Bug 830898 - kernel fails to boot in fips mode when AES-NI hardware instructions are available
kernel fails to boot in fips mode when AES-NI hardware instructions are avail...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: kernel (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Milan Broz
Red Hat Kernel QE team
Depends On:
Blocks: 717789 808744
  Show dependency treegraph
Reported: 2012-06-11 11:22 EDT by Paul Wouters
Modified: 2013-02-28 23:11 EST (History)
4 users (show)

See Also:
Fixed In Version: kernel-3.6.0-0.27.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 839239 (view as bug list)
Last Closed: 2012-10-03 11:54:05 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
kernel patch for aesni fips test (939 bytes, patch)
2012-06-11 11:22 EDT, Paul Wouters
no flags Details | Diff
testmgr.c patch to allow more modules in fips mode (1.94 KB, patch)
2012-06-13 11:53 EDT, Paul Wouters
no flags Details | Diff
Proposed patch (2.75 KB, patch)
2012-06-29 08:31 EDT, Milan Broz
no flags Details | Diff

  None (edit)
Description Paul Wouters 2012-06-11 11:22:15 EDT
Created attachment 590970 [details]
kernel patch for aesni fips test

Description of problem:
There are no crypto tests for fips mode in crypto/testmgr.c for the aesni drivers, so they are 'failing' fips testing.

Version-Release number of selected component (if applicable):
linus kernel git still does not have these.

Attached is a patch that resolves this, though it does call the tests which might not actually be needed.
Comment 1 Paul Wouters 2012-06-13 11:53:05 EDT
Created attachment 591553 [details]
testmgr.c patch to allow more modules in fips mode

This is an updated version of the patch to make it work for me. I can now boot the kernel in fips mode (with one dracut patch to remove aes-xts from the fipsmodule list) - including using aesni and full disk encryption.
Comment 2 Miloslav Trmač 2012-06-19 11:34:09 EDT
Please build this fix also as an F17 update, to make it easy to test application behavior in FIPS mode in a current-ish but reasonably stable environment.
Comment 3 Milan Broz 2012-06-27 10:29:42 EDT
I do not understand why should "modprobe tcrypt" in dracut fips seflcheck test all these algorithms

This is done in dracut:

    info "Self testing crypto algorithms"
    modprobe tcrypt || return 1
    rmmod tcrypt
    info "All initrd crypto checks done"

Herbert, is there a reason why it checks e.g. LRW mode?

IMHO the proper fix is that tcrypt does not test these in FIPS mode, not mark them "fips allowed"...
Comment 4 Milan Broz 2012-06-29 08:31:25 EDT
Created attachment 595295 [details]
Proposed patch

Proposed patch which doesn't add new modes and allows for me boot in fips mode (both rawhide/F17).
Comment 7 Milan Broz 2012-10-03 11:54:05 EDT
Fixed in kernel-3.6.0-0.27.el7 with rebase to 3.6, no more separate patches needed.

Note You need to log in before you can comment on or make changes to this bug.