Hi,
I executed the fipstest with HASH DRBG for SHA-256, as in the
drbgtestvectors list from NIST (Please see below link). The returned bits are
not matching the NIST expected bits. Please see the request file below and let
me know if there are any other request files/settings specific to NSS that I am
missing.
http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgtestvectors.zip
Request File:
# CAVS 11.1
# DRBG800-90 information for "drbg_values"
# Generated on Fri May 20 11:16:40 2011
# Hash_DRBG options: SHA-1 :: SHA-224 :: SHA-256 :: SHA-384 :: SHA-512
[SHA-256]
[PredictionResistance = True]
[EntropyInputLen = 256]
[NonceLen = 128]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 0]
COUNT = 0
EntropyInput = 0dc8e193bfac4bd7467c5540a2f3bb2033abf037344cb77d76f4ff335fe8032b
Nonce = cc0678c49c3e51d03b5942d08b1d056a
PersonalizationString =
AdditionalInput =
EntropyInputPR =
e4685b570f4fd1cb024345cdd124e7b3573819175d77aec1f01865d9fe5aa14d
INTERMEDIATE V =
f28c40afeefba0a355021f94c03143b114ee3f071dd5d6125cc87eeec61141b2aaba2a7292e6260651b47566fefe1e74f90313095b89ab
INTERMEDIATE C =
17c52bcee7625a79b91592742a19e6a723321f27e565ceeb200cf7a38c16417d57be17fb938752dfa0d126f77a4473d04f614b779cb7d0
INTERMEDIATE ReturnedBits =
dd365ad95881ec1a9b8092fec9649aa32ec509f1582bafa8da84a5e52f591a55
AdditionalInput =
EntropyInputPR =
81d0bab3ee9043cae5708beb6ad46bb5c3b33746b68815cc04779f4f25bdbbbc
ReturnedBits = ec0efb7e001817cca4089f660c1f22de57be9a32eda0df8764aed4c746ff1ba0
Error Message:
[root@datapath_dev2 fipstest]# sh rng.sh
SHA256_DRBG.req SHA256_DRBG.rsp
fipstest: /usr/lib/xulrunner-1.9.2/libsqlite3.so: no version information
available (required by fipstest)
Generate failed:
predicted=ec0efb7e001817cca4089f660c1f22de57be9a32eda0df8764aed4c746ff1ba0
actual = b916aaa5b91579e206c427159c726aec147d73ab62f5c3265307f9a88f13c71e
Rgds
Shruthi
-----Original Message-----
From: dev-tech-crypto-bounces+svasantharangan=idirect....@lists.mozilla.org
[mailto:dev-tech-crypto-bounces+svasantharangan=idirect....@lists.mozilla.org]
On Behalf Of Vasantharangan, Shruthi M.
Sent: Wednesday, 25 July, 2012 5:32 PM
To: dev-tech-crypto@lists.mozilla.org
Subject: RE: RandomNumberGenerator that is FIPS2complaint
Hi,
How can run drbg test vectors provided by NIST to validate the response of
the random output for the various algorithms on NSS.
Rgds
Shruthi
From: Vasantharangan, Shruthi M.
Sent: Wednesday, 25 July, 2012 5:01 PM
To: dev-tech-crypto@lists.mozilla.org<mailto:dev-tech-crypto@lists.mozilla.org>
Subject: RandomNumberGenerator that is FIPS2complaint
HI,
I am using the NSS Cryptographic Module document to use the random number
generator for FIPS2 random number. If I use the FC_GetFunctionList fpr
PK11_GenerateRandom and initialise with slotid as 0, then is the Mode set to
FIPS level2 ?
NSS Cryptographic Module
Version 3.11.4
FIPS 140-2 Non-Proprietary Security Policy Level 1 and 2 Validation
Thanks for your help
Shruthi
From: Vasantharangan, Shruthi M.
Sent: Tuesday, 24 July, 2012 2:20 PM
To:
dev-tech-crypto@lists.mozilla.org<mailto:dev-tech-crypto@lists.mozilla.org<mailto:dev-tech-crypto@lists.mozilla.org%3cmailto:dev-tech-crypto@lists.mozilla.org>>
Subject: RandomNumberGenerator that is FIPS2complaint
Hi,
We require a random number generator that's FIPS2 complaint on RedHat Linux
5.6.
In the linux rpm for NSS nss-3.12.8-1.el5. I find random generation api's in
pkcs11f.h.
If I use them can I be sure that the random data generated is FIPS2 complaint?
What is the api to set NSS in FIPS Mode?
pk11pub.h:SECStatus PK11_GenerateRandom(unsigned char *data,int len);
Rgds
Shruthi
_____________________________________________________
This electronic message and any files transmitted with it contains information
from iDirect, which may be privileged, proprietary and/or confidential. It is
intended solely for the use of the individual or entity to whom they are
addressed. If you are not the original recipient or the person responsible for
delivering the email to the intended recipient, be advised that you have
received this email in error, and that any use, dissemination, forwarding,
printing, or copying of this email is strictly prohibited. If you received this
email in error, please delete it and immediately notify the sender.
_____________________________________________________
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org<mailto:dev-tech-crypto@lists.mozilla.org>
https://lists.mozilla.org/listinfo/dev-tech-crypto
_____________________________________________________
This electronic message and any files transmitted with it contains
information from iDirect, which may be privileged, proprietary
and/or confidential. It is intended solely for the use of the individual
or entity to whom they are addressed. If you are not the original
recipient or the person responsible for delivering the email to the
intended recipient, be advised that you have received this email
in error, and that any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited. If you received this email
in error, please delete it and immediately notify the sender.
_____________________________________________________
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
