lkml.org 
[lkml]   [2021]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 08/18] crypto: testmgr - run only subset of DH vectors based on config
    Date
    With the previous patches, the testmgr now has up to four test vectors for
    DH which all test more or less the same thing:
    - the two vectors from before this series,
    - the vector for the ffdhe2048 group, enabled if
    CONFIG_CRYPTO_DH_GROUPS_RFC7919 is set and
    - the vector for the modp2048 group, similarly enabled if
    CONFIG_CRYPTO_DH_GROUPS_RFC3526 is set.

    In order to avoid too much redundancy during DH testing, enable only a
    subset of these depending on the kernel config:
    - if CONFIG_CRYPTO_DH_GROUPS_RFC7919 is set, enable only the ffdhe2048
    vector,
    - otherwise, if CONFIG_CRYPTO_DH_GROUPS_RFC3526 is set, enable only
    the modp2048 vector and
    - only enable the original two vectors if neither of these options
    has been selected.

    Note that an upcoming patch will make the DH implementation to reject any
    domain parameters not corresponding to some safe-prime group approved by
    SP800-56Arev3 in FIPS mode. Thus, having CONFIG_FIPS enabled, but
    both of CONFIG_CRYPTO_DH_GROUPS_RFC7919 and
    CONFIG_CRYPTO_DH_GROUPS_RFC3526 unset wouldn't make much sense as it would
    render the DH implementation unusable in FIPS mode. Conversely, any
    reasonable configuration would ensure that the original, non-conforming
    test vectors would not get to run in FIPS mode.

    Signed-off-by: Nicolai Stange <nstange@suse.de>
    ---
    crypto/testmgr.h | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/crypto/testmgr.h b/crypto/testmgr.h
    index d18844c7499e..b295512c8f22 100644
    --- a/crypto/testmgr.h
    +++ b/crypto/testmgr.h
    @@ -1331,8 +1331,7 @@ static const struct kpp_testvec dh_tv_template[] = {
    .expected_a_public_size = 256,
    .expected_ss_size = 256,
    },
    -#endif /* IS_ENABLED(CONFIG_CRYPTO_DH_GROUPS_RFC7919) */
    -#if IS_ENABLED(CONFIG_CRYPTO_DH_GROUPS_RFC3526)
    +#elif IS_ENABLED(CONFIG_CRYPTO_DH_GROUPS_RFC3526)
    {
    .secret =
    #ifdef __LITTLE_ENDIAN
    @@ -1423,7 +1422,7 @@ static const struct kpp_testvec dh_tv_template[] = {
    .expected_a_public_size = 256,
    .expected_ss_size = 256,
    },
    -#endif /* IS_ENABLED(CONFIG_CRYPTO_DH_GROUPS_RFC3526) */
    +#else
    {
    .secret =
    #ifdef __LITTLE_ENDIAN
    @@ -1642,6 +1641,7 @@ static const struct kpp_testvec dh_tv_template[] = {
    .expected_a_public_size = 256,
    .expected_ss_size = 256,
    },
    +#endif
    };

    static const struct kpp_testvec curve25519_tv_template[] = {
    --
    2.26.2
    \
     
     \ /
      Last update: 2021-12-01 01:51    [W:4.144 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site