FIPS validation capability

PATCH Superseded Fan Zhang 2 participants 20 messages Oct 4, 2018 – Oct 9, 2018 Arm/Amlogic Meson SoC support

Share & tools

Fan Zhang

author

2018-10-04 09:55 UTC #0 lore raw

v2 cover FIPS validation capability

This sample application is made for the purpose so that users of DPDK who wish to get FIPS certification for their platforms, this sample app enables users to parse test vectors that is gotten from NIST and be able to get a generated response file which they can then verify and be sure their system will pass FIPS certification.

Marko Kovacevic (8):
examples: add fips validation into examples
examples: add aes parser and enablement for test types
examples: add hmac parser
examples: add TDES parser and enablement for test types
examples: add gcm parser
examples: add cmac parser and enablement for test types
examples: add ccm parser and enablement for test types
doc: add guides for fips validation

 doc/guides/rel_notes/release_18_11.rst             |    6 +
 doc/guides/sample_app_ug/fips_validation.rst       |   97 ++
 doc/guides/sample_app_ug/index.rst                 |    5 +
 examples/cryptodev_fips_validate/Makefile          |   75 ++
 .../cryptodev_fips_parse_3des.c                    |  259 +++++
 .../cryptodev_fips_parse_aes.c                     |  188 +++
 .../cryptodev_fips_parse_ccm.c                     |  272 +++++
 .../cryptodev_fips_parse_cmac.c                    |  116 ++
 .../cryptodev_fips_parse_gcm.c                     |  125 ++
 .../cryptodev_fips_parse_hmac.c                    |  105 ++
 .../cryptodev_fips_parse_validate.c                |  593 ++++++++++
 .../cryptodev_fips_validate.h                      |  234 ++++
 examples/cryptodev_fips_validate/main.c            | 1219 ++++++++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   20 +
 14 files changed, 3314 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/fips_validation.rst
 create mode 100644 examples/cryptodev_fips_validate/Makefile
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_validate.h
 create mode 100644 examples/cryptodev_fips_validate/main.c
 create mode 100644 examples/cryptodev_fips_validate/meson.build

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #1 lore raw

PATCH v2 1/8 examples: add fips validation into examples

From: Marko Kovacevic <[email protected]>

Added FIPS application into the examples to allow users to use a simple sample app to validate their systems and be able to get FIPS certification.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |  69 +++
 .../cryptodev_fips_parse_validate.c                | 562 +++++++++++++++++++++
 .../cryptodev_fips_validate.h                      | 150 ++++++
 examples/cryptodev_fips_validate/main.c            | 387 ++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |  14 +
 5 files changed, 1182 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/Makefile
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_validate.h
 create mode 100644 examples/cryptodev_fips_validate/main.c
 create mode 100644 examples/cryptodev_fips_validate/meson.build

examples/cryptodev_fips_validate/Makefile new file +69 -0

new file mode 100644
index 000000000..5515aa6d9
@@ -0,0 +1,69 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2010-2014 Intel Corporation
+
+# binary name
+APP = cryptodev_fips_validate_app
+
+# all source are stored in SRCS-y
+SRCS-y += cryptodev_fips_parse_validate.c
+SRCS-y += main.c
+
+# Build using pkg-config variables if possible
+$(shell pkg-config --exists libdpdk)
+ifeq ($(.SHELLSTATUS),0)
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell pkg-config --path libdpdk)
+CFLAGS += -O3 $(shell pkg-config --cflags libdpdk)
+LDFLAGS_SHARED = $(shell pkg-config --libs libdpdk)
+LDFLAGS_STATIC = -Wl,-Bstatic $(shell pkg-config --static --libs libdpdk)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	rmdir --ignore-fail-on-non-empty build
+
+else
+
+ifeq ($(RTE_SDK),)
+$(error "Please define RTE_SDK environment variable")
+endif
+
+# Default target, can be overridden by command line or environment
+RTE_TARGET ?= x86_64-native-linuxapp-gcc
+
+INC += $(sort $(wildcard *.h))
+
+include $(RTE_SDK)/mk/rte.vars.mk
+
+CFLAGS += $(WERROR_FLAGS)
+
+# workaround for a gcc bug with noreturn attribute
+# http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12603
+ifeq ($(CONFIG_RTE_TOOLCHAIN_GCC),y)
+CFLAGS_main.o += -Wno-return-type
+endif
+
+CFLAGS += -DALLOW_EXPERIMENTAL_API
+CFLAGS += -I$(SRCDIR)
+CFLAGS += -O3
+CFLAGS += $(WERROR_FLAGS)
+
+include $(RTE_SDK)/mk/rte.extapp.mk
+
+endif

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c new file +562 -0

562 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_validate.h new file +150 -0

150 lines not on this page · raw message

examples/cryptodev_fips_validate/main.c new file +387 -0

387 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build new file +14 -0

new file mode 100644
index 000000000..e41773305
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2018 Intel Corporation
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev', 'bus_pci']
+allow_experimental_apis = true
+sources = files(
+	'cryptodev_fips_parse_validate.c',
+	'main.c'
+)

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #2 lore raw

PATCH v2 2/8 examples: add aes parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for AES-CBC parser, to allow the application to parser the aes request file and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_aes.c                     | 186 +++++++++++
 .../cryptodev_fips_parse_validate.c                |   6 +
 .../cryptodev_fips_validate.h                      |  24 ++
 examples/cryptodev_fips_validate/main.c            | 345 ++++++++++++++++++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 562 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 5515aa6d9..f058081ff 100644
@@ -5,6 +5,7 @@
 APP = cryptodev_fips_validate_app
 
 # all source are stored in SRCS-y
+SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c new file +186 -0

186 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +6 -0

index aec5bb9c6..32af47b1c 100644
@@ -104,6 +104,12 @@ fips_test_parse_header(void)
 		return ret;
 
 	for (i = 0; i < info.nb_vec_lines; i++) {
+		if (strstr(info.vec[i], "AESVS")) {
+			info.algo = FIPS_TEST_ALGO_AES;
+			ret = parse_test_aes_init();
+			if (ret < 0)
+				return ret;
+		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");
 		if (tmp != NULL) {

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +24 -0

index beb6bedda..5ac858d02 100644
@@ -23,6 +23,7 @@
 #define FAX_FILE_PERFIX		"fax"
 
 enum fips_test_algorithms {
+		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_MAX
 };

@@ -77,6 +78,21 @@ struct fips_test_callback {
 	struct fips_val *val;
 };
 
+enum fips_aesavs_test_types {
+	AESAVS_TYPE_GFXBOX = 0,
+	AESAVS_TYPE_KEYSBOX,
+	AESAVS_TYPE_VARKEY,
+	AESAVS_TYPE_VARTXT,
+	AESAVS_TYPE_MMT,
+	AESAVS_TYPE_MCT,
+};
+
+struct aesavs_interim_data {
+	enum fips_aesavs_test_types test_type;
+	uint32_t cipher_algo;
+	uint32_t key_len;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -88,6 +104,11 @@ struct fips_test_interim_info {
 	//uint8_t cryptodev_id;
 	char device_name[MAX_STRING_SIZE];
 
+	union {
+		struct aesavs_interim_data aes_data;
+
+	} interim_info;
+
 	enum fips_test_op op;
 
 	const struct fips_test_callback *callbacks;

@@ -118,6 +139,9 @@ void
 fips_test_write_one_case(void);
 
 int
+parse_test_aes_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +344 -1

361 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index e41773305..d04e9bbeb 100644
@@ -9,6 +9,7 @@
 deps += ['cryptodev', 'bus_pci']
 allow_experimental_apis = true
 sources = files(
+	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #3 lore raw

PATCH v2 3/8 examples: add hmac parser

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for HMAC parser, to allow the application to parser the hmac request files and to validate all tests supported

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_hmac.c                    | 105 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   9 ++
 examples/cryptodev_fips_validate/main.c            | 103 ++++++++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 224 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c

examples/cryptodev_fips_validate/Makefile +1 -0

index f058081ff..50be23cf5 100644
@@ -6,6 +6,7 @@ APP = cryptodev_fips_validate_app
 
 # all source are stored in SRCS-y
 SRCS-y := cryptodev_fips_parse_aes.c
+SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c new file +105 -0

105 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index 32af47b1c..f1cd80253 100644
@@ -109,6 +109,11 @@ fips_test_parse_header(void)
 			ret = parse_test_aes_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "HMAC")) {
+			info.algo = FIPS_TEST_ALGO_HMAC;
+			ret = parse_test_hmac_init();
+			if (ret < 0)
+				return ret;
 		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +9 -0

index 5ac858d02..3cda9fe87 100644
@@ -24,6 +24,7 @@
 
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
+		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_MAX
 };

@@ -93,6 +94,10 @@ struct aesavs_interim_data {
 	uint32_t key_len;
 };
 
+struct hmac_interim_data {
+	enum rte_crypto_auth_algorithm algo;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -106,6 +111,7 @@ struct fips_test_interim_info {
 
 	union {
 		struct aesavs_interim_data aes_data;
+		struct hmac_interim_data hmac_data;
 
 	} interim_info;

@@ -142,6 +148,9 @@ int
 parse_test_aes_init(void);
 
 int
+parse_test_hmac_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +103 -0

121 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index d04e9bbeb..dcf90bbbb 100644
@@ -10,6 +10,7 @@ deps += ['cryptodev', 'bus_pci']
 allow_experimental_apis = true
 sources = files(
 	'cryptodev_fips_parse_aes.c',
+	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #4 lore raw

PATCH v2 4/8 examples: add TDES parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for TDES parser, to allow the application to parser the TDES request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_3des.c                    | 259 +++++++++++++++++++++
 .../cryptodev_fips_parse_aes.c                     |   2 +
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |  21 ++
 examples/cryptodev_fips_validate/main.c            | 175 ++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 7 files changed, 464 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 50be23cf5..54ea43ffd 100644
@@ -7,6 +7,7 @@ APP = cryptodev_fips_validate_app
 # all source are stored in SRCS-y
 SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
+SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c new file +259 -0

259 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c +2 -0

index 39dbd6ff9..cc2775428 100644
@@ -33,6 +33,8 @@ struct {
 		{AESAVS_TYPE_KEYSBOX, "KeySbox"},
 		{AESAVS_TYPE_VARKEY, "VarKey"},
 		{AESAVS_TYPE_VARTXT, "VarTxt"},
+		{TDES_VARIABLE_TEXT, "VARIABLE PLAINTEXT/CIPHERTEXT"},
+		{TDES_VARIABLE_TEXT, "KAT"},
 		{AESAVS_TYPE_MMT, "MMT"},
 		{AESAVS_TYPE_MCT, "MCT"},
 };

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index f1cd80253..bb396e54d 100644
@@ -114,6 +114,11 @@ fips_test_parse_header(void)
 			ret = parse_test_hmac_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "TDES")) {
+			info.algo = FIPS_TEST_ALGO_TDES;
+			ret = parse_test_tdes_init();
+			if (ret < 0)
+				return 0;
 		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +21 -0

index 3cda9fe87..c9b11dda2 100644
@@ -25,6 +25,7 @@
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_HMAC,
+		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX
 };

@@ -88,6 +89,17 @@ enum fips_aesavs_test_types {
 	AESAVS_TYPE_MCT,
 };
 
+enum fips_tdes_test_types {
+	TDES_INVERSE_PERMUTATION = 0,
+	TDES_PERMUTATION,
+	TDES_SUBSTITUTION_TABLE,
+	TDES_VARIABLE_KEY,
+	TDES_VARIABLE_TEXT,
+	TDES_KAT,
+	TDES_MCT, /* Monte Carlo (Modes) Test */
+	TDES_MMT /* Multi block Message Test */
+};
+
 struct aesavs_interim_data {
 	enum fips_aesavs_test_types test_type;
 	uint32_t cipher_algo;

@@ -98,6 +110,11 @@ struct hmac_interim_data {
 	enum rte_crypto_auth_algorithm algo;
 };
 
+struct tdes_interim_data {
+	enum fips_tdes_test_types test_type;
+	uint32_t nb_keys;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -112,6 +129,7 @@ struct fips_test_interim_info {
 	union {
 		struct aesavs_interim_data aes_data;
 		struct hmac_interim_data hmac_data;
+		struct tdes_interim_data tdes_data;
 
 	} interim_info;

@@ -148,6 +166,9 @@ int
 parse_test_aes_init(void);
 
 int
+parse_test_tdes_init(void);
+
+int
 parse_test_hmac_init(void);
 
 int

examples/cryptodev_fips_validate/main.c +175 -0

193 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index dcf90bbbb..a18e76d4b 100644
@@ -11,6 +11,7 @@ allow_experimental_apis = true
 sources = files(
 	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_hmac.c',
+	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #5 lore raw

PATCH v2 5/8 examples: add gcm parser

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for GCM parser, to allow the application to parser the GCM request file and to validate all tests supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_gcm.c                     | 125 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   4 +
 examples/cryptodev_fips_validate/main.c            | 116 ++++++++++++++++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 251 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 54ea43ffd..1eb0108bd 100644
@@ -8,6 +8,7 @@ APP = cryptodev_fips_validate_app
 SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
+SRCS-y += cryptodev_fips_parse_gcm.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c new file +125 -0

125 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index bb396e54d..d45c88de6 100644
@@ -109,6 +109,11 @@ fips_test_parse_header(void)
 			ret = parse_test_aes_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "GCM")) {
+			info.algo = FIPS_TEST_ALGO_AES_GCM;
+			ret = parse_test_gcm_init();
+			if (ret < 0)
+				return ret;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +4 -0

index c9b11dda2..685bc0bf8 100644
@@ -24,6 +24,7 @@
 
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
+		FIPS_TEST_ALGO_AES_GCM,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -172,6 +173,9 @@ int
 parse_test_hmac_init(void);
 
 int
+parse_test_gcm_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +115 -1

134 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index a18e76d4b..510d2a79e 100644
@@ -12,6 +12,7 @@ sources = files(
 	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_3des.c',
+	'cryptodev_fips_parse_gcm.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #6 lore raw

PATCH v2 6/8 examples: add cmac parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for CMAC parser, to allow the application to parser the cmac request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_cmac.c                    | 116 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   4 +
 examples/cryptodev_fips_validate/main.c            |  43 ++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 170 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 1eb0108bd..f5c2705d5 100644
@@ -9,6 +9,7 @@ SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_gcm.c
+SRCS-y += cryptodev_fips_parse_cmac.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c new file +116 -0

