testing/libgcrypt
SHA256
3
0
Fork 0
forked from pool/libgcrypt
Code Pull Requests Activity
main
libgcrypt/libgcrypt-FIPS-SLI-hash-mac.patch
Pedro Monreal Gonzalez c1414c55a9 Accepting request 1183811 from home:pmonrealgonzalez:branches:devel:libraries:c_c++ 
- Update to 1.11.0:
  * New and extended interfaces:
    - Add an API for Key Encapsulation Mechanism (KEM). [T6755]
    - Add Streamlined NTRU Prime sntrup761 algorithm. [rCcf9923e1a5]
    - Add Kyber algorithm according to FIPS 203 ipd 2023-08-24. [rC18e5c0d268]
    - Add Classic McEliece algorithm. [rC003367b912]
    - Add One-Step KDF with hash and MAC. [T5964]
    - Add KDF algorithm HKDF of RFC-5869. [T5964]
    - Add KDF algorithm X963KDF for use in CMS. [rC3abac420b3]
    - Add GMAC-SM4 and Poly1305-SM4. [rCd1ccc409d4]
    - Add ARIA block cipher algorithm. [rC316c6d7715]
    - Add explicit FIPS indicators for MD and MAC algorithms. [T6376]
    - Add support for SHAKE as MGF in RSA. [T6557]
    - Add gcry_md_read support for SHAKE algorithms. [T6539]
    - Add gcry_md_hash_buffers_ext function. [T7035]
    - Add cSHAKE hash algorithm. [rC065b3f4e02]
    - Support internal generation of IV for AEAD cipher mode. [T4873]
  * Performance:
    - Add SM3 ARMv8/AArch64/CE assembly implementation. [rCfe891ff4a3]
    - Add SM4 ARMv8/AArch64 assembly implementation. [rCd8825601f1]
    - Add SM4 GFNI/AVX2 and GFI/AVX512 implementation. [rC5095d60af4,rCeaed633c16]
    - Add SM4 ARMv9 SVE CE assembly implementation. [rC2dc2654006]
    - Add PowerPC vector implementation of SM4. [rC0b2da804ee]
    - Optimize ChaCha20 and Poly1305 for PPC P10 LE. [T6006]
    - Add CTR32LE bulk acceleration for AES on PPC. [rC84f2e2d0b5]
    - Add generic bulk acceleration for CTR32LE mode (GCM-SIV) for SM4
      and Camellia. [rCcf956793af]
    - Add GFNI/AVX2 implementation of Camellia. [rC4e6896eb9f]
    - Add AVX2 and AVX512 accelerated implementations for GHASH (GCM)
      and POLYVAL (GCM-SIV). [rCd857e85cb4, rCe6f3600193]

OBS-URL: https://build.opensuse.org/request/show/1183811
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libgcrypt?expand=0&rev=180
2024-06-28 09:08:29 +00:00

173 lines
5.8 KiB
Diff
Raw Permalink Blame History

Index: libgcrypt-1.11.0/doc/gcrypt.texi
===================================================================
--- libgcrypt-1.11.0.orig/doc/gcrypt.texi
+++ libgcrypt-1.11.0/doc/gcrypt.texi
@@ -998,13 +998,21 @@ certification. If the function is approv
@code{GPG_ERR_NO_ERROR} (other restrictions might still apply).
Otherwise @code{GPG_ERR_NOT_SUPPORTED} is returned.
-@item GCRYCTL_FIPS_SERVICE_INDICATOR_MAC; Arguments: enum gcry_mac_algos
+@item GCRYCTL_FIPS_SERVICE_INDICATOR_HASH; Arguments: enum gcry_md_algos
-Check if the given MAC is approved under the current FIPS 140-3
-certification. If the MAC is approved, this function returns
-@code{GPG_ERR_NO_ERROR}. Otherwise @code{GPG_ERR_NOT_SUPPORTED}
+Check if the given HASH is approved under the current FIPS 140-3
+certification. If the HASH is approved, this function returns
+@code{GPS_ERR_NO_ERROR}. Otherwise @code{GPG_ERR_NOT_SUPPORTED}
is returned.
+@item GCRYCTL_FIPS_SERVICE_INDICATOR_MAC; Arguments: enum gcry_mac_algos [, unsigned int]
+
+Check if the given MAC is approved under the current FIPS 140-3
+certification. The second parameter provides the keylen (if the
+algorithm supports different key sizes). If the MAC is approved,
+this function returns @code{GPS_ERR_NO_ERROR}. Otherwise
+@code{GPG_ERR_NOT_SUPPORTED} is returned.
+
@item GCRYCTL_FIPS_SERVICE_INDICATOR_MD; Arguments: enum gcry_md_algos
Check if the given message digest algorithm is approved under the current
Index: libgcrypt-1.11.0/src/fips.c
===================================================================
--- libgcrypt-1.11.0.orig/src/fips.c
+++ libgcrypt-1.11.0/src/fips.c
@@ -378,31 +378,6 @@ _gcry_fips_indicator_cipher (va_list arg
}
}
-int
-_gcry_fips_indicator_mac (va_list arg_ptr)
-{
- enum gcry_mac_algos alg = va_arg (arg_ptr, enum gcry_mac_algos);
-
- switch (alg)
- {
- case GCRY_MAC_CMAC_AES:
- case GCRY_MAC_HMAC_SHA1:
- case GCRY_MAC_HMAC_SHA224:
- case GCRY_MAC_HMAC_SHA256:
- case GCRY_MAC_HMAC_SHA384:
- case GCRY_MAC_HMAC_SHA512:
- case GCRY_MAC_HMAC_SHA512_224:
- case GCRY_MAC_HMAC_SHA512_256:
- case GCRY_MAC_HMAC_SHA3_224:
- case GCRY_MAC_HMAC_SHA3_256:
- case GCRY_MAC_HMAC_SHA3_384:
- case GCRY_MAC_HMAC_SHA3_512:
- return GPG_ERR_NO_ERROR;
- default:
- return GPG_ERR_NOT_SUPPORTED;
- }
-}
-
/* FIPS approved curves, extracted from:
* cipher/ecc-curves.c:curve_aliases[] and domain_parms[]. */
static const struct
@@ -602,6 +577,62 @@ _gcry_fips_indicator_pk_flags (va_list a
return GPG_ERR_NOT_SUPPORTED;
}
+int
+_gcry_fips_indicator_hash (va_list arg_ptr)
+{
+ enum gcry_md_algos alg = va_arg (arg_ptr, enum gcry_md_algos);
+
+ switch (alg)
+ {
+ case GCRY_MD_SHA1:
+ case GCRY_MD_SHA224:
+ case GCRY_MD_SHA256:
+ case GCRY_MD_SHA384:
+ case GCRY_MD_SHA512:
+ case GCRY_MD_SHA512_224:
+ case GCRY_MD_SHA512_256:
+ case GCRY_MD_SHA3_224:
+ case GCRY_MD_SHA3_256:
+ case GCRY_MD_SHA3_384:
+ case GCRY_MD_SHA3_512:
+ case GCRY_MD_SHAKE128:
+ case GCRY_MD_SHAKE256:
+ return GPG_ERR_NO_ERROR;
+ default:
+ return GPG_ERR_NOT_SUPPORTED;
+ }
+}
+
+int
+_gcry_fips_indicator_mac (va_list arg_ptr)
+{
+ enum gcry_mac_algos alg = va_arg (arg_ptr, enum gcry_mac_algos);
+ unsigned int keylen = va_arg (arg_ptr, unsigned int);
+
+ switch (alg)
+ {
+ case GCRY_MAC_HMAC_SHA1:
+ case GCRY_MAC_HMAC_SHA224:
+ case GCRY_MAC_HMAC_SHA256:
+ case GCRY_MAC_HMAC_SHA384:
+ case GCRY_MAC_HMAC_SHA512:
+ case GCRY_MAC_HMAC_SHA512_224:
+ case GCRY_MAC_HMAC_SHA512_256:
+ case GCRY_MAC_HMAC_SHA3_224:
+ case GCRY_MAC_HMAC_SHA3_256:
+ case GCRY_MAC_HMAC_SHA3_384:
+ case GCRY_MAC_HMAC_SHA3_512:
+ if (keylen >= 112) {
+ return GPG_ERR_NO_ERROR;
+ }
+ case GCRY_MAC_CMAC_AES:
+ if (keylen == 128 || keylen == 192 || keylen == 256) {
+ return GPG_ERR_NO_ERROR;
+ }
+ default:
+ return GPG_ERR_NOT_SUPPORTED;
+ }
+}
/* This is a test on whether the library is in the error or
operational state. */
Index: libgcrypt-1.11.0/src/g10lib.h
===================================================================
--- libgcrypt-1.11.0.orig/src/g10lib.h
+++ libgcrypt-1.11.0/src/g10lib.h
@@ -469,6 +469,7 @@ void _gcry_fips_signal_error (const char
#endif
int _gcry_fips_indicator_cipher (va_list arg_ptr);
+int _gcry_fips_indicator_hash (va_list arg_ptr);
int _gcry_fips_indicator_mac (va_list arg_ptr);
int _gcry_fips_indicator_md (va_list arg_ptr);
int _gcry_fips_indicator_kdf (va_list arg_ptr);
Index: libgcrypt-1.11.0/src/gcrypt.h.in
===================================================================
--- libgcrypt-1.11.0.orig/src/gcrypt.h.in
+++ libgcrypt-1.11.0/src/gcrypt.h.in
@@ -336,7 +336,8 @@ enum gcry_ctl_cmds
GCRYCTL_FIPS_SERVICE_INDICATOR_MD = 86,
GCRYCTL_FIPS_SERVICE_INDICATOR_PK_FLAGS = 87,
GCRYCTL_MD_CUSTOMIZE = 88,
- GCRYCTL_FIPS_SERVICE_INDICATOR_PK = 89
+ GCRYCTL_FIPS_SERVICE_INDICATOR_PK = 89,
+ GCRYCTL_FIPS_SERVICE_INDICATOR_HASH = 90
};
/* Perform various operations defined by CMD. */
Index: libgcrypt-1.11.0/src/global.c
===================================================================
--- libgcrypt-1.11.0.orig/src/global.c
+++ libgcrypt-1.11.0/src/global.c
@@ -794,6 +794,12 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
rc = _gcry_fips_indicator_cipher (arg_ptr);
break;
+ case GCRYCTL_FIPS_SERVICE_INDICATOR_HASH:
+ /* Get FIPS Service Indicator for a given HASH. Returns GPG_ERR_NO_ERROR
+ * if algorithm is allowed or GPG_ERR_NOT_SUPPORTED otherwise */
+ rc = _gcry_fips_indicator_hash (arg_ptr);
+ break;
+
case GCRYCTL_FIPS_SERVICE_INDICATOR_MAC:
/* Get FIPS Service Indicator for a given message authentication code.
* Returns GPG_ERR_NO_ERROR if algorithm is allowed or
View Git Blame Copy Permalink