fips.c
/* ====================================================================
* Copyright (c) 2003 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include <openssl/rand.h>
#include <openssl/fips_rand.h>
#include <openssl/err.h>
#include <openssl/bio.h>
#include <openssl/hmac.h>
#include <openssl/rsa.h>
#include <string.h>
#include <limits.h>
#include "fips_locl.h"
#ifdef OPENSSL_FIPS
# include <openssl/fips.h>
# ifndef PATH_MAX
# define PATH_MAX 1024
# endif
static int fips_selftest_fail;
static int fips_mode;
static const void *fips_rand_check;
static void fips_set_mode(int onoff)
{
int owning_thread = fips_is_owning_thread();
if (fips_is_started()) {
if (!owning_thread)
fips_w_lock();
fips_mode = onoff;
if (!owning_thread)
fips_w_unlock();
}
}
static void fips_set_rand_check(const void *rand_check)
{
int owning_thread = fips_is_owning_thread();
if (fips_is_started()) {
if (!owning_thread)
fips_w_lock();
fips_rand_check = rand_check;
if (!owning_thread)
fips_w_unlock();
}
}
int FIPS_mode(void)
{
int ret = 0;
int owning_thread = fips_is_owning_thread();
if (fips_is_started()) {
if (!owning_thread)
fips_r_lock();
ret = fips_mode;
if (!owning_thread)
fips_r_unlock();
}
return ret;
}
const void *FIPS_rand_check(void)
{
const void *ret = 0;
int owning_thread = fips_is_owning_thread();
if (fips_is_started()) {
if (!owning_thread)
fips_r_lock();
ret = fips_rand_check;
if (!owning_thread)
fips_r_unlock();
}
return ret;
}
int FIPS_selftest_failed(void)
{
int ret = 0;
if (fips_is_started()) {
int owning_thread = fips_is_owning_thread();
if (!owning_thread)
fips_r_lock();
ret = fips_selftest_fail;
if (!owning_thread)
fips_r_unlock();
}
return ret;
}
/*
* Selftest failure fatal exit routine. This will be called during *any*
* cryptographic operation. It has the minimum overhead possible to avoid too
* big a performance hit.
*/
void FIPS_selftest_check(void)
{
if (fips_selftest_fail) {
OpenSSLDie(__FILE__, __LINE__, "FATAL FIPS SELFTEST FAILURE");
}
}
void fips_set_selftest_fail(void)
{
fips_selftest_fail = 1;
}
int FIPS_selftest()
{
return FIPS_selftest_sha1()
&& FIPS_selftest_hmac()
&& FIPS_selftest_aes()
&& FIPS_selftest_des()
&& FIPS_selftest_rsa()
&& FIPS_selftest_dsa();
}
extern const void *FIPS_text_start(), *FIPS_text_end();
extern const unsigned char FIPS_rodata_start[], FIPS_rodata_end[];
unsigned char FIPS_signature[20] = { 0 };
static const char FIPS_hmac_key[] = "etaonrishdlcupfm";
unsigned int FIPS_incore_fingerprint(unsigned char *sig, unsigned int len)
{
const unsigned char *p1 = FIPS_text_start();
const unsigned char *p2 = FIPS_text_end();
const unsigned char *p3 = FIPS_rodata_start;
const unsigned char *p4 = FIPS_rodata_end;
HMAC_CTX c;
HMAC_CTX_init(&c);
HMAC_Init(&c, FIPS_hmac_key, strlen(FIPS_hmac_key), EVP_sha1());
/* detect overlapping regions */
if (p1 <= p3 && p2 >= p3)
p3 = p1, p4 = p2 > p4 ? p2 : p4, p1 = NULL, p2 = NULL;
else if (p3 <= p1 && p4 >= p1)
p3 = p3, p4 = p2 > p4 ? p2 : p4, p1 = NULL, p2 = NULL;
if (p1)
HMAC_Update(&c, p1, (size_t)p2 - (size_t)p1);
if (FIPS_signature >= p3 && FIPS_signature < p4) {
/* "punch" hole */
HMAC_Update(&c, p3, (size_t)FIPS_signature - (size_t)p3);
p3 = FIPS_signature + sizeof(FIPS_signature);
if (p3 < p4)
HMAC_Update(&c, p3, (size_t)p4 - (size_t)p3);
} else
HMAC_Update(&c, p3, (size_t)p4 - (size_t)p3);
HMAC_Final(&c, sig, &len);
HMAC_CTX_cleanup(&c);
return len;
}
int FIPS_check_incore_fingerprint(void)
{
unsigned char sig[EVP_MAX_MD_SIZE];
unsigned int len;
# if defined(__sgi) && (defined(__mips) || defined(mips))
extern int __dso_displacement[];
# else
extern int OPENSSL_NONPIC_relocated;
# endif
if (FIPS_text_start() == NULL) {
FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
FIPS_R_UNSUPPORTED_PLATFORM);
return 0;
}
len = FIPS_incore_fingerprint(sig, sizeof(sig));
if (len != sizeof(FIPS_signature) ||
memcmp(FIPS_signature, sig, sizeof(FIPS_signature))) {
if (FIPS_signature >= FIPS_rodata_start
&& FIPS_signature < FIPS_rodata_end)
FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
FIPS_R_FINGERPRINT_DOES_NOT_MATCH_SEGMENT_ALIASING);
# if defined(__sgi) && (defined(__mips) || defined(mips))
else if (__dso_displacement != NULL)
# else
else if (OPENSSL_NONPIC_relocated)
# endif
FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
FIPS_R_FINGERPRINT_DOES_NOT_MATCH_NONPIC_RELOCATED);
else
FIPSerr(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT,
FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
return 0;
}
return 1;
}
int FIPS_mode_set(int onoff)
{
int fips_set_owning_thread();
int fips_clear_owning_thread();
int ret = 0;
fips_w_lock();
fips_set_started();
fips_set_owning_thread();
if (onoff) {
unsigned char buf[48];
fips_selftest_fail = 0;
/*
* Don't go into FIPS mode twice, just so we can do automagic seeding
*/
if (FIPS_mode()) {
FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_FIPS_MODE_ALREADY_SET);
fips_selftest_fail = 1;
ret = 0;
goto end;
}
# ifdef OPENSSL_IA32_SSE2
if ((OPENSSL_ia32cap & (1 << 25 | 1 << 26)) != (1 << 25 | 1 << 26)) {
FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_UNSUPPORTED_PLATFORM);
fips_selftest_fail = 1;
ret = 0;
goto end;
}
# endif
if (fips_signature_witness() != FIPS_signature) {
FIPSerr(FIPS_F_FIPS_MODE_SET, FIPS_R_CONTRADICTING_EVIDENCE);
fips_selftest_fail = 1;
ret = 0;
goto end;
}
if (!FIPS_check_incore_fingerprint()) {
fips_selftest_fail = 1;
ret = 0;
goto end;
}
/* Perform RNG KAT before seeding */
if (!FIPS_selftest_rng()) {
fips_selftest_fail = 1;
ret = 0;
goto end;
}
/* automagically seed PRNG if not already seeded */
if (!FIPS_rand_status()) {
if (RAND_bytes(buf, sizeof buf) <= 0) {
fips_selftest_fail = 1;
ret = 0;
goto end;
}
FIPS_rand_set_key(buf, 32);
FIPS_rand_seed(buf + 32, 16);
}
/* now switch into FIPS mode */
fips_set_rand_check(FIPS_rand_method());
RAND_set_rand_method(FIPS_rand_method());
if (FIPS_selftest())
fips_set_mode(1);
else {
fips_selftest_fail = 1;
ret = 0;
goto end;
}
ret = 1;
goto end;
}
fips_set_mode(0);
fips_selftest_fail = 0;
ret = 1;
end:
fips_clear_owning_thread();
fips_w_unlock();
return ret;
}
void fips_w_lock(void)
{
CRYPTO_w_lock(CRYPTO_LOCK_FIPS);
}
void fips_w_unlock(void)
{
CRYPTO_w_unlock(CRYPTO_LOCK_FIPS);
}
void fips_r_lock(void)
{
CRYPTO_r_lock(CRYPTO_LOCK_FIPS);
}
void fips_r_unlock(void)
{
CRYPTO_r_unlock(CRYPTO_LOCK_FIPS);
}
static int fips_started = 0;
static unsigned long fips_thread = 0;
void fips_set_started(void)
{
fips_started = 1;
}
int fips_is_started(void)
{
return fips_started;
}
int fips_is_owning_thread(void)
{
int ret = 0;
if (fips_is_started()) {
CRYPTO_r_lock(CRYPTO_LOCK_FIPS2);
if (fips_thread != 0 && fips_thread == CRYPTO_thread_id())
ret = 1;
CRYPTO_r_unlock(CRYPTO_LOCK_FIPS2);
}
return ret;
}
int fips_set_owning_thread(void)
{
int ret = 0;
if (fips_is_started()) {
CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
if (fips_thread == 0) {
fips_thread = CRYPTO_thread_id();
ret = 1;
}
CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
}
return ret;
}
int fips_clear_owning_thread(void)
{
int ret = 0;
if (fips_is_started()) {
CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
if (fips_thread == CRYPTO_thread_id()) {
fips_thread = 0;
ret = 1;
}
CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
}
return ret;
}
unsigned char *fips_signature_witness(void)
{
extern unsigned char FIPS_signature[];
return FIPS_signature;
}
/*
* Generalized public key test routine. Signs and verifies the data supplied
* in tbs using mesage digest md and setting option digest flags md_flags. If
* the 'kat' parameter is not NULL it will additionally check the signature
* matches it: a known answer test The string "fail_str" is used for
* identification purposes in case of failure.
*/
int fips_pkey_signature_test(EVP_PKEY *pkey,
const unsigned char *tbs, int tbslen,
const unsigned char *kat, unsigned int katlen,
const EVP_MD *digest, unsigned int md_flags,
const char *fail_str)
{
int ret = 0;
unsigned char sigtmp[256], *sig = sigtmp;
unsigned int siglen;
EVP_MD_CTX mctx;
EVP_MD_CTX_init(&mctx);
if ((pkey->type == EVP_PKEY_RSA)
&& (RSA_size(pkey->pkey.rsa) > sizeof(sigtmp))) {
sig = OPENSSL_malloc(RSA_size(pkey->pkey.rsa));
if (!sig) {
FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, ERR_R_MALLOC_FAILURE);
return 0;
}
}
if (tbslen == -1)
tbslen = strlen((char *)tbs);
if (md_flags)
M_EVP_MD_CTX_set_flags(&mctx, md_flags);
if (!EVP_SignInit_ex(&mctx, digest, NULL))
goto error;
if (!EVP_SignUpdate(&mctx, tbs, tbslen))
goto error;
if (!EVP_SignFinal(&mctx, sig, &siglen, pkey))
goto error;
if (kat && ((siglen != katlen) || memcmp(kat, sig, katlen)))
goto error;
if (!EVP_VerifyInit_ex(&mctx, digest, NULL))
goto error;
if (!EVP_VerifyUpdate(&mctx, tbs, tbslen))
goto error;
ret = EVP_VerifyFinal(&mctx, sig, siglen, pkey);
error:
if (sig != sigtmp)
OPENSSL_free(sig);
EVP_MD_CTX_cleanup(&mctx);
if (ret != 1) {
FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, FIPS_R_TEST_FAILURE);
if (fail_str)
ERR_add_error_data(2, "Type=", fail_str);
return 0;
}
return 1;
}
/*
* Generalized symmetric cipher test routine. Encrypt data, verify result
* against known answer, decrypt and compare with original plaintext.
*/
int fips_cipher_test(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
const unsigned char *key,
const unsigned char *iv,
const unsigned char *plaintext,
const unsigned char *ciphertext, int len)
{
unsigned char pltmp[FIPS_MAX_CIPHER_TEST_SIZE];
unsigned char citmp[FIPS_MAX_CIPHER_TEST_SIZE];
OPENSSL_assert(len <= FIPS_MAX_CIPHER_TEST_SIZE);
if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1) <= 0)
return 0;
EVP_Cipher(ctx, citmp, plaintext, len);
if (memcmp(citmp, ciphertext, len))
return 0;
if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0) <= 0)
return 0;
EVP_Cipher(ctx, pltmp, citmp, len);
if (memcmp(pltmp, plaintext, len))
return 0;
return 1;
}
# if 0
/*
* The purpose of this is to ensure the error code exists and the function
* name is to keep the error checking script quiet
*/
void hash_final(void)
{
FIPSerr(FIPS_F_HASH_FINAL, FIPS_R_NON_FIPS_METHOD);
}
# endif
#endif
