Repository navigation
Conversation
jyao1
added
the
4.0
|
This is a major breaking change that needs an update in https://github.com/DMTF/libspdm/blob/main/doc/changelog.md. |
| #if LIBSPDM_FIPS_MODE | ||
|
|
||
| #if LIBSPDM_ECDSA_SUPPORT | ||
| #if (LIBSPDM_ECDSA_SUPPORT) && (LIBSPDM_SHA256_SUPPORT) |
There was a problem hiding this comment.
This reverts what was fixed in #4186. What if the Integrator only supports SHA-384 and not SHA-256?
There was a problem hiding this comment.
What if the Integrator only supports SHA-384 and not SHA-256?
It will not run. Since HASH algo is fixed, this is a downside.
As alternative, I could use SHA-384 by default, which matches the CNSA 1.0 requirement.
Or add all SHA-256/384/512.
What do you think?
There was a problem hiding this comment.
What do you think?
It is not what I think, it is what FIPS thinks. If an SPDM endpoint supports SHA-256/384/512 then presumably it has to test all three algorithms before it establishes a connection, or it waits until ALGORITHMS finishes and tests the one algorithm selected for the connection.
| @@ -0,0 +1,53 @@ | |||
| /** | |||
| * Copyright Notice: | |||
| * Copyright 2021-2026 DMTF. All rights reserved. | |||
| @@ -0,0 +1,53 @@ | |||
| /** | |||
| * Copyright Notice: | |||
| * Copyright 2021-2026 DMTF. All rights reserved. | |||
Agree. |
56931ff to
e614fbe
Compare
| * ECDSA SigGen.txt, [P-256,SHA-256/SHA-384/SHA-512], first record. | ||
| * https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/digital-signatures | ||
| * Exactly one of SHA-256/SHA-384/SHA-512 is required for the ECDSA FIPS self-test to run; | ||
| * the strongest one enabled at build time is used. |
There was a problem hiding this comment.
the strongest one enabled at build time is used
The #if statements below pick the weakest at build time.
Also take the salt in the RSA-PSS FIPS API. Change all signature vector to NIST vector Support SHA-256/384/512 in ECDSA/RSA-SSA/RSA-PSS FIPS self-tests Signed-off-by: Jiewen Yao <jiewen.yao@intel.com> Assisted-by: Claude Code:claude-sonnet-5-5 Assisted-by: GitHub Copilot:Claude Sonnet 5
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com> Assisted-by: GitHub Copilot:Claude Sonnet 5
Document libspdm_ecdsa_verify_fips, libspdm_rsa_pkcs1_sign_fips/ verify_fips, the libspdm_ecdsa_sign_ex rename to libspdm_ecdsa_sign_fips, and the RSA-PSS FIPS salt/message parameter changes. Signed-off-by: Jiewen Yao <jiewen.yao@intel.com> Assisted-by: GitHub Copilot:Claude Sonnet 5
Also take the salt in the RSA-PSS FIPS API.
Change all signature vector to NIST vector
Assisted-by: Claude Code:claude-sonnet-5-5
Assisted-by: GitHub Copilot:Claude Sonnet 5
Fix #4198