fips140-selftests.c 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright 2021 Google LLC
  4. *
  5. * Authors: Elena Petrova <lenaptr@google.com>,
  6. * Eric Biggers <ebiggers@google.com>
  7. *
  8. * Self-tests of fips140.ko cryptographic functionality. These are run at
  9. * module load time to fulfill FIPS 140 and NIAP FPT_TST_EXT.1 requirements.
  10. *
  11. * The actual requirements for these self-tests are somewhat vague, but
  12. * section 9 ("Self-Tests") of the FIPS 140-2 Implementation Guidance document
  13. * (https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/fips140-2/fips1402ig.pdf)
  14. * is somewhat helpful. Basically, all implementations of all FIPS approved
  15. * algorithms (including modes of operation) must be tested. However:
  16. *
  17. * - There are provisions for skipping tests that are already sufficiently
  18. * covered by other tests. E.g., HMAC-SHA256 may cover SHA-256.
  19. *
  20. * - Only one test vector is required per algorithm, and it can be generated
  21. * by any known-good implementation or taken from any official document.
  22. *
  23. * - For ciphers, both encryption and decryption must be tested.
  24. *
  25. * - Only one key size per algorithm needs to be tested.
  26. *
  27. * There is some ambiguity about whether all implementations of each algorithm
  28. * must be tested, or whether it is sufficient to test just the highest priority
  29. * implementation. To be safe we test all implementations, except ones that can
  30. * be excluded by one of the rules above.
  31. *
  32. * See fips140_selftests[] for the list of tests we've selected. Currently, all
  33. * our test vectors except the AES-CBC-CTS and DRBG ones were generated by the
  34. * script tools/crypto/gen_fips140_testvecs.py, using the known-good
  35. * implementations in the Python packages hashlib, pycryptodome, and
  36. * cryptography.
  37. *
  38. * Note that we don't reuse the upstream crypto API's self-tests
  39. * (crypto/testmgr.{c,h}), for several reasons:
  40. *
  41. * - To meet FIPS requirements, the self-tests must be located within the FIPS
  42. * module boundary (fips140.ko). But testmgr is integrated into the crypto
  43. * API framework and can't be extracted into the module.
  44. *
  45. * - testmgr is much more heavyweight than required for FIPS and NIAP; it
  46. * tests more algorithms and does more tests per algorithm, as it's meant to
  47. * do proper testing and not just meet certification requirements. We need
  48. * tests that can run with minimal overhead on every boot-up.
  49. *
  50. * - Despite being more heavyweight in general, testmgr doesn't test the
  51. * SHA-256 and AES library APIs, despite that being needed here.
  52. */
  53. #include <crypto/aead.h>
  54. #include <crypto/aes.h>
  55. #include <crypto/drbg.h>
  56. #include <crypto/hash.h>
  57. #include <crypto/rng.h>
  58. #include <crypto/sha.h>
  59. #include <crypto/skcipher.h>
  60. #include "fips140-module.h"
  61. /* Test vector for an AEAD algorithm */
  62. struct aead_testvec {
  63. const u8 *key;
  64. size_t key_size;
  65. const u8 *iv;
  66. size_t iv_size;
  67. const u8 *assoc;
  68. size_t assoc_size;
  69. const u8 *plaintext;
  70. size_t plaintext_size;
  71. const u8 *ciphertext;
  72. size_t ciphertext_size;
  73. };
  74. /* Test vector for a length-preserving encryption algorithm */
  75. struct skcipher_testvec {
  76. const u8 *key;
  77. size_t key_size;
  78. const u8 *iv;
  79. size_t iv_size;
  80. const u8 *plaintext;
  81. const u8 *ciphertext;
  82. size_t message_size;
  83. };
  84. /* Test vector for a hash algorithm */
  85. struct hash_testvec {
  86. const u8 *key;
  87. size_t key_size;
  88. const u8 *message;
  89. size_t message_size;
  90. const u8 *digest;
  91. size_t digest_size;
  92. };
  93. /* Test vector for a DRBG algorithm */
  94. struct drbg_testvec {
  95. const u8 *entropy;
  96. size_t entropy_size;
  97. const u8 *pers;
  98. size_t pers_size;
  99. const u8 *entpr_a;
  100. const u8 *entpr_b;
  101. size_t entpr_size;
  102. const u8 *add_a;
  103. const u8 *add_b;
  104. size_t add_size;
  105. const u8 *output;
  106. size_t out_size;
  107. };
  108. struct fips_test {
  109. /* The name of the algorithm, in crypto API syntax */
  110. const char *alg;
  111. /*
  112. * The optional list of implementations to test. @func will be called
  113. * once per implementation, or once with @alg if this list is empty.
  114. * The implementation names must be given in crypto API syntax, or in
  115. * the case of a library implementation should have "-lib" appended.
  116. */
  117. const char *impls[8];
  118. /*
  119. * The test function. It should execute a known-answer test on an
  120. * algorithm implementation, using the below test vector.
  121. */
  122. int __must_check (*func)(const struct fips_test *test,
  123. const char *impl);
  124. /* The test vector, with a format specific to the type of algorithm */
  125. union {
  126. struct aead_testvec aead;
  127. struct skcipher_testvec skcipher;
  128. struct hash_testvec hash;
  129. struct drbg_testvec drbg;
  130. };
  131. };
  132. /* Maximum IV size (in bytes) among any algorithm tested here */
  133. #define MAX_IV_SIZE 16
  134. static int __init __must_check
  135. fips_check_result(u8 *result, const u8 *expected_result, size_t result_size,
  136. const char *impl, const char *operation)
  137. {
  138. fips140_inject_selftest_failure(impl, result);
  139. if (memcmp(result, expected_result, result_size) != 0) {
  140. pr_err("wrong result from %s %s\n", impl, operation);
  141. return -EBADMSG;
  142. }
  143. return 0;
  144. }
  145. /*
  146. * None of the algorithms should be ASYNC, as the FIPS module doesn't register
  147. * any ASYNC algorithms. (The ASYNC flag is only declared by hardware
  148. * algorithms, which would need their own FIPS certification.)
  149. *
  150. * Ideally we would verify alg->cra_module == THIS_MODULE here as well, but that
  151. * doesn't work because the files are compiled as built-in code.
  152. */
  153. static int __init __must_check
  154. fips_validate_alg(const struct crypto_alg *alg)
  155. {
  156. if (alg->cra_flags & CRYPTO_ALG_ASYNC) {
  157. pr_err("unexpectedly got async implementation of %s (%s)\n",
  158. alg->cra_name, alg->cra_driver_name);
  159. return -EINVAL;
  160. }
  161. return 0;
  162. }
  163. static int __init __must_check
  164. fips_handle_alloc_tfm_error(const char *impl, int err)
  165. {
  166. if (err == -ENOENT) {
  167. /*
  168. * The requested implementation of the algorithm wasn't found.
  169. * This is expected if the CPU lacks a feature the
  170. * implementation needs, such as the ARMv8 Crypto Extensions.
  171. *
  172. * When this happens, the implementation isn't available for
  173. * use, so we can't test it, nor do we need to. So we just skip
  174. * the test.
  175. */
  176. pr_info("%s is unavailable (no CPU support?), skipping testing it\n",
  177. impl);
  178. return 0;
  179. }
  180. pr_err("failed to allocate %s tfm: %d\n", impl, err);
  181. return err;
  182. }
  183. static int __init __must_check
  184. fips_test_aes_library(const struct fips_test *test, const char *impl)
  185. {
  186. const struct skcipher_testvec *vec = &test->skcipher;
  187. struct crypto_aes_ctx ctx;
  188. u8 block[AES_BLOCK_SIZE];
  189. int err;
  190. if (WARN_ON(vec->message_size != AES_BLOCK_SIZE))
  191. return -EINVAL;
  192. err = aes_expandkey(&ctx, vec->key, vec->key_size);
  193. if (err) {
  194. pr_err("aes_expandkey() failed: %d\n", err);
  195. return err;
  196. }
  197. aes_encrypt(&ctx, block, vec->plaintext);
  198. err = fips_check_result(block, vec->ciphertext, AES_BLOCK_SIZE,
  199. impl, "encryption");
  200. if (err)
  201. return err;
  202. aes_decrypt(&ctx, block, block);
  203. return fips_check_result(block, vec->plaintext, AES_BLOCK_SIZE,
  204. impl, "decryption");
  205. }
  206. /* Test a length-preserving symmetric cipher using the crypto_skcipher API. */
  207. static int __init __must_check
  208. fips_test_skcipher(const struct fips_test *test, const char *impl)
  209. {
  210. const struct skcipher_testvec *vec = &test->skcipher;
  211. struct crypto_skcipher *tfm;
  212. struct skcipher_request *req = NULL;
  213. u8 *message = NULL;
  214. struct scatterlist sg;
  215. u8 iv[MAX_IV_SIZE];
  216. int err;
  217. if (WARN_ON(vec->iv_size > MAX_IV_SIZE))
  218. return -EINVAL;
  219. if (WARN_ON(vec->message_size <= 0))
  220. return -EINVAL;
  221. tfm = crypto_alloc_skcipher(impl, 0, 0);
  222. if (IS_ERR(tfm))
  223. return fips_handle_alloc_tfm_error(impl, PTR_ERR(tfm));
  224. err = fips_validate_alg(&crypto_skcipher_alg(tfm)->base);
  225. if (err)
  226. goto out;
  227. if (crypto_skcipher_ivsize(tfm) != vec->iv_size) {
  228. pr_err("%s has wrong IV size\n", impl);
  229. err = -EINVAL;
  230. goto out;
  231. }
  232. req = skcipher_request_alloc(tfm, GFP_KERNEL);
  233. message = kmemdup(vec->plaintext, vec->message_size, GFP_KERNEL);
  234. if (!req || !message) {
  235. err = -ENOMEM;
  236. goto out;
  237. }
  238. sg_init_one(&sg, message, vec->message_size);
  239. skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
  240. NULL, NULL);
  241. skcipher_request_set_crypt(req, &sg, &sg, vec->message_size, iv);
  242. err = crypto_skcipher_setkey(tfm, vec->key, vec->key_size);
  243. if (err) {
  244. pr_err("failed to set %s key: %d\n", impl, err);
  245. goto out;
  246. }
  247. /* Encrypt the plaintext, then verify the resulting ciphertext. */
  248. memcpy(iv, vec->iv, vec->iv_size);
  249. err = crypto_skcipher_encrypt(req);
  250. if (err) {
  251. pr_err("%s encryption failed: %d\n", impl, err);
  252. goto out;
  253. }
  254. err = fips_check_result(message, vec->ciphertext, vec->message_size,
  255. impl, "encryption");
  256. if (err)
  257. goto out;
  258. /* Decrypt the ciphertext, then verify the resulting plaintext. */
  259. memcpy(iv, vec->iv, vec->iv_size);
  260. err = crypto_skcipher_decrypt(req);
  261. if (err) {
  262. pr_err("%s decryption failed: %d\n", impl, err);
  263. goto out;
  264. }
  265. err = fips_check_result(message, vec->plaintext, vec->message_size,
  266. impl, "decryption");
  267. out:
  268. kfree(message);
  269. skcipher_request_free(req);
  270. crypto_free_skcipher(tfm);
  271. return err;
  272. }
  273. /* Test an AEAD using the crypto_aead API. */
  274. static int __init __must_check
  275. fips_test_aead(const struct fips_test *test, const char *impl)
  276. {
  277. const struct aead_testvec *vec = &test->aead;
  278. const int tag_size = vec->ciphertext_size - vec->plaintext_size;
  279. struct crypto_aead *tfm;
  280. struct aead_request *req = NULL;
  281. u8 *assoc = NULL;
  282. u8 *message = NULL;
  283. struct scatterlist sg[2];
  284. int sg_idx = 0;
  285. u8 iv[MAX_IV_SIZE];
  286. int err;
  287. if (WARN_ON(vec->iv_size > MAX_IV_SIZE))
  288. return -EINVAL;
  289. if (WARN_ON(vec->ciphertext_size <= vec->plaintext_size))
  290. return -EINVAL;
  291. tfm = crypto_alloc_aead(impl, 0, 0);
  292. if (IS_ERR(tfm))
  293. return fips_handle_alloc_tfm_error(impl, PTR_ERR(tfm));
  294. err = fips_validate_alg(&crypto_aead_alg(tfm)->base);
  295. if (err)
  296. goto out;
  297. if (crypto_aead_ivsize(tfm) != vec->iv_size) {
  298. pr_err("%s has wrong IV size\n", impl);
  299. err = -EINVAL;
  300. goto out;
  301. }
  302. req = aead_request_alloc(tfm, GFP_KERNEL);
  303. assoc = kmemdup(vec->assoc, vec->assoc_size, GFP_KERNEL);
  304. message = kzalloc(vec->ciphertext_size, GFP_KERNEL);
  305. if (!req || !assoc || !message) {
  306. err = -ENOMEM;
  307. goto out;
  308. }
  309. memcpy(message, vec->plaintext, vec->plaintext_size);
  310. sg_init_table(sg, ARRAY_SIZE(sg));
  311. if (vec->assoc_size)
  312. sg_set_buf(&sg[sg_idx++], assoc, vec->assoc_size);
  313. sg_set_buf(&sg[sg_idx++], message, vec->ciphertext_size);
  314. aead_request_set_ad(req, vec->assoc_size);
  315. aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
  316. err = crypto_aead_setkey(tfm, vec->key, vec->key_size);
  317. if (err) {
  318. pr_err("failed to set %s key: %d\n", impl, err);
  319. goto out;
  320. }
  321. err = crypto_aead_setauthsize(tfm, tag_size);
  322. if (err) {
  323. pr_err("failed to set %s authentication tag size: %d\n",
  324. impl, err);
  325. goto out;
  326. }
  327. /*
  328. * Encrypt the plaintext, then verify the resulting ciphertext (which
  329. * includes the authentication tag).
  330. */
  331. memcpy(iv, vec->iv, vec->iv_size);
  332. aead_request_set_crypt(req, sg, sg, vec->plaintext_size, iv);
  333. err = crypto_aead_encrypt(req);
  334. if (err) {
  335. pr_err("%s encryption failed: %d\n", impl, err);
  336. goto out;
  337. }
  338. err = fips_check_result(message, vec->ciphertext, vec->ciphertext_size,
  339. impl, "encryption");
  340. if (err)
  341. goto out;
  342. /*
  343. * Decrypt the ciphertext (which includes the authentication tag), then
  344. * verify the resulting plaintext.
  345. */
  346. memcpy(iv, vec->iv, vec->iv_size);
  347. aead_request_set_crypt(req, sg, sg, vec->ciphertext_size, iv);
  348. err = crypto_aead_decrypt(req);
  349. if (err) {
  350. pr_err("%s decryption failed: %d\n", impl, err);
  351. goto out;
  352. }
  353. err = fips_check_result(message, vec->plaintext, vec->plaintext_size,
  354. impl, "decryption");
  355. out:
  356. kfree(message);
  357. kfree(assoc);
  358. aead_request_free(req);
  359. crypto_free_aead(tfm);
  360. return err;
  361. }
  362. /*
  363. * Test a hash algorithm using the crypto_shash API.
  364. *
  365. * Note that we don't need to test the crypto_ahash API too, since none of the
  366. * hash algorithms in the FIPS module have the ASYNC flag, and thus there will
  367. * be no hash algorithms that can be accessed only through crypto_ahash.
  368. */
  369. static int __init __must_check
  370. fips_test_hash(const struct fips_test *test, const char *impl)
  371. {
  372. const struct hash_testvec *vec = &test->hash;
  373. struct crypto_shash *tfm;
  374. u8 digest[HASH_MAX_DIGESTSIZE];
  375. int err;
  376. if (WARN_ON(vec->digest_size > HASH_MAX_DIGESTSIZE))
  377. return -EINVAL;
  378. tfm = crypto_alloc_shash(impl, 0, 0);
  379. if (IS_ERR(tfm))
  380. return fips_handle_alloc_tfm_error(impl, PTR_ERR(tfm));
  381. err = fips_validate_alg(&crypto_shash_alg(tfm)->base);
  382. if (err)
  383. goto out;
  384. if (crypto_shash_digestsize(tfm) != vec->digest_size) {
  385. pr_err("%s has wrong digest size\n", impl);
  386. err = -EINVAL;
  387. goto out;
  388. }
  389. if (vec->key) {
  390. err = crypto_shash_setkey(tfm, vec->key, vec->key_size);
  391. if (err) {
  392. pr_err("failed to set %s key: %d\n", impl, err);
  393. goto out;
  394. }
  395. }
  396. err = crypto_shash_tfm_digest(tfm, vec->message, vec->message_size,
  397. digest);
  398. if (err) {
  399. pr_err("%s digest computation failed: %d\n", impl, err);
  400. goto out;
  401. }
  402. err = fips_check_result(digest, vec->digest, vec->digest_size,
  403. impl, "digest");
  404. out:
  405. crypto_free_shash(tfm);
  406. return err;
  407. }
  408. static int __init __must_check
  409. fips_test_sha256_library(const struct fips_test *test, const char *impl)
  410. {
  411. const struct hash_testvec *vec = &test->hash;
  412. u8 digest[SHA256_DIGEST_SIZE];
  413. if (WARN_ON(vec->digest_size != SHA256_DIGEST_SIZE))
  414. return -EINVAL;
  415. sha256(vec->message, vec->message_size, digest);
  416. return fips_check_result(digest, vec->digest, vec->digest_size,
  417. impl, "digest");
  418. }
  419. /* Test a DRBG using the crypto_rng API. */
  420. static int __init __must_check
  421. fips_test_drbg(const struct fips_test *test, const char *impl)
  422. {
  423. const struct drbg_testvec *vec = &test->drbg;
  424. struct crypto_rng *rng;
  425. u8 *output = NULL;
  426. struct drbg_test_data test_data;
  427. struct drbg_string addtl, pers, testentropy;
  428. int err;
  429. rng = crypto_alloc_rng(impl, 0, 0);
  430. if (IS_ERR(rng))
  431. return fips_handle_alloc_tfm_error(impl, PTR_ERR(rng));
  432. err = fips_validate_alg(&crypto_rng_alg(rng)->base);
  433. if (err)
  434. goto out;
  435. output = kzalloc(vec->out_size, GFP_KERNEL);
  436. if (!output) {
  437. err = -ENOMEM;
  438. goto out;
  439. }
  440. /*
  441. * Initialize the DRBG with the entropy and personalization string given
  442. * in the test vector.
  443. */
  444. test_data.testentropy = &testentropy;
  445. drbg_string_fill(&testentropy, vec->entropy, vec->entropy_size);
  446. drbg_string_fill(&pers, vec->pers, vec->pers_size);
  447. err = crypto_drbg_reset_test(rng, &pers, &test_data);
  448. if (err) {
  449. pr_err("failed to reset %s\n", impl);
  450. goto out;
  451. }
  452. /*
  453. * Generate some random bytes using the additional data string provided
  454. * in the test vector. Also use the additional entropy if provided
  455. * (relevant for the prediction-resistant DRBG variants only).
  456. */
  457. drbg_string_fill(&addtl, vec->add_a, vec->add_size);
  458. if (vec->entpr_size) {
  459. drbg_string_fill(&testentropy, vec->entpr_a, vec->entpr_size);
  460. err = crypto_drbg_get_bytes_addtl_test(rng, output,
  461. vec->out_size, &addtl,
  462. &test_data);
  463. } else {
  464. err = crypto_drbg_get_bytes_addtl(rng, output, vec->out_size,
  465. &addtl);
  466. }
  467. if (err) {
  468. pr_err("failed to get bytes from %s (try 1): %d\n",
  469. impl, err);
  470. goto out;
  471. }
  472. /*
  473. * Do the same again, using a second additional data string, and (when
  474. * applicable) a second additional entropy string.
  475. */
  476. drbg_string_fill(&addtl, vec->add_b, vec->add_size);
  477. if (test->drbg.entpr_size) {
  478. drbg_string_fill(&testentropy, vec->entpr_b, vec->entpr_size);
  479. err = crypto_drbg_get_bytes_addtl_test(rng, output,
  480. vec->out_size, &addtl,
  481. &test_data);
  482. } else {
  483. err = crypto_drbg_get_bytes_addtl(rng, output, vec->out_size,
  484. &addtl);
  485. }
  486. if (err) {
  487. pr_err("failed to get bytes from %s (try 2): %d\n",
  488. impl, err);
  489. goto out;
  490. }
  491. /* Check that the DRBG generated the expected output. */
  492. err = fips_check_result(output, vec->output, vec->out_size,
  493. impl, "get_bytes");
  494. out:
  495. kfree(output);
  496. crypto_free_rng(rng);
  497. return err;
  498. }
  499. /* Include the test vectors generated by the Python script. */
  500. #include "fips140-generated-testvecs.h"
  501. /*
  502. * List of all self-tests. Keep this in sync with fips140_algorithms[].
  503. *
  504. * When possible, we have followed the FIPS 140-2 Implementation Guidance (IG)
  505. * document when creating this list of tests. The result is intended to be a
  506. * list of tests that is near-minimal (and thus minimizes runtime overhead)
  507. * while complying with all requirements. For additional details, see the
  508. * comment at the beginning of this file.
  509. */
  510. static const struct fips_test fips140_selftests[] __initconst = {
  511. /*
  512. * Test for the AES library API.
  513. *
  514. * Since the AES library API may use its own AES implementation and the
  515. * module provides no support for composing it with a mode of operation
  516. * (it's just plain AES), we must test it directly.
  517. *
  518. * In contrast, we don't need to directly test the "aes" ciphers that
  519. * are accessible through the crypto_cipher API (e.g. "aes-ce"), as they
  520. * are covered indirectly by AES-CMAC and AES-ECB tests.
  521. */
  522. {
  523. .alg = "aes",
  524. .impls = {"aes-lib"},
  525. .func = fips_test_aes_library,
  526. .skcipher = {
  527. .key = fips_aes_key,
  528. .key_size = sizeof(fips_aes_key),
  529. .plaintext = fips_message,
  530. .ciphertext = fips_aes_ecb_ciphertext,
  531. .message_size = 16,
  532. }
  533. },
  534. /*
  535. * Tests for AES-CMAC, a.k.a. "cmac(aes)" in crypto API syntax.
  536. *
  537. * The IG requires that each underlying AES implementation be tested in
  538. * an authenticated mode, if implemented. Of such modes, this module
  539. * implements AES-GCM and AES-CMAC. However, AES-GCM doesn't "count"
  540. * because this module's implementations of AES-GCM won't actually be
  541. * FIPS-approved, due to a quirk in the FIPS requirements.
  542. *
  543. * Therefore, for us this requirement applies to AES-CMAC, so we must
  544. * test the "cmac" template composed with each "aes" implementation.
  545. *
  546. * Separately from the above, we also must test all standalone
  547. * implementations of "cmac(aes)" such as "cmac-aes-ce", as they don't
  548. * reuse another full AES implementation and thus can't be covered by
  549. * another test.
  550. */
  551. {
  552. .alg = "cmac(aes)",
  553. .impls = {
  554. /* "cmac" template with all "aes" implementations */
  555. "cmac(aes-generic)",
  556. "cmac(aes-arm64)",
  557. "cmac(aes-ce)",
  558. /* All standalone implementations of "cmac(aes)" */
  559. "cmac-aes-neon",
  560. "cmac-aes-ce",
  561. },
  562. .func = fips_test_hash,
  563. .hash = {
  564. .key = fips_aes_key,
  565. .key_size = sizeof(fips_aes_key),
  566. .message = fips_message,
  567. .message_size = sizeof(fips_message),
  568. .digest = fips_aes_cmac_digest,
  569. .digest_size = sizeof(fips_aes_cmac_digest),
  570. }
  571. },
  572. /*
  573. * Tests for AES-ECB, a.k.a. "ecb(aes)" in crypto API syntax.
  574. *
  575. * The IG requires that each underlying AES implementation be tested in
  576. * a mode that exercises the encryption direction of AES and in a mode
  577. * that exercises the decryption direction of AES. CMAC only covers the
  578. * encryption direction, so we choose ECB to test decryption. Thus, we
  579. * test the "ecb" template composed with each "aes" implementation.
  580. *
  581. * Separately from the above, we also must test all standalone
  582. * implementations of "ecb(aes)" such as "ecb-aes-ce", as they don't
  583. * reuse another full AES implementation and thus can't be covered by
  584. * another test.
  585. */
  586. {
  587. .alg = "ecb(aes)",
  588. .impls = {
  589. /* "ecb" template with all "aes" implementations */
  590. "ecb(aes-generic)",
  591. "ecb(aes-arm64)",
  592. "ecb(aes-ce)",
  593. /* All standalone implementations of "ecb(aes)" */
  594. "ecb-aes-neon",
  595. "ecb-aes-neonbs",
  596. "ecb-aes-ce",
  597. },
  598. .func = fips_test_skcipher,
  599. .skcipher = {
  600. .key = fips_aes_key,
  601. .key_size = sizeof(fips_aes_key),
  602. .plaintext = fips_message,
  603. .ciphertext = fips_aes_ecb_ciphertext,
  604. .message_size = sizeof(fips_message)
  605. }
  606. },
  607. /*
  608. * Tests for AES-CBC, AES-CBC-CTS, AES-CTR, AES-XTS, and AES-GCM.
  609. *
  610. * According to the IG, an AES mode of operation doesn't need to have
  611. * its own test, provided that (a) both the encryption and decryption
  612. * directions of the underlying AES implementation are already tested
  613. * via other mode(s), and (b) in the case of an authenticated mode, at
  614. * least one other authenticated mode is already tested. The tests of
  615. * the "cmac" and "ecb" templates fulfill these conditions; therefore,
  616. * we don't need to test any other AES mode templates.
  617. *
  618. * This does *not* apply to standalone implementations of these modes
  619. * such as "cbc-aes-ce", as such implementations don't reuse another
  620. * full AES implementation and thus can't be covered by another test.
  621. * We must test all such standalone implementations.
  622. *
  623. * The AES-GCM test isn't actually required, as it's expected that this
  624. * module's AES-GCM implementation won't actually be able to be
  625. * FIPS-approved. This is unfortunate; it's caused by the FIPS
  626. * requirements for GCM being incompatible with GCM implementations that
  627. * don't generate their own IVs. We choose to still include the AES-GCM
  628. * test to keep it on par with the other FIPS-approved algorithms, in
  629. * case it turns out that AES-GCM can be approved after all.
  630. */
  631. {
  632. .alg = "cbc(aes)",
  633. .impls = {
  634. /* All standalone implementations of "cbc(aes)" */
  635. "cbc-aes-neon",
  636. "cbc-aes-neonbs",
  637. "cbc-aes-ce",
  638. },
  639. .func = fips_test_skcipher,
  640. .skcipher = {
  641. .key = fips_aes_key,
  642. .key_size = sizeof(fips_aes_key),
  643. .iv = fips_aes_iv,
  644. .iv_size = sizeof(fips_aes_iv),
  645. .plaintext = fips_message,
  646. .ciphertext = fips_aes_cbc_ciphertext,
  647. .message_size = sizeof(fips_message),
  648. }
  649. }, {
  650. .alg = "cts(cbc(aes))",
  651. .impls = {
  652. /* All standalone implementations of "cts(cbc(aes))" */
  653. "cts-cbc-aes-neon",
  654. "cts-cbc-aes-ce",
  655. },
  656. .func = fips_test_skcipher,
  657. /* Test vector taken from RFC 3962 */
  658. .skcipher = {
  659. .key = "\x63\x68\x69\x63\x6b\x65\x6e\x20"
  660. "\x74\x65\x72\x69\x79\x61\x6b\x69",
  661. .key_size = 16,
  662. .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
  663. "\x00\x00\x00\x00\x00\x00\x00\x00",
  664. .iv_size = 16,
  665. .plaintext = "\x49\x20\x77\x6f\x75\x6c\x64\x20"
  666. "\x6c\x69\x6b\x65\x20\x74\x68\x65"
  667. "\x20\x47\x65\x6e\x65\x72\x61\x6c"
  668. "\x20\x47\x61\x75\x27\x73\x20",
  669. .ciphertext = "\xfc\x00\x78\x3e\x0e\xfd\xb2\xc1"
  670. "\xd4\x45\xd4\xc8\xef\xf7\xed\x22"
  671. "\x97\x68\x72\x68\xd6\xec\xcc\xc0"
  672. "\xc0\x7b\x25\xe2\x5e\xcf\xe5",
  673. .message_size = 31,
  674. }
  675. }, {
  676. .alg = "ctr(aes)",
  677. .impls = {
  678. /* All standalone implementations of "ctr(aes)" */
  679. "ctr-aes-neon",
  680. "ctr-aes-neonbs",
  681. "ctr-aes-ce",
  682. },
  683. .func = fips_test_skcipher,
  684. .skcipher = {
  685. .key = fips_aes_key,
  686. .key_size = sizeof(fips_aes_key),
  687. .iv = fips_aes_iv,
  688. .iv_size = sizeof(fips_aes_iv),
  689. .plaintext = fips_message,
  690. .ciphertext = fips_aes_ctr_ciphertext,
  691. .message_size = sizeof(fips_message),
  692. }
  693. }, {
  694. .alg = "xts(aes)",
  695. .impls = {
  696. /* All standalone implementations of "xts(aes)" */
  697. "xts-aes-neon",
  698. "xts-aes-neonbs",
  699. "xts-aes-ce",
  700. },
  701. .func = fips_test_skcipher,
  702. .skcipher = {
  703. .key = fips_aes_xts_key,
  704. .key_size = sizeof(fips_aes_xts_key),
  705. .iv = fips_aes_iv,
  706. .iv_size = sizeof(fips_aes_iv),
  707. .plaintext = fips_message,
  708. .ciphertext = fips_aes_xts_ciphertext,
  709. .message_size = sizeof(fips_message),
  710. }
  711. }, {
  712. .alg = "gcm(aes)",
  713. .impls = {
  714. /* All standalone implementations of "gcm(aes)" */
  715. "gcm-aes-ce",
  716. },
  717. .func = fips_test_aead,
  718. .aead = {
  719. .key = fips_aes_key,
  720. .key_size = sizeof(fips_aes_key),
  721. .iv = fips_aes_iv,
  722. /* The GCM implementations assume an IV size of 12. */
  723. .iv_size = 12,
  724. .assoc = fips_aes_gcm_assoc,
  725. .assoc_size = sizeof(fips_aes_gcm_assoc),
  726. .plaintext = fips_message,
  727. .plaintext_size = sizeof(fips_message),
  728. .ciphertext = fips_aes_gcm_ciphertext,
  729. .ciphertext_size = sizeof(fips_aes_gcm_ciphertext),
  730. }
  731. },
  732. /* Tests for SHA-1 */
  733. {
  734. .alg = "sha1",
  735. .impls = {
  736. /* All implementations of "sha1" */
  737. "sha1-generic",
  738. "sha1-ce"
  739. },
  740. .func = fips_test_hash,
  741. .hash = {
  742. .message = fips_message,
  743. .message_size = sizeof(fips_message),
  744. .digest = fips_sha1_digest,
  745. .digest_size = sizeof(fips_sha1_digest)
  746. }
  747. },
  748. /*
  749. * Tests for all SHA-256 implementations other than the sha256() library
  750. * function. As per the IG, these tests also fulfill the tests for the
  751. * corresponding SHA-224 implementations.
