From darrenm@sac.sfbay.sun.com Tue Aug 18 07:26:15 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7IEQEIt016174 for ; Tue, 18 Aug 2009 07:26:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7IEQAtq028560; Tue, 18 Aug 2009 22:26:13 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOK00205TFOGV00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Aug 2009 07:26:12 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOK00GFFTFOLK90@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Aug 2009 07:26:12 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7IEQB5n043729; Tue, 18 Aug 2009 07:26:11 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7IEQARL016169; Tue, 18 Aug 2009 07:26:10 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n7IEQAkP016165; Tue, 18 Aug 2009 07:26:10 -0700 (PDT) Date: Tue, 18 Aug 2009 07:26:10 -0700 (PDT) From: Darren J Moffat Subject: Kernel Cryptographic Framework support for FIPS 140-2 [PSARC/2009/447 FastTrack timeout 08/25/2009] To: PSARC-ext@sun.com Cc: crypto-discuss@opensolaris.org Message-id: <200908181426.n7IEQAkP016165@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4819 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1 Project/Component Working Name: Kernel Cryptographic Framework support for FIPS 140-2 1.2 Name of Document Author/Supplier: Anthony Scarpino Technical Description The Interface taxonomy is Consolidation Private. The Release taxonomy is Patch/Micro Diff-marked draft manpages, cspi design, and header files are included in the case directory. Background Among the many requirement FIPS 140-2 documents, one is that of each algorithm modules in the boundary to perform a POST (Power-On Self Tests) when an algorithm modules loads. A FIPS 140 boundary is defined as a set of binaries that will be verified before crypto operations are allowed from any binary in the boundaries. Another requirement is that the API, which FIPS 140 support is provided through, cannot operate until the boundary has been verified by approved FIPS 140 means. In the Kernel Cryptographic Framework, a providers (or algorithm module) registers with the kcf kernel module when it loads using the existing Service Provider Interface (SPI). This allows the Cryptographic Framework to know what functions the provider supports, among many other things, before the provider is allowed to operate. Simply by defining a POST function does not the make the module FIPS 140-compliant. This is just one piece of the validation process with which involves a lab that specializes in FIPS 140 validations. Proposal For POST support, extending the existing SPI so algorithm modules can register an entry point for a POST function, it allows kcf to orchestrate the running of POST for each of the algorithm modules when the framework is configured in FIPS 140-2 mode. This case would add another structure to the crypto_ops(9s), crypto_fips140_ops(9s) and increment the SPI version to 4. The algorithms modules that support FIPS 140 will be modified to use the version 4 SPI entry point (spi.h). crypto_fips140_ops will contain one entry point: void (*fips140_post)(int *); With regard to preventing operations on FIPS 140 boundary modules until the boundary has been verified. In nearly all the cases modifying existing code can support this operation, but random is the exception. The kcf random API requires two new functions that will delay operations until the boundary can be verified. The existing random functions must remain untouched because some consumers of those functions cannot operate properly immediately without random data. All consumers using random, desiring to operate under FIPS 140-2 compliance, must use the new APIs. This case does not change the RNG or PRNG at all. The new functions are: int random_get_bytes_fips140(uint8_t *ptr, size_t len); int random_get_pseudo_bytes_fips140(uint8_t *ptr, size_t len); Compatibility The SPI interface was introduced by PSARC 2001/553. The have been incremented by PSARC 2005/576 and PSARC/2007/092. The kernel kcf module will remain backwards compatible with version 1, 2, and 3 providers. Bug/RFE Number(s): 6870299 Exported Interfaces: +--------------------------------+---------------------------+--------------+ | Interface | Classification | Comments | +--------------------------------+---------------------------+--------------+ | impl.h | Consolidation | include file | | | Private | | | | | | | spi.h | Consolidation | include file | | | Private | | | | | | | ioctladmin.h | Project Private | include file | | | | | | sched_impl.h | Project Private | include file | | | | | | random.h | Contracted Consolidation | include file | | | Private | | | | | | +--------------------------------+---------------------------+--------------+ 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From gdamore@sun.com Tue Aug 18 08:50:41 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7IFofcc023174 for ; Tue, 18 Aug 2009 08:50:41 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7IFoVu4023507 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 18 Aug 2009 08:50:41 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOK0000VXCGJO00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 18 Aug 2009 09:50:40 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOK00G8OXCFZV60@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 18 Aug 2009 09:50:39 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7IFocYG015764 for ; Tue, 18 Aug 2009 08:50:38 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KOK00D00XC6HS00@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 18 Aug 2009 08:50:38 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KOK00329XCDOA30@fe-sfbay-10.sun.com>; Tue, 18 Aug 2009 08:50:37 -0700 (PDT) Date: Tue, 18 Aug 2009 08:50:37 -0700 From: "Garrett D'Amore" Subject: Re: Kernel Cryptographic Framework