Merge branch 'main' into add-backport-tool-analysis

Author: tianyiy-tim

.github/workflows/integrations.yml

@@ -86,6 +86,25 @@ jobs:
       - name: Run socat integration test
         run: |
           ./tests/ci/integration/run_socat_integration.sh
+  memcached:
+    if: github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    steps:
+      # libio-socket-ssl-perl is what lets the Perl test suite speak TLS to
+      # memcached; t/ssl_ports.t needs its TLS 1.3 support and
+      # t/ssl_session_resumption.t needs get_session_reused().
+      - name: Install OS Dependencies
+        run: |
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
+          sudo apt-get -y --no-install-recommends install \
+          cmake gcc ninja-build golang make autoconf automake libtool pkg-config \
+          libevent-dev libio-socket-ssl-perl
+      - uses: actions/checkout@v7
+      # Pinned to a memcached release for a stable required check. Omit the
+      # argument to track the default branch instead.
+      - name: Run memcached integration test
+        run: |
+          ./tests/ci/integration/run_memcached_integration.sh '1.6.45'
   rust-openssl:
     if: github.repository_owner == 'aws'
     runs-on: ubuntu-latest

crypto/CMakeLists.txt

@@ -429,6 +429,7 @@ add_library(
   ex_data.c
   hpke/hpke.c
   hrss/hrss.c
+  keccak/keccak.c
   lhash/lhash.c
   md4/md4.c
   mem.c
@@ -835,6 +836,7 @@ if(BUILD_TESTING)
     hmac_extra/hmac_test.cc
     hrss/hrss_test.cc
     impl_dispatch_test.cc
+    keccak/keccak256_test.cc
     lhash/lhash_test.cc
     obj/obj_test.cc
     ocsp/ocsp_test.cc

crypto/digest_extra/digest_extra.c

@@ -15,6 +15,8 @@
 #include "../asn1/internal.h"
 #include "../internal.h"
 #include "../fipsmodule/digest/internal.h"
+#include "../fipsmodule/sha/internal.h"
+#include "../keccak/internal.h"
 
 
 struct nid_to_digest {
@@ -41,6 +43,11 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
     {NID_sha3_512, EVP_sha3_512, SN_sha3_512, LN_sha3_512},
     {NID_shake128, EVP_shake128, SN_shake128, LN_shake128},
     {NID_shake256, EVP_shake256, SN_shake256, LN_shake256},
+    // Keccak-256 has no NID/OID (the Ethereum-style 0x01-padding variant is
+    // not standardised), so its names are not in nid.h. Registered by name
+    // only via string literals; "KECCAK-256" matches OpenSSL 3.2+'s provider
+    // name for cross-library lookups, with a lowercase alias for convenience.
+    {NID_undef, EVP_keccak256, "KECCAK-256", "keccak-256"},
     {NID_md5_sha1, EVP_md5_sha1, SN_md5_sha1, LN_md5_sha1},
     // As a remnant of signing |EVP_MD|s, OpenSSL returned the corresponding
     // hash function when given a signature OID. To avoid unintended lax parsing
@@ -262,6 +269,40 @@ static const EVP_MD evp_md_blake2b256 = {
 
 const EVP_MD *EVP_blake2b256(void) { return &evp_md_blake2b256; }
 
+// Keccak-256 (Ethereum-style, 0x01 padding). NOT FIPS-approved, no OID.
+static void keccak256_init(EVP_MD_CTX *ctx) {
+  AWSLC_ASSERT(Keccak256_Init(ctx->md_data));
+}
+
+static int keccak256_update(EVP_MD_CTX *ctx, const void *data, size_t len) {
+  return Keccak256_Update(ctx->md_data, data, len);
+}
+
+static void keccak256_final(EVP_MD_CTX *ctx, uint8_t *md) {
+  AWSLC_ASSERT(Keccak256_Final(md, ctx->md_data));
+}
+
+// |EVP_MD_FLAG_DIGALGID_ABSENT| matches OpenSSL 3.2+'s
+// |PROV_DIGEST_FLAG_ALGID_ABSENT| on KECCAK-{224,256,384,512}. With
+// |NID_undef| this is effectively unreachable in current AWS-LC code paths
+// (|EVP_marshal_digest_algorithm| rejects digests without a known OID before
+// inspecting flags), but we set it for parity with OpenSSL and to remain
+// correct if any downstream caller starts honouring the flag.
+static const EVP_MD evp_md_keccak256 = {
+  NID_undef,
+  KECCAK256_DIGEST_LENGTH,
+  EVP_MD_FLAG_DIGALGID_ABSENT,
+  keccak256_init,
+  keccak256_update,
+  keccak256_final,
+  KECCAK256_CBLOCK,
+  sizeof(KECCAK1600_CTX),
+  /*finalXOF=*/   NULL,
+  /*squeezeXOF=*/ NULL
+};
+
+const EVP_MD *EVP_keccak256(void) { return &evp_md_keccak256; }
+
 static void null_init(EVP_MD_CTX *ctx) {}
 
