Skip to content

Commit d327e52

Browse files
FiloSottilegopherbot
FiloSottile
authored and
gopherbot
committed
crypto/internal/fips140: use hash.Hash
Since package hash is just the interface definition, not an implementation, we can make a good argument that it doesn't impact the security of the module and can be imported from outside. For #69521 Change-Id: I6a6a4656b9c3cac8bb9ab8e8df11fa3238dc5d1d Reviewed-on: https://go-review.googlesource.com/c/go/+/674917 Reviewed-by: Roland Shoemaker <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Daniel McCarney <[email protected]> Reviewed-by: David Chase <[email protected]> Auto-Submit: Filippo Valsorda <[email protected]>
1 parent d6c29c7 commit d327e52

File tree

14 files changed

+192
-207
lines changed

14 files changed

+192
-207
lines changed

‎src/crypto/internal/fips140/ecdsa/ecdsa.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"crypto/internal/fips140/drbg"
1212
"crypto/internal/fips140/nistec"
1313
"errors"
14+
"hash"
1415
"io"
1516
"sync"
1617
)
@@ -271,7 +272,7 @@ type Signature struct {
271272
// the hash function H) using the private key, priv. If the hash is longer than
272273
// the bit-length of the private key's curve order, the hash will be truncated
273274
// to that length.
274-
func Sign[P Point[P], H fips140.Hash](c *Curve[P], h func() H, priv *PrivateKey, rand io.Reader, hash []byte) (*Signature, error) {
275+
func Sign[P Point[P], H hash.Hash](c *Curve[P], h func() H, priv *PrivateKey, rand io.Reader, hash []byte) (*Signature, error) {
275276
if priv.pub.curve != c.curve {
276277
return nil, errors.New("ecdsa: private key does not match curve")
277278
}
@@ -304,7 +305,7 @@ func Sign[P Point[P], H fips140.Hash](c *Curve[P], h func() H, priv *PrivateKey,
304305
// hash is longer than the bit-length of the private key's curve order, the hash
305306
// will be truncated to that length. This applies Deterministic ECDSA as
306307
// specified in FIPS 186-5 and RFC 6979.
307-
func SignDeterministic[P Point[P], H fips140.Hash](c *Curve[P], h func() H, priv *PrivateKey, hash []byte) (*Signature, error) {
308+
func SignDeterministic[P Point[P], H hash.Hash](c *Curve[P], h func() H, priv *PrivateKey, hash []byte) (*Signature, error) {
308309
if priv.pub.curve != c.curve {
309310
return nil, errors.New("ecdsa: private key does not match curve")
310311
}

‎src/crypto/internal/fips140/ecdsa/hmacdrbg.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"bytes"
99
"crypto/internal/fips140"
1010
"crypto/internal/fips140/hmac"
11+
"hash"
1112
)
1213

1314
// hmacDRBG is an SP 800-90A Rev. 1 HMAC_DRBG.
@@ -48,7 +49,7 @@ type personalizationString interface {
4849
isPersonalizationString()
4950
}
5051

51-
func newDRBG[H fips140.Hash](hash func() H, entropy, nonce []byte, s personalizationString) *hmacDRBG {
52+
func newDRBG[H hash.Hash](hash func() H, entropy, nonce []byte, s personalizationString) *hmacDRBG {
5253
// HMAC_DRBG_Instantiate_algorithm, per Section 10.1.2.3.
5354
fips140.RecordApproved()
5455

@@ -121,7 +122,7 @@ func newDRBG[H fips140.Hash](hash func() H, entropy, nonce []byte, s personaliza
121122
//
122123
// This should only be used for ACVP testing. hmacDRBG is not intended to be
123124
// used directly.
124-
func TestingOnlyNewDRBG(hash func() fips140.Hash, entropy, nonce []byte, s []byte) *hmacDRBG {
125+
func TestingOnlyNewDRBG(hash func() hash.Hash, entropy, nonce []byte, s []byte) *hmacDRBG {
125126
return newDRBG(hash, entropy, nonce, plainPersonalizationString(s))
126127
}
127128

‎src/crypto/internal/fips140/fips140.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ package fips140
77
import (
88
"crypto/internal/fips140deps/godebug"
99
"errors"
10+
"hash"
1011
"runtime"
1112
)
1213

@@ -69,3 +70,9 @@ func Version() string {
6970
// moved to a different file.
7071
return "latest" //mkzip:version
7172
}
73+
74+
// Hash is a legacy compatibility alias for hash.Hash.
75+
//
76+
// It's only here because [crypto/internal/fips140/ecdsa.TestingOnlyNewDRBG]
77+
// takes a "func() fips140.Hash" in v1.0.0, instead of being generic.
78+
type Hash = hash.Hash

‎src/crypto/internal/fips140/hash.go

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎src/crypto/internal/fips140/hkdf/hkdf.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,10 @@ package hkdf
77
import (
88
"crypto/internal/fips140"
99
"crypto/internal/fips140/hmac"
10+
"hash"
1011
)
1112

12-
func Extract[H fips140.Hash](h func() H, secret, salt []byte) []byte {
13+
func Extract[H hash.Hash](h func() H, secret, salt []byte) []byte {
1314
if len(secret) < 112/8 {
1415
fips140.RecordNonApproved()
1516
}
@@ -23,7 +24,7 @@ func Extract[H fips140.Hash](h func() H, secret, salt []byte) []byte {
2324
return extractor.Sum(nil)
2425
}
2526

26-
func Expand[H fips140.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) []byte {
27+
func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) []byte {
2728
out := make([]byte, 0, keyLen)
2829
expander := hmac.New(h, pseudorandomKey)
2930
hmac.MarkAsUsedInKDF(expander)
@@ -50,7 +51,7 @@ func Expand[H fips140.Hash](h func() H, pseudorandomKey []byte, info string, key
5051
return out
5152
}
5253

53-
func Key[H fips140.Hash](h func() H, secret, salt []byte, info string, keyLen int) []byte {
54+
func Key[H hash.Hash](h func() H, secret, salt []byte, info string, keyLen int) []byte {
5455
prk := Extract(h, secret, salt)
5556
return Expand(h, prk, info, keyLen)
5657
}

‎src/crypto/internal/fips140/hmac/hmac.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"crypto/internal/fips140/sha256"
1313
"crypto/internal/fips140/sha3"
1414
"crypto/internal/fips140/sha512"
15+
"hash"
1516
)
1617

1718
// key is zero padded to the block size of the hash function
@@ -29,7 +30,7 @@ type marshalable interface {
2930

3031
type HMAC struct {
3132
opad, ipad []byte
32-
outer, inner fips140.Hash
33+
outer, inner hash.Hash
3334

3435
// If marshaled is true, then opad and ipad do not contain a padded
3536
// copy of the key, but rather the marshaled state of outer/inner after
@@ -127,8 +128,8 @@ func (h *HMAC) Reset() {
127128
h.marshaled = true
128129
}
129130

130-
// New returns a new HMAC hash using the given [fips140.Hash] type and key.
131-
func New[H fips140.Hash](h func() H, key []byte) *HMAC {
131+
// New returns a new HMAC hash using the given [hash.Hash] type and key.
132+
func New[H hash.Hash](h func() H, key []byte) *HMAC {
132133
hm := &HMAC{keyLen: len(key)}
133134
hm.outer = h()
134135
hm.inner = h()

‎src/crypto/internal/fips140/pbkdf2/pbkdf2.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"crypto/internal/fips140"
99
"crypto/internal/fips140/hmac"
1010
"errors"
11+
"hash"
1112
)
1213

1314
// divRoundUp divides x+y-1 by y, rounding up if the result is not whole.
@@ -19,7 +20,7 @@ func divRoundUp(x, y int) int {
1920
return int((int64(x) + int64(y) - 1) / int64(y))
2021
}
2122

22-
func Key[Hash fips140.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {
23+
func Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {
2324
setServiceIndicator(salt, keyLength)
2425

2526
if keyLength <= 0 {

‎src/crypto/internal/fips140/rsa/pkcs1v22.go

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"crypto/internal/fips140/sha512"
1717
"crypto/internal/fips140/subtle"
1818
"errors"
19+
"hash"
1920
"io"
2021
)
2122

@@ -48,7 +49,7 @@ func incCounter(c *[4]byte) {
4849

4950
// mgf1XOR XORs the bytes in out with a mask generated using the MGF1 function
5051
// specified in PKCS #1 v2.1.
51-
func mgf1XOR(out []byte, hash fips140.Hash, seed []byte) {
52+
func mgf1XOR(out []byte, hash hash.Hash, seed []byte) {
5253
var counter [4]byte
5354
var digest []byte
5455

