1 /* ====================================================================
2 * Copyright (c) 2003 The OpenSSL Project. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in
13 * the documentation and/or other materials provided with the
16 * 3. All advertising materials mentioning features or use of this
17 * software must display the following acknowledgment:
18 * "This product includes software developed by the OpenSSL Project
19 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22 * endorse or promote products derived from this software without
23 * prior written permission. For written permission, please contact
24 * openssl-core@openssl.org.
26 * 5. Products derived from this software may not be called "OpenSSL"
27 * nor may "OpenSSL" appear in their names without prior written
28 * permission of the OpenSSL Project.
30 * 6. Redistributions of any form whatsoever must retain the following
32 * "This product includes software developed by the OpenSSL Project
33 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46 * OF THE POSSIBILITY OF SUCH DAMAGE.
50 #include <openssl/rand.h>
51 #include <openssl/fips_rand.h>
52 #include <openssl/err.h>
53 #include <openssl/bio.h>
54 #include <openssl/hmac.h>
55 #include <openssl/rsa.h>
58 #include "fips_locl.h"
62 # include <openssl/fips.h>
65 # define PATH_MAX 1024
68 static int fips_selftest_fail;
70 static const void *fips_rand_check;
72 static void fips_set_mode(int onoff)
74 int owning_thread = fips_is_owning_thread();
76 if (fips_is_started()) {
85 static void fips_set_rand_check(const void *rand_check)
87 int owning_thread = fips_is_owning_thread();
89 if (fips_is_started()) {
92 fips_rand_check = rand_check;
101 int owning_thread = fips_is_owning_thread();
103 if (fips_is_started()) {
113 const void *FIPS_rand_check(void)
116 int owning_thread = fips_is_owning_thread();
118 if (fips_is_started()) {
121 ret = fips_rand_check;
128 int FIPS_selftest_failed(void)
131 if (fips_is_started()) {
132 int owning_thread = fips_is_owning_thread();
136 ret = fips_selftest_fail;
144 * Selftest failure fatal exit routine. This will be called during *any*
145 * cryptographic operation. It has the minimum overhead possible to avoid too
146 * big a performance hit.
149 void FIPS_selftest_check(void)
151 if (fips_selftest_fail) {
152 OpenSSLDie(__FILE__, __LINE__, "FATAL FIPS SELFTEST FAILURE");
156 void fips_set_selftest_fail(void)
158 fips_selftest_fail = 1;
164 return FIPS_selftest_sha1()
165 && FIPS_selftest_hmac()
166 && FIPS_selftest_aes()
167 && FIPS_selftest_des()
168 && FIPS_selftest_rsa()
169 && FIPS_selftest_dsa();
172 extern const void *FIPS_text_start(), *FIPS_text_end();
173 extern const unsigned char FIPS_rodata_start[], FIPS_rodata_end[];
174 unsigned char FIPS_signature[20] = { 0 };
176 static const char FIPS_hmac_key[] = "etaonrishdlcupfm";
178 unsigned int FIPS_incore_fingerprint(unsigned char *sig, unsigned int len)
180 const unsigned char *p1 = FIPS_text_start();
181 const unsigned char *p2 = FIPS_text_end();
182 const unsigned char *p3 = FIPS_rodata_start;
183 const unsigned char *p4 = FIPS_rodata_end;
187 HMAC_Init(&c, FIPS_hmac_key, strlen(FIPS_hmac_key), EVP_sha1());
189 /* detect overlapping regions */
190 if (p1 <= p3 && p2 >= p3)
191 p3 = p1, p4 = p2 > p4 ? p2 : p4, p1 = NULL, p2 = NULL;
192 else if (p3 <= p1 && p4 >= p1)
193 p3 = p3, p4 = p2 > p4 ? p2 : p4, p1 = NULL, p2 = NULL;
196 HMAC_Update(&c, p1, (size_t)p2 - (size_t)p1);
198 if (FIPS_signature >= p3 && FIPS_signature < p4) {
200 HMAC_Update(&c, p3, (size_t)FIPS_signature - (size_t)p3);
201 p3 = FIPS_signature + sizeof(FIPS_signature);
203 HMAC_Update(&c, p3, (size_t)p4 - (size_t)p3);
205 HMAC_Update(&c, p3, (size_t)p4 - (size_t)p3);
207 HMAC_Final(&c, sig, &len);
208 HMAC_CTX_cleanup(&c);
213 int FIPS_check_incore_fingerprint(void)
215 unsigned char sig[EVP_MAX_MD_SIZE];
217 # if defined(__sgi) && (defined(__mips) || defined(mips))
218 extern int __dso_displacement[];
220 extern int OPENSSL_NONPIC_relocated;
223 if (FIPS_text_start() == NULL) {
224 FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
225 FIPS_R_UNSUPPORTED_PLATFORM);
229 len = FIPS_incore_fingerprint(sig, sizeof(sig));
231 if (len != sizeof(FIPS_signature) ||
232 memcmp(FIPS_signature, sig, sizeof(FIPS_signature))) {
233 if (FIPS_signature >= FIPS_rodata_start
234 && FIPS_signature < FIPS_rodata_end)
235 FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
236 FIPS_R_FINGERPRINT_DOES_NOT_MATCH_SEGMENT_ALIASING);
237 # if defined(__sgi) && (defined(__mips) || defined(mips))
238 else if (__dso_displacement != NULL)
240 else if (OPENSSL_NONPIC_relocated)
242 FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
243 FIPS_R_FINGERPRINT_DOES_NOT_MATCH_NONPIC_RELOCATED);
245 FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
246 FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
253 int FIPS_mode_set(int onoff)
255 int fips_set_owning_thread();
256 int fips_clear_owning_thread();
261 fips_set_owning_thread();
264 unsigned char buf[48];
266 fips_selftest_fail = 0;
269 * Don't go into FIPS mode twice, just so we can do automagic seeding
272 FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_FIPS_MODE_ALREADY_SET);
273 fips_selftest_fail = 1;
277 # ifdef OPENSSL_IA32_SSE2
278 if ((OPENSSL_ia32cap & (1 << 25 | 1 << 26)) != (1 << 25 | 1 << 26)) {
279 FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_UNSUPPORTED_PLATFORM);
280 fips_selftest_fail = 1;
286 if (fips_signature_witness() != FIPS_signature) {
287 FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_CONTRADICTING_EVIDENCE);
288 fips_selftest_fail = 1;
293 if (!FIPS_check_incore_fingerprint()) {
294 fips_selftest_fail = 1;
299 /* Perform RNG KAT before seeding */
300 if (!FIPS_selftest_rng()) {
301 fips_selftest_fail = 1;
306 /* automagically seed PRNG if not already seeded */
307 if (!FIPS_rand_status()) {
308 if (RAND_bytes(buf, sizeof buf) <= 0) {
309 fips_selftest_fail = 1;
313 FIPS_rand_set_key(buf, 32);
314 FIPS_rand_seed(buf + 32, 16);
317 /* now switch into FIPS mode */
318 fips_set_rand_check(FIPS_rand_method());
319 RAND_set_rand_method(FIPS_rand_method());
323 fips_selftest_fail = 1;
331 fips_selftest_fail = 0;
334 fips_clear_owning_thread();
339 void fips_w_lock(void)
341 CRYPTO_w_lock(CRYPTO_LOCK_FIPS);
344 void fips_w_unlock(void)
346 CRYPTO_w_unlock(CRYPTO_LOCK_FIPS);
349 void fips_r_lock(void)
351 CRYPTO_r_lock(CRYPTO_LOCK_FIPS);
354 void fips_r_unlock(void)
356 CRYPTO_r_unlock(CRYPTO_LOCK_FIPS);
359 static int fips_started = 0;
360 static unsigned long fips_thread = 0;
362 void fips_set_started(void)
367 int fips_is_started(void)
372 int fips_is_owning_thread(void)
376 if (fips_is_started()) {
377 CRYPTO_r_lock(CRYPTO_LOCK_FIPS2);
378 if (fips_thread != 0 && fips_thread == CRYPTO_thread_id())
380 CRYPTO_r_unlock(CRYPTO_LOCK_FIPS2);
385 int fips_set_owning_thread(void)
389 if (fips_is_started()) {
390 CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
391 if (fips_thread == 0) {
392 fips_thread = CRYPTO_thread_id();
395 CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
400 int fips_clear_owning_thread(void)
404 if (fips_is_started()) {
405 CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
406 if (fips_thread == CRYPTO_thread_id()) {
410 CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
415 unsigned char *fips_signature_witness(void)
417 extern unsigned char FIPS_signature[];
418 return FIPS_signature;
422 * Generalized public key test routine. Signs and verifies the data supplied
423 * in tbs using mesage digest md and setting option digest flags md_flags. If
424 * the 'kat' parameter is not NULL it will additionally check the signature
425 * matches it: a known answer test The string "fail_str" is used for
426 * identification purposes in case of failure.
429 int fips_pkey_signature_test(EVP_PKEY *pkey,
430 const unsigned char *tbs, int tbslen,
431 const unsigned char *kat, unsigned int katlen,
432 const EVP_MD *digest, unsigned int md_flags,
433 const char *fail_str)
436 unsigned char sigtmp[256], *sig = sigtmp;
439 EVP_MD_CTX_init(&mctx);
441 if ((pkey->type == EVP_PKEY_RSA)
442 && (RSA_size(pkey->pkey.rsa) > sizeof(sigtmp))) {
443 sig = OPENSSL_malloc(RSA_size(pkey->pkey.rsa));
445 FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, ERR_R_MALLOC_FAILURE);
451 tbslen = strlen((char *)tbs);
454 M_EVP_MD_CTX_set_flags(&mctx, md_flags);
456 if (!EVP_SignInit_ex(&mctx, digest, NULL))
458 if (!EVP_SignUpdate(&mctx, tbs, tbslen))
460 if (!EVP_SignFinal(&mctx, sig, &siglen, pkey))
463 if (kat && ((siglen != katlen) || memcmp(kat, sig, katlen)))
466 if (!EVP_VerifyInit_ex(&mctx, digest, NULL))
468 if (!EVP_VerifyUpdate(&mctx, tbs, tbslen))
470 ret = EVP_VerifyFinal(&mctx, sig, siglen, pkey);
475 EVP_MD_CTX_cleanup(&mctx);
477 FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, FIPS_R_TEST_FAILURE);
479 ERR_add_error_data(2, "Type=", fail_str);
486 * Generalized symmetric cipher test routine. Encrypt data, verify result
487 * against known answer, decrypt and compare with original plaintext.
490 int fips_cipher_test(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
491 const unsigned char *key,
492 const unsigned char *iv,
493 const unsigned char *plaintext,
494 const unsigned char *ciphertext, int len)
496 unsigned char pltmp[FIPS_MAX_CIPHER_TEST_SIZE];
497 unsigned char citmp[FIPS_MAX_CIPHER_TEST_SIZE];
498 OPENSSL_assert(len <= FIPS_MAX_CIPHER_TEST_SIZE);
499 if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1) <= 0)
501 EVP_Cipher(ctx, citmp, plaintext, len);
502 if (memcmp(citmp, ciphertext, len))
504 if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0) <= 0)
506 EVP_Cipher(ctx, pltmp, citmp, len);
507 if (memcmp(pltmp, plaintext, len))
514 * The purpose of this is to ensure the error code exists and the function
515 * name is to keep the error checking script quiet
517 void hash_final(void)
519 FIPSerr(FIPS_F_HASH_FINAL, FIPS_R_NON_FIPS_METHOD);