Skip to content

Add ACVP Support for KAS-ECC#3010

Merged
justsmth merged 5 commits intoaws:mainfrom
nhatnghiho:acvp-kas-ecc
Mar 6, 2026
Merged

Add ACVP Support for KAS-ECC#3010
justsmth merged 5 commits intoaws:mainfrom
nhatnghiho:acvp-kas-ecc

Conversation

@nhatnghiho
Copy link
Copy Markdown
Contributor

Issues:

Addresses P355857148

Description of changes:

This PR adds ACVP support for KAS-ECC onePassDh and ephemeralUnified

Call-outs:

Due to the random nature of ECDH, no expected vector was added. To review, please run the script locally to verify the result.

Testing:

Run check_expected.go on the new KAS-ECC test vectors.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Copy link
Copy Markdown
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clang-tidy made some suggestions

const Span<const uint8_t> info = args[3];
const Span<const uint8_t> out_len_bytes = args[4];

uint32_t out_len;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: variable 'out_len' is not initialized [cppcoreguidelines-init-variables]

Suggested change
uint32_t out_len;
uint32_t out_len = 0;

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Feb 19, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.38%. Comparing base (e2b4850) to head (d1a1e25).
⚠️ Report is 39 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3010   +/-   ##
=======================================
  Coverage   78.37%   78.38%           
=======================================
  Files         689      689           
  Lines      121148   121148           
  Branches    16973    16975    +2     
=======================================
+ Hits        94948    94957    +9     
+ Misses      25302    25297    -5     
+ Partials      898      894    -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

sgmenda
sgmenda previously approved these changes Feb 19, 2026
Copy link
Copy Markdown
Member

@skmcgrail skmcgrail left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tested this with the ACVP demo server?

Comment on lines +73 to +74
EphemeralXHex string `json:"ephemeralPublicIutX,omitempty"`
EphemeralYHex string `json:"ephemeralPublicIutY,omitempty"`
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
EphemeralXHex string `json:"ephemeralPublicIutX,omitempty"`
EphemeralYHex string `json:"ephemeralPublicIutY,omitempty"`
EphemeralXHex hexEncodedByteString `json:"ephemeralPublicIutX,omitempty"`
EphemeralYHex hexEncodedByteString `json:"ephemeralPublicIutY,omitempty"`

Then you don't need to call hex.EncodeString(result[0]) etc.

Comment on lines +168 to +176
iutId, err := hex.DecodeString(group.IutId)
if err != nil {
return nil, err
}

serverId, err := hex.DecodeString(group.ServerId)
if err != nil {
return nil, err
}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm confused these aren't hex values so why are you calling hex.DecodeString?

Copy link
Copy Markdown
Contributor Author

@nhatnghiho nhatnghiho Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As counter-intuitive as it sounds, they are hex values (as noted in the JSON specifications here). I'll change their type from string to hexEncodedByteString

EphemeralXHex string `json:"ephemeralPublicIutX,omitempty"`
EphemeralYHex string `json:"ephemeralPublicIutY,omitempty"`

Dkm string `json:"dkm,omitempty"`
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Dkm string `json:"dkm,omitempty"`
Dkm hexEncodedByteString `json:"dkm,omitempty"`

{"auxFunctionName": "SHA2-384"},
{"auxFunctionName": "SHA2-512"}
],
"fixedInfoPattern": "algorithmId",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't match the fixedInfoPattern you are constructing in Go?

Copy link
Copy Markdown
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clang-tidy made some suggestions

p += x.size();

memcpy(fixed_info.get() + p, y.data(), y.size());
p += y.size();
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: Value stored to 'p' is never read [clang-analyzer-deadcode.DeadStores]

    p += y.size();
    ^
Additional context

util/fipstools/acvp/modulewrapper/modulewrapper.cc:2981: Value stored to 'p' is never read

    p += y.size();
    ^

@justsmth justsmth merged commit ec37c27 into aws:main Mar 6, 2026
420 of 455 checks passed
WillChilds-Klein pushed a commit to WillChilds-Klein/aws-lc that referenced this pull request Mar 11, 2026
### Issues:
Addresses P355857148

### Description of changes: 
This PR adds ACVP support for `KAS-ECC onePassDh and ephemeralUnified`

### Call-outs:
Due to the random nature of ECDH, no expected vector was added. To
review, please run the script locally to verify the result.

### Testing:
Run `check_expected.go` on the new KAS-ECC test vectors.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.

---------

Co-authored-by: Sanketh Menda <sgmenda@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants