Skip to contentSkip to conversation

crypto: don't raise alarm for no ctr(aes*) tests in fips mode

PATCH Superseded Jarod Wilson 3 participants 17 messages Apr 29, 2009 – May 6, 2009

Subsystems (2)
Crypto API Arm STM32
lore
Share & tools
lore

Jarod Wilson

author
#0 lore raw

PATCH 1/1 crypto: don't raise alarm for no ctr(aes*) tests in fips mode

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)
crypto/testmgr.c +11 -0
index 5a50416..39ffa69 100644
@@ -2134,6 +2134,17 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
 				      type, mask);
 	goto test_done;
 notest:
+	/*
+	 * Per NIST AESAVS[1], it isn't possible to have automated self-tests
+	 * for counter mode aes vectors, they have to be covered by ecb mode
+	 * and code inspection. The ecb mode tests are trigger above in the
+	 * CRYPTO_ALG_TYPE_CIPHER section. Suppress warnings about missing
+	 * ctr tests if we're in fips mode to avoid confusion.
+	 *
+	 * [1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf
+	 */
+	if (fips_enabled && !strncmp(alg, "ctr(aes", 7))
+		goto test_done;
 	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
 test_done:
 	if (fips_enabled && rc)
Signature · 2 lines
Jarod Wilson
[email protected]
#1 lore raw
Quoted 40 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)
crypto/testmgr.c +11 -0
index 5a50416..39ffa69 100644
@@ -2134,6 +2134,17 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
 				      type, mask);
 	goto test_done;
 notest:
+	/*
+	 * Per NIST AESAVS[1], it isn't possible to have automated self-tests
+	 * for counter mode aes vectors, they have to be covered by ecb mode
+	 * and code inspection. The ecb mode tests are trigger above in the
+	 * CRYPTO_ALG_TYPE_CIPHER section. Suppress warnings about missing
+	 * ctr tests if we're in fips mode to avoid confusion.
+	 *
+	 * [1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf
+	 */
+	if (fips_enabled && !strncmp(alg, "ctr(aes", 7))
+		goto test_done;
 	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
 test_done:
 	if (fips_enabled && rc)
Quoted 1 line

From the way I read the document, anything operating in a counter mode will have

an unpredictable output (given the counter operation isn't specified). While the above works, I'm not sure that it fully covers the various ccm modes available (ccm_base and rfc4309). Perhaps instead it would be better to add a TFM mask flag indicating that the selected transform included a unpredictable component or counter input (marking the alg as being unsuitable for automatic testing without knoweldge of the inner workings of that counter. Then you could just test for that flag?

Neil

Quoted 4 lines
Signature · 2 lines
Jarod Wilson
[email protected]
author
#2 lore raw
Quoted 37 lines · On Wednesday 29 April 2009 06:50:35 Neil Horman wrote:
Quoted 36 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)
crypto/testmgr.c +11 -0
index 5a50416..39ffa69 100644
@@ -2134,6 +2134,17 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
 				      type, mask);
 	goto test_done;
 notest:
+	/*
+	 * Per NIST AESAVS[1], it isn't possible to have automated self-tests
+	 * for counter mode aes vectors, they have to be covered by ecb mode
+	 * and code inspection. The ecb mode tests are trigger above in the
+	 * CRYPTO_ALG_TYPE_CIPHER section. Suppress warnings about missing
+	 * ctr tests if we're in fips mode to avoid confusion.
+	 *
+	 * [1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf
+	 */
+	if (fips_enabled && !strncmp(alg, "ctr(aes", 7))
+		goto test_done;
Quoted 8 lines

crypto/testmgr.c int alg_test(const char *driver, const char *alg, u32 type, u32 mask) · line 2150

Quoted 4 lines
crypto/testmgr.c +0 -0
 	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
 test_done:
 	if (fips_enabled && rc)

From the way I read the document, anything operating in a counter mode will have an unpredictable output (given the counter operation isn't specified). While the above works, I'm not sure that it fully covers the various ccm modes available (ccm_base and rfc4309).

I believe Appendix A only applies for straight up counter-mode aes, ccm_base and rfc4309 actually have well-defined counter operations. We've already got self-tests for ccm(aes) and a pending patch for rfc4309(ccm(aes), and since they don't start w/'ctr(aes', they wouldn't be caught by that (admittedly hacky) check even if we didn't have test vectors for them.

Quoted 5 lines

Perhaps instead it would be better to add a
TFM mask flag indicating that the selected transform included a unpredictable component or counter input (marking the alg as being unsuitable for automatic testing without knoweldge of the inner workings of that counter. Then you could just test for that flag?

