linux-crypto.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Horia Geanta <horia.geanta@nxp.com>
To: Andrey Smirnov <andrew.smirnov@gmail.com>,
	"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Cc: Chris Healy <cphealy@gmail.com>,
	Lucas Stach <l.stach@pengutronix.de>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Iuliana Prodan <iuliana.prodan@nxp.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	dl-linux-imx <linux-imx@nxp.com>
Subject: Re: [PATCH v5 0/4] enable CAAM's HWRNG as default
Date: Mon, 9 Dec 2019 15:44:15 +0000	[thread overview]
Message-ID: <VI1PR0402MB3485EF10976A4A69F90E5B0F98580@VI1PR0402MB3485.eurprd04.prod.outlook.com> (raw)
In-Reply-To: <20191203162357.21942-1-andrew.smirnov@gmail.com>

On 12/3/2019 6:24 PM, Andrey Smirnov wrote:
> Everyone:
> 
> This series is a continuation of original [discussion]. I don't know
> if what's in the series is enough to use CAAMs HWRNG system wide, but
> I am hoping that with enough iterations and feedback it will be.
> 
> Changes since [v1]:
> 
>     - Original hw_random replaced with the one using output of TRNG directly
> 
>     - SEC4 DRNG IP block exposed via crypto API
> 
>     - Small fix regarding use of GFP_DMA added to the series
> 
> Chagnes since [v2]:
> 
>     - msleep in polling loop to avoid wasting CPU cycles
> 
>     - caam_trng_read() bails out early if 'wait' is set to 'false'
> 
>     - fixed typo in ZII's name
> 
> Changes since [v3]:
> 
>     - DRNG's .cra_name is now "stdrng"
> 
>     - collected Reviewd-by tag from Lucas
> 
>     - typo fixes in commit messages of the series
> 
> Changes since [v4]:
> 
>     - Dropped "crypto: caam - RNG4 TRNG errata" and "crypto: caam -
>       enable prediction resistance in HRWNG" to limit the scope of the
>       series. Those two patches are not yet ready and can be submitted
>       separately later.
> 
I don't agree with dropping the Job Ring Interface (JRI) in favor of
using TRNG registers directly - for the purpose of extracting entropy.

One of the reasons is that TRNG registers are part of page 0,
which is not accessible in the Linux kernel in some cases.

It's possible to use JRI for extracting entropy following these steps:

1. Instantiate RNG state handle with Prediction Resistance (PR) support
This is optional in cases when page 0 is not under kernel's control.
We'll separately modify SW controlling page 0 to offer PR support.

2. For each hwrng read(), enqueue via JRI one or more job descriptors (JD)
having the PR bit set in the ALGORITHM OPERATION command.

Note that according to hwrng API, it's ok to *partially* fulfill the request:
 * @read:		New API. drivers can fill up to max bytes of data
 *			into the buffer. The buffer is aligned for any type
 *			and max is a multiple of 4 and >= 32 bytes.

It's important to limit the output of each JD, such that the recommendation
in SP800-90C (section "9.4 The Oversampling-NRBG Construction") is followed:
https://csrc.nist.gov/CSRC/media/Publications/sp/800-90c/draft/documents/sp800_90c_second_draft.pdf

For CAAM RNG4, the DRBG security strength is s = 256 bits (32 bytes),
thus each JD must extract at most s/2 - 128 bits (16 bytes).

Similar to what's being done for TRNG registers-based implementation,
some back-off mechanism is needed, such that DECO won't stall
waiting for the TRNG.
This is important on i.MX platforms where there's a single DECO
(on PPC & Layerscape platforms there are multiple DECOs).

Horia

      parent reply	other threads:[~2019-12-09 15:45 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-03 16:23 Andrey Smirnov
2019-12-03 16:23 ` [PATCH v5 1/4] crypto: caam - allocate RNG instantiation descriptor with GFP_DMA Andrey Smirnov
2019-12-03 16:23 ` [PATCH v5 2/4] crypto: caam - move RNG presence check into a shared function Andrey Smirnov
2019-12-03 16:23 ` [PATCH v5 3/4] crypto: caam - replace DRNG with TRNG for use with hw_random Andrey Smirnov
2019-12-03 16:23 ` [PATCH v5 4/4] crypto: caam - expose SEC4 DRNG via crypto RNG API Andrey Smirnov
2019-12-09 15:44 ` Horia Geanta [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=VI1PR0402MB3485EF10976A4A69F90E5B0F98580@VI1PR0402MB3485.eurprd04.prod.outlook.com \
    --to=horia.geanta@nxp.com \
    --cc=andrew.smirnov@gmail.com \
    --cc=cphealy@gmail.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=iuliana.prodan@nxp.com \
    --cc=l.stach@pengutronix.de \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-imx@nxp.com \
    --cc=linux-kernel@vger.kernel.org \
    --subject='Re: [PATCH v5 0/4] enable CAAM'\''s HWRNG as default' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).