linux-kernel - Re: [PATCH v2 2/2] crypto: aead, cipher

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45EEAC43-DC21-4B79-BE9A-9876A8C59269@amazon.com>
Date: Tue, 16 Apr 2024 19:14:28 +0000
From: "Mothershead, Hailey" <hailmo@...zon.com>
To: Eric Biggers <ebiggers@...nel.org>
CC: "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
	"davem@...emloft.net" <davem@...emloft.net>, "linux-crypto@...r.kernel.org"
	<linux-crypto@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 2/2] crypto: aead, cipher - zeroize key buffer after use

> On 4/15/24, 3:50 PM, "Eric Biggers" <ebiggers@...nel.org <mailto:ebiggers@...nel.org>> wrote:
>
> On Mon, Apr 15, 2024 at 10:19:15PM +0000, Hailey Mothershead wrote:
> > I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding
> > cryptographic information should be zeroized once they are no longer
> > needed. Accomplish this by using kfree_sensitive for buffers that
> > previously held the private key.
> >
> > Signed-off-by: Hailey Mothershead <hailmo@...zon.com <mailto:hailmo@...zon.com>>
> > ---
> > crypto/aead.c | 3 +--
> > crypto/cipher.c | 3 +--
> > 2 files changed, 2 insertions(+), 4 deletions(-)
> >
> > diff --git a/crypto/aead.c b/crypto/aead.c
> > index 16991095270d..c4ece86c45bc 100644
> > --- a/crypto/aead.c
> > +++ b/crypto/aead.c
> > @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key,
> > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
> > memcpy(alignbuffer, key, keylen);
> > ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen);
> > - memset(alignbuffer, 0, keylen);
> > - kfree(buffer);
> > + kfree_sensitive(buffer);
> > return ret;
> > }
> >
> > diff --git a/crypto/cipher.c b/crypto/cipher.c
> > index b47141ed4a9f..395f0c2fbb9f 100644
> > --- a/crypto/cipher.c
> > +++ b/crypto/cipher.c
> > @@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key,
> > alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
> > memcpy(alignbuffer, key, keylen);
> > ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen);
> > - memset(alignbuffer, 0, keylen);
> > - kfree(buffer);
> > + kfree_sensitive(buffer);
> > return ret;
>
>
> Well, the memset()s that you're removing already did the zeroization. This
> patch seems worthwhile as a code simplification, but please don't characterize
> it as a bug fix, because it's not.
>
>
> - Eric

kfree_sensitive uses memzero_explicit() instead of the memset()s used
above. The memzero_explicit header states -

* Note: usually using memset() is just fine (!), but in cases
* where clearing out _local_ data at the end of a scope is
* necessary, memzero_explicit() should be used instead in
* order to prevent the compiler from optimising away zeroing.

It accomplishes this by calling memset() and then adding a barrier. Since
FIPS requires this data be zeroed out, and the current memset() and
kfree() don't guarantee this, I do not think the commit message is
misleading. I can clarify the message with the above information if that
is preferred.