|
 |
0f7e16 |
From 05a237be2a6c7a342fb5aba4433aec487a08317f Mon Sep 17 00:00:00 2001
|
|
|
0f7e16 |
From: Milan Broz <gmazyland@gmail.com>
|
|
|
0f7e16 |
Date: Fri, 21 Jan 2022 09:47:13 +0100
|
|
|
0f7e16 |
Subject: [PATCH 1/3] Fix PBKDF benchmark in OpenSSL3 FIPS mode.
|
|
|
0f7e16 |
|
|
|
0f7e16 |
OpenSSL now enforces minimal parameters for PBKDF2 according to SP 800-132
|
|
|
0f7e16 |
key length (112 bits), minimal salt length (128 bits) and minimal number
|
|
|
0f7e16 |
of iterations (1000).
|
|
|
0f7e16 |
|
|
|
0f7e16 |
Our benchmark violates this, causeing cryptsetup misbehave for luksFormat.
|
|
|
0f7e16 |
|
|
|
0f7e16 |
Just inrease tet salt to 16 bytes here, it will little bit influence benchmark,
|
|
|
0f7e16 |
but there is no way back.
|
|
|
0f7e16 |
---
|
|
|
0f7e16 |
lib/utils_benchmark.c | 2 +-
|
|
|
0f7e16 |
src/cryptsetup.c | 2 +-
|
|
|
0f7e16 |
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
0f7e16 |
|
|
|
0f7e16 |
diff --git a/lib/utils_benchmark.c b/lib/utils_benchmark.c
|
|
|
0f7e16 |
index 7a9736d8..24e7bccc 100644
|
|
|
0f7e16 |
--- a/lib/utils_benchmark.c
|
|
|
0f7e16 |
+++ b/lib/utils_benchmark.c
|
|
|
0f7e16 |
@@ -184,7 +184,7 @@ int crypt_benchmark_pbkdf_internal(struct crypt_device *cd,
|
|
|
0f7e16 |
pbkdf->parallel_threads = 0; /* N/A in PBKDF2 */
|
|
|
0f7e16 |
pbkdf->max_memory_kb = 0; /* N/A in PBKDF2 */
|
|
|
0f7e16 |
|
|
|
0f7e16 |
- r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, "bar", 3,
|
|
|
0f7e16 |
+ r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, "01234567890abcdef", 16,
|
|
|
0f7e16 |
volume_key_size, &benchmark_callback, &u);
|
|
|
0f7e16 |
pbkdf->time_ms = ms_tmp;
|
|
|
0f7e16 |
if (r < 0) {
|
|
|
0f7e16 |
diff --git a/src/cryptsetup.c b/src/cryptsetup.c
|
|
|
0f7e16 |
index e529b7ac..37d35c92 100644
|
|
|
0f7e16 |
--- a/src/cryptsetup.c
|
|
|
0f7e16 |
+++ b/src/cryptsetup.c
|
|
|
0f7e16 |
@@ -860,7 +860,7 @@ static int action_benchmark_kdf(const char *kdf, const char *hash, size_t key_si
|
|
|
0f7e16 |
.time_ms = 1000,
|
|
|
0f7e16 |
};
|
|
|
0f7e16 |
|
|
|
0f7e16 |
- r = crypt_benchmark_pbkdf(NULL, &pbkdf, "foo", 3, "bar", 3, key_size,
|
|
|
0f7e16 |
+ r = crypt_benchmark_pbkdf(NULL, &pbkdf, "foo", 3, "0123456789abcdef", 16, key_size,
|
|
|
0f7e16 |
&benchmark_callback, &pbkdf);
|
|
|
0f7e16 |
if (r < 0)
|
|
|
0f7e16 |
log_std(_("PBKDF2-%-9s N/A\n"), hash);
|
|
|
0f7e16 |
--
|
|
|
0f7e16 |
2.27.0
|
|
|
0f7e16 |
|