|
 |
5bcc82 |
diff -up libgcrypt-1.8.4/tests/basic.c.tests-fipsmode libgcrypt-1.8.4/tests/basic.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/basic.c.tests-fipsmode 2018-04-17 17:29:40.000000000 +0200
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/basic.c 2019-02-12 13:30:48.935791024 +0100
|
|
|
5bcc82 |
@@ -6964,7 +6964,7 @@ check_ciphers (void)
|
|
|
5bcc82 |
check_one_cipher (algos[i], GCRY_CIPHER_MODE_CTR, 0);
|
|
|
5bcc82 |
if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_CCM_BLOCK_LEN)
|
|
|
5bcc82 |
check_one_cipher (algos[i], GCRY_CIPHER_MODE_CCM, 0);
|
|
|
5bcc82 |
- if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
|
|
|
5bcc82 |
+ if (!in_fips_mode && gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
|
|
|
5bcc82 |
check_one_cipher (algos[i], GCRY_CIPHER_MODE_GCM, 0);
|
|
|
5bcc82 |
if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_OCB_BLOCK_LEN)
|
|
|
5bcc82 |
check_one_cipher (algos[i], GCRY_CIPHER_MODE_OCB, 0);
|
|
|
5bcc82 |
@@ -7010,11 +7010,17 @@ check_cipher_modes(void)
|
|
|
5bcc82 |
check_cfb_cipher ();
|
|
|
5bcc82 |
check_ofb_cipher ();
|
|
|
5bcc82 |
check_ccm_cipher ();
|
|
|
5bcc82 |
- check_gcm_cipher ();
|
|
|
5bcc82 |
- check_poly1305_cipher ();
|
|
|
5bcc82 |
- check_ocb_cipher ();
|
|
|
5bcc82 |
+ if (!in_fips_mode)
|
|
|
5bcc82 |
+ {
|
|
|
5bcc82 |
+ check_gcm_cipher ();
|
|
|
5bcc82 |
+ check_poly1305_cipher ();
|
|
|
5bcc82 |
+ check_ocb_cipher ();
|
|
|
5bcc82 |
+ }
|
|
|
5bcc82 |
check_xts_cipher ();
|
|
|
5bcc82 |
- check_gost28147_cipher ();
|
|
|
5bcc82 |
+ if (!in_fips_mode)
|
|
|
5bcc82 |
+ {
|
|
|
5bcc82 |
+ check_gost28147_cipher ();
|
|
|
5bcc82 |
+ }
|
|
|
5bcc82 |
check_stream_cipher ();
|
|
|
5bcc82 |
check_stream_cipher_large_block ();
|
|
|
5bcc82 |
|
|
|
5bcc82 |
@@ -10001,7 +10007,7 @@ check_mac (void)
|
|
|
5bcc82 |
show_mac_not_available (algos[i].algo);
|
|
|
5bcc82 |
continue;
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
- if (gcry_mac_test_algo (algos[i].algo) && in_fips_mode)
|
|
|
5bcc82 |
+ if ((algos[i].algo == GCRY_MAC_GMAC_AES || gcry_mac_test_algo (algos[i].algo)) && in_fips_mode)
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
if (verbose)
|
|
|
5bcc82 |
fprintf (stderr, " algorithm %d not available in fips mode\n",
|
|
|
5bcc82 |
@@ -11095,8 +11101,6 @@ main (int argc, char **argv)
|
|
|
5bcc82 |
/* If we are in fips mode do some more tests. */
|
|
|
5bcc82 |
gcry_md_hd_t md;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
- /* First trigger a self-test. */
|
|
|
5bcc82 |
- xgcry_control (GCRYCTL_FORCE_FIPS_MODE, 0);
|
|
|
5bcc82 |
if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
|
5bcc82 |
fail ("not in operational state after self-test\n");
|
|
|
5bcc82 |
|
|
|
5bcc82 |
@@ -11121,15 +11125,6 @@ main (int argc, char **argv)
|
|
|
5bcc82 |
gcry_md_close (md);
|
|
|
5bcc82 |
if (gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
|
5bcc82 |
fail ("expected error state but still in operational state\n");
|
|
|
5bcc82 |
- else
|
|
|
5bcc82 |
- {
|
|
|
5bcc82 |
- /* Now run a self-test and to get back into
|
|
|
5bcc82 |
- operational state. */
|
|
|
5bcc82 |
- xgcry_control (GCRYCTL_FORCE_FIPS_MODE, 0);
|
|
|
5bcc82 |
- if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
|
5bcc82 |
- fail ("did not reach operational after error "
|
|
|
5bcc82 |
- "and self-test\n");
|
|
|
5bcc82 |
- }
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
}
|
|
|
