Skip to content

Commit a5a0bfe

Browse files
bjayanaxYogaraj-Alamenda
bjayanax
authored and
Yogaraj-Alamenda
committed
Enable TLSv1.3 HKDF for FIPS qatprovider.
- Enable HKDF and its fips requirements like self-tests, approved service & zeroization indicators - Version bump to v1.3.1 Signed-off-by: Jaya Naga Venkata Sudhakar <bavirisettyx.jaya.naga.venkata.sudhakar@intel.com>
1 parent 6547b63 commit a5a0bfe

14 files changed

+258
-23
lines changed

‎configure.ac‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Process this file with autoconf to produce a configure script.
33

44
AC_PREREQ([2.68])
5-
AC_INIT([qatengine], [1.3.0], [])
5+
AC_INIT([qatengine], [1.3.1], [])
66
AC_CONFIG_SRCDIR([config.h.in])
77
AC_CONFIG_HEADERS([config.h])
88
AC_CONFIG_AUX_DIR([.])

‎docs/qat_common.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,12 +174,12 @@ self tests, integrity tests and will satisfy other FIPS 140-3 CMVP & CAVP
174174
requirements. The FIPS is build as RPM using the specfile fips/qatengine_fips.spec
175175
with QAT_HW & QAT_SW Coexistence enabled along with other flags enabled.
176176

177-
Please note that the version v1.3.0 is only satisfying FIPS 140-3 Level-1
177+
Please note that the version v1.3.1 is only satisfying FIPS 140-3 Level-1
178178
certification requirements and not FIPS certified yet.
179179
The FIPS 140-3 certification is under process.
180180

181181
## Support Algorithms in FIPS mode
182182
| Mode | Algorithms |
183183
| :---: | :---: |
184-
| QAT_HW | RSA, ECDSA, ECDH, ECDHX25519, ECDHX448, DSA, DH, TLS1.2-KDF(PRF), SHA3 & AES-GCM |
184+
| QAT_HW | RSA, ECDSA, ECDH, ECDHX25519, ECDHX448, DSA, DH, TLS1.2-KDF(PRF), TLS1.3-KDF(HKDF), SHA3 & AES-GCM |
185185
| QAT_SW | RSA, ECDSA, ECDH, ECDHX25519, SHA2 & AES-GCM |

‎e_qat.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -163,13 +163,13 @@ int qat_fips_kat_test;
163163
const char *engine_qat_id = STR(QAT_ENGINE_ID);
164164
#if defined(QAT_HW) && defined(QAT_SW)
165165
const char *engine_qat_name =
166-
"Reference implementation of QAT crypto engine(qat_hw & qat_sw) v1.3.0";
166+
"Reference implementation of QAT crypto engine(qat_hw & qat_sw) v1.3.1";
167167
#elif QAT_HW
168168
const char *engine_qat_name =
169-
"Reference implementation of QAT crypto engine(qat_hw) v1.3.0";
169+
"Reference implementation of QAT crypto engine(qat_hw) v1.3.1";
170170
#else
171171
const char *engine_qat_name =
172-
"Reference implementation of QAT crypto engine(qat_sw) v1.3.0";
172+
"Reference implementation of QAT crypto engine(qat_sw) v1.3.1";
173173
#endif
174174
unsigned int engine_inited = 0;
175175
int fallback_to_openssl = 0;

‎fips/qatprovider-fips.spec‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
%global openssl_src_path /root/openssl
2424

2525
Name: qatprovider-fips
26-
Version: 1.3.0
26+
Version: 1.3.1
2727
Release: 1%{?dist}
2828
Summary: Intel QuickAssist Technology(QAT) OpenSSL Provider
2929

@@ -121,7 +121,7 @@ cp -rf %{buildroot}/%{_libdir}/libcrypto_mb.so.%{ippcpfullversion} %{openssl_lib
121121
cp -rf %{buildroot}/%{_libdir}/libcrypto_mb.so %{openssl_lib_path}/lib64/ossl-modules/
122122
cp -rf %{buildroot}/%{_libdir}/libIPSec_MB.so.%{fullversion} %{openssl_lib_path}/lib64/ossl-modules/
123123
cp -rf %{buildroot}/%{_libdir}/libIPSec_MB.so %{openssl_lib_path}/lib64/ossl-modules/
124-
./configure --with-openssl_install_dir=%{openssl_lib_path} --with-qat_hw_dir=/QAT --enable-qat_provider --enable-qat_hw_gcm --enable-qat_hw_sha3 --enable-qat_fips --enable-qat_sw --enable-qat_small_pkt_offload --enable-qat_insecure_algorithms --disable-qat_sw_sm2 --disable-qat_hw_ciphers
124+
./configure --with-openssl_install_dir=%{openssl_lib_path} --with-qat_hw_dir=/QAT --enable-qat_provider --enable-qat_hw_gcm --enable-qat_hw_hkdf --enable-qat_hw_sha3 --enable-qat_fips --enable-qat_sw --enable-qat_small_pkt_offload --enable-qat_insecure_algorithms --disable-qat_sw_sm2 --disable-qat_hw_ciphers
125125

126126
make clean
127127
%make_build
@@ -201,6 +201,9 @@ rm -rf %{buildroot}
201201
%{_includedir}/crypto_mb/sm4_gcm.h
202202

203203
%changelog
204+
* Mon Aug 21 2023 Yogaraj Alamenda <yogarajx.alamenda@intel.com> - 1.3.1-1
205+
- Update to v1.3.1
206+
204207
* Wed Aug 09 2023 Yogaraj Alamenda <yogarajx.alamenda@intel.com> - 1.3.0-1
205208
- Update to v1.3.0
206209

‎fips_install.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ cp -f /lib/firmware/qat_4xxx.bin $OPENSSL_ENGINES/
1111
cp -f /lib/firmware/qat_4xxx_mmp.bin $OPENSSL_ENGINES/
1212
cp -f /usr/lib64/libIPSec_MB.so $OPENSSL_ENGINES/
1313
cp -f /usr/lib64/libcrypto_mb.so $OPENSSL_ENGINES/
14-
./configure --with-qat_hw_dir=$ICP_ROOT --with-openssl_install_dir=$OPENSSL_LIB --enable-qat_sw --enable-qat_provider --enable-qat_hw_sha3 --enable-qat_hw_gcm --enable-qat_fips --enable-qat_insecure_algorithms --disable-qat_sw_sm2 --disable-qat_hw_ciphers
14+
./configure --with-qat_hw_dir=$ICP_ROOT --with-openssl_install_dir=$OPENSSL_LIB --enable-qat_sw --enable-qat_provider --enable-qat_hw_sha3 --enable-qat_hw_gcm --enable-qat_hw_hkdf --enable-qat_fips --enable-qat_insecure_algorithms --disable-qat_sw_sm2 --disable-qat_hw_ciphers
1515
make clean
1616
make -j 30
1717
make install
@@ -36,7 +36,7 @@ cp -f /usr/lib64/libusdm_drv_s.so $OPENSSL_ENGINES/
3636
cp -f /usr/lib64/libqat_s.so $OPENSSL_ENGINES/
3737
cp -f /lib/firmware/qat_4xxx.bin $OPENSSL_ENGINES/
3838
cp -f /lib/firmware/qat_4xxx_mmp.bin $OPENSSL_ENGINES/
39-
./configure --with-qat_hw_dir=$ICP_ROOT --with-openssl_install_dir=$OPENSSL_LIB --enable-qat_provider --enable-qat_hw_sha3 --enable-qat_hw_gcm --enable-qat_fips --enable-qat_insecure_algorithms --disable-qat_hw_ciphers
39+
./configure --with-qat_hw_dir=$ICP_ROOT --with-openssl_install_dir=$OPENSSL_LIB --enable-qat_provider --enable-qat_hw_sha3 --enable-qat_hw_gcm --enable-qat_hw_hkdf --enable-qat_fips --enable-qat_insecure_algorithms --disable-qat_hw_ciphers
4040
else
4141
cp -f /usr/lib64/libIPSec_MB.so $OPENSSL_ENGINES/
4242
cp -f /usr/lib64/libcrypto_mb.so $OPENSSL_ENGINES/

‎qat_fips.c‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,11 +181,20 @@ void fips_result(void)
181181
}
182182

183183
for (i = 0; i < (int)OSSL_NELEM(st_kat_kdf_tests); ++i) {
184-
if ((qat_hw_prf_offload == 0
184+
if ((qat_hw_hkdf_offload == 0
185+
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS13_KDF_EXTRACT_256"))
186+
|| (qat_hw_hkdf_offload == 0
187+
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS13_KDF_EXPAND_256"))
188+
|| (qat_hw_hkdf_offload == 0
189+
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS13_KDF_EXTRACT_384"))
190+
|| (qat_hw_hkdf_offload == 0
191+
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS13_KDF_EXPAND_384"))
192+
|| (qat_hw_prf_offload == 0
185193
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS12_PRF_256"))
186194
|| (qat_hw_prf_offload == 0
187195
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS12_PRF_384")))
188196
continue;
197+
189198
# ifdef QAT_DEBUG
190199
INFO("\t%s : (%s) : %s\n", qat_kdf_result->desc[i],
191200
qat_kdf_result->type[i],
@@ -308,11 +317,23 @@ void fips_result(void)
308317
}
309318

310319
for (i = 0; i < (int)OSSL_NELEM(st_kat_kdf_tests); ++i) {
311-
if ((qat_hw_prf_offload == 0
320+
if ((qat_hw_hkdf_offload == 0
321+
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS13_KDF_EXTRACT_256"))
322+
|| (qat_hw_hkdf_offload == 0
323+
&& !strcmp(st_kat_kdf_tests[i].desc,
324+
"TLS13_KDF_EXPAND_256"))
325+
|| (qat_hw_hkdf_offload == 0
326+
&& !strcmp(st_kat_kdf_tests[i].desc,
327+
"TLS13_KDF_EXTRACT_384"))
328+
|| (qat_hw_hkdf_offload == 0
329+
&& !strcmp(st_kat_kdf_tests[i].desc,
330+
"TLS13_KDF_EXPAND_384"))
331+
|| (qat_hw_prf_offload == 0
312332
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS12_PRF_256"))
313333
|| (qat_hw_prf_offload == 0
314334
&& !strcmp(st_kat_kdf_tests[i].desc, "TLS12_PRF_384")))
315335
continue;
336+
316337
# ifdef QAT_DEBUG
317338
INFO("\t%s : (%s) : %s\n", qat_async_kdf_result->desc[i],
318339
qat_async_kdf_result->type[i],
@@ -1099,6 +1120,7 @@ int qat_fips_self_test(void *qatctx, int ondemand, int co_ex_enabled)
10991120
qat_hw_dsa_offload = 0;
11001121
qat_hw_dh_offload = 0;
11011122
qat_hw_ecx_448_offload = 0;
1123+
qat_hw_hkdf_offload = 0;
11021124
qat_hw_prf_offload = 0;
11031125
# ifdef ENABLE_QAT_SW_SHA2
11041126
qat_hw_sha_offload = 0;
@@ -1146,6 +1168,9 @@ int qat_fips_self_test(void *qatctx, int ondemand, int co_ex_enabled)
11461168
# ifdef ENABLE_QAT_HW_ECX
11471169
qat_hw_ecx_448_offload = 1;
11481170
# endif
1171+
# ifdef ENABLE_QAT_HW_HKDF
1172+
qat_hw_hkdf_offload = 1;
1173+
# endif
11491174
# ifdef ENABLE_QAT_HW_PRF
11501175
qat_hw_prf_offload = 1;
11511176
# endif

‎qat_hw_gcm.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1085,10 +1085,6 @@ int qat_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
10851085

10861086
CRYPTO_QAT_LOG("CIPHER - %s\n", __func__);
10871087

1088-
#ifdef ENABLE_QAT_FIPS
1089-
qat_fips_get_approved_status();
1090-
#endif
1091-
10921088
/* Encrypt/decrypt must be performed in place */
10931089
if (NULL == in ||
10941090
out != in ||
@@ -1425,6 +1421,9 @@ int qat_aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
14251421
QATerr(QAT_F_QAT_AES_GCM_CIPHER, QAT_R_QCTX_NULL);
14261422
return RET_FAIL;
14271423
}
1424+
#ifdef ENABLE_QAT_FIPS
1425+
qat_fips_get_approved_status();
1426+
#endif
14281427

14291428
#ifdef QAT_OPENSSL_PROVIDER
14301429
enc = QAT_GCM_GET_ENC(qctx);

‎qat_hw_hkdf.c‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,10 +70,18 @@
7070
# include "qat_hw_usdm_inf.h"
7171
#endif
7272

73+
#ifdef ENABLE_QAT_FIPS
74+
# include "qat_prov_cmvp.h"
75+
#endif
76+
7377
#include "cpa.h"
7478
#include "cpa_types.h"
7579
#include "cpa_cy_key.h"
7680

81+
#ifdef ENABLE_QAT_FIPS
82+
extern int qat_fips_key_zeroize;
83+
#endif
84+
7785
/* These limits are based on QuickAssist limits.
7886
* OpenSSL is more generous but better to restrict and fail
7987
* early on here if they are exceeded rather than later on
@@ -217,6 +225,9 @@ int qat_hkdf_init(EVP_PKEY_CTX *ctx)
217225
******************************************************************************/
218226
void qat_hkdf_cleanup(EVP_PKEY_CTX *ctx)
219227
{
228+
#ifdef ENABLE_QAT_FIPS
229+
qat_fips_key_zeroize = 0;
230+
#endif
220231
QAT_HKDF_CTX *qat_hkdf_ctx = NULL;
221232
#ifndef QAT_OPENSSL_3
222233
void (*sw_cleanup_fn_ptr)(EVP_PKEY_CTX *) = NULL;
@@ -271,9 +282,12 @@ void qat_hkdf_cleanup(EVP_PKEY_CTX *ctx)
271282
OPENSSL_free(qat_hkdf_ctx);
272283
EVP_PKEY_CTX_set_data(ctx, NULL);
273284

285+
#ifdef ENABLE_QAT_FIPS
286+
qat_fips_key_zeroize = 1;
287+
qat_fips_get_key_zeroize_status();
288+
#endif
274289
}
275290

276-
277291
/******************************************************************************
278292
* function:
279293
* qat_hkdf_ctrl(EVP_PKEY_CTX *ctx,
@@ -735,6 +749,9 @@ int qat_hkdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *olen)
735749
}
736750

737751
DEBUG("QAT HW HKDF Started\n");
752+
#ifdef ENABLE_QAT_FIPS
753+
qat_fips_get_approved_status();
754+
#endif
738755
qat_hkdf_ctx = (QAT_HKDF_CTX *)EVP_PKEY_CTX_get_data(ctx);
739756
if (qat_hkdf_ctx == NULL) {
740757
WARN("qat_hkdf_ctx is NULL\n");

‎qat_prov_cmvp.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959

6060
#define QAT_FIPS_PROVIDER_NAME "QAT Provider FIPS"
6161
#define QAT_FIPS_PROVIDER_ID "qatprovider"
62-
#define QAT_FIPS_PROVIDER_VERSION "QAT Engine v1.3.0"
62+
#define QAT_FIPS_PROVIDER_VERSION "QAT Engine v1.3.1"
6363
#ifdef QAT_HW
6464
#define QAT_HW_DRIVER_version "QAT20.l.1.0.40-00004"
6565
#endif

‎qat_prov_hkdf.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,9 @@ static int qat_kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen,
256256
const EVP_MD *md;
257257
size_t mdlen;
258258
int ret = 0;
259+
#ifdef ENABLE_QAT_FIPS
260+
qat_fips_service_indicator = 1;
261+
#endif
259262
if (!qat_prov_is_running() || !qat_kdf_tls1_3_set_ctx_params(ctx, params))
260263
goto end;
261264

@@ -323,6 +326,9 @@ static int qat_kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen,
323326
ret = qat_hkdf_derive(ctx->evp_pkey_ctx, key, &keylen);
324327

325328
end:
329+
#ifdef ENABLE_QAT_FIPS
330+
qat_fips_service_indicator = 0;
331+
#endif
326332
return ret;
327333
}
328334

0 commit comments

Comments
 (0)