aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNIIBE Yutaka <[email protected]>2022-01-19 11:41:40 +0900
committerNIIBE Yutaka <[email protected]>2022-01-19 11:41:40 +0900
commit76aad97dd312e83f2f9b8d086553f2b72ab6546f (patch)
tree40d41c810f9cff3ebbdae697fceaec5ee2d49928
parent6f225308d3e59f8749403ad743d8e6c591142f8f (diff)
downloadlibgcrypt-76aad97dd312e83f2f9b8d086553f2b72ab6546f.tar.gz
libgcrypt-76aad97dd312e83f2f9b8d086553f2b72ab6546f.tar.bz2
libgcrypt-76aad97dd312e83f2f9b8d086553f2b72ab6546f.zip
fips: Reject shorter key for HMAC in FIPS mode.
* cipher/md.c (prepare_macpads): Reject < 112-bit key. * cipher/kdf.c (selftest_pbkdf2): Remove selftest cases with shorter key. * cipher/mac-hmac.c (selftests_sha224, selftests_sha256): Likewise. (selftests_sha384, selftests_sha512, selftests_sha3): Likewise. * tests/basic.c (check_one_hmac) Handle an error when shorter key is rejected. (check_one_mac): Likewise. * tests/t-kdf.c (check_pbkdf2, check_scrypt): Likewise. -- GnuPG-bug-id: 5512 Signed-off-by: NIIBE Yutaka <[email protected]>
-rw-r--r--cipher/kdf.c76
-rw-r--r--cipher/mac-hmac.c67
-rw-r--r--cipher/md.c3
-rw-r--r--tests/basic.c29
-rw-r--r--tests/t-kdf.c38
5 files changed, 62 insertions, 151 deletions
diff --git a/cipher/kdf.c b/cipher/kdf.c
index 93c2c9f6..a442e275 100644
--- a/cipher/kdf.c
+++ b/cipher/kdf.c
@@ -355,49 +355,7 @@ selftest_pbkdf2 (int extended, selftest_report_func_t report)
int disabled;
} tv[] = {
#if USE_SHA1
-#define NUM_TEST_VECTORS 9
- /* SHA1 test vectors are from RFC-6070. */
- {
- "Basic PBKDF2 SHA1 #1",
- "password", 8,
- "salt", 4,
- GCRY_MD_SHA1,
- 1,
- 20,
- "\x0c\x60\xc8\x0f\x96\x1f\x0e\x71\xf3\xa9"
- "\xb5\x24\xaf\x60\x12\x06\x2f\xe0\x37\xa6"
- },
- {
- "Basic PBKDF2 SHA1 #2",
- "password", 8,
- "salt", 4,
- GCRY_MD_SHA1,
- 2,
- 20,
- "\xea\x6c\x01\x4d\xc7\x2d\x6f\x8c\xcd\x1e"
- "\xd9\x2a\xce\x1d\x41\xf0\xd8\xde\x89\x57"
- },
- {
- "Basic PBKDF2 SHA1 #3",
- "password", 8,
- "salt", 4,
- GCRY_MD_SHA1,
- 4096,
- 20,
- "\x4b\x00\x79\x01\xb7\x65\x48\x9a\xbe\xad"
- "\x49\xd9\x26\xf7\x21\xd0\x65\xa4\x29\xc1"
- },
- {
- "Basic PBKDF2 SHA1 #4",
- "password", 8,
- "salt", 4,
- GCRY_MD_SHA1,
- 16777216,
- 20,
- "\xee\xfe\x3d\x61\xcd\x4d\xa4\xe4\xe9\x94"
- "\x5b\x3d\x6b\xa2\x15\x8c\x26\x34\xe9\x84",
- 1 /* This test takes too long. */
- },
+#define NUM_TEST_VECTORS 2
{
"Basic PBKDF2 SHA1 #5",
"passwordPASSWORDpassword", 24,
@@ -409,40 +367,10 @@ selftest_pbkdf2 (int extended, selftest_report_func_t report)
"\xd8\x36\x62\xc0\xe4\x4a\x8b\x29\x1a\x96"
"\x4c\xf2\xf0\x70\x38"
},
- {
- "Basic PBKDF2 SHA1 #6",
- "pass\0word", 9,
- "sa\0lt", 5,
- GCRY_MD_SHA1,
- 4096,
- 16,
- "\x56\xfa\x6a\xa7\x55\x48\x09\x9d\xcc\x37"
- "\xd7\xf0\x34\x25\xe0\xc3"
- },
