mirror of
https://github.com/luxfi/hsm.git
synced 2026-10-30 16:22:43 +00:00
zeekay
8232dc56c4
Add KMIP 2.1 signer (build tag `kmip`) using gemalto/kmip-go for Sign/SignatureVerify/Activate/Revoke/Destroy over TLS 1.3 mTLS. Wire-format complete; live KMS integration tests deferred. Add TR-31/ANSI X9.143 banking key block (Version "D" — AES-256 KBPK Variant Binding Method) for PCI-PIN interop. NIST SP 800-108 KDF + SP 800-38B AES-CMAC + AES-CBC. Authenticator-bound header prevents relabeling attacks. Tests cover roundtrip, header tamper, key tamper, wrong-KBPK, and NIST CAVP AES-CMAC vectors §D.1. Add RequireFIPSProvider startup gate that rejects local / mldsa / nitrokey / zymbit / personal hardware wallets in FIPS-mandated deployments. Approves aws / gcp / azure / pkcs11 / kmip / yubihsm. Add STANDARDS.md compliance matrix tracking 50+ standards across API (PKCS#11 v2.40+v3.0, KMIP 2.1), auth (TLS 1.3 mTLS, FIDO2), crypto (NIST SP 800-90A/B/C/108/131A, FIPS 197/180-4/198-1/202/203/204/205/186-5), hardware certs (FIPS 140-2/3 + CC EAL4-7+), banking (TR-31, TR-34, ISO 9564, PCI-DSS, PCI-PIN), and crypto-currency (CCSS L1-3, NIST IR 8214A). Honest claims only — entries cite test fixtures or are flagged as in-flight or missing with a remediation plan.
52 lines
1.2 KiB
Go
52 lines
1.2 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package hsm
|
|
|
|
import "testing"
|
|
|
|
// TestRequireFIPSProviderAccepts confirms that providers backed by
|
|
// FIPS-validated modules pass the gate without error.
|
|
func TestRequireFIPSProviderAccepts(t *testing.T) {
|
|
for _, p := range []string{
|
|
"aws", "AWS",
|
|
"gcp",
|
|
"azure",
|
|
"yubihsm", "yubico", "yubi",
|
|
"pkcs11",
|
|
"kmip",
|
|
} {
|
|
if err := RequireFIPSProvider(p); err != nil {
|
|
t.Errorf("RequireFIPSProvider(%q) = %v, want nil", p, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestRequireFIPSProviderRejects confirms that pure-software and
|
|
// non-validated providers are rejected.
|
|
func TestRequireFIPSProviderRejects(t *testing.T) {
|
|
cases := map[string]bool{
|
|
"": true,
|
|
"local": true,
|
|
"mldsa": true,
|
|
"pq": true,
|
|
"tr31": true,
|
|
"nitrokey": true,
|
|
"zymbit": true,
|
|
"coldcard": true,
|
|
"foundation": true,
|
|
"keystone": true,
|
|
"ngrave": true,
|
|
"ledger": true,
|
|
"trezor": true,
|
|
"gridplus": true,
|
|
"lattice": true,
|
|
"unknown": true,
|
|
}
|
|
for p := range cases {
|
|
if err := RequireFIPSProvider(p); err == nil {
|
|
t.Errorf("RequireFIPSProvider(%q) = nil, want error", p)
|
|
}
|
|
}
|
|
}
|