Skip to content

Commit eb6913a

Browse files
tim-weller-wolfssltim-weller-wolfssl
committed
Adding FIPS 140-3 Windows build support
1 parent 79f5048 commit eb6913a

File tree

7 files changed

+311
-5
lines changed

7 files changed

+311
-5
lines changed

‎windows/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ First, replace the contents of `IDE\WIN10\user_settings.h` in wolfSSL with the
4141
contents of `windows\fips_140_2\user_settings.h` from wolfEngine. Then, compile
4242
wolfSSL using `IDE\WIN10\wolfssl-fips.sln`.
4343

44+
### FIPS 140-3
45+
46+
First, replace the contents of `IDE\WIN10\user_settings.h` in wolfSSL with the
47+
contents of `windows\fips_140_3\user_settings.h` from wolfEngine. Then, compile
48+
wolfSSL using `IDE\WIN10\wolfssl-fips.sln`.
49+
4450
### FIPS Ready
4551

4652
First, replace the contents of `IDE\WIN10\user_settings.h` in wolfSSL with the
@@ -94,6 +100,37 @@ out and replace the `verifyCore` value in wolfSSL's `wolfcrypt\src\fips_test.c`
94100
with it. Rebuild wolfSSL, rebuild wolfEngine, and run the wolfEngine tests
95101
again. The integrity check should pass this time.
96102

103+
### FIPS 140-3
104+
105+
Build wolfEngine using `windows\wolfEngine.sln`. Select one of the 2 FIPS 140-3
106+
configurations (e.g. DLL Debug FIPS 140-3 or DLL Release FIPS 140-3).
107+
108+
NOTE: wolfEngine does NOT support building as a static library for FIP 140-3
109+
configurations due to per-thread private key read access support.
110+
111+
Run the test suite by right-clicking on the "test" project in the
112+
Solution Explorer > Debug > Start New Instance. You are likely to encounter
113+
this error message:
114+
115+
```
116+
in FIPS callback, ok = 0, err = -203
117+
message = In Core Integrity check FIPS error
118+
hash = 550122FD59F12AFA94F1B0D95AB361FF03E3EB8708C68974C36D6571524B675C
119+
In core integrity hash check failure, copy above hash
120+
into verifyCore[] in wolfSSL's (NOT wolfEngine) fips_test.c and rebuild
121+
ERR: Failed to find engine!
122+
```
123+
124+
As mentioned earlier, part of wolfSSL's FIPS self-test is an integrity check
125+
of the FIPS module. At startup, the self-test computes an HMAC of the code and
126+
read-only data of the FIPS module and compares the result to an expected value
127+
compiled into the library. If these don't match, the FIPS module enters an error
128+
state and cannot be used. The wolfEngine test program will print the above error
129+
message in this case. If this happens, you should take the hash value printed
130+
out and replace the `verifyCore` value in wolfSSL's `wolfcrypt\src\fips_test.c`
131+
with it. Rebuild wolfSSL, rebuild wolfEngine, and run the wolfEngine tests
132+
again. The integrity check should pass this time.
133+
97134
### FIPS Ready
98135

99136
Build wolfEngine using `windows\wolfEngine.sln`. Select one of the 4 FIPS Ready

‎windows/fips_140_3/user_settings.h‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#ifndef USER_SETTINGS_H
2+
#define USER_SETTINGS_H
3+
4+
/* Uncomment WOLFENGINE_DEBUG to enable wolfEngine debug messages
5+
#define WOLFENGINE_DEBUG */
6+
7+
#define WE_USE_HASH
8+
#define WE_HAVE_SHA384
9+
#define WE_HAVE_SHA512
10+
#define WE_HAVE_SHA1
11+
#define WE_HAVE_SHA224
12+
#define WE_HAVE_SHA256
13+
#define WE_HAVE_CMAC
14+
#define WE_HAVE_MAC
15+
#define WE_HAVE_HMAC
16+
#define WE_HAVE_MAC
17+
18+
/* The DES3CBC cipher is no longer supported with our 140-3 certificate
19+
#define WE_HAVE_DES3CBC */
20+
21+
#define WE_HAVE_AESECB
22+
#define WE_HAVE_AESCBC
23+
#define WE_HAVE_AESCTR
24+
#define WE_HAVE_RANDOM
25+
#define WE_HAVE_RSA
26+
#define WE_HAVE_DH
27+
#define WE_HAVE_ECC
28+
#define WE_HAVE_EVP_PKEY
29+
#define WE_HAVE_ECDSA
30+
#define WE_HAVE_ECDH
31+
#define WE_HAVE_ECKEYGEN
32+
#define WE_HAVE_EC_P192
33+
#define WE_HAVE_EC_P224
34+
#define WE_HAVE_EC_P256
35+
#define WE_HAVE_EC_P384
36+
#define WE_HAVE_EC_P521
37+
#define WE_HAVE_DIGEST
38+
39+
#ifdef _WIN32
40+
41+
/* The wolfSSL Visual Studio project may define these FIPS macros. We want to
42+
* override them if that's the case. */
43+
#undef HAVE_FIPS
44+
#define HAVE_FIPS
45+
#undef HAVE_FIPS_VERSION
46+
#define HAVE_FIPS_VERSION 5
47+
#undef HAVE_FIPS_VERSION_MINOR
48+
#define HAVE_FIPS_VERSION_MINOR 2
49+
50+
#define WOLFSSL_ECDSA_SET_K
51+
#define HAVE_AES_ECB
52+
#define WC_RSA_NO_PADDING
53+
#define WOLFSSL_PUBLIC_MP
54+
#define ECC_MIN_KEY_SZ 192
55+
#define WOLFSSL_TLS13
56+
#define HAVE_TLS_EXTENSIONS
57+
#define HAVE_SUPPORTED_CURVES
58+
#define HAVE_THREAD_LS
59+
#define ECC_TIMING_RESISTANT
60+
#define WC_RSA_BLINDING
61+
#define HAVE_AESCCM
62+
#define WOLFSSL_AES_COUNTER
63+
#define WOLFSSL_AES_DIRECT
64+
#define WOLFSSL_SHA224
65+
#define WOLFSSL_SHA512
66+
#define WOLFSSL_SHA384
67+
#define WOLFSSL_KEY_GEN
68+
#define HAVE_HKDF
69+
#define HAVE_X963_KDF
70+
#define NO_DSA
71+
#define HAVE_ECC
72+
#define ECC_SHAMIR
73+
#define HAVE_ECC_CDH
74+
#define WC_RSA_PSS
75+
#define WOLFSSL_BASE64_ENCODE
76+
#define NO_RC4
77+
#define WOLFSSL_CMAC
78+
#define NO_HC128
79+
#define NO_RABBIT
80+
#define WOLFSSL_SHA3
81+
#define HAVE_ONE_TIME_AUTH
82+
#define HAVE_HASHDRBG
83+
#define HAVE_EXTENDED_MASTER
84+
#define HAVE_ENCRYPT_THEN_MAC
85+
#define NO_PSK
86+
#define NO_MD4
87+
#define NO_PWDBASED
88+
#define WC_NO_ASYNC_THREADING
89+
#define HAVE_DH_DEFAULT_PARAMS
90+
#define GCM_TABLE_4BIT
91+
#define HAVE_AESGCM
92+
#define HAVE_WC_INTROSPECTION
93+
#define OPENSSL_COEXIST
94+
#define NO_OLD_RNGNAME
95+
#define NO_OLD_WC_NAMES
96+
#define NO_OLD_SSL_NAMES
97+
#define NO_OLD_SHA_NAMES
98+
#define NO_OLD_MD5_NAME
99+
#define NO_OLD_SHA256_NAMES
100+
#define HAVE_PUBLIC_FFDHE
101+
#define HAVE_FFDHE_2048
102+
#define HAVE_FFDHE_3072
103+
#define HAVE_FFDHE_4096
104+
#define Sha3 wc_Sha3
105+
#define WOLFSSL_VALIDATE_ECC_IMPORT
106+
#define WOLFSSL_VALIDATE_FFC_IMPORT
107+
#define HAVE_FFDHE_Q
108+
#define WOLFSSL_NO_SHAKE256
109+
#define WOLFSSL_NOSHA512_224
110+
#define WOLFSSL_NOSHA512_256
111+
112+
#ifdef _WIN64
113+
#define WOLFSSL_AESNI
114+
#endif
115+
116+
/* Needed to export symbols in the final DLL */
117+
#define OPENSSL_SYS_WINDOWS
118+
#define OPENSSL_OPT_WINDLL
119+
120+
#endif /* _WIN32 */
121+
122+
#endif