116 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index d45c88de6..4617c67e2 100644
@@ -114,6 +114,11 @@ fips_test_parse_header(void)
 			ret = parse_test_gcm_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "CMAC")) {
+			info.algo = FIPS_TEST_ALGO_AES_CMAC;
+			ret = parse_test_cmac_init();
+			if (ret < 0)
+				return 0;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +4 -0

index 685bc0bf8..7bd1e9a6f 100644
@@ -25,6 +25,7 @@
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_AES_GCM,
+		FIPS_TEST_ALGO_AES_CMAC,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -176,6 +177,9 @@ int
 parse_test_gcm_init(void);
 
 int
+parse_test_cmac_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +43 -0

55 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index 510d2a79e..4889d7095 100644
@@ -13,6 +13,7 @@ sources = files(
 	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_gcm.c',
+	'cryptodev_fips_parse_cmac.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #7 lore raw

PATCH v2 7/8 examples: add ccm parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for CCM parser, to allow the application to parser the ccm request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_ccm.c                     | 272 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |  22 ++
 examples/cryptodev_fips_validate/main.c            |  56 ++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 356 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c

examples/cryptodev_fips_validate/Makefile +1 -0

index f5c2705d5..4f1dc6b5d 100644
@@ -10,6 +10,7 @@ SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_gcm.c
 SRCS-y += cryptodev_fips_parse_cmac.c
+SRCS-y += cryptodev_fips_parse_ccm.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c new file +272 -0

272 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index 4617c67e2..47e3732b2 100644
@@ -119,6 +119,11 @@ fips_test_parse_header(void)
 			ret = parse_test_cmac_init();
 			if (ret < 0)
 				return 0;
+		} else if (strstr(info.vec[i], "CCM")) {
+			info.algo = FIPS_TEST_ALGO_AES_CCM;
+			ret = parse_test_ccm_init();
+			if (ret < 0)
+				return 0;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +22 -0

index 7bd1e9a6f..afa0c0a80 100644
@@ -26,6 +26,7 @@ enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_AES_GCM,
 		FIPS_TEST_ALGO_AES_CMAC,
+		FIPS_TEST_ALGO_AES_CCM,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -102,6 +103,14 @@ enum fips_tdes_test_types {
 	TDES_MMT /* Multi block Message Test */
 };
 
+enum fips_ccm_test_types {
+	CCM_VADT	= 1, /* Variable Associated Data Test */
+	CCM_VPT,		 /* Variable Payload Test */
+	CCM_VNT,		 /* Variable Nonce Test */
+	CCM_VTT,		 /* Variable Tag Test */
+	CCM_DVPT,	 /*  Decryption-Verification Process Test */
+};
+
 struct aesavs_interim_data {
 	enum fips_aesavs_test_types test_type;
 	uint32_t cipher_algo;

@@ -117,6 +126,15 @@ struct tdes_interim_data {
 	uint32_t nb_keys;
 };
 
+struct ccm_interim_data {
+	enum fips_ccm_test_types test_type;
+	uint32_t aad_len;
+	uint32_t pt_len;
+	uint32_t digest_len;
+	uint32_t key_len;
+	uint32_t iv_len;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -132,6 +150,7 @@ struct fips_test_interim_info {
 		struct aesavs_interim_data aes_data;
 		struct hmac_interim_data hmac_data;
 		struct tdes_interim_data tdes_data;
+		struct ccm_interim_data ccm_data;
 
 	} interim_info;

@@ -180,6 +199,9 @@ int
 parse_test_cmac_init(void);
 
 int
+parse_test_ccm_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +55 -1

74 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index 4889d7095..e3bf7ac88 100644
@@ -14,6 +14,7 @@ sources = files(
 	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_gcm.c',
 	'cryptodev_fips_parse_cmac.c',
+	'cryptodev_fips_parse_ccm.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 09:55 UTC #8 lore raw

PATCH v2 8/8 doc: add guides for fips validation

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Document explains how to run the fips sample app and instructions users need to parser all the request files and generate the response files.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 doc/guides/rel_notes/release_18_11.rst       |  6 ++
 doc/guides/sample_app_ug/fips_validation.rst | 97 ++++++++++++++++++++++++++++
 doc/guides/sample_app_ug/index.rst           |  5 ++
 3 files changed, 108 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/fips_validation.rst

doc/guides/rel_notes/release_18_11.rst +6 -0

index 2133a5b9b..db1579b6e 100644
@@ -104,6 +104,12 @@ New Features
   the specified port. The port must be stopped before the command call in order
   to reconfigure queues.
 
+* **Added Cryptodev Fips Validation Example Application.**
+
+  Added an example application to parse and perform symmetric cryptography
+  computation to the NIST Cryptographic Algorithm Validation Program (CAVP)
+  test vectors.
+
 
 API Changes
 -----------

doc/guides/sample_app_ug/fips_validation.rst new file +97 -0

97 lines not on this page · raw message

doc/guides/sample_app_ug/index.rst +5 -0

index 5bedf4f6f..146296b7a 100644
@@ -56,6 +56,7 @@ Sample Applications User Guides
     performance_thread
     ipsec_secgw
     bbdev_app
+    fips_validation
 
 **Figures**

@@ -83,6 +84,10 @@ Sample Applications User Guides
 
 :numref:`figure_client_svr_sym_multi_proc_app` :ref:`figure_client_svr_sym_multi_proc_app`
 
+:numref:`figure_master_slave_proc` :ref:`figure_master_slave_proc`
+
+:numref:`figure_slave_proc_recov` :ref:`figure_slave_proc_recov`
+
 :numref:`figure_qos_sched_app_arch` :ref:`figure_qos_sched_app_arch`
 
 :numref:`figure_pipeline_overview` :ref:`figure_pipeline_overview`

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #9 lore raw

v3 cover FIPS validation capability

In reply to Fan Zhang

Marko Kovacevic (8):
v3:
- Fixed a no-testing bug
- Fixed some code style issue

v2:
- Refactor the code.
- Move the code from test to sample applcation

examples: add fips validation into examples
examples: add aes parser and enablement for test types
examples: add hmac parser
examples: add TDES parser and enablement for test types
examples: add gcm parser
examples: add cmac parser and enablement for test types
examples: add ccm parser and enablement for test types
doc: add guides for fips validation

 doc/guides/rel_notes/release_18_11.rst             |    6 +
 doc/guides/sample_app_ug/fips_validation.rst       |   97 ++
 doc/guides/sample_app_ug/index.rst                 |    5 +
 examples/cryptodev_fips_validate/Makefile          |   75 ++
 .../cryptodev_fips_parse_3des.c                    |  259 +++++
 .../cryptodev_fips_parse_aes.c                     |  188 +++
 .../cryptodev_fips_parse_ccm.c                     |  272 +++++
 .../cryptodev_fips_parse_cmac.c                    |  116 ++
 .../cryptodev_fips_parse_gcm.c                     |  125 ++
 .../cryptodev_fips_parse_hmac.c                    |  105 ++
 .../cryptodev_fips_parse_validate.c                |  593 ++++++++++
 .../cryptodev_fips_validate.h                      |  234 ++++
 examples/cryptodev_fips_validate/main.c            | 1221 ++++++++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   20 +
 14 files changed, 3316 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/fips_validation.rst
 create mode 100644 examples/cryptodev_fips_validate/Makefile
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_validate.h
 create mode 100644 examples/cryptodev_fips_validate/main.c
 create mode 100644 examples/cryptodev_fips_validate/meson.build

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #10 lore raw

PATCH v3 1/8 examples: add fips validation into examples

From: Marko Kovacevic <[email protected]>

Added FIPS application into the examples to allow users to use a simple sample app to validate their systems and be able to get FIPS certification.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |  69 +++
 .../cryptodev_fips_parse_validate.c                | 562 +++++++++++++++++++++
 .../cryptodev_fips_validate.h                      | 150 ++++++
 examples/cryptodev_fips_validate/main.c            | 388 ++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |  14 +
 5 files changed, 1183 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/Makefile
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_validate.h
 create mode 100644 examples/cryptodev_fips_validate/main.c
 create mode 100644 examples/cryptodev_fips_validate/meson.build

examples/cryptodev_fips_validate/Makefile new file +69 -0

new file mode 100644
index 000000000..5515aa6d9
@@ -0,0 +1,69 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2010-2014 Intel Corporation
+
+# binary name
+APP = cryptodev_fips_validate_app
+
+# all source are stored in SRCS-y
+SRCS-y += cryptodev_fips_parse_validate.c
+SRCS-y += main.c
+
+# Build using pkg-config variables if possible
+$(shell pkg-config --exists libdpdk)
+ifeq ($(.SHELLSTATUS),0)
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell pkg-config --path libdpdk)
+CFLAGS += -O3 $(shell pkg-config --cflags libdpdk)
+LDFLAGS_SHARED = $(shell pkg-config --libs libdpdk)
+LDFLAGS_STATIC = -Wl,-Bstatic $(shell pkg-config --static --libs libdpdk)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	rmdir --ignore-fail-on-non-empty build
+
+else
+
+ifeq ($(RTE_SDK),)
+$(error "Please define RTE_SDK environment variable")
+endif
+
+# Default target, can be overridden by command line or environment
+RTE_TARGET ?= x86_64-native-linuxapp-gcc
+
+INC += $(sort $(wildcard *.h))
+
+include $(RTE_SDK)/mk/rte.vars.mk
+
+CFLAGS += $(WERROR_FLAGS)
+
+# workaround for a gcc bug with noreturn attribute
+# http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12603
+ifeq ($(CONFIG_RTE_TOOLCHAIN_GCC),y)
+CFLAGS_main.o += -Wno-return-type
+endif
+
+CFLAGS += -DALLOW_EXPERIMENTAL_API
+CFLAGS += -I$(SRCDIR)
+CFLAGS += -O3
+CFLAGS += $(WERROR_FLAGS)
+
+include $(RTE_SDK)/mk/rte.extapp.mk
+
+endif

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c new file +562 -0

562 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_validate.h new file +150 -0

150 lines not on this page · raw message

examples/cryptodev_fips_validate/main.c new file +388 -0

388 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build new file +14 -0

new file mode 100644
index 000000000..e41773305
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2018 Intel Corporation
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev', 'bus_pci']
+allow_experimental_apis = true
+sources = files(
+	'cryptodev_fips_parse_validate.c',
+	'main.c'
+)

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #11 lore raw

PATCH v3 2/8 examples: add aes parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for AES-CBC parser, to allow the application to parser the aes request file and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_aes.c                     | 186 +++++++++++
 .../cryptodev_fips_parse_validate.c                |   6 +
 .../cryptodev_fips_validate.h                      |  24 ++
 examples/cryptodev_fips_validate/main.c            | 346 ++++++++++++++++++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 563 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 5515aa6d9..f058081ff 100644
@@ -5,6 +5,7 @@
 APP = cryptodev_fips_validate_app
 
 # all source are stored in SRCS-y
+SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c new file +186 -0

186 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +6 -0

index aec5bb9c6..32af47b1c 100644
@@ -104,6 +104,12 @@ fips_test_parse_header(void)
 		return ret;
 
 	for (i = 0; i < info.nb_vec_lines; i++) {
+		if (strstr(info.vec[i], "AESVS")) {
+			info.algo = FIPS_TEST_ALGO_AES;
+			ret = parse_test_aes_init();
+			if (ret < 0)
+				return ret;
+		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");
 		if (tmp != NULL) {

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +24 -0

index beb6bedda..5ac858d02 100644
@@ -23,6 +23,7 @@
 #define FAX_FILE_PERFIX		"fax"
 
 enum fips_test_algorithms {
+		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_MAX
 };

@@ -77,6 +78,21 @@ struct fips_test_callback {
 	struct fips_val *val;
 };
 
+enum fips_aesavs_test_types {
+	AESAVS_TYPE_GFXBOX = 0,
+	AESAVS_TYPE_KEYSBOX,
+	AESAVS_TYPE_VARKEY,
+	AESAVS_TYPE_VARTXT,
+	AESAVS_TYPE_MMT,
+	AESAVS_TYPE_MCT,
+};
+
+struct aesavs_interim_data {
+	enum fips_aesavs_test_types test_type;
+	uint32_t cipher_algo;
+	uint32_t key_len;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -88,6 +104,11 @@ struct fips_test_interim_info {
 	//uint8_t cryptodev_id;
 	char device_name[MAX_STRING_SIZE];
 
+	union {
+		struct aesavs_interim_data aes_data;
+
+	} interim_info;
+
 	enum fips_test_op op;
 
 	const struct fips_test_callback *callbacks;

@@ -118,6 +139,9 @@ void
 fips_test_write_one_case(void);
 
 int
+parse_test_aes_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +345 -1

368 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index e41773305..d04e9bbeb 100644
@@ -9,6 +9,7 @@
 deps += ['cryptodev', 'bus_pci']
 allow_experimental_apis = true
 sources = files(
+	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #12 lore raw

PATCH v3 3/8 examples: add hmac parser

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for HMAC parser, to allow the application to parser the hmac request files and to validate all tests supported

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_hmac.c                    | 105 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   9 ++
 examples/cryptodev_fips_validate/main.c            | 103 ++++++++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 224 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c

examples/cryptodev_fips_validate/Makefile +1 -0

index f058081ff..50be23cf5 100644
@@ -6,6 +6,7 @@ APP = cryptodev_fips_validate_app
 
 # all source are stored in SRCS-y
 SRCS-y := cryptodev_fips_parse_aes.c
+SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_hmac.c new file +105 -0

105 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index 32af47b1c..f1cd80253 100644
@@ -109,6 +109,11 @@ fips_test_parse_header(void)
 			ret = parse_test_aes_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "HMAC")) {
+			info.algo = FIPS_TEST_ALGO_HMAC;
+			ret = parse_test_hmac_init();
+			if (ret < 0)
+				return ret;
 		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +9 -0

index 5ac858d02..3cda9fe87 100644
@@ -24,6 +24,7 @@
 
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
+		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_MAX
 };

@@ -93,6 +94,10 @@ struct aesavs_interim_data {
 	uint32_t key_len;
 };
 
+struct hmac_interim_data {
+	enum rte_crypto_auth_algorithm algo;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -106,6 +111,7 @@ struct fips_test_interim_info {
 
 	union {
 		struct aesavs_interim_data aes_data;
+		struct hmac_interim_data hmac_data;
 
 	} interim_info;

@@ -142,6 +148,9 @@ int
 parse_test_aes_init(void);
 
 int
+parse_test_hmac_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +103 -0

121 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index d04e9bbeb..dcf90bbbb 100644
@@ -10,6 +10,7 @@ deps += ['cryptodev', 'bus_pci']
 allow_experimental_apis = true
 sources = files(
 	'cryptodev_fips_parse_aes.c',
+	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #13 lore raw

PATCH v3 4/8 examples: add TDES parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for TDES parser, to allow the application to parser the TDES request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_3des.c                    | 259 +++++++++++++++++++++
 .../cryptodev_fips_parse_aes.c                     |   2 +
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |  21 ++
 examples/cryptodev_fips_validate/main.c            | 175 ++++++++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 7 files changed, 464 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 50be23cf5..54ea43ffd 100644
@@ -7,6 +7,7 @@ APP = cryptodev_fips_validate_app
 # all source are stored in SRCS-y
 SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
+SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_3des.c new file +259 -0

259 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_aes.c +2 -0

index 39dbd6ff9..cc2775428 100644
@@ -33,6 +33,8 @@ struct {
 		{AESAVS_TYPE_KEYSBOX, "KeySbox"},
 		{AESAVS_TYPE_VARKEY, "VarKey"},
 		{AESAVS_TYPE_VARTXT, "VarTxt"},
+		{TDES_VARIABLE_TEXT, "VARIABLE PLAINTEXT/CIPHERTEXT"},
+		{TDES_VARIABLE_TEXT, "KAT"},
 		{AESAVS_TYPE_MMT, "MMT"},
 		{AESAVS_TYPE_MCT, "MCT"},
 };

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index f1cd80253..bb396e54d 100644
@@ -114,6 +114,11 @@ fips_test_parse_header(void)
 			ret = parse_test_hmac_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "TDES")) {
+			info.algo = FIPS_TEST_ALGO_TDES;
+			ret = parse_test_tdes_init();
+			if (ret < 0)
+				return 0;
 		}
 
 		tmp = strstr(info.vec[i], "# Config info for ");

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +21 -0

index 3cda9fe87..c9b11dda2 100644
@@ -25,6 +25,7 @@
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_HMAC,
+		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX
 };

@@ -88,6 +89,17 @@ enum fips_aesavs_test_types {
 	AESAVS_TYPE_MCT,
 };
 
+enum fips_tdes_test_types {
+	TDES_INVERSE_PERMUTATION = 0,
+	TDES_PERMUTATION,
+	TDES_SUBSTITUTION_TABLE,
+	TDES_VARIABLE_KEY,
+	TDES_VARIABLE_TEXT,
+	TDES_KAT,
+	TDES_MCT, /* Monte Carlo (Modes) Test */
+	TDES_MMT /* Multi block Message Test */
+};
+
 struct aesavs_interim_data {
 	enum fips_aesavs_test_types test_type;
 	uint32_t cipher_algo;

@@ -98,6 +110,11 @@ struct hmac_interim_data {
 	enum rte_crypto_auth_algorithm algo;
 };
 
+struct tdes_interim_data {
+	enum fips_tdes_test_types test_type;
+	uint32_t nb_keys;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -112,6 +129,7 @@ struct fips_test_interim_info {
 	union {
 		struct aesavs_interim_data aes_data;
 		struct hmac_interim_data hmac_data;
+		struct tdes_interim_data tdes_data;
 
 	} interim_info;

@@ -148,6 +166,9 @@ int
 parse_test_aes_init(void);
 
 int
+parse_test_tdes_init(void);
+
+int
 parse_test_hmac_init(void);
 
 int

examples/cryptodev_fips_validate/main.c +175 -0

193 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index dcf90bbbb..a18e76d4b 100644
@@ -11,6 +11,7 @@ allow_experimental_apis = true
 sources = files(
 	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_hmac.c',
+	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #14 lore raw

PATCH v3 5/8 examples: add gcm parser

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for GCM parser, to allow the application to parser the GCM request file and to validate all tests supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_gcm.c                     | 125 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   4 +
 examples/cryptodev_fips_validate/main.c            | 116 ++++++++++++++++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 251 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 54ea43ffd..1eb0108bd 100644
@@ -8,6 +8,7 @@ APP = cryptodev_fips_validate_app
 SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
+SRCS-y += cryptodev_fips_parse_gcm.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_gcm.c new file +125 -0

125 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index bb396e54d..d45c88de6 100644
@@ -109,6 +109,11 @@ fips_test_parse_header(void)
 			ret = parse_test_aes_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "GCM")) {
+			info.algo = FIPS_TEST_ALGO_AES_GCM;
+			ret = parse_test_gcm_init();
+			if (ret < 0)
+				return ret;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +4 -0

index c9b11dda2..685bc0bf8 100644
@@ -24,6 +24,7 @@
 
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
+		FIPS_TEST_ALGO_AES_GCM,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -172,6 +173,9 @@ int
 parse_test_hmac_init(void);
 
 int
+parse_test_gcm_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +115 -1

134 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index a18e76d4b..510d2a79e 100644
@@ -12,6 +12,7 @@ sources = files(
 	'cryptodev_fips_parse_aes.c',
 	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_3des.c',
+	'cryptodev_fips_parse_gcm.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #15 lore raw

PATCH v3 6/8 examples: add cmac parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for CMAC parser, to allow the application to parser the cmac request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_cmac.c                    | 116 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |   4 +
 examples/cryptodev_fips_validate/main.c            |  43 ++++++++
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 170 insertions(+)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c

examples/cryptodev_fips_validate/Makefile +1 -0

index 1eb0108bd..f5c2705d5 100644
@@ -9,6 +9,7 @@ SRCS-y := cryptodev_fips_parse_aes.c
 SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_gcm.c
+SRCS-y += cryptodev_fips_parse_cmac.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_cmac.c new file +116 -0

116 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index d45c88de6..4617c67e2 100644
@@ -114,6 +114,11 @@ fips_test_parse_header(void)
 			ret = parse_test_gcm_init();
 			if (ret < 0)
 				return ret;
+		} else if (strstr(info.vec[i], "CMAC")) {
+			info.algo = FIPS_TEST_ALGO_AES_CMAC;
+			ret = parse_test_cmac_init();
+			if (ret < 0)
+				return 0;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +4 -0

index 685bc0bf8..7bd1e9a6f 100644
@@ -25,6 +25,7 @@
 enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_AES_GCM,
+		FIPS_TEST_ALGO_AES_CMAC,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -176,6 +177,9 @@ int
 parse_test_gcm_init(void);
 
 int
+parse_test_cmac_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +43 -0

55 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index 510d2a79e..4889d7095 100644
@@ -13,6 +13,7 @@ sources = files(
 	'cryptodev_fips_parse_hmac.c',
 	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_gcm.c',
+	'cryptodev_fips_parse_cmac.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #16 lore raw

PATCH v3 7/8 examples: add ccm parser and enablement for test types

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Added enablement for CCM parser, to allow the application to parser the ccm request files and to validate all test types supported.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 examples/cryptodev_fips_validate/Makefile          |   1 +
 .../cryptodev_fips_parse_ccm.c                     | 272 +++++++++++++++++++++
 .../cryptodev_fips_parse_validate.c                |   5 +
 .../cryptodev_fips_validate.h                      |  22 ++
 examples/cryptodev_fips_validate/main.c            |  56 ++++-
 examples/cryptodev_fips_validate/meson.build       |   1 +
 6 files changed, 356 insertions(+), 1 deletion(-)
 create mode 100644 examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c

examples/cryptodev_fips_validate/Makefile +1 -0

index f5c2705d5..4f1dc6b5d 100644
@@ -10,6 +10,7 @@ SRCS-y += cryptodev_fips_parse_hmac.c
 SRCS-y += cryptodev_fips_parse_3des.c
 SRCS-y += cryptodev_fips_parse_gcm.c
 SRCS-y += cryptodev_fips_parse_cmac.c
+SRCS-y += cryptodev_fips_parse_ccm.c
 SRCS-y += cryptodev_fips_parse_validate.c
 SRCS-y += main.c

examples/cryptodev_fips_validate/cryptodev_fips_parse_ccm.c new file +272 -0

272 lines not on this page · raw message

examples/cryptodev_fips_validate/cryptodev_fips_parse_validate.c +5 -0

index 4617c67e2..47e3732b2 100644
@@ -119,6 +119,11 @@ fips_test_parse_header(void)
 			ret = parse_test_cmac_init();
 			if (ret < 0)
 				return 0;
+		} else if (strstr(info.vec[i], "CCM")) {
+			info.algo = FIPS_TEST_ALGO_AES_CCM;
+			ret = parse_test_ccm_init();
+			if (ret < 0)
+				return 0;
 		} else if (strstr(info.vec[i], "HMAC")) {
 			info.algo = FIPS_TEST_ALGO_HMAC;
 			ret = parse_test_hmac_init();

examples/cryptodev_fips_validate/cryptodev_fips_validate.h +22 -0

index 7bd1e9a6f..afa0c0a80 100644
@@ -26,6 +26,7 @@ enum fips_test_algorithms {
 		FIPS_TEST_ALGO_AES = 0,
 		FIPS_TEST_ALGO_AES_GCM,
 		FIPS_TEST_ALGO_AES_CMAC,
+		FIPS_TEST_ALGO_AES_CCM,
 		FIPS_TEST_ALGO_HMAC,
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_MAX

@@ -102,6 +103,14 @@ enum fips_tdes_test_types {
 	TDES_MMT /* Multi block Message Test */
 };
 
+enum fips_ccm_test_types {
+	CCM_VADT	= 1, /* Variable Associated Data Test */
+	CCM_VPT,		 /* Variable Payload Test */
+	CCM_VNT,		 /* Variable Nonce Test */
+	CCM_VTT,		 /* Variable Tag Test */
+	CCM_DVPT,	 /*  Decryption-Verification Process Test */
+};
+
 struct aesavs_interim_data {
 	enum fips_aesavs_test_types test_type;
 	uint32_t cipher_algo;

@@ -117,6 +126,15 @@ struct tdes_interim_data {
 	uint32_t nb_keys;
 };
 
+struct ccm_interim_data {
+	enum fips_ccm_test_types test_type;
+	uint32_t aad_len;
+	uint32_t pt_len;
+	uint32_t digest_len;
+	uint32_t key_len;
+	uint32_t iv_len;
+};
+
 struct fips_test_interim_info {
 	FILE *fp_rd;
 	FILE *fp_wr;

@@ -132,6 +150,7 @@ struct fips_test_interim_info {
 		struct aesavs_interim_data aes_data;
 		struct hmac_interim_data hmac_data;
 		struct tdes_interim_data tdes_data;
+		struct ccm_interim_data ccm_data;
 
 	} interim_info;

@@ -180,6 +199,9 @@ int
 parse_test_cmac_init(void);
 
 int
+parse_test_ccm_init(void);
+
+int
 parser_read_uint8_hex(uint8_t *value, const char *p);
 
 int

examples/cryptodev_fips_validate/main.c +55 -1

74 lines not on this page · raw message

examples/cryptodev_fips_validate/meson.build +1 -0

index 4889d7095..e3bf7ac88 100644
@@ -14,6 +14,7 @@ sources = files(
 	'cryptodev_fips_parse_3des.c',
 	'cryptodev_fips_parse_gcm.c',
 	'cryptodev_fips_parse_cmac.c',
+	'cryptodev_fips_parse_ccm.c',
 	'cryptodev_fips_parse_validate.c',
 	'main.c'
 )

Signature · 1 line

2.13.6

Fan Zhang

author

2018-10-04 13:28 UTC #17 lore raw

PATCH v3 8/8 doc: add guides for fips validation

In reply to Fan Zhang

From: Marko Kovacevic <[email protected]>

Document explains how to run the fips sample app and instructions users need to parser all the request files and generate the response files.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
 doc/guides/rel_notes/release_18_11.rst       |  6 ++
 doc/guides/sample_app_ug/fips_validation.rst | 97 ++++++++++++++++++++++++++++
 doc/guides/sample_app_ug/index.rst           |  5 ++
 3 files changed, 108 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/fips_validation.rst

doc/guides/rel_notes/release_18_11.rst +6 -0

index 2133a5b9b..db1579b6e 100644
@@ -104,6 +104,12 @@ New Features
   the specified port. The port must be stopped before the command call in order
   to reconfigure queues.
 
+* **Added Cryptodev Fips Validation Example Application.**
+
+  Added an example application to parse and perform symmetric cryptography
+  computation to the NIST Cryptographic Algorithm Validation Program (CAVP)
+  test vectors.
+
 
 API Changes
 -----------

doc/guides/sample_app_ug/fips_validation.rst new file +97 -0

97 lines not on this page · raw message

doc/guides/sample_app_ug/index.rst +5 -0

index 5bedf4f6f..146296b7a 100644
@@ -56,6 +56,7 @@ Sample Applications User Guides
     performance_thread
     ipsec_secgw
     bbdev_app
+    fips_validation
 
 **Figures**

@@ -83,6 +84,10 @@ Sample Applications User Guides
 
 :numref:`figure_client_svr_sym_multi_proc_app` :ref:`figure_client_svr_sym_multi_proc_app`
 
+:numref:`figure_master_slave_proc` :ref:`figure_master_slave_proc`
+
+:numref:`figure_slave_proc_recov` :ref:`figure_slave_proc_recov`
+
 :numref:`figure_qos_sched_app_arch` :ref:`figure_qos_sched_app_arch`
 
 :numref:`figure_pipeline_overview` :ref:`figure_pipeline_overview`

Signature · 1 line

2.13.6

Akhil Goyal

2018-10-09 07:01 UTC #18 lore raw

Re: [PATCH v3 8/8] doc: add guides for fips validation

Quoted 53 lines · Fan Zhang

From: Marko Kovacevic <[email protected]>

Document explains how to run the fips sample app and instructions users need to parser all the request files and generate the response files.

Signed-off-by Marko Kovacevic <[email protected]>

Signed-off-by Fan Zhang <[email protected]>

---
  doc/guides/rel_notes/release_18_11.rst       |  6 ++
  doc/guides/sample_app_ug/fips_validation.rst | 97 ++++++++++++++++++++++++++++
  doc/guides/sample_app_ug/index.rst           |  5 ++
  3 files changed, 108 insertions(+)

create mode 100644 doc/guides/sample_app_ug/fips_validation.rst

doc/guides/rel_notes/release_18_11.rst +6 -0

index 2133a5b9b..db1579b6e 100644
@@ -104,6 +104,12 @@ New Features
    the specified port. The port must be stopped before the command call in order
    to reconfigure queues.
 
+* **Added Cryptodev Fips Validation Example Application.**
+
+  Added an example application to parse and perform symmetric cryptography
+  computation to the NIST Cryptographic Algorithm Validation Program (CAVP)
+  test vectors.
+
 
  API Changes
  -----------

doc/guides/sample_app_ug/fips_validation.rst new file +15 -0

new file mode 100644
index 000000000..0e06aab99
@@ -0,0 +1,97 @@
+..  SPDX-License-Identifier: BSD-3-Clause
+    Copyright(c) 2018 Intel Corporation.
+
+Federal Information Processing Standards (FIPS) CryptoDev Validation
+====================================================================
+
+Overview
+--------
+
+Federal Information Processing Standards (FIPS) are publicly announced standards
+developed by the United States federal government for use in computer systems by
+non-military government agencies and government contractors.
+
+This application is used to parse and perform symmetric cryptography
+computation to the NIST Cryptographic Algorithm Validation Program (CAVP) test

doc/guides/sample_app_ug/fips_validation.rst line 25

Quoted 10 lines

doc/guides/sample_app_ug/fips_validation.rst new file +10 -0

+vectors.
+
+Limitations
+-----------
+
+* Only NIST CAVP request files are parsed by this application.
+* The version of request file supported is ``CAVS 21.0``
+* The application does not supply the test vectors. The user is expected to
+  obtain the test vector files from `NIST
+  <https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/block-ciphers>`_

I cannot find the .req files in the above link. It only has .rsp files which has both cipher text as well as plain text.

Quoted 95 lines

doc/guides/sample_app_ug/fips_validation.rst new file +72 -0

+* Supported test vectors
+    * AES-CBC (128,192,256) - GFSbox, KeySbox, MCT, MMT
+    * AES-GCM (128,192,256) - EncryptExtIV, Decrypt
+    * AES-CCM (128) - VADT, VNT, VPT, VTT, DVPT
+    * AES-CMAC (128) - Generate, Verify
+    * HMAC (SHA1, SHA224, SHA256, SHA384, SHA512)
+    * TDES (1 Key, 2 Keys, 3 Keys) - MMT, Monte, Permop, Subkey, Varkey, VarText
+
+Compiling the Application
+-------------------------
+
+* Compile Application
+
+    .. code-block:: console
+
+         make -C examples/cryptodev_fips_validate
+
+*  Run ``dos2unix`` on the request files
+
+    .. code-block:: console
+
+         dos2unix AES/req/*
+         dos2unix AES_GCM/req/*
+         dos2unix CCM/req/*
+         dos2unix CMAC/req/*
+         dos2unix HMAC/req/*
+         dos2unix TDES/req/*
+
+Running the Application
+-----------------------
+
+The application requires a number of command line options:
+
+    .. code-block:: console
+
+         ./cryptodev_fips_validate_app [EAL options]
+         -- --req-file FILE_PATH/FOLDER_PATH
+         --rsp-file FILE_PATH/FOLDER_PATH
+         [--cryptodev DEVICE_NAME] [--cryptodev-id ID] [--path-is-folder]
+
+where,
+  * req-file: The path of the request file or folder, separated by
+    ``path-is-folder`` option.
+
+  * rsp-file: The path that the response file or folder is stored. separated by
+    ``path-is-folder`` option.
+
+  * cryptodev: The name of the target DPDK Crypto device to be validated.
+
+  * cryptodev-id: The id of the target DPDK Crypto device to be validated.
+
+  * path-is-folder: If presented the application expects req-file and rsp-file
+    are folder paths.
+
+To run the application in linuxapp environment to test one AES FIPS test data
+file for crypto_aesni_mb PMD, issue the command:
+
+.. code-block:: console
+
+    $ ./cryptodev_fips_validate_app --vdev crypto_aesni_mb --
+    --req-file /PATH/TO/REQUEST/FILE.req --rsp-file ./PATH/TO/RESPONSE/FILE.rsp
+    --cryptodev crypto_aesni_mb
+
+To run the application in linuxapp environment to test all AES-GCM FIPS test
+data files in one folder for crypto_aesni_gcm PMD, issue the command:
+
+.. code-block:: console
+
+    $ ./cryptodev_fips_validate_app --vdev crypto_aesni_gcm0 --
+    --req-file /PATH/TO/REQUEST/FILE/FOLDER/
+    --rsp-file ./PATH/TO/RESPONSE/FILE/FOLDER/
+    --cryptodev-id 0 --path-is-folder

doc/guides/sample_app_ug/index.rst +5 -0

index 5bedf4f6f..146296b7a 100644
@@ -56,6 +56,7 @@ Sample Applications User Guides
      performance_thread
      ipsec_secgw
      bbdev_app
+    fips_validation
 
  **Figures**

@@ -83,6 +84,10 @@ Sample Applications User Guides
 
  :numref:`figure_client_svr_sym_multi_proc_app` :ref:`figure_client_svr_sym_multi_proc_app`
 
+:numref:`figure_master_slave_proc` :ref:`figure_master_slave_proc`
+
+:numref:`figure_slave_proc_recov` :ref:`figure_slave_proc_recov`
+
  :numref:`figure_qos_sched_app_arch` :ref:`figure_qos_sched_app_arch`
 
  :numref:`figure_pipeline_overview` :ref:`figure_pipeline_overview`

Zhang, Roy Fan

author

2018-10-09 20:18 UTC #19 lore raw

Re: [PATCH v3 8/8] doc: add guides for fips validation

Hi Akhil,

To obtain request files the applicant has to fill the validation request to FIPS lab.
However to test the application the response files can be used.
The application will attach an extra line with computed results of the test cases and it will be fairly easy to check :-). Please be sure to use dos2unix to convert the formatting of the files first.

Regards,
Fan

Quoted 189 lines

-----Original Message-----
From: Akhil Goyal [mailto:[email protected]]
Sent: Tuesday, October 9, 2018 8:02 AM
To: Zhang, Roy Fan <[email protected]>; [email protected]
Cc: Kovacevic, Marko <[email protected]>
Subject: Re: [dpdk-dev] [PATCH v3 8/8] doc: add guides for fips validation
Quoted 11 lines · Fan Zhang
From: Marko Kovacevic <[email protected]>
Document explains how to run the fips sample app and instructions users need to parser all the request files and generate the response files.
Signed-off-by Marko Kovacevic <[email protected]>
Signed-off-by Fan Zhang <[email protected]>
---
  doc/guides/rel_notes/release_18_11.rst       |  6 ++
  doc/guides/sample_app_ug/fips_validation.rst | 97
++++++++++++++++++++++++++++
doc/guides/rel_notes/release_18_11.rst New Features · line 104
Quoted 11 lines
  doc/guides/sample_app_ug/index.rst           |  5 ++
  3 files changed, 108 insertions(+)
create mode 100644 doc/guides/sample_app_ug/fips_validation.rst
doc/guides/rel_notes/release_18_11.rst +0 -0
index 2133a5b9b..db1579b6e 100644
@@ -104,6 +104,12 @@ New Features
    the specified port. The port must be stopped before the command call in
order
Quoted 19 lines
doc/guides/rel_notes/release_18_11.rst +6 -0
    to reconfigure queues.
 
+* **Added Cryptodev Fips Validation Example Application.**
+
+  Added an example application to parse and perform symmetric
+ cryptography  computation to the NIST Cryptographic Algorithm
+ Validation Program (CAVP)  test vectors.
+
 
  API Changes
  -----------
doc/guides/sample_app_ug/fips_validation.rst new file +0 -0
new file mode 100644
index 000000000..0e06aab99
doc/guides/sample_app_ug/fips_validation.rst line 4
Quoted 4 lines
doc/guides/sample_app_ug/fips_validation.rst new file +4 -0
@@ -0,0 +1,97 @@
+..  SPDX-License-Identifier: BSD-3-Clause
+    Copyright(c) 2018 Intel Corporation.
+
+Federal Information Processing Standards (FIPS) CryptoDev Validation
+=========================================================
===========
doc/guides/sample_app_ug/fips_validation.rst
Quoted 6 lines
doc/guides/sample_app_ug/fips_validation.rst new file +6 -0
+
+Overview
+--------
+
+Federal Information Processing Standards (FIPS) are publicly
+announced standards developed by the United States federal
government
doc/guides/sample_app_ug/fips_validation.rst line 11
Quoted 1 line
doc/guides/sample_app_ug/fips_validation.rst new file +1 -0
+for use in computer systems by non-military government agencies and
government contractors.
Quoted 6 lines
doc/guides/sample_app_ug/fips_validation.rst new file +6 -0
+
+This application is used to parse and perform symmetric cryptography
+computation to the NIST Cryptographic Algorithm Validation Program
+(CAVP) test vectors.
+
+Limitations
doc/guides/sample_app_ug/fips_validation.rst
Quoted 10 lines
doc/guides/sample_app_ug/fips_validation.rst new file +10 -0
+-----------
+
+* Only NIST CAVP request files are parsed by this application.
+* The version of request file supported is ``CAVS 21.0``
+* The application does not supply the test vectors. The user is
+expected to
+  obtain the test vector files from `NIST
+
+<https://csrc.nist.gov/projects/cryptographic-algorithm-validation-pr
+ogram/block-ciphers>`_
I cannot find the .req files in the above link. It only has .rsp files which has both cipher text as well as plain text.
Quoted 37 lines
doc/guides/sample_app_ug/fips_validation.rst new file +37 -0
+* Supported test vectors
+    * AES-CBC (128,192,256) - GFSbox, KeySbox, MCT, MMT
+    * AES-GCM (128,192,256) - EncryptExtIV, Decrypt
+    * AES-CCM (128) - VADT, VNT, VPT, VTT, DVPT
+    * AES-CMAC (128) - Generate, Verify
+    * HMAC (SHA1, SHA224, SHA256, SHA384, SHA512)
+    * TDES (1 Key, 2 Keys, 3 Keys) - MMT, Monte, Permop, Subkey,
+Varkey, VarText
+
+Compiling the Application
+-------------------------
+
+* Compile Application
+
+    .. code-block:: console
+
+         make -C examples/cryptodev_fips_validate
+
+*  Run ``dos2unix`` on the request files
+
+    .. code-block:: console
+
+         dos2unix AES/req/*
+         dos2unix AES_GCM/req/*
+         dos2unix CCM/req/*
+         dos2unix CMAC/req/*
+         dos2unix HMAC/req/*
+         dos2unix TDES/req/*
+
+Running the Application
+-----------------------
+
+The application requires a number of command line options:
+
+    .. code-block:: console
+
+         ./cryptodev_fips_validate_app [EAL options]
doc/guides/sample_app_ug/fips_validation.rst
Quoted 10 lines
doc/guides/sample_app_ug/fips_validation.rst new file +10 -0
+         -- --req-file FILE_PATH/FOLDER_PATH
+         --rsp-file FILE_PATH/FOLDER_PATH
+         [--cryptodev DEVICE_NAME] [--cryptodev-id ID]
+ [--path-is-folder]
+
+where,
+  * req-file: The path of the request file or folder, separated by
+    ``path-is-folder`` option.
+
+  * rsp-file: The path that the response file or folder is stored. separated
by
Quoted 6 lines
doc/guides/sample_app_ug/fips_validation.rst new file +6 -0
+    ``path-is-folder`` option.
+
+  * cryptodev: The name of the target DPDK Crypto device to be validated.
+
+  * cryptodev-id: The id of the target DPDK Crypto device to be validated.
+
doc/guides/sample_app_ug/fips_validation.rst
Quoted 10 lines
doc/guides/sample_app_ug/fips_validation.rst new file +10 -0
+  * path-is-folder: If presented the application expects req-file and rsp-file
+    are folder paths.
+
+To run the application in linuxapp environment to test one AES FIPS
+test data file for crypto_aesni_mb PMD, issue the command:
+
+.. code-block:: console
+
+    $ ./cryptodev_fips_validate_app --vdev crypto_aesni_mb --
+    --req-file /PATH/TO/REQUEST/FILE.req --rsp-
file ./PATH/TO/RESPONSE/FILE.rsp
doc/guides/sample_app_ug/fips_validation.rst
Quoted 4 lines
doc/guides/sample_app_ug/fips_validation.rst new file +4 -0
+    --cryptodev crypto_aesni_mb
+
+To run the application in linuxapp environment to test all AES-GCM
+FIPS test data files in one folder for crypto_aesni_gcm PMD, issue the
command:
Quoted 32 lines
doc/guides/sample_app_ug/fips_validation.rst new file +7 -0
+
+.. code-block:: console
+
+    $ ./cryptodev_fips_validate_app --vdev crypto_aesni_gcm0 --
+    --req-file /PATH/TO/REQUEST/FILE/FOLDER/
+    --rsp-file ./PATH/TO/RESPONSE/FILE/FOLDER/
+    --cryptodev-id 0 --path-is-folder
doc/guides/sample_app_ug/index.rst +1 -0
index 5bedf4f6f..146296b7a 100644
@@ -56,6 +56,7 @@ Sample Applications User Guides
      performance_thread
      ipsec_secgw
      bbdev_app
+    fips_validation
 
  **Figures**
 
@@ -83,6 +84,10 @@ Sample Applications User Guides
 
  :numref:`figure_client_svr_sym_multi_proc_app`
:ref:figure_client_svr_sym_multi_proc_app
+:numref:figure_master_slave_proc :ref:figure_master_slave_proc
doc/guides/sample_app_ug/index.rst +3 -0
+
+:numref:`figure_slave_proc_recov` :ref:`figure_slave_proc_recov`
+
  :numref:`figure_qos_sched_app_arch` :ref:`figure_qos_sched_app_arch`
 
  :numref:`figure_pipeline_overview` :ref:`figure_pipeline_overview`