linux-kernel - Re: [PATCH v4 2/5] KEYS: trusted: allow users to use kernel RNG for key material

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YawE8cQ2SZjxqWUo@iki.fi>
Date:   Sun, 5 Dec 2021 02:16:49 +0200
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Ahmad Fatoum <a.fatoum@...gutronix.de>
Cc:     James Bottomley <jejb@...ux.ibm.com>,
        Mimi Zohar <zohar@...ux.ibm.com>,
        David Howells <dhowells@...hat.com>, kernel@...gutronix.de,
        Sumit Garg <sumit.garg@...aro.org>,
        David Gstir <david@...ma-star.at>,
        Tim Harvey <tharvey@...eworks.com>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Horia Geantă <horia.geanta@....com>,
        Aymen Sghaier <aymen.sghaier@....com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Udit Agarwal <udit.agarwal@....com>,
        Jan Luebbe <j.luebbe@...gutronix.de>,
        Eric Biggers <ebiggers@...nel.org>,
        Richard Weinberger <richard@....at>,
        Franck LENORMAND <franck.lenormand@....com>,
        keyrings@...r.kernel.org, linux-crypto@...r.kernel.org,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: Re: [PATCH v4 2/5] KEYS: trusted: allow users to use kernel RNG for
 key material

On Mon, Oct 11, 2021 at 12:02:35PM +0200, Ahmad Fatoum wrote:
> The two existing trusted key sources don't make use of the kernel RNG,
> but instead let the hardware doing the sealing/unsealing also
> generate the random key material. However, Users may want to place

"Users" -> "users"

> less trust into the quality of the trust source's random number
> generator and instead use the kernel entropy pool, which can be
> seeded from multiple entropy sources.
> 
> Make this possible by adding a new trusted.kernel_rng parameter,
> that will force use of the kernel RNG. In its absence, it's up
> to the trust source to decide, which random numbers to use,
> maintaining the existing behavior.
> 
> Suggested-by: Jarkko Sakkinen <jarkko@...nel.org>
> Acked-by: Sumit Garg <sumit.garg@...aro.org>
> Reviewed-by: David Gstir <david@...ma-star.at>
> Tested-By: Tim Harvey <tharvey@...eworks.com>
> Signed-off-by: Ahmad Fatoum <a.fatoum@...gutronix.de>
> ---
> To: James Bottomley <jejb@...ux.ibm.com>
> To: Jarkko Sakkinen <jarkko@...nel.org>
> To: Mimi Zohar <zohar@...ux.ibm.com>
> To: David Howells <dhowells@...hat.com>
> Cc: James Morris <jmorris@...ei.org>
> Cc: "Serge E. Hallyn" <serge@...lyn.com>
> Cc: "Horia Geantă" <horia.geanta@....com>
> Cc: Aymen Sghaier <aymen.sghaier@....com>
> Cc: Herbert Xu <herbert@...dor.apana.org.au>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: Udit Agarwal <udit.agarwal@....com>
> Cc: Jan Luebbe <j.luebbe@...gutronix.de>
> Cc: Eric Biggers <ebiggers@...nel.org>
> Cc: David Gstir <david@...ma-star.at>
> Cc: Richard Weinberger <richard@....at>
> Cc: Franck LENORMAND <franck.lenormand@....com>
> Cc: Sumit Garg <sumit.garg@...aro.org>
> Cc: keyrings@...r.kernel.org
> Cc: linux-crypto@...r.kernel.org
> Cc: linux-integrity@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> Cc: linux-security-module@...r.kernel.org
> ---
>  Documentation/admin-guide/kernel-parameters.txt   |  7 ++++++-
>  Documentation/security/keys/trusted-encrypted.rst | 20 +++++++++-------
>  security/keys/trusted-keys/trusted_core.c         | 17 +++++++++++++-
>  3 files changed, 35 insertions(+), 9 deletions(-)
> 
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index 43dc35fe5bc0..d5969452f063 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -5772,6 +5772,13 @@
>  			first trust source as a backend which is initialized
>  			successfully during iteration.
>  
> +	trusted.kernel_rng =	[KEYS]
> +			Format: <bool>
> +			When set to true (1), the kernel random number pool
> +			is used to generate key material for trusted keys.
> +			The default is to leave the RNG's choice to each
> +			individual trust source.
> +
>  	tsc=		Disable clocksource stability checks for TSC.
>  			Format: <string>
>  			[x86] reliable: mark tsc clocksource as reliable, this
> diff --git a/Documentation/security/keys/trusted-encrypted.rst b/Documentation/security/keys/trusted-encrypted.rst
> index 80d5a5af62a1..1d4b4b8f12f0 100644
> --- a/Documentation/security/keys/trusted-encrypted.rst
> +++ b/Documentation/security/keys/trusted-encrypted.rst
> @@ -87,22 +87,26 @@ Key Generation
>  Trusted Keys
>  ------------
>  
> -New keys are created from random numbers generated in the trust source. They
> -are encrypted/decrypted using a child key in the storage key hierarchy.
> -Encryption and decryption of the child key must be protected by a strong
> -access control policy within the trust source.
> +New keys are created from random numbers. They are encrypted/decrypted using
> +a child key in the storage key hierarchy. Encryption and decryption of the
> +child key must be protected by a strong access control policy within the
> +trust source. The random number generator in use differs according to the
> +selected trust source:
>  
> -  *  TPM (hardware device) based RNG
> +  *  TPM: hardware device based RNG
>  
> -     Strength of random numbers may vary from one device manufacturer to
> -     another.
> +     Keys are generated within the TPM. Strength of random numbers may vary
> +     from one device manufacturer to another.
>  
> -  *  TEE (OP-TEE based on Arm TrustZone) based RNG
> +  *  TEE: OP-TEE based on Arm TrustZone based RNG
>  
>       RNG is customizable as per platform needs. It can either be direct output
>       from platform specific hardware RNG or a software based Fortuna CSPRNG
>       which can be seeded via multiple entropy sources.
>  
> +Optionally, users may specify ``trusted.kernel_rng=1`` on the kernel
> +command-line to override the used RNG with the kernel's random number pool.
> +
>  Encrypted Keys
>  --------------
>  
> diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
> index 8cab69e5d0da..569af9af8df0 100644
> --- a/security/keys/trusted-keys/trusted_core.c
> +++ b/security/keys/trusted-keys/trusted_core.c
> @@ -16,12 +16,17 @@
>  #include <linux/key-type.h>
>  #include <linux/module.h>
>  #include <linux/parser.h>
> +#include <linux/random.h>
>  #include <linux/rcupdate.h>
>  #include <linux/slab.h>
>  #include <linux/static_call.h>
>  #include <linux/string.h>
>  #include <linux/uaccess.h>
>  
> +static bool trusted_kernel_rng;
> +module_param_named(kernel_rng, trusted_kernel_rng, bool, 0);
> +MODULE_PARM_DESC(kernel_rng, "Generate key material from kernel RNG");

It's not then always kernel RNG, i.e. that is a very misleading name.

I'd prefer trusted_rng with string values "kernel", "tee". That makes
it explicit what you are using.

/Jarkko