-
Notifications
You must be signed in to change notification settings - Fork 121
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ed25519ph and Ed25519ctx Support #2120
Conversation
c2407bc
to
dce8cd8
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2120 +/- ##
========================================
Coverage 78.95% 78.95%
========================================
Files 610 611 +1
Lines 105293 105470 +177
Branches 14919 14939 +20
========================================
+ Hits 83136 83276 +140
- Misses 21505 21542 +37
Partials 652 652 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
General notes:
- Missing service indicator tests for approved ph and unapproved ctx
- Missing ACVP demo vectors
- Double checking: can these new singing modes rely on the existing boringssl_ensure_eddsa_self_test or do we need a new ctx/ph specific self test?
dce8cd8
to
d310345
Compare
d310345
to
6ad9e7d
Compare
Addressed all outstanding comments and remaining work items. |
dbd0146
to
b5a7f2e
Compare
b5a7f2e
to
53a3459
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. But dreaded delocate issue shows in the CI logs....
[340/577] Generating delocate
[341/577] Generating bcm-delocated.S
[342/577] Building ASM object crypto/fipsmodule/CMakeFiles/bcm_hashunset.dir/bcm-delocated.S.o
FAILED: crypto/fipsmodule/CMakeFiles/bcm_hashunset.dir/bcm-delocated.S.o
/usr/bin/gcc-11 -DBORINGSSL_FIPS -DBORINGSSL_HAVE_LIBUNWIND -DBORINGSSL_IMPLEMENTATION -DFIPS_ENTROPY_SOURCE_PASSIVE -I/codebuild/output/src3653541563/src/github.com/aws/aws-lc/test_build_dir/symbol_prefix_include -I/codebuild/output/src3653541563/src/github.com/aws/aws-lc/include -Wno-newline-eof -Wa,--noexecstack -O3 -DNDEBUG -fPIC -MD -MT crypto/fipsmodule/CMakeFiles/bcm_hashunset.dir/bcm-delocated.S.o -MF crypto/fipsmodule/CMakeFiles/bcm_hashunset.dir/bcm-delocated.S.o.d -o crypto/fipsmodule/CMakeFiles/bcm_hashunset.dir/bcm-delocated.S.o -c /codebuild/output/src3653541563/src/github.com/aws/aws-lc/test_build_dir/crypto/fipsmodule/bcm-delocated.S
bcm.c: Assembler messages:
bcm.c:7811: Error: pc-relative address offset out of range
bcm.c:7813: Error: pc-relative address offset out of range
bcm.c:7815: Error: pc-relative address offset out of range
ninja: build stopped: subcommand failed.
util/fipstools/acvp/acvptool/acvp.go
Outdated
@@ -51,6 +52,7 @@ var ( | |||
expectedOutFlag = flag.String("expected-out", "", "Name of a file to write the expected results to") | |||
wrapperPath = flag.String("wrapper", "../../../../build/util/fipstools/acvp/modulewrapper/modulewrapper", "Path to the wrapper binary") | |||
waitForDebugger = flag.Bool("wait-for-debugger", false, "If true, jobs will run one at a time and pause for a debugger to attach") | |||
katFilePath = flag.String("kat-out", "", "Writes a KAT file out if with test information for use with AWS-LC's file-based test framework. Support is limited, so if you don't see content its likely not plumbed in.") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
where was this argument used and the path to the file passed in? Maybe it can be added to the PR description if done offline.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
line 560 is where it is used in code if set, there is nothing to plumb in, it's for an operator to invoke manually if they need to exercise this specific niche scenario. Similar to the wait-for-debuger argument. It's an aide nothing more.
df7c5d7
to
709cf2a
Compare
### Description of changes: * Add support for Ed25519ph and Ed25519ph where the digest is pre-computed and provided externally. * Add support for Ed25519ctx from RFC 8032. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
Description of changes:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.