- { /* empty password test, not in RFC-6070 */
- "Basic PBKDF2 SHA1 #7",
- "", 0,
- "salt", 4,
- GCRY_MD_SHA1,
- 2,
- 20,
- "\x13\x3a\x4c\xe8\x37\xb4\xd2\x52\x1e\xe2"
- "\xbf\x03\xe1\x1c\x71\xca\x79\x4e\x07\x97"
- },
#else
-#define NUM_TEST_VECTORS 2
+#define NUM_TEST_VECTORS 1
#endif
{
- "Basic PBKDF2 SHA256",
- "password", 8,
- "salt", 4,
- GCRY_MD_SHA256,
- 2,
- 32,
- "\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9\x28\xf0\x6d\xd0"
- "\x2a\x30\x3f\x8e\xf3\xc2\x51\xdf\xd6\xe2\xd8\x5a\x95\x47\x4c\x43"
- },
- {
"Extended PBKDF2 SHA256",
"passwordPASSWORDpassword", 24,
"saltSALTsaltSALTsaltSALTsaltSALTsalt", 36,
diff --git a/cipher/mac-hmac.c b/cipher/mac-hmac.c
index 108a4408..3f50f1c5 100644
--- a/cipher/mac-hmac.c
+++ b/cipher/mac-hmac.c
@@ -361,14 +361,6 @@ selftests_sha224 (int extended, selftest_report_func_t report)
const char expect[28];
} tv[] =
{
- { "data-28 key-4",
- "what do ya want for nothing?",
- "Jefe",
- { 0xa3, 0x0e, 0x01, 0x09, 0x8b, 0xc6, 0xdb, 0xbf,
- 0x45, 0x69, 0x0f, 0x3a, 0x7e, 0x9e, 0x6d, 0x0f,
- 0x8b, 0xbe, 0xa2, 0xa3, 0x9e, 0x61, 0x48, 0x00,
- 0x8f, 0xd0, 0x5e, 0x44 } },
-
{ "data-9 key-20",
"Hi There",
"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
@@ -475,14 +467,6 @@ selftests_sha256 (int extended, selftest_report_func_t report)
const char expect[32];
} tv[] =
{
- { "data-28 key-4",
- "what do ya want for nothing?",
- "Jefe",
- { 0x5b, 0xdc, 0xc1, 0x46, 0xbf, 0x60, 0x75, 0x4e,
- 0x6a, 0x04, 0x24, 0x26, 0x08, 0x95, 0x75, 0xc7,
- 0x5a, 0x00, 0x3f, 0x08, 0x9d, 0x27, 0x39, 0x83,
- 0x9d, 0xec, 0x58, 0xb9, 0x64, 0xec, 0x38, 0x43 } },
-
{ "data-9 key-20",
"Hi There",
"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
@@ -589,16 +573,6 @@ selftests_sha384 (int extended, selftest_report_func_t report)
const char expect[48];
} tv[] =
{
- { "data-28 key-4",
- "what do ya want for nothing?",
- "Jefe",
- { 0xaf, 0x45, 0xd2, 0xe3, 0x76, 0x48, 0x40, 0x31,
- 0x61, 0x7f, 0x78, 0xd2, 0xb5, 0x8a, 0x6b, 0x1b,
- 0x9c, 0x7e, 0xf4, 0x64, 0xf5, 0xa0, 0x1b, 0x47,
- 0xe4, 0x2e, 0xc3, 0x73, 0x63, 0x22, 0x44, 0x5e,
- 0x8e, 0x22, 0x40, 0xca, 0x5e, 0x69, 0xe2, 0xc7,
- 0x8b, 0x32, 0x39, 0xec, 0xfa, 0xb2, 0x16, 0x49 } },
-
{ "data-9 key-20",
"Hi There",
"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
@@ -715,18 +689,6 @@ selftests_sha512 (int extended, selftest_report_func_t report)
const char expect[64];
} tv[] =
{
- { "data-28 key-4",
- "what do ya want for nothing?",
- "Jefe",
- { 0x16, 0x4b, 0x7a, 0x7b, 0xfc, 0xf8, 0x19, 0xe2,
- 0xe3, 0x95, 0xfb, 0xe7, 0x3b, 0x56, 0xe0, 0xa3,
- 0x87, 0xbd, 0x64, 0x22, 0x2e, 0x83, 0x1f, 0xd6,
- 0x10, 0x27, 0x0c, 0xd7, 0xea, 0x25, 0x05, 0x54,
- 0x97, 0x58, 0xbf, 0x75, 0xc0, 0x5a, 0x99, 0x4a,
- 0x6d, 0x03, 0x4f, 0x65, 0xf8, 0xf0, 0xe6, 0xfd,