Yeah, I thought about a flag too, but it seemed potentially a lot of overhead for what might well be restricted to ctr(aes*). It might've been relevant for ctr(des3_ede) or ctr(des), but they're not on the fips approved algo/mode list, so I took the easy way out. I'm game to go the flag route if need be though.

Signature · 2 lines
Jarod Wilson
[email protected]
author
#3 lore raw

PATCH v2 1/1 crypto: don't raise alarm for no ctr(aes) tests

Quoted 12 lines · On Wednesday 29 April 2009 08:46:47 Jarod Wilson wrote:
Quoted 11 lines · On Wednesday 29 April 2009 06:50:35 Neil Horman wrote:
Quoted 10 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf

[...]

Quoted 18 lines
Quoted 4 lines

From the way I read the document, anything operating in a counter mode will have an unpredictable output (given the counter operation isn't specified). While the above works, I'm not sure that it fully covers the various ccm modes available (ccm_base and rfc4309).

I believe Appendix A only applies for straight up counter-mode aes, ccm_base and rfc4309 actually have well-defined counter operations. We've already got self-tests for ccm(aes) and a pending patch for rfc4309(ccm(aes), and since they don't start w/'ctr(aes', they wouldn't be caught by that (admittedly hacky) check even if we didn't have test vectors for them.

Quoted 5 lines

Perhaps instead it would be better to add a
TFM mask flag indicating that the selected transform included a unpredictable component or counter input (marking the alg as being unsuitable for automatic testing without knoweldge of the inner workings of that counter. Then you could just test for that flag?

Quoted 5 lines

Yeah, I thought about a flag too, but it seemed potentially a lot of overhead for what might well be restricted to ctr(aes*). It might've been relevant for ctr(des3_ede) or ctr(des), but they're not on the fips approved algo/mode list, so I took the easy way out. I'm game to go the flag route if need be though.

Neil and I talked a bit more off-list about the best approach to take, and after a bit of trial and error, we came up with the idea to simply add an 'untestable' flag to the alg_test_desc struct, a corresponding entry for ctr(aes) in alg_test_descs, and a hook to check for untestable algs in alg_find_test().

Works well enough in local testing, eliminates the use of strncmp, and results in far more granular control over marking which algs are explicitly untestable and shouldn't have warnings printed for. At the moment, I've gone for suppressing the warnings regardless of whether we're in fips mode or not, but adding a different warning (er, info) message in the untestable case works too, if that's preferred. The errnos used seem appropriate, but I might have missed more appropriate ones somewhere.

nb: this patch applies atop my earlier '[PATCH v2] crypto: catch base cipher self-test failures in fips mode'.

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   21 +++++++++++++++++++--
 1 files changed, 19 insertions(+), 2 deletions(-)
crypto/testmgr.c +19 -2
index f39c148..b78278c 100644
@@ -94,6 +94,7 @@ struct alg_test_desc {
 	const char *alg;
 	int (*test)(const struct alg_test_desc *desc, const char *driver,
 		    u32 type, u32 mask);
+	int untestable;
 
 	union {
 		struct aead_test_suite aead;

@@ -1518,6 +1519,13 @@ static const struct alg_test_desc alg_test_descs[] = {
 			}
 		}
 	}, {
+		/*
+		 * Automated ctr(aes) tests aren't possible per Appendix A of
+		 * http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf
+		 */
+		.alg = "ctr(aes)",
+		.untestable = 1,
+	}, {
 		.alg = "cts(cbc(aes))",
 		.test = alg_test_skcipher,
 		.suite = {

@@ -2198,10 +2206,13 @@ static int alg_find_test(const char *alg)
 			continue;
 		}
 
+		if (alg_test_descs[i].untestable)
+			return -ENODATA;
+
 		return i;
 	}
 
-	return -1;
+	return -ENOSYS;
 }
 
 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)

@@ -2237,7 +2248,13 @@ test_done:
 	return rc;
 
 notest:
-	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
+	switch (i) {
+	case -ENODATA:
+		break;
+	case -ENOSYS:
+	default:
+		printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
+	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(alg_test);
Signature · 2 lines
Jarod Wilson
[email protected]
Acked-by on v2 1/1
#4 lore raw

Re: [PATCH v2] crypto: don't raise alarm for no ctr(aes) tests

Quoted 124 lines · Jarod Wilson
Quoted 12 lines · On Wednesday 29 April 2009 08:46:47 Jarod Wilson wrote:
Quoted 11 lines · On Wednesday 29 April 2009 06:50:35 Neil Horman wrote:
Quoted 10 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

Dependent on earlier patch 'crypto: catch base cipher self-test failures in fips mode', which adds the test_done label.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf

[...]

Quoted 18 lines
Quoted 4 lines

From the way I read the document, anything operating in a counter mode will have an unpredictable output (given the counter operation isn't specified). While the above works, I'm not sure that it fully covers the various ccm modes available (ccm_base and rfc4309).

I believe Appendix A only applies for straight up counter-mode aes, ccm_base and rfc4309 actually have well-defined counter operations. We've already got self-tests for ccm(aes) and a pending patch for rfc4309(ccm(aes), and since they don't start w/'ctr(aes', they wouldn't be caught by that (admittedly hacky) check even if we didn't have test vectors for them.

Quoted 5 lines

Perhaps instead it would be better to add a
TFM mask flag indicating that the selected transform included a unpredictable component or counter input (marking the alg as being unsuitable for automatic testing without knoweldge of the inner workings of that counter. Then you could just test for that flag?

Quoted 5 lines

Yeah, I thought about a flag too, but it seemed potentially a lot of overhead for what might well be restricted to ctr(aes*). It might've been relevant for ctr(des3_ede) or ctr(des), but they're not on the fips approved algo/mode list, so I took the easy way out. I'm game to go the flag route if need be though.

Neil and I talked a bit more off-list about the best approach to take, and after a bit of trial and error, we came up with the idea to simply add an 'untestable' flag to the alg_test_desc struct, a corresponding entry for ctr(aes) in alg_test_descs, and a hook to check for untestable algs in alg_find_test().

Works well enough in local testing, eliminates the use of strncmp, and results in far more granular control over marking which algs are explicitly untestable and shouldn't have warnings printed for. At the moment, I've gone for suppressing the warnings regardless of whether we're in fips mode or not, but adding a different warning (er, info) message in the untestable case works too, if that's preferred. The errnos used seem appropriate, but I might have missed more appropriate ones somewhere.

nb: this patch applies atop my earlier '[PATCH v2] crypto: catch base cipher self-test failures in fips mode'.

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   21 +++++++++++++++++++--
 1 files changed, 19 insertions(+), 2 deletions(-)
crypto/testmgr.c +19 -2
index f39c148..b78278c 100644
@@ -94,6 +94,7 @@ struct alg_test_desc {
 	const char *alg;
 	int (*test)(const struct alg_test_desc *desc, const char *driver,
 		    u32 type, u32 mask);
+	int untestable;
 
 	union {
 		struct aead_test_suite aead;

@@ -1518,6 +1519,13 @@ static const struct alg_test_desc alg_test_descs[] = {
 			}
 		}
 	}, {
+		/*
+		 * Automated ctr(aes) tests aren't possible per Appendix A of
+		 * http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf
+		 */
+		.alg = "ctr(aes)",
+		.untestable = 1,
+	}, {
 		.alg = "cts(cbc(aes))",
 		.test = alg_test_skcipher,
 		.suite = {

@@ -2198,10 +2206,13 @@ static int alg_find_test(const char *alg)
 			continue;
 		}
 
+		if (alg_test_descs[i].untestable)
+			return -ENODATA;
+
 		return i;
 	}
 
-	return -1;
+	return -ENOSYS;
 }
 
 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)

@@ -2237,7 +2248,13 @@ test_done:
 	return rc;
 
 notest:
-	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
+	switch (i) {
+	case -ENODATA:
+		break;
+	case -ENOSYS:
+	default:
+		printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
+	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(alg_test);
Signature · 3 lines
-- 
Jarod Wilson
[email protected]
Acked-by Neil Horman <[email protected]>
maintainer
#5 lore raw
In reply to Jarod Wilson
Quoted 5 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

This is not true at all. In our implementation the counter is set through the IV so it definitely is possible to test counter mode algorithms in Linux.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#6 lore raw
Quoted 10 lines · On Monday 04 May 2009 07:10:10 Herbert Xu wrote:
Quoted 5 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

This is not true at all. In our implementation the counter is set through the IV so it definitely is possible to test counter mode algorithms in Linux.

Ah... Now I think I see... We can provide an initial counter w/o a problem, but counter incrementation is implementation-specific, so we can't have automated tests that cover multiple enc/dec ops, but if we limit ourselves to just one op, self-tests should be perfectly doable, and NIST SP 800-38A, Appendix F.5 has vectors we could make use of (using just the block #1 values). At least, spot-checking the vectors, I'm getting the expected results for the 1st block.

