diff options
| author | Adam Langley <agl@imperialviolet.org> | 2024-05-19 23:41:16 +0000 |
|---|---|---|
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | 2024-05-20 19:35:02 +0000 |
| commit | c798e3a54912a1bfbf1c846630e2bb86e9b543a7 (patch) | |
| tree | d222852e9e1ffa8b90f0b9834f1b7ca3a4c76e75 /util | |
| parent | ba62c812f01fb379f49f94a08a2d1282ce46e678 (diff) | |
| download | boringssl-c798e3a54912a1bfbf1c846630e2bb86e9b543a7.zip boringssl-c798e3a54912a1bfbf1c846630e2bb86e9b543a7.tar.gz boringssl-c798e3a54912a1bfbf1c846630e2bb86e9b543a7.tar.bz2 | |
Expose the FIPS module hash at build- and run-time.
In order to provide evidence that a given build is being used when
testing the module (as part of validation), this change prints the
module hash during the build process and makes it available for logging
at run time.
Change-Id: Ib128858cc429655e86444ee86dd04f1467abc735
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/68528
Reviewed-by: David Benjamin <davidben@google.com>
Auto-Submit: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Diffstat (limited to 'util')
| -rw-r--r-- | util/fipstools/inject_hash/inject_hash.go | 3 | ||||
| -rw-r--r-- | util/fipstools/test_fips.c | 9 |
2 files changed, 11 insertions, 1 deletions
diff --git a/util/fipstools/inject_hash/inject_hash.go b/util/fipstools/inject_hash/inject_hash.go index 9c30836..ffae5e9 100644 --- a/util/fipstools/inject_hash/inject_hash.go +++ b/util/fipstools/inject_hash/inject_hash.go @@ -242,6 +242,9 @@ func do(outPath, oInput string, arInput string) error { return errors.New("found two occurrences of uninitialised hash value in object file") } + if _, exists := os.LookupEnv("BORINGSSL_FIPS_SHOW_HASH"); exists { + fmt.Printf("Module hash: %x\n", calculated) + } copy(objectBytes[offset:], calculated) return os.WriteFile(outPath, objectBytes, perm&0777) diff --git a/util/fipstools/test_fips.c b/util/fipstools/test_fips.c index bd0ec46..af01bfc 100644 --- a/util/fipstools/test_fips.c +++ b/util/fipstools/test_fips.c @@ -55,9 +55,16 @@ int main(int argc, char **argv) { printf("No module version set\n"); goto err; } - printf("Module: '%s', version: %" PRIu32 "\n", FIPS_module_name(), + printf("Module: '%s', version: %" PRIu32 " hash:\n", FIPS_module_name(), module_version); +#if !defined(OPENSSL_ASAN) + hexdump(FIPS_module_hash(), SHA256_DIGEST_LENGTH); +#else + printf("(not available when compiled for ASAN)"); +#endif + printf("\n"); + static const uint8_t kAESKey[16] = "BoringCrypto Key"; static const uint8_t kPlaintext[64] = "BoringCryptoModule FIPS KAT Encryption and Decryption Plaintext!"; |