Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:frispete:python
openssl-1_1
openssl-1_1-ossl-sli-003-add-sli.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssl-1_1-ossl-sli-003-add-sli.patch of Package openssl-1_1
--- crypto/cmac/cm_pmeth.c | 5 crypto/cmac/cmac.c | 16 crypto/dh/dh_pmeth.c | 4 crypto/dsa/dsa_pmeth.c | 5 crypto/ec/ec_pmeth.c | 13 crypto/ec/ecx_meth.c | 2 crypto/evp/digest.c | 2 crypto/evp/e_aes.c | 70 +++ crypto/evp/evp_enc.c | 3 crypto/evp/evp_local.h | 4 crypto/evp/kdf_lib.c | 11 crypto/evp/m_sigver.c | 54 ++ crypto/evp/p5_crpt2.c | 38 + crypto/evp/p_open.c | 3 crypto/evp/p_seal.c | 3 crypto/evp/p_sign.c | 5 crypto/evp/p_verify.c | 4 crypto/evp/pkey_kdf.c | 5 crypto/evp/pmeth_lib.c | 2 crypto/fips/build.info | 2 crypto/fips/fips_sli.c | 371 ++++++++++++++++ crypto/hmac/hm_pmeth.c | 5 crypto/hmac/hmac.c | 49 +- crypto/hmac/hmac_local.h | 4 crypto/kdf/hkdf.c | 8 crypto/kdf/pbkdf2.c | 14 crypto/kdf/scrypt.c | 7 crypto/kdf/sshkdf.c | 13 crypto/kdf/tls1_prf.c | 12 crypto/poly1305/poly1305_pmeth.c | 4 crypto/rand/rand_lib.c | 12 crypto/rsa/rsa_pmeth.c | 61 ++ crypto/sha/sha1_one.c | 5 crypto/siphash/siphash_pmeth.c | 4 crypto/sm2/sm2_pmeth.c | 5 doc/man3/FIPS_service_level_indicator.pod | 110 +++++ include/crypto/evp.h | 5 include/crypto/fipserr.h | 121 +++++ include/internal/fips_sli_local.h | 96 ++++ include/openssl/fips_sli.h | 32 + test/build.info | 6 test/fips_slitest.c | 659 ++++++++++++++++++++++++++++++ test/fips_slitest_helper.c | 489 ++++++++++++++++++++++ test/fips_slitest_helper.h | 29 + test/recipes/30-test_fips_sli.t | 4 util/libcrypto.num | 11 46 files changed, 2345 insertions(+), 42 deletions(-) --- a/crypto/cmac/cm_pmeth.c +++ b/crypto/cmac/cm_pmeth.c @@ -72,7 +72,10 @@ static int cmac_signctx_init(EVP_PKEY_CT static int cmac_signctx(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen, EVP_MD_CTX *mctx) { - return CMAC_Final(ctx->data, sig, siglen); + const int r = CMAC_Final(ctx->data, sig, siglen); + if (!fips_sli_is_approved_CMAC_CTX(ctx->data)) + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + return r; } static int pkey_cmac_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) --- a/crypto/cmac/cmac.c +++ b/crypto/cmac/cmac.c @@ -13,6 +13,7 @@ #include "internal/cryptlib.h" #include <openssl/cmac.h> #include <openssl/err.h> +#include "internal/fips_sli_local.h" struct CMAC_CTX_st { /* Cipher context to use */ @@ -26,8 +27,11 @@ struct CMAC_CTX_st { unsigned char last_block[EVP_MAX_BLOCK_LENGTH]; /* Number of bytes in last block: -1 means context not initialised */ int nlast_block; + FIPS_STATUS sli; /* Service Level Indicator */ }; +fips_sli_define_for(CMAC_CTX) + /* Make temporary keys K1 and K2 */ static void make_kn(unsigned char *k1, const unsigned char *l, int bl) @@ -62,6 +66,7 @@ CMAC_CTX *CMAC_CTX_new(void) void CMAC_CTX_cleanup(CMAC_CTX *ctx) { + ctx->sli = FIPS_UNSET; EVP_CIPHER_CTX_reset(ctx->cctx); OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH); OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH); @@ -97,6 +102,7 @@ int CMAC_CTX_copy(CMAC_CTX *out, const C memcpy(out->tbl, in->tbl, bl); memcpy(out->last_block, in->last_block, bl); out->nlast_block = in->nlast_block; + out->sli = in->sli; return 1; } @@ -104,6 +110,7 @@ int CMAC_Init(CMAC_CTX *ctx, const void const EVP_CIPHER *cipher, ENGINE *impl) { static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 }; + ctx->sli = FIPS_UNSET; /* All zeros means restart */ if (!key && !cipher && !impl && keylen == 0) { /* Not initialised */ @@ -215,6 +222,15 @@ int CMAC_Final(CMAC_CTX *ctx, unsigned c OPENSSL_cleanse(out, bl); return 0; } + switch (EVP_CIPHER_nid(EVP_CIPHER_CTX_cipher(ctx->cctx))) { + case NID_aes_128_cbc: + case NID_aes_192_cbc: + case NID_aes_256_cbc: + fips_sli_approve_CMAC_CTX(ctx); + break; + default: + fips_sli_disapprove_CMAC_CTX(ctx); + } return 1; } --- a/crypto/dh/dh_pmeth.c +++ b/crypto/dh/dh_pmeth.c @@ -466,6 +466,8 @@ static int pkey_dh_derive(EVP_PKEY_CTX * if (ret < 0) return ret; *keylen = ret; + fips_sli_check_key_dh_EVP_PKEY_CTX(ctx, ctx->peerkey->pkey.dh); + fips_sli_check_key_dh_EVP_PKEY_CTX(ctx, dh); return 1; } #ifndef OPENSSL_NO_CMS @@ -493,6 +495,8 @@ static int pkey_dh_derive(EVP_PKEY_CTX * dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md)) goto err; *keylen = dctx->kdf_outlen; + fips_sli_check_key_dh_EVP_PKEY_CTX(ctx, ctx->peerkey->pkey.dh); + fips_sli_check_key_dh_EVP_PKEY_CTX(ctx, dh); ret = 1; err: OPENSSL_clear_free(Z, Zlen); --- a/crypto/dsa/dsa_pmeth.c +++ b/crypto/dsa/dsa_pmeth.c @@ -77,6 +77,8 @@ static int pkey_dsa_sign(EVP_PKEY_CTX *c DSA_PKEY_CTX *dctx = ctx->data; DSA *dsa = ctx->pkey->pkey.dsa; + fips_sli_check_key_dsa_siggen_EVP_PKEY_CTX(ctx, dsa); + if (dctx->md != NULL && tbslen != (size_t)EVP_MD_size(dctx->md)) return 0; @@ -96,6 +98,8 @@ static int pkey_dsa_verify(EVP_PKEY_CTX DSA_PKEY_CTX *dctx = ctx->data; DSA *dsa = ctx->pkey->pkey.dsa; + fips_sli_check_key_dsa_sigver_EVP_PKEY_CTX(ctx, dsa); + if (dctx->md != NULL && tbslen != (size_t)EVP_MD_size(dctx->md)) return 0; @@ -224,6 +228,7 @@ static int pkey_dsa_paramgen(EVP_PKEY_CT static int pkey_dsa_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) { DSA *dsa = NULL; + fips_sli_disapprove_EVP_PKEY_CTX(ctx); if (ctx->pkey == NULL) { DSAerr(DSA_F_PKEY_DSA_KEYGEN, DSA_R_NO_PARAMETERS_SET); --- a/crypto/ec/ec_pmeth.c +++ b/crypto/ec/ec_pmeth.c @@ -122,6 +122,7 @@ static int pkey_ec_sign(EVP_PKEY_CTX *ct type = (dctx->md != NULL) ? EVP_MD_type(dctx->md) : NID_sha1; + fips_sli_check_curve_siggen_EVP_PKEY_CTX(ctx, EC_KEY_get0_group(ec)); ret = ECDSA_sign(type, tbs, tbslen, sig, &sltmp, ec); if (ret <= 0) @@ -143,6 +144,7 @@ static int pkey_ec_verify(EVP_PKEY_CTX * else type = NID_sha1; + fips_sli_check_curve_sigver_EVP_PKEY_CTX(ctx, EC_KEY_get0_group(ec)); ret = ECDSA_verify(type, tbs, tbslen, sig, siglen, ec); return ret; @@ -182,6 +184,8 @@ static int pkey_ec_derive(EVP_PKEY_CTX * if (ret <= 0) return 0; *keylen = ret; + fips_sli_check_key_ecdh_EVP_PKEY_CTX(ctx, eckey); + fips_sli_check_key_ecdh_EVP_PKEY_CTX(ctx, ctx->peerkey->pkey.ec); return 1; } @@ -208,6 +212,8 @@ static int pkey_ec_kdf_derive(EVP_PKEY_C } if (!pkey_ec_derive(ctx, ktmp, &ktmplen)) goto err; + /* ANSI-X9.63-KDF (X9_62) is FIPS-approved, but we don't have a selftest */ + fips_sli_disapprove_EVP_PKEY_CTX(ctx); /* Do KDF stuff */ if (!ecdh_KDF_X9_63(key, *keylen, ktmp, ktmplen, dctx->kdf_ukm, dctx->kdf_ukmlen, dctx->kdf_md)) @@ -433,7 +439,12 @@ static int pkey_ec_keygen(EVP_PKEY_CTX * else ret = EC_KEY_set_group(ec, dctx->gen_group); - return ret ? EC_KEY_generate_key(ec) : 0; + if (ret) { + fips_sli_check_key_ec_keygen_EVP_PKEY_CTX(ctx, ec); + return EC_KEY_generate_key(ec); + } else { + return 0; + } } static const EVP_PKEY_METHOD ec_pkey_meth = { --- a/crypto/ec/ecx_meth.c +++ b/crypto/ec/ecx_meth.c @@ -691,6 +691,7 @@ static int pkey_ecx_derive25519(EVP_PKEY && X25519(key, privkey, pubkey) == 0)) return 0; *keylen = X25519_KEYLEN; + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return 1; } @@ -704,6 +705,7 @@ static int pkey_ecx_derive448(EVP_PKEY_C && X448(key, privkey, pubkey) == 0)) return 0; *keylen = X448_KEYLEN; + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return 1; } --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -40,6 +40,7 @@ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx) if (ctx == NULL) return 1; + ctx->sli = FIPS_UNSET; /* * Don't assume ctx->md_data was cleaned in EVP_Digest_Final, because * sometimes only copies of the context are ever finalised. @@ -80,6 +81,7 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, cons int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) { EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED); + ctx->sli = FIPS_UNSET; #ifdef OPENSSL_FIPS if (FIPS_selftest_failed()) { FIPSerr(FIPS_F_EVP_DIGESTINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED); --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -4303,3 +4303,73 @@ BLOCK_CIPHER_custom(NID_aes, 192, 16, 12 BLOCK_CIPHER_custom(NID_aes, 256, 16, 12, ocb, OCB, EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS) #endif /* OPENSSL_NO_OCB */ + +/* Use an explicit whitelist here (due to the number of ciphers and modes) */ +FIPS_STATUS EVP_CIPHER_get_fips_status(const EVP_CIPHER *cipher) { + /* switch on pointers is not entirely portable */ + if (cipher->do_cipher == aes_cbc_cipher + || cipher->do_cipher == aes_ecb_cipher + || cipher->do_cipher == aes_xts_cipher + || cipher->do_cipher == aes_ofb_cipher + || cipher->do_cipher == aes_cfb_cipher + || cipher->do_cipher == aes_cfb1_cipher + || cipher->do_cipher == aes_cfb8_cipher + || cipher->do_cipher == aes_ctr_cipher + || cipher->do_cipher == aes_gcm_cipher + || cipher->do_cipher == aes_gcm_tls_cipher + || cipher->do_cipher == aes_ccm_cipher + #if defined(OPENSSL_CPUID_OBJ) && ( \ + ((defined(__i386) || defined(__i386__) || defined(_M_IX86))\ + && defined(OPENSSL_IA32_SSE2)) \ + || defined(__x86_64) || defined(__x86_64__) \ + || defined(_M_AMD64) || defined(_M_X64)) + || cipher->do_cipher == aesni_cbc_cipher /* AES-NI */ + || cipher->do_cipher == aesni_ecb_cipher + || cipher->do_cipher == aesni_xts_cipher + || cipher->do_cipher == aesni_ofb_cipher + || cipher->do_cipher == aesni_cfb_cipher + || cipher->do_cipher == aesni_cfb1_cipher + || cipher->do_cipher == aesni_cfb8_cipher + || cipher->do_cipher == aesni_ctr_cipher + || cipher->do_cipher == aesni_gcm_cipher + || cipher->do_cipher == aesni_ccm_cipher + #elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__) + || cipher->do_cipher == s390x_aes_cbc_cipher /* System/390 */ + || cipher->do_cipher == s390x_aes_ecb_cipher + || cipher->do_cipher == s390x_aes_xts_cipher + || cipher->do_cipher == s390x_aes_ofb_cipher + || cipher->do_cipher == s390x_aes_cfb_cipher + || cipher->do_cipher == s390x_aes_cfb1_cipher + || cipher->do_cipher == s390x_aes_cfb8_cipher + || cipher->do_cipher == s390x_aes_ctr_cipher + || cipher->do_cipher == s390x_aes_gcm_cipher + || cipher->do_cipher == s390x_aes_gcm_tls_cipher + || cipher->do_cipher == s390x_aes_ccm_cipher + #endif + || cipher->do_cipher == aes_wrap_cipher /* key wrapping */ + ) { + switch (EVP_CIPHER_key_length(cipher) * 8) { + case 128: + case 192: + if (cipher->do_cipher == aes_xts_cipher + #if defined(OPENSSL_CPUID_OBJ) && ( \ + ((defined(__i386) || defined(__i386__) || defined(_M_IX86))\ + && defined(OPENSSL_IA32_SSE2)) \ + || defined(__x86_64) || defined(__x86_64__) \ + || defined(_M_AMD64) || defined(_M_X64)) + || cipher->do_cipher == aesni_xts_cipher + #elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__) + || cipher->do_cipher == s390x_aes_xts_cipher + #endif + ) + return FIPS_NONAPPROVED; + /* intended fall-through */ + case 256: + return FIPS_APPROVED; + } + } + /* disapproved for enc and dec: all others, including + * 3DES and AES modes + * aes_ocb_cipher */ + return FIPS_NONAPPROVED; +} --- a/crypto/evp/evp_enc.c +++ b/crypto/evp/evp_enc.c @@ -32,6 +32,7 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX #endif if (c == NULL) return 1; + c->sli = FIPS_UNSET; if (c->cipher != NULL) { if (c->cipher->cleanup && !c->cipher->cleanup(c)) return 0; @@ -116,6 +117,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct /* Restore encrypt and flags */ ctx->encrypt = enc; ctx->flags = flags; + ctx->sli = FIPS_UNSET; } #ifndef OPENSSL_NO_ENGINE if (impl) { @@ -237,6 +239,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct ctx->buf_len = 0; ctx->final_used = 0; ctx->block_mask = ctx->cipher->block_size - 1; + fips_sli_check_cipher_EVP_CIPHER_CTX(ctx, ctx->cipher); return 1; } --- a/crypto/evp/evp_local.h +++ b/crypto/evp/evp_local.h @@ -1,3 +1,4 @@ +#include "internal/fips_sli_local.h" /* * Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved. * @@ -19,6 +20,7 @@ struct evp_md_ctx_st { EVP_PKEY_CTX *pctx; /* Update function: usually copied from EVP_MD */ int (*update) (EVP_MD_CTX *ctx, const void *data, size_t count); + FIPS_STATUS sli; /* Service Level Indicator */ } /* EVP_MD_CTX */ ; struct evp_cipher_ctx_st { @@ -39,11 +41,13 @@ struct evp_cipher_ctx_st { int final_used; int block_mask; unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */ + FIPS_STATUS sli; /* Service Level Indicator */ } /* EVP_CIPHER_CTX */ ; struct evp_kdf_ctx_st { const EVP_KDF_METHOD *kmeth; EVP_KDF_IMPL *impl; /* Algorithm-specific data */ + FIPS_STATUS sli; /* Service Level Indicator */ } /* EVP_KDF_CTX */ ; int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, --- a/crypto/evp/kdf_lib.c +++ b/crypto/evp/kdf_lib.c @@ -17,6 +17,7 @@ #include <openssl/kdf.h> #include "crypto/asn1.h" #include "crypto/evp.h" +#include "internal/fips_sli_local.h" #include "internal/numbers.h" #include "evp_local.h" @@ -82,6 +83,7 @@ EVP_KDF_CTX *EVP_KDF_CTX_new_id(int id) } ret->kmeth = kmeth; + ret->sli = FIPS_UNSET; return ret; } @@ -101,6 +103,7 @@ void EVP_KDF_reset(EVP_KDF_CTX *ctx) if (ctx->kmeth->reset != NULL) ctx->kmeth->reset(ctx->impl); + ctx->sli = FIPS_UNSET; } int EVP_KDF_ctrl(EVP_KDF_CTX *ctx, int cmd, ...) @@ -161,6 +164,12 @@ int EVP_KDF_derive(EVP_KDF_CTX *ctx, uns if (ctx == NULL) return 0; - return ctx->kmeth->derive(ctx->impl, key, keylen); + int ret = ctx->kmeth->derive(ctx->impl, key, keylen); + if (ctx->kmeth->fips_sli_is_approved(ctx->impl)) + fips_sli_approve_EVP_KDF_CTX(ctx); + else + fips_sli_disapprove_EVP_KDF_CTX(ctx); + + return ret; } --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c @@ -105,15 +105,21 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, if (pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM) { if (!sigret) return pctx->pmeth->signctx(pctx, sigret, siglen, ctx); - if (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) + if (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) { r = pctx->pmeth->signctx(pctx, sigret, siglen, ctx); - else { + if (!fips_sli_is_approved_EVP_PKEY_CTX(pctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); + } else { EVP_PKEY_CTX *dctx = EVP_PKEY_CTX_dup(ctx->pctx); if (!dctx) return 0; r = dctx->pmeth->signctx(dctx, sigret, siglen, ctx); + if (!fips_sli_is_approved_EVP_PKEY_CTX(dctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); EVP_PKEY_CTX_free(dctx); } + /* stricter than necessary, ctx->digest might be set but unused */ + fips_sli_check_hash_siggen_EVP_MD_CTX(ctx, ctx->digest); return r; } if (pctx->pmeth->signctx) @@ -124,8 +130,11 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char md[EVP_MAX_MD_SIZE]; unsigned int mdlen = 0; if (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) { - if (sctx) + if (sctx) { r = ctx->pctx->pmeth->signctx(ctx->pctx, sigret, siglen, ctx); + if (!fips_sli_is_approved_EVP_PKEY_CTX(ctx->pctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); + } else r = EVP_DigestFinal_ex(ctx, md, &mdlen); } else { @@ -136,16 +145,25 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, EVP_MD_CTX_free(tmp_ctx); return 0; } - if (sctx) + if (sctx) { r = tmp_ctx->pctx->pmeth->signctx(tmp_ctx->pctx, sigret, siglen, tmp_ctx); + if (!fips_sli_is_approved_EVP_PKEY_CTX(tmp_ctx->pctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); + } else r = EVP_DigestFinal_ex(tmp_ctx, md, &mdlen); EVP_MD_CTX_free(tmp_ctx); } + /* stricter than necessary, ctx->digest might be set but unused */ + fips_sli_check_hash_siggen_EVP_MD_CTX(ctx, ctx->digest); + if (sctx || !r) return r; - if (EVP_PKEY_sign(ctx->pctx, sigret, siglen, md, mdlen) <= 0) + r = EVP_PKEY_sign(ctx->pctx, sigret, siglen, md, mdlen); + if (!fips_sli_is_approved_EVP_PKEY_CTX(ctx->pctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); + if (r <= 0) return 0; } else { if (sctx) { @@ -163,8 +181,12 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, int EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, const unsigned char *tbs, size_t tbslen) { - if (ctx->pctx->pmeth->digestsign != NULL) + if (ctx->pctx->pmeth->digestsign != NULL) { + /* digestsign is only used for ed25519 and ed448 signatures, so should + * be safe to disapprove it completely */ + fips_sli_disapprove_EVP_MD_CTX(ctx); return ctx->pctx->pmeth->digestsign(ctx, sigret, siglen, tbs, tbslen); + } if (sigret != NULL && EVP_DigestSignUpdate(ctx, tbs, tbslen) <= 0) return 0; return EVP_DigestSignFinal(ctx, sigret, siglen); @@ -178,9 +200,14 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct unsigned int mdlen = 0; int vctx = 0; - if (ctx->pctx->pmeth->verifyctx) + fips_sli_check_hash_sigver_EVP_MD_CTX(ctx, EVP_MD_CTX_md(ctx)); + + if (ctx->pctx->pmeth->verifyctx) { vctx = 1; - else + /* verifyctx seems to be unused by openssl, so should be safe to + * disapprove it */ + fips_sli_disapprove_EVP_MD_CTX(ctx); + } else vctx = 0; if (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) { if (vctx) @@ -204,14 +231,21 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct } if (vctx || !r) return r; - return EVP_PKEY_verify(ctx->pctx, sig, siglen, md, mdlen); + const int res = EVP_PKEY_verify(ctx->pctx, sig, siglen, md, mdlen); + if (!fips_sli_is_approved_EVP_PKEY_CTX(ctx->pctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); + return res; } int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen) { - if (ctx->pctx->pmeth->digestverify != NULL) + if (ctx->pctx->pmeth->digestverify != NULL) { + /* digestverify is only used for ed25519 and ed448 signatures, so should + * be safe to disapprove it completely */ + fips_sli_disapprove_EVP_MD_CTX(ctx); return ctx->pctx->pmeth->digestverify(ctx, sigret, siglen, tbs, tbslen); + } if (EVP_DigestVerifyUpdate(ctx, tbs, tbslen) <= 0) return -1; return EVP_DigestVerifyFinal(ctx, sigret, siglen); --- a/crypto/evp/p5_crpt2.c +++ b/crypto/evp/p5_crpt2.c @@ -10,6 +10,7 @@ #include <stdio.h> #include <stdlib.h> #include "internal/cryptlib.h" +#include "internal/fips_sli_local.h" #include <openssl/x509.h> #include <openssl/evp.h> #include <openssl/kdf.h> @@ -24,13 +25,13 @@ static void h__dump(const unsigned char *p, int len); #endif -int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, +static int PKCS5_PBKDF2_HMAC_internal(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, - const EVP_MD *digest, int keylen, unsigned char *out) + const EVP_MD *digest, int keylen, unsigned char *out, + EVP_KDF_CTX *kctx) { const char *empty = ""; int rv = 1; - EVP_KDF_CTX *kctx; /* Keep documented behaviour. */ if (pass == NULL) { @@ -42,9 +43,6 @@ int PKCS5_PBKDF2_HMAC(const char *pass, if (salt == NULL && saltlen == 0) salt = (unsigned char *)empty; - kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2); - if (kctx == NULL) - return 0; if (EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, pass, (size_t)passlen) != 1 || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, salt, (size_t)saltlen) != 1 @@ -53,8 +51,6 @@ int PKCS5_PBKDF2_HMAC(const char *pass, || EVP_KDF_derive(kctx, out, keylen) != 1) rv = 0; - EVP_KDF_CTX_free(kctx); - # ifdef OPENSSL_DEBUG_PKCS5V2 fprintf(stderr, "Password:\n"); h__dump(pass, passlen); @@ -67,6 +63,32 @@ int PKCS5_PBKDF2_HMAC(const char *pass, return rv; } +int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, + const EVP_MD *digest, int keylen, unsigned char *out) +{ + EVP_KDF_CTX *kctx; + kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2); + if (kctx == NULL) + return 0; + int ret = PKCS5_PBKDF2_HMAC_internal(pass, passlen, salt, saltlen, iter, digest, keylen, out, kctx); + EVP_KDF_CTX_free(kctx); + return ret; +} + +int fips_sli_PKCS5_PBKDF2_HMAC_is_approved(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, + const EVP_MD *digest, int keylen, unsigned char *out) +{ + EVP_KDF_CTX *kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2); + if (kctx == NULL) + return 0; + PKCS5_PBKDF2_HMAC_internal(pass, passlen, salt, saltlen, iter, digest, keylen, out, kctx); + int ret = fips_sli_is_approved_EVP_KDF_CTX(kctx); + EVP_KDF_CTX_free(kctx); + return ret; +} + int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, int keylen, unsigned char *out) --- a/crypto/evp/p_open.c +++ b/crypto/evp/p_open.c @@ -8,6 +8,7 @@ */ #include "internal/cryptlib.h" +#include "internal/fips_sli_local.h" #ifdef OPENSSL_NO_RSA NON_EMPTY_TRANSLATION_UNIT #else @@ -47,6 +48,8 @@ int EVP_OpenInit(EVP_CIPHER_CTX *ctx, co goto err; } + // EVP_PKEY_decrypt_old always uses RSA dec + fips_sli_disapprove_EVP_CIPHER_CTX(ctx); i = EVP_PKEY_decrypt_old(key, ek, ekl, priv); if ((i <= 0) || !EVP_CIPHER_CTX_set_key_length(ctx, i)) { /* ERROR */ --- a/crypto/evp/p_seal.c +++ b/crypto/evp/p_seal.c @@ -9,6 +9,7 @@ #include <stdio.h> #include "internal/cryptlib.h" +#include "internal/fips_sli_local.h" #include <openssl/rand.h> #include <openssl/rsa.h> #include <openssl/evp.h> @@ -44,6 +45,8 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, co ekl[i] = EVP_PKEY_encrypt_old(ek[i], key, EVP_CIPHER_CTX_key_length(ctx), pubk[i]); + // EVP_PKEY_encrypt_old always uses RSA encryption + fips_sli_disapprove_EVP_CIPHER_CTX(ctx); if (ekl[i] <= 0) { rv = -1; goto err; --- a/crypto/evp/p_sign.c +++ b/crypto/evp/p_sign.c @@ -23,6 +23,8 @@ int EVP_SignFinal(EVP_MD_CTX *ctx, unsig size_t sltmp; EVP_PKEY_CTX *pkctx = NULL; + fips_sli_check_hash_sigver_EVP_MD_CTX(ctx, EVP_MD_CTX_md(ctx)); + *siglen = 0; if (EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_FINALISE)) { if (!EVP_DigestFinal_ex(ctx, m, &m_len)) @@ -37,6 +39,7 @@ int EVP_SignFinal(EVP_MD_CTX *ctx, unsig rv = EVP_MD_CTX_copy_ex(tmp_ctx, ctx); if (rv) rv = EVP_DigestFinal_ex(tmp_ctx, m, &m_len); + EVP_MD_CTX_free(tmp_ctx); if (!rv) return 0; @@ -53,6 +56,8 @@ int EVP_SignFinal(EVP_MD_CTX *ctx, unsig goto err; if (EVP_PKEY_sign(pkctx, sigret, &sltmp, m, m_len) <= 0) goto err; + if (!fips_sli_is_approved_EVP_PKEY_CTX(pkctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); *siglen = sltmp; i = 1; err: --- a/crypto/evp/p_verify.c +++ b/crypto/evp/p_verify.c @@ -22,6 +22,8 @@ int EVP_VerifyFinal(EVP_MD_CTX *ctx, con int i = 0; EVP_PKEY_CTX *pkctx = NULL; + fips_sli_check_hash_sigver_EVP_MD_CTX(ctx, EVP_MD_CTX_md(ctx)); + if (EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_FINALISE)) { if (!EVP_DigestFinal_ex(ctx, m, &m_len)) goto err; @@ -49,6 +51,8 @@ int EVP_VerifyFinal(EVP_MD_CTX *ctx, con if (EVP_PKEY_CTX_set_signature_md(pkctx, EVP_MD_CTX_md(ctx)) <= 0) goto err; i = EVP_PKEY_verify(pkctx, sigbuf, siglen, m, m_len); + if (!fips_sli_is_approved_EVP_PKEY_CTX(pkctx)) + fips_sli_disapprove_EVP_MD_CTX(ctx); err: EVP_PKEY_CTX_free(pkctx); return i; --- a/crypto/evp/pkey_kdf.c +++ b/crypto/evp/pkey_kdf.c @@ -158,7 +158,10 @@ static int pkey_kdf_derive(EVP_PKEY_CTX if (key == NULL) return 1; } - return EVP_KDF_derive(kctx, key, *keylen); + int ret = EVP_KDF_derive(kctx, key, *keylen); + if (!fips_sli_is_approved_EVP_KDF_CTX(kctx)) + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + return ret; } #ifndef OPENSSL_NO_SCRYPT --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -162,6 +162,7 @@ static EVP_PKEY_CTX *int_ctx_new(EVP_PKE EVPerr(EVP_F_INT_CTX_NEW, ERR_R_MALLOC_FAILURE); return NULL; } + ret->sli = FIPS_UNSET; ret->engine = e; ret->pmeth = pmeth; ret->operation = EVP_PKEY_OP_UNDEFINED; @@ -299,6 +300,7 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_ rctx->data = NULL; rctx->app_data = NULL; rctx->operation = pctx->operation; + rctx->sli = pctx->sli; if (pctx->pmeth->copy(rctx, pctx) > 0) return rctx; --- a/crypto/fips/build.info +++ b/crypto/fips/build.info @@ -5,7 +5,7 @@ SOURCE[../../libcrypto]=\ fips_post.c drbgtest.c fips_drbg_ctr.c fips_drbg_hash.c fips_drbg_hmac.c \ fips_drbg_lib.c fips_drbg_rand.c fips_drbg_selftest.c fips_rand_lib.c \ fips_cmac_selftest.c fips_ecdh_selftest.c fips_ecdsa_selftest.c \ - fips_dh_selftest.c fips_kdf_selftest.c fips_ers.c + fips_dh_selftest.c fips_kdf_selftest.c fips_ers.c fips_sli.c PROGRAMS=\ fips_standalone_hmac --- /dev/null +++ b/crypto/fips/fips_sli.c @@ -0,0 +1,371 @@ +#include <openssl/dsa.h> +#include <openssl/ec.h> +#include <openssl/rsa.h> +#include "crypto/evp.h" +#include "../evp/evp_local.h" +#include "../hmac/hmac_local.h" +#include "internal/fips_sli_local.h" + +/* Main part of the FIPS Service Level Indicator + If you want to quickly change its behaviour, you most likely want to start here + - beware of some exceptions, though... */ + +FIPS_STATUS fips_sli_fsm_transition(FIPS_STATUS state, FIPS_STATUS input) { + switch (state) { + case FIPS_UNSET: + switch (input) { + case FIPS_UNSET: /* ignore */ + return state; + case FIPS_APPROVED: + case FIPS_NONAPPROVED: + case FIPS_ERROR: + return input; + } + break; + case FIPS_APPROVED: + switch (input) { + case FIPS_UNSET: /* ignore */ + case FIPS_APPROVED: + return state; + case FIPS_NONAPPROVED: + case FIPS_ERROR: + return input; + } + break; + case FIPS_NONAPPROVED: + return state; + case FIPS_ERROR: + switch (input) { + case FIPS_UNSET: /* ignore */ + case FIPS_APPROVED: + case FIPS_ERROR: + return state; + case FIPS_NONAPPROVED: + return input; + } + } + abort(); +} + +fips_sli_define_for(EVP_CIPHER_CTX) +fips_sli_define_for(EVP_KDF_CTX) +fips_sli_define_for(EVP_MD_CTX) +fips_sli_define_for(EVP_PKEY_CTX) +fips_sli_define_for(HMAC_CTX) + +typedef enum curve_usage_e { + CURVE_KEYGEN, + CURVE_SIGGEN, + CURVE_SIGVER, + CURVE_DH +} CURVE_USAGE; + +/* Check whether a curve is okay for some type of usage */ +static FIPS_STATUS get_fips_curve_status(const EC_GROUP *group, CURVE_USAGE u) { + if (group == NULL) { + return FIPS_ERROR; + } + + switch (u) { + case CURVE_KEYGEN: + switch (EC_GROUP_get_curve_name(group)) { + /* ACVP-tested curves for keygen: */ + case NID_secp224r1: + /* SECG secp256r1 is the same as X9.62 prime256v1 (P-256) and hence omitted */ + case NID_X9_62_prime256v1: + case NID_secp384r1: + case NID_secp521r1: + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + case CURVE_SIGVER: + switch (EC_GROUP_get_curve_name(group)) { + case NID_X9_62_prime192v1: /* NIST P-192 */ + case NID_secp224r1: + /* SECG secp256r1 is the same as X9.62 prime256v1 (P-256) and hence omitted */ + case NID_X9_62_prime256v1: + case NID_secp384r1: + case NID_secp521r1: + /* nist k curves */ + case NID_sect233k1: + case NID_sect283k1: + case NID_sect409k1: + case NID_sect571k1: + /* nist b curves */ + case NID_sect233r1: + case NID_sect283r1: + case NID_sect409r1: + case NID_sect571r1: + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + case CURVE_SIGGEN: + case CURVE_DH: + switch (EC_GROUP_get_curve_name(group)) { + /* see crypto/ec/ec_curve.c:2800 */ + /* nist P curves*/ + case NID_secp224r1: + /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */ + case NID_X9_62_prime256v1: + case NID_secp384r1: + case NID_secp521r1: + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + } + return FIPS_NONAPPROVED; +} + +#define make_fips_sli_check_curve(CTXTYPE, fn, usage) \ +void fips_sli_check_curve_##fn##_##CTXTYPE(CTXTYPE *ctx, const EC_GROUP *group)\ +{ \ + fips_sli_fsm_##CTXTYPE(ctx, get_fips_curve_status(group, usage)); \ +} + +make_fips_sli_check_curve(EVP_MD_CTX, siggen, CURVE_SIGGEN) +make_fips_sli_check_curve(EVP_MD_CTX, sigver, CURVE_SIGVER) +/* keygen missing because in this case we need more info than available here*/ +make_fips_sli_check_curve(EVP_PKEY_CTX, siggen, CURVE_SIGGEN) +make_fips_sli_check_curve(EVP_PKEY_CTX, sigver, CURVE_SIGVER) + +typedef enum hash_usage_e { + HASH_SIGGEN, + HASH_SIGVER, + HASH_KDF_SSHKDF, + HASH_KDF_PBKDF2, + HASH_KDF_TLS, + HASH_RNG, + HASH_MAC +} HASH_USAGE; + +static FIPS_STATUS get_fips_hash_status(const EVP_MD *md, HASH_USAGE u) { + if (md == NULL) { + return FIPS_ERROR; + } + + switch (u) { + case HASH_KDF_TLS: + switch (EVP_MD_type(md)) { + case NID_sha256: /* TLSv1.2 */ + case NID_sha384: + case NID_sha512: + case NID_md5_sha1: /* used in TLS v1.0 / v1.1 */ + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + case HASH_KDF_PBKDF2: + case HASH_KDF_SSHKDF: + case HASH_MAC: + switch (EVP_MD_type(md)) { + case NID_sha1: + case NID_sha224: + case NID_sha256: + case NID_sha384: + case NID_sha512: + case NID_sha512_224: + case NID_sha512_256: + case NID_sha3_224: + case NID_sha3_256: + case NID_sha3_384: + case NID_sha3_512: + case NID_shake128: + case NID_shake256: + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + case HASH_RNG: + case HASH_SIGGEN: + case HASH_SIGVER: + switch (EVP_MD_type(md)) { + case NID_sha224: + case NID_sha256: + case NID_sha384: + case NID_sha512: + case NID_sha512_224: + case NID_sha512_256: + case NID_sha3_224: + case NID_sha3_256: + case NID_sha3_384: + case NID_sha3_512: + case NID_shake128: + case NID_shake256: + return FIPS_APPROVED; + default: + return FIPS_NONAPPROVED; + } + } + return FIPS_ERROR; +} + +#define make_fips_sli_check_hash(CTXTYPE, fn, usage) \ +void fips_sli_check_hash_##fn##_##CTXTYPE(CTXTYPE *ctx, const EVP_MD *md) \ +{ \ + fips_sli_fsm_##CTXTYPE(ctx, get_fips_hash_status(md, usage)); \ +} + +make_fips_sli_check_hash(EVP_MD_CTX, siggen, HASH_SIGGEN) +make_fips_sli_check_hash(EVP_MD_CTX, sigver, HASH_SIGVER) +make_fips_sli_check_hash(EVP_PKEY_CTX, siggen, HASH_SIGGEN) +make_fips_sli_check_hash(EVP_PKEY_CTX, sigver, HASH_SIGVER) +make_fips_sli_check_hash(HMAC_CTX, mac, HASH_MAC) +/* KDF impl is a bit special - avoid changing everything just because of that */ +FIPS_STATUS fips_sli_get_hash_status_sshkdf(const EVP_MD * md) { + return get_fips_hash_status(md, HASH_KDF_SSHKDF); +} +FIPS_STATUS fips_sli_get_hash_status_pbkdf2(const EVP_MD * md) { + return get_fips_hash_status(md, HASH_KDF_PBKDF2); +} +FIPS_STATUS fips_sli_get_hash_status_kdf_tls1_prf(const EVP_MD * md) { + return get_fips_hash_status(md, HASH_KDF_TLS); +} + +FIPS_STATUS fips_sli_get_kdf_keylen_status(size_t keylen_bytes) { + if (keylen_bytes >= 112/8) + return FIPS_APPROVED; + else + return FIPS_NONAPPROVED; +} + +void fips_sli_check_key_rsa_keygen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa) { + fips_sli_check_key_rsa_siggen_EVP_PKEY_CTX(ctx, rsa); +} + +void fips_sli_check_key_rsa_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa) { + if (RSA_bits(rsa) >= 2048) + fips_sli_approve_EVP_PKEY_CTX(ctx); + else + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_rsa_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa) { + const int len_n = RSA_bits(rsa); + + if (1024 <= len_n && len_n < 2048) + fips_sli_approve_EVP_PKEY_CTX(ctx); // legacy use + else if (2048 <= len_n) + fips_sli_approve_EVP_PKEY_CTX(ctx); + else + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_rsa_enc_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa) { + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_rsa_dec_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa) { + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_dsa_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const DSA * dsa) { + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_dsa_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const DSA * dsa) { + fips_sli_disapprove_EVP_PKEY_CTX(ctx); +} + +void fips_sli_check_key_dh_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const DH *dh) { + switch (DH_get_nid(dh)) { + /* RFC 3526 */ + case NID_modp_2048: + case NID_modp_3072: + case NID_modp_4096: + case NID_modp_6144: + case NID_modp_8192: + /* RFC 7919 */ + case NID_ffdhe2048: + case NID_ffdhe3072: + case NID_ffdhe4096: + case NID_ffdhe6144: + case NID_ffdhe8192: + fips_sli_approve_EVP_PKEY_CTX(ctx); + break; + default: + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + } +} + +void fips_sli_check_key_ecdh_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const EC_KEY *ecdh) { + fips_sli_fsm_EVP_PKEY_CTX(ctx, get_fips_curve_status(EC_KEY_get0_group(ecdh), CURVE_DH)); +} + +void fips_sli_check_cipher_EVP_CIPHER_CTX(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher) { + fips_sli_fsm_EVP_CIPHER_CTX(ctx, EVP_CIPHER_get_fips_status(cipher)); +} + +/** According to FIPS PUB 186-5. + * Not really helpful because nist P curves are the only allowed curves for + * KeyGen, and have h=1 anyway - but allow for future extensibility */ +static FIPS_STATUS get_fips_keygen_ecdsa_order_status(const EC_KEY *ec) { + BN_CTX *ctx = BN_CTX_new(); + BIGNUM *pwr14, *pwr16, *pwr24, *pwr32; + const BIGNUM * cofactor = EC_GROUP_get0_cofactor(EC_KEY_get0_group(ec)); + const int n = EC_GROUP_order_bits(EC_KEY_get0_group(ec)); + FIPS_STATUS ret = FIPS_NONAPPROVED; + + if (ctx == NULL) { + ret = FIPS_ERROR; + goto end; + } + + BN_CTX_start(ctx); + pwr14 = BN_CTX_get(ctx); + pwr16 = BN_CTX_get(ctx); + pwr24 = BN_CTX_get(ctx); + pwr32 = BN_CTX_get(ctx); + if (pwr32 == NULL) { + /* Sufficient to check the return value of the last BN_CTX_get() */ + ret = FIPS_ERROR; + goto end; + } + BN_set_bit(pwr14, 14); + BN_set_bit(pwr16, 16); + BN_set_bit(pwr24, 24); + BN_set_bit(pwr32, 32); + + if (224 < n && n <= 255) { + if (BN_cmp(cofactor, pwr14) != 1) + ret = FIPS_APPROVED; + } else if (256 < n && n <= 383) { + if (BN_cmp(cofactor, pwr16) != 1) + ret = FIPS_APPROVED; + + } else if (384 < n && n <= 511) { + if (BN_cmp(cofactor, pwr24) != 1) + ret = FIPS_APPROVED; + + } else if (n >= 512) { + if (BN_cmp(cofactor, pwr32) != 1) + ret = FIPS_APPROVED; + } + +end: + BN_CTX_end(ctx); + BN_CTX_free(ctx); + return ret; +} + +void fips_sli_check_key_ec_keygen_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, + const EC_KEY *ec) { + fips_sli_fsm_EVP_PKEY_CTX(ctx, get_fips_curve_status( + EC_KEY_get0_group(ec), CURVE_KEYGEN)); + fips_sli_fsm_EVP_PKEY_CTX(ctx, get_fips_keygen_ecdsa_order_status(ec)); +} + +/* MINOR: refactor for sign/verify, too. See crypto/rsa/rsa_pmeth.c */ +static FIPS_STATUS get_fips_padding_rsa_encdec_status(int pad_mode/*,usg: enc/dec*/) { + return FIPS_NONAPPROVED; +} + +void fips_sli_check_padding_rsa_enc_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, int pad_mode) { + fips_sli_fsm_EVP_PKEY_CTX(ctx, get_fips_padding_rsa_encdec_status(pad_mode)); +} + +void fips_sli_check_padding_rsa_dec_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, int pad_mode) { + fips_sli_check_padding_rsa_enc_EVP_PKEY_CTX(ctx, pad_mode); +} --- a/crypto/hmac/hm_pmeth.c +++ b/crypto/hmac/hm_pmeth.c @@ -128,8 +128,11 @@ static int hmac_signctx(EVP_PKEY_CTX *ct if (!sig) return 1; - if (!HMAC_Final(hctx->ctx, sig, &hlen)) + if (!HMAC_Final(hctx->ctx, sig, &hlen)) { + if (!fips_sli_is_approved_HMAC_CTX(hctx->ctx)) + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return 0; + } *siglen = (size_t)hlen; return 1; } --- a/crypto/hmac/hmac.c +++ b/crypto/hmac/hmac.c @@ -23,6 +23,7 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const vo unsigned char pad[HMAC_MAX_MD_CBLOCK_SIZE]; unsigned int keytmp_length; unsigned char keytmp[HMAC_MAX_MD_CBLOCK_SIZE]; + ctx->sli = FIPS_UNSET; /* If we are changing MD then we must have a key */ if (md != NULL && md != ctx->md && (key == NULL || len < 0)) @@ -83,9 +84,17 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const vo if (!EVP_DigestInit_ex(ctx->o_ctx, md, impl) || !EVP_DigestUpdate(ctx->o_ctx, pad, EVP_MD_block_size(md))) goto err; + ctx->sli_key_len = len; } if (!EVP_MD_CTX_copy_ex(ctx->md_ctx, ctx->i_ctx)) goto err; + /* On reuse, key/key_len might be NULL. Use cached value. */ + if (ctx->sli_key_len >= 112/8) { + fips_sli_approve_HMAC_CTX(ctx); + } else { + fips_sli_disapprove_HMAC_CTX(ctx); + } + fips_sli_check_hash_mac_HMAC_CTX(ctx, md); rv = 1; err: if (reset) { @@ -190,6 +199,7 @@ static int hmac_ctx_alloc_mds(HMAC_CTX * int HMAC_CTX_reset(HMAC_CTX *ctx) { + ctx->sli = FIPS_UNSET; hmac_ctx_cleanup(ctx); if (!hmac_ctx_alloc_mds(ctx)) { hmac_ctx_cleanup(ctx); @@ -209,24 +219,22 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_C if (!EVP_MD_CTX_copy_ex(dctx->md_ctx, sctx->md_ctx)) goto err; dctx->md = sctx->md; + dctx->sli = sctx->sli; return 1; err: hmac_ctx_cleanup(dctx); return 0; } -unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len, +static unsigned char *HMAC_internal(const EVP_MD *evp_md, const void *key, int key_len, const unsigned char *d, size_t n, unsigned char *md, - unsigned int *md_len) + unsigned int *md_len, HMAC_CTX *c) { - HMAC_CTX *c = NULL; static unsigned char m[EVP_MAX_MD_SIZE]; static const unsigned char dummy_key[1] = {'\0'}; if (md == NULL) md = m; - if ((c = HMAC_CTX_new()) == NULL) - goto err; /* For HMAC_Init_ex, NULL key signals reuse. */ if (key == NULL && key_len == 0) { @@ -239,13 +247,40 @@ unsigned char *HMAC(const EVP_MD *evp_md goto err; if (!HMAC_Final(c, md, md_len)) goto err; - HMAC_CTX_free(c); return md; err: - HMAC_CTX_free(c); return NULL; } +unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len, + const unsigned char *d, size_t n, unsigned char *md, + unsigned int *md_len) +{ + HMAC_CTX *c = HMAC_CTX_new(); + unsigned char *ret = NULL; + if (c == NULL) + goto err; + ret = HMAC_internal(evp_md, key, key_len, d, n, md, md_len, c); + HMAC_CTX_free(c); + err: + return ret; +} + +int fips_sli_HMAC_is_approved(const EVP_MD *evp_md, const void *key, int key_len, + const unsigned char *d, size_t n, unsigned char *md, + unsigned int *md_len) +{ + HMAC_CTX *c = HMAC_CTX_new(); + int ret = 0; + if (c == NULL) + goto err; + HMAC_internal(evp_md, key, key_len, d, n, md, md_len, c); + ret = fips_sli_is_approved_HMAC_CTX(c); + HMAC_CTX_free(c); + err: + return ret; +} + void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags) { EVP_MD_CTX_set_flags(ctx->i_ctx, flags); --- a/crypto/hmac/hmac_local.h +++ b/crypto/hmac/hmac_local.h @@ -10,6 +10,8 @@ #ifndef OSSL_CRYPTO_HMAC_LOCAL_H # define OSSL_CRYPTO_HMAC_LOCAL_H +#include "internal/fips_sli_local.h" + /* The current largest case is for SHA3-224 */ #define HMAC_MAX_MD_CBLOCK_SIZE 144 @@ -18,6 +20,8 @@ struct hmac_ctx_st { EVP_MD_CTX *md_ctx; EVP_MD_CTX *i_ctx; EVP_MD_CTX *o_ctx; + FIPS_STATUS sli; /* Service Level Indicator */ + size_t sli_key_len; /* SLI needs to cache keylen in case of context reuse */ }; #endif --- a/crypto/kdf/hkdf.c +++ b/crypto/kdf/hkdf.c @@ -222,6 +222,11 @@ static int kdf_hkdf_derive(EVP_KDF_IMPL } } +static int kdf_hkdf_fips_sli_is_approved(ossl_unused const EVP_KDF_IMPL *impl) { + return 0; /* can't check whether this is only used for DH / TLS1.3 because + this is handled by the application. Thus label HKDF as non-approved. */ +} + const EVP_KDF_METHOD hkdf_kdf_meth = { EVP_KDF_HKDF, kdf_hkdf_new, @@ -230,7 +235,8 @@ const EVP_KDF_METHOD hkdf_kdf_meth = { kdf_hkdf_ctrl, kdf_hkdf_ctrl_str, kdf_hkdf_size, - kdf_hkdf_derive + kdf_hkdf_derive, + kdf_hkdf_fips_sli_is_approved }; static int HKDF(const EVP_MD *evp_md, --- a/crypto/kdf/pbkdf2.c +++ b/crypto/kdf/pbkdf2.c @@ -31,8 +31,16 @@ struct evp_kdf_impl_st { size_t salt_len; int iter; const EVP_MD *md; + FIPS_STATUS sli; /* Service Level Indicator */ }; +static ossl_unused int fips_sli_is_approved_struct_evp_kdf_impl_st(const struct evp_kdf_impl_st *ctx); +fips_sli_define_basic_for(static, struct_evp_kdf_impl_st, struct evp_kdf_impl_st) + +static void fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(struct evp_kdf_impl_st *ctx) { + fips_sli_fsm_struct_evp_kdf_impl_st(ctx, fips_sli_get_hash_status_pbkdf2(ctx->md)); +} + static EVP_KDF_IMPL *kdf_pbkdf2_new(void) { EVP_KDF_IMPL *impl; @@ -64,6 +72,7 @@ static void kdf_pbkdf2_init(EVP_KDF_IMPL { impl->iter = PKCS5_DEFAULT_ITER; impl->md = EVP_sha1(); + impl->sli = FIPS_UNSET; } static