summaryrefslogtreecommitdiffstats
path: root/crypto/Kconfig
diff options
context:
space:
mode:
authorJarod Wilson <jarod@redhat.com>2011-11-09 12:04:06 +0800
committerHerbert Xu <herbert@gondor.apana.org.au>2011-11-09 12:04:06 +0800
commit505172e11f5a0d9916e20e40d3b0a6f87d3a59b6 (patch)
treede5c671a37c3b3479595c1c9c891848953199985 /crypto/Kconfig
parentbae6d3038b7faff187f4207448a40b9912cf787d (diff)
downloadblackbird-op-linux-505172e11f5a0d9916e20e40d3b0a6f87d3a59b6.tar.gz
blackbird-op-linux-505172e11f5a0d9916e20e40d3b0a6f87d3a59b6.zip
crypto: ansi_cprng - enforce key != seed in fips mode
Apparently, NIST is tightening up its requirements for FIPS validation with respect to RNGs. Its always been required that in fips mode, the ansi cprng not be fed key and seed material that was identical, but they're now interpreting FIPS 140-2, section AS07.09 as requiring that the implementation itself must enforce the requirement. Easy fix, we just do a memcmp of key and seed in fips_cprng_reset and call it a day. v2: Per Neil's advice, ensure slen is sufficiently long before we compare key and seed to avoid looking at potentially unallocated mem. CC: Stephan Mueller <smueller@atsec.com> CC: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Jarod Wilson <jarod@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/Kconfig')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud