View source for NSSCryptoModuleSpec/Section 9: Self Tests

'''''Note: This is a draft - A work in progress! - Not official.''''' 


{| border="1" cellpadding="2"
|+
|-
! 
Document Description
!
DTR 
Section
!
Assessment
!
Status
|-
| 
'''List every error state & error indicator''' 
- Document all error states associated with 
each self-test, and indicate for each error 
state the expected error indicator.
|| [http://wiki.mozilla.org/VE_09#VE.09.04.01 VE.09.04.01 ]    
|| 
Failure of any of the power-up, conditional, or operator-initiated self-tests causes the cryptographic module to enter the Error state ([http://wiki.mozilla.org/FIPSFSM#States State 3 ]). When the cryptographic module is in the Error state, most functions (including all the cryptographic functions) do nothing and return the error code <code>CKR_DEVICE_ERROR</code>. See also the [http://wiki.mozilla.org/Rolesandservices#Show_Status Show Status] service of the cryptographic module.
{| border="1" cellpadding="2"
|+
|- 
|'''CKR_DEVICE_ERROR''' ||  Cryptographic module is in the Error state, or has entered the Error state because a self-test (other than the pairwise consistency test) fails.
|- 
|'''CKR_GENERAL_ERROR''' ||  Cryptographic module has entered the Error state because the pairwise consistency test fails.
|}
|| Draft
|-
| 
'''Module in Error State''':
Ensure that cryptographic operations cannot
be performed and all data output via the data output interface is inhibited while the module is in the 
error state. See VE02.06.01 for the vendor 
design requirement.
|| 
[http://wiki.mozilla.org/VE_09#VE.09.05.01 VE.09.05.01 ]          [http://wiki.mozilla.org/VE_09#VE.09.06.01 VE.09.06.01 ]    
|| 
'''Power-up self-test''':
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstokn.c.dep.html#FC_Initialize PKCS #11 Initialization]: 
During the PKCS #11 initialization of the FIPS 140-2 module, any error return
from the battery of self-tests will put the module in the Error state.

The Error state will inhibit further cryptographic operations ([http://wiki.mozilla.org/ModuleInterfaces#In_Error_State In Error State ]).

Output from the cryptographic module is via two paths: 1) the return code of the cryptographic function and, 2) buffers and objects which are operated on by the function, the locations of which are passed as function arguments. In the Error state the return code is always <code>CKR_DEVICE_ERROR</code>. No action besides setting the return code is taken by the requested function, which prevents data output of the second type.
|| Draft
|-
|
'''List and describe the power-up & conditional self-tests 
performed by the module''' 
|| 
[http://wiki.mozilla.org/VE_09#VE.09.07.01 VE.09.07.01 ] [http://wiki.mozilla.org/VE_09#VE.09.13.01 VE.09.13.01 ] [http://wiki.mozilla.org/VE_09#VE.09.16.01 VE.09.16.01 ] [http://wiki.mozilla.org/VE_09#VE.09.18.01 VE.09.18.01 ]    
[http://wiki.mozilla.org/VE_09#VE.09.18.02 VE.09.18.02 ]    
[http://wiki.mozilla.org/VE_09#VE.09.19.01 VE.09.19.01 ]    
[http://wiki.mozilla.org/VE_09#VE.09.19.02 VE.09.19.02 ]    
[http://wiki.mozilla.org/VE_09#VE.09.20.01 VE.09.20.01 ] 
|| 
[http://wiki.mozilla.org/Power_Up_Selftests Selftests ]
|| Draft
|-
| 
'''For each error condition, document the 
actions neccessary to clear the condition 
and resume normal operation.''' 
|| [http://wiki.mozilla.org/VE_09#VE.09.07.02 VE.09.07.02 ]    
|| 
The cryptographic module has only one Error state, which is entered when any self-test fails. The error code <code>CKR_DEVICE_ERROR</code> returned by cryptographic functions indicates that the module is in the Error state. For the fatal error condition <code>CKR_DEVICE_ERROR</code>,
the only way to clear 
the condition is to shut down and restart the module. Upon
restart the power-up tests will be 
initiated automatically and do not require
operator intervention.  
|| Draft
|-
| 
'''Describe automatic initiation of power-up self-tests'''
requires that the running of power-up 
self-tests not involve any inputs from 
or actions by the operator.
|| [http://wiki.mozilla.org/VE_09#VE.09.09.01 VE.09.09.01 ]    
||
When the <code>FC_Initialize</code> function is called, which initializes the PKCS #11 library of the NSS cryptographic module for the FIPS Approved mode of operation, the power-up self-tests are initiated automatically and don't require operator intervention.
|| Draft
|-
| 
'''Results of power-up self-tests''' successful completion indicator for the power-up self-tests.
|| [http://wiki.mozilla.org/VE_09#VE.09.10.01 VE.09.10.01 ]    
||
The <code>FC_Initialize</code> function returns the code <code>CKR_OK</code> upon successful completion of the power-up self-tests.
|| Draft
|-
| 
'''Procedure by which an operator can
initiate the power-up self-tests on demand'''
|| [http://wiki.mozilla.org/VE_09#VE.09.12.01 VE.09.12.01 ]    
||
The operator can initiate the power-up self-tests on demand by calling the <code>FC_Finalize</code> and <code>FC_Initialize</code> functions to shut down and restart the module.
|| Draft
|-
| 
'''specify the method used to compare the 
calculated output with the known answer.'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.17.01 VE.09.17.01 ]    
|| 

PORT_Memcmp is used to compare the calculated
output with the known answer. 
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fipsPowerUpSelfTest]
|| Draft
|-
|
'''Error State''' when two outputs are 
not equal. 
|| 
[http://wiki.mozilla.org/VE_09#VE.09.17.02 VE.09.17.02 ]    
|| 
When the two outputs are not equal, the module enters the Error state (by setting the Boolean state variable <code>sftk_fatalError</code> to true) and returns the error code <code>CKR_DEVICE_ERROR</code>. 
|| Draft
|-
| '''Independant cryptographic algorithm implemenations'''  
|| [http://wiki.mozilla.org/VE_09#VE.09.20.02 VE.09.20.02 ]   
||
(N/A) The NSS cryptographic module doesn't include two independent implementations of the same cryptographic algorithm.
|| Draft
|-
| 
'''Integrity test for software components'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.22.01 VE.09.22.01 ]    
[http://wiki.mozilla.org/VE_09#VE.09.22.02 VE.09.22.02 ]    
[http://wiki.mozilla.org/VE_09#VE.09.22.03 VE.09.22.03 ]    
|| 

The [http://csrc.nist.gov/publications/fips/fips186-2/fips186-2-change1.pdf Digital Signature Algorithm (DSA)] is used as the Approved authentication technique ([http://csrc.nist.gov/cryptval/dss/dsaval.htm#172 validation certificate# 172]) for the integrity test of the software components. Software that is protected using the digital signatures is the softoken and freebl libraries (e.g., libsoftokn3.so and libfreebl3.so). When the softoken and freebl libraries are built, a DSA public/private key pair is generated, the private key is used to generate a DSA signature of the library, and the public key and signature are stored in a file with the name ''libraryname''.chk. When the self-test is initiated (e.g., at initialization for the FIPS mode), the module verifies the signatures (in the ''libraryname''.chk files) of the softoken and freebl libraries. If the signature verification fails, the self-test fails.

[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstokn.c.dep.html#FC_Initialize     FC_Initialize] calls [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11.c.dep.html#nsc_CommonInitialize nsc_CommonInitialize] and then the DSA signature is verified before the library initialization is allowed to proceed. 


|| Draft
|-
| '''EDC for software integrity''' 
|| [http://wiki.mozilla.org/VE_09#VE.09.24.01 VE.09.24.01 ] 
|| (N/A) ||
|-
| '''Critical functions test''' 
|| 
[http://wiki.mozilla.org/VE_09#VE.09.27.01 VE.09.27.01 ] 
||
The critical security functions of the cryptographic module are:
* Random number generation. Used for the generation of cryptographic keys used by Approved cryptographic algorithms. Tested by the power-up random number generator known-answer test and the conditional [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/freebl/prng_fips1861.c.dep.html#alg_fips186_2_cn_1 continuous random number generator test].
* Operation of the cryptographic algorithms. Used for encryption, decryption, and authentication. Tested by the power-up [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.html cryptographic algorithm tests] and the conditional [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck pairwise consistency test] (when the module generates public and private keys).
|| Draft
|-
|
'''Key transport method'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.31.01 VE.09.31.01] 
|| 
RSA encryption (Key Wrapping using RSA keys) is the only key transport
method that VE.09.31.01 applies to. The pairwise consistency check, as defined in AS09.31, is implemented in the [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck sftk_PairwiseConsistencyCheck] function. See the source code under the comment "Pairwise Consistency Check of Encrypt/Decrypt."
|| Draft
|-
|
'''Digital signatures'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.33.01 VE.09.33.01 ] 
||
The [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck sftk_PairwiseConsistencyCheck] function of the module tests the pairwise consistency of the public and private keys used for digital signatures by the calculation and verification of a signature. If the signature cannot be verified, the test fails. See the source code under the comment "Pairwise Consistency Check of Sign/Verify."
|| Draft
|-
|
'''Approved authentication technique used for the software/firmware load test'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.35.01 VE.09.35.01 ] 
[http://wiki.mozilla.org/VE_09#VE.09.35.02 VE.09.35.02 ] 
||
N/A. No software or firmware components can be externally loaded into the cryptographic
module.
|| Draft
|-
| 
'''Manual Key Entry Test'''
|| 
[http://wiki.mozilla.org/VE_09#VE.09.40.01 VE.09.40.01 ] 
[http://wiki.mozilla.org/VE_09#VE.09.40.02 VE.09.40.02 ] 
|| (N/A) The cryptographic module does not support manual key entry. ||
|-
| 
'''Random number generator''' is implemented, document 
the continuous RNG test performed 
|| 
[http://wiki.mozilla.org/VE_09#VE.09.42.01 VE.09.42.01 ] 
[http://wiki.mozilla.org/VE_09#VE.09.43.01 VE.09.43.01 ] 
|| 
The module performs the continuous random number generator test on the Approved RNG. In the [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/freebl/prng_fips1861.c.dep.html#alg_fips186_2_cn_1 alg_fips186_2_cn_1] function, if the 320-bit block <code>x_j</code> matches
the previous 320-bit block <code>rng->Xj</code> (the odds are 2^320), then
the status code <code>SECFailure</code> is returned. This will
propogate up to calling functions to put the cryptographic
module in the Error state. The first block is not used (see the [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/freebl/prng_fips1861.c.dep.html#prng_RandomUpdate prng_RandomUpdate] function) but is saved for comparison with the next block.
|| Draft
|-
| '''Bypass Test'''  || 
[http://wiki.mozilla.org/VE_09#VE.09.45.01 VE.09.45.01 ] 
[http://wiki.mozilla.org/VE_09#VE.09.45.02 VE.09.45.02 ] 
[http://wiki.mozilla.org/VE_09#VE.09.46.01 VE.09.46.01 ] 
[http://wiki.mozilla.org/VE_09#VE.09.46.02 VE.09.46.02 ] 
|| (N/A) NSS does not implement a bypass service. 
|| Draft
|}

Return to: [[NSSCryptoModuleSpec]]