FIPS asymmetric validation

PATCH Superseded Gowrishankar Muthukrishnan 3 participants 39 messages Aug 12, 2022 – Oct 12, 2022 Arm/Amlogic Meson SoC support

lore

Share & tools

lore

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #0 lore raw

cover FIPS asymmetric validation

This patch series adds support in fips_validation app to perform asymmetric validation. To start with, RSA algorithm is used in the evaluation. For the key value pairs which is multiprecision in arithmetic, openssl library is used.

Gowrishankar Muthukrishnan (5):
examples/fips_validation: fix parsing test group info examples/fips_validation: add interim parse writeback examples/fips_validation: add function to calculate SHA hash size examples/fips_validation: fix buffer size to parse JSON string examples/fips_validation: add asymmetric validation

 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |  18 +-
 examples/fips_validation/fips_validation.h    |  58 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 534 ++++++++++++++++++
 .../fips_validation/fips_validation_sha.c     |  39 +-
 examples/fips_validation/main.c               | 465 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1025 insertions(+), 110 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #1 lore raw

PATCH 1/5 examples/fips_validation: fix parsing test group info

If a test group does not have expected key, it should not crash. This patch fixes parsing test group info to continue further when a key does not exist (as in asym tests).

Fixes 58cc98801eb ("examples/fips_validation: add JSON parsing")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.c | 3 +++
 1 file changed, 3 insertions(+)

examples/fips_validation/fips_validation.c +3 -0

index 6c9f5e42a4..06aeffe495 100644
@@ -488,6 +488,9 @@ fips_test_parse_one_json_group(void)
 		for (i = 0; info.interim_callbacks[i].key != NULL; i++) {
 			param = json_object_get(json_info.json_test_group,
 					info.interim_callbacks[i].key);
+			if (!param)
+				continue;
+
 			switch (json_typeof(param)) {
 			case JSON_STRING:
 				snprintf(json_value, 256, "%s", json_string_value(param));

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #2 lore raw

PATCH 2/5 examples/fips_validation: add interim parse writeback

In reply to Gowrishankar Muthukrishnan

Asym tests need a callback to write interim info in expected output.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.c | 6 ++++++
 examples/fips_validation/fips_validation.h | 1 +
 2 files changed, 7 insertions(+)

examples/fips_validation/fips_validation.c +6 -0

index 06aeffe495..e755654cd0 100644
@@ -512,6 +512,12 @@ fips_test_parse_one_json_group(void)
 			if (ret < 0)
 				return ret;
 		}
+
+		if (info.parse_interim_writeback) {
+			ret = info.parse_interim_writeback(NULL);
+			if (ret < 0)
+				return ret;
+		}
 	}
 
 	return 0;

examples/fips_validation/fips_validation.h +1 -0

index f42040f460..a6288e17e5 100644
@@ -228,6 +228,7 @@ struct fips_test_interim_info {
 	const struct fips_test_callback *interim_callbacks;
 	const struct fips_test_callback *writeback_callbacks;
 
+	post_prcess_t parse_interim_writeback;
 	post_prcess_t parse_writeback;
 	post_prcess_t kat_check;
 };

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #3 lore raw

PATCH 3/5 examples/fips_validation: add function to calculate SHA hash size

In reply to Gowrishankar Muthukrishnan

Add function to calculate hash size for a given SHA hash algorithm.

Fixes d5c247145c2 ("examples/fips_validation: add parsing for SHA")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |  3 ++
 .../fips_validation/fips_validation_sha.c     | 39 ++++++++++++-------
 2 files changed, 27 insertions(+), 15 deletions(-)

examples/fips_validation/fips_validation.h +3 -0

index a6288e17e5..4732341dd3 100644
@@ -293,6 +293,9 @@ parse_test_sha_json_algorithm(void);
 int
 parse_test_sha_json_test_type(void);
 
+int
+parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo);
+
 int
 parse_test_tdes_json_init(void);
 #endif /* USE_JANSSON */

examples/fips_validation/fips_validation_sha.c +24 ~~-15~~

index 75b073c15d..cac2a25e6c 100644
@@ -33,6 +33,22 @@ struct plain_hash_size_conversion {
 		{"64", RTE_CRYPTO_AUTH_SHA512},
 };
 
+int
+parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo)
+{
+	int ret = -EINVAL;
+	uint8_t i;
+
+	for (i = 0; i < RTE_DIM(phsc); i++) {
+		if (phsc[i].algo == algo) {
+			ret = atoi(phsc[i].str);
+			break;
+		}
+	}
+
+	return ret;
+}
+
 static int
 parse_interim_algo(__rte_unused const char *key,
 		char *text,

@@ -212,6 +228,7 @@ parse_test_sha_json_algorithm(void)
 	json_t *algorithm_object;
 	const char *algorithm_str;
 	uint32_t i;
+	int sz;
 
 	algorithm_object = json_object_get(json_info.json_vector_set, "algorithm");
 	algorithm_str = json_string_value(algorithm_object);

@@ -226,23 +243,15 @@ parse_test_sha_json_algorithm(void)
 	if (i == RTE_DIM(json_algorithms))
 		return -1;
 
-	for (i = 0; i < RTE_DIM(phsc); i++) {
-		if (info.interim_info.sha_data.algo == phsc[i].algo) {
-			vec.cipher_auth.digest.len = atoi(phsc[i].str);
-			free(vec.cipher_auth.digest.val);
-			vec.cipher_auth.digest.val = calloc(1, vec.cipher_auth.digest.len);
-			if (vec.cipher_auth.digest.val == NULL)
-				return -1;
-
-			break;
-		}
-	}
+	sz = parse_test_sha_hash_size(info.interim_info.sha_data.algo);
+	if (sz < 0)
+		return -1;
 
-	if (i == RTE_DIM(phsc)) {
-		free(vec.cipher_auth.digest.val);
-		vec.cipher_auth.digest.val = NULL;
+	free(vec.cipher_auth.digest.val);
+	vec.cipher_auth.digest.len = sz;
+	vec.cipher_auth.digest.val = calloc(1, sz);
+	if (vec.cipher_auth.digest.val == NULL)
 		return -1;
-	}
 
 	return 0;
 }

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #4 lore raw

PATCH 4/5 examples/fips_validation: fix buffer size to parse JSON string

In reply to Gowrishankar Muthukrishnan

In asym op, while parsing test interim info, existing buffer of size 256 bytes is not sufficient, hence setting it to maximum that a test would need.

Fixes 58cc98801eb ("examples/fips_validation: add JSON parsing")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.c | 7 ++++---
 examples/fips_validation/fips_validation.h | 7 +++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

examples/fips_validation/fips_validation.c +4 -3

index e755654cd0..be0634c3ac 100644
@@ -484,7 +484,7 @@ fips_test_parse_one_json_group(void)
 	json_t *param;
 
 	if (info.interim_callbacks) {
-		char json_value[256];
+		char json_value[FIPS_TEST_JSON_BUF_LEN];
 		for (i = 0; info.interim_callbacks[i].key != NULL; i++) {
 			param = json_object_get(json_info.json_test_group,
 					info.interim_callbacks[i].key);

@@ -493,11 +493,12 @@ fips_test_parse_one_json_group(void)
 
 			switch (json_typeof(param)) {
 			case JSON_STRING:
-				snprintf(json_value, 256, "%s", json_string_value(param));
+				snprintf(json_value, sizeof(json_value), "%s",
+						 json_string_value(param));
 				break;
 
 			case JSON_INTEGER:
-				snprintf(json_value, 255, "%"JSON_INTEGER_FORMAT,
+				snprintf(json_value, sizeof(json_value), "%"JSON_INTEGER_FORMAT,
 						json_integer_value(param));
 				break;

examples/fips_validation/fips_validation.h +7 -0

index 4732341dd3..926fe94563 100644
@@ -183,6 +183,13 @@ struct xts_interim_data {
 };
 
 #ifdef USE_JANSSON
+/*
+ * Maximum length of buffer to hold any json string.
+ * Esp, in asym op, modulo bits decide char buffer size.
+ * max = (modulo / 4)
+ */
+#define FIPS_TEST_JSON_BUF_LEN (4096 / 4)
+
 struct fips_test_json_info {
 	/* Information used for reading from json */
 	json_t *json_root;

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-08-12 11:57 UTC #5 lore raw

PATCH 5/5 examples/fips_validation: add asymmetric validation

In reply to Gowrishankar Muthukrishnan

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 534 ++++++++++++++++++
 examples/fips_validation/main.c               | 465 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 977 insertions(+), 92 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 7f7b6c92fd..ed21a8e470 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index 33a8c97575..5e9ad2d006 100644
@@ -66,6 +66,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index be0634c3ac..5d485a2bd5 100644
@@ -471,6 +471,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index 6b3d158629..e76c38ffc8 100644
@@ -80,12 +80,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +534 -0

534 lines not on this page · raw message

examples/fips_validation/main.c +382 ~~-83~~

661 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Dooley, Brian

2022-09-23 16:29 UTC #6 lore raw

In reply to Gowrishankar Muthukrishnan

Quoted 31 lines

-----Original Message-----
From: Gowrishankar Muthukrishnan <[email protected]>
Sent: Friday, August 12, 2022 12:57 PM
To: [email protected]
Cc: Anoob Joseph <[email protected]>; Zhang, Roy Fan <[email protected]>; Dooley, Brian <[email protected]>; Akhil Goyal <[email protected]>; [email protected]; Gowrishankar Muthukrishnan <[email protected]>
Subject: [PATCH v1 0/5] FIPS asymmetric validation
This patch series adds support in fips_validation app to perform asymmetric validation. To start with, RSA algorithm is used in the evaluation. For the key value pairs which is multiprecision in arithmetic, openssl library is used.
Gowrishankar Muthukrishnan (5):
examples/fips_validation: fix parsing test group info examples/fips_validation: add interim parse writeback examples/fips_validation: add function to calculate SHA hash size examples/fips_validation: fix buffer size to parse JSON string examples/fips_validation: add asymmetric validation
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |  18 +-
 examples/fips_validation/fips_validation.h    |  58 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 534 ++++++++++++++++++
 .../fips_validation/fips_validation_sha.c     |  39 +-
 examples/fips_validation/main.c               | 465 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1025 insertions(+), 110 deletions(-)  create mode 100644

Quoted 4 lines

examples/fips_validation/fips_validation_rsa.c
--
2.25.1

Series-acked-by Brian Dooley <[email protected]>

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #7 lore raw

v2 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

Gowrishankar Muthukrishnan (7):
examples/fips_validation: fix parsing test group info examples/fips_validation: add interim parse writeback examples/fips_validation: add function to calculate SHA hash size examples/fips_validation: fix buffer size to parse JSON string examples/fips_validation: add asymmetric validation examples/fips_validation: encode digest with hash OID examples/fips_validation: randomize message for conformance test

 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |  18 +-
 examples/fips_validation/fips_validation.h    |  60 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 .../fips_validation/fips_validation_sha.c     |  39 +-
 examples/fips_validation/main.c               | 542 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1200 insertions(+), 110 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #8 lore raw

PATCH v2 1/7 examples/fips_validation: fix parsing test group info

If a test group does not have expected key, it should not crash. This patch fixes parsing test group info to continue further when a key does not exist (as in asym tests).

Fixes 58cc98801eb ("examples/fips_validation: add JSON parsing")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

---
 examples/fips_validation/fips_validation.c | 3 +++
 1 file changed, 3 insertions(+)

examples/fips_validation/fips_validation.c +3 -0

index 6c9f5e42a4..06aeffe495 100644
@@ -488,6 +488,9 @@ fips_test_parse_one_json_group(void)
 		for (i = 0; info.interim_callbacks[i].key != NULL; i++) {
 			param = json_object_get(json_info.json_test_group,
 					info.interim_callbacks[i].key);
+			if (!param)
+				continue;
+
 			switch (json_typeof(param)) {
 			case JSON_STRING:
 				snprintf(json_value, 256, "%s", json_string_value(param));

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #9 lore raw

PATCH v2 2/7 examples/fips_validation: add interim parse writeback

In reply to Gowrishankar Muthukrishnan

Asym tests need a callback to write interim info in expected output.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

---
 examples/fips_validation/fips_validation.c | 6 ++++++
 examples/fips_validation/fips_validation.h | 1 +
 2 files changed, 7 insertions(+)

examples/fips_validation/fips_validation.c +6 -0

index 06aeffe495..e755654cd0 100644
@@ -512,6 +512,12 @@ fips_test_parse_one_json_group(void)
 			if (ret < 0)
 				return ret;
 		}
+
+		if (info.parse_interim_writeback) {
+			ret = info.parse_interim_writeback(NULL);
+			if (ret < 0)
+				return ret;
+		}
 	}
 
 	return 0;

examples/fips_validation/fips_validation.h +1 -0

index f42040f460..a6288e17e5 100644
@@ -228,6 +228,7 @@ struct fips_test_interim_info {
 	const struct fips_test_callback *interim_callbacks;
 	const struct fips_test_callback *writeback_callbacks;
 
+	post_prcess_t parse_interim_writeback;
 	post_prcess_t parse_writeback;
 	post_prcess_t kat_check;
 };

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #10 lore raw

PATCH v2 3/7 examples/fips_validation: add function to calculate SHA hash size

In reply to Gowrishankar Muthukrishnan

Add function to calculate hash size for a given SHA hash algorithm.

Fixes d5c247145c2 ("examples/fips_validation: add parsing for SHA")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

---
v2:
- fixed include file

---
 examples/fips_validation/fips_validation.h    |  1 +
 .../fips_validation/fips_validation_sha.c     | 39 ++++++++++++-------
 2 files changed, 25 insertions(+), 15 deletions(-)

examples/fips_validation/fips_validation.h +1 -0

index a6288e17e5..6e5f2fce75 100644
@@ -374,4 +374,5 @@ int prepare_gcm_xform(struct rte_crypto_sym_xform *xform);
 
 int prepare_gmac_xform(struct rte_crypto_sym_xform *xform);
 
+int parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo);
 #endif

examples/fips_validation/fips_validation_sha.c +24 ~~-15~~

index 75b073c15d..cac2a25e6c 100644
@@ -33,6 +33,22 @@ struct plain_hash_size_conversion {
 		{"64", RTE_CRYPTO_AUTH_SHA512},
 };
 
+int
+parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo)
+{
+	int ret = -EINVAL;
+	uint8_t i;
+
+	for (i = 0; i < RTE_DIM(phsc); i++) {
+		if (phsc[i].algo == algo) {
+			ret = atoi(phsc[i].str);
+			break;
+		}
+	}
+
+	return ret;
+}
+
 static int
 parse_interim_algo(__rte_unused const char *key,
 		char *text,

@@ -212,6 +228,7 @@ parse_test_sha_json_algorithm(void)
 	json_t *algorithm_object;
 	const char *algorithm_str;
 	uint32_t i;
+	int sz;
 
 	algorithm_object = json_object_get(json_info.json_vector_set, "algorithm");
 	algorithm_str = json_string_value(algorithm_object);

@@ -226,23 +243,15 @@ parse_test_sha_json_algorithm(void)
 	if (i == RTE_DIM(json_algorithms))
 		return -1;
 
-	for (i = 0; i < RTE_DIM(phsc); i++) {
-		if (info.interim_info.sha_data.algo == phsc[i].algo) {
-			vec.cipher_auth.digest.len = atoi(phsc[i].str);
-			free(vec.cipher_auth.digest.val);
-			vec.cipher_auth.digest.val = calloc(1, vec.cipher_auth.digest.len);
-			if (vec.cipher_auth.digest.val == NULL)
-				return -1;
-
-			break;
-		}
-	}
+	sz = parse_test_sha_hash_size(info.interim_info.sha_data.algo);
+	if (sz < 0)
+		return -1;
 
