Skip to content

Releases: usnistgov/ACVP-Server

v1.1.0.14 Hotfix 2

10 Dec 14:24
@Kritner Kritner
v1.1.0.14-2
408bdf3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.14 Hotfix 2
Assets 2
Loading

v1.1.0.14 Hotfix

09 Dec 19:08
@Kritner Kritner
v1.1.0.14-1
408bdf3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.14 Hotfix
  • Update HMAC testing to support non byte aligned MACs
  • Update KAS OneStep KDF w/ KMAC implementation issue
Assets 2
Loading

v1.1.0.14

13 Nov 21:12
@Kritner Kritner
v1.1.0.14
408bdf3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.14
  • HACT testing
    • CBC
    • RSA-SigGen
  • New SHA3 revision allowing a more similar (and controllable) registration in comparison to SHA2
  • TLS v1.3 - removes hash algorithms not specified in RFC
    • valid hash algorithms now include SHA2-256 and SHA2-384
  • Updates string validators to be case sensitive within registration validation for property values
  • KTS - update test case handling to property account for when the deferred crypto resolver cannot successfully complete the crypto.
  • KAS KDF OneStep adds l to prompt file
  • KAS HKDF the HKDF was expecting DKM in bytes, was being passed in bits, causing too long of keys to be generated
  • Domain update - changes maximum value of domain to the integer max of 2,147,483,647
    • The DRBG specification stated values up to 2^35 could be supported, also updated the specification to reflect this integer max change
    • #31
  • KAS SP800-56Br2 and SP800-56Ar3 updates so that dkm is now comprised of the full MacKey || KeyData, was previously being set to just KeyData when Key Confirmation was utilized
  • KAS KDF OneStep and HKDF, the minimum allowed l value is now the output length of the largest registered hash function, rather than 2x that value.
  • TLS v1.3 rename "earlyExporterTrafficSecret" -> "earlyExporterMasterSecret" to match RFC
  • KAS Corrects an hmac function label "HMAC_SHA2_D512_T256"
  • KTS Additional "required" property validation to return more meaningful error messages

Hotfix changes since previous documented release:

  • PBKDF genvals correction
  • Better handling of metadata updates when certain properties were not updated
  • Better error message handling in situations where an answer post/put was rejected
  • Fixed several scenarios preventing newer KAS algorithms from properly certifying
Assets 2
Loading

v1.1.0.13 Hotfix PBKDF

02 Nov 21:46
@Kritner Kritner
v1.1.0.13-1
408bdf3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.13 Hotfix PBKDF
  • Corrects an issue with PBKDF test sessions
    • PBKDF test sessions were not completing as expected so the algorithm was temporarily disabled.
    • Closes #28 (was opened due to the algorithm being unavailable, not the issue with the algorithm itself)
Assets 2
Loading

v1.1.0.13

15 Oct 20:22
@Kritner Kritner
v1.1.0.13
8c3fe4b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.13
  • SHA1/2/3 introduces "Large Data Test" (LDT)
  • cSHAKE and derivatives
    • corrects generated hexCustomizations to always be created at the byte boundary.
    • Adds additional test cases to hit "block boundary"
  • Additional domain parameter generation groups created for KAS-SSC testing
  • TLS v1.3
  • ECDSA SigGen/Ver
    • Corrects padding on r and s values to match the next byte of the length of the OrderN on the curve. Previously these values were being padded to the next byte of the number within the curve name; which represented different bytes for the curves K-233 and K-409.
    • usnistgov/ACVP#1037
  • AES-XPN NRE fix (was attempting to pull IV from the server in an "internal" iv registration)
  • KAS SP800-56Ar3 - updates to test case generation to properly mangle "expected failure" test cases for some failure scenarios.
  • SHA3 no longer includes empty message tests if the registration does not allow for them

Web.Public

Assets 2
Loading

v1.1.0.12 hotfix

01 Oct 17:38
@Kritner Kritner
v1.1.0.12-1
8c3fe4b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.12 hotfix
  • KMAC - fixes AFT test construction
  • PBKDF - fix to allow for the proper generation of 1,000,000 iteration test vectors
Assets 2
Loading

v1.1.0.12

10 Sep 16:01
@Kritner Kritner
v1.1.0.12
4ee7d8f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.12

Web API:

  • Correction to public API implementation around vendor phone numbers.
  • Additional information included in /validations/{id} endpoint
  • More strict validation of casing, especially around "algo/mode/revision" for test session registrations

Algorithms:

Old Identifier New Identifier
RSA / keyGen / 1.0 RSA / keyGen / FIPS186-4
RSA / sigGen / 1.0 RSA / sigGen / FIPS186-4
RSA / sigVer / 1.0 RSA / sigVer / FIPS186-4
RSA / legacySigVer / 1.0 RSA / sigVer / FIPS186-2
  • DRBG output bit length no longer required to be a mod of the output length of the underlying cipher
    • minimum output length is now the output length of the underlying cipher
    • usnistgov/ACVP#808
  • KeyWrap only include testPassed property in the expected answers sample projection when the case is a failing test
  • various TDES modes now validate the iv included within the resultsArray for MCT tests
  • KMAC ACVP server was creating a customization string for use in IUT testing, but not using it for its own crypto invoke
  • ParallelHash - Correction to right_encode / left_encode functions, now properly encodes "0"
  • KAS SP800-56Ar3 fixes NRE when macMethods not provided within a keyConfirmation registration property.
  • KAS KDFs parameter validation NRE fix
  • KAS-SSC-IFC adds hashFunctionZ property to group level when hash is not "none"
  • AES-XPN - corrects IV/Salt generation
  • AES/TDES MCT sample results files no longer include the "pt": "" or "ct": "" at the root of the test case
  • New algorithms
    • ConditioningComponent / AES-CBC-MAC / SP800-90B
    • ConditioningComponent / BlockCipher_DF / SP800-90B
    • ConditioningComponent / Hash_DF / SP800-90B
    • KAS-IFC / null / Sp800-56Br2
    • KTS-IFC / null / Sp800-56Br2
    • KAS-IFC-SSC / null / Sp800-56Br2
    • KAS-ECC / null / Sp800-56Ar3
    • KAS-ECC / null / Sp800-56Ar3

Misc:

  • C-based SHA implementations added and used as all hash + hmac functions
  • Internal modeling changes to metadata
    • should not have impact to users, though help with testing is always welcome
Assets 2
Loading

v1.1.0.11

09 Sep 20:10
@Kritner Kritner
v1.1.0.11
12aecae
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0.11
  • New algorithm "TLS-v1.3 / KDF / RFC4886"
    • DEMO
  • New algorithm - "KAS-KDF / HKDF / Sp800-56Cr1"
  • New algorithm - "KAS-IFC-SSC / null / Sp800-56Br2"
  • KAS-ECC Update ephemeral nonce to always be at the byte boundary
  • KAS-IFC
  • Only client cert auth is required for "Algorithms" endpoint, previously required JWT
  • Updates CTR modes (AES and TDES) with a new boolean property performCounterTests
  • ANSI 9.63 - fixes padding on z in certain situations
  • AES-CCM changes tagLen from MathDomain -> int[] to match specification
Assets 2
Loading