Re: FIPS requirements in lib/crypto/ APIs

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Sep 18, 2025 at 11:00:45AM -0500, Joachim Vandersmissen wrote:
> Hi Eric,
> 
> I'm starting a new thread since I don't want to push the SHAKE256 thread
> off-topic too much.
> 
> One simple example of a FIPS requirement that I currently don't see in
> lib/crypto/ is that HMAC keys must be at least 112 bits in length. If the
> lib/crypto/ HMAC API wants to be FIPS compliant, it must enforce that (i.e.,
> disallow HMAC computations using those small keys). It's trivial to add a
> check to __hmac_sha1_preparekey or hmac_sha1_preparekey or
> hmac_sha1_init_usingrawkey, but the API functions don't return an error
> code. How would the caller know anything is wrong? Maybe there needs to be a
> mechanism in place first to let callers know about these kinds of checks?
> 
> It would be great to have your guidance since you've done so much work on
> the lib/crypto/ APIs, you obviously know the design very well.

That's misleading.  First, in the approach to FIPS certification that is
currently (sort of) supported by the upstream kernel, the FIPS module
contains the entire kernel.  lib/crypto/ contains kernel-internal
functions, which are *not* part of the interface of the FIPS module.
So, lib/crypto/ does *not* need to have a "FIPS compliant API".

Second, according to the document "Implementation Guidance for FIPS
140-3 and the Cryptographic Module Validation Program", HMAC with keys
shorter than 112 bits is still approved for legacy use in verifying
existing messages.

Third, HMAC is sometimes used with HKDF, where the input keying material
is passed as the *data*.  The HMAC key length would be the wrong length
to check in this case.

Fourth, not every user of HMAC is the kernel is necessarily for a
"security function" of the FIPS module.  Non-security functions can use
non-FIPS-approved algorithms.

Point is: lib/crypto/ is correct in allowing HMAC keys shorter than 112
bits.  (And this is a lot like how lib/ also has entirely
non-FIPS-approved algorithms, like ChaCha20...)  It's up to callers of
the hmac_*() functions, who have more information about the purpose for
which HMAC is actually being used, to do the check *if* they need it.

- Eric