util/fipstools: allow rsakpg2-[basic|crt] for KTS-IFC

Previously the fipstools kts subprocess code rejected test groups that
corresponded to capabilities advertising keyGenerationMethods using
anything other than rsakpg1-basic (fixed pub exp, basic format) or
rsakpg1-crt (fixed pub exp, crt format). This commit extends the check
to also allow rsapkg2-basic (random pub exp, basic format) and
rsapkg2-crt (random pub exp, crt format).

The exponent (fixed or random) is already passed through to the module
wrapper so no further code changes are required in the acvptool to
support testing modules using random exponents for KTS-IFC.

Change-Id: I79e941a5ac6ddbd7068cb1067b9d8b449b70e0a4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92527
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

util/fipstools/acvp/acvptool/subprocess/kts.go

diff --git a/util/fipstools/acvp/acvptool/subprocess/kts.go b/util/fipstools/acvp/acvptool/subprocess/kts.go
index e8145df..6a05b35 100644
--- a/util/fipstools/acvp/acvptool/subprocess/kts.go
+++ b/util/fipstools/acvp/acvptool/subprocess/kts.go
@@ -103,9 +103,12 @@
 			return nil, fmt.Errorf("unsupported scheme %q in test group %d", group.Scheme, group.ID)
 		}
 
-		if group.KeyGen != "rsakpg1-basic" && group.KeyGen != "rsakpg1-crt" {
+		switch group.KeyGen {
+		case "rsakpg1-basic", "rsakpg1-crt", "rsakpg2-basic", "rsakpg2-crt":
+			// Supported key generation method.
+		default:
 			return nil, fmt.Errorf(
-				"unsupported key generation method %q in test group %d - only fixed public exponent (rsakpg1-basic or rsakpg1-crt) are supported", group.KeyGen, group.ID)
+				"unsupported key generation method %q in test group %d", group.KeyGen, group.ID)
 		}
 
 		if group.OutputBits%8 != 0 {
@@ -205,7 +208,7 @@
 	cmd := fmt.Sprintf("KTS-IFC/%s/responder", hashAlg)
 	var args [][]byte
 
-	if keyGen == "rsakpg1-basic" {
+	if keyGen == "rsakpg1-basic" || keyGen == "rsakpg2-basic" {
 		dBytes, err := hex.DecodeString(test.IutD)
 		if err != nil {
 			return fmt.Errorf("invalid IutD: %v", err)