* [PATCH 01/14] crypto: drbg - Don't use uninitialized stack data
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 02/14] crypto: rng - Remove unnecessary inclusions of internal/rng.h Eric Biggers
` (12 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
If jitterentropy fails, then uninitialized stack data is mixed into the
DRBG. While theoretically okay, this is undefined behavior and isn't
allowed by KMSAN. Fix it by zero-initializing the buffer.
Fixes: 97f2650e5040 ("crypto: drbg - always seeded with SP800-90B compliant noise source")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/drbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/drbg.c b/crypto/drbg.c
index d66c7211d6bb0..e057b00e74f5b 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -230,7 +230,7 @@ static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len,
__must_hold(&drbg->drbg_mutex)
{
int ret;
- u8 entropy_buf[(32 + 16) * 2];
+ u8 entropy_buf[(32 + 16) * 2] = {};
size_t entropylen;
const u8 *entropy;
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 02/14] crypto: rng - Remove unnecessary inclusions of internal/rng.h
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
2026-10-18 20:46 ` [PATCH 01/14] crypto: drbg - Don't use uninitialized stack data Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 03/14] crypto: jitterentropy - Move health check to first use Eric Biggers
` (11 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
In preparation for the later removal of <crypto/internal/rng.h>,
eliminate unnecessary inclusions of it.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/geniv.c | 2 +-
drivers/crypto/gemini/sl3516-ce-core.c | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/crypto/geniv.c b/crypto/geniv.c
index 04befe3a7f44c..a5c3efda1ae8e 100644
--- a/crypto/geniv.c
+++ b/crypto/geniv.c
@@ -8,7 +8,7 @@
*/
#include <crypto/internal/geniv.h>
-#include <crypto/internal/rng.h>
+#include <crypto/rng.h>
#include <linux/err.h>
#include <linux/kernel.h>
#include <linux/module.h>
diff --git a/drivers/crypto/gemini/sl3516-ce-core.c b/drivers/crypto/gemini/sl3516-ce-core.c
index c1df5f96ea421..2079fc0f0b651 100644
--- a/drivers/crypto/gemini/sl3516-ce-core.c
+++ b/drivers/crypto/gemini/sl3516-ce-core.c
@@ -8,7 +8,6 @@
*/
#include <crypto/engine.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
#include <linux/clk.h>
#include <linux/debugfs.h>
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 03/14] crypto: jitterentropy - Move health check to first use
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
2026-10-18 20:46 ` [PATCH 01/14] crypto: drbg - Don't use uninitialized stack data Eric Biggers
2026-10-18 20:46 ` [PATCH 02/14] crypto: rng - Remove unnecessary inclusions of internal/rng.h Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 04/14] crypto: jitterentropy - Add library API Eric Biggers
` (10 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Building jitterentropy into the kernel causes the expensive health check
to run on boot, even if jitterentropy is never used.
With the upcoming addition of direct linking, this problem would get
worse since it will happen even if jitterentropy is built as a module.
To fix this, do the health check on first use instead of in module_init.
Note that this shouldn't have any impact on FIPS 140-3 certifiability.
A failed health check now panics on first use instead of on boot, but
that is acceptable.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/jitterentropy-kcapi.c | 72 ++++++++++++++++++++++++++----------
1 file changed, 53 insertions(+), 19 deletions(-)
diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c
index 652852649a312..84c2c74240a0a 100644
--- a/crypto/jitterentropy-kcapi.c
+++ b/crypto/jitterentropy-kcapi.c
@@ -178,6 +178,54 @@ struct jitterentropy {
struct sha3_ctx hash_state;
};
+static int jent_init_err;
+
+static void jent_init_once(void)
+{
+ struct sha3_ctx hash_state;
+ int err;
+
+ sha3_256_init(&hash_state);
+ err = jent_entropy_init(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, &hash_state,
+ NULL);
+ memzero_explicit(&hash_state, sizeof(hash_state));
+ if (err) {
+ /* Handle permanent health test error */
+ if (fips_enabled)
+ panic("jitterentropy: Initialization failed with host not compliant with requirements: %d\n",
+ err);
+
+ pr_info("jitterentropy: Initialization failed with host not compliant with requirements: %d\n",
+ err);
+ jent_init_err = err;
+ }
+}
+
+static int jent_init(void)
+{
+ static DEFINE_MUTEX(jent_init_mutex);
+ static bool initialized;
+
+ /*
+ * To avoid lockdep reports of inconsistent ordering of drbg_mutex and
+ * once_mutex, implement one-time-init locally instead of using
+ * DO_ONCE_SLEEPABLE.
+ */
+ guard(mutex)(&jent_init_mutex);
+ if (!initialized) {
+ jent_init_once();
+ initialized = true;
+ }
+ if (jent_init_err) {
+ /*
+ * jent_init_err is a private custom error code from
+ * jitterentropy.c. Select an errno value instead.
+ */
+ return -EOPNOTSUPP;
+ }
+ return 0;
+}
+
static void jent_kcapi_cleanup(struct crypto_tfm *tfm)
{
struct jitterentropy *rng = crypto_tfm_ctx(tfm);
@@ -195,7 +243,11 @@ static void jent_kcapi_cleanup(struct crypto_tfm *tfm)
static int jent_kcapi_init(struct crypto_tfm *tfm)
{
struct jitterentropy *rng = crypto_tfm_ctx(tfm);
- int ret = 0;
+ int ret;
+
+ ret = jent_init();
+ if (ret)
+ return ret;
mutex_init(&rng->jent_lock);
@@ -277,25 +329,7 @@ static struct rng_alg jent_alg = {
static int __init jent_mod_init(void)
{
- struct sha3_ctx hash_state;
- int ret = 0;
-
jent_testing_init();
-
- sha3_256_init(&hash_state);
-
- ret = jent_entropy_init(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, &hash_state,
- NULL);
- memzero_explicit(&hash_state, sizeof(hash_state));
- if (ret) {
- /* Handle permanent health test error */
- if (fips_enabled)
- panic("jitterentropy: Initialization failed with host not compliant with requirements: %d\n", ret);
-
- jent_testing_exit();
- pr_info("jitterentropy: Initialization failed with host not compliant with requirements: %d\n", ret);
- return -EFAULT;
- }
return crypto_register_rng(&jent_alg);
}
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 04/14] crypto: jitterentropy - Add library API
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (2 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 03/14] crypto: jitterentropy - Move health check to first use Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 05/14] crypto: drbg - Use jitterentropy " Eric Biggers
` (9 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Make the jitterentropy RNG accessible using a regular set of functions.
This will allow drbg.c to just access it directly, instead of going
through the overly-general crypto_rng abstraction.
Later commits will remove crypto_rng.
Note that the library API should also continue to meet all the same
certification requirements, including the health check which occurs on
the first call to crypto_jent_alloc().
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/jitterentropy-kcapi.c | 80 +++++++++++++++++++++++++++++++++++-
crypto/jitterentropy-kcapi.h | 17 ++++++++
2 files changed, 95 insertions(+), 2 deletions(-)
create mode 100644 crypto/jitterentropy-kcapi.h
diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c
index 84c2c74240a0a..2786303195950 100644
--- a/crypto/jitterentropy-kcapi.c
+++ b/crypto/jitterentropy-kcapi.c
@@ -1,6 +1,6 @@
/*
* Non-physical true random number generator based on timing jitter --
- * Linux Kernel Crypto API specific code
+ * Public API
*
* Copyright Stephan Mueller <smueller@chronox.de>, 2015 - 2023
*
@@ -47,6 +47,7 @@
#include <crypto/internal/rng.h>
#include "jitterentropy.h"
+#include "jitterentropy-kcapi.h"
/***************************************************************************
* Helper function
@@ -169,7 +170,7 @@ void jent_read_random_block(struct sha3_ctx *hash_state, char *dst,
}
/***************************************************************************
- * Kernel crypto API interface
+ * Public API
***************************************************************************/
struct jitterentropy {
@@ -226,6 +227,81 @@ static int jent_init(void)
return 0;
}
+struct jitterentropy *crypto_jent_alloc(void)
+{
+ struct jitterentropy *rng;
+ int err;
+
+ err = jent_init();
+ if (err)
+ return ERR_PTR(err);
+
+ rng = kzalloc_obj(*rng);
+ if (!rng)
+ return ERR_PTR(-ENOMEM);
+
+ mutex_init(&rng->jent_lock);
+
+ /* Use SHA3-256 as conditioner */
+ sha3_256_init(&rng->hash_state);
+
+ rng->entropy_collector = jent_entropy_collector_alloc(
+ CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, &rng->hash_state);
+ if (!rng->entropy_collector) {
+ crypto_jent_free(rng);
+ return ERR_PTR(-ENOMEM);
+ }
+ return rng;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_jent_alloc, "CRYPTO_INTERNAL");
+
+int crypto_jent_get_bytes(struct jitterentropy *rng, u8 *out,
+ unsigned int out_len)
+{
+ int ret;
+
+ guard(mutex)(&rng->jent_lock);
+
+ ret = jent_read_entropy(rng->entropy_collector, out, out_len);
+
+ if (ret == -3) {
+ /* Handle permanent health test error */
+ /*
+ * If the kernel was booted with fips=1, it implies that
+ * the entire kernel acts as a FIPS 140 module. In this case
+ * an SP800-90B permanent health test error is treated as
+ * a FIPS module error.
+ */
+ if (fips_enabled)
+ panic("Jitter RNG permanent health test failure\n");
+
+ pr_err("Jitter RNG permanent health test failure\n");
+ return -EFAULT;
+ }
+ if (ret == -2) {
+ /* Handle intermittent health test error */
+ pr_warn_ratelimited("Reset Jitter RNG due to intermittent health test failure\n");
+ return -EAGAIN;
+ }
+ if (ret == -1) {
+ /* Handle other errors */
+ return -EINVAL;
+ }
+ return ret;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_jent_get_bytes, "CRYPTO_INTERNAL");
+
+void crypto_jent_free(struct jitterentropy *rng)
+{
+ if (!IS_ERR_OR_NULL(rng)) {
+ mutex_destroy(&rng->jent_lock);
+ if (rng->entropy_collector)
+ jent_entropy_collector_free(rng->entropy_collector);
+ kfree_sensitive(rng);
+ }
+}
+EXPORT_SYMBOL_NS_GPL(crypto_jent_free, "CRYPTO_INTERNAL");
+
static void jent_kcapi_cleanup(struct crypto_tfm *tfm)
{
struct jitterentropy *rng = crypto_tfm_ctx(tfm);
diff --git a/crypto/jitterentropy-kcapi.h b/crypto/jitterentropy-kcapi.h
new file mode 100644
index 0000000000000..9909df28ed7a6
--- /dev/null
+++ b/crypto/jitterentropy-kcapi.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright 2026 Google LLC
+ */
+#ifndef _CRYPTO_JITTERENTROPY_KCAPI_H
+#define _CRYPTO_JITTERENTROPY_KCAPI_H
+
+#include <linux/types.h>
+
+struct jitterentropy;
+
+struct jitterentropy *crypto_jent_alloc(void);
+int crypto_jent_get_bytes(struct jitterentropy *rng, u8 *out,
+ unsigned int out_len);
+void crypto_jent_free(struct jitterentropy *rng);
+
+#endif /* _CRYPTO_JITTERENTROPY_KCAPI_H */
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 05/14] crypto: drbg - Use jitterentropy library API
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (3 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 04/14] crypto: jitterentropy - Add library API Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 06/14] crypto: drbg - Add " Eric Biggers
` (8 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Now that the jitterentropy RNG is accessible via a regular set of
functions, make drbg.c just use those instead of crypto_rng.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/drbg.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/crypto/drbg.c b/crypto/drbg.c
index e057b00e74f5b..6015822129edc 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -96,6 +96,7 @@
#include <linux/mutex.h>
#include <linux/string_choices.h>
#include <linux/unaligned.h>
+#include "jitterentropy-kcapi.h"
/* State length in bytes */
#define DRBG_STATE_LEN SHA512_DIGEST_SIZE
@@ -130,7 +131,7 @@ struct drbg_state {
/* Number of RNG requests since last reseed -- 10.1.2.1 1c */
size_t reseed_ctr;
bool instantiated;
- struct crypto_rng *jent;
+ struct jitterentropy *jent;
const u8 *test_entropy;
size_t test_entropylen;
};
@@ -272,9 +273,9 @@ static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len,
* Get seed from Jitter RNG, failures are
* fatal only in FIPS mode.
*/
- ret = crypto_rng_get_bytes(drbg->jent,
- &entropy_buf[entropylen],
- entropylen);
+ ret = crypto_jent_get_bytes(drbg->jent,
+ &entropy_buf[entropylen],
+ entropylen);
if (fips_enabled && ret) {
pr_devel("DRBG: jent failed with %d\n", ret);
@@ -454,7 +455,7 @@ static int drbg_kcapi_seed(struct crypto_rng *tfm,
/* Allocate jitterentropy_rng if not in test mode. */
if (drbg->test_entropylen == 0) {
- drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
+ drbg->jent = crypto_jent_alloc();
if (IS_ERR(drbg->jent)) {
ret = PTR_ERR(drbg->jent);
drbg->jent = NULL;
@@ -466,7 +467,7 @@ static int drbg_kcapi_seed(struct crypto_rng *tfm,
ret = drbg_seed(drbg, pers, pers_len, /* reseed= */ false);
if (ret) {
- crypto_free_rng(drbg->jent);
+ crypto_jent_free(drbg->jent);
drbg->jent = NULL;
return ret;
}
@@ -512,7 +513,7 @@ static void drbg_kcapi_exit(struct crypto_tfm *tfm)
{
struct drbg_state *drbg = crypto_tfm_ctx(tfm);
- crypto_free_rng(drbg->jent);
+ crypto_jent_free(drbg->jent);
memzero_explicit(drbg, sizeof(*drbg));
}
@@ -615,3 +616,4 @@ MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG)");
MODULE_ALIAS_CRYPTO("stdrng");
MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
+MODULE_IMPORT_NS("CRYPTO_INTERNAL"); /* for jitterentropy */
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 06/14] crypto: drbg - Add library API
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (4 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 05/14] crypto: drbg - Use jitterentropy " Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 07/14] crypto: drbg - Add self-test for " Eric Biggers
` (7 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Make the SP800-90A DRBG accessible using a regular set of functions.
This will allow __crypto_stdrng_get_bytes() to just access it directly,
instead of going through the overly-general crypto_rng abstraction.
Later commits will remove crypto_rng.
Update the example code in the file comment to use the library API.
There were also multiple bugs in the example code (missing seeding and
out-of-bounds reads), so fix those too.
For consistency with other RNG functions, crypto_drbg_get_bytes() takes
a size_t length rather than unsigned int as crypto_rng did, and it
returns 0 rather than an error if asked to generate 0 bytes.
Note that the library API should also continue to meet all the same
certification requirements, including the self-test which the next
commit adds to crypto_drbg_alloc() to replace the testmgr.c one.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/drbg.c | 144 +++++++++++++++++++++++++++++++++++++++++++-------
crypto/drbg.h | 20 +++++++
2 files changed, 146 insertions(+), 18 deletions(-)
create mode 100644 crypto/drbg.h
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 6015822129edc..7d8be036e9be8 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -41,46 +41,45 @@
* ==========
* The SP 800-90A DRBG allows the user to specify a personalization string
* for initialization as well as an additional information string for each
- * random number request. The following code fragments show how a caller
- * uses the kernel crypto API to use the full functionality of the DRBG.
+ * random number request. The following code snippets show example use:
*
* Usage without any additional data
* ---------------------------------
- * struct crypto_rng *drng;
+ * struct drbg_state *drbg;
* int err;
* char data[DATALEN];
*
- * drng = crypto_alloc_rng(drng_name, 0, 0);
- * err = crypto_rng_get_bytes(drng, data, DATALEN);
- * crypto_free_rng(drng);
+ * drbg = crypto_drbg_alloc();
+ * err = crypto_drbg_seed(drbg, NULL, 0);
+ * err = crypto_drbg_get_bytes(drbg, data, sizeof(data), NULL, 0);
+ * crypto_drbg_free(drbg);
*
*
* Usage with personalization string during initialization
* -------------------------------------------------------
- * struct crypto_rng *drng;
+ * struct drbg_state *drbg;
* int err;
* char data[DATALEN];
* char personalization[11] = "some-string";
*
- * drng = crypto_alloc_rng(drng_name, 0, 0);
- * // The reset completely re-initializes the DRBG with the provided
- * // personalization string
- * err = crypto_rng_reset(drng, personalization, strlen(personalization));
- * err = crypto_rng_get_bytes(drng, data, DATALEN);
- * crypto_free_rng(drng);
+ * drbg = crypto_drbg_alloc();
+ * err = crypto_drbg_seed(drbg, personalization, sizeof(personalization));
+ * err = crypto_drbg_get_bytes(drbg, data, sizeof(data), NULL, 0);
+ * crypto_drbg_free(drbg);
*
*
* Usage with additional information string during random number request
* ---------------------------------------------------------------------
- * struct crypto_rng *drng;
+ * struct drbg_state *drbg;
* int err;
* char data[DATALEN];
* char addtl_string[11] = "some-string";
*
- * drng = crypto_alloc_rng(drng_name, 0, 0);
- * err = crypto_rng_generate(drng, addtl_string, strlen(addtl_string),
- data, DATALEN);
- * crypto_free_rng(drng);
+ * drbg = crypto_drbg_alloc();
+ * err = crypto_drbg_seed(drbg, NULL, 0);
+ * err = crypto_drbg_get_bytes(drbg, data, sizeof(data), addtl_string,
+ * sizeof(addtl_string));
+ * crypto_drbg_free(drbg);
*
*
* Usage with personalization and additional information strings
@@ -94,8 +93,10 @@
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mutex.h>
+#include <linux/slab.h>
#include <linux/string_choices.h>
#include <linux/unaligned.h>
+#include "drbg.h"
#include "jitterentropy-kcapi.h"
/* State length in bytes */
@@ -517,6 +518,113 @@ static void drbg_kcapi_exit(struct crypto_tfm *tfm)
memzero_explicit(drbg, sizeof(*drbg));
}
+/***************************************************************
+ * Public API
+ ***************************************************************/
+
+struct drbg_state *crypto_drbg_alloc(void)
+{
+ struct drbg_state *drbg = kzalloc_obj(*drbg);
+
+ if (!drbg)
+ return ERR_PTR(-ENOMEM);
+
+ mutex_init(&drbg->drbg_mutex);
+ return drbg;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_drbg_alloc, "CRYPTO_INTERNAL");
+
+/* Set test entropy in the DRBG. */
+void crypto_drbg_set_entropy(struct drbg_state *drbg, const u8 *data,
+ size_t len)
+{
+ guard(mutex)(&drbg->drbg_mutex);
+ drbg->test_entropy = data;
+ drbg->test_entropylen = len;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_drbg_set_entropy, "CRYPTO_INTERNAL");
+
+/* Seed (i.e. instantiate) or re-seed the DRBG. */
+int crypto_drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len)
+{
+ static const u8 initial_key[DRBG_STATE_LEN]; /* all zeroes */
+ int ret;
+
+ pr_devel("DRBG: Initializing DRBG\n");
+ guard(mutex)(&drbg->drbg_mutex);
+
+ if (drbg->instantiated)
+ return drbg_seed(drbg, pers, pers_len, /* reseed= */ true);
+
+ /* 9.1 step 1 is implicit with the selected DRBG type */
+
+ /*
+ * 9.1 step 2 is implicit, as this implementation doesn't support
+ * prediction resistance
+ */
+
+ /* 9.1 step 4 is implicit in DRBG_SEC_STRENGTH */
+
+ memset(drbg->V, 1, DRBG_STATE_LEN);
+ hmac_sha512_preparekey(&drbg->key, initial_key, DRBG_STATE_LEN);
+
+ /* Allocate jitterentropy if not in test mode. */
+ if (drbg->test_entropylen == 0) {
+ drbg->jent = crypto_jent_alloc();
+ if (IS_ERR(drbg->jent)) {
+ ret = PTR_ERR(drbg->jent);
+ drbg->jent = NULL;
+ if (fips_enabled)
+ return ret;
+ pr_info("DRBG: Continuing without Jitter RNG\n");
+ }
+ }
+
+ ret = drbg_seed(drbg, pers, pers_len, /* reseed= */ false);
+ if (ret) {
+ crypto_jent_free(drbg->jent);
+ drbg->jent = NULL;
+ return ret;
+ }
+ drbg->instantiated = true;
+ return 0;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_drbg_seed, "CRYPTO_INTERNAL");
+
+int crypto_drbg_get_bytes(struct drbg_state *drbg, u8 *out, size_t out_len,
+ const u8 *addtl, size_t addtl_len)
+{
+ /*
+ * Break the request into multiple requests if needed, to avoid
+ * exceeding the maximum request length of the core algorithm.
+ */
+ while (out_len) {
+ size_t n = min(out_len, DRBG_MAX_REQUEST_BYTES);
+ int err;
+
+ mutex_lock(&drbg->drbg_mutex);
+ err = drbg_generate(drbg, out, n, addtl, addtl_len);
+ mutex_unlock(&drbg->drbg_mutex);
+ if (err < 0)
+ return err;
+ out += n;
+ out_len -= n;
+ }
+ return 0;
+}
+EXPORT_SYMBOL_NS_GPL(crypto_drbg_get_bytes, "CRYPTO_INTERNAL");
+
+/* Uninstantiate the DRBG. */
+void crypto_drbg_free(struct drbg_state *drbg)
+{
+ if (!IS_ERR_OR_NULL(drbg)) {
+ mutex_destroy(&drbg->drbg_mutex);
+ crypto_jent_free(drbg->jent);
+ kfree_sensitive(drbg);
+ }
+}
+EXPORT_SYMBOL_NS_GPL(crypto_drbg_free, "CRYPTO_INTERNAL");
+
/*
* Tests as defined in 11.3.2 in addition to the cipher tests: testing
* of the error handling.
diff --git a/crypto/drbg.h b/crypto/drbg.h
new file mode 100644
index 0000000000000..f07a362374043
--- /dev/null
+++ b/crypto/drbg.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright 2026 Google LLC
+ */
+#ifndef _CRYPTO_DRBG_H
+#define _CRYPTO_DRBG_H
+
+#include <linux/types.h>
+
+struct drbg_state;
+
+struct drbg_state *crypto_drbg_alloc(void);
+void crypto_drbg_set_entropy(struct drbg_state *drbg, const u8 *data,
+ size_t len);
+int crypto_drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len);
+int crypto_drbg_get_bytes(struct drbg_state *drbg, u8 *out, size_t out_len,
+ const u8 *addtl, size_t addtl_len);
+void crypto_drbg_free(struct drbg_state *drbg);
+
+#endif /* _CRYPTO_DRBG_H */
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 07/14] crypto: drbg - Add self-test for library API
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (5 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 06/14] crypto: drbg - Add " Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 08/14] crypto: algif_rng - Use DRBG and jitterentropy library APIs Eric Biggers
` (6 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
With the SP800-90A DRBG now being accessible through a library API, it
now needs to handle the self-test internally instead of relying on
"testmgr". Implement it, using the existing test vectors.
Run the self-test at module_init time or on first call to
crypto_drbg_alloc(), whichever comes first, if either
CONFIG_CRYPTO_SELFTESTS is enabled or the kernel is booted with fips=1.
Also run the existing drbg_healthcheck_sanity() at the same time if
fips=1; previously that ran only at module_init time. If fips=1 and
either test fails, the kernel panics, as required by FIPS module tests.
When fips=1, if the tests pass, "DRBG: self-tests passed" is printed to
the log. This is for parity with testmgr.c which printed a similar
message. If the tests fail, for now don't bother calling
fips_fail_notify() before panicking: most of the FIPS self-tests already
don't call it, and those notifications only go to one driver, so clearly
that notifier chain isn't a finished feature anyway.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/drbg-testvecs.h | 228 +++++++++++++++++++++++++++++++++++++++++
crypto/drbg.c | 123 +++++++++++++++++++---
2 files changed, 338 insertions(+), 13 deletions(-)
create mode 100644 crypto/drbg-testvecs.h
diff --git a/crypto/drbg-testvecs.h b/crypto/drbg-testvecs.h
new file mode 100644
index 0000000000000..d073257eb3d18
--- /dev/null
+++ b/crypto/drbg-testvecs.h
@@ -0,0 +1,228 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright 2026 Google LLC
+ */
+#ifndef _CRYPTO_DRBG_TESTVECS_H
+#define _CRYPTO_DRBG_TESTVECS_H
+
+#include <linux/types.h>
+
+struct drbg_testvec {
+ /* Instantiate */
+ const u8 *entropy;
+ size_t entropylen;
+ const u8 *pers;
+ size_t perslen;
+
+ /* Reseed (optional) */
+ const u8 *ent_reseed;
+ size_t ent_reseed_len;
+ const u8 *addtl_reseed;
+ size_t addtl_reseed_len;
+
+ /* Generate (twice) */
+ const u8 *addtla;
+ const u8 *addtlb;
+ size_t addtllen;
+
+ /* Expected output from last call to Generate */
+ const u8 *expected;
+ size_t expectedlen;
+};
+
+static const struct drbg_testvec drbg_testvecs[] = {
+ /*
+ * Borrowed from the first applicable test vector from ACVP:
+ * https://github.com/usnistgov/ACVP-Server/blob/v1.1.0.33/gen-val/json-files/hmacDRBG-1.0/prompt.json#L4596
+ * https://github.com/usnistgov/ACVP-Server/blob/v1.1.0.33/gen-val/json-files/hmacDRBG-1.0/expectedResults.json#L986
+ */
+ {
+ /* .entropy = ACVP entropyInput || nonce */
+ .entropy = "\x47\x28\x33\x05\x82\xE8\xA7\x58\x05\xBD\x07\x9E"
+ "\xDB\x59\x87\x08\x3B\x82\x40\x70\xA1\xB7\x33\x4F"
+ "\x0F\x53\xBE\xF6\x98\x75\xFA\x21\x00\x04\xBC\x58"
+ "\x9B\xB1\xB3\xBC\x2A\xF6\xA4\x2A\xE1\xB3\x65\x24"
+ "\xA8\xEE\x56\x70\x5E\x28\x06\x04\x80\xCE\xB7\x36"
+ "\xA4\xD1\x4E\xAA\xE7\xE8\x51\x40\x7D\x30\xF7\x91"
+ "\xF2\x9E\x98\xA7\xBB\xB3\x1D\xC6\x8A\x62\xC7\xE7"
+ "\x1F\xE1\x0A\x52\x45\x39\x88\x92\x43\xA6\x5B\xC3"
+ "\x9D\x60\xDE\xFE\x79\xEF\x87\x6F\xD5\x76\x51\x69"
+ "\x7B\x4C\x3D\x08\x60\xFA\xDC\x00\x94\xEC\x0A\xC5"
+ "\xE7\xCB\x30\x05\x9F\xCC\x07\x44\x07\x14\xF4\xF9"
+ "\xBC\x7D\xC0\x66\x63\x5B\xD3\x2A\xA7\xF2\x1D\x75"
+ "\x3F\x28\x5F\x4A\xEB\x63\xD7\x92\x5A\x9A\x7C\x3A"
+ "\x56\xEA\xCB\xA9\xA0\xF9\x5B\x99\xC2\x7D\x31\xBF"
+ "\x44\xC7\x64\x6B\x7E\x64\x60\x64\x05\x86\xF0\x6B"
+ "\x76\xA7\x3E\x63\xAD\xB6\x76\xED\x3D\x05\x2E\xC7"
+ "\xC7\x52\x8F\x07\x56\x23\xFC\x2F\x93\xD5\xF2\x29"
+ "\xC6\x84\x48\xD1\x88\xB9\x3F\x84\xB2\x93\xFC\x2F"
+ "\x00\xB1\xBC\xBE\xAC\xC4\x94\x36\xF1\x2B\xF0\xC7"
+ "\x36\xE8\x1D\x45\x0A\xA2\xFE\x72\xD7\x3E\x15\x6A"
+ "\x74\x23\xB2\xD1\x3C\x20\xF2\xB7\x19\xC5\xF0\x74"
+ "\x69\x06\xD1\x92\x47\xC9\x68\xDC\xEE\xBC\xF4\x3A"
+ "\x8B\x7C\xA4\xA4\x4A\x15\xF4\xF0\x26\x26\xC5\x7D"
+ "\x57\xDC\x00\x59\x07\xDF\x84\x2A\x23\xA9\xC1\xAF"
+ "\x47\x49\x88\xCC\x2F\x3B\x90\x39\xA0\x09\xAE\x3C"
+ "\x79\xF9\x97\x9D\xEF\x13\x1D\x2B\xB6\x18\xDB\xCF"
+ "\x95\x98\x17\x7F\xF6\x95\x44\x3A\x40\x90\x63\x16"
+ "\x70\x38\x22\xC5\xD8\xE4\x57\xA0\x8E\x51\x6B\xED"
+ "\x03\x18\xC6\x74\xFA\xCA\xF2\xD5\xB2\x5A\x0C\x02"
+ "\x48\x9F\x70\x0B\x1C\x0A\xD1\xD6\x4F\x3F\x70\x3C"
+ "\x1A\x62\x29\x63\xD0\x92\x76\x30\x7C\xB9\x54\xEC"
+ "\xF6\x92\xA3\x11\x66\xB2\x56\xE0\x75\x3D\x27\x01",
+ .entropylen = 384,
+ .pers = "\x03\x75\x33\x7B\x6B\xE5\x14\xAF\x0E\x43\x33\xCC\xD3"
+ "\xF4\xF0\x8B\x8A\xCC\xFE\x95\xC1\x20\xB9\x56\x3D\x2C"
+ "\x34\xC7\xA1\x4C\xBC\xDC\x0A\x8D\xBE\x68\x28\x89\x2A"
+ "\x92\x10\x05\x4E\xF9\xE2\x51\xF7\x4F\xF4\x48\x76\xC9"
+ "\xCE\xA8\x6D\xC1\xDE\x5C\x05\x95\x77\x24\xB4\x5D\x3D"
+ "\x16\x1D\xCB\x43\xE5\xD3\x01\x96\xCC\x3E\x2E\xE1\x97"
+ "\xB3\x42\xC2\xAB\xEC\x56\xA9\xF9\xF2\x28\x59\x01\x4E"
+ "\xFC\x8A\xC0\x5E\x4E\x33\x30\x91\x96\x93\xBA\xFA\xE1"
+ "\x9F\x20\xC3\xC1\xD1\xC6\xC3\x2C\x59\x8F\x56\xD5\x73"
+ "\xE8\x8D\xCF\xAC\xB1\x85\x3E\xC7\x73\x21\x59\x8D\x0F"
+ "\xF4\xA4\xC4\x0C\xD2\x18\x81\x5F\x3E\x37\xC9\x9F\xD9"
+ "\xDE\x3F\x15\x6F\xAC\x1A\xEC\x5E\x28\xD5\x56\xA2\x65"
+ "\xD2\x7C\x41\xDE\x57\x8C\x60\xAB\xA5\x03\x42\xC8\x3C"
+ "\x70\xC2\xD1\x11\x62\x25\x4E\x17\x58\xBB\x08\x51\x79"
+ "\xE6\xED\xBA\x9A\xA7\x07\xD5\x0E\x89\x43\x31\x4F\x99"
+ "\xEE\xED\xF1\x36\xFA\x1E\xC0\x25\x01\xDA\x19\xC2\x7D"
+ "\x5D\x78\x74\x5C\xC0\x72\x2E\xF1\x7B\x4E\x9C\xDB\xFE"
+ "\x60\x89\x62\x71\x9C\xEA\xD3\xDF\x82\xC7\x8B\xB4\x7B"
+ "\x7B\x7F\x6A\x62\x3C\x57\x76\xA5\x67\x5F\x70\xFB\xE0"
+ "\x1B\x23\x79\x71\xB5\x7C\xEA\x76\x99",
+ .perslen = 256,
+
+ .ent_reseed = "\xE0\x5B\x69\xC5\xF9\xD4\x5A\x1F\xC1\x71\x0C"
+ "\x37\x6F\xFE\x31\xE0\xEF\x3E\x9B\xD5\x46\x43"
+ "\xA2\x15\xFA\x86\x75\x1C\x95\x9F\xE6\xD6\x41"
+ "\x50\x36\x0F\x67\x68\x4A\x72\x32\x85\xB0\xCB"
+ "\xA4\x0D\x1F\xA2\x43\xCA\x30\xF1\x42\xF8\xC4"
+ "\x17\x6A\xD1\x2D\x43\x46\x8C\xA5\x72\x3C\xB1"
+ "\x44\x8E\xA1\x75\xAA\x20\x30\xDD\xCD\x0B\x5A"
+ "\x0D\xE6\x28\xCA\xBC\xA9\x3B\x11\x23\x88\x85"
+ "\xDF\xD8\x84\x11\x89\x7A\x4F\x00\x90\x0B\xD8"
+ "\x8A\x35\xE9\x5F\xEC\x05\x42\x15\xCA\x7E\xA3"
+ "\xEF\xEF\xE3\xB7\xBE\x96\x8C\x36\x7D\x15\x3C"
+ "\x7A\x78\x00\x61\xAF\x62\x45\xA7\x4B\xAE\x4A"
+ "\xFD\xC9\xE0\x89\x53\x36\x71\x8F\x38\xC4\x00"
+ "\x57\xD9\xE6\xC1\xEC\xBF\xF7\x4B\x3F\x55\xD6"
+ "\x54\x15\x72\xB2\x23\x76\xD1\x4E\x8E\x7E\xFB"
+ "\xC8\xD6\xA4\xA4\x7E\x8E\xD8\x76\xD3\xEB\x90"
+ "\x90\xEB\xB3\x84\x26\x34\x93\x36\xCA\xA9\x12"
+ "\xD3\x6D\x84\x07\xE1\x0E\xE7\x63\x24\x54\x90"
+ "\x42\x8C\x6B\xE7\x21\x53\x2D\x16\xE9\x68\xA9"
+ "\xC2\x9A\x7A\x93\x31\x5E\x35\x72\xE2\x0F\x3D"
+ "\x55\x41\x8C\xC5\xD1\xBB\xEE\x5F\x3C\x95\x52"
+ "\x2A\x65\x47\xB6\x84\x6A\x05\x19\xD9\xE7\x68"
+ "\x15\xFA\x49\xD9\x9D\xFD\x47\x9F\xB9\xA6\xBB"
+ "\xA8\xD4\x22\x6C\x8B\x59\x47\xEF\xD1\xD0\xBF"
+ "\xBC\xE4\x53\x31\x2F\xA5\xD4\x2C\x89\xCA\xE5"
+ "\x29\x64\xF8\x51\x2A\x02\xDE\x31\x0D\x54\x0E"
+ "\x0E\xB8\x78\xE6\x2A\x3E\x31\xA2\xA4\xCD\x91"
+ "\x79\xF2\x9B\x04\xA0\xDB\x78\xAC\x0D\xB5\xCA"
+ "\x60\x4C\x08\x96\xCA\x8A\xE9\x93\x9F\x62\x38"
+ "\xAE",
+ .ent_reseed_len = 320,
+ .addtl_reseed = "\xD5\x46\x71\x38\x46\xE0\xC1\x27\x2C\xF1\x07"
+ "\xDD\x29\x73\xD7\xF4\x5A\x3A\xE0\x99\x98\x0A"
+ "\xEB\xA5\x9E\x2E\x49\x21\x7B\x18\xC0\xD8\x3D"
+ "\xEE\x49\xF9\x52\x7C\x55\x5E\x5E\x06\xC2\x7E"
+ "\x34\x3A\xA5\xB7\x78\x21\xC1\xB8\x8B\x4E\x07"
+ "\x1F\x3F\xC4\xB4\x9B\x3F\x20\x2D\xEE\x70\x3B"
+ "\x18\xCF\x2B\x50\x15\x1B\xF3\x6C\xE7\x9F\x2A"
+ "\x2B\x69\x53\xCA\x88\x41\xA9\x07\x31\x14\x55"
+ "\xBD\x75\x49\x68\x98\x48\xCA\x46\xA5\xEC\xAA"
+ "\x9D\x8E\x6F\x40\xBA\xCA\xC8\xE9\x9F\xA4\xC5"
+ "\x94\x89\x2C\x4D\xE4\x0A\x66\xD3\xDB\x1A\xD9"
+ "\xA7\x3F\x6B\x0A\xE0\xE4\xDC\x0B\x8B\x64\xBF"
+ "\xB4\x95\xA1\xAE\x92\xA8\x7C\xE2\x4B\xED\xFD"
+ "\xFD\xE0\x54\x48\x7C\x25\xD6\xD1\x0A\xAB\x5E"
+ "\x33\x2F\x1D\xD3\x62\x47\xAB\x35\x8C\xA1\xC2"
+ "\x75\xDD\x75\xCA\x09\xE1\x38\xDE\x87\x79\x0C"
+ "\xD7\x5D\x3E\x6D\x28\x8F\x12\x98\x2C\x26\x34"
+ "\x91\x0B\x6B\xB7\x73",
+ .addtl_reseed_len = 192,
+
+ .addtla = "\xC8\xE1\x03\x59\xEA\x9F\xD3\x1F\xCC\xCB\x5A\x3E"
+ "\x23\xDB\x47\x75\x1B\x3A\x6C\x0B\xED\xE6\xC0\xB6"
+ "\x4B\x82\x53\x5B\x6D\xEE\x2B\x97\x0F\x59\x07\xA4"
+ "\xFE\xE2\x26\x4F\xFF\xF7\x46\xAF\x62\xC4\x42\xE8"
+ "\x06\xFA\x1F\xAA\x66\xF3\xA4\xCF\x85\x02\x3C\x11"
+ "\xEF\xD2\x16\x13\x7A\xBD\x03\x66\xC3\x4D\x6F\x3A"
+ "\xE5\xD3\xFF\x92\xB6\x45\xB8\x88\x94\x42\x2E\x84"
+ "\x02\xA5\x54\x12\xBF\xCB\xF1\x6E\x1C\x0C\x23\xFE"
+ "\x8A\xFD\xF5\x1A\x4C\xD6\x2A\x34\x7F\x21\x50\xBB"
+ "\x06\x64\x9A\x77\x70\x59\x1D\x12\xD1\xA0\x10\x70"
+ "\xD7\x4F\x3C\xEE\x82\xEF\x5B\x35\x8F\x05\xF6\x51"
+ "\xBC\x28\xE1\xB1\x54\xFF\x25\x12\x16\x2C\x62\xFC"
+ "\xB9\x74\x5E\x78\x41\xB2\x04\x80\x4E\xB1\x43\x2E"
+ "\x88\x7F\x34\xA4\x33\x66\xE8\x68\x60\x54\xEB\xCE"
+ "\xD1\x5F\xC4\xD6\x21\x5E\x22\x1A\x7E\xC5\x6D\xB7"
+ "\x93\x8F\x9C\x77\x6E\x56\xA5\xA8\xF7\xB2\x10\x19",
+ .addtlb = "\xB8\x1E\x9E\xE2\xB3\xE4\x04\x43\x51\x7B\x96\x32"
+ "\xAC\x95\xF2\x1E\x5E\x7A\xBF\x68\xE3\x7A\xCE\xE5"
+ "\x2B\x3B\xB0\x34\x7F\xE1\xB5\x37\x3C\x5B\xD2\x6B"
+ "\x17\xF6\x18\xAF\x7C\x01\xA5\x84\xFE\x07\x0B\x46"
+ "\xCC\x96\x61\xAB\xCD\x81\x95\x8A\x8A\xB6\xD8\xCC"
+ "\x94\x80\x45\xF6\xFF\x95\x3A\xB8\xDC\xBF\xB4\xBF"
+ "\x26\x8C\xE9\x79\x05\x58\x9C\x03\x08\x45\xB5\xC4"
+ "\xD8\xB4\xCD\x76\x13\xAE\x2B\xCC\xB5\x3E\x3C\x65"
+ "\x7A\xAA\xDC\x9B\x0B\x13\x8B\x82\x5A\x39\x60\x9A"
+ "\xF7\xA8\x38\xB5\x83\x8E\x0B\xD1\xE6\xBF\xA1\xDC"
+ "\x30\x45\xCC\x67\x41\x0F\xF9\x86\x27\xE0\x22\x3E"
+ "\x0D\x1F\x92\x13\x16\x9B\x84\x79\x91\xFE\xBC\xDF"
+ "\x15\x6C\xDC\xAE\xC5\x64\x46\x9C\xE8\xEA\xBB\x9D"
+ "\x27\xA2\x1E\xDF\xB2\xF2\x98\xB4\x88\x4E\x22\x5F"
+ "\x3C\xD0\x35\x2C\x5C\x89\xC7\xEC\xE3\xF3\x09\x60"
+ "\xEF\xAC\x78\xBF\x94\xAA\x8C\x30\x7F\xCF\xE4\x4B",
+ .addtllen = 192,
+
+ .expected = "\x93\xFF\x4F\x4A\xA7\xE0\xFC\x3B\xCF\xCE\x57\xCD"
+ "\xFD\xE9\x94\x6D\x0D\x45\x7E\xA3\x98\xBB\xE6\x54"
+ "\x36\xF9\x92\xE6\xBB\xC5\x93\x16\x69\x35\x01\xF0"
+ "\x5A\xE2\x43\xFC\x73\x7C\xA3\x5C\x5B\x49\x72\x69"
+ "\x6A\xC4\xB6\xD4\xB2\x48\x27\x72\xCA\xE3\xF3\xB8"
+ "\xD6\x95\x9F\x39\xC8\xD7\x72\xAF\xC2\x7C\x75\xE5"
+ "\xA4\xF7\x52\x4F\xDF\x80\x75\xCA\x4B\xFA\x75\x9A"
+ "\x7A\x8D\x48\x94\x30\x1C\x82\x5E\xD6\x3F\xF1\x78"
+ "\x84\xAA\x8D\x8B\x4F\x6A\x20\x12\xA2\x65\xC5\x02"
+ "\x32\xA1\xE4\x6B\x86\x2F\xCF\x92\xCD\x01\x55\xF7"
+ "\xB8\xAB\xC3\x2C\x42\xC3\xFD\x9B\x59\x2D\x47\x8E"
+ "\xB6\x8D\xE7\x04\x2E\x67\xD9\x07\x14\xA3\xF2\x74"
+ "\x79\x9C\xAB\xC6\xD6\x52\x3E\x91\x81\xA4\x3C\x9A"
+ "\x3E\x10\x1E\xD0\x28\xBC\x1C\x50\xF0\xB6\xEC\x01"
+ "\xE5\x40\x16\x08\xB5\x58\xE0\xC4\xC2\x9A\xBB\x13"
+ "\xAB\x10\x4B\x07\x24\x09\xEB\xF9\x5E\xAA\x3E\x3A"
+ "\x25\x34\x5B\x97\x92\xF9\x46\x8A\x8E\x5A\x06\x9C"
+ "\x2B\x1C\x8E\x47\x19\xC3\x3B\x14\x8A\xC1\xEB\xF7"
+ "\xB0\xA2\x05\xE0\x70\x12\x88\x21\xFF\xC0\x35\x6D"
+ "\xE9\x08\x7E\x11\x6E\xD7\x16\x48\x24\x43\xAF\x33"
+ "\xA3\x48\x44\x91\xC5\x32\x1D\x87\xF6\x9B\x10\x1C"
+ "\xA4\x7A\x74\x23\xB3\xFC\xB9\x87\x08\xE6\x9A\xEF"
+ "\xD5\x93\x82\x17\xD4\x78\xDA\x46\x34\xC2\x61\x8C"
+ "\xB7\x53\x89\xC4\x8A\xD8\xA0\x2E\xCE\xCA\x24\x16"
+ "\xF0\x18\x7F\xC3\x12\x3F\xD0\xB1\xEF\x37\x99\xA8"
+ "\x04\x1F\x76\x50\x81\x08\xCD\x4D\x43\xEF\x64\xB6"
+ "\x03\x57\xB7\x5F\xDD\xF6\xBA\x34\xE2\x88\xE7\x1F"
+ "\x62\xA5\xA4\x05\xEB\x1A\xFE\x0B\xFE\x74\x7D\x64"
+ "\x29\x83\xE8\x0B\x97\x7D\x94\x5B\xF9\x3C\x8E\xC8"
+ "\x6B\xCD\xAD\x63\x32\x6E\x00\xBF\x8E\x57\xF2\x32"
+ "\x88\x53\x17\x40\xE3\xF8\xF8\xD9\xFD\xCD\x76\x84"
+ "\xC6\xFD\xB1\x10\x40\xED\x75\xDD\xBD\x78\x8B\x0A"
+ "\x61\x1E\xCC\xC4\x4F\x95\xF1\x2F\x8F\x5A\xF0\x12"
+ "\x00\xCE\x75\xB8\xE9\xAB\x63\xC0\x7A\xF6\x9A\x47"
+ "\xD2\x3C\xB0\xAD\xAF\x03\xDF\x25\xDD\x0C\x0F\xB6"
+ "\x29\x09\x0F\x28\x5E\xA8\x67\xBB\xC9\x78\xBE\x12"
+ "\xD8\xD6\xD0\x98\x82\x29\xA3\x82\xFB\x8E\x1C\x79"
+ "\x28\x52\x22\x73\x3C\x6F\xB5\x33\xFF\x40\x26\x4C"
+ "\x30\xE4\xE0\x39\x59\x72\x65\x79\x9F\xB7\x89\x87"
+ "\x64\xAC\x45\x11\x0D\xDD\xC0\x44\x5E\x0D\xDF\xDB"
+ "\x91\x42\x5F\x52\x7F\xBB\x66\xEE\x32\x90\x8F\x6F"
+ "\xF8\xB9\xFE\xEA\x42\xFB\x60\x2B\xE3\xD9\xB2\xD1"
+ "\x74\x37\x14\xC6\xDA\x68\xE6\x09",
+ .expectedlen = 512,
+ }
+};
+
+#endif /* _CRYPTO_DRBG_TESTVECS_H */
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 7d8be036e9be8..9c99b2d510e0a 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -93,10 +93,12 @@
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mutex.h>
+#include <linux/once.h>
#include <linux/slab.h>
#include <linux/string_choices.h>
#include <linux/unaligned.h>
#include "drbg.h"
+#include "drbg-testvecs.h"
#include "jitterentropy-kcapi.h"
/* State length in bytes */
@@ -522,7 +524,9 @@ static void drbg_kcapi_exit(struct crypto_tfm *tfm)
* Public API
***************************************************************/
-struct drbg_state *crypto_drbg_alloc(void)
+static int drbg_selftest(void);
+
+static struct drbg_state *__crypto_drbg_alloc(void)
{
struct drbg_state *drbg = kzalloc_obj(*drbg);
@@ -532,6 +536,15 @@ struct drbg_state *crypto_drbg_alloc(void)
mutex_init(&drbg->drbg_mutex);
return drbg;
}
+
+struct drbg_state *crypto_drbg_alloc(void)
+{
+ int err = drbg_selftest();
+
+ if (err)
+ return ERR_PTR(err);
+ return __crypto_drbg_alloc();
+}
EXPORT_SYMBOL_NS_GPL(crypto_drbg_alloc, "CRYPTO_INTERNAL");
/* Set test entropy in the DRBG. */
@@ -635,20 +648,16 @@ EXPORT_SYMBOL_NS_GPL(crypto_drbg_free, "CRYPTO_INTERNAL");
* Note 2: There is no sensible way of testing the reseed counter
* enforcement, so skip it.
