OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/crypto
History
Stephan Mueller 42ea507fae crypto: drbg - reseed often if seedsource is degraded 
As required by SP800-90A, the DRBG implements are reseeding threshold.
This threshold is at 2**48 (64 bit) and 2**32 bit (32 bit) as
implemented in drbg_max_requests.

With the recently introduced changes, the DRBG is now always used as a
stdrng which is initialized very early in the boot cycle. To ensure that
sufficient entropy is present, the Jitter RNG is added to even provide
entropy at early boot time.

However, the 2nd seed source, the nonblocking pool, is usually
degraded at that time. Therefore, the DRBG is seeded with the Jitter RNG
(which I believe contains good entropy, which however is questioned by
others) and is seeded with a degradded nonblocking pool. This seed is
now used for quasi the lifetime of the system (2**48 requests is a lot).

The patch now changes the reseed threshold as follows: up until the time
the DRBG obtains a seed from a fully iniitialized nonblocking pool, the
reseeding threshold is lowered such that the DRBG is forced to reseed
itself resonably often. Once it obtains the seed from a fully
initialized nonblocking pool, the reseed threshold is set to the value
required by SP800-90A.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
 		2015-06-10 19:14:05 +08:00
..
asymmetric_keys Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2014-10-12 10:13:55 -04:00
async_tx dmaengine: fix xor sources continuation 2014-08-21 10:20:52 -07:00
842.c crypto: 842 - change 842 alg to use software 2015-05-11 15:06:43 +08:00
Kconfig crypto: rng - Make DRBG the default RNG 2015-06-04 15:05:02 +08:00
Makefile crypto: drbg - use pragmas for disabling optimization 2015-06-09 22:26:00 +08:00
ablk_helper.c crypto: cryptd - process CRYPTO_ALG_INTERNAL 2015-03-31 21:21:04 +08:00
ablkcipher.c crypto: skcipher - Use tmpl->create 2015-05-25 18:41:28 +08:00
aead.c crypto: aead - Add multiple algorithm registration interface 2015-06-03 10:48:35 +08:00
aes_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
af_alg.c crypto: af_alg - make exports consistant 2015-04-01 15:32:20 -04:00
ahash.c crypto: replace scatterwalk_sg_next with sg_next 2015-01-26 11:34:22 +11:00
algapi.c crypto: api - Include alignment in crypto_alg_extsize 2015-06-03 10:48:34 +08:00
algboss.c crypto: algboss - Hold ref count on larval 2013-06-25 19:15:17 +08:00
algif_aead.c crypto: algif_aead - Switch to new AEAD interface 2015-05-28 11:23:21 +08:00
algif_hash.c new helper: msg_data_left() 2015-04-11 15:53:35 -04:00
algif_rng.c crypto: algif_rng - Remove obsolete const-removal cast 2015-04-22 09:30:21 +08:00
algif_skcipher.c new helper: msg_data_left() 2015-04-11 15:53:35 -04:00
ansi_cprng.c crypto: ansi_cprng - Convert to new rng interface 2015-04-22 09:30:18 +08:00
anubis.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
api.c crypto: api - prevent helper ciphers from being used 2015-03-31 21:21:03 +08:00
arc4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
authenc.c crypto: authenc - Use crypto_aead_set_reqsize helper 2015-05-13 10:31:37 +08:00
authencesn.c crypto: authencesn - Use crypto_aead_set_reqsize helper 2015-05-13 10:31:38 +08:00
blkcipher.c crypto: blkcipher - Include crypto/aead.h 2015-05-13 10:31:34 +08:00
blowfish_common.c
…
blowfish_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
camellia_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast5_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast6_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cast_common.c crypto: make tables used from assembler __visible 2013-08-14 20:42:03 +10:00
cbc.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
ccm.c crypto: ccm - Use crypto_aead_set_reqsize helper 2015-05-13 10:31:39 +08:00
chacha20_generic.c crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation 2015-06-04 15:04:49 +08:00
chacha20poly1305.c crypto: chacha20poly1305 - Add an IPsec variant for RFC7539 AEAD 2015-06-04 15:04:53 +08:00
chainiv.c crypto: chainiv - Move IV seeding into init function 2015-06-04 15:04:59 +08:00
cipher.c
…
cmac.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
compress.c
…
crc32.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
crc32c_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
crct10dif_common.c crypto: crct10dif - Add fallback for broken initrds 2013-09-12 15:31:34 +10:00
crct10dif_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
cryptd.c crypto: cryptd - Convert to new AEAD interface 2015-06-03 10:48:37 +08:00
crypto_null.c crypto: null - Add default null skcipher 2015-05-22 11:25:55 +08:00
crypto_user.c crypto: user - Fix crypto_alg_match race 2015-04-08 22:20:06 +08:00
crypto_wq.c crypto: crypto_wq - Fix late crypto work queue initialization 2014-03-21 21:54:28 +08:00
ctr.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
cts.c crypto: cts - Weed out non-CBC algorithms 2015-01-20 14:44:15 +11:00
deflate.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
des_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
drbg.c crypto: drbg - reseed often if seedsource is degraded 2015-06-10 19:14:05 +08:00
ecb.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
echainiv.c crypto: echainiv - Move IV seeding into init function 2015-06-04 15:05:00 +08:00
eseqiv.c crypto: eseqiv - Move IV seeding into init function 2015-06-04 15:05:00 +08:00
fcrypt.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
fips.c crypto: fips - Move fips_enabled sysctl into fips.c 2015-04-23 14:18:09 +08:00
gcm.c crypto: gcm - Use default null skcipher 2015-05-22 11:25:55 +08:00
gf128mul.c
…
ghash-generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
hash_info.c crypto: provide single place for hash algo information 2013-10-25 17:14:03 -04:00
hmac.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
internal.h crypto: api - Remove linux/fips.h from internal.h 2015-04-23 14:18:10 +08:00
jitterentropy.c crypto: drbg - use pragmas for disabling optimization 2015-06-09 22:26:00 +08:00
khazad.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lrw.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
lz4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lz4hc.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
lzo.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
mcryptd.c crypto: mcryptd - process CRYPTO_ALG_INTERNAL 2015-03-31 21:21:13 +08:00
md4.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
md5.c crypto: md5 - use md5 IV MD5_HX instead of their raw value 2015-05-18 12:20:18 +08:00
memneq.c crypto: memneq - fix for archs without efficient unaligned access 2013-12-09 20:09:12 +08:00
michael_mic.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
pcbc.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
pcompress.c crypto: pcomp - Use crypto_alg_extsize helper 2015-04-21 10:19:55 +08:00
pcrypt.c crypto: pcrypt - Add support for new AEAD interface 2015-06-03 10:48:35 +08:00
poly1305_generic.c crypto: poly1305 - Add a generic Poly1305 authenticator implementation 2015-06-04 15:04:50 +08:00
proc.c crypto: fips - Move fips_enabled sysctl into fips.c 2015-04-23 14:18:09 +08:00
ripemd.h
…
rmd128.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd160.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd256.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rmd320.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
rng.c crypto: rng - Zero seed in crypto_rng_reset 2015-04-22 09:30:21 +08:00
salsa20_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
scatterwalk.c crypto: scatterwalk - Hide PageSlab call to optimise away flush_dcache_page 2015-06-03 10:51:25 +08:00
seed.c crypto: prefix module autoloading with "crypto-" 2014-11-24 22:43:57 +08:00
seqiv.c crypto: seqiv - Move IV seeding into init function 2015-06-04 15:05:01 +08:00
serpent_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
sha1_generic.c crypto: sha1-generic - move to generic glue implementation 2015-04-10 21:39:40 +08:00
sha256_generic.c crypto: sha256-generic - move to generic glue implementation 2015-04-10 21:39:41 +08:00
sha512_generic.c crypto: sha512-generic - move to generic glue implementation 2015-04-10 21:39:41 +08:00
shash.c crypto: shash - Use crypto_alg_extsize helper 2015-04-21 10:19:54 +08:00
tcrypt.c crypto: tcrypt - Switch to new AEAD interface 2015-05-28 11:23:21 +08:00
tcrypt.h crypto: tcrypt - Added speed tests for AEAD crypto alogrithms in tcrypt test suite 2013-12-20 20:06:25 +08:00
tea.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
testmgr.c crypto: testmgr - Add draft-ietf-ipsecme-chacha20-poly1305 test vector 2015-06-04 15:04:54 +08:00
testmgr.h crypto: testmgr - Document struct cipher_testvec 2015-06-09 22:22:00 +08:00
tgr192.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
twofish_common.c
…
twofish_generic.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
vmac.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
wp512.c crypto: add missing crypto module aliases 2015-01-13 22:29:11 +11:00
xcbc.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
xor.c
…
xts.c crypto: include crypto- module prefix in template 2014-11-26 20:06:30 +08:00
zlib.c crypto: pcomp - Constify (de)compression parameters 2015-05-01 11:16:37 +08:00