Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion. Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label. [1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf Signed-off-by: Jarod Wilson <jarod@xxxxxxxxxx> --- crypto/testmgr.c | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/crypto/testmgr.c b/crypto/testmgr.c index 5a50416..39ffa69 100644 --- a/crypto/testmgr.c +++ b/crypto/testmgr.c @@ -2134,6 +2134,17 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) type, mask); goto test_done; notest: + /* + * Per NIST AESAVS[1], it isn't possible to have automated self-tests + * for counter mode aes vectors, they have to be covered by ecb mode + * and code inspection. The ecb mode tests are trigger above in the + * CRYPTO_ALG_TYPE_CIPHER section. Suppress warnings about missing + * ctr tests if we're in fips mode to avoid confusion. + * + * [1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf + */ + if (fips_enabled && !strncmp(alg, "ctr(aes", 7)) + goto test_done; printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver); test_done: if (fips_enabled && rc) -- Jarod Wilson jarod@xxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
