[lkml]   [2009]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/2] crypto: disallow non-approved algs in fips mode
At present, nothing is preventing the use of non-approved algorithms
in fips mode. I was initially working on a patch to make it easier
for all fips-approved algs to be tested using tcrypt, and realized
the changes I was making could also be used to prevent non-approved
algs in fips mode. Any approved alg *must* have self-tests, and thus
have an entry in testmgr.c's alg_test_descs[]. By adding a fips flag
to these entries, we can simply reject all algs that don't have this
flag when in fips mode by skipping their self-tests and returning
an -EINVAL to prevent them from being loaded. So with this change, I

1) 'modprobe tcrypt' and have all fips approved algs self-tested, and
*only* fips approved algs tested

2) 'modprobe md4' for example, and in fips mode, have the module load
rejected as invalid

Patch 1/2 adds the basic infra
Patch 2/2 marks the allowed algs

Jarod Wilson

 \ /
  Last update: 2009-05-07 20:45    [W:0.052 / U:0.964 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site