Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Stephan Mueller <smueller@chronox.de>
To:     linux-crypto@vger.kernel.org, Elena Petrova <lenaptr@google.com>
Cc:     Elena Petrova <lenaptr@google.com>,
        Eric Biggers <ebiggers@kernel.org>,
        Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH 0/1] crypto: af_alg - add extra parameters for DRBG interface
Date:   Tue, 14 Jul 2020 07:17:20 +0200
Message-ID: <2941213.7s5MMGUR32@tauon.chronox.de>
In-Reply-To: <20200713164857.1031117-1-lenaptr@google.com>
References: <20200713164857.1031117-1-lenaptr@google.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

Am Montag, 13. Juli 2020, 18:48:56 CEST schrieb Elena Petrova:

Hi Elena,

> This patch extends the userspace RNG interface to make it usable for
> CAVS testing. This is achieved by adding ALG_SET_DRBG_ENTROPY
> option to the setsockopt interface for specifying the entropy, and using
> sendmsg syscall for specifying the additional data.
> 
> See libkcapi patch [1] to test the added functionality. The libkcapi
> patch is not intended for merging into libkcapi as is: it is only a
> quick plug to manually verify that the extended AF_ALG RNG interface
> generates the expected output on DRBG800-90A CAVS inputs.

As I am responsible for developing such CAVS/ACVP harness as well, I played 
with the idea of going through AF_ALG. I discarded it because I do not see the 
benefit why we should add an interface solely for the purpose of testing. 
Further, it is a potentially dangerous one because the created instance of the 
DRBG is "seeded" from data provided by the caller.

Thus, I do not see the benefit from adding that extension, widening a user 
space interface solely for the purpose of CAVS testing. I would not see any 
other benefit we have with this extension. In particular, this interface would 
then be always there. What I could live with is an interface that can be 
enabled at compile time for those who want it.

Besides, when you want to do CAVS testing, the following ciphers are still not 
testable and thus this patch would only be a partial solution to get the 
testing covered:

- AES KW (you cannot get the final IV out of the kernel - I played with the 
idea to return the IV through AF_ALG, but discarded it because of the concern 
above)

- OFB/CFB MCT testing (you need the IV from the last round - same issue as for 
AES KW)

- RSA

- DH

- ECDH

With these issues, I would assume you are better off creating your own kernel 
module just like I did that externalizes the crypto API to user space but is 
only available on your test kernel and will not affect all other users.

Ciao
Stephan