WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

add FIPS 140-3 compatibility

pull/22/head
Chris Conlon 2021-11-12 17:08:07 -07:00
parent b413342be5
commit e11bc558a2
11 changed files with 282 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
jni/include/com_wolfssl_wolfcrypt_Fips.h
View File

@ -7,6 +7,8 @@
#ifdef __cplusplus
extern "C" {
#endif
#undef com_wolfssl_wolfcrypt_Fips_WC_KEYTYPE_ALL
#define com_wolfssl_wolfcrypt_Fips_WC_KEYTYPE_ALL 0L
/*
* Class: com_wolfssl_wolfcrypt_Fips
* Method: wolfCrypt_SetCb_fips
@ -31,6 +33,22 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_wolfcrypt_Fips_wolfCrypt_1GetCoreHash
JNIEXPORT jboolean JNICALL Java_com_wolfssl_wolfcrypt_Fips_enabled
(JNIEnv *, jclass);
/*
* Class: com_wolfssl_wolfcrypt_Fips
* Method: setPrivateKeyReadEnable
* Signature: (II)I
*/
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_setPrivateKeyReadEnable
(JNIEnv *, jclass, jint, jint);
/*
* Class: com_wolfssl_wolfcrypt_Fips
* Method: getPrivateKeyReadEnable
* Signature: (I)I
*/
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_getPrivateKeyReadEnable
(JNIEnv *, jclass, jint);
/*
* Class: com_wolfssl_wolfcrypt_Fips
* Method: getFipsVersion

21
jni/include/com_wolfssl_wolfcrypt_WolfObject.h 100644
View File

@ -0,0 +1,21 @@
/* DO NOT EDIT THIS FILE - it is machine generated */
#include <jni.h>
/* Header for class com_wolfssl_wolfcrypt_WolfObject */
#ifndef _Included_com_wolfssl_wolfcrypt_WolfObject
#define _Included_com_wolfssl_wolfcrypt_WolfObject
#ifdef __cplusplus
extern "C" {
#endif
/*
* Class: com_wolfssl_wolfcrypt_WolfObject
* Method: init
* Signature: ()I
*/
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfObject_init
(JNIEnv *, jclass);
#ifdef __cplusplus
}
#endif
#endif

50
jni/jni_fips.c
View File

@ -122,6 +122,52 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_wolfcrypt_Fips_enabled
#endif
}
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_setPrivateKeyReadEnable
(JNIEnv* jenv, jclass jcl, jint enable, jint keyType)
{
int ret = 0;
#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)
enum wc_KeyType type;
switch (keyType) {
case 0:
type = WC_KEYTYPE_ALL;
break;
default:
printf("Invalid key type enum");
ret = -1;
break;
}
if (ret == 0) {
ret = wolfCrypt_SetPrivateKeyReadEnable_fips(enable, type);
}
#endif
return ret;
}
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_getPrivateKeyReadEnable
(JNIEnv* jenv, jclass jcl, jint keyType)
{
int ret = 0;
#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)
enum wc_KeyType type;
switch (keyType) {
case 0:
type = WC_KEYTYPE_ALL;
break;
default:
printf("Invalid key type enum");
ret = -1;
break;
}
if (ret == 0) {
ret = wolfCrypt_GetPrivateKeyReadEnable_fips(type);
}
#endif
return ret;
}
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_getFipsVersion
(JNIEnv* env, jclass this)
{
@ -1194,8 +1240,6 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_HmacFinal_1fips__Lcom_wol
ret = HmacFinal_fips(hmac, hash);
LogStr("HmacFinal_fips(hmac=%p, hash) = %d\n", hmac, ret);
LogStr("hash[%u]: [%p]\n", (word32)MD5_DIGEST_SIZE, hash);
LogHex(hash, 0, MD5_DIGEST_SIZE);
#endif
@ -1224,8 +1268,6 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_Fips_HmacFinal_1fips__Lcom_wol
: HmacFinal_fips(hmac, hash);
LogStr("HmacFinal_fips(hmac=%p, hash) = %d\n", hmac, ret);
LogStr("hash[%u]: [%p]\n", (word32)MD5_DIGEST_SIZE, hash);
LogHex(hash, 0, MD5_DIGEST_SIZE);
releaseByteArray(env, hash_buffer, hash, ret);

