2021-11-21 14:31:31

by Stephan Müller

Subject: [PATCH] crypto: RSA - limit key size to 2048 in FIPS mode

FIPS disallows RSA with keys < 2048 bits. Thus, the kernel should
consider the enforcement of this limit.

Signed-off-by: Stephan Mueller <[email protected]>
---
crypto/rsa.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/crypto/rsa.c b/crypto/rsa.c
index 4cdbec95d077..39e04176b04b 100644
--- a/crypto/rsa.c
+++ b/crypto/rsa.c
@@ -5,6 +5,7 @@
* Authors: Tadeusz Struk <[email protected]>
*/

+#include <linux/fips.h>
#include <linux/module.h>
#include <linux/mpi.h>
#include <crypto/internal/rsa.h>
@@ -144,6 +145,9 @@ static int rsa_check_key_length(unsigned int len)
case 512:
case 1024:
case 1536:
+ if (fips_enabled)
+ return -EINVAL;
+ fallthrough;
case 2048:
case 3072:
case 4096:
--
2.33.1

2021-11-26 05:34:47

by Herbert Xu

Subject: Re: [PATCH] crypto: RSA - limit key size to 2048 in FIPS mode

On Sun, Nov 21, 2021 at 03:31:27PM +0100, Stephan M?ller wrote:
> FIPS disallows RSA with keys < 2048 bits. Thus, the kernel should
> consider the enforcement of this limit.
>
> Signed-off-by: Stephan Mueller <[email protected]>
> ---
> crypto/rsa.c | 4 ++++
> 1 file changed, 4 insertions(+)

Patch applied. Thanks.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt