Linux 5.19 Makes Its Signature Verification Code FIPS Compliant

Written by Michael Larabel in Linux Security on 22 June 2022 at 05:00 AM EDT. 2 Comments
LINUX SECURITY --
Merged yesterday into Linux 5.19 as a post merge window change is making the kernel's signature verification code FIPS compliant.

For FIPS (Federal Information Processing Standards) compliance, self-tests are required. FIPS are public standards via NIST used by US government agencies and contractors in the areas of computer security and interoperability. FIPS 140 for cryptography outlines the requirements around self-tests. Known-answer self-tests are required for FIPS compliance at startup / reboot, but the Linux kernel's signature verification code has been lacking such tests. The signature checking code is used for module signing, Kexec, and other functionality. With Linux 5.19 there will now be some basic self-tests at start.

David Howells of Red Hat explained, "The signature checking code, as used by module signing, kexec, etc., is non-FIPS compliant as there is no selftest. For a kernel to be FIPS-compliant, signature checking would have to be tested before being used, and the box would need to panic if it's not available (probably reasonable as simply disabling signature checking would prevent you from loading any driver modules). Deal with this by adding a minimal test."

This support was merged yesterday to mainline and this FIPS self-tests will be part of Linux 5.19-rc4.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week