1 /* 2 * DRBG: Deterministic Random Bits Generator 3 * Implementation of the HMAC SHA-512 DRBG from NIST SP800-90A, 4 * both with and without prediction resistance 5 * 6 * Copyright Stephan Mueller <smueller@chronox.de>, 2014 7 * Copyright 2026 Google LLC 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, and the entire permission notice in its entirety, 14 * including the disclaimer of warranties. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. The name of the author may not be used to endorse or promote 19 * products derived from this software without specific prior 20 * written permission. 21 * 22 * ALTERNATIVELY, this product may be distributed under the terms of 23 * the GNU General Public License, in which case the provisions of the GPL are 24 * required INSTEAD OF the above restrictions. (This clause is 25 * necessary due to a potential bad interaction between the GPL and 26 * the restrictions contained in a BSD-style copyright.) 27 * 28 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 29 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 30 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF 31 * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE 32 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 33 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 34 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 35 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 36 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 38 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH 39 * DAMAGE. 40 * 41 * DRBG Usage 42 * ========== 43 * The SP 800-90A DRBG allows the user to specify a personalization string 44 * for initialization as well as an additional information string for each 45 * random number request. The following code fragments show how a caller 46 * uses the kernel crypto API to use the full functionality of the DRBG. 47 * 48 * Usage without any additional data 49 * --------------------------------- 50 * struct crypto_rng *drng; 51 * int err; 52 * char data[DATALEN]; 53 * 54 * drng = crypto_alloc_rng(drng_name, 0, 0); 55 * err = crypto_rng_get_bytes(drng, data, DATALEN); 56 * crypto_free_rng(drng); 57 * 58 * 59 * Usage with personalization string during initialization 60 * ------------------------------------------------------- 61 * struct crypto_rng *drng; 62 * int err; 63 * char data[DATALEN]; 64 * char personalization[11] = "some-string"; 65 * 66 * drng = crypto_alloc_rng(drng_name, 0, 0); 67 * // The reset completely re-initializes the DRBG with the provided 68 * // personalization string 69 * err = crypto_rng_reset(drng, personalization, strlen(personalization)); 70 * err = crypto_rng_get_bytes(drng, data, DATALEN); 71 * crypto_free_rng(drng); 72 * 73 * 74 * Usage with additional information string during random number request 75 * --------------------------------------------------------------------- 76 * struct crypto_rng *drng; 77 * int err; 78 * char data[DATALEN]; 79 * char addtl_string[11] = "some-string"; 80 * 81 * drng = crypto_alloc_rng(drng_name, 0, 0); 82 * err = crypto_rng_generate(drng, addtl_string, strlen(addtl_string), 83 data, DATALEN); 84 * crypto_free_rng(drng); 85 * 86 * 87 * Usage with personalization and additional information strings 88 * ------------------------------------------------------------- 89 * Just mix both scenarios above. 90 */ 91 92 #include <crypto/internal/rng.h> 93 #include <crypto/sha2.h> 94 #include <linux/fips.h> 95 #include <linux/kernel.h> 96 #include <linux/module.h> 97 #include <linux/mutex.h> 98 #include <linux/string_choices.h> 99 #include <linux/unaligned.h> 100 101 /* State length in bytes */ 102 #define DRBG_STATE_LEN SHA512_DIGEST_SIZE 103 104 /* Security strength in bytes */ 105 #define DRBG_SEC_STRENGTH (SHA512_DIGEST_SIZE / 2) 106 107 /* 108 * Maximum number of requests before reseeding is forced. 109 * SP800-90A allows this to be up to 2**48. We use a lower value. 110 */ 111 #define DRBG_MAX_REQUESTS 4096 112 113 /* 114 * Maximum number of random bytes that can be requested at once. 115 * SP800-90A allows up to 2**19 bits, which is 2**16 bytes. 116 */ 117 #define DRBG_MAX_REQUEST_BYTES (1 << 16) 118 119 /* 120 * Maximum length of additional info and personalization strings, in bytes. 121 * SP800-90A allows up to 2**35 bits, i.e. 2**32 bytes. We use 2**32 - 2 bytes 122 * so that the value never quite completely fills the range of a size_t, 123 * allowing the health check to verify that larger values are rejected. 124 */ 125 #define DRBG_MAX_ADDTL (U32_MAX - 1) 126 127 struct drbg_state { 128 struct mutex drbg_mutex; /* lock around DRBG */ 129 u8 V[DRBG_STATE_LEN]; /* internal state -- 10.1.2.1 1a */ 130 struct hmac_sha512_key key; /* current key -- 10.1.2.1 1b */ 131 /* Number of RNG requests since last reseed -- 10.1.2.1 1c */ 132 size_t reseed_ctr; 133 bool instantiated; 134 bool pr; /* Prediction resistance enabled? */ 135 struct crypto_rng *jent; 136 const u8 *test_entropy; 137 size_t test_entropylen; 138 }; 139 140 /****************************************************************** 141 * HMAC DRBG functions 142 ******************************************************************/ 143 144 /* update function of HMAC DRBG as defined in 10.1.2.2 */ 145 static void drbg_hmac_update(struct drbg_state *drbg, 146 const u8 *data1, size_t data1_len, 147 const u8 *data2, size_t data2_len) 148 { 149 struct hmac_sha512_ctx hmac_ctx; 150 u8 new_key[DRBG_STATE_LEN]; 151 152 for (u8 i = 0; i < 2; i++) { 153 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */ 154 hmac_sha512_init(&hmac_ctx, &drbg->key); 155 hmac_sha512_update(&hmac_ctx, drbg->V, DRBG_STATE_LEN); 156 hmac_sha512_update(&hmac_ctx, &i, 1); 157 hmac_sha512_update(&hmac_ctx, data1, data1_len); 158 hmac_sha512_update(&hmac_ctx, data2, data2_len); 159 hmac_sha512_final(&hmac_ctx, new_key); 160 hmac_sha512_preparekey(&drbg->key, new_key, DRBG_STATE_LEN); 161 162 /* 10.1.2.2 step 2 and 5 -- HMAC for V */ 163 hmac_sha512(&drbg->key, drbg->V, DRBG_STATE_LEN, drbg->V); 164 165 /* 10.1.2.2 step 3 */ 166 if (data1_len == 0 && data2_len == 0) 167 break; 168 } 169 memzero_explicit(new_key, sizeof(new_key)); 170 } 171 172 /* generate function of HMAC DRBG as defined in 10.1.2.5 */ 173 static void drbg_hmac_generate(struct drbg_state *drbg, u8 *out, size_t outlen, 174 const u8 *addtl1, size_t addtl1_len) 175 { 176 u8 addtl2[32]; 177 size_t addtl2_len = 0; 178 179 /* 180 * Append some bytes from get_random_bytes() to the additional input 181 * string, except when in test mode (as it would break the tests). 182 * Using a nonempty additional input string works around the forward 183 * secrecy bug in HMAC_DRBG described by Woodage & Shumow (2018) 184 * (https://eprint.iacr.org/2018/349.pdf). Filling the string with 185 * get_random_bytes() rather than a fixed value is safer still, and in 186 * particular makes random.c reseeds be immediately reflected. 187 * 188 * Note that there's no need to pull bytes from jitterentropy here too, 189 * since FIPS doesn't require any entropy in the additional input. 190 */ 191 if (drbg->test_entropylen == 0) { 192 get_random_bytes(addtl2, sizeof(addtl2)); 193 addtl2_len = sizeof(addtl2); 194 } 195 196 /* 10.1.2.5 step 2 */ 197 if (addtl1_len || addtl2_len) 198 drbg_hmac_update(drbg, addtl1, addtl1_len, addtl2, addtl2_len); 199 200 while (outlen) { 201 size_t n = min(DRBG_STATE_LEN, outlen); 202 203 /* 10.1.2.5 step 4.1 */ 204 hmac_sha512(&drbg->key, drbg->V, DRBG_STATE_LEN, drbg->V); 205 206 /* 10.1.2.5 step 4.2 */ 207 memcpy(out, drbg->V, n); 208 out += n; 209 outlen -= n; 210 } 211 212 /* 10.1.2.5 step 6 */ 213 drbg_hmac_update(drbg, addtl1, addtl1_len, addtl2, addtl2_len); 214 215 memzero_explicit(addtl2, sizeof(addtl2)); 216 } 217 218 /* 219 * Seeding or reseeding of the DRBG 220 * 221 * @drbg: DRBG state struct 222 * @pers: personalization / additional information buffer 223 * @pers_len: length of @pers in bytes 224 * @reseed: false for initial seeding (instantiation), true for reseeding 225 * 226 * return: 227 * 0 on success 228 * error value otherwise 229 */ 230 static int drbg_seed(struct drbg_state *drbg, const u8 *pers, size_t pers_len, 231 bool reseed) 232 __must_hold(&drbg->drbg_mutex) 233 { 234 int ret; 235 u8 entropy_buf[(32 + 16) * 2]; 236 size_t entropylen; 237 const u8 *entropy; 238 239 /* 9.1 / 9.2 / 9.3.1 step 3 */ 240 if (pers_len > DRBG_MAX_ADDTL) { 241 pr_devel("DRBG: personalization string too long %zu\n", 242 pers_len); 243 return -EINVAL; 244 } 245 246 if (drbg->test_entropylen) { 247 entropy = drbg->test_entropy; 248 entropylen = drbg->test_entropylen; 249 pr_devel("DRBG: using test entropy\n"); 250 } else { 251 /* 252 * Gather entropy equal to the security strength of the DRBG. 253 * With a derivation function, a nonce is required in addition 254 * to the entropy. A nonce must be at least 1/2 of the security 255 * strength of the DRBG in size. Thus, entropy + nonce is 3/2 256 * of the strength. The consideration of a nonce is only 257 * applicable during initial seeding. 258 */ 259 entropy = entropy_buf; 260 if (!reseed) 261 entropylen = ((DRBG_SEC_STRENGTH + 1) / 2) * 3; 262 else 263 entropylen = DRBG_SEC_STRENGTH; 264 BUG_ON(entropylen * 2 > sizeof(entropy_buf)); 265 266 /* Get seed from in-kernel /dev/urandom */ 267 get_random_bytes(entropy_buf, entropylen); 268 269 if (!drbg->jent) { 270 pr_devel("DRBG: (re)seeding with %zu bytes of entropy\n", 271 entropylen); 272 } else { 273 /* 274 * Get seed from Jitter RNG, failures are 275 * fatal only in FIPS mode. 276 */ 277 ret = crypto_rng_get_bytes(drbg->jent, 278 &entropy_buf[entropylen], 279 entropylen); 280 if (fips_enabled && ret) { 281 pr_devel("DRBG: jent failed with %d\n", ret); 282 283 /* 284 * Do not treat the transient failure of the 285 * Jitter RNG as an error that needs to be 286 * reported. The combined number of the 287 * maximum reseed threshold times the maximum 288 * number of Jitter RNG transient errors is 289 * less than the reseed threshold required by 290 * SP800-90A allowing us to treat the 291 * transient errors as such. 292 * 293 * However, we mandate that at least the first 294 * seeding operation must succeed with the 295 * Jitter RNG. 296 */ 297 if (!reseed || ret != -EAGAIN) 298 goto out; 299 } 300 301 entropylen *= 2; 302 pr_devel("DRBG: (re)seeding with %zu bytes of entropy\n", 303 entropylen); 304 } 305 } 306 307 if (pers_len) 308 pr_devel("DRBG: using personalization string\n"); 309 310 drbg_hmac_update(drbg, entropy, entropylen, pers, pers_len); 311 drbg->reseed_ctr = 1; 312 ret = 0; 313 out: 314 memzero_explicit(entropy_buf, sizeof(entropy_buf)); 315 316 return ret; 317 } 318 319 /* 320 * Generate random bytes from an SP800-90A DRBG. 321 * 322 * @drbg DRBG state handle 323 * @out Buffer where to store the random bytes 324 * @outlen Number of random bytes to generate 325 * @addtl Optional additional input that is mixed into state 326 * @addtl_len Length of @addtl in bytes, may be 0 327 * 328 * return: 0 when all bytes are generated; < 0 in case of an error 329 */ 330 static int drbg_generate(struct drbg_state *drbg, u8 *out, size_t outlen, 331 const u8 *addtl, size_t addtl_len) 332 __must_hold(&drbg->drbg_mutex) 333 { 334 int err; 335 336 if (!drbg->instantiated) { 337 pr_devel("DRBG: not yet instantiated\n"); 338 return -EINVAL; 339 } 340 if (out == NULL || outlen == 0) { 341 pr_devel("DRBG: no output buffer provided\n"); 342 return -EINVAL; 343 } 344 if (addtl == NULL && addtl_len != 0) { 345 pr_devel("DRBG: wrong format of additional information\n"); 346 return -EINVAL; 347 } 348 349 /* 9.3.1 step 2 */ 350 if (outlen > DRBG_MAX_REQUEST_BYTES) { 351 pr_devel("DRBG: request length is too long %zu\n", outlen); 352 return -EINVAL; 353 } 354 355 /* 9.3.1 step 3 is implicit with the chosen DRBG */ 356 357 /* 9.3.1 step 4 */ 358 if (addtl_len > DRBG_MAX_ADDTL) { 359 pr_devel("DRBG: additional information string too long %zu\n", 360 addtl_len); 361 return -EINVAL; 362 } 363 /* 9.3.1 step 5 is implicit with the chosen DRBG */ 364 365 /* 366 * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented 367 * here. The spec is a bit convoluted here, we make it simpler. 368 * 369 * We no longer try to detect when random.c has reseeded itself and call 370 * drbg_seed() then too, since drbg_hmac_generate() adds bytes from 371 * random.c to the additional input, which is a de facto reseed anyway. 372 */ 373 if (drbg->pr || drbg->reseed_ctr > DRBG_MAX_REQUESTS) { 374 pr_devel("DRBG: reseeding before generation (prediction resistance: %s)\n", 375 str_true_false(drbg->pr)); 376 /* 9.3.1 steps 7.1 through 7.3 */ 377 err = drbg_seed(drbg, addtl, addtl_len, true); 378 if (err) 379 return err; 380 /* 9.3.1 step 7.4 */ 381 addtl = NULL; 382 addtl_len = 0; 383 } 384 385 /* 9.3.1 step 8 and 10 */ 386 drbg_hmac_generate(drbg, out, outlen, addtl, addtl_len); 387 388 /* 10.1.2.5 step 7 */ 389 drbg->reseed_ctr++; 390 391 /* 392 * Section 11.3.3 requires to re-perform self tests after some 393 * generated random numbers. The chosen value after which self 394 * test is performed is arbitrary, but it should be reasonable. 395 * However, we do not perform the self tests because of the following 396 * reasons: it is mathematically impossible that the initial self tests 397 * were successfully and the following are not. If the initial would 398 * pass and the following would not, the kernel integrity is violated. 399 * In this case, the entire kernel operation is questionable and it 400 * is unlikely that the integrity violation only affects the 401 * correct operation of the DRBG. 402 */ 403 404 return 0; 405 } 406 407 /*************************************************************** 408 * Kernel crypto API interface to DRBG 409 ***************************************************************/ 410 411 static int drbg_kcapi_init(struct crypto_tfm *tfm) 412 { 413 struct drbg_state *drbg = crypto_tfm_ctx(tfm); 414 415 mutex_init(&drbg->drbg_mutex); 416 417 return 0; 418 } 419 420 /* Set test entropy in the DRBG. */ 421 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm, 422 const u8 *data, unsigned int len) 423 { 424 struct drbg_state *drbg = crypto_rng_ctx(tfm); 425 426 mutex_lock(&drbg->drbg_mutex); 427 drbg->test_entropy = data; 428 drbg->test_entropylen = len; 429 mutex_unlock(&drbg->drbg_mutex); 430 } 431 432 /* Seed (i.e. instantiate) or re-seed the DRBG. */ 433 static int drbg_kcapi_seed(struct crypto_rng *tfm, 434 const u8 *pers, size_t pers_len, bool pr) 435 { 436 static const u8 initial_key[DRBG_STATE_LEN]; /* all zeroes */ 437 struct drbg_state *drbg = crypto_rng_ctx(tfm); 438 int ret; 439 440 pr_devel("DRBG: Initializing DRBG with prediction resistance %s\n", 441 str_enabled_disabled(pr)); 442 guard(mutex)(&drbg->drbg_mutex); 443 444 if (drbg->instantiated) 445 return drbg_seed(drbg, pers, pers_len, /* reseed= */ true); 446 447 /* 9.1 step 1 is implicit with the selected DRBG type */ 448 449 /* 450 * 9.1 step 2 is implicit as caller can select prediction resistance 451 * all DRBG types support prediction resistance 452 */ 453 454 /* 9.1 step 4 is implicit in DRBG_SEC_STRENGTH */ 455 456 drbg->pr = pr; 457 memset(drbg->V, 1, DRBG_STATE_LEN); 458 hmac_sha512_preparekey(&drbg->key, initial_key, DRBG_STATE_LEN); 459 460 /* Allocate jitterentropy_rng if not in test mode. */ 461 if (drbg->test_entropylen == 0) { 462 drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); 463 if (IS_ERR(drbg->jent)) { 464 ret = PTR_ERR(drbg->jent); 465 drbg->jent = NULL; 466 if (fips_enabled) 467 return ret; 468 pr_info("DRBG: Continuing without Jitter RNG\n"); 469 } 470 } 471 472 ret = drbg_seed(drbg, pers, pers_len, /* reseed= */ false); 473 if (ret) { 474 crypto_free_rng(drbg->jent); 475 drbg->jent = NULL; 476 return ret; 477 } 478 drbg->instantiated = true; 479 return 0; 480 } 481 482 static int drbg_kcapi_seed_pr(struct crypto_rng *tfm, 483 const u8 *seed, unsigned int slen) 484 { 485 return drbg_kcapi_seed(tfm, seed, slen, /* pr= */ true); 486 } 487 488 static int drbg_kcapi_seed_nopr(struct crypto_rng *tfm, 489 const u8 *seed, unsigned int slen) 490 { 491 return drbg_kcapi_seed(tfm, seed, slen, /* pr= */ false); 492 } 493 494 /* 495 * Generate random numbers invoked by the kernel crypto API: 496 * 497 * src is additional input supplied to the RNG. 498 * slen is the length of src. 499 * dst is the output buffer where random data is to be stored. 500 * dlen is the length of dst. 501 */ 502 static int drbg_kcapi_generate(struct crypto_rng *tfm, 503 const u8 *src, unsigned int slen, 504 u8 *dst, unsigned int dlen) 505 { 506 struct drbg_state *drbg = crypto_rng_ctx(tfm); 507 508 /* 509 * Break the request into multiple requests if needed, to avoid 510 * exceeding the maximum request length of the core algorithm. 511 */ 512 do { 513 unsigned int n = min(dlen, DRBG_MAX_REQUEST_BYTES); 514 int err; 515 516 mutex_lock(&drbg->drbg_mutex); 517 err = drbg_generate(drbg, dst, n, src, slen); 518 mutex_unlock(&drbg->drbg_mutex); 519 if (err < 0) 520 return err; 521 dst += n; 522 dlen -= n; 523 } while (dlen); 524 return 0; 525 } 526 527 /* Uninstantiate the DRBG. */ 528 static void drbg_kcapi_exit(struct crypto_tfm *tfm) 529 { 530 struct drbg_state *drbg = crypto_tfm_ctx(tfm); 531 532 crypto_free_rng(drbg->jent); 533 memzero_explicit(drbg, sizeof(*drbg)); 534 } 535 536 /* 537 * Tests as defined in 11.3.2 in addition to the cipher tests: testing 538 * of the error handling. 539 * 540 * Note: testing of failing seed source as defined in 11.3.2 is not applicable 541 * as seed source of get_random_bytes does not fail. 542 * 543 * Note 2: There is no sensible way of testing the reseed counter 544 * enforcement, so skip it. 545 */ 546 static inline int __init drbg_healthcheck_sanity(void) 547 { 548 #define OUTBUFLEN 16 549 u8 buf[OUTBUFLEN]; 550 struct drbg_state *drbg = NULL; 551 int ret; 552 553 /* only perform test in FIPS mode */ 554 if (!fips_enabled) 555 return 0; 556 557 drbg = kzalloc_obj(struct drbg_state); 558 if (!drbg) 559 return -ENOMEM; 560 561 guard(mutex_init)(&drbg->drbg_mutex); 562 drbg->instantiated = true; 563 564 /* 565 * if the following tests fail, it is likely that there is a buffer 566 * overflow as buf is much smaller than the requested or provided 567 * string lengths -- in case the error handling does not succeed 568 * we may get an OOPS. And we want to get an OOPS as this is a 569 * grave bug. 570 */ 571 572 /* overflow addtllen with additional info string */ 573 ret = drbg_generate(drbg, buf, OUTBUFLEN, buf, DRBG_MAX_ADDTL + 1); 574 BUG_ON(ret == 0); 575 /* overflow max_bits */ 576 ret = drbg_generate(drbg, buf, DRBG_MAX_REQUEST_BYTES + 1, NULL, 0); 577 BUG_ON(ret == 0); 578 579 /* overflow max addtllen with personalization string */ 580 ret = drbg_seed(drbg, buf, DRBG_MAX_ADDTL + 1, false); 581 BUG_ON(ret == 0); 582 /* all tests passed */ 583 584 pr_devel("DRBG: Sanity tests for failure code paths successfully " 585 "completed\n"); 586 587 kfree(drbg); 588 return 0; 589 } 590 591 static struct rng_alg drbg_algs[] = { 592 { 593 .base.cra_name = "stdrng", 594 .base.cra_driver_name = "drbg_pr_hmac_sha512", 595 .base.cra_priority = 200, 596 .base.cra_ctxsize = sizeof(struct drbg_state), 597 .base.cra_module = THIS_MODULE, 598 .base.cra_init = drbg_kcapi_init, 599 .set_ent = drbg_kcapi_set_entropy, 600 .seed = drbg_kcapi_seed_pr, 601 .generate = drbg_kcapi_generate, 602 .base.cra_exit = drbg_kcapi_exit, 603 }, 604 { 605 .base.cra_name = "stdrng", 606 .base.cra_driver_name = "drbg_nopr_hmac_sha512", 607 .base.cra_priority = 201, 608 .base.cra_ctxsize = sizeof(struct drbg_state), 609 .base.cra_module = THIS_MODULE, 610 .base.cra_init = drbg_kcapi_init, 611 .set_ent = drbg_kcapi_set_entropy, 612 .seed = drbg_kcapi_seed_nopr, 613 .generate = drbg_kcapi_generate, 614 .base.cra_exit = drbg_kcapi_exit, 615 }, 616 }; 617 618 static int __init drbg_init(void) 619 { 620 int ret; 621 622 ret = drbg_healthcheck_sanity(); 623 if (ret) 624 return ret; 625 626 /* 627 * In FIPS mode, boost the algorithm priorities to ensure that when 628 * users request "stdrng", they really get an algorithm from here. 629 */ 630 if (fips_enabled) { 631 for (size_t i = 0; i < ARRAY_SIZE(drbg_algs); i++) 632 drbg_algs[i].base.cra_priority += 2000; 633 } 634 635 return crypto_register_rngs(drbg_algs, ARRAY_SIZE(drbg_algs)); 636 } 637 638 static void __exit drbg_exit(void) 639 { 640 crypto_unregister_rngs(drbg_algs, ARRAY_SIZE(drbg_algs)); 641 } 642 643 module_init(drbg_init); 644 module_exit(drbg_exit); 645 MODULE_LICENSE("GPL"); 646 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); 647 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG)"); 648 MODULE_ALIAS_CRYPTO("stdrng"); 649 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512"); 650 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512"); 651