LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] crypto/testmgr: mark rfc4106(gcm(aes)) as fips_allowed
@ 2015-01-23 17:42 Jarod Wilson
  2015-01-23 19:58 ` Stephan Mueller
  0 siblings, 1 reply; 2+ messages in thread
From: Jarod Wilson @ 2015-01-23 17:42 UTC (permalink / raw)
  To: linux-crypto; +Cc: Jarod Wilson, LKML, Stephan Mueller

This gcm variant is popular for ipsec use, and there are folks who would
like to use it while in fips mode. Mark it with fips_allowed=1 to
facilitate that.

CC: LKML <linux-kernel@vger.kernel.org>
CC: Stephan Mueller <smueller@atsec.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
---
 crypto/testmgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 235b1ff..758d028 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -3293,6 +3293,7 @@ static const struct alg_test_desc alg_test_descs[] = {
 	}, {
 		.alg = "rfc4106(gcm(aes))",
 		.test = alg_test_aead,
+		.fips_allowed = 1,
 		.suite = {
 			.aead = {
 				.enc = {
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] crypto/testmgr: mark rfc4106(gcm(aes)) as fips_allowed
  2015-01-23 17:42 [PATCH] crypto/testmgr: mark rfc4106(gcm(aes)) as fips_allowed Jarod Wilson
@ 2015-01-23 19:58 ` Stephan Mueller
  0 siblings, 0 replies; 2+ messages in thread
From: Stephan Mueller @ 2015-01-23 19:58 UTC (permalink / raw)
  To: Jarod Wilson; +Cc: linux-crypto, LKML

Am Freitag, 23. Januar 2015, 12:42:15 schrieb Jarod Wilson:

Hi Jarod,

>This gcm variant is popular for ipsec use, and there are folks who
>would like to use it while in fips mode. Mark it with fips_allowed=1
>to facilitate that.

Acked-by: Stephan Mueller <smueller@atsec.com>

For the records: this change is ok as the RFC4106 "wrapper" only 
massages the input data like IV or keys without changing the 
cryptographic logic of GCM. As the basic cipher is not changed allowing 
RFC4106 is harmless with respect to FIPS 140-2 to use and apply this 
RFC4106 wrapper. This implies that the RFC4106 wrapper can be used in 
FIPS mode.
>
>CC: LKML <linux-kernel@vger.kernel.org>
>CC: Stephan Mueller <smueller@atsec.com>
>Signed-off-by: Jarod Wilson <jarod@redhat.com>
>---
> crypto/testmgr.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/crypto/testmgr.c b/crypto/testmgr.c
>index 235b1ff..758d028 100644
>--- a/crypto/testmgr.c
>+++ b/crypto/testmgr.c
>@@ -3293,6 +3293,7 @@ static const struct alg_test_desc
>alg_test_descs[] = { }, {
> 		.alg = "rfc4106(gcm(aes))",
> 		.test = alg_test_aead,
>+		.fips_allowed = 1,
> 		.suite = {
> 			.aead = {
> 				.enc = {


Ciao
Stephan



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2015-01-23 20:07 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-23 17:42 [PATCH] crypto/testmgr: mark rfc4106(gcm(aes)) as fips_allowed Jarod Wilson
2015-01-23 19:58 ` Stephan Mueller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).