On Wednesday 13 May 2009 09:27:52 Herbert Xu wrote: > On Wed, May 13, 2009 at 09:12:46AM -0400, Jarod Wilson wrote: > > > > Hm... FIPS has the requirement that we test all algs before we use any > > algs, self-tests on demand before first use for each alg is > > insufficient. At first blush, I'm not seeing how we ensure this > > happens. How can we trigger a cbc(des3_ede) self-test from userspace? > > I see that modprobe'ing des.ko runs the base des and des3_ede > > self-tests, but modprobe'ing cbc.ko doesn't lead to any self-tests > > being run. > > Once we have a user-space interface crypto API you will be able > to instantiate any given algorithm. > > For now I suggest that you create your own module to instantiate > these FIPS algorithms. Or just load tcrypt and ignore the exit > status, or make tcrypt return 0 if we're in FIPS mode. The latter option is more or less what the patch at the start of this thread did, although via a param to tcrypt, not keying off the fips flag. If I were to modify the patch to drop the mod param usage, and instead key off the fips flag to not exit, would that be acceptable for committing until such time as the userspace interface is ready? -- Jarod Wilson jarod@xxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
