From:   Stephan Mueller <smueller@chronox.de>
To:     Eric Biggers <ebiggers@kernel.org>
Cc:     herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org,
        Niolai Stange <nstange@suse.com>, Simo Sorce <simo@redhat.com>
Subject: Re: [PATCH] crypto: HMAC - disallow keys < 112 bits in FIPS mode
Date:   Tue, 11 Jan 2022 08:17:57 +0100
Message-ID: <1979340.Ftzpt9979A@tauon.chronox.de>
In-Reply-To: <2042139.9o76ZdvQCi@positron.chronox.de>
References: <2075651.9o76ZdvQCi@positron.chronox.de> <YdjMn75GFEOLvoDr@sol.localdomain> <2042139.9o76ZdvQCi@positron.chronox.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1"
Precedence: bulk

Am Samstag, 8. Januar 2022, 07:39:27 CET schrieb Stephan M=FCller:

Hi,

> Am Samstag, 8. Januar 2022, 00:28:31 CET schrieb Eric Biggers:
>=20
> Hi Eric,
>=20
> > Hi Stephan,
> >=20
> > On Fri, Jan 07, 2022 at 08:25:24PM +0100, Stephan M=FCller wrote:
> > > FIPS 140 requires a minimum security strength of 112 bits. This impli=
es
> > > that the HMAC key must not be smaller than 112 in FIPS mode.
> > >=20
> > > This restriction implies that the test vectors for HMAC that have a k=
ey
> > > that is smaller than 112 bits must be disabled when FIPS support is
> > > compiled.
> > >=20
> > > Signed-off-by: Stephan Mueller <smueller@chronox.de>
> >=20
> > This could make sense, but the weird thing is that the HMAC code has be=
en
> > like this from the beginning, yet many companies have already gotten th=
is
> > exact same HMAC implementation FIPS-certified.  What changed?
>=20
> FIPS 140-3 (which is now mandatory) requires this based on SP800-131A.

Here are a few more details:

The requirement from FIPS 140-3 that the crypto module (aka kernel crypto A=
PI)=20
must provide an indicator whether the algorithm(s) in use are FIPS complian=
t.

If you look at various user space libraries, they make quite an effort thes=
e=20
days to add that "service indicator" as an API. Adding such an API to the=20
crypto API is not helpful.

Thus we revert to the notion of a "global service indicator" meaning that w=
hen=20
the kernel is booted with fips=3D1, all algorithms operate in FIPS mode. Th=
is=20
means that all non-approved algos must be technically disabled.

There have been patches from me disabling RSA < 2k and others not too long=
=20
ago. In the future, I would expect additional patches disabling the use of =
GCM=20
when invoked without seqiv or disabling dh when not used with one of the up-
and-coming FFDHE / MODP groups from Nicolai's patch set. All those patches=
=20
revolve around the same issue.

Note, for some algorithms like XTS key check we already had such technical=
=20
enforcements. This was due to the fact that FIPS 140-2 required for some=20
aspects technical enforcements but for some others, "procedural" coverage (=
aka=20
documentation) was sufficient.

Ciao
Stephan