OpenSSL Software Foundation, Inc.

Transcription

1 OpenSSL Software Foundation, Inc 1829 Mount Ephraim Road Adamstown, MD USA Instructions for CMVP Testing Ubuntu on ARMv7 August 2, 2013 Table of Contents 1 Overview1 2 Inventory2 21 Hardware 2 22 Software2 3 Software Preparation3 31 Build System Access3 32 Compilation3 33 Target Device Access4 34 Target Device Information4 35 Test Suite Execution5 4 Processing test vectors6 1 Overview Platform testing instructions for the OpenSSL FIPS Object Module v20 validation This target device is Linux on ARMv7 with a native build These instructions cover testing with and without NEON 1 of 6 Beaglebone Black

2 2 Inventory 21 Hardware Hardware supplied by vendor: Linux based appliance Beaglebone Black (CUST0056) Hardware supplied by test lab: N/A 22 Software Software supplied by vendor: (all software should be installed in the same directory on Linux host system as described in the following section): the file openssl fips 205targz from 20/source/ the files setenv no neonsh setenv with neonsh from 20/platforms/linux arm/ When all downloads are complete the TOP directory should contain the following files (as shown by the "ls l" command): setenv no neonsh setenv with neonsh openssl fips 205targz Software supplied by the test lab: The targz or zip file containing a set of test vector request files 2 of 6

3 3 Software Preparation All commands as typed on a client system used for remote access are bolded Commands as executed on the target device are bolded in blue You will be able to cut and paste from this document (fortunately, as some of these commands are fairly complex) We could script these commands more heavily but thought you might prefer to have full visibility 31 Remote Access Remote access via the OSF testhub server: $ ssh fipstest@testhubopensslfoundationcom OSF testhub server Last login: Thu Dec 15 14:22: from fipstest@epiphany:~$ cd /mnt/share/osf/top beagleboard fipstest@epiphany:/mnt/share/osf/top beagleboard$ Note that depending on how you have configured your ssh client you may need a " i id_testhub2" argument to specify the location of the ssh private key file Next access the test device: fipstest@epiphany:/mnt/share/osf/top beagleboard$ ssh fipstest@ Warning: Permanently added ' ' (ECDSA) to the list of known hosts fipstest@ 's password: fipstest The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law Welcome to Ubuntu 1304 (GNU/Linux 3813 bone24 armv7l) * Documentation: /usr/bin/xauth: file /home/fipstest/xauthority does not exist fipstest@arm:~$ cd /mnt/top beaglebone fipstest@arm:/mnt/top beaglebone$ From this point on the shell prompt "fipstest@arm:/mnt/top beaglebone$" is abbreviated as "$" 3 of 6

4 Note at this point the processor type of the target device can be displayed: $ uname a Linux arm 3813 bone24 #1 SMP Sat Jul 13 10:07:19 UTC 2013 armv7l armv7l armv7l GNU/Linux $ cat /proc/cpuinfo processor : 0 model name : ARMv7 Processor rev 2 (v7l) BogoMIPS : Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x3 CPU part : 0xc08 CPU revision : 2 Hardware : Generic AM33XX (Flattened Device Tree) Revision : 0000 Serial : $ As with most Linux systems the O/S version can be seen with the lsb_release command: $ lsb_release a No LSB modules are available Distributor ID: Ubuntu Description: Ubuntu 1304 Release: 1304 Codename: raring $ 32 Compilation Perform the compilation to generate the binaries Note this step is only performed once as the same binary code is used for all target devices: $ setenv no neonsh (without NEON) or $ setenv with neonsh (with NEON) $ rm rf openssl 205 $ gunzip c openssl fips 205targz tar xf $ cd openssl fips of 6

5 $ gcc version gcc (Ubuntu/Linaro 473 1ubuntu1) 473 Copyright (C) 2012 Free Software Foundation, Inc This is free software; see the source for copying conditions There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE $ /config should see several screens of output $ make should see lots of output $ make build_algvs should see lots of output $ file test/fips_algvs test/fips_algvs: ELF 32 bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2632, BuildID[sha1]=0xe5ef703e127281b3a2f9e46948c547476bd29775, not stripped $ cd 35 Test Suite Execution The output of this step should be captured in a text file by any convenient method (*nix "script" command if available, " tee" command, or even cut and paste from a terminal session) $ openssl fips 205/fips_algvs fips_test_suite FIPS mode test application FIPS 205 validated module 10 Apr 2013 DRBG AES 256 CTR DF test started DRBG AES 256 CTR DF test OK 1 Non Approved cryptographic operation test Testing induced failure of X931 CPRNG test X931 continuous PRNG failed as expected Induced failure test completed with 0 errors successful as expected All tests completed with 0 errors should see the typical fips_test_suite output; note it will take a long time to run; the "/test/fips_test_suite post" command will exercise the POST only and run much more quickly $ 5 of 6

6 The fips_test_suite program can be invoked with different command line options for the various demonstrations such as KAT corruption 36 Additional Test Suite Execution Note that rebuilding from source is not necessary when testing the same platform with/without NEON optimizations The one the test suite program has been generated and executed for one case the other case can be executed immediately, eg: $ setenv with neonsh (with NEON) $ openssl fips 205/test/fips_algvs fips_test_suite 6 of 6