On Tue, Feb 10, 2015 at 07:39:22PM +0200, Jussi Kivilinna wrote: > On 10.02.2015 18:22, Marcus Meissner wrote: > > Hi Jussi, > > > > We were trying to use rfc4543(gcm(aes)) in the kernel for FIPS mode, > > but the testvectors seem to fail. > > You probably need to add '.fips_allowed = 1,' in testmgr.c for "rfc4543(gcm(aes))" to enable algorithm in fips mode. > > > > > Did you verify that they work? Are these the ones from Page 18 of > > https://tools.ietf.org/html/draft-mcgrew-gcm-test-01, as there the "plaintext" > > and "aaad" seem to be switched? > > rfc4543() wrapper constructs the aad from '.assoc' and '.input'. We tried above and still got -2 errors. I think "ecb(cipher_null)" also needs to set the .fips_allowed flag, so that the rfc4543 setup can pull it in. CIao, Marcus -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
