Skip to content

Commit

Permalink
crypto: drbg - update FIPS CTR self-checks to aes256
Browse files Browse the repository at this point in the history
When originally drbg was introduced FIPS self-checks for all types but
CTR were using the most preferred parameters for each type of
DRBG. Update CTR self-check to use aes256.

This patch updates code from 541af94 ("crypto: drbg - SP800-90A
Deterministic Random Bit Generator"), but is not interesting to
cherry-pick for stable updates, because it doesn't affect regular
builds, nor has any tangible effect on FIPS certifcation.

Signed-off-by: Dimitri John Ledkov <[email protected]>
Reviewed-by: Stephan Mueller <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
  • Loading branch information
xnox authored and herbertx committed Nov 17, 2023
1 parent 7ee44f1 commit a9dc629
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions crypto/drbg.c
Original file line number Diff line number Diff line change
Expand Up @@ -1478,8 +1478,8 @@ static int drbg_generate(struct drbg_state *drbg,
err = alg_test("drbg_pr_hmac_sha256",
"drbg_pr_hmac_sha256", 0, 0);
else if (drbg->core->flags & DRBG_CTR)
err = alg_test("drbg_pr_ctr_aes128",
"drbg_pr_ctr_aes128", 0, 0);
err = alg_test("drbg_pr_ctr_aes256",
"drbg_pr_ctr_aes256", 0, 0);
else
err = alg_test("drbg_pr_sha256",
"drbg_pr_sha256", 0, 0);
Expand Down Expand Up @@ -2017,7 +2017,7 @@ static inline int __init drbg_healthcheck_sanity(void)
return 0;

#ifdef CONFIG_CRYPTO_DRBG_CTR
drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
drbg_convert_tfm_core("drbg_nopr_ctr_aes256", &coreref, &pr);
#endif
#ifdef CONFIG_CRYPTO_DRBG_HASH
drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
Expand Down

0 comments on commit a9dc629

Please sign in to comment.