crypto: skcipher - Use RNG interface instead of get_random_bytes
diff mbox series

Message ID 20080814122331.GA21061@gondor.apana.org.au
State New, archived
Headers show
Series
  • crypto: skcipher - Use RNG interface instead of get_random_bytes
Related show

Commit Message

Herbert Xu Aug. 14, 2008, 12:23 p.m. UTC
On Thu, Aug 14, 2008 at 09:51:37PM +1000, Herbert Xu wrote:
>
> Here is the final result against cryptodev-2.6.  Let me know if
> you're OK with it and I'll push it out.

And here is the IV generator patch on top.

Cheers,

Comments

Neil Horman Aug. 14, 2008, 3:28 p.m. UTC | #1
On Thu, Aug 14, 2008 at 10:23:31PM +1000, Herbert Xu wrote:
> On Thu, Aug 14, 2008 at 09:51:37PM +1000, Herbert Xu wrote:
> >
> > Here is the final result against cryptodev-2.6.  Let me know if
> > you're OK with it and I'll push it out.
> 
> And here is the IV generator patch on top.
> 


Thumbs up. Thanks Herbert!

Acked-by: Neil Horman <nhorman@tuxdriver.com>


> Cheers,
> -- 
> Visit Openswan at http://www.openswan.org/
> Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
> --
> commit 560a63d94d36641c83a8f533ed87bab95f6298bb
> Author: Herbert Xu <herbert@gondor.apana.org.au>
> Date:   Thu Aug 14 22:21:31 2008 +1000
> 
>     crypto: skcipher - Use RNG interface instead of get_random_bytes
>     
>     This patch makes the IV generators use the new RNG interface so
>     that the user can pick an RNG other than the default get_random_bytes.
>     
>     Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> diff --git a/crypto/Kconfig b/crypto/Kconfig
> index b00860f..a985065 100644
> --- a/crypto/Kconfig
> +++ b/crypto/Kconfig
> @@ -33,6 +33,7 @@ config CRYPTO_AEAD
>  config CRYPTO_BLKCIPHER
>  	tristate
>  	select CRYPTO_ALGAPI
> +	select CRYPTO_RNG
>  
>  config CRYPTO_HASH
>  	tristate
> @@ -117,6 +118,7 @@ config CRYPTO_SEQIV
>  	tristate "Sequence Number IV Generator"
>  	select CRYPTO_AEAD
>  	select CRYPTO_BLKCIPHER
> +	select CRYPTO_RNG
>  	help
>  	  This IV generator generates an IV based on a sequence number by
>  	  xoring it with a salt.  This algorithm is mainly useful for CTR
> diff --git a/crypto/chainiv.c b/crypto/chainiv.c
> index 9affade..330b5e4 100644
> --- a/crypto/chainiv.c
> +++ b/crypto/chainiv.c
> @@ -14,11 +14,11 @@
>   */
>  
>  #include <crypto/internal/skcipher.h>
> +#include <crypto/rng.h>
>  #include <linux/err.h>
>  #include <linux/init.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
> -#include <linux/random.h>
>  #include <linux/spinlock.h>
>  #include <linux/string.h>
>  #include <linux/workqueue.h>
> @@ -44,6 +44,8 @@ struct async_chainiv_ctx {
>  	char iv[];
>  };
>  
> +static struct crypto_rng *rng;
> +
>  static int chainiv_givencrypt(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
> @@ -83,6 +85,7 @@ static int chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
>  	struct chainiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
> +	int err = 0;
>  
>  	spin_lock_bh(&ctx->lock);
>  	if (crypto_ablkcipher_crt(geniv)->givencrypt !=
> @@ -90,11 +93,15 @@ static int chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  		goto unlock;
>  
>  	crypto_ablkcipher_crt(geniv)->givencrypt = chainiv_givencrypt;
> -	get_random_bytes(ctx->iv, crypto_ablkcipher_ivsize(geniv));
> +	err = crypto_rng_get_bytes(rng, ctx->iv,
> +				   crypto_ablkcipher_ivsize(geniv));
