From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 847DEC43600 for ; Thu, 1 Apr 2021 18:09:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6347A60FE6 for ; Thu, 1 Apr 2021 18:09:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237779AbhDASI6 (ORCPT ); Thu, 1 Apr 2021 14:08:58 -0400 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:33262 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235918AbhDARx3 (ORCPT ); Thu, 1 Apr 2021 13:53:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1617299609; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=l8/dySFN4v+yQFlMN3vPmAf3KiTWg3DM/WffjDS3ers=; b=Jtg4ymg2wDz8uMA4VifHFI7nahAc9+cKEtY1lCFvLdCavT6UGIPhnClp9mW09jwDVokZ+P vPDEgNrLR/x1HTiOK1frSYEnECnypwDDCwKK8oghPIPq0kQpT+z68YN1GzZAUTMGjx3TJj UzgZbkpwaDc/8xwHCvy9rdyMljFdlzw= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-462-BIqoePmMOaa190kVodQkqA-1; Thu, 01 Apr 2021 13:53:26 -0400 X-MC-Unique: BIqoePmMOaa190kVodQkqA-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id B02D6501FF; Thu, 1 Apr 2021 17:53:24 +0000 (UTC) Received: from ovpn-113-84.phx2.redhat.com (ovpn-113-84.phx2.redhat.com [10.3.113.84]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 01EE310023AF; Thu, 1 Apr 2021 17:53:23 +0000 (UTC) Message-ID: Subject: Re: Fix hibernation in FIPS mode? From: Simo Sorce To: "Rafael J. Wysocki" Cc: Ard Biesheuvel , Dexuan Cui , "linux-pm@vger.kernel.org" , "crecklin@redhat.com" , "linux-crypto@vger.kernel.org" , "linux-kernel@vger.kernel.org" Date: Thu, 01 Apr 2021 13:53:22 -0400 In-Reply-To: References: <4e95307db43e2f7cc8516e645b81db7db0dd8ad4.camel@redhat.com> <504652e70f0a4e42e4927583b9ed47cd78590329.camel@redhat.com> <44e4e4e62bff778d3b0b59235c793ec84794372b.camel@redhat.com> Organization: Red Hat, Inc. Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2021-04-01 at 18:31 +0200, Rafael J. Wysocki wrote: > On Thu, Apr 1, 2021 at 6:22 PM Simo Sorce wrote: > > On Thu, 2021-04-01 at 18:02 +0200, Rafael J. Wysocki wrote: > > > On Thu, Apr 1, 2021 at 3:54 PM Ard Biesheuvel wrote: > > > > On Thu, 1 Apr 2021 at 15:38, Rafael J. Wysocki wrote: > > > > > On Thu, Apr 1, 2021 at 10:47 AM Ard Biesheuvel wrote: > > > > > > On Tue, 30 Mar 2021 at 21:56, Simo Sorce wrote: > > > > > > > On Tue, 2021-03-30 at 21:45 +0200, Ard Biesheuvel wrote: > > > > > > > > On Tue, 30 Mar 2021 at 20:05, Simo Sorce wrote: > > > > > > > > > On Tue, 2021-03-30 at 16:46 +0200, Rafael J. Wysocki wrote: > > > > > > > > > > On Tue, Mar 30, 2021 at 12:14 AM Dexuan Cui wrote: > > > > > > > > > > > Hi, > > > > > > > > > > > MD5 was marked incompliant with FIPS in 2009: > > > > > > > > > > > a3bef3a31a19 ("crypto: testmgr - Skip algs not flagged fips_allowed in fips mode") > > > > > > > > > > > a1915d51e8e7 ("crypto: testmgr - Mark algs allowed in fips mode") > > > > > > > > > > > > > > > > > > > > > > But hibernation_e820_save() is still using MD5, and fails in FIPS mode > > > > > > > > > > > due to the 2018 patch: > > > > > > > > > > > 749fa17093ff ("PM / hibernate: Check the success of generating md5 digest before hibernation") > > > > > > > > > > > > > > > > > > > > > > As a result, hibernation doesn't work when FIPS is on. > > > > > > > > > > > > > > > > > > > > > > Do you think if hibernation_e820_save() should be changed to use a > > > > > > > > > > > FIPS-compliant algorithm like SHA-1? > > > > > > > > > > > > > > > > > > > > I would say yes, it should. > > > > > > > > > > > > > > > > > > > > > PS, currently it looks like FIPS mode is broken in the mainline: > > > > > > > > > > > https://www.mail-archive.com/linux-crypto@vger.kernel.org/msg49414.html > > > > > > > > > > > > > > > > > > FYI, SHA-1 is not a good choice, it is only permitted in HMAC > > > > > > > > > constructions and only for specified uses. If you need to change > > > > > > > > > algorithm you should go straight