crypto: drbg - Remove redundant reseeding based on random.c state

We're now incorporating 32 bytes from get_random_bytes() in the additional input string on every request. The additional input string is processed with a call to drbg_hmac_update(), which is exactly how the seed is processed. Thus, in reality this is as good as a reseed. From the perspective of FIPS 140-3, it isn't as good as a reseed. But it doesn't actually matter, because from FIPS's point of view get_random_bytes() provides zero entropy anyway. Thus, neither the reseed with more get_random_bytes() every 300s, nor the logic that reseeds more frequently before rng_is_initialized(), is actually needed anymore. Remove it to simplify the code significantly. (Technically the use of get_random_bytes() in drbg_seed() itself could be removed too. But it's safer to keep it there for now.) Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
author: Eric Biggers <ebiggers@kernel.org> 2026-04-19 23:34:20 -0700
committer: Herbert Xu <herbert@gondor.apana.org.au> 2026-05-07 16:10:01 +0800
commit: a918c3680d2ea1d3c2df589397c0ffd4dac2ceaa (patch)
tree: 8fe78e778ca87be9fc69dcb26a5f2237aecdf2bf
parent: 005b19f18ea9fc51fc35fbcb27759ae83c7c89f8 (diff)
download: linux-next-history-a918c3680d2ea1d3c2df589397c0ffd4dac2ceaa.tar.gz
1 files changed, 9 insertions, 98 deletions
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 7fd076ddc1053..bab766026177a 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -93,18 +93,11 @@
 #include <crypto/sha2.h>
 #include <linux/fips.h>
 #include <linux/kernel.h>
-#include <linux/jiffies.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/string_choices.h>
 #include <linux/unaligned.h>
 
-enum drbg_seed_state {
-	DRBG_SEED_STATE_UNSEEDED,
-	DRBG_SEED_STATE_PARTIAL, /* Seeded with !rng_is_initialized() */
-	DRBG_SEED_STATE_FULL,
-};
-
 /* State length in bytes */
 #define DRBG_STATE_LEN		SHA512_DIGEST_SIZE
 
@@ -137,9 +130,6 @@ struct drbg_state {
 	struct hmac_sha512_key key;	/* current key -- 10.1.2.1 1b */
 	/* Number of RNG requests since last reseed -- 10.1.2.1 1c */
 	size_t reseed_ctr;
-	size_t reseed_threshold;
-	enum drbg_seed_state seeded;		/* DRBG fully seeded? */
-	unsigned long last_seed_time;
 	bool instantiated;
 	bool pr;		/* Prediction resistance enabled? */
 	struct crypto_rng *jent;
@@ -239,72 +229,6 @@ static void drbg_hmac_generate(struct drbg_state *drbg,
 	memzero_explicit(addtl2, sizeof(addtl2));
 }
 
-static inline void __drbg_seed(struct drbg_state *drbg,
-			       const u8 *seed1, size_t seed1_len,
-			       const u8 *seed2, size_t seed2_len,
-			       enum drbg_seed_state new_seed_state)
-{
-	drbg_hmac_update(drbg, seed1, seed1_len, seed2, seed2_len);
-
-	drbg->seeded = new_seed_state;
-	drbg->last_seed_time = jiffies;
-	drbg->reseed_ctr = 1;
-
-	switch (drbg->seeded) {
-	case DRBG_SEED_STATE_UNSEEDED:
-		/* Impossible, but handle it to silence compiler warnings. */
-		fallthrough;
-	case DRBG_SEED_STATE_PARTIAL:
-		/*
-		 * Require frequent reseeds until the seed source is
-		 * fully initialized.
-		 */
-		drbg->reseed_threshold = 50;
-		break;
-
-	case DRBG_SEED_STATE_FULL:
-		/*
-		 * Seed source has become fully initialized, frequent
-		 * reseeds no longer required.
-		 */
-		drbg->reseed_threshold = DRBG_MAX_REQUESTS;
-		break;
-	}
-}
-
-static void drbg_seed_from_random(struct drbg_state *drbg)
-	__must_hold(&drbg->drbg_mutex)
-{
-	u8 entropy[DRBG_SEC_STRENGTH];
-
-	get_random_bytes(entropy, DRBG_SEC_STRENGTH);
-
-	__drbg_seed(drbg, entropy, DRBG_SEC_STRENGTH, NULL, 0,
-		    DRBG_SEED_STATE_FULL);
-
-	memzero_explicit(entropy, DRBG_SEC_STRENGTH);
-}
-
-static bool drbg_nopr_reseed_interval_elapsed(struct drbg_state *drbg)
-{
-	unsigned long next_reseed;
-
-	/* Don't ever reseed from get_random_bytes() in test mode. */
-	if (drbg->test_entropylen)
-		return false;
-
-	/*
-	 * Obtain fresh entropy for the nopr DRBGs after 300s have
-	 * elapsed in order to still achieve sort of partial
-	 * prediction resistance over the time domain at least. Note
-	 * that the period of 300s has been chosen to match the
-	 * CRNG_RESEED_INTERVAL of the get_random_bytes()' chacha
-	 * rngs.
-	 */
-	next_reseed = drbg->last_seed_time + 300 * HZ;
-	return time_after(jiffies, next_reseed);
-}
-
 /*
  * Seeding or reseeding of the DRBG
  *
@@ -325,7 +249,6 @@ static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len,
 	u8 entropy_buf[(32 + 16) * 2];
 	size_t entropylen;
 	const u8 *entropy;
-	enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
 
