merged the modularization branch (credentials) back to trunk
[strongswan.git] / src / libstrongswan / fips / fips.c
1 /*
2 * Copyright (C) 2007 Bruno Krieg, Daniel Wydler
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include <stdio.h>
19
20 #include <debug.h>
21 #include <crypto/signers/hmac_signer.h>
22 #include "fips.h"
23
24 extern const u_char FIPS_rodata_start[];
25 extern const u_char FIPS_rodata_end[];
26 extern const void *FIPS_text_start();
27 extern const void *FIPS_text_end();
28
29 /**
30 * Described in header
31 */
32 bool fips_compute_hmac_signature(const char *key, char *signature)
33 {
34 u_char *text_start = (u_char *)FIPS_text_start();
35 u_char *text_end = (u_char *)FIPS_text_end();
36 size_t text_len, rodata_len;
37 signer_t *signer;
38
39 if (text_start > text_end)
40 {
41 DBG1(" TEXT start (%p) > TEXT end (%p",
42 text_start, text_end);
43 return FALSE;
44 }
45 text_len = text_end - text_start;
46 DBG1(" TEXT: %p + %6d = %p",
47 text_start, (int)text_len, text_end);
48
49 if (FIPS_rodata_start > FIPS_rodata_end)
50 {
51 DBG1(" RODATA start (%p) > RODATA end (%p",
52 FIPS_rodata_start, FIPS_rodata_end);
53 return FALSE;
54 }
55 rodata_len = FIPS_rodata_end - FIPS_rodata_start;
56 DBG1(" RODATA: %p + %6d = %p",
57 FIPS_rodata_start, (int)rodata_len, FIPS_rodata_end);
58
59 signer = (signer_t *)hmac_signer_create(HASH_SHA1, HASH_SIZE_SHA1);
60 if (signer == NULL)
61 {
62 DBG1(" SHA-1 HMAC signer could not be created");
63 return FALSE;
64 }
65 else
66 {
67 chunk_t hmac_key = { key, strlen(key) };
68 chunk_t text_chunk = { text_start, text_len };
69 chunk_t rodata_chunk = { (u_char *)FIPS_rodata_start, rodata_len };
70 chunk_t signature_chunk = chunk_empty;
71
72 signer->set_key(signer, hmac_key);
73 signer->allocate_signature(signer, text_chunk, NULL);
74 signer->allocate_signature(signer, rodata_chunk, &signature_chunk);
75 signer->destroy(signer);
76
77 sprintf(signature, "%#B", &signature_chunk);
78 DBG1(" SHA-1 HMAC key: %s", key);
79 DBG1(" SHA-1 HMAC sig: %s", signature);
80 free(signature_chunk.ptr);
81 return TRUE;
82 }
83 }
84
85 /**
86 * Described in header
87 */
88 bool fips_verify_hmac_signature(const char *key,
89 const char *signature)
90 {
91 char current_signature[BUF_LEN];
92
93 if (!fips_compute_hmac_signature(key, current_signature))
94 {
95 return FALSE;
96 }
97 return streq(signature, current_signature);
98 }