OpenSSL Software Foundation, Inc.

Transcription

1 OpenSSL Software Foundation, Inc 1829 Mount Ephraim Road Adamstown, MD USA Instructions for CMVP Testing Android 50 on ARMv7 with NEON April 13, 2015 Table of Contents 1 Overview1 2 Inventory2 21 Hardware 2 22 Software2 3 Preparation3 31 Setup3 32 Preparing the Test Environment4 33 Access to Device4 4 Testing6 41 Device Information6 42 Scripted Tests7 43 Cross Compilation7 44 Test Suite Execution9 5 Processing Test Vectors11 1 Overview Platform testing instructions for the OpenSSL FIPS Object Module v20 validation The target devices are the Galaxy Note 4 model SM N910V (CUST0069) and Galaxy S6 Edgemodel SM G925V (CUST0070) The devices features the Qualcomm APQ8084 (ARMv7) which is NON capable, and the SAMSUNG Exynos7420 (ARMv8) which is NEON and Crypto Extensions capable USB device ids: c dec54f3a219 Galaxy Note 4 model SM N910V (CUST0069) Galaxy S6 Edgemodel SM G925V (CUST0070) 1 of 12

2 Instructions for CMVP Testing Android 40 on ARMv7 with NEON 2 Inventory 21 Hardware Hardware supplied by OSF: Galaxy Note 4 model SM N910V (CUST0069) Galaxy S6 Edgemodel SM G925V (CUST0070) Hardware supplied by test facility: N/A 22 Software Software supplied by OSF: (all software should be installed in the same directory on Linux host system as described in the following section): the file openssl fips 209targz from 20/source/ patches (supplied by OSF) the file mkrespdirpl from 20/testvectors/ the files setenv android 50 32sh setenv android 50 64sh from 20/platforms/android 50/ When all downloads are complete the TOP directory should contain the following files (as shown by the "ls l" command): openssl fips 209targz 2 of 12

3 Instructions for CMVP Testing Android 40 on ARMv7 with NEON mkrespdirpl (patches) setenv android 50 32sh setenv android 50 64sh Software supplied by the test lab: The targz or zip file containing a set of test vector request files Note an example of such a testvector data set can be found at 20/testvectors/tvtargz 3 Preparation This section is blank 3 of 12

4 Instructions for CMVP Testing Android 40 on ARMv7 with NEON 4 Testing This section assumes the bolded commands are being typed on the testhub1 server with a current directory of /mnt/osf/top android 50/ For remote access via the OSF testhub server: $ ssh fipstest@testhub1opensslfoundationcom OSF testhub server Last login: Thu Dec 15 14:23: from fipstest@testhub2:~$ cd /mnt/share/osf/top android 50 fipstest@testhub:/mnt/osf/top android Device Information Note at this point the processor type of the Android test device can be displayed: $ /adb s c shell (for 32bit device) $ /adb s 12147dec54f3a219 shell (for 64bit device) should see #"prompt from a shell executing on the Android target device # cat /proc/cpuinfo processor : 0 (32 bit) model name : ARMv7 Processor rev 1 (v7l) BogoMIPS : 3840 Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 CPU implementer : 0x51 CPU architecture: 7 CPU variant : 0x3 CPU part : 0x06f CPU revision : 1 Hardware : Qualcomm APQ8084 Revision : 000c Serial : or Processor : AArch64 Processor rev 2 (aarch64) (64 bit) processor : 0 processor : 1 processor : 2 processor : 3 processor : 4 4 of 12

5 Instructions for CMVP Testing Android 40 on ARMv7 with NEON processor : 5 processor : 6 processor : 7 Features : fp asimd aes pmull sha1 sha2 crc32 CPU implementer : 0x41 CPU architecture: AArch64 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 2 Hardware : SAMSUNG Exynos7420 # cat /proc/version Linux version eng (dpi@swdd3922) (gcc version 48 (GCC) ) #1 SMP PREEMPT Fri Feb 27 14:52:07 KST 2015 (32 bit) or Linux version eng (dpi@swdd5018) (gcc version (prerelease) (GCC) ) #1 SMP PREEMPT Mon Mar 2 20:50:19 KST 2015 (64 bit) # getprop robuildversionrelease 501 (32 bit) or 502 (64 bit) # exit (return to shell on Linux host system) 42 Scripted Tests The four platforms tests have been completely scripted: $ /run android noaccelsh (32 bit no optimizations) $ /run android 50 32sh (32 bit with optimizations) $ /run android noaccelsh (64 bit no optimizations) $ /run android 50 64sh (64 bit with optimizations) Note the build from source is done each time, which is unnecessary as the 32 bit executable can be used for both 32 bit tests and the 64 bit one for both 64 bit platform tests The following sections cover the individual commands performed by the comprehensive run scripts 43 Cross Compilation First we set the environment variables to define the target platform, and confirm the pathnames are correct: $ setenv android 50 32sh (32 bit) 5 of 12

6 Instructions for CMVP Testing Android 40 on ARMv7 with NEON $ setenv android 50 64sh (64 bit) $ rm rf openssl fips 209 $ gunzip c openssl fips 209targz tar xf $ cd openssl fips 209 $ patch p1 < /ios 81patch patching file Configure patching file crypto/aes/makefile patching file crypto/arm_archh patching file crypto/armcapc patching file crypto/evp/e_aesc patching file crypto/makefile patching file crypto/modes/gcm128c patching file crypto/modes/makefile patching file crypto/sha/makefile patching file fips/fipssymsh patching file test/fips_algvsc patching file crypto/modes/modes_lclh patching file fips/fipsalgtestpl $ patch p1 < /ios 81 newpatch patching file crypto/aes/asm/aesv8 armxpl patching file crypto/arm64cpuidpl patching file crypto/modes/asm/ghashv8 armxpl patching file crypto/perlasm/arm xlatepl patching file crypto/sha/asm/sha1 armv8pl patching file crypto/sha/asm/sha512 armv8pl patching file ios/makefile patching file ios/fips_algvsapp/entitlementsplist patching file ios/fips_algvsapp/infoplist patching file ios/fips_algvsapp/resourcerulesplist patching file ios/fopenm patching file ios/incore_machoc $ patch p1 < /ios 81 32patch patching file Configure patching file crypto/aes/asm/aes armv4pl patching file crypto/bn/asm/armv4 gf2mpl patching file crypto/bn/asm/armv4 montpl patching file crypto/modes/asm/ghash armv4pl patching file crypto/perlasm/arm xlatepl patching file crypto/sha/asm/sha1 armv4 largepl patching file crypto/sha/asm/sha256 armv4pl patching file crypto/sha/asm/sha512 armv4pl patching file fips/fipssymsh 6 of 12

7 Instructions for CMVP Testing Android 40 on ARMv7 with NEON patching file crypto/armv4cpuid_ioss patching file config patching file fips/fips_test_suitec $ patch p1 < /vxworkspatch patching file config patching file Configure patching file test/fips_algvsc $ patch p1 < /android64patch patching file Configure patching file config patching file fips/fips_canisterc patching file test/fips_algvsc patching file fips/fips_test_suitec patching file util/incore $ arm linux androideabi gcc version (32 bit) $ aarch64 linux android gcc version (64 bit) arm linux androideabi gcc (GCC) (prerelease) (32 bit) oraarch64 linux android gcc (GCC) (prerelease) (64 bit) Copyright (C) 2014 Free Software Foundation, Inc This is free software; see the source for copying conditions There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE $ Next we perform the actual cross compilation to generate the binaries: $ /config should see several screens of output Configured for android armv7 Configured for android64 aarch64 $ make should see lots of output $ make build_algvs should see lots of output $ file test/fips_algvs (for 32 bit) (for 64 bit) 7 of 12

8 Instructions for CMVP Testing Android 40 on ARMv7 with NEON test/fips_algvs: ELF 32 bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), not stripped ortest/fips_algvs: ELF 64 bit LSB shared object, version 1 (SYSV), dynamically linked (uses shared libs), not stripped $ cd (back to TOP directory) Copy the test suite program to the Android target device: $ /adb s c push openssl fips 209/test/fips_algvs (32 bit) /data/local/tmp/ $ /adb s 12147dec54f3a219 push openssl fips 209/test/fips_algvs (64 bit) /data/local/tmp/ 3273 KB/s ( bytes in 0170s) (exact counts may vary) $ Note that "openssl fips 209/test/fips_algvs" and "/data/local/tmp/" are separate command line arguments separated by whitespace, but all on the same command line 44 Test Suite Execution At this point we can execute the fips_test_suite program on the Android target device: $ /adb s c shell (32 bit) $ /adb s 12147dec54f3a219 shell (64 bit) $ cd /data/local/tmp $ /fips_algvs noaccel fips_test_suite (without optimizations) $ /fips_algvs fips_test_suite (with optimizations) Optimizations disabled (only appears for " noaccel") FIPS mode test application FIPS 209 validated module 25 Oct 2014 DRBG AES 256 CTR DF test started DRBG AES 256 CTR DF test OK 1 Non Approved cryptographic operation test should see the typical fips_test_suite output; note it will take a long time to run; the "/test/fips_test_suite post" command will exercise the POST only and run much more quickly $ exit 8 of 12

9 Instructions for CMVP Testing Android 40 on ARMv7 with NEON The fips_test_suite program can be invoked with different command line options for the various demonstrations such as KAT corruption 9 of 12

10 Instructions for CMVP Testing Android 40 on ARMv7 with NEON 5 Processing Test Vectors A subdirectory containing all the test vector files should be present at the root of the source code workarea Create the "fipstestsh" script: $ perl openssl fips 209/fips/fipsalgtestpl minimal script generate script=fipstestssh dir=tv (you may see lots of informative or non fatal warning messages depending on the content of the test vector directory) Note that the fipsalgtestpl program will automatically locate the test vector files if they are present in the current directory, and are the only such set of test vector files The dir=tv option can be used to search just the subdirectory TV for the test vector files Note for this platform the /resp/ subdirectories in the test vector directory tree must exist Use the mkrespdirpl utility to generate any missing subdirectories: $ perl mkrespdirpl TV making OE3/OSF_2464_OE3/AES/resp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox128rsp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox192rsp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox256rsp touching OE3/OSF_2464_OE3/AES/resp/CBCKeySbox128rsp touching OE3/OSF_2464_OE3/XTS/resp/XTSGenAES128rsp touching OE3/OSF_2464_OE3/XTS/resp/XTSGenAES256rsp making OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp touching OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp/SigGenPSS_186 2rsp touching OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp/SigVerPSS_186 2rsp $ Copy the fipstestsh program and testvectors to the Android target device: OpenSSL_SN_Platform_6zip $ /adb s <usb id> push fipstestssh /data/local/tmp/ 705 KB/s (30512 bytes in 0042s) (actual number may differ) $ android sdk linux/platform tools/adb push TV /data/local/tmp/tv push: tv/osf_2464_template_part3_rsapss_0salt/rsa/req/siggenpss_186 2req > /mnt/sdcard/osf_2464_template_part3_rsapss_0salt/rsa/req/siggenpss_186 2req push: tv/osf_2464_template_part3_rsapss_0salt/rsa/req/sigverpss_186 2req > 10 of 12

11 Instructions for CMVP Testing Android 40 on ARMv7 with NEON push: OE2/OSF_2464_OE2_Part2_ECPrime/ECDSA/resp/SigVerrsp > /data/local/tmp/oe2/osf_2464_oe2_part2_ecprime/ecdsa/resp/sigverrsp push: OE2/OSF_2464_OE2_Part2_ECPrime/ECDSA/resp/PKVrsp > /data/local/tmp/oe2/osf_2464_oe2_part2_ecprime/ecdsa/resp/pkvrsp 518 files pushed 0 files skipped 958 KB/s ( bytes in 71488s) where TV is the name of the subdirectory containing the test vector files Invoke a shell on the Android target device to run the fipstestsh script At this point the /data/local/tmp/ directory on the Android target device should contain the fipstestsh program and two subdirectories: $ /adb s <usb id> shell $ cd /data/local/tmp $ ls l rwxrwxrwx root root :22 fips_algvs $ cd /sdcard $ ls l drwxrwxr x root root :26 TV rw rw rw root root :43 fipstestsh Now invoke the fipstestsh program Note this will take a long time (several hours) to complete: $ /data/local/tmp/fips_algvs noaccel or $ /data/local/tmp/fips_algvs Running command line: /test/fips_dssvs pqg Running command line: /test/fips_dssvs keypair Running command line: /test/fips_dssvs siggen Running command line: /test/fips_dssvs sigver Running command line: /test/fips_dssvs pqgver Running command line: /test/fips_dssvs pqg Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest xts 11 of 12

12 Instructions for CMVP Testing Android 40 on ARMv7 with NEON Running command line: /test/fips_gcmtest xts Running command line: /test/fips_ecdhvs ecdhgen Completed with 0 errors $ exit Copy the testvector directory back to the Linux host system: $ /adb pull /data/local/tmp/tv TVresults pull: building file list pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/CTR_DRBGreq > OE12results/OSF_2464_OE12/DRBG800 90/req/CTR_DRBGreq pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/HMAC_DRBGreq > OE12results/OSF_2464_OE12/DRBG800 90/req/HMAC_DRBGreq pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/Dual_EC_DRBGreq > pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/req/siggenpss_186 2req > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/req/SigGenPSS_186 2req pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/resp/siggenpss_186 2rsp > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/resp/SigGenPSS_186 2rsp pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/resp/sigverpss_186 2rsp > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/resp/SigVerPSS_186 2rsp 518 files pulled 0 files skipped 2172 KB/s ( bytes in 69179s) $ The resulting directory TVresults can then be zipped/tarred and exported for analysis $ tar cf TVresults gzip c > TVresultstargz $ scp TVresultstargz somename@someost:/somedir 12 of 12