to SHA-2 or SHA-3 based hashes. > > > > > > > > > > > > > > > > > > > > > > > > > What is the reason for using a [broken] cryptographic hash here? if > > > > > > > > this is just an integrity check, better use CRC32 > > > > > > > > > > Not really. > > > > > > > > > > CRC32 is not really sufficient for integrity checking here AFAICS. It > > > > > might be made a fallback option if MD5 is not available, but making it > > > > > the default would be somewhat over the top IMO. > > > > > > > > > > > > If the integrity check is used exclusively to verify there were no > > > > > > > accidental changes and is not used as a security measure, by all means > > > > > > > I agree that using crc32 is a better idea. > > > > > > > > > > > > > > > > > > > Looking at 62a03defeabd58f74e07ca030d6c21e069d4d88e which introduced > > > > > > this, it is only a best effort check which is simply omitted if md5 > > > > > > happens to be unavailable, so there is definitely no need for crypto > > > > > > here. > > > > > > > > > > Yes, it is about integrity checking only. No, CRC32 is not equivalent > > > > > to MD5 in that respect AFAICS. > > > > > > > > > > > > > There are two possibilities: > > > > - we care about an adversary attempting to forge a collision, in which > > > > case you need a cryptographic hash which is not broken; > > > > - we only care about integrity, in which case crypto is overkill, and > > > > CRC32 is sufficient. (Note that the likelihood of an honest, > > > > inadvertent modification not being caught by CRC32 is 1 in 4 billion) > > > > > > That depends on how you count. > > > > > > Surely, there are modifications caught by MD5 that will not be caught by CRC32. > > > > This is a technically correct statement, but does it matter in this > > context? (Hint, probably not) > > > > > > MD5 does not meet either requirement, given that it is known to be > > > > broken, and overkill for simple integrity checks. MD5 should be phased > > > > out and removed, and moving this code onto the correct abstraction > > > > would be a reasonable step towards that goal. > > > > > > This clearly is a matter of opinion. > > > > Sorry, but this is not a matter of opinion. > > The only reason to use a cryptographic hash is that you want to protect > > from active tampering, rather than from accidental changes. And if you > > need to protect from active tampering then you cannot use a known > > broken hash, there is no point. > > > > OTOH if you do not care for active tampering but only to catch > > transmission/storage errors then all you care for is error checking. In > > that case a cryptographic hash is overkill because it entails a lot > > more computation than is needed. > > But the amount of data in question is not huge in this case. > > > > I'm not religious about it though. If there is a general consensus > > > that CRC32 is sufficient for error detection in hibernation files, > > > then it can be used. So is there such a consensus and if so, can you > > > give me a pointer to some research that it is based on? > > > > CRC32 is an industry standard to check for accidental modifications of > > a bit stream. The chances of missing an accidental change are 1 in 4 > > billion. > > This is not about accidental change which basically is my point. > > The BIOSes in question change the memory map over hibernation/resume, > because they think that the memory layout is now different, so this is > about detecting a sort of intentional change. Definitely not random, > though. Ok, not random, but also not intentional, it is just "accidental". > But as stated elsewhere, it is just about failing more gracefully at > least in some cases, so let's just go ahead with using CRC32 here > (worst case, it will not fail more gracefully in super-corner cases). Sounds good. Simo. -- Simo Sorce RHEL Crypto Team Red Hat, Inc