Re: [PATCH] Documentation: crypto: add info about "fips=" boot option

[Herbert Xu]

On Mon, Mar 29, 2021 at 10:00:45PM -0700, Randy Dunlap wrote:
> On 3/29/21 9:37 PM, Herbert Xu wrote:
> > On Mon, Mar 29, 2021 at 09:00:01PM -0700, Randy Dunlap wrote:
> >>
> >> +			If fips_enabled = 1, some crypto tests are skipped.
> > 
> > I don't think any tests are skipped.  It does however disable
> > many algorithms by essentially failing them at the testing stage.
> 
> That statement was based on crypto/testmgr.c (in 4 places):
> 
> 		if (fips_enabled && template[i].fips_skip)
> 			continue;

By skipping the test, the algorithm effectively fails the self-test
and therefore is disabled.

Cheers,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt