From: Geert Uytterhoeven <geert@linux-m68k.org>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Theodore Tso <tytso@mit.edu>,
Greg KH <gregkh@linuxfoundation.org>,
Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Subject: Re: [PATCH v2 2/2] random: use BLAKE2s instead of SHA1 in extraction
Date: Tue, 11 Jan 2022 12:38:40 +0100 [thread overview]
Message-ID: <CAMuHMdU0spv9X_wErkBBWQ9kV9f1zE_YNcu5nPbTG_64Lh_h0w@mail.gmail.com> (raw)
In-Reply-To: <20211223141113.1240679-2-Jason@zx2c4.com>
Hi Jsaon,
On Sat, Dec 25, 2021 at 1:52 AM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> This commit addresses one of the lower hanging fruits of the RNG: its
> usage of SHA1.
>
> BLAKE2s is generally faster, and certainly more secure, than SHA1, which
> has [1] been [2] really [3] very [4] broken [5]. Additionally, the
> current construction in the RNG doesn't use the full SHA1 function, as
> specified, and allows overwriting the IV with RDRAND output in an
> undocumented way, even in the case when RDRAND isn't set to "trusted",
> which means potential malicious IV choices. And its short length means
> that keeping only half of it secret when feeding back into the mixer
> gives us only 2^80 bits of forward secrecy. In other words, not only is
> the choice of hash function dated, but the use of it isn't really great
> either.
m68k bloat-o-meter:
blake2s_compress_generic - 4448 +4448
blake2s256_hmac - 302 +302
blake2s_update - 156 +156
blake2s_final - 124 +124
blake2s_init.constprop - 94 +94
__ksymtab_blake2s_update - 12 +12
__ksymtab_blake2s_final - 12 +12
__ksymtab_blake2s_compress_generic - 12 +12
__ksymtab_blake2s256_hmac - 12 +12
blake2s_mod_init - 4 +4
__initcall__kmod_libblake2s__101_82_blake2s_mod_init6 - 4 +4
Unfortunately we cannot get rid of the sha1 code yet (lib/sha1.o is
built-in unconditionally), as there are other users...
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
next prev parent reply other threads:[~2022-01-11 11:39 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-23 14:11 [PATCH v2 1/2] lib/crypto: blake2s: include as built-in Jason A. Donenfeld
2021-12-23 14:11 ` [PATCH v2 2/2] random: use BLAKE2s instead of SHA1 in extraction Jason A. Donenfeld
2021-12-24 20:56 ` Eric Biggers
2022-01-05 21:42 ` Eric Biggers
2021-12-27 15:52 ` Theodore Ts'o
2022-01-11 11:38 ` Geert Uytterhoeven [this message]
2022-01-11 12:28 ` Jason A. Donenfeld
2022-01-11 12:50 ` Jason A. Donenfeld
2022-01-11 12:57 ` Geert Uytterhoeven
2022-01-11 13:00 ` Jason A. Donenfeld
2022-01-11 15:46 ` David Laight
2022-01-11 18:26 ` Jason A. Donenfeld
2022-01-14 17:27 ` David Laight
2022-01-14 17:31 ` Jason A. Donenfeld
2022-01-11 12:51 ` Geert Uytterhoeven
2022-01-11 13:02 ` Jason A. Donenfeld
2022-01-11 13:49 ` [PATCH crypto 0/2] smaller blake2s code size on m68k and other small platforms Jason A. Donenfeld
2022-01-11 13:49 ` [PATCH crypto 1/2] lib/crypto: blake2s-generic: reduce code size on small systems Jason A. Donenfeld
2022-01-12 10:57 ` Geert Uytterhoeven
2022-01-12 13:16 ` Jason A. Donenfeld
2022-01-12 18:31 ` Eric Biggers
2022-01-12 18:50 ` Jason A. Donenfeld
2022-01-12 21:27 ` David Laight
2022-01-12 22:00 ` Jason A. Donenfeld
2022-01-11 13:49 ` [PATCH crypto 2/2] lib/crypto: blake2s: move hmac construction into wireguard Jason A. Donenfeld
2022-01-11 14:43 ` Ard Biesheuvel
2022-01-12 18:35 ` Eric Biggers
2022-01-11 18:10 ` [PATCH crypto v2 0/2] reduce code size from blake2s on m68k and other small platforms Jason A. Donenfeld
2022-01-11 18:10 ` [PATCH crypto v2 1/2] lib/crypto: blake2s: move hmac construction into wireguard Jason A. Donenfeld
2022-01-11 18:10 ` [PATCH crypto v2 2/2] lib/crypto: sha1: re-roll loops to reduce code size Jason A. Donenfeld
2022-01-11 22:05 ` [PATCH crypto v3 0/2] reduce code size from blake2s on m68k and other small platforms Jason A. Donenfeld
2022-01-11 22:05 ` [PATCH crypto v3 1/2] lib/crypto: blake2s: move hmac construction into wireguard Jason A. Donenfeld
2022-01-11 22:05 ` [PATCH crypto v3 2/2] lib/crypto: sha1: re-roll loops to reduce code size Jason A. Donenfeld
2022-01-12 10:59 ` [PATCH crypto v3 0/2] reduce code size from blake2s on m68k and other small platforms Geert Uytterhoeven
2022-01-12 13:18 ` Jason A. Donenfeld
2022-01-18 6:42 ` Herbert Xu
2022-01-18 11:43 ` Jason A. Donenfeld
2022-01-18 12:44 ` David Laight
2022-01-18 12:50 ` Jason A. Donenfeld
2021-12-23 14:20 ` [PATCH v2 1/2] lib/crypto: blake2s: include as built-in Ard Biesheuvel
2021-12-24 13:35 ` Greg KH
2021-12-25 9:26 ` Masahiro Yamada
2021-12-25 10:26 ` Ard Biesheuvel
2021-12-25 15:47 ` Masahiro Yamada
2021-12-27 13:43 ` Jason A. Donenfeld
2021-12-27 13:47 ` [PATCH v3] " Jason A. Donenfeld
2021-12-27 14:20 ` [PATCH v4] " Jason A. Donenfeld
2022-01-01 15:59 ` [PATCH v5] " Jason A. Donenfeld
2022-01-02 20:42 ` [PATCH v6] " Jason A. Donenfeld
2022-01-03 3:23 ` Herbert Xu
2022-01-03 3:45 ` Jason A. Donenfeld
2022-01-03 4:06 ` Herbert Xu
2022-01-03 11:57 ` Jason A. Donenfeld
2022-01-03 12:31 ` [PATCH v7] " Jason A. Donenfeld
2022-01-04 1:21 ` Herbert Xu
2022-01-04 17:02 ` Ard Biesheuvel
2022-01-04 17:04 ` Jason A. Donenfeld
2022-01-05 0:28 ` Herbert Xu
2022-01-05 21:53 ` Eric Biggers
2022-01-05 22:01 ` Ard Biesheuvel
2022-01-05 22:09 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMuHMdU0spv9X_wErkBBWQ9kV9f1zE_YNcu5nPbTG_64Lh_h0w@mail.gmail.com \
--to=geert@linux-m68k.org \
--cc=Jason@zx2c4.com \
--cc=gregkh@linuxfoundation.org \
--cc=jeanphilippe.aumasson@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).