support for FIPS 140-2 [PSARC/2009/447 FastTrack timeout 08/25/2009] In-reply-to: <200908181426.n7IEQAkP016165@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: Darren J Moffat Cc: PSARC-ext@sun.com, crypto-discuss@opensolaris.org Message-id: <4A8ACDCD.6090309@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200908181426.n7IEQAkP016165@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 5091 Looks straight-forward to me. +1. - Garrett Darren J Moffat wrote: > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > This information is Copyright 2009 Sun Microsystems > 1. Introduction > 1.1 Project/Component Working Name: > Kernel Cryptographic Framework support for FIPS 140-2 > 1.2 Name of Document Author/Supplier: > Anthony Scarpino > > > Technical Description > > The Interface taxonomy is Consolidation Private. > The Release taxonomy is Patch/Micro > > Diff-marked draft manpages, cspi design, and header files are included > in the case directory. > > Background > > Among the many requirement FIPS 140-2 documents, one is that of > each algorithm modules in the boundary to perform a POST (Power-On > Self Tests) when an algorithm modules loads. A FIPS 140 boundary is defined > as a set of binaries that will be verified before crypto operations are > allowed from any binary in the boundaries. > > Another requirement is that the API, which FIPS 140 support is provided > through, cannot operate until the boundary has been verified by approved > FIPS 140 means. > > In the Kernel Cryptographic Framework, a providers (or algorithm module) > registers with the kcf kernel module when it loads using the existing > Service Provider Interface (SPI). This allows the Cryptographic > Framework to know what functions the provider supports, among many other > things, before the provider is allowed to operate. > > Simply by defining a POST function does not the make the module > FIPS 140-compliant. This is just one piece of the validation process with > which involves a lab that specializes in FIPS 140 validations. > > > Proposal > > For POST support, extending the existing SPI so algorithm modules > can register an entry point for a POST function, it allows kcf to > orchestrate the running of POST for each of the algorithm modules > when the framework is configured in FIPS 140-2 mode. > > This case would add another structure to the crypto_ops(9s), > crypto_fips140_ops(9s) and increment the SPI version to 4. > The algorithms modules that support FIPS 140 will be modified to use > the version 4 SPI entry point (spi.h). crypto_fips140_ops will contain > one entry point: > > void (*fips140_post)(int *); > > > With regard to preventing operations on FIPS 140 boundary modules until > the boundary has been verified. In nearly all the cases modifying > existing code can support this operation, but random is the exception. > The kcf random API requires two new functions that will delay > operations until the boundary can be verified. The existing random > functions must remain untouched because some consumers of those > functions cannot operate properly immediately without random data. > All consumers using random, desiring to operate under FIPS 140-2 > compliance, must use the new APIs. This case does not change the > RNG or PRNG at all. > > The new functions are: > > int random_get_bytes_fips140(uint8_t *ptr, size_t len); > int random_get_pseudo_bytes_fips140(uint8_t *ptr, size_t len); > > > Compatibility > > The SPI interface was introduced by PSARC 2001/553. The have > been incremented by PSARC 2005/576 and PSARC/2007/092. > The kernel kcf module will remain backwards compatible with > version 1, 2, and 3 providers. > > Bug/RFE Number(s): 6870299 > > Exported Interfaces: > > +--------------------------------+---------------------------+--------------+ > | Interface | Classification | Comments | > +--------------------------------+---------------------------+--------------+ > | impl.h | Consolidation | include file | > | | Private | | > | | | | > | spi.h | Consolidation | include file | > | | Private | | > | | | | > | ioctladmin.h | Project Private | include file | > | | | | > | sched_impl.h | Project Private | include file | > | | | | > | random.h | Contracted Consolidation | include file | > | | Private | | > | | | | > +--------------------------------+---------------------------+--------------+ > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > ON > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > > From Darren.Moffat@sun.com Thu Aug 20 01:08:43 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7K88hVh001048 for ; Thu, 20 Aug 2009 01:08:43 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7K88fAa029787 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 20 Aug 2009 01:08:42 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOO00E1Z1AHTE00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 20 Aug 2009 01:08:41 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOO0048K1AFVHA0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 20 Aug 2009 01:08:40 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7K88bIm025190 for ; Thu, 20 Aug 2009 08:08:38 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOO0020012AV800@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 20 Aug 2009 09:08:15 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOO0070X19EY8A0@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 20 Aug 2009 09:08:03 +0100 (BST) Date: Thu, 20 Aug 2009 09:08:02 +0100 From: Darren J Moffat Subject: PSARC/2009/447 Kernel Cryptographic Framework support for FIPS 140-2 [closed-approved] Sender: Darren.Moffat@sun.com To: PSARC-ext@sun.com, crypto-discuss@opensolaris.org Message-id: <4A8D0462.9010604@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 84 This case was approved in PSARC on Wednesday 19th August 2009. -- Darren J Moffat