linux-kernel - Re: [PATCH] crypto: aead: add service indicator flag for RFC4106 AES-GCM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXw9Wj19ZX6dpNHW@gondor.apana.org.au>
Date: Fri, 30 Jan 2026 13:10:50 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: jeffbarnes@...ux.microsoft.com
Cc: "David S. Miller" <davem@...emloft.net>, linux-crypto@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Jeff Barnes <jeffbarnes@...rosoft.com>
Subject: Re: [PATCH] crypto: aead: add service indicator flag for RFC4106
 AES-GCM

On Thu, Jan 29, 2026 at 04:04:36PM -0500, jeffbarnes@...ux.microsoft.com wrote:
> From: Jeff Barnes <jeffbarnes@...rosoft.com>
> 
> FIPS 140 validations require a “service indicator” to positively
> identify when an approved cryptographic service is provided. For
> RFC4106 AES‑GCM (used by IPsec), this commit exposes a per‑request
> indicator bit when the IV/nonce construction meets the FIPS uniqueness
> requirement.
> 
> Specifically, the indicator is set when the caller uses the RFC4106
> construction with seqiv (per RFC 4106 §3), where the 32‑bit salt and
> 64‑bit seqiv together guarantee a unique 96‑bit IV per key. This
> meets the SP 800‑38D §8.2 uniqueness requirement for GCM.
> 
> No ABI or uAPI changes. The flag is internal to the crypto API request
> path and may be consumed by in‑tree callers that need to record service
> use in a FIPS context.
> 
> Tests:
> - Verified that gcm(aes) requests never set the service‑indicator bit.
> - Verified that rfc4106(gcm(aes)) requests consistently set the bit.
> - Existing crypto self‑tests continue to pass.
> - checkpatch.pl: no issues.
> 
> Signed-off-by: Jeff Barnes <jeffbarnes@...rosoft.com>

Rather than exporting this indicator, I would prefer that we just
forbid non-compliant combinations when FIPS mode is enabled.

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt