Line data    Source code

       1              : /**
       2              :  *  Copyright Notice:
       3              :  *  Copyright 2023-2025 DMTF. All rights reserved.
       4              :  *  License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
       5              :  **/
       6              : 
       7              : #include "internal/libspdm_crypt_lib.h"
       8              : #include "internal/libspdm_common_lib.h"
       9              : #include "internal/libspdm_fips_lib.h"
      10              : 
      11              : #if LIBSPDM_FIPS_MODE
      12              : 
      13              : /**
      14              :  * ECDH self_test
      15              :  **/
      16            1 : bool libspdm_fips_selftest_ecdh(void *fips_selftest_context)
      17              : {
      18            1 :     bool result = true;
      19              : 
      20              : #if LIBSPDM_ECDHE_SUPPORT
      21            1 :     libspdm_fips_selftest_context_t *context = fips_selftest_context;
      22            1 :     LIBSPDM_ASSERT(fips_selftest_context != NULL);
      23              : 
      24              :     /* any test fail cause the FIPS fail*/
      25            1 :     if (context->tested_algo != context->self_test_result) {
      26            0 :         return false;
      27              :     }
      28              : 
      29              :     /* check if run before.*/
      30            1 :     if ((context->tested_algo & LIBSPDM_FIPS_SELF_TEST_ECDH) != 0) {
      31            0 :         return true;
      32              :     }
      33              : 
      34              :     void *ec_context;
      35              :     uint8_t common_key[66];
      36              :     size_t common_key_length;
      37              : 
      38            1 :     common_key_length = sizeof(common_key);
      39            1 :     libspdm_zero_mem(common_key, common_key_length);
      40              :     /* self private Key*/
      41            1 :     const uint8_t self_privkey[] = {
      42              :         0xd6, 0x84, 0xd1, 0x7c, 0xe3, 0x6b, 0xe7, 0x08,
      43              :         0xbc, 0xd9, 0x89, 0x3f, 0xbb, 0xf4, 0xf2, 0xcf,
      44              :         0x8d, 0x7f, 0xd4, 0x72, 0xbc, 0xfb, 0x54, 0x29,
      45              :         0xd9, 0x86, 0xe2, 0x86, 0xc2, 0x38, 0xe5, 0x88
      46              :     };
      47              : 
      48              :     /* peer public Key*/
      49            1 :     const uint8_t peer_public[] = {
      50              :         0x54, 0xbc, 0x5f, 0x6b, 0x70, 0x9b, 0x29, 0x5c,
      51              :         0xa9, 0x43, 0xd0, 0xb7, 0xf3, 0xa2, 0x4b, 0xf0,
      52              :         0x76, 0xb1, 0xd1, 0x9f, 0x55, 0x6a, 0x4e, 0xa0,
      53              :         0x40, 0x54, 0xd2, 0xb1, 0x2f, 0x0f, 0xc1, 0x6d,
      54              :         0xe7, 0x53, 0xe1, 0x3a, 0xd9, 0xb9, 0x2d, 0xd6,
      55              :         0x3a, 0xda, 0x9d, 0xa9, 0xa9, 0x4e, 0xdd, 0x30,
      56              :         0x60, 0x24, 0x9f, 0x9d, 0xcb, 0xfc, 0x1a, 0x56,
      57              :         0x35, 0x63, 0x64, 0xe2, 0x64, 0xcf, 0x00, 0xed
      58              :     };
      59              : 
      60              :     /* expected ecdh common secret*/
      61            1 :     const uint8_t expected_ecdh_secret[] = {
      62              :         0x05, 0xd5, 0xc8, 0x66, 0x83, 0x59, 0xe8, 0x33,
      63              :         0x1d, 0xb7, 0x68, 0x2f, 0x98, 0x71, 0x2f, 0xfe,
      64              :         0x2d, 0xfa, 0x10, 0xe6, 0x67, 0x89, 0x81, 0xd8,
      65              :         0x51, 0xd9, 0x72, 0x47, 0x17, 0x7b, 0xa3, 0x5e
      66              :     };
      67              : 
      68            1 :     ec_context = libspdm_ec_new_by_nid(LIBSPDM_CRYPTO_NID_ECDSA_NIST_P256);
      69            1 :     if (ec_context == NULL) {
      70            0 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "ECDH new failed \n"));
      71            0 :         result = false;
      72            0 :         goto update;
      73              :     }
      74              : 
      75            1 :     result = libspdm_ec_set_priv_key(ec_context, self_privkey, sizeof(self_privkey));
      76            1 :     if (!result) {
      77            0 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "ECDH set private key failed \n"));
      78            0 :         libspdm_ec_free(ec_context);
      79            0 :         result = false;
      80            0 :         goto update;
      81              :     }
      82              : 
      83            1 :     result = libspdm_ec_compute_key(ec_context, peer_public, sizeof(peer_public), common_key,
      84              :                                     &common_key_length);
      85            1 :     if (!result) {
      86            0 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "ECDH compute key failed \n"));
      87            0 :         libspdm_ec_free(ec_context);
      88            0 :         result = false;
      89            0 :         goto update;
      90              :     }
      91              : 
      92              :     /*KAT test*/
      93            1 :     if (common_key_length != sizeof(expected_ecdh_secret)) {
      94            0 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "ECDH KAT failed \n"));
      95            0 :         libspdm_ec_free(ec_context);
      96            0 :         result = false;
      97            0 :         goto update;
      98              :     }
      99              : 
     100            1 :     if (!libspdm_consttime_is_mem_equal(common_key, expected_ecdh_secret,
     101              :                                         sizeof(expected_ecdh_secret))) {
     102            0 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "ECDH KAT failed \n"));
     103            0 :         result = false;
     104            0 :         goto update;
     105              :     }
     106              : 
     107            1 : update:
     108              :     /* mark it as tested*/
     109            1 :     context->tested_algo |= LIBSPDM_FIPS_SELF_TEST_ECDH;
     110              : 
     111              :     /* record test result*/
     112            1 :     if (result) {
     113            1 :         context->self_test_result |= LIBSPDM_FIPS_SELF_TEST_ECDH;
     114              :     } else {
     115            0 :         context->self_test_result &= ~LIBSPDM_FIPS_SELF_TEST_ECDH;
     116              :     }
     117              : 
     118              : #endif/*LIBSPDM_ECDHE_SUPPORT*/
     119              : 
     120            1 :     return result;
     121              : }
     122              : 
     123              : #endif/*LIBSPDM_FIPS_MODE*/