diff options
| author | Vadim Sukhomlinov <sukhomlinov@google.com> | 2021-09-27 17:47:29 -0700 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2021-10-02 04:01:49 +0000 |
| commit | 0ad46f2259b79b07a1d4b114fd58472a88c19282 (patch) | |
| tree | 8313e9894a779c602cca27fd79b81bcc9a7ca3b6 /fuzz | |
| parent | 7b25ee08172491864900e3a2ba59d761355f4069 (diff) | |
| download | chrome-ec-0ad46f2259b79b07a1d4b114fd58472a88c19282.tar.gz | |
cr50: provide public crypto API for HMAC/HASH with error reporting.
To implement FIPS mode for Cr50 we should be able to block access to
crypto functions if errors are detected. Historically all HASH/HMAC
functions were declared as void with no return type.
1) Split existing functions into public part (data structs, update and
final parts) and internal part - unchecked init functions.
2) Introduced new functions to start SHA / HMAC operation which returns
status code and block access to crypto in case of FIPS errors.
3) Dcrypto hash algorithms codes updated to match TPM_ALG_ID to simplify
adaptation layer and move checks inside Dcrypto module.
4) Updated all uses of API outside FIPS module to check return code and
act accordingly.
5) As a side effect RSA can now support SHA384 & SHA512 for signing,
board/host mock ups simplified.
BUG=b:197893750
TEST=make buildall -j; make BOARD=cr50 CRYPTO_TEST=1;
test/tpm_test/tpm_test.py
TCG tests
------------------------------ Test Result Summary ---------------------
Test executed on: Tue Sep 28 15:23:35 2021
Performed Tests: 248
Passed Tests: 248
Failed Tests: 0
Errors: 0
Warnings: 0
========================================================================
Signed-off-by: Vadim Sukhomlinov <sukhomlinov@google.com>
Change-Id: Ibbc38703496f417cba693c37d39a82a662c3f7ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3192137
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Tested-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Commit-Queue: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Diffstat (limited to 'fuzz')
| -rw-r--r-- | fuzz/mem_hash_tree.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fuzz/mem_hash_tree.cc b/fuzz/mem_hash_tree.cc index 88e85b87cf..3aceb28518 100644 --- a/fuzz/mem_hash_tree.cc +++ b/fuzz/mem_hash_tree.cc @@ -73,7 +73,8 @@ void MemHashTree::UpdatePath(uint64_t label, shifted_parent_label &= ~child_index_mask; struct sha256_ctx ctx; - SHA256_hw_init(&ctx); + if (DCRYPTO_hw_sha256_init(&ctx) != DCRYPTO_OK) + return; int empty_nodes = 0; for (int index = 0; index < fan_out; ++index) { auto itr = @@ -119,7 +120,8 @@ void MemHashTree::Reset(uint8_t bits_per_level, uint8_t height) { uint8_t fan_out = 1 << bits_per_level; for (int level = 1; level < height; ++level) { struct sha256_ctx ctx; - SHA256_hw_init(&ctx); + if (DCRYPTO_hw_sha256_init(&ctx) != DCRYPTO_OK) + return; for (int index = 0; index < fan_out; ++index) { SHA256_update(&ctx, hash.data(), hash.size()); } |