OpenSSL Software Foundation, Inc.

Transcription

1 OpenSSL Software Foundation, Inc 1829 Mount Ephraim Road Adamstown, MD USA Instructions for CMVP Testing FreeBSD 92 on x86 June 24, 2014 Table of Contents 1 Overview1 2 Inventory1 21 Hardware 1 22 Software2 3 Preparation2 4 Compilation and Testing3 41 Compilation on Target System3 43 Testing on Target Device4 1 Overview Platform testing instructions for the OpenSSL FIPS Object Module v20 validation This target device is a single rack mount server with an x86 processor running FreeBSD 92 generic hardware (no picture) 2 Inventory 21 Hardware Hardware supplied by OSF: Generic x86 based "Lintel" system (target device): Dell PowerEdge R320 (VSI00280) Hardware supplied by test lab: N/A 1 of 5

2 22 Software Software supplied by OSF: Instructions for CMVP Testing Linux x86 no AES NI (all software should be installed in the same directory on Linux host system as described in the following section): the file openssl fips 207targz from 20/source/ When all downloads are complete the TOP directory should contain the following files (as shown by the "ls l" command): openssl fips 207targz Software supplied by the test lab: The targz or zip file(s) containing a set of test vector request files 3 Preparation OSF preparation: Create /mnt/osf/ subdirectory on each OS image NFS mount the workareas: mkdir /mnt/osf mount :/opt/share/osf /mnt/osf pkg install perl5 The build system is testhub1, using the workarea: /mnt/share/top freebsd 92/ 2 of 5

3 4 Compilation and Testing All commands as typed on a client system used for remote access are bolded Commands as executed on the target device are bolded in blue You will be able to cut and paste from this document (fortunately, as some of these commands are fairly complex) We could script these commands more heavily but thought you might prefer to have full visibility For each set of commands in green, choose only one of the commands For remote access via the OSF testhub server: ssh fipstest@testhub1opensslfoundationcom Last login: Thu Dec 15 15:02: from fipstest@testhub1:~ cd /mnt/share/top freebsd 92 fipstest@testhub1:/mnt/share/top freebsd 92 From this point on the shell prompt "fipstest@testhub1:/mnt/share/top freebsd 92" is abbreviated as "" 41 Compilation on Target System Log onto the target system to perform the native build: ssh Password for default@freebsd92: fipstest Last login: Thu Jun 19 12:02: from FreeBSD 92 RELEASE (GENERIC) #0 r255898: Thu Sep 26 22:50:31 UTC 2013 Edit /etc/motd to change this login announcement cd /mnt/top freebsd 92 rm rf openssl fips 207 gunzip c openssl fips 207targz tar xf cd openssl fips 207 Compilation from source is only done once as the same binary executable is used for testing with and without AES NI Create the test suite program executable: 3 of 5

4 gcc version gcc (GCC) patched [FreeBSD] Copyright (C) 2007 Free Software Foundation, Inc This is free software; see the source for copying conditions There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE /config (lots of output) This is the OpenSSL FIPS 20 module make (lots of output) make build_algvs (several lines of output) cd file openssl fips 207/test/fips_algvs openssl fips 207/test/fips_algvs: ELF 64 bit LSB executable, x86 64, version 1 (FreeBSD), dynamically linked (uses shared libs), for FreeBSD 92, not stripped 43 Testing on Target Device The test suite program has now been generated Note the same binary can be used for both the "with" and "without" AES NI test cases on the x86 processor uname a FreeBSD freebsd92 92 RELEASE FreeBSD 92 RELEASE #0 r255898: Thu Sep 26 22:50:31 UTC 2013 root@bakeiscfreebsdorg:/usr/obj/usr/src/sys/generic amd64 sysctl a egrep i 'hwmachine hwmodel hwncpu' hwmachine: amd64 hwmodel: Intel(R) Xeon(R) CPU E5 2430L 200GHz hwncpu: 12 hwmachine_arch: amd64 setenv x86 aesnish (x86 with AES NI) setenv x86 no aesnish (x86 without AES NI) openssl fips 207/test/fips_algvs fips_test_suite FIPS mode test application FIPS 205 validated module 10 Apr 2013 DRBG AES 256 CTR DF test started 4 of 5

5 DRBG AES 256 CTR DF test OK 1 Non Approved cryptographic operation test ECDSA key generation failed as expected Induced failure test completed with 0 errors successful as expected All tests completed with 0 errors exit logout Connection to closed The fips_test_suite program can be invoked with different command line options for the various demonstrations such as KAT corruption 5 of 5