From: Gilad Ben-Yossef <gilad@benyossef.com>
To: Stephan Mueller <smueller@chronox.de>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Ofir Drang <ofir.drang@arm.com>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>,
Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
devel@driverdev.osuosl.org
Subject: Re: [PATCH 3/7] crypto: ccree: add ablkcipher support
Date: Mon, 22 Jan 2018 09:08:16 +0200 [thread overview]
Message-ID: <CAOtvUMcmiKF6B3bM3T4mwNMO5xhXV_MFrJJKQZu+SP6wk3bFYA@mail.gmail.com> (raw)
In-Reply-To: <2378888.JBO5RdML52@tauon.chronox.de>
On Thu, Jan 11, 2018 at 12:03 PM, Stephan Mueller <smueller@chronox.de> wrote:
> Am Donnerstag, 11. Januar 2018, 10:17:10 CET schrieb Gilad Ben-Yossef:
>
> Hi Gilad,
>
>> + // verify weak keys
>> + if (ctx_p->flow_mode == S_DIN_to_DES) {
>> + if (!des_ekey(tmp, key) &&
>> + (crypto_tfm_get_flags(tfm) & CRYPTO_TFM_REQ_WEAK_KEY)) {
>> + tfm->crt_flags |= CRYPTO_TFM_RES_WEAK_KEY;
>> + dev_dbg(dev, "weak DES key");
>> + return -EINVAL;
>> + }
>> + }
>> + if (ctx_p->cipher_mode == DRV_CIPHER_XTS &&
>> + xts_check_key(tfm, key, keylen)) {
>> + dev_dbg(dev, "weak XTS key");
>> + return -EINVAL;
>> + }
>> + if (ctx_p->flow_mode == S_DIN_to_DES &&
>> + keylen == DES3_EDE_KEY_SIZE &&
>> + cc_verify_3des_keys(key, keylen)) {
>> + dev_dbg(dev, "weak 3DES key");
>> + return -EINVAL;
>> + }
>
> For the DES key, wouldn't it make sense to use __des3_ede_setkey?
>
> Note, I would plan to release a patch for review to change that function to
> disallow key1 == key2 or key1 == key3 or key2 == key3 in FIPS mode.
I took your advise and did just that in v2.
Thanks for the review!
Gilad
--
Gilad Ben-Yossef
Chief Coffee Drinker
"If you take a class in large-scale robotics, can you end up in a
situation where the homework eats your dog?"
-- Jean-Baptiste Queru
next prev parent reply other threads:[~2018-01-22 7:08 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-11 9:17 [PATCH 0/7] Introduce Arm TrustZone CryptoCell Gilad Ben-Yossef
2018-01-11 9:17 ` [PATCH 1/7] staging: ccree: remove ccree from staging tree Gilad Ben-Yossef
2018-01-13 13:21 ` Greg Kroah-Hartman
2018-01-18 8:39 ` Gilad Ben-Yossef
2018-01-18 9:41 ` Greg Kroah-Hartman
2018-01-11 9:17 ` [PATCH 2/7] crypto: ccree: introduce CryptoCell driver Gilad Ben-Yossef
2018-01-11 9:17 ` [PATCH 3/7] crypto: ccree: add ablkcipher support Gilad Ben-Yossef
2018-01-11 10:01 ` Corentin Labbe
2018-01-22 7:07 ` Gilad Ben-Yossef
2018-01-11 10:03 ` Stephan Mueller
2018-01-22 7:08 ` Gilad Ben-Yossef [this message]
2018-01-11 9:17 ` [PATCH 4/7] crypto: ccree: add ahash support Gilad Ben-Yossef
2018-01-11 9:17 ` [PATCH 5/7] crypto: ccree: add AEAD support Gilad Ben-Yossef
2018-01-11 9:17 ` [PATCH 6/7] crypto: ccree: add FIPS support Gilad Ben-Yossef
2018-01-11 9:17 ` [PATCH 7/7] MAINTAINERS: update ccree entry Gilad Ben-Yossef
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAOtvUMcmiKF6B3bM3T4mwNMO5xhXV_MFrJJKQZu+SP6wk3bFYA@mail.gmail.com \
--to=gilad@benyossef.com \
--cc=davem@davemloft.net \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ofir.drang@arm.com \
--cc=smueller@chronox.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).