Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Stephan =?ISO-8859-1?Q?M=FCller?= <smueller@chronox.de>
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     linux-crypto@vger.kernel.org, Niolai Stange <nstange@suse.com>,
        Simo Sorce <simo@redhat.com>
Subject: [PATCH v2 0/2] crypto: HMAC - disallow keys < 112 bits in FIPS mode
Date:   Tue, 01 Feb 2022 09:40:24 +0100
Message-ID: <4609802.vXUDI8C0e8@positron.chronox.de>
In-Reply-To: <YfN1HKqL9GT9R25Z@gondor.apana.org.au>
References: <2075651.9o76ZdvQCi@positron.chronox.de> <YfN1HKqL9GT9R25Z@gondor.apana.org.au>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

Hi,

this is patch set version 2 for adding the HMAC limitation to disallow
keys < 112 bits in FIPS mode.

Version 2 changes:

As requested, instead of ifdef'ing test vectors out that violate the
constraint added with this patch set, they are compiled but disabled in
FIPS mode based on the .fips_skip flag.

The first patch adds the generic support for the fips_skip flag to
hashes / HMAC test vectors similarly to the support found for symmetric
algorithms.

The second patch uses the fips_skip flag to mark offending test vectors.

Stephan Mueller (2):
  crypto: HMAC - add fips_skip support
  crypto: HMAC - disallow keys < 112 bits in FIPS mode

 crypto/hmac.c    |  4 ++++
 crypto/testmgr.c |  3 +++
 crypto/testmgr.h | 11 +++++++++++
 3 files changed, 18 insertions(+)

-- 
2.33.1