2019-10-09 09:12:56 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
|
|
|
|
2023-09-21 11:48:33 +00:00
|
|
|
extern void *jent_kvzalloc(unsigned int len);
|
|
|
|
|
extern void jent_kvzfree(void *ptr, unsigned int len);
|
2019-10-09 09:12:56 +00:00
|
|
|
extern void *jent_zalloc(unsigned int len);
|
|
|
|
|
extern void jent_zfree(void *ptr);
|
|
|
|
|
extern void jent_get_nstime(__u64 *out);
|
crypto: jitter - replace LFSR with SHA3-256
Using the kernel crypto API, the SHA3-256 algorithm is used as
conditioning element to replace the LFSR in the Jitter RNG. All other
parts of the Jitter RNG are unchanged.
The application and use of the SHA-3 conditioning operation is identical
to the user space Jitter RNG 3.4.0 by applying the following concept:
- the Jitter RNG initializes a SHA-3 state which acts as the "entropy
pool" when the Jitter RNG is allocated.
- When a new time delta is obtained, it is inserted into the "entropy
pool" with a SHA-3 update operation. Note, this operation in most of
the cases is a simple memcpy() onto the SHA-3 stack.
- To cause a true SHA-3 operation for each time delta operation, a
second SHA-3 operation is performed hashing Jitter RNG status
information. The final message digest is also inserted into the
"entropy pool" with a SHA-3 update operation. Yet, this data is not
considered to provide any entropy, but it shall stir the entropy pool.
- To generate a random number, a SHA-3 final operation is performed to
calculate a message digest followed by an immediate SHA-3 init to
re-initialize the "entropy pool". The obtained message digest is one
block of the Jitter RNG that is returned to the caller.
Mathematically speaking, the random number generated by the Jitter RNG
is:
aux_t = SHA-3(Jitter RNG state data)
Jitter RNG block = SHA-3(time_i || aux_i || time_(i-1) || aux_(i-1) ||
... || time_(i-255) || aux_(i-255))
when assuming that the OSR = 1, i.e. the default value.
This operation implies that the Jitter RNG has an output-blocksize of
256 bits instead of the 64 bits of the LFSR-based Jitter RNG that is
replaced with this patch.
The patch also replaces the varying number of invocations of the
conditioning function with one fixed number of invocations. The use
of the conditioning function consistent with the userspace Jitter RNG
library version 3.4.0.
The code is tested with a system that exhibited the least amount of
entropy generated by the Jitter RNG: the SiFive Unmatched RISC-V
system. The measured entropy rate is well above the heuristically
implied entropy value of 1 bit of entropy per time delta. On all other
tested systems, the measured entropy rate is even higher by orders
of magnitude. The measurement was performed using updated tooling
provided with the user space Jitter RNG library test framework.
The performance of the Jitter RNG with this patch is about en par
with the performance of the Jitter RNG without the patch.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2023-04-21 06:08:04 +00:00
|
|
|
extern int jent_hash_time(void *hash_state, __u64 time, u8 *addtl,
|
|
|
|
|
unsigned int addtl_len, __u64 hash_loop_cnt,
|
|
|
|
|
unsigned int stuck);
|
|
|
|
|
int jent_read_random_block(void *hash_state, char *dst, unsigned int dst_len);
|
2019-10-09 09:12:56 +00:00
|
|
|
|
|
|
|
|
struct rand_data;
|
2023-09-21 11:48:11 +00:00
|
|
|
extern int jent_entropy_init(unsigned int osr, unsigned int flags,
|
2023-10-07 07:10:43 +00:00
|
|
|
void *hash_state, struct rand_data *p_ec);
|
2019-10-09 09:12:56 +00:00
|
|
|
extern int jent_read_entropy(struct rand_data *ec, unsigned char *data,
|
|
|
|
|
unsigned int len);
|
|
|
|
|
|
|
|
|
|
extern struct rand_data *jent_entropy_collector_alloc(unsigned int osr,
|
crypto: jitter - replace LFSR with SHA3-256
Using the kernel crypto API, the SHA3-256 algorithm is used as
conditioning element to replace the LFSR in the Jitter RNG. All other
parts of the Jitter RNG are unchanged.
The application and use of the SHA-3 conditioning operation is identical
to the user space Jitter RNG 3.4.0 by applying the following concept:
- the Jitter RNG initializes a SHA-3 state which acts as the "entropy
pool" when the Jitter RNG is allocated.
- When a new time delta is obtained, it is inserted into the "entropy
pool" with a SHA-3 update operation. Note, this operation in most of
the cases is a simple memcpy() onto the SHA-3 stack.
- To cause a true SHA-3 operation for each time delta operation, a
second SHA-3 operation is performed hashing Jitter RNG status
information. The final message digest is also inserted into the
"entropy pool" with a SHA-3 update operation. Yet, this data is not
considered to provide any entropy, but it shall stir the entropy pool.
- To generate a random number, a SHA-3 final operation is performed to
calculate a message digest followed by an immediate SHA-3 init to
re-initialize the "entropy pool". The obtained message digest is one
block of the Jitter RNG that is returned to the caller.
Mathematically speaking, the random number generated by the Jitter RNG
is:
aux_t = SHA-3(Jitter RNG state data)
Jitter RNG block = SHA-3(time_i || aux_i || time_(i-1) || aux_(i-1) ||
... || time_(i-255) || aux_(i-255))
when assuming that the OSR = 1, i.e. the default value.
This operation implies that the Jitter RNG has an output-blocksize of
256 bits instead of the 64 bits of the LFSR-based Jitter RNG that is
replaced with this patch.
The patch also replaces the varying number of invocations of the
conditioning function with one fixed number of invocations. The use
of the conditioning function consistent with the userspace Jitter RNG
library version 3.4.0.
The code is tested with a system that exhibited the least amount of
entropy generated by the Jitter RNG: the SiFive Unmatched RISC-V
system. The measured entropy rate is well above the heuristically
implied entropy value of 1 bit of entropy per time delta. On all other
tested systems, the measured entropy rate is even higher by orders
of magnitude. The measurement was performed using updated tooling
provided with the user space Jitter RNG library test framework.
The performance of the Jitter RNG with this patch is about en par
with the performance of the Jitter RNG without the patch.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2023-04-21 06:08:04 +00:00
|
|
|
unsigned int flags,
|
|
|
|
|
void *hash_state);
|
2019-10-09 09:12:56 +00:00
|
|
|
extern void jent_entropy_collector_free(struct rand_data *entropy_collector);
|
2023-04-21 06:08:23 +00:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE
|
|
|
|
|
int jent_raw_hires_entropy_store(__u32 value);
|
|
|
|
|
void jent_testing_init(void);
|
|
|
|
|
void jent_testing_exit(void);
|
|
|
|
|
#else /* CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE */
|
|
|
|
|
static inline int jent_raw_hires_entropy_store(__u32 value) { return 0; }
|
|
|
|
|
static inline void jent_testing_init(void) { }
|
|
|
|
|
static inline void jent_testing_exit(void) { }
|
|
|
|
|
#endif /* CONFIG_CRYPTO_JITTERENTROPY_TESTINTERFACE */
|