*/
-static inline int __init drbg_healthcheck_sanity(void)
+static void drbg_healthcheck_sanity(void)
{
#define OUTBUFLEN 16
u8 buf[OUTBUFLEN];
struct drbg_state *drbg = NULL;
int ret;
- /* only perform test in FIPS mode */
- if (!fips_enabled)
- return 0;
-
drbg = kzalloc_obj(struct drbg_state);
if (!drbg)
- return -ENOMEM;
+ panic("DRBG: out of memory");
guard(mutex_init)(&drbg->drbg_mutex);
drbg->instantiated = true;
@@ -677,8 +686,8 @@ static inline int __init drbg_healthcheck_sanity(void)
pr_devel("DRBG: Sanity tests for failure code paths successfully "
"completed\n");
- kfree(drbg);
- return 0;
+ mutex_destroy(&drbg->drbg_mutex);
+ kfree_sensitive(drbg);
}
static struct rng_alg drbg_alg = {
@@ -694,13 +703,101 @@ static struct rng_alg drbg_alg = {
.base.cra_exit = drbg_kcapi_exit,
};
+DEFINE_FREE(crypto_drbg_free, struct drbg_state *, crypto_drbg_free(_T))
+
+static int drbg_selftest_one_vec(const struct drbg_testvec *test)
+{
+ struct drbg_state *drbg __free(crypto_drbg_free) = NULL;
+ unsigned char *buf __free(kfree_sensitive) = NULL;
+ int err;
+
+ buf = kzalloc(test->expectedlen, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ drbg = __crypto_drbg_alloc();
+ if (IS_ERR(drbg))
+ return PTR_ERR(drbg);
+
+ crypto_drbg_set_entropy(drbg, test->entropy, test->entropylen);
+ err = crypto_drbg_seed(drbg, test->pers, test->perslen);
+ if (err) {
+ pr_err("DRBG: Instantiation failed: %d\n", err);
+ return err;
+ }
+
+ if (test->ent_reseed_len) {
+ crypto_drbg_set_entropy(drbg, test->ent_reseed,
+ test->ent_reseed_len);
+ err = crypto_drbg_seed(drbg, test->addtl_reseed,
+ test->addtl_reseed_len);
+ if (err) {
+ pr_err("DRBG: Reseed failed: %d\n", err);
+ return err;
+ }
+ }
+
+ err = crypto_drbg_get_bytes(drbg, buf, test->expectedlen, test->addtla,
+ test->addtllen);
+ if (err) {
+ pr_err("DRBG: Generation failed (first): %d\n", err);
+ return err;
+ }
+
+ err = crypto_drbg_get_bytes(drbg, buf, test->expectedlen, test->addtlb,
+ test->addtllen);
+ if (err) {
+ pr_err("DRBG: Generation failed (second): %d\n", err);
+ return err;
+ }
+
+ if (memcmp(test->expected, buf, test->expectedlen) != 0) {
+ pr_err("DRBG: Actual output doesn't match expected output\n");
+ return -ELIBBAD;
+ }
+ return 0;
+}
+
+static int drbg_selftest_err;
+
+static void drbg_selftest_once(void)
+{
+ if (!fips_enabled && !IS_ENABLED(CONFIG_CRYPTO_SELFTESTS))
+ return;
+
+ if (fips_enabled)
+ drbg_healthcheck_sanity();
+
+ for (size_t i = 0; i < ARRAY_SIZE(drbg_testvecs); i++) {
+ int err = drbg_selftest_one_vec(&drbg_testvecs[i]);
+
+ if (err) {
+ if (fips_enabled)
+ panic("DRBG self-test %zu failed: %d\n", i,
+ err);
+ else
+ WARN(1, "DRBG self-test %zu failed: %d\n", i,
+ err);
+ drbg_selftest_err = err;
+ break;
+ }
+ }
+ if (fips_enabled)
+ pr_info("DRBG: self-tests passed\n");
+}
+
+static int drbg_selftest(void)
+{
+ DO_ONCE_SLEEPABLE(drbg_selftest_once);
+ return drbg_selftest_err;
+}
+
static int __init drbg_init(void)
{
- int ret;
+ int err = drbg_selftest();
- ret = drbg_healthcheck_sanity();
- if (ret)
- return ret;
+ if (err)
+ return err;
/*
* In FIPS mode, boost the algorithm priority to ensure that when users
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 08/14] crypto: algif_rng - Use DRBG and jitterentropy library APIs
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (6 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 07/14] crypto: drbg - Add self-test for " Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 09/14] crypto: stdrng - Reimplement "stdrng" using direct DRBG calls Eric Biggers
` (5 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Since the overly-general crypto_rng API will be removed, reimplement the
"rng" algorithm type of AF_ALG using the DRBG and jitterentropy library
functions instead of crypto_rng.
This preserves the behavior of all algorithm names that actually worked
with this API (assuming af_alg_restrict=0 to make it available in the
first place). Note: the only known use case for this is algorithm
testing and entropy evaluation for FIPS 140-3 certification.
Make CRYPTO_USER_API_RNG depend on CRYPTO_DRBG to reflect the
now-explicit dependency.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/Kconfig | 4 +-
crypto/algif_rng.c | 109 +++++++++++++++++++++++++++++----------------
2 files changed, 73 insertions(+), 40 deletions(-)
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 981d5dc422d4c..5b0806432694f 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1288,7 +1288,7 @@ config CRYPTO_USER_API_SKCIPHER
config CRYPTO_USER_API_RNG
tristate "Random number generation algorithms (deprecated)"
depends on NET
- select CRYPTO_RNG
+ depends on CRYPTO_DRBG
select CRYPTO_USER_API
help
Enable the AF_ALG userspace interface for random number generation
@@ -1305,7 +1305,7 @@ config CRYPTO_USER_API_RNG
config CRYPTO_USER_API_RNG_CAVP
bool "Enable CAVP testing of DRBG"
- depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
+ depends on CRYPTO_USER_API_RNG
help
Enable extra APIs in the userspace interface for NIST CAVP
(Cryptographic Algorithm Validation Program) testing:
diff --git a/crypto/algif_rng.c b/crypto/algif_rng.c
index bd522915d56d7..7fe76479a6bdc 100644
--- a/crypto/algif_rng.c
+++ b/crypto/algif_rng.c
@@ -40,11 +40,11 @@
#include <linux/capability.h>
#include <linux/module.h>
-#include <crypto/rng.h>
-#include <linux/random.h>
#include <crypto/if_alg.h>
#include <linux/net.h>
#include <net/sock.h>
+#include "drbg.h"
+#include "jitterentropy-kcapi.h"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
@@ -54,17 +54,26 @@ static const struct af_alg_allowlist_entry rng_allowlist[] = {
{},
};
+enum rng_type {
+ RNG_JITTERENTROPY = 1,
+ RNG_DRBG = 2,
+};
+
+struct rng_parent_ctx {
+ enum rng_type type;
+ union {
+ struct jitterentropy *jent;
+ struct drbg_state *drbg;
+ };
+ u8 *entropy;
+};
+
struct rng_ctx {
#define MAXSIZE 128
unsigned int len;
- struct crypto_rng *drng;
u8 *addtl;
size_t addtl_len;
-};
-
-struct rng_parent_ctx {
- struct crypto_rng *drng;
- u8 *entropy;
+ struct rng_parent_ctx *pctx;
};
static void rng_reset_addtl(struct rng_ctx *ctx)
@@ -74,11 +83,10 @@ static void rng_reset_addtl(struct rng_ctx *ctx)
ctx->addtl_len = 0;
}
-static int _rng_recvmsg(struct crypto_rng *drng, struct msghdr *msg, size_t len,
+static int _rng_recvmsg(struct rng_ctx *ctx, struct msghdr *msg, size_t len,
u8 *addtl, size_t addtl_len)
{
int err = 0;
- int genlen = 0;
u8 result[MAXSIZE];
if (len == 0)
@@ -92,15 +100,18 @@ static int _rng_recvmsg(struct crypto_rng *drng, struct msghdr *msg, size_t len,
*/
memset(result, 0, len);
- /*
- * The enforcement of a proper seeding of an RNG is done within an
- * RNG implementation. Some RNGs (DRBG, krng) do not need specific
- * seeding as they automatically seed. The X9.31 DRNG will return
- * an error if it was not seeded properly.
- */
- genlen = crypto_rng_generate(drng, addtl, addtl_len, result, len);
- if (genlen < 0)
- return genlen;
+ err = -EINVAL;
+ switch (ctx->pctx->type) {
+ case RNG_JITTERENTROPY:
+ err = crypto_jent_get_bytes(ctx->pctx->jent, result, len);
+ break;
+ case RNG_DRBG:
+ err = crypto_drbg_get_bytes(ctx->pctx->drbg, result, len, addtl,
+ addtl_len);
+ break;
+ }
+ if (err < 0)
+ return err;
err = memcpy_to_msg(msg, result, len);
memzero_explicit(result, len);
@@ -115,7 +126,7 @@ static int rng_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
struct alg_sock *ask = alg_sk(sk);
struct rng_ctx *ctx = ask->private;
- return _rng_recvmsg(ctx->drng, msg, len, NULL, 0);
+ return _rng_recvmsg(ctx, msg, len, NULL, 0);
}
static int rng_test_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
@@ -127,7 +138,7 @@ static int rng_test_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
int ret;
lock_sock(sock->sk);
- ret = _rng_recvmsg(ctx->drng, msg, len, ctx->addtl, ctx->addtl_len);
+ ret = _rng_recvmsg(ctx, msg, len, ctx->addtl, ctx->addtl_len);
rng_reset_addtl(ctx);
release_sock(sock->sk);
@@ -204,7 +215,6 @@ static struct proto_ops __maybe_unused algif_rng_test_ops = {
static void *rng_bind(const char *name)
{
struct rng_parent_ctx *pctx;
- struct crypto_rng *rng;
int err;
err = af_alg_check_restriction(name, rng_allowlist);
@@ -215,14 +225,30 @@ static void *rng_bind(const char *name)
if (!pctx)
return ERR_PTR(-ENOMEM);
- rng = crypto_alloc_rng(name, 0, AF_ALG_CRYPTOAPI_MASK);
- if (IS_ERR(rng)) {
- kfree(pctx);
- return ERR_CAST(rng);
+ if (strcmp(name, "jitterentropy_rng") == 0) {
+ pctx->type = RNG_JITTERENTROPY;
+ pctx->jent = crypto_jent_alloc();
+ if (IS_ERR(pctx->jent)) {
+ err = PTR_ERR(pctx->jent);
+ goto error;
+ }
+ } else if (strcmp(name, "stdrng") == 0 ||
+ strcmp(name, "drbg_nopr_hmac_sha512") == 0) {
+ pctx->type = RNG_DRBG;
+ pctx->drbg = crypto_drbg_alloc();
+ if (IS_ERR(pctx->drbg)) {
+ err = PTR_ERR(pctx->drbg);
+ goto error;
+ }
+ } else {
+ err = -ENOENT;
+ goto error;
}
-
- pctx->drng = rng;
return pctx;
+
+error:
+ kfree_sensitive(pctx);
+ return ERR_PTR(err);
}
static void rng_release(void *private)
@@ -231,7 +257,14 @@ static void rng_release(void *private)
if (unlikely(!pctx))
return;
- crypto_free_rng(pctx->drng);
+ switch (pctx->type) {
+ case RNG_JITTERENTROPY:
+ crypto_jent_free(pctx->jent);
+ break;
+ case RNG_DRBG:
+ crypto_drbg_free(pctx->drbg);
+ break;
+ }
kfree_sensitive(pctx->entropy);
kfree_sensitive(pctx);
}
@@ -266,7 +299,7 @@ static int rng_accept_parent(void *private, struct sock *sk)
* state of the RNG.
*/
- ctx->drng = pctx->drng;
+ ctx->pctx = pctx;
ask->private = ctx;
sk->sk_destruct = rng_sock_destruct;
@@ -283,11 +316,10 @@ static int rng_accept_parent(void *private, struct sock *sk)
static int rng_setkey(void *private, const u8 *seed, unsigned int seedlen)
{
struct rng_parent_ctx *pctx = private;
- /*
- * Check whether seedlen is of sufficient size is done in RNG
- * implementations.
- */
- return crypto_rng_reset(pctx->drng, seed, seedlen);
+
+ if (pctx->type != RNG_DRBG)
+ return 0;
+ return crypto_drbg_seed(pctx->drbg, seed, seedlen);
}
static int __maybe_unused rng_setentropy(void *private, sockptr_t entropy,
@@ -299,7 +331,7 @@ static int __maybe_unused rng_setentropy(void *private, sockptr_t entropy,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
- if (pctx->entropy)
+ if (pctx->entropy || pctx->type != RNG_DRBG)
return -EINVAL;
if (len > MAXSIZE)
@@ -311,9 +343,9 @@ static int __maybe_unused rng_setentropy(void *private, sockptr_t entropy,
return PTR_ERR(kentropy);
}
- crypto_rng_alg(pctx->drng)->set_ent(pctx->drng, kentropy, len);
+ crypto_drbg_set_entropy(pctx->drbg, kentropy, len);
/*
- * Since rng doesn't perform any memory management for the entropy
+ * Since drbg doesn't perform any memory management for the entropy
* buffer, save kentropy pointer to pctx now to free it after use.
*/
pctx->entropy = kentropy;
@@ -346,3 +378,4 @@ static void __exit rng_exit(void)
module_init(rng_init);
module_exit(rng_exit);
+MODULE_IMPORT_NS("CRYPTO_INTERNAL"); /* for drbg and jitterentropy */
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 09/14] crypto: stdrng - Reimplement "stdrng" using direct DRBG calls
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (7 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 08/14] crypto: algif_rng - Use DRBG and jitterentropy library APIs Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 10/14] crypto: drbg - Remove crypto_rng support Eric Biggers
` (4 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
When fips=1, the so-called "stdrng" is always the NIST SP800-90A DRBG.
Simplify the code by making __crypto_stdrng_get_bytes() call into the
DRBG directly instead of going through the unnecessary crypto_rng API.
This required moving the shared DRBG instance (and the function to
delete it) from rng.c to drbg.c.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/Kconfig | 1 -
crypto/crypto_user.c | 2 +-
crypto/drbg.c | 66 ++++++++++++++++++++++++++
crypto/rng.c | 88 -----------------------------------
include/crypto/internal/rng.h | 9 ----
include/crypto/rng.h | 14 ++++--
6 files changed, 78 insertions(+), 102 deletions(-)
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 5b0806432694f..c41c2f3475d0b 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -158,7 +158,6 @@ config CRYPTO_USER
tristate "Userspace cryptographic algorithm configuration"
depends on NET
select CRYPTO_MANAGER
- select CRYPTO_RNG
help
Userspace configuration for cryptographic instantiations such as
cbc(aes).
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index d3ccb507153b2..08e2b4fb9bf73 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -16,9 +16,9 @@
#include <net/net_namespace.h>
#include <net/sock.h>
#include <crypto/internal/skcipher.h>
-#include <crypto/internal/rng.h>
#include <crypto/akcipher.h>
#include <crypto/kpp.h>
+#include <crypto/rng.h>
#include "internal.h"
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 9c99b2d510e0a..0f36aa45bfaca 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -638,6 +638,67 @@ void crypto_drbg_free(struct drbg_state *drbg)
}
EXPORT_SYMBOL_NS_GPL(crypto_drbg_free, "CRYPTO_INTERNAL");
+#ifdef CONFIG_CRYPTO_FIPS
+static DEFINE_MUTEX(crypto_default_rng_lock);
+static struct drbg_state *crypto_default_rng;
+static int crypto_default_rng_refcnt;
+
+static int crypto_get_default_rng(void)
+{
+ struct drbg_state *drbg;
+ int err;
+
+ guard(mutex)(&crypto_default_rng_lock);
+ if (!crypto_default_rng) {
+ drbg = crypto_drbg_alloc();
+ if (IS_ERR(drbg))
+ return PTR_ERR(drbg);
+
+ err = crypto_drbg_seed(drbg, NULL, 0);
+ if (err) {
+ crypto_drbg_free(drbg);
+ return err;
+ }
+ crypto_default_rng = drbg;
+ }
+
+ crypto_default_rng_refcnt++;
+ return 0;
+}
+
+static void crypto_put_default_rng(void)
+{
+ guard(mutex)(&crypto_default_rng_lock);
+ crypto_default_rng_refcnt--;
+}
+
+int __crypto_stdrng_get_bytes(void *buf, unsigned int len)
+{
+ int err;
+
+ err = crypto_get_default_rng();
+ if (err)
+ return err;
+
+ err = crypto_drbg_get_bytes(crypto_default_rng, buf, len, NULL, 0);
+ crypto_put_default_rng();
+ return err;
+}
+EXPORT_SYMBOL_GPL(__crypto_stdrng_get_bytes);
+
+int crypto_del_default_rng(void)
+{
+ guard(mutex)(&crypto_default_rng_lock);
+ if (crypto_default_rng_refcnt)
+ return -EBUSY;
+
+ crypto_drbg_free(crypto_default_rng);
+ crypto_default_rng = NULL;
+ return 0;
+}
+EXPORT_SYMBOL_GPL(crypto_del_default_rng);
+#endif /* CONFIG_CRYPTO_FIPS */
+
/*
* Tests as defined in 11.3.2 in addition to the cipher tests: testing
* of the error handling.
@@ -812,6 +873,11 @@ static int __init drbg_init(void)
static void __exit drbg_exit(void)
{
crypto_unregister_rng(&drbg_alg);
+
+ /*
+ * Note there's no need to call crypto_del_default_rng() from here, as
+ * it can exist only when this file is built-in.