>  
>  unlock:
>  	spin_unlock_bh(&ctx->lock);
>  
> +	if (err)
> +		return err;
> +
>  	return chainiv_givencrypt(req);
>  }
>  
> @@ -203,6 +210,7 @@ static int async_chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
>  	struct async_chainiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
> +	int err = 0;
>  
>  	if (test_and_set_bit(CHAINIV_STATE_INUSE, &ctx->state))
>  		goto out;
> @@ -212,11 +220,15 @@ static int async_chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  		goto unlock;
>  
>  	crypto_ablkcipher_crt(geniv)->givencrypt = async_chainiv_givencrypt;
> -	get_random_bytes(ctx->iv, crypto_ablkcipher_ivsize(geniv));
> +	err = crypto_rng_get_bytes(rng, ctx->iv,
> +				   crypto_ablkcipher_ivsize(geniv));
>  
>  unlock:
>  	clear_bit(CHAINIV_STATE_INUSE, &ctx->state);
>  
> +	if (err)
> +		return err;
> +
>  out:
>  	return async_chainiv_givencrypt(req);
>  }
> @@ -322,10 +334,30 @@ static struct crypto_template chainiv_tmpl = {
>  
>  int __init chainiv_module_init(void)
>  {
> -	return crypto_register_template(&chainiv_tmpl);
> +	int err;
> +
> +	rng = crypto_alloc_rng("stdrng", 0, 0);
> +	if (IS_ERR(rng))
> +		return PTR_ERR(rng);
> +
> +	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
> +	if (err)
> +		goto free_rng;
> +
> +	err = crypto_register_template(&chainiv_tmpl);
> +	if (err)
> +		goto free_rng;
> +
> +out:
> +	return err;
> +
> +free_rng:
> +	crypto_free_rng(rng);
> +	goto out;
>  }
>  
>  void chainiv_module_exit(void)
>  {
>  	crypto_unregister_template(&chainiv_tmpl);
> +	crypto_free_rng(rng);
>  }
> diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
> index 881d309..b450943 100644
> --- a/crypto/eseqiv.c
> +++ b/crypto/eseqiv.c
> @@ -16,13 +16,13 @@
>   */
>  
>  #include <crypto/internal/skcipher.h>
> +#include <crypto/rng.h>
>  #include <crypto/scatterwalk.h>
>  #include <linux/err.h>
>  #include <linux/init.h>
>  #include <linux/kernel.h>
>  #include <linux/mm.h>
>  #include <linux/module.h>
> -#include <linux/random.h>
>  #include <linux/scatterlist.h>
>  #include <linux/spinlock.h>
>  #include <linux/string.h>
> @@ -39,6 +39,8 @@ struct eseqiv_ctx {
>  	char salt[];
>  };
>  
> +static struct crypto_rng *rng;
> +
>  static void eseqiv_complete2(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
> @@ -163,17 +165,22 @@ static int eseqiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
>  	struct eseqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
> +	int err = 0;
>  
>  	spin_lock_bh(&ctx->lock);
>  	if (crypto_ablkcipher_crt(geniv)->givencrypt != eseqiv_givencrypt_first)
>  		goto unlock;
>  
>  	crypto_ablkcipher_crt(geniv)->givencrypt = eseqiv_givencrypt;
> -	get_random_bytes(ctx->salt, crypto_ablkcipher_ivsize(geniv));
> +	err = crypto_rng_get_bytes(rng, ctx->salt,
> +				   crypto_ablkcipher_ivsize(geniv));
>  
>  unlock:
>  	spin_unlock_bh(&ctx->lock);
>  
> +	if (err)
> +		return err;
> +
>  	return eseqiv_givencrypt(req);
>  }
>  
> @@ -250,10 +257,30 @@ static struct crypto_template eseqiv_tmpl = {
>  
>  int __init eseqiv_module_init(void)
>  {
> -	return crypto_register_template(&eseqiv_tmpl);
> +	int err;
> +
> +	rng = crypto_alloc_rng("stdrng", 0, 0);
> +	if (IS_ERR(rng))
> +		return PTR_ERR(rng);
> +
> +	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
> +	if (err)
> +		goto free_rng;
> +
> +	err = crypto_register_template(&eseqiv_tmpl);
> +	if (err)
> +		goto free_rng;
> +
> +out:
> +	return err;
> +
> +free_rng:
> +	crypto_free_rng(rng);
> +	goto out;
>  }
>  
>  void __exit eseqiv_module_exit(void)
>  {
>  	crypto_unregister_template(&eseqiv_tmpl);
> +	crypto_free_rng(rng);
>  }
> diff --git a/crypto/seqiv.c b/crypto/seqiv.c
> index b903aab..1b95c0e 100644
> --- a/crypto/seqiv.c
> +++ b/crypto/seqiv.c
> @@ -15,11 +15,11 @@
>  
>  #include <crypto/internal/aead.h>
>  #include <crypto/internal/skcipher.h>
> +#include <crypto/rng.h>
>  #include <linux/err.h>
>  #include <linux/init.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
> -#include <linux/random.h>
>  #include <linux/spinlock.h>
>  #include <linux/string.h>
>  
> @@ -28,6 +28,8 @@ struct seqiv_ctx {
>  	u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
>  };
>  
> +static struct crypto_rng *rng;
> +
>  static void seqiv_complete2(struct skcipher_givcrypt_request *req, int err)
>  {
>  	struct ablkcipher_request *subreq = skcipher_givcrypt_reqctx(req);
> @@ -189,17 +191,22 @@ static int seqiv_givencrypt_first(struct skcipher_givcrypt_request *req)
>  {
>  	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
>  	struct seqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
> +	int err = 0;
>  
>  	spin_lock_bh(&ctx->lock);
>  	if (crypto_ablkcipher_crt(geniv)->givencrypt != seqiv_givencrypt_first)
>  		goto unlock;
>  
>  	crypto_ablkcipher_crt(geniv)->givencrypt = seqiv_givencrypt;
> -	get_random_bytes(ctx->salt, crypto_ablkcipher_ivsize(geniv));
> +	err = crypto_rng_get_bytes(rng, ctx->salt,
> +				   crypto_ablkcipher_ivsize(geniv));
>  
>  unlock:
>  	spin_unlock_bh(&ctx->lock);
>  
> +	if (err)
> +		return err;
> +
>  	return seqiv_givencrypt(req);
>  }
>  
> @@ -207,17 +214,21 @@ static int seqiv_aead_givencrypt_first(struct aead_givcrypt_request *req)
>  {
>  	struct crypto_aead *geniv = aead_givcrypt_reqtfm(req);
>  	struct seqiv_ctx *ctx = crypto_aead_ctx(geniv);
> +	int err = 0;
>  
>  	spin_lock_bh(&ctx->lock);
>  	if (crypto_aead_crt(geniv)->givencrypt != seqiv_aead_givencrypt_first)
>  		goto unlock;
>  
>  	crypto_aead_crt(geniv)->givencrypt = seqiv_aead_givencrypt;
> -	get_random_bytes(ctx->salt, crypto_aead_ivsize(geniv));
> +	err = crypto_rng_get_bytes(rng, ctx->salt, crypto_aead_ivsize(geniv));
>  
>  unlock:
>  	spin_unlock_bh(&ctx->lock);
>  
> +	if (err)
> +		return err;
> +
>  	return seqiv_aead_givencrypt(req);
>  }
>  
> @@ -330,12 +341,32 @@ static struct crypto_template seqiv_tmpl = {
>  
>  static int __init seqiv_module_init(void)
>  {
> -	return crypto_register_template(&seqiv_tmpl);
> +	int err;
> +
> +	rng = crypto_alloc_rng("stdrng", 0, 0);
> +	if (IS_ERR(rng))
> +		return PTR_ERR(rng);
> +
> +	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
> +	if (err)
> +		goto free_rng;
> +
> +	err = crypto_register_template(&seqiv_tmpl);
> +	if (err)
> +		goto free_rng;
> +
> +out:
> +	return err;
> +
> +free_rng:
> +	crypto_free_rng(rng);
> +	goto out;
>  }
>  
>  static void __exit seqiv_module_exit(void)
>  {
>  	crypto_unregister_template(&seqiv_tmpl);
> +	crypto_free_rng(rng);
>  }
>  
>  module_init(seqiv_module_init);
Herbert Xu Aug. 17, 2008, 12:22 p.m. UTC | #2
On Thu, Aug 14, 2008 at 10:23:31PM +1000, Herbert Xu wrote:
> 
> And here is the IV generator patch on top.

This also dead-locked if built as modules.  I've split out the
IV generators from crypto_blkcipher so it doesn't interfere with
cryptomgr.

commit 106475b7c368794f22493fc67d98b874eb0f9383
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Sun Aug 17 18:04:30 2008 +1000

    crypto: skcipher - Move IV generators into their own modules
    
    This patch moves the default IV generators into their own modules
    in order to break a dependency loop between cryptomgr, rng, and
    blkcipher.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/Makefile b/crypto/Makefile
index 42e3980..ed2be05 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -13,9 +13,9 @@ obj-$(CONFIG_CRYPTO_AEAD) += aead.o
 
 crypto_blkcipher-objs := ablkcipher.o
 crypto_blkcipher-objs += blkcipher.o
-crypto_blkcipher-objs += chainiv.o
-crypto_blkcipher-objs += eseqiv.o
 obj-$(CONFIG_CRYPTO_BLKCIPHER) += crypto_blkcipher.o
+obj-$(CONFIG_CRYPTO_BLKCIPHER) += chainiv.o
+obj-$(CONFIG_CRYPTO_BLKCIPHER) += eseqiv.o
 obj-$(CONFIG_CRYPTO_SEQIV) += seqiv.o
 
 crypto_hash-objs := hash.o
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 185f955..4a7e65c 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -696,34 +696,5 @@ void skcipher_geniv_exit(struct crypto_tfm *tfm)
 }
 EXPORT_SYMBOL_GPL(skcipher_geniv_exit);
 
-static int __init blkcipher_module_init(void)
-{
-	int err;
-
-	err = chainiv_module_init();
-	if (err)
-		goto out;
-
-	err = eseqiv_module_init();
-	if (err)
-		goto eseqiv_err;
-
-out:
-	return err;
-
-eseqiv_err:
-	chainiv_module_exit();
-	goto out;
-}
-
-static void __exit blkcipher_module_exit(void)
-{
-	eseqiv_module_exit();
-	chainiv_module_exit();
-}
-
-module_init(blkcipher_module_init);
-module_exit(blkcipher_module_exit);
-
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Generic block chaining cipher type");
diff --git a/crypto/chainiv.c b/crypto/chainiv.c
index 9affade..cf68d43 100644
--- a/crypto/chainiv.c
+++ b/crypto/chainiv.c
@@ -320,12 +320,18 @@ static struct crypto_template chainiv_tmpl = {
 	.module = THIS_MODULE,
 };
 
-int __init chainiv_module_init(void)
+static int __init chainiv_module_init(void)
 {
 	return crypto_register_template(&chainiv_tmpl);
 }
 
-void chainiv_module_exit(void)
+static void chainiv_module_exit(void)
 {
 	crypto_unregister_template(&chainiv_tmpl);
 }
+
+module_init(chainiv_module_init);
+module_exit(chainiv_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Chain IV Generator");
diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
index 881d309..f5def21 100644
--- a/crypto/eseqiv.c
+++ b/crypto/eseqiv.c
@@ -248,12 +248,18 @@ static struct crypto_template eseqiv_tmpl = {
 	.module = THIS_MODULE,
 };
 
-int __init eseqiv_module_init(void)
+static int __init eseqiv_module_init(void)
 {
 	return crypto_register_template(&eseqiv_tmpl);
 }
 
-void __exit eseqiv_module_exit(void)
+static void __exit eseqiv_module_exit(void)
 {
 	crypto_unregister_template(&eseqiv_tmpl);
 }
+
+module_init(eseqiv_module_init);
+module_exit(eseqiv_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Encrypted Sequence Number IV Generator");
diff --git a/include/crypto/internal/skcipher.h b/include/crypto/internal/skcipher.h
index ccc32ba..2ba42cd 100644
--- a/include/crypto/internal/skcipher.h
+++ b/include/crypto/internal/skcipher.h
@@ -15,7 +15,6 @@
 
 #include <crypto/algapi.h>
 #include <crypto/skcipher.h>
-#include <linux/init.h>
 #include <linux/types.h>
 
 struct rtattr;
@@ -65,11 +64,6 @@ void skcipher_geniv_free(struct crypto_instance *inst);
 int skcipher_geniv_init(struct crypto_tfm *tfm);
 void skcipher_geniv_exit(struct crypto_tfm *tfm);
 
-int __init eseqiv_module_init(void);
-void __exit eseqiv_module_exit(void);
-int __init chainiv_module_init(void);
-void chainiv_module_exit(void);
-
 static inline struct crypto_ablkcipher *skcipher_geniv_cipher(
 	struct crypto_ablkcipher *geniv)
 {

> Cheers,

Patch
diff mbox series

diff --git a/crypto/Kconfig b/crypto/Kconfig
index b00860f..a985065 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -33,6 +33,7 @@  config CRYPTO_AEAD
 config CRYPTO_BLKCIPHER
 	tristate
 	select CRYPTO_ALGAPI
+	select CRYPTO_RNG
 
 config CRYPTO_HASH
 	tristate
@@ -117,6 +118,7 @@  config CRYPTO_SEQIV
 	tristate "Sequence Number IV Generator"
 	select CRYPTO_AEAD
 	select CRYPTO_BLKCIPHER
+	select CRYPTO_RNG
 	help
 	  This IV generator generates an IV based on a sequence number by
 	  xoring it with a salt.  This algorithm is mainly useful for CTR
diff --git a/crypto/chainiv.c b/crypto/chainiv.c
index 9affade..330b5e4 100644
--- a/crypto/chainiv.c
+++ b/crypto/chainiv.c
@@ -14,11 +14,11 @@ 
  */
 
 #include <crypto/internal/skcipher.h>
+#include <crypto/rng.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/random.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/workqueue.h>
@@ -44,6 +44,8 @@  struct async_chainiv_ctx {
 	char iv[];
 };
 
+static struct crypto_rng *rng;
+
 static int chainiv_givencrypt(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
@@ -83,6 +85,7 @@  static int chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 	struct chainiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
+	int err = 0;
 
 	spin_lock_bh(&ctx->lock);
 	if (crypto_ablkcipher_crt(geniv)->givencrypt !=
@@ -90,11 +93,15 @@  static int chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 		goto unlock;
 
 	crypto_ablkcipher_crt(geniv)->givencrypt = chainiv_givencrypt;
-	get_random_bytes(ctx->iv, crypto_ablkcipher_ivsize(geniv));
+	err = crypto_rng_get_bytes(rng, ctx->iv,
+				   crypto_ablkcipher_ivsize(geniv));
 
 unlock:
 	spin_unlock_bh(&ctx->lock);
 
+	if (err)
+		return err;
+
 	return chainiv_givencrypt(req);
 }
 
@@ -203,6 +210,7 @@  static int async_chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 	struct async_chainiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
+	int err = 0;
 
 	if (test_and_set_bit(CHAINIV_STATE_INUSE, &ctx->state))
 		goto out;
@@ -212,11 +220,15 @@  static int async_chainiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 		goto unlock;
 
 	crypto_ablkcipher_crt(geniv)->givencrypt = async_chainiv_givencrypt;
-	get_random_bytes(ctx->iv, crypto_ablkcipher_ivsize(geniv));
+	err = crypto_rng_get_bytes(rng, ctx->iv,
+				   crypto_ablkcipher_ivsize(geniv));
 
 unlock:
 	clear_bit(CHAINIV_STATE_INUSE, &ctx->state);
 
+	if (err)
+		return err;
+
 out:
 	return async_chainiv_givencrypt(req);
 }
@@ -322,10 +334,30 @@  static struct crypto_template chainiv_tmpl = {
 
 int __init chainiv_module_init(void)
 {
-	return crypto_register_template(&chainiv_tmpl);
+	int err;
+
+	rng = crypto_alloc_rng("stdrng", 0, 0);
+	if (IS_ERR(rng))
+		return PTR_ERR(rng);
+
+	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
+	if (err)
+		goto free_rng;
+
+	err = crypto_register_template(&chainiv_tmpl);
+	if (err)
+		goto free_rng;
+
+out:
+	return err;
+
+free_rng:
+	crypto_free_rng(rng);
+	goto out;
 }
 
 void chainiv_module_exit(void)
 {
 	crypto_unregister_template(&chainiv_tmpl);
+	crypto_free_rng(rng);
 }
diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
index 881d309..b450943 100644
--- a/crypto/eseqiv.c
+++ b/crypto/eseqiv.c
@@ -16,13 +16,13 @@ 
  */
 
 #include <crypto/internal/skcipher.h>
+#include <crypto/rng.h>
 #include <crypto/scatterwalk.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/module.h>
-#include <linux/random.h>
 #include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -39,6 +39,8 @@  struct eseqiv_ctx {
 	char salt[];
 };
 
+static struct crypto_rng *rng;
+
 static void eseqiv_complete2(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
@@ -163,17 +165,22 @@  static int eseqiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 	struct eseqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
+	int err = 0;
 
 	spin_lock_bh(&ctx->lock);
 	if (crypto_ablkcipher_crt(geniv)->givencrypt != eseqiv_givencrypt_first)
 		goto unlock;
 
 	crypto_ablkcipher_crt(geniv)->givencrypt = eseqiv_givencrypt;
-	get_random_bytes(ctx->salt, crypto_ablkcipher_ivsize(geniv));
+	err = crypto_rng_get_bytes(rng, ctx->salt,
+				   crypto_ablkcipher_ivsize(geniv));
 
 unlock:
 	spin_unlock_bh(&ctx->lock);
 
