Created attachment 590970 [details] kernel patch for aesni fips test Description of problem: There are no crypto tests for fips mode in crypto/testmgr.c for the aesni drivers, so they are 'failing' fips testing. Version-Release number of selected component (if applicable): linus kernel git still does not have these. Attached is a patch that resolves this, though it does call the tests which might not actually be needed.
Created attachment 591553 [details] testmgr.c patch to allow more modules in fips mode This is an updated version of the patch to make it work for me. I can now boot the kernel in fips mode (with one dracut patch to remove aes-xts from the fipsmodule list) - including using aesni and full disk encryption.
Please build this fix also as an F17 update, to make it easy to test application behavior in FIPS mode in a current-ish but reasonably stable environment.
I do not understand why should "modprobe tcrypt" in dracut fips seflcheck test all these algorithms This is done in dracut: info "Self testing crypto algorithms" modprobe tcrypt || return 1 rmmod tcrypt info "All initrd crypto checks done" Herbert, is there a reason why it checks e.g. LRW mode? IMHO the proper fix is that tcrypt does not test these in FIPS mode, not mark them "fips allowed"...
Created attachment 595295 [details] Proposed patch Proposed patch which doesn't add new modes and allows for me boot in fips mode (both rawhide/F17).
Patch in crypto dev tree upstream http://git.kernel.org/?p=linux/kernel/git/herbert/cryptodev-2.6.git;a=commitdiff;h=6c79294f44fd7d1122cbaabff3b9815b074c0dd0 For debug kernel we need also this one http://git.kernel.org/?p=linux/kernel/git/herbert/cryptodev-2.6.git;a=commitdiff;h=bf084d8f6eb4ded3f90a6ab79bb682db00ebfbd4
Fixed in kernel-3.6.0-0.27.el7 with rebase to 3.6, no more separate patches needed.