Re: [PATCH 6.1 1069/1887] crypto: jitter - replace LFSR with SHA3-256

Re: [PATCH 6.1 1069/1887] crypto: jitter - replace LFSR with SHA3-256

[Eric Biggers]

[+Cc linux-crypto@vger.kernel.org]

On Wed, Oct 28, 2026 at 05:52:45PM +0100, Greg Kroah-Hartman wrote:
> 6.1-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Stephan Müller <smueller@chronox.de>
> 
> [ Upstream commit bb897c55042e9330bcf88b4b13cbdd6f9fabdd5e ]
> 
> Using the kernel crypto API, the SHA3-256 algorithm is used as
> conditioning element to replace the LFSR in the Jitter RNG. All other
> parts of the Jitter RNG are unchanged.

For some reason this is going by on stable@ without linux-crypto@ being
Cc'ed, which is itself grounds for a nack.

But also this commit had known bugs that were fixed in follow-up commits
such as 735b72568c73, 908dffaf88a2, 9aa7e045f4af7, maybe others.

Now, these changes were all to the known-problematic and little-used
"FIPS RNG" instead of the regular one.  So, ideally, it shouldn't matter
much.  The thing is, before v7.1, certain things actually *did* pull
from the "FIPS RNG" even when the kernel wasn't booted with fips=1.

So pulling in known-broken commits to it is a little concerning.

- Eric

Re: [PATCH 6.1 1069/1887] crypto: jitter - replace LFSR with SHA3-256

[Sasha Levin]

> But also this commit had known bugs that were fixed in follow-up commits
> such as 735b72568c73, 908dffaf88a2, 9aa7e045f4af7, maybe others.

Queued the first one for 6.1. 908dffaf88a2 ("crypto: jitter - add oversampling
of noise source") is already in 6.1. 9aa7e045f4af ("crypto: jitter - Mark
intermediary memory as clean") only adds a KMSAN annotation and is not in 6.12
or 6.6 either, so I left it out.

-- 
Thanks,
Sasha

Re: [PATCH 6.1 1069/1887] crypto: jitter - replace LFSR with SHA3-256

[Eric Biggers]

On Fri, Oct 30, 2026 at 04:54:04PM -0400, Sasha Levin wrote:
> > But also this commit had known bugs that were fixed in follow-up commits
> > such as 735b72568c73, 908dffaf88a2, 9aa7e045f4af7, maybe others.
> 
> Queued the first one for 6.1. 908dffaf88a2 ("crypto: jitter - add oversampling
> of noise source") is already in 6.1. 9aa7e045f4af ("crypto: jitter - Mark
> intermediary memory as clean") only adds a KMSAN annotation and is not in 6.12
> or 6.6 either, so I left it out.

Okay, there are more too and this should just be reverted, but whatever.
It's clear stable is just doing its own thing here for some reason.

- Eric