File 0003-dh-primes-make-the-FIPS-approved-check-ret... of Package gnutls.16450

Overview Repositories Revisions Requests Users Attributes Meta

File 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch of Package gnutls.16450

From 245fb622e82bfa7b80d2cec7cafdbc65014ca3cb Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Fri, 17 Jul 2020 17:45:17 +0200
Subject: [PATCH 3/5] dh-primes: make the FIPS approved check return Q value

This is necessary for full public key validation in
SP800-56A (revision 3), section 5.6.2.3.1.

Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
 lib/auth/dh_common.c |  2 +-
 lib/dh-primes.c      | 38 +++++++++++++++++++++++---------------
 lib/dh.h             | 10 ++++++----
 3 files changed, 30 insertions(+), 20 deletions(-)

Index: gnutls-3.6.7/lib/auth/dh_common.c
===================================================================
--- gnutls-3.6.7.orig/lib/auth/dh_common.c	2020-09-03 14:20:20.133197853 +0200
+++ gnutls-3.6.7/lib/auth/dh_common.c	2020-09-03 14:20:20.233198482 +0200
@@ -256,7 +256,7 @@ _gnutls_proc_dh_common_server_kx(gnutls_
 
 #ifdef ENABLE_FIPS140
 	if (gnutls_fips140_mode_enabled() &&
-	    !_gnutls_dh_prime_is_fips_approved(data_p, n_p, data_g, n_g)) {
+	    !_gnutls_dh_prime_match_fips_approved(data_p, n_p, data_g, n_g, NULL, NULL)) {
 		gnutls_assert();
 		return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
 	}
Index: gnutls-3.6.7/lib/dh-primes.c
===================================================================
--- gnutls-3.6.7.orig/lib/dh-primes.c	2020-09-03 14:20:20.133197853 +0200
+++ gnutls-3.6.7/lib/dh-primes.c	2020-09-03 14:20:20.233198482 +0200
@@ -1446,25 +1446,28 @@ const gnutls_datum_t gnutls_modp_8192_gr
 const unsigned int gnutls_modp_8192_key_bits = 512;
 
 unsigned
-_gnutls_dh_prime_is_fips_approved(const uint8_t *prime,
-				  size_t prime_size,
-				  const uint8_t *generator,
-				  size_t generator_size)
+_gnutls_dh_prime_match_fips_approved(const uint8_t *prime,
+				     size_t prime_size,
+				     const uint8_t *generator,
+				     size_t generator_size,
+				     uint8_t **q,
+				     size_t *q_size)
 {
 	static const struct {
 		const gnutls_datum_t *prime;
 		const gnutls_datum_t *generator;
+		const gnutls_datum_t *q;
 	} primes[] = {
-		{ &gnutls_ffdhe_8192_group_prime, &gnutls_ffdhe_8192_group_generator },
-		{ &gnutls_ffdhe_6144_group_prime, &gnutls_ffdhe_6144_group_generator },
-		{ &gnutls_ffdhe_4096_group_prime, &gnutls_ffdhe_4096_group_generator },
-		{ &gnutls_ffdhe_3072_group_prime, &gnutls_ffdhe_3072_group_generator },
-		{ &gnutls_ffdhe_2048_group_prime, &gnutls_ffdhe_2048_group_generator },
-		{ &gnutls_modp_8192_group_prime, &gnutls_modp_8192_group_generator },
-		{ &gnutls_modp_6144_group_prime, &gnutls_modp_6144_group_generator },
-		{ &gnutls_modp_4096_group_prime, &gnutls_modp_4096_group_generator },
-		{ &gnutls_modp_3072_group_prime, &gnutls_modp_3072_group_generator },
-		{ &gnutls_modp_2048_group_prime, &gnutls_modp_2048_group_generator },
+		{ &gnutls_ffdhe_8192_group_prime, &gnutls_ffdhe_8192_group_generator, &gnutls_ffdhe_8192_group_q },
+		{ &gnutls_ffdhe_6144_group_prime, &gnutls_ffdhe_6144_group_generator, &gnutls_ffdhe_6144_group_q },
+		{ &gnutls_ffdhe_4096_group_prime, &gnutls_ffdhe_4096_group_generator, &gnutls_ffdhe_4096_group_q },
+		{ &gnutls_ffdhe_3072_group_prime, &gnutls_ffdhe_3072_group_generator, &gnutls_ffdhe_3072_group_q },
+		{ &gnutls_ffdhe_2048_group_prime, &gnutls_ffdhe_2048_group_generator, &gnutls_ffdhe_2048_group_q },
+		{ &gnutls_modp_8192_group_prime, &gnutls_modp_8192_group_generator, &gnutls_modp_8192_group_q },
+		{ &gnutls_modp_6144_group_prime, &gnutls_modp_6144_group_generator, &gnutls_modp_6144_group_q },
+		{ &gnutls_modp_4096_group_prime, &gnutls_modp_4096_group_generator, &gnutls_modp_4096_group_q },
+		{ &gnutls_modp_3072_group_prime, &gnutls_modp_3072_group_generator, &gnutls_modp_3072_group_q },
+		{ &gnutls_modp_2048_group_prime, &gnutls_modp_2048_group_generator, &gnutls_modp_2048_group_q },
 	};
 	size_t i;
 
@@ -1472,8 +1475,13 @@ _gnutls_dh_prime_is_fips_approved(const
 		if (primes[i].prime->size == prime_size &&
 		    memcmp(primes[i].prime->data, prime, primes[i].prime->size) == 0 &&
 		    primes[i].generator->size == generator_size &&
-		    memcmp(primes[i].generator->data, generator, primes[i].generator->size) == 0)
+		    memcmp(primes[i].generator->data, generator, primes[i].generator->size) == 0) {
+			if (q) {
+				*q = primes[i].q->data;
+				*q_size = primes[i].q->size;
+			}
 			return 1;
+		}
 	}
 
 	return 0;
Index: gnutls-3.6.7/lib/dh.h
===================================================================
--- gnutls-3.6.7.orig/lib/dh.h	2020-09-03 14:20:20.133197853 +0200
+++ gnutls-3.6.7/lib/dh.h	2020-09-03 14:20:20.233198482 +0200
@@ -67,9 +67,11 @@ _gnutls_dh_prime_is_fips_approved(const
 				  size_t generator_size);
 
 unsigned
-_gnutls_dh_prime_is_fips_approved(const uint8_t *prime,
-				  size_t prime_size,
-				  const uint8_t *generator,
-				  size_t generator_size);
+_gnutls_dh_prime_match_fips_approved(const uint8_t *prime,
+				     size_t prime_size,
+				     const uint8_t *generator,
+				     size_t generator_size,
+				     uint8_t **q,
+				     size_t *q_size);
 
 #endif

Places

File 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch of Package gnutls.16450

Places