From: Oleksij Rempel <ore@pengutronix.de>
To: "Horia Geantă" <horia.geanta@nxp.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>
Cc: Harald Freudenberger <freude@linux.vnet.ibm.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Oleksij Rempel <o.rempel@pengutronix.de>,
Dan Douglass <dan.douglass@nxp.com>,
"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
"kernel@pengutronix.de" <kernel@pengutronix.de>,
Martin Schwidefsky <schwidefsky@de.ibm.com>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH v1] crypto: caam - set hwrng quality level
Date: Thu, 3 Aug 2017 11:26:57 +0200 [thread overview]
Message-ID: <8c0a88cd-8ce0-3752-d17a-9e78ff05b640@pengutronix.de> (raw)
In-Reply-To: <VI1PR0401MB25919FFF2B07150E1BD02AE298B10@VI1PR0401MB2591.eurprd04.prod.outlook.com>
On 03.08.2017 09:48, Horia Geantă wrote:
> On 8/3/2017 6:17 AM, Herbert Xu wrote:
>> On Wed, Aug 02, 2017 at 02:03:14PM +0000, Horia Geantă wrote:
>>>
>>> Take CAAM's engine HWRNG: it can work both as a TRNG and as a
>>> TRNG-seeded DRBG (that's how it's currently configured).
>>> IIUC, both setups are fit as source for the entropy pool.
>>
>> So which is it? If it's a DRBG then it should not be exposed through
>> the hwrng interface. Only TRNG should go through hwrng. DRBGs
>> can use the crypto rng API.
>
> Right now it's configured as a DRBG.
> If I read correctly, it doesn't matter it's using the internal TRNG for
> (automated) seeding, it still shouldn't use hwrng.
> This means it's broken since the very beginning:
> e24f7c9e87d4 crypto: caam - hwrng support
Hmmm..
- what is the security risk of this issue? For example system which use
/dev/hwrng directly?
- And who will fix it?
next prev parent reply other threads:[~2017-08-03 9:27 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-19 7:44 Oleksij Rempel
2017-07-19 12:49 ` Horia Geantă
2017-07-19 16:32 ` Oleksij Rempel
2017-07-19 16:53 ` Horia Geantă
2017-07-19 18:13 ` Oleksij Rempel
2017-07-20 13:08 ` Harald Freudenberger
2017-08-02 14:03 ` Horia Geantă
2017-08-03 3:16 ` Herbert Xu
2017-08-03 7:48 ` Horia Geantă
2017-08-03 9:26 ` Oleksij Rempel [this message]
2017-08-09 4:56 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8c0a88cd-8ce0-3752-d17a-9e78ff05b640@pengutronix.de \
--to=ore@pengutronix.de \
--cc=dan.douglass@nxp.com \
--cc=davem@davemloft.net \
--cc=freude@linux.vnet.ibm.com \
--cc=herbert@gondor.apana.org.au \
--cc=horia.geanta@nxp.com \
--cc=kernel@pengutronix.de \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=schwidefsky@de.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®