|
 |
623667 |
From 293abb5435e2b4bec7f8333fb11c88d5c1f45800 Mon Sep 17 00:00:00 2001
|
|
|
623667 |
From: Ondrej Kozina <okozina@redhat.com>
|
|
|
623667 |
Date: Mon, 5 Dec 2022 13:35:24 +0100
|
|
|
623667 |
Subject: [PATCH 3/3] Add FIPS related error message in keyslot add code.
|
|
|
623667 |
|
|
|
623667 |
Add hints on what went wrong when creating new LUKS
|
|
|
623667 |
keyslots. The hint is printed only in FIPS mode and
|
|
|
623667 |
when pbkdf2 failed with passphrase shorter than 8
|
|
|
623667 |
bytes.
|
|
|
623667 |
---
|
|
|
623667 |
lib/luks1/keymanage.c | 5 ++++-
|
|
|
623667 |
lib/luks2/luks2_keyslot_luks2.c | 2 ++
|
|
|
623667 |
2 files changed, 6 insertions(+), 1 deletion(-)
|
|
|
623667 |
|
|
|
623667 |
diff --git a/lib/luks1/keymanage.c b/lib/luks1/keymanage.c
|
|
|
623667 |
index de97b73c..225e84b8 100644
|
|
|
623667 |
--- a/lib/luks1/keymanage.c
|
|
|
623667 |
+++ b/lib/luks1/keymanage.c
|
|
|
623667 |
@@ -924,8 +924,11 @@ int LUKS_set_key(unsigned int keyIndex,
|
|
|
623667 |
hdr->keyblock[keyIndex].passwordSalt, LUKS_SALTSIZE,
|
|
|
623667 |
derived_key->key, hdr->keyBytes,
|
|
|
623667 |
hdr->keyblock[keyIndex].passwordIterations, 0, 0);
|
|
|
623667 |
- if (r < 0)
|
|
|
623667 |
+ if (r < 0) {
|
|
|
623667 |
+ if (crypt_fips_mode() && passwordLen < 8)
|
|
|
623667 |
+ log_err(ctx, _("Invalid passphrase for PBKDF2 in FIPS mode."));
|
|
|
623667 |
goto out;
|
|
|
623667 |
+ }
|
|
|
623667 |
|
|
|
623667 |
/*
|
|
|
623667 |
* AF splitting, the volume key stored in vk->key is split to AfKey
|
|
|
623667 |
diff --git a/lib/luks2/luks2_keyslot_luks2.c b/lib/luks2/luks2_keyslot_luks2.c
|
|
|
623667 |
index 78f74242..f480bcab 100644
|
|
|
623667 |
--- a/lib/luks2/luks2_keyslot_luks2.c
|
|
|
623667 |
+++ b/lib/luks2/luks2_keyslot_luks2.c
|
|
|
623667 |
@@ -265,6 +265,8 @@ static int luks2_keyslot_set_key(struct crypt_device *cd,
|
|
|
623667 |
free(salt);
|
|
|
623667 |
if (r < 0) {
|
|
|
623667 |
crypt_free_volume_key(derived_key);
|
|
|
623667 |
+ if (crypt_fips_mode() && passwordLen < 8 && !strcmp(pbkdf.type, "pbkdf2"))
|
|
|
623667 |
+ log_err(cd, _("Invalid passphrase for PBKDF2 in FIPS mode."));
|
|
|
623667 |
return r;
|
|
|
623667 |
}
|
|
|
623667 |
|
|
|
623667 |
--
|
|
|
623667 |
2.38.1
|
|
|
623667 |
|