wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-20 15:27:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Replace NSS with Pale Moon's

Browse source
This commit is contained in:
wuggy 2026-06-29 21:29:25 +01:00
commit 8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
Download patch file Download diff file Expand all files Collapse all files

139
security/nss/lib/softoken/fipstest.c
View file

@ -13,6 +13,7 @@
#include "secoid.h"
#include "secerr.h"
#include "pkcs11i.h"
#include "lowpbe.h"
/*
* different platforms have different ways of calling and initial entry point
@ -39,7 +40,8 @@ static void INIT_FUNCTION sftk_startup_tests(void);
#if defined(XP_WIN) && !defined(NSS_NO_INIT_SUPPORT)
#include <windows.h>
BOOL WINAPI DllMain(
BOOL WINAPI
DllMain(
HINSTANCE hinstDLL, // handle to DLL module
DWORD fdwReason, // reason for calling function
LPVOID lpReserved) // reserved
@ -581,6 +583,106 @@ rsa_loser:
return (SECFailure);
}
static SECStatus
sftk_fips_HKDF_PowerUpSelfTest(void)
{
SECStatus status;
static const unsigned char base_key[] = {
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f
};
static const unsigned char known_hkdf_sha256_key[] = {
0xdd, 0xdb, 0xeb, 0xe5, 0x6d, 0xd2, 0x96, 0xa4,
0x07, 0xc5, 0x7d, 0xda, 0x31, 0x56, 0x8d, 0xa5,
0x41, 0x3e, 0x90, 0xd4, 0xe6, 0x98, 0xeb, 0xf8,
0x5a, 0x49, 0x7f, 0x38, 0xef, 0x01, 0x8a, 0xe5,
0xda, 0x36, 0xe5, 0xcf, 0x21, 0xe3, 0x9f, 0xc3,
0x32, 0xb3, 0x1e, 0xf6, 0xc5, 0x10, 0x4c, 0x86,
0x53, 0x5e, 0x6f, 0xe0, 0x63, 0x6e, 0x43, 0x33,
0x61, 0x35, 0xf4, 0x17, 0x10, 0x77, 0x75, 0x2a
};
/* current NIST IG's say we only need to test one instance
* of kdfs, keep these others around in case the guidance
* changes */
#ifdef NSS_FULL_POST
static const unsigned char known_hkdf_sha384_key[] = {
0x35, 0x64, 0xc4, 0xa1, 0xcc, 0xc1, 0xdc, 0xe4,
0xe2, 0xca, 0x51, 0xae, 0xe8, 0x92, 0x88, 0x30,
0x8b, 0xb0, 0x2b, 0xac, 0x00, 0x15, 0xac, 0x15,
0x97, 0xc9, 0xf4, 0x6b, 0xf6, 0x3f, 0x97, 0xea,
0x48, 0x55, 0x38, 0x25, 0x06, 0x5d, 0x91, 0x64,
0xbd, 0x09, 0xf3, 0x44, 0xbc, 0x82, 0xbe, 0xdb,
0x5c, 0xd7, 0xf2, 0x24, 0xa5, 0x55, 0x8d, 0xa9,
0xa8, 0x85, 0xde, 0x8c, 0x33, 0xe0, 0x4d, 0xc3
};
static const unsigned char known_hkdf_sha512_key[] = {
0x63, 0x4e, 0xbc, 0x42, 0xb3, 0x56, 0x74, 0x7d,
0x1b, 0x55, 0xf0, 0x34, 0x54, 0xcb, 0x6d, 0x58,
0x39, 0x96, 0x10, 0xda, 0x03, 0x20, 0x8f, 0x77,
0x0d, 0xb4, 0xf7, 0xf6, 0x67, 0x0d, 0x5b, 0x6b,
0xd0, 0x30, 0xc4, 0xdd, 0x67, 0x61, 0x5d, 0x9a,
0xf5, 0x18, 0x6e, 0x1b, 0x60, 0x97, 0xc2, 0x4d,
0x23, 0x43, 0x69, 0xe6, 0x3b, 0xa5, 0xdf, 0xe9,
0x7c, 0xf1, 0x87, 0x48, 0x6f, 0xb9, 0xd3, 0x02
};
#endif
unsigned char outBytes[64] = { 0 };
CK_HKDF_PARAMS hkdf_params;
hkdf_params.bExpand = CK_TRUE;
hkdf_params.bExtract = CK_TRUE;
hkdf_params.ulSaltType = CKF_HKDF_SALT_DATA;
hkdf_params.pSalt = (CK_BYTE_PTR)base_key;
hkdf_params.ulSaltLen = sizeof(base_key);
hkdf_params.pInfo = (CK_BYTE_PTR)base_key;
