|
 |
7682e8 |
From 0a5e608b8b18d4f41e4d7434c6262bf11507f859 Mon Sep 17 00:00:00 2001
|
|
|
7682e8 |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
7682e8 |
Date: Tue, 16 Aug 2022 15:30:43 +0200
|
|
|
7682e8 |
Subject: [PATCH] random: Use getrandom (GRND_RANDOM) in FIPS mode
|
|
|
7682e8 |
|
|
|
7682e8 |
The SP800-90C (clarified in IG D.K.) requires the following when
|
|
|
7682e8 |
different DRBGs are chained:
|
|
|
7682e8 |
* the parent needs to be reseeded before generate operation
|
|
|
7682e8 |
* the reseed & generate needs to be atomic
|
|
|
7682e8 |
|
|
|
7682e8 |
In RHEL, this is addressed by change in the kernel, that will do this
|
|
|
7682e8 |
automatically, when the getentropy () is called with GRND_RANDOM flag.
|
|
|
7682e8 |
|
|
|
7682e8 |
* random/rndgetentropy.c (_gcry_rndgetentropy_gather_random): Use
|
|
|
7682e8 |
GRND_RANDOM in FIPS Mode
|
|
|
7682e8 |
---
|
|
|
7682e8 |
|
|
|
7682e8 |
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
|
7682e8 |
---
|
|
|
7682e8 |
random/rndgetentropy.c | 5 ++++-
|
|
|
7682e8 |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
7682e8 |
|
|
|
7682e8 |
diff --git a/random/rndgetentropy.c b/random/rndgetentropy.c
|
|
|
7682e8 |
index 7580873e..db4b09ed 100644
|
|
|
7682e8 |
--- a/random/rndgetentropy.c
|
|
|
7682e8 |
+++ b/random/rndgetentropy.c
|
|
|
7682e8 |
@@ -82,7 +82,10 @@ _gcry_rndgetentropy_gather_random (void (*add)(const void*, size_t,
|
|
|
7682e8 |
{
|
|
|
7682e8 |
nbytes = length < sizeof (buffer)? length : sizeof (buffer);
|
|
|
7682e8 |
_gcry_pre_syscall ();
|
|
|
7682e8 |
- ret = getentropy (buffer, nbytes);
|
|
|
7682e8 |
+ if (fips_mode ())
|
|
|
7682e8 |
+ ret = getrandom (buffer, nbytes, GRND_RANDOM);
|
|
|
7682e8 |
+ else
|
|
|
7682e8 |
+ ret = getentropy (buffer, nbytes);
|
|
|
7682e8 |
_gcry_post_syscall ();
|
|
|
7682e8 |
}
|
|
|
7682e8 |
while (ret == -1 && errno == EINTR);
|
|
|
7682e8 |
--
|
|
|
7682e8 |
2.37.1
|
|
|
7682e8 |
|