boringssl

961 Commits

61 Branches

23 Tags

511 MiB

Tag: Branch: Tree: ea2ad5a876

Commit Graph

Author	SHA1	Message	Date
Adam Langley	d04c32a3d8	Break FIPS tests differently. FIPS validation requires showing that the continuous and start-up tests are effective by breaking them. Traditionally BoringSSL used #defines that tweaked the expected values. However, 140-3 now requires that the inputs be changed, not the expected outputs. Also, the number of tests is going to increase. Since slower platforms already took too long to compile BoringSSL n times (once for each test to break) we want something faster too. Therefore all the known-answer tests (KATs) are changed such that a Go program can find and replace the input value in order to break them. Thus we only need to recompile once to disable the integrity test. The runtime tests still need a #define to break, but that #define is now put in a header file so that only the module need be recompiled, not everything as in the previous system. Change-Id: Ib621198e6ad02253e29af0ccd978e3c3830ad54c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/51329 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com>	3 years ago

Author

SHA1

Message

Date

Adam Langley

d04c32a3d8

Break FIPS tests differently.

FIPS validation requires showing that the continuous and start-up tests
are effective by breaking them. Traditionally BoringSSL used #defines
that tweaked the expected values. However, 140-3 now requires that the
inputs be changed, not the expected outputs.

Also, the number of tests is going to increase. Since slower platforms
already took too long to compile BoringSSL n times (once for each test
to break) we want something faster too.

Therefore all the known-answer tests (KATs) are changed such that a Go
program can find and replace the input value in order to break them.
Thus we only need to recompile once to disable the integrity test.

The runtime tests still need a #define to break, but that #define is now
put in a header file so that only the module need be recompiled, not
everything as in the previous system.

Change-Id: Ib621198e6ad02253e29af0ccd978e3c3830ad54c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/51329
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>

3 years ago

1 Commits (ea2ad5a876664017895f2b02b7488f7ee61daf2a)