linux/drivers/char
George Spelvin c51f8f88d7 random32: make prandom_u32() output unpredictable
Non-cryptographic PRNGs may have great statistical properties, but
are usually trivially predictable to someone who knows the algorithm,
given a small sample of their output.  An LFSR like prandom_u32() is
particularly simple, even if the sample is widely scattered bits.

It turns out the network stack uses prandom_u32() for some things like
random port numbers which it would prefer are *not* trivially predictable.
Predictability led to a practical DNS spoofing attack.  Oops.

This patch replaces the LFSR with a homebrew cryptographic PRNG based
on the SipHash round function, which is in turn seeded with 128 bits
of strong random key.  (The authors of SipHash have *not* been consulted
about this abuse of their algorithm.)  Speed is prioritized over security;
attacks are rare, while performance is always wanted.

Replacing all callers of prandom_u32() is the quick fix.
Whether to reinstate a weaker PRNG for uses which can tolerate it
is an open question.

Commit f227e3ec3b ("random32: update the net random state on interrupt
and activity") was an earlier attempt at a solution.  This patch replaces
it.

Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: tytso@mit.edu
Cc: Florian Westphal <fw@strlen.de>
Cc: Marc Plumb <lkml.mplumb@gmail.com>
Fixes: f227e3ec3b ("random32: update the net random state on interrupt and activity")
Signed-off-by: George Spelvin <lkml@sdf.org>
Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/
[ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions
  to prandom.h for later use; merged George's prandom_seed() proposal;
  inlined siprand_u32(); replaced the net_rand_state[] array with 4
  members to fix a build issue; cosmetic cleanups to make checkpatch
  happy; fixed RANDOM32_SELFTEST build ]
Signed-off-by: Willy Tarreau <w@1wt.eu>
2020-10-24 20:21:57 +02:00
..
agp agp: use semicolons rather than commas to separate statements 2020-09-28 06:06:52 +10:00
hw_random Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-10-13 08:50:16 -07:00
ipmi Bug fix pull for IPMI for 5.10 2020-10-14 15:00:20 -07:00
mwave char/mwave: remove redundant initialization of variable bRC 2020-07-10 14:50:51 +02:00
pcmcia cm4000_cs.c cmm_ioctl(): get rid of pointless access_ok() 2020-05-29 11:04:56 -04:00
tpm tpm_tis: Add a check for invalid status 2020-10-02 00:21:03 +03:00
xilinx_hwicap
xillybus
adi.c
apm-emulation.c
applicom.c
applicom.h
bsr.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
ds1620.c
dsp56k.c
dtlk.c
hangcheck-timer.c
hpet.c
Kconfig char: virtio: Select VIRTIO from VIRTIO_CONSOLE. 2020-09-07 14:32:40 +02:00
lp.c Merge 5.9-rc3 into char-misc-next 2020-08-31 07:17:17 +02:00
Makefile
mem.c /dev/zero: fixups for ->read 2020-09-07 10:46:35 +02:00
misc.c
mspec.c char: mspec: Use kvzalloc() in mspec_mmap() 2020-08-28 12:10:04 +02:00
nsc_gpio.c
nvram.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nwbutton.c
nwbutton.h
nwflash.c
pc8736x_gpio.c
powernv-op-panel.c
ppdev.c
ps3flash.c
random.c random32: make prandom_u32() output unpredictable 2020-10-24 20:21:57 +02:00
raw.c raw: don't keep unopened block device around 2020-09-23 10:43:19 -06:00
scx200_gpio.c
sonypi.c
tb0219.c
tlclk.c drivers: char: tlclk.c: Avoid data race between init and interrupt handler 2020-04-23 16:55:24 +02:00
toshiba.c
ttyprintk.c ttyprintk: remove redundant initialization of variable ret 2020-07-10 14:50:51 +02:00
uv_mmtimer.c
virtio_console.c Merge v5.8-rc6 into char-misc-next 2020-07-20 09:43:40 +02:00