crypto/internal/fips140/rsa: add Pairwise Consistency Test

For #69536

Change-Id: I2cbb03fc942f5542b8a26347213304c2a3cb5268
Reviewed-on: https://go-review.googlesource.com/c/go/+/632537
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

diff --git a/src/crypto/internal/fips140/rsa/cast.go b/src/crypto/internal/fips140/rsa/cast.go
index a547d985e89ee2753c388bb9108d7b215ac6e1f5..ec7b5f3aeb92751ae79ab9e770e347b42109d98b 100644 (file)
--- a/src/crypto/internal/fips140/rsa/cast.go
+++ b/src/crypto/internal/fips140/rsa/cast.go
@@ -175,15 +175,6 @@ func testPrivateKey() *PrivateKey {
 
 }
 
-func testHash() []byte {
-       return []byte{
-               0x17, 0x1b, 0x1f, 0x5e, 0x9f, 0x8f, 0x8c, 0x5c,
-               0x42, 0xe8, 0x06, 0x59, 0x7b, 0x54, 0xc7, 0xb4,
-               0x49, 0x05, 0xa1, 0xdb, 0x3a, 0x3c, 0x31, 0xd3,
-               0xb7, 0x56, 0x45, 0x8c, 0xc2, 0xd6, 0x88, 0x62,
-       }
-}
-
 var fipsSelfTest = sync.OnceFunc(func() {
        fips140.CAST("RSASSA-PKCS-v1.5 2048-bit sign and verify", func() error {
                k := testPrivateKey()

diff --git a/src/crypto/internal/fips140/rsa/rsa.go b/src/crypto/internal/fips140/rsa/rsa.go
index a65a31eb43eacd3b160b2e6bd44e396c7d8b0faf..f751f107224b05fc63b22858a0d0d0a309e6ef16 100644 (file)
--- a/src/crypto/internal/fips140/rsa/rsa.go
+++ b/src/crypto/internal/fips140/rsa/rsa.go
@@ -306,6 +306,26 @@ func checkPrivateKey(priv *PrivateKey) error {
                return errors.New("crypto/rsa: d too small")
        }
 
+       // If the key is still in scope for FIPS mode, perform a Pairwise
+       // Consistency Test.
+       if priv.fipsApproved {
+               if err := fips140.PCT("RSA sign and verify PCT", func() error {
+                       hash := []byte{
+                               0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                               0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+                               0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+                               0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
+                       }
+                       sig, err := signPKCS1v15(priv, "SHA-256", hash)
+                       if err != nil {
+                               return err
+                       }
+                       return verifyPKCS1v15(priv.PublicKey(), "SHA-256", hash, sig)
+               }); err != nil {
+                       return err
+               }
+       }
+
        return nil
 }
 

diff --git a/src/crypto/internal/fips140test/cast_test.go b/src/crypto/internal/fips140test/cast_test.go
index 0ef75afcbef9c72b88d312176bfcd46ef773e610..c6e3212f3f064f9beed9d4ef47f05af102122262 100644 (file)
--- a/src/crypto/internal/fips140test/cast_test.go
+++ b/src/crypto/internal/fips140test/cast_test.go
@@ -6,6 +6,8 @@ package fipstest
 
