summaryrefslogtreecommitdiffstats
path: root/crypto
diff options
context:
space:
mode:
authorDimitri John Ledkov <dimitri.ledkov@canonical.com>2023-10-30 14:05:13 +0200
committerHerbert Xu <herbert@gondor.apana.org.au>2023-11-17 19:16:29 +0800
commit7ee44f1b59df29419e1bfdfd118fbcdd83c5398c (patch)
treea514cd2462b572b6b075d295fb301bf22cc7850a /crypto
parentd872ca165cb67112f2841ef9c37d51ef7e63d1e4 (diff)
downloadlinux-7ee44f1b59df29419e1bfdfd118fbcdd83c5398c.tar.gz
linux-7ee44f1b59df29419e1bfdfd118fbcdd83c5398c.tar.bz2
linux-7ee44f1b59df29419e1bfdfd118fbcdd83c5398c.zip
crypto: drbg - ensure most preferred type is FIPS health checked
drbg supports multiple types of drbg, and multiple parameters of each. Health check sanity only checks one drbg of a single type. One can enable all three types of drbg. And instead of checking the most preferred algorithm (last one wins), it is currently checking first one instead. Update ifdef to ensure that healthcheck prefers HMAC, over HASH, over CTR, last one wins, like all other code and functions. This patch updates code from 541af946fe ("crypto: drbg - SP800-90A Deterministic Random Bit Generator"), but is not interesting to cherry-pick for stable updates, because it doesn't affect regular builds, nor has any tangible effect on FIPS certifcation. Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com> Reviewed-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/drbg.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/drbg.c b/crypto/drbg.c
index e01f8c7769d0..e3baaa5777f9 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -2018,9 +2018,11 @@ static inline int __init drbg_healthcheck_sanity(void)
#ifdef CONFIG_CRYPTO_DRBG_CTR
drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
-#elif defined CONFIG_CRYPTO_DRBG_HASH
+#endif
+#ifdef CONFIG_CRYPTO_DRBG_HASH
drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
-#else
+#endif
+#ifdef CONFIG_CRYPTO_DRBG_HMAC
drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
#endif