Re: [PATCH 00/11] Stop pulling DRBG code into non-FIPS kernels

[Herbert Xu <herbert@gondor.apana.org.au>]

On Wed, Mar 25, 2026 at 05:14:56PM -0700, Eric Biggers wrote:
> Most kernels have CRYPTO_FIPS=n but still include crypto/drbg.c and
> everything it depends on, including crypto/jitterentropy.c.
> 
> This dependency bloat happens because some kernel code gets random bytes
> from "stdrng" in the crypto_rng API instead of from get_random_bytes().
> (This is apparently done for FIPS certification reasons.)  Then, that
> pulls crypto/drbg.c to provide a "stdrng" implementation.
> 
> This series fixes the dependency bloat by making "stdrng" be used only
> in FIPS mode, and get_random_bytes_wait() be used otherwise.
> 
> This series is targeting cryptodev/master.
> 
> Eric Biggers (11):
>   crypto: rng - Add crypto_stdrng_get_bytes()
>   crypto: dh - Use crypto_stdrng_get_bytes()
>   crypto: ecc - Use crypto_stdrng_get_bytes()
>   crypto: geniv - Use crypto_stdrng_get_bytes()
>   crypto: hisilicon/hpre - Use crypto_stdrng_get_bytes()
>   crypto: intel/keembay-ocs-ecc - Use crypto_stdrng_get_bytes()
>   net: tipc: Use crypto_stdrng_get_bytes()
>   crypto: rng - Unexport "default RNG" symbols
>   crypto: rng - Make crypto_stdrng_get_bytes() use normal RNG in
>     non-FIPS mode
>   crypto: fips - Depend on CRYPTO_DRBG=y
>   crypto: rng - Don't pull in DRBG when CRYPTO_FIPS=n
> 
>  crypto/Kconfig                                |  9 +------
>  crypto/dh.c                                   |  8 +-----
>  crypto/ecc.c                                  | 11 +++-----
>  crypto/geniv.c                                |  8 +-----
>  crypto/rng.c                                  | 23 ++++++++++++-----
>  drivers/crypto/hisilicon/hpre/hpre_crypto.c   | 12 ++-------
>  .../crypto/intel/keembay/keembay-ocs-ecc.c    | 17 +++----------
>  include/crypto/rng.h                          | 25 ++++++++++++++++---
>  net/tipc/crypto.c                             | 13 ++--------
>  9 files changed, 53 insertions(+), 73 deletions(-)
> 
> 
> base-commit: f9bbd547cfb98b1c5e535aab9b0671a2ff22453a
> -- 
> 2.53.0

All applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt