Network Working Group B. Fussell, Ed. Internet-Draft Intended status: Informational R. Hammett, Ed. Expires: 11 February 2021 10 August 2020 ACVP KAS ECC JSON Specification Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 11 February 2021. Copyright Notice Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Table of Contents 1. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 3 2. Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 4. Terms and definitions . . . . . . . . . . . . . . . . . . . . 3 5. Supported KAS-ECCs . . . . . . . . . . . . . . . . . . . . . 3 6. Test Types and Test Coverage . . . . . . . . . . . . . . . . 4 6.1. Test Types . . . . . . . . . . . . . . . . . . . . . . . 4 6.2. Test Coverage . . . . . . . . . . . . . . . . . . . . . . 4 6.2.1. KAS-ECC Requirements Covered . . . . . . . . . . . . 4 6.2.2. KAS-ECC Requirements Not Covered . . . . . . . . . . 6 Fussell & Hammett Expires 11 February 2021 [Page 1] Internet-Draft ACVP KAS ECC August 2020 7. Capabilities Registration . . . . . . . . . . . . . . . . . . 7 7.1. Prerequisites . . . . . . . . . . . . . . . . . . . . . . 7 7.2. Required Prerequisite Algorithms . . . . . . . . . . . . 8 7.3. KAS ECC Algorithm Capabilities JSON Values . . . . . . . 9 7.4. Supported KAS ECC Functions . . . . . . . . . . . . . . . 10 7.5. KAS ECC Schemes . . . . . . . . . . . . . . . . . . . . . 11 7.5.1. KAS ECC Scheme Capabilities JSON Values . . . . . . . 11 7.5.2. Supported KAS ECC Schemes . . . . . . . . . . . . . . 12 7.6. KAS ECC Modes . . . . . . . . . . . . . . . . . . . . . . 13 7.6.1. KAS ECC noKdfNoKc . . . . . . . . . . . . . . . . . . 13 7.6.2. KAS ECC kdfNoKc . . . . . . . . . . . . . . . . . . . 13 7.6.3. KAS ECC kdfKc . . . . . . . . . . . . . . . . . . . . 14 7.7. Parameter Sets . . . . . . . . . . . . . . . . . . . . . 14 7.7.1. KAS ECC Parameter Set . . . . . . . . . . . . . . . . 14 7.7.2. KAS ECC Parameter Set Details . . . . . . . . . . . . 15 7.8. Supported ECC Curves . . . . . . . . . . . . . . . . . . 15 7.9. Supported Hash Algorithm Methods . . . . . . . . . . . . 16 7.10. Supported KAS ECC MAC Options . . . . . . . . . . . . . . 16 7.11. Supported KAS ECC KDF Options . . . . . . . . . . . . . . 17 7.11.1. Other Information Construction . . . . . . . . . . . 18 7.12. Supported KAS ECC KC Options . . . . . . . . . . . . . . 19 7.13. Example KAS ECC Capabilities JSON Object . . . . . . . . 19 7.14. Example KAS ECC Component Capabilities JSON Object . . . 21 8. Generation requirements per party per scheme . . . . . . . . 23 9. Test Vectors . . . . . . . . . . . . . . . . . . . . . . . . 26 9.1. Test Groups JSON Schema . . . . . . . . . . . . . . . . . 27 9.2. Test Case JSON Schema . . . . . . . . . . . . . . . . . . 30 9.3. Example Test Vectors JSON Object . . . . . . . . . . . . 33 9.4. Example Test Vectors Component JSON Object . . . . . . . 36 10. Test Vector Responses . . . . . . . . . . . . . . . . . . . . 37 10.1. Vector Set Response JSON Object . . . . . . . . . . . . 38 10.2. Vector Set Group Response JSON Object . . . . . . . . . 38 10.3. Example Test Results JSON Object . . . . . . . . . . . . 38 10.4. Example Test Results Component JSON Object . . . . . . . 40 11. ECC CDH Component Test . . . . . . . . . . . . . . . . . . . 41 11.1. ECC CDH Component Capabilities JSON Values . . . . . . . 41 11.1.1. Example KAS ECC CDH-Component Capabilities JSON Object . . . . . . . . . . . . . . . . . . . . . . . 41 11.2. ECC CDH Component TestVectors JSON Values . . . . . . . 42 11.2.1. ECC CDH Component TestGroup JSON Values . . . . . . 43 11.2.2. ECC CDH Component TestCase JSON Values . . . . . . . 43 11.2.3. Example KAS ECC CDH-Component Test Vectors JSON Object . . . . . . . . . . . . . . . . . . . . . . . 44 11.3. KAS CDH-Component Test Vector Responses . . . . . . . . 46 11.3.1. CDH Component Vector Set Response JSON Object . . . 46 11.3.2. CDH Component Vector Set Group Response JSON Object . . . . . . . . . . . . . . . . . . . . . . . 46 11.3.3. CDH Component Test Case Results JSON Object . . . . 47 Fussell & Hammett Expires 11 February 2021 [Page 2] Internet-Draft ACVP KAS ECC August 2020 11.4. Example KAS ECC CDH Component Test Results JSON Object . . . . . . . . . . . . . . . . . . . . . . . . . 47 12. Security Considerations . . . . . . . . . . . . . . . . . . . 48 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 48 14. Normative references . . . . . . . . . . . . . . . . . . . . 48 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 49 1. Acknowledgements There are no acknowledgements. 2. Abstract This document defines the JSON schema for testing SP800-56a KAS ECC implementations with the ACVP specification. 3. Introduction The Automated Crypto Validation Protocol (ACVP) defines a mechanism to automatically verify the cryptographic implementation of a software or hardware crypto module. The ACVP specification defines how a crypto module communicates with an ACVP server, including crypto capabilities negotiation, session management, authentication, vector processing and more. The ACVP specification does not define algorithm specific JSON constructs for performing the crypto validation. A series of ACVP sub-specifications define the constructs for testing individual crypto algorithms. Each sub- specification addresses a specific class of crypto algorithms. This sub-specification defines the JSON constructs for testing SP800-56a KAS ECC implementations using ACVP. 4. Terms and definitions No terms and definitions are listed in this document. 5. Supported KAS-ECCs The following key derivation functions MAY be advertised by the ACVP compliant cryptographic module: * KAS-ECC / null / 1.0 * KAS-ECC / Component / 1.0 Fussell & Hammett Expires 11 February 2021 [Page 3] Internet-Draft ACVP KAS ECC August 2020 6. Test Types and Test Coverage The ACVP server performs a set of tests on the KAS protocol in order to assess the correctness and robustness of the implementation. A typical ACVP validation session SHALL require multiple tests to be performed for every supported permutation of KAS capabilities. This section describes the design of the tests used to validate implementations of KAS algorithms. 6.1. Test Types There are two test types for KAS testing: * "AFT" - Algorithm Function Test. In the AFT test mode, the IUT SHALL act as a party in the Key Agreement with the ACVP server. The server SHALL generate and provide all necessary information for the IUT to perform a successful key agreement; both the server and IUT MAY act as party U/V, as well as recipient/provider to key confirmation. * "VAL" - Validation Test. In the VAL test mode, The ACVP server MUST generate a complete (from both party U and party V's perspectives) key agreement, and expects the IUT to be able to determine if that agreement is valid. Various types of errors MUST be introduced in varying portions of the key agreement process (changed DKM, changed key, changed hash digest, etc), that the IUT MUST be able to detect and report on. 6.2. Test Coverage The tests described in this document have the intention of ensuring an implementation is conformant to [SP800-56a]. 6.2.1. KAS-ECC Requirements Covered * SP 800-56a - 4.1 Key Establishment Preparations. The ACVP server is responsible for generating domain parameters as per the IUT's capability registration. * SP 800-56a - 4.2 Key-Agreement Process. Both the ACVP server and IUT participate in the Key Agreement process. The server and IUT can both take the roles of party U/V, and as such the "performer" of steps depicted in "Figure 2: Key Agreement process" can vary. Fussell & Hammett Expires 11 February 2021 [Page 4] Internet-Draft ACVP KAS ECC August 2020 * SP 800-56a - 5.1 Cryptographic Hash Functions. All modes of performing KAS SHALL make use of a hash function. The hash function MAY be used for confirmation of a successfully generated shared secret Z (noKdfNoKc), or as a primitive within the KDF being tested (kdfNoKc and kdfKc). * SP 800-56a - 5.2 Message Authentication Code (MAC) Algorithm. A MAC is utilized for confirmation of success for kdfNoKc and kdfKc modes of KAS. Note - a MAC prerequisite is REQUIRED only for kdfKc, though is utilized for both kdfNoKc and kdfKc. * SP 800-56a - 5.4 Nonce. Nonces are made use of in various KAS schemes - both the ACVP server and IUT SHALL be expected to generate nonces. * SP 800-56a - 5.6 Domain Parameters. Domain Parameter Generation SHALL be performed solely from the ACVP server, with constraints from the IUTs capabilities registration. The same set of domain parameters SHALL generate all keypairs (party U/V, static/ ephemeral) for a single test case. * SP 800-56a - 5.6 Key-Pair Generation. While Key-Pairs are used in each KAS scheme, the generation of said key-pairs is out of scope for KAS testing. Random tests from the VAL groups, MAY inject bad keypairs that the IUT MUST be able detect. These random tests are only present in groups given appropriate assurance functions see: Section 7.4 * SP 800-56a - 4.3 DLC-based Key-Transport Process / 5.7 DLC Primitives. Depending on the scheme used, either Diffie Hellman or MQV SHALL be used to negotiate a shared secret of z. Testing and validation of such key exchanges is covered under their respective schemes. * SP 800-56a - 5.8 Key-Derivation Methods for Key-Agreement Schemes. All schemes/modes save noKdfNoKc (component) MUST make use of a KDF. KDF construction SHALL utilize Section 7.11.1 for its pattern. * SP 800-56a - 5.9 Key Confirmation. Most KAS schemes allow for a Key