 static int null_update(EVP_MD_CTX *ctx, const void *data, size_t count) { return 1;}

crypto/digest_extra/digest_test.cc

@@ -26,6 +26,7 @@
 
 #include "../fipsmodule/md5/internal.h"
 #include "../fipsmodule/sha/internal.h"
+#include "../keccak/internal.h"
 #include "../internal.h"
 #include "../test/test_util.h"
 
@@ -61,6 +62,7 @@ static const MD shake128 = { "shake128", &EVP_shake128, nullptr, &SHAKE128};
 static const MD shake256 = { "shake256", &EVP_shake256, nullptr, &SHAKE256};
 static const MD md5_sha1 = { "MD5-SHA1", &EVP_md5_sha1, nullptr, nullptr };
 static const MD blake2b256 = { "BLAKE2b-256", &EVP_blake2b256, nullptr, nullptr };
+static const MD keccak256 = { "KECCAK-256", &EVP_keccak256, &Keccak256, nullptr };
 static const MD md_null = { "NULL", &EVP_md_null, nullptr, nullptr };
 
 struct DigestTestVector {
@@ -224,6 +226,16 @@ static const DigestTestVector kTestVectors[] = {
     {sha3_512, "\x0c\xe9\xf8\xc3\xa9\x90\xc2\x68\xf3\x4e\xfd\x9b\xef\xdb\x0f\x7c\x4e\xf8\x46\x6c\xfd\xb0\x11\x71\xf8\xde\x70\xdc\x5f\xef\xa9\x2a\xcb\xe9\x3d\x29\xe2\xac\x1a\x5c\x29\x79\x12\x9f\x1a\xb0\x8c\x0e\x77\xde\x79\x24\xdd\xf6\x8a\x20\x9c\xdf\xa0\xad\xc6\x2f\x85\xc1\x86\x37\xd9\xc6\xb3\x3f\x4f\xf8",
     1, "b018a20fcf831dde290e4fb18c56342efe138472cbe142da6b77eea4fce52588c04c808eb32912faa345245a850346faec46c3a16d39bd2e1ddb1816bc57d2da"},
 
+    // Keccak-256 tests (Ethereum-style, original 0x01 padding). Reproducible
+    // by anyone using e.g. eth_utils.keccak() or pycryptodome with
+    // digest_bits=256. NOT FIPS, no OID.
+    {keccak256, "", 1,
+     "c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470"},
+    {keccak256, "abc", 1,
+     "4e03657aea45a94fc7d47ba826c8d667c0d1e6e33a64a036ec44f58fa12d6c45"},
+    {keccak256, "The quick brown fox jumps over the lazy dog", 1,
+     "4d741b6f1eb29cb2a9b9911c82f56fa8d73b04959d3d9d222895df6c0b28aa15"},
+
     // SHAKE128 XOF tests, from NIST.
     // http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html
     // NOTE: the |repeat| field in this struct denotes output length for XOF digests.
@@ -392,6 +404,13 @@ TEST(DigestTest, Getters) {
   EXPECT_EQ(EVP_md4(), EVP_get_digestbyname("md4"));
   EXPECT_EQ(EVP_md4(), EVP_get_digestbyname("MD4"));
 
+  // Keccak-256 is registered by name only (no OID), matching OpenSSL 3.x's
+  // "KECCAK-256" provider name. Lookup via either casing must work; lookup
+  // by NID does not (the digest's type is NID_undef).
+  EXPECT_EQ(EVP_keccak256(), EVP_get_digestbyname("KECCAK-256"));
+  EXPECT_EQ(EVP_keccak256(), EVP_get_digestbyname("keccak-256"));
+  EXPECT_EQ(NID_undef, EVP_MD_type(EVP_keccak256()));
+
   EXPECT_EQ(EVP_sha512(), EVP_get_digestbynid(NID_sha512));
   EXPECT_EQ(nullptr, EVP_get_digestbynid(NID_sha512WithRSAEncryption));
   EXPECT_EQ(nullptr, EVP_get_digestbynid(NID_undef));

crypto/fipsmodule/sha/internal.h

@@ -440,8 +440,33 @@ OPENSSL_EXPORT uint8_t *SHAKE128(const uint8_t *data, const size_t in_len,
 // to |out| and returns |out| on success and NULL on failure.
 OPENSSL_EXPORT uint8_t *SHAKE256(const uint8_t *data, const size_t in_len,
                                  uint8_t *out, size_t out_len);
+
+// KeccakSponge APIs manage the internal input/output buffer on top of the
+// Keccak1600 API layer. They are the shared padding-and-buffering primitives
+// underneath the SHA3 and SHAKE APIs below. They are also reused, outside the
+// FIPS module, by the (non-FIPS) Keccak-256 implementation in
+// crypto/keccak/keccak.c, which sets up the context with the original Keccak
+// padding byte rather than a FIPS 202 one. |KeccakSponge_Init| deliberately
+// accepts only FIPS 202 padding characters and is therefore kept private to
+// this module.
+
+// KeccakSponge_Reset zeroes the Keccak state and buffer of |ctx| and returns it
+// to the absorb phase.
+void KeccakSponge_Reset(KECCAK1600_CTX *ctx);
+
+// KeccakSponge_Absorb absorbs |len| bytes from |data| into |ctx|, buffering any
+// trailing partial block. It returns 1 on success and 0 if |ctx| is no longer
+// in a phase that accepts input. |len| must be non-zero (checked by callers).
+int KeccakSponge_Absorb(KECCAK1600_CTX *ctx, const void *data, size_t len);
+
+// KeccakSponge_AbsorbFinal applies the |ctx->pad| padding to the final block
+// and absorbs it. It must be called once to conclude the absorb phase, after
+// which the caller squeezes the digest via |Keccak1600_Squeeze|. It returns 1 on
+// success and 0 if |ctx| is no longer in a phase that accepts input.
+int KeccakSponge_AbsorbFinal(uint8_t *md, KECCAK1600_CTX *ctx);
+
 /*
- * SHA3 APIs implement SHA3 functionalities on top of FIPS202 API layer
+ * SHA3 APIs implement SHA3 functionalities on top of KeccakSponge API layer
  *
  * SHA3 context must go through the flow: (a) Init, (b) Update [multiple times],
  * (c) Final [one time].
@@ -452,19 +477,20 @@ OPENSSL_EXPORT uint8_t *SHAKE256(const uint8_t *data, const size_t in_len,
  * detailed above each SHA3_ function signature, is satisfied.
  */
 
-// SHA3_Init initialises |ctx| field through |FIPS202_Init| and
+// SHA3_Init initialises |ctx| field through |KeccakSponge_Init| and
 // returns 1 on success and 0 on failure. When call-discipline is
 // maintained and |bitlen| value corresponds to a SHA3 digest length
 // in bits, this function never fails.
 OPENSSL_EXPORT int SHA3_Init(KECCAK1600_CTX *ctx, size_t bitlen);
 
-// SHA3_Update checks |ctx| pointer and |len| value, calls |FIPS202_Update|
+// SHA3_Update checks |ctx| pointer and |len| value, calls |KeccakSponge_Absorb|
 // and returns 1 on success and 0 on failure. When call-discipline is
 // maintained and |len| value corresponds to the input message length
 // (including zero), this function never fails.
 int SHA3_Update(KECCAK1600_CTX *ctx, const void *data, size_t len);
 
-// SHA3_Final pads the last data block and absorbs it through |FIPS202_Finalize|.
+// SHA3_Final pads the last data block and absorbs it through
+// |KeccakSponge_AbsorbFinal|.
 // It then calls |Keccak1600_Squeeze| and returns 1 on success and 0 on failure.
 // When call-discipline is maintained, this function never fails.
 int SHA3_Final(uint8_t *md, KECCAK1600_CTX *ctx);
@@ -510,7 +536,7 @@ int SHA3_512_Update(KECCAK1600_CTX *sha, const void *data, size_t len);
 int SHA3_512_Final(uint8_t out[SHA3_512_DIGEST_LENGTH], KECCAK1600_CTX *sha);
 
 /*
- * SHAKE APIs implement SHAKE functionalities on top of FIPS202 API layer
+ * SHAKE APIs implement SHAKE functionalities on top of KeccakSponge API layer
  *
  * SHAKE context must go through the flow: (a) Init, (b) Absorb [multiple times],
  * (c) Final [one time] or Squeeze [multiple times]
@@ -521,24 +547,24 @@ int SHA3_512_Final(uint8_t out[SHA3_512_DIGEST_LENGTH], KECCAK1600_CTX *sha);
  * detailed above each SHAKE_ function signature, is satisfied.
  */
 
-// SHAKE_Init initialises |ctx| fields through |FIPS202_Init| and
+// SHAKE_Init initialises |ctx| fields through |KeccakSponge_Init| and
 // returns 1 on success and 0 on failure. When call-discipline is
 // maintained and |block_size| value corresponds to a SHAKE block size length
 // in bytes, this function never fails.
 int SHAKE_Init(KECCAK1600_CTX *ctx, size_t block_size);
 
 // SHAKE_Absorb checks |ctx| pointer and |len| values. It updates and absorbs
-// input blocks via |FIPS202_Update|. When call-discipline is
+// input blocks via |KeccakSponge_Absorb|. When call-discipline is
 // maintained and |len| value corresponds to the input message length
 // (including zero), this function never fails.
 int SHAKE_Absorb(KECCAK1600_CTX *ctx, const void *data,
                                size_t len);
 
 // SHAKE_Squeeze pads the last data block and absorbs it through
-// |FIPS202_Finalize| on first call. It writes |len| bytes of incremental
-// XOF output to |md| and returns 1 on success and 0 on failure. It can be
-// called multiple times. When call-discipline is maintained, this function
-// never fails.
+// |KeccakSponge_AbsorbFinal| on first call. It writes |len| bytes of
+// incremental XOF output to |md| and returns 1 on success and 0 on failure. It
+// can be called multiple times. When call-discipline is maintained, this
+// function never fails.
 int SHAKE_Squeeze(uint8_t *md, KECCAK1600_CTX *ctx, size_t len);
 
 // SHAKE_Final writes |len| bytes of finalized extendible output to |md|, returns 1 on
@@ -548,7 +574,8 @@ int SHAKE_Squeeze(uint8_t *md, KECCAK1600_CTX *ctx, size_t len);
 int SHAKE_Final(uint8_t *md, KECCAK1600_CTX *ctx, size_t len);
 
 /*
- * SHAKE128_x4_ batched APIs implement x4 SHAKE functionalities on top of FIPS202 API layer
+ * SHAKE128_x4_ batched APIs implement x4 SHAKE functionalities on top of
+ * KeccakSponge API layer
  *
  * SHAKE128_x4_ context must go through the flow: (a) Init_x4, (b) Absorb_once_x4 [one time;
  * maximum input length of |SHAKE128_BLOCKSIZE - 1|] (c) Squeezeblocks_x4 [multiple times]
@@ -581,7 +608,7 @@ OPENSSL_EXPORT int SHAKE128_Squeezeblocks_x4(uint8_t *md0, uint8_t *md1, uint8_t
                                   KECCAK1600_CTX_x4 *ctx, size_t blks);
 /*
  * SHAKE256_x4_ signle-shot batched API implements x4 SHAKE256 functionalities on top
- * of FIPS202 API layer
+ * of KeccakSponge API layer
  *
  * SHAKE256_x4_ function never fails when the later call-discipline is adhered to:
  * (a) the pointers passed to the functions are valid.