|
 |
253609 |
From b89b408953e9192d7bfcb31cdf8c48d6c973488a Mon Sep 17 00:00:00 2001
|
|
|
253609 |
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
253609 |
Date: Wed, 16 Feb 2022 10:23:29 +0100
|
|
|
253609 |
Subject: [PATCH 14/34] EP11: Add new control points
|
|
|
253609 |
|
|
|
253609 |
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
253609 |
---
|
|
|
253609 |
usr/lib/ep11_stdll/ep11_specific.c | 7 +++++++
|
|
|
253609 |
usr/lib/ep11_stdll/ep11cpfilter.conf | 6 ++++++
|
|
|
253609 |
2 files changed, 13 insertions(+)
|
|
|
253609 |
|
|
|
253609 |
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
253609 |
index 304989fc..147ce7b2 100644
|
|
|
253609 |
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
253609 |
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
253609 |
@@ -10524,13 +10524,20 @@ static const_info_t ep11_cps[] = {
|
|
|
253609 |
CONSTINFO(XCP_CPB_WRAP_WITH_RAW_SPKI),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ALG_DH),
|
|
|
253609 |
CONSTINFO(XCP_CPB_DERIVE),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_ALLOW_NONSESSION),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ALG_EC_25519),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_ALG_EC_SECGCRV),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ALG_NBSI2017),
|
|
|
253609 |
CONSTINFO(XCP_CPB_CPACF_PK),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ALG_PQC_DILITHIUM),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ALG_PQC),
|
|
|
253609 |
CONSTINFO(XCP_CPB_BTC),
|
|
|
253609 |
CONSTINFO(XCP_CPB_ECDSA_OTHER),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_ALG_NFIPS2021),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_ALG_NFIPS2024),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_COMPAT_LEGACY_SHA3),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_DSA_PARAMETER_GEN),
|
|
|
253609 |
+ CONSTINFO(XCP_CPB_DERIVE_NON_AB_KEYS),
|
|
|
253609 |
};
|
|
|
253609 |
|
|
|
253609 |
#ifdef DEBUG
|
|
|
253609 |
diff --git a/usr/lib/ep11_stdll/ep11cpfilter.conf b/usr/lib/ep11_stdll/ep11cpfilter.conf
|
|
|
253609 |
index 0d3a6b3f..9d6a2fc8 100644
|
|
|
253609 |
--- a/usr/lib/ep11_stdll/ep11cpfilter.conf
|
|
|
253609 |
+++ b/usr/lib/ep11_stdll/ep11cpfilter.conf
|
|
|
253609 |
@@ -80,3 +80,9 @@ XCP_CPB_BTC: CKM_IBM_BTC_DERIVE
|
|
|
253609 |
|
|
|
253609 |
# enable non-ECDSA/non-EdDSA elliptic curve signature algorithms
|
|
|
253609 |
XCP_CPB_ECDSA_OTHER: CKM_IBM_ECDSA_OTHER
|
|
|
253609 |
+
|
|
|
253609 |
+# allow non-FIPS-approved algs (2021)
|
|
|
253609 |
+XCP_CPB_ALG_NFIPS2021: CKM_RSA_PKCS, CKM_SHA1_RSA_PKCS, CKM_DSA_SHA1, CKM_ECDSA_SHA1, CKM_DES_KEY_GEN, CKM_DES_ECB, CKM_DES_CBC, CKM_DES_CBC_PAD, CKM_DES2_KEY_GEN, CKM_DES3_KEY_GEN, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_MAC, CKM_DES3_MAC_GENERAL, CKM_DES3_CBC_PAD, CKM_DES3_CMAC_GENERAL, CKM_DES3_CMAC, CKM_DES_OFB64, CKM_DES_CFB64, CKM_DES_CFB8, CKM_SHA_1_HMAC, CKM_SHA_1_HMAC_GENERAL, CKM_SHA1_KEY_DERIVATION
|
|
|
253609 |
+
|
|
|
253609 |
+# allow non-FIPS-approved algs (2024)
|
|
|
253609 |
+XCP_CPB_ALG_NFIPS2024: CKM_RSA_PKCS, CKM_SHA1_RSA_PKCS, CKM_DSA_SHA1, CKM_ECDSA_SHA1, CKM_DES_KEY_GEN, CKM_DES_ECB, CKM_DES_CBC, CKM_DES_CBC_PAD, CKM_DES2_KEY_GEN, CKM_DES3_KEY_GEN, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_MAC, CKM_DES3_MAC_GENERAL, CKM_DES3_CBC_PAD, CKM_DES3_CMAC_GENERAL, CKM_DES3_CMAC, CKM_DES_OFB64, CKM_DES_CFB64, CKM_DES_CFB8, CKM_SHA_1_HMAC, CKM_SHA_1_HMAC_GENERAL, CKM_SHA1_KEY_DERIVATION
|
|
|
253609 |
--
|
|
|
253609 |
2.16.2.windows.1
|
|
|
253609 |
|