Skip to contentSkip to conversation

random: initialize ChaCha20 constants with correct endianness

PATCH RESEND In review Eric Biggers 2 participants 2 messages Mar 22, 2021 – Apr 2, 2021

Subsystems (2)
Crypto API Random number driver
lore
Share & tools
lore

Eric Biggers

author
#0 lore raw

PATCH RESEND 1/1 random: initialize ChaCha20 constants with correct endianness

From: Eric Biggers <[email protected]>

On big endian CPUs, the ChaCha20-based CRNG is using the wrong endianness for the ChaCha20 constants.

This doesn't matter cryptographically, but technically it means it's not ChaCha20 anymore. Fix it to always use the standard constants.

Cc [email protected]
Cc Andy Lutomirski <[email protected]>
Cc Jann Horn <[email protected]>
Cc Theodore Ts'o <[email protected]>
Acked-by Herbert Xu <[email protected]>
Acked-by Ard Biesheuvel <[email protected]>
Signed-off-by Eric Biggers <[email protected]>
---
 drivers/char/random.c   | 4 ++--
 include/crypto/chacha.h | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/char/random.c +2 -2
index 0fe9e200e4c84..5d6acfecd919b 100644
@@ -819,7 +819,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng)
 
 static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)
 {
-	memcpy(&crng->state[0], "expand 32-byte k", 16);
+	chacha_init_consts(crng->state);
 	_get_random_bytes(&crng->state[4], sizeof(__u32) * 12);
 	crng_init_try_arch(crng);
 	crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;

@@ -827,7 +827,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng)
 
 static void __init crng_initialize_primary(struct crng_state *crng)
 {
-	memcpy(&crng->state[0], "expand 32-byte k", 16);
+	chacha_init_consts(crng->state);
 	_extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0);
 	if (crng_init_try_arch_early(crng) && trust_cpu) {
 		invalidate_batched_entropy();
include/crypto/chacha.h +7 -2
index 3a1c72fdb7cf5..dabaee6987186 100644
@@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds)
 		hchacha_block_generic(state, out, nrounds);
 }
 
-void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv);
-static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv)
+static inline void chacha_init_consts(u32 *state)
 {
 	state[0]  = 0x61707865; /* "expa" */
 	state[1]  = 0x3320646e; /* "nd 3" */
 	state[2]  = 0x79622d32; /* "2-by" */
 	state[3]  = 0x6b206574; /* "te k" */
+}
+
+void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv);
+static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv)
+{
+	chacha_init_consts(state);
 	state[4]  = key[0];
 	state[5]  = key[1];
 	state[6]  = key[2];
Signature · 1 line
2.31.0
maintainer
#1 lore raw
Quoted 15 lines · Eric Biggers

From: Eric Biggers <[email protected]>

On big endian CPUs, the ChaCha20-based CRNG is using the wrong endianness for the ChaCha20 constants.

This doesn't matter cryptographically, but technically it means it's not ChaCha20 anymore. Fix it to always use the standard constants.

Cc [email protected]
Cc Andy Lutomirski <[email protected]>
Cc Jann Horn <[email protected]>
Cc Theodore Ts'o <[email protected]>
Acked-by Herbert Xu <[email protected]>
Acked-by Ard Biesheuvel <[email protected]>
Signed-off-by Eric Biggers <[email protected]>
Quoted 4 lines
---
 drivers/char/random.c   | 4 ++--
 include/crypto/chacha.h | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt