Commit 1c4428b2 authored by Nicolai Stange's avatar Nicolai Stange Committed by Herbert Xu
Browse files

crypto: xts - restrict key lengths to approved values in FIPS mode 



According to FIPS 140-3 IG C.I., only (total) key lengths of either
256 bits or 512 bits are allowed with xts(aes). Make xts_verify_key() to
reject anything else in FIPS mode.

As xts(aes) is the only approved xts() template instantiation in FIPS mode,
the new restriction implemented in xts_verify_key() effectively only
applies to this particular construction.

Signed-off-by: default avatarNicolai Stange <nstange@suse.de>
Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 39a76cf1

include/crypto/xts.h

+7 −0
Original line number Diff line number Diff line
@@ -35,6 +35,13 @@ static inline int xts_verify_key(struct crypto_skcipher *tfm, 
	if (keylen % 2)

		return -EINVAL;



	/*

	 * In FIPS mode only a combined key length of either 256 or

	 * 512 bits is allowed, c.f. FIPS 140-3 IG C.I.

	 */

	if (fips_enabled && keylen != 32 && keylen != 64)

		return -EINVAL;



	/* ensure that the AES and tweak key are not identical */

	if ((fips_enabled || (crypto_skcipher_get_flags(tfm) &

			      CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) &&