+ */
}
module_init(drbg_init);
diff --git a/crypto/rng.c b/crypto/rng.c
index 828b0d8074738..be4873bec679b 100644
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -23,10 +23,6 @@
#include "internal.h"
-static DEFINE_MUTEX(crypto_default_rng_lock);
-static struct crypto_rng *crypto_default_rng;
-static int crypto_default_rng_refcnt;
-
int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen)
{
u8 *buf = NULL;
@@ -103,79 +99,6 @@ struct crypto_rng *crypto_alloc_rng(const char *alg_name, u32 type, u32 mask)
}
EXPORT_SYMBOL_GPL(crypto_alloc_rng);
-static int crypto_get_default_rng(void)
-{
- struct crypto_rng *rng;
- int err;
-
- mutex_lock(&crypto_default_rng_lock);
- if (!crypto_default_rng) {
- rng = crypto_alloc_rng("stdrng", 0, 0);
- err = PTR_ERR(rng);
- if (IS_ERR(rng))
- goto unlock;
-
- err = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
- if (err) {
- crypto_free_rng(rng);
- goto unlock;
- }
-
- crypto_default_rng = rng;
- }
-
- crypto_default_rng_refcnt++;
- err = 0;
-
-unlock:
- mutex_unlock(&crypto_default_rng_lock);
-
- return err;
-}
-
-static void crypto_put_default_rng(void)
-{
- mutex_lock(&crypto_default_rng_lock);
- crypto_default_rng_refcnt--;
- mutex_unlock(&crypto_default_rng_lock);
-}
-
-int __crypto_stdrng_get_bytes(void *buf, unsigned int len)
-{
- int err;
-
- err = crypto_get_default_rng();
- if (err)
- return err;
-
- err = crypto_rng_get_bytes(crypto_default_rng, buf, len);
- crypto_put_default_rng();
- return err;
-}
-EXPORT_SYMBOL_GPL(__crypto_stdrng_get_bytes);
-
-#if defined(CONFIG_CRYPTO_RNG) || defined(CONFIG_CRYPTO_RNG_MODULE)
-int crypto_del_default_rng(void)
-{
- int err = -EBUSY;
-
- mutex_lock(&crypto_default_rng_lock);
- if (crypto_default_rng_refcnt)
- goto out;
-
- crypto_free_rng(crypto_default_rng);
- crypto_default_rng = NULL;
-
- err = 0;
-
-out:
- mutex_unlock(&crypto_default_rng_lock);
-
- return err;
-}
-EXPORT_SYMBOL_GPL(crypto_del_default_rng);
-#endif
-
static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data,
unsigned int len)
{
@@ -230,16 +153,5 @@ void crypto_unregister_rngs(struct rng_alg *algs, int count)
}
EXPORT_SYMBOL_GPL(crypto_unregister_rngs);
-static void __exit rng_exit(void)
-{
- int err;
-
- err = crypto_del_default_rng();
- if (err)
- pr_err("Failed delete default RNG: %d\n", err);
-}
-
-module_exit(rng_exit);
-
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Random Number Generator");
diff --git a/include/crypto/internal/rng.h b/include/crypto/internal/rng.h
index e0711b6a597fc..8c9f560d6449c 100644
--- a/include/crypto/internal/rng.h
+++ b/include/crypto/internal/rng.h
@@ -17,15 +17,6 @@ void crypto_unregister_rng(struct rng_alg *alg);
int crypto_register_rngs(struct rng_alg *algs, int count);
void crypto_unregister_rngs(struct rng_alg *algs, int count);
-#if defined(CONFIG_CRYPTO_RNG) || defined(CONFIG_CRYPTO_RNG_MODULE)
-int crypto_del_default_rng(void);
-#else
-static inline int crypto_del_default_rng(void)
-{
- return 0;
-}
-#endif
-
static inline void *crypto_rng_ctx(struct crypto_rng *tfm)
{
return crypto_tfm_ctx(&tfm->base);
diff --git a/include/crypto/rng.h b/include/crypto/rng.h
index 07f494b2c8817..463bbdce11c2c 100644
--- a/include/crypto/rng.h
+++ b/include/crypto/rng.h
@@ -66,9 +66,8 @@ int __crypto_stdrng_get_bytes(void *buf, unsigned int len);
* @buf: output buffer holding the random numbers
* @len: length of the output buffer
*
- * This function fills the caller-allocated buffer with random numbers using the
- * normal Linux RNG if fips_enabled=0, or the highest-priority "stdrng"
- * algorithm in the crypto_rng subsystem if fips_enabled=1.
+ * This function fills the given buffer with random numbers using the normal
+ * Linux RNG if fips_enabled=0, or a NIST SP800-90A DRBG if fips_enabled=1.
*
* Context: May sleep
* Return: 0 function was successful; < 0 if an error occurred
@@ -81,6 +80,15 @@ static inline int crypto_stdrng_get_bytes(void *buf, unsigned int len)
return get_random_bytes_wait(buf, len);
}
+#ifdef CONFIG_CRYPTO_FIPS
+int crypto_del_default_rng(void);
+#else
+static inline int crypto_del_default_rng(void)
+{
+ return 0;
+}
+#endif
+
/**
* DOC: Random number generator API
*
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 10/14] crypto: drbg - Remove crypto_rng support
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (8 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 09/14] crypto: stdrng - Reimplement "stdrng" using direct DRBG calls Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 11/14] crypto: jitterentropy " Eric Biggers
` (3 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Now that drbg is used only via its library API instead of crypto_rng,
remove its obsolete crypto_rng support. Also remove the associated
self-test, which has been superseded by the built-in self-test.
Note: /proc/crypto will no longer list the DRBG algorithm. However,
this should be fine. Its existence is implied by either fips=1 or the
support for the "rng" algorithm type in AF_ALG. When fips=1 there is
also the "DRBG: self-tests passed" log message, which makes it clear
that the DRBG code is built into the kernel and is tested.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/Kconfig | 2 -
crypto/drbg.c | 150 +-------------------------------
crypto/testmgr.c | 98 ---------------------
crypto/testmgr.h | 218 -----------------------------------------------
4 files changed, 2 insertions(+), 466 deletions(-)
diff --git a/crypto/Kconfig b/crypto/Kconfig
index c41c2f3475d0b..ed8612dcc5212 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -151,7 +151,6 @@ config CRYPTO_MANAGER2
select CRYPTO_SIG2 if CRYPTO_SELFTESTS
select CRYPTO_HASH2 if CRYPTO_SELFTESTS
select CRYPTO_KPP2 if CRYPTO_SELFTESTS
- select CRYPTO_RNG2 if CRYPTO_SELFTESTS
select CRYPTO_SKCIPHER2 if CRYPTO_SELFTESTS
config CRYPTO_USER
@@ -1109,7 +1108,6 @@ config CRYPTO_DRBG
tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
select CRYPTO_JITTERENTROPY
select CRYPTO_LIB_SHA512
- select CRYPTO_RNG
help
DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 0f36aa45bfaca..831178f7bc001 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -87,7 +87,7 @@
* Just mix both scenarios above.
*/
-#include <crypto/internal/rng.h>
+#include <crypto/rng.h>
#include <crypto/sha2.h>
#include <linux/fips.h>
#include <linux/kernel.h>
@@ -95,8 +95,6 @@
#include <linux/mutex.h>
#include <linux/once.h>
#include <linux/slab.h>
-#include <linux/string_choices.h>
-#include <linux/unaligned.h>
#include "drbg.h"
#include "drbg-testvecs.h"
#include "jitterentropy-kcapi.h"
@@ -405,121 +403,6 @@ static int drbg_generate(struct drbg_state *drbg, u8 *out, size_t outlen,
return 0;
}
-/***************************************************************
- * Kernel crypto API interface to DRBG
- ***************************************************************/
-
-static int drbg_kcapi_init(struct crypto_tfm *tfm)
-{
- struct drbg_state *drbg = crypto_tfm_ctx(tfm);
-
- mutex_init(&drbg->drbg_mutex);
-
- return 0;
-}
-
-/* Set test entropy in the DRBG. */
-static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
- const u8 *data, unsigned int len)
-{
- struct drbg_state *drbg = crypto_rng_ctx(tfm);
-
- mutex_lock(&drbg->drbg_mutex);
- drbg->test_entropy = data;
- drbg->test_entropylen = len;
- mutex_unlock(&drbg->drbg_mutex);
-}
-
-/* Seed (i.e. instantiate) or re-seed the DRBG. */
-static int drbg_kcapi_seed(struct crypto_rng *tfm,
- const u8 *pers, unsigned int pers_len)
-{
- static const u8 initial_key[DRBG_STATE_LEN]; /* all zeroes */
- struct drbg_state *drbg = crypto_rng_ctx(tfm);
- int ret;
-
- pr_devel("DRBG: Initializing DRBG\n");
- guard(mutex)(&drbg->drbg_mutex);
-
- if (drbg->instantiated)
- return drbg_seed(drbg, pers, pers_len, /* reseed= */ true);
-
- /* 9.1 step 1 is implicit with the selected DRBG type */
-
- /*
- * 9.1 step 2 is implicit, as this implementation doesn't support
- * prediction resistance
- */
-
- /* 9.1 step 4 is implicit in DRBG_SEC_STRENGTH */
-
- memset(drbg->V, 1, DRBG_STATE_LEN);
- hmac_sha512_preparekey(&drbg->key, initial_key, DRBG_STATE_LEN);
-
- /* Allocate jitterentropy_rng if not in test mode. */
- if (drbg->test_entropylen == 0) {
- drbg->jent = crypto_jent_alloc();
- if (IS_ERR(drbg->jent)) {
- ret = PTR_ERR(drbg->jent);
- drbg->jent = NULL;
- if (fips_enabled)
- return ret;
- pr_info("DRBG: Continuing without Jitter RNG\n");
- }
- }
-
- ret = drbg_seed(drbg, pers, pers_len, /* reseed= */ false);
- if (ret) {
- crypto_jent_free(drbg->jent);
- drbg->jent = NULL;
- return ret;
- }
- drbg->instantiated = true;
- return 0;
-}
-
-/*
- * Generate random numbers invoked by the kernel crypto API:
- *
- * src is additional input supplied to the RNG.
- * slen is the length of src.
- * dst is the output buffer where random data is to be stored.
- * dlen is the length of dst.
- */
-static int drbg_kcapi_generate(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int dlen)
-{
- struct drbg_state *drbg = crypto_rng_ctx(tfm);
-
- /*
- * Break the request into multiple requests if needed, to avoid
- * exceeding the maximum request length of the core algorithm.
- */
- do {
- unsigned int n = min(dlen, DRBG_MAX_REQUEST_BYTES);
- int err;
-
- mutex_lock(&drbg->drbg_mutex);
- err = drbg_generate(drbg, dst, n, src, slen);
- mutex_unlock(&drbg->drbg_mutex);
- if (err < 0)
- return err;
- dst += n;
- dlen -= n;
- } while (dlen);
- return 0;
-}
-
-/* Uninstantiate the DRBG. */
-static void drbg_kcapi_exit(struct crypto_tfm *tfm)
-{
- struct drbg_state *drbg = crypto_tfm_ctx(tfm);
-
- crypto_jent_free(drbg->jent);
- memzero_explicit(drbg, sizeof(*drbg));
-}
-
/***************************************************************
* Public API
***************************************************************/
@@ -751,19 +634,6 @@ static void drbg_healthcheck_sanity(void)
kfree_sensitive(drbg);
}
-static struct rng_alg drbg_alg = {
- .base.cra_name = "stdrng",
- .base.cra_driver_name = "drbg_nopr_hmac_sha512",
- .base.cra_priority = 201,
- .base.cra_ctxsize = sizeof(struct drbg_state),
- .base.cra_module = THIS_MODULE,
- .base.cra_init = drbg_kcapi_init,
- .set_ent = drbg_kcapi_set_entropy,
- .seed = drbg_kcapi_seed,
- .generate = drbg_kcapi_generate,
- .base.cra_exit = drbg_kcapi_exit,
-};
-
DEFINE_FREE(crypto_drbg_free, struct drbg_state *, crypto_drbg_free(_T))
static int drbg_selftest_one_vec(const struct drbg_testvec *test)
@@ -855,25 +725,11 @@ static int drbg_selftest(void)
static int __init drbg_init(void)
{
- int err = drbg_selftest();
-
- if (err)
- return err;
-
- /*
- * In FIPS mode, boost the algorithm priority to ensure that when users
- * request "stdrng", they really get the algorithm from here.
- */
- if (fips_enabled)
- drbg_alg.base.cra_priority += 2000;
-
- return crypto_register_rng(&drbg_alg);
+ return drbg_selftest();
}
static void __exit drbg_exit(void)
{
- crypto_unregister_rng(&drbg_alg);
-
/*
* Note there's no need to call crypto_del_default_rng() from here, as
* it can exist only when this file is built-in.
@@ -885,6 +741,4 @@ module_exit(drbg_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG)");
-MODULE_ALIAS_CRYPTO("stdrng");
-MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
MODULE_IMPORT_NS("CRYPTO_INTERNAL"); /* for jitterentropy */
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 9419d61d06027..4abb18bc2fa79 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -33,7 +33,6 @@
#include <crypto/acompress.h>
#include <crypto/sig.h>
#include <crypto/internal/cipher.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/simd.h>
#include "internal.h"
@@ -116,11 +115,6 @@ struct hash_test_suite {
unsigned int count;
};
-struct drbg_test_suite {
- const struct drbg_testvec *vecs;
- unsigned int count;
-};
-
struct akcipher_test_suite {
const struct akcipher_testvec *vecs;
unsigned int count;
@@ -148,7 +142,6 @@ struct alg_test_desc {
struct cipher_test_suite cipher;
struct comp_test_suite comp;
struct hash_test_suite hash;
- struct drbg_test_suite drbg;
struct akcipher_test_suite akcipher;
struct sig_test_suite sig;
struct kpp_test_suite kpp;
@@ -3481,90 +3474,6 @@ static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
return err;
}
-static int drbg_cavs_test(const struct drbg_testvec *test, const char *driver,
- u32 type, u32 mask)
-{
- int ret = -EAGAIN;
- struct crypto_rng *drng;
- unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
-
- if (!buf)
- return -ENOMEM;
-
- drng = crypto_alloc_rng(driver, type, mask);
- if (IS_ERR(drng)) {
- kfree_sensitive(buf);
- if (PTR_ERR(drng) == -ENOENT)
- return 0;
- printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
- "%s\n", driver);
- return PTR_ERR(drng);
- }
-
- crypto_rng_set_entropy(drng, test->entropy, test->entropylen);
- ret = crypto_rng_reset(drng, test->pers, test->perslen);
- if (ret) {
- printk(KERN_ERR "alg: drbg: Failed to instantiate rng\n");
- goto outbuf;
- }
-
- if (test->ent_reseed_len) {
- crypto_rng_set_entropy(drng, test->ent_reseed,
- test->ent_reseed_len);
- ret = crypto_rng_reset(drng, test->addtl_reseed,
- test->addtl_reseed_len);
- if (ret) {
- printk(KERN_ERR "alg: drbg: Failed to reseed rng\n");
- goto outbuf;
- }
- }
-
- ret = crypto_rng_generate(drng, test->addtla, test->addtllen,
- buf, test->expectedlen);
- if (ret < 0) {
- printk(KERN_ERR "alg: drbg: could not obtain random data for "
- "driver %s\n", driver);
- goto outbuf;
- }
-
- ret = crypto_rng_generate(drng, test->addtlb, test->addtllen,
- buf, test->expectedlen);
- if (ret < 0) {
- printk(KERN_ERR "alg: drbg: could not obtain random data for "
- "driver %s\n", driver);
- goto outbuf;
- }
-
- ret = memcmp(test->expected, buf, test->expectedlen);
-
-outbuf:
- crypto_free_rng(drng);
- kfree_sensitive(buf);
- return ret;
-}
-
-
-static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
- u32 type, u32 mask)
-{
- int err = 0;
- int i = 0;
- const struct drbg_testvec *template = desc->suite.drbg.vecs;
- unsigned int tcount = desc->suite.drbg.count;
-
- for (i = 0; i < tcount; i++) {
- err = drbg_cavs_test(&template[i], driver, type, mask);
- if (err) {
- printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
- i, driver);
- err = -EINVAL;
- break;
- }
- }
- return err;
-
-}
-
static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
const char *alg)
{
@@ -4644,13 +4553,6 @@ static const struct alg_test_desc alg_test_descs[] = {
}, {
.alg = "digest_null",
.test = alg_test_null,
- }, {
- .alg = "drbg_nopr_hmac_sha512",
- .test = alg_test_drbg,
- .fips_allowed = 1,
- .suite = {
- .drbg = __VECS(drbg_nopr_hmac_sha512_tv_template)
- }
}, {
.alg = "ecb(aes)",
.generic_driver = "ecb(aes-lib)",
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index 0ee15a8fae27b..0e196ebc933ab 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -119,29 +119,6 @@ struct aead_testvec {
int crypt_error;
};
-struct drbg_testvec {
- /* Instantiate */
- const unsigned char *entropy;
- size_t entropylen;
- const unsigned char *pers;
- size_t perslen;
-
- /* Reseed (optional) */
- const unsigned char *ent_reseed;
- size_t ent_reseed_len;
- const unsigned char *addtl_reseed;
- size_t addtl_reseed_len;
-
- /* Generate (twice) */
- const unsigned char *addtla;
- const unsigned char *addtlb;
- size_t addtllen;
-
- /* Expected output from last call to Generate */
- const unsigned char *expected;
- size_t expectedlen;
-};
-
struct akcipher_testvec {
const unsigned char *key;
const unsigned char *m;
@@ -23755,201 +23732,6 @@ static const struct aead_testvec aegis128_tv_template[] = {
},
};
-static const struct drbg_testvec drbg_nopr_hmac_sha512_tv_template[] = {
- /*
- * Borrowed from the first applicable test vector from ACVP:
- * https://github.com/usnistgov/ACVP-Server/blob/v1.1.0.33/gen-val/json-files/hmacDRBG-1.0/prompt.json#L4596
- * https://github.com/usnistgov/ACVP-Server/blob/v1.1.0.33/gen-val/json-files/hmacDRBG-1.0/expectedResults.json#L986
- */
- {
- /* .entropy = ACVP entropyInput || nonce */
- .entropy = "\x47\x28\x33\x05\x82\xE8\xA7\x58\x05\xBD\x07\x9E"
- "\xDB\x59\x87\x08\x3B\x82\x40\x70\xA1\xB7\x33\x4F"
- "\x0F\x53\xBE\xF6\x98\x75\xFA\x21\x00\x04\xBC\x58"
- "\x9B\xB1\xB3\xBC\x2A\xF6\xA4\x2A\xE1\xB3\x65\x24"
- "\xA8\xEE\x56\x70\x5E\x28\x06\x04\x80\xCE\xB7\x36"
- "\xA4\xD1\x4E\xAA\xE7\xE8\x51\x40\x7D\x30\xF7\x91"
- "\xF2\x9E\x98\xA7\xBB\xB3\x1D\xC6\x8A\x62\xC7\xE7"
- "\x1F\xE1\x0A\x52\x45\x39\x88\x92\x43\xA6\x5B\xC3"
- "\x9D\x60\xDE\xFE\x79\xEF\x87\x6F\xD5\x76\x51\x69"
- "\x7B\x4C\x3D\x08\x60\xFA\xDC\x00\x94\xEC\x0A\xC5"
- "\xE7\xCB\x30\x05\x9F\xCC\x07\x44\x07\x14\xF4\xF9"
- "\xBC\x7D\xC0\x66\x63\x5B\xD3\x2A\xA7\xF2\x1D\x75"
- "\x3F\x28\x5F\x4A\xEB\x63\xD7\x92\x5A\x9A\x7C\x3A"
- "\x56\xEA\xCB\xA9\xA0\xF9\x5B\x99\xC2\x7D\x31\xBF"
- "\x44\xC7\x64\x6B\x7E\x64\x60\x64\x05\x86\xF0\x6B"
- "\x76\xA7\x3E\x63\xAD\xB6\x76\xED\x3D\x05\x2E\xC7"
- "\xC7\x52\x8F\x07\x56\x23\xFC\x2F\x93\xD5\xF2\x29"
- "\xC6\x84\x48\xD1\x88\xB9\x3F\x84\xB2\x93\xFC\x2F"
- "\x00\xB1\xBC\xBE\xAC\xC4\x94\x36\xF1\x2B\xF0\xC7"
- "\x36\xE8\x1D\x45\x0A\xA2\xFE\x72\xD7\x3E\x15\x6A"
- "\x74\x23\xB2\xD1\x3C\x20\xF2\xB7\x19\xC5\xF0\x74"
- "\x69\x06\xD1\x92\x47\xC9\x68\xDC\xEE\xBC\xF4\x3A"
- "\x8B\x7C\xA4\xA4\x4A\x15\xF4\xF0\x26\x26\xC5\x7D"
- "\x57\xDC\x00\x59\x07\xDF\x84\x2A\x23\xA9\xC1\xAF"
- "\x47\x49\x88\xCC\x2F\x3B\x90\x39\xA0\x09\xAE\x3C"
- "\x79\xF9\x97\x9D\xEF\x13\x1D\x2B\xB6\x18\xDB\xCF"
- "\x95\x98\x17\x7F\xF6\x95\x44\x3A\x40\x90\x63\x16"
- "\x70\x38\x22\xC5\xD8\xE4\x57\xA0\x8E\x51\x6B\xED"
- "\x03\x18\xC6\x74\xFA\xCA\xF2\xD5\xB2\x5A\x0C\x02"
- "\x48\x9F\x70\x0B\x1C\x0A\xD1\xD6\x4F\x3F\x70\x3C"
- "\x1A\x62\x29\x63\xD0\x92\x76\x30\x7C\xB9\x54\xEC"
- "\xF6\x92\xA3\x11\x66\xB2\x56\xE0\x75\x3D\x27\x01",
- .entropylen = 384,
- .pers = "\x03\x75\x33\x7B\x6B\xE5\x14\xAF\x0E\x43\x33\xCC\xD3"
- "\xF4\xF0\x8B\x8A\xCC\xFE\x95\xC1\x20\xB9\x56\x3D\x2C"
- "\x34\xC7\xA1\x4C\xBC\xDC\x0A\x8D\xBE\x68\x28\x89\x2A"
- "\x92\x10\x05\x4E\xF9\xE2\x51\xF7\x4F\xF4\x48\x76\xC9"
- "\xCE\xA8\x6D\xC1\xDE\x5C\x05\x95\x77\x24\xB4\x5D\x3D"
- "\x16\x1D\xCB\x43\xE5\xD3\x01\x96\xCC\x3E\x2E\xE1\x97"
- "\xB3\x42\xC2\xAB\xEC\x56\xA9\xF9\xF2\x28\x59\x01\x4E"
- "\xFC\x8A\xC0\x5E\x4E\x33\x30\x91\x96\x93\xBA\xFA\xE1"
- "\x9F\x20\xC3\xC1\xD1\xC6\xC3\x2C\x59\x8F\x56\xD5\x73"
- "\xE8\x8D\xCF\xAC\xB1\x85\x3E\xC7\x73\x21\x59\x8D\x0F"
- "\xF4\xA4\xC4\x0C\xD2\x18\x81\x5F\x3E\x37\xC9\x9F\xD9"
- "\xDE\x3F\x15\x6F\xAC\x1A\xEC\x5E\x28\xD5\x56\xA2\x65"
- "\xD2\x7C\x41\xDE\x57\x8C\x60\xAB\xA5\x03\x42\xC8\x3C"
- "\x70\xC2\xD1\x11\x62\x25\x4E\x17\x58\xBB\x08\x51\x79"
- "\xE6\xED\xBA\x9A\xA7\x07\xD5\x0E\x89\x43\x31\x4F\x99"
- "\xEE\xED\xF1\x36\xFA\x1E\xC0\x25\x01\xDA\x19\xC2\x7D"
- "\x5D\x78\x74\x5C\xC0\x72\x2E\xF1\x7B\x4E\x9C\xDB\xFE"
- "\x60\x89\x62\x71\x9C\xEA\xD3\xDF\x82\xC7\x8B\xB4\x7B"
- "\x7B\x7F\x6A\x62\x3C\x57\x76\xA5\x67\x5F\x70\xFB\xE0"
- "\x1B\x23\x79\x71\xB5\x7C\xEA\x76\x99",
- .perslen = 256,
-
- .ent_reseed = "\xE0\x5B\x69\xC5\xF9\xD4\x5A\x1F\xC1\x71\x0C"
- "\x37\x6F\xFE\x31\xE0\xEF\x3E\x9B\xD5\x46\x43"
- "\xA2\x15\xFA\x86\x75\x1C\x95\x9F\xE6\xD6\x41"
- "\x50\x36\x0F\x67\x68\x4A\x72\x32\x85\xB0\xCB"
- "\xA4\x0D\x1F\xA2\x43\xCA\x30\xF1\x42\xF8\xC4"
- "\x17\x6A\xD1\x2D\x43\x46\x8C\xA5\x72\x3C\xB1"
- "\x44\x8E\xA1\x75\xAA\x20\x30\xDD\xCD\x0B\x5A"
- "\x0D\xE6\x28\xCA\xBC\xA9\x3B\x11\x23\x88\x85"
- "\xDF\xD8\x84\x11\x89\x7A\x4F\x00\x90\x0B\xD8"
- "\x8A\x35\xE9\x5F\xEC\x05\x42\x15\xCA\x7E\xA3"
- "\xEF\xEF\xE3\xB7\xBE\x96\x8C\x36\x7D\x15\x3C"
- "\x7A\x78\x00\x61\xAF\x62\x45\xA7\x4B\xAE\x4A"
- "\xFD\xC9\xE0\x89\x53\x36\x71\x8F\x38\xC4\x00"
- "\x57\xD9\xE6\xC1\xEC\xBF\xF7\x4B\x3F\x55\xD6"
- "\x54\x15\x72\xB2\x23\x76\xD1\x4E\x8E\x7E\xFB"
- "\xC8\xD6\xA4\xA4\x7E\x8E\xD8\x76\xD3\xEB\x90"
- "\x90\xEB\xB3\x84\x26\x34\x93\x36\xCA\xA9\x12"
- "\xD3\x6D\x84\x07\xE1\x0E\xE7\x63\x24\x54\x90"
- "\x42\x8C\x6B\xE7\x21\x53\x2D\x16\xE9\x68\xA9"
- "\xC2\x9A\x7A\x93\x31\x5E\x35\x72\xE2\x0F\x3D"
- "\x55\x41\x8C\xC5\xD1\xBB\xEE\x5F\x3C\x95\x52"
- "\x2A\x65\x47\xB6\x84\x6A\x05\x19\xD9\xE7\x68"
- "\x15\xFA\x49\xD9\x9D\xFD\x47\x9F\xB9\xA6\xBB"
- "\xA8\xD4\x22\x6C\x8B\x59\x47\xEF\xD1\xD0\xBF"
- "\xBC\xE4\x53\x31\x2F\xA5\xD4\x2C\x89\xCA\xE5"
- "\x29\x64\xF8\x51\x2A\x02\xDE\x31\x0D\x54\x0E"
- "\x0E\xB8\x78\xE6\x2A\x3E\x31\xA2\xA4\xCD\x91"
- "\x79\xF2\x9B\x04\xA0\xDB\x78\xAC\x0D\xB5\xCA"
- "\x60\x4C\x08\x96\xCA\x8A\xE9\x93\x9F\x62\x38"
- "\xAE",
- .ent_reseed_len = 320,
- .addtl_reseed = "\xD5\x46\x71\x38\x46\xE0\xC1\x27\x2C\xF1\x07"
- "\xDD\x29\x73\xD7\xF4\x5A\x3A\xE0\x99\x98\x0A"
- "\xEB\xA5\x9E\x2E\x49\x21\x7B\x18\xC0\xD8\x3D"
- "\xEE\x49\xF9\x52\x7C\x55\x5E\x5E\x06\xC2\x7E"
- "\x34\x3A\xA5\xB7\x78\x21\xC1\xB8\x8B\x4E\x07"
- "\x1F\x3F\xC4\xB4\x9B\x3F\x20\x2D\xEE\x70\x3B"
- "\x18\xCF\x2B\x50\x15\x1B\xF3\x6C\xE7\x9F\x2A"
- "\x2B\x69\x53\xCA\x88\x41\xA9\x07\x31\x14\x55"
- "\xBD\x75\x49\x68\x98\x48\xCA\x46\xA5\xEC\xAA"
- "\x9D\x8E\x6F\x40\xBA\xCA\xC8\xE9\x9F\xA4\xC5"
- "\x94\x89\x2C\x4D\xE4\x0A\x66\xD3\xDB\x1A\xD9"
- "\xA7\x3F\x6B\x0A\xE0\xE4\xDC\x0B\x8B\x64\xBF"
- "\xB4\x95\xA1\xAE\x92\xA8\x7C\xE2\x4B\xED\xFD"
- "\xFD\xE0\x54\x48\x7C\x25\xD6\xD1\x0A\xAB\x5E"
- "\x33\x2F\x1D\xD3\x62\x47\xAB\x35\x8C\xA1\xC2"
- "\x75\xDD\x75\xCA\x09\xE1\x38\xDE\x87\x79\x0C"
- "\xD7\x5D\x3E\x6D\x28\x8F\x12\x98\x2C\x26\x34"
- "\x91\x0B\x6B\xB7\x73",
- .addtl_reseed_len = 192,
-
- .addtla = "\xC8\xE1\x03\x59\xEA\x9F\xD3\x1F\xCC\xCB\x5A\x3E"
- "\x23\xDB\x47\x75\x1B\x3A\x6C\x0B\xED\xE6\xC0\xB6"
- "\x4B\x82\x53\x5B\x6D\xEE\x2B\x97\x0F\x59\x07\xA4"
- "\xFE\xE2\x26\x4F\xFF\xF7\x46\xAF\x62\xC4\x42\xE8"
- "\x06\xFA\x1F\xAA\x66\xF3\xA4\xCF\x85\x02\x3C\x11"
- "\xEF\xD2\x16\x13\x7A\xBD\x03\x66\xC3\x4D\x6F\x3A"
- "\xE5\xD3\xFF\x92\xB6\x45\xB8\x88\x94\x42\x2E\x84"
- "\x02\xA5\x54\x12\xBF\xCB\xF1\x6E\x1C\x0C\x23\xFE"
- "\x8A\xFD\xF5\x1A\x4C\xD6\x2A\x34\x7F\x21\x50\xBB"
- "\x06\x64\x9A\x77\x70\x59\x1D\x12\xD1\xA0\x10\x70"
- "\xD7\x4F\x3C\xEE\x82\xEF\x5B\x35\x8F\x05\xF6\x51"
- "\xBC\x28\xE1\xB1\x54\xFF\x25\x12\x16\x2C\x62\xFC"
- "\xB9\x74\x5E\x78\x41\xB2\x04\x80\x4E\xB1\x43\x2E"
- "\x88\x7F\x34\xA4\x33\x66\xE8\x68\x60\x54\xEB\xCE"
- "\xD1\x5F\xC4\xD6\x21\x5E\x22\x1A\x7E\xC5\x6D\xB7"
- "\x93\x8F\x9C\x77\x6E\x56\xA5\xA8\xF7\xB2\x10\x19",
- .addtlb = "\xB8\x1E\x9E\xE2\xB3\xE4\x04\x43\x51\x7B\x96\x32"
- "\xAC\x95\xF2\x1E\x5E\x7A\xBF\x68\xE3\x7A\xCE\xE5"
- "\x2B\x3B\xB0\x34\x7F\xE1\xB5\x37\x3C\x5B\xD2\x6B"
- "\x17\xF6\x18\xAF\x7C\x01\xA5\x84\xFE\x07\x0B\x46"
- "\xCC\x96\x61\xAB\xCD\x81\x95\x8A\x8A\xB6\xD8\xCC"
- "\x94\x80\x45\xF6\xFF\x95\x3A\xB8\xDC\xBF\xB4\xBF"
- "\x26\x8C\xE9\x79\x05\x58\x9C\x03\x08\x45\xB5\xC4"
- "\xD8\xB4\xCD\x76\x13\xAE\x2B\xCC\xB5\x3E\x3C\x65"
- "\x7A\xAA\xDC\x9B\x0B\x13\x8B\x82\x5A\x39\x60\x9A"
- "\xF7\xA8\x38\xB5\x83\x8E\x0B\xD1\xE6\xBF\xA1\xDC"
- "\x30\x45\xCC\x67\x41\x0F\xF9\x86\x27\xE0\x22\x3E"
- "\x0D\x1F\x92\x13\x16\x9B\x84\x79\x91\xFE\xBC\xDF"
- "\x15\x6C\xDC\xAE\xC5\x64\x46\x9C\xE8\xEA\xBB\x9D"
- "\x27\xA2\x1E\xDF\xB2\xF2\x98\xB4\x88\x4E\x22\x5F"
- "\x3C\xD0\x35\x2C\x5C\x89\xC7\xEC\xE3\xF3\x09\x60"
- "\xEF\xAC\x78\xBF\x94\xAA\x8C\x30\x7F\xCF\xE4\x4B",
- .addtllen = 192,
-
- .expected = "\x93\xFF\x4F\x4A\xA7\xE0\xFC\x3B\xCF\xCE\x57\xCD"
- "\xFD\xE9\x94\x6D\x0D\x45\x7E\xA3\x98\xBB\xE6\x54"
- "\x36\xF9\x92\xE6\xBB\xC5\x93\x16\x69\x35\x01\xF0"
- "\x5A\xE2\x43\xFC\x73\x7C\xA3\x5C\x5B\x49\x72\x69"
- "\x6A\xC4\xB6\xD4\xB2\x48\x27\x72\xCA\xE3\xF3\xB8"
- "\xD6\x95\x9F\x39\xC8\xD7\x72\xAF\xC2\x7C\x75\xE5"
- "\xA4\xF7\x52\x4F\xDF\x80\x75\xCA\x4B\xFA\x75\x9A"
- "\x7A\x8D\x48\x94\x30\x1C\x82\x5E\xD6\x3F\xF1\x78"
- "\x84\xAA\x8D\x8B\x4F\x6A\x20\x12\xA2\x65\xC5\x02"
- "\x32\xA1\xE4\x6B\x86\x2F\xCF\x92\xCD\x01\x55\xF7"
- "\xB8\xAB\xC3\x2C\x42\xC3\xFD\x9B\x59\x2D\x47\x8E"
- "\xB6\x8D\xE7\x04\x2E\x67\xD9\x07\x14\xA3\xF2\x74"
- "\x79\x9C\xAB\xC6\xD6\x52\x3E\x91\x81\xA4\x3C\x9A"
- "\x3E\x10\x1E\xD0\x28\xBC\x1C\x50\xF0\xB6\xEC\x01"
- "\xE5\x40\x16\x08\xB5\x58\xE0\xC4\xC2\x9A\xBB\x13"
- "\xAB\x10\x4B\x07\x24\x09\xEB\xF9\x5E\xAA\x3E\x3A"
- "\x25\x34\x5B\x97\x92\xF9\x46\x8A\x8E\x5A\x06\x9C"
- "\x2B\x1C\x8E\x47\x19\xC3\x3B\x14\x8A\xC1\xEB\xF7"
- "\xB0\xA2\x05\xE0\x70\x12\x88\x21\xFF\xC0\x35\x6D"
