On Fri, May 21, 2021 at 04:08:10PM +0800, Hui Tang wrote: > > On 2021/5/21 15:45, Herbert Xu wrote: > > On Wed, May 12, 2021 at 02:40:00PM +0800, Hui Tang wrote: > > > NIST P192 is not unregistered if failed to register NIST P256, > > > actually it need to unregister the algorithms already registered. > > > > > > Signed-off-by: Hui Tang <tanghui20@xxxxxxxxxx> > > > --- > > > crypto/ecdh.c | 11 ++++++++++- > > > 1 file changed, 10 insertions(+), 1 deletion(-) > > > > Thanks for catching this. The variable ecdh_nist_p192_registered > > is bogus. You should just make it so that if p192 fails to > > register then the init function aborts. There would then be > > no need to check for the registered state in the exit function. > > Okay, I will fix it in next version, and 'ecdsa_init' should > do the same thing too? Actually, it looks like it is needed for FIPS. We should add a comment that p192 will fail to register in FIPS mode and that's why there is a check for it. Funnily enough, ecdsa has the FIPS comment but testmgr doesn't set fips_allowed for any of them while ecdh is set but has no comment. Stephan, can you confirm that both ecdh-nist-p192 and ecdsa-nist-p192 should be disabled in FIPS mode? Also, we should fix ecdh-nist-p192's entry in testmgr by removing the ifdefs and not setting fips_allowed. Cheers, -- Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
