dm crypt: rewrite (wipe) key in crypto layer using random data
The message "key wipe" used to wipe real key stored in crypto layer by rewriting it with zeroes. Since commithifive-unleashed-5.128856a9
("crypto: xts - consolidate sanity check for keys") this no longer works in FIPS mode for XTS. While running in FIPS mode the crypto key part has to differ from the tweak key. Fixes:28856a9
("crypto: xts - consolidate sanity check for keys") Cc: stable@vger.kernel.org Signed-off-by: Ondrej Kozina <okozina@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
parent
06eb061f48
commit
c82feeec9a
|
@ -2152,12 +2152,16 @@ out:
|
|||
|
||||
static int crypt_wipe_key(struct crypt_config *cc)
|
||||
{
|
||||
int r;
|
||||
|
||||
clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
|
||||
memset(&cc->key, 0, cc->key_size * sizeof(u8));
|
||||
get_random_bytes(&cc->key, cc->key_size);
|
||||
kzfree(cc->key_string);
|
||||
cc->key_string = NULL;
|
||||
r = crypt_setkey(cc);
|
||||
memset(&cc->key, 0, cc->key_size * sizeof(u8));
|
||||
|
||||
return crypt_setkey(cc);
|
||||
return r;
|
||||
}
|
||||
|
||||
static void crypt_dtr(struct dm_target *ti)
|
||||
|
|
Loading…
Reference in New Issue