1 Commits (103d3109dc18032d5446c71764917f6bf25fbfaa)

Author	SHA1	Message	Date
Clemens Lang	fe09690308	pbkdf2: Set minimum password length of 8 bytes ... The Implementation Guidance for FIPS 140-3 says in section D.N "Password-Based Key Derivation for Storage Applications" that "the vendor shall document in the module’s Security Policy the length of a password/passphrase used in key derivation and establish an upper bound for the probability of having this parameter guessed at random. This probability shall take into account not only the length of the password/passphrase, but also the difficulty of guessing it. The decision on the minimum length of a password used for key derivation is the vendor’s, but the vendor shall at a minimum informally justify the decision." We are choosing a minimum password length of 8 bytes, because NIST's ACVP testing uses passwords as short as 8 bytes, and requiring longer passwords combined with an implicit indicator (i.e., returning an error) would cause the module to fail ACVP testing. Signed-off-by: Clemens Lang <cllang@redhat.com> Resolves: rhbz#2144003	2 years ago