Linux 5.19 Makes Its Signature Verification Code FIPS Compliant
For FIPS (Federal Information Processing Standards) compliance, self-tests are required. FIPS are public standards via NIST used by US government agencies and contractors in the areas of computer security and interoperability. FIPS 140 for cryptography outlines the requirements around self-tests. Known-answer self-tests are required for FIPS compliance at startup / reboot, but the Linux kernel's signature verification code has been lacking such tests. The signature checking code is used for module signing, Kexec, and other functionality. With Linux 5.19 there will now be some basic self-tests at start.
David Howells of Red Hat explained, "The signature checking code, as used by module signing, kexec, etc., is non-FIPS compliant as there is no selftest. For a kernel to be FIPS-compliant, signature checking would have to be tested before being used, and the box would need to panic if it's not available (probably reasonable as simply disabling signature checking would prevent you from loading any driver modules). Deal with this by adding a minimal test."
This support was merged yesterday to mainline and this FIPS self-tests will be part of Linux 5.19-rc4.
2 Comments
