[lkml]   [2019]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH v26 00/12] /dev/random - a new approach with full SP800-90B

The following patch set provides a different approach to /dev/random which is
called Linux Random Number Generator (LRNG) to collect entropy within the Linux
kernel. The main improvements compared to the existing /dev/random is to provide
sufficient entropy during boot time as well as in virtual environments and when
using SSDs. A secondary design goal is to limit the impact of the entropy
collection on massive parallel systems and also allow the use accelerated
cryptographic primitives. Also, all steps of the entropic data processing are

The LRNG patch set allows a user to select use of the existing /dev/random or
the LRNG during compile time. As the LRNG provides API and ABI compatible
interfaces to the existing /dev/random implementation, the user can freely chose
the RNG implementation without affecting kernel or user space operations.

This patch set provides early boot-time entropy which implies that no
additional flags to the getrandom(2) system call discussed recently on
the LKML is considered to be necessary. Yet, if additional flags are
introduced to cover special hardware, the LRNG implementation will also
provide them to be fully ABI and API compliant as already discussed on

The LRNG is fully compliant to SP800-90B requirements and is shipped with a
full SP800-90B assessment and all required test tools. The existing /dev/random
implementation on the other hand has architectural limitations which
does not easily allow to bring the implementation in compliance with
SP800-90B. The key statement that causes concern is SP800-90B section
3.1.6. This section denies crediting entropy to multiple similar noise
sources. This section explicitly references different noise sources resting
on the timing of events and their derivatives (i.e. it is a direct complaint
to the existing existing /dev/random implementation). Therefore, SP800-90B
now denies the very issue mentioned in [1] with the existing /dev/random
implementation for a long time: crediting entropy to interrupts as well as
crediting entropy to derivatives of interrupts (HID and disk events). This is
not permissible with SP800-90B.

SP800-90B specifies various requirements for the noise source(s) that seed any
DRNG including SP800-90A DRBGs. In about a year from now, SP800-90B will be
mandated for all noise sources that provide entropy to DRBGs as part of a FIPS
140-[2|3] validation or other evaluation types. That means, if we there are no
solutions to comply with the requirements of SP800-90B found till one year
from now, any random number generation and ciphers based on random numbers
on Linux will be considered and treated as not applicable and delivering
no entropy! As /dev/urandom, getrandom(2) and /dev/random are the most
common and prevalent noise sources for DRNGs, all these DRNGs are affected.
This applies across the board for all validations of cryptography executing on
Linux (kernel and user space modules).

For users that are not interested in SP800-90B, the entire code for the
compliance as well as test interfaces can be deselected at compile time.

The design and implementation is driven by a set of goals described in [1]
that the LRNG completely implements. Furthermore, [1] includes the full
assessment of the SP800-90B compliance as well as a comparison with RNG
design suggestions of SP800-90C, and AIS20/31.

The LRNG provides a complete separation of the noise source maintenance
and the collection of entropy into an entropy pool from the post-processing
using a pseudo-random number generator. Different DRNGs are supported,

* The LRNG can be compile-time enabled to replace the existing /dev/random
implementation. When not selecting the LRNG at compile time (default), the
existing /dev/random implementation is built.

* Built-in ChaCha20 DRNG which has no dependency to other kernel

* SP800-90A DRBG using the kernel crypto API including its accelerated
raw cipher implementations. This implies that the output of /dev/random,
getrandom(2), /dev/urandom or get_random_bytes is fully compliant to

* Arbitrary DRNGs registered with the kernel crypto API

* Full compliance with SP800-90B which covers the startup and runtime health
tests mandated by SP800-90B as well as providing the test tools and test
interfaces to obtain raw noise data securely. The test tools are provided at

Booting the patch with the kernel command line option
"dyndbg=file drivers/char/lrng/* +p" generates logs indicating the operation
of the LRNG. Each log is pre-pended with "lrng".

The LRNG has a flexible design by allowing an easy replacement of the
deterministic random number generator component.

Compared to the existing /dev/random implementation, the compiled binary
is smaller when the LRNG is compiled with all options equal to the
existing /dev/random (i.e. only CONFIG_LRNG and
CONFIG_LRNG_TRNG_SUPPORT are set): random.o is 52.5 kBytes whereas
all LRNG object files are in 49 kBytes in size. The fully
SP800-90A/SP800-90B compliant binary code (CONFIG_LRNG,
uses some 61 kBytes.

[1] - If the patch is accepted, I would
be volunteering to convert the documentation into RST format and
contribute it to the Linux kernel documentation directory.

Changes (compared to the previous patch set):

* Extract the time initalization code into its own function
lrng_init_time_source and invoke it with core_initcall as reported
by Nicolai Stange

* Add linux/errno.h include to lrng.h as suggested by Nicolai Stange

* Add linux/slab.h to lrng_chacha20.h

* Changed lrng_testing.c reading/writing of ring buffer to use a lock
as suggested by Andy Lutomirski

* Use "depends on DEBUG_FS" for lrng_testing.c Kconfig entry as
suggested by Randy Dunlap

* Remove declaration of random_table from lrng_proc.c as suggested by
Eric W. Biederman

* Move the lrng_type file out of the sysctl table into its own file
/proc/lrng_type since its purpose is not to serve as a sysctl
as suggested by Eric W. Biederman

* Update patch description for /proc patch to refer to sysctls as suggested
by Eric W. Biederman

* /dev/random and getrandom(GRND_RANDOM) now invokes the secondary DRNG
ensuring that the DRNG is fully seeded before requests are served. With
this change, /dev/random is no TRNG any more. This change implements
the suggestion from Andy Lutomirski and is based on the discussions
previously on the LKML and the changes developed by Andy for the existing
random.c implementation.

* Simplification of the debugfs code in lrng_testing.c as return code
checks are not further needed any more as suggested by Nicolai Stange.

* Addition of GRND_TRUERANDOM to the getrandom(2) syscall to make the TRNG
externally accessible as a TRNG. The change also includes the GRND_INSECURE
flag as proposed by Andy Lutomirski. To avoid touching the random.h and
potentially clashing with Andy's patch set, I kept the symbol definitions
in lrng_interfaces.c noting that they should be moved to random.h. The
GRND_TRUERANDOM allows unprivileged user space to access the TRNG as follows:
if CAP_SYS_ADMIN calls, the whole entropy available to the LRNG is used. If
an unprivileged process invokes GRND_TRUERANDOM, at least 1024 bits of entropy
will remain in the pool to serve CAP_SYS_ADMIN and all secondary DRNGs
serving /dev/urandom, /dev/random and getrandom(.., 0) with entropy. With
that unprivileged processes calling GRND_TRUERANDOM have the lowest priority
in getting entropy and must wait accordingly. If the TRNG is not present,
GRND_TRUERANDOM returns -EOPNOTSUPP. A new test tool is provided as part
of the LRNG test archive found at [1] allowing to analyze all four types
of RNGs accessible via getrandom(2).

* Remove duplication of MODULE_LICENSE/AUTHOR/DESCRIPTION from lrng_testing.c

A patch for adding power-up self tests is prepared but I did not want to add it
now to support code review of a code base with minimal changes. It will be
provided once the code review is completed. With this pending code, the
following tests are available:

* power-on self test: LFSR self test

* power-on self test: ChaCha20 DRNG self test

* power-on self test: time stamp array handling in lrng_sw_noise.c

* power-on self test: SP800-90A DRBG self test

* runtime test: raw noise source data collection, if enabled

* separate test: SP800-90B APT and RCT test enforcement validation if enabled

As a side node: With the switchable DRNG support offered in this patch set,
the following areas could be removed. As the existing /dev/random has no support
for switchable DRNGs, however, this is not yet feasible though.

* remove lrng_ready_list and all code around it in lrng_interfaces.c

* remove the kernel crypto API RNG API to avoid having two random number
providing APIs - this would imply that all RNGs developed for this API would
be converted to the LRNG interface

CC: "Eric W. Biederman" <>
CC: "Alexander E. Patrakov" <>
CC: "Ahmed S. Darwish" <>
CC: "Theodore Y. Ts'o" <>
CC: Willy Tarreau <>
CC: Matthew Garrett <>
CC: Vito Caputo <>
CC: Andreas Dilger <>
CC: Jan Kara <>
CC: Ray Strode <>
CC: William Jon McCann <>
CC: zhangjs <>
CC: Andy Lutomirski <>
CC: Florian Weimer <>
CC: Lennart Poettering <>
CC: Nicolai Stange <>
Tested-by: Roman Drahtmüller <>
Tested-by: Marcelo Henrique Cerri <>

Stephan Mueller (12):
Linux Random Number Generator
LRNG - allocate one SDRNG instance per NUMA node
LRNG - sysctls and /proc interface
LRNG - add switchable DRNG support
crypto: DRBG - externalize DRBG functions for LRNG
LRNG - add SP800-90A DRBG extension
LRNG - add kernel crypto API PRNG extension
crypto: provide access to a static Jitter RNG state
LRNG - add Jitter RNG fast noise source
LRNG - add TRNG support
LRNG - add SP800-90B compliant health tests
LRNG - add interface for gathering of raw entropy

crypto/drbg.c | 16 +-
crypto/jitterentropy.c | 23 +
drivers/char/Kconfig | 2 +
drivers/char/Makefile | 9 +-
drivers/char/lrng/Kconfig | 188 ++++++++
drivers/char/lrng/Makefile | 19 +
drivers/char/lrng/lrng_archrandom.c | 92 ++++
drivers/char/lrng/lrng_aux.c | 148 ++++++
drivers/char/lrng/lrng_chacha20.c | 329 ++++++++++++++
drivers/char/lrng/lrng_drbg.c | 261 +++++++++++
drivers/char/lrng/lrng_health.c | 409 +++++++++++++++++
drivers/char/lrng/lrng_interfaces.c | 665 +++++++++++++++++++++++++++
drivers/char/lrng/lrng_internal.h | 320 +++++++++++++
drivers/char/lrng/lrng_jent.c | 88 ++++
drivers/char/lrng/lrng_kcapi.c | 328 ++++++++++++++
drivers/char/lrng/lrng_numa.c | 101 +++++
drivers/char/lrng/lrng_pool.c | 671 ++++++++++++++++++++++++++++
drivers/char/lrng/lrng_proc.c | 179 ++++++++
drivers/char/lrng/lrng_sdrng.c | 420 +++++++++++++++++
drivers/char/lrng/lrng_sw_noise.c | 144 ++++++
drivers/char/lrng/lrng_switch.c | 185 ++++++++
drivers/char/lrng/lrng_testing.c | 269 +++++++++++
drivers/char/lrng/lrng_trng.c | 297 ++++++++++++
include/crypto/drbg.h | 7 +
include/linux/lrng.h | 71 +++
26 files changed, 5241 insertions(+), 7 deletions(-)
create mode 100644 drivers/char/lrng/Kconfig
create mode 100644 drivers/char/lrng/Makefile
create mode 100644 drivers/char/lrng/lrng_archrandom.c
create mode 100644 drivers/char/lrng/lrng_aux.c
create mode 100644 drivers/char/lrng/lrng_chacha20.c
create mode 100644 drivers/char/lrng/lrng_drbg.c
create mode 100644 drivers/char/lrng/lrng_health.c
create mode 100644 drivers/char/lrng/lrng_interfaces.c
create mode 100644 drivers/char/lrng/lrng_internal.h
create mode 100644 drivers/char/lrng/lrng_jent.c
create mode 100644 drivers/char/lrng/lrng_kcapi.c
create mode 100644 drivers/char/lrng/lrng_numa.c
create mode 100644 drivers/char/lrng/lrng_pool.c
create mode 100644 drivers/char/lrng/lrng_proc.c
create mode 100644 drivers/char/lrng/lrng_sdrng.c
create mode 100644 drivers/char/lrng/lrng_sw_noise.c
create mode 100644 drivers/char/lrng/lrng_switch.c
create mode 100644 drivers/char/lrng/lrng_testing.c
create mode 100644 drivers/char/lrng/lrng_trng.c
create mode 100644 include/linux/lrng.h


 \ /
  Last update: 2019-11-23 21:40    [W:0.570 / U:3.288 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site