[PATCH 26/38] crypto: drbg - Consolidate "instantiate" logic and remove drbg_state::C

[Eric Biggers <ebiggers@kernel.org>]

Currently some of the steps of "Instantiate the DRBG" occur in a
convoluted way in different places in the call stack:

drbg_instantiate()

    => drbg_seed(reseed=0) sets the raw HMAC key drbg_state::C to its
       correct initial value, and it sets the state value
       drbg_state::V to an *incorrect* initial value.

        => drbg_hmac_update(reseed=0) overwrites drbg_state::V with the
           correct initial value, then prepares the hmac_sha512_key
           drbg_state::key from the initial raw HMAC key drbg_state::C.

Later, each time the HMAC key is updated, drbg_hmac_update() also uses
drbg_state::C to temporarily store the new raw key.

Simplify all of this by:

    - Making drbg_instantiate() set the correct initial values of
      drbg_state::V and drbg_state::key.

    - Converting drbg_hmac_update() to generate the raw key in a
      temporary on-stack array instead of drbg_state::C.

    - Removing drbg_state::C.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/drbg.c | 38 +++++++++++++++-----------------------
 1 file changed, 15 insertions(+), 23 deletions(-)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index 439581d7bb83..7e3ab2f811b6 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -134,11 +134,10 @@ enum drbg_seed_state {
 
 struct drbg_state {
 	struct mutex drbg_mutex;	/* lock around DRBG */
 	u8 V[DRBG_STATE_LEN];		/* internal state -- 10.1.2.1 1a */
 	struct hmac_sha512_key key;	/* current key -- 10.1.2.1 1b */
-	u8 C[DRBG_STATE_LEN];		/* current key -- 10.1.2.1 1b */
 	/* Number of RNG requests since last reseed -- 10.1.2.1 1c */
 	size_t reseed_ctr;
 	size_t reseed_threshold;
 	enum drbg_seed_state seeded;		/* DRBG fully seeded? */
 	unsigned long last_seed_time;
@@ -158,21 +157,15 @@ static int drbg_uninstantiate(struct drbg_state *drbg);
 /******************************************************************
  * HMAC DRBG functions
  ******************************************************************/
 
 /* update function of HMAC DRBG as defined in 10.1.2.2 */
-static void drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
-			     int reseed)
+static void drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed)
 {
 	int i = 0;
 	struct hmac_sha512_ctx hmac_ctx;
-
-	if (!reseed) {
-		/* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
-		memset(drbg->V, 1, DRBG_STATE_LEN);
-		hmac_sha512_preparekey(&drbg->key, drbg->C, DRBG_STATE_LEN);
-	}
+	u8 new_key[DRBG_STATE_LEN];
 
 	for (i = 2; 0 < i; i--) {
 		/* first round uses 0x0, second 0x1 */
 		unsigned char prefix = DRBG_PREFIX0;
 		if (1 == i)
@@ -186,20 +179,21 @@ static void drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 
 			list_for_each_entry(input, seed, list)
 				hmac_sha512_update(&hmac_ctx, input->buf,
 						   input->len);
 		}
-		hmac_sha512_final(&hmac_ctx, drbg->C);
-		hmac_sha512_preparekey(&drbg->key, drbg->C, DRBG_STATE_LEN);
+		hmac_sha512_final(&hmac_ctx, new_key);
+		hmac_sha512_preparekey(&drbg->key, new_key, DRBG_STATE_LEN);
 
 		/* 10.1.2.2 step 2 and 5 -- HMAC for V */
 		hmac_sha512(&drbg->key, drbg->V, DRBG_STATE_LEN, drbg->V);
 
 		/* 10.1.2.2 step 3 */
 		if (!seed)
 			break;
 	}
+	memzero_explicit(new_key, sizeof(new_key));
 }
 
 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
 static void drbg_hmac_generate(struct drbg_state *drbg,
 			       unsigned char *buf,
@@ -208,11 +202,11 @@ static void drbg_hmac_generate(struct drbg_state *drbg,
 {
 	int len = 0;
 
