AES GCM selftests.
[openssl.git] / fips / fips.c
1 /* ====================================================================
2  * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer. 
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in
13  *    the documentation and/or other materials provided with the
14  *    distribution.
15  *
16  * 3. All advertising materials mentioning features or use of this
17  *    software must display the following acknowledgment:
18  *    "This product includes software developed by the OpenSSL Project
19  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
20  *
21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22  *    endorse or promote products derived from this software without
23  *    prior written permission. For written permission, please contact
24  *    openssl-core@openssl.org.
25  *
26  * 5. Products derived from this software may not be called "OpenSSL"
27  *    nor may "OpenSSL" appear in their names without prior written
28  *    permission of the OpenSSL Project.
29  *
30  * 6. Redistributions of any form whatsoever must retain the following
31  *    acknowledgment:
32  *    "This product includes software developed by the OpenSSL Project
33  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
34  *
35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46  * OF THE POSSIBILITY OF SUCH DAMAGE.
47  *
48  */
49
50 #define OPENSSL_FIPSAPI
51
52 #include <openssl/crypto.h>
53 #include <openssl/rand.h>
54 #include <openssl/fips_rand.h>
55 #include <openssl/err.h>
56 #include <openssl/bio.h>
57 #include <openssl/hmac.h>
58 #include <openssl/rsa.h>
59 #include <openssl/dsa.h>
60 #include <openssl/ecdsa.h>
61 #include <string.h>
62 #include <limits.h>
63 #include "fips_locl.h"
64
65 #ifdef OPENSSL_FIPS
66
67 #include <openssl/fips.h>
68
69 #ifndef PATH_MAX
70 #define PATH_MAX 1024
71 #endif
72
73 static int fips_selftest_fail;
74 static int fips_mode;
75 static int fips_started = 0;
76 static const void *fips_rand_check;
77
78 static int fips_is_owning_thread(void);
79 static int fips_set_owning_thread(void);
80 static int fips_clear_owning_thread(void);
81 static unsigned char *fips_signature_witness(void);
82
83 static void fips_w_lock(void)   { CRYPTO_w_lock(CRYPTO_LOCK_FIPS); }
84 static void fips_w_unlock(void) { CRYPTO_w_unlock(CRYPTO_LOCK_FIPS); }
85 static void fips_r_lock(void)   { CRYPTO_r_lock(CRYPTO_LOCK_FIPS); }
86 static void fips_r_unlock(void) { CRYPTO_r_unlock(CRYPTO_LOCK_FIPS); }
87
88 static void fips_set_mode(int onoff)
89         {
90         int owning_thread = fips_is_owning_thread();
91
92         if (fips_started)
93                 {
94                 if (!owning_thread) fips_w_lock();
95                 fips_mode = onoff;
96                 if (!owning_thread) fips_w_unlock();
97                 }
98         }
99
100 static void fips_set_rand_check(const void *rand_check)
101         {
102         int owning_thread = fips_is_owning_thread();
103
104         if (fips_started)
105                 {
106                 if (!owning_thread) fips_w_lock();
107                 fips_rand_check = rand_check;
108                 if (!owning_thread) fips_w_unlock();
109                 }
110         }
111
112 int FIPS_mode(void)
113         {
114         int ret = 0;
115         int owning_thread = fips_is_owning_thread();
116
117         if (fips_started)
118                 {
119                 if (!owning_thread) fips_r_lock();
120                 ret = fips_mode;
121                 if (!owning_thread) fips_r_unlock();
122                 }
123         return ret;
124         }
125
126 const void *FIPS_rand_check(void)
127         {
128         const void *ret = 0;
129         int owning_thread = fips_is_owning_thread();
130
131         if (fips_started)
132                 {
133                 if (!owning_thread) fips_r_lock();
134                 ret = fips_rand_check;
135                 if (!owning_thread) fips_r_unlock();
136                 }
137         return ret;
138         }
139
140 int FIPS_selftest_failed(void)
141     {
142     int ret = 0;
143     if (fips_started)
144         {
145         int owning_thread = fips_is_owning_thread();
146
147         if (!owning_thread) fips_r_lock();
148         ret = fips_selftest_fail;
149         if (!owning_thread) fips_r_unlock();
150         }
151     return ret;
152     }
153
154 /* Selftest failure fatal exit routine. This will be called
155  * during *any* cryptographic operation. It has the minimum
156  * overhead possible to avoid too big a performance hit.
157  */
158
159 void FIPS_selftest_check(void)
160     {
161     if (fips_selftest_fail)
162         {
163         OpenSSLDie(__FILE__,__LINE__, "FATAL FIPS SELFTEST FAILURE");
164         }
165     }
166
167 void fips_set_selftest_fail(void)
168     {
169     fips_selftest_fail = 1;
170     }
171
172 int FIPS_selftest(void)
173     {
174
175     return FIPS_selftest_sha1()
176         && FIPS_selftest_hmac()
177         && FIPS_selftest_aes()
178         && FIPS_selftest_aes_gcm()
179         && FIPS_selftest_des()
180         && FIPS_selftest_rsa()
181         && FIPS_selftest_dsa();
182     }
183
184 extern const void         *FIPS_text_start(),  *FIPS_text_end();
185 extern const unsigned char FIPS_rodata_start[], FIPS_rodata_end[];
186 unsigned char              FIPS_signature [20] = { 0 };
187 static const char          FIPS_hmac_key[]="etaonrishdlcupfm";
188
189 unsigned int FIPS_incore_fingerprint(unsigned char *sig,unsigned int len)
190     {
191     const unsigned char *p1 = FIPS_text_start();
192     const unsigned char *p2 = FIPS_text_end();
193     const unsigned char *p3 = FIPS_rodata_start;
194     const unsigned char *p4 = FIPS_rodata_end;
195     HMAC_CTX c;
196
197     HMAC_CTX_init(&c);
198     HMAC_Init(&c,FIPS_hmac_key,strlen(FIPS_hmac_key),EVP_sha1());
199
200     /* detect overlapping regions */
201     if (p1<=p3 && p2>=p3)
202         p3=p1, p4=p2>p4?p2:p4, p1=NULL, p2=NULL;
203     else if (p3<=p1 && p4>=p1)
204         p3=p3, p4=p2>p4?p2:p4, p1=NULL, p2=NULL;
205
206     if (p1)
207         HMAC_Update(&c,p1,(size_t)p2-(size_t)p1);
208
209     if (FIPS_signature>=p3 && FIPS_signature<p4)
210         {
211         /* "punch" hole */
212         HMAC_Update(&c,p3,(size_t)FIPS_signature-(size_t)p3);
213         p3 = FIPS_signature+sizeof(FIPS_signature);
214         if (p3<p4)
215             HMAC_Update(&c,p3,(size_t)p4-(size_t)p3);
216         }
217     else
218         HMAC_Update(&c,p3,(size_t)p4-(size_t)p3);
219
220     HMAC_Final(&c,sig,&len);
221     HMAC_CTX_cleanup(&c);
222
223     return len;
224     }
225
226 int FIPS_check_incore_fingerprint(void)
227     {
228     unsigned char sig[EVP_MAX_MD_SIZE];
229     unsigned int len;
230 #if defined(__sgi) && (defined(__mips) || defined(mips))
231     extern int __dso_displacement[];
232 #else
233     extern int OPENSSL_NONPIC_relocated;
234 #endif
235
236     if (FIPS_text_start()==NULL)
237         {
238         FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,FIPS_R_UNSUPPORTED_PLATFORM);
239         return 0;
240         }
241
242     len=FIPS_incore_fingerprint (sig,sizeof(sig));
243
244     if (len!=sizeof(FIPS_signature) ||
245         memcmp(FIPS_signature,sig,sizeof(FIPS_signature)))
246         {
247         if (FIPS_signature>=FIPS_rodata_start && FIPS_signature<FIPS_rodata_end)
248             FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,FIPS_R_FINGERPRINT_DOES_NOT_MATCH_SEGMENT_ALIASING);
249 #if defined(__sgi) && (defined(__mips) || defined(mips))
250         else if (__dso_displacement!=NULL)
251 #else
252         else if (OPENSSL_NONPIC_relocated)
253 #endif
254             FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,FIPS_R_FINGERPRINT_DOES_NOT_MATCH_NONPIC_RELOCATED);
255         else
256             FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
257 #ifdef OPENSSL_FIPS_DEBUGGER
258         return 1;
259 #else
260         return 0;
261 #endif
262         }
263     return 1;
264     }
265
266 int FIPS_mode_set(int onoff)
267     {
268     int fips_set_owning_thread();
269     int fips_clear_owning_thread();
270     int ret = 0;
271
272     fips_w_lock();
273     fips_started = 1;
274     fips_set_owning_thread();
275
276     if(onoff)
277         {
278         unsigned char buf[48];
279
280         fips_selftest_fail = 0;
281
282         /* Don't go into FIPS mode twice, just so we can do automagic
283            seeding */
284         if(FIPS_mode())
285             {
286             FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_FIPS_MODE_ALREADY_SET);
287             fips_selftest_fail = 1;
288             ret = 0;
289             goto end;
290             }
291
292 #ifdef OPENSSL_IA32_SSE2
293         if ((OPENSSL_ia32cap & (1<<25|1<<26)) != (1<<25|1<<26))
294             {
295             FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_UNSUPPORTED_PLATFORM);
296             fips_selftest_fail = 1;
297             ret = 0;
298             goto end;
299             }
300 #endif
301
302         if(fips_signature_witness() != FIPS_signature)
303             {
304             FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_CONTRADICTING_EVIDENCE);
305             fips_selftest_fail = 1;
306             ret = 0;
307             goto end;
308             }
309
310         if(!FIPS_check_incore_fingerprint())
311             {
312             fips_selftest_fail = 1;
313             ret = 0;
314             goto end;
315             }
316
317         /* Perform RNG KAT before seeding */
318         if (!FIPS_selftest_rng())
319             {
320             fips_selftest_fail = 1;
321             ret = 0;
322             goto end;
323             }
324
325         /* automagically seed PRNG if not already seeded */
326         if(!FIPS_rand_status())
327             {
328             if(RAND_bytes(buf,sizeof buf) <= 0)
329                 {
330                 fips_selftest_fail = 1;
331                 ret = 0;
332                 goto end;
333                 }
334             FIPS_rand_set_key(buf,32);
335             FIPS_rand_seed(buf+32,16);
336             }
337
338         /* now switch into FIPS mode */
339         fips_set_rand_check(FIPS_rand_method());
340         RAND_set_rand_method(FIPS_rand_method());
341         if(FIPS_selftest())
342             fips_set_mode(1);
343         else
344             {
345             fips_selftest_fail = 1;
346             ret = 0;
347             goto end;
348             }
349         ret = 1;
350         goto end;
351         }
352     fips_set_mode(0);
353     fips_selftest_fail = 0;
354     ret = 1;
355 end:
356     fips_clear_owning_thread();
357     fips_w_unlock();
358     return ret;
359     }
360
361 static CRYPTO_THREADID fips_thread;
362 static int fips_thread_set = 0;
363
364 static int fips_is_owning_thread(void)
365         {
366         int ret = 0;
367
368         if (fips_started)
369                 {
370                 CRYPTO_r_lock(CRYPTO_LOCK_FIPS2);
371                 if (fips_thread_set)
372                         {
373                         CRYPTO_THREADID cur;
374                         CRYPTO_THREADID_current(&cur);
375                         if (!CRYPTO_THREADID_cmp(&cur, &fips_thread))
376                                 ret = 1;
377                         }
378                 CRYPTO_r_unlock(CRYPTO_LOCK_FIPS2);
379                 }
380         return ret;
381         }
382
383 int fips_set_owning_thread(void)
384         {
385         int ret = 0;
386
387         if (fips_started)
388                 {
389                 CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
390                 if (!fips_thread_set)
391                         {
392                         CRYPTO_THREADID_current(&fips_thread);
393                         ret = 1;
394                         }
395                 CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
396                 }
397         return ret;
398         }
399
400 int fips_clear_owning_thread(void)
401         {
402         int ret = 0;
403
404         if (fips_started)
405                 {
406                 CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
407                 if (fips_thread_set)
408                         {
409                         CRYPTO_THREADID cur;
410                         CRYPTO_THREADID_current(&cur);
411                         if (!CRYPTO_THREADID_cmp(&cur, &fips_thread))
412                                 fips_thread_set = 0;
413                         }
414                 CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
415                 }
416         return ret;
417         }
418
419 unsigned char *fips_signature_witness(void)
420         {
421         extern unsigned char FIPS_signature[];
422         return FIPS_signature;
423         }
424
425 /* Generalized public key test routine. Signs and verifies the data
426  * supplied in tbs using mesage digest md and setting RSA padding mode
427  * pad_mode. If the 'kat' parameter is not NULL it will
428  * additionally check the signature matches it: a known answer test
429  * The string "fail_str" is used for identification purposes in case
430  * of failure.
431  */
432
433 int fips_pkey_signature_test(EVP_PKEY *pkey,
434                         const unsigned char *tbs, int tbslen,
435                         const unsigned char *kat, unsigned int katlen,
436                         const EVP_MD *digest, int pad_mode,
437                         const char *fail_str)
438         {       
439         int ret = 0;
440         unsigned char sigtmp[256], *sig = sigtmp;
441         unsigned int siglen;
442         DSA_SIG *dsig = NULL;
443         ECDSA_SIG *esig = NULL;
444         EVP_MD_CTX mctx;
445         FIPS_md_ctx_init(&mctx);
446
447         if ((pkey->type == EVP_PKEY_RSA)
448                 && ((size_t)RSA_size(pkey->pkey.rsa) > sizeof(sigtmp)))
449                 {
450                 sig = OPENSSL_malloc(RSA_size(pkey->pkey.rsa));
451                 if (!sig)
452                         {
453                         FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST,ERR_R_MALLOC_FAILURE);
454                         return 0;
455                         }
456                 }
457
458         if (tbslen == -1)
459                 tbslen = strlen((char *)tbs);
460
461         if (digest == NULL)
462                 digest = EVP_sha256();
463
464         if (!FIPS_digestinit(&mctx, digest))
465                 goto error;
466         if (!FIPS_digestupdate(&mctx, tbs, tbslen))
467                 goto error;
468         if (pkey->type == EVP_PKEY_RSA)
469                 {
470                 if (!FIPS_rsa_sign_ctx(pkey->pkey.rsa, &mctx,
471                                         pad_mode, 0, NULL, sig, &siglen))
472                         goto error;
473                 }
474         else if (pkey->type == EVP_PKEY_DSA)
475                 {
476                 dsig = FIPS_dsa_sign_ctx(pkey->pkey.dsa, &mctx);
477                 if (!dsig)
478                         goto error;
479                 }
480         else if (pkey->type == EVP_PKEY_EC)
481                 {
482                 esig = FIPS_ecdsa_sign_ctx(pkey->pkey.ec, &mctx);
483                 if (!esig)
484                         goto error;
485                 }
486 #if 0
487         else if (!EVP_SignFinal(&mctx, sig, &siglen, pkey))
488                 goto error;
489 #endif
490
491         if (kat && ((siglen != katlen) || memcmp(kat, sig, katlen)))
492                 goto error;
493
494         if (!FIPS_digestinit(&mctx, digest))
495                 goto error;
496         if (!FIPS_digestupdate(&mctx, tbs, tbslen))
497                 goto error;
498         if (pkey->type == EVP_PKEY_RSA)
499                 {
500                 ret = FIPS_rsa_verify_ctx(pkey->pkey.rsa, &mctx,
501                                                 pad_mode, 0, NULL, sig, siglen);
502                 }
503         else if (pkey->type == EVP_PKEY_DSA)
504                 {
505                 ret = FIPS_dsa_verify_ctx(pkey->pkey.dsa, &mctx, dsig);
506                 }
507         else if (pkey->type == EVP_PKEY_EC)
508                 {
509                 ret = FIPS_ecdsa_verify_ctx(pkey->pkey.ec, &mctx, esig);
510                 }
511 #if 0
512         else
513                 ret = EVP_VerifyFinal(&mctx, sig, siglen, pkey);
514 #endif
515
516         error:
517         if (dsig != NULL)
518                 FIPS_dsa_sig_free(dsig);
519         if (esig != NULL)
520                 FIPS_ecdsa_sig_free(esig);
521         if (sig != sigtmp)
522                 OPENSSL_free(sig);
523         FIPS_md_ctx_cleanup(&mctx);
524         if (ret != 1)
525                 {
526                 FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST,FIPS_R_TEST_FAILURE);
527                 if (fail_str)
528                         FIPS_add_error_data(2, "Type=", fail_str);
529                 return 0;
530                 }
531         return 1;
532         }
533
534 /* Generalized symmetric cipher test routine. Encrypt data, verify result
535  * against known answer, decrypt and compare with original plaintext.
536  */
537
538 int fips_cipher_test(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
539                         const unsigned char *key,
540                         const unsigned char *iv,
541                         const unsigned char *plaintext,
542                         const unsigned char *ciphertext,
543                         int len)
544         {
545         unsigned char pltmp[FIPS_MAX_CIPHER_TEST_SIZE];
546         unsigned char citmp[FIPS_MAX_CIPHER_TEST_SIZE];
547         OPENSSL_assert(len <= FIPS_MAX_CIPHER_TEST_SIZE);
548         if (FIPS_cipherinit(ctx, cipher, key, iv, 1) <= 0)
549                 return 0;
550         FIPS_cipher(ctx, citmp, plaintext, len);
551         if (memcmp(citmp, ciphertext, len))
552                 return 0;
553         if (FIPS_cipherinit(ctx, cipher, key, iv, 0) <= 0)
554                 return 0;
555         FIPS_cipher(ctx, pltmp, citmp, len);
556         if (memcmp(pltmp, plaintext, len))
557                 return 0;
558         return 1;
559         }
560
561 #if 0
562 /* The purpose of this is to ensure the error code exists and the function
563  * name is to keep the error checking script quiet
564  */
565 void hash_final(void)
566         {
567         FIPSerr(FIPS_F_HASH_FINAL,FIPS_R_NON_FIPS_METHOD);
568         }
569 #endif
570
571
572 #endif