@@ -67,7 +68,7 @@ func mgf1XOR(out []byte, hash fips140.Hash, seed []byte) {
6768
}
6869
}
6970

70-
func emsaPSSEncode(mHash []byte, emBits int, salt []byte, hash fips140.Hash) ([]byte, error) {
71+
func emsaPSSEncode(mHash []byte, emBits int, salt []byte, hash hash.Hash) ([]byte, error) {
7172
// See RFC 8017, Section 9.1.1.
7273

7374
hLen := hash.Size()
@@ -144,7 +145,7 @@ func emsaPSSEncode(mHash []byte, emBits int, salt []byte, hash fips140.Hash) ([]
144145

145146
const pssSaltLengthAutodetect = -1
146147

147-
func emsaPSSVerify(mHash, em []byte, emBits, sLen int, hash fips140.Hash) error {
148+
func emsaPSSVerify(mHash, em []byte, emBits, sLen int, hash hash.Hash) error {
148149
// See RFC 8017, Section 9.1.2.
149150

150151
hLen := hash.Size()
@@ -250,7 +251,7 @@ func emsaPSSVerify(mHash, em []byte, emBits, sLen int, hash fips140.Hash) error
250251

251252
// PSSMaxSaltLength returns the maximum salt length for a given public key and
252253
// hash function.
253-
func PSSMaxSaltLength(pub *PublicKey, hash fips140.Hash) (int, error) {
254+
func PSSMaxSaltLength(pub *PublicKey, hash hash.Hash) (int, error) {
254255
saltLength := (pub.N.BitLen()-1+7)/8 - 2 - hash.Size()
255256
if saltLength < 0 {
256257
return 0, ErrMessageTooLong
@@ -264,7 +265,7 @@ func PSSMaxSaltLength(pub *PublicKey, hash fips140.Hash) (int, error) {
264265
}
265266

266267
// SignPSS calculates the signature of hashed using RSASSA-PSS.
267-
func SignPSS(rand io.Reader, priv *PrivateKey, hash fips140.Hash, hashed []byte, saltLength int) ([]byte, error) {
268+
func SignPSS(rand io.Reader, priv *PrivateKey, hash hash.Hash, hashed []byte, saltLength int) ([]byte, error) {
268269
fipsSelfTest()
269270
fips140.RecordApproved()
270271
checkApprovedHash(hash)
@@ -311,19 +312,19 @@ func SignPSS(rand io.Reader, priv *PrivateKey, hash fips140.Hash, hashed []byte,
311312
}
312313

313314
// VerifyPSS verifies sig with RSASSA-PSS automatically detecting the salt length.
314-
func VerifyPSS(pub *PublicKey, hash fips140.Hash, digest []byte, sig []byte) error {
315+
func VerifyPSS(pub *PublicKey, hash hash.Hash, digest []byte, sig []byte) error {
315316
return verifyPSS(pub, hash, digest, sig, pssSaltLengthAutodetect)
316317
}
317318

318319
// VerifyPSS verifies sig with RSASSA-PSS and an expected salt length.
319-
func VerifyPSSWithSaltLength(pub *PublicKey, hash fips140.Hash, digest []byte, sig []byte, saltLength int) error {
320+
func VerifyPSSWithSaltLength(pub *PublicKey, hash hash.Hash, digest []byte, sig []byte, saltLength int) error {
320321
if saltLength < 0 {
321322
return errors.New("crypto/rsa: salt length cannot be negative")
322323
}
323324
return verifyPSS(pub, hash, digest, sig, saltLength)
324325
}
325326

326-
func verifyPSS(pub *PublicKey, hash fips140.Hash, digest []byte, sig []byte, saltLength int) error {
327+
func verifyPSS(pub *PublicKey, hash hash.Hash, digest []byte, sig []byte, saltLength int) error {
327328
fipsSelfTest()
328329
fips140.RecordApproved()
329330
checkApprovedHash(hash)
@@ -359,7 +360,7 @@ func verifyPSS(pub *PublicKey, hash fips140.Hash, digest []byte, sig []byte, sal
359360
return emsaPSSVerify(digest, em, emBits, saltLength, hash)
360361
}
361362

