Aleksander Jan BajkowskiandHauke Mehrtens
b6f2b5ea13
FIPS 140-3 recommends that all crypto implementations should be tested before first use. Testmanager performs initial tests based on existing test vectors. Not all algorithms have defined test vectors, so to improve this situation, this commit backports recently added test vectors for some cipher suites. These vectors were calculated using a software implementation and then double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms passed self-tests. Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://github.com/openwrt/openwrt/pull/23012 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From 0441ee8d35ad6998da5043c65c4124904e8daee2 Mon Sep 17 00:00:00 2001
|
|
From: Aleksander Jan Bajkowski <olek2@wp.pl>
|
|
Date: Fri, 6 Feb 2026 20:26:59 +0100
|
|
Subject: [PATCH] crypto: tesmgr - allow authenc(hmac(sha224/sha384),cbc(aes))
|
|
in fips mode
|
|
|
|
The remaining combinations of AES-CBC and SHA* have already been marked
|
|
as allowed. This commit does the same for SHA224 and SHA384.
|
|
|
|
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
|
|
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
---
|
|
crypto/testmgr.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
--- a/crypto/testmgr.c
|
|
+++ b/crypto/testmgr.c
|
|
@@ -4435,6 +4435,7 @@ static const struct alg_test_desc alg_te
|
|
.alg = "authenc(hmac(sha224),cbc(aes))",
|
|
.generic_driver = "authenc(hmac-sha224-lib,cbc(aes-generic))",
|
|
.test = alg_test_aead,
|
|
+ .fips_allowed = 1,
|
|
.suite = {
|
|
.aead = __VECS(hmac_sha224_aes_cbc_tv_temp)
|
|
}
|
|
@@ -4493,6 +4494,7 @@ static const struct alg_test_desc alg_te
|
|
.alg = "authenc(hmac(sha384),cbc(aes))",
|
|
.generic_driver = "authenc(hmac-sha384-lib,cbc(aes-generic))",
|
|
.test = alg_test_aead,
|
|
+ .fips_allowed = 1,
|
|
.suite = {
|
|
.aead = __VECS(hmac_sha384_aes_cbc_tv_temp)
|
|
}
|