netdev - [PATCH] net-xfrm: add build time cfg option to PF_KEY SHA256 to use RFC4868-compliant truncation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 16 Oct 2018 01:06:34 -0700
From:   "Maciej Żenczykowski" <zenczykowski@...il.com>
To:     "Maciej Żenczykowski" <maze@...gle.com>,
        "David S . Miller" <davem@...emloft.net>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>
Cc:     netdev@...r.kernel.org, Lorenzo Colitti <lorenzo@...gle.com>
Subject: [PATCH] net-xfrm: add build time cfg option to PF_KEY SHA256 to use
 RFC4868-compliant truncation

From: Maciej Żenczykowski <maze@...gle.com>

When using the PF_KEY interface, SHA-256 hashes are hardcoded to
use 96-bit truncation.  This is a violation of RFC4868, which
specifies 128-bit truncation.

We cannot fix this without introducing backwards compatibility
concerns unless we make it an optional build time setting
(defaulting to no).  Android will default to yes instead
of carrying an Android specific one line patch.

While the PF_KEY interface is deprecated in favour of netlink XFRM
(which allows the app to specify an arbitrary truncation length),
changing the PF_KEY truncation length from 96 to 128 allows PF_KEY
apps such as racoon to work with standards-compliant VPN servers.

Cc: Lorenzo Colitti <lorenzo@...gle.com>
Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
---
 net/xfrm/Kconfig     | 10 ++++++++++
 net/xfrm/xfrm_algo.c |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 4a9ee2d83158..0ede7e81a5d3 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -15,6 +15,16 @@ config XFRM_ALGO
 	select XFRM
 	select CRYPTO
 
+config XFRM_HMAC_SHA256_RFC4868
+	bool "Strict RFC4868 hmac(sha256) 128-bit truncation"
+	depends on XFRM_ALGO
+	default n
+	---help---
+	  Support strict RFC4868 hmac(sha256) 128-bit truncation
+	  (default on Android) instead of the default 96-bit Linux truncation.
+
+	  If unsure, say N.
+
 config XFRM_USER
 	tristate "Transformation user configuration interface"
 	depends on INET
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 44ac85fe2bc9..a70391fb2c1e 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -241,7 +241,11 @@ static struct xfrm_algo_desc aalg_list[] = {
 
 	.uinfo = {
 		.auth = {
+#if IS_ENABLED(CONFIG_XFRM_HMAC_SHA256_RFC4868)
+			.icv_truncbits = 128,
+#else
 			.icv_truncbits = 96,
+#endif
 			.icv_fullbits = 256,
 		}
 	},
-- 
2.19.1.331.ge82ca0e54c-goog