 	/* 9.1 / 9.2 / 9.3.1 step 3 */
 	if (pers_len > DRBG_MAX_ADDTL) {
@@ -355,9 +278,6 @@ static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len,
 		BUG_ON(entropylen * 2 > sizeof(entropy_buf));
 
 		/* Get seed from in-kernel /dev/urandom */
-		if (!rng_is_initialized())
-			new_seed_state = DRBG_SEED_STATE_PARTIAL;
-
 		get_random_bytes(entropy_buf, entropylen);
 
 		if (!drbg->jent) {
@@ -401,7 +321,8 @@ static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len,
 	if (pers_len)
 		pr_devel("DRBG: using personalization string\n");
 
-	__drbg_seed(drbg, entropy, entropylen, pers, pers_len, new_seed_state);
+	drbg_hmac_update(drbg, entropy, entropylen, pers, pers_len);
+	drbg->reseed_ctr = 1;
 	ret = 0;
 out:
 	memzero_explicit(entropy_buf, sizeof(entropy_buf));
@@ -463,16 +384,14 @@ static int drbg_generate(struct drbg_state *drbg,
 	/*
 	 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
 	 * here. The spec is a bit convoluted here, we make it simpler.
+	 *
+	 * We no longer try to detect when random.c has reseeded itself and call
+	 * drbg_seed() then too, since drbg_hmac_generate() adds bytes from
+	 * random.c to the additional input, which is a de facto reseed anyway.
 	 */
-	if (drbg->reseed_threshold < drbg->reseed_ctr)
-		drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
-
-	if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
-		pr_devel("DRBG: reseeding before generation (prediction "
-			 "resistance: %s, state %s)\n",
-			 str_true_false(drbg->pr),
-			 (drbg->seeded ==  DRBG_SEED_STATE_FULL ?
-			  "seeded" : "unseeded"));
+	if (drbg->pr || drbg->reseed_ctr > DRBG_MAX_REQUESTS) {
+		pr_devel("DRBG: reseeding before generation (prediction resistance: %s)\n",
+			 str_true_false(drbg->pr));
 		/* 9.3.1 steps 7.1 through 7.3 */
 		len = drbg_seed(drbg, addtl, addtl_len, true);
 		if (len)
@@ -480,10 +399,6 @@ static int drbg_generate(struct drbg_state *drbg,
 		/* 9.3.1 step 7.4 */
 		addtl = NULL;
 		addtl_len = 0;
-	} else if (rng_is_initialized() &&
-		   (drbg->seeded == DRBG_SEED_STATE_PARTIAL ||
-		    drbg_nopr_reseed_interval_elapsed(drbg))) {
-		drbg_seed_from_random(drbg);
 	}
 
 	/* 9.3.1 step 8 and 10 */
@@ -564,9 +479,6 @@ static int drbg_kcapi_seed(struct crypto_rng *tfm,
 	/* 9.1 step 4 is implicit in DRBG_SEC_STRENGTH */
 
 	drbg->pr = pr;
-	drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
-	drbg->last_seed_time = 0;
-	drbg->reseed_threshold = DRBG_MAX_REQUESTS;
 	memset(drbg->V, 1, DRBG_STATE_LEN);
 	hmac_sha512_preparekey(&drbg->key, initial_key, DRBG_STATE_LEN);
 
@@ -673,7 +585,6 @@ static inline int __init drbg_healthcheck_sanity(void)
 
 	guard(mutex_init)(&drbg->drbg_mutex);
 	drbg->instantiated = true;
-	drbg->reseed_threshold = DRBG_MAX_REQUESTS;
 
 	/*
 	 * if the following tests fail, it is likely that there is a buffer
author	Eric Biggers <ebiggers@kernel.org>	2026-04-19 23:34:20 -0700
committer	Herbert Xu <herbert@gondor.apana.org.au>	2026-05-07 16:10:01 +0800
commit	a918c3680d2ea1d3c2df589397c0ffd4dac2ceaa (patch)
tree	8fe78e778ca87be9fc69dcb26a5f2237aecdf2bf
parent	005b19f18ea9fc51fc35fbcb27759ae83c7c89f8 (diff)
download	linux-next-history-a918c3680d2ea1d3c2df589397c0ffd4dac2ceaa.tar.gz