Re: [PATCH 00/38] Fix and simplify the NIST DRBG implementation

[Herbert Xu <herbert@gondor.apana.org.au>]

On Sun, Apr 19, 2026 at 11:33:44PM -0700, Eric Biggers wrote:
> This series is intended to be taken through the cryptodev tree.  It can
> also be retrieved from:
> 
>     git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git drbg-v1
> 
> This series fixes and greatly simplifies crypto/drbg.c, i.e. the
> kernel's implementation of NIST SP800-90A.  This code isn't normally
> used, but it's sometimes used by people doing FIPS 140-3 certifications.
> 
> Note: this series is *not* meant to encourage using this code over
> random.c.  In fact, my recent commit 65b3c2f627851639 made "normal"
> systems stop using this code.  It's just that the reality is that this
> is in the kernel tree, it's been there for many years, and people are
> using it to get FIPS 140-3 certifications.  As long as that's the case,
> it might as well be fixed up and simplified.  Another reason to simplify
> this as much as possible is that for historical reasons it's accessible
> to unprivileged users via AF_ALG (even though it shouldn't be).  So I do
> think this is a clear step forwards, regardless of level of enthusiasm
> for FIPS, especially considering the massively negative diffstat.
> 
> Patches 1-5 begin with some bug fixes.  Fixes for CTR_DRBG and HASH_DRBG
> are included, despite that code being removed later in the series, so
> that they can be backported (though that is likely unused code anyway).
> 
> Patches 6-11 do some initial cleanups.
> 
> Patches 12-17 clean up the museum of DRBG variants to just support the
> HMAC-SHA512 DRBG only, dropping support for the others.  This is already
> the default variant, it makes sense that it's the default, and it's
> probably the only one actually being used on current kernels.  In any
> case, supporting more than one is pretty pointless.  See the patches for
> more details about why it makes sense to keep using this one.
> 
> Patches 18-33 contain many more cleanups, including switching from the
> crypto_shash API to the crypto library.
> 
> Patch 34 is a significant one: it starts adding 32 bytes from
> get_random_bytes() to every additional input string.  This is to work
> around the forward secrecy bug described in Woodage & Shumow (2018)
> (https://eprint.iacr.org/2018/349.pdf), and to ensure that random.c
> reseeds are actually reflected in drbg.c.  Of course, for FIPS 140-3
> this is irrelevant, but this is the right thing to do in practice, and
> it should make drbg.c quite a bit more robust in practice.  (This isn't
> particularly novel, either; BoringSSL does essentially this same thing.)
> 
> Patches 35-38 are some further cleanups, including some tweaks to when
> the formal reseeding happens.
> 
> Note: while the primary goal of this series is to fix and simplify this
> code, this series is also intended to preserve the FIPS 140-3
> "certifiable" property of crypto/drbg.c.  I.e. after this series, it
> should still be possible to get a FIPS 140-3 certification that covers
> it.  In fact it should become quite a bit easier, since there will be
> only one DRBG variant to worry about and the code will be much more
> straightforward.  If there's anything I missed, let me know.
> 
> Eric Biggers (38):
>   crypto: drbg - Fix returning success on failure in CTR_DRBG
>   crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
>   crypto: drbg - Fix ineffective sanity check
>   crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
>   crypto: drbg - Fix the fips_enabled priority boost
>   crypto: drbg - Remove always-enabled symbol CRYPTO_DRBG_HMAC
>   crypto: drbg - Remove broken commented-out code
>   crypto: drbg - Remove unhelpful helper functions
>   crypto: drbg - Remove obsolete FIPS 140-2 continuous test
>   crypto: drbg - Fold include/crypto/drbg.h into crypto/drbg.c
>   crypto: drbg - Remove import of crypto_cipher functions
>   crypto: drbg - Remove support for CTR_DRBG
>   crypto: drbg - Remove support for HASH_DRBG
>   crypto: drbg - Flatten the DRBG menu
>   crypto: testmgr - Add test for drbg_pr_hmac_sha512
>   crypto: testmgr - Update test for drbg_nopr_hmac_sha512
>   crypto: drbg - Remove support for HMAC-SHA256 and HMAC-SHA384
>   crypto: drbg - Simplify algorithm registration
>   crypto: drbg - De-virtualize drbg_state_ops
>   crypto: drbg - Move fixed values into constants
>   crypto: drbg - Embed V and C into struct drbg_state
>   crypto: drbg - Use HMAC-SHA512 library API
>   crypto: drbg - Remove drbg_core
>   crypto: drbg - Install separate seed functions for pr and nopr
>   crypto: drbg - Move module aliases to end of file
>   crypto: drbg - Consolidate "instantiate" logic and remove
>     drbg_state::C
>   crypto: drbg - Eliminate use of 'drbg_string' and lists
>   crypto: drbg - Simplify drbg_generate_long() and fold into caller
>   crypto: drbg - Put rng_alg methods in logical order
>   crypto: drbg - Fold drbg_instantiate() into drbg_kcapi_seed()
>   crypto: drbg - Separate "reseed" case in drbg_kcapi_seed()
>   crypto: drbg - Fold drbg_prepare_hrng() into drbg_kcapi_seed()
>   crypto: drbg - Simplify "uninstantiate" logic
>   crypto: drbg - Include get_random_bytes() output in additional input
>   crypto: drbg - Change DRBG_MAX_REQUESTS to 4096
>   crypto: drbg - Remove redundant reseeding based on random.c state
>   crypto: drbg - Clean up generation code
>   crypto: drbg - Clean up loop in drbg_hmac_update()
> 
>  Documentation/crypto/api-samples.rst          |    2 +-
>  Documentation/crypto/userspace-if.rst         |    2 +-
>  arch/m68k/configs/amiga_defconfig             |    2 -
>  arch/m68k/configs/apollo_defconfig            |    2 -
>  arch/m68k/configs/atari_defconfig             |    2 -
>  arch/m68k/configs/bvme6000_defconfig          |    2 -
>  arch/m68k/configs/hp300_defconfig             |    2 -
>  arch/m68k/configs/mac_defconfig               |    2 -
>  arch/m68k/configs/multi_defconfig             |    2 -
>  arch/m68k/configs/mvme147_defconfig           |    2 -
>  arch/m68k/configs/mvme16x_defconfig           |    2 -
>  arch/m68k/configs/q40_defconfig               |    2 -
>  arch/m68k/configs/sun3_defconfig              |    2 -
>  arch/m68k/configs/sun3x_defconfig             |    2 -
>  arch/mips/configs/decstation_64_defconfig     |    2 -
>  arch/mips/configs/decstation_defconfig        |    2 -
>  arch/mips/configs/decstation_r4k_defconfig    |    2 -
>  crypto/Kconfig                                |   40 +-
>  crypto/df_sp80090a.c                          |    8 +-
>  crypto/drbg.c                                 | 1800 +++--------------
>  crypto/testmgr.c                              |  143 +-
>  crypto/testmgr.h                              | 1262 ++++--------
>  drivers/crypto/xilinx/xilinx-trng.c           |    1 -
>  include/crypto/df_sp80090a.h                  |   25 +
>  include/crypto/drbg.h                         |  263 ---
>  include/crypto/internal/drbg.h                |   54 -
>  .../crypto/chacha20-s390/test-cipher.c        |    1 -
>  27 files changed, 728 insertions(+), 2903 deletions(-)
>  delete mode 100644 include/crypto/drbg.h
>  delete mode 100644 include/crypto/internal/drbg.h
> 
> 
> base-commit: c1f49dea2b8f335813d3b348fd39117fb8efb428
> -- 
> 2.53.0

All applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt