lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 21 Sep 2020 16:31:00 +0800 From: Archie Pusaka <apusaka@...gle.com> To: linux-bluetooth <linux-bluetooth@...r.kernel.org>, Marcel Holtmann <marcel@...tmann.org> Cc: CrosBT Upstreaming <chromeos-bluetooth-upstreaming@...omium.org>, Archie Pusaka <apusaka@...omium.org>, Alain Michaud <alainm@...omium.org>, "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Johan Hedberg <johan.hedberg@...il.com>, linux-kernel@...r.kernel.org, netdev@...r.kernel.org Subject: [PATCH v1] Bluetooth: Enforce key size of 16 bytes on FIPS level From: Archie Pusaka <apusaka@...omium.org> According to the spec Ver 5.2, Vol 3, Part C, Sec 5.2.2.8: Device in security mode 4 level 4 shall enforce: 128-bit equivalent strength for link and encryption keys required using FIPS approved algorithms (E0 not allowed, SAFER+ not allowed, and P-192 not allowed; encryption key not shortened) This patch rejects connection with key size below 16 for FIPS level services. Signed-off-by: Archie Pusaka <apusaka@...omium.org> Reviewed-by: Alain Michaud <alainm@...omium.org> --- net/bluetooth/l2cap_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index ade83e224567..306616ec26e6 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1515,8 +1515,13 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon) * that have no key size requirements. Ensure that the link is * actually encrypted before enforcing a key size. */ + int min_key_size = hcon->hdev->min_enc_key_size; + + if (hcon->sec_level == BT_SECURITY_FIPS) + min_key_size = 16; + return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || - hcon->enc_key_size >= hcon->hdev->min_enc_key_size); + hcon->enc_key_size >= min_key_size); } static void l2cap_do_start(struct l2cap_chan *chan) -- 2.28.0.681.g6f77f65b4e-goog
Powered by blists - more mailing lists