5bcc82 |
|
|
|
5bcc82 |
diff -up libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode libgcrypt-1.8.4/tests/benchmark.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode 2019-02-12 11:31:44.859603883 +0100
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/benchmark.c 2019-02-12 14:10:40.271999352 +0100
|
|
|
5bcc82 |
@@ -872,8 +872,10 @@ cipher_bench ( const char *algoname )
|
|
|
5bcc82 |
|| (blklen == 1 && modes[modeidx].mode != GCRY_CIPHER_MODE_STREAM))
|
|
|
5bcc82 |
continue;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
- if (modes[modeidx].req_blocksize > 0
|
|
|
5bcc82 |
- && blklen != modes[modeidx].req_blocksize)
|
|
|
5bcc82 |
+ if ((modes[modeidx].req_blocksize > 0
|
|
|
5bcc82 |
+ && blklen != modes[modeidx].req_blocksize)
|
|
|
5bcc82 |
+ || (in_fips_mode
|
|
|
5bcc82 |
+ && modes[modeidx].mode == GCRY_CIPHER_MODE_GCM))
|
|
|
5bcc82 |
{
|
|
|
5bcc82 |
printf (" %7s %7s", "-", "-" );
|
|
|
5bcc82 |
continue;
|
|
|
5bcc82 |
diff -up libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode libgcrypt-1.8.4/tests/bench-slope.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/bench-slope.c 2019-02-12 14:14:33.618763325 +0100
|
|
|
5bcc82 |
@@ -1338,7 +1338,7 @@ cipher_bench_one (int algo, struct bench
|
|
|
5bcc82 |
return;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* GCM has restrictions for block-size */
|
|
|
5bcc82 |
- if (mode.mode == GCRY_CIPHER_MODE_GCM && blklen != GCRY_GCM_BLOCK_LEN)
|
|
|
5bcc82 |
+ if (mode.mode == GCRY_CIPHER_MODE_GCM && (gcry_fips_mode_active () || blklen != GCRY_GCM_BLOCK_LEN))
|
|
|
5bcc82 |
return;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* XTS has restrictions for block-size */
|
|
|
5bcc82 |
diff -up libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode libgcrypt-1.8.4/tests/pubkey.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/pubkey.c 2019-02-12 13:52:25.658746415 +0100
|
|
|
5bcc82 |
@@ -504,15 +504,30 @@ get_dsa_key_with_domain_new (gcry_sexp_t
|
|
|
5bcc82 |
rc = gcry_sexp_new
|
|
|
5bcc82 |
(&key_spec,
|
|
|
5bcc82 |
"(genkey (dsa (transient-key)(domain"
|
|
|
5bcc82 |
- "(p #d3aed1876054db831d0c1348fbb1ada72507e5fbf9a62cbd47a63aeb7859d6921"
|
|
|
5bcc82 |
- "4adeb9146a6ec3f43520f0fd8e3125dd8bbc5d87405d1ac5f82073cd762a3f8d7"
|
|
|
5bcc82 |
- "74322657c9da88a7d2f0e1a9ceb84a39cb40876179e6a76e400498de4bb9379b0"
|
|
|
5bcc82 |
- "5f5feb7b91eb8fea97ee17a955a0a8a37587a272c4719d6feb6b54ba4ab69#)"
|
|
|
5bcc82 |
- "(q #9c916d121de9a03f71fb21bc2e1c0d116f065a4f#)"
|
|
|
5bcc82 |
- "(g #8157c5f68ca40b3ded11c353327ab9b8af3e186dd2e8dade98761a0996dda99ab"
|
|
|
5bcc82 |
- "0250d3409063ad99efae48b10c6ab2bba3ea9a67b12b911a372a2bba260176fad"
|
|
|
5bcc82 |
- "b4b93247d9712aad13aa70216c55da9858f7a298deb670a403eb1e7c91b847f1e"
|
|
|
5bcc82 |
- "ccfbd14bd806fd42cf45dbb69cd6d6b43add2a78f7d16928eaa04458dea44#)"
|
|
|
5bcc82 |
+ " (p #a85378d8fd3f8d72ec7418080da21317e43ec4b62ba8c862"
|
|
|
5bcc82 |
+ " 3b7e4d04441dd1a0658662596493ca8e9e8fbb7e34aaddb6"
|
|
|
5bcc82 |
+ " 2e5d67b6d09a6e61b769e7c352aa2b10e20ca0636963b552"
|
|
|
5bcc82 |
+ " 3e86470decbbeda027e797e7b67635d4d49c30700e74af8a"
|
|
|
5bcc82 |
+ " 0ff156a801af57a26e7078f1d82f74908ecb6d07e70b3503"
|
|
|
5bcc82 |
+ " eed94fa32cf17a7fc3d6cf40dc7b00830e6a2566dc073e34"
|
|
|
5bcc82 |
+ " 3312517c6aa5152b4bfecd2e551fee346318a153423c996b"
|
|
|
5bcc82 |
+ " 0d5dcb9102aedd38798616f1f1e0d6c403525b1f9b3d4dc7"
|
|
|
5bcc82 |
+ " 66de2dfc4a56d7b8ba5963d60f3e16318870ad436952e557"
|
|
|
5bcc82 |
+ " 65374eab85e8ec17d6b9a4547b9b5f2752f3105be809b23a"
|
|
|
5bcc82 |
+ " 2c8d7469db02e24d592394a7dba069e9#)"
|
|
|
5bcc82 |
+ " (q #d277044e50f5a4e3f510a50a0b84fdffbca047ed27602056"
|
|
|
5bcc82 |
+ " 7441a0a5#)"
|
|
|
5bcc82 |
+ " (g #13d754e21fd241655da891c522a65a72a89bdc64ec9b54a8"
|
|
|
5bcc82 |
+ " 21ed4a898b490e0c4fcb72192a4a20f541f3f2925399f0ba"
|
|
|
5bcc82 |
+ " ecf929aafbf79dfe4332393b32cd2e2fcf272f32a627434a"
|
|
|
5bcc82 |
+ " 0df242b75b414df372121e53a553f222f836b000f016485b"
|
|
|
5bcc82 |
+ " 6bd0898451801dcd8de64cd5365696ffc532d528c506620a"
|
|
|
5bcc82 |
+ " 942a0305046d8f1876341f1e570bc3974ba6b9a438e97023"
|
|
|
5bcc82 |
+ " 02a2e6e67bfd06d32bc679962271d7b40cd72f386e64e0d7"
|
|
|
5bcc82 |
+ " ef86ca8ca5d14228dc2a4f16e3189886b5990674f4200f3a"
|
|
|
5bcc82 |
+ " 4cf65a3f0ddba1fa672dff2f5e143d10e4e97ae84f6da095"
|
|
|
5bcc82 |
+ " 35d5b9df259181a79b63b069e949972b02ba36b3586aab7e"
|
|
|
5bcc82 |
+ " 45f322f82e4e85ca3ab85591b3c2a966#)"
|
|
|
5bcc82 |
")))", 0, 1);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
die ("error creating S-expression: %s\n", gcry_strerror (rc));
|
|
|
5bcc82 |
@@ -595,7 +610,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
|
|
|
5bcc82 |
" (use-fips186)"
|
|
|
5bcc82 |
" (transient-key)"
|
|
|
5bcc82 |
" (derive-parms"
|
|
|
5bcc82 |
- " (seed #0cb1990c1fd3626055d7a0096f8fa99807399871#))))",
|
|
|
5bcc82 |
+ " (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
|
|
|
5bcc82 |
0, 1);
|
|
|
5bcc82 |
if (rc)
|
|
|
5bcc82 |
die ("error creating S-expression: %s\n", gcry_strerror (rc));
|
|
|
5bcc82 |
diff -up libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode libgcrypt-1.8.4/tests/t-cv25519.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/t-cv25519.c 2019-02-12 14:02:35.935705390 +0100
|
|
|
5bcc82 |
@@ -560,6 +560,9 @@ main (int argc, char **argv)
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
|
|
5bcc82 |
+ /* Curve25519 isn't supported in fips mode */
|
|
|
5bcc82 |
+ if (gcry_fips_mode_active())
|
|
|
5bcc82 |
+ return 77;
|
|
|
5bcc82 |
|
|
|
5bcc82 |
start_timer ();
|
|
|
5bcc82 |
check_cv25519 ();
|
|
|
5bcc82 |
diff -up libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode libgcrypt-1.8.4/tests/t-secmem.c
|
|
|
5bcc82 |
--- libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode 2017-11-23 19:19:54.000000000 +0100
|
|
|
5bcc82 |
+++ libgcrypt-1.8.4/tests/t-secmem.c 2019-02-12 11:51:02.462190538 +0100
|
|
|
5bcc82 |
@@ -174,7 +174,8 @@ main (int argc, char **argv)
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_INIT_SECMEM, pool_size, 0);
|
|
|
5bcc82 |
- gcry_set_outofcore_handler (outofcore_handler, NULL);
|
|
|
5bcc82 |
+ if (!gcry_fips_mode_active ())
|
|
|
5bcc82 |
+ gcry_set_outofcore_handler (outofcore_handler, NULL);
|
|
|
5bcc82 |
xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
|
|
5bcc82 |
|
|
|
5bcc82 |
/* Libgcrypt prints a warning when the first overflow is allocated;
|
|
|
5bcc82 |
@@ -184,7 +185,8 @@ main (int argc, char **argv)
|
|
|
5bcc82 |
|
|
|
5bcc82 |
|
|
|
5bcc82 |
test_secmem ();
|
|
|
5bcc82 |
- test_secmem_overflow ();
|
|
|
5bcc82 |
+ if (!gcry_fips_mode_active ())
|
|
|
5bcc82 |
+ test_secmem_overflow ();
|
|
|
5bcc82 |
/* FIXME: We need to improve the tests, for example by registering
|
|
|
5bcc82 |
* our own log handler and comparing the output of
|
|
|
5bcc82 |
* PRIV_CTL_DUMP_SECMEM_STATS to expected pattern. */
|