int pbkdf2_set_membuf(unsigned char **buffer, size_t *buflen, @@ -175,6 +184,8 @@ static int kdf_pbkdf2_derive(EVP_KDF_IMP return 0; } + fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(impl); + return pkcs5_pbkdf2_alg((char *)impl->pass, impl->pass_len, impl->salt, impl->salt_len, impl->iter, impl->md, key, keylen); @@ -188,7 +199,8 @@ const EVP_KDF_METHOD pbkdf2_kdf_meth = { kdf_pbkdf2_ctrl, kdf_pbkdf2_ctrl_str, NULL, - kdf_pbkdf2_derive + kdf_pbkdf2_derive, + fips_sli_is_approved_struct_evp_kdf_impl_st }; /* --- a/crypto/kdf/scrypt.c +++ b/crypto/kdf/scrypt.c @@ -266,6 +266,10 @@ static int kdf_scrypt_derive(EVP_KDF_IMP impl->maxmem_bytes, key, keylen); } +static int kdf_scrypt_fips_sli_is_approved(ossl_unused const EVP_KDF_IMPL *impl) { + return 0; /* not FIPS-approved */ +} + const EVP_KDF_METHOD scrypt_kdf_meth = { EVP_KDF_SCRYPT, kdf_scrypt_new, @@ -274,7 +278,8 @@ const EVP_KDF_METHOD scrypt_kdf_meth = { kdf_scrypt_ctrl, kdf_scrypt_ctrl_str, NULL, - kdf_scrypt_derive + kdf_scrypt_derive, + kdf_scrypt_fips_sli_is_approved }; #define R(a,b) (((a) << (b)) | ((a) >> (32 - (b)))) --- a/crypto/kdf/sshkdf.c +++ b/crypto/kdf/sshkdf.c @@ -34,8 +34,19 @@ struct evp_kdf_impl_st { char type; /* X */ unsigned char *session_id; size_t session_id_len; + FIPS_STATUS sli; /* Service Level Indicator */ }; + +fips_sli_define_basic_for(static, struct_evp_kdf_impl_st, struct evp_kdf_impl_st) + +static void fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(struct evp_kdf_impl_st *ctx) { + fips_sli_fsm_struct_evp_kdf_impl_st(ctx, + fips_sli_get_hash_status_sshkdf(ctx->md)); + fips_sli_fsm_struct_evp_kdf_impl_st(ctx, + fips_sli_get_kdf_keylen_status(ctx->key_len)); +} + static EVP_KDF_IMPL *kdf_sshkdf_new(void) { EVP_KDF_IMPL *impl; @@ -196,6 +207,7 @@ static int kdf_sshkdf_derive(EVP_KDF_IMP KDFerr(KDF_F_KDF_SSHKDF_DERIVE, KDF_R_MISSING_TYPE); return 0; } + fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(impl); return SSHKDF(impl->md, impl->key, impl->key_len, impl->xcghash, impl->xcghash_len, impl->session_id, impl->session_id_len, @@ -211,6 +223,7 @@ const EVP_KDF_METHOD sshkdf_kdf_meth = { kdf_sshkdf_ctrl_str, kdf_sshkdf_size, kdf_sshkdf_derive, + fips_sli_is_approved_struct_evp_kdf_impl_st }; static int SSHKDF(const EVP_MD *evp_md, --- a/crypto/kdf/tls1_prf.c +++ b/crypto/kdf/tls1_prf.c @@ -35,8 +35,16 @@ struct evp_kdf_impl_st { /* Buffer of concatenated seed data */ unsigned char seed[TLS1_PRF_MAXBUF]; size_t seedlen; + FIPS_STATUS sli; /* Service Level Indicator */ }; +fips_sli_define_basic_for(static, struct_evp_kdf_impl_st, struct evp_kdf_impl_st) + +static void fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(struct evp_kdf_impl_st *ctx) { + fips_sli_fsm_struct_evp_kdf_impl_st(ctx, + fips_sli_get_hash_status_kdf_tls1_prf(ctx->md)); +} + static EVP_KDF_IMPL *kdf_tls1_prf_new(void) { EVP_KDF_IMPL *impl; @@ -152,6 +160,7 @@ static int kdf_tls1_prf_derive(EVP_KDF_I KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_SEED); return 0; } + fips_sli_check_hash_kdf_struct_evp_kdf_impl_st(impl); return tls1_prf_alg(impl->md, impl->sec, impl->seclen, impl->seed, impl->seedlen, key, keylen); @@ -165,7 +174,8 @@ const EVP_KDF_METHOD tls1_prf_kdf_meth = kdf_tls1_prf_ctrl, kdf_tls1_prf_ctrl_str, NULL, - kdf_tls1_prf_derive + kdf_tls1_prf_derive, + fips_sli_is_approved_struct_evp_kdf_impl_st }; static int tls1_prf_P_hash(const EVP_MD *md, --- a/crypto/poly1305/poly1305_pmeth.c +++ b/crypto/poly1305/poly1305_pmeth.c @@ -108,8 +108,10 @@ static int poly1305_signctx(EVP_PKEY_CTX POLY1305_PKEY_CTX *pctx = ctx->data; *siglen = POLY1305_DIGEST_SIZE; - if (sig != NULL) + if (sig != NULL) { Poly1305_Final(&pctx->ctx, sig); + fips_sli_disapprove_EVP_PKEY_CTX(ctx); // Poly1305 isn't an approved MAC + } return 1; } --- a/crypto/rand/rand_lib.c +++ b/crypto/rand/rand_lib.c @@ -937,6 +937,13 @@ int RAND_priv_bytes(unsigned char *buf, return 0; } +int fips_sli_RAND_priv_bytes_is_approved(unsigned char *buf, int num) { + const RAND_METHOD *meth = RAND_get_rand_method(); + if (meth != NULL && meth != RAND_OpenSSL()) + return 0; + return 1; +} + int RAND_bytes(unsigned char *buf, int num) { const RAND_METHOD *meth = RAND_get_rand_method(); @@ -947,6 +954,11 @@ int RAND_bytes(unsigned char *buf, int n return -1; } +int fips_sli_RAND_bytes_is_approved(unsigned char *buf, int num) { + const RAND_METHOD *meth = RAND_get_rand_method(); + return meth == RAND_OpenSSL(); +} + #if OPENSSL_API_COMPAT < 0x10100000L int RAND_pseudo_bytes(unsigned char *buf, int num) { --- a/crypto/rsa/rsa_pmeth.c +++ b/crypto/rsa/rsa_pmeth.c @@ -129,6 +129,7 @@ static int pkey_rsa_sign(EVP_PKEY_CTX *c RSA_PKEY_CTX *rctx = ctx->data; RSA *rsa = ctx->pkey->pkey.rsa; + fips_sli_check_key_rsa_siggen_EVP_PKEY_CTX(ctx, rsa); if (rctx->md) { if (tbslen != (size_t)EVP_MD_size(rctx->md)) { RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH); @@ -139,6 +140,8 @@ static int pkey_rsa_sign(EVP_PKEY_CTX *c unsigned int sltmp; if (rctx->pad_mode != RSA_PKCS1_PADDING) return -1; + /* PKCS1-v1.5 padding is disallowed after 2023 */ + fips_sli_disapprove_EVP_PKEY_CTX(ctx); ret = RSA_sign_ASN1_OCTET_STRING(0, tbs, tbslen, sig, &sltmp, rsa); @@ -154,11 +157,30 @@ static int pkey_rsa_sign(EVP_PKEY_CTX *c RSAerr(RSA_F_PKEY_RSA_SIGN, ERR_R_MALLOC_FAILURE); return -1; } + /* MINOR fips: refactor out? May have to read rctx->pad_mode (RSA_PKEY_CTX), though */ + /* ANSI X9.31 */ + switch (EVP_MD_type(rctx->md)) { + case NID_sha256: + case NID_sha384: + case NID_sha512: + case NID_sha3_224: + case NID_sha3_256: + case NID_sha3_384: + case NID_sha3_512: + case NID_shake128: + case NID_shake256: + fips_sli_approve_EVP_PKEY_CTX(ctx); + break; + default: + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + } memcpy(rctx->tbuf, tbs, tbslen); rctx->tbuf[tbslen] = RSA_X931_hash_id(EVP_MD_type(rctx->md)); ret = RSA_private_encrypt(tbslen + 1, rctx->tbuf, sig, rsa, RSA_X931_PADDING); } else if (rctx->pad_mode == RSA_PKCS1_PADDING) { + /* PKCS1-v1.5 padding is disallowed after 2023 */ + fips_sli_disapprove_EVP_PKEY_CTX(ctx); unsigned int sltmp; ret = RSA_sign(EVP_MD_type(rctx->md), tbs, tbslen, sig, &sltmp, rsa); @@ -173,12 +195,14 @@ static int pkey_rsa_sign(EVP_PKEY_CTX *c rctx->md, rctx->mgf1md, rctx->saltlen)) return -1; + fips_sli_check_hash_siggen_EVP_PKEY_CTX(ctx, rctx->md); ret = RSA_private_encrypt(RSA_size(rsa), rctx->tbuf, sig, rsa, RSA_NO_PADDING); } else { return -1; } } else { + fips_sli_approve_EVP_PKEY_CTX(ctx); /* plain sig without hash */ ret = RSA_private_encrypt(tbslen, tbs, sig, ctx->pkey->pkey.rsa, rctx->pad_mode); } @@ -199,6 +223,23 @@ static int pkey_rsa_verifyrecover(EVP_PK if (rctx->pad_mode == RSA_X931_PADDING) { if (!setup_tbuf(rctx, ctx)) return -1; + /* MINOR fips: refactor out? May have to read rctx->pad_mode (RSA_PKEY_CTX), though */ + /* ANSI X9.31 */ + switch (EVP_MD_type(rctx->md)) { + case NID_sha256: + case NID_sha384: + case NID_sha512: + case NID_sha3_224: + case NID_sha3_256: + case NID_sha3_384: + case NID_sha3_512: + case NID_shake128: + case NID_shake256: + fips_sli_approve_EVP_PKEY_CTX(ctx); + break; + default: + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + } ret = RSA_public_decrypt(siglen, sig, rctx->tbuf, ctx->pkey->pkey.rsa, RSA_X931_PADDING); @@ -245,11 +286,15 @@ static int pkey_rsa_verify(EVP_PKEY_CTX RSA_PKEY_CTX *rctx = ctx->data; RSA *rsa = ctx->pkey->pkey.rsa; size_t rslen; + fips_sli_check_key_rsa_sigver_EVP_PKEY_CTX(ctx, rsa); if (rctx->md) { - if (rctx->pad_mode == RSA_PKCS1_PADDING) + if (rctx->pad_mode == RSA_PKCS1_PADDING) { + /* PKCS1-v1.5 padding is disallowed after 2023 */ + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen, sig, siglen, rsa); + } if (tbslen != (size_t)EVP_MD_size(rctx->md)) { RSAerr(RSA_F_PKEY_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH); return -1; @@ -270,6 +315,7 @@ static int pkey_rsa_verify(EVP_PKEY_CTX rctx->tbuf, rctx->saltlen); if (ret <= 0) return 0; + fips_sli_check_hash_sigver_EVP_PKEY_CTX(ctx, rctx->md); return 1; } else { return -1; @@ -277,6 +323,7 @@ static int pkey_rsa_verify(EVP_PKEY_CTX } else { if (!setup_tbuf(rctx, ctx)) return -1; + fips_sli_approve_EVP_PKEY_CTX(ctx); /* plain sig without hash */ rslen = RSA_public_decrypt(siglen, sig, rctx->tbuf, rsa, rctx->pad_mode); if (rslen == 0) @@ -313,6 +360,8 @@ static int pkey_rsa_encrypt(EVP_PKEY_CTX ret = RSA_public_encrypt(inlen, in, out, ctx->pkey->pkey.rsa, rctx->pad_mode); } + fips_sli_check_padding_rsa_enc_EVP_PKEY_CTX(ctx, rctx->pad_mode); + fips_sli_check_key_rsa_enc_EVP_PKEY_CTX(ctx, ctx->pkey->pkey.rsa); if (ret < 0) return ret; *outlen = ret; @@ -342,6 +391,8 @@ static int pkey_rsa_decrypt(EVP_PKEY_CTX ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa, rctx->pad_mode); } + fips_sli_check_padding_rsa_dec_EVP_PKEY_CTX(ctx, rctx->pad_mode); + fips_sli_check_key_rsa_dec_EVP_PKEY_CTX(ctx, ctx->pkey->pkey.rsa); *outlen = constant_time_select_s(constant_time_msb_s(ret), *outlen, ret); ret = constant_time_select_int(constant_time_msb(ret), ret, 1); return ret; @@ -747,9 +798,13 @@ static int pkey_rsa_keygen(EVP_PKEY_CTX RSA_free(rsa); return 0; } - if (ret > 0) + if (rctx->primes != 2) + fips_sli_disapprove_EVP_PKEY_CTX(ctx); + + if (ret > 0) { + fips_sli_check_key_rsa_keygen_EVP_PKEY_CTX(ctx, rsa); EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, rsa); - else + } else RSA_free(rsa); return ret; } --- a/crypto/sha/sha1_one.c +++ b/crypto/sha/sha1_one.c @@ -26,3 +26,8 @@ unsigned char *SHA1(const unsigned char OPENSSL_cleanse(&c, sizeof(c)); return md; } + +int fips_sli_SHA1_is_approved(const unsigned char *d, size_t n, unsigned char *md) { + /* Only approved depending on usage context, so default to false */ + return 0; +} --- a/crypto/siphash/siphash_pmeth.c +++ b/crypto/siphash/siphash_pmeth.c @@ -109,8 +109,10 @@ static int siphash_signctx(EVP_PKEY_CTX SIPHASH_PKEY_CTX *pctx = ctx->data; *siglen = SipHash_hash_size(&pctx->ctx); - if (sig != NULL) + if (sig != NULL) { + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return SipHash_Final(&pctx->ctx, sig, *siglen); + } return 1; } --- a/crypto/sm2/sm2_pmeth.c +++ b/crypto/sm2/sm2_pmeth.c @@ -107,6 +107,7 @@ static int pkey_sm2_sign(EVP_PKEY_CTX *c return 0; } + fips_sli_disapprove_EVP_PKEY_CTX(ctx); ret = sm2_sign(tbs, tbslen, sig, &sltmp, ec); if (ret <= 0) @@ -120,7 +121,7 @@ static int pkey_sm2_verify(EVP_PKEY_CTX const unsigned char *tbs, size_t tbslen) { EC_KEY *ec = ctx->pkey->pkey.ec; - + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return sm2_verify(tbs, tbslen, sig, siglen, ec); } @@ -139,6 +140,7 @@ static int pkey_sm2_encrypt(EVP_PKEY_CTX return 1; } + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return sm2_encrypt(ec, md, in, inlen, out, outlen); } @@ -157,6 +159,7 @@ static int pkey_sm2_decrypt(EVP_PKEY_CTX return 1; } + fips_sli_disapprove_EVP_PKEY_CTX(ctx); return sm2_decrypt(ec, md, in, inlen, out, outlen); } --- /dev/null +++ b/doc/man3/FIPS_service_level_indicator.pod @@ -0,0 +1,110 @@ +=pod + +=head1 NAME + +C<int fips_sli_is_approved_*_CTX> - get status of the FIPS Service Level Indicator (SLI) for context operations + +C<int fips_sli_*_is_approved> - get status of the FIPS SLI for standalone operations + +=head1 SYNOPSIS + + #include <openssl/fips_sli.h> + + int fips_sli_is_approved_EVP_CIPHER_CTX(const EVP_CIPHER_CTX *ctx); + + int fips_sli_is_approved_EVP_KDF_CTX(const EVP_KDF_CTX *ctx); + + int fips_sli_is_approved_EVP_MD_CTX(const EVP_MD_CTX *ctx); + + int fips_sli_is_approved_EVP_PKEY_CTX(const EVP_PKEY_CTX *ctx); + + int fips_sli_is_approved_CMAC_CTX(const CMAC_CTX *ctx); + + int fips_sli_is_approved_HMAC_CTX(const HMAC_CTX *ctx); + + int fips_sli_SHA1_is_approved(const unsigned char *d, size_t n, unsigned char *md); + + int fips_sli_HMAC_is_approved(const EVP_MD *evp_md, const void *key, int key_len, + const unsigned char *d, size_t n, unsigned char *md, + unsigned int *md_len); + + int fips_sli_PKCS5_PBKDF2_HMAC_is_approved(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, + const EVP_MD *digest, int keylen, unsigned char *out); + + int fips_sli_RAND_bytes_is_approved(unsigned char *buf, int num); + + int fips_sli_RAND_priv_bytes_is_approved(unsigned char *buf, int num); + +=head1 DESCRIPTION + +The service level indicator has two different usage scenarios. + +=over 1 + +=item C<int fips_sli_is_approved_*_CTX(...)> + +Most operations happen on some form of a context, which also holds the SLI. +This function returns whether the FIPS SLI indicates an approved operation or not. + +After a disapproved operation is encountered, the SLI will continue to indicate this disapproved state. The SLI can only +be reset by the various existing resetting functions such as C<EVP_MD_CTX_reset(EVP_MD_CTX *ctx)> or reinitializing the +context, e.g. via L<EVP_DigestInit(3)>. + +=item C<int fips_sli_*_is_approved(...)> + +Operations without a context (standalone functions) have a separate SLI with the name fips_sli_FNNAME_is_approved(). +These indicator functions take the same parameters as their corresponding operation +and may modify them just like their corresponding function might do. + +In order to check the SLI status of an operation C<FNNAME()>, the function +C<fips_sli_FNNAME_is_approved()> must be called with the same set of parameters as C<FNNAME()>. +Note that applications must check the return value of C<FNNAME()> according to its documentation B<as well as> the return value of the SLI (see below for L</RETURN VALUES>). +Both are orthogonal: the former reports about success and failure of C<FNNAME()>, and the latter whether a disapproved operation happened or not. +Well-behaving applications check for both. + +The following explicit indicators exist: + +C<int fips_sli_SHA1_is_approved(const unsigned char *d, size_t n, unsigned char *md);> + +C<int fips_sli_HMAC_is_approved(const EVP_MD *evp_md, const void *key, int key_len, const unsigned char *d, size_t n, unsigned char *md, unsigned int *md_len);> + +C<int fips_sli_PKCS5_PBKDF2_HMAC_is_approved(const char *pass, int passlen, const unsigned char *salt, int saltlen, int iter, const EVP_MD *digest, int keylen, unsigned char *out);> + +C<int fips_sli_RAND_bytes_is_approved(unsigned char *buf, int num);> + +C<int fips_sli_RAND_priv_bytes_is_approved(unsigned char *buf, int num);> + +=back + +=head1 Notes on the RNG + +OpenSSL 1.1.1l implements a CTR DRBG with AES 128/192/256 (defaults to AES-256). +See L<RAND_bytes(3)>/RAND_priv_bytes(). + +Swapping out OPENSSL's RNG implementation (e.g. via L<RAND_set_rand_method(3)>) is NOT allowed. + +=head1 RETURN VALUES + +C<fips_sli_is_approved_*_CTX()> returns 0 if the previous operation(s) was unapproved or B<ctx> was B<NULL>, and returns 1 +if the previous operation(s) were approved (or rather, no non-approved operations happened). + +C<fips_sli_*_is_approved()> returns 0 if an operation with a given set of parameters was unapproved, and returns 1 +if the operation is approved with the given set of parameters. + +These functions can be invoked at any time. + +=head1 HISTORY + +The FIPS SLI was added in OpenSSL 1.1.1.l. + +=head1 COPYRIGHT + +Copyright 2022 + +Licensed under the OpenSSL license (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L<https://www.openssl.org/source/license.html>. + +=cut --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -9,6 +9,7 @@ #include <openssl/evp.h> #include "internal/refcount.h" +#include "internal/fips_sli_local.h" /* * Don't free up md_ctx->pctx in EVP_MD_CTX_reset, use the reserved flag @@ -36,6 +37,7 @@ struct evp_pkey_ctx_st { /* implementation specific keygen data */ int *keygen_info; int keygen_info_count; + FIPS_STATUS sli; /* Service Level Indicator */ } /* EVP_PKEY_CTX */ ; #define EVP_PKEY_FLAG_DYNAMIC 1 @@ -123,6 +125,9 @@ typedef struct { int (*ctrl_str) (EVP_KDF_IMPL *impl, const char *type, const char *value); size_t (*size) (EVP_KDF_IMPL *impl); int (*derive) (EVP_KDF_IMPL *impl, unsigned char *key, size_t keylen); + /* KDFs are handled differently by the SLI because the EVP_KDF_IMPL, which + holds the required information, is defined implementation-dependent */ + int (*fips_sli_is_approved) (const EVP_KDF_IMPL *impl); } EVP_KDF_METHOD; extern const EVP_KDF_METHOD pbkdf2_kdf_meth; --- /dev/null +++ b/include/crypto/fipserr.h @@ -0,0 +1,121 @@ +/* + * Generated by util/mkerr.pl DO NOT EDIT + * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#ifndef HEADER_FIPSERR_H +# define HEADER_FIPSERR_H + +# include <openssl/symhacks.h> + +# ifdef __cplusplus +extern "C" +# endif +int ERR_load_FIPS_strings(void); + +/* + * FIPS function codes. + */ +# define FIPS_F_DRBG_RESEED 100 +# define FIPS_F_DSA_BUILTIN_PARAMGEN2 101 +# define FIPS_F_DSA_DO_SIGN 102 +# define FIPS_F_DSA_DO_VERIFY 103 +# define FIPS_F_ECDSA_SIMPLE_SIGN_SIG 104 +# define FIPS_F_ECDSA_SIMPLE_VERIFY_SIG 105 +# define FIPS_F_EVP_CIPHERINIT_EX 106 +# define FIPS_F_EVP_CIPHER_CTX_NEW 107 +# define FIPS_F_EVP_CIPHER_CTX_RESET 108 +# define FIPS_F_EVP_DIGESTINIT_EX 109 +# define FIPS_F_FIPS_CHECK_DSA 110 +# define FIPS_F_FIPS_CHECK_EC 111 +# define FIPS_F_FIPS_CHECK_RSA 112 +# define FIPS_F_FIPS_DRBG_BYTES 113 +# define FIPS_F_FIPS_DRBG_CHECK 114 +# define FIPS_F_FIPS_DRBG_ERROR_CHECK 115 +# define FIPS_F_FIPS_DRBG_GENERATE 116 +# define FIPS_F_FIPS_DRBG_INIT 117 +# define FIPS_F_FIPS_DRBG_INSTANTIATE 118 +# define FIPS_F_FIPS_DRBG_NEW 119 +# define FIPS_F_FIPS_DRBG_SINGLE_KAT 120 +# define FIPS_F_FIPS_GET_ENTROPY 121 +# define FIPS_F_FIPS_MODULE_MODE_SET 122 +# define FIPS_F_FIPS_PKEY_SIGNATURE_TEST 123 +# define FIPS_F_FIPS_RAND_BYTES 124 +# define FIPS_F_FIPS_RAND_SEED 125 +# define FIPS_F_FIPS_RAND_SET_METHOD 126 +# define FIPS_F_FIPS_RAND_STATUS 127 +# define FIPS_F_FIPS_RSA_BUILTIN_KEYGEN 128 +# define FIPS_F_FIPS_SELFTEST_AES 129 +# define FIPS_F_FIPS_SELFTEST_AES_CCM 130 +# define FIPS_F_FIPS_SELFTEST_AES_GCM 131 +# define FIPS_F_FIPS_SELFTEST_AES_XTS 132 +# define FIPS_F_FIPS_SELFTEST_CMAC 133 +# define FIPS_F_FIPS_SELFTEST_DES 134 +# define FIPS_F_FIPS_SELFTEST_ECDSA 135 +# define FIPS_F_FIPS_SELFTEST_HKDF 136 +# define FIPS_F_FIPS_SELFTEST_HMAC 137 +# define FIPS_F_FIPS_SELFTEST_PBKDF2 138 +# define FIPS_F_FIPS_SELFTEST_SHA1 139 +# define FIPS_F_FIPS_SELFTEST_SHA2 140 +# define FIPS_F_FIPS_SELFTEST_SHA3 141 +# define FIPS_F_FIPS_SELFTEST_SSH 142 +# define FIPS_F_FIPS_SELFTEST_TLS 143 +# define FIPS_F_OSSL_ECDH_COMPUTE_KEY 144 +# define FIPS_F_RSA_OSSL_PRIVATE_DECRYPT 145 +# define FIPS_F_RSA_OSSL_PRIVATE_ENCRYPT 146 +# define FIPS_F_RSA_OSSL_PUBLIC_DECRYPT 147 +# define FIPS_F_RSA_OSSL_PUBLIC_ENCRYPT 148 + +/* + * FIPS reason codes. + */ +# define FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED 100 +# define FIPS_R_ADDITIONAL_INPUT_TOO_LONG 101 +# define FIPS_R_ALREADY_INSTANTIATED 102 +# define FIPS_R_DRBG_NOT_INITIALISED 103 +# define FIPS_R_ENTROPY_ERROR_UNDETECTED 104 +# define FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED 105 +# define FIPS_R_ENTROPY_SOURCE_STUCK 106 +# define FIPS_R_ERROR_INITIALISING_DRBG 107 +# define FIPS_R_ERROR_INSTANTIATING_DRBG 108 +# define FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT 109 +# define FIPS_R_ERROR_RETRIEVING_ENTROPY 110 +# define FIPS_R_ERROR_RETRIEVING_NONCE 111 +# define FIPS_R_FINGERPRINT_DOES_NOT_MATCH 112 +# define FIPS_R_FIPS_MODE_ALREADY_SET 113 +# define FIPS_R_FIPS_SELFTEST_FAILED 114 +# define FIPS_R_FUNCTION_ERROR 115 +# define FIPS_R_GENERATE_ERROR 116 +# define FIPS_R_GENERATE_ERROR_UNDETECTED 117 +# define FIPS_R_INSTANTIATE_ERROR 118 +# define FIPS_R_INVALID_KEY_LENGTH 119 +# define FIPS_R_IN_ERROR_STATE 120 +# define FIPS_R_KEY_TOO_SHORT 121 +# define FIPS_R_NONCE_ERROR_UNDETECTED 122 +# define FIPS_R_NON_FIPS_METHOD 123 +# define FIPS_R_NOPR_TEST1_FAILURE 124 +# define FIPS_R_NOPR_TEST2_FAILURE 125 +# define FIPS_R_NOT_INSTANTIATED 126 +# define FIPS_R_PAIRWISE_TEST_FAILED 127 +# define FIPS_R_PERSONALISATION_ERROR_UNDETECTED 128 +# define FIPS_R_PERSONALISATION_STRING_TOO_LONG 129 +# define FIPS_R_PR_TEST1_FAILURE 130 +# define FIPS_R_PR_TEST2_FAILURE 131 +# define FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED 132 +# define FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG 133 +# define FIPS_R_RESEED_COUNTER_ERROR 134 +# define FIPS_R_RESEED_ERROR 135 +# define FIPS_R_SELFTEST_FAILED 136 +# define FIPS_R_SELFTEST_FAILURE 137 +# define FIPS_R_TEST_FAILURE 138 +# define FIPS_R_UNINSTANTIATE_ERROR 139 +# define FIPS_R_UNINSTANTIATE_ZEROISE_ERROR 140 +# define FIPS_R_UNSUPPORTED_DRBG_TYPE 141 +# define FIPS_R_UNSUPPORTED_PLATFORM 142 + +#endif --- /dev/null +++ b/include/internal/fips_sli_local.h @@ -0,0 +1,96 @@ +#ifndef FIPS_SLI_LOCAL_H_INCLUDED +#define FIPS_SLI_LOCAL_H_INCLUDED + +#include <openssl/cmac.h> +#include <openssl/ec.h> +#include <openssl/fips_sli.h> + +/* status for SLI */ +typedef enum fips_status_e { + FIPS_UNSET, + FIPS_APPROVED, + FIPS_NONAPPROVED, + FIPS_ERROR, +} FIPS_STATUS; + + +void fips_sli_approve_EVP_KDF_CTX(EVP_KDF_CTX *ctx); +void fips_sli_approve_EVP_MD_CTX(EVP_MD_CTX *ctx); +void fips_sli_approve_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx); +void fips_sli_approve_HMAC_CTX(HMAC_CTX *ctx); + +/* Unused: + * void fips_sli_approve_EVP_CIPHER_CTX(EVP_CIPHER_CTX *ctx); + */ +void fips_sli_disapprove_EVP_CIPHER_CTX(EVP_CIPHER_CTX *ctx); +void fips_sli_disapprove_EVP_KDF_CTX(EVP_KDF_CTX *ctx); +void fips_sli_disapprove_EVP_MD_CTX(EVP_MD_CTX *ctx); +void fips_sli_disapprove_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx); +void fips_sli_disapprove_HMAC_CTX(HMAC_CTX *ctx); + +//void fips_sli_error_EVP_KDF_CTX(EVP_KDF_CTX *ctx); /* unused */ +//void fips_sli_error_HMAC_CTX(HMAC_CTX *ctx); +//void fips_sli_error_EVP_CIPHER_CTX(EVP_CIPHER_CTX *ctx); +void fips_sli_error_EVP_MD_CTX(EVP_MD_CTX *ctx); +void fips_sli_error_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx); + +FIPS_STATUS fips_sli_fsm_transition(FIPS_STATUS state, FIPS_STATUS input); + +#define fips_sli_define_basic_for(LNKG, FNNAME, CTXTYPE) \ +static void fips_sli_fsm_##FNNAME(CTXTYPE *ctx, FIPS_STATUS input) { \ + if (ctx == NULL) \ + return; \ + ctx->sli = fips_sli_fsm_transition(ctx->sli, input); \ +} \ +LNKG int fips_sli_is_approved_##FNNAME(const CTXTYPE *ctx) { \ + if (ctx == NULL) \ + return 0; \ + return (ctx->sli == FIPS_UNSET) || (ctx->sli == FIPS_APPROVED); \ +} + +#define fips_sli_define_for(CTXTYPE) \ +fips_sli_define_basic_for(, CTXTYPE, CTXTYPE) \ +void fips_sli_approve_##CTXTYPE(CTXTYPE *ctx) { \ + fips_sli_fsm_##CTXTYPE(ctx, FIPS_APPROVED); \ +} \ +void fips_sli_disapprove_##CTXTYPE(CTXTYPE *ctx) { \ + fips_sli_fsm_##CTXTYPE(ctx, FIPS_NONAPPROVED); \ +} \ +void fips_sli_error_##CTXTYPE(CTXTYPE *ctx) { \ + fips_sli_fsm_##CTXTYPE(ctx, FIPS_ERROR); \ +} + +void fips_sli_check_hash_siggen_EVP_MD_CTX(EVP_MD_CTX * ctx, const EVP_MD * md); +void fips_sli_check_hash_sigver_EVP_MD_CTX(EVP_MD_CTX * ctx, const EVP_MD * md); +void fips_sli_check_hash_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const EVP_MD * md); +void fips_sli_check_hash_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const EVP_MD * md); +void fips_sli_check_hash_mac_HMAC_CTX(HMAC_CTX * ctx, const EVP_MD * md); + +FIPS_STATUS fips_sli_get_hash_status_sshkdf(const EVP_MD * md); +FIPS_STATUS fips_sli_get_hash_status_pbkdf2(const EVP_MD * md); +FIPS_STATUS fips_sli_get_hash_status_kdf_tls1_prf(const EVP_MD * md); +FIPS_STATUS fips_sli_get_kdf_keylen_status(size_t keylen_bytes); + +/* Check if used curve is okay for and in this context */ +void fips_sli_check_curve_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const EC_GROUP *group); +void fips_sli_check_curve_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const EC_GROUP *group); + +void fips_sli_check_key_ec_keygen_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const EC_KEY *ec); +void fips_sli_check_key_rsa_keygen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa); +void fips_sli_check_key_rsa_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa); +void fips_sli_check_key_rsa_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa); +void fips_sli_check_key_rsa_enc_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa); +void fips_sli_check_key_rsa_dec_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const RSA * rsa); +void fips_sli_check_key_dsa_siggen_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const DSA * dsa); +void fips_sli_check_key_dsa_sigver_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, const DSA * dsa); + +void fips_sli_check_key_dh_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const DH *dh); +void fips_sli_check_key_ecdh_EVP_PKEY_CTX(EVP_PKEY_CTX *ctx, const EC_KEY *ecdh); + +void fips_sli_check_padding_rsa_enc_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, int pad_mode); +void fips_sli_check_padding_rsa_dec_EVP_PKEY_CTX(EVP_PKEY_CTX * ctx, int pad_mode); + +FIPS_STATUS EVP_CIPHER_get_fips_status(const EVP_CIPHER *cipher); +void fips_sli_check_cipher_EVP_CIPHER_CTX(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher); + +#endif /* FIPS_SLI_LOCAL_H_INCLUDED */ --- /dev/null +++ b/include/openssl/fips_sli.h @@ -0,0 +1,32 @@ +#ifndef FIPS_SLI_H_INCLUDED +#define FIPS_SLI_H_INCLUDED + +#include <openssl/evp.h> +#include <openssl/cmac.h> +# ifdef __cplusplus +extern "C" { +# endif + +/* Interface for consumers to check if their usage of the services offered by + * this ctx was approved */ +int fips_sli_is_approved_EVP_CIPHER_CTX(const EVP_CIPHER_CTX *ctx); +int fips_sli_is_approved_EVP_KDF_CTX(const EVP_KDF_CTX *ctx); +int fips_sli_is_approved_EVP_MD_CTX(const EVP_MD_CTX *ctx); +int fips_sli_is_approved_EVP_PKEY_CTX(const EVP_PKEY_CTX *ctx); +int fips_sli_is_approved_CMAC_CTX(const CMAC_CTX *ctx); +int fips_sli_is_approved_HMAC_CTX(const HMAC_CTX *ctx); + +int fips_sli_SHA1_is_approved(const unsigned char *d, size_t n, unsigned char *md); +int fips_sli_HMAC_is_approved(const EVP_MD *evp_md, const void *key, int key_len, + const unsigned char *d, size_t n, unsigned char *md, + unsigned int *md_len); +int fips_sli_PKCS5_PBKDF2_HMAC_is_approved(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, + const