+	if (err)
+		return err;
+
 	return eseqiv_givencrypt(req);
 }
 
@@ -250,10 +257,30 @@  static struct crypto_template eseqiv_tmpl = {
 
 int __init eseqiv_module_init(void)
 {
-	return crypto_register_template(&eseqiv_tmpl);
+	int err;
+
+	rng = crypto_alloc_rng("stdrng", 0, 0);
+	if (IS_ERR(rng))
+		return PTR_ERR(rng);
+
+	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
+	if (err)
+		goto free_rng;
+
+	err = crypto_register_template(&eseqiv_tmpl);
+	if (err)
+		goto free_rng;
+
+out:
+	return err;
+
+free_rng:
+	crypto_free_rng(rng);
+	goto out;
 }
 
 void __exit eseqiv_module_exit(void)
 {
 	crypto_unregister_template(&eseqiv_tmpl);
+	crypto_free_rng(rng);
 }
diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index b903aab..1b95c0e 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -15,11 +15,11 @@ 
 
 #include <crypto/internal/aead.h>
 #include <crypto/internal/skcipher.h>
+#include <crypto/rng.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/random.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
 
@@ -28,6 +28,8 @@  struct seqiv_ctx {
 	u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
 };
 
+static struct crypto_rng *rng;
+
 static void seqiv_complete2(struct skcipher_givcrypt_request *req, int err)
 {
 	struct ablkcipher_request *subreq = skcipher_givcrypt_reqctx(req);
@@ -189,17 +191,22 @@  static int seqiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 {
 	struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 	struct seqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
+	int err = 0;
 
 	spin_lock_bh(&ctx->lock);
 	if (crypto_ablkcipher_crt(geniv)->givencrypt != seqiv_givencrypt_first)
 		goto unlock;
 
 	crypto_ablkcipher_crt(geniv)->givencrypt = seqiv_givencrypt;
-	get_random_bytes(ctx->salt, crypto_ablkcipher_ivsize(geniv));
+	err = crypto_rng_get_bytes(rng, ctx->salt,
+				   crypto_ablkcipher_ivsize(geniv));
 
 unlock:
 	spin_unlock_bh(&ctx->lock);
 
+	if (err)
+		return err;
+
 	return seqiv_givencrypt(req);
 }
 
@@ -207,17 +214,21 @@  static int seqiv_aead_givencrypt_first(struct aead_givcrypt_request *req)
 {
 	struct crypto_aead *geniv = aead_givcrypt_reqtfm(req);
 	struct seqiv_ctx *ctx = crypto_aead_ctx(geniv);
+	int err = 0;
 
 	spin_lock_bh(&ctx->lock);
 	if (crypto_aead_crt(geniv)->givencrypt != seqiv_aead_givencrypt_first)
 		goto unlock;
 
 	crypto_aead_crt(geniv)->givencrypt = seqiv_aead_givencrypt;
-	get_random_bytes(ctx->salt, crypto_aead_ivsize(geniv));
+	err = crypto_rng_get_bytes(rng, ctx->salt, crypto_aead_ivsize(geniv));
 
 unlock:
 	spin_unlock_bh(&ctx->lock);
 
+	if (err)
+		return err;
+
 	return seqiv_aead_givencrypt(req);
 }
 
@@ -330,12 +341,32 @@  static struct crypto_template seqiv_tmpl = {
 
 static int __init seqiv_module_init(void)
 {
-	return crypto_register_template(&seqiv_tmpl);
+	int err;
+
+	rng = crypto_alloc_rng("stdrng", 0, 0);
+	if (IS_ERR(rng))
+		return PTR_ERR(rng);
+
+	err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
+	if (err)
+		goto free_rng;
+
+	err = crypto_register_template(&seqiv_tmpl);
+	if (err)
+		goto free_rng;
+
+out:
+	return err;
+
+free_rng:
+	crypto_free_rng(rng);
+	goto out;
 }
 
 static void __exit seqiv_module_exit(void)
 {
 	crypto_unregister_template(&seqiv_tmpl);
+	crypto_free_rng(rng);
 }
 
 module_init(seqiv_module_init);