[v1,00/10] fips_validation application improvements

  This patch series adds support for SHA3, SHAKE, AES-CCM
JSON test vectors and fixes existing algorithms to
support NIST test vectors.

Gowrishankar Muthukrishnan (10):
  examples/fips_validation: fix MCT output for SHA
  examples/fips_validation: add SHA3 validation
  examples/fips_validation: fix integer parse in test case
  examples/fips_validation: add SHAKE validation
  examples/fips_validation: add CCM JSON validation
  examples/fips_validation: add ECDSA keygen support
  examples/fips_validation: add SHA3 algorithms in ECDSA test
  examples/fips_validation: fix AES GCM validation tests
  examples/fips_validation: fix AES XTS to read seq number
  examples/fips_validation: add extra space in JSON buffer

 doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
 examples/fips_validation/fips_validation.c    |  31 ++-
 examples/fips_validation/fips_validation.h    |  10 +-
 .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
 .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
 .../fips_validation/fips_validation_gcm.c     |  12 +-
 .../fips_validation/fips_validation_hmac.c    |   8 +
 .../fips_validation/fips_validation_sha.c     |  91 ++++++--
 .../fips_validation/fips_validation_xts.c     |  13 +-
 examples/fips_validation/main.c               | 196 +++++++++++++-----
 10 files changed, 467 insertions(+), 89 deletions(-)
  

Hi Gowrishankar,

Looks good to me.

> -----Original Message-----
> From: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> Sent: Monday 6 February 2023 14:46
> To: dev@dpdk.org
> Cc: Anoob Joseph <anoobj@marvell.com>; jerinj@marvell.com; Akhil Goyal
> <gakhil@marvell.com>; Dooley, Brian <brian.dooley@intel.com>;
> Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> Subject: [v1, 00/10] fips_validation application improvements
> 
> This patch series adds support for SHA3, SHAKE, AES-CCM JSON test vectors
> and fixes existing algorithms to support NIST test vectors.
> 
> Gowrishankar Muthukrishnan (10):
>   examples/fips_validation: fix MCT output for SHA
>   examples/fips_validation: add SHA3 validation
>   examples/fips_validation: fix integer parse in test case
>   examples/fips_validation: add SHAKE validation
>   examples/fips_validation: add CCM JSON validation
>   examples/fips_validation: add ECDSA keygen support
>   examples/fips_validation: add SHA3 algorithms in ECDSA test
>   examples/fips_validation: fix AES GCM validation tests
>   examples/fips_validation: fix AES XTS to read seq number
>   examples/fips_validation: add extra space in JSON buffer
> 
>  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
>  examples/fips_validation/fips_validation.c    |  31 ++-
>  examples/fips_validation/fips_validation.h    |  10 +-
>  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
>  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
>  .../fips_validation/fips_validation_gcm.c     |  12 +-
>  .../fips_validation/fips_validation_hmac.c    |   8 +
>  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
>  .../fips_validation/fips_validation_xts.c     |  13 +-
>  examples/fips_validation/main.c               | 196 +++++++++++++-----
>  10 files changed, 467 insertions(+), 89 deletions(-)
> 
> --
> 2.25.1

Series-acked-by: Brian Dooley <brian.dooley@intel.com>
  

> Hi Gowrishankar,
> 
> Looks good to me.
> 
> > Subject: [v1, 00/10] fips_validation application improvements
> >
> > This patch series adds support for SHA3, SHAKE, AES-CCM JSON test vectors
> > and fixes existing algorithms to support NIST test vectors.
> >
> > Gowrishankar Muthukrishnan (10):
> >   examples/fips_validation: fix MCT output for SHA
> >   examples/fips_validation: add SHA3 validation
> >   examples/fips_validation: fix integer parse in test case
> >   examples/fips_validation: add SHAKE validation
> >   examples/fips_validation: add CCM JSON validation
> >   examples/fips_validation: add ECDSA keygen support
> >   examples/fips_validation: add SHA3 algorithms in ECDSA test
> >   examples/fips_validation: fix AES GCM validation tests
> >   examples/fips_validation: fix AES XTS to read seq number
> >   examples/fips_validation: add extra space in JSON buffer
> >
> >  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
> >  examples/fips_validation/fips_validation.c    |  31 ++-
> >  examples/fips_validation/fips_validation.h    |  10 +-
> >  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
> >  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
> >  .../fips_validation/fips_validation_gcm.c     |  12 +-
> >  .../fips_validation/fips_validation_hmac.c    |   8 +
> >  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
> >  .../fips_validation/fips_validation_xts.c     |  13 +-
> >  examples/fips_validation/main.c               | 196 +++++++++++++-----
> >  10 files changed, 467 insertions(+), 89 deletions(-)
> >
> > --
> > 2.25.1
> 
> Series-acked-by: Brian Dooley <brian.dooley@intel.com>

Series Applied to dpdk-next-crypto

Thanks.
  

