Blame SOURCES/gnutls-3.7.6-fips-symkey-limit.patch

cd0318
From f8a8961cfa176fc74c153cb6e1e68aff5e2d42f2 Mon Sep 17 00:00:00 2001
cd0318
From: rpm-build <rpm-build>
cd0318
Date: Tue, 27 Sep 2022 10:52:19 +0900
cd0318
Subject: [PATCH] gnutls-3.7.6-fips-symkey-limit.patch
cd0318
cd0318
---
cd0318
 lib/crypto-api.c  | 26 ++++++++++++++++++++++---
cd0318
 tests/fips-test.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++
cd0318
 tests/kdf-api.c   |  9 ++++++++-
cd0318
 3 files changed, 80 insertions(+), 4 deletions(-)
cd0318
cd0318
diff --git a/lib/crypto-api.c b/lib/crypto-api.c
cd0318
index b3e1eec..35200fb 100644
cd0318
--- a/lib/crypto-api.c
cd0318
+++ b/lib/crypto-api.c
cd0318
@@ -896,6 +896,7 @@ gnutls_hash_hd_t gnutls_hash_copy(gnutls_hash_hd_t handle)
cd0318
 int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
cd0318
 {
cd0318
 	int ret;
cd0318
+	bool not_approved = false;
cd0318
 
cd0318
 	FAIL_IF_LIB_ERROR;
cd0318
 
cd0318
@@ -912,17 +913,31 @@ int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
cd0318
 	key->data = gnutls_malloc(key->size);
cd0318
 	if (!key->data) {
cd0318
 		gnutls_assert();
cd0318
-		return GNUTLS_E_MEMORY_ERROR;
cd0318
+		ret = GNUTLS_E_MEMORY_ERROR;
cd0318
+		goto error;
cd0318
+	}
cd0318
+
cd0318
+	/* Key lengths of less than 112 bits are not approved */
cd0318
+	if (key_size < 14) {
cd0318
+		not_approved = true;
cd0318
 	}
cd0318
 
cd0318
 	ret = gnutls_rnd(GNUTLS_RND_RANDOM, key->data, key->size);
cd0318
 	if (ret < 0) {
cd0318
 		gnutls_assert();
cd0318
 		_gnutls_free_datum(key);
cd0318
-		return ret;
cd0318
+		goto error;
cd0318
 	}
cd0318
 
cd0318
-	return 0;
cd0318
+ error:
cd0318
+	if (ret < 0) {
cd0318
+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
cd0318
+	} else if (not_approved) {
cd0318
+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
cd0318
+	} else {
cd0318
+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
cd0318
+	}
cd0318
+	return ret;
cd0318
 }
cd0318
 
cd0318
 /* AEAD API */
cd0318
@@ -2058,6 +2073,11 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
cd0318
 		not_approved = true;
cd0318
 	}
cd0318
 
cd0318
+	/* Key lengths and output sizes of less than 112 bits are not approved */
cd0318
+	if (key->size < 14 || length < 14) {
cd0318
+		not_approved = true;
cd0318
+	}
cd0318
+
cd0318
 	ret = _gnutls_kdf_ops.pbkdf2(mac, key->data, key->size,
cd0318
 				     salt->data, salt->size, iter_count,
cd0318
 				     output, length);
cd0318
diff --git a/tests/fips-test.c b/tests/fips-test.c
cd0318
index 31a5e26..27da414 100644
cd0318
--- a/tests/fips-test.c
cd0318
+++ b/tests/fips-test.c
cd0318
@@ -274,6 +274,8 @@ void doit(void)
cd0318
 	gnutls_datum_t signature;
cd0318
 	unsigned int bits;
cd0318
 	uint8_t hmac[64];
cd0318
+	uint8_t pbkdf2[64];
cd0318
+	gnutls_datum_t temp_key = { NULL, 0 };
cd0318
 
cd0318
 	fprintf(stderr,
cd0318
 		"Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n");
cd0318
@@ -371,11 +373,58 @@ void doit(void)
cd0318
 	}
cd0318
 	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
 
cd0318
+	/* PBKDF2 with key equal to or longer than 112 bits: approved */
cd0318
+	FIPS_PUSH_CONTEXT();
cd0318
+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
cd0318
+			    &pbkdf2, sizeof(pbkdf2));
cd0318
+	if (ret < 0) {
cd0318
+		fail("gnutls_pbkdf2 failed\n");
cd0318
+	}
cd0318
+	FIPS_POP_CONTEXT(APPROVED);
cd0318
+
cd0318
+	/* PBKDF2 with key shorter than 112 bits: not approved */
cd0318
+	FIPS_PUSH_CONTEXT();
cd0318
+	key.size = 13;
cd0318
+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
cd0318
+			    &pbkdf2, sizeof(pbkdf2));
cd0318
+	if (ret < 0) {
cd0318
+		fail("gnutls_pbkdf2 failed\n");
cd0318
+	}
cd0318
+	key.size = sizeof(key16);
cd0318
+	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
+
cd0318
+	/* PBKDF2 with output shorter than 112 bits: not approved */
cd0318
+	FIPS_PUSH_CONTEXT();
cd0318
+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
cd0318
+			    &pbkdf2, 13);
cd0318
+	if (ret < 0) {
cd0318
+		fail("gnutls_pbkdf2 failed\n");
cd0318
+	}
cd0318
+	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
+
cd0318
 	ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
cd0318
 	if (ret < 0) {
cd0318
 		fail("gnutls_rnd failed\n");
cd0318
 	}
cd0318
 
cd0318
+	/* Symmetric key generation equal to or longer than 112 bits: approved */
cd0318
+	FIPS_PUSH_CONTEXT();
cd0318
+	ret = gnutls_key_generate(&temp_key, 14);
cd0318
+	if (ret < 0) {
cd0318
+		fail("gnutls_key_generate failed\n");
cd0318
+	}
cd0318
+	gnutls_free(temp_key.data);
cd0318
+	FIPS_POP_CONTEXT(APPROVED);
cd0318
+
cd0318
+	/* Symmetric key generation shorter than 112 bits: not approved */
cd0318
+	FIPS_PUSH_CONTEXT();
cd0318
+	ret = gnutls_key_generate(&temp_key, 13);
cd0318
+	if (ret < 0) {
cd0318
+		fail("gnutls_key_generate failed\n");
cd0318
+	}
cd0318
+	gnutls_free(temp_key.data);
cd0318
+	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
+
cd0318
 	ret = gnutls_pubkey_init(&pubkey);
cd0318
 	if (ret < 0) {
cd0318
 		fail("gnutls_pubkey_init failed\n");
cd0318
diff --git a/tests/kdf-api.c b/tests/kdf-api.c
cd0318
index 25fbc6a..8a4677c 100644
cd0318
--- a/tests/kdf-api.c
cd0318
+++ b/tests/kdf-api.c
cd0318
@@ -89,6 +89,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
cd0318
 
cd0318
 	FIPS_PUSH_CONTEXT();
cd0318
 	assert(gnutls_hkdf_extract(mac, &ikm, &salt, buf) >= 0);
cd0318
+	/* HKDF outside of TLS usage is not approved */
cd0318
 	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
 	gnutls_free(ikm.data);
cd0318
 	gnutls_free(salt.data);
cd0318
@@ -110,6 +111,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
cd0318
 
cd0318
 	FIPS_PUSH_CONTEXT();
cd0318
 	assert(gnutls_hkdf_expand(mac, &prk, &info, buf, length) >= 0);
cd0318
+	/* HKDF outside of TLS usage is not approved */
cd0318
 	FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
 	gnutls_free(info.data);
cd0318
 
cd0318
@@ -151,7 +153,12 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
cd0318
 
cd0318
 	FIPS_PUSH_CONTEXT();
cd0318
 	assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
cd0318
-	FIPS_POP_CONTEXT(APPROVED);
cd0318
+	/* Key sizes and output sizes less than 112-bit are not approved.  */
cd0318
+	if (ikm.size < 14 || length < 14) {
cd0318
+		FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
+	} else {
cd0318
+		FIPS_POP_CONTEXT(APPROVED);
cd0318
+	}
cd0318
 	gnutls_free(ikm.data);
cd0318
 	gnutls_free(salt.data);
cd0318
 
cd0318
-- 
cd0318
2.37.3
cd0318
cd0318
From 86eded166f77612c70201c0d85d3abe711edd77d Mon Sep 17 00:00:00 2001
cd0318
From: Daiki Ueno <ueno@gnu.org>
cd0318
Date: Thu, 29 Sep 2022 21:19:26 +0900
cd0318
Subject: [PATCH] fips: only mark HMAC as approved in PBKDF2
cd0318
cd0318
As ACVP only allows HMAC used with PBKDF2[1], this change marks other
cd0318
hash algorithms not-approved.
cd0318
cd0318
1. https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
cd0318
cd0318
Signed-off-by: Daiki Ueno <ueno@gnu.org>
cd0318
---
cd0318
 lib/crypto-api.c |  5 ++++-
cd0318
 lib/fips.h       | 16 +++++++++++++++-
cd0318
 tests/kdf-api.c  | 30 +++++++++++++++++++++++++++++-
cd0318
 3 files changed, 48 insertions(+), 3 deletions(-)
cd0318
cd0318
diff --git a/lib/crypto-api.c b/lib/crypto-api.c
cd0318
index d3e601ab3a..9f7e18db11 100644
cd0318
--- a/lib/crypto-api.c
cd0318
+++ b/lib/crypto-api.c
cd0318
@@ -2229,7 +2229,10 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
cd0318
 	if (!is_mac_algo_allowed(mac)) {
cd0318
 		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
cd0318
 		return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
cd0318
-	} else if (!is_mac_algo_approved_in_fips(mac)) {
cd0318
+	} else if (!is_mac_algo_hmac_approved_in_fips(mac)) {
cd0318
+		/* ACVP only allows HMAC used with PBKDF2:
cd0318
+		 * https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
cd0318
+		 */
cd0318
 		not_approved = true;
cd0318
 	}
cd0318
 
cd0318
diff --git a/lib/fips.h b/lib/fips.h
cd0318
index 3a74f254e7..bf61b36741 100644
cd0318
--- a/lib/fips.h
cd0318
+++ b/lib/fips.h
cd0318
@@ -76,7 +76,7 @@ void _gnutls_lib_simulate_error(void);
cd0318
 void _gnutls_lib_force_operational(void);
cd0318
 
cd0318
 inline static bool
cd0318
-is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
cd0318
+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
cd0318
 {
cd0318
 	switch (algo) {
cd0318
 	case GNUTLS_MAC_SHA1:
cd0318
@@ -88,6 +88,20 @@ is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
cd0318
 	case GNUTLS_MAC_SHA3_256:
cd0318
 	case GNUTLS_MAC_SHA3_384:
cd0318
 	case GNUTLS_MAC_SHA3_512:
cd0318
+		return true;
cd0318
+	default:
cd0318
+		return false;
cd0318
+	}
cd0318
+}
cd0318
+
cd0318
+inline static bool
cd0318
+is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
cd0318
+{
cd0318
+	if (is_mac_algo_hmac_approved_in_fips(algo)) {
cd0318
+		return true;
cd0318
+	}
cd0318
+
cd0318
+	switch (algo) {
cd0318
 	case GNUTLS_MAC_AES_CMAC_128:
cd0318
 	case GNUTLS_MAC_AES_CMAC_256:
cd0318
 	case GNUTLS_MAC_AES_GMAC_128:
cd0318
diff --git a/tests/kdf-api.c b/tests/kdf-api.c
cd0318
index 577cbf7a17..4feb22688b 100644
cd0318
--- a/tests/kdf-api.c
cd0318
+++ b/tests/kdf-api.c
cd0318
@@ -26,6 +26,7 @@
cd0318
 #include <gnutls/crypto.h>
cd0318
 
cd0318
 #include <assert.h>
cd0318
+#include <stdbool.h>
cd0318
 #include <stdint.h>
cd0318
 
cd0318
 #include "utils.h"
cd0318
@@ -133,6 +134,25 @@ test_hkdf(gnutls_mac_algorithm_t mac,
cd0318
 	gnutls_free(hex.data);
cd0318
 }
cd0318
 
cd0318
+inline static bool
cd0318
+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
cd0318
+{
cd0318
+	switch (algo) {
cd0318
+	case GNUTLS_MAC_SHA1:
cd0318
+	case GNUTLS_MAC_SHA256:
cd0318
+	case GNUTLS_MAC_SHA384:
cd0318
+	case GNUTLS_MAC_SHA512:
cd0318
+	case GNUTLS_MAC_SHA224:
cd0318
+	case GNUTLS_MAC_SHA3_224:
cd0318
+	case GNUTLS_MAC_SHA3_256:
cd0318
+	case GNUTLS_MAC_SHA3_384:
cd0318
+	case GNUTLS_MAC_SHA3_512:
cd0318
+		return true;
cd0318
+	default:
cd0318
+		return false;
cd0318
+	}
cd0318
+}
cd0318
+
cd0318
 static void
cd0318
 test_pbkdf2(gnutls_mac_algorithm_t mac,
cd0318
 	    const char *ikm_hex,
cd0318
@@ -161,7 +181,8 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
cd0318
 	FIPS_PUSH_CONTEXT();
cd0318
 	assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
cd0318
 	/* Key sizes and output sizes less than 112-bit are not approved.  */
cd0318
-	if (ikm.size < 14 || length < 14) {
cd0318
+	if (ikm.size < 14 || length < 14 ||
cd0318
+	    !is_mac_algo_hmac_approved_in_fips(mac)) {
cd0318
 		FIPS_POP_CONTEXT(NOT_APPROVED);
cd0318
 	} else {
cd0318
 		FIPS_POP_CONTEXT(APPROVED);
cd0318
@@ -208,5 +229,12 @@ doit(void)
cd0318
 		    20,
cd0318
 		    "4b007901b765489abead49d926f721d065a429c1");
cd0318
 
cd0318
+	test_pbkdf2(GNUTLS_MAC_AES_CMAC_128,
cd0318
+		    "70617373776f726470617373776f7264", /* "passwordpassword" */
cd0318
+		    "73616c74",		/* "salt" */
cd0318
+		    4096,
cd0318
+		    20,
cd0318
+		    "c4c112c6e1e3b8757640603dec78825ff87605a7");
cd0318
+
cd0318
 	gnutls_fips140_context_deinit(fips_context);
cd0318
 }
cd0318
-- 
cd0318
2.37.3
cd0318