fips.h 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343
  1. /* ====================================================================
  2. * Copyright (c) 2003 The OpenSSL Project. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * 1. Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. *
  11. * 2. Redistributions in binary form must reproduce the above copyright
  12. * notice, this list of conditions and the following disclaimer in
  13. * the documentation and/or other materials provided with the
  14. * distribution.
  15. *
  16. * 3. All advertising materials mentioning features or use of this
  17. * software must display the following acknowledgment:
  18. * "This product includes software developed by the OpenSSL Project
  19. * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  20. *
  21. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  22. * endorse or promote products derived from this software without
  23. * prior written permission. For written permission, please contact
  24. * openssl-core@openssl.org.
  25. *
  26. * 5. Products derived from this software may not be called "OpenSSL"
  27. * nor may "OpenSSL" appear in their names without prior written
  28. * permission of the OpenSSL Project.
  29. *
  30. * 6. Redistributions of any form whatsoever must retain the following
  31. * acknowledgment:
  32. * "This product includes software developed by the OpenSSL Project
  33. * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  34. *
  35. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  36. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  38. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  39. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  40. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  41. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  42. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  44. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  45. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  46. * OF THE POSSIBILITY OF SUCH DAMAGE.
  47. *
  48. */
  49. #include <openssl/opensslconf.h>
  50. #ifndef OPENSSL_FIPS
  51. #error FIPS is disabled.
  52. #endif
  53. #ifdef OPENSSL_FIPS
  54. #ifdef __cplusplus
  55. extern "C" {
  56. #endif
  57. struct dsa_st;
  58. struct ec_key_st;
  59. struct rsa_st;
  60. struct evp_pkey_st;
  61. struct env_md_st;
  62. struct evp_cipher_st;
  63. struct evp_cipher_ctx_st;
  64. int FIPS_mode_set(int onoff);
  65. int FIPS_mode(void);
  66. const void *FIPS_rand_check(void);
  67. int FIPS_selftest(void);
  68. int FIPS_selftest_failed(void);
  69. void FIPS_selftest_check(void);
  70. int FIPS_selftest_sha1(void);
  71. int FIPS_selftest_aes_ccm(void);
  72. int FIPS_selftest_aes_gcm(void);
  73. int FIPS_selftest_aes_xts(void);
  74. int FIPS_selftest_aes(void);
  75. int FIPS_selftest_des(void);
  76. int FIPS_selftest_rsa(void);
  77. int FIPS_selftest_dsa(void);
  78. int FIPS_selftest_ecdsa(void);
  79. void FIPS_corrupt_drbg(void);
  80. void FIPS_x931_stick(void);
  81. void FIPS_drbg_stick(void);
  82. int FIPS_selftest_x931(void);
  83. int FIPS_selftest_hmac(void);
  84. int FIPS_selftest_drbg(void);
  85. int FIPS_selftest_cmac(void);
  86. unsigned int FIPS_incore_fingerprint(unsigned char *sig,unsigned int len);
  87. int FIPS_check_incore_fingerprint(void);
  88. void fips_set_selftest_fail(void);
  89. int fips_check_rsa(struct rsa_st *rsa);
  90. int fips_check_rsa_prng(struct rsa_st *rsa, int bits);
  91. int fips_check_dsa_prng(struct dsa_st *dsa, size_t L, size_t N);
  92. int fips_check_ec_prng(struct ec_key_st *ec);
  93. void FIPS_set_locking_callbacks(void (*func)(int mode, int type,
  94. const char *file,int line),
  95. int (*add_cb)(int *pointer, int amount,
  96. int type, const char *file, int line));
  97. void FIPS_set_malloc_callbacks(
  98. void *(*malloc_cb)(int num, const char *file, int line),
  99. void (*free_cb)(void *));
  100. void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr);
  101. /* POST callback operation value: */
  102. /* All tests started */
  103. #define FIPS_POST_BEGIN 1
  104. /* All tests end: result in id */
  105. #define FIPS_POST_END 2
  106. /* One individual test started */
  107. #define FIPS_POST_STARTED 3
  108. /* Individual test success */
  109. #define FIPS_POST_SUCCESS 4
  110. /* Individual test failure */
  111. #define FIPS_POST_FAIL 5
  112. /* Induce failure in test if zero return */
  113. #define FIPS_POST_CORRUPT 6
  114. /* Test IDs */
  115. /* HMAC integrity test */
  116. #define FIPS_TEST_INTEGRITY 1
  117. /* Digest test */
  118. #define FIPS_TEST_DIGEST 2
  119. /* Symmetric cipher test */
  120. #define FIPS_TEST_CIPHER 3
  121. /* Public key signature test */
  122. #define FIPS_TEST_SIGNATURE 4
  123. /* HMAC test */
  124. #define FIPS_TEST_HMAC 5
  125. /* CMAC test */
  126. #define FIPS_TEST_CMAC 6
  127. /* GCM test */
  128. #define FIPS_TEST_GCM 7
  129. /* CCM test */
  130. #define FIPS_TEST_CCM 8
  131. /* XTS test */
  132. #define FIPS_TEST_XTS 9
  133. /* X9.31 PRNG */
  134. #define FIPS_TEST_X931 10
  135. /* DRNB */
  136. #define FIPS_TEST_DRBG 11
  137. /* Keygen pairwise consistency test */
  138. #define FIPS_TEST_PAIRWISE 12
  139. /* Continuous PRNG test */
  140. #define FIPS_TEST_CONTINUOUS 13
  141. void FIPS_post_set_callback(
  142. int (*post_cb)(int op, int id, int subid, void *ex));
  143. #define FIPS_ERROR_IGNORED(alg) OpenSSLDie(__FILE__, __LINE__, \
  144. alg " previous FIPS forbidden algorithm error ignored");
  145. int fips_pkey_signature_test(int id, struct evp_pkey_st *pkey,
  146. const unsigned char *tbs, size_t tbslen,
  147. const unsigned char *kat, size_t katlen,
  148. const struct env_md_st *digest, int pad_mode,
  149. const char *fail_str);
  150. int fips_cipher_test(int id, struct evp_cipher_ctx_st *ctx,
  151. const struct evp_cipher_st *cipher,
  152. const unsigned char *key,
  153. const unsigned char *iv,
  154. const unsigned char *plaintext,
  155. const unsigned char *ciphertext,
  156. int len);
  157. /* Where necessary redirect standard OpenSSL APIs to FIPS versions */
  158. #if defined(OPENSSL_FIPSCANISTER) && defined(OPENSSL_FIPSAPI)
  159. #define CRYPTO_lock FIPS_lock
  160. #define CRYPTO_add_lock FIPS_add_lock
  161. #define CRYPTO_malloc FIPS_malloc
  162. #define CRYPTO_free FIPS_free
  163. #define ERR_put_error FIPS_put_error
  164. #define ERR_add_error_data FIPS_add_error_data
  165. #define EVP_MD_CTX_init FIPS_md_ctx_init
  166. #define EVP_MD_CTX_cleanup FIPS_md_ctx_cleanup
  167. #define EVP_MD_CTX_create FIPS_md_ctx_create
  168. #define EVP_MD_CTX_destroy FIPS_md_ctx_destroy
  169. #define EVP_DigestInit_ex(ctx, type, impl) FIPS_digestinit(ctx, type)
  170. #define EVP_DigestInit FIPS_digestinit
  171. #define EVP_DigestUpdate FIPS_digestupdate
  172. #define EVP_Digest(data, count, md, size, type, impl) \
  173. FIPS_digest(data, count, md, size, type)
  174. #define EVP_DigestFinal_ex FIPS_digestfinal
  175. #define EVP_MD_CTX_copy_ex FIPS_md_ctx_copy
  176. #define EVP_CipherInit_ex(ctx, cipher, impl, key, iv, enc) \
  177. FIPS_cipherinit(ctx, cipher, key, iv, enc)
  178. #define EVP_CipherInit FIPS_cipherinit
  179. #define EVP_CIPHER_CTX_init FIPS_cipher_ctx_init
  180. #define EVP_CIPHER_CTX_cleanup FIPS_cipher_ctx_cleanup
  181. #define EVP_Cipher FIPS_cipher
  182. #define EVP_CIPHER_CTX_ctrl FIPS_cipher_ctx_ctrl
  183. #define EVP_CIPHER_CTX_new FIPS_cipher_ctx_new
  184. #define EVP_CIPHER_CTX_free FIPS_cipher_ctx_free
  185. #define EVP_CIPHER_CTX_copy FIPS_cipher_ctx_copy
  186. #define EVP_CIPHER_CTX_set_key_length FIPS_cipher_ctx_set_key_length
  187. #define DSA_SIG_new FIPS_dsa_sig_new
  188. #define DSA_SIG_free FIPS_dsa_sig_free
  189. #define ECDSA_SIG_new FIPS_ecdsa_sig_new
  190. #define ECDSA_SIG_free FIPS_ecdsa_sig_free
  191. #define ecdsa_check fips_ecdsa_check
  192. #define ecdh_check fips_ecdh_check
  193. #define RAND_bytes FIPS_rand_bytes
  194. #define RAND_pseudo_bytes FIPS_rand_pseudo_bytes
  195. #define RAND_add FIPS_rand_add
  196. #define RAND_seed FIPS_rand_seed
  197. #define RAND_status FIPS_rand_status
  198. #endif
  199. /* BEGIN ERROR CODES */
  200. /* The following lines are auto generated by the script mkerr.pl. Any changes
  201. * made after this point may be overwritten when the script is next run.
