Skip to content

Commit 54ffe15

Browse files
AkendoAkendo
authored
Merge pull request #16 from gardenlinux/feat/fips/slh_dsa_entropy
add 0035-FIPS-SLH-DSA-sign-entropy-indicator.patch and 0036-FIPS-SLH-DSA-keygen-seed-indicator.patch
2 parents 10c0af4 + ae36bcd commit 54ffe15

3 files changed

Lines changed: 258 additions & 0 deletions

File tree

‎upstream_patches/0035-FIPS-SLH-DSA-sign-entropy-indicator.patch‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
From c7cb2e9bbf8a833e0e8507142438ea6dcb683bbb Mon Sep 17 00:00:00 2001
2+
From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
3+
Date: Thu, 11 Jun 2026 22:41:20 +0000
4+
Subject: [PATCH] providers: add FIPS SLH-DSA signing entropy indicator
5+
6+
Mark SLH-DSA signing using OSSL_SIGNATURE_PARAM_TEST_ENTROPY (i.e.
7+
hedged sigGen with caller-supplied addrnd) as unapproved in FIPS mode
8+
unless tolerated via indicator, as section 9.2 of FIPS 205 requires
9+
the additional randomness to be obtained internally from an approved
10+
RBG and explicitly forbids passing it from outside the module.
11+
---
12+
.../fips/include/fips_indicator_params.inc | 1 +
13+
.../implementations/signature/slh_dsa_sig.c | 27 +++++++++++++++++++
14+
util/perl/OpenSSL/paramnames.pm | 2 ++
15+
3 files changed, 30 insertions(+)
16+
17+
diff --git a/providers/fips/include/fips_indicator_params.inc b/providers/fips/include/fips_indicator_params.inc
18+
index 30c73f7cb3..168dd6c968 100644
19+
--- a/providers/fips/include/fips_indicator_params.inc
20+
+++ b/providers/fips/include/fips_indicator_params.inc
21+
@@ -33,3 +33,4 @@ OSSL_FIPS_PARAM(ecdh_cofactor_check, ECDH_COFACTOR_CHECK, 1)
22+
OSSL_FIPS_PARAM(ml_kem_ikme_check, ML_KEM_IKME_CHECK, 1)
23+
OSSL_FIPS_PARAM(ml_kem_seed_check, ML_KEM_SEED_CHECK, 1)
24+
OSSL_FIPS_PARAM(ml_dsa_seed_check, ML_DSA_SEED_CHECK, 1)
25+
+OSSL_FIPS_PARAM(slh_dsa_sign_entropy_check, SLH_DSA_SIGN_ENTROPY_CHECK, 1)
26+
diff --git a/providers/implementations/signature/slh_dsa_sig.c b/providers/implementations/signature/slh_dsa_sig.c
27+
index c2ee2e6bed..5aa58f6eb8 100644
28+
--- a/providers/implementations/signature/slh_dsa_sig.c
29+
+++ b/providers/implementations/signature/slh_dsa_sig.c
30+
@@ -14,6 +14,7 @@
31+
#include "prov/implementations.h"
32+
#include "prov/providercommon.h"
33+
#include "prov/provider_ctx.h"
34+
+#include "prov/securitycheck.h"
35+
#include "prov/der_slh_dsa.h"
36+
#include "crypto/slh_dsa.h"
37+
#include "internal/sizes.h"
38+
@@ -53,6 +54,7 @@ typedef struct {
39+
/* The Algorithm Identifier of the signature algorithm */
40+
uint8_t aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
41+
size_t aid_len;
42+
+ OSSL_FIPS_IND_DECLARE
43+