146
jni/jni_wolfobject.c 100644
View File

@ -0,0 +1,146 @@
/* jni_wolfobject.c
*
* Copyright (C) 2006-2020 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
#ifndef __ANDROID__
#include <wolfssl/options.h>
#endif
#include <jni.h>
#include <wolfcrypt_jni_debug.h>
#include <wolfssl/wolfcrypt/wc_port.h>
#ifdef WC_RNG_SEED_CB
#include <wolfssl/wolfcrypt/random.h>
#endif
#ifdef HAVE_FIPS
#include <wolfssl/wolfcrypt/fips_test.h>
#endif
JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfObject_init
(JNIEnv* jenv, jclass jcl)
{
(void)jenv;
(void)jcl;
int ret = 0;
#ifdef WC_RNG_SEED_CB
ret = wc_SetSeed_Cb(wc_GenerateSeed);
if (ret != 0) {
printf("wc_SetSeed_Cb() failed");
}
#endif
#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 5)
/* run FIPS 140-3 conditional algorithm self tests early to prevent
* multi threaded issues later on */
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_AES_CBC);
if (ret != 0) {
printf("AES-CBC CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_AES_GCM);
if (ret != 0) {
printf("AES-GCM CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_HMAC_SHA1);
if (ret != 0) {
printf("HMAC-SHA1 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_HMAC_SHA2_256);
if (ret != 0) {
printf("HMAC-SHA2-256 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_HMAC_SHA2_512);
if (ret != 0) {
printf("HMAC-SHA2-512 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_HMAC_SHA3_256);
if (ret != 0) {
printf("HMAC-SHA3-256 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_DRBG);
if (ret != 0) {
printf("Hash_DRBG CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_RSA_SIGN_PKCS1v15);
if (ret != 0) {
printf("RSA sign CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_ECC_PRIMITIVE_Z);
if (ret != 0) {
printf("ECC Primitive Z CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_DH_PRIMITIVE_Z);
if (ret != 0) {
printf("DH Primitive Z CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_ECDSA);
if (ret != 0) {
printf("ECDSA CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_KDF_TLS12);
if (ret != 0) {
printf("KDF TLSv1.2 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_KDF_TLS13);
if (ret != 0) {
printf("KDF TLSv1.3 CAST failed");
}
}
if (ret == 0) {
ret = wc_RunCast_fips(FIPS_CAST_KDF_SSH);
if (ret != 0) {
printf("KDF SSHv2.0 CAST failed");
}
}
#endif
if (ret < 0) {
return ret;
}
return (jint)wolfCrypt_Init();
}

2
makefile
View File

@ -5,7 +5,7 @@ INC_PATH = $(SRC_PATH)/include
OBJ_LIST = jni_fips.o jni_native_struct.o jni_aes.o jni_des3.o jni_md5.o \
jni_sha.o jni_hmac.o jni_rng.o jni_rsa.o jni_dh.o jni_ecc.o \
jni_ed25519.o jni_curve25519.o jni_chacha.o jni_error.o jni_asn.o \
jni_logging.o jni_feature_detect.o
jni_logging.o jni_feature_detect.o jni_wolfobject.o
OBJS = $(patsubst %,$(OUT_PATH)/%,$(OBJ_LIST))
TARGET = $(OUT_PATH)/libwolfcryptjni.jnilib

2
makefile.linux
View File

@ -5,7 +5,7 @@ INC_PATH = $(SRC_PATH)/include
OBJ_LIST = jni_fips.o jni_native_struct.o jni_aes.o jni_des3.o jni_md5.o \
jni_sha.o jni_hmac.o jni_rng.o jni_rsa.o jni_dh.o jni_ecc.o \
jni_ed25519.o jni_curve25519.o jni_chacha.o jni_error.o jni_asn.o \
jni_logging.o jni_feature_detect.o
jni_logging.o jni_feature_detect.o jni_wolfobject.o
OBJS = $(patsubst %,$(OUT_PATH)/%,$(OBJ_LIST))
TARGET = $(OUT_PATH)/libwolfcryptjni.so

2
makefile.macosx
View File

@ -5,7 +5,7 @@ INC_PATH = $(SRC_PATH)/include
OBJ_LIST = jni_fips.o jni_native_struct.o jni_aes.o jni_des3.o jni_md5.o \
jni_sha.o jni_hmac.o jni_rng.o jni_rsa.o jni_dh.o jni_ecc.o \
jni_ed25519.o jni_curve25519.o jni_chacha.o jni_error.o jni_asn.o \
jni_logging.o jni_feature_detect.o
jni_logging.o jni_feature_detect.o jni_wolfobject.o
OBJS = $(patsubst %,$(OUT_PATH)/%,$(OBJ_LIST))
TARGET = $(OUT_PATH)/libwolfcryptjni.jnilib

7
src/main/java/com/wolfssl/provider/jce/WolfCryptProvider.java
View File

@ -23,6 +23,7 @@ package com.wolfssl.provider.jce;
import java.security.Provider;
import com.wolfssl.wolfcrypt.FeatureDetect;
import com.wolfssl.wolfcrypt.Fips;
/**
* wolfCrypt JCE Provider implementation
@ -138,6 +139,12 @@ public final class WolfCryptProvider extends Provider {
put("KeyPairGenerator.DH",
"com.wolfssl.provider.jce.WolfCryptKeyPairGenerator$wcKeyPairGenDH");
put("Alg.Alias.KeyPairGenerator.DiffieHellman", "DH");
/* If using a FIPS version of wolfCrypt, allow private key to be
* exported for use. Only applicable to FIPS 140-3 */
if (Fips.enabled) {
Fips.setPrivateKeyReadEnable(1, Fips.WC_KEYTYPE_ALL);
}
}
}

27
src/main/java/com/wolfssl/wolfcrypt/Fips.java
View File

@ -67,10 +67,35 @@ public class Fips extends WolfObject {
*/
private static native boolean enabled();
/* Needs to match native WC_KEYTYPE_ALL in fips.h.
* Used with Fips.get/setPrivateKeyReadEnable() */
public static final int WC_KEYTYPE_ALL = 0;
/**
* Enable reading/export of private key from wolfCrypt FIPS module.
*
* @param enable enable/disable ability to read private keys from module
* @param keyType type of key to enable/disable. Currently only supports
* Fips.WC_KEYTYPE_ALL
* @return 0 on success, negative on error
*/
public static native int setPrivateKeyReadEnable(int enable, int keyType);
/**
* Get enable status for ability of application to read/export private key
* material from wolfCrypt FIPS library.
*
* @param keyType type of key to poll enable/disable status for. Currently
* the only keyType supported is Fips.WC_KEYTYPE_ALL
*
* @return 1 if able to read private key material, otherwise 0
*/
public static native int getPrivateKeyReadEnable(int keyType);
private static native int getFipsVersion();
/*
* ### FIPS Aprooved Security Methods ######################################
* ### FIPS Approved Security Methods ######################################
*/
/*

15
src/main/java/com/wolfssl/wolfcrypt/WolfObject.java
View File

@ -30,11 +30,16 @@ package com.wolfssl.wolfcrypt;
*/
public class WolfObject {
static {
System.loadLibrary("wolfcryptjni");
}
private static native int init();
protected WolfObject() {
}
static {
System.loadLibrary("wolfcryptjni");
/* initialize native wolfCrypt library */
init();
}
protected WolfObject() {
}
}

5
src/test/java/com/wolfssl/wolfcrypt/test/DhTest.java
View File

@ -31,6 +31,7 @@ import com.wolfssl.wolfcrypt.Dh;
import com.wolfssl.wolfcrypt.Rng;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.WolfCryptException;
import com.wolfssl.wolfcrypt.Fips;
public class DhTest {
private static Rng rng = new Rng();
@ -38,6 +39,10 @@ public class DhTest {
@BeforeClass
public static void setUpRng() {
rng.init();
if (Fips.enabled) {
Fips.setPrivateKeyReadEnable(1, Fips.WC_KEYTYPE_ALL);
}
}
@BeforeClass