EVP_MD *digest, int keylen, unsigned char *out); +int fips_sli_RAND_bytes_is_approved(unsigned char *buf, int num); +int fips_sli_RAND_priv_bytes_is_approved(unsigned char *buf, int num); + +# ifdef __cplusplus +} +# endif +#endif // FIPS_SLI_H_INCLUDED --- a/test/build.info +++ b/test/build.info @@ -52,7 +52,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /I recordlentest drbgtest drbg_cavs_test sslbuffertest \ time_offset_test pemtest ssl_cert_table_internal_test ciphername_test \ servername_test ocspapitest rsa_mp_test fatalerrtest tls13ccstest \ - sysdefaulttest errtest ssl_ctx_test gosttest + sysdefaulttest errtest ssl_ctx_test gosttest fips_slitest SOURCE[versions]=versions.c INCLUDE[versions]=../include @@ -575,6 +575,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /I INCLUDE[gosttest]=../include .. DEPEND[gosttest]=../libcrypto ../libssl libtestutil.a + SOURCE[fips_slitest]=fips_slitest.c fips_slitest_helper.c + INCLUDE[fips_slitest]=../include + DEPEND[fips_slitest]=../libcrypto libtestutil.a + SOURCE[ssl_ctx_test]=ssl_ctx_test.c INCLUDE[ssl_ctx_test]=../include DEPEND[ssl_ctx_test]=../libcrypto ../libssl libtestutil.a --- /dev/null +++ b/test/fips_slitest.c @@ -0,0 +1,659 @@ +#include <openssl/evp.h> +#include <openssl/fips_sli.h> +#include <openssl/kdf.h> +#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_EC is defined */ +#ifndef OPENSSL_NO_EC +# include <openssl/ec.h> +#endif +#ifndef OPENSSL_NO_RSA +# include <openssl/rsa.h> +#endif +#include <openssl/rand.h> + +#include "testutil.h" +#include "fips_slitest_helper.h" + +static int test_sli_noop(void) { + int res = 0; /* 0 means test failure */ + EVP_MD_CTX* ctx = NULL; + if (!TEST_ptr(ctx = EVP_MD_CTX_new())) + goto end; + if (!TEST_true(fips_sli_is_approved_EVP_MD_CTX(ctx))) + goto end; + if (!TEST_false(fips_sli_is_approved_EVP_MD_CTX(NULL))) + goto end; + res = 1; /* test case successful */ +end: + EVP_MD_CTX_free(ctx); + return res; +} + +static int cmac_aes_cbc(void) { + int success = 0; + CMAC_CTX *ctx = NULL; + size_t maclen = 0; + + if (!TEST_ptr(ctx = CMAC_CTX_new())) + return 0; + if (!TEST_true(CMAC_Init(ctx, get_key_16(), 16, EVP_aes_128_cbc(), NULL)) + || !TEST_true(CMAC_Final(ctx, NULL, &maclen)) + ) { + CMAC_CTX_free(ctx); + return 0; + } + + uint8_t mac[maclen]; + + if (!TEST_true(maclen > 0) + || !TEST_true(CMAC_Update(ctx, get_msg_16(), 16)) + || !TEST_true(CMAC_Final(ctx, mac, &maclen)) + || !TEST_true(fips_sli_is_approved_CMAC_CTX(ctx)) + ) + goto end; + success = 1; +end: + CMAC_CTX_free(ctx); + return success; +} + +static int cmac_no_des(void) { + int success = 0; + CMAC_CTX *ctx = NULL; + size_t maclen = 0; + +#ifdef OPENSSL_FIPS + if (FIPS_mode()) { + TEST_note("Skipping test because DES is disabled in FIPS mode"); + return 1; + } +#endif + + if (!TEST_ptr(ctx = CMAC_CTX_new())) + return 0; + if (!TEST_true(CMAC_Init(ctx, get_key_16(), 16, EVP_des_ede_cbc(), NULL)) + || !TEST_true(CMAC_Final(ctx, NULL, &maclen)) + ) { + CMAC_CTX_free(ctx); + return 0; + } + + uint8_t mac[maclen]; + + if (!TEST_true(maclen > 0) + || !TEST_int_eq(16, EVP_CIPHER_key_length(EVP_des_ede_cbc())) + || !TEST_true(CMAC_Update(ctx, get_msg_16(), 16)) + || !TEST_true(CMAC_Final(ctx, mac, &maclen)) + || !TEST_false(fips_sli_is_approved_CMAC_CTX(ctx)) + ) + goto end; + success = 1; +end: + CMAC_CTX_free(ctx); + return success; +} + +typedef struct { + int fips_approved; + int cipher_nid; +} SLI_CMAC_TEST; + +static const SLI_CMAC_TEST cmac_tests[] = { + // Cipher must fit to key length of 32 B + {1, NID_aes_256_cbc}, + {0, NID_camellia_256_cbc}, +}; +static const size_t cmac_tests_len = sizeof(cmac_tests) / sizeof(cmac_tests[0]); + +static int cmac_via_md_ctx(int cmac_test_index) { + int success = 0; + EVP_MD_CTX *ctx = NULL; + const EVP_MD* md = NULL; + unsigned char* mac = NULL; + size_t maclen = 0; + + EVP_PKEY *key = NULL; + +#ifdef OPENSSL_FIPS + if (FIPS_mode() + && cmac_tests[cmac_test_index].cipher_nid == NID_camellia_256_cbc) { + TEST_note("Skipping test because Camellia is disabled in FIPS mode"); + success = 1; + goto end; + } +#endif + + if (!TEST_true(get_cmac_key(cmac_tests[cmac_test_index].cipher_nid, + &key) == 1)) + goto end; + if (!TEST_ptr(ctx = EVP_MD_CTX_new())) + goto end; + // hash doesn't matter here but must be present... + if (!TEST_true(EVP_DigestInit_ex(ctx, EVP_sha256(), NULL))) + goto end; + if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, key))) + goto end; + if (!TEST_true(EVP_DigestSignUpdate(ctx, get_msg_16(), 16))) + goto end; + size_t req = 0; + if (!TEST_true(EVP_DigestSignFinal(ctx, NULL, &req))) + goto end; + if (!TEST_true(req > 0)) + goto end; + if (!TEST_ptr(mac = OPENSSL_malloc(req))) + goto end; + maclen = req; + if (!TEST_true(EVP_DigestSignFinal(ctx, mac, &maclen))) + goto end; + if (cmac_tests[cmac_test_index].fips_approved) { + if (!TEST_true(fips_sli_is_approved_EVP_MD_CTX(ctx))) + goto end; + } else { + if (!TEST_false(fips_sli_is_approved_EVP_MD_CTX(ctx))) + goto end; + } + + success = 1; +end: + if (mac) + OPENSSL_free(mac); + EVP_MD_CTX_free(ctx); + return success; +} + +#ifndef OPENSSL_NO_EC +typedef struct { + int fips_approved; + int curve_nid; +} SLI_ECDSA_TEST; + +static const SLI_ECDSA_TEST ecdsa_tests[] = { + {0, NID_secp112r2}, + {1, NID_secp521r1}, +#ifndef OPENSSL_NO_EC2M + {0, NID_sect163r1}, +#endif + {0, NID_brainpoolP512r1}, +}; +static const size_t ecdsa_tests_len = sizeof(ecdsa_tests) / sizeof(ecdsa_tests[0]); + +/* Adapted from openssl/test/ecdsatest.c */ +static int ecdsa_via_EVP_DigestSign(int ecdsa_test_index) { + unsigned char *sig = NULL; + EC_KEY *eckey = NULL; + EVP_PKEY *pkey = NULL; + EVP_MD_CTX *mctx = NULL; + size_t sig_len; + const int nid = ecdsa_tests[ecdsa_test_index].curve_nid; + int success = 0; + const uint8_t* tbs = get_msg_128(); + + TEST_note("testing ECDSA for curve %s", OBJ_nid2sn(nid)); + + if (!TEST_ptr(mctx = EVP_MD_CTX_new()) + || !TEST_ptr(eckey = EC_KEY_new_by_curve_name(nid)) + || !TEST_true(EC_KEY_generate_key(eckey)) + || !TEST_ptr(pkey = EVP_PKEY_new()) + || !TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey))) + goto err; + + sig_len = ECDSA_size(eckey); + + if (!TEST_ptr(sig = OPENSSL_malloc(sig_len)) + /* create a signature */ + || !TEST_true(EVP_DigestSignInit(mctx, NULL, NULL, NULL, pkey)) + || !TEST_true(EVP_DigestSign(mctx, sig, &sig_len, tbs, sizeof(tbs))) + || !TEST_int_le(sig_len, ECDSA_size(eckey))) + goto err; + + // SLI shows proper status for sign() + if (ecdsa_tests[ecdsa_test_index].fips_approved) { + if (!TEST_true(fips_sli_is_approved_EVP_MD_CTX(mctx))) + goto err; + } else { + if (!TEST_false(fips_sli_is_approved_EVP_MD_CTX(mctx))) + goto err; + } + + /* positive test, verify with correct key, 1 return */ + if (!TEST_true(EVP_MD_CTX_reset(mctx)) + || !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))) + goto err; + + /* a resetted and initialised ctx should be okay again */ + if (!TEST_true(fips_sli_is_approved_EVP_MD_CTX(mctx))) + goto err; + + if (!TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1)) + goto err; + + // SLI shows proper status for verify() + if (ecdsa_tests[ecdsa_test_index].fips_approved) { + if (!TEST_true(fips_sli_is_approved_EVP_MD_CTX(mctx))) + goto err; + } else { + if (!TEST_false(fips_sli_is_approved_EVP_MD_CTX(mctx))) + goto err; + } + + success = 1; +err: + EVP_PKEY_free(pkey); + if (mctx != NULL) + EVP_MD_CTX_free(mctx); + if (sig != NULL) + OPENSSL_free(sig); + return success; +} +#endif + +typedef struct { + int fips_approved; + int cipher_nid; +} SLI_CIPHER_TEST; + +static const SLI_CIPHER_TEST cipher_tests[] = { + {1, NID_aes_128_cfb128}, + {1, NID_aes_256_gcm}, + {0, NID_des_ede3_cbc}, + {0, NID_des_ede3_cfb8}, + {0, NID_des_ofb64}, + {0, NID_des_ede_ecb}, + {0, NID_des_ede_ofb64}, + {0, NID_idea_cbc}, +}; +static const size_t cipher_tests_len = sizeof(cipher_tests) / sizeof(cipher_tests[0]); + +static size_t get_ciphertext_len(size_t plaintextlen, const EVP_CIPHER *cipher) { + /* maximum value according to manpage */ + return plaintextlen + EVP_CIPHER_block_size(cipher); +} + +static int cipher(int cipher_test_index) { + int success = 0; + unsigned char *key = NULL, *iv = NULL, *ctext = NULL; + int ctext_written_len = 0; + const EVP_CIPHER *cipher = NULL; + EVP_CIPHER_CTX *ctx = NULL; + const uint8_t* const ptext = get_msg_16(); + const size_t ptext_len = 16; + const int cipher_nid = cipher_tests[cipher_test_index].cipher_nid; + + TEST_note("testing SLI for cipher %s", OBJ_nid2sn(cipher_nid)); + +#ifdef OPENSSL_NO_IDEA + switch (cipher_nid) { + case NID_idea_cbc: + TEST_note("Skipping test since IDEA is not supported in this build"); + success = 1; + goto end; + } +#endif + +#ifdef OPENSSL_FIPS + if (FIPS_mode()) { + switch (cipher_nid) { + case NID_des_ofb64: + case NID_des_ede_ecb: + case NID_des_ede_ofb64: + case NID_idea_cbc: + TEST_note("Skipping test since DES/IDEA are disabled in FIPS mode"); + success = 1; + goto end; + } + } +#endif + + if (!TEST_ptr(cipher = EVP_get_cipherbynid(cipher_nid))) { + goto end; + } + + const size_t key_len = EVP_CIPHER_key_length(cipher); + const size_t iv_len = EVP_CIPHER_iv_length(cipher); + TEST_note("have keylen = %zd, ivlen = %zd", key_len, iv_len); + + if (!TEST_ptr(key = OPENSSL_malloc(key_len)) + || !TEST_ptr(ctext = OPENSSL_malloc(get_ciphertext_len(ptext_len, cipher))) + || !TEST_true(RAND_bytes(key, key_len) == 1)) + goto end; + + if (iv_len != 0) { + if (!TEST_ptr(iv = OPENSSL_malloc(iv_len)) + || !TEST_true(RAND_bytes(iv, iv_len) == 1)) + goto end; + } + + int tmp_len = 0; + if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) + || !TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, key, iv) == 1) + || !TEST_true(EVP_EncryptUpdate(ctx, ctext, &ctext_written_len, ptext, ptext_len) == 1) + || !TEST_true(ctext_written_len <= get_ciphertext_len(ptext_len, cipher)) + || !TEST_true(EVP_EncryptFinal_ex(ctx, ctext + ctext_written_len, &tmp_len) == 1)) + goto end; + + if (!TEST_true(ctext_written_len + tmp_len <= get_ciphertext_len(ptext_len, cipher))) + goto end; + + if (cipher_tests[cipher_test_index].fips_approved) { + if (!TEST_true(fips_sli_is_approved_EVP_CIPHER_CTX(ctx))) + goto end; + } else { + if (!TEST_false(fips_sli_is_approved_EVP_CIPHER_CTX(ctx))) + goto end; + } + + success = 1; +end: + EVP_CIPHER_CTX_free(ctx); + if (key != NULL) + OPENSSL_free(key); + if (iv != NULL) + OPENSSL_free(iv); + if (ctext != NULL) + OPENSSL_free(ctext); + return success; +} + +#ifndef OPENSSL_NO_RSA +typedef struct { + int fips_approved; + int cipher_nid; + uint8_t rsa_key_id; +} SLI_SEALENV_TEST; + +static const SLI_SEALENV_TEST sealenv_tests[] = { + // consider RSA enc/dec as always disapproved + {0, NID_aes_128_cfb128, 0}, + {0, NID_aes_256_gcm, 1}, + {0, NID_idea_cbc, 0}, + {0, NID_des_ede3_cbc, 2}, + {0, NID_aes_128_ecb, 0}, + {0, NID_aes_128_ecb, 3}, + {0, NID_aes_128_ccm, 3}, +}; +static const size_t sealenv_tests_len = sizeof(sealenv_tests) / sizeof(sealenv_tests[0]); + +/* Asymmetric enc/dec */ +static int sealenv(int sealenv_test_index) { + int success = 0; + RSA *rsa_pkey = RSA_new(); + EVP_PKEY *pkey = NULL; + const EVP_CIPHER *cipher = NULL; + const int cipher_nid = sealenv_tests[sealenv_test_index].cipher_nid; + EVP_CIPHER_CTX *ctx = NULL; + + uint8_t* enc_sym_key = NULL; + int enc_sym_key_len = 0; + + const uint8_t* const ptext = get_msg_128(); + const size_t ptext_len = 128; + unsigned char *iv = NULL, *ctext = NULL; + size_t ctext_len = 0; + int ctext_written_len = 0; + + switch (sealenv_tests[sealenv_test_index].rsa_key_id) { + case 0: + get_rsa_key1(rsa_pkey); + break; + case 1: + get_rsa_key2(rsa_pkey); + break; + case 2: + get_rsa_key3(rsa_pkey); + break; + case 3: + if (!TEST_int_eq(256, get_rsa_key2048p3(rsa_pkey))) + goto end; + break; + default: + goto end; + } + + TEST_note("RSA enc with key #%d, cipher %s", + sealenv_tests[sealenv_test_index].rsa_key_id, + OBJ_nid2sn(cipher_nid)); + +#ifdef OPENSSL_NO_IDEA + switch (cipher_nid) { + case NID_idea_cbc: + TEST_note("Skipping test since IDEA is not supported in this build"); + success = 1; + goto end; + } +#endif + +#ifdef OPENSSL_FIPS + if (FIPS_mode()) { + switch (cipher_nid) { + case NID_idea_cbc: + TEST_note("Skipping test since IDEA is disabled in FIPS mode"); + success = 1; + goto end; + } + } +#endif + + if (!TEST_ptr(pkey = EVP_PKEY_new()) + || !TEST_true(EVP_PKEY_assign_RSA(pkey, rsa_pkey)) + || !TEST_ptr(cipher = EVP_get_cipherbynid(cipher_nid)) + || !TEST_ptr(enc_sym_key = OPENSSL_malloc(EVP_PKEY_size(pkey))) + || !TEST_ptr(ctext = OPENSSL_malloc(get_ciphertext_len(ptext_len, cipher))) + ) + goto end; + + const size_t iv_len = EVP_CIPHER_iv_length(cipher); + if (iv_len != 0) { + if (!TEST_ptr(iv = OPENSSL_malloc(iv_len))) + goto end; + } + + if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) + || !TEST_true(1 == EVP_SealInit(ctx, cipher, &enc_sym_key, &enc_sym_key_len, iv, &pkey, 1)) + || !TEST_true(enc_sym_key_len > 0 && enc_sym_key_len <= EVP_PKEY_size(pkey)) + || !TEST_true(1 == EVP_SealUpdate(ctx, ctext, &ctext_written_len, ptext, ptext_len)) + ) + goto end; + ctext_len += ctext_written_len; + if (!TEST_true(1 == EVP_SealFinal(ctx, ctext + ctext_len, &ctext_written_len))) + goto end; + ctext_len += ctext_written_len; + if (!TEST_true(ctext_len <= get_ciphertext_len(ptext_len, cipher))) + goto end; + + if (sealenv_tests[sealenv_test_index].fips_approved) { + if (!TEST_true(fips_sli_is_approved_EVP_CIPHER_CTX(ctx))) + goto end; + } else { + if (!TEST_false(fips_sli_is_approved_EVP_CIPHER_CTX(ctx))) + goto end; + } + + success = 1; +end: + EVP_PKEY_free(pkey); /* also frees rsa_pkey */ + if (ctx != NULL) + EVP_CIPHER_CTX_free(ctx); + if (enc_sym_key != NULL) + OPENSSL_free(enc_sym_key); + if (iv != NULL) + OPENSSL_free(iv); + if (ctext != NULL) + OPENSSL_free(ctext); + return success; +} +#endif + +typedef struct { + int fips_approved; + int iterations; + int nid_digest; + const uint8_t key_expected[32]; // length has to be 32 +} SLI_PBKDF2_TEST; + +static const SLI_PBKDF2_TEST pbkdf2_tests[] = { + { + 1, 4200, NID_sha256, { + 0xE7, 0xBE, 0x37, 0x75, 0x9D, 0x53, 0x3E, 0x5A, 0x06, 0x20, 0xC9, 0xA5, 0x3A, 0x8D, 0xA2, 0x9E, + 0x9C, 0x27, 0xDF, 0x26, 0x24, 0xAB, 0xD8, 0x8E, 0x56, 0xE5, 0xB9, 0xF5, 0xA0, 0xD6, 0xD5, 0xEE + } + }, + { + 1, 1347, NID_sha256, { + 0xFB, 0xBB, 0xEC, 0x28, 0x5B, 0x48, 0xE7, 0xC2, 0x54, 0x4E, 0x65, 0x0F, 0x1E, 0xC8, 0xB5, 0x1C, + 0xF5, 0xAD, 0xAE, 0x2A, 0x21, 0x56, 0x94, 0xD2, 0xE1, 0xB7, 0xC8, 0x7D, 0x7A, 0x0D, 0x63, 0x86 + } + }, + { + 1, 4200, NID_sha1, { + 0x45, 0x96, 0x78, 0xF3, 0x92, 0x74, 0xAC, 0x5B, 0x1F, 0x2B, 0xD3, 0x75, 0x1A, 0xBA, 0x5D, 0xBE, + 0xF2, 0xDE, 0xE9, 0x88, 0x16, 0x4B, 0x0B, 0x84, 0x94, 0xD9, 0xC2, 0x2D, 0xC1, 0xB9, 0xB0, 0x8A + } + }, + { + 1, 4200, NID_sha3_512, { + 0x1E, 0x77, 0xC8, 0x28, 0x9A, 0x79, 0x2E, 0x25, 0x85, 0x8D, 0x73, 0xB3, 0x0D, 0xA1, 0x26, 0x65, + 0xC0, 0x04, 0x7D, 0x91, 0xB6, 0x5F, 0x89, 0x5E, 0x01, 0x82, 0x23, 0x35, 0x19, 0x2E, 0x5C, 0x09 + } + }, + { + 0, 1347, NID_md5, { + 0xC2, 0x78, 0x16, 0xDC, 0xD1, 0xC5, 0x71, 0xBD, 0x4A, 0x06, 0x2B, 0x38, 0x50, 0xE7, 0x4E, 0xC2, + 0x0E, 0x74, 0x9D, 0xB1, 0x59, 0xA8, 0xFF, 0x11, 0x24, 0x68, 0xD0, 0xCF, 0x69, 0xE5, 0x30, 0x36 + } + } +}; +static const size_t pbkdf2_tests_len = sizeof(pbkdf2_tests) / sizeof(pbkdf2_tests[0]); + +static int test_PKCS5_PBKDF2_HMAC(int pbkdf2_tests_idx) { + int success = 0; + const char password[] = "password"; + const unsigned char salt[] = {'s', 'a', 'l', 't'}; + const size_t password_len = sizeof(password) / sizeof(password[0]); + const size_t salt_len = sizeof(salt) / sizeof(salt[0]); + + int iter = pbkdf2_tests[pbkdf2_tests_idx].iterations; + const EVP_MD *digest = EVP_get_digestbynid(pbkdf2_tests[pbkdf2_tests_idx].nid_digest); + const size_t key_len = 32; + const size_t key_expected_len = key_len; + uint8_t* key = NULL; + +#ifdef OPENSSL_FIPS + if (FIPS_mode()) { + switch (pbkdf2_tests[pbkdf2_tests_idx].nid_digest) { + case NID_md5: + TEST_note("Skipping test since MD5 is disabled in FIPS mode"); + success = 1; + goto end; + } + } +#endif + + if (!TEST_ptr(key = OPENSSL_malloc(key_len)) + || !TEST_true(1 == PKCS5_PBKDF2_HMAC(password, password_len, salt, salt_len, + iter, digest, + key_len, key)) + || !TEST_true(fips_sli_PKCS5_PBKDF2_HMAC_is_approved(password, password_len, + salt, salt_len, + iter, digest, + key_len, key) == pbkdf2_tests[pbkdf2_tests_idx].fips_approved) + || !TEST_mem_eq(key, key_len, pbkdf2_tests[pbkdf2_tests_idx].key_expected, key_expected_len)) + goto end; + success = 1; +end: + return success; +} + +typedef struct { + int fips_approved; + int digest_nid; +} SLI_SSHKDF_TEST; + +static const SLI_SSHKDF_TEST sshkdf_tests[] = { + {1, NID_sha256}, + {0, NID_md5}, +}; +static const size_t sshkdf_tests_len = sizeof(sshkdf_tests) / sizeof(sshkdf_tests[0]); + +static int sshkdf(int sshkdf_test_idx) { + int success = 0; + const uint8_t *key = get_key_32(); + const uint8_t *xcghash = get_msg_128(); + const uint8_t *session_id = get_key_32(); + uint8_t kdfout[16]; + size_t kdfoutlen = sizeof(kdfout) / sizeof(kdfout[0]); + const int digest_nid = sshkdf_tests[sshkdf_test_idx].digest_nid; + EVP_KDF_CTX *ctx = NULL; + + TEST_note("SSHKDF with %s", OBJ_nid2sn(digest_nid)); + +#ifdef OPENSSL_FIPS + if (FIPS_mode()) { + switch (digest_nid) { + case NID_md5: + TEST_note("Skipping test since MD5 is disabled in FIPS mode"); + success = 1; + goto end; + } + } +#endif + + if (!TEST_ptr(ctx = EVP_KDF_CTX_new_id(NID_sshkdf)) + || !TEST_true(EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, EVP_get_digestbynid(digest_nid)) == 1) + || !TEST_true(EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, 32) == 1) + || !TEST_true(EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID, session_id, 32) == 1) + || !TEST_true(EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, EVP_KDF_SSHKDF_TYPE_ENCRYPTION_KEY_CLI_TO_SRV) == 1) + || !TEST_true(EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH, xcghash, 128) == 1) + || !TEST_true(fips_sli_is_approved_EVP_KDF_CTX(ctx)) + || !TEST_true(EVP_KDF_derive(ctx, kdfout, kdfoutlen) == 1) + || !TEST_true(fips_sli_is_approved_EVP_KDF_CTX(ctx) == sshkdf_tests[sshkdf_test_idx].fips_approved) + ) + goto end; + + EVP_KDF_reset(ctx); + + if (!TEST_true(fips_sli_is_approved_EVP_KDF_CTX(ctx))) + goto end; + + success = 1; +end: + EVP_KDF_CTX_free(ctx); + return success; +} + +static int rand_bytes() { + int success = 0; + unsigned char r[1]; + size_t rlen = sizeof(r) / sizeof(r[0]); + if (!TEST_true(fips_sli_RAND_bytes_is_approved(r, rlen) == 1) + || !TEST_true(RAND_bytes(r, rlen) == 1) + || !TEST_true(fips_sli_RAND_priv_bytes_is_approved(r, rlen) == 1) + || !TEST_true(RAND_priv_bytes(r, rlen) == 1) + || !TEST_true(fips_sli_RAND_priv_bytes_is_approved(r, rlen) == 1) + ) + goto end; + success = 1; +end: + return success; +} + +int setup_tests(void) { + ADD_TEST(test_sli_noop); + ADD_TEST(cmac_aes_cbc); + ADD_TEST(cmac_no_des); + ADD_ALL_TESTS(cmac_via_md_ctx, cmac_tests_len); +#ifdef OPENSSL_NO_EC + TEST_note("Elliptic curves are disabled."); +#else + ADD_ALL_TESTS(ecdsa_via_EVP_DigestSign, ecdsa_tests_len); +#endif + ADD_ALL_TESTS(cipher, cipher_tests_len); +#ifdef OPENSSL_NO_RSA + TEST_note("RSA is disabled."); +#else + ADD_ALL_TESTS(sealenv, sealenv_tests_len); +#endif + ADD_ALL_TESTS(test_PKCS5_PBKDF2_HMAC, pbkdf2_tests_len); + ADD_ALL_TESTS(sshkdf, sshkdf_tests_len); + ADD_TEST(rand_bytes); + + return 1; /* success */ +} --- /dev/null +++ b/test/fips_slitest_helper.c @@ -0,0 +1,489 @@ +#include <stdlib.h> +#include <stdio.h> +#include <limits.h> +#include <string.h> +#include <assert.h> + +#include <openssl/err.h> +#include <openssl/sha.h> +#include <openssl/rand.h> + +#include "testutil.h" +#include "fips_slitest_helper.h" + +int make_hmac_keys(EVP_PKEY** skey, EVP_PKEY** vkey) { + byte hkey[EVP_MAX_MD_SIZE]; + + int result = -1; + + if (!skey || !vkey) + return -1; + + if (*skey != NULL) { + EVP_PKEY_free(*skey); + *skey = NULL; + } + + if (*vkey != NULL) { + EVP_PKEY_free(*vkey); + *vkey = NULL; + } + + do { + const EVP_MD* md = EVP_sha256(); + int size = EVP_MD_size(md); + assert(size >= 16); + if (!(size >= 16)) { + printf("EVP_MD_size failed, error 0x%lx\n", ERR_get_error()); + break; /* failed */ + } + + assert(size <= sizeof(hkey)); + if (!(size <= sizeof(hkey))) { + printf("EVP_MD_size is too large\n"); + break; /* failed */ + } + + /* Generate bytes */ + int rc = RAND_bytes(hkey, size); + assert(rc == 1); + if (rc != 1) { + printf("RAND_bytes failed, error 0x%lx\n", ERR_get_error()); + break; + } + + //print_it("HMAC key", hkey, size); + + *skey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, hkey, size); + assert(*skey != NULL); + if (*skey == NULL) { + printf("EVP_PKEY_new_mac_key 1st failed, error 0x%lx\n", ERR_get_error()); + break; + } + + *vkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, hkey, size); + assert(*vkey != NULL); + if (*vkey == NULL) { + printf("EVP_PKEY_new_mac_key 2nd failed, error 0x%lx\n", ERR_get_error()); + break; + } + + result = 0; + + } while (0); + + OPENSSL_cleanse(hkey, sizeof(hkey)); + + /* Convert to 0/1 result */ + return !!result; +} +static const uint8_t msg[16] = { 0x71, 0x50, 0x00, 0x00, + 0xc0, 0xff, 0xee, 0x00, + 0xde, 0xad, 0xbe, 0xef, + 0x01, 0x02, 0x03, 0x04 + }; +static const uint8_t msg128[128] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, + 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, + 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, + 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, + 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, + 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, + 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, + 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, + 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, + 101, 102, 103, 104, 105, 106, 107, 108, 109, + 110, 111, 112, 113, 114, 115, 116, 117, 118, + 119, 120, 121, 122, 123, 124, 125, 126, 127 + }; + +static const uint8_t key16[16] = { 0xaa, 0xbb, 0xcc, 0xdd, + 0x01, 0x02, 0x03, 0x04, + 0xaa, 0xbb, 0xcc, 0xdd, + 0xde, 0xad, 0xbe, 0xef + }; +static const uint8_t key32[32] = { 0xaa, 0xbb, 0xcc, 0xdd, + 0x01, 0x02, 0x03, 0x04, + 0xaa, 0xbb, 0xcc, 0xdd, + 0xde, 0xad, 0xbe, 0xef, + 0xaa, 0xbb, 0xcc, 0xdd, + 0x01, 0x02, 0x03, 0x04, + 0xaa, 0xbb, 0xcc, 0xdd, + 0xde, 0xad, 0xbe, 0xef + }; + +const uint8_t* get_msg_16() { + return msg; +} + +const uint8_t* get_msg_128() { + return msg128; +} + +const uint8_t* get_key_16() { + return key16; +} + +const uint8_t* get_key_32() { + return key32; +} + +void print_it(const char* label, const byte* buff, size_t len) { + if (!buff || !len) + return; + + if (label) + printf("%s: ", label); + + for (size_t i = 0; i < len; ++i) + printf("%02X", buff[i]); + + printf("\n"); +} + +int get_cmac_key(int cipher_nid, EVP_PKEY** out) { + int success = 0; + EVP_PKEY_CTX *ctx = NULL; + const size_t key_len = 32; + const uint8_t *key = get_key_32(); + const EVP_CIPHER *cipher = EVP_get_cipherbynid(cipher_nid); + + if (!(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_CMAC, NULL))) + goto end; + if (EVP_PKEY_keygen_init(ctx) != 1) + goto end; + if (cipher == NULL) + goto end; + if (EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_CIPHER, 0, (void*)cipher) <= 0) + goto end; + if (EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_SET_MAC_KEY, key_len, (void*)key) <= 0) + goto end; + if (!EVP_PKEY_keygen(ctx, out)) + goto end; + + success = 1; +end: + + if (ctx) + EVP_PKEY_CTX_free(ctx); + return success; +} + +#ifndef OPENSSL_NO_RSA +# include <openssl/rsa.h> + +/* adapted from openssl/test/rsa_test.c */ +# define SetKey \ + RSA_set0_key(key, \ + BN_bin2bn(n, sizeof(n)-1, NULL), \ + BN_bin2bn(e, sizeof(e)-1, NULL), \ + BN_bin2bn(d, sizeof(d)-1, NULL)); \ + RSA_set0_factors(key, \ + BN_bin2bn(p, sizeof(p)-1, NULL), \ + BN_bin2bn(q, sizeof(q)-1, NULL)); \ + RSA_set0_crt_params(key, \ + BN_bin2bn(dmp1, sizeof(dmp1)-1, NULL), \ + BN_bin2bn(dmq1, sizeof(dmq1)-1, NULL), \ + BN_bin2bn(iqmp, sizeof(iqmp)-1, NULL)); + +void get_rsa_key1(RSA *key) { + static unsigned char n[] = + "\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F" + "\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5" + "\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93" + "\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1" + "\xF5"; + + static unsigned char e[] = "\x11"; + + static unsigned char d[] = + "\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44" + "\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64" + "\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9" + "\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51"; + + static unsigned char p[] = + "\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5" + "\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12" + "\x0D"; + + static unsigned char q[] = + "\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9" + "\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D" + "\x89"; + + static unsigned char dmp1[] = + "\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF" + "\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05"; + + static unsigned char dmq1[] = + "\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99" + "\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D" + "\x51"; + + static unsigned char iqmp[] = + "\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8" + "\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26"; + + SetKey; +} + +void get_rsa_key2(RSA *key) { + static unsigned char n[] = + "\x00\xA3\x07\x9A\x90\xDF\x0D\xFD\x72\xAC\x09\x0C\xCC\x2A\x78\xB8" + "\x74\x13\x13\x3E\x40\x75\x9C\x98\xFA\xF8\x20\x4F\x35\x8A\x0B\x26" + "\x3C\x67\x70\xE7\x83\xA9\x3B\x69\x71\xB7\x37\x79\xD2\x71\x7B\xE8" + "\x34\x77\xCF"; + + static unsigned char e[] = "\x3"; + + static unsigned char d[] = + "\x6C\xAF\xBC\x60\x94\xB3\xFE\x4C\x72\xB0\xB3\x32\xC6\xFB\x25\xA2" + "\xB7\x62\x29\x80\x4E\x68\x65\xFC\xA4\x5A\x74\xDF\x0F\x8F\xB8\x41" + "\x3B\x52\xC0\xD0\xE5\x3D\x9B\x59\x0F\xF1\x9B\xE7\x9F\x49\xDD\x21" + "\xE5\xEB"; + + static