crypto: print self-test pass notices in fips mode
Subsystems (2)
PATCH 1/1 crypto: print self-test pass notices in fips mode
According to our FIPS CAVS testing lab guru, when we're in fips mode, we *must* print out notices of successful self-test completion for every alg to be compliant.
Dependent on patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.
--- crypto/testmgr.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
crypto/testmgr.c +4 -0
@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);return rc; }EXPORT_SYMBOL_GPL (alg_test);
Signature · 2 lines
Jarod Wilson [email protected]
Quoted 33 lines · Jarod Wilson
According to our FIPS CAVS testing lab guru, when we're in fips mode, we *must* print out notices of successful self-test completion for every alg to be compliant.
Dependent on patch 'crypto: catch base cipher self-test failures in fips mode', which adds the
test_donelabel.Signed-off-by Jarod Wilson <[email protected]>--- crypto/testmgr.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)crypto/testmgr.c +4
-0@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);return rc; }EXPORT_SYMBOL_GPL (alg_test);Signature · 3 lines
-- Jarod Wilson [email protected]
Herbert Xu
maintainercrypto/testmgr.c notest: · line 2155
Quoted 13 lines · Jarod Wilson
crypto/testmgr.c +4
-0@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);
What is this strncmp crap for?
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txtQuoted 16 lines · On Wednesday 29 April 2009 09:18:17 Herbert Xu wrote:
crypto/testmgr.c notest: · line 2155
Quoted 13 lines · Jarod Wilson
crypto/testmgr.c +4
-0@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);What is this strncmp crap for?
To avoid claiming we successfully self-tested ctr(aes) when its not actually directly testable. Was intended to go sort of hand in hand with the other patch to suppress 'no self test' messages for ctr(aes) when in fips mode. Of course, since at this point, we've run ecb(aes), and that's what's suggested as the way to test ctr(aes)[*], perhaps we don't need to
suppress it.
[*] well, along with the sign-off from the lab that the counter code is acceptable
Signature · 2 lines
Jarod Wilson [email protected]
Quoted 26 lines · On Wednesday 29 April 2009 09:21:53 Jarod Wilson wrote:
Quoted 16 lines · On Wednesday 29 April 2009 09:18:17 Herbert Xu wrote:
crypto/testmgr.c notest: · line 2155
Quoted 13 lines · Jarod Wilson
crypto/testmgr.c +4
-0@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);What is this strncmp crap for?
To avoid claiming we successfully self-tested ctr(aes) when its not actually directly testable. Was intended to go sort of hand in hand with the other patch to suppress 'no self test' messages for ctr(aes) when in fips mode. Of course, since at this point, we've run ecb(aes), and that's what's suggested as the way to test ctr(aes)[*], perhaps we don't need to
suppress it.
Quoted 2 lines
[*] well, along with the sign-off from the lab that the counter code is acceptable
So this might actually be another argument in favor of adding a "this algo isn't really testable" flag as Neil suggested...
Signature · 2 lines
Jarod Wilson [email protected]
PATCH v2 1/1 crypto: print self-test pass notices in fips mode
Quoted 27 lines · On Wednesday 29 April 2009 09:24:10 Jarod Wilson wrote:
Quoted 26 lines · On Wednesday 29 April 2009 09:21:53 Jarod Wilson wrote:
Quoted 16 lines · On Wednesday 29 April 2009 09:18:17 Herbert Xu wrote:
crypto/testmgr.c notest: · line 2155
Quoted 13 lines · Jarod Wilson
crypto/testmgr.c +4
-0@@ -2149,6 +2149,10 @@ notest: test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +/* fips mode requires we print out self-test success notices */ +if (fips_enabled && !rc &&strncmp (alg,"ctr(aes" ,7 )) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg);What is this strncmp crap for?
To avoid claiming we successfully self-tested ctr(aes) when its not actually directly testable. Was intended to go sort of hand in hand with the other patch to suppress 'no self test' messages for ctr(aes) when in fips mode. Of course, since at this point, we've run ecb(aes), and that's what's suggested as the way to test ctr(aes)[*], perhaps we don't need to
suppress it.
Quoted 5 lines
Quoted 2 lines
[*] well, along with the sign-off from the lab that the counter code is acceptable
So this might actually be another argument in favor of adding a "this algo isn't really testable" flag as Neil suggested...
According to our FIPS CAVS testing lab guru, when we're in fips mode, we must print out notices of successful self-test completion for every alg to be compliant.
New and improved v2, without strncmp crap. Doesn't need to touch a flag though, due to not moving the notest label around anymore.
Applies atop '[PATCH v2] crypto: catch base cipher self-test failures in fips mode'.
Personally, I wouldn't mind seeing this info printed out regardless of whether or not we're in fips mode, I think its useful info, but will stick with only in fips mode for now.
--- crypto/testmgr.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
crypto/testmgr.c +4 -0
@@ -2245,6 +2245,10 @@ test_done:if (fips_enabled && rc)panic ("%s: %s alg self test failed in fips mode!\n" , driver, alg); +if (fips_enabled && !rc) +printk (KERN_INFO "alg: self-tests for %s (%s) passed\n" , + driver, alg); +return rc; notest:
Signature · 2 lines
Jarod Wilson [email protected]
Herbert Xu
maintainerQuoted 4 lines · Jarod Wilson
According to our FIPS CAVS testing lab guru, when we're in fips mode, we must print out notices of successful self-test completion for every alg to be compliant.
Also applied.
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt