Add explicit FIPS indicator for PBKDF2
Also use test vector with FIPS-compliant salt in PBKDF2 FIPS self-test. Resolves: rhbz#2178137 Signed-off-by: Clemens Lang <cllang@redhat.com>
This commit is contained in:
Clemens Lang
parent
50cb33e688
commit
d60644ea6a
|
|
@ -0,0 +1,82 @@
|
|||
From 56090fca0a0c8b6cf1782aced0a02349358aae7d Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Fri, 3 Mar 2023 12:22:03 +0100
|
||||
Subject: [PATCH 1/2] fips: Use salt >= 16 bytes in PBKDF2 selftest
|
||||
|
||||
NIST SP 800-132 [1] section 5.1 says "[t]he length of the
|
||||
randomly-generated portion of the salt shall be at least
|
||||
128 bits", which implies that the salt for PBKDF2 must be at least 16
|
||||
bytes long (see also Appendix A.2.1).
|
||||
|
||||
The FIPS 140-3 IG [2] section 10.3.A requires that "the lengths and the
|
||||
properties of the Password and Salt parameters, as well as the desired
|
||||
length of the Master Key used in a CAST shall be among those supported
|
||||
by the module in the approved mode."
|
||||
|
||||
As a consequence, the salt length in the self test must be at least 16
|
||||
bytes long for FIPS 140-3 compliance. Switch the self test to use the
|
||||
only test vector from RFC 6070 that uses salt that is long enough to
|
||||
fulfil this requirement. Since RFC 6070 does not provide expected
|
||||
results for PBKDF2 with HMAC-SHA256, use the output from [3], which was
|
||||
generated with python cryptography, which was tested against the RFC
|
||||
6070 vectors with HMAC-SHA1.
|
||||
|
||||
[1]: https://doi.org/10.6028/NIST.SP.800-132
|
||||
[2]: https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
|
||||
[3]: https://github.com/brycx/Test-Vector-Generation/blob/master/PBKDF2/pbkdf2-hmac-sha2-test-vectors.md
|
||||
|
||||
Signed-off-by: Clemens Lang <cllang@redhat.com>
|
||||
|
||||
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||||
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
|
||||
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/20429)
|
||||
|
||||
(cherry picked from commit 451cb23c41c90d5a02902b3a77551aa9ee1c6956)
|
||||
---
|
||||
providers/fips/self_test_data.inc | 22 ++++++++++++++++------
|
||||
1 file changed, 16 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
|
||||
index 8ae8cd6f4a..03adf28f3c 100644
|
||||
--- a/providers/fips/self_test_data.inc
|
||||
+++ b/providers/fips/self_test_data.inc
|
||||
@@ -361,19 +361,29 @@ static const ST_KAT_PARAM x963kdf_params[] = {
|
||||
};
|
||||
|
||||
static const char pbkdf2_digest[] = "SHA256";
|
||||
+/*
|
||||
+ * Input parameters from RFC 6070, vector 5 (because it is the only one with
|
||||
+ * a salt >= 16 bytes, which NIST SP 800-132 section 5.1 requires). The
|
||||
+ * expected output is taken from
|
||||
+ * https://github.com/brycx/Test-Vector-Generation/blob/master/PBKDF2/pbkdf2-hmac-sha2-test-vectors.md,
|
||||
+ * which ran these test vectors with SHA-256.
|
||||
+ */
|
||||
static const unsigned char pbkdf2_password[] = {
|
||||
- 0x70, 0x61, 0x73, 0x73, 0x00, 0x77, 0x6f, 0x72,
|
||||
- 0x64
|
||||
+ 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x50, 0x41, 0x53, 0x53,
|
||||
+ 0x57, 0x4f, 0x52, 0x44, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64
|
||||
};
|
||||
static const unsigned char pbkdf2_salt[] = {
|
||||
- 0x73, 0x61, 0x00, 0x6c, 0x74
|
||||
+ 0x73, 0x61, 0x6c, 0x74, 0x53, 0x41, 0x4c, 0x54, 0x73, 0x61, 0x6c, 0x74,
|
||||
+ 0x53, 0x41, 0x4c, 0x54, 0x73, 0x61, 0x6c, 0x74, 0x53, 0x41, 0x4c, 0x54,
|
||||
+ 0x73, 0x61, 0x6c, 0x74, 0x53, 0x41, 0x4c, 0x54, 0x73, 0x61, 0x6c, 0x74
|
||||
};
|
||||
static const unsigned char pbkdf2_expected[] = {
|
||||
- 0x89, 0xb6, 0x9d, 0x05, 0x16, 0xf8, 0x29, 0x89,
|
||||
- 0x3c, 0x69, 0x62, 0x26, 0x65, 0x0a, 0x86, 0x87,
|
||||
+ 0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f, 0x32, 0xd8, 0x14, 0xb8,
|
||||
+ 0x11, 0x6e, 0x84, 0xcf, 0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
|
||||
+ 0x1c
|
||||
};
|
||||
static int pbkdf2_iterations = 4096;
|
||||
-static int pbkdf2_pkcs5 = 1;
|
||||
+static int pbkdf2_pkcs5 = 0;
|
||||
static const ST_KAT_PARAM pbkdf2_params[] = {
|
||||
ST_KAT_PARAM_UTF8STRING(OSSL_KDF_PARAM_DIGEST, pbkdf2_digest),
|
||||
ST_KAT_PARAM_OCTET(OSSL_KDF_PARAM_PASSWORD, pbkdf2_password),
|
||||
--
|
||||
2.39.2
|
||||
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
From fa96a2f493276e7a57512e8c3d535052586f1525 Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Mon, 6 Mar 2023 12:32:04 +0100
|
||||
Subject: [PATCH 2/2] pbdkf2: Set indicator if pkcs5 param disabled checks
|
||||
|
||||
The pbkdf2 implementation in the FIPS provider supports the checks
|
||||
required by NIST, but allows disabling these checks by setting the
|
||||
OSSL_KDF_PARAM_PKCS5 parameter to 1. The implementation must indicate
|
||||
that the use of this configuration is not approved in FIPS mode. Add an
|
||||
explicit indicator to provide this indication.
|
||||
|
||||
Resolves: rhbz#2175145
|
||||
Signed-off-by: Clemens Lang <cllang@redhat.com>
|
||||
---
|
||||
providers/implementations/kdfs/pbkdf2.c | 40 +++++++++++++++++++++++--
|
||||
1 file changed, 37 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c
|
||||
index aa0adce5e6..6df8c6d321 100644
|
||||
--- a/providers/implementations/kdfs/pbkdf2.c
|
||||
+++ b/providers/implementations/kdfs/pbkdf2.c
|
||||
@@ -251,11 +251,42 @@ static const OSSL_PARAM *kdf_pbkdf2_settable_ctx_params(ossl_unused void *ctx,
|
||||
|
||||
static int kdf_pbkdf2_get_ctx_params(void *vctx, OSSL_PARAM params[])
|
||||
{
|
||||
+#ifdef FIPS_MODULE
|
||||
+ KDF_PBKDF2 *ctx = (KDF_PBKDF2 *)vctx;
|
||||
+#endif /* defined(FIPS_MODULE) */
|
||||
OSSL_PARAM *p;
|
||||
+ int any_valid = 0; /* set to 1 when at least one parameter was valid */
|
||||
+
|
||||
+ if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) {
|
||||
+ any_valid = 1;
|
||||
+
|
||||
+ if (!OSSL_PARAM_set_size_t(p, SIZE_MAX))
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+#ifdef FIPS_MODULE
|
||||
+ if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR))
|
||||
+ != NULL) {
|
||||
+ int fips_indicator = EVP_KDF_REDHAT_FIPS_INDICATOR_APPROVED;
|
||||
+
|
||||
+ /* The lower_bound_checks parameter enables checks required by FIPS. If
|
||||
+ * those checks are disabled, the PBKDF2 implementation will also
|
||||
+ * support non-approved parameters (e.g., salt lengths < 16 bytes, see
|
||||
+ * NIST SP 800-132 section 5.1). */
|
||||
+ if (!ctx->lower_bound_checks)
|
||||
+ fips_indicator = EVP_KDF_REDHAT_FIPS_INDICATOR_NOT_APPROVED;
|
||||
|
||||
- if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL)
|
||||
- return OSSL_PARAM_set_size_t(p, SIZE_MAX);
|
||||
- return -2;
|
||||
+ if (!OSSL_PARAM_set_int(p, fips_indicator))
|
||||
+ return 0;
|
||||
+
|
||||
+ any_valid = 1;
|
||||
+ }
|
||||
+#endif /* defined(FIPS_MODULE) */
|
||||
+
|
||||
+ if (!any_valid)
|
||||
+ return -2;
|
||||
+
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
static const OSSL_PARAM *kdf_pbkdf2_gettable_ctx_params(ossl_unused void *ctx,
|
||||
@@ -263,6 +294,9 @@ static const OSSL_PARAM *kdf_pbkdf2_gettable_ctx_params(ossl_unused void *ctx,
|
||||
{
|
||||
static const OSSL_PARAM known_gettable_ctx_params[] = {
|
||||
OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL),
|
||||
+#ifdef FIPS_MODULE
|
||||
+ OSSL_PARAM_int(OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR, NULL),
|
||||
+#endif /* defined(FIPS_MODULE) */
|
||||
OSSL_PARAM_END
|
||||
};
|
||||
return known_gettable_ctx_params;
|
||||
--
|
||||
2.39.2
|
||||
|
||||
|
|
@ -170,6 +170,9 @@ Patch108: 0108-CVE-2023-0401-pkcs7-md.patch
|
|||
Patch109: 0109-fips-Zeroize-out-in-fips-selftest.patch
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2168289
|
||||
Patch110: 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2175145
|
||||
Patch111: 0111-fips-Use-salt-16-bytes-in-PBKDF2-selftest.patch
|
||||
Patch112: 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
|
||||
|
||||
License: ASL 2.0
|
||||
URL: http://www.openssl.org/
|
||||
|
|
@ -507,6 +510,9 @@ install -m644 %{SOURCE9} \
|
|||
Resolves: rhbz#2175873
|
||||
- Add explicit FIPS indicator for IV generation in AES-GCM
|
||||
Resolves: rhbz#2175868
|
||||
- Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant
|
||||
salt in PBKDF2 FIPS self-test
|
||||
Resolves: rhbz#2178137
|
||||
|
||||
* Wed Mar 08 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-6
|
||||
- Fixes RNG slowdown in FIPS mode
|
||||
|
|
|
|||
Loading…
Reference in New Issue