Confirmation process, the ACVP server and IUT MAY be Providers or Recipients of said confirmation. Additionally, key confirmation MAY be performed on one or both parties (depending on scheme). * SP 800-56a - 6 Key Agreement Schemes. All schemes specified in referenced document are supported for validation with the ACVP server. Fussell & Hammett Expires 11 February 2021 [Page 5] Internet-Draft ACVP KAS ECC August 2020 6.2.2. KAS-ECC Requirements Not Covered * SP 800-56a - 4.1 Key Establishment Preparations. The ACVP server SHALL NOT make a distinction between IUT generated keys via a trusted third party and the IUT itself. * SP 800-56a - 5.3 Random Number Generation. The IUT MUST perform all random number generation with a validated random number generator. A DRBG is REQUIRED as a prerequisite to KAS, but SHALL NOT be in the scope testing assurances. * SP 800-56a - 5.4 Nonce. Nonce generation is utilized for several schemes. The various methods of generating a nonce described in section 5.5 MUST be used, however their generation SHALL NOT be in scope of KAS testing assurances. * SP 800-56a - 5.5.2 Assurances of Domain-Parameter Validity. The ACVP server SHALL generate all domain parameters, IUT validation of such parameters is SHALL NOT be in scope for KAS testing. * SP 800-56a - 5.5.3 Domain Parameter Management. Domain Parameter Management SHALL NOT be in scope for KAS testing. * SP 800-56a - 5.6 Key-Pair Generation. While Key-Pairs MUST be used in each KAS scheme, the generation, assurances, and management of said key-pairs SHALL NOT be in scope of KAS testing. * SP 800-56a - 5.8 Key-Derivation Methods for Key-Agreement Schemes. Two-step Key-Derivation (Extraction-then-Expansion) SHALL NOT be utilized in KAS testing. * SP 800-56a - 5.9 Key Confirmation. KMAC is referenced in 800-56a as being a valid MAC function; it however SHALL NOT (currently) be supported in KAS testing. * SP 800-56a - 5.7 Rationale for Selecting a Specific Scheme. It is expected that the IUT registers all schemes it supports in its capabilities registration. Selecting specific schemes from a KAS testing perspective SHALL NOT be in scope. * SP 800-56a - 8 Key Recovery. Key Recovery SHALL NOT be in scope of KAS testing. Fussell & Hammett Expires 11 February 2021 [Page 6] Internet-Draft ACVP KAS ECC August 2020 7. Capabilities Registration ACVP requires crypto modules to register their capabilities. This allows the crypto module to advertise support for specific algorithms, notifying the ACVP server which algorithms need test vectors generated for the validation process. This section describes the constructs for advertising support of KAS ECC algorithms to the ACVP server. The algorithm capabilities MUST be advertised as JSON objects within the 'algorithms' value of the ACVP registration message. The 'algorithms' value is an array, where each array element is an individual JSON object defined in this section. The 'algorithms' value is part of the 'capability_exchange' element of the ACVP JSON registration message. See the ACVP specification [ACVP] for more details on the registration message. 7.1. Prerequisites Each algorithm implementation MAY rely on other cryptographic primitives. For example, RSA Signature algorithms depend on an underlying hash function. Each of these underlying algorithm primitives must be validated, either separately or as part of the same submission. ACVP provides a mechanism for specifying the required prerequisites: Prerequisites, if applicable, MUST be submitted in the registration as the "prereqVals" JSON property array inside each element of the "algorithms" array. Each element in the "prereqVals" array MUST contain the following properties +===============+=============================+===========+ | JSON Property | Description | JSON Type | +===============+=============================+===========+ | algorithm | a prerequisite algorithm | string | +---------------+-----------------------------+-----------+ | valValue | algorithm validation number | string | +---------------+-----------------------------+-----------+ Table 1: Prerequisite Properties A "valValue" of "same" SHALL be used to indicate that the prerequisite is being met by a different algorithm in the capability exchange in the same registration. An example description of prerequisites within a single algorithm capability exchange looks like this Fussell & Hammett Expires 11 February 2021 [Page 7] Internet-Draft ACVP KAS ECC August 2020 "prereqVals": [ { "algorithm": "Alg1", "valValue": "Val-1234" }, { "algorithm": "Alg2", "valValue": "same" } ] Figure 1 7.2. Required Prerequisite Algorithms Some algorithm implementations rely on other cryptographic primitives. For example, IKEv2 uses an underlying SHA algorithm. Each of these underlying algorithm primitives must be validated, either separately or as part of the same submission. ACVP provides a mechanism for specifying the required prerequisites: +============+==============+========+==============+==============+ | JSON Value | Description | JSON | Valid Values | Optional | | | | type | | | +============+==============+========+==============+==============+ | algorithm | a | value | CCM, CMAC, | valValue | | | prerequisite | | DRBG, ECDSA, | | | | algorithm | | HMAC, SHA | | +------------+--------------+--------+--------------+--------------+ | algorithm | value | actual | prereqAlgVal | prerequistie | | validation | | number | | algorithm | | number | | or | | validation | | | | "same" | | | +------------+--------------+--------+--------------+--------------+ Table 2: Required Prerequisite Algorithms JSON Values KAS has conditional prerequisite algorithms, depending on the capabilities registered: Fussell & Hammett Expires 11 February 2021 [Page 8] Internet-Draft ACVP KAS ECC August 2020 +==============+===============================================+ | Prerequisite | Condition | | Algorithm | | +==============+===============================================+ | DRBG | Always REQUIRED | +--------------+-----------------------------------------------+ | SHA | Always REQUIRED | +--------------+-----------------------------------------------+ | ECDSA | ECDSA.PKV validation REQUIRED when IUT using | | | assurance functions of "fullVal", | | | "keyPairGen", or "keyRegen". ECDSA.KeyPair | | | validation REQUIRED when IUT using assurances | | | functions of "keyPairGen", or "keyRegen". | +--------------+-----------------------------------------------+ | AES-CCM | AES-CCM validation REQUIRED when IUT is | | | performing KeyConfirmation (KC) and utilizing | | | AES-CCM. | +--------------+-----------------------------------------------+ | CMAC | CMAC validation REQUIRED when IUT is | | | performing KeyConfirmation (KC) and utilizing | | | CMAC. | +--------------+-----------------------------------------------+ | HMAC | HMAC validation REQUIRED when IUT is | | | performing KeyConfirmation (KC) and utilizing | | | HMAC. | +--------------+-----------------------------------------------+ Table 3: Prerequisite requirement conditions 7.3. KAS ECC Algorithm Capabilities JSON Values Each algorithm capability advertised is a self-contained JSON object using the following values. Fussell & Hammett Expires 11 February 2021 [Page 9] Internet-Draft ACVP KAS ECC August 2020 +============+===============+==============+===========+==========+ | JSON Value | Description | JSON type | Valid | Optional | | | | | Values | | +============+===============+==============+===========+==========+ | algorithm | The algorithm | value | KAS-ECC | No | | | under test | | | | +------------+---------------+--------------+-----------+----------+ | mode | The algorithm | value | Component | Yes | | | mode. | | | | +------------+---------------+--------------+-----------+----------+ | revision | The algorithm | value | "1.0" | No | | | testing | | | | | | revision to | | | | | | use. | | | | +------------+---------------+--------------+-----------+----------+ | prereqVals | Prerequisite | array of | See | No | | | algorithm | prereqAlgVal | Section | | | | validations | objects | 7.2 | | +------------+---------------+--------------+-----------+----------+ | function | Type of | array | See | No | | | function | | Section | | | | supported | | 7.4 | | +------------+---------------+--------------+-----------+----------+ | scheme | Array of | object | See | No | | | supported key | | Section | | | | agreement | | 7.5.1 | | | | schemes each | | | | | | having their | | | | | | own | | | | | | capabilities | | | | +------------+---------------+--------------+-----------+----------+ Table 4: KAS ECC Capabilities JSON Values Note: Some optional values are required depending on the algorithm. Failure to provide these values will result in the ACVP server returning an error to the ACVP client during registration. 7.4. Supported KAS ECC Functions The following function types MAY be advertised by the ACVP compliant crypto module: * dpGen - IUT can perform domain parameter generation (FFC only) * dpVal - IUT can perform domain parameter validation (FFC only) * keyPairGen - IUT can perform keypair generation. Fussell & Hammett Expires 11 February 2021 [Page 10] Internet-Draft ACVP KAS ECC August 2020 * fullVal - IUT can perform full public key validation ( [SP800-56a] section 5.6.2.3.1 / 5.6.2.3.3) * partialVal - IUT can perform partial public key validation ( [SP800-56a] section 5.6.2.3.2 / 5.6.2.3.4) * keyRegen - IUT can regenerate keys given a specific seed and domain parameter (pqg for FFC, curve for ECC) 7.5. KAS ECC Schemes 7.5.1. KAS ECC Scheme Capabilities JSON Values All other scheme capabilities are advertised as a self-contained JSON object using the following values. Note that at least one of "noKdfNoKc", "kdfNoKc", or "kdfKc" *MUST* be supplied with the registration. See <> for allowed ECC scheme types. Figure 2 Fussell & Hammett Expires 11 February 2021 [Page 11] Internet-Draft ACVP KAS ECC August 2020 +===========+=======================+========+===========+==========+ | JSON | Description | JSON | Valid | Optional | | Value | | type | Values | | +===========+=======================+========+===========+==========+ | kasRole | Roles supported for | array | initiator | No | | | key agreement | | and/or | | | | | | responder | | +-----------+-----------------------+--------+-----------+----------+ | noKdfNoKc | Indicates no KDF, | object | Section | Yes | | | no KC tests are to | | 7.6.1 | | | | be generated. Note | | | | | | this is a COMPONENT | | | | | | mode only test. | | | | | | This property MUST | | | | | | only be used with | | | | | | "KAS-ECC" / | | | | | | "Component" | | | | +-----------+-----------------------+--------+-----------+----------+ | kdfNoKc | Indicates KDF, no | object | Section | Yes | | | KC tests are to be | | 7.6.2 | | | | generated. Note | | | | | | this is a KAS-ECC | | | | | | only test. This | | | | | | mode MAY only be | | | | | | used for | | | | | | registrations with | | | | | | "KAS-ECC" (no mode) | | | | +-----------+-----------------------+--------+-----------+----------+ | kdfKc | Indicates KDF, KC | object | Section | Yes | | | tests are to be | | 7.6.3 | | | | generated. Note | | | | | | this is a KAS-ECC | | | | | | only test. This | | | | | | mode MAY only be | | | | | | used for | | | | | | registrations with | | | | | | "KAS-ECC" (no mode) | | | | +-----------+-----------------------+--------+-----------+----------+ Table 5: KAS ECC Capabilities JSON Values 7.5.2. Supported KAS ECC Schemes The following schemes MAY be advertised by the ACVP compliant crypto module: * ephemeralUnified - keyConfirmation not supported Fussell & Hammett Expires 11 February 2021 [Page 12] Internet-Draft ACVP KAS ECC August 2020 * fullMqv * fullUnified * onePassDh - Can only provide unilateral key confirmation party V to party U. * onePassMqv * onePassUnified * staticUnified 7.6. KAS ECC Modes 7.6.1. KAS ECC noKdfNoKc Contains properties REQUIRED for "noKdfNoKc" registration. +==============+==================+========+=========+==========+ | JSON Value | Description | JSON | Valid | Optional | | | | type | Values | | +==============+==================+========+=========+==========+ | parameterSet | The parameterSet | object | Section | No | | | options for | | 7.7.1 | | | | "noKdfNoKc" | | | | +--------------+------------------+--------+---------+----------+ Table 6: NoKdfNoKc Capabilities 7.6.2. KAS ECC kdfNoKc Contains properties REQUIRED for "kdfNoKc" registration. +==============+==================+========+=========+==========+ | JSON Value | Description | JSON | Valid | Optional | | | | type | Values | | +==============+==================+========+=========+==========+ | kdfOption | The kdf options | object | Section | No | | | for "kdfNoKc" | | 7.11 | | +--------------+------------------+--------+---------+----------+ | parameterSet | The parameterSet | object | Section | No | | | options for | | 7.7.1 | | | | "kdfNoKc" | | | | +--------------+------------------+--------+---------+----------+ Table 7: kdfNoKc Capabilities Fussell & Hammett Expires 11 February 2021 [Page 13] Internet-Draft ACVP KAS ECC August 2020 7.6.3. KAS ECC kdfKc Contains properties REQUIRED for "kdfKc" registration. +==============+==================+========+=========+==========+ | JSON Value | Description | JSON | Valid | Optional | | | | type | Values | | +==============+==================+========+=========+==========+ | kdfOption | The kdf options | object | Section | No | | | for "kdfNoKc" | | 7.11 | | +--------------+------------------+--------+---------+----------+ | kcOption | The kc options | object | Section | No | | | for "kdfNoKc" | | 7.12 | | +--------------+------------------+--------+---------+----------+ | parameterSet | The parameterSet | object | Section | No | | | options for | | 7.7.1 | | | | "kdfNoKc" | | | | +--------------+------------------+--------+---------+----------+ Table 8: kdfKc Capabilities 7.7. Parameter Sets 7.7.1. KAS ECC Parameter Set Each parameter set advertised is a self-contained JSON object using the following values. Note that at least one parameter set ("eb", "ec", "ed", "ee") is REQUIRED. +============+===============+===========+==============+==========+ | JSON Value | Description | JSON type | Valid Values | Optional | +============+===============+===========+==============+==========+ | eb | The eb | object | See Section | Yes | | | parameter set | | 7.7.2 | | +------------+---------------+-----------+--------------+----------+ | ec | The ec | object | See Section | Yes | | | parameter set | | 7.7.2 | | +------------+---------------+-----------+--------------+----------+ | ed | The ed | object | See Section | Yes | | | parameter set | | 7.7.2 | | +------------+---------------+-----------+--------------+----------+ | ee | The ee | object | See Section | Yes | | | parameter set | | 7.7.2 | | +------------+---------------+-----------+--------------+----------+ Table 9: KAS ECC Parameter Set Capabilities JSON Values Fussell & Hammett Expires 11 February 2021 [Page 14] Internet-Draft ACVP KAS ECC August 2020 7.7.2. KAS ECC Parameter Set Details * eb: Len n - 224-255, min Len h - 112, min hash len - 224, min keySize - 112, min macSize - 64 * ec: Len n - 256-283, min Len h - 128, min hash len - 256, min keySize - 128, min macSize - 64 * ed: Len n - 384-511, min Len h - 192, min hash len - 384, min keySize - 192, min macSize - 64 * ee: Len n - 512+, min Len h - 256, min hash len - 512, min keySize - 256, min macSize - 64 "noKdfNoKc" *REQUIRES* "hashAlg" "kdfNoKc" *REQUIRES* "hashAlg" and at least one valid MAC registration "kdfKc" *REQUIRES* "hashAlg" and at least one valid MAC registration +===========+=========================+========+=========+==========+ | JSON | Description | JSON | Valid | Optional | | Value | | type | Values | | +===========+=========================+========+=========+==========+ | curve | The elliptic curve | value | See | No | | | to use for key | | Section | | | | generation. | | 7.8 | | +-----------+-------------------------+--------+---------+----------+ | hashAlg | The hash algorithms | array | See | No | | | to use for KDF (and | | Section | | | | noKdfNoKc) | | 7.9 | | +-----------+-------------------------+--------+---------+----------+ | macOption | The macOption(s) to | object | See | Yes | | | use with "kdfNoKc" | | Section | | | | and/or "kdfKc" | | 7.10 | | +-----------+-------------------------+--------+---------+----------+ Table 10: KAS ECC Parameter Set Details Capabilities JSON Values 7.8. Supported ECC Curves The following ECC Curves MAY be advertised by the ACVP compliant crypto module: Fussell & Hammett Expires 11 February 2021 [Page 15] Internet-Draft ACVP KAS ECC August 2020 +===============+=======+=========+========+ | Parameter Set | Prime | Koblitz | Binary | +===============+=======+=========+========+ | eb | P-224 | K-233 | B-233 | +---------------+-------+---------+--------+ | ec | P-256 | K-283 | B-283 | +---------------+-------+---------+--------+ | ed | P-384 | K-409 | B-409 | +---------------+-------+---------+--------+ | ee | P-521 | K-571 | B-571 | +---------------+-------+---------+--------+ Table 11: Supported Curves per parameter set. 7.9. Supported Hash Algorithm Methods The following SHA methods MAY be advertised by the ACVP compliant crypto module: * SHA2-224 * SHA2-256 * SHA2-384 * SHA2-512 7.10. Supported KAS ECC MAC Options The following MAC options MAY be advertised for registration under a "kdfNoKc" and "kdfKc" kasMode: * AES-CCM * CMAC * HMAC-SHA2-224 * HMAC-SHA2-256 * HMAC-SHA2-384 * HMAC-SHA2-512 Fussell & Hammett Expires 11 February 2021 [Page 16] Internet-Draft ACVP KAS ECC August 2020 +==========+=============+========+==================+===========+ | JSON | Description | JSON | Valid Values | Optional | | Value | | type | | | +==========+=============+========+==================+===========+ | keyLen | The | Domain | AES based MACs | No | | | supported | | limited to 128, | | | | keyLens for | | 192, 256. | | | | the | | HashAlg based | | | | selected | | MACs mod 8. All | | | | MAC. | | keySizes minimum | | | | | | MUST conform to | | | | | | parameter set | | | | | | requirements See | | | | | | Section 7.7.2 . | | +----------+-------------+--------+------------------+-----------+ | nonceLen | The nonce | value | Input as bits, | Yes | | | len for use | | 56-104, odd byte | (required | | | with AES- | | values only | for AES- | | | CCM mac | | (7-13). | CCM) | | | | | Additionally | | | | | | minimum MUST | | | | | | conform to | | | | | | parameter set | | | | | | requirements See | | | | | | Section 7.7.2 . | | +----------+-------------+--------+------------------+-----------+ | macLen | The mac len | value | Input as bits, | Yes | | | for use | | mod 8, minimum | (required | | | with mac | | MUST conform to | for AES- | | | | | parameter set | CCM) | | | | | requirements See | | | | | | Section 7.7.2 , | | | | | | maximum SHALL | | | | | | NOT exceed block | | | | | | size.. | | +----------+-------------+--------+------------------+-----------+ Table 12: KAS ECC Mac Option Details 7.11. Supported KAS ECC KDF Options The following MAC options are available for registration under a "kdfNoKc" and "kdfKc" kasMode: * concatenation Fussell & Hammett Expires 11 February 2021 [Page 17] Internet-Draft ACVP KAS ECC August 2020 +===========+======================+=======+==========+==========+ | JSON | Description | JSON | Valid | Optional | | Value | | type | Values | | +===========+======================+=======+==========+==========+ | oiPattern | The OI pattern to | value | See | No | | | use for constructing | | Section | | | | OtherInformation. | | 7.11.1 . | | +-----------+----------------------+-------+----------+----------+ Table 13: KAS ECC KDF Option Details 7.11.1. Other Information Construction Some IUTs *MAY* require a specific pattern for the OtherInfo portion of the KDFs for KAS. An "oiPattern" is specified in the KDF registration to accommodate such requirements. Regardless of the oiPattern specified, the OI bitlength *MUST* be 240 for FFC, and 376 for ECC. The OI *SHALL* be padded with random bits (or the most significant bits utilized) when the specified OI pattern does not meet the bitlength requirement Figure 3 Pattern candidates: * literal[123456789ABCDEF] - uses the specified hex within "[]". literal[123456789ABCDEF] substitutes "123456789ABCDEF" in place of the field * uPartyInfo - uPartyId { || ephemeralKey } { || ephemeralNonce } { || dkmNonce } o dkmNonce is provided by party u for static schemes o "optional" items such as ephemeralKey MUST be included when available for ACVP testing. * vPartyInfo { || ephemeralKey } { || ephemeralNonce } - vPartyId o "optional" items such as ephemeralKey MUST be included when available for ACVP testing. * counter - 32bit counter starting at "1" (0x00000001) Example (Note that party U is the server in this case "434156536964", party V is the IUT "a1b2c3d4e5", using an ECC non-static scheme): Fussell & Hammett Expires 11 February 2021 [Page 18] Internet-Draft ACVP KAS ECC August 2020 * "concatenation" : "literal[123456789CAFECAFE]||uPartyInfo||vPartyInfo" Evaluated as: * "123456789CAFECAFE434156536964a1b2c3d4e5b16c5f78ef56e8c14a561" - "b16c5f78ef56e8c14a561" are random bits applied to meet length requirements 7.12. Supported KAS ECC KC Options The following KC options are available for registration under a "kdfKc" kasMode: +===========+==================+=====+===================+==========+ |JSON Value | Description |JSON | Valid Values | Optional | | | |type | | | +===========+==================+=====+===================+==========+ | kcRole | The role(s) the |array|provider/recipient | No | | | IUT is to act as | | | | | | for | | | | | | KeyConfirmation. | | | | +-----------+------------------+-----+-------------------+----------+ | kcType | The type(s) the |array| unilateral/ | No | | | IUT is to act as | | bilateral | | | | for | | | | | | KeyConfirmation. | | | | +-----------+------------------+-----+-------------------+----------+ | nonceType |The nonce type(s) |array| randomNonce, | No | | |the IUT is to use | | timestamp, | | | | for | | sequence, | | | | KeyConfirmation. | | timestampSequence | | +-----------+------------------+-----+-------------------+----------+ Table 14: KAS ECC KC Option Details Capabilities 7.13. Example KAS ECC Capabilities JSON Object The following is a example JSON object advertising support for KAS ECC. { "algorithm": "KAS-ECC", "revision": "1.0", "prereqVals": [{ "algorithm": "ECDSA", "valValue": "123456" Fussell & Hammett Expires 11 February 2021 [Page 19] Internet-Draft ACVP KAS ECC August 2020 }, { "algorithm": "DRBG", "valValue": "123456" }, { "algorithm": "SHA", "valValue": "123456" }, { "algorithm": "CCM", "valValue": "123456" }, { "algorithm": "CMAC", "valValue": "123456" }, { "algorithm": "HMAC", "valValue": "123456" } ], "function": ["keyPairGen", "dpGen"], "scheme": { "ephemeralUnified": { "kasRole": ["initiator", "responder"], "kdfNoKc": { "kdfOption": { "concatenation": "uPartyInfo||vPartyInfo", "ASN1": "uPartyInfo||vPartyInfo" }, "parameterSet": { "ec": { "curve": "K-283", "hashAlg": ["SHA2-224", "SHA2-256"], "macOption": { "AES-CCM": { "keyLen": [128], "nonceLen": 56, "macLen": 64 } } } } } } } } Fussell & Hammett Expires 11 February 2021 [Page 20] Internet-Draft ACVP KAS ECC August 2020 Figure 4 7.14. Example KAS ECC Component Capabilities JSON Object The following is a example JSON object advertising support for KAS ECC Component. Fussell & Hammett Expires 11 February 2021 [Page 21] Internet-Draft ACVP KAS ECC August 2020 { "algorithm": "KAS-ECC", "mode": "Component", "revision": "1.0", "prereqVals": [{ "algorithm": "ECDSA", "valValue": "123456" }, { "algorithm": "DRBG", "valValue": "123456" }, { "algorithm": "SHA", "valValue": "123456" }, { "algorithm": "CCM", "valValue": "123456" }, { "algorithm": "CMAC", "valValue": "123456" }, { "algorithm": "HMAC", "valValue": "123456" } ], "function": ["keyPairGen", "dpGen"], "scheme": { "ephemeralUnified": { "kasRole": ["initiator", "responder"], "noKdfNoKc": { "parameterSet": { "eb": { "curve": "P-224", "hashAlg": ["SHA2-224", "SHA2-256"] } } } } } } Figure 5 Fussell & Hammett Expires 11 February 2021 [Page 22] Internet-Draft ACVP KAS ECC August 2020 8. Generation requirements per party per scheme The various schemes of KAS all have their own requirements as to keys and nonces per scheme, per party. The below table demonstrates those generation requirements: +===============+=========+===============+===================+========================+=============+================+==============+========+ | Scheme | KasMode | KasRole |KeyConfirmationRole|KeyConfirmationDirection|StaticKeyPair|EphemeralKeyPair|EphemeralNonce|DkmNonce| +===============+=========+===============+===================+========================+=============+================+==============+========+ | DhHybrid1 |NoKdfNoKc|InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 |NoKdfNoKc|ResponderPartyV| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfNoKc |InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfNoKc |ResponderPartyV| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |InitiatorPartyU| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |InitiatorPartyU| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |InitiatorPartyU| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |InitiatorPartyU| Recipient | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |ResponderPartyV| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |ResponderPartyV| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |ResponderPartyV| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhHybrid1 | KdfKc |ResponderPartyV| Recipient | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 |NoKdfNoKc|InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 |NoKdfNoKc|ResponderPartyV| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfNoKc |InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfNoKc |ResponderPartyV| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |InitiatorPartyU| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |InitiatorPartyU| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |InitiatorPartyU| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |InitiatorPartyU| Recipient | Bilateral | True | True | False | False | Fussell & Hammett Expires 11 February 2021 [Page 23] Internet-Draft ACVP KAS ECC August 2020 +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |ResponderPartyV| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |ResponderPartyV| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |ResponderPartyV| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv2 | KdfKc |ResponderPartyV| Recipient | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhEphem |NoKdfNoKc|InitiatorPartyU| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhEphem |NoKdfNoKc|ResponderPartyV| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhEphem | KdfNoKc |InitiatorPartyU| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhEphem | KdfNoKc |ResponderPartyV| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow|NoKdfNoKc|InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow|NoKdfNoKc|ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfNoKc |InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfNoKc |ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |InitiatorPartyU| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |InitiatorPartyU| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |InitiatorPartyU| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |InitiatorPartyU| Recipient | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |ResponderPartyV| Provider | Unilateral | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |ResponderPartyV| Provider | Bilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |ResponderPartyV| Recipient | Unilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ |DhHybridOneFlow| KdfKc |ResponderPartyV| Recipient | Bilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 |NoKdfNoKc|InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 |NoKdfNoKc|ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfNoKc |InitiatorPartyU| None | None | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfNoKc |ResponderPartyV| None | None | True | False | False | False | Fussell & Hammett Expires 11 February 2021 [Page 24] Internet-Draft ACVP KAS ECC August 2020 +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |InitiatorPartyU| Provider | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |InitiatorPartyU| Provider | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |InitiatorPartyU| Recipient | Unilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |InitiatorPartyU| Recipient | Bilateral | True | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |ResponderPartyV| Provider | Unilateral | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |ResponderPartyV| Provider | Bilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |ResponderPartyV| Recipient | Unilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | Mqv1 | KdfKc |ResponderPartyV| Recipient | Bilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow |NoKdfNoKc|InitiatorPartyU| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow |NoKdfNoKc|ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow | KdfNoKc |InitiatorPartyU| None | None | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow | KdfNoKc |ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow | KdfKc |InitiatorPartyU| Recipient | Unilateral | False | True | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhOneFlow | KdfKc |ResponderPartyV| Provider | Unilateral | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic |NoKdfNoKc|InitiatorPartyU| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic |NoKdfNoKc|ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfNoKc |InitiatorPartyU| None | None | True | False | False | True | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfNoKc |ResponderPartyV| None | None | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |InitiatorPartyU| Provider | Unilateral | True | False | False | True | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |InitiatorPartyU| Provider | Bilateral | True | False | False | True | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |InitiatorPartyU| Recipient | Unilateral | True | False | False | True | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |InitiatorPartyU| Recipient | Bilateral | True | False | False | True | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |ResponderPartyV| Provider | Unilateral | True | False | False | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |ResponderPartyV| Provider | Bilateral | True | False | True | False | Fussell & Hammett Expires 11 February 2021 [Page 25] Internet-Draft ACVP KAS ECC August 2020 +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |ResponderPartyV| Recipient | Unilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ | DhStatic | KdfKc |ResponderPartyV| Recipient | Bilateral | True | False | True | False | +---------------+---------+---------------+-------------------+------------------------+-------------+----------------+--------------+--------+ Table 15: Required Party Generation Obligations 9. Test Vectors The ACVP server provides test vectors to the ACVP client, which are then processed and returned to the ACVP server for validation. A typical ACVP validation test session would require multiple test vector sets to be downloaded and processed by the ACVP client. Each test vector set represents an individual algorithm defined during the capability exchange. This section describes the JSON schema for a test vector set used with SP800-56a KAS ECC algorithms. The test vector set JSON schema is a multi-level hierarchy that contains meta data for the entire vector set as well as individual test vectors to be processed by the ACVP client. The following table describes the JSON elements at the top level of the hierarchy. +=============+======================================+===========+ | JSON Values | Description | JSON Type | +=============+======================================+===========+ | acvVersion | Protocol version identifier | string | +-------------+--------------------------------------+-----------+ | vsId | Unique numeric vector set identifier | integer | +-------------+--------------------------------------+-----------+ | algorithm | Algorithm defined in the capability | string | | | exchange | | +-------------+--------------------------------------+-----------+ | mode | Mode defined in the capability | string | | | exchange | | +-------------+--------------------------------------+-----------+ | revision | Protocol test revision selected | string | +-------------+--------------------------------------+-----------+ | testGroups | Array of test groups containing test | array | | | data, see Section 9.1 | | +-------------+--------------------------------------+-----------+ Table 16: Top Level Test Vector JSON Elements An example of this would look like this Fussell & Hammett Expires 11 February 2021 [Page 26] Internet-Draft ACVP KAS ECC August 2020 { "acvVersion": "version", "vsId": 1, "algorithm": "Alg1", "mode": "Mode1", "revision": "Revision1.0", "testGroups": [ ... ] } Figure 6 9.1. Test Groups JSON Schema The testGroups element at the top level in the test vector JSON object is an array of test groups. Test vectors are grouped into similar test cases to reduce the amount of data transmitted in the vector set. For instance, all test vectors that use the same key size would be grouped together. The Test Group JSON object contains meta data that applies to all test vectors within the group. The following table describes the secure hash JSON elements of the Test Group JSON object. The test group for KAS ECC is as follows: +----------------+----------------------+----------------+----------+ | JSON Value | Description | JSON type | Optional | +----------------+----------------------+----------------+----------+ | tgId | Numeric identifier | value | No | | | for the test group, | | | | | unique across the | | | | | entire vector set. | | | +----------------+----------------------+----------------+----------+ | scheme | The scheme for the | value | No | | | test vectors. See | | | | | Section 7.5.1 for | | | | | possible values | | | +----------------+----------------------+----------------+----------+ | testType | The type of | AFT, VAL | No | | | testCases expected | | | | | within the group. | | | | | AFT (Functional) | | | | | tests produce test | | | | | cases where the | | | | | prompt file | | | | | delivers only the | | | | | needed public | | | | | server information | | | | | in which the IUT is | | | Fussell & Hammett Expires 11 February 2021 [Page 27] Internet-Draft ACVP KAS ECC August 2020 | | expected to perform | | | | | KAS. VAL | | | | | (Validity) tests | | | | | produce inputs/ | | | | | outputs from both | | | | | server and IUT | | | | | perspectives of a | | | | | KAS negotiation. | | | | | The expectation of | | | | | the IUT on such | | | | | tests is to | | | | | determine if the | | | | | KAS negotiation was | | | | | successful or not. | | | +----------------+----------------------+----------------+----------+ | kasRole | The KAS role | initiator, | No | | | | responder | | +----------------+----------------------+----------------+----------+ | kasMode | The KAS mode | noKdfNoKc, | No | | | | kdfNoKc, kdfKc | | +----------------+----------------------+----------------+----------+ | parmSet | Parameter set value | eb, ec, ed, ee | No | | | to use | | | +----------------+----------------------+----------------+----------+ | hashAlg | hashAlg values | See | No | | | being used | Section 7.9 | | +----------------+----------------------+----------------+----------+ | macType | The MAC being used. | See | Yes | | | REQUIRED for | Section 7.10 | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | keyLen | The key length of | See | Yes | | | the MAC. REQUIRED | Section 7.10 | | | | for "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | nonceAesCcmLen | The nonce length of | See | Yes | | | the MAC (applies | Section 7.10 | | | | only to AES-CCM). | | | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes using | | | | | a AES-CCM MAC. | | | +----------------+----------------------+----------------+----------+ | macLen | The mac length. | See | Yes | | | REQUIRED for | Section 7.10 | | | | "kdfNoKc" and | | | Fussell & Hammett Expires 11 February 2021 [Page 28] Internet-Draft ACVP KAS ECC August 2020 | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | kdfType | The KDF being used. | concatenation, | Yes | | | REQUIRED for | asn1 | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | idServerLen | The length of the | value | Yes | | | server ID. | | | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | idServer | The server ID. | value | Yes | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | idIutLen | The length of the | value | Yes | | | server ID. | | | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | | | Provided in | | | | | response by IUT for | | | | | AFT tests. | | | +----------------+----------------------+----------------+----------+ | idIut | The server ID. | value | Yes | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | | | Provided in | | | | | response by IUT for | | | | | AFT tests. | | | +----------------+----------------------+----------------+----------+ | oiPattern | The oiPattern used | See | Yes | | | in the KDF. | Section 7.11.1 | | | | REQUIRED for | | | | | "kdfNoKc" and | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | kcRole | Key confirmation | provider, | Yes | | | roles supported. | recipient | | | | REQUIRED for | | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | kcType | Key confirmation | unilateral | Yes | | | types supported. | and/or | | Fussell & Hammett Expires 11 February 2021 [Page 29] Internet-Draft ACVP KAS