[v1 2/2] examples/fips_validation: add ECDSA validation

[Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>]

This patch adds support in fips_validation app to validate ECDSA.

Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
---
 doc/guides/sample_app_ug/fips_validation.rst  |   1 +
 examples/fips_validation/fips_validation.c    |   2 +
 examples/fips_validation/fips_validation.h    |  27 ++
 .../fips_validation/fips_validation_ecdsa.c   | 431 ++++++++++++++++++
 examples/fips_validation/main.c               | 210 ++++++++-
 examples/fips_validation/meson.build          |   1 +
 6 files changed, 669 insertions(+), 3 deletions(-)
 create mode 100644 examples/fips_validation/fips_validation_ecdsa.c

diff --git a/doc/guides/sample_app_ug/fips_validation.rst b/doc/guides/sample_app_ug/fips_validation.rst
index 5e9ad2d006..3a2357eaa9 100644
--- a/doc/guides/sample_app_ug/fips_validation.rst
+++ b/doc/guides/sample_app_ug/fips_validation.rst
@@ -67,6 +67,7 @@ ACVP
     * TDES-CBC - AFT, MCT
     * TDES-ECB - AFT, MCT
     * RSA
+    * ECDSA
 
 
 Application Information
diff --git a/examples/fips_validation/fips_validation.c b/examples/fips_validation/fips_validation.c
index 5d485a2bd5..55f68a7ae0 100644
--- a/examples/fips_validation/fips_validation.c
+++ b/examples/fips_validation/fips_validation.c
@@ -473,6 +473,8 @@ fips_test_parse_one_json_vector_set(void)
 		info.algo = FIPS_TEST_ALGO_TDES;
 	else if (strstr(algo_str, "RSA"))
 		info.algo = FIPS_TEST_ALGO_RSA;
+	else if (strstr(algo_str, "ECDSA"))
+		info.algo = FIPS_TEST_ALGO_ECDSA;
 	else
 		return -EINVAL;
 
diff --git a/examples/fips_validation/fips_validation.h b/examples/fips_validation/fips_validation.h
index 7cbbc1f084..f9dfbecd5d 100644
--- a/examples/fips_validation/fips_validation.h
+++ b/examples/fips_validation/fips_validation.h
@@ -43,6 +43,7 @@ enum fips_test_algorithms {
 		FIPS_TEST_ALGO_TDES,
 		FIPS_TEST_ALGO_SHA,
 		FIPS_TEST_ALGO_RSA,
+		FIPS_TEST_ALGO_ECDSA,
 		FIPS_TEST_ALGO_MAX
 };
 
@@ -94,6 +95,15 @@ struct fips_test_vector {
 		struct fips_val dq;
 		struct fips_val qinv;
 	} rsa;
+	struct {
+		struct fips_val seed;
+		struct fips_val pkey;
+		struct fips_val qx;
+		struct fips_val qy;
+		struct fips_val r;
+		struct fips_val s;
+		struct fips_val k;
+	} ecdsa;
 
 	struct fips_val pt;
 	struct fips_val ct;
@@ -159,6 +169,10 @@ enum fips_rsa_test_types {
 	RSA_KAT
 };
 
+enum fips_ecdsa_test_types {
+	ECDSA_AFT = 0,
+};
+
 struct aesavs_interim_data {
 	enum fips_aesavs_test_types test_type;
 	uint32_t cipher_algo;
@@ -213,6 +227,14 @@ struct rsa_interim_data {
 	uint8_t random_msg;
 };
 
+struct ecdsa_interim_data {
+	enum rte_crypto_auth_algorithm auth;
+	enum rte_crypto_curve_id curve_id;
+	u_int8_t curve_len;
+	uint8_t random_msg;
+	uint8_t pubkey_gen;
+};
+
 #ifdef USE_JANSSON
 /*
  * Maximum length of buffer to hold any json string.
@@ -259,6 +281,7 @@ struct fips_test_interim_info {
 		struct gcm_interim_data gcm_data;
 		struct xts_interim_data xts_data;
 		struct rsa_interim_data rsa_data;
+		struct ecdsa_interim_data ecdsa_data;
 	} interim_info;
 
 	enum fips_test_op op;
@@ -268,6 +291,7 @@ struct fips_test_interim_info {
 	const struct fips_test_callback *writeback_callbacks;
 
 	post_prcess_t parse_interim_writeback;
+	post_prcess_t post_interim_writeback;
 	post_prcess_t parse_writeback;
 	post_prcess_t kat_check;
 };
@@ -338,6 +362,9 @@ parse_test_tdes_json_init(void);
 int
 parse_test_rsa_json_init(void);
 
+int
+parse_test_ecdsa_json_init(void);
+
 int
 fips_test_randomize_message(struct fips_val *msg, struct fips_val *rand);
 #endif /* USE_JANSSON */
diff --git a/examples/fips_validation/fips_validation_ecdsa.c b/examples/fips_validation/fips_validation_ecdsa.c
new file mode 100644
index 0000000000..2bac348052
--- /dev/null
+++ b/examples/fips_validation/fips_validation_ecdsa.c
@@ -0,0 +1,431 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(C) 2022 Marvell.
+ */
+
+#include <string.h>
+#include <time.h>
+#include <stdio.h>
+#include <sys/random.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#ifdef USE_OPENSSL
+#include <openssl/bn.h>
+#include <openssl/rand.h>
+#endif /* USE_OPENSSL */
+
+#include <rte_cryptodev.h>
+#include <rte_malloc.h>
+
+#include "fips_validation.h"
+
+#define CONFORMANCE_JSON_STR	"conformance"
+#define TESTTYPE_JSON_STR	"testType"
+#define CURVE_JSON_STR	"curve"
+#define HASH_JSON_STR	"hashAlg"
+#define RV_JSON_STR	"randomValue"
+
+#define MSG_JSON_STR	"message"
+#define QX_JSON_STR	"qx"
+#define QY_JSON_STR	"qy"
+#define R_JSON_STR	"r"
+#define S_JSON_STR	"s"
+
+#define RV_BUF_LEN (1024/8)
+#define RV_BIT_LEN (256)
+
+#ifdef USE_JANSSON
+struct {
+	uint8_t type;
+	const char *desc;
+} ecdsa_test_types[] = {
+		{ECDSA_AFT, "AFT"}
+};
+
+struct {
+	enum rte_crypto_auth_algorithm auth;
+	const char *desc;
+} ecdsa_auth_algs[] = {
+		{RTE_CRYPTO_AUTH_SHA1, "SHA-1"},
+		{RTE_CRYPTO_AUTH_SHA224, "SHA2-224"},
+		{RTE_CRYPTO_AUTH_SHA256, "SHA2-256"},
+		{RTE_CRYPTO_AUTH_SHA384, "SHA2-384"},
+		{RTE_CRYPTO_AUTH_SHA512, "SHA2-512"},
+};
+
+struct {
+	enum rte_crypto_curve_id curve_id;
+	const char *desc;
+} ecdsa_curve_ids[] = {
+	{RTE_CRYPTO_EC_GROUP_SECP192R1, "P-192"},
+	{RTE_CRYPTO_EC_GROUP_SECP224R1, "P-224"},
+	{RTE_CRYPTO_EC_GROUP_SECP256R1, "P-256"},
+	{RTE_CRYPTO_EC_GROUP_SECP384R1, "P-384"},
+	{RTE_CRYPTO_EC_GROUP_SECP521R1, "P-521"},
+};
+
+struct {
+	uint8_t curve_len;
+	const char *desc;
+} ecdsa_curve_len[] = {
+	{24, "P-192"},
+	{28, "P-224"},
+	{32, "P-256"},
+	{48, "P-384"},
+	{66, "P-521"},
+};
+
+#ifdef USE_OPENSSL
+#define MAX_TRIES 10
+static int
+prepare_vec_ecdsa(void)
+{
+	BIGNUM *pkey = NULL, *order = NULL, *r = NULL;
+	int ret = -1, j;
+	unsigned long pid;
+
+	/* For ECDSA prime fields, order of base points.
+	 * Below string array is indexed by starting with first supported
+	 * curve (SECP-192R1).
+	 */
+	static const char * const orderstr[] = {
+			"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
+			"",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
+			"",
+			"FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
+			"1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"
+	};
+
+	/* Seed PRNG */
+	if (vec.ecdsa.seed.val) {
+		writeback_hex_str("", info.one_line_text, &vec.ecdsa.seed);
+		RAND_seed((char *)info.one_line_text, strlen(info.one_line_text));
+	} else {
+		pid = getpid();
+		RAND_seed(&pid, sizeof(pid));
+	}
+
+	if (!RAND_status())
+		return -1;
+
+	order = BN_new();
+	if (!order)
+		goto err;
+
+	j = info.interim_info.ecdsa_data.curve_id - RTE_CRYPTO_EC_GROUP_SECP192R1;
+	if (!BN_hex2bn(&order, orderstr[j]))
+		goto err;
+
+	pkey = BN_new();
+	if (!pkey)
+		goto err;
+
+	for (j = 0; j < MAX_TRIES; j++) {
+		/* pkey should be in [1, order - 1] */
+		if (!BN_rand_range(pkey, order))
+			goto err;
+
+		if (!BN_is_zero(pkey))
+			break;
+	}
+
+	if (j == MAX_TRIES)
+		goto err;
+
+	parse_uint8_hex_str("", BN_bn2hex(pkey), &vec.ecdsa.pkey);
+
+	r = BN_new();
+	if (!r)
+		goto err;
+
+	if (info.interim_info.ecdsa_data.random_msg) {
+		if (!BN_rand(r, RV_BIT_LEN, 0, 0))
+			goto err;
+
+		parse_uint8_hex_str("", BN_bn2hex(r), &vec.ecdsa.seed);
+	}
+
+	ret = 0;
+err:
+	BN_free(order);
+	BN_free(pkey);
+	BN_free(r);
+	return ret;
+}
+
+static int
+prepare_vec_ecdsa_k(void)
+{
+	BIGNUM *pkey = NULL, *k = NULL;
+	int ret = -1;
+
+	if (!vec.ecdsa.pkey.len)
+		return -1;
+
+	pkey = BN_new();
+	if (!pkey)
+		goto err;
+
+	writeback_hex_str("", info.one_line_text, &vec.ecdsa.pkey);
+	ret = BN_hex2bn(&pkey, info.one_line_text);
+	if ((uint32_t)ret != strlen(info.one_line_text))
+		goto err;
+
+	k = BN_new();
+	if (!k)
+		goto err;
+
+	if (!BN_sub(k, pkey, BN_value_one()))
+		goto err;
+
+	if (BN_is_zero(pkey)) {
+		if (!BN_add(k, pkey, BN_value_one()))
+			goto err;
+	}
+
+	parse_uint8_hex_str("", BN_bn2hex(k), &vec.ecdsa.k);
+	ret = 0;
+err:
+	BN_free(pkey);
+	BN_free(k);
+	return ret;
+}
+
+#else
+static int
+prepare_vec_ecdsa(void)
+{
+	/*
+	 * Generate ECDSA values.
+	 */
+	return -ENOTSUP;
+}
+
+static int
+prepare_vec_ecdsa_k(void)
+{
+	/*
+	 * Generate ECDSA values.
+	 */
+	return -ENOTSUP;
+}
+#endif /* USE_OPENSSL */
+
+static int
+parse_test_ecdsa_json_interim_writeback(struct fips_val *val)
+{
+	RTE_SET_USED(val);
+
+	if (info.interim_info.ecdsa_data.random_msg) {
+		json_object_set_new(json_info.json_write_group, "conformance",
+							json_string("SP800-106"));
+	}
+
+	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
+		/* For siggen tests, ECDSA values can be created soon after
+		 * the test group data are parsed.
+		 */
+		if (vec.ecdsa.pkey.val) {
+			rte_free(vec.ecdsa.pkey.val);
+			vec.ecdsa.pkey.val = NULL;
+		}
+
+		if (prepare_vec_ecdsa() < 0)
+			return -1;
+
+		info.interim_info.ecdsa_data.pubkey_gen = 1;
+	}
+
+	return 0;
+}
+
+static int
+post_test_ecdsa_json_interim_writeback(struct fips_val *val)
+{
+	RTE_SET_USED(val);
+
+	if (info.op == FIPS_TEST_ASYM_KEYGEN) {
+		json_t *obj;
+
+		writeback_hex_str("", info.one_line_text, &vec.ecdsa.qx);
+		obj = json_string(info.one_line_text);
+		json_object_set_new(json_info.json_write_group, "qx", obj);
+
+		writeback_hex_str("", info.one_line_text, &vec.ecdsa.qy);
+		obj = json_string(info.one_line_text);
+		json_object_set_new(json_info.json_write_group, "qy", obj);
+	}
+
+	return 0;
+}
+
+static int
+parse_test_ecdsa_json_writeback(struct fips_val *val)
+{
+	json_t *tcId;
+
+	RTE_SET_USED(val);
+
+	tcId = json_object_get(json_info.json_test_case, "tcId");
+
+	json_info.json_write_case = json_object();
+	json_object_set(json_info.json_write_case, "tcId", tcId);
+
+	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
+		json_t *obj;
+
+		writeback_hex_str("", info.one_line_text, &vec.ecdsa.r);
+		obj = json_string(info.one_line_text);
+		json_object_set_new(json_info.json_write_case, "r", obj);
+
+		writeback_hex_str("", info.one_line_text, &vec.ecdsa.s);
+		obj = json_string(info.one_line_text);
+		json_object_set_new(json_info.json_write_case, "s", obj);
+
+		if (info.interim_info.ecdsa_data.random_msg) {
+			writeback_hex_str("", info.one_line_text, &vec.ecdsa.seed);
+			obj = json_string(info.one_line_text);
+			json_object_set_new(json_info.json_write_case, "randomValue", obj);
+			json_object_set_new(json_info.json_write_case, "randomValueLen",
+				json_integer(vec.ecdsa.seed.len * 8));
+		}
+	} else if (info.op == FIPS_TEST_ASYM_SIGVER) {
+		if (vec.status == RTE_CRYPTO_OP_STATUS_SUCCESS)
+			json_object_set_new(json_info.json_write_case, "testPassed", json_true());
+		else
+			json_object_set_new(json_info.json_write_case, "testPassed", json_false());
