imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-11-02 23:54:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: Enforce key size of 16 bytes on FIPS level

Browse Source 
According to the spec Ver 5.2, Vol 3, Part C, Sec 5.2.2.8:
Device in security mode 4 level 4 shall enforce:
128-bit equivalent strength for link and encryption keys required
using FIPS approved algorithms (E0 not allowed, SAFER+ not allowed,
and P-192 not allowed; encryption key not shortened)

This patch rejects connection with key size below 16 for FIPS
level services.

Signed-off-by: Archie Pusaka <[email protected]>
Reviewed-by: Alain Michaud <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>
This commit is contained in:
Archie Pusaka authored and Marcel Holtmann committed 2020-11-11 10:52:01 +01:00
1 parent 0d484db60f
commit 288c06973d
1 file changed
+7 -1
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/l2cap_core.c
+7 -1
View File
@@ -1515,8 +1515,14 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
* that have no key size requirements. Ensure that the link is
* actually encrypted before enforcing a key size.
*/
int min_key_size = hcon->hdev->min_enc_key_size;
/* On FIPS security level, key size must be 16 bytes */
if (hcon->sec_level == BT_SECURITY_FIPS)
min_key_size = 16;
return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
hcon->enc_key_size >= hcon->hdev->min_enc_key_size);
hcon->enc_key_size >= min_key_size);
}
static void l2cap_do_start(struct l2cap_chan *chan)