Don't draw entropy during FIPS power-on tests.

Change-Id: I8512c6bfb62f1a83afc8f763d681bf5db3b4ceae
Reviewed-on: https://boringssl-review.googlesource.com/17144
Commit-Queue: Adam Langley <alangley@gmail.com>
Reviewed-by: David Benjamin <davidben@google.com>

crypto/fipsmodule/bcm.c

diff --git a/crypto/fipsmodule/bcm.c b/crypto/fipsmodule/bcm.c
index 76fbae3..c6ea796 100644
--- a/crypto/fipsmodule/bcm.c
+++ b/crypto/fipsmodule/bcm.c
@@ -245,8 +245,7 @@
       !set_bignum(&rsa->q, kQ, sizeof(kQ)) ||
       !set_bignum(&rsa->dmp1, kDModPMinusOne, sizeof(kDModPMinusOne)) ||
       !set_bignum(&rsa->dmq1, kDModQMinusOne, sizeof(kDModQMinusOne)) ||
-      !set_bignum(&rsa->iqmp, kQInverseModP, sizeof(kQInverseModP)) ||
-      !RSA_check_fips(rsa)) {
+      !set_bignum(&rsa->iqmp, kQInverseModP, sizeof(kQInverseModP))) {
     RSA_free(rsa);
     return NULL;
   }
@@ -277,8 +276,7 @@
   BIGNUM *d = BN_bin2bn(kD, sizeof(kD), NULL);
   if (ec_key == NULL || qx == NULL || qy == NULL || d == NULL ||
       !EC_KEY_set_public_key_affine_coordinates(ec_key, qx, qy) ||
-      !EC_KEY_set_private_key(ec_key, d) ||
-      !EC_KEY_check_fips(ec_key)) {
+      !EC_KEY_set_private_key(ec_key, d)) {
     EC_KEY_free(ec_key);
     ec_key = NULL;
   }
@@ -460,6 +458,21 @@
       0xd5, 0xa8, 0x66, 0x16, 0xbd, 0x18, 0x3c, 0xf2, 0xaa, 0x7a, 0x2b,
       0x37, 0xf9, 0xab, 0x35, 0x64, 0x15, 0x01, 0x3f, 0xc4,
   };
+  const uint8_t kECDSASigR[32] = {
+      0x67, 0x80, 0xc5, 0xfc, 0x70, 0x27, 0x5e, 0x2c, 0x70, 0x61, 0xa0,
+      0xe7, 0x87, 0x7b, 0xb1, 0x74, 0xde, 0xad, 0xeb, 0x98, 0x87, 0x02,
+      0x7f, 0x3f, 0xa8, 0x36, 0x54, 0x15, 0x8b, 0xa7, 0xf5,
+#if !defined(BORINGSSL_FIPS_BREAK_ECDSA_SIG)
+      0x0c,
+#else
+      0x00,
+#endif
+  };
+  const uint8_t kECDSASigS[32] = {
+      0xa5, 0x93, 0xe0, 0x23, 0x91, 0xe7, 0x4b, 0x8d, 0x77, 0x25, 0xa6,
+      0xba, 0x4d, 0xd9, 0x86, 0x77, 0xda, 0x7d, 0x8f, 0xef, 0xc4, 0x1a,
+      0xf0, 0xcc, 0x81, 0xe5, 0xea, 0x3f, 0xc2, 0x41, 0x7f, 0xd8,
+  };
 
   AES_KEY aes_key;
   uint8_t aes_iv[16];
@@ -572,6 +585,11 @@
 
   /* RSA Sign KAT */
   unsigned sig_len;
+
+  /* Disable blinding for the power-on tests because it's not needed and
+   * triggers an entropy draw. */
+  rsa_key->flags |= RSA_FLAG_NO_BLINDING;
+
   if (!RSA_sign(NID_sha256, kPlaintextSHA256, sizeof(kPlaintextSHA256), output,
                 &sig_len, rsa_key) ||
       !check_test(kRSASignature, output, sizeof(kRSASignature),
@@ -595,15 +613,28 @@
   }
 
   /* ECDSA Sign/Verify PWCT */
+
+  /* The 'k' value for ECDSA is fixed to avoid an entropy draw. */
+  ec_key->fixed_k = BN_new();
+  if (ec_key->fixed_k == NULL ||
+      !BN_set_word(ec_key->fixed_k, 42)) {
+    printf("Out of memory\n");
+    goto err;
+  }
+
   ECDSA_SIG *sig =
       ECDSA_do_sign(kPlaintextSHA256, sizeof(kPlaintextSHA256), ec_key);
-#if defined(BORINGSSL_FIPS_BREAK_ECDSA_SIG)
-  sig->r->d[0] = ~sig->r->d[0];
-#endif
+
+  uint8_t ecdsa_r_bytes[sizeof(kECDSASigR)];
+  uint8_t ecdsa_s_bytes[sizeof(kECDSASigS)];
   if (sig == NULL ||
-      !ECDSA_do_verify(kPlaintextSHA256, sizeof(kPlaintextSHA256), sig,
-                       ec_key)) {
-    printf("ECDSA Sign/Verify power-on PWCT failed.\n");
+      BN_num_bytes(sig->r) != sizeof(ecdsa_r_bytes) ||
+      !BN_bn2bin(sig->r, ecdsa_r_bytes) ||
+      BN_num_bytes(sig->s) != sizeof(ecdsa_s_bytes) ||
+      !BN_bn2bin(sig->s, ecdsa_s_bytes) ||
+      !check_test(kECDSASigR, ecdsa_r_bytes, sizeof(kECDSASigR), "ECDSA R") ||
+      !check_test(kECDSASigS, ecdsa_s_bytes, sizeof(kECDSASigS), "ECDSA S")) {
+    printf("ECDSA KAT failed.\n");
     goto err;
   }
 

crypto/fipsmodule/ec/ec_key.c

diff --git a/crypto/fipsmodule/ec/ec_key.c b/crypto/fipsmodule/ec/ec_key.c
index 67b92a7..acabb06 100644
--- a/crypto/fipsmodule/ec/ec_key.c
+++ b/crypto/fipsmodule/ec/ec_key.c
@@ -152,6 +152,7 @@
   EC_GROUP_free(r->group);
   EC_POINT_free(r->pub_key);
   BN_clear_free(r->priv_key);
+  BN_free(r->fixed_k);
 
   CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data);
 

crypto/fipsmodule/ec/internal.h

diff --git a/crypto/fipsmodule/ec/internal.h b/crypto/fipsmodule/ec/internal.h
index b86a0f9..d14fec6 100644
--- a/crypto/fipsmodule/ec/internal.h
+++ b/crypto/fipsmodule/ec/internal.h
@@ -235,6 +235,10 @@
   EC_POINT *pub_key;
   BIGNUM *priv_key;
 
+  /* fixed_k may contain a specific value of 'k', to be used in ECDSA signing.
+   * This is only for the FIPS power-on tests. */
+  BIGNUM *fixed_k;
+
   unsigned int enc_flag;
   point_conversion_form_t conv_form;
 

crypto/fipsmodule/ecdsa/ecdsa.c

diff --git a/crypto/fipsmodule/ecdsa/ecdsa.c b/crypto/fipsmodule/ecdsa/ecdsa.c
index 37f8223..9e719f2 100644
--- a/crypto/fipsmodule/ecdsa/ecdsa.c
+++ b/crypto/fipsmodule/ecdsa/ecdsa.c
@@ -262,7 +262,11 @@
     /* If possible, we'll include the private key and message digest in the k
      * generation. The |digest| argument is only empty if |ECDSA_sign_setup| is
      * being used. */
-    if (digest_len > 0) {
+    if (eckey->fixed_k != NULL) {
+      if (!BN_copy(k, eckey->fixed_k)) {
+        goto err;
+      }
+    } else if (digest_len > 0) {
       do {
         if (!BN_generate_dsa_nonce(k, order, EC_KEY_get0_private_key(eckey),
                                    digest, digest_len, ctx)) {