Embarrassing! Yes, I just saw this while you are pressing send on that replyŠ default bits were set to 4096 in x509.genkey. :-( I am trying out with 2048 bits. I will confirm. -Tapas On 8/9/16, 9:55 AM, "Stephan Mueller" <smueller@xxxxxxxxxx> wrote: >Am Dienstag, 9. August 2016, 14:39:03 CEST schrieb Tapas Sarangi: > >Hi Tapas, David, > >> Hi Stephan, >> >> If I understand this correctly, this (CONFIG_MODULE_SIG_HASH=³sha256") >> tells about the key size used. >> I am using ³sha256². Initially, I was using ³sha512² which I thought >>could >> be causing problem, but I am getting same error when change it to >> ³sha256². >> >> [root@localhost ~]# grep MODULE_SIG /boot/config-4.7.0-1.tos2_5 >> >> CONFIG_MODULE_SIG=y >> # CONFIG_MODULE_SIG_FORCE is not set >> CONFIG_MODULE_SIG_ALL=y >> # CONFIG_MODULE_SIG_SHA1 is not set >> # CONFIG_MODULE_SIG_SHA224 is not set >> CONFIG_MODULE_SIG_SHA256=y >> # CONFIG_MODULE_SIG_SHA384 is not set >> # CONFIG_MODULE_SIG_SHA512 is not set >> CONFIG_MODULE_SIG_HASH="sha256" >> CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" > >It is rather the question how signing_key.pem is generated. > >Do you have the file certs/x509.genkey? If yes, what is the default_bits >value? > >David, the x509.genkey file seems to generate a 4k RSA key per default. >This >will cause a panic with fips=1 as only 2k and 3k keys are allowed. > >Ciao >Stephan ________________________________ This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