- "\xE9\x08\x7E\x11\x6E\xD7\x16\x48\x24\x43\xAF\x33"
- "\xA3\x48\x44\x91\xC5\x32\x1D\x87\xF6\x9B\x10\x1C"
- "\xA4\x7A\x74\x23\xB3\xFC\xB9\x87\x08\xE6\x9A\xEF"
- "\xD5\x93\x82\x17\xD4\x78\xDA\x46\x34\xC2\x61\x8C"
- "\xB7\x53\x89\xC4\x8A\xD8\xA0\x2E\xCE\xCA\x24\x16"
- "\xF0\x18\x7F\xC3\x12\x3F\xD0\xB1\xEF\x37\x99\xA8"
- "\x04\x1F\x76\x50\x81\x08\xCD\x4D\x43\xEF\x64\xB6"
- "\x03\x57\xB7\x5F\xDD\xF6\xBA\x34\xE2\x88\xE7\x1F"
- "\x62\xA5\xA4\x05\xEB\x1A\xFE\x0B\xFE\x74\x7D\x64"
- "\x29\x83\xE8\x0B\x97\x7D\x94\x5B\xF9\x3C\x8E\xC8"
- "\x6B\xCD\xAD\x63\x32\x6E\x00\xBF\x8E\x57\xF2\x32"
- "\x88\x53\x17\x40\xE3\xF8\xF8\xD9\xFD\xCD\x76\x84"
- "\xC6\xFD\xB1\x10\x40\xED\x75\xDD\xBD\x78\x8B\x0A"
- "\x61\x1E\xCC\xC4\x4F\x95\xF1\x2F\x8F\x5A\xF0\x12"
- "\x00\xCE\x75\xB8\xE9\xAB\x63\xC0\x7A\xF6\x9A\x47"
- "\xD2\x3C\xB0\xAD\xAF\x03\xDF\x25\xDD\x0C\x0F\xB6"
- "\x29\x09\x0F\x28\x5E\xA8\x67\xBB\xC9\x78\xBE\x12"
- "\xD8\xD6\xD0\x98\x82\x29\xA3\x82\xFB\x8E\x1C\x79"
- "\x28\x52\x22\x73\x3C\x6F\xB5\x33\xFF\x40\x26\x4C"
- "\x30\xE4\xE0\x39\x59\x72\x65\x79\x9F\xB7\x89\x87"
- "\x64\xAC\x45\x11\x0D\xDD\xC0\x44\x5E\x0D\xDF\xDB"
- "\x91\x42\x5F\x52\x7F\xBB\x66\xEE\x32\x90\x8F\x6F"
- "\xF8\xB9\xFE\xEA\x42\xFB\x60\x2B\xE3\xD9\xB2\xD1"
- "\x74\x37\x14\xC6\xDA\x68\xE6\x09",
- .expectedlen = 512,
- }
-};
-
/* Cast5 test vectors from RFC 2144 */
static const struct cipher_testvec cast5_tv_template[] = {
{
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 11/14] crypto: jitterentropy - Remove crypto_rng support
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (9 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 10/14] crypto: drbg - Remove crypto_rng support Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 12/14] crypto: jitterentropy - Remove the kconfig prompt Eric Biggers
` (2 subsequent siblings)
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Now that jitterentropy is used only via its library API instead of
crypto_rng, remove its obsolete crypto_rng support.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/Kconfig | 1 -
crypto/jitterentropy-kcapi.c | 106 +----------------------------------
crypto/testmgr.c | 4 --
3 files changed, 1 insertion(+), 110 deletions(-)
diff --git a/crypto/Kconfig b/crypto/Kconfig
index ed8612dcc5212..c9d842706b9ff 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1117,7 +1117,6 @@ config CRYPTO_DRBG
config CRYPTO_JITTERENTROPY
tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
select CRYPTO_LIB_SHA3
- select CRYPTO_RNG
help
CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c
index 2786303195950..1311df9882228 100644
--- a/crypto/jitterentropy-kcapi.c
+++ b/crypto/jitterentropy-kcapi.c
@@ -44,7 +44,6 @@
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/time.h>
-#include <crypto/internal/rng.h>
#include "jitterentropy.h"
#include "jitterentropy-kcapi.h"
@@ -302,117 +301,15 @@ void crypto_jent_free(struct jitterentropy *rng)
}
EXPORT_SYMBOL_NS_GPL(crypto_jent_free, "CRYPTO_INTERNAL");
-static void jent_kcapi_cleanup(struct crypto_tfm *tfm)
-{
- struct jitterentropy *rng = crypto_tfm_ctx(tfm);
-
- mutex_lock(&rng->jent_lock);
-
- memzero_explicit(&rng->hash_state, sizeof(rng->hash_state));
-
- if (rng->entropy_collector)
- jent_entropy_collector_free(rng->entropy_collector);
- rng->entropy_collector = NULL;
- mutex_unlock(&rng->jent_lock);
-}
-
-static int jent_kcapi_init(struct crypto_tfm *tfm)
-{
- struct jitterentropy *rng = crypto_tfm_ctx(tfm);
- int ret;
-
- ret = jent_init();
- if (ret)
- return ret;
-
- mutex_init(&rng->jent_lock);
-
- /* Use SHA3-256 as conditioner */
- sha3_256_init(&rng->hash_state);
-
- rng->entropy_collector = jent_entropy_collector_alloc(
- CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, &rng->hash_state);
- if (!rng->entropy_collector) {
- ret = -ENOMEM;
- goto err;
- }
-
- return 0;
-
-err:
- jent_kcapi_cleanup(tfm);
- return ret;
-}
-
-static int jent_kcapi_random(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *rdata, unsigned int dlen)
-{
- struct jitterentropy *rng = crypto_rng_ctx(tfm);
- int ret = 0;
-
- mutex_lock(&rng->jent_lock);
-
- ret = jent_read_entropy(rng->entropy_collector, rdata, dlen);
-
- if (ret == -3) {
- /* Handle permanent health test error */
- /*
- * If the kernel was booted with fips=1, it implies that
- * the entire kernel acts as a FIPS 140 module. In this case
- * an SP800-90B permanent health test error is treated as
- * a FIPS module error.
- */
- if (fips_enabled)
- panic("Jitter RNG permanent health test failure\n");
-
- pr_err("Jitter RNG permanent health test failure\n");
- ret = -EFAULT;
- } else if (ret == -2) {
- /* Handle intermittent health test error */
- pr_warn_ratelimited("Reset Jitter RNG due to intermittent health test failure\n");
- ret = -EAGAIN;
- } else if (ret == -1) {
- /* Handle other errors */
- ret = -EINVAL;
- }
-
- mutex_unlock(&rng->jent_lock);
-
- return ret;
-}
-
-static int jent_kcapi_reset(struct crypto_rng *tfm,
- const u8 *seed, unsigned int slen)
-{
- return 0;
-}
-
-static struct rng_alg jent_alg = {
- .generate = jent_kcapi_random,
- .seed = jent_kcapi_reset,
- .seedsize = 0,
- .base = {
- .cra_name = "jitterentropy_rng",
- .cra_driver_name = "jitterentropy_rng",
- .cra_priority = 100,
- .cra_ctxsize = sizeof(struct jitterentropy),
- .cra_module = THIS_MODULE,
- .cra_init = jent_kcapi_init,
- .cra_exit = jent_kcapi_cleanup,
- }
-};
-
static int __init jent_mod_init(void)
{
jent_testing_init();
- return crypto_register_rng(&jent_alg);
+ return 0;
}
static void __exit jent_mod_exit(void)
{
jent_testing_exit();
- crypto_unregister_rng(&jent_alg);
}
module_init(jent_mod_init);
@@ -421,4 +318,3 @@ module_exit(jent_mod_exit);
MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
MODULE_DESCRIPTION("Non-physical True Random Number Generator based on CPU Jitter");
-MODULE_ALIAS_CRYPTO("jitterentropy_rng");
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 4abb18bc2fa79..0e60702ab6a4c 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4923,10 +4923,6 @@ static const struct alg_test_desc alg_test_descs[] = {
.suite = {
.hash = __VECS(hmac_streebog512_tv_template)
}
- }, {
- .alg = "jitterentropy_rng",
- .fips_allowed = 1,
- .test = alg_test_null,
}, {
.alg = "krb5enc(cmac(camellia),cts(cbc(camellia)))",
.test = alg_test_aead,
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 12/14] crypto: jitterentropy - Remove the kconfig prompt
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (10 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 11/14] crypto: jitterentropy " Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 13/14] crypto: rng - Remove the rng algorithm type Eric Biggers
2026-10-18 20:46 ` [PATCH 14/14] crypto: stdrng - Make crypto_stdrng_get_bytes() take size_t Eric Biggers
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
There's no longer any need for CRYPTO_JITTERENTROPY to have a kconfig
prompt, since it's now library code that provides no functionality by
itself.
It can still be enabled by enabling CRYPTO_DRBG, which selects it.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/Kconfig b/crypto/Kconfig
index c9d842706b9ff..da7f2dca05d4a 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1115,7 +1115,7 @@ config CRYPTO_DRBG
It's otherwise redundant with the kernel's regular RNG.
config CRYPTO_JITTERENTROPY
- tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
+ tristate
select CRYPTO_LIB_SHA3
help
CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 13/14] crypto: rng - Remove the rng algorithm type
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (11 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 12/14] crypto: jitterentropy - Remove the kconfig prompt Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
2026-10-18 20:46 ` [PATCH 14/14] crypto: stdrng - Make crypto_stdrng_get_bytes() take size_t Eric Biggers
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
There are no users of crypto_rng remaining, so remove it.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
Documentation/crypto/api-rng.rst | 17 ---
Documentation/crypto/api-samples.rst | 37 ------
Documentation/crypto/api.rst | 1 -
Documentation/crypto/architecture.rst | 8 --
crypto/Kconfig | 9 --
crypto/Makefile | 1 -
crypto/rng.c | 157 ----------------------
include/crypto/internal/rng.h | 31 -----
include/crypto/rng.h | 182 --------------------------
include/linux/crypto.h | 3 +-
include/uapi/linux/cryptouser.h | 3 +-
11 files changed, 3 insertions(+), 446 deletions(-)
delete mode 100644 Documentation/crypto/api-rng.rst
delete mode 100644 crypto/rng.c
delete mode 100644 include/crypto/internal/rng.h
diff --git a/Documentation/crypto/api-rng.rst b/Documentation/crypto/api-rng.rst
deleted file mode 100644
index 23a94c0b272ee..0000000000000
--- a/Documentation/crypto/api-rng.rst
+++ /dev/null
@@ -1,17 +0,0 @@
-Random Number Generator (RNG)
-=============================
-
-Random Number Algorithm Definitions
------------------------------------
-
-.. kernel-doc:: include/crypto/rng.h
- :functions: rng_alg
-
-Crypto API Random Number API
-----------------------------
-
-.. kernel-doc:: include/crypto/rng.h
- :doc: Random number generator API
-
-.. kernel-doc:: include/crypto/rng.h
- :functions: crypto_alloc_rng crypto_rng_alg crypto_free_rng crypto_rng_generate crypto_rng_get_bytes crypto_rng_reset crypto_rng_seedsize
diff --git a/Documentation/crypto/api-samples.rst b/Documentation/crypto/api-samples.rst
index 388bb7d7a460b..8816565dd046f 100644
--- a/Documentation/crypto/api-samples.rst
+++ b/Documentation/crypto/api-samples.rst
@@ -148,40 +148,3 @@ Code Example For Use of Operational State Memory With SHASH
crypto_free_shash(alg);
return ret;
}
-
-
-Code Example For Random Number Generator Usage
-----------------------------------------------
-
-::
-
-
- static int get_random_numbers(u8 *buf, unsigned int len)
- {
- struct crypto_rng *rng = NULL;
- char *drbg = "stdrng";
- int ret;
-
- if (!buf || !len) {
- pr_debug("No output buffer provided\n");
- return -EINVAL;
- }
-
- rng = crypto_alloc_rng(drbg, 0, 0);
- if (IS_ERR(rng)) {
- pr_debug("could not allocate RNG handle for %s\n", drbg);
- return PTR_ERR(rng);
- }
-
- ret = crypto_rng_get_bytes(rng, buf, len);
- if (ret < 0)
- pr_debug("generation of random numbers failed\n");
- else if (ret == 0)
- pr_debug("RNG returned no data");
- else
- pr_debug("RNG returned %d bytes of data\n", ret);
-
- out:
- crypto_free_rng(rng);
- return ret;
- }
diff --git a/Documentation/crypto/api.rst b/Documentation/crypto/api.rst
index 8b2a905218862..bf5827eca88dc 100644
--- a/Documentation/crypto/api.rst
+++ b/Documentation/crypto/api.rst
@@ -8,7 +8,6 @@ Programming Interface
api-skcipher
api-aead
api-digest
- api-rng
api-akcipher
api-sig
api-kpp
diff --git a/Documentation/crypto/architecture.rst b/Documentation/crypto/architecture.rst
index ec2e99d99aff5..206cd9322dee3 100644
--- a/Documentation/crypto/architecture.rst
+++ b/Documentation/crypto/architecture.rst
@@ -13,8 +13,6 @@ cipher types:
- Message digest, including keyed message digest
-- Random number generation
-
- User space interface
Ciphers And Templates
@@ -155,8 +153,6 @@ applicable to a cipher, it is not displayed:
- compression for compression type transformations
- - rng for random number generator
-
- kpp for a Key-agreement Protocol Primitive (KPP) cipher such as
an ECDH or DH implementation
@@ -166,8 +162,6 @@ applicable to a cipher, it is not displayed:
- ivsize: IV size in bytes
-- seedsize: required size of seed data for random number generator
-
- digestsize: output size of the message digest
- geniv: IV generator (obsolete)
@@ -208,8 +202,6 @@ the aforementioned cipher types:
- CRYPTO_ALG_TYPE_AHASH Asynchronous multi-block hash
-- CRYPTO_ALG_TYPE_RNG Random Number Generation
-
- CRYPTO_ALG_TYPE_AKCIPHER Asymmetric cipher
- CRYPTO_ALG_TYPE_SIG Asymmetric signature
diff --git a/crypto/Kconfig b/crypto/Kconfig
index da7f2dca05d4a..01fe01656d442 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -98,15 +98,6 @@ config CRYPTO_HASH2
tristate
select CRYPTO_ALGAPI2
-config CRYPTO_RNG
- tristate
- select CRYPTO_RNG2
- select CRYPTO_ALGAPI
-
-config CRYPTO_RNG2
- tristate
- select CRYPTO_ALGAPI2
-
config CRYPTO_AKCIPHER2
tristate
select CRYPTO_ALGAPI2
diff --git a/crypto/Makefile b/crypto/Makefile
index 8386d55a9755e..b5256119d035a 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -156,7 +156,6 @@ obj-$(CONFIG_CRYPTO_LZ4) += lz4.o
obj-$(CONFIG_CRYPTO_LZ4HC) += lz4hc.o
obj-$(CONFIG_CRYPTO_XXHASH) += xxhash_generic.o
obj-$(CONFIG_CRYPTO_842) += 842.o
-obj-$(CONFIG_CRYPTO_RNG2) += rng.o
obj-$(CONFIG_CRYPTO_DRBG) += drbg.o
obj-$(CONFIG_CRYPTO_JITTERENTROPY) += jitterentropy_rng.o
CFLAGS_jitterentropy.o = -O0
diff --git a/crypto/rng.c b/crypto/rng.c
deleted file mode 100644
index be4873bec679b..0000000000000
--- a/crypto/rng.c
+++ /dev/null
@@ -1,157 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Cryptographic API.
