[dpdk-dev] Question Regarding FIPS Validation in DPDK

[dpdk-dev] Question Regarding FIPS Validation in DPDK

[Brandon Lo]

Hello,

I have been able to use Cisco's libacvp tool to retrieve test vectors
from the NIST ACVP API.
However, after building the dpdk-fips_validation example and reading
through its documentation, it seems like the example application is
unable to parse the request files due to them being in a different
format.
Currently, the ACVP API will supply request files in json format.

The example app documentation says that the request file must be in
CAVS 21.0 format. I have not been able to find a specification for
this format to compare.
Does the current version of the dpdk-fips_validation example support
the API's test vectors in json format?

Thanks,
Brandon



-- 
Brandon Lo
UNH InterOperability Laboratory
21 Madbury Rd, Suite 100, Durham, NH 03824
blo@iol.unh.edu
www.iol.unh.edu

RE: [dpdk-dev] Question Regarding FIPS Validation in DPDK

[Mcnamara, John]

> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Brandon Lo
> Sent: Wednesday, November 3, 2021 5:45 PM
> To: Kovacevic, Marko <marko.kovacevic@intel.com>
> Cc: dev <dev@dpdk.org>
> Subject: [dpdk-dev] Question Regarding FIPS Validation in DPDK
> 
> Hello,
> 
> I have been able to use Cisco's libacvp tool to retrieve test vectors from
> the NIST ACVP API.
> However, after building the dpdk-fips_validation example and reading
> through its documentation, it seems like the example application is unable
> to parse the request files due to them being in a different format.
> Currently, the ACVP API will supply request files in json format.
> 
> The example app documentation says that the request file must be in CAVS
> 21.0 format. I have not been able to find a specification for this format
> to compare.
> Does the current version of the dpdk-fips_validation example support the
> API's test vectors in json format?


At the time the dpdk-fips_validation tool was written the test vectors weren't available in JSON format, and, to the best of my knowledge, there was a format specification (which is why there is different parsing for different algorithms). We (the community) should probably move to the JSON format. Adding Fan Zhang since I think this was discussion in the community previously.

John

RE: [dpdk-dev] Question Regarding FIPS Validation in DPDK

[Mcnamara, John]

> -----Original Message-----
> From: Mcnamara, John <john.mcnamara@intel.com>
> Sent: Thursday, December 2, 2021 8:45 AM
> To: Brandon Lo <blo@iol.unh.edu>; Zhang, Roy Fan <roy.fan.zhang@intel.com>
> Cc: dev <dev@dpdk.org>; Kovacevic, Marko <marko.kovacevic@intel.com>
> Subject: RE: [dpdk-dev] Question Regarding FIPS Validation in DPDK
> 
> > -----Original Message-----
> > From: dev <dev-bounces@dpdk.org> On Behalf Of Brandon Lo
> > Sent: Wednesday, November 3, 2021 5:45 PM
> > To: Kovacevic, Marko <marko.kovacevic@intel.com>
> > Cc: dev <dev@dpdk.org>
> > Subject: [dpdk-dev] Question Regarding FIPS Validation in DPDK
> >
> > Hello,
> >
> > I have been able to use Cisco's libacvp tool to retrieve test vectors
> > from the NIST ACVP API.
> > However, after building the dpdk-fips_validation example and reading
> > through its documentation, it seems like the example application is
> > unable to parse the request files due to them being in a different
> format.
> > Currently, the ACVP API will supply request files in json format.
> >
> > The example app documentation says that the request file must be in
> > CAVS
> > 21.0 format. I have not been able to find a specification for this
> > format to compare.
> > Does the current version of the dpdk-fips_validation example support
> > the API's test vectors in json format?
> 
> 
> At the time the dpdk-fips_validation tool was written the test vectors
> weren't available in JSON format, and, to the best of my knowledge, there
> was a format specification (which is why there is different parsing for
> different algorithms). We (the community) should probably move to the JSON
> format. Adding Fan Zhang since I think this was discussion in the
> community previously.

Sorry I meant to say " to the best of my knowledge, there *wasn't* a format specification" available.

John

Re: [dpdk-dev] Question Regarding FIPS Validation in DPDK

[Brandon Lo]

On Thu, Dec 2, 2021 at 9:45 AM Mcnamara, John <john.mcnamara@intel.com> wrote:
> > At the time the dpdk-fips_validation tool was written the test vectors
> > weren't available in JSON format, and, to the best of my knowledge, there
> > was a format specification (which is why there is different parsing for
> > different algorithms). We (the community) should probably move to the JSON
> > format. Adding Fan Zhang since I think this was discussion in the
> > community previously.
>
> Sorry I meant to say " to the best of my knowledge, there *wasn't* a format specification" available.
>
> John

Should we plan to move away from the old format to only use the new
JSON format going forward? I believe the file format "CAVS 21.0" is
fully deprecated and NIST does not produce any new files in that
format.

Thanks,
Brandon


--
Brandon Lo
UNH InterOperability Laboratory
21 Madbury Rd, Suite 100, Durham, NH 03824
blo@iol.unh.edu
www.iol.unh.edu

RE: [dpdk-dev] Question Regarding FIPS Validation in DPDK

[Mcnamara, John]

> -----Original Message-----
> From: Brandon Lo <blo@iol.unh.edu>
> Sent: Friday, December 3, 2021 6:45 PM
> To: Mcnamara, John <john.mcnamara@intel.com>
> Cc: Zhang, Roy Fan <roy.fan.zhang@intel.com>; dev <dev@dpdk.org>;
> Kovacevic, Marko <marko.kovacevic@intel.com>
> Subject: Re: [dpdk-dev] Question Regarding FIPS Validation in DPDK
> 
> On Thu, Dec 2, 2021 at 9:45 AM Mcnamara, John <john.mcnamara@intel.com>
> wrote:
> > > At the time the dpdk-fips_validation tool was written the test
> > > vectors weren't available in JSON format, and, to the best of my
> > > knowledge, there was a format specification (which is why there is
> > > different parsing for different algorithms). We (the community)
> > > should probably move to the JSON format. Adding Fan Zhang since I
> > > think this was discussion in the community previously.
> >
> > Sorry I meant to say " to the best of my knowledge, there *wasn't* a
> format specification" available.
> >
> > John
> 
> Should we plan to move away from the old format to only use the new JSON
> format going forward? I believe the file format "CAVS 21.0" is fully
> deprecated and NIST does not produce any new files in that format.

Yes, we should drop support for the older formats, which were inconsistent and hard to deal with. I don't know if there are any deprecation implications, we can look into that.

John