 	/* 10.1.2.5 step 2 */
 	if (addtl && !list_empty(addtl))
-		drbg_hmac_update(drbg, addtl, 1);
+		drbg_hmac_update(drbg, addtl);
 
 	while (len < buflen) {
 		unsigned int outlen = 0;
 
 		/* 10.1.2.5 step 4.1 */
@@ -225,19 +219,19 @@ static void drbg_hmac_generate(struct drbg_state *drbg,
 		len += outlen;
 	}
 
 	/* 10.1.2.5 step 6 */
 	if (addtl && !list_empty(addtl))
-		drbg_hmac_update(drbg, addtl, 1);
+		drbg_hmac_update(drbg, addtl);
 	else
-		drbg_hmac_update(drbg, NULL, 1);
+		drbg_hmac_update(drbg, NULL);
 }
 
 static inline void __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
-			       int reseed, enum drbg_seed_state new_seed_state)
+			       enum drbg_seed_state new_seed_state)
 {
-	drbg_hmac_update(drbg, seed, reseed);
+	drbg_hmac_update(drbg, seed);
 
 	drbg->seeded = new_seed_state;
 	drbg->last_seed_time = jiffies;
 	drbg->reseed_ctr = 1;
 
@@ -273,11 +267,11 @@ static void drbg_seed_from_random(struct drbg_state *drbg)
 	drbg_string_fill(&data, entropy, DRBG_SEC_STRENGTH);
 	list_add_tail(&data.list, &seedlist);
 
 	get_random_bytes(entropy, DRBG_SEC_STRENGTH);
 
-	__drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
+	__drbg_seed(drbg, &seedlist, DRBG_SEED_STATE_FULL);
 
 	memzero_explicit(entropy, DRBG_SEC_STRENGTH);
 }
 
 static bool drbg_nopr_reseed_interval_elapsed(struct drbg_state *drbg)
@@ -402,16 +396,12 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
 	if (pers && pers->buf && 0 < pers->len) {
 		list_add_tail(&pers->list, &seedlist);
 		pr_devel("DRBG: using personalization string\n");
 	}
 
-	if (!reseed) {
-		memset(drbg->V, 0, DRBG_STATE_LEN);
-		memset(drbg->C, 0, DRBG_STATE_LEN);
-	}
 
-	__drbg_seed(drbg, &seedlist, reseed, new_seed_state);
+	__drbg_seed(drbg, &seedlist, new_seed_state);
 	ret = 0;
 out:
 	memzero_explicit(entropy, sizeof(entropy));
 
 	return ret;
@@ -422,11 +412,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
 {
 	if (!drbg)
 		return;
 	memzero_explicit(&drbg->key, sizeof(drbg->key));
 	memzero_explicit(drbg->V, sizeof(drbg->V));
-	memzero_explicit(drbg->C, sizeof(drbg->C));
 	drbg->reseed_ctr = 0;
 	drbg->instantiated = false;
 }
 
 /*
@@ -603,10 +592,11 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
  *	error value otherwise
  */
 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
 			    bool pr)
 {
+	static const u8 initial_key[DRBG_STATE_LEN]; /* all zeroes */
 	int ret;
 	bool reseed = true;
 
 	pr_devel("DRBG: Initializing DRBG with prediction resistance %s\n",
 		 str_enabled_disabled(pr));
@@ -625,10 +615,12 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
 		drbg->instantiated = true;
 		drbg->pr = pr;
 		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
 		drbg->last_seed_time = 0;
 		drbg->reseed_threshold = DRBG_MAX_REQUESTS;
+		memset(drbg->V, 1, DRBG_STATE_LEN);
+		hmac_sha512_preparekey(&drbg->key, initial_key, DRBG_STATE_LEN);
 
 		ret = drbg_prepare_hrng(drbg);
 		if (ret)
 			goto free_everything;
 
-- 
2.53.0