Messages in this thread | | | From | Stephan Müller <> | Subject | Re: [PATCH v2 6/9] staging: ccree: add FIPS support | Date | Sun, 23 Apr 2017 20:57:58 +0200 |
| |
Am Sonntag, 23. April 2017, 11:48:58 CEST schrieb Gilad Ben-Yossef:
Hi Gilad,
> I do wonder if there is value in alternate behavior of stopping crypto > API on FIPS error rather than a panic though. I will try to get an > explanation why we do it this way.
In FIPS, all crypto function must cease if a self test fails. This can be done by instrumenting the crypto API calls with a check to a global flag or by simply terminating the entire "FIPS module".
The panic() is the simplest approach to meet that requirement.
Ciao Stephan
| |