[v1,2/2] examples/fips_validation: add ECDSA validation

  This patch adds support in fips_validation app to validate ECDSA.

Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
---
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  27 ++
 .../fips_validation/fips_validation_ecdsa.c   | 431 ++++++++++++++++++
 examples/fips_validation/main.c               | 210 ++++++++-
 examples/fips_validation/meson.build          |   1 +
 6 files changed, 669 insertions(+), 3 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_ecdsa.c
  

Hi Brian,
> Subject: [v1 2/2] examples/fips_validation: add ECDSA validation
> 
> This patch adds support in fips_validation app to validate ECDSA.
> 
> Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> ---
Can you review this and ack?
  

> -----Original Message-----
> From: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> Sent: Tuesday, September 27, 2022 8:31 AM
> To: dev@dpdk.org
> Cc: Anoob Joseph <anoobj@marvell.com>; Zhang, Roy Fan
> <roy.fan.zhang@intel.com>; Dooley, Brian <brian.dooley@intel.com>; Akhil
> Goyal <gakhil@marvell.com>; jerinj@marvell.com; Gowrishankar
> Muthukrishnan <gmuthukrishn@marvell.com>
> Subject: [v1 2/2] examples/fips_validation: add ECDSA validation
> 
> This patch adds support in fips_validation app to validate ECDSA.
> 
> Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> ---
>  doc/guides/sample_app_ug/fips_validation.rst  |   1 +
>  examples/fips_validation/fips_validation.c    |   2 +
>  examples/fips_validation/fips_validation.h    |  27 ++
>  .../fips_validation/fips_validation_ecdsa.c   | 431 ++++++++++++++++++
>  examples/fips_validation/main.c               | 210 ++++++++-
>  examples/fips_validation/meson.build          |   1 +
>  6 files changed, 669 insertions(+), 3 deletions(-)  create mode 100644
> examples/fips_validation/fips_validation_ecdsa.c
> 
> diff --git a/doc/guides/sample_app_ug/fips_validation.rst
> b/doc/guides/sample_app_ug/fips_validation.rst
> index 5e9ad2d006..3a2357eaa9 100644
> --- a/doc/guides/sample_app_ug/fips_validation.rst
> +++ b/doc/guides/sample_app_ug/fips_validation.rst
> @@ -67,6 +67,7 @@ ACVP
>      * TDES-CBC - AFT, MCT
>      * TDES-ECB - AFT, MCT
>      * RSA
> +    * ECDSA
> 
> 
>  Application Information
> diff --git a/examples/fips_validation/fips_validation.c
> b/examples/fips_validation/fips_validation.c
> index 5d485a2bd5..55f68a7ae0 100644
> --- a/examples/fips_validation/fips_validation.c
> +++ b/examples/fips_validation/fips_validation.c
> @@ -473,6 +473,8 @@ fips_test_parse_one_json_vector_set(void)
>  		info.algo = FIPS_TEST_ALGO_TDES;
>  	else if (strstr(algo_str, "RSA"))
>  		info.algo = FIPS_TEST_ALGO_RSA;
> +	else if (strstr(algo_str, "ECDSA"))
> +		info.algo = FIPS_TEST_ALGO_ECDSA;
>  	else
>  		return -EINVAL;
> 
> diff --git a/examples/fips_validation/fips_validation.h
> b/examples/fips_validation/fips_validation.h
> index 7cbbc1f084..f9dfbecd5d 100644
> --- a/examples/fips_validation/fips_validation.h
> +++ b/examples/fips_validation/fips_validation.h
> @@ -43,6 +43,7 @@ enum fips_test_algorithms {
>  		FIPS_TEST_ALGO_TDES,
>  		FIPS_TEST_ALGO_SHA,
>  		FIPS_TEST_ALGO_RSA,
> +		FIPS_TEST_ALGO_ECDSA,
>  		FIPS_TEST_ALGO_MAX
>  };
> 
> @@ -94,6 +95,15 @@ struct fips_test_vector {
>  		struct fips_val dq;
>  		struct fips_val qinv;
>  	} rsa;
> +	struct {
> +		struct fips_val seed;
> +		struct fips_val pkey;
> +		struct fips_val qx;
> +		struct fips_val qy;
> +		struct fips_val r;
> +		struct fips_val s;
> +		struct fips_val k;
> +	} ecdsa;
> 
>  	struct fips_val pt;
>  	struct fips_val ct;
> @@ -159,6 +169,10 @@ enum fips_rsa_test_types {
>  	RSA_KAT
>  };
> 
> +enum fips_ecdsa_test_types {
> +	ECDSA_AFT = 0,
> +};
> +
>  struct aesavs_interim_data {
>  	enum fips_aesavs_test_types test_type;
>  	uint32_t cipher_algo;
> @@ -213,6 +227,14 @@ struct rsa_interim_data {
>  	uint8_t random_msg;
>  };
> 
> +struct ecdsa_interim_data {
> +	enum rte_crypto_auth_algorithm auth;
> +	enum rte_crypto_curve_id curve_id;
> +	u_int8_t curve_len;
> +	uint8_t random_msg;
> +	uint8_t pubkey_gen;
> +};
> +
>  #ifdef USE_JANSSON
>  /*
>   * Maximum length of buffer to hold any json string.
> @@ -259,6 +281,7 @@ struct fips_test_interim_info {
>  		struct gcm_interim_data gcm_data;
>  		struct xts_interim_data xts_data;
>  		struct rsa_interim_data rsa_data;
> +		struct ecdsa_interim_data ecdsa_data;
>  	} interim_info;
> 
>  	enum fips_test_op op;
> @@ -268,6 +291,7 @@ struct fips_test_interim_info {
>  	const struct fips_test_callback *writeback_callbacks;
> 
>  	post_prcess_t parse_interim_writeback;
> +	post_prcess_t post_interim_writeback;
>  	post_prcess_t parse_writeback;
>  	post_prcess_t kat_check;
>  };
> @@ -338,6 +362,9 @@ parse_test_tdes_json_init(void);  int
> parse_test_rsa_json_init(void);
> 
> +int
> +parse_test_ecdsa_json_init(void);
> +
>  int
>  fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
> #endif /* USE_JANSSON */ diff --git
> a/examples/fips_validation/fips_validation_ecdsa.c
> b/examples/fips_validation/fips_validation_ecdsa.c
> new file mode 100644
> index 0000000000..2bac348052
> --- /dev/null
> +++ b/examples/fips_validation/fips_validation_ecdsa.c
> @@ -0,0 +1,431 @@
> +/* SPDX-License-Identifier: BSD-3-Clause
> + * Copyright(C) 2022 Marvell.
> + */
> +
> +#include <string.h>
> +#include <time.h>
> +#include <stdio.h>
> +#include <sys/random.h>
> +#include <sys/types.h>
> +#include <unistd.h>
> +
> +#ifdef USE_OPENSSL
> +#include <openssl/bn.h>
> +#include <openssl/rand.h>
> +#endif /* USE_OPENSSL */
> +
> +#include <rte_cryptodev.h>
> +#include <rte_malloc.h>
> +
> +#include "fips_validation.h"
> +
> +#define CONFORMANCE_JSON_STR	"conformance"
> +#define TESTTYPE_JSON_STR	"testType"
> +#define CURVE_JSON_STR	"curve"
> +#define HASH_JSON_STR	"hashAlg"
> +#define RV_JSON_STR	"randomValue"
> +
> +#define MSG_JSON_STR	"message"
> +#define QX_JSON_STR	"qx"
> +#define QY_JSON_STR	"qy"
> +#define R_JSON_STR	"r"
> +#define S_JSON_STR	"s"
> +
> +#define RV_BUF_LEN (1024/8)
> +#define RV_BIT_LEN (256)
> +
> +#ifdef USE_JANSSON
> +struct {
> +	uint8_t type;
> +	const char *desc;
> +} ecdsa_test_types[] = {
> +		{ECDSA_AFT, "AFT"}
> +};
> +
> +struct {
> +	enum rte_crypto_auth_algorithm auth;
> +	const char *desc;
> +} ecdsa_auth_algs[] = {
> +		{RTE_CRYPTO_AUTH_SHA1, "SHA-1"},
> +		{RTE_CRYPTO_AUTH_SHA224, "SHA2-224"},
> +		{RTE_CRYPTO_AUTH_SHA256, "SHA2-256"},
> +		{RTE_CRYPTO_AUTH_SHA384, "SHA2-384"},
> +		{RTE_CRYPTO_AUTH_SHA512, "SHA2-512"}, };
> +
> +struct {
> +	enum rte_crypto_curve_id curve_id;
> +	const char *desc;
> +} ecdsa_curve_ids[] = {
> +	{RTE_CRYPTO_EC_GROUP_SECP192R1, "P-192"},
> +	{RTE_CRYPTO_EC_GROUP_SECP224R1, "P-224"},
> +	{RTE_CRYPTO_EC_GROUP_SECP256R1, "P-256"},
> +	{RTE_CRYPTO_EC_GROUP_SECP384R1, "P-384"},
> +	{RTE_CRYPTO_EC_GROUP_SECP521R1, "P-521"}, };
> +
> +struct {
> +	uint8_t curve_len;
> +	const char *desc;
> +} ecdsa_curve_len[] = {
> +	{24, "P-192"},
> +	{28, "P-224"},
> +	{32, "P-256"},
> +	{48, "P-384"},
> +	{66, "P-521"},
> +};
> +
> +#ifdef USE_OPENSSL
> +#define MAX_TRIES 10
> +static int
> +prepare_vec_ecdsa(void)
> +{
> +	BIGNUM *pkey = NULL, *order = NULL, *r = NULL;
> +	int ret = -1, j;
> +	unsigned long pid;
> +
> +	/* For ECDSA prime fields, order of base points.
