Fix and simplify the NIST DRBG implementation

This series is intended to be taken through the cryptodev tree. It can also be retrieved from:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git drbg-v1

This series fixes and greatly simplifies crypto/drbg.c, i.e. the kernel's implementation of NIST SP800-90A. This code isn't normally used, but it's sometimes used by people doing FIPS 140-3 certifications.

Note: this series is *not* meant to encourage using this code over random.c. In fact, my recent commit 65b3c2f627851639 made "normal" systems stop using this code. It's just that the reality is that this is in the kernel tree, it's been there for many years, and people are using it to get FIPS 140-3 certifications. As long as that's the case, it might as well be fixed up and simplified. Another reason to simplify this as much as possible is that for historical reasons it's accessible to unprivileged users via AF_ALG (even though it shouldn't be). So I do think this is a clear step forwards, regardless of level of enthusiasm for FIPS, especially considering the massively negative diffstat.

Patches 1-5 begin with some bug fixes. Fixes for CTR_DRBG and HASH_DRBG are included, despite that code being removed later in the series, so that they can be backported (though that is likely unused code anyway).

Patches 6-11 do some initial cleanups.

Patches 12-17 clean up the museum of DRBG variants to just support the HMAC-SHA512 DRBG only, dropping support for the others. This is already the default variant, it makes sense that it's the default, and it's probably the only one actually being used on current kernels. In any case, supporting more than one is pretty pointless. See the patches for more details about why it makes sense to keep using this one.

Patches 18-33 contain many more cleanups, including switching from the crypto_shash API to the crypto library.

Patch 34 is a significant one: it starts adding 32 bytes from get_random_bytes() to every additional input string. This is to work around the forward secrecy bug described in Woodage & Shumow (2018)
(https://eprint.iacr.org/2018/349.pdf), and to ensure that random.c reseeds are actually reflected in drbg.c. Of course, for FIPS 140-3 this is irrelevant, but this is the right thing to do in practice, and it should make drbg.c quite a bit more robust in practice. (This isn't particularly novel, either; BoringSSL does essentially this same thing.)

Patches 35-38 are some further cleanups, including some tweaks to when the formal reseeding happens.

Note: while the primary goal of this series is to fix and simplify this code, this series is also intended to preserve the FIPS 140-3 "certifiable" property of crypto/drbg.c. I.e. after this series, it should still be possible to get a FIPS 140-3 certification that covers it. In fact it should become quite a bit easier, since there will be only one DRBG variant to worry about and the code will be much more straightforward. If there's anything I missed, let me know.

Eric Biggers (38):
crypto: drbg - Fix returning success on failure in CTR_DRBG
crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
crypto: drbg - Fix ineffective sanity check
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
crypto: drbg - Fix the fips_enabled priority boost
crypto: drbg - Remove always-enabled symbol CRYPTO_DRBG_HMAC
crypto: drbg - Remove broken commented-out code
crypto: drbg - Remove unhelpful helper functions
crypto: drbg - Remove obsolete FIPS 140-2 continuous test
crypto: drbg - Fold include/crypto/drbg.h into crypto/drbg.c
crypto: drbg - Remove import of crypto_cipher functions
crypto: drbg - Remove support for CTR_DRBG
crypto: drbg - Remove support for HASH_DRBG
crypto: drbg - Flatten the DRBG menu
crypto: testmgr - Add test for drbg_pr_hmac_sha512
crypto: testmgr - Update test for drbg_nopr_hmac_sha512
crypto: drbg - Remove support for HMAC-SHA256 and HMAC-SHA384
crypto: drbg - Simplify algorithm registration
crypto: drbg - De-virtualize drbg_state_ops
crypto: drbg - Move fixed values into constants
crypto: drbg - Embed V and C into struct drbg_state
crypto: drbg - Use HMAC-SHA512 library API
crypto: drbg - Remove drbg_core
crypto: drbg - Install separate seed functions for pr and nopr
crypto: drbg - Move module aliases to end of file
crypto: drbg - Consolidate "instantiate" logic and remove
drbg_state::C
crypto: drbg - Eliminate use of 'drbg_string' and lists
crypto: drbg - Simplify drbg_generate_long() and fold into caller
crypto: drbg - Put rng_alg methods in logical order
crypto: drbg - Fold drbg_instantiate() into drbg_kcapi_seed()
crypto: drbg - Separate "reseed" case in drbg_kcapi_seed()
crypto: drbg - Fold drbg_prepare_hrng() into drbg_kcapi_seed()
crypto: drbg - Simplify "uninstantiate" logic
crypto: drbg - Include get_random_bytes() output in additional input
crypto: drbg - Change DRBG_MAX_REQUESTS to 4096
crypto: drbg - Remove redundant reseeding based on random.c state
crypto: drbg - Clean up generation code
crypto: drbg - Clean up loop in drbg_hmac_update()

 Documentation/crypto/api-samples.rst          |    2 +-
 Documentation/crypto/userspace-if.rst         |    2 +-
 arch/m68k/configs/amiga_defconfig             |    2 -
 arch/m68k/configs/apollo_defconfig            |    2 -
 arch/m68k/configs/atari_defconfig             |    2 -
 arch/m68k/configs/bvme6000_defconfig          |    2 -
 arch/m68k/configs/hp300_defconfig             |    2 -
 arch/m68k/configs/mac_defconfig               |    2 -
 arch/m68k/configs/multi_defconfig             |    2 -
 arch/m68k/configs/mvme147_defconfig           |    2 -
 arch/m68k/configs/mvme16x_defconfig           |    2 -
 arch/m68k/configs/q40_defconfig               |    2 -
 arch/m68k/configs/sun3_defconfig              |    2 -
 arch/m68k/configs/sun3x_defconfig             |    2 -
 arch/mips/configs/decstation_64_defconfig     |    2 -
 arch/mips/configs/decstation_defconfig        |    2 -
 arch/mips/configs/decstation_r4k_defconfig    |    2 -
 crypto/Kconfig                                |   40 +-
 crypto/df_sp80090a.c                          |    8 +-
 crypto/drbg.c                                 | 1800 +++--------------
 crypto/testmgr.c                              |  143 +-
 crypto/testmgr.h                              | 1262 ++++--------
 drivers/crypto/xilinx/xilinx-trng.c           |    1 -
 include/crypto/df_sp80090a.h                  |   25 +
 include/crypto/drbg.h                         |  263 ---
 include/crypto/internal/drbg.h                |   54 -
 .../crypto/chacha20-s390/test-cipher.c        |    1 -
 27 files changed, 728 insertions(+), 2903 deletions(-)
 delete mode 100644 include/crypto/drbg.h
 delete mode 100644 include/crypto/internal/drbg.h

base-commit: c1f49dea2b8f335813d3b348fd39117fb8efb428

2.53.0