Re: [PATCH v4 15/15] crypto: dh - calculate Q from P for the full public key verification

[Hannes Reinecke]

On 2/21/22 13:11, Nicolai Stange wrote:
> As the ->q in struct dh_ctx gets never set anywhere, the code in
> dh_is_pubkey_valid() for doing the full public key validation in accordance
> to SP800-56Arev3 is effectively dead.
>
> However, for safe-prime groups Q = (P - 1)/2 by definition and
> as the safe-prime groups are the only possible groups in FIPS mode (via
> those ffdheXYZ() templates), this enables dh_is_pubkey_valid() to calculate
> Q on the fly for these.
> Implement this.
>
> With this change, the last code accessing struct dh_ctx's ->q is now gone.
> Remove this member from struct dh_ctx.
>
> Signed-off-by: Nicolai Stange <nstange@xxxxxxx>
> ---
>   crypto/dh.c | 40 +++++++++++++++++++++++++++++-----------
>   1 file changed, 29 insertions(+), 11 deletions(-)
Reviewed-by: Hannes Reinecke <hare@xxxxxxx>

Cheers,

Hannes
--
Dr. Hannes Reinecke		           Kernel Storage Architect
hare@xxxxxxx			                  +49 911 74053 688
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg
HRB 36809 (AG Nürnberg), GF: Felix Imendörffer