 import (
        "crypto/rand"
+       "crypto/x509"
+       "encoding/pem"
        "fmt"
        "internal/testenv"
        "io/fs"
@@ -89,6 +91,38 @@ func TestConditionals(t *testing.T) {
        }
        ed25519.Sign(k25519, make([]byte, 32))
        rsa.VerifyPKCS1v15(&rsa.PublicKey{}, "", nil, nil)
+       // Parse an RSA key to hit the PCT rather than generating one (which is slow).
+       block, _ := pem.Decode([]byte(strings.ReplaceAll(
+               `-----BEGIN RSA TESTING KEY-----
+MIIEowIBAAKCAQEAsPnoGUOnrpiSqt4XynxA+HRP7S+BSObI6qJ7fQAVSPtRkqso
+tWxQYLEYzNEx5ZSHTGypibVsJylvCfuToDTfMul8b/CZjP2Ob0LdpYrNH6l5hvFE
+89FU1nZQF15oVLOpUgA7wGiHuEVawrGfey92UE68mOyUVXGweJIVDdxqdMoPvNNU
+l86BU02vlBiESxOuox+dWmuVV7vfYZ79Toh/LUK43YvJh+rhv4nKuF7iHjVjBd9s
+B6iDjj70HFldzOQ9r8SRI+9NirupPTkF5AKNe6kUhKJ1luB7S27ZkvB3tSTT3P59
+3VVJvnzOjaA1z6Cz+4+eRvcysqhrRgFlwI9TEwIDAQABAoIBAEEYiyDP29vCzx/+
+dS3LqnI5BjUuJhXUnc6AWX/PCgVAO+8A+gZRgvct7PtZb0sM6P9ZcLrweomlGezI
+FrL0/6xQaa8bBr/ve/a8155OgcjFo6fZEw3Dz7ra5fbSiPmu4/b/kvrg+Br1l77J
+aun6uUAs1f5B9wW+vbR7tzbT/mxaUeDiBzKpe15GwcvbJtdIVMa2YErtRjc1/5B2
+BGVXyvlJv0SIlcIEMsHgnAFOp1ZgQ08aDzvilLq8XVMOahAhP1O2A3X8hKdXPyrx
+IVWE9bS9ptTo+eF6eNl+d7htpKGEZHUxinoQpWEBTv+iOoHsVunkEJ3vjLP3lyI/
+fY0NQ1ECgYEA3RBXAjgvIys2gfU3keImF8e/TprLge1I2vbWmV2j6rZCg5r/AS0u
+pii5CvJ5/T5vfJPNgPBy8B/yRDs+6PJO1GmnlhOkG9JAIPkv0RBZvR0PMBtbp6nT
+Y3yo1lwamBVBfY6rc0sLTzosZh2aGoLzrHNMQFMGaauORzBFpY5lU50CgYEAzPHl
+u5DI6Xgep1vr8QvCUuEesCOgJg8Yh1UqVoY/SmQh6MYAv1I9bLGwrb3WW/7kqIoD
+fj0aQV5buVZI2loMomtU9KY5SFIsPV+JuUpy7/+VE01ZQM5FdY8wiYCQiVZYju9X
+Wz5LxMNoz+gT7pwlLCsC4N+R8aoBk404aF1gum8CgYAJ7VTq7Zj4TFV7Soa/T1eE
+k9y8a+kdoYk3BASpCHJ29M5R2KEA7YV9wrBklHTz8VzSTFTbKHEQ5W5csAhoL5Fo
+qoHzFFi3Qx7MHESQb9qHyolHEMNx6QdsHUn7rlEnaTTyrXh3ifQtD6C0yTmFXUIS
+CW9wKApOrnyKJ9nI0HcuZQKBgQCMtoV6e9VGX4AEfpuHvAAnMYQFgeBiYTkBKltQ
+XwozhH63uMMomUmtSG87Sz1TmrXadjAhy8gsG6I0pWaN7QgBuFnzQ/HOkwTm+qKw
+AsrZt4zeXNwsH7QXHEJCFnCmqw9QzEoZTrNtHJHpNboBuVnYcoueZEJrP8OnUG3r
+UjmopwKBgAqB2KYYMUqAOvYcBnEfLDmyZv9BTVNHbR2lKkMYqv5LlvDaBxVfilE0
+2riO4p6BaAdvzXjKeRrGNEKoHNBpOSfYCOM16NjL8hIZB1CaV3WbT5oY+jp7Mzd5
+7d56RZOE+ERK2uz/7JX9VSsM/LbH9pJibd4e8mikDS9ntciqOH/3
+-----END RSA TESTING KEY-----`, "TESTING KEY", "PRIVATE KEY")))
+       if _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {
+               t.Fatal(err)
+       }
        t.Log("completed successfully")
 }