Description of problem:

Recent changes in RHEL-8 kernel (see BZ#166715) break the tests in FIPS mode. Since kernel-4.18.0-473.el8 HMAC keys require at least 112 bits and various tests are using 64 bit keys (password / 70617373776f726464 in hex). The following tests fail:

• /usr/libexec/libkcapi/test.sh
• /usr/libexec/libkcapi/kcapi-enc-test.sh
• /usr/libexec/libkcapi/kcapi-dgst-test.sh
• /usr/libexec/libkcapi/hasher-test.sh
• /usr/libexec/libkcapi/kcapi-convenience.sh

It is not a bug, the kernel is now more restrictive about key sizes in FIPS mode because FIPS 140-3 requires it. Tests can be modified to use longer keys.

Version-Release number of selected component (if applicable):

libkcapi-1.2.0-2.el8
kernel-4.18.0-473.el8

How reproducible:

100% in FIPS mode

Steps to Reproduce:

1. Enable FIPS mode

1. fips-mode-setup --enable && reboot

2. Disable 3DES cases for test.sh

1. sed -i 's/HASHEXEC="1 2/HASHEXEC="2/g' /usr/libexec/libkcapi/test.sh
2. sed -i 's/SYMEXEC="1 2 3 4 5 6 7/SYMEXEC="1 2 3/g' /usr/libexec/libkcapi/test.sh

3. Run the tests

1. /usr/libexec/libkcapi/test.sh
2. /usr/libexec/libkcapi/kcapi-enc-test.sh
3. /usr/libexec/libkcapi/kcapi-dgst-test.sh
4. /usr/libexec/libkcapi/hasher-test.sh
5. /usr/libexec/libkcapi/kcapi-convenience.sh

Actual results:

All tests failed (see attached taskout.log).

Expected results:

All Test passed.

Additional info:

All tests pass with the same libkcapi version and with kernel-4.18.0-472.el8.