FIPS validation requires showing that the continuous and start-up tests are effective by breaking them. Traditionally BoringSSL used #defines that tweaked the expected values. However, 140-3 now requires that the inputs be changed, not the expected outputs. Also, the number of tests is going to increase. Since slower platforms already took too long to compile BoringSSL n times (once for each test to break) we want something faster too. Therefore all the known-answer tests (KATs) are changed such that a Go program can find and replace the input value in order to break them. Thus we only need to recompile once to disable the integrity test. The runtime tests still need a #define to break, but that #define is now put in a header file so that only the module need be recompiled, not everything as in the previous system. Change-Id: Ib621198e6ad02253e29af0ccd978e3c3830ad54c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/51329 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com>fips-20220613
Adam Langley
3 years ago
committed by
Boringssl LUCI CQ
parent
f8235e4993
commit
d04c32a3d8
11 changed files with 555 additions and 499 deletions
@ -0,0 +1,38 @@ |
||||
/* Copyright (c) 2022, Google Inc.
|
||||
* |
||||
* Permission to use, copy, modify, and/or distribute this software for any |
||||
* purpose with or without fee is hereby granted, provided that the above |
||||
* copyright notice and this permission notice appear in all copies. |
||||
* |
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
||||
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
||||
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
||||
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
||||
|
||||
#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_FIPS_BREAK_TEST_H |
||||
#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_FIPS_BREAK_TEST_H |
||||
|
||||
#include <openssl/base.h> |
||||
|
||||
#include <stdlib.h> |
||||
#include <string.h> |
||||
|
||||
#if defined(BORINGSSL_FIPS_BREAK_TESTS) |
||||
|
||||
OPENSSL_INLINE int boringssl_fips_break_test(const char *test) { |
||||
const char *const value = getenv("BORINGSSL_FIPS_BREAK_TEST"); |
||||
return value != NULL && strcmp(value, test) == 0; |
||||
} |
||||
|
||||
#else |
||||
|
||||
OPENSSL_INLINE int boringssl_fips_break_test(const char *test) { |
||||
return 0; |
||||
} |
||||
|
||||
#endif // BORINGSSL_FIPS_BREAK_TESTS
|
||||
|
||||
#endif // OPENSSL_HEADER_CRYPTO_FIPSMODULE_FIPS_BREAK_TEST_H
|
||||
@ -0,0 +1,89 @@ |
||||
// break-kat corrupts a known-answer-test input in a binary and writes the
|
||||
// corrupted binary to stdout. This is used to demonstrate that the KATs in the
|
||||
// binary notice the error.
|
||||
package main |
||||
|
||||
import ( |
||||
"bytes" |
||||
"encoding/hex" |
||||
"flag" |
||||
"fmt" |
||||
"io/ioutil" |
||||
"os" |
||||
"sort" |
||||
) |
||||
|
||||
var ( |
||||
kats = map[string]string{ |
||||
"HMAC-SHA-256": "dad91293dfcf2a7c8ecd13fe353fa75b", |
||||
"AES-CBC-encrypt": "078609a6c5ac2544699adf682fa377f9be8ab6aef563e8c56a36b84f557fadd3", |
||||
"AES-CBC-decrypt": "347aa5a024b28257b36510be583d4f47adb7bbeedc6005bbbd0d0a9f06bb7b10", |
||||
"AES-GCM-encrypt": "8fcc4099808e75caaff582898848a88d808b55ab4e9370797d940be8cc1d7884", |
||||
"AES-GCM-decrypt": "35f3058f875760ff09d3120f70c4bc9ed7a86872e13452202176f7371ae04faae1dd391920f5d13953d896785994823c", |
||||
"DRBG": "c4da0740d505f1ee280b95e58c4931ac6de846a0152fbb4a3f174cf4787a4f1a40c2b50babe14aae530be5886d910a27", |
||||
"DRBG-reseed": "c7161ca36c2309b716e9859bb96c6d49bdc8352103a18cd24ef42ec97ef46bf446eb1a4576c186e9351803763a7912fe", |
||||
"SHA-1": "132fd9bad5c1826263bafbb699f707a5", |
||||
"SHA-256": "ff3b857da7236a2baa0f396b51522217", |
||||
"SHA-512": "212512f8d2ad8322781c6c4d69a9daa1", |
||||
"TLS-KDF": "abc3657b094c7628a0b282996fe75a75f4984fd94d4ecc2fcf53a2c469a3f731", |
||||
"RSA-sign": "d2b56e53306f720d7929d8708bf46f1c22300305582b115bedcac722d8aa5ab2", |
||||
"RSA-verify": "abe2cbc13d6bd39d48db5334ddbf8d070a93bdcb104e2cc5d0ee486ee295f6b31bda126c41890b98b73e70e6b65d82f95c663121755a90744c8d1c21148a1960be0eca446e9ff497f1345c537ef8119b9a4398e95c5c6de2b1c955905c5299d8ce7a3b6ab76380d9babdd15f610237e1f3f2aa1c1f1e770b62fbb596381b2ebdd77ecef9c90d4c92f7b6b05fed2936285fa94826e62055322a33b6f04c74ce69e5d8d737fb838b79d2d48e3daf71387531882531a95ac964d02ea413bf85952982bbc089527daff5b845c9a0f4d14ef1956d9c3acae882d12da66da0f35794f5ee32232333517db9315232a183b991654dbea41615345c885325926744a53915", |
||||
"ECDSA-sign": "1e35930be860d0942ca7bbd6f6ded87f157e4de24f81ed4b875c0e018e89a81f", |
||||
"ECDSA-verify": "6780c5fc70275e2c7061a0e7877bb174deadeb9887027f3fa83654158ba7f50c2d36e5799790bfbe2183d33e96f3c51f6a232f2a24488c8e5f64c37ea2cf0529", |
||||
"Z-computation": "e7604491269afb5b102d6ea52cb59feb70aede6ce3bfb3e0105485abd861d77b", |
||||
"FFDH": "a14f8ad36be37b18b8f35864392f150ab7ee22c47e1870052a3f17918274af18aaeaf4cf6aacfde96c9d586eb7ebaff6b03fe3b79a8e2ff9dd6df34caaf2ac70fd3771d026b41a561ee90e4337d0575f8a0bd160c868e7e3cef88aa1d88448b1e4742ba11480a9f8a8b737347c408d74a7d57598c48875629df0c85327a124ddec1ad50cd597a985588434ce19c6f044a1696b5f244b899b7e77d4f6f20213ae8eb15d37eb8e67e6c8bdbc4fd6e17426283da96f23a897b210058c7c70fb126a5bf606dbeb1a6d5cca04184c4e95c2e8a70f50f5c1eabd066bd79c180456316ac02d366eb3b0e7ba82fb70dcbd737ca55734579dd250fffa8e0584be99d32b35", |
||||
} |
||||
|
||||
listTests = flag.Bool("list-tests", false, "List known test values and exit") |
||||
) |
||||
|
||||
func main() { |
||||
flag.Parse() |
||||
|
||||
if *listTests { |
||||
for _, kat := range sortedKATs() { |
||||
fmt.Println(kat) |
||||
} |
||||
os.Exit(0) |
||||
} |
||||
|
||||
if flag.NArg() != 2 || kats[flag.Arg(1)] == "" { |
||||
fmt.Fprintln(os.Stderr, "Usage: break-kat <binary path> <test to break> > output") |
||||
fmt.Fprintln(os.Stderr, "Possible values for <test to break>:") |
||||
for _, kat := range sortedKATs() { |
||||
fmt.Fprintln(os.Stderr, " ", kat) |
||||
} |
||||
os.Exit(1) |
||||
} |
||||
|
||||
inPath := flag.Arg(0) |
||||
test := flag.Arg(1) |
||||
testInputValue, err := hex.DecodeString(kats[test]) |
||||
if err != nil { |
||||
panic("invalid kat data: " + err.Error()) |
||||
} |
||||
|
||||
binaryContents, err := ioutil.ReadFile(inPath) |
||||
if err != nil { |
||||
fmt.Fprintln(os.Stderr, err) |
||||
os.Exit(2) |
||||
} |
||||
|
||||
i := bytes.Index(binaryContents, testInputValue) |
||||
if i < 0 { |
||||
fmt.Fprintln(os.Stderr, "Expected test input value was not found in binary.") |
||||
os.Exit(3) |
||||
} |
||||
|
||||
binaryContents[i] ^= 1 |
||||
os.Stdout.Write(binaryContents) |
||||
} |
||||
|
||||
func sortedKATs() []string { |
||||
var ret []string |
||||
for kat := range kats { |
||||
ret = append(ret, kat) |
||||
} |
||||
sort.Strings(ret) |
||||
return ret |
||||
} |
||||
@ -1,117 +0,0 @@ |
||||
# Copyright (c) 2019, Google Inc. |
||||
# |
||||
# Permission to use, copy, modify, and/or distribute this software for any |
||||
# purpose with or without fee is hereby granted, provided that the above |
||||
# copyright notice and this permission notice appear in all copies. |
||||
# |
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
||||
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
||||
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
||||
# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
||||
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
||||
# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
||||
# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
||||
|
||||
# This script exists to exercise breaking each of the FIPS tests on an Android |
||||
# device. Since, on Android, BoringCrypto exists in both 32- and 64-bit |
||||
# versions, the first argument must be either "32" or "64" to select which is |
||||
# being tested. The Android source tree must have been setup (with "lunch") for |
||||
# a matching build configuration before using this script to build the |
||||
# binaries. (Although it'll fail non-silently if there's a mismatch.) |
||||
# |
||||
# Since each test needs the FIPS module to be compiled differently, and that |
||||
# can take a long time, this script is run twice: once with "build" as the |
||||
# second argument to run the builds, and then with "run" as the second argument |
||||
# to run each test. |
||||
# |
||||
# Run it with /bin/bash, not /bin/sh, otherwise "read" may fail. |
||||
# |
||||
# In order to reconfigure the build for each test, it needs to set a define. It |
||||
# does so by rewriting a template in external/boringssl/Android.bp and you must |
||||
# add the template value before doing the builds. To do so, insert |
||||
# -DBORINGSSL_FIPS_BREAK_XXX=1 in the cflags list for the module, probably by |
||||
# putting it in the "boringssl_flags" stanza. |
||||
|
||||
set -x |
||||
set -e |
||||
|
||||
if [ ! -f external/boringssl/Android.bp ]; then |
||||
echo "Must be run from the top-level of an Android source tree." |
||||
exit 1 |
||||
fi |
||||
|
||||
. build/envsetup.sh |
||||
|
||||
TESTS="NONE ECDSA_PWCT CRNG RSA_PWCT AES_CBC AES_GCM DES SHA_1 SHA_256 SHA_512 RSA_SIG DRBG ECDSA_SIG Z_COMPUTATION TLS_KDF FFC_DH" |
||||
|
||||
if [ "x$1" = "x32" ]; then |
||||
lib="lib" |
||||
bits="32" |
||||
elif [ "x$1" = "x64" ] ; then |
||||
lib="lib64" |
||||
bits="64" |
||||
else |
||||
echo "First argument must be 32 or 64" |
||||
exit 1 |
||||
fi |
||||
|
||||
if [ "x$2" = "xbuild" ]; then |
||||
if ! grep -q DBORINGSSL_FIPS_BREAK_XXX=1 external/boringssl/Android.bp; then |
||||
echo "Missing DBORINGSSL_FIPS_BREAK_XXX in external/boringssl/Android.bp. Edit the file and insert -DBORINGSSL_FIPS_BREAK_XXX=1 in the cflags for the FIPS module" |
||||
exit 1 |
||||
fi |
||||
|
||||
printf "\\x1b[1mBuilding modules\\x1b[0m\n" |
||||
for test in $TESTS; do |
||||
printf "\\x1b[1mBuilding for ${test}\\x1b[0m\n" |
||||
cp external/boringssl/Android.bp external/boringssl/Android.bp.orig |
||||
sed -i -e "s/DBORINGSSL_FIPS_BREAK_XXX/DBORINGSSL_FIPS_BREAK_${test}/" external/boringssl/Android.bp |
||||
m test_fips |
||||
dir=test-${bits}-${test} |
||||
rm -Rf $dir |
||||
mkdir $dir |
||||
cp ${ANDROID_PRODUCT_OUT}/system/${lib}/libcrypto.so $dir |
||||
cp ${ANDROID_PRODUCT_OUT}/system/bin/test_fips $dir |
||||
if [ $bits = "32" ] ; then |
||||
if ! file ${dir}/test_fips | grep -q "32-bit" ; then |
||||
echo "32-bit build requested but binaries don't appear to be 32-bit:" |
||||
file ${dir}/test_fips |
||||
exit 1 |
||||
fi |
||||
else |
||||
if ! file ${dir}/test_fips | grep -q "64-bit" ; then |
||||
echo "64-bit build requested but binaries don't appear to be 64-bit:" |
||||
file ${dir}/test_fips |
||||
exit 1 |
||||
fi |
||||
fi |
||||
cp external/boringssl/Android.bp.orig external/boringssl/Android.bp |
||||
done |
||||
elif [ "x$2" = "xrun" ]; then |
||||
printf "\\x1b[1mTesting\\x1b[0m\n" |
||||
for test in $TESTS; do |
||||
dir=test-${bits}-${test} |
||||
if [ ! '(' -d ${dir} -a -f ${dir}/test_fips -a -f ${dir}/libcrypto.so ')' ] ; then |
||||
echo "Build directory ${dir} is missing or is missing files" |
||||
exit 1 |
||||
fi |
||||
adb push ${dir}/* /data/local/tmp |
||||
printf "\\x1b[1mTesting ${test}\\x1b[0m\n" |
||||
adb shell -n -t -x LD_LIBRARY_PATH=/data/local/tmp /data/local/tmp/test_fips |
||||
read |
||||
done |
||||
|
||||
printf "\\x1b[1mTesting integrity}\\x1b[0m\n" |
||||
src=test-${bits}-NONE |
||||
dir=test-${bits}-INT |
||||
rm -Rf $dir |
||||
mkdir $dir |
||||
go run external/boringssl/src/util/fipstools/break-hash.go ${src}/libcrypto.so ${dir}/libcrypto.so |
||||
cp ${src}/test_fips $dir |
||||
adb push ${dir}/* /data/local/tmp |
||||
adb shell -n -t -x LD_LIBRARY_PATH=/data/local/tmp /data/local/tmp/test_fips |
||||
read |
||||
else |
||||
echo "Second argument must be build or run" |
||||
exit 1 |
||||
fi |
||||
@ -1,53 +0,0 @@ |
||||
# Copyright (c) 2018, Google Inc. |
||||
# |
||||
# Permission to use, copy, modify, and/or distribute this software for any |
||||
# purpose with or without fee is hereby granted, provided that the above |
||||
# copyright notice and this permission notice appear in all copies. |
||||
# |
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
||||
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
||||
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
||||
# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
||||
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
||||
# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
||||
# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
||||
|
||||
# This script exists to exercise breaking each of the FIPS tests. It builds |
||||
# BoringSSL differently for each test and that can take a long time. Thus it's |
||||
# run twice: once, from a BoringSSL source tree, with "build" as the sole |
||||
# argument to run the builds, and then (from the same location) with no |
||||
# arguments to run each script. |
||||
# |
||||
# Run it with /bin/bash, not /bin/sh, otherwise "read" may fail. |
||||
|
||||
set -x |
||||
|
||||
TESTS="NONE ECDSA_PWCT CRNG RSA_PWCT AES_CBC AES_GCM DES SHA_1 SHA_256 SHA_512 HMAC_SHA_256 RSA_SIG DRBG ECDSA_SIG Z_COMPUTATION TLS_KDF FFC_DH" |
||||
|
||||
if [ "x$1" = "xbuild" ]; then |
||||
for test in $TESTS; do |
||||
rm -Rf build-$test |
||||
mkdir build-$test |
||||
pushd build-$test |
||||
cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=${HOME}/toolchain -DFIPS=1 -DFIPS_BREAK_TEST=${test} -DCMAKE_BUILD_TYPE=Release .. |
||||
ninja test_fips |
||||
popd |
||||
done |
||||
|
||||
exit 0 |
||||
fi |
||||
|
||||
for test in $TESTS; do |
||||
pushd build-$test |
||||
printf "\n\n\\x1b[1m$test\\x1b[0m\n" |
||||
./util/fipstools/cavp/test_fips |
||||
echo "Waiting for keypress..." |
||||
read |
||||
popd |
||||
done |
||||
|
||||
pushd build-NONE |
||||
printf "\\x1b[1mIntegrity\\x1b[0m\n" |
||||
go run ../util/fipstools/break-hash.go ./util/fipstools/cavp/test_fips ./util/fipstools/cavp/test_fips_broken |
||||
./util/fipstools/cavp/test_fips_broken |
||||
popd |
||||
@ -0,0 +1,40 @@ |
||||
# Copyright (c) 2022, Google Inc. |
||||
# |
||||
# Permission to use, copy, modify, and/or distribute this software for any |
||||
# purpose with or without fee is hereby granted, provided that the above |
||||
# copyright notice and this permission notice appear in all copies. |
||||
# |
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
||||
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
||||
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
||||
# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
||||
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
||||
# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
||||
# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
||||
|
||||
# This script attempts to break each of the known KATs and checks that doing so |
||||
# seems to work and at least mentions the correct KAT in the output. |
||||
|
||||
set -x |
||||
set -e |
||||
|
||||
TEST_FIPS_BIN="build/util/fipstools/cavp/test_fips" |
||||
|
||||
if [ ! -f $TEST_FIPS_BIN ]; then |
||||
echo "$TEST_FIPS_BIN is missing. Run this script from the top level of a" |
||||
echo "BoringSSL checkout and ensure that ./build-fips-break-test-binaries.sh" |
||||
echo "has been run first." |
||||
exit 1 |
||||
fi |
||||
|
||||
KATS=$(go run util/fipstools/break-kat.go --list-tests) |
||||
|
||||
for kat in $KATS; do |
||||
go run util/fipstools/break-kat.go $TEST_FIPS_BIN $kat > break-kat-bin |
||||
chmod u+x ./break-kat-bin |
||||
if ! (./break-kat-bin 2>&1 || true) | egrep -q "^$kat[^a-zA-Z0-9]"; then |
||||
echo "Failure for $kat did not mention that name in the output" |
||||
exit 1 |
||||
fi |
||||
rm ./break-kat-bin |
||||
done |
||||
Loading…
Reference in new issue