From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Eric Biggers <ebiggers@kernel.org>
Cc: x86@kernel.org, linux-arm-kernel@lists.infradead.org,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
Adam Langley <agl@google.com>, Ard Biesheuvel <ardb@kernel.org>
Subject: Re: Should Linux set the new constant-time mode CPU flags?
Date: Mon, 29 Aug 2022 12:39:53 -0400 [thread overview]
Message-ID: <Ywzr2d52ixYXUDWR@zx2c4.com> (raw)
In-Reply-To: <YwgCrqutxmX0W72r@gmail.com>
Hi Eric,
On Thu, Aug 25, 2022 at 11:15:58PM +0000, Eric Biggers wrote:
> I'm wondering if people are aware of this issue, and whether anyone has any
> thoughts on whether/where the kernel should be setting these new CPU flags.
> There don't appear to have been any prior discussions about this. (Thanks to
Maybe it should be set unconditionally now, until we figure out how to
make it more granular.
In terms of granularity, I saw other folks suggesting making it per-task
(so, presumably, a prctl() knob), and others mentioning doing it just
for kernel crypto. For the latter, I guess the crypto API could set it
inside of its abstractions, and the various lib/crypto APIs could set it
at invocation time. I wonder, though, what's the cost of
enabling/disabling it? Would we in fact need a kind of lazy-deferred
disabling, like we have with kernel_fpu_end()? I also wonder what
crypto-adjacent code might wind up being missed if we're going function
by function. Like, obviously we'd set this for crypto_memneq, but what
about potential unprotected `==` of ID numbers that could leak some info
in various protocols? What other subtle nearby code should we be
thinking about, that relies on constant time logic but isn't neatly
folded inside a crypto_do_something() function?
Jason
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-08-29 16:51 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-25 23:15 Should Linux set the new constant-time mode CPU flags? Eric Biggers
2022-08-26 7:23 ` Peter Zijlstra
2022-08-26 8:45 ` Arnd Bergmann
2022-09-15 17:18 ` Catalin Marinas
2022-08-26 15:40 ` Jeffrey Walton
2022-08-29 16:39 ` Jason A. Donenfeld [this message]
2022-08-29 18:08 ` Eric Biggers
2022-08-29 19:09 ` Jason A. Donenfeld
2022-08-29 19:05 ` Jason A. Donenfeld
2022-08-30 14:25 ` Dave Hansen
2022-09-01 11:00 ` Peter Zijlstra
2022-10-25 5:06 ` Eric Biggers
2022-09-15 17:52 ` Catalin Marinas
2022-10-26 17:01 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Ywzr2d52ixYXUDWR@zx2c4.com \
--to=jason@zx2c4.com \
--cc=agl@google.com \
--cc=ardb@kernel.org \
--cc=ebiggers@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).