diff options
| author | David Howells <dhowells@redhat.com> | 2022-05-18 17:15:34 +0100 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2022-06-21 16:05:12 +0100 |
| commit | 3cde3174eb910513d32a9ec8a9b95ea59be833df (patch) | |
| tree | 41ec5b5f807d1f7f04c5d95d2e8caf82e734238b /crypto/asymmetric_keys/Kconfig | |
| parent | 60050ffe3d770dd1df5b641aa48f49d07a54bd84 (diff) | |
| download | linux-3cde3174eb910513d32a9ec8a9b95ea59be833df.tar.bz2 | |
certs: Add FIPS selftests
Add some selftests for signature checking when FIPS mode is enabled. These
need to be done before we start actually using the signature checking for
things and must panic the kernel upon failure.
Note that the tests must not check the blacklist lest this provide a way to
prevent a kernel from booting by installing a hash of a test key in the
appropriate UEFI table.
Reported-by: Simo Sorce <simo@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
Link: https://lore.kernel.org/r/165515742832.1554877.2073456606206090838.stgit@warthog.procyon.org.uk/
Diffstat (limited to 'crypto/asymmetric_keys/Kconfig')
| -rw-r--r-- | crypto/asymmetric_keys/Kconfig | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig index 460bc5d0a828..3df3fe4ed95f 100644 --- a/crypto/asymmetric_keys/Kconfig +++ b/crypto/asymmetric_keys/Kconfig @@ -75,4 +75,14 @@ config SIGNED_PE_FILE_VERIFICATION This option provides support for verifying the signature(s) on a signed PE binary. +config FIPS_SIGNATURE_SELFTEST + bool "Run FIPS selftests on the X.509+PKCS7 signature verification" + help + This option causes some selftests to be run on the signature + verification code, using some built in data. This is required + for FIPS. + depends on KEYS + depends on ASYMMETRIC_KEY_TYPE + depends on PKCS7_MESSAGE_PARSER + endif # ASYMMETRIC_KEY_TYPE |