You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
34 lines
1.1 KiB
34 lines
1.1 KiB
6 years ago
|
diff --git a/lib/luks2/luks2_keyslot_luks2.c b/lib/luks2/luks2_keyslot_luks2.c
|
||
|
|
index 3716c26..540915b 100644
|
||
|
|
--- a/lib/luks2/luks2_keyslot_luks2.c
|
||
|
|
+++ b/lib/luks2/luks2_keyslot_luks2.c
|
||
|
|
@@ -350,6 +350,13 @@ static int luks2_keyslot_get_key(struct crypt_device *cd,
|
||
|
|
crypt_free_volume_key(derived_key);
|
||
|
|
return -ENOMEM;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+ if (crypt_fips_mode() &&
|
||
|
|
+ (!strcmp(pbkdf.type, CRYPT_KDF_ARGON2I) ||
|
||
|
|
+ !strcmp(pbkdf.type, CRYPT_KDF_ARGON2ID)))
|
||
|
|
+ log_verbose(cd, _("%s key derivation function is not currently FIPS-compliant."),
|
||
|
|
+ pbkdf.type);
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* Calculate derived key, decrypt keyslot content and merge it.
|
||
|
|
*/
|
||
|
|
@@ -406,6 +413,14 @@ static int luks2_keyslot_update_json(struct crypt_device *cd,
|
||
|
|
if (!pbkdf)
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
+ if (crypt_fips_mode() &&
|
||
|
|
+ (!strcmp(pbkdf->type, CRYPT_KDF_ARGON2I) ||
|
||
|
|
+ !strcmp(pbkdf->type, CRYPT_KDF_ARGON2ID))) {
|
||
|
|
+ log_err(cd, _("%s key derivation function is not allowed in FIPS mode."),
|
||
|
|
+ pbkdf->type);
|
||
|
|
+ return -EINVAL;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
r = crypt_benchmark_pbkdf_internal(cd, CONST_CAST(struct crypt_pbkdf_type *)pbkdf, keyslot_key_len);
|
||
|
|
if (r < 0)
|
||
|
|
return r;
|