OpenSSL Software Foundation, Inc.

Transcription

1 OpenSSL Software Foundation, Inc 1829 Mount Ephraim Road Adamstown, MD USA Instructions for CMVP Testing Android 41 on ARMv7 with NEON December 5, /platforms/android xm/testinginstructions android xm 41pdf Table of Contents 1 Overview1 2 Inventory2 21 Hardware 2 22 Software2 3 Preparation3 31 Setup3 32 Preparing the Test Environment4 33 Access to Device4 4 Testing6 41 Device Information6 42 Cross Compilation6 43 Test Suite Execution7 44 Corruption Tests8 5 Processing Test Vectors9 1 Overview Platform testing instructions for the OpenSSL FIPS Object Module v20 validation This target device is the BeagleBoard xm evaluation board This device features the DM3730CBP 1GHz ARMv7 processor which is NEON capable, running Android 40 Detailed technical specifications for this device, including the FCC Part 15 statement, are 1 of 11

2 Instructions for CMVP Testing Android 41 on ARMv7 with NEON given in the document at USB device id is Inventory 21 Hardware Hardware supplied by OSF: Special Computing Beagleboard xm device (OSF00005) Power supply Micro SD card containing an Android 41 O/S image (installed in usd port) (OSF00118) Hardware supplied by test facility: N/A 22 Software Software supplied by OSF: (all software should be installed in the same directory on Linux host system as described in the following section): the file openssl fips ecp 202targz from 20/source/ the file mkrespdirpl from 20/testvectors/ the file setenv android ecp 41sh from 20/platforms/android/ When all downloads are complete the TOP directory should contain the following files (as shown by the "ls l" command): 2 of 11

3 Instructions for CMVP Testing Android 41 on ARMv7 with NEON openssl fips ecp 202targz mkrespdirpl setenv android ecp 41sh Software supplied by the test lab: The targz or zip file containing a set of test vector request files Note an example of such a testvector data set can be found at 20/testvectors/tvtargz 3 Preparation 31 Setup Hardware Setup Insert the 4Gb thumb drive into one of the USB ports The microsd card should already be inserted into the usd connector used for booting Connect an Ethernet cable to the RJ45 port Connect a USB cable between the "OTG" USB port on the Beagleboard (the one mini USB jack, not one of the four regular sized USB jacks) and the host build system (testhub) Connection of a digital LCD monitor, USB keyboard, and USB mouse is optional, but if a monitor is used it should be connected and powered up before the Beagleboard is powered up Connect the power supply The Beagleboard device takes about a minute to boot Host System Setup Do $ lsusb grep Google Bus 001 Device 024: ID 18d1:9018 Google Inc $ To confirm the Beagleboard device USB connection is visible on the host system Done one time only: Log in as root and create the file /etc/udev/rulesd/51 androidrules with contents: SUBSYSTEM=="usb", SYSFS{idVendor}=="18d1", MODE="0666" Execute the following to change the user mode for the rules file: 3 of 11

4 Instructions for CMVP Testing Android 41 on ARMv7 with NEON $ chmod a+r /etc/udev/rulesd/51 androidrules $ restart udev Note the MAC address changes with each reboot 32 Preparing the Test Environment All commands are typed on the Linux host system, though some commands (those executed via adb shell ) will be remotely executed on the Android target device You will be able to cut and paste from this document (fortunately, as some of these commands are fairly complex) We could script these commands more heavily but thought you might prefer to have full visibility In this document commands entered and executed on the Linux host system are bolded Commands entered on the Linux host system but executed on the target device are shown in blue The five files identified in the Inventory section should reside in a single directory on the Linux host system; in this document we refer to this directory as TOP The filesystem should have at least 500Mb of free space (the "df h " command will show the amount of available space under the Avail column) Open a command shell on the Linux host system (use of an unprivileged account is highly recommended), anbd change the working directory to TOP Unpack the compressed files: $ bunzip2 c android ndk r8b linux x86tarbz2 tar xf $ gunzip c android sdk_r2003 linuxtgz tar xf $ gunzip c tvtargz tar xf (unpack this test lab supplied file as appropriate) (first we start the communications service) Open a separate command shell as root ("sudo su "), and change to the directory containing the files that were just unpacked Then start the background service Note this must be done with root privilege: # android sdk linux/platform tools/adb start server 33 Access to Device For remote access via the OSF testhub server: $ ssh fipstest@testhubopensslfoundationcom OSF testhub server Last login: Thu Dec 15 14:23: from fipstest@testhub:~$ cd /mnt/share/osf/top android 41 fipstest@testhub:/mnt/osf/top Android 41 4 of 11

5 Instructions for CMVP Testing Android 41 on ARMv7 with NEON (next we establish that the Linux host system can talk to the Android device) We strongly recommend that you not use the root shell for any testing The USB cable to the Android target device and the Linux host system should have been connected before the Android target device was powered up $ android sdk linux/platform tools/adb devices List of devices attached device If you see only the one line List of devices attached then the USB connection has not been initialized; try powering down the Android target device, confirming that the USB is connected at both ends, and powering it back up If more than one device is displayed, for instance: List of devices attached device f8057 device then more than one Android device is currently connected to the Linux host system In that case the specific device of interest will need to be specified with the " s <device serial>" option to subsequent android sdk linux/tools/adb invocations: android sdk linux/platform tools/adb s <subcommand> <options> For clarity the the " s <device serial>" option is not shown in the following discussion 5 of 11

6 Instructions for CMVP Testing Android 41 on ARMv7 with NEON 4 Testing This section assumes the bolded commands are being typed on the testhub server (see section 32) with a current directory of /mnt/osf/top android xm/ For remote access via the OSF testhub server: $ ssh fipstest@testhubopensslfoundationcom OSF testhub server Last login: Thu Dec 15 14:23: from fipstest@testhub:~$ cd /mnt/share/osf/top android 41 fipstest@testhub:/mnt/osf/top Android Device Information Note at this point the processor type of the Android test device can be displayed: $ android sdk linux/platform tools/adb shell should see $"prompt from a shell executing on the Android target device root@android:/ # cat /proc/cpuinfo Processor : ARMv7 Processor rev 2 (v7l) BogoMIPS : Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x3 CPU part : 0xc08 CPU revision : 2 Hardware : OMAP3 Beagle Board Revision : 0020 Serial : root@android:/ # cat /proc/version Linux version 2637 gf39966b (x @sditapps03) (gcc version 46x google (prerelease) (GCC) ) #1 Fri Aug 17 12:20:54 IST 2012 root@android:/ # getprop robuildversionrelease 411 root@android:/ # exit (return to shell on Linux host system) 42 Cross Compilation First we set the environment variables to define the target platform, and confirm the pathnames are correct: 6 of 11

7 Instructions for CMVP Testing Android 41 on ARMv7 with NEON $ setenv android ecp 41sh (note the leading dot "" followed by a space " ") $ rm rf openssl fips ecp 202 $ gunzip c openssl fips ecp 202targz tar xf $ cd openssl fips ecp 202 $ arm linux androideabi gcc version arm linux androideabi gcc (GCC) 46x google (prerelease) Copyright (C) 2011 Free Software Foundation, Inc This is free software; see the source for copying conditions There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE Next we perform the actual cross compilation to generate the binaries: $ /config should see several screens of output $ make should see lots of output $ make build_algvs should see lots of output $ cd (back to TOP directory) Copy the test suite program to the Android target device: $ android sdk linux/platform tools/adb push openssl fips ecp 202/test/fips_algvs /data/local/tmp/ 1181 KB/s ( bytes in 0438s) (exact counts may vary) $ Note that "openssl fips ecp 202/test/fips_algvs" and "/data/local/tmp/" are separate command line arguments separated by whitespace 43 Test Suite Execution At this point we can execute the fips_test_suite program on the Android target device Note that the "with NEON" and "without NEON" cases can be run using the same executable (rebuilding from source is not necessary): $ android sdk linux/platform tools/adb shell $ cd /data/local/tmp $ unset OPENSSL_armcap $ export OPENSSL_armcap=0 $ /fips_algvs fips_test_suite 7 of 11 (with NEON) (without NEON)

8 Instructions for CMVP Testing Android 41 on ARMv7 with NEON FIPS mode test application FIPS 20 rc1 unvalidated test module xx XXX xxxx DRBG AES 256 CTR DF test started DRBG AES 256 CTR DF test OK 1 Non Approved cryptographic operation test should see the typical fips_test_suite output; note it will take a long time to run; the "/test/fips_test_suite post" command will exercise the POST only and run much more quickly $ exit The fips_test_suite program can be invoked with different command line options for the various demonstrations such as KAT corruption 44 Corruption Tests Note the corruption tests are run automatically for the fips_test_suite option as invoked in Section 43 above The tests are shown in the output from that option from the point where the line 13 Induced test failure check is printed Each specific test is preceded by one of the lines Testing induced failure of XXXX Testing operation failure with XXXX and the conclusion of all the corruption tests should end with the lines Induced failure test completed with 0 errors successful as expected 8 of 11

