lkml.org 
[lkml]   [2015]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] crypto/testmgr: mark rfc4106(gcm(aes)) as fips_allowed
Date
Am Freitag, 23. Januar 2015, 12:42:15 schrieb Jarod Wilson:

Hi Jarod,

>This gcm variant is popular for ipsec use, and there are folks who
>would like to use it while in fips mode. Mark it with fips_allowed=1
>to facilitate that.

Acked-by: Stephan Mueller <smueller@atsec.com>

For the records: this change is ok as the RFC4106 "wrapper" only
massages the input data like IV or keys without changing the
cryptographic logic of GCM. As the basic cipher is not changed allowing
RFC4106 is harmless with respect to FIPS 140-2 to use and apply this
RFC4106 wrapper. This implies that the RFC4106 wrapper can be used in
FIPS mode.
>
>CC: LKML <linux-kernel@vger.kernel.org>
>CC: Stephan Mueller <smueller@atsec.com>
>Signed-off-by: Jarod Wilson <jarod@redhat.com>
>---
> crypto/testmgr.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/crypto/testmgr.c b/crypto/testmgr.c
>index 235b1ff..758d028 100644
>--- a/crypto/testmgr.c
>+++ b/crypto/testmgr.c
>@@ -3293,6 +3293,7 @@ static const struct alg_test_desc
>alg_test_descs[] = { }, {
> .alg = "rfc4106(gcm(aes))",
> .test = alg_test_aead,
>+ .fips_allowed = 1,
> .suite = {
> .aead = {
> .enc = {


Ciao
Stephan




\
 
 \ /
  Last update: 2015-01-23 21:21    [W:1.126 / U:0.340 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site