From 2ddeec574bc1ae90bb4242c4ce9ad9e7975a27bd Mon Sep 17 00:00:00 2001

From: Jakub Jelen <jjelen@redhat.com>

Date: Wed, 1 Mar 2023 15:42:29 +0100

Subject: [PATCH] ecc: Do not allow skipping tests in FIPS Mode.

* cipher/ecc.c (ecc_generate): Do not allow skipping tests PCT tests

in FIPS mode.

--

The new FIPS specification requires to run the PCT without any

exceptions.

GnuPG-bug-id: 6394

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

---

 cipher/ecc.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cipher/ecc.c b/cipher/ecc.c

index 1e80200e..797f2368 100644

--- a/cipher/ecc.c

+++ b/cipher/ecc.c

@@ -677,7 +677,7 @@ ecc_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey)

         log_debug ("ecgen result  using Ed25519+EdDSA\n");

     }

-  if (!(flags & PUBKEY_FLAG_NO_KEYTEST) && fips_mode ())

+  if (fips_mode ())

     test_keys_fips (*r_skey);

  leave:

-- 

2.39.2

From 23a2d1285e35b2eb91bb422609eb1c965c8a9bf6 Mon Sep 17 00:00:00 2001

From: Jakub Jelen <jjelen@redhat.com>

Date: Thu, 2 Mar 2023 09:43:44 +0100

Subject: [PATCH] ecc: Make the PCT recoverable in FIPS mode and consistent

 with RSA.

* cipher/ecc.c (test_keys_fips): Replace calls to log_fatal with

return code on error.

(ecc_generate): Signal error when PCT fails in FIPS mode.

--

GnuPG-bug-id: 6397

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

---

 cipher/ecc.c | 36 ++++++++++++++++++++++++++++--------

 1 file changed, 28 insertions(+), 8 deletions(-)

diff --git a/cipher/ecc.c b/cipher/ecc.c

index 797f2368..19520db3 100644

--- a/cipher/ecc.c

+++ b/cipher/ecc.c

@@ -101,7 +101,7 @@ static void *progress_cb_data;

 /* Local prototypes. */

 static void test_keys (mpi_ec_t ec, unsigned int nbits);

-static void test_keys_fips (gcry_sexp_t skey);

+static int test_keys_fips (gcry_sexp_t skey);

 static void test_ecdh_only_keys (mpi_ec_t ec, unsigned int nbits, int flags);

 static unsigned int ecc_get_nbits (gcry_sexp_t parms);

@@ -308,9 +308,10 @@ test_keys (mpi_ec_t ec, unsigned int nbits)

 /* We should get here only with the NIST curves as they are the only ones

  * having the fips bit set in ecc_domain_parms_t struct so this is slightly

  * simpler than the whole ecc_generate function */

-static void

+static int

 test_keys_fips (gcry_sexp_t skey)

 {

+  int result = -1; /* Default to failure */

   gcry_md_hd_t hd = NULL;

   const char *data_tmpl = "(data (flags rfc6979) (hash %s %b))";

   gcry_sexp_t sig = NULL;

@@ -323,18 +324,27 @@ test_keys_fips (gcry_sexp_t skey)

   /* Open MD context and feed the random data in */

   rc = _gcry_md_open (&hd, GCRY_MD_SHA256, 0);

   if (rc)

-    log_fatal ("ECDSA operation: failed to initialize MD context: %s\n", gpg_strerror (rc));

+    {

+      log_error ("ECDSA operation: failed to initialize MD context: %s\n", gpg_strerror (rc));

+      goto leave;

+    }

   _gcry_md_write (hd, plaintext, sizeof(plaintext));

   /* Sign the data */

   rc = _gcry_pk_sign_md (&sig, data_tmpl, hd, skey, NULL);

   if (rc)

-    log_fatal ("ECDSA operation: signing failed: %s\n", gpg_strerror (rc));

+    {

+      log_error ("ECDSA operation: signing failed: %s\n", gpg_strerror (rc));

+      goto leave;

+    }

   /* Verify this signature.  */

   rc = _gcry_pk_verify_md (sig, data_tmpl, hd, skey, NULL);

   if (rc)

-    log_fatal ("ECDSA operation: verification failed: %s\n", gpg_strerror (rc));

+    {

+      log_error ("ECDSA operation: verification failed: %s\n", gpg_strerror (rc));

+      goto leave;

+    }

   /* Modify the data and check that the signing fails.  */

   _gcry_md_reset(hd);

@@ -342,10 +352,16 @@ test_keys_fips (gcry_sexp_t skey)

   _gcry_md_write (hd, plaintext, sizeof(plaintext));

   rc = _gcry_pk_verify_md (sig, data_tmpl, hd, skey, NULL);

   if (rc != GPG_ERR_BAD_SIGNATURE)

-    log_fatal ("ECDSA operation: signature verification worked on modified data\n");

+    {

+      log_error ("ECDSA operation: signature verification worked on modified data\n");

+      goto leave;

+    }

+  result = 0;

+leave:

   _gcry_md_close (hd);

   sexp_release (sig);

+  return result;

 }

@@ -677,8 +693,12 @@ ecc_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey)

         log_debug ("ecgen result  using Ed25519+EdDSA\n");

     }

-  if (fips_mode ())

-    test_keys_fips (*r_skey);

+  if (fips_mode () && test_keys_fips (*r_skey))

+    {

+      sexp_release (*r_skey); r_skey = NULL;

+      fips_signal_error ("self-test after key generation failed");

+      rc = GPG_ERR_SELFTEST_FAILED;

+    }

  leave:

   mpi_free (public);

-- 

2.39.2