Received-SPF: pass (google.com: domain of linux-crypto+bounces-3786-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <908bc808-f8bd-4cc2-8644-c6c84e8cd4ea@jvdsn.com>
Date: Mon, 22 Apr 2024 23:02:38 -0500
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PATCH] KEYS: asymmetric: Add missing dependencies of
 FIPS_SIGNATURE_SELFTEST
To: Eric Biggers <ebiggers@kernel.org>
Cc: linux-crypto@vger.kernel.org, keyrings@vger.kernel.org,
 stable@vger.kernel.org, Simo Sorce <simo@redhat.com>,
 David Howells <dhowells@redhat.com>,
 kernel test robot <oliver.sang@intel.com>
References: <20240422211041.322370-1-ebiggers@kernel.org>
Content-Language: en-US
From: Joachim Vandersmissen <git@jvdsn.com>
Autocrypt: addr=joachim@jvdsn.com; keydata=
 xjMEYFm2zhYJKwYBBAHaRw8BAQdAa0ToltLs88MRtcZT3AnfaX4y9z7tNuQumkFnraoacSrN
 KUpvYWNoaW0gVmFuZGVyc21pc3NlbiA8am9hY2hpbUBqdmRzbi5jb20+wosEExYIADMWIQTl
 ppuIImvmYHZckHHNOH6x9cuKxQUCYFm2zgIbAwULCQgHAgYVCAkKCwIFFgIDAQAACgkQzTh+
 sfXLisVD7wEAufvtZXIMlofHV5P3O4Cj+J/npvpmxnNPBqd+2AdJ8GAA+wS1j7TvvtPhTccG
 DYXZbrGlvTrCrGyGdTRdK0ZcTgQLzjgEYFm2zhIKKwYBBAGXVQEFAQEHQHUI004BPYxgvmBd
 PTzZYgyko/t3ZlPeWcSQen0JEOZ2AwEIB8J4BBgWCAAgFiEE5aabiCJr5mB2XJBxzTh+sfXL
 isUFAmBZts4CGwwACgkQzTh+sfXLisVlRQD/XXtpe2kyEJ4rkRHNxS/0yHi4B26uyyutGaZN
 t/aaUDQA/RweY9tHblOuDvCCMnRSI+HDambm+2OgKwe45MXNdssK
In-Reply-To: <20240422211041.322370-1-ebiggers@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi Eric,

On 4/22/24 4:10 PM, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Since the signature self-test uses RSA and SHA-256, it must only be
> enabled when those algorithms are enabled.  Otherwise it fails and
> panics the kernel on boot-up.

I actually submitted two related patch recently which change the 
structure of the PKCS#7 self-tests and add an ECDSA self-test. See 
"[PATCH v2 1/2] certs: Move RSA self-test data to separate file" and 
"[PATCH v2 2/2] certs: Add ECDSA signature verification self-test" on 
2024-04-20. The explicit dependency on CRYPTO_RSA shouldn't be necessary 
with those patches (I think).

However, I didn't consider CRYPTO_SHA256 there. I think it can remain 
since both the RSA and proposed ECDSA self-tests use SHA-256.

>
> Reported-by: kernel test robot <oliver.sang@intel.com>
> Closes: https://lore.kernel.org/oe-lkp/202404221528.51d75177-lkp@intel.com
> Fixes: 3cde3174eb91 ("certs: Add FIPS selftests")
> Cc: stable@vger.kernel.org
> Cc: Simo Sorce <simo@redhat.com>
> Cc: David Howells <dhowells@redhat.com>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
>   crypto/asymmetric_keys/Kconfig | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
> index 59ec726b7c77..4abc58c55efa 100644
> --- a/crypto/asymmetric_keys/Kconfig
> +++ b/crypto/asymmetric_keys/Kconfig
> @@ -83,7 +83,9 @@ config FIPS_SIGNATURE_SELFTEST
>   	  for FIPS.
>   	depends on KEYS
>   	depends on ASYMMETRIC_KEY_TYPE
>   	depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
>   	depends on X509_CERTIFICATE_PARSER
> +	depends on CRYPTO_RSA
> +	depends on CRYPTO_SHA256
>   
>   endif # ASYMMETRIC_KEY_TYPE
>
> base-commit: ed30a4a51bb196781c8058073ea720133a65596f