Patch "security/keys: rewrite all of big_key crypto" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

security/keys: rewrite all of big_key crypto

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
security-keys-rewrite-all-of-big_key-crypto.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Jason A. Donenfeld" <[email protected]>
Date: Wed, 20 Sep 2017 16:58:39 +0200
Subject: security/keys: rewrite all of big_key crypto

From: Jason A. Donenfeld <[email protected]>

commit 428490e38b2e352812e0b765d8bceafab0ec441d upstream.

This started out as just replacing the use of crypto/rng with get_random_bytes_wait, so that we wouldn't use bad randomness at boot time. But, upon looking further, it appears that there were even deeper underlying cryptographic problems, and that this seems to have been committed with very little crypto review. So, I rewrote the whole thing, trying to keep to the conventions introduced by the previous author, to fix these cryptographic flaws.

It makes no sense to seed crypto/rng at boot time and then keep using it like this, when in fact there's already get_random_bytes_wait, which can ensure there's enough entropy and be a much more standard way of generating keys. Since this sensitive material is being stored untrusted, using ECB and no authentication is simply not okay at all. I find it surprising and a bit horrifying that this code even made it past basic crypto review, which perhaps points to some larger issues. This patch moves from using AES-ECB to using AES-GCM. Since keys are uniquely generated each time, we can set the nonce to zero. There was also a race condition in which the same key would be reused at the same time in different threads. A mutex fixes this issue now.

So, to summarize, this commit fixes the following vulnerabilities:

* Low entropy key generation, allowing an attacker to potentially guess or predict keys.
* Unauthenticated encryption, allowing an attacker to modify the cipher text in particular ways in order to manipulate the plaintext, which is is even more frightening considering the next point.
* Use of ECB mode, allowing an attacker to trivially swap blocks or compare identical plaintext blocks.
* Key re-use.
* Faulty memory zeroing.

---
 security/keys/Kconfig   |    4 -
 security/keys/big_key.c |  124 ++++++++++++++++++++++--------------------------
 2 files changed, 59 insertions(+), 69 deletions(-)

@@ -45,10 +45,8 @@ config BIG_KEYS
 	bool "Large payload keys"
 	depends on KEYS
 	depends on TMPFS
-	depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
 	select CRYPTO_AES
-	select CRYPTO_ECB
-	select CRYPTO_RNG
+	select CRYPTO_GCM
 	help
 	  This option provides support for holding large keys within the kernel
 	  (for example Kerberos ticket caches).  The data may be stored out to

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/security-keys-rewrite-all-of-big_key-crypto.patch queue-4.13/security-keys-properly-zero-out-sensitive-key-material-in-big_key.patch