Hi Gowrishankar,
> >
> > > Subject: [v1, 00/10] fips_validation application improvements
> > >
> > > This patch series adds support for SHA3, SHAKE, AES-CCM JSON test vectors
> > > and fixes existing algorithms to support NIST test vectors.
> > >
> > > Gowrishankar Muthukrishnan (10):
> > >   examples/fips_validation: fix MCT output for SHA
> > >   examples/fips_validation: add SHA3 validation
> > >   examples/fips_validation: fix integer parse in test case
> > >   examples/fips_validation: add SHAKE validation
> > >   examples/fips_validation: add CCM JSON validation
> > >   examples/fips_validation: add ECDSA keygen support
> > >   examples/fips_validation: add SHA3 algorithms in ECDSA test
> > >   examples/fips_validation: fix AES GCM validation tests
> > >   examples/fips_validation: fix AES XTS to read seq number
> > >   examples/fips_validation: add extra space in JSON buffer
> > >
> > >  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
> > >  examples/fips_validation/fips_validation.c    |  31 ++-
> > >  examples/fips_validation/fips_validation.h    |  10 +-
> > >  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
> > >  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
> > >  .../fips_validation/fips_validation_gcm.c     |  12 +-
> > >  .../fips_validation/fips_validation_hmac.c    |   8 +
> > >  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
> > >  .../fips_validation/fips_validation_xts.c     |  13 +-
> > >  examples/fips_validation/main.c               | 196 +++++++++++++-----
> > >  10 files changed, 467 insertions(+), 89 deletions(-)
> > >
> > > --
> > > 2.25.1
> >
> > Series-acked-by: Brian Dooley <brian.dooley@intel.com>
> 
> Series Applied to dpdk-next-crypto
The series is showing compilation issues, please fix it. The series is removed from the tree.
  

Hello Akhil and Gowrishankar,

We saw the same issue with running the fips sample app under CI testing
here at the UNH Community Lab:
http://mails.dpdk.org/archives/test-report/2023-February/350635.html. We
reported a warn because it failed on the compilation stage (as opposed to a
failure of the actual sample app run).

On the other hand, we are excited to see this patch again with the
compilation part resolved. I sent an email to the dev mailing list a few
weeks ago for our fips sample app CI testing regarding where we could and
could not provide test vector coverage, and it appears this patch series
may resolve our ciphertext issue with AES-GCM test vector and more issues
with the sample app. So - looking forward to seeing a patch like this being
merged when stable!

Best,
Patrick Robb






On Tue, Feb 28, 2023 at 2:39 AM Akhil Goyal <gakhil@marvell.com> wrote:

> Hi Gowrishankar,
> > >
> > > > Subject: [v1, 00/10] fips_validation application improvements
> > > >
> > > > This patch series adds support for SHA3, SHAKE, AES-CCM JSON test
> vectors
> > > > and fixes existing algorithms to support NIST test vectors.
> > > >
> > > > Gowrishankar Muthukrishnan (10):
> > > >   examples/fips_validation: fix MCT output for SHA
> > > >   examples/fips_validation: add SHA3 validation
> > > >   examples/fips_validation: fix integer parse in test case
> > > >   examples/fips_validation: add SHAKE validation
> > > >   examples/fips_validation: add CCM JSON validation
> > > >   examples/fips_validation: add ECDSA keygen support
> > > >   examples/fips_validation: add SHA3 algorithms in ECDSA test
> > > >   examples/fips_validation: fix AES GCM validation tests
> > > >   examples/fips_validation: fix AES XTS to read seq number
> > > >   examples/fips_validation: add extra space in JSON buffer
> > > >
> > > >  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
> > > >  examples/fips_validation/fips_validation.c    |  31 ++-
> > > >  examples/fips_validation/fips_validation.h    |  10 +-
> > > >  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
> > > >  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
> > > >  .../fips_validation/fips_validation_gcm.c     |  12 +-
> > > >  .../fips_validation/fips_validation_hmac.c    |   8 +
> > > >  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
> > > >  .../fips_validation/fips_validation_xts.c     |  13 +-
> > > >  examples/fips_validation/main.c               | 196
> +++++++++++++-----
> > > >  10 files changed, 467 insertions(+), 89 deletions(-)
> > > >
> > > > --
> > > > 2.25.1
> > >
> > > Series-acked-by: Brian Dooley <brian.dooley@intel.com>
> >
> > Series Applied to dpdk-next-crypto
> The series is showing compilation issues, please fix it. The series is
> removed from the tree.
>
>
>
  