- 0xca, 0xea, 0xb1, 0xa3, 0x4d, 0x4a, 0x6b, 0x4b,
- 0x63, 0x6e, 0x07, 0x0a, 0x38, 0xbc, 0xe7, 0x37 } },
-
{ "data-9 key-20",
"Hi There",
"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
@@ -889,35 +851,6 @@ selftests_sha3 (int hashalgo, int extended, selftest_report_func_t report)
0x37, 0xc0, 0xa0, 0xb8, 0x64, 0x07, 0x68, 0x9e }
},
- { "data-28 key-4", /* Test 2 */
- /* Test with a key shorter than the length of the HMAC output. */
- "what do ya want for nothing?",
- "Jefe",
-
- { 0x7f, 0xdb, 0x8d, 0xd8, 0x8b, 0xd2, 0xf6, 0x0d,
- 0x1b, 0x79, 0x86, 0x34, 0xad, 0x38, 0x68, 0x11,
- 0xc2, 0xcf, 0xc8, 0x5b, 0xfa, 0xf5, 0xd5, 0x2b,
- 0xba, 0xce, 0x5e, 0x66 },
- { 0xc7, 0xd4, 0x07, 0x2e, 0x78, 0x88, 0x77, 0xae,
- 0x35, 0x96, 0xbb, 0xb0, 0xda, 0x73, 0xb8, 0x87,
- 0xc9, 0x17, 0x1f, 0x93, 0x09, 0x5b, 0x29, 0x4a,
- 0xe8, 0x57, 0xfb, 0xe2, 0x64, 0x5e, 0x1b, 0xa5 },
- { 0xf1, 0x10, 0x1f, 0x8c, 0xbf, 0x97, 0x66, 0xfd,
- 0x67, 0x64, 0xd2, 0xed, 0x61, 0x90, 0x3f, 0x21,
- 0xca, 0x9b, 0x18, 0xf5, 0x7c, 0xf3, 0xe1, 0xa2,
- 0x3c, 0xa1, 0x35, 0x08, 0xa9, 0x32, 0x43, 0xce,
- 0x48, 0xc0, 0x45, 0xdc, 0x00, 0x7f, 0x26, 0xa2,
- 0x1b, 0x3f, 0x5e, 0x0e, 0x9d, 0xf4, 0xc2, 0x0a },
- { 0x5a, 0x4b, 0xfe, 0xab, 0x61, 0x66, 0x42, 0x7c,
- 0x7a, 0x36, 0x47, 0xb7, 0x47, 0x29, 0x2b, 0x83,
- 0x84, 0x53, 0x7c, 0xdb, 0x89, 0xaf, 0xb3, 0xbf,
- 0x56, 0x65, 0xe4, 0xc5, 0xe7, 0x09, 0x35, 0x0b,
- 0x28, 0x7b, 0xae, 0xc9, 0x21, 0xfd, 0x7c, 0xa0,
- 0xee, 0x7a, 0x0c, 0x31, 0xd0, 0x22, 0xa9, 0x5e,
- 0x1f, 0xc9, 0x2b, 0xa9, 0xd7, 0x7d, 0xf8, 0x83,
- 0x96, 0x02, 0x75, 0xbe, 0xb4, 0xe6, 0x20, 0x24 }
- },
-
{ "data-50 key-20", /* Test 3 */
/* Test with a combined length of key and data that is larger
* than 64 bytes (= block-size of SHA-224 and SHA-256). */
diff --git a/cipher/md.c b/cipher/md.c
index 34336b5c..4f4fc9bf 100644
--- a/cipher/md.c
+++ b/cipher/md.c
@@ -903,6 +903,9 @@ prepare_macpads (gcry_md_hd_t a, const unsigned char *key, size_t keylen)
{
GcryDigestEntry *r;
+ if (fips_mode () && keylen < 14)
+ return GPG_ERR_INV_VALUE;
+
if (!a->ctx->list)
return GPG_ERR_DIGEST_ALGO; /* Might happen if no algo is enabled. */
diff --git a/tests/basic.c b/tests/basic.c
index ab9a4733..32be7c2f 100644
--- a/tests/basic.c
+++ b/tests/basic.c
@@ -13757,7 +13757,19 @@ check_one_hmac (int algo, const char *data, int datalen,
return;
}
- gcry_md_setkey( hd, key, keylen );
+ err = gcry_md_setkey( hd, key, keylen );
+ if (err)
+ {
+ if (in_fips_mode)
+ {
+ if (verbose)
+ fprintf (stderr,
+ " shorter key (%d) rejected correctly in fips mode\n",
+ keylen);
+ }
+ gcry_md_close (hd);
+ return;
+ }
gcry_md_write (hd, data, datalen);
@@ -14161,9 +14173,18 @@ check_one_mac (int algo, const char *data, int datalen,
clutter_vector_registers();
err = gcry_mac_setkey (hd, key, keylen);
if (err)
- fail("algo %d, mac gcry_mac_setkey failed: %s\n", algo, gpg_strerror (err));
- if (err)
- goto out;
+ {
+ if (in_fips_mode)
+ {
+ if (verbose)
+ fprintf (stderr,
+ " shorter key (%d) rejected correctly in fips mode\n",
+ keylen);
+ }
+ else
+ fail("algo %d, mac gcry_mac_setkey failed: %s\n", algo, gpg_strerror (err));
+ goto out;
+ }
if (ivlen && iv)
{
diff --git a/tests/t-kdf.c b/tests/t-kdf.c
index 48309b9a..26570186 100644
--- a/tests/t-kdf.c
+++ b/tests/t-kdf.c
@@ -31,6 +31,8 @@
#define PGM "t-kdf"
#include "t-common.h"
+static int in_fips_mode;
+
static void
dummy_consumer (volatile char *buffer, size_t buflen)
@@ -858,8 +860,7 @@ check_openpgp (void)
if (tv[tvidx].disabled)
continue;
/* MD5 isn't supported in fips mode */
- if (gcry_fips_mode_active()
- && tv[tvidx].hashalgo == GCRY_MD_MD5)
+ if (in_fips_mode && tv[tvidx].hashalgo == GCRY_MD_MD5)
continue;
if (verbose)
fprintf (stderr, "checking S2K test vector %d\n", tvidx);
@@ -1104,7 +1105,7 @@ check_pbkdf2 (void)
GCRY_KDF_PBKDF2, tv[tvidx].hashalgo,
tv[tvidx].salt, tv[tvidx].saltlen,
tv[tvidx].c, tv[tvidx].dklen, outbuf);
- if (gcry_fips_mode_active() && tvidx > 6)
+ if (in_fips_mode && tvidx > 6)
{
if (!err)
fail ("pbkdf2 test %d unexpectedly passed in FIPS mode: %s\n",
@@ -1112,7 +1113,17 @@ check_pbkdf2 (void)
continue;
}
if (err)
- fail ("pbkdf2 test %d failed: %s\n", tvidx, gpg_strerror (err));
+ {
+ if (in_fips_mode && tv[tvidx].plen < 14)
+ {
+ if (verbose)
+ fprintf (stderr,
+ " shorter key (%ld) rejected correctly in fips mode\n",
+ tv[tvidx].plen);
+ }
+ else
+ fail ("pbkdf2 test %d failed: %s\n", tvidx, gpg_strerror (err));
+ }
else if (memcmp (outbuf, tv[tvidx].dk, tv[tvidx].dklen))
{
fail ("pbkdf2 test %d failed: mismatch\n", tvidx);
@@ -1209,7 +1220,17 @@ check_scrypt (void)
tv[tvidx].salt, tv[tvidx].saltlen,
tv[tvidx].parm_p, tv[tvidx].dklen, outbuf);
if (err)
- fail ("scrypt test %d failed: %s\n", tvidx, gpg_strerror (err));
+ {
+ if (in_fips_mode && tv[tvidx].plen < 14)
+ {
+ if (verbose)
+ fprintf (stderr,
+ " shorter key (%ld) rejected correctly in fips mode\n",
+ tv[tvidx].plen);
+ }
+ else
+ fail ("scrypt test %d failed: %s\n", tvidx, gpg_strerror (err));
+ }
else if (memcmp (outbuf, tv[tvidx].dk, tv[tvidx].dklen))
{
fail ("scrypt test %d failed: mismatch\n", tvidx);
@@ -1281,7 +1302,12 @@ main (int argc, char **argv)
if (!gcry_check_version (GCRYPT_VERSION))
die ("version mismatch\n");
- xgcry_control ((GCRYCTL_DISABLE_SECMEM, 0));
+ if (gcry_fips_mode_active ())
+ in_fips_mode = 1;
+
+ if (!in_fips_mode)
+ xgcry_control ((GCRYCTL_DISABLE_SECMEM, 0));
+
xgcry_control ((GCRYCTL_INITIALIZATION_FINISHED, 0));
if (debug)
xgcry_control ((GCRYCTL_SET_DEBUG_FLAGS, 1u, 0));