Latest update.
This commit is contained in:
@@ -1,2 +1,3 @@
|
||||
|
||||
SOURCE[../fips]=fipsprov.c selftest.c
|
||||
INCLUDE[../fips]=../implementations/include ../common/include
|
||||
+82
-47
@@ -25,10 +25,10 @@
|
||||
|
||||
#include "internal/cryptlib.h"
|
||||
#include "internal/property.h"
|
||||
#include "internal/evp_int.h"
|
||||
#include "internal/provider_algs.h"
|
||||
#include "internal/provider_ctx.h"
|
||||
#include "internal/providercommon.h"
|
||||
#include "crypto/evp.h"
|
||||
#include "prov/implementations.h"
|
||||
#include "prov/provider_ctx.h"
|
||||
#include "prov/providercommon.h"
|
||||
#include "selftest.h"
|
||||
|
||||
extern OSSL_core_thread_start_fn *c_thread_start;
|
||||
@@ -227,19 +227,19 @@ const char *ossl_prov_util_nid_to_name(int nid)
|
||||
switch (nid) {
|
||||
/* Digests */
|
||||
case NID_sha1:
|
||||
return "SHA224";
|
||||
return "SHA1";
|
||||
case NID_sha224:
|
||||
return "SHA224";
|
||||
return "SHA-224";
|
||||
case NID_sha256:
|
||||
return "SHA256";
|
||||
return "SHA-256";
|
||||
case NID_sha384:
|
||||
return "SHA384";
|
||||
return "SHA-384";
|
||||
case NID_sha512:
|
||||
return "SHA512";
|
||||
return "SHA-512";
|
||||
case NID_sha512_224:
|
||||
return "SHA512-224";
|
||||
return "SHA-512/224";
|
||||
case NID_sha512_256:
|
||||
return "SHA512-256";
|
||||
return "SHA-512/256";
|
||||
case NID_sha3_224:
|
||||
return "SHA3-224";
|
||||
case NID_sha3_256:
|
||||
@@ -272,31 +272,30 @@ const char *ossl_prov_util_nid_to_name(int nid)
|
||||
return "AES-256-XTS";
|
||||
case NID_aes_128_xts:
|
||||
return "AES-128-XTS";
|
||||
/* TODO(3.0) Change these when we have aliases */
|
||||
case NID_aes_256_gcm:
|
||||
return "id-aes256-GCM";
|
||||
return "AES-256-GCM";
|
||||
case NID_aes_192_gcm:
|
||||
return "id-aes192-GCM";
|
||||
return "AES-192-GCM";
|
||||
case NID_aes_128_gcm:
|
||||
return "id-aes128-GCM";
|
||||
return "AES-128-GCM";
|
||||
case NID_aes_256_ccm:
|
||||
return "id-aes256-CCM";
|
||||
return "AES-256-CCM";
|
||||
case NID_aes_192_ccm:
|
||||
return "id-aes192-CCM";
|
||||
return "AES-192-CCM";
|
||||
case NID_aes_128_ccm:
|
||||
return "id-aes128-CCM";
|
||||
return "AES-128-CCM";
|
||||
case NID_id_aes256_wrap:
|
||||
return "id-aes256-wrap";
|
||||
return "AES-256-WRAP";
|
||||
case NID_id_aes192_wrap:
|
||||
return "id-aes192-wrap";
|
||||
return "AES-192-WRAP";
|
||||
case NID_id_aes128_wrap:
|
||||
return "id-aes128-wrap";
|
||||
return "AES-128-WRAP";
|
||||
case NID_id_aes256_wrap_pad:
|
||||
return "id-aes256-wrap-pad";
|
||||
return "AES-256-WRAP-PAD";
|
||||
case NID_id_aes192_wrap_pad:
|
||||
return "id-aes192-wrap-pad";
|
||||
return "AES-192-WRAP-PAD";
|
||||
case NID_id_aes128_wrap_pad:
|
||||
return "id-aes128-wrap-pad";
|
||||
return "AES-128-WRAP-PAD";
|
||||
case NID_des_ede3_ecb:
|
||||
return "DES-EDE3";
|
||||
case NID_des_ede3_cbc:
|
||||
@@ -308,14 +307,43 @@ const char *ossl_prov_util_nid_to_name(int nid)
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* For the algorithm names, we use the following formula for our primary
|
||||
* names:
|
||||
*
|
||||
* ALGNAME[VERSION?][-SUBNAME[VERSION?]?][-SIZE?][-MODE?]
|
||||
*
|
||||
* VERSION is only present if there are multiple versions of
|
||||
* an alg (MD2, MD4, MD5). It may be omitted if there is only
|
||||
* one version (if a subsequent version is released in the future,
|
||||
* we can always change the canonical name, and add the old name
|
||||
* as an alias).
|
||||
*
|
||||
* SUBNAME may be present where we are combining multiple
|
||||
* algorithms together, e.g. MD5-SHA1.
|
||||
*
|
||||
* SIZE is only present if multiple versions of an algorithm exist
|
||||
* with different sizes (e.g. AES-128-CBC, AES-256-CBC)
|
||||
*
|
||||
* MODE is only present where applicable.
|
||||
*
|
||||
* We add diverse other names where applicable, such as the names that
|
||||
* NIST uses, or that are used for ASN.1 OBJECT IDENTIFIERs, or names
|
||||
* we have used historically.
|
||||
*/
|
||||
static const OSSL_ALGORITHM fips_digests[] = {
|
||||
{ "SHA1", "fips=yes", sha1_functions },
|
||||
{ "SHA224", "fips=yes", sha224_functions },
|
||||
{ "SHA256", "fips=yes", sha256_functions },
|
||||
{ "SHA384", "fips=yes", sha384_functions },
|
||||
{ "SHA512", "fips=yes", sha512_functions },
|
||||
{ "SHA512-224", "fips=yes", sha512_224_functions },
|
||||
{ "SHA512-256", "fips=yes", sha512_256_functions },
|
||||
/* Our primary name:NiST name[:our older names] */
|
||||
{ "SHA1:SHA-1", "fips=yes", sha1_functions },
|
||||
{ "SHA2-224:SHA-224:SHA224", "fips=yes", sha224_functions },
|
||||
{ "SHA2-256:SHA-256:SHA256", "fips=yes", sha256_functions },
|
||||
{ "SHA2-384:SHA-384:SHA384", "fips=yes", sha384_functions },
|
||||
{ "SHA2-512:SHA-512:SHA512", "fips=yes", sha512_functions },
|
||||
{ "SHA2-512/224:SHA-512/224:SHA512-224", "fips=yes",
|
||||
sha512_224_functions },
|
||||
{ "SHA2-512/256:SHA-512/256:SHA512-256", "fips=yes",
|
||||
sha512_256_functions },
|
||||
|
||||
/* We agree with NIST here, so one name only */
|
||||
{ "SHA3-224", "fips=yes", sha3_224_functions },
|
||||
{ "SHA3-256", "fips=yes", sha3_256_functions },
|
||||
{ "SHA3-384", "fips=yes", sha3_384_functions },
|
||||
@@ -331,6 +359,7 @@ static const OSSL_ALGORITHM fips_digests[] = {
|
||||
};
|
||||
|
||||
static const OSSL_ALGORITHM fips_ciphers[] = {
|
||||
/* Our primary name[:ASN.1 OID name][:our older names] */
|
||||
{ "AES-256-ECB", "fips=yes", aes256ecb_functions },
|
||||
{ "AES-192-ECB", "fips=yes", aes192ecb_functions },
|
||||
{ "AES-128-ECB", "fips=yes", aes128ecb_functions },
|
||||
@@ -342,22 +371,27 @@ static const OSSL_ALGORITHM fips_ciphers[] = {
|
||||
{ "AES-128-CTR", "fips=yes", aes128ctr_functions },
|
||||
{ "AES-256-XTS", "fips=yes", aes256xts_functions },
|
||||
{ "AES-128-XTS", "fips=yes", aes128xts_functions },
|
||||
/* TODO(3.0) Add aliases for these ciphers */
|
||||
{ "id-aes256-GCM", "fips=yes", aes256gcm_functions },
|
||||
{ "id-aes192-GCM", "fips=yes", aes192gcm_functions },
|
||||
{ "id-aes128-GCM", "fips=yes", aes128gcm_functions },
|
||||
{ "id-aes256-CCM", "fips=yes", aes256ccm_functions },
|
||||
{ "id-aes192-CCM", "fips=yes", aes192ccm_functions },
|
||||
{ "id-aes128-CCM", "fips=yes", aes128ccm_functions },
|
||||
{ "id-aes256-wrap", "fips=yes", aes256wrap_functions },
|
||||
{ "id-aes192-wrap", "fips=yes", aes192wrap_functions },
|
||||
{ "id-aes128-wrap", "fips=yes", aes128wrap_functions },
|
||||
{ "id-aes256-wrap-pad", "fips=yes", aes256wrappad_functions },
|
||||
{ "id-aes192-wrap-pad", "fips=yes", aes192wrappad_functions },
|
||||
{ "id-aes128-wrap-pad", "fips=yes", aes128wrappad_functions },
|
||||
{ "AES-256-GCM:id-aes256-GCM", "fips=yes", aes256gcm_functions },
|
||||
{ "AES-192-GCM:id-aes192-GCM", "fips=yes", aes192gcm_functions },
|
||||
{ "AES-128-GCM:id-aes128-GCM", "fips=yes", aes128gcm_functions },
|
||||
{ "AES-256-CCM:id-aes256-CCM", "fips=yes", aes256ccm_functions },
|
||||
{ "AES-192-CCM:id-aes192-CCM", "fips=yes", aes192ccm_functions },
|
||||
{ "AES-128-CCM:id-aes128-CCM", "fips=yes", aes128ccm_functions },
|
||||
{ "AES-256-WRAP:id-aes256-wrap:AES256-WRAP", "fips=yes",
|
||||
aes256wrap_functions },
|
||||
{ "AES-192-WRAP:id-aes192-wrap:AES192-WRAP", "fips=yes",
|
||||
aes192wrap_functions },
|
||||
{ "AES-128-WRAP:id-aes128-wrap:AES128-WRAP", "fips=yes",
|
||||
aes128wrap_functions },
|
||||
{ "AES-256-WRAP-PAD:id-aes256-wrap-pad:AES256-WRAP-PAD", "fips=yes",
|
||||
aes256wrappad_functions },
|
||||
{ "AES-192-WRAP-PAD:id-aes192-wrap-pad:AES192-WRAP-PAD", "fips=yes",
|
||||
aes192wrappad_functions },
|
||||
{ "AES-128-WRAP-PAD:id-aes128-wrap-pad:AES128-WRAP-PAD", "fips=yes",
|
||||
aes128wrappad_functions },
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{ "DES-EDE3", "fips=yes", tdes_ede3_ecb_functions },
|
||||
{ "DES-EDE3-CBC", "fips=yes", tdes_ede3_cbc_functions },
|
||||
{ "DES-EDE3-ECB:DES-EDE3", "fips=yes", tdes_ede3_ecb_functions },
|
||||
{ "DES-EDE3-CBC:DES3", "fips=yes", tdes_ede3_cbc_functions },
|
||||
#endif /* OPENSSL_NO_DES */
|
||||
{ NULL, NULL, NULL }
|
||||
};
|
||||
@@ -378,7 +412,8 @@ static const OSSL_ALGORITHM fips_kdfs[] = {
|
||||
{ OSSL_KDF_NAME_SSKDF, "fips=yes", kdf_sskdf_functions },
|
||||
{ OSSL_KDF_NAME_PBKDF2, "fips=yes", kdf_pbkdf2_functions },
|
||||
{ OSSL_KDF_NAME_TLS1_PRF, "fips=yes", kdf_tls1_prf_functions },
|
||||
{ NULL, NULL, NULL }
|
||||
{ OSSL_KDF_NAME_KBKDF, "fips=yes", kdf_kbkdf_functions },
|
||||
{ NULL, NULL, NULL }
|
||||
};
|
||||
|
||||
static const OSSL_ALGORITHM *fips_query(OSSL_PROVIDER *prov,
|
||||
|
||||
@@ -141,9 +141,10 @@ end:
|
||||
OPENSSL_free(module_checksum);
|
||||
OPENSSL_free(indicator_checksum);
|
||||
|
||||
(*st->bio_free_cb)(bio_indicator);
|
||||
(*st->bio_free_cb)(bio_module);
|
||||
|
||||
if (st != NULL) {
|
||||
(*st->bio_free_cb)(bio_indicator);
|
||||
(*st->bio_free_cb)(bio_module);
|
||||
}
|
||||
FIPS_state = ok ? FIPS_STATE_RUNNING : FIPS_STATE_ERROR;
|
||||
|
||||
return ok;
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
*/
|
||||
|
||||
#include <openssl/core_numbers.h>
|
||||
#include <openssl/ossl_typ.h>
|
||||
#include <openssl/types.h>
|
||||
|
||||
typedef struct self_test_post_params_st {
|
||||
/* FIPS module integrity check parameters */
|
||||
|
||||
Reference in New Issue
Block a user