crypto: testmgr - disallow certain DRBG hash functions in FIPS mode

According to FIPS 140-3 IG, section D.R "Hash Functions Acceptable for
Use in the SP 800-90A DRBGs", modules certified after May 16th, 2023
must not support the use of: SHA-224, SHA-384, SHA512-224, SHA512-256,
SHA3-224, SHA3-384. Disallow HMAC and HASH DRBGs using SHA-384 in FIPS
mode.

Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Stephan Müller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 795c485..dd74883 100644 (file)
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4781,7 +4781,6 @@ static const struct alg_test_desc alg_test_descs[] = {
        }, {
                /* covered by drbg_nopr_hmac_sha256 test */
                .alg = "drbg_nopr_hmac_sha384",
-               .fips_allowed = 1,
                .test = alg_test_null,
        }, {
                .alg = "drbg_nopr_hmac_sha512",
@@ -4804,7 +4803,6 @@ static const struct alg_test_desc alg_test_descs[] = {
        }, {
                /* covered by drbg_nopr_sha256 test */
                .alg = "drbg_nopr_sha384",
-               .fips_allowed = 1,
                .test = alg_test_null,
        }, {
                .alg = "drbg_nopr_sha512",
@@ -4840,7 +4838,6 @@ static const struct alg_test_desc alg_test_descs[] = {
        }, {
                /* covered by drbg_pr_hmac_sha256 test */
                .alg = "drbg_pr_hmac_sha384",
-               .fips_allowed = 1,
                .test = alg_test_null,
        }, {
                .alg = "drbg_pr_hmac_sha512",
@@ -4860,7 +4857,6 @@ static const struct alg_test_desc alg_test_descs[] = {
        }, {
                /* covered by drbg_pr_sha256 test */
                .alg = "drbg_pr_sha384",
-               .fips_allowed = 1,
                .test = alg_test_null,
        }, {
                .alg = "drbg_pr_sha512",