Hi,
  I am compiling and running open ssl  fips compliant version and trying to
run the power on self tests during boot up time as part of FIPS
requirements. I have observed invokation of zeroization function as well as
output displayed as part of this function. Here are questions
a) What is the intent of this zeroization function (it is not related to
zeroization operation of FIPS)
b) This function is not testing any algorithm, is it satisfying any other
requirements
c) Theoretically , output should not be displayed regarding the buffers
during Power on self tests, why are the buffer(s) outputed during this
zeroization operation. Any comments and relevance for FIPS 140-2.

Any comments or inputs regarding this  is really appreciated.
File:fips_test_suite.c
Function name:
/* Zeroization
    */
    printf("9. Zero-ization...\n");
    Zeroize();


Code:

/* Zeroize
*/
static int Zeroize()
    {
    RSA *key;
    unsigned char userkey[16] =
{ 0x48, 0x50, 0xf0, 0xa3, 0x3a, 0xed, 0xd3, 0xaf, 0x6e, 0x47, 0x7f, 0x83,
0x02, 0xb1, 0x09, 0x68 };
    int i, n;

    key = RSA_generate_key(1024,65537,NULL,NULL);
    if (!key)
return 0;
    n = BN_num_bytes(key->d);
    printf(" Generated %d byte RSA private key\n", n);
    printf("\tBN key before overwriting:\n%s\n", BN_bn2hex(key->d));
    BN_rand(key->d,n*8,-1,0);
    printf("\tBN key after overwriting:\n%s\n", BN_bn2hex(key->d));

    printf("\tchar buffer key before overwriting: \n\t\t");
    for(i = 0; i < sizeof(userkey); i++) printf("%02x", userkey[i]);
        printf("\n");
    RAND_bytes(userkey, sizeof userkey);
    printf("\tchar buffer key after overwriting: \n\t\t");
    for(i = 0; i < sizeof(userkey); i++) printf("%02x", userkey[i]);
        printf("\n");

    return 1;
    }
-- 
Vidya Sagar

Reply via email to