about FIPS-140 enabling

[jyao1]

Ref: #1260

Ref: https://icmconference.org/wp-content/uploads/C22b-RuanX.pdf

background

openssl

• Openssl 3.0 info
  https://www.openssl.org/docs/fips.html
  https://www.openssl.org/docs/man3.0/man7/fips_module.html

• Legacy Openssl 1.1 info
  https://beta.openssl.org/docs/fips.html
  https://beta.openssl.org/docs/fips/UserGuide-2.0.pdf

• NIST doc
  https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4282.pdf

• API
  https://github.com/openssl/openssl/blob/OpenSSL-fips-2_0-stable/fips/fips.h

unsigned long FIPS_module_version(void);
const char *FIPS_module_version_text(void);

int FIPS_module_mode_set(int onoff, const char *auth);
int FIPS_module_mode(void);

int FIPS_selftest(void);
int FIPS_selftest_failed(void);

mbedtls

• info
  https://mbed-tls.readthedocs.io/en/latest/kb/generic/is-mbedtls-fips-certified/
  FIPS 140-2 certification Mbed-TLS/mbedtls#5995

wolfssl

• info
  https://www.wolfssl.com/license/fips/
  https://www.wolfssl.com/docs/fips-ready-user-guide/

• NIST doc
  https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3389.pdf

• API
  wolfssl-5.5.3-gplv3-fips-ready\wolfssl\wolfcrypt\fips.h

WOLFSSL_API const char* wolfCrypt_GetVersion_fips(void);
WOLFSSL_API int wolfCrypt_IntegrityTest_fips(void);

WOLFSSL_API int wolfCrypt_GetStatus_fips(void);

TPM

• info
  https://trustedcomputinggroup.org/resource/tcg-fips-140-2-guidance-for-tpm-2-0/

proposal

Design

• Cryptographic Algorithm Self-Test

Reference:
[1] Implementation Guide: https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
[2] Cryptographic Algorithm Validation Program (CAVP): https://csrc.nist.gov/Projects/cryptographic-algorithm-validation-program
[3] Cryptographic Module Validation Program (CMVP): https://csrc.nist.gov/Projects/cryptographic-module-validation-program
[4] CMVP Approved Security Functions: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Cr1.pdf
[5] CMVP Approved Sensitive Security Parameter Generation and Establishment Methods: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Dr1.pdf
[6] Cryptographic Standards and Guidelines (Examples with Intermediate Values): https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values

SPDM Algorithm	Specification	Type	Test Attributes
SHA-256/384/512	NIST.FIPS.180-4	KAT	SHA-256/384/512
SHA3-256/384/512	NIST.FIPS.202	KAT	SHA3-256/384/512
RSA-SSA	NIST.FIPS.186-5, rfc8017	KAT	RSA-SSA2048 + SHA256
RSA-PSS	NIST.FIPS.186-5, rfc8017	KAT	RSA-PSS2048 + SHA256
ECDSA	NIST.FIPS.186-5, NIST.SP.800-186	KAT	ECDSA-P256+SHA256
EdDSA	NIST.FIPS.186-5, NIST.SP.800-186, rfc8032	KAT	EdDSA-25519,EdDSA-448
HMAC	NIST.FIPS.198-1, rfc2104	KAT	HMAC-SHA-256/384/512
AES-GCM	NIST.FIPS.197, NIST.SP.800-38D	KAT	AES-GCM-256
FFDHE	NIST.SP.800-56Ar3, rfc7919	PCT	FFDHE-2048
ECDHE	NIST.SP.800-56Ar3, rfc8446	KAT	ECDHE-P256
HKDF	NIST.SP.800-56Cr2, rfc5869	KAT	HKDF-HMAC-SHA-256
ChaCha-Poly (*)	rfc8439	KAT	not FIPS approved yet
SM3 (*)	GB/T 32905-2016, ISO/IEC 10118-3:2018	KAT	not FIPS approved yet
SM4-GCM (*)	GB/T 32907-2016, ISO/IEC 18033-3:2010/Amd 1:2021, rfc8998	KAT	not FIPS approved yet
SM2-digital-signature (*) SM2-key-exchange (*)	GB/T 32918.1-2016, GB/T 32918.2-2016, GB/T 32918.3-2016, GB/T 32918.4-2016, GB/T 32918.5-2016, ISO/IEC 14888-3:2018	KAT	not FIPS approved yet
SPDM-Key-Schedule (*)	DMTF-DSP0274	KAT	not FIPS approved yet

It maybe Known Answer Test (KAT) or Pairwise Consistency Test (PCT).

The Test Vector (KAT) can be found at [2] and [6].

• Software Integrity Self-Test

It uses HMAC-SHA-256, TBD.

Implementation

• libspdm_lib_config macro

#ifdef LIBSPDM_FIPS_MODE
#define LIBSPDM_SM2_DSA_SUPPORT 0
#define LIBSPDM_EDDSA_ED25519_SUPPORT 0
#define LIBSPDM_EDDSA_ED448_SUPPORT 0
#define LIBSPDM_SM2_KEY_EXCHANGE_SUPPORT 0
#define LIBSPDM_AEAD_CHACHA20_POLY1305_SUPPORT 0
#define LIBSPDM_AEAD_SM4_SUPPORT 0
#define LIBSPDM_SM3_256_SUPPORT 0
#endif

• libspdm_common_lib API

#ifdef LIBSPDM_FIPS_MODE
const char* libspdm_get_module_version(void);
#endif

• libspdm_crypt_lib API

#ifdef LIBSPDM_FIPS_MODE
const char* libspdm_fips_get_module_version(void);
int libspdm_fips_run_selftest(void);
int libspdm_fips_get_selftest_result(void);
#endif

• libspdm_crypt_lib internal API

#ifdef LIBSPDM_FIPS_MODE
int libspdm_fips_module_integrity_test(void); // TBD

// sym
int libspdm_fips_selftest_sha2(void);
int libspdm_fips_selftest_sha3(void);
int libspdm_fips_selftest_hmac(void);
int libspdm_fips_selftest_hkdf(void);
int libspdm_fips_selftest_aes_gcm(void);

// asym digital signing (deterministic)
int libspdm_fips_selftest_rsa_ssa(void);
int libspdm_fips_selftest_eddsa(void);

// asym key exchange
int libspdm_fips_selftest_ffdhe(void);
int libspdm_fips_selftest_ecdhe(void);

// asym digital signing (probabilistic) - need hardcode random salt
int libspdm_fips_selftest_rsa_pss(void);
int libspdm_fips_selftest_ecdsa(void);

#endif

[xiaoyuruan]

• Need to add HMAC-SHA-512 KAT.
• Use some other mode for AES KAT, maybe AES-CBC-256.
• NIST PUB186-4 has RSASSA-PKCS1 v1.5 or RSASSA-PSS. What does "RSA SSA" refer to?
• FIPS requires KAT on only one of RSASSA-PKCS1 v1.5 and RSASSA-PSS (both can still be performed; doesn't harm).
• FIPS does not require SPDM-Key-Schedule KAT (it can still be performed; doesn't harm).
• For ECDSA KAT and RSASSA-PSS KAT: hardcode random salt; check signature against hardcoded known answer too (not just sign then verify)

[jyao1]

"RSA SSA" in SPDM spec means "RSASSA-PKCS1 v1.5".

[jyao1]

Discussed with Xiaoyu, we are thinking to introduce another MACRO - LIBSPDM_FIPS_TEST_AT_LOAD for selftest.

1. If LIBSPDM_FIPS_TEST_AT_LOAD, then libspdm runs libspdm_fips_run_selftest() at load time.
2. If !LIBSPDM_FIPS_TEST_AT_LOAD, then libspdm runs individual libspdm_fips_selftest_xxx() when algo XXX is called and libspdm_fips_selftest_xxx() is not runs before.
3. The integrator can always call libspdm_fips_run_selftest() at any time, regardless LIBSPDM_FIPS_TEST_AT_LOAD value.

[jyao1]

Status summary:

1. FIPS SKU

• Add FIPS 140-3 config for libspdm - Add FIPS 140-3 config for libspdm #1576

2. zero key

• Zero private key before free for FIPS - Zero private key before free for FIPS #1606
• Zero key for FIPS when encode and decode - Zero key for FIPS #1590

3. Only approved algorithms

• Make only approved algo when in FIPS mode - Make only approved algo when in FIPS mode #1577
• Add check for FIPS approved algo - Add more check for supported algorithm #1581

4. module_id API

• Add fips_module_id api - Add fips_module_id api #1623

5. run_selftests API

• Add aes_gcm selftest - Add FIPS selftest and get_result_selftest #1647
• Add rsa_ssa selftest - Add FIPS selftest and get_result_selftest #1647
• Add hmac self_test - Add FIPS selftest and get_result_selftest #1647
• Add hkdf self_test - Add hkdf self_test #1678
• Add ecdh self_test - Add ecdh self_test #1679
• Add sha2 self_test - Add sha2 self_test #1680
• Add sha3 self_test - Add sha3 self_test #1687
• Add ffdh self_test - Add ffdh self_test #1695
• Add ecdsa self_test - Add ecdsa self_test #1681
• Add eddsa self_test - Add eddsa fips #1803
• Add rsa_pss self_test - Add RSAPSS FIPS test with KAT #2277

6. run selftest_results

• Add FIPS selftest and get_result_selftest - Add FIPS selftest and get_result_selftest #1647

7. integrity selftest.

• Defer

8. pre-operational selftest.

• libspdm_fips_run_selftest - Add feature to run libspdm_fips_run_selftest at load time #1833
• FIPS selftest refactor -FIPS selftest refactor #1974