  202. */
  203. void ERR_load_FIPS_strings(void);
  204. /* Error codes for the FIPS functions. */
  205. /* Function codes. */
  206. #define FIPS_F_DH_BUILTIN_GENPARAMS 100
  207. #define FIPS_F_DH_INIT 148
  208. #define FIPS_F_DSA_BUILTIN_PARAMGEN 101
  209. #define FIPS_F_DSA_BUILTIN_PARAMGEN2 102
  210. #define FIPS_F_DSA_DO_SIGN 103
  211. #define FIPS_F_DSA_DO_VERIFY 104
  212. #define FIPS_F_FIPS_CHECK_DSA 105
  213. #define FIPS_F_FIPS_CHECK_DSA_PRNG 151
  214. #define FIPS_F_FIPS_CHECK_EC 106
  215. #define FIPS_F_FIPS_CHECK_EC_PRNG 152
  216. #define FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT 107
  217. #define FIPS_F_FIPS_CHECK_RSA 108
  218. #define FIPS_F_FIPS_CHECK_RSA_PRNG 150
  219. #define FIPS_F_FIPS_CIPHERINIT 109
  220. #define FIPS_F_FIPS_DIGESTINIT 110
  221. #define FIPS_F_FIPS_DRBG_BYTES 111
  222. #define FIPS_F_FIPS_DRBG_CHECK 146
  223. #define FIPS_F_FIPS_DRBG_CPRNG_TEST 112
  224. #define FIPS_F_FIPS_DRBG_GENERATE 113
  225. #define FIPS_F_FIPS_DRBG_HEALTH_CHECK 114
  226. #define FIPS_F_FIPS_DRBG_INIT 115
  227. #define FIPS_F_FIPS_DRBG_INSTANTIATE 116
  228. #define FIPS_F_FIPS_DRBG_NEW 117
  229. #define FIPS_F_FIPS_DRBG_RESEED 118
  230. #define FIPS_F_FIPS_DRBG_SINGLE_KAT 119
  231. #define FIPS_F_FIPS_GET_ENTROPY 147
  232. #define FIPS_F_FIPS_MODE_SET 120
  233. #define FIPS_F_FIPS_PKEY_SIGNATURE_TEST 121
  234. #define FIPS_F_FIPS_RAND_ADD 122
  235. #define FIPS_F_FIPS_RAND_BYTES 123
  236. #define FIPS_F_FIPS_RAND_PSEUDO_BYTES 124
  237. #define FIPS_F_FIPS_RAND_SEED 125
  238. #define FIPS_F_FIPS_RAND_SET_METHOD 126
  239. #define FIPS_F_FIPS_RAND_STATUS 127
  240. #define FIPS_F_FIPS_SELFTEST_AES 128
  241. #define FIPS_F_FIPS_SELFTEST_AES_CCM 145
  242. #define FIPS_F_FIPS_SELFTEST_AES_GCM 129
  243. #define FIPS_F_FIPS_SELFTEST_AES_XTS 144
  244. #define FIPS_F_FIPS_SELFTEST_CMAC 130
  245. #define FIPS_F_FIPS_SELFTEST_DES 131
  246. #define FIPS_F_FIPS_SELFTEST_DSA 132
  247. #define FIPS_F_FIPS_SELFTEST_ECDSA 133
  248. #define FIPS_F_FIPS_SELFTEST_HMAC 134
  249. #define FIPS_F_FIPS_SELFTEST_SHA1 135
  250. #define FIPS_F_FIPS_SELFTEST_X931 136
  251. #define FIPS_F_HASH_FINAL 137
  252. #define FIPS_F_RSA_BUILTIN_KEYGEN 138
  253. #define FIPS_F_RSA_EAY_INIT 149
  254. #define FIPS_F_RSA_EAY_PRIVATE_DECRYPT 139
  255. #define FIPS_F_RSA_EAY_PRIVATE_ENCRYPT 140
  256. #define FIPS_F_RSA_EAY_PUBLIC_DECRYPT 141
  257. #define FIPS_F_RSA_EAY_PUBLIC_ENCRYPT 142