- *
- * RNG operations.
- *
- * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
- * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
- */
-
-#include <crypto/internal/rng.h>
-#include <linux/atomic.h>
-#include <linux/cryptouser.h>
-#include <linux/err.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/mutex.h>
-#include <linux/random.h>
-#include <linux/seq_file.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <net/netlink.h>
-
-#include "internal.h"
-
-int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen)
-{
- u8 *buf = NULL;
- int err;
-
- if (!seed && slen) {
- buf = kmalloc(slen, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
- err = get_random_bytes_wait(buf, slen);
- if (err)
- goto out;
- seed = buf;
- }
-
- err = crypto_rng_alg(tfm)->seed(tfm, seed, slen);
-out:
- kfree_sensitive(buf);
- return err;
-}
-EXPORT_SYMBOL_GPL(crypto_rng_reset);
-
-static int crypto_rng_init_tfm(struct crypto_tfm *tfm)
-{
- return 0;
-}
-
-static unsigned int seedsize(struct crypto_alg *alg)
-{
- struct rng_alg *ralg = container_of(alg, struct rng_alg, base);
-
- return ralg->seedsize;
-}
-
-static int __maybe_unused crypto_rng_report(
- struct sk_buff *skb, struct crypto_alg *alg)
-{
- struct crypto_report_rng rrng = {
- .type = "rng",
- };
-
- rrng.seedsize = seedsize(alg);
-
- return nla_put(skb, CRYPTOCFGA_REPORT_RNG, sizeof(rrng), &rrng);
-}
-
-static void __maybe_unused crypto_rng_show(struct seq_file *m,
- struct crypto_alg *alg)
-{
- seq_printf(m, "type : rng\n");
- seq_printf(m, "seedsize : %u\n", seedsize(alg));
-}
-
-static const struct crypto_type crypto_rng_type = {
- .extsize = crypto_alg_extsize,
- .init_tfm = crypto_rng_init_tfm,
-#ifdef CONFIG_PROC_FS
- .show = crypto_rng_show,
-#endif
-#if IS_ENABLED(CONFIG_CRYPTO_USER)
- .report = crypto_rng_report,
-#endif
- .maskclear = ~CRYPTO_ALG_TYPE_MASK,
- .maskset = CRYPTO_ALG_TYPE_MASK,
- .type = CRYPTO_ALG_TYPE_RNG,
- .tfmsize = offsetof(struct crypto_rng, base),
- .algsize = offsetof(struct rng_alg, base),
-};
-
-struct crypto_rng *crypto_alloc_rng(const char *alg_name, u32 type, u32 mask)
-{
- return crypto_alloc_tfm(alg_name, &crypto_rng_type, type, mask);
-}
-EXPORT_SYMBOL_GPL(crypto_alloc_rng);
-
-static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data,
- unsigned int len)
-{
-}
-
-int crypto_register_rng(struct rng_alg *alg)
-{
- struct crypto_alg *base = &alg->base;
-
- if (alg->seedsize > PAGE_SIZE / 8)
- return -EINVAL;
-
- base->cra_type = &crypto_rng_type;
- base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK;
- base->cra_flags |= CRYPTO_ALG_TYPE_RNG;
-
- if (!alg->set_ent)
- alg->set_ent = rng_default_set_ent;
-
- return crypto_register_alg(base);
-}
-EXPORT_SYMBOL_GPL(crypto_register_rng);
-
-void crypto_unregister_rng(struct rng_alg *alg)
-{
- crypto_unregister_alg(&alg->base);
-}
-EXPORT_SYMBOL_GPL(crypto_unregister_rng);
-
-int crypto_register_rngs(struct rng_alg *algs, int count)
-{
- int i, ret;
-
- for (i = 0; i < count; i++) {
- ret = crypto_register_rng(algs + i);
- if (ret) {
- crypto_unregister_rngs(algs, i);
- return ret;
- }
- }
-
- return 0;
-}
-EXPORT_SYMBOL_GPL(crypto_register_rngs);
-
-void crypto_unregister_rngs(struct rng_alg *algs, int count)
-{
- int i;
-
- for (i = count - 1; i >= 0; --i)
- crypto_unregister_rng(algs + i);
-}
-EXPORT_SYMBOL_GPL(crypto_unregister_rngs);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("Random Number Generator");
diff --git a/include/crypto/internal/rng.h b/include/crypto/internal/rng.h
deleted file mode 100644
index 8c9f560d6449c..0000000000000
--- a/include/crypto/internal/rng.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- * RNG: Random Number Generator algorithms under the crypto API
- *
- * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
- * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
- */
-
-#ifndef _CRYPTO_INTERNAL_RNG_H
-#define _CRYPTO_INTERNAL_RNG_H
-
-#include <crypto/algapi.h>
-#include <crypto/rng.h>
-
-int crypto_register_rng(struct rng_alg *alg);
-void crypto_unregister_rng(struct rng_alg *alg);
-int crypto_register_rngs(struct rng_alg *algs, int count);
-void crypto_unregister_rngs(struct rng_alg *algs, int count);
-
-static inline void *crypto_rng_ctx(struct crypto_rng *tfm)
-{
- return crypto_tfm_ctx(&tfm->base);
-}
-
-static inline void crypto_rng_set_entropy(struct crypto_rng *tfm,
- const u8 *data, unsigned int len)
-{
- crypto_rng_alg(tfm)->set_ent(tfm, data, len);
-}
-
-#endif
diff --git a/include/crypto/rng.h b/include/crypto/rng.h
index 463bbdce11c2c..087c04c118db6 100644
--- a/include/crypto/rng.h
+++ b/include/crypto/rng.h
@@ -9,56 +9,9 @@
#ifndef _CRYPTO_RNG_H
#define _CRYPTO_RNG_H
-#include <linux/atomic.h>
-#include <linux/container_of.h>
-#include <linux/crypto.h>
#include <linux/fips.h>
#include <linux/random.h>
-struct crypto_rng;
-
-/**
- * struct rng_alg - random number generator definition
- *
- * @generate: The function defined by this variable obtains a
- * random number. The random number generator transform
- * must generate the random number out of the context
- * provided with this call, plus any additional data
- * if provided to the call.
- * @seed: Seed or reseed the random number generator. With the
- * invocation of this function call, the random number
- * generator shall become ready for generation. If the
- * random number generator requires a seed for setting
- * up a new state, the seed must be provided by the
- * consumer while invoking this function. The required
- * size of the seed is defined with @seedsize .
- * @set_ent: Set entropy that would otherwise be obtained from
- * entropy source. Internal use only.
- * @seedsize: The seed size required for a random number generator
- * initialization defined with this variable. Some
- * random number generators does not require a seed
- * as the seeding is implemented internally without
- * the need of support by the consumer. In this case,
- * the seed size is set to zero.
- * @base: Common crypto API algorithm data structure.
- */
-struct rng_alg {
- int (*generate)(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int dlen);
- int (*seed)(struct crypto_rng *tfm, const u8 *seed, unsigned int slen);
- void (*set_ent)(struct crypto_rng *tfm, const u8 *data,
- unsigned int len);
-
- unsigned int seedsize;
-
- struct crypto_alg base;
-};
-
-struct crypto_rng {
- struct crypto_tfm base;
-};
-
int __crypto_stdrng_get_bytes(void *buf, unsigned int len);
/**
@@ -89,139 +42,4 @@ static inline int crypto_del_default_rng(void)
}
#endif
-/**
- * DOC: Random number generator API
- *
- * The random number generator API is used with the ciphers of type
- * CRYPTO_ALG_TYPE_RNG (listed as type "rng" in /proc/crypto)
- */
-
-/**
- * crypto_alloc_rng() -- allocate RNG handle
- * @alg_name: is the cra_name / name or cra_driver_name / driver name of the
- * message digest cipher
- * @type: specifies the type of the cipher
- * @mask: specifies the mask for the cipher
- *
- * Allocate a cipher handle for a random number generator. The returned struct
- * crypto_rng is the cipher handle that is required for any subsequent
- * API invocation for that random number generator.
- *
- * For all random number generators, this call creates a new private copy of
- * the random number generator that does not share a state with other
- * instances. The only exception is the "krng" random number generator which
- * is a kernel crypto API use case for the get_random_bytes() function of the
- * /dev/random driver.
- *
- * Return: allocated cipher handle in case of success; IS_ERR() is true in case
- * of an error, PTR_ERR() returns the error code.
- */
-struct crypto_rng *crypto_alloc_rng(const char *alg_name, u32 type, u32 mask);
-
-static inline struct crypto_tfm *crypto_rng_tfm(struct crypto_rng *tfm)
-{
- return &tfm->base;
-}
-
-static inline struct rng_alg *__crypto_rng_alg(struct crypto_alg *alg)
-{
- return container_of(alg, struct rng_alg, base);
-}
-
-/**
- * crypto_rng_alg() - obtain 'struct rng_alg' pointer from RNG handle
- * @tfm: RNG handle
- *
- * Return: Pointer to 'struct rng_alg', derived from @tfm RNG handle
- */
-static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm)
-{
- return __crypto_rng_alg(crypto_rng_tfm(tfm)->__crt_alg);
-}
-
-/**
- * crypto_free_rng() - zeroize and free RNG handle
- * @tfm: cipher handle to be freed
- *
- * If @tfm is a NULL or error pointer, this function does nothing.
- */
-static inline void crypto_free_rng(struct crypto_rng *tfm)
-{
- crypto_destroy_tfm(tfm, crypto_rng_tfm(tfm));
-}
-
-/**
- * crypto_rng_generate() - get random number
- * @tfm: cipher handle
- * @src: Input buffer holding additional data, may be NULL
- * @slen: Length of additional data
- * @dst: output buffer holding the random numbers
- * @dlen: length of the output buffer
- *
- * This function fills the caller-allocated buffer with random
- * numbers using the random number generator referenced by the
- * cipher handle.
- *
- * Return: 0 function was successful; < 0 if an error occurred
- */
-static inline int crypto_rng_generate(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int dlen)
-{
- return crypto_rng_alg(tfm)->generate(tfm, src, slen, dst, dlen);
-}
-
-/**
- * crypto_rng_get_bytes() - get random number
- * @tfm: cipher handle
- * @rdata: output buffer holding the random numbers
- * @dlen: length of the output buffer
- *
- * This function fills the caller-allocated buffer with random numbers using the
- * random number generator referenced by the cipher handle.
- *
- * Return: 0 function was successful; < 0 if an error occurred
- */
-static inline int crypto_rng_get_bytes(struct crypto_rng *tfm,
- u8 *rdata, unsigned int dlen)
-{
- return crypto_rng_generate(tfm, NULL, 0, rdata, dlen);
-}
-
-/**
- * crypto_rng_reset() - re-initialize the RNG
- * @tfm: cipher handle
- * @seed: seed input data
- * @slen: length of the seed input data
- *
- * The reset function completely re-initializes the random number generator
- * referenced by the cipher handle by clearing the current state. The new state
- * is initialized with the caller provided seed or automatically, depending on
- * the random number generator type. (The SP800-90A DRBGs perform an automatic
- * seeding.) The seed is provided as a parameter to this function call. The
- * provided seed should have the length of the seed size defined for the random
- * number generator as defined by crypto_rng_seedsize.
- *
- * Return: 0 if the setting of the key was successful; < 0 if an error occurred
- */
-int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen);
-
-/**
- * crypto_rng_seedsize() - obtain seed size of RNG
- * @tfm: cipher handle
- *
- * The function returns the seed size for the random number generator
- * referenced by the cipher handle. This value may be zero if the random
- * number generator does not implement or require a reseeding. For example,
- * the SP800-90A DRBGs implement an automated reseeding after reaching a
- * pre-defined threshold.
- *
- * Return: seed size for the random number generator
- */
-static inline int crypto_rng_seedsize(struct crypto_rng *tfm)
-{
- return crypto_rng_alg(tfm)->seedsize;
-}
-
#endif
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index b7c97f1c47c92..bfad00a1339ca 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -31,7 +31,6 @@
#define CRYPTO_ALG_TYPE_KPP 0x00000008
#define CRYPTO_ALG_TYPE_ACOMPRESS 0x0000000a
#define CRYPTO_ALG_TYPE_SCOMPRESS 0x0000000b
-#define CRYPTO_ALG_TYPE_RNG 0x0000000c
#define CRYPTO_ALG_TYPE_HASH 0x0000000e
#define CRYPTO_ALG_TYPE_SHASH 0x0000000e
#define CRYPTO_ALG_TYPE_AHASH 0x0000000f
@@ -307,7 +306,7 @@ struct cipher_alg {
* @cra_type: Type of the cryptographic transformation. This is a pointer to
* struct crypto_type, which implements callbacks common for all
* transformation types. There are multiple options, such as
- * &crypto_skcipher_type, &crypto_ahash_type, &crypto_rng_type.
+ * &crypto_skcipher_type, &crypto_ahash_type.
* This field might be empty. In that case, there are no common
* callbacks. This is the case for: cipher.
* @cra_u: Callbacks implementing the transformation. This is a union of
diff --git a/include/uapi/linux/cryptouser.h b/include/uapi/linux/cryptouser.h
index db05e04199726..29f9c6c4290bb 100644
--- a/include/uapi/linux/cryptouser.h
+++ b/include/uapi/linux/cryptouser.h
@@ -49,7 +49,7 @@ enum crypto_attr_type_t {
CRYPTOCFGA_REPORT_BLKCIPHER, /* struct crypto_report_blkcipher */
CRYPTOCFGA_REPORT_AEAD, /* struct crypto_report_aead */
CRYPTOCFGA_REPORT_COMPRESS, /* struct crypto_report_comp */
- CRYPTOCFGA_REPORT_RNG, /* struct crypto_report_rng */
+ CRYPTOCFGA_REPORT_RNG, /* No longer supported, do not use. */
CRYPTOCFGA_REPORT_CIPHER, /* struct crypto_report_cipher */
CRYPTOCFGA_REPORT_AKCIPHER, /* struct crypto_report_akcipher */
CRYPTOCFGA_REPORT_KPP, /* struct crypto_report_kpp */
@@ -191,6 +191,7 @@ struct crypto_report_comp {
char type[CRYPTO_MAX_NAME];
};
+/* No longer supported, do not use. */
struct crypto_report_rng {
char type[CRYPTO_MAX_NAME];
unsigned int seedsize;
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH 14/14] crypto: stdrng - Make crypto_stdrng_get_bytes() take size_t
2026-10-18 20:46 [PATCH 00/14] crypto: Remove the unnecessary crypto_rng API Eric Biggers
` (12 preceding siblings ...)
2026-10-18 20:46 ` [PATCH 13/14] crypto: rng - Remove the rng algorithm type Eric Biggers
@ 2026-10-18 20:46 ` Eric Biggers
13 siblings, 0 replies; 15+ messages in thread
From: Eric Biggers @ 2026-10-18 20:46 UTC (permalink / raw)
To: linux-crypto, Herbert Xu; +Cc: Stephan Müller, Eric Biggers
Now that both underlying RNG APIs that crypto_stdrng_get_bytes() uses
take size_t, make crypto_stdrng_get_bytes() itself take size_t too.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
crypto/drbg.c | 2 +-
include/crypto/rng.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 831178f7bc001..faa39045bdc6b 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -555,7 +555,7 @@ static void crypto_put_default_rng(void)
crypto_default_rng_refcnt--;
}
-int __crypto_stdrng_get_bytes(void *buf, unsigned int len)
+int __crypto_stdrng_get_bytes(void *buf, size_t len)
{
int err;
diff --git a/include/crypto/rng.h b/include/crypto/rng.h
index 087c04c118db6..719401225f92b 100644
--- a/include/crypto/rng.h
+++ b/include/crypto/rng.h
@@ -12,7 +12,7 @@
#include <linux/fips.h>
#include <linux/random.h>
-int __crypto_stdrng_get_bytes(void *buf, unsigned int len);
+int __crypto_stdrng_get_bytes(void *buf, size_t len);
/**
* crypto_stdrng_get_bytes() - get cryptographically secure random bytes
@@ -25,7 +25,7 @@ int __crypto_stdrng_get_bytes(void *buf, unsigned int len);
* Context: May sleep
* Return: 0 function was successful; < 0 if an error occurred
*/
-static inline int crypto_stdrng_get_bytes(void *buf, unsigned int len)
+static inline int crypto_stdrng_get_bytes(void *buf, size_t len)
{
might_sleep();
if (fips_enabled)
--
2.56.0
^ permalink raw reply related [flat|nested] 15+ messages in thread