All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stephan Mueller <smueller@chronox.de>
To: Tapas Sarangi <TSarangi@trustwave.com>, herbert@gondor.apana.org.au
Cc: "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Subject: Re: FIPS mode: modprobe: ERROR: could not insert 'drbg'
Date: Tue, 09 Aug 2016 19:52:46 +0200	[thread overview]
Message-ID: <2671088.6l5BeQPtPO@positron.chronox.de> (raw)
In-Reply-To: <D3CF7805.2937%tsarangi@trustwave.com>

Am Dienstag, 9. August 2016, 17:11:09 CEST schrieb Tapas Sarangi:

Hi Tapas, Herbert,

> Hi Stephan,
> 
> Thanks. I have already tried that. ‘drbg’ module is loaded fine in a
> non-fips mode. Here are output from some commands.

There is something strange going on. I have to compile the DRBG statically. 
When booting the kernel with fips=1 (of course after changing the key size to 
2k or 3k in certs/x509.genkey), the DRBG does not show up in /proc/crypto nor 
can I find testmgr entries about the DRBG.

When I reboot the kernel without fips=1, all works as expected.

When I create a copy of the drbg.c code and have it compiled as a module to 
ensure it is signed, I can insmod it and the testmgr successfully tests it.

Note, with fips=1, my kernel crashes randomly somewhere in the elf loading 
code -- I guess it is because there is no stdrng.

> 
> I see that at some point you had a patch to use CONFIG_CRYPTO_LRNG. I am
> not using that, could that be a problem ?

Nope, this LRNG is something completely different -- it is my proposal to 
replace the current /dev/random and /dev/urandom implementation as documented 
in [1].

[1] http://www.chronox.de/lrng.html

Ciao
Stephan

  reply	other threads:[~2016-08-09 17:52 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-08-09 16:34 FIPS mode: modprobe: ERROR: could not insert 'drbg' Tapas Sarangi
2016-08-09 17:05 ` Stephan Mueller
2016-08-09 17:11   ` Tapas Sarangi
2016-08-09 17:52     ` Stephan Mueller [this message]
2016-08-09 19:02       ` [PATCH] crypto: DRBG: do not call drbg_instantiate in healt test Stephan Mueller
2016-08-09 21:59         ` Tapas Sarangi
2016-08-10  5:49           ` [PATCH] crypto: XTS - remove test that will fail in FIPS mode Stephan Mueller
2016-08-10 22:08             ` Tapas Sarangi
2016-08-11 19:42               ` Tapas Sarangi
2016-08-12  8:43                 ` Stephan Mueller
2016-08-16  9:38             ` [PATCH v2] " Stephan Mueller
2016-08-17 14:52               ` Tapas Sarangi
2016-08-17 14:57                 ` Stephan Mueller
2016-08-17 15:09                   ` Tapas Sarangi
2016-08-18  8:20                     ` Stephan Mueller
2016-08-23  9:47               ` Herbert Xu
2016-08-16  9:49         ` [PATCH] crypto: DRBG: do not call drbg_instantiate in healt test Herbert Xu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2671088.6l5BeQPtPO@positron.chronox.de \
    --to=smueller@chronox.de \
    --cc=TSarangi@trustwave.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-crypto@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.