Skip to content

Commit 3d9bbda

Browse files
cconloncconlon
authored
Merge pull request #120 from haydenroche5/fips_restrictions
Restrict usage of P-192 when using wolfCrypt FIPS.
2 parents 5a589e0 + d3ff275 commit 3d9bbda

File tree

7 files changed

+490
-19
lines changed

7 files changed

+490
-19
lines changed

‎openssl_patches/1.0.2h/tests/ecdsatest_102h.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ index 0f301f8..abf26e1 100644
103103
if (nid == NID_ipsec4)
104104
continue;
105105
+
106-
+ /* Only testing supported curves for FIPS mode */
106+
+ /* Only testing curves supported by wolfEngine */
107107
+ if (nid != NID_X9_62_prime192v1 && nid != NID_X9_62_prime256v1)
108108
+ continue;
109109
+

‎openssl_patches/1.0.2h/tests/fips/ecdhtest_102h.patch‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/crypto/ecdh/ecdhtest.c b/crypto/ecdh/ecdhtest.c
2+
index 2fe2c66443..b1a8bab26f 100644
3+
--- a/crypto/ecdh/ecdhtest.c
4+
+++ b/crypto/ecdh/ecdhtest.c
5+
@@ -501,7 +501,7 @@ int main(int argc, char *argv[])
6+
goto err;
7+
8+
/* NIST PRIME CURVES TESTS */
9+
- if (!test_ecdh_curve
10+
+ if (test_ecdh_curve
11+
(NID_X9_62_prime192v1, "NIST Prime-Curve P-192", ctx, out))
12+
goto err;
13+
if (!test_ecdh_curve(NID_secp224r1, "NIST Prime-Curve P-224", ctx, out))

‎openssl_patches/1.0.2h/tests/fips/ecdsatest_102h.patch‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
diff --git a/crypto/ecdsa/ecdsatest.c b/crypto/ecdsa/ecdsatest.c
2+
index 856d042..037ffb8 100644
3+
--- a/crypto/ecdsa/ecdsatest.c
4+
+++ b/crypto/ecdsa/ecdsatest.c
5+
@@ -260,7 +260,7 @@ int x9_62_tests(BIO *out, ENGINE *e)
6+
if (!change_rand())
7+
goto x962_err;
8+
9+
- if (!x9_62_test_internal(out, NID_X9_62_prime192v1,
10+
+ if (x9_62_test_internal(out, NID_X9_62_prime192v1,
11+
"3342403536405981729393488334694600415596881826869351677613",
12+
"5735822328888155254683894997897571951568553642892029982342",
13+
e))
14+
@@ -337,8 +337,8 @@ int test_builtin(BIO *out)
15+
if (nid == NID_ipsec4)
16+
continue;
17+
18+
- /* Only testing curves supported by wolfEngine */
19+
- if (nid != NID_X9_62_prime192v1 && nid != NID_X9_62_prime256v1)
20+
+ /* Only testing curves supported by wolfEngine and wolfCrypt FIPS */
21+
+ if (nid != NID_X9_62_prime256v1)
22+
continue;
23+
24+
/* create new ecdsa key (== EC_KEY) */

‎openssl_patches/1.1.1b/tests/fips/14-curves.conf.in_111b.patch‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/test/ssl-tests/14-curves.conf.in b/test/ssl-tests/14-curves.conf.in
2+
index 6f656affd7..5b4518d56c 100644
3+
--- a/test/ssl-tests/14-curves.conf.in
4+
+++ b/test/ssl-tests/14-curves.conf.in
5+
@@ -10,7 +10,7 @@ use warnings;
6+
use OpenSSL::Test;
7+
use OpenSSL::Test::Utils qw(anydisabled);
8+
9+
-my @curves = ( "prime192v1", "prime256v1", "secp384r1", "secp521r1");
10+
+my @curves = ( "prime256v1", "secp384r1", "secp521r1");
11+
12+
our @tests = ();
13+

‎openssl_patches/1.1.1b/tests/fips/evppkey.txt_111b.patch‎

Lines changed: 216 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
diff --git a/test/recipes/30-test_evp_data/evppkey.txt b/test/recipes/30-test_evp_data/evppkey.txt
2-
index 736e0ce4d3..4ebbc27d50 100644
2+
index 736e0ce4d3..9afffd0187 100644
33
--- a/test/recipes/30-test_evp_data/evppkey.txt
44
+++ b/test/recipes/30-test_evp_data/evppkey.txt
55
@@ -134,6 +134,7 @@ Sign = RSA-2048
@@ -27,15 +27,228 @@ index 736e0ce4d3..4ebbc27d50 100644
2727

2828
# Mismatched digest
2929
Verify = RSA-2048
30-
@@ -17402,6 +17403,7 @@ DigestSign = SHA1
30+
@@ -5444,10 +5445,12 @@ PrivPubKeyPair = PRIME192V1_RFC5114-Peer:PRIME192V1_RFC5114-Peer-PUBLIC
31+
Derive=PRIME192V1_RFC5114
32+
PeerKey=PRIME192V1_RFC5114-Peer-PUBLIC
33+
SharedSecret=AD420182633F8526BFE954ACDA376F05E5FF4F837F54FEBE
34+
+Result = DERIVE_ERROR
35+
36+
Derive=PRIME192V1_RFC5114-Peer
37+
PeerKey=PRIME192V1_RFC5114-PUBLIC
38+
SharedSecret=AD420182633F8526BFE954ACDA376F05E5FF4F837F54FEBE
39+
+Result = DERIVE_ERROR
40+
41+
PrivateKey=SECP224R1_RFC5114
42+
-----BEGIN PRIVATE KEY-----
43+
@@ -5934,6 +5937,7 @@ Derive=KAS-ECC-CDH_P-192_C0
44+
PeerKey=KAS-ECC-CDH_P-192_C0-Peer-PUBLIC
45+
Ctrl=ecdh_cofactor_mode:1
46+
SharedSecret=803d8ab2e5b6e6fca715737c3a82f7ce3c783124f6d51cd0
47+
+Result=DERIVE_ERROR
48+
49+
PrivateKey=KAS-ECC-CDH_P-192_C1
50+
-----BEGIN PRIVATE KEY-----
51+
@@ -5962,6 +5966,7 @@ Derive=KAS-ECC-CDH_P-192_C1
52+
PeerKey=KAS-ECC-CDH_P-192_C1-Peer-PUBLIC
53+
Ctrl=ecdh_cofactor_mode:1
54+
SharedSecret=c208847568b98835d7312cef1f97f7aa298283152313c29d
55+
+Result=DERIVE_ERROR
56+
57+
PrivateKey=KAS-ECC-CDH_P-192_C2
58+
-----BEGIN PRIVATE KEY-----
59+
@@ -5990,6 +5995,7 @@ Derive=KAS-ECC-CDH_P-192_C2
60+
PeerKey=KAS-ECC-CDH_P-192_C2-Peer-PUBLIC
61+
Ctrl=ecdh_cofactor_mode:1
62+
SharedSecret=87229107047a3b611920d6e3b2c0c89bea4f49412260b8dd
63+
+Result=DERIVE_ERROR
64+
65+
PrivateKey=KAS-ECC-CDH_P-192_C3
66+
-----BEGIN PRIVATE KEY-----
67+
@@ -6018,6 +6024,7 @@ Derive=KAS-ECC-CDH_P-192_C3
68+
PeerKey=KAS-ECC-CDH_P-192_C3-Peer-PUBLIC
69+
Ctrl=ecdh_cofactor_mode:1
70+
SharedSecret=eec0bed8fc55e1feddc82158fd6dc0d48a4d796aaf47d46c
71+
+Result=DERIVE_ERROR
72+
73+
PrivateKey=KAS-ECC-CDH_P-192_C4
74+
-----BEGIN PRIVATE KEY-----
75+
@@ -6046,6 +6053,7 @@ Derive=KAS-ECC-CDH_P-192_C4
76+
PeerKey=KAS-ECC-CDH_P-192_C4-Peer-PUBLIC
77+
Ctrl=ecdh_cofactor_mode:1
78+
SharedSecret=716e743b1b37a2cd8479f0a3d5a74c10ba2599be18d7e2f4
79+
+Result=DERIVE_ERROR
80+
81+
PrivateKey=KAS-ECC-CDH_P-192_C5
82+
-----BEGIN PRIVATE KEY-----
83+
@@ -6074,6 +6082,7 @@ Derive=KAS-ECC-CDH_P-192_C5
84+
PeerKey=KAS-ECC-CDH_P-192_C5-Peer-PUBLIC
85+
Ctrl=ecdh_cofactor_mode:1
86+
SharedSecret=f67053b934459985a315cb017bf0302891798d45d0e19508
87+
+Result=DERIVE_ERROR
88+
89+
PrivateKey=KAS-ECC-CDH_P-192_C6
90+
-----BEGIN PRIVATE KEY-----
91+
@@ -6102,6 +6111,7 @@ Derive=KAS-ECC-CDH_P-192_C6
92+
PeerKey=KAS-ECC-CDH_P-192_C6-Peer-PUBLIC
93+
Ctrl=ecdh_cofactor_mode:1
94+
SharedSecret=75822971193edd472bf30151a782619c55ad0b279c9303dd
95+
+Result=DERIVE_ERROR
96+
97+
PrivateKey=KAS-ECC-CDH_P-192_C7
98+
-----BEGIN PRIVATE KEY-----
99+
@@ -6130,6 +6140,7 @@ Derive=KAS-ECC-CDH_P-192_C7
100+
PeerKey=KAS-ECC-CDH_P-192_C7-Peer-PUBLIC
101+
Ctrl=ecdh_cofactor_mode:1
102+
SharedSecret=67cba2cbb69ee78bf1abafb0e6fbe33fa2094c128d59652d
103+
+Result=DERIVE_ERROR
104+
105+
PrivateKey=KAS-ECC-CDH_P-192_C8
106+
-----BEGIN PRIVATE KEY-----
107+
@@ -6158,6 +6169,7 @@ Derive=KAS-ECC-CDH_P-192_C8
108+
PeerKey=KAS-ECC-CDH_P-192_C8-Peer-PUBLIC
109+
Ctrl=ecdh_cofactor_mode:1
110+
SharedSecret=cf99a2770a386ca0137d1eca0a226e484297ac3c513f3631
111+
+Result=DERIVE_ERROR
112+
113+
PrivateKey=KAS-ECC-CDH_P-192_C9
114+
-----BEGIN PRIVATE KEY-----
115+
@@ -6186,6 +6198,7 @@ Derive=KAS-ECC-CDH_P-192_C9
116+
PeerKey=KAS-ECC-CDH_P-192_C9-Peer-PUBLIC
117+
Ctrl=ecdh_cofactor_mode:1
118+
SharedSecret=576331e2b4fb38a112810e1529834de8307fb0a0d2756877
119+
+Result=DERIVE_ERROR
120+
121+
PrivateKey=KAS-ECC-CDH_P-192_C10
122+
-----BEGIN PRIVATE KEY-----
123+
@@ -6214,6 +6227,7 @@ Derive=KAS-ECC-CDH_P-192_C10
124+
PeerKey=KAS-ECC-CDH_P-192_C10-Peer-PUBLIC
125+
Ctrl=ecdh_cofactor_mode:1
126+
SharedSecret=902f4501916a0dd945554c3a37b3d780d375a6da713197c4
127+
+Result=DERIVE_ERROR
128+
129+
PrivateKey=KAS-ECC-CDH_P-192_C11
130+
-----BEGIN PRIVATE KEY-----
131+
@@ -6242,6 +6256,7 @@ Derive=KAS-ECC-CDH_P-192_C11
132+
PeerKey=KAS-ECC-CDH_P-192_C11-Peer-PUBLIC
133+
Ctrl=ecdh_cofactor_mode:1
134+
SharedSecret=46e4de335054d429863218ae33636fc9b89c628b64b506c7
135+
+Result=DERIVE_ERROR
136+
137+
PrivateKey=KAS-ECC-CDH_P-192_C12
138+
-----BEGIN PRIVATE KEY-----
139+
@@ -6270,6 +6285,7 @@ Derive=KAS-ECC-CDH_P-192_C12
140+
PeerKey=KAS-ECC-CDH_P-192_C12-Peer-PUBLIC
141+
Ctrl=ecdh_cofactor_mode:1
142+
SharedSecret=1bfe9e5a20ac7a38d8f605b425bb9030be31ef97c101c76c
143+
+Result=DERIVE_ERROR
144+
145+
PrivateKey=KAS-ECC-CDH_P-192_C13
146+
-----BEGIN PRIVATE KEY-----
147+
@@ -6298,6 +6314,7 @@ Derive=KAS-ECC-CDH_P-192_C13
148+
PeerKey=KAS-ECC-CDH_P-192_C13-Peer-PUBLIC
149+
Ctrl=ecdh_cofactor_mode:1
150+
SharedSecret=0e8c493a4adc445dc9288a3b9b272599224054592d7265b3
151+
+Result=DERIVE_ERROR
152+
153+
PrivateKey=KAS-ECC-CDH_P-192_C14
154+
-----BEGIN PRIVATE KEY-----
155+
@@ -6326,6 +6343,7 @@ Derive=KAS-ECC-CDH_P-192_C14
156+
PeerKey=KAS-ECC-CDH_P-192_C14-Peer-PUBLIC
157+
Ctrl=ecdh_cofactor_mode:1
158+
SharedSecret=0f1991086b455ded6a1c4146f7bf59fe9b495de566ebc6bf
159+
+Result=DERIVE_ERROR
160+
161+
PrivateKey=KAS-ECC-CDH_P-192_C15
162+
-----BEGIN PRIVATE KEY-----
163+
@@ -6354,6 +6372,7 @@ Derive=KAS-ECC-CDH_P-192_C15
164+
PeerKey=KAS-ECC-CDH_P-192_C15-Peer-PUBLIC
165+
Ctrl=ecdh_cofactor_mode:1
166+
SharedSecret=b30f2127c34df35aaa91dbf0bbe15798e799a03ed11698c1
167+
+Result=DERIVE_ERROR
168+
169+
PrivateKey=KAS-ECC-CDH_P-192_C16
170+
-----BEGIN PRIVATE KEY-----
171+
@@ -6382,6 +6401,7 @@ Derive=KAS-ECC-CDH_P-192_C16
172+
PeerKey=KAS-ECC-CDH_P-192_C16-Peer-PUBLIC
173+
Ctrl=ecdh_cofactor_mode:1
174+
SharedSecret=64a5c246599d3e8177a2402a1110eb81e6c456ab4edb5127
175+
+Result=DERIVE_ERROR
176+
177+
PrivateKey=KAS-ECC-CDH_P-192_C17
178+
-----BEGIN PRIVATE KEY-----
179+
@@ -6410,6 +6430,7 @@ Derive=KAS-ECC-CDH_P-192_C17
180+
PeerKey=KAS-ECC-CDH_P-192_C17-Peer-PUBLIC
181+
Ctrl=ecdh_cofactor_mode:1
182+
SharedSecret=017b8ca53c82fab163da2ab783966a39e061b32c8cfa334d
183+
+Result=DERIVE_ERROR
184+
185+
PrivateKey=KAS-ECC-CDH_P-192_C18
186+
-----BEGIN PRIVATE KEY-----
187+
@@ -6438,6 +6459,7 @@ Derive=KAS-ECC-CDH_P-192_C18
188+
PeerKey=KAS-ECC-CDH_P-192_C18-Peer-PUBLIC
189+
Ctrl=ecdh_cofactor_mode:1
190+
SharedSecret=340ef3db3dbebdd91c62c3d4e1a3da2c7c52a3338b865259
191+
+Result=DERIVE_ERROR
192+
193+
PrivateKey=KAS-ECC-CDH_P-192_C19
194+
-----BEGIN PRIVATE KEY-----
195+
@@ -6466,6 +6488,7 @@ Derive=KAS-ECC-CDH_P-192_C19
196+
PeerKey=KAS-ECC-CDH_P-192_C19-Peer-PUBLIC
197+
Ctrl=ecdh_cofactor_mode:1
198+
SharedSecret=2162144921df5103d0e6a650fb13fd246f4738d0896ce92f
199+
+Result=DERIVE_ERROR
200+
201+
PrivateKey=KAS-ECC-CDH_P-192_C20
202+
-----BEGIN PRIVATE KEY-----
203+
@@ -6494,6 +6517,7 @@ Derive=KAS-ECC-CDH_P-192_C20
204+
PeerKey=KAS-ECC-CDH_P-192_C20-Peer-PUBLIC
205+
Ctrl=ecdh_cofactor_mode:1
206+
SharedSecret=4c69e7feed4b11159adfc16a6047a92572ea44e0740b23af
207+
+Result=DERIVE_ERROR
208+
209+
PrivateKey=KAS-ECC-CDH_P-192_C21
210+
-----BEGIN PRIVATE KEY-----
211+
@@ -6522,6 +6546,7 @@ Derive=KAS-ECC-CDH_P-192_C21
212+
PeerKey=KAS-ECC-CDH_P-192_C21-Peer-PUBLIC
213+
Ctrl=ecdh_cofactor_mode:1
214+
SharedSecret=46072acefd67bff50de355ca7a31fa6be59f26e467587259
215+
+Result=DERIVE_ERROR
216+
217+
PrivateKey=KAS-ECC-CDH_P-192_C22
218+
-----BEGIN PRIVATE KEY-----
219+
@@ -6550,6 +6575,7 @@ Derive=KAS-ECC-CDH_P-192_C22
220+
PeerKey=KAS-ECC-CDH_P-192_C22-Peer-PUBLIC
221+
Ctrl=ecdh_cofactor_mode:1
222+
SharedSecret=ec5580eabca9f3389d2b427ddf6e49e26d629afd03fa766e
223+
+Result=DERIVE_ERROR
224+
225+
PrivateKey=KAS-ECC-CDH_P-192_C23
226+
-----BEGIN PRIVATE KEY-----
227+
@@ -6578,6 +6604,7 @@ Derive=KAS-ECC-CDH_P-192_C23
228+
PeerKey=KAS-ECC-CDH_P-192_C23-Peer-PUBLIC
229+
Ctrl=ecdh_cofactor_mode:1
230+
SharedSecret=7f3929dd3cbf7673bc30d859d90b880307475f800660ea32
231+
+Result=DERIVE_ERROR
232+
233+
PrivateKey=KAS-ECC-CDH_P-192_C24
234+
-----BEGIN PRIVATE KEY-----
235+
@@ -6606,6 +6633,7 @@ Derive=KAS-ECC-CDH_P-192_C24
236+
PeerKey=KAS-ECC-CDH_P-192_C24-Peer-PUBLIC
237+
Ctrl=ecdh_cofactor_mode:1
238+
SharedSecret=72e88f3ea67d46d46dbf83926e7e2a6b85b54536741e6d2c
239+
+Result=DERIVE_ERROR
240+
241+
PrivateKey=KAS-ECC-CDH_P-224_C0
242+
-----BEGIN PRIVATE KEY-----
243+
@@ -17402,6 +17430,7 @@ DigestSign = SHA1
31244
Key = RSA-2048
32245
Input = "Hello World"
33246
Output = 3da3ca2bdd1b23a231b0e3c49d95d5959f9398c27a1e534c7e6baf1d2682304d3b6b229385b1edf483f5ef6f9b35bf10c519a302bb2f79c564e1a59ba71aa2fa36df96c942c43e8d9bd4702b5f61c12a078ae2b34d0de221fc8f9f936b79a67c89d11ba5da8c63a1370d0e824c6b661123e9b58b143ff533cf362cbdad70e65b419a6d45723bf22db3c76bb8f5337c5c5c93cb6f38b30d0c835b54c23405ca4217dd0b755f3712ebad285d9e0c02655f6ce5ce6fed78f3c81843de325f628055eef57f280dee0c3170050137ee599b9ab7f2b5d3c5f831777ea05a5eb097c70bad1a7214dadae12d7960bb9425390c7d25a79985e1e3c28ad422ff93c808f4b5
34247
+Result = DIGESTSIGNFINAL_LENGTH_ERROR
35248

36249
DigestSign = SHA256
37250
Key = RSA-2048
38-
@@ -17455,6 +17457,7 @@ OneShotDigestSign = SHA1
251+
@@ -17455,6 +17484,7 @@ OneShotDigestSign = SHA1
39252
Key = RSA-2048
40253
Input = "Hello World"
41254
Output = 3da3ca2bdd1b23a231b0e3c49d95d5959f9398c27a1e534c7e6baf1d2682304d3b6b229385b1edf483f5ef6f9b35bf10c519a302bb2f79c564e1a59ba71aa2fa36df96c942c43e8d9bd4702b5f61c12a078ae2b34d0de221fc8f9f936b79a67c89d11ba5da8c63a1370d0e824c6b661123e9b58b143ff533cf362cbdad70e65b419a6d45723bf22db3c76bb8f5337c5c5c93cb6f38b30d0c835b54c23405ca4217dd0b755f3712ebad285d9e0c02655f6ce5ce6fed78f3c81843de325f628055eef57f280dee0c3170050137ee599b9ab7f2b5d3c5f831777ea05a5eb097c70bad1a7214dadae12d7960bb9425390c7d25a79985e1e3c28ad422ff93c808f4b5

0 commit comments

Comments
 (0)