diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2018-07-17 18:24:27 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-25 11:46:25 +0200 |
| commit | 923eb78099e022db51884ef80bb589a21a30dd9e (patch) | |
| tree | 670570d588fa968ba7ca4db2167544e26d3390fa | |
| parent | 005e7ac06d2b5e2994794efd700f5866beda4e54 (diff) | |
| download | linux-stable-923eb78099e022db51884ef80bb589a21a30dd9e.tar.gz linux-stable-923eb78099e022db51884ef80bb589a21a30dd9e.tar.bz2 linux-stable-923eb78099e022db51884ef80bb589a21a30dd9e.zip | |
random: add a config option to trust the CPU's hwrng
commit 39a8883a2b989d1d21bd8dd99f5557f0c5e89694 upstream.
This gives the user building their own kernel (or a Linux
distribution) the option of deciding whether or not to trust the CPU's
hardware random number generator (e.g., RDRAND for x86 CPU's) as being
correctly implemented and not having a back door introduced (perhaps
courtesy of a Nation State's law enforcement or intelligence
agencies).
This will prevent getrandom(2) from blocking, if there is a
willingness to trust the CPU manufacturer.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/char/Kconfig | 14 | ||||
| -rw-r--r-- | drivers/char/random.c | 11 |
2 files changed, 24 insertions, 1 deletions
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig index 88316f86cc95..d122c61ddd16 100644 --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -590,3 +590,17 @@ source "drivers/char/xillybus/Kconfig" endmenu +config RANDOM_TRUST_CPU + bool "Trust the CPU manufacturer to initialize Linux's CRNG" + depends on X86 || S390 || PPC + default n + help + Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or + RDRAND, IBM for the S390 and Power PC architectures) is trustworthy + for the purposes of initializing Linux's CRNG. Since this is not + something that can be independently audited, this amounts to trusting + that CPU manufacturer (perhaps with the insistence or mandate + of a Nation State's intelligence or law enforcement agencies) + has not installed a hidden back door to compromise the CPU's + random number generation facilities. + diff --git a/drivers/char/random.c b/drivers/char/random.c index 859b56d41c26..a18efc76fc7d 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -782,6 +782,7 @@ static void invalidate_batched_entropy(void); static void crng_initialize(struct crng_state *crng) { int i; + int arch_init = 1; unsigned long rv; memcpy(&crng->state[0], "expand 32-byte k", 16); @@ -792,10 +793,18 @@ static void crng_initialize(struct crng_state *crng) _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); for (i = 4; i < 16; i++) { if (!arch_get_random_seed_long(&rv) && - !arch_get_random_long(&rv)) + !arch_get_random_long(&rv)) { rv = random_get_entropy(); + arch_init = 0; + } crng->state[i] ^= rv; } +#ifdef CONFIG_RANDOM_TRUST_CPU + if (arch_init) { + crng_init = 2; + pr_notice("random: crng done (trusting CPU's manufacturer)\n"); + } +#endif crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; } |