Skip to content

Commit f397d34

Browse files
gasbytesgasbytes
committed
Various FIPS fixes
- Removed -DWOLFSSL_ECDSA_DETERMINISTIC_K from the FIPS ./configure; - Removed unused function is_hash_type_fips; - Added various HAVE_FIPS gates with proper alternatives for the FIPS build; - Added various WC_RNG_SEED_CB callbacks; - Updated the tests;
1 parent 7400bf3 commit f397d34

4 files changed

Lines changed: 63 additions & 36 deletions

File tree

‎setup.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ if [ $FIPS_MODE -eq 1 ]; then
6565

6666
cd fips-v5-checkout
6767

68-
./configure --prefix=$WOLFSSL_INSTALL/ CC=clang --enable-cmac --enable-aesccm --enable-aescfb --enable-keygen 'CFLAGS=-DWOLFSSL_PUBLIC_ASN -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DWOLFSSL_DH_EXTRA -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DWOLFSSL_PUBLIC_MP -DWOLFSSL_RSA_KEY_CHECK -DWOLFSSL_ECDSA_DETERMINISTIC_K' --enable-fips=v5
68+
./configure --prefix=$WOLFSSL_INSTALL/ CC=clang --enable-cmac --enable-aesccm --enable-aescfb --enable-keygen 'CFLAGS=-DWOLFSSL_PUBLIC_ASN -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DWOLFSSL_DH_EXTRA -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DWOLFSSL_PUBLIC_MP -DWOLFSSL_RSA_KEY_CHECK' --enable-fips=v5
6969

7070
make
7171

‎wolfssl-gnutls-wrapper/src/wolfssl.c‎

Lines changed: 35 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1720,30 +1720,6 @@ static int get_hash_type(gnutls_mac_algorithm_t algorithm)
17201720
}
17211721
}
17221722

1723-
/* checks if the provided operation and hash_type are fips approved */
1724-
#if defined(HAVE_FIPS)
1725-
static int is_hash_type_fips(int hash_type, int operation) {
1726-
switch(hash_type) {
1727-
case WC_SHA:
1728-
if (operation == VERIFY_OP)
1729-
return 1;
1730-
else
1731-
return 0;
1732-
case WC_SHA224:
1733-
case WC_SHA256:
1734-
case WC_SHA384:
1735-
case WC_SHA512:
1736-
case WC_SHA3_224:
1737-
case WC_SHA3_256:
1738-
case WC_SHA3_384:
1739-
case WC_SHA3_512:
1740-
return 1;
1741-
default:
1742-
return 0;
1743-
}
1744-
}
1745-
#endif
1746-
17471723
/**
17481724
* Checks if MAC is supported.
17491725
*
@@ -4002,6 +3978,7 @@ static int dh_load_params(DhKey *dh, const gnutls_pk_params_st *params)
40023978
static int ecc_level_to_curve(int level, int *curve_id, int *curve_size)
40033979
{
40043980
switch (level) {
3981+
#if !defined(HAVE_FIPS)
40053982
#if ECC_MIN_KEY_SZ <= 192
40063983
case GNUTLS_ECC_CURVE_SECP192R1:
40073984
WGW_LOG("SECP192R1 - 24 bytes");
@@ -4015,6 +3992,7 @@ static int ecc_level_to_curve(int level, int *curve_id, int *curve_size)
40153992
*curve_id = ECC_SECP224R1;
40163993
*curve_size = 28;
40173994
break;
3995+
#endif
40183996
#endif
40193997
case GNUTLS_ECC_CURVE_SECP256R1:
40203998
WGW_LOG("SECP256R1 - 32 bytes");
@@ -4070,7 +4048,11 @@ static int ecc_load_params(ecc_key *ecc, const gnutls_pk_params_st *pk_params,
40704048
ret = mp_set(ecc->pubkey.z, 1);
40714049
}
40724050
if ((ret == 0) && priv) {
4051+
#if !defined(HAVE_FIPS)
40734052
ret = bigint_to_mp(pk_params->params[ECC_K], ecc->k);
4053+
#else
4054+
ret = bigint_to_mp(pk_params->params[ECC_K], &ecc->k);
4055+
#endif
40744056
}
40754057
if (ret == 0) {
40764058
if (priv) {
@@ -4449,6 +4431,10 @@ static int wolfssl_pk_sign_rsa(gnutls_datum_t *signature,
44494431

44504432
WGW_FUNC_ENTER();
44514433

4434+
#ifdef WC_RNG_SEED_CB
4435+
wc_SetSeed_Cb(wc_GenerateSeed);
4436+
#endif
4437+
44524438
ret = wc_InitRng(&rng);
44534439
if (ret != 0) {
44544440
WGW_WOLFSSL_ERROR("wc_InitRng", ret);
@@ -4549,6 +4535,9 @@ static int wolfssl_pk_sign_ecc(gnutls_datum_t *signature,
45494535
ecc_key ecc;
45504536
WC_RNG rng;
45514537
word32 len;
4538+
#if defined(HAVE_FIPS)
4539+
(void)sign_params;
4540+
#endif
45524541

45534542
WGW_FUNC_ENTER();
45544543

@@ -4993,6 +4982,7 @@ static int wolfssl_pk_verify(gnutls_pk_algorithm_t algo,
49934982
break;
49944983
#endif
49954984
default:
4985+
WGW_LOG("algo not supported!");
49964986
ret = GNUTLS_E_INVALID_REQUEST;
49974987
}
49984988

@@ -5193,6 +5183,10 @@ static int wolfssl_pk_generate_keys_rsa(unsigned int bits,
51935183
}
51945184
#endif
51955185

5186+
#ifdef WC_RNG_SEED_CB
5187+
wc_SetSeed_Cb(wc_GenerateSeed);
5188+
#endif
5189+
51965190
ret = wc_InitRng(&rng);
51975191
if (ret != 0) {
51985192
WGW_WOLFSSL_ERROR("wc_InitRng", ret);
@@ -5375,6 +5369,10 @@ static int wolfssl_pk_generate_keys_dh(unsigned int bits,
53755369

53765370
WGW_FUNC_ENTER();
53775371

5372+
#ifdef WC_RNG_SEED_CB
5373+
wc_SetSeed_Cb(wc_GenerateSeed);
5374+
#endif
5375+
53785376
ret = wc_InitRng(&rng);
53795377
if (ret != 0) {
53805378
WGW_WOLFSSL_ERROR("wc_InitRng", ret);
@@ -5477,6 +5475,10 @@ static int wolfssl_pk_generate_keys_ecc(unsigned int level,
54775475
return ret;
54785476
}
54795477

5478+
#ifdef WC_RNG_SEED_CB
5479+
wc_SetSeed_Cb(wc_GenerateSeed);
5480+
#endif
5481+
54805482
ret = wc_InitRng(&rng);
54815483
if (ret != 0) {
54825484
WGW_WOLFSSL_ERROR("wc_InitRng", ret);
@@ -5514,7 +5516,11 @@ static int wolfssl_pk_generate_keys_ecc(unsigned int level,
55145516
}
55155517
if (ret == 0) {
55165518
params->params_nr++;
5519+
#if !defined(HAVE_FIPS)
55175520
ret = mp_to_bigint(ecc.k, &params->params[ECC_K]);
5521+
#else
5522+
ret = mp_to_bigint(&ecc.k, &params->params[ECC_K]);
5523+
#endif
55185524
}
55195525
if (ret == 0) {
55205526
params->params_nr++;
@@ -6392,8 +6398,13 @@ static int wolfssl_pk_derive_dh(gnutls_datum_t *out,
63926398
PRIVATE_KEY_UNLOCK();
63936399

63946400
if (flags & PK_DERIVE_TLS13) {
6401+
#if !defined(HAVE_FIPS)
63956402
ret = wc_DhAgree_ct(&dh, out->data, &len, private.data, private.size,
63966403
public.data, public.size);
6404+
#else
6405+
ret = wc_DhAgree(&dh, out->data, &len, private.data, private.size,
6406+
public.data, public.size);
6407+
#endif
63976408
} else {
63986409
ret = wc_DhAgree(&dh, out->data, &len, private.data, private.size,
63996410
public.data, public.size);

‎wolfssl-gnutls-wrapper/tests/test_ecdh_encrypt_and_decrypt.c‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,7 @@ int test_ecdh_encrypt_decrypt(gnutls_pk_algorithm_t algo, const char *curve_name
445445

446446
int main(void) {
447447
int ret;
448+
unsigned int fips_mode;
448449

449450
printf("Testing GnuTLS's ECDH encryption/decryption with various curves...\n");
450451

@@ -455,18 +456,25 @@ int main(void) {
455456
return 1;
456457
}
457458

458-
/* Test X25519 */
459-
ret = test_ecdh_encrypt_decrypt(GNUTLS_PK_ECDH_X25519, "X25519");
460-
if (ret != 0) {
461-
gnutls_global_deinit();
462-
return 1;
463-
}
459+
/* Check if FIPS mode is enabled */
460+
fips_mode = gnutls_fips140_mode_enabled();
464461

465-
/* Test X448 */
466-
ret = test_ecdh_encrypt_decrypt(GNUTLS_PK_ECDH_X448, "X448");
467-
if (ret != 0) {
468-
gnutls_global_deinit();
469-
return 1;
462+
if (!fips_mode) {
463+
/* Test X25519 */
464+
ret = test_ecdh_encrypt_decrypt(GNUTLS_PK_ECDH_X25519, "X25519");
465+
if (ret != 0) {
466+
gnutls_global_deinit();
467+
return 1;
468+
}
469+
470+
/* Test X448 */
471+
ret = test_ecdh_encrypt_decrypt(GNUTLS_PK_ECDH_X448, "X448");
472+
if (ret != 0) {
473+
gnutls_global_deinit();
474+
return 1;
475+
}
476+
} else {
477+
printf("Skipping X448 and X25519 since FIPS mode is enabled.\n");
470478
}
471479

472480
/* Test P-256 (SECP256R1) */

‎wolfssl-gnutls-wrapper/tests/test_eddsa_sign_and_verify.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ int test_eddsa_curve(const char *curve_name) {
116116

117117
int main(void) {
118118
int ret;
119+
unsigned int fips_mode;
119120

120121
printf("Testing GnuTLS's EdDSA implementation...\n");
121122

@@ -126,6 +127,13 @@ int main(void) {
126127
return 1;
127128
}
128129

130+
/* Check if FIPS mode is enabled */
131+
fips_mode = gnutls_fips140_mode_enabled();
132+
if (fips_mode == 1) {
133+
printf("This test can be run only when FIPS140 mode is not enabled\n");
134+
return 0; /* Skip test */
135+
}
136+
129137
/* Test Ed25519 */
130138
ret = test_eddsa_curve("Ed25519");
131139
if (ret != 0) {

0 commit comments

Comments
 (0)