Re: [PATCH net-next] [RESEND] wireguard: disable in FIPS mode

On Fri, 2021-04-09 at 16:08 +0800, Hangbin Liu wrote:

On Fri, Apr 09, 2021 at 09:08:20AM +0200, Stephan Mueller wrote:

quoted

quoted

quoted

quoted

quoted

quoted

And how do you handle all the other places in the kernel that use
ChaCha20 and
SipHash?  For example, drivers/char/random.c?

Good question, I will check it and reply to you later.

I just read the code. The drivers/char/random.c do has some fips
specific
parts(seems not related to crypto). After commit e192be9d9a30 ("random:
replace
non-blocking pool with a Chacha20-based CRNG") we moved part of chacha
code to
lib/chacha20.c and make that code out of control.

So you are saying that you removed drivers/char/random.c and
lib/chacha20.c from
your FIPS module boundary?  Why not do the same for WireGuard?

No, I mean this looks like a bug (using not allowed crypto in FIPS mode) and
we should fix it.

The entirety of random.c is not compliant to FIPS rules. ChaCha20 is the least
of the problems. SP800-90B is the challenge. This is one of the motivation of
the design and architecture of the LRNG allowing different types of crypto and
have a different approach to post-process the data.

https://github.com/smuellerDD/lrng

Thanks Stephan for this info. After offline discussion with Herbert, here is
what he said:

"""
This is not a problem in RHEL8 because the Crypto API RNG replaces /dev/random
in FIPS mode.
"""

I'm not familiar with this code, not sure how upstream handle this.

It is an open problem upstream.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc