From d23fe2901d9877a60cd219d0d49df01aa07f5940 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Tue, 5 Jul 2016 17:14:59 +0200 Subject: index hashtable: run random indices through siphash If /dev/urandom is a NOBUS RNG backdoor, like the infamous Dual_EC_DRBG, then sending 4 bytes of raw RNG output over the wire directly might not be such a great idea. This mitigates that vulnerability by, at some point before the indices are generated, creating a random secret. Then, for each session index, we simply run SipHash24 on an incrementing counter. This is probably overkill because /dev/urandom is probably not a backdoored RNG, and itself already uses several rounds of SHA-1 for mixing. If the kernel RNG is backdoored, there may very well be bigger problems at play. Four bytes is also not so many bytes. Signed-off-by: Jason A. Donenfeld --- src/hashtables.c | 6 +++++- src/hashtables.h | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/hashtables.c b/src/hashtables.c index 8911625..db7c23b 100644 --- a/src/hashtables.c +++ b/src/hashtables.c @@ -60,6 +60,8 @@ static inline struct hlist_head *index_bucket(struct index_hashtable *table, con void index_hashtable_init(struct index_hashtable *table) { + get_random_bytes(table->key, SIPHASH24_KEY_LEN); + atomic64_set(&table->counter, 0); hash_init(table->hashtable); spin_lock_init(&table->lock); } @@ -67,6 +69,7 @@ void index_hashtable_init(struct index_hashtable *table) __le32 index_hashtable_insert(struct index_hashtable *table, struct index_hashtable_entry *entry) { struct index_hashtable_entry *existing_entry; + uint64_t counter; spin_lock(&table->lock); hlist_del_init_rcu(&entry->index_hash); @@ -76,7 +79,8 @@ __le32 index_hashtable_insert(struct index_hashtable *table, struct index_hashta search_unused_slot: /* First we try to find an unused slot, randomly, while unlocked. */ - get_random_bytes(&entry->index, sizeof(entry->index)); + counter = atomic64_inc_return(&table->counter); + entry->index = (__force __le32)siphash24((uint8_t *)&counter, sizeof(counter), table->key); hlist_for_each_entry_rcu(existing_entry, index_bucket(table, entry->index), index_hash) { if (existing_entry->index == entry->index) goto search_unused_slot; /* If it's already in use, we continue searching. */ diff --git a/src/hashtables.h b/src/hashtables.h index 495a6f0..ed9506b 100644 --- a/src/hashtables.h +++ b/src/hashtables.h @@ -20,6 +20,8 @@ struct wireguard_peer *pubkey_hashtable_lookup(struct pubkey_hashtable *table, c struct index_hashtable { DECLARE_HASHTABLE(hashtable, 10); + uint8_t key[SIPHASH24_KEY_LEN]; + atomic64_t counter; spinlock_t lock; }; struct index_hashtable_entry; -- cgit v1.2.3