Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

From: "Theodore Ts'o" <tytso@mit.edu>
To: "Reshetova, Elena" <elena.reshetova@intel.com>
Cc: Eric Biggers <ebiggers3@gmail.com>,
	"ebiggers@google.com" <ebiggers@google.com>,
	"herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
	David Laight <David.Laight@ACULAB.COM>,
	Ingo Molnar <mingo@kernel.org>,
	"'Peter Zijlstra'" <peterz@infradead.org>,
	"keescook@chromium.org" <keescook@chromium.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	"luto@kernel.org" <luto@kernel.org>,
	"luto@amacapital.net" <luto@amacapital.net>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"jpoimboe@redhat.com" <jpoimboe@redhat.com>,
	"jannh@google.com" <jannh@google.com>,
	"Perla, Enrico" <enrico.perla@intel.com>,
	"mingo@redhat.com" <mingo@redhat.com>,
	"bp@alien8.de" <bp@alien8.de>,
	"tglx@linutronix.de" <tglx@linutronix.de>,
	"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
	"Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
Subject: Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall
Date: Fri, 26 Apr 2019 10:01:02 -0400	[thread overview]
Message-ID: <20190426140102.GA4922@mit.edu> (raw)
In-Reply-To: <2236FBA76BA1254E88B949DDB74E612BA4C63E24@IRSMSX102.ger.corp.intel.com>

On Fri, Apr 26, 2019 at 11:33:09AM +0000, Reshetova, Elena wrote:
> Adding Eric and Herbert to continue discussion for the chacha part. 
> So, as a short summary I am trying to find out a fast (fast enough to be used per syscall
> invocation) source of random bits with good enough security properties. 
> I started to look into chacha kernel implementation and while it seems that it is designed to 
> work with any number of rounds, it does not expose less than 12 rounds primitive. 
> I guess this is done for security sake, since 12 is probably the lowest bound we want people
> to use for the purpose of encryption/decryption, but if we are to build an efficient RNG,
> chacha8 probably is a good tradeoff between security and speed. 
> 
> What are people's opinions/perceptions on this? Has it been considered before to create a
> kernel RNG based on chacha?

Well, sure.  The get_random_bytes() kernel interface and the
getrandom(2) system call uses a CRNG based on chacha20.  See
extract_crng() and crng_reseed() in drivers/char/random.c.

It *is* possible to use an arbitrary number of rounds if you use the
low level interface exposed as chacha_block(), which is an
EXPORT_SYMBOL interface so even modules can use it.  "Does not expose
less than 12 rounds" applies only if you are using the high-level
crypto interface.

We have used cut down crypto algorithms for performance critical
applications before; at one point, we were using a cut down MD4(!) for
initial TCP sequence number generation.  But that was getting rekeyed
every five minutes, and the goal was to make it just hard enough that
there were other easier ways of DOS attacking a server.

I'm not a cryptographer, so I'd really us to hear from multiple
experts about the security level of, say, ChaCha8 so we understand
exactly kind of security we'd offering.  And I'd want that interface
to be named so that it's clear it's only intended for a very specific
use case, since it will be tempting for other kernel developers to use
it in other contexts, with undue consideration.

      	    	      	   	 - Ted