On Wed, Jan 28, 2009 at 07:58:48AM -0500, Neil Horman wrote:
>
> FIPS 140-2 specifies that all access to various cryptographic modules be
> prevented in the event that any of the provided self tests fail on the various
> implemented algorithms. We already panic when any of the test in testmgr.c
>
On Wed, Jan 28, 2009 at 11:17:41PM +1100, Herbert Xu wrote:
> On Wed, Jan 28, 2009 at 07:15:11AM -0500, Neil Horman wrote:
> > On Wed, Jan 28, 2009 at 03:18:28PM +1100, Herbert Xu wrote:
> > >
> > > I'm OK with this change but I'd like it to look like:
> > >
> > > if (fips_enabled) {
> > >
On Wed, Jan 28, 2009 at 07:15:11AM -0500, Neil Horman wrote:
> On Wed, Jan 28, 2009 at 03:18:28PM +1100, Herbert Xu wrote:
> >
> > I'm OK with this change but I'd like it to look like:
> >
> > if (fips_enabled) {
> > panic(...)
> > }
> >
> > blah blah blah
> >
> > This w
On Wed, Jan 28, 2009 at 03:18:28PM +1100, Herbert Xu wrote:
>
> I'm OK with this change but I'd like it to look like:
>
> if (fips_enabled) {
> panic(...)
> }
>
> blah blah blah
>
> This way the FIPS crap doesn't get in the way of everyday use.
>
> Thanks,
Sur
On Fri, Jan 23, 2009 at 10:58:17AM -0500, Neil Horman wrote:
>
> diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
> index 0fac8ff..7eef5be 100644
> --- a/crypto/ansi_cprng.c
> +++ b/crypto/ansi_cprng.c
> @@ -132,10 +132,20 @@ static int _get_more_prng_bytes(struct prng_context
> *ctx)
>
FIPS 140-2 specifies that all access to various cryptographic modules be
prevented in the event that any of the provided self tests fail on the various
implemented algorithms. The way this is currently done is by simply panicing the
box. We do this already for the various alg tests in testmgr.c,
