From c210c3c9e3047799a16f6e1929f279299816110e Mon Sep 17 00:00:00 2001
From: Nicolai Stange <nstange@suse.de>
Date: Sat, 29 Jan 2022 10:09:41 +0100
Subject: [PATCH] crypto: xts - restrict key lengths to approved values in FIPS
mode
References: jsc#SLE-21132,bsc#1193136
Patch-mainline: Submitted, linux-crypto ML
According to FIPS 140-3 IG C.I., only (total) key lengths of either
256 bits or 512 bits are allowed with xts(aes). Make xts_verify_key() to
reject anything else in FIPS mode.
As xts(aes) is the only approved xts() template instantiation in FIPS mode,
the new restriction implemented in xts_verify_key() effectively only
applies to this particular construction.
Signed-off-by: Nicolai Stange <nstange@suse.de>
---
include/crypto/xts.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/include/crypto/xts.h
+++ b/include/crypto/xts.h
@@ -35,6 +35,13 @@ static inline int xts_verify_key(struct
if (keylen % 2)
return -EINVAL;
+ /*
+ * In FIPS mode only a combined key length of either 256 or
+ * 512 bits is allowed, c.f. FIPS 140-3 IG C.I.
+ */
+ if (fips_enabled && keylen != 32 && keylen != 64)
+ return -EINVAL;
+
/* ensure that the AES and tweak key are not identical */
if ((fips_enabled || (crypto_skcipher_get_flags(tfm) &
CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) &&