[RESEND][PATCH] crypto: drbg - panic on continuous self test error

[RESEND][PATCH] crypto: drbg - panic on continuous self test error

[Stephan Mueller]

This patch adds a panic if the FIPS 140-2 self test error failed.
Note, that entire code is only executed with fips_enabled (i.e. when the
kernel is booted with fips=1. It is therefore not executed for 99.9% of
all user base.

As mathematically such failure cannot occur, this panic should never be
triggered. But to comply with NISTs current requirements, an endless
loop must be replaced with the panic.

When the new version of FIPS 140 will be released, this entire
continuous self test function will be ripped out as it will not be
needed any more.

This patch is functionally equivalent as implemented in ansi_cprng.c and drivers/char/random.c.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
 crypto/drbg.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index 9fb38a5..2c46d5e 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -222,15 +222,6 @@ static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
  * function. Thus, the function implicitly knows the size of the
  * buffer.
  *
- * The FIPS test can be called in an endless loop until it returns
- * true. Although the code looks like a potential for a deadlock, it
- * is not the case, because returning a false cannot mathematically
- * occur (except once when a reseed took place and the updated state
- * would is now set up such that the generation of new value returns
- * an identical one -- this is most unlikely and would happen only once).
- * Thus, if this function repeatedly returns false and thus would cause
- * a deadlock, the integrity of the entire kernel is lost.
- *
  * @drbg DRBG handle
  * @buf output buffer of random data to be checked
  *
@@ -257,6 +248,8 @@ static bool drbg_fips_continuous_test(struct drbg_state *drbg,
 		return false;
 	}
 	ret = memcmp(drbg->prev, buf, drbg_blocklen(drbg));
+	if (!ret)
+		panic("DRBG continuous self test failed\n");
 	memcpy(drbg->prev, buf, drbg_blocklen(drbg));
 	/* the test shall pass when the two compared values are not equal */
 	return ret != 0;
-- 
2.1.0

Re: [RESEND][PATCH] crypto: drbg - panic on continuous self test error

[Herbert Xu]

On Fri, Dec 05, 2014 at 10:40:21PM +0100, Stephan Mueller wrote:
> This patch adds a panic if the FIPS 140-2 self test error failed.
> Note, that entire code is only executed with fips_enabled (i.e. when the
> kernel is booted with fips=1. It is therefore not executed for 99.9% of
> all user base.
> 
> As mathematically such failure cannot occur, this panic should never be
> triggered. But to comply with NISTs current requirements, an endless
> loop must be replaced with the panic.
> 
> When the new version of FIPS 140 will be released, this entire
> continuous self test function will be ripped out as it will not be
> needed any more.
> 
> This patch is functionally equivalent as implemented in ansi_cprng.c and drivers/char/random.c.
> 
> Signed-off-by: Stephan Mueller <smueller@chronox.de>

Patch applied.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt