__ __ ______ ___ ______ ____ ____ ______
| | | | | _ \ / \ / |\ \ / / | _ \
| | | | | |_) | / ^ \ | ,----' \ \/ / | |_) |
| | | | | _ < / /_\ \ | | \ / | ___/
| `----.| | | |_) | / _____ \ | `----. \ / | |
|_______||__| |______/ /__/ \__\ \______| \__/ | _|
A library that implements the client-side of the ACVP protocol.
The ACVP specification can be found at https://github.com/usnistgov/ACVP
Libacvp is licensed under the Apache License 2.0, which means that you are free to get and use it for commercial and non-commercial purposes as long as you fulfill its conditions. See the LICENSE file for details.
Libacvp has been updated to 2.0.0! The included acvp_app now supports OpenSSL 3.0. Various new algorithms are supported and tested on top of multiple other new features and improvements. Please see the release notes for more details. Support for OpenSSL 1.0.2 has been removed.
Libacvp is a client-side ACVP library implementation, and also includes an example application (acvp_app) which utilizes the library.
libacvp will login and then register with the ACVP server (advertising capabilities). The server will respond with a list of vector set identifiers that need to be processed. libacvp will download each vector set, process the vectors, and send the results back to the server. This is performed in real-time by default. The user can also use "offline" mode for non-realtime processing.
The app/ directory contains a sample application which uses libacvp. This app
provides the glue between the crypto module DUT and the library itself.
Depending upon the DUT, the crypto backend API, and other factors, the user
may need to enhance the reference application, or create a new one from scratch.
The application within app/ demonstrates how to use libacvp to interface with a crypto module on
top of providing a broad testing harness for OpenSSL.
This application includes support for FIPS testing OpenSSL 3.X. Historically, support was included for FIPS testing OpenSSL's FIPS module for 1.0.2; this is end of life and support has been removed. Some artifacts have been left behind in case users have need to test a similar FOM structure for OpenSSL 1.1.1 (OpenSSL does not support this themselves). For OpenSSL 3.X, testing the FIPS provider or the default provider is managed at runtime. If you are testing a different provider, you will need to modify the application code to fetch those algorithms accordingly. For previous versions, a build time argument providing a path to the FIPS module being tested was required.
The certs/ directory contains the certificates used to establish a TLS
session with well-known ACVP servers. If the ACVP server uses a self-signed certificate,
then the proper CA file must be specified.
libacvp also requires a client certificate and key pair,
which the ACVP server uses to identify the client. You will need to
contact NIST to register your client certificate with their server.
The murl directory contains experimental code to replace the Curl dependency. This may be useful for target platforms that don't support Curl, such as Android or iOS. Murl is a "minimal" Curl implementation. It implements a handful of the Curl API entry points used by libacvp. The Murl code is currently in an experimental stage and is not supported or maintained as part of libacvp and should not be used in any production environment.
- autotools
- gcc
- make
- curl (or substitution)
- openssl (or substitution)
- libcriterion (for unit tests only)
- doxygen (for building documentation only)
Curl is used for sending REST calls to the ACVP server.
Openssl is used for TLS transport by libcurl.
Parson is used to parse and generate JSON data for the REST calls. The parson code is included and compiled as part of libacvp.
libcurl, libssl and libcrypto are not included, and must be installed separately on your build/target host, including the header files.
This codebase uses features in OpenSSL >= 1.1.1. If the system-default install does not meet this requirement, you will need to download, compile and install at least OpenSSL 1.1.1 on your system. The new OpenSSL resources should typically be installed into /usr/local/ssl to avoid overwriting the default OpenSSL that comes with your distro.
Version 1.1.1 of OpenSSL reaches end of life officially on September 11, 2023. Updating to OpenSSL 3.X is highly recommended when possible. All previous versions have reached end of life status.
A potential source of issues is the default libcurl on the Linux distro, which may be linked against the previously mentioned default OpenSSL. This could result in linker failures when trying to use the system default libcurl with the new OpenSSL install (due to missing symbols). Therefore, you SHOULD download the Curl source, compile it against the "new" OpenSSL header files, and link libcurl against the "new" OpenSSL. libacvp uses compile time macro logic to address differences in the APIs of different OpenSSL versions; therefore, it is important that you ensure libacvp is linking to the correct openSSL versions at run time as well.
Libacvp is designed to work with curl version 7.80.0 or newer. Some operating systems may ship with older versions of Curl which are missing certain features that libacvp depends on. In this case you should either acquire a newer version through your OS package manager if possible or build a newer version from source. While it is possible some older versions may work, they are not tested or supported.
The instructions below indicate how to build libacvp for OpenSSL 3.X testing. The process is the same for building 1.1.1 without FIPS. If you have a FIPS module for 1.1.1, we are unable to officially support it as OpenSSL does not have a FIPS for 1.1.1 and there is no standard format to follow. However, some support for building with a FOM (such as that included with 1.0.2) remains; for more details, see the README included with versions prior to 2.0. It will be up to the user to maintain an application capable of testing your implementation.
--prefix<path to install dir> can be used with any configure options to specify where you would
like the library and application to install to.
./configure --with-ssl-dir=<path to ssl dir> --with-libcurl-dir=<path to curl dir>
make clean
make
make install
Use the following ./configure command line option and only the library will be built and installed.
--disable-app
Note that this option is not useful when building for offline testing since the application is needed. Using this option, only a libcurl installation dir needs to be provided.
< 8000 div class="markdown-heading" dir="auto">