Merge pull request #260 from gardenlinux/feature/FIPS-PCT-for-ECDH

Feature/fips pct for ecdh

Author: Akendo

upstream_patches/0003-implement-FIPS-PCT-for-ECDH.patch

@@ -0,0 +1,67 @@
+diff -urN b/crypto/ecdh.c a/crypto/ecdh.c
+--- b/crypto/ecdh.c	2026-02-27 14:37:11
++++ a/crypto/ecdh.c	2026-03-02 14:19:40
+@@ -4,7 +4,7 @@
+  * Copyright (c) 2016, Intel Corporation
+  * Authors: Salvator Benedetto <[email protected]>
+  */
+-
++#include <linux/fips.h>
+ #include <linux/module.h>
+ #include <crypto/internal/ecc.h>
+ #include <crypto/internal/kpp.h>
+@@ -57,6 +57,7 @@
+ 	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
+ 	struct ecdh_ctx *ctx = ecdh_get_ctx(tfm);
+ 	u64 *public_key;
++	u64 *val_pct = NULL;
+ 	u64 *shared_secret = NULL;
+ 	void *buf;
+ 	size_t copied, nbytes, public_key_sz;
+@@ -104,6 +105,33 @@
+ 	if (ret < 0)
+ 		goto free_all;
+ 
++	if (fips_enabled) {
++		if (!req->src) {
++			/*
++			 * SP800-56Arev3, 5.6.2.1.4: ("Owner Assurance
++			 * of Pair-wise Consistency"): recompute the
++			 * public key and check if the results match.
++			 */
++			val_pct = kmalloc(public_key_sz, GFP_KERNEL);
++			if (!val_pct) {
++				ret = -ENOMEM;
++				goto free_all;
++			}
++			
++			ret = ecc_make_pub_key(ctx->curve_id, ctx->ndigits,
++				       ctx->private_key, val_pct);
++			
++			if (ret < 0) {
++				goto free_all;
++			}
++			
++			if (crypto_memneq(public_key, val_pct, public_key_sz)) {
++				fips_fail_notify();
++				panic("ecdh: pair-wise consistency test failed\n");
++			}
++		}
++	}
++
+ 	/* might want less than we've got */
+ 	nbytes = min_t(size_t, nbytes, req->dst_len);
+ 	copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst,
+@@ -115,9 +143,10 @@
+ 	/* fall through */
+ free_all:
+ 	kfree_sensitive(shared_secret);
++	kfree(val_pct);
+ free_pubkey:
+ 	kfree(public_key);
+-	return ret;
++	return ret;	
+ }
+ 
+ static unsigned int ecdh_max_size(struct crypto_kpp *tfm)
+

upstream_patches/series

@@ -1,3 +1,4 @@
 0001-disable-sha1-for-fips.patch
 0002-implement-FIPS-PCT-for-DH.patch
+0003-implement-FIPS-PCT-for-ECDH.patch
 0004-flag-instantiations-as-FIPS_compliant.patch