Pedro Monreal Gonzalez
c941c8db1e
- FIPS: Disable DSA in FIPS mode [bsc#1195385] * Upstream task: https://dev.gnupg.org/T5710 * Add libgcrypt-FIPS-disable-DSA.patch - FIPS: Service level indicator [bsc#1190700] * Provide an indicator to check wether the service utilizes an approved cryptographic algorithm or not. * Add patches: - libgcrypt-FIPS-service-indicators.patch - libgcrypt-FIPS-verify-unsupported-KDF-test.patch - libgcrypt-FIPS-HMAC-short-keylen.patch - FIPS: Define an entropy source SP800-90B compliant [bsc#1185140] * Disable jitter entropy by default in random.conf * Disable only-urandom option by default in random.conf - FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240] * rsa: Check RSA keylen constraints for key operations. * rsa: Fix regression in not returning an error for prime generation. * tests: Add 2k RSA key working in FIPS mode. * tests: pubkey: Replace RSA key to one of 2k. * tests: pkcs1v2: Skip tests with small keys in FIPS. * Add patches: - libgcrypt-FIPS-RSA-keylen.patch - libgcrypt-FIPS-RSA-keylen-tests.patch - FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138] * Add libgcrypt-FIPS-disable-3DES.patch - FIPS: PBKDF requirements [bsc#1185137] OBS-URL: https://build.opensuse.org/request/show/950433 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libgcrypt?expand=0&rev=153
36 lines
1.2 KiB
Diff
36 lines
1.2 KiB
Diff
From 0ab4e8063729147fb9abd463055785aac831bf5c Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Tue, 13 Jul 2021 16:58:54 +0200
|
|
Subject: [PATCH 348/500] tests: Verify unsupported KDF tests fail in FIPS mode
|
|
|
|
* tests/t-kdf.c (check_pbkdf2): Verify tests based on algorithms
|
|
unsupported in FIPS mode fail.
|
|
--
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
---
|
|
tests/t-kdf.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/tests/t-kdf.c b/tests/t-kdf.c
|
|
index 7a48e98a..48309b9a 100644
|
|
--- a/tests/t-kdf.c
|
|
+++ b/tests/t-kdf.c
|
|
@@ -1104,6 +1104,13 @@ check_pbkdf2 (void)
|
|
GCRY_KDF_PBKDF2, tv[tvidx].hashalgo,
|
|
tv[tvidx].salt, tv[tvidx].saltlen,
|
|
tv[tvidx].c, tv[tvidx].dklen, outbuf);
|
|
+ if (gcry_fips_mode_active() && tvidx > 6)
|
|
+ {
|
|
+ if (!err)
|
|
+ fail ("pbkdf2 test %d unexpectedly passed in FIPS mode: %s\n",
|
|
+ tvidx, gpg_strerror (err));
|
|
+ continue;
|
|
+ }
|
|
if (err)
|
|
fail ("pbkdf2 test %d failed: %s\n", tvidx, gpg_strerror (err));
|
|
else if (memcmp (outbuf, tv[tvidx].dk, tv[tvidx].dklen))
|
|
--
|
|
2.34.1
|
|
|