Skip to contentSkip to conversation

Disable ccm and ccm4309 in fips mod

PATCH In review Leonidas S. Barbosa 2 participants 2 messages Oct 28, 2014 – Nov 6, 2014

Subsystems (3)
PowerPC Crypto API IBM Power in-Nest Crypto Acceleration
lore
Share & tools
lore

Leonidas S. Barbosa

author
#0 lore raw

PATCH 9/9 Disable ccm and ccm4309 in fips mod

NX CCM has not support to keys larger than 128 neither our hardware. In cases where a system is running in fips mode enabled a tcrypt test will crash the system in a kernel panic call.
This patch disable, for now, CCM's algorithms in fips mode to avoid this.

Signed-off-by Leonidas S. Barbosa <[email protected]>
---
 drivers/crypto/nx/nx.c |   32 ++++++++++++++++++++++----------
 1 files changed, 22 insertions(+), 10 deletions(-)
drivers/crypto/nx/nx.c +22 -10
index aa8c38d..a32239c 100644
@@ -35,6 +35,7 @@
 #include <linux/of.h>
 #include <asm/hvcall.h>
 #include <asm/vio.h>
+#include <linux/fips.h>
 
 #include "nx_csbcpb.h"
 #include "nx.h"

@@ -566,13 +567,15 @@ static int nx_register_algs(void)
 	if (rc)
 		goto out_unreg_gcm;
 
-	rc = crypto_register_alg(&nx_ccm_aes_alg);
-	if (rc)
-		goto out_unreg_gcm4106;
+	if (!fips_enabled) {
+		rc = crypto_register_alg(&nx_ccm_aes_alg);
+		if (rc)
+			goto out_unreg_gcm4106;
 
-	rc = crypto_register_alg(&nx_ccm4309_aes_alg);
-	if (rc)
-		goto out_unreg_ccm;
+		rc = crypto_register_alg(&nx_ccm4309_aes_alg);
+		if (rc)
+			goto out_unreg_ccm;
+	}
 
 	rc = crypto_register_shash(&nx_shash_sha256_alg);
 	if (rc)

@@ -593,9 +596,11 @@ out_unreg_s512:
 out_unreg_s256:
 	crypto_unregister_shash(&nx_shash_sha256_alg);
 out_unreg_ccm4309:
-	crypto_unregister_alg(&nx_ccm4309_aes_alg);
+	if (!fips_enabled)
+		crypto_unregister_alg(&nx_ccm4309_aes_alg);
 out_unreg_ccm:
-	crypto_unregister_alg(&nx_ccm_aes_alg);
+	if (fips_enabled)
+		crypto_unregister_alg(&nx_ccm_aes_alg);
 out_unreg_gcm4106:
 	crypto_unregister_alg(&nx_gcm4106_aes_alg);
 out_unreg_gcm:

@@ -746,8 +751,15 @@ static int nx_remove(struct vio_dev *viodev)
 	if (nx_driver.of.status == NX_OKAY) {
 		NX_DEBUGFS_FINI(&nx_driver);
 
-		crypto_unregister_alg(&nx_ccm_aes_alg);
-		crypto_unregister_alg(&nx_ccm4309_aes_alg);
+		/* CCM algorithm has not support to keys larger than 128
+		 * however tcrypt test uses key larger than. If a system
+		 * runs with fips enabled it'll crash. For now we need to
+		 * disable this two algorithms in fips mode.
+		 */
+		if (!fips_enabled) {
+			crypto_unregister_alg(&nx_ccm_aes_alg);
+			crypto_unregister_alg(&nx_ccm4309_aes_alg);
+		}
 		crypto_unregister_alg(&nx_gcm_aes_alg);
 		crypto_unregister_alg(&nx_gcm4106_aes_alg);
 		crypto_unregister_alg(&nx_ctr_aes_alg);
Signature · 1 line
1.7.1
maintainer
#1 lore raw
Quoted 6 lines · Leonidas S. Barbosa

NX CCM has not support to keys larger than 128 neither our hardware. In cases where a system is running in fips mode enabled a tcrypt test will crash the system in a kernel panic call.
This patch disable, for now, CCM's algorithms in fips mode to avoid this.

Signed-off-by Leonidas S. Barbosa <[email protected]>

For cases like this you should be using a software fallback rather than just failing. See padlock-sha for an example.

Cheers,

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt