fips_crypto_tests.c

// Copyright 2018 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include "fips_err.h"
#include "u2f_corp.h"
#include "fips.h"
#include "fips_aes.h"
#include "sha256.h"
#include "p256_ecdsa.h"
#include "cmac.h"
#include "fips_crypto_tests.h"
#include "console.h"

/* Fixed values for ECDSA FIPS testing. These are exposed externally
 * for the sake of FIPS initialization in fips.c.
 *
 * Generated with the same inputs as HMAC-DRBG's KAT
 * DRBG_init(entropy0, nonce0, perso0)
 * DRBG_reseed(entropy1, addtl_input1)
 * DRBG_generate()
 * DRBG_reseed(entropy2, addtl_input2)
 * DRBG_generate()
 * fips_p256_pick(drbg_ctx)
 */
p256_int fixed_d = {{0x2AD5EEBB, 0x15E31174, 0x8C21CBFA, 0xB59773BD,
                     0x3E296192, 0x5FF3F73E, 0x01DF7E79, 0x947F8898}};

/* SHA256 H("Google Google Google"). No terminating Null. */
p256_int test_msg = {{0x9fda1d90, 0x9c73eca1, 0x9e7365e3, 0xeaf6c93f,
                      0x6d476c9a, 0x16c80d3c, 0xf8bca31f, 0x4600f657}};

/* Fixed random parameter k for KAT. Generated by running DRBG */
/* Generate() a 3rd time after the same sequence as the DRBG KAT. */
p256_int fixed_k = {{0xCCF7C3FD, 0xB53EF2AB, 0x7B5F036E, 0x58431BE9,
                     0x58F59D47, 0x87CBC945, 0xCE54555E, 0x520D2764}};

p256_int fixed_r = {{0x90b3bc00, 0xf92caa14, 0xfa9c9747, 0x72ef4d27,
                     0xf1c79a10, 0x613af428, 0x012e1484, 0xc145c17b}};
p256_int fixed_s = {{0x6b9e4254, 0x799c70af, 0xc89e8923, 0x0d225f87,
                     0x30d64b8a, 0x25b9c485, 0x05034354, 0x61aa46e7}};

/* DRBG KAT taken from
 * http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgtestvectors.zip
 * on 6/1/2017.
 * Specific test vectors are:
 * [SHA-256]
 * [PredictionResistance = True]
 * [EntropyInputLen = 256]
 * [NonceLen = 128]
 * [PersonalizationStringLen = 256]
 * [AdditionalInputLen = 256]
 * [ReturnedBitsLen = 1024]
 * COUNT = 0
 * EntropyInput =
 * 4294671d493dc085b5184607d7de2ff2b6aceb734a1b026f6cfee7c5a90f03da Nonce =
 * d071544e599235d5eb38b64b551d2a6e PersonalizationString =
 * 63bc769ae1d95a98bde870e4db7776297041d37c8a5c688d4e024b78d83f4d78
 * AdditionalInput =
 * 28848becd3f47696f124f4b14853a456156f69be583a7d4682cff8d44b39e1d3
 * EntropyInputPR =
 * db9b4790b62336fbb9a684b82947065393eeef8f57bd2477141ad17e776dac34
 * AdditionalInput =
 * 8bfce0b7132661c3cd78175d83926f643e36f7608eec2c5dac3ddcbacc8c2182
 * EntropyInputPR =
 * 4a9abe80f6f522f29878bedf8245b27940a76471006fb4a4110beb4decb6c341 ReturnedBits
 * =
 * e580dc969194b2b18a97478aef9d1a72390aff14562747bf080d741527a6655ce7fc135325b457483a9f9c70f91165a811cf4524b50d51199a0df3bd60d12abac27d0bf6618e6b114e05420352e23f3603dfe8a225dc19b3d1fff1dc245dc6b1df24c741744bec3f9437dbbf222df84881a457a589e7815ef132f686b760f012
 */

static uint8_t entropy0[] = {
    0x42, 0x94, 0x67, 0x1d, 0x49, 0x3d, 0xc0, 0x85, 0xb5, 0x18, 0x46,
    0x07, 0xd7, 0xde, 0x2f, 0xf2, 0xb6, 0xac, 0xeb, 0x73, 0x4a, 0x1b,
    0x02, 0x6f, 0x6c, 0xfe, 0xe7, 0xc5, 0xa9, 0x0f, 0x03, 0xda};
static uint8_t nonce0[] = {0xd0, 0x71, 0x54, 0x4e, 0x59, 0x92,
                           0x35, 0xd5, 0xeb, 0x38, 0xb6, 0x4b,
                           0x55, 0x1d, 0x2a, 0x6e};
static uint8_t perso0[] = {
    0x63, 0xbc, 0x76, 0x9a, 0xe1, 0xd9, 0x5a, 0x98, 0xbd, 0xe8, 0x70,
    0xe4, 0xdb, 0x77, 0x76, 0x29, 0x70, 0x41, 0xd3, 0x7c, 0x8a, 0x5c,
    0x68, 0x8d, 0x4e, 0x02, 0x4b, 0x78, 0xd8, 0x3f, 0x4d, 0x78};

/* K,V word order same as *.fax, byte-order w/in word reversed. */
static uint32_t K0[] = {0x7fe2b43a, 0x94f11b33, 0x2b76c5ce, 0xfbb784af,
                        0x81cfe716, 0xc43596d6, 0xbdfe968b, 0x189c80fb};
static uint32_t V0[] = {0xc42b237a, 0x929cdd0b, 0xe7fbafdd, 0xba22a36a,
                        0x4d23471a, 0xd8607022, 0x687e18ac, 0x2ac08007};

// Reseed
static uint8_t entropy1[] = {
    0xdb, 0x9b, 0x47, 0x90, 0xb6, 0x23, 0x36, 0xfb, 0xb9, 0xa6, 0x84,
    0xb8, 0x29, 0x47, 0x06, 0x53, 0x93, 0xee, 0xef, 0x8f, 0x57, 0xbd,
    0x24, 0x77, 0x14, 0x1a, 0xd1, 0x7e, 0x77, 0x6d, 0xac, 0x34};

static uint8_t addtl_input1[] = {
    0x28, 0x84, 0x8b, 0xec, 0xd3, 0xf4, 0x76, 0x96, 0xf1, 0x24, 0xf4,
    0xb1, 0x48, 0x53, 0xa4, 0x56, 0x15, 0x6f, 0x69, 0xbe, 0x58, 0x3a,
    0x7d, 0x46, 0x82, 0xcf, 0xf8, 0xd4, 0x4b, 0x39, 0xe1, 0xd3};

static uint32_t K1[] = {0x3118D36E, 0x05DEEC48, 0x7EFB6363, 0x3D575CDE,
                        0xCFCD14C1, 0x8D4F937D, 0x896B811E, 0x0EF038EB};
// may need to reverse byte ordering
static uint32_t V1[] = {0xC8ED8EEC, 0x24DD7B66, 0x09C635CD, 0x6AC74196,
                        0xC70067D7, 0xC2E71FEF, 0x918D9EB7, 0xAE0CD544};

// Generate
static uint32_t K2[] = {0x980ccd6a, 0x0b34f7e1, 0x594aabd7, 0x33b66049,
                        0xb919bd57, 0x8ecc7194, 0xaf1748a3, 0x80982577};

static uint32_t V2[] = {0xe4927cdb, 0xb3435cc5, 0x601ab870, 0x46e1f024,
                        0x966ca875, 0x102b4167, 0xa71e5dce, 0xe4c15962};

// Reseed, prediction resistance
static uint8_t entropy2[] = {
    0x4a, 0x9a, 0xbe, 0x80, 0xf6, 0xf5, 0x22, 0xf2, 0x98, 0x78, 0xbe,
    0xdf, 0x82, 0x45, 0xb2, 0x79, 0x40, 0xa7, 0x64, 0x71, 0x00, 0x6f,
    0xb4, 0xa4, 0x11, 0x0b, 0xeb, 0x4d, 0xec, 0xb6, 0xc3, 0x41};

static uint8_t addtl_input2[] = {
    0x8b, 0xfc, 0xe0, 0xb7, 0x13, 0x26, 0x61, 0xc3, 0xcd, 0x78, 0x17,
    0x5d, 0x83, 0x92, 0x6f, 0x64, 0x3e, 0x36, 0xf7, 0x60, 0x8e, 0xec,
    0x2c, 0x5d, 0xac, 0x3d, 0xdc, 0xba, 0xcc, 0x8c, 0x21, 0x82};

// 1024-bit known answer output after two calls to Generate()
static uint8_t KA[] = {
    0xe5, 0x80, 0xdc, 0x96, 0x91, 0x94, 0xb2, 0xb1, 0x8a, 0x97, 0x47, 0x8a,
    0xef, 0x9d, 0x1a, 0x72, 0x39, 0x0a, 0xff, 0x14, 0x56, 0x27, 0x47, 0xbf,
    0x08, 0x0d, 0x74, 0x15, 0x27, 0xa6, 0x65, 0x5c, 0xe7, 0xfc, 0x13, 0x53,
    0x25, 0xb4, 0x57, 0x48, 0x3a, 0x9f, 0x9c, 0x70, 0xf9, 0x11, 0x65, 0xa8,
    0x11, 0xcf, 0x45, 0x24, 0xb5, 0x0d, 0x51, 0x19, 0x9a, 0x0d, 0xf3, 0xbd,
    0x60, 0xd1, 0x2a, 0xba, 0xc2, 0x7d, 0x0b, 0xf6, 0x61, 0x8e, 0x6b, 0x11,
    0x4e, 0x05, 0x42, 0x03, 0x52, 0xe2, 0x3f, 0x36, 0x03, 0xdf, 0xe8, 0xa2,
    0x25, 0xdc, 0x19, 0xb3, 0xd1, 0xff, 0xf1, 0xdc, 0x24, 0x5d, 0xc6, 0xb1,
    0xdf, 0x24, 0xc7, 0x41, 0x74, 0x4b, 0xec, 0x3f, 0x94, 0x37, 0xdb, 0xbf,
    0x22, 0x2d, 0xf8, 0x48, 0x81, 0xa4, 0x57, 0xa5, 0x89, 0xe7, 0x81, 0x5e,
    0xf1, 0x32, 0xf6, 0x86, 0xb7, 0x60, 0xf0, 0x12};

/* AES KAT for FIPS, smallest supported key length */
int fips_aes128_kat(void) {
  static uint8_t k[AES256_BLOCK_CIPHER_KEY_SIZE] = /* "etaonrishd" */
      {0x65, 0x74, 0x61, 0x6f, 0x6e, 0x72, 0x69, 0x73, 0x68, 0x64, 0x00,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

  static uint8_t msg[AES_BLOCK_LEN] = {0x00, 0xAA, 0x00, 0xAA, 0x00, 0xAA,
                                             0x00, 0xAA, 0x00, 0xAA, 0x00, 0xAA,
                                             0x00, 0xAA, 0x00, 0xAA};
  uint8_t enc[AES_BLOCK_LEN];
  uint8_t dec[AES_BLOCK_LEN];

  uint8_t iv[AES_BLOCK_LEN] = {0};  // AES_BLOCK_LEN = 16.
  fips_aes_init(k, 256, iv, AES_CIPHER_MODE_CBC, AES_ENCRYPT_MODE);
  fips_aes_block(msg, enc);

