Skip to content

Commit b6f2b5e

Browse files
abajkhauke
abajk
authored and
hauke
committed
kernel: backport crypto selftests
FIPS 140-3 recommends that all crypto implementations should be tested before first use. Testmanager performs initial tests based on existing test vectors. Not all algorithms have defined test vectors, so to improve this situation, this commit backports recently added test vectors for some cipher suites. These vectors were calculated using a software implementation and then double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms passed self-tests. Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: openwrt/openwrt#23012 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
1 parent 0ba4e2c commit b6f2b5e

28 files changed

Lines changed: 1984 additions & 1107 deletions

File tree

‎target/linux/generic/backport-6.12/910-v6.19-crypto-testmgr-Add-missing-DES-weak-and-semi-weak-ke.patch‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
From c637f3e4a59d710ffd80da1c11d2ebed162d8ff0 Mon Sep 17 00:00:00 2001
2+
From: Thorsten Blum <thorsten.blum@linux.dev>
3+
Date: Mon, 17 Nov 2025 12:44:26 +0100
4+
Subject: [PATCH] crypto: testmgr - Add missing DES weak and semi-weak key
5+
tests
6+
7+
Ever since commit da7f033ddc9f ("crypto: cryptomgr - Add test
8+
infrastructure"), the DES test suite has tested only one of the four
9+
weak keys and none of the twelve semi-weak keys.
10+
11+
DES has four weak keys and twelve semi-weak keys, and the kernel's DES
12+
implementation correctly detects and rejects all of these keys when the
13+
CRYPTO_TFM_REQ_FORBID_WEAK_KEYS flag is set. However, only a single weak
14+
key was being tested. Add tests for all 16 weak and semi-weak keys.
15+
16+
While DES is deprecated, it is still used in some legacy protocols, and
17+
weak/semi-weak key detection should be tested accordingly.
18+
19+
Tested on arm64 with cryptographic self-tests.
20+
21+
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
22+
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
23+
---
24+
crypto/testmgr.h | 120 +++++++++++++++++++++++++++++++++++++++++++++++
25+
1 file changed, 120 insertions(+)
26+
27+
--- a/crypto/testmgr.h
28+
+++ b/crypto/testmgr.h
29+
@@ -10330,6 +10330,126 @@ static const struct cipher_testvec des_t
30+
.ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
31+
.ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
32+
.len = 8,
33+
+ }, { /* Weak key */
34+
+ .setkey_error = -EINVAL,
35+
+ .wk = 1,
36+
+ .key = "\xe0\xe0\xe0\xe0\xf1\xf1\xf1\xf1",
37+
+ .klen = 8,
38+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
39+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
40+
+ .len = 8,
41+
+ }, { /* Weak key */
42+
+ .setkey_error = -EINVAL,
43+
+ .wk = 1,
44+
+ .key = "\x1f\x1f\x1f\x1f\x0e\x0e\x0e\x0e",
45+
+ .klen = 8,
46+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
47+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
48+
+ .len = 8,
49+
+ }, { /* Weak key */
50+
+ .setkey_error = -EINVAL,
51+
+ .wk = 1,
52+
+ .key = "\xfe\xfe\xfe\xfe\xfe\xfe\xfe\xfe",
53+
+ .klen = 8,
54+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
55+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
56+
+ .len = 8,
57+
+ }, { /* Semi-weak key pair 1a */
58+
+ .setkey_error = -EINVAL,
59+
+ .wk = 1,
60+
+ .key = "\x01\xfe\x01\xfe\x01\xfe\x01\xfe",
61+
+ .klen = 8,
62+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
63+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
64+
+ .len = 8,
65+
+ }, { /* Semi-weak key pair 1b */
66+
+ .setkey_error = -EINVAL,
67+
+ .wk = 1,
68+
+ .key = "\xfe\x01\xfe\x01\xfe\x01\xfe\x01",
69+
+ .klen = 8,
70+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
71+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
72+
+ .len = 8,
73+
+ }, { /* Semi-weak key pair 2a */
74+
+ .setkey_error = -EINVAL,
75+
+ .wk = 1,
76+
+ .key = "\x1f\xe0\x1f\xe0\x0e\xf1\x0e\xf1",
77+
+ .klen = 8,
78+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
79+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
80+
+ .len = 8,
81+
+ }, { /* Semi-weak key pair 2b */
82+
+ .setkey_error = -EINVAL,
83+
+ .wk = 1,
84+
+ .key = "\xe0\x1f\xe0\x1f\xf1\x0e\xf1\x0e",
85+
+ .klen = 8,
86+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
87+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
88+
+ .len = 8,
89+
+ }, { /* Semi-weak key pair 3a */
90+
+ .setkey_error = -EINVAL,
91+
+ .wk = 1,
92+
+ .key = "\x01\xe0\x01\xe0\x01\xf1\x01\xf1",
93+
+ .klen = 8,
94+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
95+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
96+
+ .len = 8,
97+
+ }, { /* Semi-weak key pair 3b */
98+
+ .setkey_error = -EINVAL,
99+
+ .wk = 1,
100+
+ .key = "\xe0\x01\xe0\x01\xf1\x01\xf1\x01",
101+
+ .klen = 8,
102+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
103+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
104+
+ .len = 8,
105+
+ }, { /* Semi-weak key pair 4a */
106+
+ .setkey_error = -EINVAL,
107+
+ .wk = 1,
108+
+ .key = "\x1f\xfe\x1f\xfe\x0e\xfe\x0e\xfe",
109+
+ .klen = 8,
110+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
111+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
112+
+ .len = 8,
113+
+ }, { /* Semi-weak key pair 4b */
114+
+ .setkey_error = -EINVAL,
115+
+ .wk = 1,
116+
+ .key = "\xfe\x1f\xfe\x1f\xfe\x0e\xfe\x0e",
117+
+ .klen = 8,
118+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
119+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
120+
+ .len = 8,
121+
+ }, { /* Semi-weak key pair 5a */
122+
+ .setkey_error = -EINVAL,
123+
+ .wk = 1,
124+
+ .key = "\x01\x1f\x01\x1f\x01\x0e\x01\x0e",
125+
+ .klen = 8,
126+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
127+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
128+
+ .len = 8,
129+
+ }, { /* Semi-weak key pair 5b */
130+
+ .setkey_error = -EINVAL,
131+
+ .wk = 1,
132+
+ .key = "\x1f\x01\x1f\x01\x0e\x01\x0e\x01",
133+
+ .klen = 8,
134+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
135+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
136+
+ .len = 8,
137+
+ }, { /* Semi-weak key pair 6a */
138+
+ .setkey_error = -EINVAL,
139+
+ .wk = 1,
140+
+ .key = "\xe0\xfe\xe0\xfe\xf1\xfe\xf1\xfe",
141+
+ .klen = 8,
142+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
143+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
144+
+ .len = 8,
145+
+ }, { /* Semi-weak key pair 6b */
146+
+ .setkey_error = -EINVAL,
147+
+ .wk = 1,
148+
+ .key = "\xfe\xe0\xfe\xe0\xfe\xf1\xfe\xf1",
149+
+ .klen = 8,
150+
+ .ptext = "\x01\x23\x45\x67\x89\xab\xcd\xe7",
151+
+ .ctext = "\xc9\x57\x44\x25\x6a\x5e\xd3\x1d",
152+
+ .len = 8,
153+
}, { /* Two blocks -- for testing encryption across pages */
154+
.key = "\x01\x23\x45\x67\x89\xab\xcd\xef",
155+
.klen = 8,

0 commit comments

Comments
 (0)