Re: [PATCH RFC v4 2/4] crypto: add PKE API

[Herbert Xu <herbert@gondor.apana.org.au>]

On Fri, Jun 12, 2015 at 10:42:46AM +0800, Herbert Xu wrote:
> On Fri, Jun 12, 2015 at 03:00:42AM +0200, Stephan Mueller wrote:
> >
> > The testmgr code can mark an entire cipher implementation as fips_allowed=1 as 
> > already done for RSA. However, unlike with the other ciphers, that flag must 
> > go in conjunction with the used key sizes.
> > 
> > For FIPS mode, the following restrictions apply:
> > 
> > - RSA: 2048/3072
> > 
> > - DSA: L 2048 / N 224; L 2048 / N 256; L 3072 / N 256
> > 
> > - ECDSA: only the NIST curves
> > 
> > Any other key sizes for the given ciphers is not allowed in FIPS mode.
> > 
> > Should that constraint be considered here?
> 
> Yes.  However it should be placed into a helper that everybody
> can call so that future hardware implementations can also make
> the same checks.

Ugh I didn't notice this was the generic API setkey function.
No it should go into the algorithm-specific setkey function and
then be in the form of a helper so that all implementations of
that algorithm can call it.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt