linux-kernel - Re: [PATCH] crypto: Restore sha384 and hmac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aFkdgzg7J6MA1OhC@gondor.apana.org.au>
Date: Mon, 23 Jun 2025 17:25:23 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Jeff Barnes <jeffbarnes@...ux.microsoft.com>
Cc: "David S . Miller" <davem@...emloft.net>, linux-crypto@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] crypto: Restore sha384 and hmac_sha384 drbgs in FIPS mode

On Tue, Jun 17, 2025 at 03:30:05PM -0400, Jeff Barnes wrote:
> Set .fips_allowed in the following drbg alg_test_desc structs.
> 
> drbg_nopr_hmac_sha384
> drbg_nopr_sha384
> drbg_pr_hmac_sha384
> drbg_pr_sha384
> 
> The sha384 and hmac_sha384 DRBGs with and without prediction resistance
> were disallowed in an early version of the FIPS 140-3 Implementation
> Guidance document. Hence, the fips_allowed flag in struct alg_test_desc
> pertaining to the affected DRBGs was unset. The IG has been withdrawn
> and they are allowed again.
> 
> Furthermore, when the DRBGs are configured, /proc/crypto shows that
> drbg_*pr_sha384 and drbg_*pr_hmac_sha384 are fips-approved ("fips: yes")
> but because their self-tests are not run (a consequence of unsetting
> the fips_allowed flag), the drbgs won't load successfully with the seeming
> contradictory "fips: yes" in /proc/crypto.
> 
> This series contains a single patch that sets the fips_allowed flag in
> the sha384-impacted DRBGs, which restores the ability to load them in
> FIPS mode.
> 
> Link: https://lore.kernel.org/linux-crypto/979f4f6f-bb74-4b93-8cbf-6ed653604f0e@jvdsn.com/
> Link: https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
> 
> To: Herbert Xu <herbert@...dor.apana.org.au>
> To: David S. Miller <davem@...emloft.net>
> Cc: linux-crypto@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> Signed-off-by: Jeff Barnes <jeffbarnes@...ux.microsoft.com>
> ---
>  crypto/testmgr.c | 4 ++++
>  1 file changed, 4 insertions(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt