[PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code

[PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code

[Thomas Huth]

When the Ceph code had been updated to use the libcrypto hmac_sha256
functions instead of the "hmac(sha256)" crypto shash driver, we lost
the FIPS key length check from  hmac_setkey() in crypto/hmac.c.
Since libcrypto won't support this FIPS check (it should be done in
the calling sites instead), add the check now to the Ceph code
instead to make this code more FIPS friendly again.

Fixes: 27c0a7b05d13a ("libceph: Use HMAC-SHA256 library instead of crypto_shash")
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 net/ceph/messenger_v2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
index 05f6eea299fc0..378493d5d7155 100644
--- a/net/ceph/messenger_v2.c
+++ b/net/ceph/messenger_v2.c
@@ -12,6 +12,7 @@
 #include <crypto/utils.h>
 #include <linux/bvec.h>
 #include <linux/crc32c.h>
+#include <linux/fips.h>
 #include <linux/net.h>
 #include <linux/scatterlist.h>
 #include <linux/socket.h>
@@ -721,6 +722,9 @@ static int setup_crypto(struct ceph_connection *con,
 		return 0;  /* auth_none */
 	}
 
+	if (fips_enabled && session_key_len < 112 / 8)
+		return -EKEYREJECTED;
+
 	hmac_sha256_preparekey(&con->v2.hmac_key, session_key, session_key_len);
 	con->v2.hmac_key_set = true;
 
-- 
2.55.0

Re: [PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code

[Eric Biggers]

On Fri, Aug 21, 2026 at 04:43:22PM +0200, Thomas Huth wrote:
> When the Ceph code had been updated to use the libcrypto hmac_sha256
> functions instead of the "hmac(sha256)" crypto shash driver, we lost
> the FIPS key length check from  hmac_setkey() in crypto/hmac.c.

Well, except on s390 which already didn't do the FIPS key length check.

> @@ -720,6 +722,9 @@ static int setup_crypto(struct ceph_connection *con,
>  		return 0;  /* auth_none */
>  	}
>  
> +	if (fips_enabled && session_key_len < 112 / 8)
> +		return -EKEYREJECTED;
> +

I assume it's intentional that auth_none is still FIPS-allowed?  Kind of
ironic.

Do Ceph session keys shorter than 128 bits even actually occur in
practice?  It seems that the Ceph authenticated modes support only
AES-based cipher suites, where the minimum valid session key length is
128 bits.

I wonder if the client should just reject session_key_len < 16
regardless of fips_enabled.

- Eric

Re: [PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code

[Eric Biggers]

On Fri, Aug 21, 2026 at 05:53:15PM +0000, Eric Biggers wrote:
> Do Ceph session keys shorter than 128 bits even actually occur in
> practice?  It seems that the Ceph authenticated modes support only
> AES-based cipher suites, where the minimum valid session key length is
> 128 bits.
> 
> I wonder if the client should just reject session_key_len < 16
> regardless of fips_enabled.

It looks like this is theoretically possible only when CEPH_AUTH_CEPHX
is being used but the session key uses CEPH_CRYPTO_NONE, which seems
insecure and contradictory, and likely not ever used by the server.  I
suspect the ceph client should just reject that combination outright
(and also session_key_len < 16 as defense-in-depth).  It is up to the
ceph folks who are the experts here, but if there are unnecessary
footguns like this, they should just be fixed for everyone.

- Eric