aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/endian_test.cc

@@ -0,0 +1,308 @@
+#include <gtest/gtest.h>
+#include "internal.h"
+#include "openssl/aes.h"
+#include "openssl/bn.h"
+#include "test/test_util.h"
+
+
+TEST(EndianTest, u32Operations) {
+  uint8_t buffer[4];
+  uint32_t val = 0x12345678;
+  uint8_t expected_be[4] = {0x12, 0x34, 0x56, 0x78};
+  uint8_t expected_le[4] = {0x78, 0x56, 0x34, 0x12};
+
+
+  CRYPTO_store_u32_le(buffer, val);
+  EXPECT_EQ(Bytes(expected_le), Bytes(buffer));
+  EXPECT_EQ(val, CRYPTO_load_u32_le(buffer));
+
+  CRYPTO_store_u32_be(buffer, val);
+  EXPECT_EQ(Bytes(expected_be), Bytes(buffer));
+  EXPECT_EQ(val, CRYPTO_load_u32_be(buffer));
+}
+
+TEST(EndianTest, u64Operations) {
+  uint8_t buffer[8];
+  uint64_t val = 0x123456789abcdef0;
+  uint8_t expected_be[8] = {0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0};
+  uint8_t expected_le[8] = {0xf0, 0xde, 0xbc, 0x9a, 0x78, 0x56, 0x34, 0x12};
+
+  CRYPTO_store_u64_le(buffer, val);
+  EXPECT_EQ(Bytes(expected_le), Bytes(buffer));
+  EXPECT_EQ(val, CRYPTO_load_u64_le(buffer));
+
+  CRYPTO_store_u64_be(buffer, val);
+  EXPECT_EQ(Bytes(expected_be), Bytes(buffer));
+  EXPECT_EQ(val, CRYPTO_load_u64_be(buffer));
+}
+
+TEST(EndianTest, wordOperations) {
+  uint8_t buffer[sizeof(crypto_word_t)];
+#if defined(OPENSSL_64_BIT)
+  size_t val = 0x123456789abcdef0;
+  uint8_t expected_le[8] = {0xf0, 0xde, 0xbc, 0x9a, 0x78, 0x56, 0x34, 0x12};
+#else
+size_t val = 0x12345678;
+uint8_t expected_le[4] = {0x78, 0x56, 0x34, 0x12};
+#endif
+
+  CRYPTO_store_word_le(buffer, val);
+  EXPECT_EQ(Bytes(expected_le), Bytes(buffer));
+  EXPECT_EQ(val, CRYPTO_load_word_le(buffer));
+}
+
+TEST(EndianTest, TestRotate32) {
+  uint32_t value = 0b00000010000000000000000000000;
+  uint32_t expected = 0b00100000000000000000000000000;
+
+  uint32_t rotl_by = 4;
+  uint32_t rotr_by = 32 - rotl_by;
+
+  uint32_t rotl_value = CRYPTO_rotl_u32(value, rotl_by);
+  uint32_t rotr_value = CRYPTO_rotr_u32(value, rotr_by);
+
+  ASSERT_EQ(rotl_value, rotr_value);
+  EXPECT_EQ(expected, rotl_value);
+  ASSERT_EQ(CRYPTO_rotr_u32(rotl_value, rotl_by), value);
+}
+
+TEST(EndianTest, TestRotate64) {
+  uint64_t value = 0b0000001000000000000000000000000000010000000000000000000000;
+  uint64_t expected = 0b0010000000000000000000000000000100000000000000000000000000;
+
+  uint64_t rotl_by = 4;
+  uint64_t rotr_by = 64 - rotl_by;
+
+  uint64_t rotl_value = CRYPTO_rotl_u64(value, rotl_by);
+  uint64_t rotr_value = CRYPTO_rotr_u64(value, rotr_by);
+
+  ASSERT_EQ(rotl_value, rotr_value);
+  EXPECT_EQ(expected, rotl_value);
+  ASSERT_EQ(CRYPTO_rotr_u64(rotl_value, rotl_by), value);
+}
+
+union test_union {
+  uint16_t big[2];
+  uint8_t small[4];
+};
+
+struct test_struct {
+  test_union union_val;
+};
+
+TEST(EndianTest, TestStructUnion) {
+  struct test_struct val = {{{0}}};
+  val.union_val.big[0] = 0x1234;
+  val.union_val.big[1] = 0x5678;
+
+
+#if defined(OPENSSL_BIG_ENDIAN)
+  ASSERT_EQ(val.union_val.small[0], 0x12);
+  ASSERT_EQ(val.union_val.small[1], 0x34);
+  ASSERT_EQ(val.union_val.small[2], 0x56);
+  ASSERT_EQ(val.union_val.small[3], 0x78);
+#else
+  ASSERT_EQ(val.union_val.small[0], 0x34);
+  ASSERT_EQ(val.union_val.small[1], 0x12);
+  ASSERT_EQ(val.union_val.small[2], 0x78);
+  ASSERT_EQ(val.union_val.small[3], 0x56);
+#endif
+}
+
+// Shift left is increasing value/significance
+// shift right decreases value/drops values
+TEST(EndianTest, Shifting) {
+  uint32_t test = 0b1010000000010001;
+  ASSERT_EQ(test << 4, (uint32_t)0b10100000000100010000);
+  ASSERT_EQ(test >> 4, (uint32_t)0b101000000001);
+}
+
+TEST(EndianTest, Swap) {
+  EXPECT_EQ(0x3412, CRYPTO_bswap2(0x1234));
+  EXPECT_EQ((uint32_t)0x78563412, CRYPTO_bswap4(0x12345678));
+  EXPECT_EQ(0xf0debc9a78563412, CRYPTO_bswap8(0x123456789abcdef0));
+}
+
+TEST(EndianTest, BN_bin2bn) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  input[255] = 0x02;
+  ASSERT_NE(nullptr, BN_bin2bn(input, sizeof(input), x.get()));
+  EXPECT_FALSE(BN_is_zero(x.get()));
+  for (size_t i = 1; i < (sizeof(input)*8/BN_BITS2) - 1; i++) {
+    SCOPED_TRACE(i);
+    EXPECT_EQ((uint64_t)0, x.get()->d[i]);
+  }
+  EXPECT_EQ((uint64_t)0x0102, x.get()->d[0]);
+  EXPECT_EQ((uint64_t)0xaa01 << (BN_BITS2-16), x.get()->d[(256*8/BN_BITS2)-1]);
+}
+
+TEST(EndianTest, BN_le2bn) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  input[255] = 0x02;
+  ASSERT_NE(nullptr, BN_le2bn(input, sizeof(input), x.get()));
+  EXPECT_FALSE(BN_is_zero(x.get()));
+  for (int i = 1; i < (256*8/BN_BITS2) - 1; i++) {
+    SCOPED_TRACE(i);
+    EXPECT_EQ((uint64_t)0, x.get()->d[i]);
+  }
+  EXPECT_EQ((uint64_t)0x01aa, x.get()->d[0]);
+  EXPECT_EQ((uint64_t)0x0201 << (BN_BITS2-16), x.get()->d[(256*8/BN_BITS2)-1]);
+}
+
+// This test creates a BIGNUM, where 255 bytes are significant.
+// Notice that 255 = 7 (mod 8) and 255 = 3 (mod 4), so the most significant
+// bytes do not fill an entire word in the output BIGNUM, requiring special
+// handling in the underlying logic.
+TEST(EndianTest, BN_le2bn_255) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[255];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  ASSERT_TRUE(BN_le2bn(input, sizeof(input), x.get()));
+  EXPECT_FALSE(BN_is_zero(x.get()));
+  for (size_t i = 1; i <= (255/sizeof(BN_ULONG)) - 1; i++) {
+    EXPECT_EQ((BN_ULONG)0, x.get()->d[i]);
+  }
+  EXPECT_EQ((BN_ULONG)0x01aa, x.get()->d[0]);
+  EXPECT_EQ((BN_ULONG)0x01 << (BN_BITS2-16), x.get()->d[255/sizeof(BN_ULONG)]);
+}
+
+TEST(EndianTest, BN_bn2bin) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  input[255] = 0x02;
+  ASSERT_NE(nullptr, BN_bin2bn(input, sizeof(input), x.get()));
+
+  uint8_t out[256];
+  OPENSSL_memset(out, 0, sizeof(out));
+  EXPECT_EQ((size_t)256, BN_bn2bin(x.get(), out));
+  EXPECT_EQ(Bytes(input), Bytes(out));
+}
+
+TEST(EndianTest, BN_bn2le_padded) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  input[255] = 0x02;
+  ASSERT_NE(nullptr, BN_le2bn(input, sizeof(input), x.get()));
+
+  uint8_t out[256];
+  OPENSSL_memset(out, 0, sizeof(out));
+  EXPECT_EQ(1, BN_bn2le_padded(out, sizeof(out), x.get()));
+  EXPECT_EQ(Bytes(input), Bytes(out));
+}
+
+// This test creates a BIGNUM, where 255 bytes are significant.
+// It then calls |BN_bn2le_padded| to write the number into a 255-byte array
+// in little-endian byte-order.
+// Notice that 255 = 7 (mod 8) and 255 = 3 (mod 4), so the output array does not
+// have room to hold every word of the input, requiring special handling
+// in the underlying logic.
+TEST(EndianTest, BN_bn2le_padded_255) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[255];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[253] = 0x01;
+  input[254] = 0x01;
+  ASSERT_TRUE(BN_le2bn(input, sizeof(input), x.get()));
+
+  uint8_t out[255];
+  OPENSSL_memset(out, 0, sizeof(out));
+  EXPECT_EQ(1, BN_bn2le_padded(out, sizeof(out), x.get()));
+  EXPECT_EQ(Bytes(input), Bytes(out));
+}
+
+// This test creates a 256-byte BIGNUM, where only 2 bytes are significant.
+// It then calls |BN_bn2le_padded| to write the number into a 2-byte array
+// in little-endian byte-order.
+TEST(EndianTest, BN_bn2le_padded_much) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  ASSERT_TRUE(BN_le2bn(input, sizeof(input), x.get()));
+
+  uint8_t out[2];
+  OPENSSL_memset(out, 0, sizeof(out));
+  EXPECT_EQ(1, BN_bn2le_padded(out, sizeof(out), x.get()));
+  EXPECT_EQ(Bytes(input, 2), Bytes(out, 2));
+}
+
+
+TEST(EndianTest, BN_bn2bin_padded) {
+  bssl::UniquePtr<BIGNUM> x(BN_new());
+  uint8_t input[256];
+  OPENSSL_memset(input, 0, sizeof(input));
+  input[0] = 0xaa;
+  input[1] = 0x01;
+  input[254] = 0x01;
+  input[255] = 0x02;
+  ASSERT_NE(nullptr, BN_bin2bn(input, sizeof(input), x.get()));
+
+  uint8_t out[256];
+  OPENSSL_memset(out, 0, sizeof(out));
+  EXPECT_EQ(1, BN_bn2bin_padded(out, sizeof(out), x.get()));
+  EXPECT_EQ(Bytes(input), Bytes(out));
+}
+
+TEST(EndianTest, AES) {
+  // Initialize the key and message buffers with zeros
+  uint8_t key[16] = {0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22, 0x33,
+	0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0x50};
+  uint8_t message[AES_BLOCK_SIZE] = {0x50, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
+	0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99};
+
+  // Allocate buffer to store the encrypted message
+  uint8_t encrypted_message[AES_BLOCK_SIZE];
+
+  // Create an AES_KEY struct
+  AES_KEY aes_key = {{0}, 0};
+  ASSERT_EQ(0, AES_set_encrypt_key(key, 128, &aes_key));
+
+  AES_encrypt(message, encrypted_message, &aes_key);
+
+  const uint8_t known_value_bytes[AES_BLOCK_SIZE] = {
+	0x5e, 0x3e, 0x8e, 0x76, 0xf4, 0xf2, 0x7d, 0x41, 0x35, 0x86, 0x96, 0xb5, 0x57, 0x2d, 0xd5, 0xc6
+  };
+  EXPECT_EQ(Bytes(known_value_bytes), Bytes(encrypted_message));
+}
+
+TEST(EndianTest, memcpy) {
+  uint8_t buffer[2] = {0xab, 0xcd};
+  uint16_t out = 0;
+  memcpy(&out, buffer, 2);
+#if defined(OPENSSL_BIG_ENDIAN)
+  EXPECT_EQ(out, 0xabcd);
+#else
+  EXPECT_EQ(out, 0xcdab);
+#endif
+}
+
+TEST(EndianTest, masking) {
+  uint16_t value = 0xabcd;
+  uint16_t mask = 0xf00f;
+  uint16_t result = value & mask;
+  EXPECT_EQ(result, 0xa00d);
+}

data/aws-crt-ffi/crt/aws-lc/crypto/err/ssl.errordata

@@ -13,6 +13,8 @@ SSL,107,BAD_ECC_CERT
 SSL,108,BAD_ECPOINT
 SSL,109,BAD_HANDSHAKE_RECORD
 SSL,110,BAD_HELLO_REQUEST
+SSL,507,BAD_HYBRID_KEYSHARE
+SSL,508,BAD_KEM_CIPHERTEXT
 SSL,111,BAD_LENGTH
 SSL,112,BAD_PACKET_LENGTH
 SSL,113,BAD_RSA_ENCRYPT

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_extra_test.cc

@@ -1969,6 +1969,8 @@ struct RsassaPssParamsMatchTestInput {
      EVP_sha384(), 0},
     {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha512(),
      EVP_sha512(), 0},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha512_224(),
+     EVP_sha512_224(), 0},
     {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha512_256(),
      EVP_sha512_256(), 0},
     // This test expects success when setting |signature_md| and |rsa_mgf1_md|

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_test.cc

@@ -103,6 +103,8 @@ static const EVP_MD *GetDigest(FileTest *t, const std::string &name) {
     return EVP_sha384();
   } else if (name == "SHA512") {
     return EVP_sha512();
+  } else if (name == "SHA512/224") {
+    return EVP_sha512_224();
   } else if (name == "SHA512/256") {
     return EVP_sha512_256();
   } else if (name == "SHA3-224") {
@@ -113,6 +115,10 @@ static const EVP_MD *GetDigest(FileTest *t, const std::string &name) {
     return EVP_sha3_384();
   } else if (name == "SHA3-512") {
     return EVP_sha3_512();
+  } else if (name == "SHAKE128") {
+    return EVP_shake128();
+  } else if (name == "SHAKE256") {
+    return EVP_shake256();
   }
   ADD_FAILURE() << "Unknown digest: " << name;
   return nullptr;
@@ -138,7 +144,7 @@ static int GetKeyType(FileTest *t, const std::string &name) {
   return EVP_PKEY_NONE;
 }
 
-static int GetRSAPadding(FileTest *t, int *out, const std::string &name) {
+static bool GetRSAPadding(FileTest *t, int *out, const std::string &name) {
   if (name == "PKCS1") {
     *out = RSA_PKCS1_PADDING;
     return true;
@@ -151,6 +157,10 @@ static int GetRSAPadding(FileTest *t, int *out, const std::string &name) {
     *out = RSA_PKCS1_OAEP_PADDING;
     return true;
   }
+  if (name == "None") {
+    *out = RSA_NO_PADDING;
+    return true;
+  }
   ADD_FAILURE() << "Unknown RSA padding mode: " << name;
   return false;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_tests.txt

@@ -155,6 +155,21 @@ PublicKey = P-256-SPKI
 Input = 305b301506072a8648ce3d020106082a8648ce3d0301070500034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = DECODE_ERROR
 
+PrivateKey = P-224-ExplicitParameters
+Input = 308201540201003081eb06072a8648ce3d02013081df020101302806072a8648ce3d0101021d00ffffffffffffffffffffffffffffffff0000000000000000000000013053041cfffffffffffffffffffffffffffffffefffffffffffffffffffffffe041cb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4031500bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5043904b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34021d00ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d0201010461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+Type = EC
+Output = 3078020100301006072a8648ce3d020106052b810400210461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+
+PrivateKey = P-384-ExplicitParameters
+Input = 3082020c0201003082016406072a8648ce3d020130820157020101303c06072a8648ce3d0101023100fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff307b0430fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc0430b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef031500a335926aa319a27a1d00896a6773a4827acdac73046104aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f023100ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc5297302010104819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+Type = EC
+Output = 3081b6020100301006072a8648ce3d020106052b8104002204819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+
+PrivateKey = P-521-ExplicitParameters
+Input = 308202b0020100308201d006072a8648ce3d0201308201c3020101304d06072a8648ce3d0101024201ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff30819f044201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc04420051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00031500d09e8800291cb85396cc6717393284aaa0da64ba0481850400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650024201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e913864090201010481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+Type = EC
+Output = 3081ee020100301006072a8648ce3d020106052b810400230481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+
 # A DSA private key.
 PrivateKey = DSA-1024
 Type = DSA
@@ -772,6 +787,16 @@ Digest = SHA256
 Input = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 Output = 07fa4e3de9c002c41c952dc292ef5a814c4c17dc1a6cf958c4c971e8089676d6661b442270ef9295c41e5385c9628aa1bdee2cc2558b8473ba212f2ba04b9ff2264c19187b9506b1d0a1cc2751844cc8dedf555d62ce81bc0e70bfe83d0184ee964593af91b9b327c0fb272c799148cd8737d412cbf36c2ad25fd66977bf805f
 
+# The input is 1 (mod p) and q - 1 (mod q). If the CRT implementation does not
+# account for p < q, the subtraction step will break. However, this test only
+# works when RSA blinding is disabled. When blinding is enabled, these values
+# are randomized and, instead, either this or the above test will hit this case
+# if repeated enough. (It hits it with probability (q-p)^2 / 2pq, or 1.8% here.)
+Encrypt = RSA-Swapped
+RSAPadding = None
+Input = 7ab490e1f5e718ff23a9e738f9867559e3a6ea72332e3bcc1b6f58585218ed815a865dab75e3f44ea550bdef815101d6039251a513fd99188c1916abb94b15ef72de793f6472a342b33a125cfc96a4fc89d140e337f5fe6ff937ed3f34b6b09f5227f598e12faddf4423254acbee748197bed26954502c7484c65e279fed7fed
+CheckDecrypt
+
 # Though we will never generate such a key, test that RSA keys where p and q are
 # different sizes work properly.
 PrivateKey = RSA-PrimeMismatch

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_ec_asn1.c

@@ -204,7 +204,7 @@ static int ec_bits(const EVP_PKEY *pkey) {
     ERR_clear_error();
     return 0;
   }
-  return BN_num_bits(EC_GROUP_get0_order(group));
+  return EC_GROUP_order_bits(group);
 }
 
 static int ec_missing_parameters(const EVP_PKEY *pkey) {

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_kem.c

@@ -141,9 +141,9 @@ static int pkey_kem_decapsulate(EVP_PKEY_CTX *ctx,
   }
 
   // The input and output buffers need to be large enough.
-  if (ciphertext_len < kem->ciphertext_len ||
+  if (ciphertext_len != kem->ciphertext_len ||
       *shared_secret_len < kem->shared_secret_len) {
-      OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+      OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_BUFFER_SIZE);
       return 0;
   }
 

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_rsa_asn1.c

@@ -63,6 +63,7 @@
 
 #include "../rsa_extra/internal.h"
 #include "../fipsmodule/evp/internal.h"
+#include "../fipsmodule/rsa/internal.h"
 #include "internal.h"
 
 static int rsa_pub_encode(CBB *out, const EVP_PKEY *key) {

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/print.c

@@ -200,12 +200,12 @@ static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent) {
 static int do_dsa_print(BIO *bp, const DSA *x, int off, int ptype) {
   const BIGNUM *priv_key = NULL;
   if (ptype == 2) {
-    priv_key = x->priv_key;
+    priv_key = DSA_get0_priv_key(x);
   }
 
   const BIGNUM *pub_key = NULL;
   if (ptype > 0) {
-    pub_key = x->pub_key;
+    pub_key = DSA_get0_pub_key(x);
   }
 
   const char *ktype = "DSA-Parameters";
@@ -216,14 +216,15 @@ static int do_dsa_print(BIO *bp, const DSA *x, int off, int ptype) {
   }
 
   if (!BIO_indent(bp, off, 128) ||
-      BIO_printf(bp, "%s: (%u bit)\n", ktype, BN_num_bits(x->p)) <= 0 ||
+      BIO_printf(bp, "%s: (%u bit)\n", ktype, BN_num_bits(DSA_get0_p(x))) <=
+          0 ||
       // |priv_key| and |pub_key| may be NULL, in which case |bn_print| will
       // silently skip them.
       !bn_print(bp, "priv:", priv_key, off) ||
       !bn_print(bp, "pub:", pub_key, off) ||
-      !bn_print(bp, "P:", x->p, off) ||
-      !bn_print(bp, "Q:", x->q, off) ||
-      !bn_print(bp, "G:", x->g, off)) {
+      !bn_print(bp, "P:", DSA_get0_p(x), off) ||
+      !bn_print(bp, "Q:", DSA_get0_q(x), off) ||
+      !bn_print(bp, "G:", DSA_get0_g(x), off)) {
     return 0;
   }
 

data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/scrypt.c

@@ -28,7 +28,8 @@
 // scrypt blocks, respectively.
 
 // A block_t is a Salsa20 block.
-typedef struct { uint32_t words[16]; } block_t;
+#define SCRYPT_BLOCK_WORD_CNT 16
+typedef struct { uint32_t words[SCRYPT_BLOCK_WORD_CNT]; } block_t;
 
 OPENSSL_STATIC_ASSERT(sizeof(block_t) == 64, block_t_has_padding)
 
@@ -111,7 +112,13 @@ static void scryptBlockMix(block_t *out, const block_t *B, uint64_t r) {
 static void scryptROMix(block_t *B, uint64_t r, uint64_t N, block_t *T,
                         block_t *V) {
   // Steps 1 and 2.
+#ifdef OPENSSL_BIG_ENDIAN
+  for(size_t i = 0; i < (2 * r * SCRYPT_BLOCK_WORD_CNT); i++) {
+    CRYPTO_store_u32_le(&V->words[i], B->words[i]);
+  }
+#else
   OPENSSL_memcpy(V, B, 2 * r * sizeof(block_t));
+#endif
   for (uint64_t i = 1; i < N; i++) {
     scryptBlockMix(&V[2 * r * i /* scrypt block i */],
                    &V[2 * r * (i - 1) /* scrypt block i-1 */], r);
@@ -127,6 +134,11 @@ static void scryptROMix(block_t *B, uint64_t r, uint64_t N, block_t *T,
     }
     scryptBlockMix(B, T, r);
   }
+#ifdef OPENSSL_BIG_ENDIAN
+  for(size_t i = 0; i < (2 * r * SCRYPT_BLOCK_WORD_CNT); i++) {
+    CRYPTO_store_u32_le(&B->words[i], B->words[i]);
+  }
+#endif
 }
 
 // SCRYPT_PR_MAX is the maximum value of p * r. This is equivalent to the

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/CMakeLists.txt

@@ -162,7 +162,7 @@ endif()
 if ((CMAKE_ASM_COMPILER_ID MATCHES "Clang" OR CMAKE_ASM_COMPILER MATCHES "clang") AND
     (CMAKE_ASM_COMPILER_VERSION VERSION_LESS "7.0.0") AND (ARCH STREQUAL "x86_64"))
   set_source_files_properties(${CMAKE_CURRENT_BINARY_DIR}/aesni-gcm-avx512.${ASM_EXT} PROPERTIES COMPILE_FLAGS "-mavx512f -mavx512bw -mavx512dq -mavx512vl")
-  set_source_files_properties(${CMAKE_CURRENT_BINARY_DIR}/aesni-xts-avx512.${ASM_EXT} PROPERTIES COMPILE_FLAGS "-mavx512f -mavx512bw -mavx512dq -mavx512vl -mavx512vbmi2")
+  set_source_files_properties(${CMAKE_CURRENT_BINARY_DIR}/aesni-xts-avx512.${ASM_EXT} PROPERTIES COMPILE_FLAGS "-mavx512f -mavx512bw -mavx512dq -mavx512vl")
 endif()
 
 # s2n-bignum files can be compiled on Unix platforms only (except Apple),
@@ -249,6 +249,11 @@ if((((ARCH STREQUAL "x86_64") AND NOT MY_ASSEMBLER_IS_TOO_OLD_FOR_AVX) OR
                 fastmul/bignum_ksqr_16_32_neon.S
                 fastmul/bignum_ksqr_32_64_neon.S
                 fastmul/bignum_emontredc_8n_neon.S
+
+                generic/bignum_copy_row_from_table.S
+                generic/bignum_copy_row_from_table_8n_neon.S
+                generic/bignum_copy_row_from_table_16_neon.S
+                generic/bignum_copy_row_from_table_32_neon.S
                 )
   endif()
 endif()
@@ -270,6 +275,8 @@ function(cpreprocess dest src)
     DEPENDS
     ${src}
     ${PROJECT_SOURCE_DIR}/include/openssl/arm_arch.h
+    ${PROJECT_SOURCE_DIR}/include/openssl/asm_base.h
+    ${PROJECT_SOURCE_DIR}/include/openssl/target.h
     WORKING_DIRECTORY .
   )
 endfunction()
@@ -453,17 +460,19 @@ elseif(FIPS_SHARED)
     # generate the output object file where all the code in the __text section
     # and all the read-only data in the __const section are between the
     # respective start and end markers.
+    if (CMAKE_OSX_DEPLOYMENT_TARGET)
+      set(OSX_VERSION_MIN_FLAG "-mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
+    endif()
     add_custom_command(
       OUTPUT fips_apple_start.o
-      COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_START -o fips_apple_start.o
+      COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} ${OSX_VERSION_MIN_FLAG} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_START -o fips_apple_start.o
       DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
     )
     add_custom_command(
       OUTPUT fips_apple_end.o
-      COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_END -o fips_apple_end.o
+      COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} ${OSX_VERSION_MIN_FLAG} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_END -o fips_apple_end.o
       DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
     )
-
     add_custom_command(
       OUTPUT bcm.o
       COMMAND ${CMAKE_LINKER} -r fips_apple_start.o -force_load $<TARGET_FILE:bcm_library> fips_apple_end.o -keep_private_externs -o bcm.o

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/aes/aes_nohw.c

@@ -349,15 +349,27 @@ static inline void aes_nohw_compact_block(aes_word_t out[AES_NOHW_BLOCK_WORDS],
 #if defined(OPENSSL_SSE2)
   // No conversions needed.
 #elif defined(OPENSSL_64_BIT)
+#if defined(OPENSSL_BIG_ENDIAN)
+  uint64_t a0 = aes_nohw_compact_word(CRYPTO_load_u64_le(&out[0]));
+  uint64_t a1 = aes_nohw_compact_word(CRYPTO_load_u64_le(&out[1]));
+#else
   uint64_t a0 = aes_nohw_compact_word(out[0]);
   uint64_t a1 = aes_nohw_compact_word(out[1]);
+#endif
   out[0] = (a0 & UINT64_C(0x00000000ffffffff)) | (a1 << 32);
   out[1] = (a1 & UINT64_C(0xffffffff00000000)) | (a0 >> 32);
+#else
+#if defined(OPENSSL_BIG_ENDIAN)
+  uint32_t a0 = aes_nohw_compact_word(CRYPTO_load_u32_le(&out[0]));
+  uint32_t a1 = aes_nohw_compact_word(CRYPTO_load_u32_le(&out[1]));
+  uint32_t a2 = aes_nohw_compact_word(CRYPTO_load_u32_le(&out[2]));
+  uint32_t a3 = aes_nohw_compact_word(CRYPTO_load_u32_le(&out[3]));
 #else
   uint32_t a0 = aes_nohw_compact_word(out[0]);
   uint32_t a1 = aes_nohw_compact_word(out[1]);
   uint32_t a2 = aes_nohw_compact_word(out[2]);
   uint32_t a3 = aes_nohw_compact_word(out[3]);
+#endif
   // Note clang, when building for ARM Thumb2, will sometimes miscompile
   // expressions such as (a0 & 0x0000ff00) << 8, particularly when building
   // without optimizations. This bug was introduced in
@@ -381,8 +393,8 @@ static inline void aes_nohw_uncompact_block(
       aes_nohw_uncompact_word((a0 & UINT64_C(0x00000000ffffffff)) | (a1 << 32));
   uint64_t b1 =
       aes_nohw_uncompact_word((a1 & UINT64_C(0xffffffff00000000)) | (a0 >> 32));
-  memcpy(out, &b0, 8);
-  memcpy(out + 8, &b1, 8);
+  CRYPTO_store_u64_le(&out[0], b0);
+  CRYPTO_store_u64_le(&out[8], b1);
 #else
   uint32_t a0 = in[0];
   uint32_t a1 = in[1];
@@ -403,10 +415,10 @@ static inline void aes_nohw_uncompact_block(
   b1 = aes_nohw_uncompact_word(b1);
   b2 = aes_nohw_uncompact_word(b2);
   b3 = aes_nohw_uncompact_word(b3);
-  memcpy(out, &b0, 4);
-  memcpy(out + 4, &b1, 4);
-  memcpy(out + 8, &b2, 4);
-  memcpy(out + 12, &b3, 4);
+  CRYPTO_store_u32_le(&out[0], b0);
+  CRYPTO_store_u32_le(&out[4], b1);
+  CRYPTO_store_u32_le(&out[8], b2);
+  CRYPTO_store_u32_le(&out[12], b3);
 #endif
 }
 

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bcm.c

@@ -228,14 +228,19 @@ static void BORINGSSL_bcm_power_on_self_test(void) __attribute__ ((constructor))
 #endif
 
 static void BORINGSSL_bcm_power_on_self_test(void) {
-#if !defined(OPENSSL_NO_ASM)
+// TODO: remove !defined(OPENSSL_PPC64BE) from the check below when starting to support
+// PPC64BE that has VCRYPTO capability. In that case, add `|| defined(OPENSSL_PPC64BE)`
+// to `#if defined(OPENSSL_PPC64LE)` wherever it occurs.
+#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_PPC32BE) && !defined(OPENSSL_PPC64BE)
   OPENSSL_cpuid_setup();
 #endif
 
+#if defined(FIPS_ENTROPY_SOURCE_JITTER_CPU)
   if (jent_entropy_init()) {
     fprintf(stderr, "CPU Jitter entropy RNG initialization failed.\n");
     goto err;
   }
+#endif
 
 #if !defined(OPENSSL_ASAN)
   // Integrity tests cannot run under ASAN because it involves reading the full
@@ -273,7 +278,7 @@ int BORINGSSL_integrity_test(void) {
   assert_not_within(start, OPENSSL_ia32cap_P, end);
 #elif defined(OPENSSL_AARCH64)
   assert_not_within(start, &OPENSSL_armcap_P, end);
-#endif  
+#endif
 
 #if defined(BORINGSSL_SHARED_LIBRARY)
   const uint8_t *const rodata_start = BORINGSSL_bcm_rodata_start;
@@ -320,11 +325,14 @@ int BORINGSSL_integrity_test(void) {
 #endif
 #if defined(BORINGSSL_SHARED_LIBRARY)
   uint64_t length = end - start;
-  HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length));
+  uint8_t buffer[sizeof(length)];
+  CRYPTO_store_u64_le(buffer, length);
+  HMAC_Update(&hmac_ctx, buffer, sizeof(length));
   HMAC_Update(&hmac_ctx, start, length);
 
   length = rodata_end - rodata_start;
-  HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length));
+  CRYPTO_store_u64_le(buffer, length);
+  HMAC_Update(&hmac_ctx, buffer, sizeof(length));
   HMAC_Update(&hmac_ctx, rodata_start, length);
 #else
   HMAC_Update(&hmac_ctx, start, end - start);