linux-kernel - Re: [PATCH v6 3/3] arch/x86/mm/kaslr: use siphash instead of prandom_bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAD0z2U0GkJt8Xt1xDPfhBRJ3JbugUSggFj2-Q+F9MKhQr+0L6A@mail.gmail.com>
Date:   Sun, 23 Apr 2023 10:30:24 +0300
From:   David Keisar Schm <david.keisarschm@...l.huji.ac.il>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     linux-kernel@...r.kernel.org,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        keescook@...omium.org, ilay.bahat1@...il.com, aksecurity@...il.com
Subject: Re: [PATCH v6 3/3] arch/x86/mm/kaslr: use siphash instead of prandom_bytes_state

On Sun, Apr 16, 2023 at 8:26 PM Jason A. Donenfeld <Jason@...c4.com> wrote:
>
> On 4/16/23, david.keisarschm@...l.huji.ac.il
> <david.keisarschm@...l.huji.ac.il> wrote:
> > From: David Keisar Schmidt <david.keisarschm@...l.huji.ac.il>
> >
> > However, the seeding here is done by calling prandom_seed_state,
> > which effectively uses only 32bits of the seed, which means that observing
> > ONE
> > region's offset (say 30 bits) can provide the attacker with 2 possible
> > seeds
> > (from which the attacker can calculate the remaining two regions)
> >
> > In order to fix it,  we have replaced the two invocations of
> > prandom_bytes_state and prandom_seed_state
> > with siphash, which is considered more secure.
> > Besides, the original code used the same pseudo-random number in every
> > iteration,
> > so to add some additional randomization
> > we call siphash every iteration, hashing the iteration index with the
> > described key.
> >
> >
>
> Nack. Please don't add bespoke new RNG constructions willy nilly. I
> just spent a while cleaning this kind of thing up.

Hi Jason,

Thank you for reviewing our revised patch. We appreciate your concern
regarding the use of custom RNG constructions, and we understand the
potential issues that could arise from doing so.

However, we wanted to clarify that our intention was to use a
deterministic PRNG that meets Kees Cook's requirements for debugging
and performance analysis purposes.

We also acknowledge that using a custom RNG could introduce additional
risks, and we're open to exploring alternative solutions that meet our
requirements.

If you have any suggestions for a more secure and deterministic RNG,
we'd be happy to hear them and implement them.