Hi Patrick,

The issue reported by CI in below link is not an issue, as the patchset was dependent on another patch which is already merged. Now we are observing a new issue which is coming only on CentOS I believe.
CI reports are not useful in case there are dependent patches. There should be a way maintainer/developer can retrigger the CI as required when other patches are merged.

This issue got skipped as I personally do not test on CentOS and CI results are not meaningful when there were dependent patches.
Below is the log for the compilation issue observed now on TOT when these patches are applied which is not visible in the below link.


> OS: CentOS79-64

> Target: x86_64-native-linuxapp-gcc

> FAILED: examples/dpdk-fips_validation.p/fips_validation_main.c.o

> gcc -Iexamples/dpdk-fips_validation.p -Iexamples -I../examples -

> Iexamples/fips_validation -I../examples/fips_validation -I../examples/common -

> I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -

> Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include -

> I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal -I../lib/eal

> -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics -Ilib/telemetry -

> I../lib/telemetry -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring -Ilib/net -

> I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/ethdev -I../lib/ethdev -Ilib/meter -

> I../lib/meter -Ilib/cmdline -I../lib/cmdline -Ilib/cryptodev -I../lib/cryptodev -

> Ilib/rcu -I../lib/rcu -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra -

> Werror -O3 -include rte_config.h -Wcast-qual -Wdeprecated -Wformat -

> Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-

> prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith -Wsign-

> compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-missing-field-

> initializers -D_GNU_SOURCE -march=native -DUSE_OPENSSL -

> DALLOW_EXPERIMENTAL_API -MD -MQ examples/dpdk-

> fips_validation.p/fips_validation_main.c.o -MF examples/dpdk-

> fips_validation.p/fips_validation_main.c.o.d -o examples/dpdk-

> fips_validation.p/fips_validation_main.c.o -c ../examples/fips_validation/main.c

> ../examples/fips_validation/main.c: In function 'fips_mct_shake_test':

> ../examples/fips_validation/main.c:2438:5: error: dereferencing type-punned

> pointer will break strict-aliasing rules [-Werror=strict-aliasing]

>      (*(uint16_t *)rightmost % range);

>      ^


Regards,
Akhil
  

Hi Akhil,

One 2023 goal for UNH is implementing an email based retesting framework.
Once that work is completed, you will be able to trigger a retest yourself
under circumstances where waiting for dependent patches is needed.

On Tue, Feb 28, 2023 at 10:02 AM Akhil Goyal <gakhil@marvell.com> wrote:

> Hi Patrick,
>
>
>
> The issue reported by CI in below link is not an issue, as the patchset
> was dependent on another patch which is already merged. Now we are
> observing a new issue which is coming only on CentOS I believe.
>
> CI reports are not useful in case there are dependent patches. There
> should be a way maintainer/developer can retrigger the CI as required when
> other patches are merged.
>
>
>
> This issue got skipped as I personally do not test on CentOS and CI
> results are not meaningful when there were dependent patches.
>
> Below is the log for the compilation issue observed now on TOT when these
> patches are applied which is not visible in the below link.
>
>
>
> > OS: CentOS79-64
>
> > Target: x86_64-native-linuxapp-gcc
>
> > FAILED: examples/dpdk-fips_validation.p/fips_validation_main.c.o
>
> > gcc -Iexamples/dpdk-fips_validation.p -Iexamples -I../examples -
>
> > Iexamples/fips_validation -I../examples/fips_validation
> -I../examples/common -
>
> > I. -I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include -
>
> > Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include -
>
> > I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
> -I../lib/eal
>
> > -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
> -Ilib/telemetry -
>
> > I../lib/telemetry -Ilib/mempool -I../lib/mempool -Ilib/ring
> -I../lib/ring -Ilib/net -
>
> > I../lib/net -Ilib/mbuf -I../lib/mbuf -Ilib/ethdev -I../lib/ethdev
> -Ilib/meter -
>
> > I../lib/meter -Ilib/cmdline -I../lib/cmdline -Ilib/cryptodev
> -I../lib/cryptodev -
>
> > Ilib/rcu -I../lib/rcu -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -Wextra
> -
>
> > Werror -O3 -include rte_config.h -Wcast-qual -Wdeprecated -Wformat -
>
> > Wformat-nonliteral -Wformat-security -Wmissing-declarations -Wmissing-
>
> > prototypes -Wnested-externs -Wold-style-definition -Wpointer-arith
> -Wsign-
>
> > compare -Wstrict-prototypes -Wundef -Wwrite-strings -Wno-missing-field-
>
> > initializers -D_GNU_SOURCE -march=native -DUSE_OPENSSL -
>
> > DALLOW_EXPERIMENTAL_API -MD -MQ examples/dpdk-
>
> > fips_validation.p/fips_validation_main.c.o -MF examples/dpdk-
>
> > fips_validation.p/fips_validation_main.c.o.d -o examples/dpdk-
>
> > fips_validation.p/fips_validation_main.c.o -c
> ../examples/fips_validation/main.c
>
> > ../examples/fips_validation/main.c: In function 'fips_mct_shake_test':
>
> > ../examples/fips_validation/main.c:2438:5: error: dereferencing
> type-punned
>
> > pointer will break strict-aliasing rules [-Werror=strict-aliasing]
>
> >      (*(uint16_t *)rightmost % range);
>
> >      ^
>
>
>
>
>
> Regards,
>
> Akhil
>
>
> ------------------------------
>
> Hello Akhil and Gowrishankar,
>
>
>
> We saw the same issue with running the fips sample app under CI testing
> here at the UNH Community Lab:
> http://mails.dpdk.org/archives/test-report/2023-February/350635.html
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__mails.dpdk.org_archives_test-2Dreport_2023-2DFebruary_350635.html&d=DwMFaQ&c=nKjWec2b6R0mOyPaz7xtfQ&r=DnL7Si2wl_PRwpZ9TWey3eu68gBzn7DkPwuqhd6WNyo&m=QswegPR1LvDRH4f_2rvo_BvAfrFOBGZPVPGXC7pPlKn2Q99LMoJlfwv4ZZ0QxRu-&s=Ozm6byIlAfWxebW0mSomWcCW-0s59wZNJ7QED4-Tjcs&e=>.
> We reported a warn because it failed on the compilation stage (as opposed
> to a failure of the actual sample app run).
>
>
>
> On the other hand, we are excited to see this patch again with the
> compilation part resolved. I sent an email to the dev mailing list a few
> weeks ago for our fips sample app CI testing regarding where we could and
> could not provide test vector coverage, and it appears this patch series
> may resolve our ciphertext issue with AES-GCM test vector and more issues
> with the sample app. So - looking forward to seeing a patch like this being
> merged when stable!
>
>
>
> Best,
>
> Patrick Robb
>
>
>
>
>
>
>
>
>
> On Tue, Feb 28, 2023 at 2:39 AM Akhil Goyal <gakhil@marvell.com> wrote:
>
> Hi Gowrishankar,
> > >
> > > > Subject: [v1, 00/10] fips_validation application improvements
> > > >
> > > > This patch series adds support for SHA3, SHAKE, AES-CCM JSON test
> vectors
> > > > and fixes existing algorithms to support NIST test vectors.
> > > >
> > > > Gowrishankar Muthukrishnan (10):
> > > >   examples/fips_validation: fix MCT output for SHA
> > > >   examples/fips_validation: add SHA3 validation
> > > >   examples/fips_validation: fix integer parse in test case
> > > >   examples/fips_validation: add SHAKE validation
> > > >   examples/fips_validation: add CCM JSON validation
> > > >   examples/fips_validation: add ECDSA keygen support
> > > >   examples/fips_validation: add SHA3 algorithms in ECDSA test
> > > >   examples/fips_validation: fix AES GCM validation tests
> > > >   examples/fips_validation: fix AES XTS to read seq number
> > > >   examples/fips_validation: add extra space in JSON buffer
> > > >
> > > >  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
> > > >  examples/fips_validation/fips_validation.c    |  31 ++-
> > > >  examples/fips_validation/fips_validation.h    |  10 +-
> > > >  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
> > > >  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
> > > >  .../fips_validation/fips_validation_gcm.c     |  12 +-
> > > >  .../fips_validation/fips_validation_hmac.c    |   8 +
> > > >  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
> > > >  .../fips_validation/fips_validation_xts.c     |  13 +-
> > > >  examples/fips_validation/main.c               | 196
> +++++++++++++-----
> > > >  10 files changed, 467 insertions(+), 89 deletions(-)
> > > >
> > > > --
> > > > 2.25.1
> > >
> > > Series-acked-by: Brian Dooley <brian.dooley@intel.com>
> >
> > Series Applied to dpdk-next-crypto
> The series is showing compilation issues, please fix it. The series is
> removed from the tree.
>
>
>
>
> --
>
> Patrick Robb
>
> Technical Service Manager
>
> UNH InterOperability Laboratory
>
> 21 Madbury Rd, Suite 100, Durham, NH 03824
>
> www.iol.unh.edu
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.iol.unh.edu_&d=DwMFaQ&c=nKjWec2b6R0mOyPaz7xtfQ&r=DnL7Si2wl_PRwpZ9TWey3eu68gBzn7DkPwuqhd6WNyo&m=QswegPR1LvDRH4f_2rvo_BvAfrFOBGZPVPGXC7pPlKn2Q99LMoJlfwv4ZZ0QxRu-&s=Gr4qCfskeNAMKr2DcgjPKd30D2zh9SGznw6lTmy1FnA&e=>
>
>
>
>
  