-	if (i == RTE_DIM(phsc)) {
-		free(vec.cipher_auth.digest.val);
-		vec.cipher_auth.digest.val = NULL;
+	free(vec.cipher_auth.digest.val);
+	vec.cipher_auth.digest.len = sz;
+	vec.cipher_auth.digest.val = calloc(1, sz);
+	if (vec.cipher_auth.digest.val == NULL)
 		return -1;
-	}
 
 	return 0;
 }

Signature · 1 line

2.25.1

Akhil Goyal

2022-10-07 17:53 UTC #11 lore raw

RE: [v2 3/7] examples/fips_validation: add function to calculate SHA hash size

Quoted 4 lines

Subject: [v2 3/7] examples/fips_validation: add function to calculate SHA hash size

Quoted 8 lines

Add function to calculate hash size for a given SHA hash algorithm.
Fixes d5c247145c2 ("examples/fips_validation: add parsing for SHA")
Signed-off-by Gowrishankar Muthukrishnan <[email protected]>
Acked-by Brian Dooley <[email protected]>
---

This patch caused a build failure for cross compile.

[713/820] Compiling C object 'examples/c590b3c@@dpdk-fips_validation@exe/fips_validation_fips_validation_sha.c.o'. ../examples/fips_validation/fips_validation_sha.c: In function 'parse_test_sha_hash_size':
../examples/fips_validation/fips_validation_sha.c:44:10: error: implicit declaration of function 'atoi' [-Wimplicit-function-declaration]

   44 |    ret = atoi(phsc[i].str);
      |          ^~~~

../examples/fips_validation/fips_validation_sha.c:44:10: error: nested extern declaration of 'atoi' [-Wnested-externs]

Added include file in fips_validation_sha.c
#include <stdlib.h>

Quoted 90 lines

v2:
- fixed include file

---
 examples/fips_validation/fips_validation.h    |  1 +
 .../fips_validation/fips_validation_sha.c     | 39 ++++++++++++-------
 2 files changed, 25 insertions(+), 15 deletions(-)

examples/fips_validation/fips_validation.h +1 -0

index a6288e17e5..6e5f2fce75 100644
@@ -374,4 +374,5 @@ int prepare_gcm_xform(struct rte_crypto_sym_xform
 *xform);
 
 int prepare_gmac_xform(struct rte_crypto_sym_xform *xform);
 
+int parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo);

#endif

examples/fips_validation/fips_validation_sha.c +17 -0

index 75b073c15d..cac2a25e6c 100644
@@ -33,6 +33,22 @@ struct plain_hash_size_conversion {
 		{"64", RTE_CRYPTO_AUTH_SHA512},
 };
 
+int
+parse_test_sha_hash_size(enum rte_crypto_auth_algorithm algo)
+{
+	int ret = -EINVAL;
+	uint8_t i;
+
+	for (i = 0; i < RTE_DIM(phsc); i++) {
+		if (phsc[i].algo == algo) {
+			ret = atoi(phsc[i].str);
+			break;
+		}
+	}
+
+	return ret;
+}
+
 static int
 parse_interim_algo(__rte_unused const char *key,
 		char *text,

@@ -212,6 +228,7 @@ parse_test_sha_json_algorithm(void)
 	json_t *algorithm_object;
 	const char *algorithm_str;
 	uint32_t i;
+	int sz;
 
 	algorithm_object = json_object_get(json_info.json_vector_set,
 "algorithm");

examples/fips_validation/fips_validation_sha.c +7 ~~-15~~

 	algorithm_str = json_string_value(algorithm_object);

@@ -226,23 +243,15 @@ parse_test_sha_json_algorithm(void)
 	if (i == RTE_DIM(json_algorithms))
 		return -1;
 
-	for (i = 0; i < RTE_DIM(phsc); i++) {
-		if (info.interim_info.sha_data.algo == phsc[i].algo) {
-			vec.cipher_auth.digest.len = atoi(phsc[i].str);
-			free(vec.cipher_auth.digest.val);
-			vec.cipher_auth.digest.val = calloc(1,
 vec.cipher_auth.digest.len);
-			if (vec.cipher_auth.digest.val == NULL)
-				return -1;
-
-			break;
-		}
-	}
+	sz = parse_test_sha_hash_size(info.interim_info.sha_data.algo);
+	if (sz < 0)
+		return -1;
 
-	if (i == RTE_DIM(phsc)) {
-		free(vec.cipher_auth.digest.val);
-		vec.cipher_auth.digest.val = NULL;
+	free(vec.cipher_auth.digest.val);
+	vec.cipher_auth.digest.len = sz;
+	vec.cipher_auth.digest.val = calloc(1, sz);
+	if (vec.cipher_auth.digest.val == NULL)
 		return -1;
-	}
 
 	return 0;

}
--
2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #12 lore raw

PATCH v2 4/7 examples/fips_validation: fix buffer size to parse JSON string

In reply to Gowrishankar Muthukrishnan

In asym op, while parsing test interim info, existing buffer of size 256 bytes is not sufficient, hence setting it to maximum that a test would need.

Fixes 58cc98801eb ("examples/fips_validation: add JSON parsing")

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

---
 examples/fips_validation/fips_validation.c | 7 ++++---
 examples/fips_validation/fips_validation.h | 7 +++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

examples/fips_validation/fips_validation.c +4 -3

index e755654cd0..be0634c3ac 100644
@@ -484,7 +484,7 @@ fips_test_parse_one_json_group(void)
 	json_t *param;
 
 	if (info.interim_callbacks) {
-		char json_value[256];
+		char json_value[FIPS_TEST_JSON_BUF_LEN];
 		for (i = 0; info.interim_callbacks[i].key != NULL; i++) {
 			param = json_object_get(json_info.json_test_group,
 					info.interim_callbacks[i].key);

@@ -493,11 +493,12 @@ fips_test_parse_one_json_group(void)
 
 			switch (json_typeof(param)) {
 			case JSON_STRING:
-				snprintf(json_value, 256, "%s", json_string_value(param));
+				snprintf(json_value, sizeof(json_value), "%s",
+						 json_string_value(param));
 				break;
 
 			case JSON_INTEGER:
-				snprintf(json_value, 255, "%"JSON_INTEGER_FORMAT,
+				snprintf(json_value, sizeof(json_value), "%"JSON_INTEGER_FORMAT,
 						json_integer_value(param));
 				break;

examples/fips_validation/fips_validation.h +7 -0

index 6e5f2fce75..43e5ffe4b0 100644
@@ -183,6 +183,13 @@ struct xts_interim_data {
 };
 
 #ifdef USE_JANSSON
+/*
+ * Maximum length of buffer to hold any json string.
+ * Esp, in asym op, modulo bits decide char buffer size.
+ * max = (modulo / 4)
+ */
+#define FIPS_TEST_JSON_BUF_LEN (4096 / 4)
+
 struct fips_test_json_info {
 	/* Information used for reading from json */
 	json_t *json_root;

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:26 UTC #13 lore raw

PATCH v2 5/7 examples/fips_validation: add asymmetric validation

In reply to Gowrishankar Muthukrishnan

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 464 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 962 insertions(+), 92 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 7f7b6c92fd..ed21a8e470 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index 33a8c97575..5e9ad2d006 100644
@@ -66,6 +66,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index be0634c3ac..5d485a2bd5 100644
@@ -471,6 +471,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index 6b3d158629..e76c38ffc8 100644
@@ -80,12 +80,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +381 ~~-83~~

660 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:27 UTC #14 lore raw

PATCH v2 6/7 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash ddigest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index ed86c10350..cfa01eae20 100644
@@ -851,6 +851,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -864,6 +921,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-09-27 07:27 UTC #15 lore raw

PATCH v2 7/7 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index ed59322635..7cbbc1f084 100644
@@ -210,6 +210,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -336,6 +337,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Akhil Goyal

2022-10-07 09:52 UTC #16 lore raw

In reply to Gowrishankar Muthukrishnan

Quoted 13 lines

Subject: [v2 0/7] FIPS asymmetric validation
This patch series adds support in fips_validation app to perform asymmetric validation. To start with, RSA algorithm is used in the evaluation. For the key value pairs which is multiprecision in arithmetic, openssl library is used.
Changes:
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

Quoted 5 lines

Gowrishankar Muthukrishnan (7):
examples/fips_validation: fix parsing test group info examples/fips_validation: add interim parse writeback examples/fips_validation: add function to calculate SHA hash size examples/fips_validation: fix buffer size to parse JSON string

First 4 patches are applied to dpdk-next-crypto
Rest of the patches need a rebase due to the recent changes in session create APIs. Please send the rest of the patches.

Quoted 18 lines

examples/fips_validation: add asymmetric validation examples/fips_validation: encode digest with hash OID examples/fips_validation: randomize message for conformance test

 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |  18 +-
 examples/fips_validation/fips_validation.h    |  60 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 .../fips_validation/fips_validation_sha.c     |  39 +-
 examples/fips_validation/main.c               | 542 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1200 insertions(+), 110 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

--
2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 09:26 UTC #17 lore raw

v3 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

Gowrishankar Muthukrishnan (3):
examples/fips_validation: add asymmetric validation examples/fips_validation: encode digest with hash OID examples/fips_validation: randomize message for conformance test

 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 546 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 1154 insertions(+), 96 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 09:26 UTC #18 lore raw

PATCH v3 1/3 examples/fips_validation: add asymmetric validation

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v3:
- rebased according to cryptodev session rework changes.
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 468 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 962 insertions(+), 96 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 0fc209db01..e82797d206 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index 33a8c97575..5e9ad2d006 100644
@@ -66,6 +66,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index 363e17a6f3..2c47f9480b 100644
@@ -473,6 +473,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index db8208a5b6..1a2a71ae9f 100644
@@ -81,12 +81,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +381 ~~-87~~

656 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 09:26 UTC #19 lore raw

PATCH v3 2/3 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash digest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index dbf9c6fce2..f8bb89b0ec 100644
@@ -844,6 +844,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -857,6 +914,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 09:27 UTC #20 lore raw

PATCH v3 3/3 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index ed59322635..7cbbc1f084 100644
@@ -210,6 +210,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -336,6 +337,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Akhil Goyal

2022-10-11 15:37 UTC #21 lore raw

In reply to Gowrishankar Muthukrishnan

Quoted 10 lines

Subject: [v3 0/3] FIPS asymmetric validation
This patch series adds support in fips_validation app to perform asymmetric validation. To start with, RSA algorithm is used in the evaluation. For the key value pairs which is multiprecision in arithmetic, openssl library is used.
Changes:
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.

Rebase on latest next-crypto needed as GMAC and CTR are merged.

Quoted 23 lines

v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.
Gowrishankar Muthukrishnan (3):
examples/fips_validation: add asymmetric validation examples/fips_validation: encode digest with hash OID examples/fips_validation: randomize message for conformance test
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 546 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 1154 insertions(+), 96 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c
--
2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 16:08 UTC #22 lore raw

v4 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v4:
- AES GMAC callback fixes.
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 550 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 1156 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 16:08 UTC #23 lore raw

PATCH v4 1/3 examples/fips_validation: add asymmetric validation

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v4:
- AES GMAC callback fix.
v3:
- rebased according to cryptodev session rework changes.
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 472 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 8 files changed, 964 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 0fc209db01..e82797d206 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index e8929fdad4..2cf92483d7 100644
@@ -68,6 +68,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index dddfd3f9d8..3bb5937805 100644
@@ -477,6 +477,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index d6dfdd2443..1b141501f0 100644
@@ -81,12 +81,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +383 ~~-89~~

663 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 16:08 UTC #24 lore raw

PATCH v4 2/3 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash ddigest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index 538c0c98e2..4af8d142e8 100644
@@ -859,6 +859,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -872,6 +929,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-11 16:08 UTC #25 lore raw

PATCH v4 3/3 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index 7c275403c7..eec9616462 100644
@@ -213,6 +213,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -339,6 +340,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 03:56 UTC #26 lore raw

v5 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v5:
- Release notes.
v4:
- AES GMAC callback fixes.
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 550 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1161 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 03:56 UTC #27 lore raw

PATCH v5 1/3 examples/fips_validation: add asymmetric validation

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v5:
- release notes.
v4:
- AES GMAC callback fix.
v3:
- rebased according to cryptodev session rework changes.
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 472 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 969 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 0fc209db01..e82797d206 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/rel_notes/release_22_11.rst +5 -0

index da69689c41..57351085ac 100644
@@ -241,6 +241,11 @@ New Features
   Added support for lookaside sessions in event mode.
   See the :doc:`../sample_app_ug/ipsec_secgw` for more details.
 
+* **Updated fips_validation sample application.**
+
+  Added support for asymmetric crypto algorithms.
+  See the :doc:`../sample_app_ug/fips_validation` for more details.
+
 
 Removed Items
 -------------

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index e8929fdad4..2cf92483d7 100644
@@ -68,6 +68,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index dddfd3f9d8..3bb5937805 100644
@@ -477,6 +477,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index d6dfdd2443..1b141501f0 100644
@@ -81,12 +81,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +383 ~~-89~~

663 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 03:56 UTC #28 lore raw

PATCH v5 2/3 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash ddigest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index 538c0c98e2..4af8d142e8 100644
@@ -859,6 +859,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -872,6 +929,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 03:56 UTC #29 lore raw

PATCH v5 3/3 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index 7c275403c7..eec9616462 100644
@@ -213,6 +213,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -339,6 +340,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 04:05 UTC #30 lore raw

v6 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v6:
- checkpatch related fix.
v5:
- Release notes.
v4:
- AES GMAC callback fixes.
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 550 ++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1161 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 04:05 UTC #31 lore raw

PATCH v6 1/3 examples/fips_validation: add asymmetric validation

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v6:
- checpatch related fix.
v5:
- release notes.
v4:
- AES GMAC callback fix.
v3:
- rebased according to cryptodev session rework changes.
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 472 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 969 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 0fc209db01..e82797d206 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/rel_notes/release_22_11.rst +5 -0

index da69689c41..57351085ac 100644
@@ -241,6 +241,11 @@ New Features
   Added support for lookaside sessions in event mode.
   See the :doc:`../sample_app_ug/ipsec_secgw` for more details.
 
+* **Updated fips_validation sample application.**
+
+  Added support for asymmetric crypto algorithms.
+  See the :doc:`../sample_app_ug/fips_validation` for more details.
+
 
 Removed Items
 -------------

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index e8929fdad4..2cf92483d7 100644
@@ -68,6 +68,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index dddfd3f9d8..3bb5937805 100644
@@ -477,6 +477,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index d6dfdd2443..1b141501f0 100644
@@ -81,12 +81,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +383 ~~-89~~

663 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 04:05 UTC #32 lore raw

PATCH v6 2/3 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash ddigest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index 23f020fd71..dc191bdb1b 100644
@@ -859,6 +859,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -872,6 +929,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 04:05 UTC #33 lore raw

PATCH v6 3/3 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index 7c275403c7..eec9616462 100644
@@ -213,6 +213,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -339,6 +340,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 06:12 UTC #34 lore raw

v7 cover FIPS asymmetric validation

In reply to Gowrishankar Muthukrishnan

Changes:
v7:
- fix test to handle app parameter correctly.
v6:
- checkpatch related fix.
v5:
- Release notes.
v4:
- AES GMAC callback fixes.
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.

 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 556 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1167 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 06:12 UTC #35 lore raw

PATCH v7 1/3 examples/fips_validation: add asymmetric validation

Add support for asymmetric crypto validation starting with RSA. For the generation of crypto values which is multiprecision in math, openssl library is used only for this purpose.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

Acked-by Brian Dooley <[email protected]>

--
v7:
- fix test to return error if not relevant.
v6:
- checpatch related fix.
v5:
- release notes.
v4:
- AES GMAC callback fix.
v3:
- rebased according to cryptodev session rework changes.
v2:
- improved handling priv key type.

---
 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  47 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 520 ++++++++++++++++++
 examples/fips_validation/main.c               | 478 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 975 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

config/meson.build +6 -0

index 0fc209db01..e82797d206 100644
@@ -226,6 +226,12 @@ if jansson_dep.found()
     dpdk_conf.set('RTE_HAS_JANSSON', 1)
 endif
 
+# check for openssl
+openssl_dep = dependency('openssl', required: false, method: 'pkg-config')
+if openssl_dep.found()
+    dpdk_conf.set('RTE_HAS_OPENSSL', 1)
+endif
+
 # check for pcap
 pcap_dep = dependency('libpcap', required: false, method: 'pkg-config')
 pcap_lib = is_windows ? 'wpcap' : 'pcap'

doc/guides/rel_notes/release_22_11.rst +5 -0

index da69689c41..57351085ac 100644
@@ -241,6 +241,11 @@ New Features
   Added support for lookaside sessions in event mode.
   See the :doc:`../sample_app_ug/ipsec_secgw` for more details.
 
+* **Updated fips_validation sample application.**
+
+  Added support for asymmetric crypto algorithms.
+  See the :doc:`../sample_app_ug/fips_validation` for more details.
+
 
 Removed Items
 -------------

doc/guides/sample_app_ug/fips_validation.rst +1 -0

index e8929fdad4..2cf92483d7 100644
@@ -68,6 +68,7 @@ ACVP
     * SHA (1, 256, 384, 512) - AFT, MCT
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
+    * RSA
 
 
 Application Information

examples/fips_validation/fips_validation.c +2 -0

index dddfd3f9d8..3bb5937805 100644
@@ -477,6 +477,8 @@ fips_test_parse_one_json_vector_set(void)
 	else if (strstr(algo_str, "TDES-CBC") ||
 		strstr(algo_str, "TDES-ECB"))
 		info.algo = FIPS_TEST_ALGO_TDES;
+	else if (strstr(algo_str, "RSA"))
+		info.algo = FIPS_TEST_ALGO_RSA;
 	else
 		return -EINVAL;

examples/fips_validation/fips_validation.h +42 -5

108 lines not on this page · raw message

examples/fips_validation/fips_validation_gcm.c +4 -4

index d6dfdd2443..1b141501f0 100644
@@ -81,12 +81,12 @@ parser_read_gcm_pt_len(const char *key, char *src,
 
 	if (vec.pt.len == 0) {
 		info.interim_info.gcm_data.is_gmac = 1;
-		test_ops.prepare_op = prepare_auth_op;
-		test_ops.prepare_xform = prepare_gmac_xform;
+		test_ops.prepare_sym_op = prepare_auth_op;
+		test_ops.prepare_sym_xform = prepare_gmac_xform;
 	} else {
 		info.interim_info.gcm_data.is_gmac = 0;
-		test_ops.prepare_op = prepare_aead_op;
-		test_ops.prepare_xform = prepare_gcm_xform;
+		test_ops.prepare_sym_op = prepare_aead_op;
+		test_ops.prepare_sym_xform = prepare_gcm_xform;
 	}
 
 	return ret;

examples/fips_validation/fips_validation_rsa.c new file +520 -0

520 lines not on this page · raw message

examples/fips_validation/main.c +389 ~~-89~~

669 lines not on this page · raw message

examples/fips_validation/meson.build +6 -0

index 8bca26a095..d310093189 100644
@@ -18,6 +18,7 @@ sources = files(
         'fips_validation_ccm.c',
         'fips_validation_sha.c',
         'fips_validation_xts.c',
+        'fips_validation_rsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )

@@ -26,3 +27,8 @@ if dpdk_conf.has('RTE_HAS_JANSSON')
     ext_deps += jansson_dep
     cflags += '-DUSE_JANSSON'
 endif
+
+if dpdk_conf.has('RTE_HAS_OPENSSL')
+    ext_deps += openssl_dep
+    cflags += '-DUSE_OPENSSL'
+endif

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 06:13 UTC #36 lore raw

PATCH v7 2/3 examples/fips_validation: encode digest with hash OID

In reply to Gowrishankar Muthukrishnan

FIPS RSA validation requires hash ddigest be encoded with ASN.1 value for digest info.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/main.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

examples/fips_validation/main.c +78 -0

index b85409e056..b1fa38bda7 100644
@@ -859,6 +859,63 @@ prepare_aead_op(void)
 	return 0;
 }
 
+static int
+get_hash_oid(enum rte_crypto_auth_algorithm hash, uint8_t *buf)
+{
+	uint8_t id_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x03, 0x05, 0x00, 0x04,
+				  0x40};
+	uint8_t id_sha384[] = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x02, 0x05, 0x00, 0x04,
+				  0x30};
+	uint8_t id_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x01, 0x05, 0x00, 0x04,
+				  0x20};
+	uint8_t id_sha224[] = {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+				  0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+				  0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
+				  0x1c};
+	uint8_t id_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+				0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+				0x00, 0x04, 0x14};
+	uint8_t *id = NULL;
+	int id_len = 0;
+
+	switch (hash) {
+	case RTE_CRYPTO_AUTH_SHA1:
+		id = id_sha1;
+		id_len = sizeof(id_sha1);
+		break;
+	case RTE_CRYPTO_AUTH_SHA224:
+		id = id_sha224;
+		id_len = sizeof(id_sha224);
+		break;
+	case RTE_CRYPTO_AUTH_SHA256:
+		id = id_sha256;
+		id_len = sizeof(id_sha256);
+		break;
+	case RTE_CRYPTO_AUTH_SHA384:
+		id = id_sha384;
+		id_len = sizeof(id_sha384);
+		break;
+	case RTE_CRYPTO_AUTH_SHA512:
+		id = id_sha512;
+		id_len = sizeof(id_sha512);
+		break;
+	default:
+		id_len = -1;
+		break;
+	}
+
+	if (id != NULL)
+		rte_memcpy(buf, id, id_len);
+
+	return id_len;
+}
+
 static int
 prepare_rsa_op(void)
 {

@@ -872,6 +929,27 @@ prepare_rsa_op(void)
 	asym->rsa.padding.hash = info.interim_info.rsa_data.auth;
 
 	if (env.digest) {
+		if (asym->rsa.padding.type == RTE_CRYPTO_RSA_PADDING_PKCS1_5) {
+			int b_len = 0;
+			uint8_t b[32];
+
+			b_len = get_hash_oid(asym->rsa.padding.hash, b);
+			if (b_len < 0) {
+				RTE_LOG(ERR, USER1, "Failed to get digest info for hash %d\n",
+					asym->rsa.padding.hash);
+				return -EINVAL;
+			}
+
+			if (b_len) {
+				msg.len = env.digest_len + b_len;
+				msg.val = rte_zmalloc(NULL, msg.len, 0);
+				rte_memcpy(msg.val, b, b_len);
+				rte_memcpy(msg.val + b_len, env.digest, env.digest_len);
+				rte_free(env.digest);
+				env.digest = msg.val;
+				env.digest_len = msg.len;
+			}
+		}
 		msg.val = env.digest;
 		msg.len = env.digest_len;
 	} else {

Signature · 1 line

2.25.1

Gowrishankar Muthukrishnan

author

2022-10-12 06:13 UTC #37 lore raw

PATCH v7 3/3 examples/fips_validation: randomize message for conformance test

In reply to Gowrishankar Muthukrishnan

FIPS conformance tests require randomizing message based on SP 800-106.

Signed-off-by Gowrishankar Muthukrishnan <[email protected]>

---
 examples/fips_validation/fips_validation.h    |   4 +
 .../fips_validation/fips_validation_rsa.c     | 112 +++++++++++++++++-
 2 files changed, 115 insertions(+), 1 deletion(-)

examples/fips_validation/fips_validation.h +4 -0

index 7c275403c7..eec9616462 100644
@@ -213,6 +213,7 @@ struct rsa_interim_data {
 	uint16_t saltlen;
 	enum rte_crypto_rsa_padding_type padding;
 	enum rte_crypto_rsa_priv_key_type privkey;
+	uint8_t random_msg;
 };
 
 #ifdef USE_JANSSON

@@ -339,6 +340,9 @@ parse_test_tdes_json_init(void);
 
 int
 parse_test_rsa_json_init(void);
+
+int
+fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
 
 int

examples/fips_validation/fips_validation_rsa.c +111 -1

195 lines not on this page · raw message

Signature · 1 line

2.25.1

Akhil Goyal

Applied

2022-10-12 18:44 UTC #38 lore raw

In reply to Gowrishankar Muthukrishnan

Quoted 28 lines

Subject: [v7 0/3] FIPS asymmetric validation
This patch series adds support in fips_validation app to perform asymmetric validation. To start with, RSA algorithm is used in the evaluation. For the key value pairs which is multiprecision in arithmetic, openssl library is used.
Changes:
v7:
- fix test to handle app parameter correctly.
v6:
- checkpatch related fix.
v5:
- Release notes.
v4:
- AES GMAC callback fixes.
v3:
- patches 5,6 and 7 in v2 are rebased and submitted here.
v2:
- minor fixes in v1
- addition of digest encoding for fips validation
- addition of message randomization for fips conformance tests.
Gowrishankar Muthukrishnan (3):
examples/fips_validation: add asymmetric validation examples/fips_validation: encode digest with hash OID examples/fips_validation: randomize message for conformance test

Quoted 12 lines

 config/meson.build                            |   6 +
 doc/guides/rel_notes/release_22_11.rst        |   5 +
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  51 +-
 .../fips_validation/fips_validation_gcm.c     |   8 +-
 .../fips_validation/fips_validation_rsa.c     | 630 ++++++++++++++++++
 examples/fips_validation/main.c               | 556 +++++++++++++---
 examples/fips_validation/meson.build          |   6 +
 9 files changed, 1167 insertions(+), 98 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_rsa.c

Applied to dpdk-next-crypto

Thanks.