NSSCryptoModuleSpec/Section 9: Self Tests: Difference between revisions

m
GPHemsley moved page Section 9: Self Tests to NSSCryptoModuleSpec/Section 9: Self Tests without leaving a redirect: NSSCryptoModuleSpec page
mNo edit summary
m (GPHemsley moved page Section 9: Self Tests to NSSCryptoModuleSpec/Section 9: Self Tests without leaving a redirect: NSSCryptoModuleSpec page)
 
(52 intermediate revisions by 5 users not shown)
Line 1: Line 1:
'''''Note: This is a draft - A work in progress! - Not official.'''''
{| border="1" cellpadding="2"
{| border="1" cellpadding="2"
|+
|+
Line 5: Line 8:
Document Description
Document Description
!
!
  DTR  
DTR  
Section
Section
!
!
Assesment
Assessment
!
!
Status
Status
Line 19: Line 22:
|| [http://wiki.mozilla.org/VE_09#VE.09.04.01 VE.09.04.01 ]     
|| [http://wiki.mozilla.org/VE_09#VE.09.04.01 VE.09.04.01 ]     
||  
||  
Failure of any of the power-up, conditional, or operator-initiated self-tests causes the cryptographic module to enter the Error state ([http://wiki.mozilla.org/FIPSFSM#States State 3 ]). If the pairwise consistency test fails, the <code>FC_GenerateKeyPair</code> function returns the error code <code>CKR_GENERAL_ERROR</code>. If any other self-test fails, the PKCS #11 function returns the error code <code>CKR_DEVICE_ERROR</code>. When the cryptographic module is in the Error state, most PKCS #11 functions (including all the functions that perform cryptographic operations) do nothing and return the error code <code>CKR_DEVICE_ERROR</code>. See also the [http://wiki.mozilla.org/Rolesandservices#Show_Status Show Status] service of the cryptographic module.
{| border="1" cellpadding="2"
{| border="1" cellpadding="2"
|+
|+
|-
|'''CKR_USER_NOT_LOGGED_IN''' || User has not logged
in by supplying their password to the
FIPS-140-2 PKCS#11 module.
|-  
|-  
|'''CKR_DEVICE_ERROR''' ||  Crypographic operation failure
|'''CKR_DEVICE_ERROR''' ||  Cryptographic module is in the Error state, or has entered the Error state because a self-test (other than the pairwise consistency test) fails.
|-
|-  
| '''CKR_HOST_MEMORY''' || Memory allocation failure
|'''CKR_GENERAL_ERROR''' || Cryptographic module has entered the Error state because the pairwise consistency test fails.
|-
|'''CKR_OK''' || Success, no error
|}
|}
||
|| Draft
|-
|-
|  
|  
'''Module in Error State''':
'''Module in Error State''':
Ensure that cryptographic operations cannot
Ensure that cryptographic operations cannot
be performed while the module is in the  
be performed and all data output via the data output interface is inhibited while the module is in the  
error state. See VE02.06.01 for the vendor  
error state. See VE02.06.01 for the vendor  
design requirement.
design requirement.
||  
||  
[http://wiki.mozilla.org/VE_09#VE.09.05.01 VE.09.05.01 ]     [http://wiki.mozilla.org/VE_09#VE.09.06.01 VE.09.06.01 ]     
[http://wiki.mozilla.org/VE_09#VE.09.05.01 VE.09.05.01 ]         [http://wiki.mozilla.org/VE_09#VE.09.06.01 VE.09.06.01 ]     
||
'''Power-up Self Test''':
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstokn.c.dep.html#FC_Initialize 'PKCS#11 Initialization']:
As part of the PKCS#11 initialization of the
FIPS-140-2 module, any error return
from the battery of self tests will put the
PKCS#11 module in the fatalError state.
The fatalError state will inhibit further
cryptographic operations.
||
||
All the PKCS #11 functions that perform cryptographic operations or output data check the Boolean state variable <code>sftk_fatalError</code> on entry. In the Error state (<code>sftk_fatalError</code> is true), no action besides returning the error code <code>CKR_DEVICE_ERROR</code> is taken by those functions, which prevents cryptograhic operations and data output. (See also [http://wiki.mozilla.org/ModuleInterfaces#In_Error_State In Error State].)
|| Draft
|-
|-
|
|
'''List of mandatory & optional self-tests  
'''List and describe the power-up & conditional self-tests  
performed by the module''' - Provide a list
performed by the module'''  
of all self-tests, both mandatory and optional,
that the module can perform. This list must
include both power-up tests and conditional
tests.
||  
||  
[http://wiki.mozilla.org/VE_09#VE.09.07.01 VE.09.07.01 ]     
[http://wiki.mozilla.org/VE_09#VE.09.07.01 VE.09.07.01 ] [http://wiki.mozilla.org/VE_09#VE.09.13.01 VE.09.13.01 ] [http://wiki.mozilla.org/VE_09#VE.09.16.01 VE.09.16.01 ] [http://wiki.mozilla.org/VE_09#VE.09.18.01 VE.09.18.01 ]     
[http://wiki.mozilla.org/VE_09#VE.09.18.02 VE.09.18.02 ]   
[http://wiki.mozilla.org/VE_09#VE.09.19.01 VE.09.19.01 ]   
[http://wiki.mozilla.org/VE_09#VE.09.19.02 VE.09.19.02 ]   
[http://wiki.mozilla.org/VE_09#VE.09.20.01 VE.09.20.01 ]
||  
||  
* [http://wiki.mozilla.org/Power_Up_Selftests Power-up tests ]


