Date:   Fri, 7 Jan 2022 15:28:31 -0800
From:   Eric Biggers <ebiggers@kernel.org>
To:     Stephan =?iso-8859-1?Q?M=FCller?= <smueller@chronox.de>
Cc:     herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org,
        Niolai Stange <nstange@suse.com>, Simo Sorce <simo@redhat.com>
Subject: Re: [PATCH] crypto: HMAC - disallow keys < 112 bits in FIPS mode
Message-ID: <YdjMn75GFEOLvoDr@sol.localdomain>
References: <2075651.9o76ZdvQCi@positron.chronox.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <2075651.9o76ZdvQCi@positron.chronox.de>
Precedence: bulk

Hi Stephan,

On Fri, Jan 07, 2022 at 08:25:24PM +0100, Stephan M?ller wrote:
> FIPS 140 requires a minimum security strength of 112 bits. This implies
> that the HMAC key must not be smaller than 112 in FIPS mode.
> 
> This restriction implies that the test vectors for HMAC that have a key
> that is smaller than 112 bits must be disabled when FIPS support is
> compiled.
> 
> Signed-off-by: Stephan Mueller <smueller@chronox.de>

This could make sense, but the weird thing is that the HMAC code has been like
this from the beginning, yet many companies have already gotten this exact same
HMAC implementation FIPS-certified.  What changed?

- Eric