diff options
| author |  Nicolai Stange <nstange@suse.de>
| 2022-12-29 22:17:05 +0100 |
|---|---|---|
| committer |  Herbert Xu <herbert@gondor.apana.org.au>
| 2023-01-06 17:15:46 +0800 |
| commit | 1c4428b295884316eaff16be9c1d85f7c2361696 (patch) | |
| tree | 93daad08b6d207cffea11813ce6c96e641d92384 /include/crypto | |
| parent | crypto: sun8i-ss - Remove GFP_DMA and add DMA alignment padding (diff) | |
| download | linux-1c4428b295884316eaff16be9c1d85f7c2361696.tar.gz linux-1c4428b295884316eaff16be9c1d85f7c2361696.tar.bz2 linux-1c4428b295884316eaff16be9c1d85f7c2361696.zip | |
crypto: xts - restrict key lengths to approved values in FIPS mode
According to FIPS 140-3 IG C.I., only (total) key lengths of either
256 bits or 512 bits are allowed with xts(aes). Make xts_verify_key() to
reject anything else in FIPS mode.
As xts(aes) is the only approved xts() template instantiation in FIPS mode,
the new restriction implemented in xts_verify_key() effectively only
applies to this particular construction.
Signed-off-by: Nicolai Stange <nstange@suse.de>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'include/crypto')
| -rw-r--r-- | include/crypto/xts.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/include/crypto/xts.h b/include/crypto/xts.h index 0f8dba69feb4..a233c1054df2 100644 --- a/include/crypto/xts.h +++ b/include/crypto/xts.h @@ -35,6 +35,13 @@ static inline int xts_verify_key(struct crypto_skcipher *tfm, if (keylen % 2) return -EINVAL; + /* + * In FIPS mode only a combined key length of either 256 or + * 512 bits is allowed, c.f. FIPS 140-3 IG C.I. + */ + if (fips_enabled && keylen != 32 && keylen != 64) + return -EINVAL; + /* ensure that the AES and tweak key are not identical */ if ((fips_enabled || (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) && |