+	}
+
+	return 0;
+}
+
+static int
+parse_interim_str(const char *key, char *src, struct fips_val *val)
+{
+	uint32_t i;
+
+	RTE_SET_USED(val);
+
+	if (strcmp(key, TESTTYPE_JSON_STR) == 0) {
+		for (i = 0; i < RTE_DIM(ecdsa_test_types); i++)
+			if (strstr(src, ecdsa_test_types[i].desc)) {
+				info.parse_writeback = parse_test_ecdsa_json_writeback;
+				break;
+			}
+
+		if (!info.parse_writeback || i >= RTE_DIM(ecdsa_test_types))
+			return -EINVAL;
+
+	} else if (strcmp(key, CURVE_JSON_STR) == 0) {
+		for (i = 0; i < RTE_DIM(ecdsa_curve_ids); i++)
+			if (strstr(src, ecdsa_curve_ids[i].desc)) {
+				info.interim_info.ecdsa_data.curve_id = ecdsa_curve_ids[i].curve_id;
+				info.interim_info.ecdsa_data.curve_len =
+					ecdsa_curve_len[i].curve_len;
+				break;
+			}
+
+		if (i >= RTE_DIM(ecdsa_curve_ids))
+			return -EINVAL;
+	} else if (strcmp(key, HASH_JSON_STR) == 0) {
+		for (i = 0; i < RTE_DIM(ecdsa_auth_algs); i++)
+			if (strstr(src, ecdsa_auth_algs[i].desc)) {
+				info.interim_info.ecdsa_data.auth = ecdsa_auth_algs[i].auth;
+				break;
+			}
+
+		if (i >= RTE_DIM(ecdsa_auth_algs))
+			return -EINVAL;
+	} else if (strcmp(key, CONFORMANCE_JSON_STR) == 0) {
+		info.interim_info.ecdsa_data.random_msg = 1;
+	} else {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int
+parse_siggen_message_str(const char *key, char *src, struct fips_val *val)
+{
+	int ret = 0;
+
+	parse_uint8_hex_str(key, src, val);
+	if (info.interim_info.ecdsa_data.random_msg) {
+		ret = fips_test_randomize_message(val, &vec.ecdsa.seed);
+		if (ret < 0)
+			return ret;
+	}
+
+	if (vec.ecdsa.k.val) {
+		rte_free(vec.ecdsa.k.val);
+		vec.ecdsa.k.val = NULL;
+	}
+
+	ret = prepare_vec_ecdsa_k();
+	return ret;
+}
+
+static int
+parse_sigver_randomvalue_str(const char *key, char *src, struct fips_val *val)
+{
+	int ret = 0;
+
+	parse_uint8_hex_str(key, src, val);
+	if (info.interim_info.ecdsa_data.random_msg)
+		ret = fips_test_randomize_message(&vec.pt, val);
+
+	return ret;
+}
+
+struct fips_test_callback ecdsa_interim_json_vectors[] = {
+		{TESTTYPE_JSON_STR, parse_interim_str, NULL},
+		{CURVE_JSON_STR, parse_interim_str, NULL},
+		{HASH_JSON_STR, parse_interim_str, NULL},
+		{CONFORMANCE_JSON_STR, parse_interim_str, NULL},
+		{NULL, NULL, NULL} /**< end pointer */
+};
+
+struct fips_test_callback ecdsa_siggen_json_vectors[] = {
+		{MSG_JSON_STR, parse_siggen_message_str, &vec.pt},
+		{NULL, NULL, NULL} /**< end pointer */
+};
+
+struct fips_test_callback ecdsa_sigver_json_vectors[] = {
+		{MSG_JSON_STR, parse_uint8_hex_str, &vec.pt},
+		{QX_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.qx},
+		{QY_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.qy},
+		{R_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.r},
+		{S_JSON_STR, parse_uint8_hex_str, &vec.ecdsa.s},
+		{RV_JSON_STR, parse_sigver_randomvalue_str, &vec.ecdsa.seed},
+		{NULL, NULL, NULL} /**< end pointer */
+};
+
+int
+parse_test_ecdsa_json_init(void)
+{
+	json_t *mode_obj = json_object_get(json_info.json_vector_set, "mode");
+	const char *mode_str = json_string_value(mode_obj);
+
+	info.callbacks = NULL;
+	info.parse_writeback = NULL;
+	info.interim_info.ecdsa_data.random_msg = 0;
+
+	info.interim_callbacks = ecdsa_interim_json_vectors;
+	info.post_interim_writeback = post_test_ecdsa_json_interim_writeback;
+	info.parse_interim_writeback = parse_test_ecdsa_json_interim_writeback;
+	if (strcmp(mode_str, "sigGen") == 0) {
+		info.op = FIPS_TEST_ASYM_SIGGEN;
+		info.callbacks = ecdsa_siggen_json_vectors;
+	} else if (strcmp(mode_str, "sigVer") == 0) {
+		info.op = FIPS_TEST_ASYM_SIGVER;
+		info.callbacks = ecdsa_sigver_json_vectors;
+	} else {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+#endif /* USE_JANSSON */
diff --git a/examples/fips_validation/main.c b/examples/fips_validation/main.c
index cfa01eae20..b4cb10a106 100644
--- a/examples/fips_validation/main.c
+++ b/examples/fips_validation/main.c
@@ -977,6 +977,103 @@ prepare_rsa_op(void)
 	return 0;
 }
 
