Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Elliott, Robert (Servers)" <elliott@hpe.com>
To:     Nicolai Stange <nstange@suse.de>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>
CC:     Vladis Dronov <vdronov@redhat.com>,
        Stephan Mueller <smueller@chronox.de>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH 1/4] crypto: xts - restrict key lengths to approved values
 in FIPS mode
Thread-Topic: [PATCH 1/4] crypto: xts - restrict key lengths to approved
 values in FIPS mode
Thread-Index: AQHY831ixjJdferq10idPflaF1LnHq41ep+g
Date:   Tue, 8 Nov 2022 20:34:10 +0000
Message-ID: <MW5PR84MB1842EEC44A8CB6594D4D0CD0AB3F9@MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM>
References: <20221108142025.13461-1-nstange@suse.de>
 <20221108142025.13461-2-nstange@suse.de>
In-Reply-To: <20221108142025.13461-2-nstange@suse.de>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?7hr+beydPqAnGdZOEGsQScOq29Y0E8kCCQCnw+5+hZePrLaDwofHz72is293?=
 =?us-ascii?Q?JfhIMw4PXbZTWLkSK4W7hjBHhyYZF7FMYiQPHCwAV0uLPu7Jg0/6TwcH33lS?=
 =?us-ascii?Q?yqVyfn7mYN9tt4zAbBzxhrmImKpq/xSWTVKndxflLIq9bJ2Qq1WgwtoSpz76?=
 =?us-ascii?Q?v05Tqg8P2vyIOewJ9IN4fmW/c6IMwLKisTg7JG0ZLihkUz+7MJpjZyHOPhGQ?=
 =?us-ascii?Q?WVF39neVnVNYAv3UUjCiV45ItIfFZ9ZCPAAG9kolAFKvyqSTz/JQCspH8T5A?=
 =?us-ascii?Q?2fYpjQbu6lI9wgTh9Kz5DmXSvsZHc+IzOPEcYotTCxf001pvfTBqjQXFcBAY?=
 =?us-ascii?Q?nTBaVSBL2awKKfBlx52O5/mt9GlI3F+bgSgZ/NbkI92YQlQ4tdj1YKO1TL7r?=
 =?us-ascii?Q?TkF+oaNbXl/cawwZqu7n+2EYnluEGsPqlElAVbkgkQTZaMEpJiXTA0KTy8o9?=
 =?us-ascii?Q?5FINOBgFZf1/JZ5Woo5IJYqmbHomXjwDhle/SLc6KU15CEod5ooqMgq6aglL?=
 =?us-ascii?Q?HzJRwVHGOSuiioCy4hQyzMVkY1+ErOe44x+xSw+UN1UceTUbBizejMV34pIR?=
 =?us-ascii?Q?qsKWobT9j7y4LTukSPZCnGWZ81aXM1C3egF/GbBXigp5iuitZ/T7ZQG7Busq?=
 =?us-ascii?Q?TY+X6GWdfBNmhjnjo2VUFpZvh9AJ0SHOwtXwBZqmnBau2T2zYP21fqJOBmYD?=
 =?us-ascii?Q?lO4Ew/YHJutRapD06asmpmxZBOqTJOcxUuyejIHn40sSqRR5cwwKuR4GtqmJ?=
 =?us-ascii?Q?MdrOUfSxl6SzwDIhegfxGRsrhOqLm1F5nX/hw3oenNk/I8oTYJmli+/9umu2?=
 =?us-ascii?Q?+bdHZER2gFPjxMkQA2LpzZqmnOkX7KrZ7siAAVfC3MnuVeANiBLijIaLGnoY?=
 =?us-ascii?Q?8ZGgUu6lF54dyUgkcK/HDkU0Ize1YoM8ZeoxoIPbLN1b82XGj/vHWj1AcBot?=
 =?us-ascii?Q?rWgjji/rfVYqfKUlfwRMc0xgSxJjHHCxjhORsE5PGqBY6xh3RYHDVIFgtPv9?=
 =?us-ascii?Q?SAWU3cM2jMTv4w1TqOBaJvEaioPzsahBbA8SXUy/VPH9AP8ZodhjzXiio4RI?=
 =?us-ascii?Q?bW0Avawdvphs2PH+6+fcz1hnfZoqrVph/Pbq2Fqd+u3+GW8QKJZx8cAdeCjQ?=
 =?us-ascii?Q?RO/TnVaSEbLvj3NaakBwzsfrLwm3CZSgqSmXmprK+ALbLdcGR3d2zh56bOlR?=
 =?us-ascii?Q?hloDQEOd5QDUj5YQffS7RCB6/+RnQnkhja7SjtPkkqtZNRpJKpinRo4TQdOG?=
 =?us-ascii?Q?KI70sHfWLhaJj85VV51tuh8UGe4q8Tk5rGXDMLQcUtYarswT9totA0/OgCRA?=
 =?us-ascii?Q?La5QPY5ua7tyJ9M8CLqQopkMNLGBsbudi24tq/TkStF0INI0b8zFNvgNmM66?=
 =?us-ascii?Q?clv+B30F4/MckqcImAIhhB910/IuAGZ9gYaa7JAdlEeOLaC2GQFWED5s18xi?=
 =?us-ascii?Q?48mRFhpvzzJTPN0o1BWG28dfbnV6TBddLA2DFTZPUy8aUB9Nr3qQKVVq+jOn?=
 =?us-ascii?Q?PQcuwvz7nA8ROu5uq/RIEK3HeEVjevkNqd7Npi5C/tuf/W4yH3yxTuruHvv0?=
 =?us-ascii?Q?gnSu+IJLKR4YS22dWUU=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 240deed6-6d11-487a-b4d3-08dac1c89789
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Nov 2022 20:34:10.5882
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 105b2061-b669-4b31-92ac-24d304d195dc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gd5uSgdi0FDYNPnzJZ5sDxuXofZKaWrFlkLolALfhFJCRxEqy3C89lUu1VdaHWDp
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR84MB1429
X-OriginatorOrg: hpe.com
X-Proofpoint-GUID: FhFnDzrQpfRWoYBkQqtr2KfwJ2HoQanI
X-Proofpoint-ORIG-GUID: FhFnDzrQpfRWoYBkQqtr2KfwJ2HoQanI
X-HPE-SCL: -1
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-07_11,2022-11-08_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 clxscore=1015
 suspectscore=0 impostorscore=0 mlxlogscore=877 bulkscore=0 malwarescore=0
 spamscore=0 adultscore=0 mlxscore=0 lowpriorityscore=0 priorityscore=1501
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2211080131
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

