization right
after the first non-blocking seeding is completed. As required by the
asynchronous operation of random.c, a callback function is provided that
is triggered by random.c once entropy is available. That callback
function performs the actual seeding of the DRBG.

CC: Andreas Steffen <andreas.steffen@strongswan.org>
CC: Theodore Ts'o <tytso@mit.edu>
CC: Sandy Harris <sandyinchina@gmail.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Stephan Mueller 2015-05-25 15:09:36 +02:00 committed by Herbert Xu
parent 3d6a5f75d1
commit 4c7879907e
2 changed files with 26 additions and 0 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

24
crypto/drbg.c
View file

@ -1056,6 +1056,23 @@ static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
return ret; return ret;
} }
static void drbg_async_seed(struct work_struct *work)
{
struct drbg_string data;
LIST_HEAD(seedlist);
struct drbg_state *drbg = container_of(work, struct drbg_state,
seed_work);
get_blocking_random_bytes(drbg->seed_buf, drbg->seed_buf_len);
drbg_string_fill(&data, drbg->seed_buf, drbg->seed_buf_len);
list_add_tail(&data.list, &seedlist);
mutex_lock(&drbg->drbg_mutex);
__drbg_seed(drbg, &seedlist, true);
memzero_explicit(drbg->seed_buf, drbg->seed_buf_len);
mutex_unlock(&drbg->drbg_mutex);
}
/* /*
* Seeding or reseeding of the DRBG * Seeding or reseeding of the DRBG
* *
@ -1125,6 +1142,10 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
if (!reseed) if (!reseed)
drbg->seed_buf_len = drbg->seed_buf_len / 3 * 2; drbg->seed_buf_len = drbg->seed_buf_len / 3 * 2;
/* Invoke asynchronous seeding unless DRBG is in test mode. */
if (!list_empty(&drbg->test_data.list) && !reseed)
schedule_work(&drbg->seed_work);
out: out:
return ret; return ret;
} }
@ -1231,6 +1252,8 @@ static inline int drbg_alloc_state(struct drbg_state *drbg)
if (!drbg->seed_buf) if (!drbg->seed_buf)
goto err; goto err;
INIT_WORK(&drbg->seed_work, drbg_async_seed);
return 0; return 0;
err: err:
@ -1487,6 +1510,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
*/ */
static int drbg_uninstantiate(struct drbg_state *drbg) static int drbg_uninstantiate(struct drbg_state *drbg)
{ {
cancel_work_sync(&drbg->seed_work);
if (drbg->d_ops) if (drbg->d_ops)
drbg->d_ops->crypto_fini(drbg); drbg->d_ops->crypto_fini(drbg);
drbg_dealloc_state(drbg); drbg_dealloc_state(drbg);

2
include/crypto/drbg.h
View file

@ -51,6 +51,7 @@
#include <linux/fips.h> #include <linux/fips.h>
#include <linux/mutex.h> #include <linux/mutex.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/workqueue.h>
/* /*
* Concatenation Helper and string operation helper * Concatenation Helper and string operation helper
@ -119,6 +120,7 @@ struct drbg_state {
bool fips_primed; /* Continuous test primed? */ bool fips_primed; /* Continuous test primed? */
unsigned char *prev; /* FIPS 140-2 continuous test value */ unsigned char *prev; /* FIPS 140-2 continuous test value */
#endif #endif
struct work_struct seed_work; /* asynchronous seeding support */
u8 *seed_buf; /* buffer holding the seed */ u8 *seed_buf; /* buffer holding the seed */
size_t seed_buf_len; size_t seed_buf_len;
const struct drbg_state_ops *d_ops; const struct drbg_state_ops *d_ops;