} PROV_SLH_DSA_CTX;
44+
45+
static void slh_dsa_freectx(void *vctx)
46+
@@ -81,6 +83,7 @@ static void *slh_dsa_newctx(void *provctx, const char *alg, const char *propq)
47+
goto err;
48+
ctx->alg = alg;
49+
ctx->msg_encode = SLH_DSA_MESSAGE_ENCODE_PURE;
50+
+ OSSL_FIPS_IND_INIT(ctx)
51+
return ctx;
52+
err:
53+
slh_dsa_freectx(ctx);
54+
@@ -266,6 +269,16 @@ static int slh_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
55+
if (ossl_param_is_empty(params))
56+
return 1;
57+
58+
+#ifdef FIPS_MODULE
59+
+ if (!OSSL_FIPS_IND_SET_CTX_PARAM(
60+
+ pctx,
61+
+ OSSL_FIPS_IND_SETTABLE0,
62+
+ params,
63+
+ OSSL_SIGNATURE_PARAM_FIPS_SLH_DSA_ENTROPY_CHECK
64+
+ ))
65+
+ return 0;
66+
+#endif
67+
+
68+
p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_CONTEXT_STRING);
69+
if (p != NULL) {
70+
void *vp = pctx->context_string;
71+
@@ -286,6 +299,20 @@ static int slh_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
72+
pctx->add_random_len = 0;
73+
return 0;
74+
}
75+
+#ifdef FIPS_MODULE
76+
+ if (!OSSL_FIPS_IND_ON_UNAPPROVED(
77+
+ pctx,
78+
+ OSSL_FIPS_IND_SETTABLE0,
79+
+ pctx->libctx,
80+
+ "SLH-DSA",
81+
+ "Explicit signing entropy",
82+
+ ossl_fips_config_slh_dsa_sign_entropy_check
83+
+ )) {
84+
+ OPENSSL_cleanse(pctx->add_random, pctx->add_random_len);
85+
+ pctx->add_random_len = 0;
86+
+ return 0;
87+
+ }
88+
+#endif
89+
}
90+
p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DETERMINISTIC);
91+
if (p != NULL && !OSSL_PARAM_get_int(p, &pctx->deterministic))
92+
diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm
93+
index f782d55209..9f0d2009d7 100644
94+
--- a/util/perl/OpenSSL/paramnames.pm
95+
+++ b/util/perl/OpenSSL/paramnames.pm
96+
@@ -65,6 +65,7 @@ my %params = (
97+
'PROV_PARAM_ML_KEM_IKME_CHECK' => "ml-kem-ikme-check", # uint
98+
'PROV_PARAM_ML_KEM_SEED_CHECK' => "ml-kem-seed-check", # uint
99+
'PROV_PARAM_ML_DSA_SEED_CHECK' => "ml-dsa-seed-check", # uint
100+
+ 'PROV_PARAM_SLH_DSA_SIGN_ENTROPY_CHECK' => "slh-dsa-sign-entropy-check", # uint
101+
102+
# Self test callback parameters
103+
'PROV_PARAM_SELF_TEST_PHASE' => "st-phase",# utf8_string
104+
@@ -492,6 +493,7 @@ my %params = (
105+
'SIGNATURE_PARAM_FIPS_VERIFY_CHECK' => 'verify-check',
106+
'SIGNATURE_PARAM_FIPS_RSA_PSS_SALTLEN_CHECK' => "rsa-pss-saltlen-check",
107+
'SIGNATURE_PARAM_FIPS_SIGN_X931_PAD_CHECK' => "sign-x931-pad-check",
108+
+ 'SIGNATURE_PARAM_FIPS_SLH_DSA_ENTROPY_CHECK' => '*PROV_PARAM_SLH_DSA_SIGN_ENTROPY_CHECK',
109+
'SIGNATURE_PARAM_FIPS_APPROVED_INDICATOR' => '*ALG_PARAM_FIPS_APPROVED_INDICATOR',
110+
'SIGNATURE_PARAM_SIGNATURE' => "signature",
111+
'SIGNATURE_PARAM_MESSAGE_ENCODING' => "message-encoding",
112+
--
113+
2.47.3
114+

‎upstream_patches/0036-FIPS-SLH-DSA-keygen-seed-indicator.patch‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
From c88b5029780cb2e4354dbd276e3d3fa02e33e4a4 Mon Sep 17 00:00:00 2001
2+
From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
3+
Date: Thu, 11 Jun 2026 23:00:27 +0000
4+
Subject: [PATCH] providers: add FIPS SLH-DSA keygen seed indicator
5+
6+
Mark SLH-DSA key pair generation using OSSL_PKEY_PARAM_SLH_DSA_SEED
7+
(caller-provided entropy) as unapproved in FIPS mode unless tolerated
8+
via indicator. Section 3.1 of FIPS 205 requires the SK.seed, SK.prf
9+
and PK.seed values to be retrieved from an approved RBG inside the
10+
module and explicitly forbids passing them in from outside.
11+
12+
Wire the corresponding KAT to opt out of strict mode so the
13+
deterministic SLH-DSA keygen self-test still passes.
14+
---
15+
.../fips/include/fips_indicator_params.inc | 1 +
16+
providers/fips/self_test_kats.c | 6 +++++
17+
.../implementations/keymgmt/slh_dsa_kmgmt.c | 27 +++++++++++++++++++
18+
util/perl/OpenSSL/paramnames.pm | 2 ++
19+
4 files changed, 36 insertions(+)
20+
21+
diff --git a/providers/fips/include/fips_indicator_params.inc b/providers/fips/include/fips_indicator_params.inc
22+
index 168dd6c968..de0e372548 100644
23+
--- a/providers/fips/include/fips_indicator_params.inc
24+
+++ b/providers/fips/include/fips_indicator_params.inc
25+
@@ -34,3 +34,4 @@ OSSL_FIPS_PARAM(ml_kem_ikme_check, ML_KEM_IKME_CHECK, 1)
26+
OSSL_FIPS_PARAM(ml_kem_seed_check, ML_KEM_SEED_CHECK, 1)
27+
OSSL_FIPS_PARAM(ml_dsa_seed_check, ML_DSA_SEED_CHECK, 1)
28+
OSSL_FIPS_PARAM(slh_dsa_sign_entropy_check, SLH_DSA_SIGN_ENTROPY_CHECK, 1)
29+
+OSSL_FIPS_PARAM(slh_dsa_seed_check, SLH_DSA_SEED_CHECK, 1)
30+
diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c
31+
index f856c7ffab..e17cd2cd8e 100644
32+
--- a/providers/fips/self_test_kats.c
33+
+++ b/providers/fips/self_test_kats.c
34+
@@ -644,6 +644,10 @@ static int self_test_asym_keygen(const ST_KAT_ASYM_KEYGEN *t, OSSL_SELF_TEST *st
35+
ST_KAT_PARAM_INT(OSSL_PKEY_PARAM_FIPS_ML_DSA_SEED_CHECK, seed_check),
36+
ST_KAT_PARAM_END()
37+
};
38+
+ const ST_KAT_PARAM slh_dsa_keygen_fips_params[] = {
39+
+ ST_KAT_PARAM_INT(OSSL_PKEY_PARAM_FIPS_SLH_DSA_SEED_CHECK, seed_check),
40+
+ ST_KAT_PARAM_END()
41+
+ };
42+
43+
OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_ASYM_KEYGEN, t->desc);
44+
45+
@@ -655,6 +659,8 @@ static int self_test_asym_keygen(const ST_KAT_ASYM_KEYGEN *t, OSSL_SELF_TEST *st
46+
extra_keygen_params = ml_kem_keygen_fips_params;
47+
else if (strncmp(t->algorithm, "ML-DSA-", 7) == 0)
48+
extra_keygen_params = ml_dsa_keygen_fips_params;
49+
+ else if (strncmp(t->algorithm, "SLH-DSA-", 8) == 0)
50+
+ extra_keygen_params = slh_dsa_keygen_fips_params;
51+
key_params = kat_params_to_ossl_params(libctx, t->keygen_params,
52+
extra_keygen_params, NULL);
53+
if (key_params == NULL)
54+
diff --git a/providers/implementations/keymgmt/slh_dsa_kmgmt.c b/providers/implementations/keymgmt/slh_dsa_kmgmt.c
55+
index 8a67621390..88963e5c4d 100644
56+
--- a/providers/implementations/keymgmt/slh_dsa_kmgmt.c
57+
+++ b/providers/implementations/keymgmt/slh_dsa_kmgmt.c
58+
@@ -18,6 +18,7 @@
59+
