Skip to content

Increase RNG_SECURITY_STRENGTH for FIPS#5860

Merged
SparkiDev merged 2 commits intowolfSSL:masterfrom
tmael:entropy_memuse
Dec 7, 2022
Merged

Increase RNG_SECURITY_STRENGTH for FIPS#5860
SparkiDev merged 2 commits intowolfSSL:masterfrom
tmael:entropy_memuse

Conversation

@tmael
Copy link
Copy Markdown
Contributor

@tmael tmael commented Dec 6, 2022 •
edited
Loading

Description

The proposed changes are required to get the RANDOM test to pass in FIPS mode.
$ ./configure --enable-entropy-memuse --enable-fips=v5 && make && ./wolfcrypt/test/testwolfcrypt

@dgarske dgarske requested a review from SparkiDev December 6, 2022 22:57
@SparkiDev
Copy link
Copy Markdown
Contributor

SparkiDev commented Dec 6, 2022 •
edited
Loading

Why do you need 1024 bits of entropy?
Typically ENTROPY_SCALE_FACTOR is changed to reflect the number of bits needed to meet the security strength.

@tmael
Copy link
Copy Markdown
Contributor Author

tmael commented Dec 7, 2022

@SparkiDev, The WCv5.0-RC12 FIPS code already has the proposed changes.
I need to dig into the root cause.

Start with commit 824c280d
cd wolfssl
./fips-check.sh linuxv5 keep
cd  XXX-fips-test/
cp ../wolfcrypt/src/random.c wolfcrypt/src/random.c
cp ../wolfssl/wolfcrypt/random.h wolfssl/wolfcrypt/random.h
./configure --enable-entropy-memuse --enable-fips=v5 && make && ./wolfcrypt/test/testwolfcrypt
./fips-hash.sh && make && ./wolfcrypt/test/testwolfcrypt

------------------------------------------------------------------------------
 wolfSSL version 5.5.3
------------------------------------------------------------------------------
error    test passed!
MEMORY   test passed!
base64   test passed!
base16   test passed!
asn      test passed!
RANDOM   test failed!
 error = -7010
Exiting main with return code: -1

Applying the proposed changes, RANDOM test passes.

@tmael tmael self-assigned this Dec 7, 2022
@SparkiDev SparkiDev merged commit 1f607ee into wolfSSL:master Dec 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SparkiDev SparkiDev SparkiDev approved these changes

Assignees

@tmael tmael

@SparkiDev SparkiDev

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tmael @SparkiDev