I have fixed it in v2 and CI passed.
http://mails.dpdk.org/archives/test-report/2023-February/360464.html

Thanks,
Gowrishankar
> -----Original Message-----
> From: Akhil Goyal <gakhil@marvell.com>
> Sent: Tuesday, February 28, 2023 1:09 PM
> To: Akhil Goyal <gakhil@marvell.com>; Dooley, Brian
> <brian.dooley@intel.com>; Gowrishankar Muthukrishnan
> <gmuthukrishn@marvell.com>; dev@dpdk.org
> Cc: Anoob Joseph <anoobj@marvell.com>; Jerin Jacob Kollanukkaran
> <jerinj@marvell.com>
> Subject: RE: [v1, 00/10] fips_validation application improvements
> 
> Hi Gowrishankar,
> > >
> > > > Subject: [v1, 00/10] fips_validation application improvements
> > > >
> > > > This patch series adds support for SHA3, SHAKE, AES-CCM JSON test
> > > > vectors and fixes existing algorithms to support NIST test vectors.
> > > >
> > > > Gowrishankar Muthukrishnan (10):
> > > >   examples/fips_validation: fix MCT output for SHA
> > > >   examples/fips_validation: add SHA3 validation
> > > >   examples/fips_validation: fix integer parse in test case
> > > >   examples/fips_validation: add SHAKE validation
> > > >   examples/fips_validation: add CCM JSON validation
> > > >   examples/fips_validation: add ECDSA keygen support
> > > >   examples/fips_validation: add SHA3 algorithms in ECDSA test
> > > >   examples/fips_validation: fix AES GCM validation tests
> > > >   examples/fips_validation: fix AES XTS to read seq number
> > > >   examples/fips_validation: add extra space in JSON buffer
> > > >
> > > >  doc/guides/sample_app_ug/fips_validation.rst  |   7 +-
> > > >  examples/fips_validation/fips_validation.c    |  31 ++-
> > > >  examples/fips_validation/fips_validation.h    |  10 +-
> > > >  .../fips_validation/fips_validation_ccm.c     | 132 ++++++++++++
> > > >  .../fips_validation/fips_validation_ecdsa.c   |  56 +++++
> > > >  .../fips_validation/fips_validation_gcm.c     |  12 +-
> > > >  .../fips_validation/fips_validation_hmac.c    |   8 +
> > > >  .../fips_validation/fips_validation_sha.c     |  91 ++++++--
> > > >  .../fips_validation/fips_validation_xts.c     |  13 +-
> > > >  examples/fips_validation/main.c               | 196 +++++++++++++-----
> > > >  10 files changed, 467 insertions(+), 89 deletions(-)
> > > >
> > > > --
> > > > 2.25.1
> > >
> > > Series-acked-by: Brian Dooley <brian.dooley@intel.com>
> >
> > Series Applied to dpdk-next-crypto
> The series is showing compilation issues, please fix it. The series is removed
> from the tree.
>