Okay, I'll whip something up in a sec.

Signature · 2 lines
Jarod Wilson
[email protected]
maintainer
#7 lore raw
Quoted 3 lines · Jarod Wilson

Ah... Now I think I see... We can provide an initial counter w/o a problem, but counter incrementation is implementation-specific, so

Not in Linux. If you're going to provide ctr you'd better increment in the way the current implementation does it. Otherwise anything that wraps around it, such as RFC3686 will fail.

Another way to put it, only the counter mode as used in RFC 3686, CCM and GCM is what we call ctr.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#8 lore raw
Quoted 10 lines · Herbert Xu
Quoted 2 lines · Jarod Wilson

Ah... Now I think I see... We can provide an initial counter w/o a problem, but counter incrementation is implementation-specific, so

Not in Linux. If you're going to provide ctr you'd better increment in the way the current implementation does it. Otherwise anything that wraps around it, such as RFC3686 will fail.

Another way to put it, only the counter mode as used in RFC 3686, CCM and GCM is what we call ctr.

Yeah, no, I didn't mean within Linux we'd have different implementations, I meant e.g. Linux vs. Windows vs. a Cisco router or what have you as far as the base counter increment routine being implementation-specific.

Can't keep all the RFCs and SPs and whatnot straight in my head, and they aren't in front of me, but I thought I read that the basic counter increment routine wasn't mandated to be any specific way, the only mandate was to ensure unique values. Suggestions for how to do so were made though.

That all seems to coincide with the AESAVS's assertion that automated testing of ctr(aes) isn't possible, if one considers that Monte Carlo tests are typically a standard part of all the other ciphers/modes full validation test suites. I just initially read that to mean that self-tests weren't possible, while I now believe its only referring to exhaustive CAVS testing (i.e. w/MCT) not being possible, due to potential differences from one counter inc routine to another.

Its also possible I'm losing my mind though.

Signature · 2 lines
Jarod Wilson
[email protected]
maintainer
#9 lore raw
Quoted 5 lines · Jarod Wilson

Can't keep all the RFCs and SPs and whatnot straight in my head, and they aren't in front of me, but I thought I read that the basic counter increment routine wasn't mandated to be any specific way, the only mandate was to ensure unique values. Suggestions for how to do so were made though.

It doesn't matter what is or isn't specified for CTR, the thing that we call "ctr" is the one that's used for RFC 3686, CCM, and GCM. It is completely pinned down and can be tested.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#10 lore raw
Quoted 10 lines · On Tuesday 05 May 2009 01:29:05 Herbert Xu wrote:
Quoted 5 lines · Jarod Wilson

Can't keep all the RFCs and SPs and whatnot straight in my head, and they aren't in front of me, but I thought I read that the basic counter increment routine wasn't mandated to be any specific way, the only mandate was to ensure unique values. Suggestions for how to do so were made though.

It doesn't matter what is or isn't specified for CTR, the thing that we call "ctr" is the one that's used for RFC 3686, CCM, and GCM. It is completely pinned down and can be tested.

There are two different "can be tested" contexts here. I completely agree that ctr(aes) is testable within the tcrypt/testmgr context, and sent a patch for such in this thread yesterday. The other context is FIPS CAVS testing, which NIST is saying can't be done, and I was attempting to understand why, which probably only served to muddy the waters. We can definitely do self-tests for ctr(aes).

Signature · 2 lines
Jarod Wilson
[email protected]
author
#11 lore raw

PATCH 1/1 crypto: add ctr(aes) test vectors

In reply to Herbert Xu
Quoted 10 lines · On Monday 04 May 2009 07:10:10 Herbert Xu wrote:
Quoted 5 lines · Jarod Wilson

Per the NIST AESAVS document, Appendix A[1], it isn't possible to have automated self-tests for counter-mode AES, but people are misled to believe something is wrong by the message that says there is no test for ctr(aes). Simply suppress all 'no test for ctr(aes*' messages if fips_enabled is set to avoid confusion.

This is not true at all. In our implementation the counter is set through the IV so it definitely is possible to test counter mode algorithms in Linux.

Indeed, the first enc/dec operation after we set the counter *is* completely deterministic across all implementations, the AESAVS is referring to tests with multiple operations, which aren't possible, due to varying implementations of counter increment routines. This patch adds test vectors for ctr(aes), using the first block input values from Appendix F.5 of NIST Special Pub 800-38A.

Was also necessary to rename the rfc3686(ctr(aes)) components slightly, to resolve a namespace collision.

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/testmgr.c |   23 +++++++++++--
 crypto/testmgr.h |   92 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 109 insertions(+), 6 deletions(-)
crypto/testmgr.c +19 -4
index ffe7963..0efdda7 100644
@@ -1518,6 +1518,21 @@ static const struct alg_test_desc alg_test_descs[] = {
 			}
 		}
 	}, {
+		.alg = "ctr(aes)",
+		.test = alg_test_skcipher,
+		.suite = {
+			.cipher = {
+				.enc = {
+					.vecs = aes_ctr_enc_tv_template,
+					.count = AES_CTR_ENC_TEST_VECTORS
+				},
+				.dec = {
+					.vecs = aes_ctr_dec_tv_template,
+					.count = AES_CTR_DEC_TEST_VECTORS
+				}
+			}
+		}
+	}, {
 		.alg = "cts(cbc(aes))",
 		.test = alg_test_skcipher,
 		.suite = {

@@ -1967,12 +1982,12 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.cipher = {
 				.enc = {
-					.vecs = aes_ctr_enc_tv_template,
-					.count = AES_CTR_ENC_TEST_VECTORS
+					.vecs = aes_ctr_rfc3686_enc_tv_template,
+					.count = AES_CTR_3686_ENC_TEST_VECTORS
 				},
 				.dec = {
-					.vecs = aes_ctr_dec_tv_template,
-					.count = AES_CTR_DEC_TEST_VECTORS
+					.vecs = aes_ctr_rfc3686_dec_tv_template,
+					.count = AES_CTR_3686_DEC_TEST_VECTORS
 				}
 			}
 		}
crypto/testmgr.h +90 -2

104 lines not on this page · raw message

Signature · 2 lines
Jarod Wilson
[email protected]
maintainer
#12 lore raw

Re: [PATCH] crypto: add ctr(aes) test vectors

Quoted 8 lines · Jarod Wilson

Indeed, the first enc/dec operation after we set the counter *is* completely deterministic across all implementations, the AESAVS is referring to tests with multiple operations, which aren't possible, due to varying implementations of counter increment routines. This patch adds test vectors for ctr(aes), using the first block input values from Appendix F.5 of NIST Special Pub 800-38A.

Well, our ctr(aes) must be completely deterministic as it is used as the base for CCM and GCM. In fact, if it weren't so then you can't use it for anything since two implementations may produces different outputs.

So if you could resend some vectors that test multiple blocks then I'll happily add them.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#13 lore raw

Re: [PATCH] crypto: add ctr(aes) test vectors

Quoted 10 lines · On Tuesday 05 May 2009 09:18:35 Herbert Xu wrote:
Quoted 8 lines · Jarod Wilson

Indeed, the first enc/dec operation after we set the counter *is* completely deterministic across all implementations, the AESAVS is referring to tests with multiple operations, which aren't possible, due to varying implementations of counter increment routines. This patch adds test vectors for ctr(aes), using the first block input values from Appendix F.5 of NIST Special Pub 800-38A.

Quoted 4 lines

Well, our ctr(aes) must be completely deterministic as it is used as the base for CCM and GCM. In fact, if it weren't so then you can't use it for anything since two implementations may produces different outputs.

Yeah, that makes sense, I believe I finally see the light.

Quoted 2 lines

So if you could resend some vectors that test multiple blocks then I'll happily add them.

Multi-block test vectors coming shortly, passing in all the input blocks from F.5 of 800-38A is spitting back the expected answers for ever block.

Signature · 2 lines
Jarod Wilson
[email protected]
author
#14 lore raw

PATCH v2 1/1 crypto: add ctr(aes) test vectors

Quoted 16 lines · On Tuesday 05 May 2009 09:55:24 Jarod Wilson wrote:
Quoted 10 lines · On Tuesday 05 May 2009 09:18:35 Herbert Xu wrote:
Quoted 8 lines · Jarod Wilson

Indeed, the first enc/dec operation after we set the counter *is* completely deterministic across all implementations, the AESAVS is referring to tests with multiple operations, which aren't possible, due to varying implementations of counter increment routines. This patch adds test vectors for ctr(aes), using the first block input values from Appendix F.5 of NIST Special Pub 800-38A.

Quoted 4 lines

Well, our ctr(aes) must be completely deterministic as it is used as the base for CCM and GCM. In fact, if it weren't so then you can't use it for anything since two implementations may produces different outputs.

Quoted 8 lines

Yeah, that makes sense, I believe I finally see the light.

Quoted 2 lines

So if you could resend some vectors that test multiple blocks then I'll happily add them.

Multi-block test vectors coming shortly, passing in all the input blocks from F.5 of 800-38A is spitting back the expected answers for ever block.

Now with multi-block test vectors, all from SP800-38A, Appendix F.5. Also added ctr(aes) to case 10 in tcrypt.

Quickly smoke-tested in fips mode, got back "alg_test: alg ctr(aes-x86_64) (ctr(aes)) self-test passed".

Signed-off-by Jarod Wilson <[email protected]>
---
 crypto/tcrypt.c  |    1 +
 crypto/testmgr.c |   23 ++++++-
 crypto/testmgr.h |  164 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 182 insertions(+), 6 deletions(-)
crypto/tcrypt.c +1 -0
index ea3b8a8..9e4974e 100644
@@ -526,6 +526,7 @@ static void do_test(int m)
 		tcrypt_test("cbc(aes)");
 		tcrypt_test("lrw(aes)");
 		tcrypt_test("xts(aes)");
+		tcrypt_test("ctr(aes)");
 		tcrypt_test("rfc3686(ctr(aes))");
 		break;
crypto/testmgr.c +19 -4
index ffe7963..0efdda7 100644
@@ -1518,6 +1518,21 @@ static const struct alg_test_desc alg_test_descs[] = {
 			}
 		}
 	}, {
+		.alg = "ctr(aes)",
+		.test = alg_test_skcipher,
+		.suite = {
+			.cipher = {
+				.enc = {
+					.vecs = aes_ctr_enc_tv_template,
+					.count = AES_CTR_ENC_TEST_VECTORS
+				},
+				.dec = {
+					.vecs = aes_ctr_dec_tv_template,
+					.count = AES_CTR_DEC_TEST_VECTORS
+				}
+			}
+		}
+	}, {
 		.alg = "cts(cbc(aes))",
 		.test = alg_test_skcipher,
 		.suite = {

@@ -1967,12 +1982,12 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.suite = {
 			.cipher = {
 				.enc = {
-					.vecs = aes_ctr_enc_tv_template,
-					.count = AES_CTR_ENC_TEST_VECTORS
+					.vecs = aes_ctr_rfc3686_enc_tv_template,
+					.count = AES_CTR_3686_ENC_TEST_VECTORS
 				},
 				.dec = {
-					.vecs = aes_ctr_dec_tv_template,
-					.count = AES_CTR_DEC_TEST_VECTORS
+					.vecs = aes_ctr_rfc3686_dec_tv_template,
+					.count = AES_CTR_3686_DEC_TEST_VECTORS
 				}
 			}
 		}
crypto/testmgr.h +162 -2

176 lines not on this page · raw message

Signature · 2 lines
Jarod Wilson
[email protected]
maintainer
#15 lore raw

Re: [PATCH v2] crypto: add ctr(aes) test vectors

Quoted 8 lines · Jarod Wilson

Now with multi-block test vectors, all from SP800-38A, Appendix F.5. Also added ctr(aes) to case 10 in tcrypt.

Quickly smoke-tested in fips mode, got back "alg_test: alg ctr(aes-x86_64) (ctr(aes)) self-test passed".

Signed-off-by Jarod Wilson <[email protected]>

It didn't build because you forgot to change the RFC3686 dec vector name. I've fixed it for you. Please test your patches in future.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#16 lore raw

Re: [PATCH v2] crypto: add ctr(aes) test vectors

Quoted 5 lines · On Wednesday 06 May 2009 05:30:21 Herbert Xu wrote:
Quoted 4 lines · Jarod Wilson

Now with multi-block test vectors, all from SP800-38A, Appendix F.5. Also added ctr(aes) to case 10 in tcrypt.

Quoted 8 lines
Quoted 4 lines

Quickly smoke-tested in fips mode, got back "alg_test: alg ctr(aes-x86_64) (ctr(aes)) self-test passed".

Signed-off-by Jarod Wilson <[email protected]>

It didn't build because you forgot to change the RFC3686 dec vector name. I've fixed it for you. Please test your patches in future.

Gah, apologies. Tested it in that other kernel tree I needed to get this done for, then neglected to do so for cryptodev.

Thanks for the fixage.

Signature · 2 lines
Jarod Wilson
[email protected]