crypto/internal/fips/aes: add CAST

For #69536

Change-Id: I6ecbe8b05f9f01afe2aa32c59fc56c9e1c6ea6b4
Reviewed-on: https://go-review.googlesource.com/c/go/+/626437
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

3 files changed, 90 insertions, 0 deletions

diff --git a/src/crypto/internal/fips/aes/cast.go b/src/crypto/internal/fips/aes/cast.go
new file mode 100644
index 0000000000..e1aea8a19b
--- /dev/null
+++ b/src/crypto/internal/fips/aes/cast.go
@@ -0,0 +1,46 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package aes
+
+import (
+	"bytes"
+	"crypto/internal/fips"
+	"errors"
+)
+
+func init() {
+	fips.CAST("AES-CBC", func() error {
+		key := []byte{
+			0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+			0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+		}
+		iv := [16]byte{
+			0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+			0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
+		}
+		plaintext := []byte{
+			0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
+			0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
+		}
+		ciphertext := []byte{
+			0xdf, 0x76, 0x26, 0x4b, 0xd3, 0xb2, 0xc4, 0x8d,
+			0x40, 0xa2, 0x6e, 0x7a, 0xc4, 0xff, 0xbd, 0x35,
+		}
+		b, err := New(key)
+		if err != nil {
+			return err
+		}
+		buf := make([]byte, 16)
+		NewCBCEncrypter(b, iv).CryptBlocks(buf, plaintext)
+		if !bytes.Equal(buf, ciphertext) {
+			return errors.New("unexpected result")
+		}
+		NewCBCDecrypter(b, iv).CryptBlocks(buf, ciphertext)
+		if !bytes.Equal(buf, plaintext) {
+			return errors.New("unexpected result")
+		}
+		return nil
+	})
+}
diff --git a/src/crypto/internal/fips/aes/gcm/cast.go b/src/crypto/internal/fips/aes/gcm/cast.go
new file mode 100644
index 0000000000..3a2b6b7877
--- /dev/null
+++ b/src/crypto/internal/fips/aes/gcm/cast.go
@@ -0,0 +1,42 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package gcm
+
+import (
+	"crypto/internal/fips"
+	"crypto/internal/fips/aes"
+	"errors"
+)
+
+func init() {
+	// Counter KDF covers CMAC per IG 10.3.B, and CMAC covers GCM per IG 10.3.A
+	// Resolution 1.d(i). AES decryption is covered by the CBC CAST in package
+	// crypto/internal/fips/aes.
+	fips.CAST("CounterKDF", func() error {
+		key := []byte{
+			0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+			0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+		}
+		context := [12]byte{
+			0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
+			0x29, 0x2a, 0x2b, 0x2c,
+		}
+		want := [32]byte{
+			0xe6, 0x86, 0x96, 0x97, 0x08, 0xfc, 0x90, 0x30,
+			0x36, 0x1c, 0x65, 0x94, 0xb2, 0x62, 0xa5, 0xf7,
+			0xcb, 0x9d, 0x93, 0x94, 0xda, 0xf1, 0x94, 0x09,
+			0x6a, 0x27, 0x5e, 0x85, 0x22, 0x5e, 0x7a, 0xee,
+		}
+		b, err := aes.New(key)
+		if err != nil {
+			return err
+		}
+		got := NewCounterKDF(b).DeriveKey(0xFF, context)
+		if got != want {
+			return errors.New("unexpected result")
+		}
+		return nil
+	})
+}
diff --git a/src/crypto/internal/fips/cast_external_test.go b/src/crypto/internal/fips/cast_external_test.go
index d31086d5e3..2698f9a9d8 100644
--- a/src/crypto/internal/fips/cast_external_test.go
+++ b/src/crypto/internal/fips/cast_external_test.go
@@ -12,6 +12,8 @@ import (
 	"testing"
 
 	// Import packages that define CASTs to test them.
+	_ "crypto/internal/fips/aes"
+	_ "crypto/internal/fips/aes/gcm"
 	_ "crypto/internal/fips/drbg"
 	_ "crypto/internal/fips/hkdf"
 	_ "crypto/internal/fips/hmac"