/* To demonstrate KAT breakage for FIPS compliance */
#ifdef FIPS_BREAK_AES_KAT
  memset(enc, 0x0A, sizeof(uint32_t));
#endif
  fips_aes_init(k, 256, iv, AES_CIPHER_MODE_CBC, AES_DECRYPT_MODE);
  fips_aes_block(enc, dec);

  if (memcmp(msg, dec, AES_BLOCK_LEN)) {
    printf("[ANS] != [OUT]\n");
    for (int i = 0; i < AES_BLOCK_LEN; i++) {
      printf("0x%02x   0x%02x\n", msg[i], dec[i]);
    }
    throw_fips_err(FIPS_FATAL_AES128);
    return EC_ERROR_UNKNOWN;
  }

  return EC_SUCCESS;
}

/* Test values from OpenSSL */

int fips_hmac_sha256_kat(void) {
  static const uint8_t ans[] = {0xe9, 0x17, 0xc1, 0x7b, 0x4c, 0x6b, 0x77, 0xda,
                                0xd2, 0x30, 0x36, 0x02, 0xf5, 0x72, 0x33, 0x87,
                                0x9f, 0xc6, 0x6e, 0x7b, 0x7e, 0xa8, 0xea, 0xaa,
                                0x9f, 0xba, 0xee, 0x51, 0xff, 0xda, 0x24, 0xf4};
  static uint8_t k[SHA256_DIGEST_SIZE] = /* "etaonrishd" */
      {0x65, 0x74, 0x61, 0x6f, 0x6e, 0x72, 0x69, 0x73, 0x68, 0x64, 0x00,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

  uint8_t out[SHA256_DIGEST_SIZE];
  static uint8_t in[] = /* "Sample text" */
    {0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x74, 0x65, 0x78, 0x74};

  fips_hwHMAC256_init((uint32_t*)k);
  fips_hwSHA256_update(in, sizeof(in));
  fips_hwSHA256_final((uint32_t*)out);
  return memcmp(out, ans, SHA256_DIGEST_SIZE);
}

/* Test values from OpenSSL */
int fips_sha256_kat(void) {
  static const uint8_t ans[] = {0xf5, 0x53, 0xcd, 0xb8, 0xcf, 0x1,  0xee, 0x17,
                                0x9b, 0x93, 0xc9, 0x68, 0xc0, 0xea, 0x40, 0x91,
                                0x6,  0xec, 0x8e, 0x11, 0x96, 0xc8, 0x5d, 0x1c,
                                0xaf, 0x64, 0x22, 0xe6, 0x50, 0x4f, 0x47, 0x57};
  static uint8_t in[] = /* "etaonrishd" */
      {0x65, 0x74, 0x61, 0x6f, 0x6e, 0x72, 0x69, 0x73, 0x68, 0x64};
  uint8_t out[SHA256_DIGEST_SIZE];

  fips_hwSHA256_init();
  fips_hwSHA256_update(in, sizeof(in));
  fips_hwSHA256_final((uint32_t*)out);
  return memcmp(out, ans, SHA256_DIGEST_SIZE);
}

/* - Prediction resistance is always enabled -- i.e. we call reseed w/
 * fresh entropy.
 * - All values are 256-bit, except entropy, which is 128-bit.
 */
int fips_hmac_drbg_instantiate_kat(DRBG* ctx) {
  // entropy, nonce, perso
  DRBG_init(ctx, entropy0, sizeof(entropy0), nonce0, sizeof(nonce0), perso0,
            sizeof(perso0));

  if (memcmp(ctx->V, V0, sizeof(V0))) return -1;
  if (memcmp(ctx->K, K0, sizeof(K0))) return -2;
  return 0;
}

int fips_hmac_drbg_reseed_kat(DRBG* ctx) {
  // Reseed -- "Additional Input" field MUST be part of reseed, not generate
  DRBG_reseed(ctx, entropy1, sizeof(entropy1), addtl_input1,
              sizeof(addtl_input1), NULL, 0);

  if (memcmp(ctx->V, V1, sizeof(V1))) return -1;
  if (memcmp(ctx->K, K1, sizeof(K1))) return -2;
  return 0;
}

int fips_hmac_drbg_generate_kat(DRBG* ctx) {
  uint8_t buf[128];  // 1024 bits

  // Internal K, V
  DRBG_generate(ctx, buf, sizeof(buf), NULL, 0);
  if (memcmp(ctx->V, V2, sizeof(V2))) return -1;
  if (memcmp(ctx->K, K2, sizeof(K2))) return -2;

  DRBG_reseed(ctx, entropy2, sizeof(entropy2), addtl_input2,
              sizeof(addtl_input2), NULL, 0);
  DRBG_generate(ctx, buf, sizeof(buf), NULL, 0);
  if (memcmp(buf, KA, sizeof(KA))) return -3;

  return 0;
}

int fips_cmac_aes128_kat(void) {
  uint8_t mac[16];
  uint8_t k[16];

  memcpy(k, &fixed_d, 16);

  if (fips_cmac_generate(k, (uint8_t*)&test_msg, sizeof(p256_int), mac)) {
    printf("  Failed to generate AES CMAC\n");
    throw_fips_err(FIPS_FATAL_CMAC_AES128);
    return EC_ERROR_UNKNOWN;
  }

/* Purposeful break for FIPS testing */
#ifdef FIPS_BREAK_CMAC_KAT
  memset(mac, 0x0A, 1);
#endif
  if (fips_cmac_verify(k, (uint8_t*)&test_msg, sizeof(p256_int), mac,
                       sizeof(mac))) {
    printf("  Failed to verify AES CMAC\n");
    throw_fips_err(FIPS_FATAL_CMAC_AES128);
    return EC_ERROR_UNKNOWN;
  }

  return EC_SUCCESS;
}

int fips_ecdsa_sign_kat(void) {
  p256_int r, s;
  uint8_t fixed[ENTROPY_128SEC + NONCE_128SEC] = {0x0C};
  DRBG ctx;  // fixed-input DRBG

  /* Uses a fixed-output DRBG. Loads the same every time, leads
   * to a, purposefully, fixed value for k. */
  DRBG_init(&ctx, fixed, ENTROPY_128SEC, fixed + ENTROPY_128SEC, NONCE_128SEC,
            NULL, 0);

  if (!fips_p256_ecdsa_sign(&ctx, &fixed_d, &test_msg, &r, &s)) {
    printf("FIPS ECDSA SIGN FAIL\n");
    throw_fips_err(FIPS_FATAL_ECDSA);
    return EC_ERROR_UNKNOWN;
  }

  if (memcmp(&fixed_r, &r, sizeof(p256_int)) ||
      memcmp(&fixed_s, &s, sizeof(p256_int))) {
    throw_fips_err(FIPS_FATAL_ECDSA);
    return EC_ERROR_UNKNOWN;
  }

  return EC_SUCCESS;
}

/* Run on every generated ECSDA p256 keypair in FIPS mode */
int fips_ecdsa_consistency_test(const p256_int* x, const p256_int* y,
                                const p256_int* d) {
  p256_int r, s;
  DRBG ctx;

  make_drbg2(&ctx);

  /*
   * (1) Sign pre-determined message.
   * (2) Verify signature.
   */
  if (!fips_p256_ecdsa_sign(&ctx, d, &test_msg, &r, &s)) {
    throw_fips_err(FIPS_FATAL_ECDSA);
    return EC_ERROR_UNKNOWN;
  }
  if (!fips_p256_ecdsa_verify(x, y, &test_msg, &r, &s)) {
    throw_fips_err(FIPS_FATAL_ECDSA);
    return EC_ERROR_UNKNOWN;
  }

  return EC_SUCCESS;
}