> diff --git a/include/crypto/xts.h b/include/crypto/xts.h
...
> @@ -35,6 +35,13 @@ static inline int xts_verify_key(struct crypto_skciphe=
r
> *tfm,
>  	if (keylen % 2)
>  		return -EINVAL;
>=20
> +	/*
> +	 * In FIPS mode only a combined key length of either 256 or
> +	 * 512 bits is allowed, c.f. FIPS 140-3 IG C.I.
> +	 */
> +	if (fips_enabled && keylen !=3D 32 && keylen !=3D 64)
> +		return -EINVAL;
> +
>  	/* ensure that the AES and tweak key are not identical */
>  	if ((fips_enabled || (crypto_skcipher_get_flags(tfm) &
>  			      CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) &&
> --
> 2.38.0

There's another function in the same file called xts_check_key()=20
that is used by some of the hardware drivers:

arch/s390/crypto/paes_s390.c:    * xts_check_key verifies the key length is=
 not odd and makes
 [that references it in the comment but actually calls xts_verify_key in th=
e code]
drivers/crypto/axis/artpec6_crypto.c:   ret =3D xts_check_key(&cipher->base=
, key, keylen);
drivers/crypto/cavium/cpt/cptvf_algs.c: err =3D xts_check_key(tfm, key, key=
len);
drivers/crypto/cavium/nitrox/nitrox_skcipher.c: ret =3D xts_check_key(tfm, =
key, keylen);
drivers/crypto/ccree/cc_cipher.c:           xts_check_key(tfm, key, keylen)=
) {
drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:       ret =3D xts_check_k=
ey(crypto_skcipher_tfm(tfm), key, keylen);
drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c:     ret =3D xts_check_k=
ey(crypto_skcipher_tfm(tfm), key, keylen);
drivers/crypto/atmel-aes.c:     err =3D xts_check_key(crypto_skcipher_tfm(t=
fm), key, keylen);

It already has one check qualified by fips_enabled:

        /* ensure that the AES and tweak key are not identical */
        if (fips_enabled && !crypto_memneq(key, key + (keylen / 2), keylen =
/ 2))
                return -EINVAL;

Should that implement the same key length restrictions?