+static int
+prepare_ecdsa_op(void)
+{
+	struct rte_crypto_asym_op *asym;
+	struct fips_val msg;
+
+	__rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_ASYMMETRIC);
+
+	asym = env.op->asym;
+	if (env.digest) {
+		msg.val = env.digest;
+		msg.len = env.digest_len;
+	} else {
+		msg.val = vec.pt.val;
+		msg.len = vec.pt.len;
+	}
+
+	if (info.op == FIPS_TEST_ASYM_SIGGEN) {
+		asym->ecdsa.op_type = RTE_CRYPTO_ASYM_OP_SIGN;
+		asym->ecdsa.message.data = msg.val;
+		asym->ecdsa.message.length = msg.len;
+		asym->ecdsa.pkey.data = vec.ecdsa.pkey.val;
+		asym->ecdsa.pkey.length = vec.ecdsa.pkey.len;
+		asym->ecdsa.k.data = vec.ecdsa.k.val;
+		asym->ecdsa.k.length = vec.ecdsa.k.len;
+
+		if (vec.ecdsa.r.val)
+			rte_free(vec.ecdsa.r.val);
+
+		if (vec.ecdsa.s.val)
+			rte_free(vec.ecdsa.s.val);
+
+		vec.ecdsa.r.len = info.interim_info.ecdsa_data.curve_len;
+		vec.ecdsa.r.val = rte_zmalloc(NULL, vec.ecdsa.r.len, 0);
+
+		vec.ecdsa.s.len = vec.ecdsa.r.len;
+		vec.ecdsa.s.val = rte_zmalloc(NULL, vec.ecdsa.s.len, 0);
+
+		asym->ecdsa.r.data = vec.ecdsa.r.val;
+		asym->ecdsa.r.length = 0;
+		asym->ecdsa.s.data = vec.ecdsa.s.val;
+		asym->ecdsa.s.length = 0;
+	} else if (info.op == FIPS_TEST_ASYM_SIGVER) {
+		asym->ecdsa.op_type = RTE_CRYPTO_ASYM_OP_VERIFY;
+		asym->ecdsa.message.data = msg.val;
+		asym->ecdsa.message.length = msg.len;
+		asym->ecdsa.q.x.data = vec.ecdsa.qx.val;
+		asym->ecdsa.q.x.length = vec.ecdsa.qx.len;
+		asym->ecdsa.q.y.data = vec.ecdsa.qy.val;
+		asym->ecdsa.q.y.length = vec.ecdsa.qy.len;
+		asym->ecdsa.r.data = vec.ecdsa.r.val;
+		asym->ecdsa.r.length = vec.ecdsa.r.len;
+		asym->ecdsa.s.data = vec.ecdsa.s.val;
+		asym->ecdsa.s.length = vec.ecdsa.s.len;
+	} else {
+		RTE_LOG(ERR, USER1, "Invalid op %d\n", info.op);
+		return -EINVAL;
+	}
+
+	rte_crypto_op_attach_asym_session(env.op, env.asym.sess);
+
+	return 0;
+}
+
+static int
+prepare_ecfpm_op(void)
+{
+	struct rte_crypto_asym_op *asym;
+
+	__rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_ASYMMETRIC);
+
+	asym = env.op->asym;
+	asym->ecpm.scalar.data = vec.ecdsa.pkey.val;
+	asym->ecpm.scalar.length = vec.ecdsa.pkey.len;
+
+	if (vec.ecdsa.qx.val)
+		rte_free(vec.ecdsa.qx.val);
+
+	if (vec.ecdsa.qy.val)
+		rte_free(vec.ecdsa.qy.val);
+
+	vec.ecdsa.qx.len = info.interim_info.ecdsa_data.curve_len;
+	vec.ecdsa.qx.val = rte_zmalloc(NULL, vec.ecdsa.qx.len, 0);
+
+	vec.ecdsa.qy.len = vec.ecdsa.qx.len;
+	vec.ecdsa.qy.val = rte_zmalloc(NULL, vec.ecdsa.qy.len, 0);
+
+	asym->ecpm.r.x.data = vec.ecdsa.qx.val;
+	asym->ecpm.r.x.length = 0;
+	asym->ecpm.r.y.data = vec.ecdsa.qy.val;
+	asym->ecpm.r.y.length = 0;
+
+	rte_crypto_op_attach_asym_session(env.op, env.asym.sess);
+
+	return 0;
+}
+
 static int
 prepare_aes_xform(struct rte_crypto_sym_xform *xform)
 {
@@ -1441,6 +1538,69 @@ prepare_rsa_xform(struct rte_crypto_asym_xform *xform)
 	return 0;
 }
 
+static int
+prepare_ecdsa_xform(struct rte_crypto_asym_xform *xform)
+{
+	const struct rte_cryptodev_asymmetric_xform_capability *cap;
+	struct rte_cryptodev_asym_capability_idx cap_idx;
+
+	xform->xform_type = RTE_CRYPTO_ASYM_XFORM_ECDSA;
+	xform->next = NULL;
+
+	cap_idx.type = xform->xform_type;
+	cap = rte_cryptodev_asym_capability_get(env.dev_id, &cap_idx);
+	if (!cap) {
+		RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
+				env.dev_id);
+		return -EINVAL;
+	}
+
+	switch (info.op) {
+	case FIPS_TEST_ASYM_SIGGEN:
+		if (!rte_cryptodev_asym_xform_capability_check_optype(cap,
+			RTE_CRYPTO_ASYM_OP_SIGN)) {
+			RTE_LOG(ERR, USER1, "PMD %s xform_op %u\n",
+				info.device_name, RTE_CRYPTO_ASYM_OP_SIGN);
+			return -EPERM;
+		}
+		break;
+	case FIPS_TEST_ASYM_SIGVER:
+		if (!rte_cryptodev_asym_xform_capability_check_optype(cap,
+			RTE_CRYPTO_ASYM_OP_VERIFY)) {
+			RTE_LOG(ERR, USER1, "PMD %s xform_op %u\n",
+				info.device_name, RTE_CRYPTO_ASYM_OP_VERIFY);
+			return -EPERM;
+		}
+		break;
+	default:
+		break;
+	}
+
+	xform->ec.curve_id = info.interim_info.ecdsa_data.curve_id;
+	return 0;
+}
+
+static int
+prepare_ecfpm_xform(struct rte_crypto_asym_xform *xform)
+{
+	const struct rte_cryptodev_asymmetric_xform_capability *cap;
+	struct rte_cryptodev_asym_capability_idx cap_idx;
+
+	xform->xform_type = RTE_CRYPTO_ASYM_XFORM_ECFPM;
+	xform->next = NULL;
+
+	cap_idx.type = xform->xform_type;
+	cap = rte_cryptodev_asym_capability_get(env.dev_id, &cap_idx);
+	if (!cap) {
+		RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
+				env.dev_id);
+		return -EINVAL;
+	}
+
+	xform->ec.curve_id = info.interim_info.ecdsa_data.curve_id;
+	return 0;
+}
+
 static int
 get_writeback_data(struct fips_val *val)
 {
@@ -1546,7 +1706,7 @@ fips_run_asym_test(void)
 	struct rte_crypto_op *deqd_op;
 	int ret;
 