> +	 * Below string array is indexed by starting with first supported
> +	 * curve (SECP-192R1).
> +	 */
> +	static const char * const orderstr[] = {
> +
> 	"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
> +			"",
> +
> 	"FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
> +			"",
> +
> 	"FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2F
> C632551",
> +
> 	"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F43
> 72DDF581A0DB248B0A77AECEC196ACCC52973",
> +
> 	"1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
> FFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E
> 91386409"
> +	};
> +
> +	/* Seed PRNG */
> +	if (vec.ecdsa.seed.val) {
> +		writeback_hex_str("", info.one_line_text, &vec.ecdsa.seed);
> +		RAND_seed((char *)info.one_line_text,
> strlen(info.one_line_text));
> +	} else {
> +		pid = getpid();
> +		RAND_seed(&pid, sizeof(pid));
> +	}
> +
> +	if (!RAND_status())
> +		return -1;
> +
> +	order = BN_new();
> +	if (!order)
> +		goto err;
> +
> +	j = info.interim_info.ecdsa_data.curve_id -
> RTE_CRYPTO_EC_GROUP_SECP192R1;
> +	if (!BN_hex2bn(&order, orderstr[j]))
> +		goto err;
> +
> +	pkey = BN_new();
> +	if (!pkey)
> +		goto err;
> +
> +	for (j = 0; j < MAX_TRIES; j++) {
> +		/* pkey should be in [1, order - 1] */
> +		if (!BN_rand_range(pkey, order))
> +			goto err;
> +
> +		if (!BN_is_zero(pkey))
> +			break;
> +	}
> +
> +	if (j == MAX_TRIES)
> +		goto err;
> +
> +	parse_uint8_hex_str("", BN_bn2hex(pkey), &vec.ecdsa.pkey);
> +
> +	r = BN_new();
> +	if (!r)
> +		goto err;
> +
> +	if (info.interim_info.ecdsa_data.random_msg) {
> +		if (!BN_rand(r, RV_BIT_LEN, 0, 0))
> +			goto err;
> +
> +		parse_uint8_hex_str("", BN_bn2hex(r), &vec.ecdsa.seed);
> +	}
> +
> +	ret = 0;
> +err:
> +	BN_free(order);
> +	BN_free(pkey);
> +	BN_free(r);
> +	return ret;
> +}
> +
> +static int
> +prepare_vec_ecdsa_k(void)
> +{
> +	BIGNUM *pkey = NULL, *k = NULL;
> +	int ret = -1;
> +
> +	if (!vec.ecdsa.pkey.len)
> +		return -1;
> +
> +	pkey = BN_new();
> +	if (!pkey)
> +		goto err;
> +
> +	writeback_hex_str("", info.one_line_text, &vec.ecdsa.pkey);
> +	ret = BN_hex2bn(&pkey, info.one_line_text);
> +	if ((uint32_t)ret != strlen(info.one_line_text))
> +		goto err;
> +
> +	k = BN_new();
> +	if (!k)
> +		goto err;
> +
> +	if (!BN_sub(k, pkey, BN_value_one()))
> +		goto err;
> +
> +	if (BN_is_zero(pkey)) {
> +		if (!BN_add(k, pkey, BN_value_one()))
> +			goto err;
> +	}
> +
> +	parse_uint8_hex_str("", BN_bn2hex(k), &vec.ecdsa.k);
> +	ret = 0;
> +err:
> +	BN_free(pkey);
> +	BN_free(k);
> +	return ret;
> +}
> +
> +#else
> +static int
> +prepare_vec_ecdsa(void)
> +{
> +	/*
> +	 * Generate ECDSA values.
> +	 */
> +	return -ENOTSUP;
> +}
> +
> +static int
> +prepare_vec_ecdsa_k(void)
> +{
> +	/*
> +	 * Generate ECDSA values.
> +	 */
> +	return -ENOTSUP;
> +}
> +#endif /* USE_OPENSSL */
> +
> +static int
> +parse_test_ecdsa_json_interim_writeback(struct fips_val *val) {
> +	RTE_SET_USED(val);
> +
> +	if (info.interim_info.ecdsa_data.random_msg) {
> +		json_object_set_new(json_info.json_write_group,
> "conformance",
> +							json_string("SP800-
> 106"));
> +	}
> +
> +	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
> +		/* For siggen tests, ECDSA values can be created soon after
> +		 * the test group data are parsed.
> +		 */
> +		if (vec.ecdsa.pkey.val) {
> +			rte_free(vec.ecdsa.pkey.val);
> +			vec.ecdsa.pkey.val = NULL;
> +		}
> +
> +		if (prepare_vec_ecdsa() < 0)
> +			return -1;
> +
> +		info.interim_info.ecdsa_data.pubkey_gen = 1;
> +	}
> +
> +	return 0;
> +}
> +
> +static int
> +post_test_ecdsa_json_interim_writeback(struct fips_val *val) {
> +	RTE_SET_USED(val);
> +
> +	if (info.op == FIPS_TEST_ASYM_KEYGEN) {
> +		json_t *obj;
> +
> +		writeback_hex_str("", info.one_line_text, &vec.ecdsa.qx);
> +		obj = json_string(info.one_line_text);
> +		json_object_set_new(json_info.json_write_group, "qx",
> obj);
> +
> +		writeback_hex_str("", info.one_line_text, &vec.ecdsa.qy);
> +		obj = json_string(info.one_line_text);
> +		json_object_set_new(json_info.json_write_group, "qy",
> obj);
> +	}
> +
> +	return 0;
> +}
> +
> +static int
> +parse_test_ecdsa_json_writeback(struct fips_val *val) {
> +	json_t *tcId;
> +
> +	RTE_SET_USED(val);
> +
> +	tcId = json_object_get(json_info.json_test_case, "tcId");
> +
> +	json_info.json_write_case = json_object();
> +	json_object_set(json_info.json_write_case, "tcId", tcId);
> +
> +	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
> +		json_t *obj;
> +
> +		writeback_hex_str("", info.one_line_text, &vec.ecdsa.r);
> +		obj = json_string(info.one_line_text);
> +		json_object_set_new(json_info.json_write_case, "r", obj);
> +
> +		writeback_hex_str("", info.one_line_text, &vec.ecdsa.s);
> +		obj = json_string(info.one_line_text);
> +		json_object_set_new(json_info.json_write_case, "s", obj);
> +
> +		if (info.interim_info.ecdsa_data.random_msg) {
> +			writeback_hex_str("", info.one_line_text,
> &vec.ecdsa.seed);
> +			obj = json_string(info.one_line_text);
> +			json_object_set_new(json_info.json_write_case,
> "randomValue", obj);
> +			json_object_set_new(json_info.json_write_case,
> "randomValueLen",
> +				json_integer(vec.ecdsa.seed.len * 8));
> +		}
> +	} else if (info.op == FIPS_TEST_ASYM_SIGVER) {
> +		if (vec.status == RTE_CRYPTO_OP_STATUS_SUCCESS)
> +			json_object_set_new(json_info.json_write_case,
> "testPassed", json_true());
> +		else
> +			json_object_set_new(json_info.json_write_case,
> "testPassed", json_false());
> +	}
> +
> +	return 0;
> +}
> +
> +static int
> +parse_interim_str(const char *key, char *src, struct fips_val *val) {
> +	uint32_t i;
> +
> +	RTE_SET_USED(val);
> +
> +	if (strcmp(key, TESTTYPE_JSON_STR) == 0) {
> +		for (i = 0; i < RTE_DIM(ecdsa_test_types); i++)
> +			if (strstr(src, ecdsa_test_types[i].desc)) {
> +				info.parse_writeback =
> parse_test_ecdsa_json_writeback;
> +				break;
> +			}
> +
> +		if (!info.parse_writeback || i >=
> RTE_DIM(ecdsa_test_types))
> +			return -EINVAL;
> +
> +	} else if (strcmp(key, CURVE_JSON_STR) == 0) {
> +		for (i = 0; i < RTE_DIM(ecdsa_curve_ids); i++)
> +			if (strstr(src, ecdsa_curve_ids[i].desc)) {
> +				info.interim_info.ecdsa_data.curve_id =
> ecdsa_curve_ids[i].curve_id;
> +				info.interim_info.ecdsa_data.curve_len =
> +					ecdsa_curve_len[i].curve_len;
> +				break;
> +			}
> +
> +		if (i >= RTE_DIM(ecdsa_curve_ids))
> +			return -EINVAL;
> +	} else if (strcmp(key, HASH_JSON_STR) == 0) {
> +		for (i = 0; i < RTE_DIM(ecdsa_auth_algs); i++)
> +			if (strstr(src, ecdsa_auth_algs[i].desc)) {
> +				info.interim_info.ecdsa_data.auth =
> ecdsa_auth_algs[i].auth;
> +				break;
> +			}
> +
> +		if (i >= RTE_DIM(ecdsa_auth_algs))
> +			return -EINVAL;
> +	} else if (strcmp(key, CONFORMANCE_JSON_STR) == 0) {
> +		info.interim_info.ecdsa_data.random_msg = 1;
> +	} else {
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}
> +
> +static int
> +parse_siggen_message_str(const char *key, char *src, struct fips_val
> +*val) {
> +	int ret = 0;
> +
> +	parse_uint8_hex_str(key, src, val);
> +	if (info.interim_info.ecdsa_data.random_msg) {
> +		ret = fips_test_randomize_message(val, &vec.ecdsa.seed);
> +		if (ret < 0)
> +			return ret;
> +	}
> +
> +	if (vec.ecdsa.k.val) {
> +		rte_free(vec.ecdsa.k.val);
> +		vec.ecdsa.k.val = NULL;
> +	}
> +
> +	ret = prepare_vec_ecdsa_k();
> +	return ret;
> +}
> +
> +static int
> +parse_sigver_randomvalue_str(const char *key, char *src, struct
> +fips_val *val) {
> +	int ret = 0;
> +
> +	parse_uint8_hex_str(key, src, val);
> +	if (info.interim_info.ecdsa_data.random_msg)
> +		ret = fips_test_randomize_message(&vec.pt, val);
> +
> +	return ret;
> +}
> +
> +struct fips_test_callback ecdsa_interim_json_vectors[] = {
> +		{TESTTYPE_JSON_STR, parse_interim_str, NULL},
> +		{CURVE_JSON_STR, parse_interim_str, NULL},
> +		{HASH_JSON_STR, parse_interim_str, NULL},
> +		{CONFORMANCE_JSON_STR, parse_interim_str, NULL},
> +		{NULL, NULL, NULL} /**< end pointer */ };
> +
> +struct fips_test_callback ecdsa_siggen_json_vectors[] = {
> +		{MSG_JSON_STR, parse_siggen_message_str, &vec.pt},
> +		{NULL, NULL, NULL} /**< end pointer */ };
> +
> +struct fips_test_callback ecdsa_sigver_json_vectors[] = {
> +		{MSG_JSON_STR, parse_uint8_hex_str, &vec.pt},
> +		{QX_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.qx},
> +		{QY_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.qy},
> +		{R_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.r},
> +		{S_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.s},
> +		{RV_JSON_STR, parse_sigver_randomvalue_str,
> &vec.ecdsa.seed},
> +		{NULL, NULL, NULL} /**< end pointer */ };
> +
> +int
> +parse_test_ecdsa_json_init(void)
> +{
> +	json_t *mode_obj = json_object_get(json_info.json_vector_set,
> "mode");
> +	const char *mode_str = json_string_value(mode_obj);
> +
> +	info.callbacks = NULL;
> +	info.parse_writeback = NULL;
> +	info.interim_info.ecdsa_data.random_msg = 0;
> +
> +	info.interim_callbacks = ecdsa_interim_json_vectors;
> +	info.post_interim_writeback =
> post_test_ecdsa_json_interim_writeback;
> +	info.parse_interim_writeback =
> parse_test_ecdsa_json_interim_writeback;
> +	if (strcmp(mode_str, "sigGen") == 0) {
> +		info.op = FIPS_TEST_ASYM_SIGGEN;
> +		info.callbacks = ecdsa_siggen_json_vectors;
> +	} else if (strcmp(mode_str, "sigVer") == 0) {
> +		info.op = FIPS_TEST_ASYM_SIGVER;
> +		info.callbacks = ecdsa_sigver_json_vectors;
> +	} else {
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}
> +#endif /* USE_JANSSON */
> diff --git a/examples/fips_validation/main.c
> b/examples/fips_validation/main.c index cfa01eae20..b4cb10a106 100644
> --- a/examples/fips_validation/main.c
> +++ b/examples/fips_validation/main.c
> @@ -977,6 +977,103 @@ prepare_rsa_op(void)
>  	return 0;
>  }
> 
> +static int
> +prepare_ecdsa_op(void)
> +{
> +	struct rte_crypto_asym_op *asym;
> +	struct fips_val msg;
> +
> +	__rte_crypto_op_reset(env.op,
> RTE_CRYPTO_OP_TYPE_ASYMMETRIC);
> +
> +	asym = env.op->asym;
> +	if (env.digest) {
> +		msg.val = env.digest;
> +		msg.len = env.digest_len;
> +	} else {
> +		msg.val = vec.pt.val;
> +		msg.len = vec.pt.len;
> +	}
> +
> +	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
> +		asym->ecdsa.op_type = RTE_CRYPTO_ASYM_OP_SIGN;
> +		asym->ecdsa.message.data = msg.val;
> +		asym->ecdsa.message.length = msg.len;
> +		asym->ecdsa.pkey.data = vec.ecdsa.pkey.val;
> +		asym->ecdsa.pkey.length = vec.ecdsa.pkey.len;
> +		asym->ecdsa.k.data = vec.ecdsa.k.val;
> +		asym->ecdsa.k.length = vec.ecdsa.k.len;
> +
> +		if (vec.ecdsa.r.val)
> +			rte_free(vec.ecdsa.r.val);
> +
> +		if (vec.ecdsa.s.val)
> +			rte_free(vec.ecdsa.s.val);
> +
> +		vec.ecdsa.r.len = info.interim_info.ecdsa_data.curve_len;
> +		vec.ecdsa.r.val = rte_zmalloc(NULL, vec.ecdsa.r.len, 0);
> +
> +		vec.ecdsa.s.len = vec.ecdsa.r.len;
> +		vec.ecdsa.s.val = rte_zmalloc(NULL, vec.ecdsa.s.len, 0);
> +
> +		asym->ecdsa.r.data = vec.ecdsa.r.val;
> +		asym->ecdsa.r.length = 0;
> +		asym->ecdsa.s.data = vec.ecdsa.s.val;
> +		asym->ecdsa.s.length = 0;
> +	} else if (info.op == FIPS_TEST_ASYM_SIGVER) {
> +		asym->ecdsa.op_type = RTE_CRYPTO_ASYM_OP_VERIFY;
> +		asym->ecdsa.message.data = msg.val;
> +		asym->ecdsa.message.length = msg.len;
> +		asym->ecdsa.q.x.data = vec.ecdsa.qx.val;
> +		asym->ecdsa.q.x.length = vec.ecdsa.qx.len;
> +		asym->ecdsa.q.y.data = vec.ecdsa.qy.val;
> +		asym->ecdsa.q.y.length = vec.ecdsa.qy.len;
> +		asym->ecdsa.r.data = vec.ecdsa.r.val;
> +		asym->ecdsa.r.length = vec.ecdsa.r.len;
> +		asym->ecdsa.s.data = vec.ecdsa.s.val;
> +		asym->ecdsa.s.length = vec.ecdsa.s.len;
> +	} else {
> +		RTE_LOG(ERR, USER1, "Invalid op %d\n", info.op);
> +		return -EINVAL;
> +	}
> +
> +	rte_crypto_op_attach_asym_session(env.op, env.asym.sess);
> +
> +	return 0;
> +}
> +
> +static int
> +prepare_ecfpm_op(void)
> +{
> +	struct rte_crypto_asym_op *asym;
> +
> +	__rte_crypto_op_reset(env.op,
> RTE_CRYPTO_OP_TYPE_ASYMMETRIC);
> +
> +	asym = env.op->asym;
> +	asym->ecpm.scalar.data = vec.ecdsa.pkey.val;
> +	asym->ecpm.scalar.length = vec.ecdsa.pkey.len;
> +
> +	if (vec.ecdsa.qx.val)
> +		rte_free(vec.ecdsa.qx.val);
> +
> +	if (vec.ecdsa.qy.val)
> +		rte_free(vec.ecdsa.qy.val);
> +
> +	vec.ecdsa.qx.len = info.interim_info.ecdsa_data.curve_len;
> +	vec.ecdsa.qx.val = rte_zmalloc(NULL, vec.ecdsa.qx.len, 0);
> +
> +	vec.ecdsa.qy.len = vec.ecdsa.qx.len;
> +	vec.ecdsa.qy.val = rte_zmalloc(NULL, vec.ecdsa.qy.len, 0);
> +
> +	asym->ecpm.r.x.data = vec.ecdsa.qx.val;
> +	asym->ecpm.r.x.length = 0;
> +	asym->ecpm.r.y.data = vec.ecdsa.qy.val;
> +	asym->ecpm.r.y.length = 0;
> +
> +	rte_crypto_op_attach_asym_session(env.op, env.asym.sess);
> +
> +	return 0;
> +}
> +
>  static int
>  prepare_aes_xform(struct rte_crypto_sym_xform *xform)  { @@ -1441,6
> +1538,69 @@ prepare_rsa_xform(struct rte_crypto_asym_xform *xform)
>  	return 0;
>  }
> 
> +static int
> +prepare_ecdsa_xform(struct rte_crypto_asym_xform *xform) {
> +	const struct rte_cryptodev_asymmetric_xform_capability *cap;
> +	struct rte_cryptodev_asym_capability_idx cap_idx;
> +
> +	xform->xform_type = RTE_CRYPTO_ASYM_XFORM_ECDSA;
> +	xform->next = NULL;
> +
> +	cap_idx.type = xform->xform_type;
> +	cap = rte_cryptodev_asym_capability_get(env.dev_id, &cap_idx);
> +	if (!cap) {
> +		RTE_LOG(ERR, USER1, "Failed to get capability for cdev
> %u\n",
> +				env.dev_id);
> +		return -EINVAL;
> +	}
> +
> +	switch (info.op) {
> +	case FIPS_TEST_ASYM_SIGGEN:
> +		if
> (!rte_cryptodev_asym_xform_capability_check_optype(cap,
> +			RTE_CRYPTO_ASYM_OP_SIGN)) {
> +			RTE_LOG(ERR, USER1, "PMD %s xform_op %u\n",
> +				info.device_name,
> RTE_CRYPTO_ASYM_OP_SIGN);
> +			return -EPERM;
> +		}
> +		break;
> +	case FIPS_TEST_ASYM_SIGVER:
> +		if
> (!rte_cryptodev_asym_xform_capability_check_optype(cap,
> +			RTE_CRYPTO_ASYM_OP_VERIFY)) {
> +			RTE_LOG(ERR, USER1, "PMD %s xform_op %u\n",
> +				info.device_name,
> RTE_CRYPTO_ASYM_OP_VERIFY);
> +			return -EPERM;
> +		}
> +		break;
> +	default:
> +		break;
> +	}
> +
> +	xform->ec.curve_id = info.interim_info.ecdsa_data.curve_id;
> +	return 0;
> +}
> +
> +static int
> +prepare_ecfpm_xform(struct rte_crypto_asym_xform *xform) {
> +	const struct rte_cryptodev_asymmetric_xform_capability *cap;
> +	struct rte_cryptodev_asym_capability_idx cap_idx;
> +
> +	xform->xform_type = RTE_CRYPTO_ASYM_XFORM_ECFPM;
> +	xform->next = NULL;
> +
> +	cap_idx.type = xform->xform_type;
> +	cap = rte_cryptodev_asym_capability_get(env.dev_id, &cap_idx);
> +	if (!cap) {
> +		RTE_LOG(ERR, USER1, "Failed to get capability for cdev
> %u\n",
> +				env.dev_id);
> +		return -EINVAL;
> +	}
> +
> +	xform->ec.curve_id = info.interim_info.ecdsa_data.curve_id;
> +	return 0;
> +}
> +
>  static int
>  get_writeback_data(struct fips_val *val)  { @@ -1546,7 +1706,7 @@
> fips_run_asym_test(void)
>  	struct rte_crypto_op *deqd_op;
>  	int ret;
> 
> -	if (info.op == FIPS_TEST_ASYM_KEYGEN) {
> +	if (info.op == FIPS_TEST_ASYM_KEYGEN && info.algo !=
> +FIPS_TEST_ALGO_ECDSA) {
>  		RTE_SET_USED(asym);
>  		ret = 0;
>  		goto exit;
> @@ -1606,7 +1766,33 @@ fips_run_test(void)
>  	}
> 
>  	env.op = env.asym.op;
> -	return fips_run_asym_test();
> +	if (info.op == FIPS_TEST_ASYM_SIGGEN &&
> +		info.algo == FIPS_TEST_ALGO_ECDSA &&
> +		info.interim_info.ecdsa_data.pubkey_gen == 1) {
> +		fips_prepare_asym_xform_t ecdsa_xform;
> +		fips_prepare_op_t ecdsa_op;
> +
> +		ecdsa_xform = test_ops.prepare_asym_xform;
> +		ecdsa_op = test_ops.prepare_asym_op;
> +		info.op = FIPS_TEST_ASYM_KEYGEN;
> +		test_ops.prepare_asym_xform = prepare_ecfpm_xform;
> +		test_ops.prepare_asym_op = prepare_ecfpm_op;
> +		ret = fips_run_asym_test();
> +		if (ret < 0)
> +			return ret;
> +
> +		info.post_interim_writeback(NULL);
> +		info.interim_info.ecdsa_data.pubkey_gen = 0;
> +
> +		test_ops.prepare_asym_xform = ecdsa_xform;
> +		test_ops.prepare_asym_op = ecdsa_op;
> +		info.op = FIPS_TEST_ASYM_SIGGEN;
> +		ret = fips_run_asym_test();
> +	} else {
> +		ret = fips_run_asym_test();
> +	}
> +
> +	return ret;
>  }
> 
>  static int
> @@ -2235,6 +2421,17 @@ init_test_ops(void)
>  		test_ops.prepare_asym_xform = prepare_rsa_xform;
>  		test_ops.test = fips_generic_test;
>  		break;
> +	case FIPS_TEST_ALGO_ECDSA:
> +		if (info.op == FIPS_TEST_ASYM_KEYGEN) {
> +			test_ops.prepare_asym_op = prepare_ecfpm_op;
> +			test_ops.prepare_asym_xform =
> prepare_ecfpm_xform;
> +			test_ops.test = fips_generic_test;
> +		} else {
> +			test_ops.prepare_asym_op = prepare_ecdsa_op;
> +			test_ops.prepare_asym_xform =
> prepare_ecdsa_xform;
> +			test_ops.test = fips_generic_test;
> +		}
> +		break;
>  	default:
>  		if (strstr(info.file_name, "TECB") ||
>  				strstr(info.file_name, "TCBC")) {
> @@ -2409,6 +2606,9 @@ fips_test_one_test_group(void)
>  	case FIPS_TEST_ALGO_RSA:
>  		ret = parse_test_rsa_json_init();
>  		break;
> +	case FIPS_TEST_ALGO_ECDSA:
> +		ret = parse_test_ecdsa_json_init();
> +		break;
>  	default:
>  		return -EINVAL;
>  	}
> @@ -2439,7 +2639,7 @@ static int
>  fips_test_one_vector_set(void)
>  {
>  	int ret;
> -	json_t *test_groups, *write_groups, *write_version, *write_set;
> +	json_t *test_groups, *write_groups, *write_version, *write_set,
> *mode;
>  	size_t group_idx, num_groups;
> 
>  	test_groups = json_object_get(json_info.json_vector_set,
> "testGroups"); @@ -2458,6 +2658,10 @@ fips_test_one_vector_set(void)
>  		json_object_get(json_info.json_vector_set, "vsId"));
>  	json_object_set(write_set, "algorithm",
>  		json_object_get(json_info.json_vector_set, "algorithm"));
> +	mode = json_object_get(json_info.json_vector_set, "mode");
> +	if (mode != NULL)
> +		json_object_set_new(write_set, "mode", mode);
> +
>  	json_object_set(write_set, "revision",
>  		json_object_get(json_info.json_vector_set, "revision"));
>  	json_object_set_new(write_set, "isSample", diff --git
> a/examples/fips_validation/meson.build
> b/examples/fips_validation/meson.build
> index d310093189..34d3c7c8ca 100644
> --- a/examples/fips_validation/meson.build
> +++ b/examples/fips_validation/meson.build
> @@ -19,6 +19,7 @@ sources = files(
>          'fips_validation_sha.c',
>          'fips_validation_xts.c',
>          'fips_validation_rsa.c',
> +        'fips_validation_ecdsa.c',
>          'fips_dev_self_test.c',
>          'main.c',
>  )
> --
> 2.25.1

Acked-by: Brian Dooley <brian.dooley@intel.com>
  

> > Subject: [v1 2/2] examples/fips_validation: add ECDSA validation
> >
> > This patch adds support in fips_validation app to validate ECDSA.
> >
> > Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
> 
> Acked-by: Brian Dooley <brian.dooley@intel.com>

Applied to dpdk-next-crypto

Thanks.