From:   Stephan =?ISO-8859-1?Q?M=FCller?= <smueller@chronox.de>
To:     Eric Biggers <ebiggers@kernel.org>
Cc:     herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org,
        Niolai Stange <nstange@suse.com>, Simo Sorce <simo@redhat.com>
Subject: Re: [PATCH] crypto: HMAC - disallow keys < 112 bits in FIPS mode
Date:   Sat, 08 Jan 2022 07:39:27 +0100
Message-ID: <2042139.9o76ZdvQCi@positron.chronox.de>
In-Reply-To: <YdjMn75GFEOLvoDr@sol.localdomain>
References: <2075651.9o76ZdvQCi@positron.chronox.de> <YdjMn75GFEOLvoDr@sol.localdomain>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1"
Precedence: bulk

Am Samstag, 8. Januar 2022, 00:28:31 CET schrieb Eric Biggers:

Hi Eric,

> Hi Stephan,
>=20
> On Fri, Jan 07, 2022 at 08:25:24PM +0100, Stephan M=FCller wrote:
> > FIPS 140 requires a minimum security strength of 112 bits. This implies
> > that the HMAC key must not be smaller than 112 in FIPS mode.
> >=20
> > This restriction implies that the test vectors for HMAC that have a key
> > that is smaller than 112 bits must be disabled when FIPS support is
> > compiled.
> >=20
> > Signed-off-by: Stephan Mueller <smueller@chronox.de>
>=20
> This could make sense, but the weird thing is that the HMAC code has been
> like this from the beginning, yet many companies have already gotten this
> exact same HMAC implementation FIPS-certified.  What changed?

=46IPS 140-3 (which is now mandatory) requires this based on SP800-131A.
>=20
> - Eric


Ciao
Stephan