Original Motivation
SHA-256, SHA-512 and SHA-512/256 are secure hash algorithms specified in FIPS 180-4, NIST’s Secure Hash Standard. ZFS uses the above as block checksums (checksum=sha256, checksum=sha512) for data integrity and deduplication. There is currently no unit test coverage for this family of hash algorithms.
What does this commit introduce?
It adds a tests/unit/test_sha2.c with three types of tests that follow the FIPS 180-4 standard as defined in https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.180-4.pdf :
- known answer tests (KAT) for SHA-256, SHA-512 and SHA-512/256, using the same NIST test messages and digests as
tests/zfs-tests/cmd/checksum/sha2_test.c
- an incremental test: split updates across the 64- and 128-byte message block boundaries must produce the same digest as a single update
- a cross-implementation test via
zfs_impl_get_ops(): every supported implementation must reproduce the known answer and compute the same digest for a multi-block message
Testing perfomed:
https://github.com/openzfs/zfs/pull/18779