From: "Theodore Ts'o" <tytso@mit.edu>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] random: use named fields for adjusting chacha state
Date: Thu, 20 Jan 2022 12:50:18 -0500 [thread overview]
Message-ID: <Yemg2rWLqmYNzcDF@mit.edu> (raw)
In-Reply-To: <20220120150734.509125-1-Jason@zx2c4.com>
On Thu, Jan 20, 2022 at 04:07:34PM +0100, Jason A. Donenfeld wrote:
> @@ -750,13 +756,13 @@ static bool crng_init_try_arch(struct crng_state *crng)
> bool arch_init = true;
> unsigned long rv;
>
> - for (i = 4; i < 16; i++) {
> + for (i = 0; i < ARRAY_SIZE(crng->key); i++) {
> if (!arch_get_random_seed_long(&rv) &&
> !arch_get_random_long(&rv)) {
> rv = random_get_entropy();
> arch_init = false;
> }
> - crng->state[i] ^= rv;
> + crng->key[i] ^= rv;
> }
This change means that we're only initializing the key, but we're not
initializing the counter/nonce (well, IV) value. Could you fix this,
please?
> @@ -768,13 +774,13 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)
> bool arch_init = true;
> unsigned long rv;
>
> - for (i = 4; i < 16; i++) {
> + for (i = 0; i < ARRAY_SIZE(crng->key); i++) {
> if (!arch_get_random_seed_long_early(&rv) &&
> !arch_get_random_long_early(&rv)) {
> rv = random_get_entropy();
> arch_init = false;
> }
> - crng->state[i] ^= rv;
> + crng->key[i] ^= rv;
> }
Same issue here.
> @@ -783,14 +789,14 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)
> static void crng_initialize_secondary(struct crng_state *crng)
> {
> chacha_init_consts(crng->state);
> - _get_random_bytes(&crng->state[4], sizeof(u32) * 12);
> + _get_random_bytes(&crng->key, sizeof(crng->key));
> crng_init_try_arch(crng);
> crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
> }
.... and here....
> static void __init crng_initialize_primary(struct crng_state *crng)
> {
> - _extract_entropy(&crng->state[4], sizeof(u32) * 12);
> + _extract_entropy(&crng->key, sizeof(crng->key));
> if (crng_init_try_arch_early(crng) && trust_cpu && crng_init < 2) {
> invalidate_batched_entropy();
> numa_crng_init();
> @@ -892,7 +898,7 @@ static size_t crng_fast_load(const u8 *cp, size_t len)
And here....
> @@ -994,9 +1000,9 @@ static void _extract_crng(struct crng_state *crng, u8 out[CHACHA_BLOCK_SIZE])
> crng_reseed(crng, crng == &primary_crng);
> }
> spin_lock_irqsave(&crng->lock, flags);
> - chacha20_block(&crng->state[0], out);
> - if (crng->state[12] == 0)
> - crng->state[13]++;
> + chacha20_block(crng->state, out);
> + if (unlikely(!crng->counter[0] && !++crng->counter[1]))
> + ++crng->nonce;
> spin_unlock_irqrestore(&crng->lock, flags);
> }
Minor nit, but I might do this as:
if (unlikely(!crng->counter[0]) && !++crng->counter[1])
++crng->nonce;
Cheers,
- Ted
next prev parent reply other threads:[~2022-01-20 17:50 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-30 16:50 [PATCH] random: avoid superfluous call to RDRAND in CRNG extraction Jason A. Donenfeld
2021-12-30 22:13 ` Theodore Ts'o
2021-12-30 22:58 ` Jason A. Donenfeld
2021-12-31 3:35 ` Theodore Ts'o
2021-12-31 11:49 ` [PATCH v2] " Jason A. Donenfeld
2021-12-31 17:13 ` Theodore Ts'o
2022-01-04 5:03 ` Sandy Harris
2022-01-04 5:55 ` Theodore Ts'o
2022-01-20 15:03 ` Jason A. Donenfeld
2022-01-20 15:07 ` [PATCH] random: use named fields for adjusting chacha state Jason A. Donenfeld
2022-01-20 17:50 ` Theodore Ts'o [this message]
2022-01-20 21:53 ` Jason A. Donenfeld
2022-01-05 15:28 ` [PATCH v2] random: avoid superfluous call to RDRAND in CRNG extraction Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Yemg2rWLqmYNzcDF@mit.edu \
--to=tytso@mit.edu \
--cc=Jason@zx2c4.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).