From a935f2f86dea3b1c8f1bdf06a73ce03400bdc0e1 Mon Sep 17 00:00:00 2001 From: John Safranek Date: Fri, 4 Dec 2020 14:56:08 -0800 Subject: [PATCH] FIPS CAST Update 1. In the unit test, when checking the build options, also check for FIPSv4 to make sure 2048-bit RSA is used. 2. In the standalone SHA-1 one step hash function, wc_InitSha() wasn't getting called, so the FIPS flags didn't get checked. (It was using wc_InitSha_ex() which bypasses the FIPS checks.) --- tests/api.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/tests/api.c b/tests/api.c index f9acc8af0..f0d1539ed 100644 --- a/tests/api.c +++ b/tests/api.c @@ -407,7 +407,8 @@ static const char* failed = "failed"; #define TEST_STRING "Everyone gets Friday off." #define TEST_STRING_SZ 25 -#if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) +#if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) #define TEST_RSA_BITS 1024 #else #define TEST_RSA_BITS 2048 @@ -18282,7 +18283,8 @@ static int test_wc_MakeRsaKey (void) RsaKey genKey; WC_RNG rng; - #if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) + #if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) int bits = 1024; #else int bits = 2048; @@ -18943,7 +18945,8 @@ static int test_wc_RsaKeyToDer (void) RsaKey genKey; WC_RNG rng; byte* der; - #if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) + #if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) int bits = 1024; word32 derSz = 611; /* (2 x 128) + 2 (possible leading 00) + (5 x 64) + 5 (possible leading 00) @@ -19052,7 +19055,8 @@ static int test_wc_RsaKeyToPublicDer (void) RsaKey key; WC_RNG rng; byte* der; - #if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) + #if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) int bits = 1024; word32 derLen = 162; #else @@ -19545,7 +19549,8 @@ static int test_wc_RsaEncryptSize (void) } printf(testingFmt, "wc_RsaEncryptSize()"); -#if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) +#if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) if (ret == 0) { ret = MAKE_RSA_KEY(&key, 1024, WC_RSA_EXPONENT, &rng); if (ret == 0) { @@ -19615,7 +19620,8 @@ static int test_wc_RsaFlattenPublicKey (void) byte n[256]; word32 eSz = sizeof(e); word32 nSz = sizeof(n); - #if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL) + #if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \ + (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) int bits = 1024; #else int bits = 2048;