Blame SOURCES/cryptsetup-argon2-fips.patch
|
 |
ac737d |
diff --git a/lib/luks2/luks2_keyslot_luks2.c b/lib/luks2/luks2_keyslot_luks2.c
|
|
|
ac737d |
index 3716c26..540915b 100644
|
|
|
ac737d |
--- a/lib/luks2/luks2_keyslot_luks2.c
|
|
|
ac737d |
+++ b/lib/luks2/luks2_keyslot_luks2.c
|
|
|
ac737d |
@@ -350,6 +350,13 @@ static int luks2_keyslot_get_key(struct crypt_device *cd,
|
|
|
ac737d |
crypt_free_volume_key(derived_key);
|
|
|
ac737d |
return -ENOMEM;
|
|
|
ac737d |
}
|
|
|
ac737d |
+
|
|
|
ac737d |
+ if (crypt_fips_mode() &&
|
|
|
ac737d |
+ (!strcmp(pbkdf.type, CRYPT_KDF_ARGON2I) ||
|
|
|
ac737d |
+ !strcmp(pbkdf.type, CRYPT_KDF_ARGON2ID)))
|
|
|
ac737d |
+ log_verbose(cd, _("%s key derivation function is not currently FIPS-compliant."),
|
|
|
ac737d |
+ pbkdf.type);
|
|
|
ac737d |
+
|
|
|
ac737d |
/*
|
|
|
ac737d |
* Calculate derived key, decrypt keyslot content and merge it.
|
|
|
ac737d |
*/
|
|
|
ac737d |
@@ -406,6 +413,14 @@ static int luks2_keyslot_update_json(struct crypt_device *cd,
|
|
|
ac737d |
if (!pbkdf)
|
|
|
ac737d |
return -EINVAL;
|
|
|
ac737d |
|
|
|
ac737d |
+ if (crypt_fips_mode() &&
|
|
|
ac737d |
+ (!strcmp(pbkdf->type, CRYPT_KDF_ARGON2I) ||
|
|
|
ac737d |
+ !strcmp(pbkdf->type, CRYPT_KDF_ARGON2ID))) {
|
|
|
ac737d |
+ log_err(cd, _("%s key derivation function is not allowed in FIPS mode."),
|
|
|
ac737d |
+ pbkdf->type);
|
|
|
ac737d |
+ return -EINVAL;
|
|
|
ac737d |
+ }
|
|
|
ac737d |
+
|
|
|
ac737d |
r = crypt_benchmark_pbkdf_internal(cd, CONST_CAST(struct crypt_pbkdf_type *)pbkdf, keyslot_key_len);
|
|
|
ac737d |
if (r < 0)
|
|
|
ac737d |
return r;
|