‎windows/props/fips_140_3.props‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ImportGroup Label="PropertySheets" />
4+
<PropertyGroup Label="UserMacros" />
5+
<PropertyGroup>
6+
<_PropertySheetDisplayName>FIPS 140-3</_PropertySheetDisplayName>
7+
</PropertyGroup>
8+
<ItemDefinitionGroup>
9+
<ClCompile>
10+
<AdditionalIncludeDirectories>.\fips_140_3;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
11+
</ClCompile>
12+
</ItemDefinitionGroup>
13+
<ItemGroup />
14+
</Project>

‎windows/test.vcxproj‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,14 @@
3333
<Configuration>DLL Debug FIPS 140-2</Configuration>
3434
<Platform>x64</Platform>
3535
</ProjectConfiguration>
36+
<ProjectConfiguration Include="DLL Debug FIPS 140-3|Win32">
37+
<Configuration>DLL Debug FIPS 140-3</Configuration>
38+
<Platform>Win32</Platform>
39+
</ProjectConfiguration>
40+
<ProjectConfiguration Include="DLL Debug FIPS 140-3|x64">
41+
<Configuration>DLL Debug FIPS 140-3</Configuration>
42+
<Platform>x64</Platform>
43+
</ProjectConfiguration>
3644
<ProjectConfiguration Include="DLL Debug FIPS Ready|Win32">
3745
<Configuration>DLL Debug FIPS Ready</Configuration>
3846
<Platform>Win32</Platform>
@@ -57,6 +65,14 @@
5765
<Configuration>DLL Release FIPS 140-2</Configuration>
5866
<Platform>x64</Platform>
5967
</ProjectConfiguration>
68+
<ProjectConfiguration Include="DLL Release FIPS 140-3|Win32">
69+
<Configuration>DLL Release FIPS 140-3</Configuration>
70+
<Platform>Win32</Platform>
71+
</ProjectConfiguration>
72+
<ProjectConfiguration Include="DLL Release FIPS 140-3|x64">
73+
<Configuration>DLL Release FIPS 140-3</Configuration>
74+
<Platform>x64</Platform>
75+
</ProjectConfiguration>
6076
<ProjectConfiguration Include="DLL Release FIPS Ready|Win32">
6177
<Configuration>DLL Release FIPS Ready</Configuration>
6278
<Platform>Win32</Platform>
@@ -115,9 +131,15 @@
115131
<PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-2|Win32'">
116132
<PlatformToolset>v143</PlatformToolset>
117133
</PropertyGroup>
134+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|Win32'" Label="Configuration">
135+
<PlatformToolset>v143</PlatformToolset>
136+
</PropertyGroup>
118137
<PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-2|x64'">
119138
<PlatformToolset>v143</PlatformToolset>
120139
</PropertyGroup>
140+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|x64'" Label="Configuration">
141+
<PlatformToolset>v143</PlatformToolset>
142+
</PropertyGroup>
121143
<PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug FIPS Ready|x64'">
122144
<PlatformToolset>v143</PlatformToolset>
123145
</PropertyGroup>
@@ -172,12 +194,18 @@
172194
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-2|Win32'" Label="Configuration">
173195
<PlatformToolset>v143</PlatformToolset>
174196
</PropertyGroup>
197+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|Win32'" Label="Configuration">
198+
<PlatformToolset>v143</PlatformToolset>
199+
</PropertyGroup>
175200
<PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS Ready|x64'">
176201
<PlatformToolset>v143</PlatformToolset>
177202
</PropertyGroup>
178203
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-2|x64'" Label="Configuration">
179204
<PlatformToolset>v143</PlatformToolset>
180205
</PropertyGroup>
206+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|x64'" Label="Configuration">
207+
<PlatformToolset>v143</PlatformToolset>
208+
</PropertyGroup>
181209
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
182210
<ImportGroup Label="ExtensionSettings">
183211
</ImportGroup>
@@ -191,6 +219,10 @@
191219
<Import Project="props\dll_debug_fips_test.props" />
192220
<Import Project="props\fips_140_2.props" />
193221
</ImportGroup>
222+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|x64'" Label="PropertySheets">
223+
<Import Project="props\dll_debug_fips_test.props" />
224+
<Import Project="props\fips_140_3.props" />
225+
</ImportGroup>
194226
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug FIPS Ready|x64'">
195227
<Import Project="props\static_debug_fips_test.props" />
196228
<Import Project="props\fips_ready.props" />
@@ -239,6 +271,10 @@
239271
<Import Project="props\dll_release_fips_test.props" />
240272
<Import Project="props\fips_140_2.props" />
241273
</ImportGroup>
274+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|Win32'" Label="PropertySheets">
275+
<Import Project="props\dll_release_fips_test.props" />
276+
<Import Project="props\fips_140_3.props" />
277+
</ImportGroup>
242278
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release FIPS 140-2|x64'">
243279
<Import Project="props\static_release_fips_test.props" />
244280
<Import Project="props\fips_140_2.props" />
@@ -247,6 +283,10 @@
247283
<Import Project="props\dll_release_fips_test.props" />
248284
<Import Project="props\fips_140_2.props" />
249285
</ImportGroup>
286+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|x64'" Label="PropertySheets">
287+
<Import Project="props\dll_release_fips_test.props" />
288+
<Import Project="props\fips_140_3.props" />
289+
</ImportGroup>
250290
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release Non-FIPS|Win32'">
251291
<Import Project="props\static_release_non_fips_test.props" />
252292
</ImportGroup>
@@ -257,6 +297,10 @@
257297
<Import Project="props\dll_debug_fips_test.props" />
258298
<Import Project="props\fips_140_2.props" />
259299
</ImportGroup>
300+
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|Win32'" Label="PropertySheets">
301+
<Import Project="props\dll_debug_fips_test.props" />
302+
<Import Project="props\fips_140_3.props" />
303+
</ImportGroup>
260304
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='DLL Debug Non-FIPS|Win32'">
261305
<Import Project="props\dll_debug_non_fips_test.props" />
262306
</ImportGroup>
@@ -295,4 +339,4 @@
295339
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
296340
<ImportGroup Label="ExtensionTargets">
297341
</ImportGroup>
298-
</Project>
342+
</Project>

‎windows/test.vcxproj.user‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,22 @@ $(LocalDebuggerEnvironment)</LocalDebuggerEnvironment>
3636
<LocalDebuggerEnvironment>OPENSSL_ENGINES=$(OutDir)</LocalDebuggerEnvironment>
3737
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
3838
</PropertyGroup>
39-
</Project>
39+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|Win32'">
40+
<LocalDebuggerEnvironment>OPENSSL_ENGINES=$(OutDir)
41+
$(LocalDebuggerEnvironment)</LocalDebuggerEnvironment>
42+
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
43+
</PropertyGroup>
44+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release FIPS 140-3|x64'">
45+
<LocalDebuggerEnvironment>OPENSSL_ENGINES=$(OutDir)</LocalDebuggerEnvironment>
46+
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|Win32'">
49+
<LocalDebuggerEnvironment>OPENSSL_ENGINES=$(OutDir)
50+
$(LocalDebuggerEnvironment)</LocalDebuggerEnvironment>
51+
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
52+
</PropertyGroup>
53+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug FIPS 140-3|x64'">
54+
<LocalDebuggerEnvironment>OPENSSL_ENGINES=$(OutDir)</LocalDebuggerEnvironment>
55+
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
56+
</PropertyGroup>
57+
</Project>

0 commit comments

Comments
 (0)