CVS commit: src

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Thu Apr 30 03:28:19 UTC 2020

Modified Files:
        src/common/lib/libc: Makefile.inc
        src/distrib/sets/lists/comp: mi
        src/share/man/man4: rnd.4
        src/share/man/man9: Makefile rnd.9
        src/sys/dev: files.dev
        src/sys/kern: files.kern init_main.c subr_autoconf.c subr_cprng.c
            subr_prf.c
        src/sys/lib/libkern: Makefile.libkern
        src/sys/rump/dev/lib/librnd: Makefile rnd_component.c
        src/sys/rump/librump/rumpkern: Makefile.rumpkern emul.c rump.c
        src/sys/sys: cprng.h rndpool.h rndsource.h
Added Files:
        src/sys/dev: random.c
        src/sys/kern: kern_entropy.c
        src/sys/lib/libkern: entpool.c entpool.h
        src/sys/sys: entropy.h
Removed Files:
        src/share/man/man9: rndsink.9
        src/sys/arch/amd64/conf: RNDVERBOSE
        src/sys/dev: rnd_private.h rndpseudo.c
        src/sys/kern: kern_rndpool.c kern_rndq.c kern_rndsink.c
        src/sys/sys: rndsink.h

Log Message:
Rewrite entropy subsystem.

Primary goals:

1. Use cryptography primitives designed and vetted by cryptographers.
2. Be honest about entropy estimation.
3. Propagate full entropy as soon as possible.
4. Simplify the APIs.
5. Reduce overhead of rnd_add_data and cprng_strong.
6. Reduce side channels of HWRNG data and human input sources.
7. Improve visibility of operation with sysctl and event counters.

Caveat: rngtest is no longer used generically for RND_TYPE_RNG
rndsources.  Hardware RNG devices should have hardware-specific
health tests.  For example, checking for two repeated 256-bit outputs
works to detect AMD's 2019 RDRAND bug.  Not all hardware RNGs are
necessarily designed to produce exactly uniform output.

ENTROPY POOL

- A Keccak sponge, with test vectors, replaces the old LFSR/SHA-1
  kludge as the cryptographic primitive.

- `Entropy depletion' is available for testing purposes with a sysctl
  knob kern.entropy.depletion; otherwise it is disabled, and once the
  system reaches full entropy it is assumed to stay there as far as
  modern cryptography is concerned.

- No `entropy estimation' based on sample values.  Such `entropy
  estimation' is a contradiction in terms, dishonest to users, and a
  potential source of side channels.  It is the responsibility of the
  driver author to study the entropy of the process that generates
  the samples.

- Per-CPU gathering pools avoid contention on a global queue.

- Entropy is occasionally consolidated into global pool -- as soon as
  it's ready, if we've never reached full entropy, and with a rate
  limit afterward.  Operators can force consolidation now by running
  sysctl -w kern.entropy.consolidate=1.

- rndsink(9) API has been replaced by an epoch counter which changes
  whenever entropy is consolidated into the global pool.
  . Usage: Cache entropy_epoch() when you seed.  If entropy_epoch()
    has changed when you're about to use whatever you seeded, reseed.
  . Epoch is never zero, so initialize cache to 0 if you want to reseed
    on first use.
  . Epoch is -1 iff we have never reached full entropy -- in other
    words, the old rnd_initial_entropy is (entropy_epoch() != -1) --
    but it is better if you check for changes rather than for -1, so
    that if the system estimated its own entropy incorrectly, entropy
    consolidation has the opportunity to prevent future compromise.

- Sysctls and event counters provide operator visibility into what's
  happening:
  . kern.entropy.needed - bits of entropy short of full entropy
  . kern.entropy.pending - bits known to be pending in per-CPU pools,
    can be consolidated with sysctl -w kern.entropy.consolidate=1
  . kern.entropy.epoch - number of times consolidation has happened,
    never 0, and -1 iff we have never reached full entropy

CPRNG_STRONG

- A cprng_strong instance is now a collection of per-CPU NIST
  Hash_DRBGs.  There are only two in the system: user_cprng for
  /dev/urandom and sysctl kern.?random, and kern_cprng for kernel
  users which may need to operate in interrupt context up to IPL_VM.

  (Calling cprng_strong in interrupt context does not strike me as a
  particularly good idea, so I added an event counter to see whether
  anything actually does.)

- Event counters provide operator visibility into when reseeding
  happens.

INTEL RDRAND/RDSEED, VIA C3 RNG (CPU_RNG)

- Unwired for now; will be rewired in a subsequent commit.


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 src/common/lib/libc/Makefile.inc
cvs rdiff -u -r1.2322 -r1.2323 src/distrib/sets/lists/comp/mi
cvs rdiff -u -r1.28 -r1.29 src/share/man/man4/rnd.4
cvs rdiff -u -r1.448 -r1.449 src/share/man/man9/Makefile
cvs rdiff -u -r1.27 -r1.28 src/share/man/man9/rnd.9
cvs rdiff -u -r1.2 -r0 src/share/man/man9/rndsink.9
cvs rdiff -u -r1.2 -r0 src/sys/arch/amd64/conf/RNDVERBOSE
cvs rdiff -u -r1.5 -r1.6 src/sys/dev/files.dev
cvs rdiff -u -r0 -r1.1 src/sys/dev/random.c
cvs rdiff -u -r1.11 -r0 src/sys/dev/rnd_private.h
cvs rdiff -u -r1.38 -r0 src/sys/dev/rndpseudo.c
cvs rdiff -u -r1.46 -r1.47 src/sys/kern/files.kern
cvs rdiff -u -r1.523 -r1.524 src/sys/kern/init_main.c
cvs rdiff -u -r0 -r1.1 src/sys/kern/kern_entropy.c
cvs rdiff -u -r1.18 -r0 src/sys/kern/kern_rndpool.c
cvs rdiff -u -r1.96 -r0 src/sys/kern/kern_rndq.c
cvs rdiff -u -r1.17 -r0 src/sys/kern/kern_rndsink.c
cvs rdiff -u -r1.269 -r1.270 src/sys/kern/subr_autoconf.c
cvs rdiff -u -r1.35 -r1.36 src/sys/kern/subr_cprng.c
cvs rdiff -u -r1.182 -r1.183 src/sys/kern/subr_prf.c
cvs rdiff -u -r1.47 -r1.48 src/sys/lib/libkern/Makefile.libkern
cvs rdiff -u -r0 -r1.1 src/sys/lib/libkern/entpool.c \
    src/sys/lib/libkern/entpool.h
cvs rdiff -u -r1.11 -r1.12 src/sys/rump/dev/lib/librnd/Makefile
cvs rdiff -u -r1.6 -r1.7 src/sys/rump/dev/lib/librnd/rnd_component.c
cvs rdiff -u -r1.182 -r1.183 src/sys/rump/librump/rumpkern/Makefile.rumpkern
cvs rdiff -u -r1.195 -r1.196 src/sys/rump/librump/rumpkern/emul.c
cvs rdiff -u -r1.346 -r1.347 src/sys/rump/librump/rumpkern/rump.c
cvs rdiff -u -r1.16 -r1.17 src/sys/sys/cprng.h
cvs rdiff -u -r0 -r1.1 src/sys/sys/entropy.h
cvs rdiff -u -r1.3 -r1.4 src/sys/sys/rndpool.h
cvs rdiff -u -r1.1 -r0 src/sys/sys/rndsink.h
cvs rdiff -u -r1.6 -r1.7 src/sys/sys/rndsource.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.