On Tue, 12 Jan 2021 at 20:30, Eric Biggers <ebiggers@xxxxxxxxxx> wrote: > > From: Eric Biggers <ebiggers@xxxxxxxxxx> > > On big endian CPUs, the ChaCha20-based CRNG is using the wrong > endianness for the ChaCha20 constants. > > This doesn't matter cryptographically, but technically it means it's not > ChaCha20 anymore. Fix it to always use the standard constants. > > Cc: linux-crypto@xxxxxxxxxxxxxxx > Cc: Andy Lutomirski <luto@xxxxxxxxxx> > Cc: Jann Horn <jannh@xxxxxxxxxx> > Cc: Theodore Ts'o <tytso@xxxxxxx> > Acked-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> > Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> Acked-by: Ard Biesheuvel <ardb@xxxxxxxxxx> > --- > > Andrew, please consider taking this patch since the maintainer has been > ignoring it for 4 months > (https://lkml.kernel.org/lkml/20200916045013.142179-1-ebiggers@xxxxxxxxxx/T/#u). > > > drivers/char/random.c | 4 ++-- > include/crypto/chacha.h | 9 +++++++-- > 2 files changed, 9 insertions(+), 4 deletions(-) > > diff --git a/drivers/char/random.c b/drivers/char/random.c > index bbc5098b1a81f..4037a1e0fb748 100644 > --- a/drivers/char/random.c > +++ b/drivers/char/random.c > @@ -809,7 +809,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng) > > static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) > { > - memcpy(&crng->state[0], "expand 32-byte k", 16); > + chacha_init_consts(crng->state); > _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); > crng_init_try_arch(crng); > crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; > @@ -817,7 +817,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) > > static void __init crng_initialize_primary(struct crng_state *crng) > { > - memcpy(&crng->state[0], "expand 32-byte k", 16); > + chacha_init_consts(crng->state); > _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0); > if (crng_init_try_arch_early(crng) && trust_cpu) { > invalidate_batched_entropy(); > diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h > index 3a1c72fdb7cf5..dabaee6987186 100644 > --- a/include/crypto/chacha.h > +++ b/include/crypto/chacha.h > @@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds) > hchacha_block_generic(state, out, nrounds); > } > > -void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); > -static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) > +static inline void chacha_init_consts(u32 *state) > { > state[0] = 0x61707865; /* "expa" */ > state[1] = 0x3320646e; /* "nd 3" */ > state[2] = 0x79622d32; /* "2-by" */ > state[3] = 0x6b206574; /* "te k" */ > +} > + > +void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); > +static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) > +{ > + chacha_init_consts(state); > state[4] = key[0]; > state[5] = key[1]; > state[6] = key[2]; > -- > 2.30.0 >
