Messages in this thread | | | From | Stephan Mueller <> | Subject | Re: [PATCH RFC v5 3/4] crypto: rsa: add a new rsa generic implementation | Date | Tue, 16 Jun 2015 01:23:14 +0200 |
| |
Am Montag, 15. Juni 2015, 13:18:47 schrieb Tadeusz Struk:
Hi Tadeusz,
> Add a new rsa generic SW implementation. > This implements only cryptographic primitives.
Thank you, that seems to address the issues around the FIPS side including the self test code.
Though, I have one question:
> + > +int rsa_get_n(void *context, size_t hdrlen, unsigned char tag, > + const void *value, size_t vlen) > +{ > + struct crypto_akcipher *tfm = context; > + struct rsa_key *key = tfm->key; > + > + key->n = mpi_read_raw_data(value, vlen); > + > + if (!key->n) > + return -ENOMEM; > + > + /* In FIPS mode only allow key size minimum 2K */ > + if (fips_enabled && (mpi_get_size(key->n) < 256)) {
Considering my previous email, shouldn't that check rather be
if (fips_enabled && ((mpi_get_size(key->n) != 256) || (mpi_get_size(key->n) != 384))
?
> + pr_err("RSA: key size not allowed in FIPS mode\n"); > + mpi_free(key->n); > + key->n = NULL; > + return -EINVAL; > + } > + > + return 0; > +} > + > +int rsa_get_e(void *context, size_t hdrlen, unsigned char tag, > + const void *value, size_t vlen) > +{ > + struct crypto_akcipher *tfm = context; > + struct rsa_key *key = tfm->key; > + > + key->e = mpi_read_raw_data(value, vlen); > + > + if (!key->e) > + return -ENOMEM; > + > + return 0; > +} > + > +int rsa_get_d(void *context, size_t hdrlen, unsigned char tag, > + const void *value, size_t vlen) > +{ > + struct crypto_akcipher *tfm = context; > + struct rsa_key *key = tfm->key; > + > + key->d = mpi_read_raw_data(value, vlen); > + > + if (!key->d) > + return -ENOMEM; > + > + /* In FIPS mode only allow key size minimum 2K */ > + if (fips_enabled && (mpi_get_size(key->d) < 256)) {
dto.
> + pr_err("RSA: key size not allowed in FIPS mode\n"); > + mpi_free(key->d); > + key->d = NULL; > + return -EINVAL; > + } > + return 0; > +} > +
Thanks -- Ciao Stephan
| |