luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

crypto: ux500 - Forbid 2-key 3DES in FIPS mode

Browse Source 
This patch forbids the use of 2-key 3DES (K1 == K3) in FIPS mode.

It also removes the registration of the non-standard des/des3
ablkcipher algorithms.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Herbert Xu 2019-04-11 16:51:22 +08:00
parent ef7c5c8548
commit 3c2bc63621
1 changed files with 7 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
drivers/crypto/ux500/cryp/cryp_core.c
View File

@ -1019,37 +1019,16 @@ static int des3_ablkcipher_setkey(struct crypto_ablkcipher *cipher,
const u8 *key, unsigned int keylen)
{
struct cryp_ctx *ctx = crypto_ablkcipher_ctx(cipher);
u32 *flags = &cipher->base.crt_flags;
const u32 *K = (const u32 *)key;
u32 tmp[DES3_EDE_EXPKEY_WORDS];
int i, ret;
u32 flags;
int err;
pr_debug(DEV_DBG_NAME " [%s]", __func__);
if (keylen != DES3_EDE_KEY_SIZE) {
*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_BAD_KEY_LEN",
__func__);
return -EINVAL;
}
/* Checking key interdependency for weak key detection. */
if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
!((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
(*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {
*flags |= CRYPTO_TFM_RES_WEAK_KEY;
pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",
__func__);
return -EINVAL;
}
for (i = 0; i < 3; i++) {
ret = des_ekey(tmp, key + i*DES_KEY_SIZE);
if (unlikely(ret == 0) &&
(*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {
*flags |= CRYPTO_TFM_RES_WEAK_KEY;
pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",
__func__);
return -EINVAL;
}
flags = crypto_ablkcipher_get_flags(cipher);
err = __des3_verify_key(&flags, key);
if (unlikely(err)) {
crypto_ablkcipher_set_flags(cipher, flags);
return err;
}
memcpy(ctx->key, key, keylen);
@ -1216,57 +1195,6 @@ static struct cryp_algo_template cryp_algs[] = {
}
}
},
{
.algomode = CRYP_ALGO_DES_ECB,
.crypto = {
.cra_name = "des",
.cra_driver_name = "des-ux500",
.cra_priority = 300,
.cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
CRYPTO_ALG_ASYNC,
.cra_blocksize = DES_BLOCK_SIZE,
.cra_ctxsize = sizeof(struct cryp_ctx),
.cra_alignmask = 3,
.cra_type = &crypto_ablkcipher_type,
.cra_init = cryp_cra_init,
.cra_module = THIS_MODULE,
.cra_u = {
.ablkcipher = {
.min_keysize = DES_KEY_SIZE,
.max_keysize = DES_KEY_SIZE,
.setkey = des_ablkcipher_setkey,
.encrypt = cryp_blk_encrypt,
.decrypt = cryp_blk_decrypt
}
}
}
},
{
.algomode = CRYP_ALGO_TDES_ECB,
.crypto = {
.cra_name = "des3_ede",
.cra_driver_name = "des3_ede-ux500",
.cra_priority = 300,
.cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
CRYPTO_ALG_ASYNC,
.cra_blocksize = DES3_EDE_BLOCK_SIZE,
.cra_ctxsize = sizeof(struct cryp_ctx),
.cra_alignmask = 3,
.cra_type = &crypto_ablkcipher_type,
.cra_init = cryp_cra_init,
.cra_module = THIS_MODULE,
.cra_u = {
.ablkcipher = {
.min_keysize = DES3_EDE_KEY_SIZE,
.max_keysize = DES3_EDE_KEY_SIZE,
.setkey = des_ablkcipher_setkey,
.encrypt = cryp_blk_encrypt,
.decrypt = cryp_blk_decrypt
}
}
}
},
{
.algomode = CRYP_ALGO_DES_ECB,
.crypto = {