Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Elliott, Robert (Servers)" <elliott@hpe.com>
To:     Nicolai Stange <nstange@suse.de>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>
CC:     Vladis Dronov <vdronov@redhat.com>,
        Stephan Mueller <smueller@chronox.de>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH 1/4] crypto: xts - restrict key lengths to approved values
 in FIPS mode
Thread-Topic: [PATCH 1/4] crypto: xts - restrict key lengths to approved
 values in FIPS mode
Thread-Index: AQHY831ixjJdferq10idPflaF1LnHq41P+BA
Date:   Tue, 8 Nov 2022 17:12:21 +0000
Message-ID: <MW5PR84MB1842A19B7BDA70A7C81AFB98AB3F9@MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM>
References: <20221108142025.13461-1-nstange@suse.de>
 <20221108142025.13461-2-nstange@suse.de>
In-Reply-To: <20221108142025.13461-2-nstange@suse.de>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?UalDIT0dujtjLjg3+wufsxPoCNW8lBJvEKJBGPehRNYo+YjGsF5xYwKclFnP?=
 =?us-ascii?Q?/CPbjHzH90bsY8uQrBCOi3h9Vps00ivx9kkU7q9sPUfH6NaRl8TEj4CMoiwu?=
 =?us-ascii?Q?3tHXMkuaA8WnVr+Jr1Q6foMWVix8ADJpHl8V87oI1eVSffJulwEgHrV5gxlN?=
 =?us-ascii?Q?SvcWvsPnOX8bic10huRHd9pe1c8GQxPX8Is6EVMaukIpJJv/O8/RX9mWSzhO?=
 =?us-ascii?Q?AGf47WxZV25tpOmMqH8wFG7iT6STlqj9fbtNcg5arxTb3QGiyInNDS3yaet3?=
 =?us-ascii?Q?I0S4Co3pfdrZpv0ueT9MDh+uHfecKzNqT0VprNZlH9ttwAp2itom/zVXgL+b?=
 =?us-ascii?Q?2cGM8yo3yWOhIs+2iRaSwk6Fso+xQ8XrZGhNYWfCVYetUJRJ8/sPtbby7ljy?=
 =?us-ascii?Q?hbziLSUfq8ELh+hRhunJYcL2+RlqO2jfETPbifnNLUzi5PePRTX3Ph8RG5nb?=
 =?us-ascii?Q?OFmXd5plONmv2KofwCXhRitMOhLgLShb4JGm8sqRmCuG2LbCtPJw4uHxZsmj?=
 =?us-ascii?Q?KVbaEg4z8xB6maWRJknnjq9/+z0U2zdVdNrTu3EjcvOCHfhNI/FjAD/6YdJm?=
 =?us-ascii?Q?W1TcYOQ06IYSR6vjh8VvR6vOEw/vO/WaxrBkAFM6PyC+3PtmEPX1SE7rLQ1s?=
 =?us-ascii?Q?MqJSsA96Q+EZwwhhawx1Y4W4He1gLlAwFHgo5bOF0UfU6eyfl8tcJ/rH/yiu?=
 =?us-ascii?Q?lD6BF9ogahOwON2SPPNeUAPrIilISmePds4Q3WsFAQo+B01l0oE1fz8ZvFB7?=
 =?us-ascii?Q?fHiCjsl862I/IycDwYI3MLQQiMwfIiKSBt7pP5uoL5tvTKbizVfe+Uydk9Em?=
 =?us-ascii?Q?9I0jd4st2xmqNBL7eUakbbisHW23xUYqit+yh4r7jUAL48KqD7rcaDaRMxDj?=
 =?us-ascii?Q?DkuIqffAh0Vn2nShauC/aPimfzh6Ott/I0l2g6Ov6WdvIDMYEBBRCPGkDKTH?=
 =?us-ascii?Q?4qVrsLdf4fr7dhA3/HvNdc2N3QWxc4dcdWyatl9yJSJ5fOHBqXPqVVUH9fuD?=
 =?us-ascii?Q?6h53gytSTi3TWyJQlBN643R7ZrelX7dMWUrCf+ISRcNewVC/17G9bTJRXILT?=
 =?us-ascii?Q?iCq+854HV6S8gKUNsFj2XHEamXmG1W4NMAt2bZpPscnqV3lscprhuEFZb+74?=
 =?us-ascii?Q?hnRKVt/mCcH/nRNb2T97R4uo9u21alc7nP+jnrPLiKlbeQeBMLm7GmpjG6G3?=
 =?us-ascii?Q?Gj5BCtBfC5R2RYCAyQVdHXAFfhv8xtqUvGrCQmxJ6I8wdxSE8NOew7NS7VdA?=
 =?us-ascii?Q?eCU1TiYRIfkp8etzhISvT6rVf6JCH8pLyeBaETLb2jz3P7OnorXFVPYrQopD?=
 =?us-ascii?Q?TqzBckTiZVpfg84zU2kpgVm5gv3O9BDH5uOy6d+aMezzjfblo4r5uhi/6Yh5?=
 =?us-ascii?Q?QQmq7wAIZretrWsgkH8aS1EbGw0A2ixvvo5bbynFFfiiEFx1eJlLkuMcJN7t?=
 =?us-ascii?Q?nGRr7lN4abzqtbIN0nEKbTXw4f0E1WhOvWR9B0O+FYI8Uigs/vD0/LmSV8TV?=
 =?us-ascii?Q?hfFQPurXzyZfJ/RoxDyOUxIXEJuT/kpbbVD6Az4fICo+JjvfLctLF1G9pDwy?=
 =?us-ascii?Q?ByU4QykZcMAg6tOoFMA=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: d2e9dc3b-b611-477e-4e19-08dac1ac65bc
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Nov 2022 17:12:21.1096
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 105b2061-b669-4b31-92ac-24d304d195dc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: m4yzOJEMy2/pEUjz82BMEcls9GLQeONsxadCaaP/yP7Aq/3/hQRwEMCmaND3aS++
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR84MB1682
X-OriginatorOrg: hpe.com
X-Proofpoint-GUID: W_NBAQvxgF5zG1N925ZLM3Qnn5EPJn5k
X-Proofpoint-ORIG-GUID: W_NBAQvxgF5zG1N925ZLM3Qnn5EPJn5k
X-HPE-SCL: -1
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-07_11,2022-11-08_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
 malwarescore=0 adultscore=0 suspectscore=0 bulkscore=0 mlxlogscore=722
 phishscore=0 clxscore=1011 impostorscore=0 spamscore=0 mlxscore=0
 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2210170000 definitions=main-2211080107
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> diff --git a/include/crypto/xts.h b/include/crypto/xts.h
...
> @@ -35,6 +35,13 @@ static inline int xts_verify_key(struct crypto_skciphe=
r
> *tfm,
>  	if (keylen % 2)
>  		return -EINVAL;
>=20
> +	/*
> +	 * In FIPS mode only a combined key length of either 256 or
> +	 * 512 bits is allowed, c.f. FIPS 140-3 IG C.I.
> +	 */
> +	if (fips_enabled && keylen !=3D 32 && keylen !=3D 64)
> +		return -EINVAL;
> +
>  	/* ensure that the AES and tweak key are not identical */
>  	if ((fips_enabled || (crypto_skcipher_get_flags(tfm) &
>  			      CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) &&
> --
> 2.38.0

arch/s390/crypto/aes_s390.c has similar lines:

static int xts_aes_set_key(struct crypto_skcipher *tfm, const u8 *in_key,
                           unsigned int key_len)
{
        struct s390_xts_ctx *xts_ctx =3D crypto_skcipher_ctx(tfm);
        unsigned long fc;
        int err;

        err =3D xts_fallback_setkey(tfm, in_key, key_len);
        if (err)
                return err;

        /* In fips mode only 128 bit or 256 bit keys are valid */
        if (fips_enabled && key_len !=3D 32 && key_len !=3D 64)
                return -EINVAL;


xts_fallback_setkey will now enforce that rule when setting up the
fallback algorithm keys, which makes the xts_aes_set_key check
unreachable.

If that fallback setup were not present, then a call to xts_verify_key
might be preferable to enforce any other rules like the WEAK_KEYS
rule.