Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230416172323.13278-1-david.keisarschm@mail.huji.ac.il> <CAHmME9qP2jwSk7o6EYGK_=vRntfLq6O1BcnH46ibt=Ypv3v-vw@mail.gmail.com>
In-Reply-To: <CAHmME9qP2jwSk7o6EYGK_=vRntfLq6O1BcnH46ibt=Ypv3v-vw@mail.gmail.com>
From:   David Keisar Schm <david.keisarschm@mail.huji.ac.il>
Date:   Sun, 23 Apr 2023 10:30:24 +0300
Message-ID: <CAD0z2U0GkJt8Xt1xDPfhBRJ3JbugUSggFj2-Q+F9MKhQr+0L6A@mail.gmail.com>
Subject: Re: [PATCH v6 3/3] arch/x86/mm/kaslr: use siphash instead of prandom_bytes_state
To:     "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc:     linux-kernel@vger.kernel.org,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Andy Lutomirski <luto@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
        keescook@chromium.org, ilay.bahat1@gmail.com, aksecurity@gmail.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Sun, Apr 16, 2023 at 8:26=E2=80=AFPM Jason A. Donenfeld <Jason@zx2c4.com=
> wrote:
>
> On 4/16/23, david.keisarschm@mail.huji.ac.il
> <david.keisarschm@mail.huji.ac.il> wrote:
> > From: David Keisar Schmidt <david.keisarschm@mail.huji.ac.il>
> >
> > However, the seeding here is done by calling prandom_seed_state,
> > which effectively uses only 32bits of the seed, which means that observ=
ing
> > ONE
> > region's offset (say 30 bits) can provide the attacker with 2 possible
> > seeds
> > (from which the attacker can calculate the remaining two regions)
> >
> > In order to fix it,  we have replaced the two invocations of
> > prandom_bytes_state and prandom_seed_state
> > with siphash, which is considered more secure.
> > Besides, the original code used the same pseudo-random number in every
> > iteration,
> > so to add some additional randomization
> > we call siphash every iteration, hashing the iteration index with the
> > described key.
> >
> >
>
> Nack. Please don't add bespoke new RNG constructions willy nilly. I
> just spent a while cleaning this kind of thing up.

Hi Jason,

Thank you for reviewing our revised patch. We appreciate your concern
regarding the use of custom RNG constructions, and we understand the
potential issues that could arise from doing so.

However, we wanted to clarify that our intention was to use a
deterministic PRNG that meets Kees Cook's requirements for debugging
and performance analysis purposes.

We also acknowledge that using a custom RNG could introduce additional
risks, and we're open to exploring alternative solutions that meet our
requirements.

If you have any suggestions for a more secure and deterministic RNG,
we'd be happy to hear them and implement them.