-	if (info.op == FIPS_TEST_ASYM_KEYGEN) {
+	if (info.op == FIPS_TEST_ASYM_KEYGEN && info.algo != FIPS_TEST_ALGO_ECDSA) {
 		RTE_SET_USED(asym);
 		ret = 0;
 		goto exit;
@@ -1606,7 +1766,33 @@ fips_run_test(void)
 	}
 
 	env.op = env.asym.op;
-	return fips_run_asym_test();
+	if (info.op == FIPS_TEST_ASYM_SIGGEN &&
+		info.algo == FIPS_TEST_ALGO_ECDSA &&
+		info.interim_info.ecdsa_data.pubkey_gen == 1) {
+		fips_prepare_asym_xform_t ecdsa_xform;
+		fips_prepare_op_t ecdsa_op;
+
+		ecdsa_xform = test_ops.prepare_asym_xform;
+		ecdsa_op = test_ops.prepare_asym_op;
+		info.op = FIPS_TEST_ASYM_KEYGEN;
+		test_ops.prepare_asym_xform = prepare_ecfpm_xform;
+		test_ops.prepare_asym_op = prepare_ecfpm_op;
+		ret = fips_run_asym_test();
+		if (ret < 0)
+			return ret;
+
+		info.post_interim_writeback(NULL);
+		info.interim_info.ecdsa_data.pubkey_gen = 0;
+
+		test_ops.prepare_asym_xform = ecdsa_xform;
+		test_ops.prepare_asym_op = ecdsa_op;
+		info.op = FIPS_TEST_ASYM_SIGGEN;
+		ret = fips_run_asym_test();
+	} else {
+		ret = fips_run_asym_test();
+	}
+
+	return ret;
 }
 
 static int
@@ -2235,6 +2421,17 @@ init_test_ops(void)
 		test_ops.prepare_asym_xform = prepare_rsa_xform;
 		test_ops.test = fips_generic_test;
 		break;
+	case FIPS_TEST_ALGO_ECDSA:
+		if (info.op == FIPS_TEST_ASYM_KEYGEN) {
+			test_ops.prepare_asym_op = prepare_ecfpm_op;
+			test_ops.prepare_asym_xform = prepare_ecfpm_xform;
+			test_ops.test = fips_generic_test;
+		} else {
+			test_ops.prepare_asym_op = prepare_ecdsa_op;
+			test_ops.prepare_asym_xform = prepare_ecdsa_xform;
+			test_ops.test = fips_generic_test;
+		}
+		break;
 	default:
 		if (strstr(info.file_name, "TECB") ||
 				strstr(info.file_name, "TCBC")) {
@@ -2409,6 +2606,9 @@ fips_test_one_test_group(void)
 	case FIPS_TEST_ALGO_RSA:
 		ret = parse_test_rsa_json_init();
 		break;
+	case FIPS_TEST_ALGO_ECDSA:
+		ret = parse_test_ecdsa_json_init();
+		break;
 	default:
 		return -EINVAL;
 	}
@@ -2439,7 +2639,7 @@ static int
 fips_test_one_vector_set(void)
 {
 	int ret;
-	json_t *test_groups, *write_groups, *write_version, *write_set;
+	json_t *test_groups, *write_groups, *write_version, *write_set, *mode;
 	size_t group_idx, num_groups;
 
 	test_groups = json_object_get(json_info.json_vector_set, "testGroups");
@@ -2458,6 +2658,10 @@ fips_test_one_vector_set(void)
 		json_object_get(json_info.json_vector_set, "vsId"));
 	json_object_set(write_set, "algorithm",
 		json_object_get(json_info.json_vector_set, "algorithm"));
+	mode = json_object_get(json_info.json_vector_set, "mode");
+	if (mode != NULL)
+		json_object_set_new(write_set, "mode", mode);
+
 	json_object_set(write_set, "revision",
 		json_object_get(json_info.json_vector_set, "revision"));
 	json_object_set_new(write_set, "isSample",
diff --git a/examples/fips_validation/meson.build b/examples/fips_validation/meson.build
index d310093189..34d3c7c8ca 100644
--- a/examples/fips_validation/meson.build
+++ b/examples/fips_validation/meson.build
@@ -19,6 +19,7 @@ sources = files(
         'fips_validation_sha.c',
         'fips_validation_xts.c',
         'fips_validation_rsa.c',
+        'fips_validation_ecdsa.c',
         'fips_dev_self_test.c',
         'main.c',
 )
-- 
2.25.1