lkml.org 
[lkml]   [2021]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/3] crypto: ecdh - fix 'ecdh_init'
On Fri, May 21, 2021 at 04:08:10PM +0800, Hui Tang wrote:
>
> On 2021/5/21 15:45, Herbert Xu wrote:
> > On Wed, May 12, 2021 at 02:40:00PM +0800, Hui Tang wrote:
> > > NIST P192 is not unregistered if failed to register NIST P256,
> > > actually it need to unregister the algorithms already registered.
> > >
> > > Signed-off-by: Hui Tang <tanghui20@huawei.com>
> > > ---
> > > crypto/ecdh.c | 11 ++++++++++-
> > > 1 file changed, 10 insertions(+), 1 deletion(-)
> >
> > Thanks for catching this. The variable ecdh_nist_p192_registered
> > is bogus. You should just make it so that if p192 fails to
> > register then the init function aborts. There would then be
> > no need to check for the registered state in the exit function.
>
> Okay, I will fix it in next version, and 'ecdsa_init' should
> do the same thing too?

Actually, it looks like it is needed for FIPS. We should add
a comment that p192 will fail to register in FIPS mode and that's
why there is a check for it.

Funnily enough, ecdsa has the FIPS comment but testmgr doesn't
set fips_allowed for any of them while ecdh is set but has no
comment.

Stephan, can you confirm that both ecdh-nist-p192 and ecdsa-nist-p192
should be disabled in FIPS mode?

Also, we should fix ecdh-nist-p192's entry in testmgr by removing
the ifdefs and not setting fips_allowed.

Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

\
 
 \ /
  Last update: 2021-05-21 10:14    [W:0.037 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site