diff options
| author | Vladis Dronov <vdronov@redhat.com> | 2023-01-17 18:20:06 +0100 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2023-01-27 18:58:09 +0800 |
| commit | f7b618b17efdd512d0f7b9c53ed53dc25c89a729 (patch) | |
| tree | 749e486adefff72de8c13a69bd1776e6034d2e8f | |
| parent | ef591c7f3b434de7f2309bc9601b1926e4aa055d (diff) | |
| download | linux-crypto-f7b618b17efdd512d0f7b9c53ed53dc25c89a729.tar.gz linux-crypto-f7b618b17efdd512d0f7b9c53ed53dc25c89a729.zip | |
crypto: testmgr - disallow certain DRBG hash functions in FIPS mode
According to FIPS 140-3 IG, section D.R "Hash Functions Acceptable for
Use in the SP 800-90A DRBGs", modules certified after May 16th, 2023
must not support the use of: SHA-224, SHA-384, SHA512-224, SHA512-256,
SHA3-224, SHA3-384. Disallow HMAC and HASH DRBGs using SHA-384 in FIPS
mode.
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Stephan Müller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | crypto/testmgr.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/crypto/testmgr.c b/crypto/testmgr.c index 795c4858..dd748832 100644 --- a/crypto/testmgr.c +++ b/crypto/testmgr.c @@ -4781,7 +4781,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { /* covered by drbg_nopr_hmac_sha256 test */ .alg = "drbg_nopr_hmac_sha384", - .fips_allowed = 1, .test = alg_test_null, }, { .alg = "drbg_nopr_hmac_sha512", @@ -4804,7 +4803,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { /* covered by drbg_nopr_sha256 test */ .alg = "drbg_nopr_sha384", - .fips_allowed = 1, .test = alg_test_null, }, { .alg = "drbg_nopr_sha512", @@ -4840,7 +4838,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { /* covered by drbg_pr_hmac_sha256 test */ .alg = "drbg_pr_hmac_sha384", - .fips_allowed = 1, .test = alg_test_null, }, { .alg = "drbg_pr_hmac_sha512", @@ -4860,7 +4857,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { /* covered by drbg_pr_sha256 test */ .alg = "drbg_pr_sha384", - .fips_allowed = 1, .test = alg_test_null, }, { .alg = "drbg_pr_sha512", |