* [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use @ 2024-04-15 22:19 Hailey Mothershead 2024-04-15 22:49 ` Eric Biggers 2024-04-26 9:30 ` [PATCH v2 2/2] crypto: aead,cipher " Herbert Xu 0 siblings, 2 replies; 5+ messages in thread From: Hailey Mothershead @ 2024-04-15 22:19 UTC (permalink / raw) To: herbert; +Cc: davem, linux-crypto, linux-kernel, hailmo I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo@amazon.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 16991095270d..c4ece86c45bc 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index b47141ed4a9f..395f0c2fbb9f 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } -- 2.40.1 memsets removed and first patch in series dropped. ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use 2024-04-15 22:19 [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use Hailey Mothershead @ 2024-04-15 22:49 ` Eric Biggers 2024-04-16 19:14 ` [PATCH v2 2/2] crypto: aead, cipher " Mothershead, Hailey 2024-04-26 9:30 ` [PATCH v2 2/2] crypto: aead,cipher " Herbert Xu 1 sibling, 1 reply; 5+ messages in thread From: Eric Biggers @ 2024-04-15 22:49 UTC (permalink / raw) To: Hailey Mothershead; +Cc: herbert, davem, linux-crypto, linux-kernel On Mon, Apr 15, 2024 at 10:19:15PM +0000, Hailey Mothershead wrote: > I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding > cryptographic information should be zeroized once they are no longer > needed. Accomplish this by using kfree_sensitive for buffers that > previously held the private key. > > Signed-off-by: Hailey Mothershead <hailmo@amazon.com> > --- > crypto/aead.c | 3 +-- > crypto/cipher.c | 3 +-- > 2 files changed, 2 insertions(+), 4 deletions(-) > > diff --git a/crypto/aead.c b/crypto/aead.c > index 16991095270d..c4ece86c45bc 100644 > --- a/crypto/aead.c > +++ b/crypto/aead.c > @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > memcpy(alignbuffer, key, keylen); > ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); > - memset(alignbuffer, 0, keylen); > - kfree(buffer); > + kfree_sensitive(buffer); > return ret; > } > > diff --git a/crypto/cipher.c b/crypto/cipher.c > index b47141ed4a9f..395f0c2fbb9f 100644 > --- a/crypto/cipher.c > +++ b/crypto/cipher.c > @@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > memcpy(alignbuffer, key, keylen); > ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); > - memset(alignbuffer, 0, keylen); > - kfree(buffer); > + kfree_sensitive(buffer); > return ret; Well, the memset()s that you're removing already did the zeroization. This patch seems worthwhile as a code simplification, but please don't characterize it as a bug fix, because it's not. - Eric ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] crypto: aead, cipher - zeroize key buffer after use 2024-04-15 22:49 ` Eric Biggers @ 2024-04-16 19:14 ` Mothershead, Hailey 2024-04-17 6:13 ` Eric Biggers 0 siblings, 1 reply; 5+ messages in thread From: Mothershead, Hailey @ 2024-04-16 19:14 UTC (permalink / raw) To: Eric Biggers Cc: herbert@gondor.apana.org.au, davem@davemloft.net, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org > On 4/15/24, 3:50 PM, "Eric Biggers" <ebiggers@kernel.org <mailto:ebiggers@kernel.org>> wrote: > > On Mon, Apr 15, 2024 at 10:19:15PM +0000, Hailey Mothershead wrote: > > I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding > > cryptographic information should be zeroized once they are no longer > > needed. Accomplish this by using kfree_sensitive for buffers that > > previously held the private key. > > > > Signed-off-by: Hailey Mothershead <hailmo@amazon.com <mailto:hailmo@amazon.com>> > > --- > > crypto/aead.c | 3 +-- > > crypto/cipher.c | 3 +-- > > 2 files changed, 2 insertions(+), 4 deletions(-) > > > > diff --git a/crypto/aead.c b/crypto/aead.c > > index 16991095270d..c4ece86c45bc 100644 > > --- a/crypto/aead.c > > +++ b/crypto/aead.c > > @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, > > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > > memcpy(alignbuffer, key, keylen); > > ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); > > - memset(alignbuffer, 0, keylen); > > - kfree(buffer); > > + kfree_sensitive(buffer); > > return ret; > > } > > > > diff --git a/crypto/cipher.c b/crypto/cipher.c > > index b47141ed4a9f..395f0c2fbb9f 100644 > > --- a/crypto/cipher.c > > +++ b/crypto/cipher.c > > @@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, > > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > > memcpy(alignbuffer, key, keylen); > > ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); > > - memset(alignbuffer, 0, keylen); > > - kfree(buffer); > > + kfree_sensitive(buffer); > > return ret; > > > Well, the memset()s that you're removing already did the zeroization. This > patch seems worthwhile as a code simplification, but please don't characterize > it as a bug fix, because it's not. > > > - Eric kfree_sensitive uses memzero_explicit() instead of the memset()s used above. The memzero_explicit header states - * Note: usually using memset() is just fine (!), but in cases * where clearing out _local_ data at the end of a scope is * necessary, memzero_explicit() should be used instead in * order to prevent the compiler from optimising away zeroing. It accomplishes this by calling memset() and then adding a barrier. Since FIPS requires this data be zeroed out, and the current memset() and kfree() don't guarantee this, I do not think the commit message is misleading. I can clarify the message with the above information if that is preferred. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] crypto: aead, cipher - zeroize key buffer after use 2024-04-16 19:14 ` [PATCH v2 2/2] crypto: aead, cipher " Mothershead, Hailey @ 2024-04-17 6:13 ` Eric Biggers 0 siblings, 0 replies; 5+ messages in thread From: Eric Biggers @ 2024-04-17 6:13 UTC (permalink / raw) To: Mothershead, Hailey Cc: herbert@gondor.apana.org.au, davem@davemloft.net, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org On Tue, Apr 16, 2024 at 07:14:28PM +0000, Mothershead, Hailey wrote: > > On 4/15/24, 3:50 PM, "Eric Biggers" <ebiggers@kernel.org <mailto:ebiggers@kernel.org>> wrote: > > > > On Mon, Apr 15, 2024 at 10:19:15PM +0000, Hailey Mothershead wrote: > > > I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding > > > cryptographic information should be zeroized once they are no longer > > > needed. Accomplish this by using kfree_sensitive for buffers that > > > previously held the private key. > > > > > > Signed-off-by: Hailey Mothershead <hailmo@amazon.com <mailto:hailmo@amazon.com>> > > > --- > > > crypto/aead.c | 3 +-- > > > crypto/cipher.c | 3 +-- > > > 2 files changed, 2 insertions(+), 4 deletions(-) > > > > > > diff --git a/crypto/aead.c b/crypto/aead.c > > > index 16991095270d..c4ece86c45bc 100644 > > > --- a/crypto/aead.c > > > +++ b/crypto/aead.c > > > @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, > > > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > > > memcpy(alignbuffer, key, keylen); > > > ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); > > > - memset(alignbuffer, 0, keylen); > > > - kfree(buffer); > > > + kfree_sensitive(buffer); > > > return ret; > > > } > > > > > > diff --git a/crypto/cipher.c b/crypto/cipher.c > > > index b47141ed4a9f..395f0c2fbb9f 100644 > > > --- a/crypto/cipher.c > > > +++ b/crypto/cipher.c > > > @@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, > > > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); > > > memcpy(alignbuffer, key, keylen); > > > ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); > > > - memset(alignbuffer, 0, keylen); > > > - kfree(buffer); > > > + kfree_sensitive(buffer); > > > return ret; > > > > > > Well, the memset()s that you're removing already did the zeroization. This > > patch seems worthwhile as a code simplification, but please don't characterize > > it as a bug fix, because it's not. > > > > > > - Eric > > kfree_sensitive uses memzero_explicit() instead of the memset()s used > above. The memzero_explicit header states - > > * Note: usually using memset() is just fine (!), but in cases > * where clearing out _local_ data at the end of a scope is > * necessary, memzero_explicit() should be used instead in > * order to prevent the compiler from optimising away zeroing. > > It accomplishes this by calling memset() and then adding a barrier. Since > FIPS requires this data be zeroed out, and the current memset() and > kfree() don't guarantee this, I do not think the commit message is > misleading. I can clarify the message with the above information if that > is preferred. > It's heap data, not local data. So no, memzero_explicit() isn't actually needed here. It would convey the intent better, but it's not actually needed. - Eric ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use 2024-04-15 22:19 [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use Hailey Mothershead 2024-04-15 22:49 ` Eric Biggers @ 2024-04-26 9:30 ` Herbert Xu 1 sibling, 0 replies; 5+ messages in thread From: Herbert Xu @ 2024-04-26 9:30 UTC (permalink / raw) To: Hailey Mothershead; +Cc: davem, linux-crypto, linux-kernel On Mon, Apr 15, 2024 at 10:19:15PM +0000, Hailey Mothershead wrote: > I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding > cryptographic information should be zeroized once they are no longer > needed. Accomplish this by using kfree_sensitive for buffers that > previously held the private key. > > Signed-off-by: Hailey Mothershead <hailmo@amazon.com> > --- > crypto/aead.c | 3 +-- > crypto/cipher.c | 3 +-- > 2 files changed, 2 insertions(+), 4 deletions(-) Patch applied. Thanks. -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-26 9:30 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-04-15 22:19 [PATCH v2 2/2] crypto: aead,cipher - zeroize key buffer after use Hailey Mothershead 2024-04-15 22:49 ` Eric Biggers 2024-04-16 19:14 ` [PATCH v2 2/2] crypto: aead, cipher " Mothershead, Hailey 2024-04-17 6:13 ` Eric Biggers 2024-04-26 9:30 ` [PATCH v2 2/2] crypto: aead,cipher " Herbert Xu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox