crypto: ux500 - Forbid 2-key 3DES in FIPS mode

This patch forbids the use of 2-key 3DES (K1 == K3) in FIPS mode.

It also removes the registration of the non-standard des/des3
ablkcipher algorithms.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
index 3235611..7a93cba 100644 (file)
--- a/drivers/crypto/ux500/cryp/cryp_core.c
+++ b/drivers/crypto/ux500/cryp/cryp_core.c
@@ -1019,37 +1019,16 @@ static int des3_ablkcipher_setkey(struct crypto_ablkcipher *cipher,
                                  const u8 *key, unsigned int keylen)
 {
        struct cryp_ctx *ctx = crypto_ablkcipher_ctx(cipher);
-       u32 *flags = &cipher->base.crt_flags;
-       const u32 *K = (const u32 *)key;
-       u32 tmp[DES3_EDE_EXPKEY_WORDS];
-       int i, ret;
+       u32 flags;
+       int err;
 
        pr_debug(DEV_DBG_NAME " [%s]", __func__);
-       if (keylen != DES3_EDE_KEY_SIZE) {
-               *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
-               pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_BAD_KEY_LEN",
-                               __func__);
-               return -EINVAL;
-       }
 
-       /* Checking key interdependency for weak key detection. */
-       if (unlikely(!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
-                               !((K[2] ^ K[4]) | (K[3] ^ K[5]))) &&
-                       (*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {
-               *flags |= CRYPTO_TFM_RES_WEAK_KEY;
-               pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",
-                        __func__);
-               return -EINVAL;
-       }
-       for (i = 0; i < 3; i++) {
-               ret = des_ekey(tmp, key + i*DES_KEY_SIZE);
-               if (unlikely(ret == 0) &&
-                   (*flags & CRYPTO_TFM_REQ_FORBID_WEAK_KEYS)) {
-                       *flags |= CRYPTO_TFM_RES_WEAK_KEY;
-                       pr_debug(DEV_DBG_NAME " [%s]: CRYPTO_TFM_RES_WEAK_KEY",
-                                __func__);
-                       return -EINVAL;
-               }
+       flags = crypto_ablkcipher_get_flags(cipher);
+       err = __des3_verify_key(&flags, key);
+       if (unlikely(err)) {
+               crypto_ablkcipher_set_flags(cipher, flags);
+               return err;
        }
 
        memcpy(ctx->key, key, keylen);
@@ -1216,57 +1195,6 @@ static struct cryp_algo_template cryp_algs[] = {
                        }
                }
        },
-       {
-               .algomode = CRYP_ALGO_DES_ECB,
-               .crypto = {
-                       .cra_name = "des",
-                       .cra_driver_name = "des-ux500",
-                       .cra_priority = 300,
-                       .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
-                                               CRYPTO_ALG_ASYNC,
-                       .cra_blocksize = DES_BLOCK_SIZE,
-                       .cra_ctxsize = sizeof(struct cryp_ctx),
-                       .cra_alignmask = 3,
-                       .cra_type = &crypto_ablkcipher_type,
-                       .cra_init = cryp_cra_init,
-                       .cra_module = THIS_MODULE,
-                       .cra_u = {
-                               .ablkcipher = {
-                                       .min_keysize = DES_KEY_SIZE,
-                                       .max_keysize = DES_KEY_SIZE,
-                                       .setkey = des_ablkcipher_setkey,
-                                       .encrypt = cryp_blk_encrypt,
-                                       .decrypt = cryp_blk_decrypt
-                               }
-                       }
-               }
-
-       },
-       {
-               .algomode = CRYP_ALGO_TDES_ECB,
-               .crypto = {
-                       .cra_name = "des3_ede",
-                       .cra_driver_name = "des3_ede-ux500",
-                       .cra_priority = 300,
-                       .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
-                                               CRYPTO_ALG_ASYNC,
-                       .cra_blocksize = DES3_EDE_BLOCK_SIZE,
-                       .cra_ctxsize = sizeof(struct cryp_ctx),
-                       .cra_alignmask = 3,
-                       .cra_type = &crypto_ablkcipher_type,
-                       .cra_init = cryp_cra_init,
-                       .cra_module = THIS_MODULE,
-                       .cra_u = {
-                               .ablkcipher = {
-                                       .min_keysize = DES3_EDE_KEY_SIZE,
-                                       .max_keysize = DES3_EDE_KEY_SIZE,
-                                       .setkey = des_ablkcipher_setkey,
-                                       .encrypt = cryp_blk_encrypt,
-                                       .decrypt = cryp_blk_decrypt
-                               }
-                       }
-               }
-       },
        {
                .algomode = CRYP_ALGO_DES_ECB,
                .crypto = {