Re: FIPS 140 service indicator revamp

David Sugar <[email protected]> wrote:
> Sure, I've attached a diff.

Thank you.

While I understand the requirement of the check by
_gcry_fips_check_kdf_compliant after actual computation, I'm a bit
confused about your suggested change.

Here are two comments, for now. 


(1) There are two different failures; a failure before the computation,
and a failure after the computation.  In your patch, it returns
GPG_ERR_FORBIDDEN by fips_not_compliant macro for both cases.
I wonder if this two cases should be distinguished differently.


(2) gcry_kdf_derive does not allocate memory, but let us consider a
function which allocates memory on successful computation.  It's the
case where an application needs to release memory after use of a
function when success.

Considering this situation...

IIUC, your change implies changing success path for all applications
(even if an application does not care about FIPS).  That's because
"success" may be actually failure (by examining ERRNO), releasing memory
should not be done in this case.

I wonder if it's possible to ask changing error path for FIPS-contious
applications, and non FIPS-contious application can avoid any changes.
--