362-
func checkApprovedHash(hash fips140.Hash) {
363+
func checkApprovedHash(hash hash.Hash) {
363364
switch hash.(type) {
364365
case *sha256.Digest, *sha512.Digest, *sha3.Digest:
365366
default:
@@ -368,7 +369,7 @@ func checkApprovedHash(hash fips140.Hash) {
368369
}
369370

370371
// EncryptOAEP encrypts the given message with RSAES-OAEP.
371-
func EncryptOAEP(hash, mgfHash fips140.Hash, random io.Reader, pub *PublicKey, msg []byte, label []byte) ([]byte, error) {
372+
func EncryptOAEP(hash, mgfHash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, label []byte) ([]byte, error) {
372373
// Note that while we don't commit to deterministic execution with respect
373374
// to the random stream, we also don't apply MaybeReadByte, so per Hyrum's
374375
// Law it's probably relied upon by some. It's a tolerable promise because a
@@ -411,7 +412,7 @@ func EncryptOAEP(hash, mgfHash fips140.Hash, random io.Reader, pub *PublicKey, m
411412
}
412413

413414
// DecryptOAEP decrypts ciphertext using RSAES-OAEP.
414-
func DecryptOAEP(hash, mgfHash fips140.Hash, priv *PrivateKey, ciphertext []byte, label []byte) ([]byte, error) {
415+
func DecryptOAEP(hash, mgfHash hash.Hash, priv *PrivateKey, ciphertext []byte, label []byte) ([]byte, error) {
415416
fipsSelfTest()
416417
fips140.RecordApproved()
417418
checkApprovedHash(hash)

‎src/crypto/internal/fips140/ssh/kdf.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
package ssh
88

99
import (
10-
"crypto/internal/fips140"
1110
_ "crypto/internal/fips140/check"
11+
"hash"
1212
)
1313

1414
type Direction struct {
@@ -24,7 +24,7 @@ func init() {
2424
ClientKeys = Direction{[]byte{'A'}, []byte{'C'}, []byte{'E'}}
2525
}
2626

27-
func Keys[Hash fips140.Hash](hash func() Hash, d Direction,
27+
func Keys[Hash hash.Hash](hash func() Hash, d Direction,
2828
K, H, sessionID []byte,
2929
ivKeyLen, keyLen, macKeyLen int,
3030
) (ivKey, key, macKey []byte) {

‎src/crypto/internal/fips140/tls12/tls12.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,12 @@ import (
99
"crypto/internal/fips140/hmac"
1010
"crypto/internal/fips140/sha256"
1111
"crypto/internal/fips140/sha512"
12+
"hash"
1213
)
1314

1415
// PRF implements the TLS 1.2 pseudo-random function, as defined in RFC 5246,
1516
// Section 5 and allowed by SP 800-135, Revision 1, Section 4.2.2.
16-
func PRF[H fips140.Hash](hash func() H, secret []byte, label string, seed []byte, keyLen int) []byte {
17+
func PRF[H hash.Hash](hash func() H, secret []byte, label string, seed []byte, keyLen int) []byte {
1718
labelAndSeed := make([]byte, len(label)+len(seed))
1819
copy(labelAndSeed, label)
1920
copy(labelAndSeed[len(label):], seed)
@@ -24,7 +25,7 @@ func PRF[H fips140.Hash](hash func() H, secret []byte, label string, seed []byte
2425
}
2526

2627
// pHash implements the P_hash function, as defined in RFC 5246, Section 5.
27-
func pHash[H fips140.Hash](hash func() H, result, secret, seed []byte) {
28+
func pHash[H hash.Hash](hash func() H, result, secret, seed []byte) {
2829
h := hmac.New(hash, secret)
2930
h.Write(seed)
3031
a := h.Sum(nil)
@@ -48,7 +49,7 @@ const extendedMasterSecretLabel = "extended master secret"
4849

4950
// MasterSecret implements the TLS 1.2 extended master secret derivation, as
5051
// defined in RFC 7627 and allowed by SP 800-135, Revision 1, Section 4.2.2.
51-
func MasterSecret[H fips140.Hash](hash func() H, preMasterSecret, transcript []byte) []byte {
52+
func MasterSecret[H hash.Hash](hash func() H, preMasterSecret, transcript []byte) []byte {
5253
// "The TLS 1.2 KDF is an approved KDF when the following conditions are
5354
// satisfied: [...] (3) P_HASH uses either SHA-256, SHA-384 or SHA-512."
5455
h := hash()

0 commit comments

Comments
 (0)