| Message ID | 20210112192927.70596-1-ebiggers@kernel.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Herbert Xu |
| Headers | show |
| Series | [RESEND] random: initialize ChaCha20 constants with correct endianness | expand |
On Tue, 12 Jan 2021 at 20:30, Eric Biggers <ebiggers@kernel.org> wrote: > > From: Eric Biggers <ebiggers@google.com> > > On big endian CPUs, the ChaCha20-based CRNG is using the wrong > endianness for the ChaCha20 constants. > > This doesn't matter cryptographically, but technically it means it's not > ChaCha20 anymore. Fix it to always use the standard constants. > > Cc: linux-crypto@vger.kernel.org > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Jann Horn <jannh@google.com> > Cc: Theodore Ts'o <tytso@mit.edu> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au> > Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Ard Biesheuvel <ardb@kernel.org> > --- > > Andrew, please consider taking this patch since the maintainer has been > ignoring it for 4 months > (https://lkml.kernel.org/lkml/20200916045013.142179-1-ebiggers@kernel.org/T/#u). > > > drivers/char/random.c | 4 ++-- > include/crypto/chacha.h | 9 +++++++-- > 2 files changed, 9 insertions(+), 4 deletions(-) > > diff --git a/drivers/char/random.c b/drivers/char/random.c > index bbc5098b1a81f..4037a1e0fb748 100644 > --- a/drivers/char/random.c > +++ b/drivers/char/random.c > @@ -809,7 +809,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng) > > static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) > { > - memcpy(&crng->state[0], "expand 32-byte k", 16); > + chacha_init_consts(crng->state); > _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); > crng_init_try_arch(crng); > crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; > @@ -817,7 +817,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) > > static void __init crng_initialize_primary(struct crng_state *crng) > { > - memcpy(&crng->state[0], "expand 32-byte k", 16); > + chacha_init_consts(crng->state); > _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0); > if (crng_init_try_arch_early(crng) && trust_cpu) { > invalidate_batched_entropy(); > diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h > index 3a1c72fdb7cf5..dabaee6987186 100644 > --- a/include/crypto/chacha.h > +++ b/include/crypto/chacha.h > @@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds) > hchacha_block_generic(state, out, nrounds); > } > > -void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); > -static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) > +static inline void chacha_init_consts(u32 *state) > { > state[0] = 0x61707865; /* "expa" */ > state[1] = 0x3320646e; /* "nd 3" */ > state[2] = 0x79622d32; /* "2-by" */ > state[3] = 0x6b206574; /* "te k" */ > +} > + > +void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); > +static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) > +{ > + chacha_init_consts(state); > state[4] = key[0]; > state[5] = key[1]; > state[6] = key[2]; > -- > 2.30.0 >
On Tue, Jan 12, 2021 at 11:29:27AM -0800, Eric Biggers wrote: > From: Eric Biggers <ebiggers@google.com> > > On big endian CPUs, the ChaCha20-based CRNG is using the wrong > endianness for the ChaCha20 constants. > > This doesn't matter cryptographically, but technically it means it's not > ChaCha20 anymore. Fix it to always use the standard constants. > > Cc: linux-crypto@vger.kernel.org > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Jann Horn <jannh@google.com> > Cc: Theodore Ts'o <tytso@mit.edu> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au> > Signed-off-by: Eric Biggers <ebiggers@google.com> > --- > > Andrew, please consider taking this patch since the maintainer has been > ignoring it for 4 months > (https://lkml.kernel.org/lkml/20200916045013.142179-1-ebiggers@kernel.org/T/#u). Ping.
diff --git a/drivers/char/random.c b/drivers/char/random.c index bbc5098b1a81f..4037a1e0fb748 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -809,7 +809,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng) static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) { - memcpy(&crng->state[0], "expand 32-byte k", 16); + chacha_init_consts(crng->state); _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); crng_init_try_arch(crng); crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; @@ -817,7 +817,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) static void __init crng_initialize_primary(struct crng_state *crng) { - memcpy(&crng->state[0], "expand 32-byte k", 16); + chacha_init_consts(crng->state); _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0); if (crng_init_try_arch_early(crng) && trust_cpu) { invalidate_batched_entropy(); diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h index 3a1c72fdb7cf5..dabaee6987186 100644 --- a/include/crypto/chacha.h +++ b/include/crypto/chacha.h @@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds) hchacha_block_generic(state, out, nrounds); } -void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); -static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) +static inline void chacha_init_consts(u32 *state) { state[0] = 0x61707865; /* "expa" */ state[1] = 0x3320646e; /* "nd 3" */ state[2] = 0x79622d32; /* "2-by" */ state[3] = 0x6b206574; /* "te k" */ +} + +void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); +static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) +{ + chacha_init_consts(state); state[4] = key[0]; state[5] = key[1]; state[6] = key[2];