Re: [PATCH RFC v4 2/4] crypto: add PKE API

From	Herbert Xu <herbert@gondor.apana.org.au>
Newsgroups	linux.kernel
Subject	Re: [PATCH RFC v4 2/4] crypto: add PKE API
Date	2015-06-12 04:50 +0200
Message-ID	<pAncC-tp-7@gated-at.bofh.it> (permalink)
References	<pAg1r-6ty-9@gated-at.bofh.it> <pAg1s-6ty-29@gated-at.bofh.it> <pAlDQ-6qA-7@gated-at.bofh.it> <pAncB-tp-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Jun 12, 2015 at 10:42:46AM +0800, Herbert Xu wrote:
> On Fri, Jun 12, 2015 at 03:00:42AM +0200, Stephan Mueller wrote:
> >
> > The testmgr code can mark an entire cipher implementation as fips_allowed=1 as 
> > already done for RSA. However, unlike with the other ciphers, that flag must 
> > go in conjunction with the used key sizes.
> > 
> > For FIPS mode, the following restrictions apply:
> > 
> > - RSA: 2048/3072
> > 
> > - DSA: L 2048 / N 224; L 2048 / N 256; L 3072 / N 256
> > 
> > - ECDSA: only the NIST curves
> > 
> > Any other key sizes for the given ciphers is not allowed in FIPS mode.
> > 
> > Should that constraint be considered here?
> 
> Yes.  However it should be placed into a helper that everybody
> can call so that future hardware implementations can also make
> the same checks.

Ugh I didn't notice this was the generic API setkey function.
No it should go into the algorithm-specific setkey function and
then be in the form of a helper so that all implementations of
that algorithm can call it.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH RFC v4 2/4] crypto: add PKE API Stephan Mueller <smueller@chronox.de> - 2015-06-12 03:10 +0200
  Re: [PATCH RFC v4 2/4] crypto: add PKE API Herbert Xu <herbert@gondor.apana.org.au> - 2015-06-12 04:50 +0200
    Re: [PATCH RFC v4 2/4] crypto: add PKE API Herbert Xu <herbert@gondor.apana.org.au> - 2015-06-12 04:50 +0200

csiph-web