  752. */
  753. {
  754. .alg = "sha256",
  755. .impls = {
  756. /* All implementations of "sha256" */
  757. "sha256-generic",
  758. "sha256-arm64",
  759. "sha256-ce",
  760. },
  761. .func = fips_test_hash,
  762. .hash = {
  763. .message = fips_message,
  764. .message_size = sizeof(fips_message),
  765. .digest = fips_sha256_digest,
  766. .digest_size = sizeof(fips_sha256_digest)
  767. }
  768. },
  769. /*
  770. * Test for the sha256() library function. This must be tested
  771. * separately because it may use its own SHA-256 implementation.
  772. */
  773. {
  774. .alg = "sha256",
  775. .impls = {"sha256-lib"},
  776. .func = fips_test_sha256_library,
  777. .hash = {
  778. .message = fips_message,
  779. .message_size = sizeof(fips_message),
  780. .digest = fips_sha256_digest,
  781. .digest_size = sizeof(fips_sha256_digest)
  782. }
  783. },
  784. /*
  785. * Tests for all SHA-512 implementations. As per the IG, these tests
  786. * also fulfill the tests for the corresponding SHA-384 implementations.
  787. */
  788. {
  789. .alg = "sha512",
  790. .impls = {
  791. /* All implementations of "sha512" */
  792. "sha512-generic",
  793. "sha512-arm64",
  794. "sha512-ce",
  795. },
  796. .func = fips_test_hash,
  797. .hash = {
  798. .message = fips_message,
  799. .message_size = sizeof(fips_message),
  800. .digest = fips_sha512_digest,
  801. .digest_size = sizeof(fips_sha512_digest)
  802. }
  803. },
  804. /*
  805. * Test for HMAC. As per the IG, only one HMAC test is required,
  806. * provided that the same HMAC code is shared by all HMAC-SHA*. This is
  807. * true in our case. We choose HMAC-SHA256 for the test.
  808. *
  809. * Note that as per the IG, this can fulfill the test for the underlying
  810. * SHA. However, we don't currently rely on this.
  811. */
  812. {
  813. .alg = "hmac(sha256)",
  814. .func = fips_test_hash,
  815. .hash = {
  816. .key = fips_hmac_key,
  817. .key_size = sizeof(fips_hmac_key),
  818. .message = fips_message,
  819. .message_size = sizeof(fips_message),
  820. .digest = fips_hmac_sha256_digest,
  821. .digest_size = sizeof(fips_hmac_sha256_digest)
  822. }
  823. },
  824. /*
  825. * Known-answer tests for the SP800-90A DRBG algorithms.
  826. *
  827. * These test vectors were manually extracted from
  828. * https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/drbg/drbgtestvectors.zip.
  829. *
  830. * The selection of these tests follows the FIPS 140-2 IG as well as
  831. * Section 11 of SP800-90A:
  832. *
  833. * - We must test all DRBG types (HMAC, Hash, and CTR) that the module
  834. * implements. However, currently the module only implements
  835. * HMAC_DRBG (since CONFIG_CRYPTO_DRBG_CTR and CONFIG_CRYPTO_DRBG_HASH
  836. * aren't enabled). Therefore, we only need to test HMAC_DRBG.
  837. *
  838. * - We only need to test one HMAC variant.
  839. *
  840. * - We must test all DRBG operations: Instantiate(), Reseed(), and
  841. * Generate(). However, a single test sequence with a single output
  842. * comparison may cover all three operations, and this is what we do.
  843. * Note that Reseed() happens implicitly via the use of the additional
  844. * input and also via the use of prediction resistance when enabled.
  845. *
  846. * - The personalization string, additional input, and prediction
  847. * resistance support must be tested. Therefore we have chosen test
  848. * vectors that have a nonempty personalization string and nonempty
  849. * additional input, and we test the prediction-resistant variant.
  850. * Testing the non-prediction-resistant variant is not required.
  851. */
  852. {
  853. .alg = "drbg_pr_hmac_sha256",
  854. .func = fips_test_drbg,
  855. .drbg = {
  856. .entropy =
  857. "\xc7\xcc\xbc\x67\x7e\x21\x66\x1e\x27\x2b\x63\xdd"
  858. "\x3a\x78\xdc\xdf\x66\x6d\x3f\x24\xae\xcf\x37\x01"
  859. "\xa9\x0d\x89\x8a\xa7\xdc\x81\x58\xae\xb2\x10\x15"
  860. "\x7e\x18\x44\x6d\x13\xea\xdf\x37\x85\xfe\x81\xfb",
  861. .entropy_size = 48,
  862. .entpr_a =
  863. "\x7b\xa1\x91\x5b\x3c\x04\xc4\x1b\x1d\x19\x2f\x1a"
  864. "\x18\x81\x60\x3c\x6c\x62\x91\xb7\xe9\xf5\xcb\x96"
  865. "\xbb\x81\x6a\xcc\xb5\xae\x55\xb6",
  866. .entpr_b =
  867. "\x99\x2c\xc7\x78\x7e\x3b\x88\x12\xef\xbe\xd3\xd2"
  868. "\x7d\x2a\xa5\x86\xda\x8d\x58\x73\x4a\x0a\xb2\x2e"
  869. "\xbb\x4c\x7e\xe3\x9a\xb6\x81\xc1",
  870. .entpr_size = 32,
  871. .output =
  872. "\x95\x6f\x95\xfc\x3b\xb7\xfe\x3e\xd0\x4e\x1a\x14"
  873. "\x6c\x34\x7f\x7b\x1d\x0d\x63\x5e\x48\x9c\x69\xe6"
  874. "\x46\x07\xd2\x87\xf3\x86\x52\x3d\x98\x27\x5e\xd7"
  875. "\x54\xe7\x75\x50\x4f\xfb\x4d\xfd\xac\x2f\x4b\x77"
  876. "\xcf\x9e\x8e\xcc\x16\xa2\x24\xcd\x53\xde\x3e\xc5"
  877. "\x55\x5d\xd5\x26\x3f\x89\xdf\xca\x8b\x4e\x1e\xb6"
  878. "\x88\x78\x63\x5c\xa2\x63\x98\x4e\x6f\x25\x59\xb1"
  879. "\x5f\x2b\x23\xb0\x4b\xa5\x18\x5d\xc2\x15\x74\x40"
  880. "\x59\x4c\xb4\x1e\xcf\x9a\x36\xfd\x43\xe2\x03\xb8"
  881. "\x59\x91\x30\x89\x2a\xc8\x5a\x43\x23\x7c\x73\x72"
  882. "\xda\x3f\xad\x2b\xba\x00\x6b\xd1",
  883. .out_size = 128,
  884. .add_a =
  885. "\x18\xe8\x17\xff\xef\x39\xc7\x41\x5c\x73\x03\x03"
  886. "\xf6\x3d\xe8\x5f\xc8\xab\xe4\xab\x0f\xad\xe8\xd6"
  887. "\x86\x88\x55\x28\xc1\x69\xdd\x76",
  888. .add_b =
  889. "\xac\x07\xfc\xbe\x87\x0e\xd3\xea\x1f\x7e\xb8\xe7"
  890. "\x9d\xec\xe8\xe7\xbc\xf3\x18\x25\x77\x35\x4a\xaa"
  891. "\x00\x99\x2a\xdd\x0a\x00\x50\x82",
  892. .add_size = 32,
  893. .pers =
  894. "\xbc\x55\xab\x3c\xf6\x52\xb0\x11\x3d\x7b\x90\xb8"
  895. "\x24\xc9\x26\x4e\x5a\x1e\x77\x0d\x3d\x58\x4a\xda"
  896. "\xd1\x81\xe9\xf8\xeb\x30\x8f\x6f",
  897. .pers_size = 32,
  898. }
  899. }
  900. };
  901. static int __init __must_check
  902. fips_run_test(const struct fips_test *test)
  903. {
  904. int i;
  905. int err;
  906. /*
  907. * If no implementations were specified, then just test the default one.
  908. * Otherwise, test the specified list of implementations.
  909. */
  910. if (test->impls[0] == NULL) {
  911. err = test->func(test, test->alg);
  912. if (err)
  913. pr_emerg("self-tests failed for algorithm %s: %d\n",
  914. test->alg, err);
  915. return err;
  916. }
  917. for (i = 0; i < ARRAY_SIZE(test->impls) && test->impls[i] != NULL;
  918. i++) {
  919. err = test->func(test, test->impls[i]);
  920. if (err) {
  921. pr_emerg("self-tests failed for algorithm %s, implementation %s: %d\n",
  922. test->alg, test->impls[i], err);
  923. return err;
  924. }
  925. }
  926. return 0;
  927. }
  928. bool __init fips140_run_selftests(void)
  929. {
  930. int i;
  931. pr_info("running self-tests\n");
  932. for (i = 0; i < ARRAY_SIZE(fips140_selftests); i++) {
  933. if (fips_run_test(&fips140_selftests[i]) != 0) {
  934. /* The caller is responsible for calling panic(). */
  935. return false;
  936. }
  937. }
  938. pr_info("all self-tests passed\n");
  939. return true;
  940. }