ECC August 2020 | | REQUIRED for | bilateral | | | | "kdfKc" modes. | | | +----------------+----------------------+----------------+----------+ | curve | The curve useds for | value | No | | | keypair generation | | | +----------------+----------------------+----------------+----------+ | tests | Array of individual | array | No | | | test vector JSON | | | | | objects, which are | | | | | defined in | | | | | Section 9.2 | | | +----------------+----------------------+----------------+----------+ Table 17: Vector Group JSON Object 9.2. Test Case JSON Schema Each test group contains an array of one or more test cases. Each test case is a JSON object that represents a single test vector to be processed by the ACVP client. The following table describes the JSON elements for each test vector. +========================+======================+========+==========+ | JSON Value | Description | JSON | Optional | | | | type | | +========================+======================+========+==========+ | tcId |Numeric identifier for| value | No | | |the test case, unique | | | | | across the entire | | | | | vector set. | | | +------------------------+----------------------+--------+----------+ | staticPublicServerX | The ECDSA static | value | Yes | | | public key X | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | staticPublicServerY | The ECDSA static | value | Yes | | | public key Y | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | ephemeralPublicServerX | The ECDSA ephemeral | value | Yes | | | public key X | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | ephemeralPublicServerY | The ECDSA ephemeral | value | Yes | | | public key Y | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | nonceEphemeralServer | nonceEphemeralServer | value | Yes | Fussell & Hammett Expires 11 February 2021 [Page 30] Internet-Draft ACVP KAS ECC August 2020 | | ONLY USED BY C(1,2) | | | | | and C(0,2) schemes | | | | | with KC. nonce to be | | | | | used in the MacData | | | | | field | | | +------------------------+----------------------+--------+----------+ | nonceNoKc | The 16 byte nonce | value | Yes | | | concatenated to the | | | | | "Standard Test | | | | |Message". Used for No| | | | |Key Confirmation tests| | | | | only. | | | +------------------------+----------------------+--------+----------+ | nonceDkm |The nonce supplied by | value | Yes | | | the initiator to be | | | | | used in the OI field | | | | | in the PartyUInfo | | | | | field. | | | +------------------------+----------------------+--------+----------+ | staticPrivateIut | The IUT ECDSA static | value | Yes | | | private key | | | +------------------------+----------------------+--------+----------+ | staticPublicIutX | The IUT ECDSA static | value | Yes | | | public key X | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | staticPublicIutY | The IUT ECDSA static | value | Yes | | | public key Y | | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | ephemeralPrivateIut | The IUT ECDSA | value | Yes | | |ephemeral private key | | | +------------------------+----------------------+--------+----------+ | ephemeralPublicIutX | The IUT ECDSA | value | Yes | | |ephemeral public key X| | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | ephemeralPublicIutY | The IUT ECDSA | value | Yes | | |ephemeral public key Y| | | | | coordinate | | | +------------------------+----------------------+--------+----------+ | oiLen | Length of the | value | Yes | | | OtherInfo field | | | +------------------------+----------------------+--------+----------+ | oi | OtherInfo field | value | Yes | +------------------------+----------------------+--------+----------+ | dkm | Derived Keying | value | Yes | | | Material. | | | Fussell & Hammett Expires 11 February 2021 [Page 31] Internet-Draft ACVP KAS ECC August 2020 +------------------------+----------------------+--------+----------+ | tagIut | The tag (or MAC) | value | Yes | | | GENERATED BY THE | | | | | SERVER/IUT by using | | | | | the DKM to MAC the | | | | | Message with the | | | | | specified method | | | +------------------------+----------------------+--------+----------+ | nonceEphemeralIut |nonceEphemeralIut ONLY| value | Yes | | | USED BY C(1,2) and | | | | | C(0,2) schemes with | | | | | KC. nonce to be used | | | | | in the MacData field | | | +------------------------+----------------------+--------+----------+ | nonceDkmIut | ONLY USED BY STATIC | value | Yes | | | SCHEME. The nonce | | | | | supplied by the | | | | | initiator to be used | | | | |in the OI field in the| | | | | PartyUInfo field | | | +------------------------+----------------------+--------+----------+ | nonceLenDkm | ONLY USED BY STATIC | value | Yes | | |SCHEME. The length of| | | | |the nonce supplied by | | | | | the initiator to be | | | | | used in the OI field | | | | | in the PartyUInfo | | | | | field. | | | +------------------------+----------------------+--------+----------+ | nonceEphemeralDkm | ONLY USED BY C(1,2) | value | Yes | | | and C(0,2) schemes | | | | | with KC. nonce to be | | | | | used in the MacData | | | | | field | | | +------------------------+----------------------+--------+----------+ | nonceEphemralDkmLen | length of | value | Yes | | | nonceEphemeralIut | | | | | value. | | | +------------------------+----------------------+--------+----------+ | nonceAesCcm |Nonce used by the CCM | value | Yes | | | function, if CCM is | | | | | used to generate the | | | | | Tag. | | | +------------------------+----------------------+--------+----------+ | macData | The message to be | value | Yes | | | MAced. | | | +------------------------+----------------------+--------+----------+ | | A shared secret that | value | Yes | Fussell & Hammett Expires 11 February 2021 [Page 32] Internet-Draft ACVP KAS ECC August 2020 | | is used to derive | | | | |secret keying material| | | | |using a key derivation| | | | | function. | | | +------------------------+----------------------+--------+----------+ | hashZServer | The hashed shared | value | Yes | | |secret, only provided | | | | |in noKdfNoKc modes of | | | | | operation. | | | +------------------------+----------------------+--------+----------+ | hashZIut | The hashed shared | value | Yes | | |secret, only provided | | | | |in noKdfNoKc modes of | | | | | operation. | | | +------------------------+----------------------+--------+----------+ | testPassed | Pass Fail indicating |boolean | Yes | | |if the IUT agrees with| | | | | the Tag generated by | | | | | the server. | | | +------------------------+----------------------+--------+----------+ Table 18: Test Case JSON Object 9.3. Example Test Vectors JSON Object The following is a example JSON object for KAS ECC test vectors sent from the ACVP server to the crypto module. [{ "acvVersion": "1.0" }, { "vsId": 1564, "algorithm": "KAS-ECC", "revision": "1.0", "testGroups": [ { "tgId": 1, "scheme": "ephemeralUnified", "testType": "AFT", "kasRole": "initiator", "kasMode": "kdfNoKc", "parmSet": "ec", "hashAlg": "SHA2-256", "macType": "AES-CCM", "keyLen": 128, "aesCcmNonceLen": 64, "macLen": 128, Fussell & Hammett Expires 11 February 2021 [Page 33] Internet-Draft ACVP KAS ECC August 2020 "kdfType": "asn1", "idServerLen": 48, "idServer": "434156536964", "curve": "P-256", "tests": [{ "tcId": 151, "ephemeralPublicServerX": "CBC9AF2F0FCE0F06643D7524DCCA96C78564BA77196C5F5F65DC0A119409A1F3", "ephemeralPublicServerY": "B619EBE85F2EC5E0A9B542CC77539D698C96CA5D0BDFCA224787C30CF971E3F4", "nonceNoKc": "BBDF1A42C9405B58B8329D583C437331", "nonceAesCcm": "FF5B0FD5F295257B" }] }, { "tgId": 2, "scheme": "ephemeralUnified", "testType": "AFT", "kasRole": "responder", "kasMode": "kdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "macType": "HMAC-SHA2-224", "keyLen": 128, "macLen": 128, "kdfType": "asn1", "idServerLen": 48, "idServer": "434156536964", "curve": "P-224", "tests": [{ "tcId": 161, "ephemeralPublicServerX": "FFAD4CDB4293F61C2A74566FD4323A03C6BB3F9D6526D8E0506B2186", "ephemeralPublicServerY": "0D614DAA05395A5FDF51BC769AEC355C9688ECEFCF2FE10E6DC1030E", "nonceNoKc": "BEAB1A2CB8406A7083105EC234603A80" }] }, { "tgId": 3, "scheme": "ephemeralUnified", "testType": "VAL", "kasRole": "initiator", "kasMode": "kdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "macType": "HMAC-SHA2-224", "keyLen": 128, "macLen": 128, "kdfType": "asn1", "idServerLen": 48, "idServer": "434156536964", Fussell & Hammett Expires 11 February 2021 [Page 34] Internet-Draft ACVP KAS ECC August 2020 "idIutLen": 0, "curve": "P-224", "tests": [{ "tcId": 181, "ephemeralPublicServerX": "D489605D37C4F555E50D8F010BEE3165B93F7C749263C4BF3E9A4808", "ephemeralPublicServerY": "23C8167ACFB24DC62D6747960330471B28DC646E04E593DBE6F8F1A4", "nonceNoKc": "6BBFEECEBBD5200C5FAE050526A77342", "ephemeralPrivateIut": "343936401C5F88E658E2C9C47C2EB48DDE10506684D8B55027C05A15", "ephemeralPublicIutX": "14AA2C1ECDC258FE8AD035E9A2872CD14466783F82F5F3F8D757133A", "ephemeralPublicIutY": "8DD3D48BF9115EA5AB7A479FB1DAB0A46BCD6B4D1A306D5CAC254EC1", "oiLen": 376, "otherInfo": "A1B2C3D4E5434156536964CAFECAFE2D822B413172BB3012AA986AFFAE95B46360E00AAD0D0548104C1F946389B97D", "tagIut": "5EEE5D912191984D89DF074B9A885411" }] }, { "tgId": 4, "scheme": "ephemeralUnified", "testType": "VAL", "kasRole": "responder", "kasMode": "kdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "macType": "AES-CCM", "keyLen": 128, "aesCcmNonceLen": 64, "macLen": 128, "kdfType": "asn1", "idServerLen": 48, "idServer": "434156536964", "idIutLen": 0, "curve": "P-224", "tests": [{ "tcId": 231, "ephemeralPublicServerX": "A0457CF2F5D38B72FF1BF3A2CF4C7CE30F215B5E52A53C39193B1639", "ephemeralPublicServerY": "38CA7951888E462D6C5F4E46FA953FF231F43D5A4F3FEBAEEBF3D52B", "nonceNoKc": "A889762176F5F02F8C1E4BBC0C669805", "ephemeralPrivateIut": "5F76009454AE9158797467C297229569C6E2027D6AFC226A63489444", "ephemeralPublicIutX": "1060CEE336B183738952CF13760D542E2F3AA60124D560EFA10F392C", "ephemeralPublicIutY": "216EA3B35E630A1EA4A91C430E5B63306A83624F0FFD8ADFF63A380E", "oiLen": 376, "otherInfo": "454156536964A1B2C3D4E5CAFECAFE9EF1EA2DC20EE820E7562CDD4DBCD5FD8CD57DB1F54961D8B0C83342C09B7D72", "nonceAesCcm": "BD79B8A8D5559128", "tagIut": "5CC10EF2564B0CD23D746A47DB5B98A2" }] } ] } Fussell & Hammett Expires 11 February 2021 [Page 35] Internet-Draft ACVP KAS ECC August 2020 ] Figure 7 9.4. Example Test Vectors Component JSON Object The following is a example JSON object for KAS ECC Component test vectors sent from the ACVP server to the crypto module. [{ "acvVersion": "1.0" }, { "vsId": 1565, "algorithm": "KAS-ECC", "mode": "Component", "revision": "1.0", "testGroups": [{ "tgId": 1, "scheme": "ephemeralUnified", "testType": "AFT", "kasRole": "initiator", "kasMode": "noKdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "curve": "P-224", "tests": [{ "tcId": 1, "ephemeralPublicServerX": "DACE4B35FD720DDD6B307777EBAFE53859C5FC2D330755B05B061CEB", "ephemeralPublicServerY": "195344DE0C79898C5C060BFACE1D24FDE1127ECF503EA04B08FFB9F1" }] }, { "tgId": 2, "scheme": "ephemeralUnified", "testType": "AFT", "kasRole": "responder", "kasMode": "noKdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "curve": "P-224", "tests": [{ "tcId": 21, "ephemeralPublicServerX": "747EDBB8F62E1F06BD542FC2DD93169CB24DA6EF9E2FED4FE60FCBE6", "ephemeralPublicServerY": "C7FB2C3C9B95E70D908B9992C8018B785F7BCD3E5967E37EFB18A422" }] }, { "tgId": 3, Fussell & Hammett Expires 11 February 2021 [Page 36] Internet-Draft ACVP KAS ECC August 2020 "scheme": "ephemeralUnified", "testType": "VAL", "kasRole": "initiator", "kasMode": "noKdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "curve": "P-224", "tests": [{ "tcId": 41, "ephemeralPublicServerX": "866BD81E951787AA1130CB67BA48E22F8A9E7EFF0713418B4FB8A31C", "ephemeralPublicServerY": "050C9E3DB4560313979FE465AC8624E93BC0D97E7C68AC589840BCF7", "ephemeralPrivateIut": "0C9AE6286544FED81921E6495B946C6AF39DF90EC68379CEF2F7C69D", "ephemeralPublicIutX": "CA296A5C86EC39C4EA626A8D9AB39DE5D5092FAA3AE2F241D7791497", "ephemeralPublicIutY": "F768358D14A428C61A3229FB4BB752F02ECC1F54763CA98655A8412C", "hashZIut": "FC6268A34B63B5A82AF03A6CABE61C69CC57317E5E8C8F508FCB82D0" }] }, { "tgId": 4, "scheme": "ephemeralUnified", "testType": "VAL", "kasRole": "responder", "kasMode": "noKdfNoKc", "parmSet": "eb", "hashAlg": "SHA2-224", "curve": "P-224", "tests": [{ "tcId": 91, "ephemeralPublicServerX": "7A2EBA553C4DC0E4D7A19A3648BA9713496EB462B1B7D83D375F7FFD", "ephemeralPublicServerY": "5972BF3B114612AA5BBA14D0BE956DED03359F52ADDF0B9C2D0314E1", "ephemeralPrivateIut": "9AEDA69CE438C6F8592CE3B8E14E92BE9143E82B3EED42CF62E45BF7", "ephemeralPublicIutX": "941DAF3C527D2B76AA907F60C208F8987681972E466529CA8BD962FD", "ephemeralPublicIutY": "F381EC5DBEA7F6EA3A09D2D75372C014C3DE3ECABBBBC00DDFB97359", "hashZIut": "BB61FA1DCA5D93A6FBB43317AABCAE22A3EDF7F72216516115935D4E" }] } ] } ] Figure 8 10. Test Vector Responses After the ACVP client downloads and processes a vector set, it must send the response vectors back to the ACVP server. The following table describes the JSON object that represents a vector set response. Fussell & Hammett Expires 11 February 2021 [Page 37] Internet-Draft ACVP KAS ECC August 2020 10.1. Vector Set Response JSON Object +============+===========================================+=======+ | JSON Value | Description | JSON | | | | type | +============+===========================================+=======+ | acvVersion | Protocol version identifier | value | +------------+-------------------------------------------+-------+ | vsId | Unique numeric identifier for the vector | value | | | set | | +------------+-------------------------------------------+-------+ | testGroups | Array of JSON objects that represent each | array | | | test vector group. See Section 10.2 | | +------------+-------------------------------------------+-------+ Table 19: Vector Set Response JSON Object The testGroups section is used to organize the ACVP client response in a similar manner to how it receives vectors. Several algorithms SHALL require the client to send back group level properties in their response. This structure helps accommodate that. 10.2. Vector Set Group Response JSON Object +============+=============================+===========+ | JSON Value | Description | JSON type | +============+=============================+===========+ | tgId | The test group Id | value | +------------+-----------------------------+-----------+ | tests | The tests associated to the | value | | | group specified in tgId | | +------------+-----------------------------+-----------+ Table 20: Vector Set Group Response JSON Object 10.3. Example Test Results JSON Object The following is a example JSON object for KAS ECC test results sent from the crypto module to the ACVP server. [{ "acvVersion": "1.0" }, { "vsId": 1564, "testGroups": [{ "tgId": 1, "tests": [{ Fussell & Hammett Expires 11 February 2021 [Page 38] Internet-Draft ACVP KAS ECC August 2020 "tcId": 151, "nonceNoKc": "BBDF1A42C9405B58B8329D583C437331", "ephemeralPublicIutX": "F90FE5B7D5DA0F7849B0849D780143F4CC7E9F080465AA05DBD3E610D6B24763", "ephemeralPublicIutY": "1D746A8F960AE8425C63DE17618362F7040365D9168F21A0762526ECCC556084", "idIutLen": 40, "idIut": "A1B2C3D4E5", "oiLen": 376, "oi": "A1B2C3D4E5434156536964CAFECAFEA0988C0EB862E29CBFBD0B087D3223B9052811800B2D1ADF1D42AE73BAAD162A", "nonceAesCcm": "FF5B0FD5F295257B", "tagIut": "FF1ADCA06E582AD9E4A8B7FE3D7D9C28" }] }, { "tgId": 2, "tests": [{ "tcId": 161, "nonceNoKc": "BEAB1A2CB8406A7083105EC234603A80", "ephemeralPublicIutX": "C5D934686BAB0E156D4F5CF1BDA7B044128C803E4C8AA2D9B0024FC0", "ephemeralPublicIutY": "E2D8973A51A9CE0FA7FAD8A444ECAB518C672C65313BEE4150CFD50E", "idIutLen": 40, "idIut": "A1B2C3D4E5", "oiLen": 376, "oi": "434156536964A1B2C3D4E5CAFECAFE9D9E4AB0A187C117158C9A234F4AEE8328714003BFED6C08A7F191E61DCA2B6A", "tagIut": "77587ED9D13B811F200214FD5E1F864A" }] }, { "tgId": 3, "tests": [{ "tcId": 181, "testPassed": false }] }, { "tgId": 4, "tests": [{ "tcId": 231, "testPassed": false }] } ] } ] Figure 9 Fussell & Hammett Expires 11 February 2021 [Page 39] Internet-Draft ACVP KAS ECC August 2020 10.4. Example Test Results Component JSON Object The following is a example JSON object for KAS ECC Component test results sent from the crypto module to the ACVP server. [{ "acvVersion": "1.0" }, { "vsId": 1564, "testGroups": [{ "tgId": 1, "tests": [{ "tcId": 1, "ephemeralPublicIutX": "50471CE7F6FE2CAD6C901F85BF258E84571D3C88F59356B91DDBF286", "ephemeralPublicIutY": "5B8A7BC07BE15F28D34AA8324DEE93C715F569D3AF4820209F6452E7", "hashZIut": "96DCAF87127AB615896CCD0479C8BEAFD7EE111F384C962687D28ACC" }] }, { "tgId": 2, "tests": [{ "tcId": 21, "ephemeralPublicIutX": "3E95CE4241A63C4ECBDC12CF2A3FB9E56222C0D395885CF0B51B04F7", "ephemeralPublicIutY": "F8865F76DE98CFCFBBAD2E99A317636F48AC874847E0A489C96631EC", "hashZIut": "3B7721F7514C09DD38D62E72E20D0375A7B3AC5BD837A7B860BC65FA" }] }, { "tgId": 3, "tests": [{ "tcId": 41, "testPassed": false }] }, { "tgId": 4, "tests": [{ "tcId": 91, "testPassed": true }] } ] } ] Figure 10 Fussell & Hammett Expires 11 February 2021 [Page 40] Internet-Draft ACVP KAS ECC August 2020 11. ECC CDH Component Test The ECC CDH Component Test 11.1. ECC CDH Component Capabilities JSON Values Each algorithm capability advertised is a self-contained JSON object using the following values. +------------+--------------+--------------+---------------+--------+ | JSON Value | Description | JSON type | Valid Values |Optional| +------------+--------------+--------------+---------------+--------+ | algorithm |The algorithm | value | KAS-ECC | No | | | under test | | | | +------------+--------------+--------------+---------------+--------+ | mode |The algorithm | value | CDH-Component | No | | | mode | | | | +------------+--------------+--------------+---------------+--------+ | revision |The algorithm | value | "1.0" | No | | | testing | | | | | | revision to | | | | | | use. | | | | +------------+--------------+--------------+---------------+--------+ | prereqVals | Prerequisite | array of |See Section 7.2| No | | | algorithm | prereqAlgVal | | | | | validations | objects | | | +------------+--------------+--------------+---------------+--------+ | curve | Array of | array |See Section 7.8| No | | | supported | | | | | | curves | | | | +------------+--------------+--------------+---------------+--------+ Table 21: KAS ECC Component Capabilities JSON Values 11.1.1. Example KAS ECC CDH-Component Capabilities JSON Object The following is a example JSON object advertising support for KAS ECC CDH-Component. Fussell & Hammett Expires 11 February 2021 [Page 41] Internet-Draft ACVP KAS ECC August 2020 { "algorithm": "KAS-ECC", "mode": "CDH-Component", "revision": "1.0", "prereqVals": [{ "algorithm": "ECDSA", "valValue": "123456" }], "function": ["keyPairGen", "dpGen"], "curve": ["p-192", "k-163", "b-163"] } Figure 11 11.2. ECC CDH Component TestVectors JSON Values +============+=================+=======+===============+==========+ | JSON Value | Description | JSON | Valid Values | Optional | | | | type | | | +============+=================+=======+===============+==========+ | algorithm | The algorithm | value | KAS-ECC | No | | | under test | | | | +------------+-----------------+-------+---------------+----------+ | mode | The algorithm | value | CDH-Component | No | | | mode under test | | | | +------------+-----------------+-------+---------------+----------+ | revision | The algorithm | value | "1.0" | No | | | testing | | | | | | revision to | | | | | | use. | | | | +------------+-----------------+-------+---------------+----------+ | testGroups | Array of | Array | Array of test | No | | | individual test | | group | | | | group JSON | | information | | | | objects, which | | | | | | are defined in | | | | | | Section 11.2.1 | | | | +------------+-----------------+-------+---------------+----------+ Table 22: KAS ECC CDH Component TestVectors JSON Values Fussell & Hammett Expires 11 February 2021 [Page 42] Internet-Draft ACVP KAS ECC August 2020 11.2.1. ECC CDH Component TestGroup JSON Values +==========+=====================+=======+===============+==========+ | JSON | Description | JSON | Valid Values | Optional | | Value | | type | | | +==========+=====================+=======+===============+==========+ | testType | The test type | value | AFT | No | | | expected within | | | | | | the group. AFT | | | | | | is the only | | | | | | valid value for | | | | | | ECC Component. | | | | +----------+---------------------+-------+---------------+----------+ | curve | The curve used | value | P-224, P-256, | No | | | in the test | | P-384, P-521, | | | | group | | K-233, K-283, | | | | | | K-409, K-571, | | | | | | B-233, B-283, | | | | | | B-409, B-571 | | +----------+---------------------+-------+---------------+----------+ | tests | Array of | array | | No | | | individual test | | | | | | vector JSON | | | | | | objects, which | | | | | | are defined in | | | | | | Section 11.2.2 | | | | +----------+---------------------+-------+---------------+----------+ Table 23: KAS ECC CDH Component TestGroup JSON Values 11.2.2. ECC CDH Component TestCase JSON Values +===============+============================+========+==========+ | JSON Value | Description | Valid | Optional | | | | Values | | +===============+============================+========+==========+ | tcId | Numeric identifier for the | value | No | | | test case, unique across | | | | | the entire vector set. | | | +---------------+----------------------------+--------+----------+ | publicServerX | The X coordinate of the | value | Yes | | | server's public key | | | +---------------+----------------------------+--------+----------+ | publicServerY | The Y coordinate of the | value | Yes | | | server's public key | | | +---------------+----------------------------+--------+----------+ | publicIutX | The X coordinate of the | value | No | | | iut's public key | | | Fussell & Hammett Expires 11 February 2021 [Page 43] Internet-Draft ACVP KAS ECC August 2020 +---------------+----------------------------+--------+----------+ | publicIutY | The Y coordinate of the | value | No | | | iut's public key | | | +---------------+----------------------------+--------+----------+ | | The shared secret Z | value | No | +---------------+----------------------------+--------+----------+ Table 24: KAS ECC CDH Component TestCase JSON Values 11.2.3. Example KAS ECC CDH-Component Test Vectors JSON Object The following is a example JSON object for KAS ECC CDH-Component test vectors sent from the ACVP server to the crypto module. Fussell & Hammett Expires 11 February 2021 [Page 44] Internet-Draft ACVP KAS ECC August 2020 [{ "acvVersion": "1.0" }, { "vsId": 1750, "algorithm": "KAS-ECC", "mode": "CDH-Component", "revision": "1.0", "testGroups": [{ "tgId": 1, "testType": "AFT", "curve": "p-192", "tests": [{ "tcId": 1, "publicServerX": "CAEF2CBA796BB7FC143D3EAED698C26AAE6F6F79DF3974EE", "publicServerY": "03ED6D7A90637629DBCEBFF4A2D1D771D9D4CF9F0D88CE90" }] }, { "tgId": 2, "testType": "AFT", "curve": "k-163", "tests": [{ "tcId": 26, "publicServerX": "048C46D674E1218D0BD3C9FCD120ECE8B4DB7310E7", "publicServerY": "ED3EEDB656E035C779081090BE44B743E857E3B4" }] }, { "tgId": 3, "testType": "AFT", "curve": "b-163", "tests": [{ "tcId": 51, "publicServerX": "8EE7C8F08BF47B21CA2FE911B721651B90E52391", "publicServerY": "0461DF3646E95598EAE4F5C6A634E71006ABC6FE1F" }] } ] } ] Figure 12 Fussell & Hammett Expires 11 February 2021 [Page 45] Internet-Draft ACVP KAS ECC August 2020 11.3. KAS CDH-Component Test Vector Responses After the ACVP client downloads and processes a vector set, it must send the response vectors back to the ACVP server. The following table describes the JSON object that represents a vector set response. 11.3.1. CDH Component Vector Set Response JSON Object +============+===========================================+=======+ | JSON Value | Description | JSON | | | | type | +============+===========================================+=======+ | acvVersion | Protocol version identifier | value | +------------+-------------------------------------------+-------+ | vsId | Unique numeric identifier for the vector | value | | | set | | +------------+-------------------------------------------+-------+ | testGroups | Array of JSON objects that represent each | array | | | test vector group. See Section 11.3.2 | | +------------+-------------------------------------------+-------+ Table 25: CDH Component Vector Set Response JSON Object The testGroups section is used to organize the ACVP client response in a similar manner to how it receives vectors. Several algorithms SHALL require the client to send back group level properties in their response. This structure helps accommodate that. 11.3.2. CDH Component Vector Set Group Response JSON Object +============+===================+=============+ | JSON Value | Description | JSON type | +============+===================+=============+ | tgId | The test group Id | value tests | +------------+-------------------+-------------+ Table 26: CDH Component Vector Set Group Response JSON Object Each test group contains an array of one or more test cases. Each test case is a JSON object that represents a single test vector to be processed by the ACVP client. The following table describes the JSON elements for each DRBG test vector. Fussell & Hammett Expires 11 February 2021 [Page 46] Internet-Draft ACVP KAS ECC August 2020 11.3.3. CDH Component Test Case Results JSON Object +============+============================+=======+==========+ | JSON Value | Description | JSON | Optional | | | | type | | +============+============================+=======+==========+ | tcId | Numeric identifier for the | value | No | | | test case, unique across | | | | | the entire vector set. | | | +------------+----------------------------+-------+----------+ | publicIutX | x value of the IUT public | value | No | | | key | | | +------------+----------------------------+-------+----------+ | publicIutY | x value of the IUT public | value | No | | | key | | | +------------+----------------------------+-------+----------+ | | Computed shared secret Z | value | No | +------------+----------------------------+-------+----------+ Table 27: CDH Component Test Case Results JSON Object 11.4. Example KAS ECC CDH Component Test Results JSON Object The following is a example JSON object for KAS ECC CDH Component test results sent from the crypto module to the ACVP server. Fussell & Hammett Expires 11 February 2021 [Page 47] Internet-Draft ACVP KAS ECC August 2020 [{ "acvVersion": "1.0" }, { "vsId": 1750, "testGroups": [{ "tgId": 1, "tests": [{ "tcId": 1, "publicIutX": "DB9FBC84CBAD3EED42C31CDBF2882041634D040219C3E47A", "publicIutY": "9BD672733BCCEF2BD805E97FF9BBFE0FFC003BEEEF56868B", "z": "8BEAEA60DFAC075F9F25A5CFEA39818D98D3EA4B9D4C34A8" }] }, { "tgId": 2, "tests": [{ "tcId": 26, "publicIutX": "058C593D1D4E8238102BDE6B497218D92F8EDD2997", "publicIutY": "0437682E4608984EFC7FB619FB260EF27CAF704D7B", "z": "075D9A831E0665521D613AEAA59B8C8CDFBAC8C683" }] }, { "tgId": 3, "tests": [{ "tcId": 51, "publicIutX": "04128CD094F6988AA26DA2B100A71A31214CC9C50B", "publicIutY": "01A3A88C9F0987E488922573D0A31D300532F0B268", "z": "07EC896621BF1703EB7567196ED1DE5742C4695990" }] } ] } ] Figure 13 12. Security Considerations There are no additional security considerations outside of those outlined in the ACVP document. 13. IANA Considerations This document does not require any action by IANA. 14. Normative references Fussell & Hammett Expires 11 February 2021 [Page 48] Internet-Draft ACVP KAS ECC August 2020 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", IETF RFC 2119, IETF RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC7991] Hoffman, P., "The "xml2rfc" Version 3 Vocabulary", IETF RFC 7991, IETF RFC 7991, DOI 10.17487/RFC7991, December 2016, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", IETF RFC 8174, IETF RFC 8174, DOI 10.17487/RFC8174, May 2017, . [ACVP] Hammett, R., Fussell, B., Vassilev, A., and H. Booth, "Automatic Cryptographic Validation Protocol", 2019. [FIPS186-4] National Institute of Standards and Technology, "FIPS 186-4 Digital Signature Standard (DSS)", 2013, . [SP800-56a] Barker, E., Chen, L., Roginsky, A., Vassilev, A., and R. Davis, "SP800-56Ar3 Recommendation for Pair-Wise Key- Establishment Schemes Using Discrete Logarithm Cryptography", 2018, . Authors' Addresses Barry Fussell (editor) Email: bfussell@cisco.com Russell Hammett (editor) Email: russ.hammett@g2-inc.com Fussell & Hammett Expires 11 February 2021 [Page 49]