[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.html 
* Conditional tests
Power up Self Test Code]
** Pair-wise consistency test (for public and private keys): the module performs the pair-wise consistency test specified in FIPS 140-2 Section 4.9.2 when it generates RSA, DSA, and ECDSA key pairs.
 
** Continuous random number generator test: the module performs the continuous random number generator test specified in FIPS 140-2 Section 4.9.2 that tests for failure to a constant value.
[[Power up SelfTest Design]]
** In addtion to power up, NSS also performs health checks on the random number generate at instantiate and reseed time.
** No other conditional tests are performed.


No operator call backs have been implemented
These tests are mandatory for the FIPS 140-2 mode of
at any point within the power-up self tests. These
tests are mandatory for the FIPS-140-2 mode of
operation.
operation.
||
|| Draft
|-
|-
|  
|  
Line 81: Line 72:
|| [http://wiki.mozilla.org/VE_09#VE.09.07.02 VE.09.07.02 ]     
|| [http://wiki.mozilla.org/VE_09#VE.09.07.02 VE.09.07.02 ]     
||  
||  
For fatal error conditions CKR_DEVICE_ERROR  
The cryptographic module has only one Error state, which is entered when any self-test fails. The error code <code>CKR_DEVICE_ERROR</code> returned by cryptographic functions indicates that the module is in the Error state. For the fatal error condition <code>CKR_DEVICE_ERROR</code>,
and CKR_HOST_MEMORY the only way to clear  
the only way to clear  
the condition is to reboot the module. Upon
the condition is to shut down and restart the module. Upon
restart the power-up tests shall be  
restart the power-up tests will be  
initiated automatically and does not require
initiated automatically and do not require
operator intervention.   
operator intervention.   
||
|| Draft
|-
|-
|  
|  
'''Describe self-test initiation on demand'''
'''Describe automatic initiation of power-up self-tests'''
requires that the running of power-up  
requires that the running of power-up  
self-tests not involve any inputs from  
self-tests not involve any inputs from  
actions by the operator.
or actions by the operator.
|| [http://wiki.mozilla.org/VE_09#VE.09.09.01 VE.09.09.01 ]     
|| [http://wiki.mozilla.org/VE_09#VE.09.09.01 VE.09.09.01 ]     
||
||
The products will not have a user
When the <code>FC_Initialize</code> function is called, which initializes the PKCS #11 library of the NSS cryptographic module for the FIPS Approved mode of operation, the power-up self-tests are initiated automatically and don't require operator intervention.
visible way to initiate these tests  
|| Draft
other than restarting the program.
||
|-
|-
|  
|  
'''Document cryptographic algorithm's known
'''Results of power-up self-tests''' successful completion indicator for the power-up self-tests.
answer test''' The vendor shall document the
indicator that the module outputs upon
successful completion of the power-up self-tests.
|| [http://wiki.mozilla.org/VE_09#VE.09.10.01 VE.09.10.01 ]     
|| [http://wiki.mozilla.org/VE_09#VE.09.10.01 VE.09.10.01 ]     
||
||
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstokn.c.html Power Up Self Test Code] This is
The <code>FC_Initialize</code> function returns the code <code>CKR_OK</code> upon successful completion of the power-up self-tests.
demonstrated throughout the self test
|| Draft
module. Each of the following functions
declares static key material at the
beginning of each test and upon  
successful completion returns CKR_OK:
 
 
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_RC2_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_RC4_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_DES_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_DES3_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_MD2_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_MD5_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_SHA1_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_RSA_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_DSA_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fips_AES_PowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fipsPowerUpSelfTest]
 
||
|-
|-
|  
|  
'''Procedure by which an operator can
'''Procedure by which an operator can
initiate the power-up self-tests'''
initiate the power-up self-tests on demand'''
|| [http://wiki.mozilla.org/VE_09#VE.09.12.01 VE.09.12.01 ]     
|| [http://wiki.mozilla.org/VE_09#VE.09.12.01 VE.09.12.01 ]     
||
||
The products will not have a user visible way to initiate
The operator can initiate the power-up self-tests on demand by calling the <code>FC_Finalize</code> and <code>FC_Initialize</code> functions to shut down and restart the module.
these tests other than restarting the program.
|| Draft
||
|-
|
'''All self tests shall use a known answer'''.
|| [http://wiki.mozilla.org/VE_09#VE.09.13.01 VE.09.13.01 ]   
||
A known answer shall be conducted for
all cryptographic functions (e.g., encryption,
decryption, authentication and random
number generation) of each Approved
cryptographic algorithm self test.
||
|-
|
'''If the calculated output does not
equal the known answer, the
known-answer test shall fail.'''
|| [http://wiki.mozilla.org/VE_09#VE.09.16.01 VE.09.16.01 ]   
||
CKR_DEVICE_ERROR is returned when
ever the calculated output does not
equal the known answer.  
||
|-
|-
|  
|  
Line 168: Line 112:
||  
||  


PORT_Memcmp is used to compare the computed
<code>PORT_Memcmp</code>, a synonym for <code>memcmp</code>, is used to compare the calculated output with the known answer byte by byte.  
cipher text with the known ciphertext.  
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fipsPowerUpSelfTest]
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.dep.html                      sftk_fipsPowerUpSelfTest]
When keys are used for encryption/decryption
|| Draft
the [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck  'Pairwise Consistency Check Self Tests']
are used.
||
|-
|-
|
|
Line 182: Line 122:
[http://wiki.mozilla.org/VE_09#VE.09.17.02 VE.09.17.02 ]     
[http://wiki.mozilla.org/VE_09#VE.09.17.02 VE.09.17.02 ]     
||  
||  
'''CKR_DEVICE_ERROR''' is returned when the two outputs
When the two outputs are not equal, the module enters the Error state (by setting the Boolean state variable <code>sftk_fatalError</code> to true) and returns the error code <code>CKR_DEVICE_ERROR</code>.  
are not equal.
|| Draft
||
|-
|
'''Self-Test discription''' for
all tests implemented.
||
[http://wiki.mozilla.org/VE_09#VE.09.18.01 VE.09.18.01 ]   
[http://wiki.mozilla.org/VE_09#VE.09.18.02 VE.09.18.02 ]   
[http://wiki.mozilla.org/VE_09#VE.09.19.01 VE.09.19.01 ]   
[http://wiki.mozilla.org/VE_09#VE.09.19.02 VE.09.19.02 ]   
[http://wiki.mozilla.org/VE_09#VE.09.20.01 VE.09.20.01 ] 
||
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.html Power up Self Test Code]
 
[[Power up SelfTest Design]]
 
No operator call backs have been implemented
at any point within the power-up self tests. These
tests are mandatory for the FIPS-140-2 mode of
operation.
||
|-
|-
| '''Independant cryptographic algorithm implemenations'''   
| '''Independant cryptographic algorithm implemenations'''   
|| [http://wiki.mozilla.org/VE_09#VE.09.20.02 VE.09.20.02 ]   
|| [http://wiki.mozilla.org/VE_09#VE.09.20.02 VE.09.20.02 ]   
||
||
(N/A)  
(N/A) The NSS cryptographic module doesn't include two independent implementations of the same cryptographic algorithm.
||
|| Draft
|-
|-
|  
|  
Line 219: Line 138:
[http://wiki.mozilla.org/VE_09#VE.09.22.03 VE.09.22.03 ]     
[http://wiki.mozilla.org/VE_09#VE.09.22.03 VE.09.22.03 ]     
||  
||  
[http://wiki.mozilla.org/FIPS_Operational_Environment#Software_Integrity_Test Software Integrity Test]


[http://www.itl.nist.gov/fipspubs/fip186.htm Digital Signature Standard (DSS) ] is used as the approved authentication
|| Draft
technique for the integrity test of the software component. When the softokn library (libsoftokn3/softokn3) is built a DSA signature checksum is
generated and stored in a file libsoftokn3.chk/softokn3.chk. When the module is in FIPS mode, at initialization the softoken computes its checksum and compares it with the value in libsoftokn3.chk/softokn3.chk.
 
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstokn.c.dep.html#FC_Initialize    FC_Initialize ] calls [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11.c.dep.html#nsc_CommonInitialize nsc_CommonInitialize ] and then the DSS signature is check before the module
is allowed to load.
 
 
||
|-
|-
| '''EDC for software integrity''' || [http://wiki.mozilla.org/VE_09#VE.09.24.01 VE.09.24.01 ] || (N/A) ||
| '''EDC for software integrity'''  
|| [http://wiki.mozilla.org/VE_09#VE.09.24.01 VE.09.24.01 ]  
|| (N/A) ||
|-
|-
| '''Critical Functions'''  
| '''Critical functions test'''  
|| [http://wiki.mozilla.org/VE_09#VE.09.27.01 VE.09.27.01 ] 
||
||  
||  
|-
[http://wiki.mozilla.org/VE_09#VE.09.27.01 VE.09.27.01 ]  
|
'''Conditional tests'''
|| [http://wiki.mozilla.org/VE_09#VE.09.28.01 VE.09.28.01 ]  
||
||
||
The critical security functions of the cryptographic module are:
* Random number generation. Used for the generation of cryptographic keys used by Approved cryptographic algorithms. Tested by the random number generator health tests on power up, instantiate and reseed time and the conditional [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/freebl/prng_fips1861.c.dep.html#alg_fips186_2_cn_1 continuous random number generator test].
* Operation of the cryptographic algorithms. Used for encryption, decryption, and authentication. Tested by the power-up [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/fipstest.c.html cryptographic algorithm tests] and the conditional [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck pairwise consistency test] (when the module generates public and private keys).
|| Draft
|-
|-
'''Verification of Digital Signatures'''
|
|  
'''Key transport method'''
'''Key transport method'''
||  
||  
[http://wiki.mozilla.org/VE_09#VE.09.31.01 VE.09.31.01 ]
[http://wiki.mozilla.org/VE_09#VE.09.31.01 VE.09.31.01]  
[http://wiki.mozilla.org/VE_09#VE.09.32.01 VE.09.32.01 ]  
||  
||  
RSA encryption (Key Wrapping using RSA keys) is the only key transport
method that VE.09.31.01 applies to. The pairwise consistency check, as defined in AS09.31, is implemented in the <code>[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck sftk_PairwiseConsistencyCheck]</code> function. (See the source code under the comment "Pairwise Consistency Check of Encrypt/Decrypt.") If the <code>sftk_PairwiseConsistencyCheck</code> call fails, <code>FC_GenerateKeyPair</code> sets <code>sftk_fatalError</code> to true (to enter the Error state) and returns the error code <code>CKR_GENERAL_ERROR</code>.
|| Draft
|-
|
'''Digital signatures'''
||
[http://wiki.mozilla.org/VE_09#VE.09.33.01 VE.09.33.01 ]
||
||
The <code>[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/softoken/pkcs11c.c.dep.html#sftk_PairwiseConsistencyCheck sftk_PairwiseConsistencyCheck]</code> function of the module tests the pairwise consistency of the public and private keys used for digital signatures by the calculation and verification of a signature. If the signature cannot be verified, the test fails. (See the source code under the comment "Pairwise Consistency Check of Sign/Verify.") If the <code>sftk_PairwiseConsistencyCheck</code> call fails, <code>FC_GenerateKeyPair</code> sets <code>sftk_fatalError</code> to true (to enter the Error state) and returns the error code <code>CKR_GENERAL_ERROR</code>.
|| Draft
|-
|-
|
|
'''Approved authentication technique'''
'''Approved authentication technique used for the software/firmware load test'''
||  
||  
[http://wiki.mozilla.org/VE_09#VE.09.33.01 VE.09.33.01 ]
[http://wiki.mozilla.org/VE_09#VE.09.35.01 VE.09.35.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.35.01 VE.09.35.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.35.02 VE.09.35.02 ]  
[http://wiki.mozilla.org/VE_09#VE.09.35.02 VE.09.35.02 ]  
||
||
DSS signature see 09.22.03
N/A. No software or firmware components can be externally loaded into the cryptographic
||
module.
|| Draft
|-
|-
|  
|  
'''Manual Key Entry'''
'''Manual Key Entry Test'''
||  
||  
[http://wiki.mozilla.org/VE_09#VE.09.40.01 VE.09.40.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.40.01 VE.09.40.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.40.02 VE.09.40.02 ]  
[http://wiki.mozilla.org/VE_09#VE.09.40.02 VE.09.40.02 ]  
|| (N/A) NSS does not implement manual Key entry ||
|| (N/A) The cryptographic module does not support manual key entry. ||
|-
|-
|  
|  
Line 276: Line 197:
[http://wiki.mozilla.org/VE_09#VE.09.43.01 VE.09.43.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.43.01 VE.09.43.01 ]  
||  
||  
[http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/freebl/prng_fips1861.c.dep.html#alg_fips186_1_x3_1 Continuous Pseudo-Random Number Self-Tests ]
There is only one random number generator (RNG) used in the NSS cryptographic module. The RNG is an Approved RNG, implementing Algorithm Hash_DRBG of [http://csrc.nist.gov/publications/nistpubs/800-90/SP800-90revised_March2007.pdf NIST SP 800-90].
In this code reference, if the SHA-1 hash matches
|| Draft
the previous SHA-1 hash (the odds are 2^160), then
the error code SECFailure is returned. This will
propogate up to calling functions to put the cryptographic
module in critical error state.
||
|-
|-
| '''ByPass Service'''  ||  
| '''Bypass Test'''  ||  
[http://wiki.mozilla.org/VE_09#VE.09.45.01 VE.09.45.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.45.01 VE.09.45.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.45.02 VE.09.45.02 ]  
[http://wiki.mozilla.org/VE_09#VE.09.45.02 VE.09.45.02 ]  
[http://wiki.mozilla.org/VE_09#VE.09.46.01 VE.09.46.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.46.01 VE.09.46.01 ]  
[http://wiki.mozilla.org/VE_09#VE.09.46.02 VE.09.46.02 ]  
[http://wiki.mozilla.org/VE_09#VE.09.46.02 VE.09.46.02 ]  
|| (N/A) NSS does not implement a ByPass service.  
|| (N/A) NSS does not implement a bypass service.  
||
|| Draft
|}
|}


Return to: [[NSSCryptoModuleSpec]]
Return to: [[NSSCryptoModuleSpec]]
canmove, Confirmed users, Bureaucrats and Sysops emeriti
960

edits