unsigned char p[] = + "\x00\xCF\x20\x35\x02\x8B\x9D\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92" + "\xEA\x0D\xA3\xB4\x32\x04\xB5\xCF\xCE\x91"; + + static unsigned char q[] = + "\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9" + "\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5F"; + + static unsigned char dmp1[] = + "\x00\x8A\x15\x78\xAC\x5D\x13\xAF\x10\x2B\x22\xB9\x99\xCD\x74\x61" + "\xF1\x5E\x6D\x22\xCC\x03\x23\xDF\xDF\x0B"; + + static unsigned char dmq1[] = + "\x00\x86\x55\x21\x4A\xC5\x4D\x8D\x4E\xCD\x61\x77\xF1\xC7\x36\x90" + "\xCE\x2A\x48\x2C\x8B\x05\x99\xCB\xE0\x3F"; + + static unsigned char iqmp[] = + "\x00\x83\xEF\xEF\xB8\xA9\xA4\x0D\x1D\xB6\xED\x98\xAD\x84\xED\x13" + "\x35\xDC\xC1\x08\xF3\x22\xD0\x57\xCF\x8D"; + + SetKey; +} + +void get_rsa_key3(RSA *key) { + static unsigned char n[] = + "\x00\xBB\xF8\x2F\x09\x06\x82\xCE\x9C\x23\x38\xAC\x2B\x9D\xA8\x71" + "\xF7\x36\x8D\x07\xEE\xD4\x10\x43\xA4\x40\xD6\xB6\xF0\x74\x54\xF5" + "\x1F\xB8\xDF\xBA\xAF\x03\x5C\x02\xAB\x61\xEA\x48\xCE\xEB\x6F\xCD" + "\x48\x76\xED\x52\x0D\x60\xE1\xEC\x46\x19\x71\x9D\x8A\x5B\x8B\x80" + "\x7F\xAF\xB8\xE0\xA3\xDF\xC7\x37\x72\x3E\xE6\xB4\xB7\xD9\x3A\x25" + "\x84\xEE\x6A\x64\x9D\x06\x09\x53\x74\x88\x34\xB2\x45\x45\x98\x39" + "\x4E\xE0\xAA\xB1\x2D\x7B\x61\xA5\x1F\x52\x7A\x9A\x41\xF6\xC1\x68" + "\x7F\xE2\x53\x72\x98\xCA\x2A\x8F\x59\x46\xF8\xE5\xFD\x09\x1D\xBD" + "\xCB"; + + static unsigned char e[] = "\x11"; + + static unsigned char d[] = + "\x00\xA5\xDA\xFC\x53\x41\xFA\xF2\x89\xC4\xB9\x88\xDB\x30\xC1\xCD" + "\xF8\x3F\x31\x25\x1E\x06\x68\xB4\x27\x84\x81\x38\x01\x57\x96\x41" + "\xB2\x94\x10\xB3\xC7\x99\x8D\x6B\xC4\x65\x74\x5E\x5C\x39\x26\x69" + "\xD6\x87\x0D\xA2\xC0\x82\xA9\x39\xE3\x7F\xDC\xB8\x2E\xC9\x3E\xDA" + "\xC9\x7F\xF3\xAD\x59\x50\xAC\xCF\xBC\x11\x1C\x76\xF1\xA9\x52\x94" + "\x44\xE5\x6A\xAF\x68\xC5\x6C\x09\x2C\xD3\x8D\xC3\xBE\xF5\xD2\x0A" + "\x93\x99\x26\xED\x4F\x74\xA1\x3E\xDD\xFB\xE1\xA1\xCE\xCC\x48\x94" + "\xAF\x94\x28\xC2\xB7\xB8\x88\x3F\xE4\x46\x3A\x4B\xC8\x5B\x1C\xB3" + "\xC1"; + + static unsigned char p[] = + "\x00\xEE\xCF\xAE\x81\xB1\xB9\xB3\xC9\x08\x81\x0B\x10\xA1\xB5\x60" + "\x01\x99\xEB\x9F\x44\xAE\xF4\xFD\xA4\x93\xB8\x1A\x9E\x3D\x84\xF6" + "\x32\x12\x4E\xF0\x23\x6E\x5D\x1E\x3B\x7E\x28\xFA\xE7\xAA\x04\x0A" + "\x2D\x5B\x25\x21\x76\x45\x9D\x1F\x39\x75\x41\xBA\x2A\x58\xFB\x65" + "\x99"; + + static unsigned char q[] = + "\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9" + "\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D" + "\x86\x98\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5" + "\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x15" + "\x03"; + + static unsigned char dmp1[] = + "\x54\x49\x4C\xA6\x3E\xBA\x03\x37\xE4\xE2\x40\x23\xFC\xD6\x9A\x5A" + "\xEB\x07\xDD\xDC\x01\x83\xA4\xD0\xAC\x9B\x54\xB0\x51\xF2\xB1\x3E" + "\xD9\x49\x09\x75\xEA\xB7\x74\x14\xFF\x59\xC1\xF7\x69\x2E\x9A\x2E" + "\x20\x2B\x38\xFC\x91\x0A\x47\x41\x74\xAD\xC9\x3C\x1F\x67\xC9\x81"; + + static unsigned char dmq1[] = + "\x47\x1E\x02\x90\xFF\x0A\xF0\x75\x03\x51\xB7\xF8\x78\x86\x4C\xA9" + "\x61\xAD\xBD\x3A\x8A\x7E\x99\x1C\x5C\x05\x56\xA9\x4C\x31\x46\xA7" + "\xF9\x80\x3F\x8F\x6F\x8A\xE3\x42\xE9\x31\xFD\x8A\xE4\x7A\x22\x0D" + "\x1B\x99\xA4\x95\x84\x98\x07\xFE\x39\xF9\x24\x5A\x98\x36\xDA\x3D"; + + static unsigned char iqmp[] = + "\x00\xB0\x6C\x4F\xDA\xBB\x63\x01\x19\x8D\x26\x5B\xDB\xAE\x94\x23" + "\xB3\x80\xF2\x71\xF7\x34\x53\x88\x50\x93\x07\x7F\xCD\x39\xE2\x11" + "\x9F\xC9\x86\x32\x15\x4F\x58\x83\xB1\x67\xA9\x67\xBF\x40\x2B\x4E" + "\x9E\x2E\x0F\x96\x56\xE6\x98\xEA\x36\x66\xED\xFB\x25\x79\x80\x39" + "\xF7"; + + SetKey; +} + +/* taken from openssl/test/rsa_mp_test.c */ +#define NUM_EXTRA_PRIMES 1 +/* Returns the public key length (256) on success */ +int get_rsa_key2048p3(RSA *key) { + /* C90 requires string should <= 509 bytes */ + static const unsigned char n[] = + "\x92\x60\xd0\x75\x0a\xe1\x17\xee\xe5\x5c\x3f\x3d\xea\xba\x74\x91" + "\x75\x21\xa2\x62\xee\x76\x00\x7c\xdf\x8a\x56\x75\x5a\xd7\x3a\x15" + "\x98\xa1\x40\x84\x10\xa0\x14\x34\xc3\xf5\xbc\x54\xa8\x8b\x57\xfa" + "\x19\xfc\x43\x28\xda\xea\x07\x50\xa4\xc4\x4e\x88\xcf\xf3\xb2\x38" + "\x26\x21\xb8\x0f\x67\x04\x64\x43\x3e\x43\x36\xe6\xd0\x03\xe8\xcd" + "\x65\xbf\xf2\x11\xda\x14\x4b\x88\x29\x1c\x22\x59\xa0\x0a\x72\xb7" + "\x11\xc1\x16\xef\x76\x86\xe8\xfe\xe3\x4e\x4d\x93\x3c\x86\x81\x87" + "\xbd\xc2\x6f\x7b\xe0\x71\x49\x3c\x86\xf7\xa5\x94\x1c\x35\x10\x80" + "\x6a\xd6\x7b\x0f\x94\xd8\x8f\x5c\xf5\xc0\x2a\x09\x28\x21\xd8\x62" + "\x6e\x89\x32\xb6\x5c\x5b\xd8\xc9\x20\x49\xc2\x10\x93\x2b\x7a\xfa" + "\x7a\xc5\x9c\x0e\x88\x6a\xe5\xc1\xed\xb0\x0d\x8c\xe2\xc5\x76\x33" + "\xdb\x26\xbd\x66\x39\xbf\xf7\x3c\xee\x82\xbe\x92\x75\xc4\x02\xb4" + "\xcf\x2a\x43\x88\xda\x8c\xf8\xc6\x4e\xef\xe1\xc5\xa0\xf5\xab\x80" + "\x57\xc3\x9f\xa5\xc0\x58\x9c\x3e\x25\x3f\x09\x60\x33\x23\x00\xf9" + "\x4b\xea\x44\x87\x7b\x58\x8e\x1e\xdb\xde\x97\xcf\x23\x60\x72\x7a" + "\x09\xb7\x75\x26\x2d\x7e\xe5\x52\xb3\x31\x9b\x92\x66\xf0\x5a\x25"; + + static const unsigned char e[] = "\x01\x00\x01"; + + static const unsigned char d[] = + "\x6a\x7d\xf2\xca\x63\xea\xd4\xdd\xa1\x91\xd6\x14\xb6\xb3\x85\xe0" + "\xd9\x05\x6a\x3d\x6d\x5c\xfe\x07\xdb\x1d\xaa\xbe\xe0\x22\xdb\x08" + "\x21\x2d\x97\x61\x3d\x33\x28\xe0\x26\x7c\x9d\xd2\x3d\x78\x7a\xbd" + "\xe2\xaf\xcb\x30\x6a\xeb\x7d\xfc\xe6\x92\x46\xcc\x73\xf5\xc8\x7f" + "\xdf\x06\x03\x01\x79\xa2\x11\x4b\x76\x7d\xb1\xf0\x83\xff\x84\x1c" + "\x02\x5d\x7d\xc0\x0c\xd8\x24\x35\xb9\xa9\x0f\x69\x53\x69\xe9\x4d" + "\xf2\x3d\x2c\xe4\x58\xbc\x3b\x32\x83\xad\x8b\xba\x2b\x8f\xa1\xba" + "\x62\xe2\xdc\xe9\xac\xcf\xf3\x79\x9a\xae\x7c\x84\x00\x16\xf3\xba" + "\x8e\x00\x48\xc0\xb6\xcc\x43\x39\xaf\x71\x61\x00\x3a\x5b\xeb\x86" + "\x4a\x01\x64\xb2\xc1\xc9\x23\x7b\x64\xbc\x87\x55\x69\x94\x35\x1b" + "\x27\x50\x6c\x33\xd4\xbc\xdf\xce\x0f\x9c\x49\x1a\x7d\x6b\x06\x28" + "\xc7\xc8\x52\xbe\x4f\x0a\x9c\x31\x32\xb2\xed\x3a\x2c\x88\x81\xe9" + "\xaa\xb0\x7e\x20\xe1\x7d\xeb\x07\x46\x91\xbe\x67\x77\x76\xa7\x8b" + "\x5c\x50\x2e\x05\xd9\xbd\xde\x72\x12\x6b\x37\x38\x69\x5e\x2d\xd1" + "\xa0\xa9\x8a\x14\x24\x7c\x65\xd8\xa7\xee\x79\x43\x2a\x09\x2c\xb0" + "\x72\x1a\x12\xdf\x79\x8e\x44\xf7\xcf\xce\x0c\x49\x81\x47\xa9\xb1"; + + static const unsigned char p[] = + "\x06\x77\xcd\xd5\x46\x9b\xc1\xd5\x58\x00\x81\xe2\xf3\x0a\x36\xb1" + "\x6e\x29\x89\xd5\x2f\x31\x5f\x92\x22\x3b\x9b\x75\x30\x82\xfa\xc5" + "\xf5\xde\x8a\x36\xdb\xc6\xe5\x8f\xef\x14\x37\xd6\x00\xf9\xab\x90" + "\x9b\x5d\x57\x4c\xf5\x1f\x77\xc4\xbb\x8b\xdd\x9b\x67\x11\x45\xb2" + "\x64\xe8\xac\xa8\x03\x0f\x16\x0d\x5d\x2d\x53\x07\x23\xfb\x62\x0d" + "\xe6\x16\xd3\x23\xe8\xb3"; + + static const unsigned char q[] = + "\x06\x66\x9a\x70\x53\xd6\x72\x74\xfd\xea\x45\xc3\xc0\x17\xae\xde" + "\x79\x17\xae\x79\xde\xfc\x0e\xf7\xa4\x3a\x8c\x43\x8f\xc7\x8a\xa2" + "\x2c\x51\xc4\xd0\x72\x89\x73\x5c\x61\xbe\xfd\x54\x3f\x92\x65\xde" + "\x4d\x65\x71\x70\xf6\xf2\xe5\x98\xb9\x0f\xd1\x0b\xe6\x95\x09\x4a" + "\x7a\xdf\xf3\x10\x16\xd0\x60\xfc\xa5\x10\x34\x97\x37\x6f\x0a\xd5" + "\x5d\x8f\xd4\xc3\xa0\x5b"; + + static const unsigned char dmp1[] = + "\x05\x7c\x9e\x1c\xbd\x90\x25\xe7\x40\x86\xf5\xa8\x3b\x7a\x3f\x99" + "\x56\x95\x60\x3a\x7b\x95\x4b\xb8\xa0\xd7\xa5\xf1\xcc\xdc\x5f\xb5" + "\x8c\xf4\x62\x95\x54\xed\x2e\x12\x62\xc2\xe8\xf6\xde\xce\xed\x8e" + "\x77\x6d\xc0\x40\x25\x74\xb3\x5a\x2d\xaa\xe1\xac\x11\xcb\xe2\x2f" + "\x0a\x51\x23\x1e\x47\xb2\x05\x88\x02\xb2\x0f\x4b\xf0\x67\x30\xf0" + "\x0f\x6e\xef\x5f\xf7\xe7"; + + static const unsigned char dmq1[] = + "\x01\xa5\x6b\xbc\xcd\xe3\x0e\x46\xc6\x72\xf5\x04\x56\x28\x01\x22" + "\x58\x74\x5d\xbc\x1c\x3c\x29\x41\x49\x6c\x81\x5c\x72\xe2\xf7\xe5" + "\xa3\x8e\x58\x16\xe0\x0e\x37\xac\x1f\xbb\x75\xfd\xaf\xe7\xdf\xe9" + "\x1f\x70\xa2\x8f\x52\x03\xc0\x46\xd9\xf9\x96\x63\x00\x27\x7e\x5f" + "\x38\x60\xd6\x6b\x61\xe2\xaf\xbe\xea\x58\xd3\x9d\xbc\x75\x03\x8d" + "\x42\x65\xd6\x6b\x85\x97"; + + static const unsigned char iqmp[] = + "\x03\xa1\x8b\x80\xe4\xd8\x87\x25\x17\x5d\xcc\x8d\xa9\x8a\x22\x2b" + "\x6c\x15\x34\x6f\x80\xcc\x1c\x44\x04\x68\xbc\x03\xcd\x95\xbb\x69" + "\x37\x61\x48\xb4\x23\x13\x08\x16\x54\x6a\xa1\x7c\xf5\xd4\x3a\xe1" + "\x4f\xa4\x0c\xf5\xaf\x80\x85\x27\x06\x0d\x70\xc0\xc5\x19\x28\xfe" + "\xee\x8e\x86\x21\x98\x8a\x37\xb7\xe5\x30\x25\x70\x93\x51\x2d\x49" + "\x85\x56\xb3\x0c\x2b\x96"; + + static const unsigned char ex_prime[] = + "\x03\x89\x22\xa0\xb7\x3a\x91\xcb\x5e\x0c\xfd\x73\xde\xa7\x38\xa9" + "\x47\x43\xd6\x02\xbf\x2a\xb9\x3c\x48\xf3\x06\xd6\x58\x35\x50\x56" + "\x16\x5c\x34\x9b\x61\x87\xc8\xaa\x0a\x5d\x8a\x0a\xcd\x9c\x41\xd9" + "\x96\x24\xe0\xa9\x9b\x26\xb7\xa8\x08\xc9\xea\xdc\xa7\x15\xfb\x62" + "\xa0\x2d\x90\xe6\xa7\x55\x6e\xc6\x6c\xff\xd6\x10\x6d\xfa\x2e\x04" + "\x50\xec\x5c\x66\xe4\x05"; + + static const unsigned char ex_exponent[] = + "\x02\x0a\xcd\xc3\x82\xd2\x03\xb0\x31\xac\xd3\x20\x80\x34\x9a\x57" + "\xbc\x60\x04\x57\x25\xd0\x29\x9a\x16\x90\xb9\x1c\x49\x6a\xd1\xf2" + "\x47\x8c\x0e\x9e\xc9\x20\xc2\xd8\xe4\x8f\xce\xd2\x1a\x9c\xec\xb4" + "\x1f\x33\x41\xc8\xf5\x62\xd1\xa5\xef\x1d\xa1\xd8\xbd\x71\xc6\xf7" + "\xda\x89\x37\x2e\xe2\xec\x47\xc5\xb8\xe3\xb4\xe3\x5c\x82\xaa\xdd" + "\xb7\x58\x2e\xaf\x07\x79"; + + static const unsigned char ex_coefficient[] = + "\x00\x9c\x09\x88\x9b\xc8\x57\x08\x69\x69\xab\x2d\x9e\x29\x1c\x3c" + "\x6d\x59\x33\x12\x0d\x2b\x09\x2e\xaf\x01\x2c\x27\x01\xfc\xbd\x26" + "\x13\xf9\x2d\x09\x22\x4e\x49\x11\x03\x82\x88\x87\xf4\x43\x1d\xac" + "\xca\xec\x86\xf7\x23\xf1\x64\xf3\xf5\x81\xf0\x37\x36\xcf\x67\xff" + "\x1a\xff\x7a\xc7\xf9\xf9\x67\x2d\xa0\x9d\x61\xf8\xf6\x47\x5c\x2f" + "\xe7\x66\xe8\x3c\x3a\xe8"; + + BIGNUM **pris = NULL, **exps = NULL, **coeffs = NULL; + int rv = 256; /* public key length */ + + if (!TEST_int_eq(RSA_set0_key(key, + BN_bin2bn(n, sizeof(n) - 1, NULL), + BN_bin2bn(e, sizeof(e) - 1, NULL), + BN_bin2bn(d, sizeof(d) - 1, NULL)), 1)) + goto err; + + if (!TEST_int_eq(RSA_set0_factors(key, + BN_bin2bn(p, sizeof(p) - 1, NULL), + BN_bin2bn(q, sizeof(q) - 1, NULL)), 1)) + goto err; + + if (!TEST_int_eq(RSA_set0_crt_params(key, + BN_bin2bn(dmp1, sizeof(dmp1) - 1, NULL), + BN_bin2bn(dmq1, sizeof(dmq1) - 1, NULL), + BN_bin2bn(iqmp, sizeof(iqmp) - 1, + NULL)), 1)) + return 0; + + pris = OPENSSL_zalloc(sizeof(BIGNUM *)); + exps = OPENSSL_zalloc(sizeof(BIGNUM *)); + coeffs = OPENSSL_zalloc(sizeof(BIGNUM *)); + if (!TEST_ptr(pris) || !TEST_ptr(exps) || !TEST_ptr(coeffs)) + goto err; + + pris[0] = BN_bin2bn(ex_prime, sizeof(ex_prime) - 1, NULL); + exps[0] = BN_bin2bn(ex_exponent, sizeof(ex_exponent) - 1, NULL); + coeffs[0] = BN_bin2bn(ex_coefficient, sizeof(ex_coefficient) - 1, NULL); + if (!TEST_ptr(pris[0]) || !TEST_ptr(exps[0]) || !TEST_ptr(coeffs[0])) + goto err; + + if (!TEST_true(RSA_set0_multi_prime_params(key, pris, exps, + coeffs, NUM_EXTRA_PRIMES))) + goto err; + +ret: + OPENSSL_free(pris); + OPENSSL_free(exps); + OPENSSL_free(coeffs); + return rv; +err: + if (pris != NULL) + BN_free(pris[0]); + if (exps != NULL) + BN_free(exps[0]); + if (coeffs != NULL) + BN_free(coeffs[0]); + rv = 0; + goto ret; +} + +#endif --- /dev/null +++ b/test/fips_slitest_helper.h @@ -0,0 +1,29 @@ +#ifndef __FIPS_SLITEST_HELPER_H__ +#define __FIPS_SLITEST_HELPER_H__ + +#include <openssl/evp.h> + +typedef unsigned char byte; + +/** Create a MAC key: one copy for macgen, one for macver (verification) + * Adapted from https://wiki.openssl.org/images/1/1b/T-hmac.c.tar.gz + */ +int make_hmac_keys(EVP_PKEY** skey, EVP_PKEY** vkey); + +/* Adapted from https://wiki.openssl.org/images/1/1b/T-hmac.c.tar.gz */ +void print_it(const char* label, const byte* buff, size_t len); + +int get_cmac_key(int cipher_nid, EVP_PKEY** out); + +const uint8_t* get_msg_16(); +const uint8_t* get_msg_128(); +/* Get constant keys of specified length */ +const uint8_t* get_key_16(); +const uint8_t* get_key_32(); + +void get_rsa_key1(RSA *key); +void get_rsa_key2(RSA *key); +void get_rsa_key3(RSA *key); +int get_rsa_key2048p3(RSA *key); + +#endif /* __FIPS_SLITEST_HELPER_H__ */ --- /dev/null +++ b/test/recipes/30-test_fips_sli.t @@ -0,0 +1,4 @@ +#!/usr/bin/env perl +use OpenSSL::Test::Simple; + +simple_test("test_fips_sli", "fips_slitest", "fips_sli"); --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4636,3 +4636,14 @@ EVP_KDF_size EVP_KDF_derive 6597 1_1_1d EXIST::FUNCTION: EC_GROUP_get0_field 6598 1_1_1l EXIST::FUNCTION:EC NONFIPS_selftest_check 6599 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_EVP_MD_CTX 6600 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_CMAC_CTX 6601 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_HMAC_CTX 6602 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_EVP_PKEY_CTX 6603 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_EVP_CIPHER_CTX 6604 1_1_1l EXIST::FUNCTION: +fips_sli_is_approved_EVP_KDF_CTX 6605 1_1_1l EXIST::FUNCTION: +fips_sli_SHA1_is_approved 6606 1_1_1l EXIST::FUNCTION: +fips_sli_PKCS5_PBKDF2_HMAC_is_approved 6607 1_1_1l EXIST::FUNCTION: +fips_sli_HMAC_is_approved 6608 1_1_1l EXIST::FUNCTION: +fips_sli_RAND_bytes_is_approved 6609 1_1_1l EXIST::FUNCTION: +fips_sli_RAND_priv_bytes_is_approved 6610 1_1_1l EXIST::FUNCTION:
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