hkdf_params.ulInfoLen = sizeof(base_key);
/**************************************************/
/* HKDF tests */
/**************************************************/
hkdf_params.prfHashMechanism = CKM_SHA256_HMAC;
status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,
base_key, 32, NULL, outBytes, sizeof(outBytes),
PR_TRUE, PR_TRUE);
if ((status != SECSuccess) ||
PORT_Memcmp(outBytes, known_hkdf_sha256_key, sizeof(outBytes)) != 0) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return (SECFailure);
}
#ifdef NSS_FULL_POST
hkdf_params.prfHashMechanism = CKM_SHA384_HMAC;
status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,
base_key, 48, NULL, outBytes, sizeof(outBytes),
PR_TRUE, PR_TRUE);
if ((status != SECSuccess) ||
PORT_Memcmp(outBytes, known_hkdf_sha384_key, sizeof(outBytes)) != 0) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return (SECFailure);
}
hkdf_params.prfHashMechanism = CKM_SHA512_HMAC;
status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,
base_key, 64, NULL, outBytes, sizeof(outBytes),
PR_TRUE, PR_TRUE);
if ((status != SECSuccess) ||
PORT_Memcmp(outBytes, known_hkdf_sha512_key, sizeof(outBytes)) != 0) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return (SECFailure);
}
#endif
return (SECSuccess);
}
static PRBool sftk_self_tests_ran = PR_FALSE;
static PRBool sftk_self_tests_success = PR_FALSE;
@ -588,11 +690,11 @@ static PRBool sftk_self_tests_success = PR_FALSE;
* This function is called at dll load time, the code tha makes this
* happen is platform specific on defined above.
*/
static void
sftk_startup_tests(void)
void
sftk_startup_tests_with_rerun(PRBool rerun)
{
SECStatus rv;
const char *libraryName = SOFTOKEN_LIB_NAME;
const char *libraryName = rerun ? BLAPI_FIPS_RERUN_FLAG_STRING SOFTOKEN_LIB_NAME : SOFTOKEN_LIB_NAME;
PORT_Assert(!sftk_self_tests_ran);
PORT_Assert(!sftk_self_tests_success);
@ -631,16 +733,38 @@ sftk_startup_tests(void)
if (rv != SECSuccess) {
return;
}
rv = sftk_fips_SP800_108_PowerUpSelfTests();
if (rv != SECSuccess) {
return;
}
rv = sftk_fips_HKDF_PowerUpSelfTest();
if (rv != SECSuccess) {
return;
}
rv = sftk_fips_pbkdf_PowerUpSelfTests();
if (rv != SECSuccess) {
return;
}
sftk_self_tests_success = PR_TRUE;
}
static void
sftk_startup_tests(void)
{
sftk_startup_tests_with_rerun(PR_FALSE);
}
/*
* this is called from nsc_Common_Initizialize entry points that gates access
* to * all other pkcs11 functions. This prevents softoken operation if our
* power on selftest failed.
*/
CK_RV
sftk_FIPSEntryOK()
sftk_FIPSEntryOK(PRBool rerun)
{
#ifdef NSS_NO_INIT_SUPPORT
/* this should only be set on platforms that can't handle one of the INIT
@ -653,6 +777,11 @@ sftk_FIPSEntryOK()
sftk_startup_tests();
}
#endif
if (rerun) {
sftk_self_tests_ran = PR_FALSE;
sftk_self_tests_success = PR_FALSE;
sftk_startup_tests_with_rerun(PR_TRUE);
}
if (!sftk_self_tests_success) {
return CKR_DEVICE_ERROR;
}