Commit 288c0697 authored by Archie Pusaka's avatar Archie Pusaka Committed by Marcel Holtmann
Browse files

Bluetooth: Enforce key size of 16 bytes on FIPS level 



According to the spec Ver 5.2, Vol 3, Part C, Sec 5.2.2.8:
Device in security mode 4 level 4 shall enforce:
128-bit equivalent strength for link and encryption keys required
using FIPS approved algorithms (E0 not allowed, SAFER+ not allowed,
and P-192 not allowed; encryption key not shortened)

This patch rejects connection with key size below 16 for FIPS
level services.

Signed-off-by: default avatarArchie Pusaka <apusaka@chromium.org>
Reviewed-by: default avatarAlain Michaud <alainm@chromium.org>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 0d484db6

net/bluetooth/l2cap_core.c

+7 −1
Original line number Diff line number Diff line
@@ -1515,8 +1515,14 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon) 
	 * that have no key size requirements. Ensure that the link is

	 * actually encrypted before enforcing a key size.

	 */

	int min_key_size = hcon->hdev->min_enc_key_size;



	/* On FIPS security level, key size must be 16 bytes */

	if (hcon->sec_level == BT_SECURITY_FIPS)

		min_key_size = 16;



	return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||

		hcon->enc_key_size >= hcon->hdev->min_enc_key_size);

		hcon->enc_key_size >= min_key_size);

}



static void l2cap_do_start(struct l2cap_chan *chan)