Re: SHAKE256 support

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Sep 17, 2025 at 05:20:43PM +0100, David Howells wrote:
> Okay, I have lib/crypto/sha3 working.  One question though: why are the hash
> tests built as separate kunit modules rather than being built into the
> algorithm module init function and marked __init/__initdata?

KUnit is the standard way to do unit testing in the kernel these days.
The kernel community has been working on migrating legacy ad-hoc tests
over to KUnit.  This is not specific to lib/crypto/.

> For FIPS compliance, IIRC, you *have* to run tests on the algorithms,
> so wouldn't using kunit just be a waste of resources?

The lib/crypto/ KUnit tests are real tests, which thoroughly test each
algorithm.  This includes computing thousands of hashes for each hash
algorithm, for example.

FIPS pre-operational self-testing, if and when it is required, would be
a completely different thing.  For example, FIPS often requires only a
single test (with a single call to the algorithm) per algorithm.  Refer
to section 10.3.A of "Implementation Guidance for FIPS 140-3 and the
Cryptographic Module Validation Program"
(https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf)

Of course, so far the people doing FIPS certification of the whole
kernel haven't actually cared about FIPS pre-operational self-tests for
the library functions.  lib/ has had SHA-1 support since 2005, for
example, and it's never had a FIPS pre-operational self-test.

*If* that's changing and the people doing FIPS certifications of the
whole kernel have decided that the library functions actually need FIPS
pre-operational self-tests after all, that's fine.  But please don't try
to misuse the actual (KUnit) tests.  Instead, just add exactly what is
actually required by the FIPS to the appropriate subsys_initcall in the
library.  For SHA-3 for example, you'd only need to compute and verify a
single hash, using any of SHA3-224, SHA3-256, SHA3-384, SHA3-512.  Then
panic() if it fails and fips_enabled is true.

- Eric