#include "prov/implementations.h"
60+
#include "prov/providercommon.h"
61+
#include "prov/provider_ctx.h"
62+
+#include "prov/securitycheck.h"
63+
64+
#ifdef FIPS_MODULE
65+
static int slh_dsa_fips140_pairwise_test(const SLH_DSA_KEY *key,
66+
@@ -49,6 +50,7 @@ struct slh_dsa_gen_ctx {
67+
char *propq;
68+
uint8_t entropy[SLH_DSA_MAX_N * 3];
69+
size_t entropy_len;
70+
+ OSSL_FIPS_IND_DECLARE
71+
};
72+
73+
static void *slh_dsa_new_key(void *provctx, const char *alg)
74+
@@ -275,6 +277,7 @@ static void *slh_dsa_gen_init(void *provctx, int selection,
75+
76+
if ((gctx = OPENSSL_zalloc(sizeof(*gctx))) != NULL) {
77+
gctx->libctx = libctx;
78+
+ OSSL_FIPS_IND_INIT(gctx)
79+
if (!slh_dsa_gen_set_params(gctx, params)) {
80+
OPENSSL_free(gctx);
81+
gctx = NULL;
82+
@@ -387,6 +390,16 @@ static int slh_dsa_gen_set_params(void *genctx, const OSSL_PARAM params[])
83+
if (gctx == NULL)
84+
return 0;
85+
86+
+#ifdef FIPS_MODULE
87+
+ if (!OSSL_FIPS_IND_SET_CTX_PARAM(
88+
+ gctx,
89+
+ OSSL_FIPS_IND_SETTABLE0,
90+
+ params,
91+
+ OSSL_PKEY_PARAM_FIPS_SLH_DSA_SEED_CHECK
92+
+ ))
93+
+ return 0;
94+
+#endif
95+
+
96+
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_SLH_DSA_SEED);
97+
if (p != NULL) {
98+
void *vp = gctx->entropy;
99+
@@ -396,6 +409,20 @@ static int slh_dsa_gen_set_params(void *genctx, const OSSL_PARAM params[])
100+
gctx->entropy_len = 0;
101+
return 0;
102+
}
103+
+#ifdef FIPS_MODULE
104+
+ if (!OSSL_FIPS_IND_ON_UNAPPROVED(
105+
+ gctx,
106+
+ OSSL_FIPS_IND_SETTABLE0,
107+
+ gctx->libctx,
108+
+ "SLH-DSA",
109+
+ "Explicit key generation seed",
110+
+ ossl_fips_config_slh_dsa_seed_check
111+
+ )) {
112+
+ OPENSSL_cleanse(gctx->entropy, gctx->entropy_len);
113+
+ gctx->entropy_len = 0;
114+
+ return 0;
115+
+ }
116+
+#endif
117+
}
118+
119+
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PROPERTIES);
120+
diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm
121+
index 9f0d2009d7..240b29cba3 100644
122+
--- a/util/perl/OpenSSL/paramnames.pm
123+
+++ b/util/perl/OpenSSL/paramnames.pm
124+
@@ -66,6 +66,7 @@ my %params = (
125+
'PROV_PARAM_ML_KEM_SEED_CHECK' => "ml-kem-seed-check", # uint
126+
'PROV_PARAM_ML_DSA_SEED_CHECK' => "ml-dsa-seed-check", # uint
127+
'PROV_PARAM_SLH_DSA_SIGN_ENTROPY_CHECK' => "slh-dsa-sign-entropy-check", # uint
128+
+ 'PROV_PARAM_SLH_DSA_SEED_CHECK' => "slh-dsa-seed-check", # uint
129+
130+
# Self test callback parameters
131+
'PROV_PARAM_SELF_TEST_PHASE' => "st-phase",# utf8_string
132+
@@ -458,6 +459,7 @@ my %params = (
133+
134+
# SLH_DSA Key generation parameters
135+
'PKEY_PARAM_SLH_DSA_SEED' => "seed",
136+
+ 'PKEY_PARAM_FIPS_SLH_DSA_SEED_CHECK' => '*PROV_PARAM_SLH_DSA_SEED_CHECK',
137+
138+
# Key Exchange parameters
139+
'EXCHANGE_PARAM_PAD' => "pad",# uint
140+
--
141+
2.47.3
142+

‎upstream_patches/series‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,5 @@ rsa_kem-test-RSA_public_encrypt-result-in-RSASVE.patch
3535
0032-FIPS-RSA-no-padding-encrypt-indicator.patch
3636
0033-FIPS-RSA-pkcs1-primitive-indicators.patch
3737
0034-FIPS-ECDSA-verify-indicator.patch
38+
0035-FIPS-SLH-DSA-sign-entropy-indicator.patch
39+
0036-FIPS-SLH-DSA-keygen-seed-indicator.patch

0 commit comments

Comments
 (0)