| Message ID | CACXcFmmw8bzSr-pmTauMS7a=036eW0=1KLdwAD1MOB_fY-7VRg@mail.gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | random Remove setting of chacha state to constant values. | expand |
diff --git a/drivers/char/random.c b/drivers/char/random.c index 655e327d425e..6df9e656a157 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -249,9 +249,7 @@ static void crng_fast_key_erasure(u8 key[CHACHA_KEY_SIZE], BUG_ON(random_data_len > 32); - chacha_init_consts(chacha_state); memcpy(&chacha_state[4], key, CHACHA_KEY_SIZE); - memset(&chacha_state[12], 0, sizeof(u32) * 4); chacha20_block(chacha_state, first_block); memcpy(key, first_block, CHACHA_KEY_SIZE);
Setting parts of the state to known constants is needed in some Chacha applications to ensure that blocks can be processed in parallel and that when needed (e.g. when encrypting disk blocks) the algorithm can jump to an arbitrary part of the output stream. In an RNG these are not required, and setting the constants wastes cycles. If (as we hope) the enemy does not know the state, then this is more secure since it makes the chacha outputs depend on more unknown bits. If they can peek at the state or infer parts of it from outputs, knowable values cannot possibly be worse than known ones. This at least prevents them from using pre-computed tables based on the known constants. Signed-off-by: Sandy Harris <sandyinchina@gmail.com> --- drivers/char/random.c | 2 -- 1 file changed, 2 deletions(-)