502294 - NSSLOW_Init does not trigger a power-up self-test for DSA

Status: RESOLVED WORKSFORME

(NSS :: Libraries, defect, P1)

Description

[Elio Maldonado]

Attachment: adds code to nsslowhash for a power up dsa self test

From the FIPS validation laboratory we are advised that NSSLOW_Init does not trigger a power-up self-test for DSA. Per Implementation Guidance, Section 9.3, a KAT is required for DSA.

We do a power-up self test for DSA in freebl but not in the code for the nspr-free version in nsslowhash.c. Since DSA is used in the self-integrity check a power-up self test for DSA is required.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

OK, since we have to thaw the FIPS tree for this, we should also plan to 
fix bug 501605 at the same time.  That bug is probably more important to 
Mozilla than FIPS validation, and we wouldn't want Mozilla to have to choose
between the two.

Comment 2

[Elio Maldonado]

Comment on attachment 386779 [details] [diff] [review]
adds code to nsslowhash for a power up dsa self test

The latest communication from the lab is that the DSA KAT is not required after all.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Elio, If you've received additional emails from the lab, please forward copies
to me.  The lab is supposed to be CC'ing me on all communications about our 
evaluation, but apparently that doesn't always happen.

Comment 4

[Elio Maldonado]

(In reply to comment #3) On its way to you.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

So, is this bug now resolved "WORKS FOR ME" ?

Comment 6

[Elio Maldonado]

(In reply to comment #5) Now it is.