Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Stephan Mueller <smueller@chronox.de>
To:     Yann Droneaud <ydroneaud@opteya.com>
Cc:     Herbert Xu <herbert@gondor.apana.org.au>,
        linux-crypto@vger.kernel.org
Subject: Re: [PATCH v5] crypto: DRBG - add FIPS 140-2 CTRNG for noise source
Date:   Tue, 07 May 2019 15:18:48 +0200
Message-ID: <2220012.cB1XuMDAq9@tauon.chronox.de>
In-Reply-To: <74c517ac2c654a7372af731a67e24743c843e157.camel@opteya.com>
References: <1852500.fyBc0DU23F@positron.chronox.de> <1654549.mqJkfNR9fV@positron.chronox.de> <74c517ac2c654a7372af731a67e24743c843e157.camel@opteya.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1"
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

Am Dienstag, 7. Mai 2019, 15:10:38 CEST schrieb Yann Droneaud:

Hi Yann,

> Hi,
>=20
> Le mardi 07 mai 2019 =E0 11:29 +0200, Stephan M=FCller a =E9crit :
> > FIPS 140-2 section 4.9.2 requires a continuous self test of the noise
> > source. Up to kernel 4.8 drivers/char/random.c provided this continuous
> > self test. Afterwards it was moved to a location that is inconsistent
> > with the FIPS 140-2 requirements. The relevant patch was
> > e192be9d9a30555aae2ca1dc3aad37cba484cd4a .
>=20
> Please elaborate: in commit e192be9d9a30 ("random: replace non-blocking
> pool with a Chacha20-based CRNG") the "self test" code was moved from
> extract_entropy() to _extract_entropy(), which is used by
> extract_entropy().
>=20
> Only crng_initialize() call _extract_entropy() with fips =3D 0, regarless
> of fips_enabled.
>=20
> Is this the issue ?

The issue is that _extract_entropy is invoked with the input_pool from the=
=20
ChaCha20 RNG during its initialization or reseed. So, this function is call=
ed=20
to extract data from the input_pool and inject it into the ChaCha20 RNG.

However, we need the test to be applied at the output of the ChaCha20 RNG (=
or=20
/dev/random).

>=20
> Could crng_initialize() pass fips_enabled to _extract_entropy() instead
> of 0 ?

This small change does not fix it. At the time the change to ChaCha20 was=20
applied, I provided a patch that moved the continuous test back to the=20
locations were we need it. But it was ignored.


Ciao
Stephan