## Appendix A Description of the Self-Tests ¶

In addition to the build time regression test suite, Libgcrypt implements self-tests to be performed at runtime. Which self-tests are actually used depends on the mode Libgcrypt is used in. In standard mode a limited set of self-tests is run at the time an algorithm is first used. Note that not all algorithms feature a self-test in standard mode. The `GCRYCTL_SELFTEST` control command may be used to run all implemented self-tests at any time; this will even run more tests than those run in FIPS mode.

If any of the self-tests fails, the library immediately returns an error code to the caller. If Libgcrypt is in FIPS mode, the self-tests will be performed within the “Self-Test” state and any failure puts the library into the “Error” state.

### A.1 Power-Up Tests ¶

Power-up tests are only performed if Libgcrypt is in FIPS mode.

#### A.1.1 Symmetric Cipher Algorithm Power-Up Tests ¶

The following symmetric encryption algorithm tests are run during power-up:

AES-128

  A known answer tests is run using one test vector and one test key with AES in ECB mode. (`cipher/rijndael.c:selftest_basic_128`)

AES-192

  A known answer tests is run using one test vector and one test key with AES in ECB mode. (`cipher/rijndael.c:selftest_basic_192`)

AES-256

  A known answer tests is run using one test vector and one test key with AES in ECB mode. (`cipher/rijndael.c:selftest_basic_256`)

#### A.1.2 Hash Algorithm Power-Up Tests ¶

The following hash algorithm tests are run during power-up:

SHA-1

  A known answer test using the string `"abc"` is run. (`cipher/sha1.c:selftests_sha1`)

SHA-224

  A known answer test using the string `"abc"` is run. (`cipher/sha256.c:selftests_sha224`)

SHA-256

  A known answer test using the string `"abc"` is run. (`cipher/sha256.c:selftests_sha256`)

SHA-384

  A known answer test using the string `"abc"` is run. (`cipher/sha512.c:selftests_sha384`)

SHA-512

  A known answer test using the string `"abc"` is run. (`cipher/sha512.c:selftests_sha512`)

#### A.1.3 MAC Algorithm Power-Up Tests ¶

The following MAC algorithm tests are run during power-up:

HMAC SHA-1

  A known answer test using 9 bytes of data and a 64 byte key is run. (`cipher/mac-hmac.c:selftests_sha1`)

HMAC SHA-224

  A known answer test using 28 bytes of data and a 4 byte key is run. (`cipher/mac-hmac.c:selftests_sha224`)

HMAC SHA-256

  A known answer test using 28 bytes of data and a 4 byte key is run. (`cipher/mac-hmac.c:selftests_sha256`)

HMAC SHA-384

  A known answer test using 28 bytes of data and a 4 byte key is run. (`cipher/mac-hmac.c:selftests_sha384`)

HMAC SHA-512

  A known answer test using 28 bytes of data and a 4 byte key is run. (`cipher/mac-hmac.c:selftests_sha512`)

HMAC SHA3-224
HMAC SHA3-256
HMAC SHA3-384
HMAC SHA3-512

  A known answer test using 9 bytes of data and a 20 byte key is run. (`cipher/mac-hmac.c:selftests_sha3`)

CMAC AES

  A known answer test using 40 bytes of data and a 16 byte key is run. (`cipher/mac-cmac.c:selftests_cmac_aes`)

#### A.1.4 Random Number Power-Up Test ¶

The DRNG is tested during power-up this way:

1. Requesting one block of random using the public interface to check general working and the duplicated block detection.
2. 3 know answer tests using pre-defined keys, seed and initial DT values. For each test 3 blocks of 16 bytes are requested and compared to the expected result. The DT value is incremented for each block.

#### A.1.5 Public Key Algorithm Power-Up Tests ¶

The public key algorithms are tested during power-up:

RSA

  A pre-defined 2048 bit RSA key is used and these tests are run in turn:

  1. Conversion of S-expression to internal format. (`cipher/rsa.c:selftests_rsa`)
  2. Private key consistency check. (`cipher/rsa.c:selftests_rsa`)
  3. A pre-defined 20 byte value is signed with PKCS#1 padding for SHA-256. The result is verified using the public key against the original data and against modified data. (`cipher/rsa.c:selftest_sign_2048`)
  4. A predefined 66 byte value is encrypted and checked that it matches reference encyrpted message. The encrypted result is then decrypted and checked that it matches the original random value. (`cipher/rsa.c:selftest_encr_2048`)
ECC

  A pre-defined SEC P-256 ECDSA key is used and these tests are run in turn:

  1. Conversion of S-expression to internal format. (`cipher/ecc.c:selftests_ecdsa`)
  2. Private key consistency check. (`cipher/ecc.c:selftests_ecdsa`)
  3. A pre-defined 32 byte value (SHA-256 digest) is signed. The result is verified using the public key against the original data and against modified data. (`cipher/ecc.c:selftest_sign`)

#### A.1.6 Key derivation function Power-Up Tests ¶

The key derivation functions are tested during power-up:

PBKDF2

  A known answer tests with 8 byte password and 4 byte salt and SHA-1 is used. (`cipher/kdf.c:selftest_pbkdf2`)

#### A.1.7 Integrity Power-Up Tests ¶

The integrity of the Libgcrypt is tested during power-up but only if checking has been enabled at build time. The check works by computing a HMAC SHA-256 checksum over the file used to load Libgcrypt into memory. That checksum is compared against a checksum stored inside of the same file as in the text in the .rodata1 section of the ELF file.

### A.2 Conditional Tests ¶

The conditional tests are performed if a certain condition is met. This may occur at any time; the library does not necessary enter the “Self-Test” state to run these tests but will transit to the “Error” state if a test failed.

#### A.2.1 Key-Pair Generation Tests ¶

After an asymmetric key-pair has been generated, Libgcrypt runs a pair-wise consistency tests on the generated key. On failure the generated key is not used, an error code is returned and, if in FIPS mode, the library is put into the “Error” state.

RSA

  The test uses a random number 64 bits less the size of the modulus as plaintext and runs an encryption and decryption operation in turn. The encrypted value is checked to not match the plaintext, and the result of the decryption is checked to match the plaintext.

  A new random number of the same size is generated, signed and verified to test the correctness of the signing operation. As a second signing test, the signature is modified by incrementing its value and then verified with the expected result that the verification fails. (`cipher/rsa.c:test_keys`)

#### A.2.2 Software Load Tests ¶

No code is loaded at runtime.

#### A.2.3 Manual Key Entry Tests ¶

A manual key entry feature is not implemented in Libgcrypt.

### A.3 Application Requested Tests ¶

The application may requests tests at any time by means of the `GCRYCTL_SELFTEST` control command. Note that using these tests is not FIPS conformant: Although Libgcrypt rejects all application requests for services while running self-tests, it does not ensure that no other operations of Libgcrypt are still being executed. Thus, in FIPS mode an application requesting self-tests needs to power-cycle Libgcrypt instead.

When self-tests are requested, Libgcrypt runs all the tests it does during power-up as well as a few extra checks as described below.

#### A.3.1 Symmetric Cipher Algorithm Tests ¶

The following symmetric encryption algorithm tests are run in addition to the power-up tests:

AES-128

  A known answer tests with test vectors taken from NIST SP800-38a and using the high level functions is run for block modes CFB and OFB.

#### A.3.2 Hash Algorithm Tests ¶

The following hash algorithm tests are run in addition to the power-up tests:

SHA-1
SHA-224
SHA-256
  1. A known answer test using a 56 byte string is run.
  2. A known answer test using a string of one million letters "a" is run.

  (`cipher/sha1.c:selftests_sha1`, `cipher/sha256.c:selftests_sha224`, `cipher/sha256.c:selftests_sha256`)

SHA-384
SHA-512
  1. A known answer test using a 112 byte string is run.
  2. A known answer test using a string of one million letters "a" is run.

  (`cipher/sha512.c:selftests_sha384`, `cipher/sha512.c:selftests_sha512`)

#### A.3.3 MAC Algorithm Tests ¶

The following MAC algorithm tests are run in addition to the power-up tests:

HMAC SHA-1
  1. A known answer test using 9 bytes of data and a 20 byte key is run.
  2. A known answer test using 9 bytes of data and a 100 byte key is run.
  3. A known answer test using 9 bytes of data and a 49 byte key is run.

  (`cipher/mac-hmac.c:selftests_sha1`)

HMAC SHA-224
HMAC SHA-256
HMAC SHA-384
HMAC SHA-512
  1. A known answer test using 9 bytes of data and a 20 byte key is run.
  2. A known answer test using 50 bytes of data and a 20 byte key is run.
  3. A known answer test using 50 bytes of data and a 26 byte key is run.
  4. A known answer test using 54 bytes of data and a 131 byte key is run.
  5. A known answer test using 152 bytes of data and a 131 byte key is run.

  (`cipher/mac-hmac.c:selftests_sha224`, `cipher/mac-hmac.c:selftests_sha256`, `cipher/mac-hmac.c:selftests_sha384`, `cipher/mac-hmac.c:selftests_sha512`)

HMAC SHA3-224
HMAC SHA3-256
HMAC SHA3-384
HMAC SHA3-512
  1. A known answer test using 28 byte of data and a 4 byte key is run.
  2. A known answer test using 50 byte of data and a 20 byte key is run.
  3. A known answer test using 50 byte of data and a 25 byte key is run.
  4. A known answer test using 20 byte of data and a 20 byte key with truncation is run.
  5. A known answer test using 54 byte of data and a 131 byte key is run.
  6. A known answer test using 54 byte of data and a 147 byte key is run.
  7. A known answer test using 152 byte of data and a 131 byte key is run.
  8. A known answer test using 152 byte of data and a 147 byte key is run.

  (`cipher/mac-hmac.c:selftests_sha3`,

CMAC AES
  1. A known answer test using 0 byte of data and a 16 byte key is run.
  2. A known answer test using 24 byte of data and a 16 byte key is run.
  3. A known answer test using 64 byte of data and a 32 byte key is run.
  4. A known answer test using 16 byte of data and a 16 byte key is run.
  5. A known answer test using 64 byte of data and a 16 byte key is run.
  6. A known answer test using 0 byte of data and a 24 byte key is run.
  7. A known answer test using 64 byte of data and a 24 byte key is run.
  8. A known answer test using 0 byte of data and a 32 byte key is run.
  9. A known answer test using 16 byte of data and a 32 byte key is run.

  (`cipher/mac-cmac.c:selftests_cmac_aes`,