9 Instructions for CMVP Testing Android 41 on ARMv7 with NEON 5 Processing Test Vectors A subdirectory containing all the test vector files should be present at the root of the source code workarea Create the "fipstestsh" script: $ perl openssl fips ecp 202/fips/fipsalgtestpl minimal script generate script=fipstestssh dir=tv (you may see lots of informative or non fatal warning messages depending on the content of the test vector directory) OSF_2859_OE10_ Note that the fipsalgtestpl program will automatically locate the test vector files if they are present in the current directory, and are the only such set of test vector files The dir=tv option can be used to search just the subdirectory TV for the test vector files Note for this platform the /resp/ subdirectories in the test vector directory tree must exist Use the mkrespdirpl utility to generate any missing subdirectories: $ perl mkrespdirpl TV making OE3/OSF_2464_OE3/AES/resp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox128rsp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox192rsp touching OE3/OSF_2464_OE3/AES/resp/CBCGFSbox256rsp touching OE3/OSF_2464_OE3/AES/resp/CBCKeySbox128rsp touching OE3/OSF_2464_OE3/XTS/resp/XTSGenAES128rsp touching OE3/OSF_2464_OE3/XTS/resp/XTSGenAES256rsp making OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp touching OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp/SigGenPSS_186 2rsp touching OE3/OSF_2464_OE3_Part3_RSAPSS_0salt/RSA/resp/SigVerPSS_186 2rsp $ Copy the fipstestsh program and testvectors to the Android target device: OpenSSL_SN_Platform_6zip $ android sdk linux/platform tools/adb push fipstestssh /storage/sdcard0/ 705 KB/s (30512 bytes in 0042s) (actual number may differ) $ android sdk linux/platform tools/adb push TV /storage/sdcard0/tv push: tv/osf_2464_template_part3_rsapss_0salt/rsa/req/siggenpss_186 2req > /mnt/sdcard/osf_2464_template_part3_rsapss_0salt/rsa/req/siggenpss_186 2req push: tv/osf_2464_template_part3_rsapss_0salt/rsa/req/sigverpss_186 2req > 9 of 11

10 Instructions for CMVP Testing Android 41 on ARMv7 with NEON push: OE2/OSF_2464_OE2_Part2_ECPrime/ECDSA/resp/SigVerrsp > /data/local/tmp/oe2/osf_2464_oe2_part2_ecprime/ecdsa/resp/sigverrsp push: OE2/OSF_2464_OE2_Part2_ECPrime/ECDSA/resp/PKVrsp > /data/local/tmp/oe2/osf_2464_oe2_part2_ecprime/ecdsa/resp/pkvrsp 518 files pushed 0 files skipped 958 KB/s ( bytes in 71488s) where TV is the name of the subdirectory containing the test vector files Invoke a shell on the Android target device to run the fipstestsh script At this point the /data/local/tmp/ directory on the Android target device should contain the fipstestsh program and two subdirectories: $ android sdk linux/platform tools/adb shell $ unset OPENSSL_armcap (with NEON) $ export OPENSSL_armcap=0 (without NEON) $ cd /data/local/tmp $ ls l rwxrwxrwx root root :22 fips_algvs $ cd /storage/sdcard0 $ ls l drwxrwxr x root root :26 TV rw rw rw root root :43 fipstestsh Now invoke the fipstestsh program Note this will take a long time (several hours) to complete: $ /data/local/tmp/fips_algvs Running command line: /test/fips_dssvs pqg Running command line: /test/fips_dssvs keypair Running command line: /test/fips_dssvs siggen Running command line: /test/fips_dssvs sigver Running command line: /test/fips_dssvs pqgver Running command line: /test/fips_dssvs pqg Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest encrypt Running command line: /test/fips_gcmtest xts 10 of 11

11 Instructions for CMVP Testing Android 41 on ARMv7 with NEON Running command line: /test/fips_gcmtest xts Running command line: /test/fips_ecdhvs ecdhgen Completed with 0 errors $ exit Copy the testvector directory back to the Linux host system: $ android sdk linux/platform tools/adb pull /storage/sdcard0/tv TVresults pull: building file list pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/CTR_DRBGreq > OE12results/OSF_2464_OE12/DRBG800 90/req/CTR_DRBGreq pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/HMAC_DRBGreq > OE12results/OSF_2464_OE12/DRBG800 90/req/HMAC_DRBGreq pull: /mnt/sdcard/oe12/osf_2464_oe12/drbg800 90/req/Dual_EC_DRBGreq > pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/req/siggenpss_186 2req > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/req/SigGenPSS_186 2req pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/resp/siggenpss_186 2rsp > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/resp/SigGenPSS_186 2rsp pull: /mnt/sdcard/oe12/osf_2464_oe12_part3_rsapss_0salt/rsa/resp/sigverpss_186 2rsp > OE12results/OSF_2464_OE12_Part3_RSAPSS_0salt/RSA/resp/SigVerPSS_186 2rsp 518 files pulled 0 files skipped 2172 KB/s ( bytes in 69179s) $ The resulting directory TVresults can then be zipped/tarred and exported for analysis $ tar cf TVresults gzip c > TVresultstargz $ scp TVresultstargz somename@someost:/somedir 11 of 11