mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 06:44:00 -04:00
2505f9157e
Add a FIPS cryptographic algorithm self-test for AES-CMAC to fulfill the self-test requirement when this code is built into a FIPS 140 cryptographic module. This provides parity with the traditional crypto API, which uses crypto/testmgr.c to meet the FIPS self-test requirement. Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Link: https://lore.kernel.org/r/20260218213501.136844-8-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
47 lines
1.6 KiB
Python
Executable File
47 lines
1.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
#
|
|
# Script that generates lib/crypto/fips.h
|
|
#
|
|
# Requires that python-cryptography be installed.
|
|
#
|
|
# Copyright 2025 Google LLC
|
|
|
|
import cryptography.hazmat.primitives.ciphers
|
|
import cryptography.hazmat.primitives.cmac
|
|
import hashlib
|
|
import hmac
|
|
|
|
fips_test_data = b"fips test data\0\0"
|
|
fips_test_key = b"fips test key\0\0\0"
|
|
|
|
def print_static_u8_array_definition(name, value):
|
|
print('')
|
|
print(f'static const u8 {name}[] __initconst __maybe_unused = {{')
|
|
for i in range(0, len(value), 8):
|
|
line = '\t' + ''.join(f'0x{b:02x}, ' for b in value[i:i+8])
|
|
print(f'{line.rstrip()}')
|
|
print('};')
|
|
|
|
print('/* SPDX-License-Identifier: GPL-2.0-or-later */')
|
|
print(f'/* This file was generated by: gen-fips-testvecs.py */')
|
|
print()
|
|
print('#include <linux/fips.h>')
|
|
|
|
print_static_u8_array_definition("fips_test_data", fips_test_data)
|
|
print_static_u8_array_definition("fips_test_key", fips_test_key)
|
|
|
|
for alg in 'sha1', 'sha256', 'sha512':
|
|
ctx = hmac.new(fips_test_key, digestmod=alg)
|
|
ctx.update(fips_test_data)
|
|
print_static_u8_array_definition(f'fips_test_hmac_{alg}_value', ctx.digest())
|
|
|
|
print_static_u8_array_definition(f'fips_test_sha3_256_value',
|
|
hashlib.sha3_256(fips_test_data).digest())
|
|
|
|
aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_key)
|
|
aes_cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
|
|
aes_cmac.update(fips_test_data)
|
|
print_static_u8_array_definition('fips_test_aes_cmac_value',
|
|
aes_cmac.finalize())
|