[PATCH] crypto: FIPS - allow RSA keys >= 2048 bits

[PATCH] crypto: FIPS - allow RSA keys >= 2048 bits

[Stephan Mueller]

With a public notification, NIST now allows the use of RSA keys with a
modulus >= 2048 bits. The new rule allows any modulus size >= 2048 bits
provided that either 2048 or 3072 bits are supported at least so that
the entire RSA implementation can be CAVS tested.

This patch fixes the inability to boot the kernel in FIPS mode, because
certs/x509.genkey defines a 4096 bit RSA key per default. This key causes
the RSA signature verification to fail in FIPS mode without the patch
below.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
 crypto/rsa_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
index 4df6451..0b66dc8 100644
--- a/crypto/rsa_helper.c
+++ b/crypto/rsa_helper.c
@@ -35,8 +35,8 @@ int rsa_get_n(void *context, size_t hdrlen, unsigned char tag,
 			n_sz--;
 		}
 
-		/* In FIPS mode only allow key size 2K & 3K */
-		if (n_sz != 256 && n_sz != 384) {
+		/* In FIPS mode only allow key size 2K and higher */
+		if (n_sz < 256) {
 			pr_err("RSA: key size not allowed in FIPS mode\n");
 			return -EINVAL;
 		}
-- 
2.7.4

Re: [PATCH] crypto: FIPS - allow RSA keys >= 2048 bits

[Herbert Xu]

On Tue, Aug 23, 2016 at 10:09:32AM +0200, Stephan Mueller wrote:
> With a public notification, NIST now allows the use of RSA keys with a
> modulus >= 2048 bits. The new rule allows any modulus size >= 2048 bits
> provided that either 2048 or 3072 bits are supported at least so that
> the entire RSA implementation can be CAVS tested.
> 
> This patch fixes the inability to boot the kernel in FIPS mode, because
> certs/x509.genkey defines a 4096 bit RSA key per default. This key causes
> the RSA signature verification to fail in FIPS mode without the patch
> below.
> 
> Signed-off-by: Stephan Mueller <smueller@chronox.de>

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt