Make Counter Tests for AES-CTR and TDES-CTR Optional

[celic]

Some implementations use a LFSR counter approach which is valid according to the CTR mode standards. However it isn't compatible for the "CTR" test groups in ACVP. We will introduce a new registration parameter for CTR modes "performCounterTests": true/false that allows the client to determine if these tests are applicable.

This does have repercussions for CMVP validations. If tests were not performed, a justification may be needed during a module validation.

[smuellerDD]

Am Freitag, 31. Juli 2020, 16:44:36 CEST schrieb Chris Celi: Hi Chris,

Some implementations use a LFSR counter approach which is valid according to the CTR mode standards. However it isn't compatible for the "CTR" test groups in ACVP. We will introduce a new registration parameter for CTR modes `"performCounterTests": true/false` that allows the client to determine if these tests are applicable. This does have repercussions for CMVP validations. If tests were not performed, a justification may be needed during a module validation.

For clarification: what is the default of that additional flag? Is it enabled to ensure a seamless continuation of existing clients or is it false requiring clients to actively change the requests for existing working solutions? Ciao Stephan

[AlexThurston]

Specifically (and because this just happens to be something top of mind), is this related to the test group/test case that ends up having a payload length of 12800 for example?

[celic]

Default to true yes.

The large payload test groups are indeed the "CTR" test groups.

[AlexThurston]

Is there an ETA on when this setting will be available?

[AlexThurston]

This does have repercussions for CMVP validations. If tests were not performed, a justification may be needed during a module validation.

Also, what kind of repercussions for CMVP?

[celic]

Next release this will be on demo.

When going through a CMVP validation for a module with a CTR mode, if these tests aren't performed additional justification will be needed to explain the counter mechanism. The CMVP should have more details coming soon but as I understand it the reviewer might just ask for this information after reviewing the algorithm certificates. (It will state on the certificate whether or not the tests were performed)

[celic]

This was deployed last night. Leaving issue open until I can put together the documentation update.