Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c2bc636 authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: ux500 - Forbid 2-key 3DES in FIPS mode 



This patch forbids the use of 2-key 3DES (K1 == K3) in FIPS mode.

It also removes the registration of the non-standard des/des3
ablkcipher algorithms.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent ef7c5c85

drivers/crypto/ux500/cryp/cryp_core.c

+7 −79
Original line number Diff line number Diff line
@@ -1019,37 +1019,16 @@ static int des3_ablkcipher_setkey(struct crypto_ablkcipher *cipher, 
				  const u8 *key, unsigned int keylen)

{

	struct cryp_ctx *ctx = crypto_ablkcipher_ctx(cipher);

	u32 *flags = &cipher->base.crt_flags;

	const u32 *K = (const u32 *)key;

	u32 tmp[DES3_EDE_EXPKEY_WORDS];

	int i, ret;

	u32 flags;

	int err;



	pr_debug(DEV_DBG_NAME " [%s]", __func__);

	if (keylen != DES3_EDE_KEY_SIZE) {

		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;

		pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_BAD_KEY_LEN",

				__func__);

		return -EINVAL;

	}



	/* Checking key interdependency for weak key detection. */

	if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||

				!((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&

			(*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {

		*flags |= CRYPTO_TFM_RES_WEAK_KEY;

		pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",

			 __func__);

		return -EINVAL;

	}

	for (i = 0; i < 3; i++) {

		ret = des_ekey(tmp, key + i*DES_KEY_SIZE);

		if (unlikely(ret == 0) &&

		    (*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {

			*flags |= CRYPTO_TFM_RES_WEAK_KEY;

			pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",

				 __func__);

			return -EINVAL;

		}

	flags = crypto_ablkcipher_get_flags(cipher);

	err = __des3_verify_key(&flags, key);

	if (unlikely(err)) {

		crypto_ablkcipher_set_flags(cipher, flags);

		return err;

	}



	memcpy(ctx->key, key, keylen);
@@ -1216,57 +1195,6 @@ static struct cryp_algo_template cryp_algs[] = { 
			}

		}

	},

	{

		.algomode = CRYP_ALGO_DES_ECB,

		.crypto = {

			.cra_name = "des",

			.cra_driver_name = "des-ux500",

			.cra_priority = 300,

			.cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |

						CRYPTO_ALG_ASYNC,

			.cra_blocksize = DES_BLOCK_SIZE,

			.cra_ctxsize = sizeof(struct cryp_ctx),

			.cra_alignmask = 3,

			.cra_type = &crypto_ablkcipher_type,

			.cra_init = cryp_cra_init,

			.cra_module = THIS_MODULE,

			.cra_u = {

				.ablkcipher = {

					.min_keysize = DES_KEY_SIZE,

					.max_keysize = DES_KEY_SIZE,

					.setkey = des_ablkcipher_setkey,

					.encrypt = cryp_blk_encrypt,

					.decrypt = cryp_blk_decrypt

				}

			}

		}



	},

	{

		.algomode = CRYP_ALGO_TDES_ECB,

		.crypto = {

			.cra_name = "des3_ede",

			.cra_driver_name = "des3_ede-ux500",

			.cra_priority = 300,

			.cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |

						CRYPTO_ALG_ASYNC,

			.cra_blocksize = DES3_EDE_BLOCK_SIZE,

			.cra_ctxsize = sizeof(struct cryp_ctx),

			.cra_alignmask = 3,

			.cra_type = &crypto_ablkcipher_type,

			.cra_init = cryp_cra_init,

			.cra_module = THIS_MODULE,

			.cra_u = {

				.ablkcipher = {

					.min_keysize = DES3_EDE_KEY_SIZE,

					.max_keysize = DES3_EDE_KEY_SIZE,

					.setkey = des_ablkcipher_setkey,

					.encrypt = cryp_blk_encrypt,

					.decrypt = cryp_blk_decrypt

				}

			}

		}

	},

	{

		.algomode = CRYP_ALGO_DES_ECB,

		.crypto = {