Skip to contentSkip to conversation

lib/crypto: chacha - Zeroize permuted_state before it leaves scope

PATCH Applied Eric Biggers 2 participants 3 messages Mar 26 – Mar 27

Subsystems (3)
Stable branch Crypto API Crypto library
lore
Share & tools
lore

Eric Biggers

author maintainer
#0 lore raw

PATCH 1/1 lib/crypto: chacha - Zeroize permuted_state before it leaves scope

Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done.

While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG.

Thus, explicitly zeroize 'permuted_state' before it goes out of scope.

Fixes c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation")
Cc [email protected]
Signed-off-by Eric Biggers <[email protected]>

---

This patch is targeting libcrypto-fixes

 lib/crypto/chacha-block-generic.c | 4 ++++
 1 file changed, 4 insertions(+)
lib/crypto/chacha-block-generic.c +4 -0
index 77f68de71066..4a6d627580cb 100644
@@ -85,10 +85,12 @@ void chacha_block_generic(struct chacha_state *state,
 	for (i = 0; i < ARRAY_SIZE(state->x); i++)
 		put_unaligned_le32(permuted_state.x[i] + state->x[i],
 				   &out[i * sizeof(u32)]);
 
 	state->x[12]++;
+
+	chacha_zeroize_state(&permuted_state);
 }
 EXPORT_SYMBOL(chacha_block_generic);
 
 /**
  * hchacha_block_generic - abbreviated ChaCha core, for XChaCha

@@ -108,7 +110,9 @@ void hchacha_block_generic(const struct chacha_state *state,
 
 	chacha_permute(&permuted_state, nrounds);
 
 	memcpy(&out[0], &permuted_state.x[0], 16);
 	memcpy(&out[4], &permuted_state.x[12], 16);
+
+	chacha_zeroize_state(&permuted_state);
 }
 EXPORT_SYMBOL(hchacha_block_generic);

base-commit: 0138af2472dfdef0d56fc4697416eaa0ff2589bd

Signature · 1 line
2.53.0
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 13 lines · Eric Biggers

Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done.

While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG.

Thus, explicitly zeroize 'permuted_state' before it goes out of scope.

Fixes c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream

cipher implementation")

Quoted 9 lines
Cc [email protected]
Signed-off-by Eric Biggers <[email protected]>

---

This patch is targeting libcrypto-fixes

 lib/crypto/chacha-block-generic.c | 4 ++++
 1 file changed, 4 insertions(+)
Acked-by Ard Biesheuvel <[email protected]>
author maintainer Applied
#2 lore raw
In reply to Eric Biggers
Quoted 9 lines · Eric Biggers

Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done.

While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG.

Quoted 8 lines

Thus, explicitly zeroize 'permuted_state' before it goes out of scope.

Fixes c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation")
Cc [email protected]
Signed-off-by Eric Biggers <[email protected]>

---

This patch is targeting libcrypto-fixes

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes

- Eric