Page MenuHomeFreeBSD

Fortuna: Clean up reseeding key material to closer match FS&K
ClosedPublic

Authored by cem on Aug 29 2018, 4:19 AM.

Details

Summary

When reseeding, only incorporate actual key material. Do not include e.g.
the derived key schedules or other AES context.

I don't think the extra material was harmful here, just not beneficial.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

cem created this revision.Aug 29 2018, 4:19 AM
markm added inline comments.Aug 29 2018, 7:26 PM
sys/dev/random/fortuna.c
289 ↗(On Diff #47423)

The sentiment is good, but this looks a bit "magic number-ish". Dividing by 8 may give the right answer, but rather co-incidentially, no?

Would it not be more correct to have a specific sizeof(something)?

cem added inline comments.Aug 29 2018, 7:32 PM
sys/dev/random/fortuna.c
289 ↗(On Diff #47423)

keyLen is stored in bits, but randomdev_hash_iterate() takes a number of bytes. sizeof(something) wouldn't be semantically correct, even if it produced the number 8 ;-).

See preexisting use of the 8 constant to translate between rijndael key lengths and ordinary byte lengths in e.g., dev/random/hash.c and crypto/rijndael/rijndael-api-fst.c.

(In general, FreeBSD MI code in general and crypto implementations in particular widely assume 8 bits per byte.)

markm accepted this revision.Aug 29 2018, 7:36 PM
markm added inline comments.
sys/dev/random/fortuna.c
289 ↗(On Diff #47423)

I geddit. keyless is in bits.

LGTM.

This revision is now accepted and ready to land.Aug 29 2018, 7:36 PM
delphij accepted this revision.Aug 29 2018, 8:54 PM
delphij accepted this revision.
delphij added a reviewer: secteam.
This revision was automatically updated to reflect the committed changes.