  258. #define FIPS_F_RSA_X931_GENERATE_KEY_EX 143
  259. /* Reason codes. */
  260. #define FIPS_R_ADDITIONAL_INPUT_TOO_LONG 100
  261. #define FIPS_R_ALREADY_INSTANTIATED 101
  262. #define FIPS_R_CONTRADICTING_EVIDENCE 102
  263. #define FIPS_R_DRBG_STUCK 103
  264. #define FIPS_R_ENTROPY_ERROR_UNDETECTED 104
  265. #define FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED 105
  266. #define FIPS_R_ENTROPY_SOURCE_STUCK 142
  267. #define FIPS_R_ERROR_INITIALISING_DRBG 106
  268. #define FIPS_R_ERROR_INSTANTIATING_DRBG 107
  269. #define FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT 108
  270. #define FIPS_R_ERROR_RETRIEVING_ENTROPY 109
  271. #define FIPS_R_ERROR_RETRIEVING_NONCE 110
  272. #define FIPS_R_FINGERPRINT_DOES_NOT_MATCH 111
  273. #define FIPS_R_FINGERPRINT_DOES_NOT_MATCH_NONPIC_RELOCATED 112
  274. #define FIPS_R_FINGERPRINT_DOES_NOT_MATCH_SEGMENT_ALIASING 113
  275. #define FIPS_R_FIPS_MODE_ALREADY_SET 114
  276. #define FIPS_R_FIPS_SELFTEST_FAILED 115
  277. #define FIPS_R_FUNCTION_ERROR 116
  278. #define FIPS_R_GENERATE_ERROR 117
  279. #define FIPS_R_GENERATE_ERROR_UNDETECTED 118
  280. #define FIPS_R_INSTANTIATE_ERROR 119
  281. #define FIPS_R_INSUFFICIENT_SECURITY_STRENGTH 120
  282. #define FIPS_R_INTERNAL_ERROR 121
  283. #define FIPS_R_INVALID_KEY_LENGTH 122
  284. #define FIPS_R_INVALID_PARAMETERS 144
  285. #define FIPS_R_IN_ERROR_STATE 123
  286. #define FIPS_R_KEY_TOO_SHORT 124
  287. #define FIPS_R_NON_FIPS_METHOD 125
  288. #define FIPS_R_NOT_INSTANTIATED 126
  289. #define FIPS_R_PAIRWISE_TEST_FAILED 127
  290. #define FIPS_R_PERSONALISATION_ERROR_UNDETECTED 128
  291. #define FIPS_R_PERSONALISATION_STRING_TOO_LONG 129
  292. #define FIPS_R_PRNG_STRENGTH_TOO_LOW 143
  293. #define FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED 130
  294. #define FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG 131
  295. #define FIPS_R_RESEED_COUNTER_ERROR 132
  296. #define FIPS_R_RESEED_ERROR 133
  297. #define FIPS_R_SELFTEST_FAILED 134
  298. #define FIPS_R_SELFTEST_FAILURE 135
  299. #define FIPS_R_STRENGTH_ERROR_UNDETECTED 136
  300. #define FIPS_R_TEST_FAILURE 137
  301. #define FIPS_R_UNINSTANTIATE_ERROR 141
  302. #define FIPS_R_UNINSTANTIATE_ZEROISE_ERROR 138
  303. #define FIPS_R_UNSUPPORTED_DRBG_TYPE 139
  304. #define FIPS_R_UNSUPPORTED_PLATFORM 140
  305. #ifdef __cplusplus
  306. }
  307. #endif
  308. #endif