On Tue, Aug 16, 2016 at 11:38:00AM +0200, Stephan Mueller wrote: > Hi Tapas, > > I was able to reproduce the issue now. > > I tested the patch below and it works for me now. Yet, I see that dracut-fips > seems to need some fixes too as it cannot find cmac when compiled as module > and has some issues with the authenc() ciphers too. > > > ---8<--- > > In FIPS mode, setting XTS keys where the AES key is identical to the > tweak key is forbidden. Thus, the self test with such property will fail > in FIPS mode. > > As we have other tests available for XTS, this patch simply removes the > offending test vectors. > > Reported-by: Tapas Sarangi <tsara...@trustwave.com> > Signed-off-by: Stephan Mueller <stephan.muel...@atsec.com>
We should fix this without removing tests. Perhaps add a field in the vector to indicate that it should be skipped when in FIPS mode, just like we do for expected weak keys. Cheers, -- Email: Herbert Xu <herb...@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
