Re: [PATCH] cipher: Check and mark non-compliant cipher modes in the SLI

Hi,

Fixed in the attached patch (included a small typo fix from the other
patch, sorry about that).

> MODE is not an int but enum gcry_cipher_modes and thus it is better to
> use that.  Also put all modes into the switch so that the compiler can
> check its completeness and we do not miss to check whether new modes may
> be FIPS compliant.

Not sure if _gcry_cipher_open_internal should also use gcry_cipher_modes.
Let me know
if this is something you want changed since it checks mode as an int as
well.

Best,
Lucas Mülling


On Tue, Jan 28, 2025 at 1:39 PM Werner Koch <[email protected]> wrote:

> Hi!
>
> On Fri, 24 Jan 2025 10:19, Lucas Mulling said:
>
> > +int
> > +_gcry_cipher_is_mode_fips_compliant(int mode)
>
> Given that this function returns an error code it should also be
> declared as to do this.  However, the name of the function indicates
> that this returns a boolean status and one would expect true for FIPS
> comliance.  But the logic is invers.  This is fine but the function
> should then for example be named _gcry_cipher_mode_fips_compliance.
>
> MODE is not an int but enum gcry_cipher_modes and thus it is better to
> use that.  Also put all modes into the switch so that the compiler can
> check its completeness and we do not miss to check whether new modes may
> be FIPS compliant.
>
> > @@ -1988,6 +1988,7 @@ char *gcry_get_config (int mode, const char *what);
> >  #define GCRY_FIPS_FLAG_REJECT_PK            (1 << 5)
> >  #define GCRY_FIPS_FLAG_REJECT_PK_MD         (1 << 6)
> >  #define GCRY_FIPS_FLAG_REJECT_PK_GOST_SM2   (1 << 7)
> > +#define GCRY_FIPS_FLAG_REJECT_CIPHER_MODE   (1 << 8)
>
> Do we already have a documentation for these new constants?  In any case
> it should be put into the NEWS file.
>
>
>
> Shalom-Salam,
>
>    Werner
>
>
> --
> The pioneers of a warless world are the youth that
> refuse military service.             - A. Einstein
>

_______________________________________________
Gcrypt-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gcrypt-devel

From 285b9b348221a3b331ac3ecf63443f6a63e187dd Mon Sep 17 00:00:00 2001
From: Lucas Mulling <[email protected]>
Date: Tue, 28 Jan 2025 13:45:39 -0300
Subject: [PATCH] chiper: Rename _gcry_cipher_is_mode_fips_compliant

* cipher/cipher.c (_gcry_cipher_is_mode_fips_compliant): Rename to
_gcry_cipher_mode_fips_compliance for better clarity and change the
return type to gcry_err_code_t
* cipher/cipher.c (_gcry_cipher_mode_fips_compliance): Use
gcry_cipher_modes instead of int for mode
* tests/t-fips-service-ind.c (check_cipher_o_s_e_d_c): Fix typo in fail

Signed-off-by: Lucas Mulling <[email protected]>
---
 cipher/cipher.c            | 6 +++---
 tests/t-fips-service-ind.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cipher/cipher.c b/cipher/cipher.c
index b5420671..7775356f 100644
--- a/cipher/cipher.c
+++ b/cipher/cipher.c
@@ -504,8 +504,8 @@ _gcry_cipher_open (gcry_cipher_hd_t *handle,
   return rc;
 }
 
-int
-_gcry_cipher_is_mode_fips_compliant(int mode)
+gcry_err_code_t
+_gcry_cipher_mode_fips_compliance(enum gcry_cipher_modes mode)
 {
   switch (mode)
     {
@@ -555,7 +555,7 @@ _gcry_cipher_open_internal (gcry_cipher_hd_t *handle,
               err = 0;
             }
         }
-      else if ((err = _gcry_cipher_is_mode_fips_compliant(mode)))
+      else if ((err = _gcry_cipher_mode_fips_compliance(mode)))
         {
           if (!fips_check_rejection (GCRY_FIPS_FLAG_REJECT_CIPHER_MODE))
             {
diff --git a/tests/t-fips-service-ind.c b/tests/t-fips-service-ind.c
index 74521bb3..ed5f8d3f 100644
--- a/tests/t-fips-service-ind.c
+++ b/tests/t-fips-service-ind.c
@@ -767,7 +767,7 @@ check_cipher_o_s_e_d_c (int reject)
 
           err = gcry_cipher_set_decryption_tag (h, tag, 16);
           if (err)
-            fail ("gcry_cipher_set_decryption_tag %d failed: %s\n", tvidx<
+            fail ("gcry_cipher_set_decryption_tag %d failed: %s\n", tvidx,
                    gpg_strerror (err));
       }
 
-- 
2.48.1