lkml.org 
[lkml]   [2009]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 0/2] crypto: disallow non-approved algs in fips mode
Date
At present, nothing is preventing the use of non-approved algorithms
in fips mode. I was initially working on a patch to make it easier
for all fips-approved algs to be tested using tcrypt, and realized
the changes I was making could also be used to prevent non-approved
algs in fips mode. Any approved alg *must* have self-tests, and thus
have an entry in testmgr.c's alg_test_descs[]. By adding a fips flag
to these entries, we can simply reject all algs that don't have this
flag when in fips mode by skipping their self-tests and returning
an -EINVAL to prevent them from being loaded. So with this change, I
can

1) 'modprobe tcrypt' and have all fips approved algs self-tested, and
*only* fips approved algs tested

2) 'modprobe md4' for example, and in fips mode, have the module load
rejected as invalid

Patch 1/2 adds the basic infra
Patch 2/2 marks the allowed algs

--
Jarod Wilson
jarod@redhat.com


\
 
 \ /
  Last update: 2009-05-07 20:45    [W:0.049 / U:23.392 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site