test_crypto.c 115 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202
  1. /* Copyright (c) 2001-2004, Roger Dingledine.
  2. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  3. * Copyright (c) 2007-2018, The Tor Project, Inc. */
  4. /* See LICENSE for licensing information */
  5. #include "orconfig.h"
  6. #define CRYPTO_CURVE25519_PRIVATE
  7. #define CRYPTO_RAND_PRIVATE
  8. #include "core/or/or.h"
  9. #include "test/test.h"
  10. #include "lib/crypt_ops/aes.h"
  11. #include "siphash.h"
  12. #include "lib/crypt_ops/crypto_curve25519.h"
  13. #include "lib/crypt_ops/crypto_dh.h"
  14. #include "lib/crypt_ops/crypto_ed25519.h"
  15. #include "lib/crypt_ops/crypto_format.h"
  16. #include "lib/crypt_ops/crypto_hkdf.h"
  17. #include "lib/crypt_ops/crypto_rand.h"
  18. #include "lib/crypt_ops/crypto_init.h"
  19. #include "ed25519_vectors.inc"
  20. #include "test/log_test_helpers.h"
  21. #ifdef HAVE_SYS_STAT_H
  22. #include <sys/stat.h>
  23. #endif
  24. #ifdef HAVE_UNISTD_H
  25. #include <unistd.h>
  26. #endif
  27. #if defined(ENABLE_OPENSSL)
  28. #include "lib/crypt_ops/compat_openssl.h"
  29. DISABLE_GCC_WARNING(redundant-decls)
  30. #include <openssl/dh.h>
  31. ENABLE_GCC_WARNING(redundant-decls)
  32. #endif
  33. /** Run unit tests for Diffie-Hellman functionality. */
  34. static void
  35. test_crypto_dh(void *arg)
  36. {
  37. crypto_dh_t *dh1 = crypto_dh_new(DH_TYPE_CIRCUIT);
  38. crypto_dh_t *dh1_dup = NULL;
  39. crypto_dh_t *dh2 = crypto_dh_new(DH_TYPE_CIRCUIT);
  40. char p1[DH1024_KEY_LEN];
  41. char p2[DH1024_KEY_LEN];
  42. char s1[DH1024_KEY_LEN];
  43. char s2[DH1024_KEY_LEN];
  44. ssize_t s1len, s2len;
  45. #ifdef ENABLE_OPENSSL
  46. crypto_dh_t *dh3 = NULL;
  47. DH *dh4 = NULL;
  48. BIGNUM *pubkey_tmp = NULL;
  49. #endif
  50. (void)arg;
  51. tt_int_op(crypto_dh_get_bytes(dh1),OP_EQ, DH1024_KEY_LEN);
  52. tt_int_op(crypto_dh_get_bytes(dh2),OP_EQ, DH1024_KEY_LEN);
  53. memset(p1, 0, DH1024_KEY_LEN);
  54. memset(p2, 0, DH1024_KEY_LEN);
  55. tt_mem_op(p1,OP_EQ, p2, DH1024_KEY_LEN);
  56. tt_int_op(-1, OP_EQ, crypto_dh_get_public(dh1, p1, 6)); /* too short */
  57. tt_assert(! crypto_dh_get_public(dh1, p1, DH1024_KEY_LEN));
  58. tt_mem_op(p1,OP_NE, p2, DH1024_KEY_LEN);
  59. tt_assert(! crypto_dh_get_public(dh2, p2, DH1024_KEY_LEN));
  60. tt_mem_op(p1,OP_NE, p2, DH1024_KEY_LEN);
  61. memset(s1, 0, DH1024_KEY_LEN);
  62. memset(s2, 0xFF, DH1024_KEY_LEN);
  63. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p2, DH1024_KEY_LEN, s1, 50);
  64. s2len = crypto_dh_compute_secret(LOG_WARN, dh2, p1, DH1024_KEY_LEN, s2, 50);
  65. tt_assert(s1len > 0);
  66. tt_int_op(s1len,OP_EQ, s2len);
  67. tt_mem_op(s1,OP_EQ, s2, s1len);
  68. /* test dh_dup; make sure it works the same. */
  69. dh1_dup = crypto_dh_dup(dh1);
  70. s1len = crypto_dh_compute_secret(LOG_WARN, dh1_dup, p2, DH1024_KEY_LEN,
  71. s1, 50);
  72. tt_i64_op(s1len, OP_GE, 0);
  73. tt_mem_op(s1,OP_EQ, s2, s1len);
  74. {
  75. /* Now fabricate some bad values and make sure they get caught. */
  76. /* 1 and 0 should both fail. */
  77. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, "\x01", 1, s1, 50);
  78. tt_int_op(-1, OP_EQ, s1len);
  79. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, "\x00", 1, s1, 50);
  80. tt_int_op(-1, OP_EQ, s1len);
  81. memset(p1, 0, DH1024_KEY_LEN); /* 0 with padding. */
  82. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  83. s1, 50);
  84. tt_int_op(-1, OP_EQ, s1len);
  85. p1[DH1024_KEY_LEN-1] = 1; /* 1 with padding*/
  86. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  87. s1, 50);
  88. tt_int_op(-1, OP_EQ, s1len);
  89. /* 2 is okay, though weird. */
  90. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, "\x02", 1, s1, 50);
  91. tt_int_op(50, OP_EQ, s1len);
  92. /* 2 a second time is still okay, though weird. */
  93. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, "\x02", 1, s1, 50);
  94. tt_int_op(50, OP_EQ, s1len);
  95. const char P[] =
  96. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  97. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  98. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  99. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  100. "49286651ECE65381FFFFFFFFFFFFFFFF";
  101. /* p-1, p, and so on are not okay. */
  102. base16_decode(p1, sizeof(p1), P, strlen(P));
  103. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  104. s1, 50);
  105. tt_int_op(-1, OP_EQ, s1len);
  106. p1[DH1024_KEY_LEN-1] = 0xFE; /* p-1 */
  107. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  108. s1, 50);
  109. tt_int_op(-1, OP_EQ, s1len);
  110. p1[DH1024_KEY_LEN-1] = 0xFD; /* p-2 works fine */
  111. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  112. s1, 50);
  113. tt_int_op(50, OP_EQ, s1len);
  114. const char P_plus_one[] =
  115. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  116. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  117. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  118. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  119. "49286651ECE653820000000000000000";
  120. base16_decode(p1, sizeof(p1), P_plus_one, strlen(P_plus_one));
  121. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  122. s1, 50);
  123. tt_int_op(-1, OP_EQ, s1len);
  124. p1[DH1024_KEY_LEN-1] = 0x01; /* p+2 */
  125. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  126. s1, 50);
  127. tt_int_op(-1, OP_EQ, s1len);
  128. p1[DH1024_KEY_LEN-1] = 0xff; /* p+256 */
  129. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  130. s1, 50);
  131. tt_int_op(-1, OP_EQ, s1len);
  132. memset(p1, 0xff, DH1024_KEY_LEN), /* 2^1024-1 */
  133. s1len = crypto_dh_compute_secret(LOG_WARN, dh1, p1, DH1024_KEY_LEN,
  134. s1, 50);
  135. tt_int_op(-1, OP_EQ, s1len);
  136. }
  137. {
  138. /* provoke an error in the openssl DH_compute_key function; make sure we
  139. * survive. */
  140. tt_assert(! crypto_dh_get_public(dh1, p1, DH1024_KEY_LEN));
  141. crypto_dh_free(dh2);
  142. dh2= crypto_dh_new(DH_TYPE_CIRCUIT); /* no private key set */
  143. s1len = crypto_dh_compute_secret(LOG_WARN, dh2,
  144. p1, DH1024_KEY_LEN,
  145. s1, 50);
  146. tt_int_op(s1len, OP_EQ, -1);
  147. }
  148. #if defined(ENABLE_OPENSSL)
  149. {
  150. /* Make sure that our crypto library can handshake with openssl. */
  151. dh3 = crypto_dh_new(DH_TYPE_TLS);
  152. tt_assert(!crypto_dh_get_public(dh3, p1, DH1024_KEY_LEN));
  153. dh4 = crypto_dh_new_openssl_tls();
  154. tt_assert(DH_generate_key(dh4));
  155. const BIGNUM *pk=NULL;
  156. #ifdef OPENSSL_1_1_API
  157. const BIGNUM *sk=NULL;
  158. DH_get0_key(dh4, &pk, &sk);
  159. #else
  160. pk = dh4->pub_key;
  161. #endif
  162. tt_assert(pk);
  163. tt_int_op(BN_num_bytes(pk), OP_LE, DH1024_KEY_LEN);
  164. tt_int_op(BN_num_bytes(pk), OP_GT, 0);
  165. memset(p2, 0, sizeof(p2));
  166. /* right-pad. */
  167. BN_bn2bin(pk, (unsigned char *)(p2+DH1024_KEY_LEN-BN_num_bytes(pk)));
  168. s1len = crypto_dh_handshake(LOG_WARN, dh3, p2, DH1024_KEY_LEN,
  169. (unsigned char *)s1, sizeof(s1));
  170. pubkey_tmp = BN_bin2bn((unsigned char *)p1, DH1024_KEY_LEN, NULL);
  171. s2len = DH_compute_key((unsigned char *)s2, pubkey_tmp, dh4);
  172. tt_int_op(s1len, OP_EQ, s2len);
  173. tt_int_op(s1len, OP_GT, 0);
  174. tt_mem_op(s1, OP_EQ, s2, s1len);
  175. }
  176. #endif
  177. done:
  178. crypto_dh_free(dh1);
  179. crypto_dh_free(dh2);
  180. crypto_dh_free(dh1_dup);
  181. #ifdef ENABLE_OPENSSL
  182. crypto_dh_free(dh3);
  183. if (dh4)
  184. DH_free(dh4);
  185. if (pubkey_tmp)
  186. BN_free(pubkey_tmp);
  187. #endif
  188. }
  189. static void
  190. test_crypto_openssl_version(void *arg)
  191. {
  192. (void)arg;
  193. #ifdef ENABLE_NSS
  194. tt_skip();
  195. #else
  196. const char *version = crypto_openssl_get_version_str();
  197. const char *h_version = crypto_openssl_get_header_version_str();
  198. tt_assert(version);
  199. tt_assert(h_version);
  200. if (strcmpstart(version, h_version)) { /* "-fips" suffix, etc */
  201. TT_DIE(("OpenSSL library version %s did not begin with header version %s.",
  202. version, h_version));
  203. }
  204. if (strstr(version, "OpenSSL")) {
  205. TT_DIE(("assertion failed: !strstr(\"%s\", \"OpenSSL\")", version));
  206. }
  207. int a=-1,b=-1,c=-1;
  208. if (!strcmpstart(version, "LibreSSL") || !strcmpstart(version, "BoringSSL"))
  209. return;
  210. int r = tor_sscanf(version, "%d.%d.%d", &a,&b,&c);
  211. tt_int_op(r, OP_EQ, 3);
  212. tt_int_op(a, OP_GE, 0);
  213. tt_int_op(b, OP_GE, 0);
  214. tt_int_op(c, OP_GE, 0);
  215. #endif
  216. done:
  217. ;
  218. }
  219. /** Run unit tests for our random number generation function and its wrappers.
  220. */
  221. static void
  222. test_crypto_rng(void *arg)
  223. {
  224. int i, j, allok;
  225. char data1[100], data2[100];
  226. double d;
  227. char *h=NULL;
  228. /* Try out RNG. */
  229. (void)arg;
  230. tt_assert(! crypto_seed_rng());
  231. crypto_rand(data1, 100);
  232. crypto_rand(data2, 100);
  233. tt_mem_op(data1,OP_NE, data2,100);
  234. allok = 1;
  235. for (i = 0; i < 100; ++i) {
  236. uint64_t big;
  237. char *host;
  238. j = crypto_rand_int(100);
  239. if (j < 0 || j >= 100)
  240. allok = 0;
  241. big = crypto_rand_uint64(UINT64_C(1)<<40);
  242. if (big >= (UINT64_C(1)<<40))
  243. allok = 0;
  244. big = crypto_rand_uint64(UINT64_C(5));
  245. if (big >= 5)
  246. allok = 0;
  247. d = crypto_rand_double();
  248. tt_assert(d >= 0);
  249. tt_assert(d < 1.0);
  250. host = crypto_random_hostname(3,8,"www.",".onion");
  251. if (strcmpstart(host,"www.") ||
  252. strcmpend(host,".onion") ||
  253. strlen(host) < 13 ||
  254. strlen(host) > 18)
  255. allok = 0;
  256. tor_free(host);
  257. }
  258. /* Make sure crypto_random_hostname clips its inputs properly. */
  259. h = crypto_random_hostname(20000, 9000, "www.", ".onion");
  260. tt_assert(! strcmpstart(h,"www."));
  261. tt_assert(! strcmpend(h,".onion"));
  262. tt_int_op(63+4+6, OP_EQ, strlen(h));
  263. tt_assert(allok);
  264. done:
  265. tor_free(h);
  266. }
  267. static void
  268. test_crypto_rng_range(void *arg)
  269. {
  270. int got_smallest = 0, got_largest = 0;
  271. int i;
  272. (void)arg;
  273. for (i = 0; i < 1000; ++i) {
  274. int x = crypto_rand_int_range(5,9);
  275. tt_int_op(x, OP_GE, 5);
  276. tt_int_op(x, OP_LT, 9);
  277. if (x == 5)
  278. got_smallest = 1;
  279. if (x == 8)
  280. got_largest = 1;
  281. }
  282. /* These fail with probability 1/10^603. */
  283. tt_assert(got_smallest);
  284. tt_assert(got_largest);
  285. got_smallest = got_largest = 0;
  286. const uint64_t ten_billion = 10 * ((uint64_t)1000000000000);
  287. for (i = 0; i < 1000; ++i) {
  288. uint64_t x = crypto_rand_uint64_range(ten_billion, ten_billion+10);
  289. tt_u64_op(x, OP_GE, ten_billion);
  290. tt_u64_op(x, OP_LT, ten_billion+10);
  291. if (x == ten_billion)
  292. got_smallest = 1;
  293. if (x == ten_billion+9)
  294. got_largest = 1;
  295. }
  296. tt_assert(got_smallest);
  297. tt_assert(got_largest);
  298. const time_t now = time(NULL);
  299. for (i = 0; i < 2000; ++i) {
  300. time_t x = crypto_rand_time_range(now, now+60);
  301. tt_i64_op(x, OP_GE, now);
  302. tt_i64_op(x, OP_LT, now+60);
  303. if (x == now)
  304. got_smallest = 1;
  305. if (x == now+59)
  306. got_largest = 1;
  307. }
  308. tt_assert(got_smallest);
  309. tt_assert(got_largest);
  310. done:
  311. ;
  312. }
  313. static void
  314. test_crypto_rng_strongest(void *arg)
  315. {
  316. const char *how = arg;
  317. int broken = 0;
  318. if (how == NULL) {
  319. ;
  320. } else if (!strcmp(how, "nosyscall")) {
  321. break_strongest_rng_syscall = 1;
  322. } else if (!strcmp(how, "nofallback")) {
  323. break_strongest_rng_fallback = 1;
  324. } else if (!strcmp(how, "broken")) {
  325. broken = break_strongest_rng_syscall = break_strongest_rng_fallback = 1;
  326. }
  327. #define N 128
  328. uint8_t combine_and[N];
  329. uint8_t combine_or[N];
  330. int i, j;
  331. memset(combine_and, 0xff, N);
  332. memset(combine_or, 0, N);
  333. for (i = 0; i < 100; ++i) { /* 2^-100 chances just don't happen. */
  334. uint8_t output[N];
  335. memset(output, 0, N);
  336. if (how == NULL) {
  337. /* this one can't fail. */
  338. crypto_strongest_rand(output, sizeof(output));
  339. } else {
  340. int r = crypto_strongest_rand_raw(output, sizeof(output));
  341. if (r == -1) {
  342. if (broken) {
  343. goto done; /* we're fine. */
  344. }
  345. /* This function is allowed to break, but only if it always breaks. */
  346. tt_int_op(i, OP_EQ, 0);
  347. tt_skip();
  348. } else {
  349. tt_assert(! broken);
  350. }
  351. }
  352. for (j = 0; j < N; ++j) {
  353. combine_and[j] &= output[j];
  354. combine_or[j] |= output[j];
  355. }
  356. }
  357. for (j = 0; j < N; ++j) {
  358. tt_int_op(combine_and[j], OP_EQ, 0);
  359. tt_int_op(combine_or[j], OP_EQ, 0xff);
  360. }
  361. done:
  362. ;
  363. #undef N
  364. }
  365. /** Run unit tests for our AES128 functionality */
  366. static void
  367. test_crypto_aes128(void *arg)
  368. {
  369. char *data1 = NULL, *data2 = NULL, *data3 = NULL;
  370. crypto_cipher_t *env1 = NULL, *env2 = NULL;
  371. int i, j;
  372. char *mem_op_hex_tmp=NULL;
  373. char key[CIPHER_KEY_LEN];
  374. int use_evp = !strcmp(arg,"evp");
  375. evaluate_evp_for_aes(use_evp);
  376. evaluate_ctr_for_aes();
  377. data1 = tor_malloc(1024);
  378. data2 = tor_malloc(1024);
  379. data3 = tor_malloc(1024);
  380. /* Now, test encryption and decryption with stream cipher. */
  381. data1[0]='\0';
  382. for (i = 1023; i>0; i -= 35)
  383. strncat(data1, "Now is the time for all good onions", i);
  384. memset(data2, 0, 1024);
  385. memset(data3, 0, 1024);
  386. crypto_rand(key, sizeof(key));
  387. env1 = crypto_cipher_new(key);
  388. tt_ptr_op(env1, OP_NE, NULL);
  389. env2 = crypto_cipher_new(key);
  390. tt_ptr_op(env2, OP_NE, NULL);
  391. /* Try encrypting 512 chars. */
  392. crypto_cipher_encrypt(env1, data2, data1, 512);
  393. crypto_cipher_decrypt(env2, data3, data2, 512);
  394. tt_mem_op(data1,OP_EQ, data3, 512);
  395. tt_mem_op(data1,OP_NE, data2, 512);
  396. /* Now encrypt 1 at a time, and get 1 at a time. */
  397. for (j = 512; j < 560; ++j) {
  398. crypto_cipher_encrypt(env1, data2+j, data1+j, 1);
  399. }
  400. for (j = 512; j < 560; ++j) {
  401. crypto_cipher_decrypt(env2, data3+j, data2+j, 1);
  402. }
  403. tt_mem_op(data1,OP_EQ, data3, 560);
  404. /* Now encrypt 3 at a time, and get 5 at a time. */
  405. for (j = 560; j < 1024-5; j += 3) {
  406. crypto_cipher_encrypt(env1, data2+j, data1+j, 3);
  407. }
  408. for (j = 560; j < 1024-5; j += 5) {
  409. crypto_cipher_decrypt(env2, data3+j, data2+j, 5);
  410. }
  411. tt_mem_op(data1,OP_EQ, data3, 1024-5);
  412. /* Now make sure that when we encrypt with different chunk sizes, we get
  413. the same results. */
  414. crypto_cipher_free(env2);
  415. env2 = NULL;
  416. memset(data3, 0, 1024);
  417. env2 = crypto_cipher_new(key);
  418. tt_ptr_op(env2, OP_NE, NULL);
  419. for (j = 0; j < 1024-16; j += 17) {
  420. crypto_cipher_encrypt(env2, data3+j, data1+j, 17);
  421. }
  422. for (j= 0; j < 1024-16; ++j) {
  423. if (data2[j] != data3[j]) {
  424. printf("%d: %d\t%d\n", j, (int) data2[j], (int) data3[j]);
  425. }
  426. }
  427. tt_mem_op(data2,OP_EQ, data3, 1024-16);
  428. crypto_cipher_free(env1);
  429. env1 = NULL;
  430. crypto_cipher_free(env2);
  431. env2 = NULL;
  432. /* NIST test vector for aes. */
  433. /* IV starts at 0 */
  434. env1 = crypto_cipher_new("\x80\x00\x00\x00\x00\x00\x00\x00"
  435. "\x00\x00\x00\x00\x00\x00\x00\x00");
  436. crypto_cipher_encrypt(env1, data1,
  437. "\x00\x00\x00\x00\x00\x00\x00\x00"
  438. "\x00\x00\x00\x00\x00\x00\x00\x00", 16);
  439. test_memeq_hex(data1, "0EDD33D3C621E546455BD8BA1418BEC8");
  440. /* Now test rollover. All these values are originally from a python
  441. * script. */
  442. crypto_cipher_free(env1);
  443. env1 = crypto_cipher_new_with_iv(
  444. "\x80\x00\x00\x00\x00\x00\x00\x00"
  445. "\x00\x00\x00\x00\x00\x00\x00\x00",
  446. "\x00\x00\x00\x00\x00\x00\x00\x00"
  447. "\xff\xff\xff\xff\xff\xff\xff\xff");
  448. memset(data2, 0, 1024);
  449. crypto_cipher_encrypt(env1, data1, data2, 32);
  450. test_memeq_hex(data1, "335fe6da56f843199066c14a00a40231"
  451. "cdd0b917dbc7186908a6bfb5ffd574d3");
  452. crypto_cipher_free(env1);
  453. env1 = crypto_cipher_new_with_iv(
  454. "\x80\x00\x00\x00\x00\x00\x00\x00"
  455. "\x00\x00\x00\x00\x00\x00\x00\x00",
  456. "\x00\x00\x00\x00\xff\xff\xff\xff"
  457. "\xff\xff\xff\xff\xff\xff\xff\xff");
  458. memset(data2, 0, 1024);
  459. crypto_cipher_encrypt(env1, data1, data2, 32);
  460. test_memeq_hex(data1, "e627c6423fa2d77832a02b2794094b73"
  461. "3e63c721df790d2c6469cc1953a3ffac");
  462. crypto_cipher_free(env1);
  463. env1 = crypto_cipher_new_with_iv(
  464. "\x80\x00\x00\x00\x00\x00\x00\x00"
  465. "\x00\x00\x00\x00\x00\x00\x00\x00",
  466. "\xff\xff\xff\xff\xff\xff\xff\xff"
  467. "\xff\xff\xff\xff\xff\xff\xff\xff");
  468. memset(data2, 0, 1024);
  469. crypto_cipher_encrypt(env1, data1, data2, 32);
  470. test_memeq_hex(data1, "2aed2bff0de54f9328efd070bf48f70a"
  471. "0EDD33D3C621E546455BD8BA1418BEC8");
  472. /* Now check rollover on inplace cipher. */
  473. crypto_cipher_free(env1);
  474. env1 = crypto_cipher_new_with_iv(
  475. "\x80\x00\x00\x00\x00\x00\x00\x00"
  476. "\x00\x00\x00\x00\x00\x00\x00\x00",
  477. "\xff\xff\xff\xff\xff\xff\xff\xff"
  478. "\xff\xff\xff\xff\xff\xff\xff\xff");
  479. crypto_cipher_crypt_inplace(env1, data2, 64);
  480. test_memeq_hex(data2, "2aed2bff0de54f9328efd070bf48f70a"
  481. "0EDD33D3C621E546455BD8BA1418BEC8"
  482. "93e2c5243d6839eac58503919192f7ae"
  483. "1908e67cafa08d508816659c2e693191");
  484. crypto_cipher_free(env1);
  485. env1 = crypto_cipher_new_with_iv(
  486. "\x80\x00\x00\x00\x00\x00\x00\x00"
  487. "\x00\x00\x00\x00\x00\x00\x00\x00",
  488. "\xff\xff\xff\xff\xff\xff\xff\xff"
  489. "\xff\xff\xff\xff\xff\xff\xff\xff");
  490. crypto_cipher_crypt_inplace(env1, data2, 64);
  491. tt_assert(tor_mem_is_zero(data2, 64));
  492. done:
  493. tor_free(mem_op_hex_tmp);
  494. if (env1)
  495. crypto_cipher_free(env1);
  496. if (env2)
  497. crypto_cipher_free(env2);
  498. tor_free(data1);
  499. tor_free(data2);
  500. tor_free(data3);
  501. }
  502. static void
  503. test_crypto_aes_ctr_testvec(void *arg)
  504. {
  505. const char *bitstr = arg;
  506. char *mem_op_hex_tmp=NULL;
  507. crypto_cipher_t *c=NULL;
  508. /* from NIST SP800-38a, section F.5 */
  509. const char ctr16[] = "f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff";
  510. const char plaintext16[] =
  511. "6bc1bee22e409f96e93d7e117393172a"
  512. "ae2d8a571e03ac9c9eb76fac45af8e51"
  513. "30c81c46a35ce411e5fbc1191a0a52ef"
  514. "f69f2445df4f9b17ad2b417be66c3710";
  515. const char *ciphertext16;
  516. const char *key16;
  517. int bits;
  518. if (!strcmp(bitstr, "128")) {
  519. ciphertext16 = /* section F.5.1 */
  520. "874d6191b620e3261bef6864990db6ce"
  521. "9806f66b7970fdff8617187bb9fffdff"
  522. "5ae4df3edbd5d35e5b4f09020db03eab"
  523. "1e031dda2fbe03d1792170a0f3009cee";
  524. key16 = "2b7e151628aed2a6abf7158809cf4f3c";
  525. bits = 128;
  526. } else if (!strcmp(bitstr, "192")) {
  527. ciphertext16 = /* section F.5.3 */
  528. "1abc932417521ca24f2b0459fe7e6e0b"
  529. "090339ec0aa6faefd5ccc2c6f4ce8e94"
  530. "1e36b26bd1ebc670d1bd1d665620abf7"
  531. "4f78a7f6d29809585a97daec58c6b050";
  532. key16 = "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b";
  533. bits = 192;
  534. } else if (!strcmp(bitstr, "256")) {
  535. ciphertext16 = /* section F.5.5 */
  536. "601ec313775789a5b7a7f504bbf3d228"
  537. "f443e3ca4d62b59aca84e990cacaf5c5"
  538. "2b0930daa23de94ce87017ba2d84988d"
  539. "dfc9c58db67aada613c2dd08457941a6";
  540. key16 =
  541. "603deb1015ca71be2b73aef0857d7781"
  542. "1f352c073b6108d72d9810a30914dff4";
  543. bits = 256;
  544. } else {
  545. tt_abort_msg("AES doesn't support this number of bits.");
  546. }
  547. char key[32];
  548. char iv[16];
  549. char plaintext[16*4];
  550. memset(key, 0xf9, sizeof(key)); /* poison extra bytes */
  551. base16_decode(key, sizeof(key), key16, strlen(key16));
  552. base16_decode(iv, sizeof(iv), ctr16, strlen(ctr16));
  553. base16_decode(plaintext, sizeof(plaintext),
  554. plaintext16, strlen(plaintext16));
  555. c = crypto_cipher_new_with_iv_and_bits((uint8_t*)key, (uint8_t*)iv, bits);
  556. crypto_cipher_crypt_inplace(c, plaintext, sizeof(plaintext));
  557. test_memeq_hex(plaintext, ciphertext16);
  558. done:
  559. tor_free(mem_op_hex_tmp);
  560. crypto_cipher_free(c);
  561. }
  562. /** Run unit tests for our SHA-1 functionality */
  563. static void
  564. test_crypto_sha(void *arg)
  565. {
  566. crypto_digest_t *d1 = NULL, *d2 = NULL;
  567. int i;
  568. #define RFC_4231_MAX_KEY_SIZE 131
  569. char key[RFC_4231_MAX_KEY_SIZE];
  570. char digest[DIGEST256_LEN];
  571. char data[DIGEST512_LEN];
  572. char d_out1[DIGEST512_LEN], d_out2[DIGEST512_LEN];
  573. char *mem_op_hex_tmp=NULL;
  574. /* Test SHA-1 with a test vector from the specification. */
  575. (void)arg;
  576. i = crypto_digest(data, "abc", 3);
  577. test_memeq_hex(data, "A9993E364706816ABA3E25717850C26C9CD0D89D");
  578. tt_int_op(i, OP_EQ, 0);
  579. /* Test SHA-256 with a test vector from the specification. */
  580. i = crypto_digest256(data, "abc", 3, DIGEST_SHA256);
  581. test_memeq_hex(data, "BA7816BF8F01CFEA414140DE5DAE2223B00361A3"
  582. "96177A9CB410FF61F20015AD");
  583. tt_int_op(i, OP_EQ, 0);
  584. /* Test SHA-512 with a test vector from the specification. */
  585. i = crypto_digest512(data, "abc", 3, DIGEST_SHA512);
  586. test_memeq_hex(data, "ddaf35a193617abacc417349ae20413112e6fa4e89a97"
  587. "ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3"
  588. "feebbd454d4423643ce80e2a9ac94fa54ca49f");
  589. tt_int_op(i, OP_EQ, 0);
  590. /* Test HMAC-SHA256 with test cases from wikipedia and RFC 4231 */
  591. /* Case empty (wikipedia) */
  592. crypto_hmac_sha256(digest, "", 0, "", 0);
  593. tt_str_op(hex_str(digest, 32),OP_EQ,
  594. "B613679A0814D9EC772F95D778C35FC5FF1697C493715653C6C712144292C5AD");
  595. /* Case quick-brown (wikipedia) */
  596. crypto_hmac_sha256(digest, "key", 3,
  597. "The quick brown fox jumps over the lazy dog", 43);
  598. tt_str_op(hex_str(digest, 32),OP_EQ,
  599. "F7BC83F430538424B13298E6AA6FB143EF4D59A14946175997479DBC2D1A3CD8");
  600. /* "Test Case 1" from RFC 4231 */
  601. memset(key, 0x0b, 20);
  602. crypto_hmac_sha256(digest, key, 20, "Hi There", 8);
  603. test_memeq_hex(digest,
  604. "b0344c61d8db38535ca8afceaf0bf12b"
  605. "881dc200c9833da726e9376c2e32cff7");
  606. /* "Test Case 2" from RFC 4231 */
  607. memset(key, 0x0b, 20);
  608. crypto_hmac_sha256(digest, "Jefe", 4, "what do ya want for nothing?", 28);
  609. test_memeq_hex(digest,
  610. "5bdcc146bf60754e6a042426089575c7"
  611. "5a003f089d2739839dec58b964ec3843");
  612. /* "Test case 3" from RFC 4231 */
  613. memset(key, 0xaa, 20);
  614. memset(data, 0xdd, 50);
  615. crypto_hmac_sha256(digest, key, 20, data, 50);
  616. test_memeq_hex(digest,
  617. "773ea91e36800e46854db8ebd09181a7"
  618. "2959098b3ef8c122d9635514ced565fe");
  619. /* "Test case 4" from RFC 4231 */
  620. base16_decode(key, 25,
  621. "0102030405060708090a0b0c0d0e0f10111213141516171819", 50);
  622. memset(data, 0xcd, 50);
  623. crypto_hmac_sha256(digest, key, 25, data, 50);
  624. test_memeq_hex(digest,
  625. "82558a389a443c0ea4cc819899f2083a"
  626. "85f0faa3e578f8077a2e3ff46729665b");
  627. /* "Test case 5" from RFC 4231 */
  628. memset(key, 0x0c, 20);
  629. crypto_hmac_sha256(digest, key, 20, "Test With Truncation", 20);
  630. test_memeq_hex(digest,
  631. "a3b6167473100ee06e0c796c2955552b");
  632. /* "Test case 6" from RFC 4231 */
  633. memset(key, 0xaa, 131);
  634. crypto_hmac_sha256(digest, key, 131,
  635. "Test Using Larger Than Block-Size Key - Hash Key First",
  636. 54);
  637. test_memeq_hex(digest,
  638. "60e431591ee0b67f0d8a26aacbf5b77f"
  639. "8e0bc6213728c5140546040f0ee37f54");
  640. /* "Test case 7" from RFC 4231 */
  641. memset(key, 0xaa, 131);
  642. crypto_hmac_sha256(digest, key, 131,
  643. "This is a test using a larger than block-size key and a "
  644. "larger than block-size data. The key needs to be hashed "
  645. "before being used by the HMAC algorithm.", 152);
  646. test_memeq_hex(digest,
  647. "9b09ffa71b942fcb27635fbcd5b0e944"
  648. "bfdc63644f0713938a7f51535c3a35e2");
  649. /* Incremental digest code. */
  650. d1 = crypto_digest_new();
  651. tt_assert(d1);
  652. crypto_digest_add_bytes(d1, "abcdef", 6);
  653. d2 = crypto_digest_dup(d1);
  654. tt_assert(d2);
  655. crypto_digest_add_bytes(d2, "ghijkl", 6);
  656. crypto_digest_get_digest(d2, d_out1, DIGEST_LEN);
  657. crypto_digest(d_out2, "abcdefghijkl", 12);
  658. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST_LEN);
  659. crypto_digest_assign(d2, d1);
  660. crypto_digest_add_bytes(d2, "mno", 3);
  661. crypto_digest_get_digest(d2, d_out1, DIGEST_LEN);
  662. crypto_digest(d_out2, "abcdefmno", 9);
  663. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST_LEN);
  664. crypto_digest_get_digest(d1, d_out1, DIGEST_LEN);
  665. crypto_digest(d_out2, "abcdef", 6);
  666. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST_LEN);
  667. crypto_digest_free(d1);
  668. crypto_digest_free(d2);
  669. /* Incremental digest code with sha256 */
  670. d1 = crypto_digest256_new(DIGEST_SHA256);
  671. tt_assert(d1);
  672. crypto_digest_add_bytes(d1, "abcdef", 6);
  673. d2 = crypto_digest_dup(d1);
  674. tt_assert(d2);
  675. crypto_digest_add_bytes(d2, "ghijkl", 6);
  676. crypto_digest_get_digest(d2, d_out1, DIGEST256_LEN);
  677. crypto_digest256(d_out2, "abcdefghijkl", 12, DIGEST_SHA256);
  678. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  679. crypto_digest_assign(d2, d1);
  680. crypto_digest_add_bytes(d2, "mno", 3);
  681. crypto_digest_get_digest(d2, d_out1, DIGEST256_LEN);
  682. crypto_digest256(d_out2, "abcdefmno", 9, DIGEST_SHA256);
  683. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  684. crypto_digest_get_digest(d1, d_out1, DIGEST256_LEN);
  685. crypto_digest256(d_out2, "abcdef", 6, DIGEST_SHA256);
  686. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  687. crypto_digest_free(d1);
  688. crypto_digest_free(d2);
  689. /* Incremental digest code with sha512 */
  690. d1 = crypto_digest512_new(DIGEST_SHA512);
  691. tt_assert(d1);
  692. crypto_digest_add_bytes(d1, "abcdef", 6);
  693. d2 = crypto_digest_dup(d1);
  694. tt_assert(d2);
  695. crypto_digest_add_bytes(d2, "ghijkl", 6);
  696. crypto_digest_get_digest(d2, d_out1, DIGEST512_LEN);
  697. crypto_digest512(d_out2, "abcdefghijkl", 12, DIGEST_SHA512);
  698. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  699. crypto_digest_assign(d2, d1);
  700. crypto_digest_add_bytes(d2, "mno", 3);
  701. crypto_digest_get_digest(d2, d_out1, DIGEST512_LEN);
  702. crypto_digest512(d_out2, "abcdefmno", 9, DIGEST_SHA512);
  703. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  704. crypto_digest_get_digest(d1, d_out1, DIGEST512_LEN);
  705. crypto_digest512(d_out2, "abcdef", 6, DIGEST_SHA512);
  706. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  707. done:
  708. if (d1)
  709. crypto_digest_free(d1);
  710. if (d2)
  711. crypto_digest_free(d2);
  712. tor_free(mem_op_hex_tmp);
  713. }
  714. static void
  715. test_crypto_sha3(void *arg)
  716. {
  717. crypto_digest_t *d1 = NULL, *d2 = NULL;
  718. int i;
  719. char data[DIGEST512_LEN];
  720. char d_out1[DIGEST512_LEN], d_out2[DIGEST512_LEN];
  721. char *mem_op_hex_tmp=NULL;
  722. char *large = NULL;
  723. (void)arg;
  724. /* Test SHA3-[256,512] with a test vectors from the Keccak Code Package.
  725. *
  726. * NB: The code package's test vectors have length expressed in bits.
  727. */
  728. /* Len = 8, Msg = CC */
  729. const uint8_t keccak_kat_msg8[] = { 0xcc };
  730. i = crypto_digest256(data, (const char*)keccak_kat_msg8, 1, DIGEST_SHA3_256);
  731. test_memeq_hex(data, "677035391CD3701293D385F037BA3279"
  732. "6252BB7CE180B00B582DD9B20AAAD7F0");
  733. tt_int_op(i, OP_EQ, 0);
  734. i = crypto_digest512(data, (const char*)keccak_kat_msg8, 1, DIGEST_SHA3_512);
  735. test_memeq_hex(data, "3939FCC8B57B63612542DA31A834E5DC"
  736. "C36E2EE0F652AC72E02624FA2E5ADEEC"
  737. "C7DD6BB3580224B4D6138706FC6E8059"
  738. "7B528051230B00621CC2B22999EAA205");
  739. tt_int_op(i, OP_EQ, 0);
  740. /* Len = 24, Msg = 1F877C */
  741. const uint8_t keccak_kat_msg24[] = { 0x1f, 0x87, 0x7c };
  742. i = crypto_digest256(data, (const char*)keccak_kat_msg24, 3,
  743. DIGEST_SHA3_256);
  744. test_memeq_hex(data, "BC22345E4BD3F792A341CF18AC0789F1"
  745. "C9C966712A501B19D1B6632CCD408EC5");
  746. tt_int_op(i, OP_EQ, 0);
  747. i = crypto_digest512(data, (const char*)keccak_kat_msg24, 3,
  748. DIGEST_SHA3_512);
  749. test_memeq_hex(data, "CB20DCF54955F8091111688BECCEF48C"
  750. "1A2F0D0608C3A575163751F002DB30F4"
  751. "0F2F671834B22D208591CFAF1F5ECFE4"
  752. "3C49863A53B3225BDFD7C6591BA7658B");
  753. tt_int_op(i, OP_EQ, 0);
  754. /* Len = 1080, Msg = B771D5CEF... ...C35AC81B5 (SHA3-256 rate - 1) */
  755. const uint8_t keccak_kat_msg1080[] = {
  756. 0xB7, 0x71, 0xD5, 0xCE, 0xF5, 0xD1, 0xA4, 0x1A, 0x93, 0xD1,
  757. 0x56, 0x43, 0xD7, 0x18, 0x1D, 0x2A, 0x2E, 0xF0, 0xA8, 0xE8,
  758. 0x4D, 0x91, 0x81, 0x2F, 0x20, 0xED, 0x21, 0xF1, 0x47, 0xBE,
  759. 0xF7, 0x32, 0xBF, 0x3A, 0x60, 0xEF, 0x40, 0x67, 0xC3, 0x73,
  760. 0x4B, 0x85, 0xBC, 0x8C, 0xD4, 0x71, 0x78, 0x0F, 0x10, 0xDC,
  761. 0x9E, 0x82, 0x91, 0xB5, 0x83, 0x39, 0xA6, 0x77, 0xB9, 0x60,
  762. 0x21, 0x8F, 0x71, 0xE7, 0x93, 0xF2, 0x79, 0x7A, 0xEA, 0x34,
  763. 0x94, 0x06, 0x51, 0x28, 0x29, 0x06, 0x5D, 0x37, 0xBB, 0x55,
  764. 0xEA, 0x79, 0x6F, 0xA4, 0xF5, 0x6F, 0xD8, 0x89, 0x6B, 0x49,
  765. 0xB2, 0xCD, 0x19, 0xB4, 0x32, 0x15, 0xAD, 0x96, 0x7C, 0x71,
  766. 0x2B, 0x24, 0xE5, 0x03, 0x2D, 0x06, 0x52, 0x32, 0xE0, 0x2C,
  767. 0x12, 0x74, 0x09, 0xD2, 0xED, 0x41, 0x46, 0xB9, 0xD7, 0x5D,
  768. 0x76, 0x3D, 0x52, 0xDB, 0x98, 0xD9, 0x49, 0xD3, 0xB0, 0xFE,
  769. 0xD6, 0xA8, 0x05, 0x2F, 0xBB,
  770. };
  771. i = crypto_digest256(data, (const char*)keccak_kat_msg1080, 135,
  772. DIGEST_SHA3_256);
  773. test_memeq_hex(data, "A19EEE92BB2097B64E823D597798AA18"
  774. "BE9B7C736B8059ABFD6779AC35AC81B5");
  775. tt_int_op(i, OP_EQ, 0);
  776. i = crypto_digest512(data, (const char*)keccak_kat_msg1080, 135,
  777. DIGEST_SHA3_512);
  778. test_memeq_hex(data, "7575A1FB4FC9A8F9C0466BD5FCA496D1"
  779. "CB78696773A212A5F62D02D14E3259D1"
  780. "92A87EBA4407DD83893527331407B6DA"
  781. "DAAD920DBC46489B677493CE5F20B595");
  782. tt_int_op(i, OP_EQ, 0);
  783. /* Len = 1088, Msg = B32D95B0... ...8E380C04 (SHA3-256 rate) */
  784. const uint8_t keccak_kat_msg1088[] = {
  785. 0xB3, 0x2D, 0x95, 0xB0, 0xB9, 0xAA, 0xD2, 0xA8, 0x81, 0x6D,
  786. 0xE6, 0xD0, 0x6D, 0x1F, 0x86, 0x00, 0x85, 0x05, 0xBD, 0x8C,
  787. 0x14, 0x12, 0x4F, 0x6E, 0x9A, 0x16, 0x3B, 0x5A, 0x2A, 0xDE,
  788. 0x55, 0xF8, 0x35, 0xD0, 0xEC, 0x38, 0x80, 0xEF, 0x50, 0x70,
  789. 0x0D, 0x3B, 0x25, 0xE4, 0x2C, 0xC0, 0xAF, 0x05, 0x0C, 0xCD,
  790. 0x1B, 0xE5, 0xE5, 0x55, 0xB2, 0x30, 0x87, 0xE0, 0x4D, 0x7B,
  791. 0xF9, 0x81, 0x36, 0x22, 0x78, 0x0C, 0x73, 0x13, 0xA1, 0x95,
  792. 0x4F, 0x87, 0x40, 0xB6, 0xEE, 0x2D, 0x3F, 0x71, 0xF7, 0x68,
  793. 0xDD, 0x41, 0x7F, 0x52, 0x04, 0x82, 0xBD, 0x3A, 0x08, 0xD4,
  794. 0xF2, 0x22, 0xB4, 0xEE, 0x9D, 0xBD, 0x01, 0x54, 0x47, 0xB3,
  795. 0x35, 0x07, 0xDD, 0x50, 0xF3, 0xAB, 0x42, 0x47, 0xC5, 0xDE,
  796. 0x9A, 0x8A, 0xBD, 0x62, 0xA8, 0xDE, 0xCE, 0xA0, 0x1E, 0x3B,
  797. 0x87, 0xC8, 0xB9, 0x27, 0xF5, 0xB0, 0x8B, 0xEB, 0x37, 0x67,
  798. 0x4C, 0x6F, 0x8E, 0x38, 0x0C, 0x04,
  799. };
  800. i = crypto_digest256(data, (const char*)keccak_kat_msg1088, 136,
  801. DIGEST_SHA3_256);
  802. test_memeq_hex(data, "DF673F4105379FF6B755EEAB20CEB0DC"
  803. "77B5286364FE16C59CC8A907AFF07732");
  804. tt_int_op(i, OP_EQ, 0);
  805. i = crypto_digest512(data, (const char*)keccak_kat_msg1088, 136,
  806. DIGEST_SHA3_512);
  807. test_memeq_hex(data, "2E293765022D48996CE8EFF0BE54E87E"
  808. "FB94A14C72DE5ACD10D0EB5ECE029CAD"
  809. "FA3BA17A40B2FFA2163991B17786E51C"
  810. "ABA79E5E0FFD34CF085E2A098BE8BACB");
  811. tt_int_op(i, OP_EQ, 0);
  812. /* Len = 1096, Msg = 04410E310... ...601016A0D (SHA3-256 rate + 1) */
  813. const uint8_t keccak_kat_msg1096[] = {
  814. 0x04, 0x41, 0x0E, 0x31, 0x08, 0x2A, 0x47, 0x58, 0x4B, 0x40,
  815. 0x6F, 0x05, 0x13, 0x98, 0xA6, 0xAB, 0xE7, 0x4E, 0x4D, 0xA5,
  816. 0x9B, 0xB6, 0xF8, 0x5E, 0x6B, 0x49, 0xE8, 0xA1, 0xF7, 0xF2,
  817. 0xCA, 0x00, 0xDF, 0xBA, 0x54, 0x62, 0xC2, 0xCD, 0x2B, 0xFD,
  818. 0xE8, 0xB6, 0x4F, 0xB2, 0x1D, 0x70, 0xC0, 0x83, 0xF1, 0x13,
  819. 0x18, 0xB5, 0x6A, 0x52, 0xD0, 0x3B, 0x81, 0xCA, 0xC5, 0xEE,
  820. 0xC2, 0x9E, 0xB3, 0x1B, 0xD0, 0x07, 0x8B, 0x61, 0x56, 0x78,
  821. 0x6D, 0xA3, 0xD6, 0xD8, 0xC3, 0x30, 0x98, 0xC5, 0xC4, 0x7B,
  822. 0xB6, 0x7A, 0xC6, 0x4D, 0xB1, 0x41, 0x65, 0xAF, 0x65, 0xB4,
  823. 0x45, 0x44, 0xD8, 0x06, 0xDD, 0xE5, 0xF4, 0x87, 0xD5, 0x37,
  824. 0x3C, 0x7F, 0x97, 0x92, 0xC2, 0x99, 0xE9, 0x68, 0x6B, 0x7E,
  825. 0x58, 0x21, 0xE7, 0xC8, 0xE2, 0x45, 0x83, 0x15, 0xB9, 0x96,
  826. 0xB5, 0x67, 0x7D, 0x92, 0x6D, 0xAC, 0x57, 0xB3, 0xF2, 0x2D,
  827. 0xA8, 0x73, 0xC6, 0x01, 0x01, 0x6A, 0x0D,
  828. };
  829. i = crypto_digest256(data, (const char*)keccak_kat_msg1096, 137,
  830. DIGEST_SHA3_256);
  831. test_memeq_hex(data, "D52432CF3B6B4B949AA848E058DCD62D"
  832. "735E0177279222E7AC0AF8504762FAA0");
  833. tt_int_op(i, OP_EQ, 0);
  834. i = crypto_digest512(data, (const char*)keccak_kat_msg1096, 137,
  835. DIGEST_SHA3_512);
  836. test_memeq_hex(data, "BE8E14B6757FFE53C9B75F6DDE9A7B6C"
  837. "40474041DE83D4A60645A826D7AF1ABE"
  838. "1EEFCB7B74B62CA6A514E5F2697D585B"
  839. "FECECE12931BBE1D4ED7EBF7B0BE660E");
  840. tt_int_op(i, OP_EQ, 0);
  841. /* Len = 1144, Msg = EA40E83C... ...66DFAFEC (SHA3-512 rate *2 - 1) */
  842. const uint8_t keccak_kat_msg1144[] = {
  843. 0xEA, 0x40, 0xE8, 0x3C, 0xB1, 0x8B, 0x3A, 0x24, 0x2C, 0x1E,
  844. 0xCC, 0x6C, 0xCD, 0x0B, 0x78, 0x53, 0xA4, 0x39, 0xDA, 0xB2,
  845. 0xC5, 0x69, 0xCF, 0xC6, 0xDC, 0x38, 0xA1, 0x9F, 0x5C, 0x90,
  846. 0xAC, 0xBF, 0x76, 0xAE, 0xF9, 0xEA, 0x37, 0x42, 0xFF, 0x3B,
  847. 0x54, 0xEF, 0x7D, 0x36, 0xEB, 0x7C, 0xE4, 0xFF, 0x1C, 0x9A,
  848. 0xB3, 0xBC, 0x11, 0x9C, 0xFF, 0x6B, 0xE9, 0x3C, 0x03, 0xE2,
  849. 0x08, 0x78, 0x33, 0x35, 0xC0, 0xAB, 0x81, 0x37, 0xBE, 0x5B,
  850. 0x10, 0xCD, 0xC6, 0x6F, 0xF3, 0xF8, 0x9A, 0x1B, 0xDD, 0xC6,
  851. 0xA1, 0xEE, 0xD7, 0x4F, 0x50, 0x4C, 0xBE, 0x72, 0x90, 0x69,
  852. 0x0B, 0xB2, 0x95, 0xA8, 0x72, 0xB9, 0xE3, 0xFE, 0x2C, 0xEE,
  853. 0x9E, 0x6C, 0x67, 0xC4, 0x1D, 0xB8, 0xEF, 0xD7, 0xD8, 0x63,
  854. 0xCF, 0x10, 0xF8, 0x40, 0xFE, 0x61, 0x8E, 0x79, 0x36, 0xDA,
  855. 0x3D, 0xCA, 0x5C, 0xA6, 0xDF, 0x93, 0x3F, 0x24, 0xF6, 0x95,
  856. 0x4B, 0xA0, 0x80, 0x1A, 0x12, 0x94, 0xCD, 0x8D, 0x7E, 0x66,
  857. 0xDF, 0xAF, 0xEC,
  858. };
  859. i = crypto_digest512(data, (const char*)keccak_kat_msg1144, 143,
  860. DIGEST_SHA3_512);
  861. test_memeq_hex(data, "3A8E938C45F3F177991296B24565D9A6"
  862. "605516615D96A062C8BE53A0D6C5A648"
  863. "7BE35D2A8F3CF6620D0C2DBA2C560D68"
  864. "295F284BE7F82F3B92919033C9CE5D80");
  865. tt_int_op(i, OP_EQ, 0);
  866. i = crypto_digest256(data, (const char*)keccak_kat_msg1144, 143,
  867. DIGEST_SHA3_256);
  868. test_memeq_hex(data, "E58A947E98D6DD7E932D2FE02D9992E6"
  869. "118C0C2C606BDCDA06E7943D2C95E0E5");
  870. tt_int_op(i, OP_EQ, 0);
  871. /* Len = 1152, Msg = 157D5B7E... ...79EE00C63 (SHA3-512 rate * 2) */
  872. const uint8_t keccak_kat_msg1152[] = {
  873. 0x15, 0x7D, 0x5B, 0x7E, 0x45, 0x07, 0xF6, 0x6D, 0x9A, 0x26,
  874. 0x74, 0x76, 0xD3, 0x38, 0x31, 0xE7, 0xBB, 0x76, 0x8D, 0x4D,
  875. 0x04, 0xCC, 0x34, 0x38, 0xDA, 0x12, 0xF9, 0x01, 0x02, 0x63,
  876. 0xEA, 0x5F, 0xCA, 0xFB, 0xDE, 0x25, 0x79, 0xDB, 0x2F, 0x6B,
  877. 0x58, 0xF9, 0x11, 0xD5, 0x93, 0xD5, 0xF7, 0x9F, 0xB0, 0x5F,
  878. 0xE3, 0x59, 0x6E, 0x3F, 0xA8, 0x0F, 0xF2, 0xF7, 0x61, 0xD1,
  879. 0xB0, 0xE5, 0x70, 0x80, 0x05, 0x5C, 0x11, 0x8C, 0x53, 0xE5,
  880. 0x3C, 0xDB, 0x63, 0x05, 0x52, 0x61, 0xD7, 0xC9, 0xB2, 0xB3,
  881. 0x9B, 0xD9, 0x0A, 0xCC, 0x32, 0x52, 0x0C, 0xBB, 0xDB, 0xDA,
  882. 0x2C, 0x4F, 0xD8, 0x85, 0x6D, 0xBC, 0xEE, 0x17, 0x31, 0x32,
  883. 0xA2, 0x67, 0x91, 0x98, 0xDA, 0xF8, 0x30, 0x07, 0xA9, 0xB5,
  884. 0xC5, 0x15, 0x11, 0xAE, 0x49, 0x76, 0x6C, 0x79, 0x2A, 0x29,
  885. 0x52, 0x03, 0x88, 0x44, 0x4E, 0xBE, 0xFE, 0x28, 0x25, 0x6F,
  886. 0xB3, 0x3D, 0x42, 0x60, 0x43, 0x9C, 0xBA, 0x73, 0xA9, 0x47,
  887. 0x9E, 0xE0, 0x0C, 0x63,
  888. };
  889. i = crypto_digest512(data, (const char*)keccak_kat_msg1152, 144,
  890. DIGEST_SHA3_512);
  891. test_memeq_hex(data, "FE45289874879720CE2A844AE34BB735"
  892. "22775DCB6019DCD22B8885994672A088"
  893. "9C69E8115C641DC8B83E39F7311815A1"
  894. "64DC46E0BA2FCA344D86D4BC2EF2532C");
  895. tt_int_op(i, OP_EQ, 0);
  896. i = crypto_digest256(data, (const char*)keccak_kat_msg1152, 144,
  897. DIGEST_SHA3_256);
  898. test_memeq_hex(data, "A936FB9AF87FB67857B3EAD5C76226AD"
  899. "84DA47678F3C2FFE5A39FDB5F7E63FFB");
  900. tt_int_op(i, OP_EQ, 0);
  901. /* Len = 1160, Msg = 836B34B5... ...11044C53 (SHA3-512 rate * 2 + 1) */
  902. const uint8_t keccak_kat_msg1160[] = {
  903. 0x83, 0x6B, 0x34, 0xB5, 0x15, 0x47, 0x6F, 0x61, 0x3F, 0xE4,
  904. 0x47, 0xA4, 0xE0, 0xC3, 0xF3, 0xB8, 0xF2, 0x09, 0x10, 0xAC,
  905. 0x89, 0xA3, 0x97, 0x70, 0x55, 0xC9, 0x60, 0xD2, 0xD5, 0xD2,
  906. 0xB7, 0x2B, 0xD8, 0xAC, 0xC7, 0x15, 0xA9, 0x03, 0x53, 0x21,
  907. 0xB8, 0x67, 0x03, 0xA4, 0x11, 0xDD, 0xE0, 0x46, 0x6D, 0x58,
  908. 0xA5, 0x97, 0x69, 0x67, 0x2A, 0xA6, 0x0A, 0xD5, 0x87, 0xB8,
  909. 0x48, 0x1D, 0xE4, 0xBB, 0xA5, 0x52, 0xA1, 0x64, 0x57, 0x79,
  910. 0x78, 0x95, 0x01, 0xEC, 0x53, 0xD5, 0x40, 0xB9, 0x04, 0x82,
  911. 0x1F, 0x32, 0xB0, 0xBD, 0x18, 0x55, 0xB0, 0x4E, 0x48, 0x48,
  912. 0xF9, 0xF8, 0xCF, 0xE9, 0xEB, 0xD8, 0x91, 0x1B, 0xE9, 0x57,
  913. 0x81, 0xA7, 0x59, 0xD7, 0xAD, 0x97, 0x24, 0xA7, 0x10, 0x2D,
  914. 0xBE, 0x57, 0x67, 0x76, 0xB7, 0xC6, 0x32, 0xBC, 0x39, 0xB9,
  915. 0xB5, 0xE1, 0x90, 0x57, 0xE2, 0x26, 0x55, 0x2A, 0x59, 0x94,
  916. 0xC1, 0xDB, 0xB3, 0xB5, 0xC7, 0x87, 0x1A, 0x11, 0xF5, 0x53,
  917. 0x70, 0x11, 0x04, 0x4C, 0x53,
  918. };
  919. i = crypto_digest512(data, (const char*)keccak_kat_msg1160, 145,
  920. DIGEST_SHA3_512);
  921. test_memeq_hex(data, "AFF61C6E11B98E55AC213B1A0BC7DE04"
  922. "05221AC5EFB1229842E4614F4A029C9B"
  923. "D14A0ED7FD99AF3681429F3F309FDB53"
  924. "166AA9A3CD9F1F1223D04B4A9015E94A");
  925. tt_int_op(i, OP_EQ, 0);
  926. i = crypto_digest256(data, (const char*)keccak_kat_msg1160, 145,
  927. DIGEST_SHA3_256);
  928. test_memeq_hex(data, "3A654B88F88086C2751EDAE6D3924814"
  929. "3CF6235C6B0B7969342C45A35194B67E");
  930. tt_int_op(i, OP_EQ, 0);
  931. /* SHA3-[256,512] Empty case (wikipedia) */
  932. i = crypto_digest256(data, "", 0, DIGEST_SHA3_256);
  933. test_memeq_hex(data, "a7ffc6f8bf1ed76651c14756a061d662"
  934. "f580ff4de43b49fa82d80a4b80f8434a");
  935. tt_int_op(i, OP_EQ, 0);
  936. i = crypto_digest512(data, "", 0, DIGEST_SHA3_512);
  937. test_memeq_hex(data, "a69f73cca23a9ac5c8b567dc185a756e"
  938. "97c982164fe25859e0d1dcc1475c80a6"
  939. "15b2123af1f5f94c11e3e9402c3ac558"
  940. "f500199d95b6d3e301758586281dcd26");
  941. tt_int_op(i, OP_EQ, 0);
  942. /* Incremental digest code with SHA3-256 */
  943. d1 = crypto_digest256_new(DIGEST_SHA3_256);
  944. tt_assert(d1);
  945. crypto_digest_add_bytes(d1, "abcdef", 6);
  946. d2 = crypto_digest_dup(d1);
  947. tt_assert(d2);
  948. crypto_digest_add_bytes(d2, "ghijkl", 6);
  949. crypto_digest_get_digest(d2, d_out1, DIGEST256_LEN);
  950. crypto_digest256(d_out2, "abcdefghijkl", 12, DIGEST_SHA3_256);
  951. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  952. crypto_digest_assign(d2, d1);
  953. crypto_digest_add_bytes(d2, "mno", 3);
  954. crypto_digest_get_digest(d2, d_out1, DIGEST256_LEN);
  955. crypto_digest256(d_out2, "abcdefmno", 9, DIGEST_SHA3_256);
  956. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  957. crypto_digest_get_digest(d1, d_out1, DIGEST256_LEN);
  958. crypto_digest256(d_out2, "abcdef", 6, DIGEST_SHA3_256);
  959. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST256_LEN);
  960. crypto_digest_free(d1);
  961. crypto_digest_free(d2);
  962. /* Incremental digest code with SHA3-512 */
  963. d1 = crypto_digest512_new(DIGEST_SHA3_512);
  964. tt_assert(d1);
  965. crypto_digest_add_bytes(d1, "abcdef", 6);
  966. d2 = crypto_digest_dup(d1);
  967. tt_assert(d2);
  968. crypto_digest_add_bytes(d2, "ghijkl", 6);
  969. crypto_digest_get_digest(d2, d_out1, DIGEST512_LEN);
  970. crypto_digest512(d_out2, "abcdefghijkl", 12, DIGEST_SHA3_512);
  971. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  972. crypto_digest_assign(d2, d1);
  973. crypto_digest_add_bytes(d2, "mno", 3);
  974. crypto_digest_get_digest(d2, d_out1, DIGEST512_LEN);
  975. crypto_digest512(d_out2, "abcdefmno", 9, DIGEST_SHA3_512);
  976. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  977. crypto_digest_get_digest(d1, d_out1, DIGEST512_LEN);
  978. crypto_digest512(d_out2, "abcdef", 6, DIGEST_SHA3_512);
  979. tt_mem_op(d_out1,OP_EQ, d_out2, DIGEST512_LEN);
  980. crypto_digest_free(d1);
  981. /* Attempt to exercise the incremental hashing code by creating a randomized
  982. * 30 KiB buffer, and hashing rand[1, 5 * Rate] bytes at a time. SHA3-512
  983. * is used because it has a lowest rate of the family (the code is common,
  984. * but the slower rate exercises more of it).
  985. */
  986. const size_t bufsz = 30 * 1024;
  987. size_t j = 0;
  988. large = tor_malloc(bufsz);
  989. crypto_rand(large, bufsz);
  990. d1 = crypto_digest512_new(DIGEST_SHA3_512); /* Running digest. */
  991. while (j < bufsz) {
  992. /* Pick how much data to add to the running digest. */
  993. size_t incr = (size_t)crypto_rand_int_range(1, 72 * 5);
  994. incr = MIN(bufsz - j, incr);
  995. /* Add the data, and calculate the hash. */
  996. crypto_digest_add_bytes(d1, large + j, incr);
  997. crypto_digest_get_digest(d1, d_out1, DIGEST512_LEN);
  998. /* One-shot hash the buffer up to the data that was just added,
  999. * and ensure that the values match up.
  1000. *
  1001. * XXX/yawning: If this actually fails, it'll be rather difficult to
  1002. * reproduce. Improvements welcome.
  1003. */
  1004. i = crypto_digest512(d_out2, large, j + incr, DIGEST_SHA3_512);
  1005. tt_int_op(i, OP_EQ, 0);
  1006. tt_mem_op(d_out1, OP_EQ, d_out2, DIGEST512_LEN);
  1007. j += incr;
  1008. }
  1009. done:
  1010. if (d1)
  1011. crypto_digest_free(d1);
  1012. if (d2)
  1013. crypto_digest_free(d2);
  1014. tor_free(large);
  1015. tor_free(mem_op_hex_tmp);
  1016. }
  1017. /** Run unit tests for our XOF. */
  1018. static void
  1019. test_crypto_sha3_xof(void *arg)
  1020. {
  1021. uint8_t msg[255];
  1022. uint8_t out[512];
  1023. crypto_xof_t *xof;
  1024. char *mem_op_hex_tmp=NULL;
  1025. (void)arg;
  1026. /* SHAKE256 test vector (Len = 2040) from the Keccak Code Package. */
  1027. base16_decode((char *)msg, 255,
  1028. "3A3A819C48EFDE2AD914FBF00E18AB6BC4F14513AB27D0C178A188B61431"
  1029. "E7F5623CB66B23346775D386B50E982C493ADBBFC54B9A3CD383382336A1"
  1030. "A0B2150A15358F336D03AE18F666C7573D55C4FD181C29E6CCFDE63EA35F"
  1031. "0ADF5885CFC0A3D84A2B2E4DD24496DB789E663170CEF74798AA1BBCD457"
  1032. "4EA0BBA40489D764B2F83AADC66B148B4A0CD95246C127D5871C4F114186"
  1033. "90A5DDF01246A0C80A43C70088B6183639DCFDA4125BD113A8F49EE23ED3"
  1034. "06FAAC576C3FB0C1E256671D817FC2534A52F5B439F72E424DE376F4C565"
  1035. "CCA82307DD9EF76DA5B7C4EB7E085172E328807C02D011FFBF33785378D7"
  1036. "9DC266F6A5BE6BB0E4A92ECEEBAEB1", 510);
  1037. const char *squeezed_hex =
  1038. "8A5199B4A7E133E264A86202720655894D48CFF344A928CF8347F48379CE"
  1039. "F347DFC5BCFFAB99B27B1F89AA2735E23D30088FFA03B9EDB02B9635470A"
  1040. "B9F1038985D55F9CA774572DD006470EA65145469609F9FA0831BF1FFD84"
  1041. "2DC24ACADE27BD9816E3B5BF2876CB112232A0EB4475F1DFF9F5C713D9FF"
  1042. "D4CCB89AE5607FE35731DF06317949EEF646E9591CF3BE53ADD6B7DD2B60"
  1043. "96E2B3FB06E662EC8B2D77422DAAD9463CD155204ACDBD38E319613F39F9"
  1044. "9B6DFB35CA9365160066DB19835888C2241FF9A731A4ACBB5663727AAC34"
  1045. "A401247FBAA7499E7D5EE5B69D31025E63D04C35C798BCA1262D5673A9CF"
  1046. "0930B5AD89BD485599DC184528DA4790F088EBD170B635D9581632D2FF90"
  1047. "DB79665CED430089AF13C9F21F6D443A818064F17AEC9E9C5457001FA8DC"
  1048. "6AFBADBE3138F388D89D0E6F22F66671255B210754ED63D81DCE75CE8F18"
  1049. "9B534E6D6B3539AA51E837C42DF9DF59C71E6171CD4902FE1BDC73FB1775"
  1050. "B5C754A1ED4EA7F3105FC543EE0418DAD256F3F6118EA77114A16C15355B"
  1051. "42877A1DB2A7DF0E155AE1D8670ABCEC3450F4E2EEC9838F895423EF63D2"
  1052. "61138BAAF5D9F104CB5A957AEA06C0B9B8C78B0D441796DC0350DDEABB78"
  1053. "A33B6F1F9E68EDE3D1805C7B7E2CFD54E0FAD62F0D8CA67A775DC4546AF9"
  1054. "096F2EDB221DB42843D65327861282DC946A0BA01A11863AB2D1DFD16E39"
  1055. "73D4";
  1056. /* Test oneshot absorb/squeeze. */
  1057. xof = crypto_xof_new();
  1058. tt_assert(xof);
  1059. crypto_xof_add_bytes(xof, msg, sizeof(msg));
  1060. crypto_xof_squeeze_bytes(xof, out, sizeof(out));
  1061. test_memeq_hex(out, squeezed_hex);
  1062. crypto_xof_free(xof);
  1063. memset(out, 0, sizeof(out));
  1064. /* Test incremental absorb/squeeze. */
  1065. xof = crypto_xof_new();
  1066. tt_assert(xof);
  1067. for (size_t i = 0; i < sizeof(msg); i++)
  1068. crypto_xof_add_bytes(xof, msg + i, 1);
  1069. for (size_t i = 0; i < sizeof(out); i++)
  1070. crypto_xof_squeeze_bytes(xof, out + i, 1);
  1071. test_memeq_hex(out, squeezed_hex);
  1072. done:
  1073. if (xof)
  1074. crypto_xof_free(xof);
  1075. tor_free(mem_op_hex_tmp);
  1076. }
  1077. /* Test our MAC-SHA3 function. There are not actually any MAC-SHA3 test
  1078. * vectors out there for our H(len(k) || k || m) construction. Hence what we
  1079. * are gonna do is test our crypto_mac_sha3_256() function against manually
  1080. * doing H(len(k) || k||m). If in the future the Keccak group decides to
  1081. * standarize an MAC construction and make test vectors, we should
  1082. * incorporate them here. */
  1083. static void
  1084. test_crypto_mac_sha3(void *arg)
  1085. {
  1086. const char msg[] = "i am in a library somewhere using my computer";
  1087. const char key[] = "i'm from the past talking to the future.";
  1088. uint8_t hmac_test[DIGEST256_LEN];
  1089. char hmac_manual[DIGEST256_LEN];
  1090. (void) arg;
  1091. /* First let's use our nice HMAC-SHA3 function */
  1092. crypto_mac_sha3_256(hmac_test, sizeof(hmac_test),
  1093. (uint8_t *) key, strlen(key),
  1094. (uint8_t *) msg, strlen(msg));
  1095. /* Now let's try a manual H(len(k) || k || m) construction */
  1096. {
  1097. char *key_msg_concat = NULL, *all = NULL;
  1098. int result;
  1099. const uint64_t key_len_netorder = tor_htonll(strlen(key));
  1100. size_t all_len;
  1101. tor_asprintf(&key_msg_concat, "%s%s", key, msg);
  1102. all_len = sizeof(key_len_netorder) + strlen(key_msg_concat);
  1103. all = tor_malloc_zero(all_len);
  1104. memcpy(all, &key_len_netorder, sizeof(key_len_netorder));
  1105. memcpy(all + sizeof(key_len_netorder), key_msg_concat,
  1106. strlen(key_msg_concat));
  1107. result = crypto_digest256(hmac_manual, all, all_len, DIGEST_SHA3_256);
  1108. tor_free(key_msg_concat);
  1109. tor_free(all);
  1110. tt_int_op(result, OP_EQ, 0);
  1111. }
  1112. /* Now compare the two results */
  1113. tt_mem_op(hmac_test, OP_EQ, hmac_manual, DIGEST256_LEN);
  1114. done: ;
  1115. }
  1116. /** Run unit tests for our public key crypto functions */
  1117. static void
  1118. test_crypto_pk(void *arg)
  1119. {
  1120. crypto_pk_t *pk1 = NULL, *pk2 = NULL;
  1121. char *encoded = NULL;
  1122. char data1[1024], data2[1024], data3[1024];
  1123. size_t size;
  1124. int i, len;
  1125. /* Public-key ciphers */
  1126. (void)arg;
  1127. pk1 = pk_generate(0);
  1128. pk2 = crypto_pk_new();
  1129. tt_assert(pk1 && pk2);
  1130. tt_assert(! crypto_pk_write_public_key_to_string(pk1, &encoded, &size));
  1131. tt_assert(! crypto_pk_read_public_key_from_string(pk2, encoded, size));
  1132. tt_int_op(0,OP_EQ, crypto_pk_cmp_keys(pk1, pk2));
  1133. /* comparison between keys and NULL */
  1134. tt_int_op(crypto_pk_cmp_keys(NULL, pk1), OP_LT, 0);
  1135. tt_int_op(crypto_pk_cmp_keys(NULL, NULL), OP_EQ, 0);
  1136. tt_int_op(crypto_pk_cmp_keys(pk1, NULL), OP_GT, 0);
  1137. tt_int_op(128,OP_EQ, crypto_pk_keysize(pk1));
  1138. tt_int_op(1024,OP_EQ, crypto_pk_num_bits(pk1));
  1139. tt_int_op(128,OP_EQ, crypto_pk_keysize(pk2));
  1140. tt_int_op(1024,OP_EQ, crypto_pk_num_bits(pk2));
  1141. tt_int_op(128,OP_EQ, crypto_pk_public_encrypt(pk2, data1, sizeof(data1),
  1142. "Hello whirled.", 15,
  1143. PK_PKCS1_OAEP_PADDING));
  1144. tt_int_op(128,OP_EQ, crypto_pk_public_encrypt(pk1, data2, sizeof(data1),
  1145. "Hello whirled.", 15,
  1146. PK_PKCS1_OAEP_PADDING));
  1147. /* oaep padding should make encryption not match */
  1148. tt_mem_op(data1,OP_NE, data2, 128);
  1149. tt_int_op(15,OP_EQ,
  1150. crypto_pk_private_decrypt(pk1, data3, sizeof(data3), data1, 128,
  1151. PK_PKCS1_OAEP_PADDING,1));
  1152. tt_str_op(data3,OP_EQ, "Hello whirled.");
  1153. memset(data3, 0, 1024);
  1154. tt_int_op(15,OP_EQ,
  1155. crypto_pk_private_decrypt(pk1, data3, sizeof(data3), data2, 128,
  1156. PK_PKCS1_OAEP_PADDING,1));
  1157. tt_str_op(data3,OP_EQ, "Hello whirled.");
  1158. /* Can't decrypt with public key. */
  1159. tt_int_op(-1,OP_EQ,
  1160. crypto_pk_private_decrypt(pk2, data3, sizeof(data3), data2, 128,
  1161. PK_PKCS1_OAEP_PADDING,1));
  1162. /* Try again with bad padding */
  1163. memcpy(data2+1, "XYZZY", 5); /* This has fails ~ once-in-2^40 */
  1164. tt_int_op(-1,OP_EQ,
  1165. crypto_pk_private_decrypt(pk1, data3, sizeof(data3), data2, 128,
  1166. PK_PKCS1_OAEP_PADDING,1));
  1167. /* File operations: save and load private key */
  1168. tt_assert(! crypto_pk_write_private_key_to_filename(pk1,
  1169. get_fname("pkey1")));
  1170. /* failing case for read: can't read. */
  1171. tt_int_op(crypto_pk_read_private_key_from_filename(pk2, get_fname("xyzzy")),
  1172. OP_LT, 0);
  1173. write_str_to_file(get_fname("xyzzy"), "foobar", 6);
  1174. /* Failing case for read: no key. */
  1175. tt_int_op(crypto_pk_read_private_key_from_filename(pk2, get_fname("xyzzy")),
  1176. OP_LT, 0);
  1177. tt_assert(! crypto_pk_read_private_key_from_filename(pk2,
  1178. get_fname("pkey1")));
  1179. tt_int_op(15,OP_EQ,
  1180. crypto_pk_private_decrypt(pk2, data3, sizeof(data3), data1, 128,
  1181. PK_PKCS1_OAEP_PADDING,1));
  1182. /* Now try signing. */
  1183. strlcpy(data1, "Ossifrage", 1024);
  1184. tt_int_op(128,OP_EQ,
  1185. crypto_pk_private_sign(pk1, data2, sizeof(data2), data1, 10));
  1186. tt_int_op(10,OP_EQ,
  1187. crypto_pk_public_checksig(pk1, data3, sizeof(data3), data2, 128));
  1188. tt_str_op(data3,OP_EQ, "Ossifrage");
  1189. /* Try signing digests. */
  1190. tt_int_op(128,OP_EQ, crypto_pk_private_sign_digest(pk1, data2, sizeof(data2),
  1191. data1, 10));
  1192. tt_int_op(20,OP_EQ,
  1193. crypto_pk_public_checksig(pk1, data3, sizeof(data3), data2, 128));
  1194. tt_int_op(0,OP_EQ,
  1195. crypto_pk_public_checksig_digest(pk1, data1, 10, data2, 128));
  1196. tt_int_op(-1,OP_EQ,
  1197. crypto_pk_public_checksig_digest(pk1, data1, 11, data2, 128));
  1198. /*XXXX test failed signing*/
  1199. /* Try encoding */
  1200. crypto_pk_free(pk2);
  1201. pk2 = NULL;
  1202. i = crypto_pk_asn1_encode(pk1, data1, 1024);
  1203. tt_int_op(i, OP_GT, 0);
  1204. pk2 = crypto_pk_asn1_decode(data1, i);
  1205. tt_int_op(crypto_pk_cmp_keys(pk1, pk2), OP_EQ, 0);
  1206. /* Try with hybrid encryption wrappers. */
  1207. crypto_rand(data1, 1024);
  1208. for (i = 85; i < 140; ++i) {
  1209. memset(data2,0,1024);
  1210. memset(data3,0,1024);
  1211. len = crypto_pk_obsolete_public_hybrid_encrypt(pk1,data2,sizeof(data2),
  1212. data1,i,PK_PKCS1_OAEP_PADDING,0);
  1213. tt_int_op(len, OP_GE, 0);
  1214. len = crypto_pk_obsolete_private_hybrid_decrypt(pk1,data3,sizeof(data3),
  1215. data2,len,PK_PKCS1_OAEP_PADDING,1);
  1216. tt_int_op(len,OP_EQ, i);
  1217. tt_mem_op(data1,OP_EQ, data3,i);
  1218. }
  1219. /* Try copy_full */
  1220. crypto_pk_free(pk2);
  1221. pk2 = crypto_pk_copy_full(pk1);
  1222. tt_ptr_op(pk2, OP_NE, NULL);
  1223. tt_ptr_op(pk1, OP_NE, pk2);
  1224. tt_int_op(crypto_pk_cmp_keys(pk1, pk2), OP_EQ, 0);
  1225. done:
  1226. if (pk1)
  1227. crypto_pk_free(pk1);
  1228. if (pk2)
  1229. crypto_pk_free(pk2);
  1230. tor_free(encoded);
  1231. }
  1232. static void
  1233. test_crypto_pk_fingerprints(void *arg)
  1234. {
  1235. crypto_pk_t *pk = NULL;
  1236. char encoded[512];
  1237. char d[DIGEST_LEN], d2[DIGEST_LEN];
  1238. char fingerprint[FINGERPRINT_LEN+1];
  1239. int n;
  1240. unsigned i;
  1241. char *mem_op_hex_tmp=NULL;
  1242. (void)arg;
  1243. pk = pk_generate(1);
  1244. tt_assert(pk);
  1245. n = crypto_pk_asn1_encode(pk, encoded, sizeof(encoded));
  1246. tt_int_op(n, OP_GT, 0);
  1247. tt_int_op(n, OP_GT, 128);
  1248. tt_int_op(n, OP_LT, 256);
  1249. /* Is digest as expected? */
  1250. crypto_digest(d, encoded, n);
  1251. tt_int_op(0, OP_EQ, crypto_pk_get_digest(pk, d2));
  1252. tt_mem_op(d,OP_EQ, d2, DIGEST_LEN);
  1253. /* Is fingerprint right? */
  1254. tt_int_op(0, OP_EQ, crypto_pk_get_fingerprint(pk, fingerprint, 0));
  1255. tt_int_op(strlen(fingerprint), OP_EQ, DIGEST_LEN * 2);
  1256. test_memeq_hex(d, fingerprint);
  1257. /* Are spaces right? */
  1258. tt_int_op(0, OP_EQ, crypto_pk_get_fingerprint(pk, fingerprint, 1));
  1259. for (i = 4; i < strlen(fingerprint); i += 5) {
  1260. tt_int_op(fingerprint[i], OP_EQ, ' ');
  1261. }
  1262. tor_strstrip(fingerprint, " ");
  1263. tt_int_op(strlen(fingerprint), OP_EQ, DIGEST_LEN * 2);
  1264. test_memeq_hex(d, fingerprint);
  1265. /* Now hash again and check crypto_pk_get_hashed_fingerprint. */
  1266. crypto_digest(d2, d, sizeof(d));
  1267. tt_int_op(0, OP_EQ, crypto_pk_get_hashed_fingerprint(pk, fingerprint));
  1268. tt_int_op(strlen(fingerprint), OP_EQ, DIGEST_LEN * 2);
  1269. test_memeq_hex(d2, fingerprint);
  1270. done:
  1271. crypto_pk_free(pk);
  1272. tor_free(mem_op_hex_tmp);
  1273. }
  1274. static void
  1275. test_crypto_pk_base64(void *arg)
  1276. {
  1277. crypto_pk_t *pk1 = NULL;
  1278. crypto_pk_t *pk2 = NULL;
  1279. char *encoded = NULL;
  1280. (void)arg;
  1281. /* Test Base64 encoding a key. */
  1282. pk1 = pk_generate(0);
  1283. tt_assert(pk1);
  1284. tt_int_op(0, OP_EQ, crypto_pk_base64_encode_private(pk1, &encoded));
  1285. tt_assert(encoded);
  1286. /* Test decoding a valid key. */
  1287. pk2 = crypto_pk_base64_decode_private(encoded, strlen(encoded));
  1288. tt_assert(pk2);
  1289. tt_int_op(crypto_pk_cmp_keys(pk1, pk2), OP_EQ, 0);
  1290. crypto_pk_free(pk2);
  1291. /* Test decoding a invalid key (not Base64). */
  1292. static const char *invalid_b64 = "The key is in another castle!";
  1293. pk2 = crypto_pk_base64_decode_private(invalid_b64, strlen(invalid_b64));
  1294. tt_ptr_op(pk2, OP_EQ, NULL);
  1295. /* Test decoding a truncated Base64 blob. */
  1296. pk2 = crypto_pk_base64_decode_private(encoded, strlen(encoded)/2);
  1297. tt_ptr_op(pk2, OP_EQ, NULL);
  1298. done:
  1299. crypto_pk_free(pk1);
  1300. crypto_pk_free(pk2);
  1301. tor_free(encoded);
  1302. }
  1303. static void
  1304. test_crypto_pk_pem_encrypted(void *arg)
  1305. {
  1306. crypto_pk_t *pk = NULL;
  1307. (void)arg;
  1308. pk = crypto_pk_new();
  1309. /* we need to make sure that we won't stall if somebody gives us a key
  1310. that's encrypted with a password. */
  1311. {
  1312. const char *s =
  1313. "-----BEGIN RSA PRIVATE KEY-----\n"
  1314. "Proc-Type: 4,ENCRYPTED\n"
  1315. "DEK-Info: AES-128-CBC,EFA86BB9D2AB11E80B4E3DCD97782B16\n"
  1316. "\n"
  1317. "Z2Je4m0cFepc6coQkVbGcvNCHxTf941N2XYEVE6kn0CqWqoUH4tlwV6for5D91np\n"
  1318. "5NiEFTkWj31EhrvrYcuiJtQ/iEbABxZULFWFeJ058rb+1izBz5rScqnEacIS/3Go\n"
  1319. "YntnROBDwiKmUnue6PJVYg==\n"
  1320. "-----END RSA PRIVATE KEY-----\n";
  1321. tt_int_op(-1, OP_EQ,
  1322. crypto_pk_read_private_key_from_string(pk, s, strlen(s)));
  1323. }
  1324. /* For fun, make sure we aren't hit by OpenSSL issue
  1325. https://github.com/openssl/openssl/issues/6347 , where we get in trouble
  1326. if a cipher doesn't use an IV.
  1327. */
  1328. {
  1329. const char *s =
  1330. "-----BEGIN RSA PUBLIC KEY-----\n"
  1331. "Proc-Type:4,ENCRYPTED\n"
  1332. "DEK-Info:des-ede -\n"
  1333. "\n"
  1334. "iRqK\n"
  1335. "-----END RSA PUBLIC KEY-----\n";
  1336. tt_int_op(-1, OP_EQ,
  1337. crypto_pk_read_public_key_from_string(pk, s, strlen(s)));
  1338. }
  1339. done:
  1340. crypto_pk_free(pk);
  1341. }
  1342. static void
  1343. test_crypto_pk_invalid_private_key(void *arg)
  1344. {
  1345. (void)arg;
  1346. /* Here is a simple invalid private key: it was produced by making
  1347. * a regular private key, and then adding 2 to the modulus. */
  1348. const char pem[] =
  1349. "-----BEGIN RSA PRIVATE KEY-----\n"
  1350. "MIIEpQIBAAKCAQEAskRyZrs+YAukvBmZlgo6/rCxyKF2xyUk073ap+2CgRUnSfGG\n"
  1351. "mflHlzqVq7tpH50DafpS+fFAbaEaNV/ac20QG0rUZi38HTB4qURWOu6n0Bws6E4l\n"
  1352. "UX/AkvDlWnuYH0pHHi2c3DGNFjwoJpjKuUTk+cRffVR8X3Kjr62SUDUaBNW0Kecz\n"
  1353. "3SYLbmgmZI16dFZ+g9sNM3znXZbhvb33WwPqpZSSPs37cPgF7eS6mAw/gUMx6zfE\n"
  1354. "HRmUnOQSzUdS05rvc/hsiCLhiIZ8hgfkD07XnTT1Ds8DwE55k7BUWY2wvwWCNLsH\n"
  1355. "qtqAxTr615XdkMxVkYgImpqPybarpfNYhFqkOwIDAQABAoIBACPC3VxEdbfYvhxJ\n"
  1356. "2mih9sG++nswAN7kUaX0cRe86rAwaShJPmJHApiQ1ROVTfpciiHJaLnhLraPWe2Z\n"
  1357. "I/6Bw3hmI4O399p3Lc1u+wlpdNqnvE6B1rSptx0DHE9xecvVH70rE0uM2Su7t6Y+\n"
  1358. "gnR2IKUGQs2mlCilm7aTUEWs0WJkkl4CG1dyxItuOSdNBjOEzXimJyiB10jEBFsp\n"
  1359. "SZeCF2FZ7AJbck5CVC42+oTsiDbZrHTHOn7v26rFGdONeHD1wOI1v7JwHFpCB923\n"
  1360. "aEHBzsPbMeq7DWG1rjzCYpcXHhTDBDBWSia4SEhyr2Nl7m7qxWWWwR+x4dqAj3rD\n"
  1361. "HeTmos0CgYEA6uf1CLpjPpOs5IaW1DQI8dJA/xFEAC/6GVgq4nFOGHZrm8G3L5o+\n"
  1362. "qvtQNMpDs2naWuZpqROFqv24o01DykHygR72GlPIY6uvmmf5tvJLoGnbFUay33L4\n"
  1363. "7b9dkNhuEIBNPzVDie0pgS77WgaPbYkVv5fnDwgPuVnkqfakEt7Pz2MCgYEAwkZ5\n"
  1364. "R1wLuTQEA2Poo6Gf4L8Bg6yNYI46LHDqDIs818iYLjtcnEEvbPfaoKNpOn7s7s4O\n"
  1365. "Pc+4HnT1aIQs0IKVLRTp+5a/9wfOkPZnobWOUHZk9UzBL3Hc1uy/qhp93iE3tSzx\n"
  1366. "v0O1pvR+hr3guTCZx8wZnDvaMgG3hlyPnVlHdrMCgYEAzQQxGbMC1ySv6quEjCP2\n"
  1367. "AogMbhE1lixJTUFj/EoDbNo9xKznIkauly/Lqqc1OysRhfA/G2+MY9YZBX1zwtyX\n"
  1368. "uBW7mPKynDrFgi9pBECnvJNmwET57Ic9ttIj6Tzbos83nAjyrzgr1zGX8dRz7ZeN\n"
  1369. "QbBj2vygLJbGOYinXkjUeh0CgYEAhN5aF9n2EqZmkEMGWtMxWy6HRJ0A3Cap1rcq\n"
  1370. "+4VHCXWhzwy+XAeg/e/N0MuyLlWcif7XcqLcE8h+BwtO8xQ8HmcNWApUJAls12wO\n"
  1371. "mGRpftJaXgIupdpD5aJpu1b++qrRRNIGTH9sf1D8L/8w8LcylZkbcuTkaAsQj45C\n"
  1372. "kqT64U0CgYEAq47IKS6xc3CDc17BqExR6t+1yRe+4ml+z1zcVbfUKony4pGvl1yo\n"
  1373. "rk0IYDN5Vd8h5xtXrkPdX9h+ywmohnelDKsayEuE+opyqEpSU4/96Bb22RZUoucb\n"
  1374. "LWkV5gZx5hFnDFtEd4vadMIiY4jVv/3JqiZDKwMVBJKlHRXJEEmIEBk=\n"
  1375. "-----END RSA PRIVATE KEY-----\n";
  1376. crypto_pk_t *pk = NULL;
  1377. pk = crypto_pk_new();
  1378. setup_capture_of_logs(LOG_WARN);
  1379. tt_int_op(-1, OP_EQ,
  1380. crypto_pk_read_private_key_from_string(pk, pem, strlen(pem)));
  1381. #ifdef ENABLE_NSS
  1382. expect_single_log_msg_containing("received bad data");
  1383. #else
  1384. expect_single_log_msg_containing("while checking RSA key");
  1385. #endif
  1386. done:
  1387. teardown_capture_of_logs();
  1388. crypto_pk_free(pk);
  1389. }
  1390. #ifdef HAVE_TRUNCATE
  1391. #define do_truncate truncate
  1392. #else
  1393. static int
  1394. do_truncate(const char *fname, size_t len)
  1395. {
  1396. struct stat st;
  1397. char *bytes;
  1398. bytes = read_file_to_str(fname, RFTS_BIN, &st);
  1399. if (!bytes)
  1400. return -1;
  1401. /* This cast isn't so great, but it should be safe given the actual files
  1402. * and lengths we're using. */
  1403. if (st.st_size < (off_t)len)
  1404. len = MIN(len, (size_t)st.st_size);
  1405. int r = write_bytes_to_file(fname, bytes, len, 1);
  1406. tor_free(bytes);
  1407. return r;
  1408. }
  1409. #endif /* defined(HAVE_TRUNCATE) */
  1410. /** Sanity check for crypto pk digests */
  1411. static void
  1412. test_crypto_digests(void *arg)
  1413. {
  1414. crypto_pk_t *k = NULL;
  1415. ssize_t r;
  1416. common_digests_t pkey_digests;
  1417. char digest[DIGEST_LEN];
  1418. (void)arg;
  1419. k = crypto_pk_new();
  1420. tt_assert(k);
  1421. r = crypto_pk_read_private_key_from_string(k, AUTHORITY_SIGNKEY_3,
  1422. strlen(AUTHORITY_SIGNKEY_3));
  1423. tt_assert(!r);
  1424. r = crypto_pk_get_digest(k, digest);
  1425. tt_assert(r == 0);
  1426. tt_mem_op(hex_str(digest, DIGEST_LEN),OP_EQ,
  1427. AUTHORITY_SIGNKEY_A_DIGEST, HEX_DIGEST_LEN);
  1428. r = crypto_pk_get_common_digests(k, &pkey_digests);
  1429. tt_int_op(r, OP_EQ, 0);
  1430. tt_mem_op(hex_str(pkey_digests.d[DIGEST_SHA1], DIGEST_LEN),OP_EQ,
  1431. AUTHORITY_SIGNKEY_A_DIGEST, HEX_DIGEST_LEN);
  1432. tt_mem_op(hex_str(pkey_digests.d[DIGEST_SHA256], DIGEST256_LEN),OP_EQ,
  1433. AUTHORITY_SIGNKEY_A_DIGEST256, HEX_DIGEST256_LEN);
  1434. done:
  1435. crypto_pk_free(k);
  1436. }
  1437. static void
  1438. test_crypto_digest_names(void *arg)
  1439. {
  1440. static const struct {
  1441. int a; const char *n;
  1442. } names[] = {
  1443. { DIGEST_SHA1, "sha1" },
  1444. { DIGEST_SHA256, "sha256" },
  1445. { DIGEST_SHA512, "sha512" },
  1446. { DIGEST_SHA3_256, "sha3-256" },
  1447. { DIGEST_SHA3_512, "sha3-512" },
  1448. { -1, NULL }
  1449. };
  1450. (void)arg;
  1451. int i;
  1452. for (i = 0; names[i].n; ++i) {
  1453. tt_str_op(names[i].n, OP_EQ,crypto_digest_algorithm_get_name(names[i].a));
  1454. tt_int_op(names[i].a,
  1455. OP_EQ,crypto_digest_algorithm_parse_name(names[i].n));
  1456. }
  1457. tt_int_op(-1, OP_EQ,
  1458. crypto_digest_algorithm_parse_name("TimeCubeHash-4444"));
  1459. done:
  1460. ;
  1461. }
  1462. /** Run unit tests for misc crypto formatting functionality (base64, base32,
  1463. * fingerprints, etc) */
  1464. static void
  1465. test_crypto_formats(void *arg)
  1466. {
  1467. char *data1 = NULL, *data2 = NULL, *data3 = NULL;
  1468. int i, j, idx;
  1469. (void)arg;
  1470. data1 = tor_malloc(1024);
  1471. data2 = tor_malloc(1024);
  1472. data3 = tor_malloc(1024);
  1473. tt_assert(data1 && data2 && data3);
  1474. /* Base64 tests */
  1475. memset(data1, 6, 1024);
  1476. for (idx = 0; idx < 10; ++idx) {
  1477. i = base64_encode(data2, 1024, data1, idx, 0);
  1478. tt_int_op(i, OP_GE, 0);
  1479. tt_int_op(i, OP_EQ, strlen(data2));
  1480. j = base64_decode(data3, 1024, data2, i);
  1481. tt_int_op(j,OP_EQ, idx);
  1482. tt_mem_op(data3,OP_EQ, data1, idx);
  1483. i = base64_encode_nopad(data2, 1024, (uint8_t*)data1, idx);
  1484. tt_int_op(i, OP_GE, 0);
  1485. tt_int_op(i, OP_EQ, strlen(data2));
  1486. tt_assert(! strchr(data2, '='));
  1487. j = base64_decode(data3, 1024, data2, i);
  1488. tt_int_op(j, OP_EQ, idx);
  1489. tt_mem_op(data3,OP_EQ, data1, idx);
  1490. }
  1491. strlcpy(data1, "Test string that contains 35 chars.", 1024);
  1492. strlcat(data1, " 2nd string that contains 35 chars.", 1024);
  1493. i = base64_encode(data2, 1024, data1, 71, 0);
  1494. tt_int_op(i, OP_GE, 0);
  1495. j = base64_decode(data3, 1024, data2, i);
  1496. tt_int_op(j,OP_EQ, 71);
  1497. tt_str_op(data3,OP_EQ, data1);
  1498. tt_int_op(data2[i], OP_EQ, '\0');
  1499. crypto_rand(data1, DIGEST_LEN);
  1500. memset(data2, 100, 1024);
  1501. digest_to_base64(data2, data1);
  1502. tt_int_op(BASE64_DIGEST_LEN,OP_EQ, strlen(data2));
  1503. tt_int_op(100,OP_EQ, data2[BASE64_DIGEST_LEN+2]);
  1504. memset(data3, 99, 1024);
  1505. tt_int_op(digest_from_base64(data3, data2),OP_EQ, 0);
  1506. tt_mem_op(data1,OP_EQ, data3, DIGEST_LEN);
  1507. tt_int_op(99,OP_EQ, data3[DIGEST_LEN+1]);
  1508. tt_int_op(digest_from_base64(data3, "###"), OP_LT, 0);
  1509. /* Encoding SHA256 */
  1510. crypto_rand(data2, DIGEST256_LEN);
  1511. memset(data2, 100, 1024);
  1512. digest256_to_base64(data2, data1);
  1513. tt_int_op(BASE64_DIGEST256_LEN,OP_EQ, strlen(data2));
  1514. tt_int_op(100,OP_EQ, data2[BASE64_DIGEST256_LEN+2]);
  1515. memset(data3, 99, 1024);
  1516. tt_int_op(digest256_from_base64(data3, data2),OP_EQ, 0);
  1517. tt_mem_op(data1,OP_EQ, data3, DIGEST256_LEN);
  1518. tt_int_op(99,OP_EQ, data3[DIGEST256_LEN+1]);
  1519. /* Base32 tests */
  1520. strlcpy(data1, "5chrs", 1024);
  1521. /* bit pattern is: [35 63 68 72 73] ->
  1522. * [00110101 01100011 01101000 01110010 01110011]
  1523. * By 5s: [00110 10101 10001 10110 10000 11100 10011 10011]
  1524. */
  1525. base32_encode(data2, 9, data1, 5);
  1526. tt_str_op(data2,OP_EQ, "gvrwq4tt");
  1527. strlcpy(data1, "\xFF\xF5\x6D\x44\xAE\x0D\x5C\xC9\x62\xC4", 1024);
  1528. base32_encode(data2, 30, data1, 10);
  1529. tt_str_op(data2,OP_EQ, "772w2rfobvomsywe");
  1530. /* Base16 tests */
  1531. strlcpy(data1, "6chrs\xff", 1024);
  1532. base16_encode(data2, 13, data1, 6);
  1533. tt_str_op(data2,OP_EQ, "3663687273FF");
  1534. strlcpy(data1, "f0d678affc000100", 1024);
  1535. i = base16_decode(data2, 8, data1, 16);
  1536. tt_int_op(i,OP_EQ, 8);
  1537. tt_mem_op(data2,OP_EQ, "\xf0\xd6\x78\xaf\xfc\x00\x01\x00",8);
  1538. /* now try some failing base16 decodes */
  1539. tt_int_op(-1,OP_EQ, base16_decode(data2, 8, data1, 15)); /* odd input len */
  1540. tt_int_op(-1,OP_EQ, base16_decode(data2, 7, data1, 16)); /* dest too short */
  1541. strlcpy(data1, "f0dz!8affc000100", 1024);
  1542. tt_int_op(-1,OP_EQ, base16_decode(data2, 8, data1, 16));
  1543. tor_free(data1);
  1544. tor_free(data2);
  1545. tor_free(data3);
  1546. /* Add spaces to fingerprint */
  1547. {
  1548. data1 = tor_strdup("ABCD1234ABCD56780000ABCD1234ABCD56780000");
  1549. tt_int_op(strlen(data1),OP_EQ, 40);
  1550. data2 = tor_malloc(FINGERPRINT_LEN+1);
  1551. crypto_add_spaces_to_fp(data2, FINGERPRINT_LEN+1, data1);
  1552. tt_str_op(data2, OP_EQ,
  1553. "ABCD 1234 ABCD 5678 0000 ABCD 1234 ABCD 5678 0000");
  1554. tor_free(data1);
  1555. tor_free(data2);
  1556. }
  1557. done:
  1558. tor_free(data1);
  1559. tor_free(data2);
  1560. tor_free(data3);
  1561. }
  1562. /** Test AES-CTR encryption and decryption with IV. */
  1563. static void
  1564. test_crypto_aes_iv(void *arg)
  1565. {
  1566. char *plain, *encrypted1, *encrypted2, *decrypted1, *decrypted2;
  1567. char plain_1[1], plain_15[15], plain_16[16], plain_17[17];
  1568. char key1[16], key2[16];
  1569. ssize_t encrypted_size, decrypted_size;
  1570. int use_evp = !strcmp(arg,"evp");
  1571. evaluate_evp_for_aes(use_evp);
  1572. plain = tor_malloc(4095);
  1573. encrypted1 = tor_malloc(4095 + 1 + 16);
  1574. encrypted2 = tor_malloc(4095 + 1 + 16);
  1575. decrypted1 = tor_malloc(4095 + 1);
  1576. decrypted2 = tor_malloc(4095 + 1);
  1577. crypto_rand(plain, 4095);
  1578. crypto_rand(key1, 16);
  1579. crypto_rand(key2, 16);
  1580. crypto_rand(plain_1, 1);
  1581. crypto_rand(plain_15, 15);
  1582. crypto_rand(plain_16, 16);
  1583. crypto_rand(plain_17, 17);
  1584. key1[0] = key2[0] + 128; /* Make sure that contents are different. */
  1585. /* Encrypt and decrypt with the same key. */
  1586. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted1, 16 + 4095,
  1587. plain, 4095);
  1588. tt_int_op(encrypted_size,OP_EQ, 16 + 4095);
  1589. tt_assert(encrypted_size > 0); /* This is obviously true, since 4111 is
  1590. * greater than 0, but its truth is not
  1591. * obvious to all analysis tools. */
  1592. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 4095,
  1593. encrypted1, encrypted_size);
  1594. tt_int_op(decrypted_size,OP_EQ, 4095);
  1595. tt_assert(decrypted_size > 0);
  1596. tt_mem_op(plain,OP_EQ, decrypted1, 4095);
  1597. /* Encrypt a second time (with a new random initialization vector). */
  1598. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted2, 16 + 4095,
  1599. plain, 4095);
  1600. tt_int_op(encrypted_size,OP_EQ, 16 + 4095);
  1601. tt_assert(encrypted_size > 0);
  1602. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted2, 4095,
  1603. encrypted2, encrypted_size);
  1604. tt_int_op(decrypted_size,OP_EQ, 4095);
  1605. tt_assert(decrypted_size > 0);
  1606. tt_mem_op(plain,OP_EQ, decrypted2, 4095);
  1607. tt_mem_op(encrypted1,OP_NE, encrypted2, encrypted_size);
  1608. /* Decrypt with the wrong key. */
  1609. decrypted_size = crypto_cipher_decrypt_with_iv(key2, decrypted2, 4095,
  1610. encrypted1, encrypted_size);
  1611. tt_int_op(decrypted_size,OP_EQ, 4095);
  1612. tt_mem_op(plain,OP_NE, decrypted2, decrypted_size);
  1613. /* Alter the initialization vector. */
  1614. encrypted1[0] += 42;
  1615. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 4095,
  1616. encrypted1, encrypted_size);
  1617. tt_int_op(decrypted_size,OP_EQ, 4095);
  1618. tt_mem_op(plain,OP_NE, decrypted2, 4095);
  1619. /* Special length case: 1. */
  1620. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted1, 16 + 1,
  1621. plain_1, 1);
  1622. tt_int_op(encrypted_size,OP_EQ, 16 + 1);
  1623. tt_assert(encrypted_size > 0);
  1624. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 1,
  1625. encrypted1, encrypted_size);
  1626. tt_int_op(decrypted_size,OP_EQ, 1);
  1627. tt_assert(decrypted_size > 0);
  1628. tt_mem_op(plain_1,OP_EQ, decrypted1, 1);
  1629. /* Special length case: 15. */
  1630. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted1, 16 + 15,
  1631. plain_15, 15);
  1632. tt_int_op(encrypted_size,OP_EQ, 16 + 15);
  1633. tt_assert(encrypted_size > 0);
  1634. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 15,
  1635. encrypted1, encrypted_size);
  1636. tt_int_op(decrypted_size,OP_EQ, 15);
  1637. tt_assert(decrypted_size > 0);
  1638. tt_mem_op(plain_15,OP_EQ, decrypted1, 15);
  1639. /* Special length case: 16. */
  1640. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted1, 16 + 16,
  1641. plain_16, 16);
  1642. tt_int_op(encrypted_size,OP_EQ, 16 + 16);
  1643. tt_assert(encrypted_size > 0);
  1644. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 16,
  1645. encrypted1, encrypted_size);
  1646. tt_int_op(decrypted_size,OP_EQ, 16);
  1647. tt_assert(decrypted_size > 0);
  1648. tt_mem_op(plain_16,OP_EQ, decrypted1, 16);
  1649. /* Special length case: 17. */
  1650. encrypted_size = crypto_cipher_encrypt_with_iv(key1, encrypted1, 16 + 17,
  1651. plain_17, 17);
  1652. tt_int_op(encrypted_size,OP_EQ, 16 + 17);
  1653. tt_assert(encrypted_size > 0);
  1654. decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 17,
  1655. encrypted1, encrypted_size);
  1656. tt_int_op(decrypted_size,OP_EQ, 17);
  1657. tt_assert(decrypted_size > 0);
  1658. tt_mem_op(plain_17,OP_EQ, decrypted1, 17);
  1659. done:
  1660. /* Free memory. */
  1661. tor_free(plain);
  1662. tor_free(encrypted1);
  1663. tor_free(encrypted2);
  1664. tor_free(decrypted1);
  1665. tor_free(decrypted2);
  1666. }
  1667. /** Test base32 decoding. */
  1668. static void
  1669. test_crypto_base32_decode(void *arg)
  1670. {
  1671. char plain[60], encoded[96 + 1], decoded[60];
  1672. int res;
  1673. (void)arg;
  1674. crypto_rand(plain, 60);
  1675. /* Encode and decode a random string. */
  1676. base32_encode(encoded, 96 + 1, plain, 60);
  1677. res = base32_decode(decoded, 60, encoded, 96);
  1678. tt_int_op(res,OP_EQ, 0);
  1679. tt_mem_op(plain,OP_EQ, decoded, 60);
  1680. /* Encode, uppercase, and decode a random string. */
  1681. base32_encode(encoded, 96 + 1, plain, 60);
  1682. tor_strupper(encoded);
  1683. res = base32_decode(decoded, 60, encoded, 96);
  1684. tt_int_op(res,OP_EQ, 0);
  1685. tt_mem_op(plain,OP_EQ, decoded, 60);
  1686. /* Change encoded string and decode. */
  1687. if (encoded[0] == 'A' || encoded[0] == 'a')
  1688. encoded[0] = 'B';
  1689. else
  1690. encoded[0] = 'A';
  1691. res = base32_decode(decoded, 60, encoded, 96);
  1692. tt_int_op(res,OP_EQ, 0);
  1693. tt_mem_op(plain,OP_NE, decoded, 60);
  1694. /* Bad encodings. */
  1695. encoded[0] = '!';
  1696. res = base32_decode(decoded, 60, encoded, 96);
  1697. tt_int_op(0, OP_GT, res);
  1698. done:
  1699. ;
  1700. }
  1701. static void
  1702. test_crypto_kdf_TAP(void *arg)
  1703. {
  1704. uint8_t key_material[100];
  1705. int r;
  1706. char *mem_op_hex_tmp = NULL;
  1707. (void)arg;
  1708. #define EXPAND(s) \
  1709. r = crypto_expand_key_material_TAP( \
  1710. (const uint8_t*)(s), strlen(s), \
  1711. key_material, 100)
  1712. /* Test vectors generated with a little python script; feel free to write
  1713. * your own. */
  1714. memset(key_material, 0, sizeof(key_material));
  1715. EXPAND("");
  1716. tt_int_op(r, OP_EQ, 0);
  1717. test_memeq_hex(key_material,
  1718. "5ba93c9db0cff93f52b521d7420e43f6eda2784fbf8b4530d8"
  1719. "d246dd74ac53a13471bba17941dff7c4ea21bb365bbeeaf5f2"
  1720. "c654883e56d11e43c44e9842926af7ca0a8cca12604f945414"
  1721. "f07b01e13da42c6cf1de3abfdea9b95f34687cbbe92b9a7383");
  1722. EXPAND("Tor");
  1723. tt_int_op(r, OP_EQ, 0);
  1724. test_memeq_hex(key_material,
  1725. "776c6214fc647aaa5f683c737ee66ec44f03d0372e1cce6922"
  1726. "7950f236ddf1e329a7ce7c227903303f525a8c6662426e8034"
  1727. "870642a6dabbd41b5d97ec9bf2312ea729992f48f8ea2d0ba8"
  1728. "3f45dfda1a80bdc8b80de01b23e3e0ffae099b3e4ccf28dc28");
  1729. EXPAND("AN ALARMING ITEM TO FIND ON A MONTHLY AUTO-DEBIT NOTICE");
  1730. tt_int_op(r, OP_EQ, 0);
  1731. test_memeq_hex(key_material,
  1732. "a340b5d126086c3ab29c2af4179196dbf95e1c72431419d331"
  1733. "4844bf8f6afb6098db952b95581fb6c33625709d6f4400b8e7"
  1734. "ace18a70579fad83c0982ef73f89395bcc39493ad53a685854"
  1735. "daf2ba9b78733b805d9a6824c907ee1dba5ac27a1e466d4d10");
  1736. done:
  1737. tor_free(mem_op_hex_tmp);
  1738. #undef EXPAND
  1739. }
  1740. static void
  1741. test_crypto_hkdf_sha256(void *arg)
  1742. {
  1743. uint8_t key_material[100];
  1744. const uint8_t salt[] = "ntor-curve25519-sha256-1:key_extract";
  1745. const size_t salt_len = strlen((char*)salt);
  1746. const uint8_t m_expand[] = "ntor-curve25519-sha256-1:key_expand";
  1747. const size_t m_expand_len = strlen((char*)m_expand);
  1748. int r;
  1749. char *mem_op_hex_tmp = NULL;
  1750. (void)arg;
  1751. #define EXPAND(s) \
  1752. r = crypto_expand_key_material_rfc5869_sha256( \
  1753. (const uint8_t*)(s), strlen(s), \
  1754. salt, salt_len, \
  1755. m_expand, m_expand_len, \
  1756. key_material, 100)
  1757. /* Test vectors generated with ntor_ref.py */
  1758. EXPAND("Tor");
  1759. tt_int_op(r, OP_EQ, 0);
  1760. test_memeq_hex(key_material,
  1761. "5521492a85139a8d9107a2d5c0d9c91610d0f95989975ebee6"
  1762. "c02a4f8d622a6cfdf9b7c7edd3832e2760ded1eac309b76f8d"
  1763. "66c4a3c4d6225429b3a016e3c3d45911152fc87bc2de9630c3"
  1764. "961be9fdb9f93197ea8e5977180801926d3321fa21513e59ac");
  1765. EXPAND("AN ALARMING ITEM TO FIND ON YOUR CREDIT-RATING STATEMENT");
  1766. tt_int_op(r, OP_EQ, 0);
  1767. test_memeq_hex(key_material,
  1768. "a2aa9b50da7e481d30463adb8f233ff06e9571a0ca6ab6df0f"
  1769. "b206fa34e5bc78d063fc291501beec53b36e5a0e434561200c"
  1770. "5f8bd13e0f88b3459600b4dc21d69363e2895321c06184879d"
  1771. "94b18f078411be70b767c7fc40679a9440a0c95ea83a23efbf");
  1772. done:
  1773. tor_free(mem_op_hex_tmp);
  1774. #undef EXPAND
  1775. }
  1776. static void
  1777. test_crypto_hkdf_sha256_testvecs(void *arg)
  1778. {
  1779. (void) arg;
  1780. /* Test vectors from RFC5869, sections A.1 through A.3 */
  1781. const struct {
  1782. const char *ikm16, *salt16, *info16;
  1783. int L;
  1784. const char *okm16;
  1785. } vecs[] = {
  1786. { /* from A.1 */
  1787. "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b",
  1788. "000102030405060708090a0b0c",
  1789. "f0f1f2f3f4f5f6f7f8f9",
  1790. 42,
  1791. "3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf"
  1792. "34007208d5b887185865"
  1793. },
  1794. { /* from A.2 */
  1795. "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"
  1796. "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f"
  1797. "404142434445464748494a4b4c4d4e4f",
  1798. "606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f"
  1799. "808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f"
  1800. "a0a1a2a3a4a5a6a7a8a9aaabacadaeaf",
  1801. "b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecf"
  1802. "d0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeef"
  1803. "f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
  1804. 82,
  1805. "b11e398dc80327a1c8e7f78c596a49344f012eda2d4efad8a050cc4c19afa97c"
  1806. "59045a99cac7827271cb41c65e590e09da3275600c2f09b8367793a9aca3db71"
  1807. "cc30c58179ec3e87c14c01d5c1f3434f1d87"
  1808. },
  1809. { /* from A.3 */
  1810. "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b",
  1811. "",
  1812. "",
  1813. 42,
  1814. "8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d"
  1815. "9d201395faa4b61a96c8",
  1816. },
  1817. { NULL, NULL, NULL, -1, NULL }
  1818. };
  1819. int i;
  1820. char *ikm = NULL;
  1821. char *salt = NULL;
  1822. char *info = NULL;
  1823. char *okm = NULL;
  1824. char *mem_op_hex_tmp = NULL;
  1825. for (i = 0; vecs[i].ikm16; ++i) {
  1826. size_t ikm_len = strlen(vecs[i].ikm16)/2;
  1827. size_t salt_len = strlen(vecs[i].salt16)/2;
  1828. size_t info_len = strlen(vecs[i].info16)/2;
  1829. size_t okm_len = vecs[i].L;
  1830. ikm = tor_malloc(ikm_len);
  1831. salt = tor_malloc(salt_len);
  1832. info = tor_malloc(info_len);
  1833. okm = tor_malloc(okm_len);
  1834. base16_decode(ikm, ikm_len, vecs[i].ikm16, strlen(vecs[i].ikm16));
  1835. base16_decode(salt, salt_len, vecs[i].salt16, strlen(vecs[i].salt16));
  1836. base16_decode(info, info_len, vecs[i].info16, strlen(vecs[i].info16));
  1837. int r = crypto_expand_key_material_rfc5869_sha256(
  1838. (const uint8_t*)ikm, ikm_len,
  1839. (const uint8_t*)salt, salt_len,
  1840. (const uint8_t*)info, info_len,
  1841. (uint8_t*)okm, okm_len);
  1842. tt_int_op(r, OP_EQ, 0);
  1843. test_memeq_hex(okm, vecs[i].okm16);
  1844. tor_free(ikm);
  1845. tor_free(salt);
  1846. tor_free(info);
  1847. tor_free(okm);
  1848. }
  1849. done:
  1850. tor_free(ikm);
  1851. tor_free(salt);
  1852. tor_free(info);
  1853. tor_free(okm);
  1854. tor_free(mem_op_hex_tmp);
  1855. }
  1856. static void
  1857. test_crypto_curve25519_impl(void *arg)
  1858. {
  1859. /* adapted from curve25519_donna, which adapted it from test-curve25519
  1860. version 20050915, by D. J. Bernstein, Public domain. */
  1861. const int randomize_high_bit = (arg != NULL);
  1862. #ifdef SLOW_CURVE25519_TEST
  1863. const int loop_max=10000;
  1864. const char e1_expected[] = "4faf81190869fd742a33691b0e0824d5"
  1865. "7e0329f4dd2819f5f32d130f1296b500";
  1866. const char e2k_expected[] = "05aec13f92286f3a781ccae98995a3b9"
  1867. "e0544770bc7de853b38f9100489e3e79";
  1868. const char e1e2k_expected[] = "cd6e8269104eb5aaee886bd2071fba88"
  1869. "bd13861475516bc2cd2b6e005e805064";
  1870. #else /* !(defined(SLOW_CURVE25519_TEST)) */
  1871. const int loop_max=200;
  1872. const char e1_expected[] = "bc7112cde03f97ef7008cad1bdc56be3"
  1873. "c6a1037d74cceb3712e9206871dcf654";
  1874. const char e2k_expected[] = "dd8fa254fb60bdb5142fe05b1f5de44d"
  1875. "8e3ee1a63c7d14274ea5d4c67f065467";
  1876. const char e1e2k_expected[] = "7ddb98bd89025d2347776b33901b3e7e"
  1877. "c0ee98cb2257a4545c0cfb2ca3e1812b";
  1878. #endif /* defined(SLOW_CURVE25519_TEST) */
  1879. unsigned char e1k[32];
  1880. unsigned char e2k[32];
  1881. unsigned char e1e2k[32];
  1882. unsigned char e2e1k[32];
  1883. unsigned char e1[32] = {3};
  1884. unsigned char e2[32] = {5};
  1885. unsigned char k[32] = {9};
  1886. int loop, i;
  1887. char *mem_op_hex_tmp = NULL;
  1888. for (loop = 0; loop < loop_max; ++loop) {
  1889. curve25519_impl(e1k,e1,k);
  1890. curve25519_impl(e2e1k,e2,e1k);
  1891. curve25519_impl(e2k,e2,k);
  1892. if (randomize_high_bit) {
  1893. /* We require that the high bit of the public key be ignored. So if
  1894. * we're doing this variant test, we randomize the high bit of e2k, and
  1895. * make sure that the handshake still works out the same as it would
  1896. * otherwise. */
  1897. uint8_t byte;
  1898. crypto_rand((char*)&byte, 1);
  1899. e2k[31] |= (byte & 0x80);
  1900. }
  1901. curve25519_impl(e1e2k,e1,e2k);
  1902. tt_mem_op(e1e2k,OP_EQ, e2e1k, 32);
  1903. if (loop == loop_max-1) {
  1904. break;
  1905. }
  1906. for (i = 0;i < 32;++i) e1[i] ^= e2k[i];
  1907. for (i = 0;i < 32;++i) e2[i] ^= e1k[i];
  1908. for (i = 0;i < 32;++i) k[i] ^= e1e2k[i];
  1909. }
  1910. test_memeq_hex(e1, e1_expected);
  1911. test_memeq_hex(e2k, e2k_expected);
  1912. test_memeq_hex(e1e2k, e1e2k_expected);
  1913. done:
  1914. tor_free(mem_op_hex_tmp);
  1915. }
  1916. static void
  1917. test_crypto_curve25519_basepoint(void *arg)
  1918. {
  1919. uint8_t secret[32];
  1920. uint8_t public1[32];
  1921. uint8_t public2[32];
  1922. const int iters = 2048;
  1923. int i;
  1924. (void) arg;
  1925. for (i = 0; i < iters; ++i) {
  1926. crypto_rand((char*)secret, 32);
  1927. curve25519_set_impl_params(1); /* Use optimization */
  1928. curve25519_basepoint_impl(public1, secret);
  1929. curve25519_set_impl_params(0); /* Disable optimization */
  1930. curve25519_basepoint_impl(public2, secret);
  1931. tt_mem_op(public1, OP_EQ, public2, 32);
  1932. }
  1933. done:
  1934. ;
  1935. }
  1936. static void
  1937. test_crypto_curve25519_testvec(void *arg)
  1938. {
  1939. (void)arg;
  1940. char *mem_op_hex_tmp = NULL;
  1941. /* From RFC 7748, section 6.1 */
  1942. /* Alice's private key, a: */
  1943. const char a16[] =
  1944. "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a";
  1945. /* Alice's public key, X25519(a, 9): */
  1946. const char a_pub16[] =
  1947. "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a";
  1948. /* Bob's private key, b: */
  1949. const char b16[] =
  1950. "5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb";
  1951. /* Bob's public key, X25519(b, 9): */
  1952. const char b_pub16[] =
  1953. "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f";
  1954. /* Their shared secret, K: */
  1955. const char k16[] =
  1956. "4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742";
  1957. uint8_t a[32], b[32], a_pub[32], b_pub[32], k1[32], k2[32];
  1958. base16_decode((char*)a, sizeof(a), a16, strlen(a16));
  1959. base16_decode((char*)b, sizeof(b), b16, strlen(b16));
  1960. curve25519_basepoint_impl(a_pub, a);
  1961. curve25519_basepoint_impl(b_pub, b);
  1962. curve25519_impl(k1, a, b_pub);
  1963. curve25519_impl(k2, b, a_pub);
  1964. test_memeq_hex(a, a16);
  1965. test_memeq_hex(b, b16);
  1966. test_memeq_hex(a_pub, a_pub16);
  1967. test_memeq_hex(b_pub, b_pub16);
  1968. test_memeq_hex(k1, k16);
  1969. test_memeq_hex(k2, k16);
  1970. done:
  1971. tor_free(mem_op_hex_tmp);
  1972. }
  1973. static void
  1974. test_crypto_curve25519_wrappers(void *arg)
  1975. {
  1976. curve25519_public_key_t pubkey1, pubkey2;
  1977. curve25519_secret_key_t seckey1, seckey2;
  1978. uint8_t output1[CURVE25519_OUTPUT_LEN];
  1979. uint8_t output2[CURVE25519_OUTPUT_LEN];
  1980. (void)arg;
  1981. /* Test a simple handshake, serializing and deserializing some stuff. */
  1982. curve25519_secret_key_generate(&seckey1, 0);
  1983. curve25519_secret_key_generate(&seckey2, 1);
  1984. curve25519_public_key_generate(&pubkey1, &seckey1);
  1985. curve25519_public_key_generate(&pubkey2, &seckey2);
  1986. tt_assert(curve25519_public_key_is_ok(&pubkey1));
  1987. tt_assert(curve25519_public_key_is_ok(&pubkey2));
  1988. curve25519_handshake(output1, &seckey1, &pubkey2);
  1989. curve25519_handshake(output2, &seckey2, &pubkey1);
  1990. tt_mem_op(output1,OP_EQ, output2, sizeof(output1));
  1991. done:
  1992. ;
  1993. }
  1994. static void
  1995. test_crypto_curve25519_encode(void *arg)
  1996. {
  1997. curve25519_secret_key_t seckey;
  1998. curve25519_public_key_t key1, key2, key3;
  1999. char buf[64];
  2000. (void)arg;
  2001. curve25519_secret_key_generate(&seckey, 0);
  2002. curve25519_public_key_generate(&key1, &seckey);
  2003. tt_int_op(0, OP_EQ, curve25519_public_to_base64(buf, &key1));
  2004. tt_int_op(CURVE25519_BASE64_PADDED_LEN, OP_EQ, strlen(buf));
  2005. tt_int_op(0, OP_EQ, curve25519_public_from_base64(&key2, buf));
  2006. tt_mem_op(key1.public_key,OP_EQ, key2.public_key, CURVE25519_PUBKEY_LEN);
  2007. buf[CURVE25519_BASE64_PADDED_LEN - 1] = '\0';
  2008. tt_int_op(CURVE25519_BASE64_PADDED_LEN-1, OP_EQ, strlen(buf));
  2009. tt_int_op(0, OP_EQ, curve25519_public_from_base64(&key3, buf));
  2010. tt_mem_op(key1.public_key,OP_EQ, key3.public_key, CURVE25519_PUBKEY_LEN);
  2011. /* Now try bogus parses. */
  2012. strlcpy(buf, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$=", sizeof(buf));
  2013. tt_int_op(-1, OP_EQ, curve25519_public_from_base64(&key3, buf));
  2014. strlcpy(buf, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$", sizeof(buf));
  2015. tt_int_op(-1, OP_EQ, curve25519_public_from_base64(&key3, buf));
  2016. strlcpy(buf, "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", sizeof(buf));
  2017. tt_int_op(-1, OP_EQ, curve25519_public_from_base64(&key3, buf));
  2018. done:
  2019. ;
  2020. }
  2021. static void
  2022. test_crypto_curve25519_persist(void *arg)
  2023. {
  2024. curve25519_keypair_t keypair, keypair2;
  2025. char *fname = tor_strdup(get_fname("curve25519_keypair"));
  2026. char *tag = NULL;
  2027. char *content = NULL;
  2028. const char *cp;
  2029. struct stat st;
  2030. size_t taglen;
  2031. (void)arg;
  2032. tt_int_op(0,OP_EQ,curve25519_keypair_generate(&keypair, 0));
  2033. tt_int_op(0,OP_EQ,
  2034. curve25519_keypair_write_to_file(&keypair, fname, "testing"));
  2035. tt_int_op(0,OP_EQ,curve25519_keypair_read_from_file(&keypair2, &tag, fname));
  2036. tt_str_op(tag,OP_EQ,"testing");
  2037. tor_free(tag);
  2038. tt_mem_op(keypair.pubkey.public_key,OP_EQ,
  2039. keypair2.pubkey.public_key,
  2040. CURVE25519_PUBKEY_LEN);
  2041. tt_mem_op(keypair.seckey.secret_key,OP_EQ,
  2042. keypair2.seckey.secret_key,
  2043. CURVE25519_SECKEY_LEN);
  2044. content = read_file_to_str(fname, RFTS_BIN, &st);
  2045. tt_assert(content);
  2046. taglen = strlen("== c25519v1: testing ==");
  2047. tt_u64_op((uint64_t)st.st_size, OP_EQ,
  2048. 32+CURVE25519_PUBKEY_LEN+CURVE25519_SECKEY_LEN);
  2049. tt_assert(fast_memeq(content, "== c25519v1: testing ==", taglen));
  2050. tt_assert(tor_mem_is_zero(content+taglen, 32-taglen));
  2051. cp = content + 32;
  2052. tt_mem_op(keypair.seckey.secret_key,OP_EQ,
  2053. cp,
  2054. CURVE25519_SECKEY_LEN);
  2055. cp += CURVE25519_SECKEY_LEN;
  2056. tt_mem_op(keypair.pubkey.public_key,OP_EQ,
  2057. cp,
  2058. CURVE25519_SECKEY_LEN);
  2059. tor_free(fname);
  2060. fname = tor_strdup(get_fname("bogus_keypair"));
  2061. tt_int_op(-1, OP_EQ,
  2062. curve25519_keypair_read_from_file(&keypair2, &tag, fname));
  2063. tor_free(tag);
  2064. content[69] ^= 0xff;
  2065. tt_int_op(0, OP_EQ,
  2066. write_bytes_to_file(fname, content, (size_t)st.st_size, 1));
  2067. tt_int_op(-1, OP_EQ,
  2068. curve25519_keypair_read_from_file(&keypair2, &tag, fname));
  2069. done:
  2070. tor_free(fname);
  2071. tor_free(content);
  2072. tor_free(tag);
  2073. }
  2074. static void
  2075. test_crypto_ed25519_simple(void *arg)
  2076. {
  2077. ed25519_keypair_t kp1, kp2;
  2078. ed25519_public_key_t pub1, pub2;
  2079. ed25519_secret_key_t sec1, sec2;
  2080. ed25519_signature_t sig1, sig2;
  2081. const uint8_t msg[] =
  2082. "GNU will be able to run Unix programs, "
  2083. "but will not be identical to Unix.";
  2084. const uint8_t msg2[] =
  2085. "Microsoft Windows extends the features of the DOS operating system, "
  2086. "yet is compatible with most existing applications that run under DOS.";
  2087. size_t msg_len = strlen((const char*)msg);
  2088. size_t msg2_len = strlen((const char*)msg2);
  2089. (void)arg;
  2090. tt_int_op(0, OP_EQ, ed25519_secret_key_generate(&sec1, 0));
  2091. tt_int_op(0, OP_EQ, ed25519_secret_key_generate(&sec2, 1));
  2092. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pub1, &sec1));
  2093. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pub2, &sec1));
  2094. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, 0);
  2095. tt_int_op(ed25519_validate_pubkey(&pub2), OP_EQ, 0);
  2096. tt_mem_op(pub1.pubkey, OP_EQ, pub2.pubkey, sizeof(pub1.pubkey));
  2097. tt_assert(ed25519_pubkey_eq(&pub1, &pub2));
  2098. tt_assert(ed25519_pubkey_eq(&pub1, &pub1));
  2099. memcpy(&kp1.pubkey, &pub1, sizeof(pub1));
  2100. memcpy(&kp1.seckey, &sec1, sizeof(sec1));
  2101. tt_int_op(0, OP_EQ, ed25519_sign(&sig1, msg, msg_len, &kp1));
  2102. tt_int_op(0, OP_EQ, ed25519_sign(&sig2, msg, msg_len, &kp1));
  2103. /* Ed25519 signatures are deterministic */
  2104. tt_mem_op(sig1.sig, OP_EQ, sig2.sig, sizeof(sig1.sig));
  2105. /* Basic signature is valid. */
  2106. tt_int_op(0, OP_EQ, ed25519_checksig(&sig1, msg, msg_len, &pub1));
  2107. /* Altered signature doesn't work. */
  2108. sig1.sig[0] ^= 3;
  2109. tt_int_op(-1, OP_EQ, ed25519_checksig(&sig1, msg, msg_len, &pub1));
  2110. /* Wrong public key doesn't work. */
  2111. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pub2, &sec2));
  2112. tt_int_op(-1, OP_EQ, ed25519_checksig(&sig2, msg, msg_len, &pub2));
  2113. tt_assert(! ed25519_pubkey_eq(&pub1, &pub2));
  2114. /* Wrong message doesn't work. */
  2115. tt_int_op(0, OP_EQ, ed25519_checksig(&sig2, msg, msg_len, &pub1));
  2116. tt_int_op(-1, OP_EQ, ed25519_checksig(&sig2, msg, msg_len-1, &pub1));
  2117. tt_int_op(-1, OP_EQ, ed25519_checksig(&sig2, msg2, msg2_len, &pub1));
  2118. /* Batch signature checking works with some bad. */
  2119. tt_int_op(0, OP_EQ, ed25519_keypair_generate(&kp2, 0));
  2120. tt_int_op(0, OP_EQ, ed25519_sign(&sig1, msg, msg_len, &kp2));
  2121. {
  2122. ed25519_checkable_t ch[] = {
  2123. { &pub1, sig2, msg, msg_len }, /*ok*/
  2124. { &pub1, sig2, msg, msg_len-1 }, /*bad*/
  2125. { &kp2.pubkey, sig2, msg2, msg2_len }, /*bad*/
  2126. { &kp2.pubkey, sig1, msg, msg_len }, /*ok*/
  2127. };
  2128. int okay[4];
  2129. tt_int_op(-2, OP_EQ, ed25519_checksig_batch(okay, ch, 4));
  2130. tt_int_op(okay[0], OP_EQ, 1);
  2131. tt_int_op(okay[1], OP_EQ, 0);
  2132. tt_int_op(okay[2], OP_EQ, 0);
  2133. tt_int_op(okay[3], OP_EQ, 1);
  2134. tt_int_op(-2, OP_EQ, ed25519_checksig_batch(NULL, ch, 4));
  2135. }
  2136. /* Batch signature checking works with all good. */
  2137. {
  2138. ed25519_checkable_t ch[] = {
  2139. { &pub1, sig2, msg, msg_len }, /*ok*/
  2140. { &kp2.pubkey, sig1, msg, msg_len }, /*ok*/
  2141. };
  2142. int okay[2];
  2143. tt_int_op(0, OP_EQ, ed25519_checksig_batch(okay, ch, 2));
  2144. tt_int_op(okay[0], OP_EQ, 1);
  2145. tt_int_op(okay[1], OP_EQ, 1);
  2146. tt_int_op(0, OP_EQ, ed25519_checksig_batch(NULL, ch, 2));
  2147. }
  2148. /* Test the string-prefixed sign/checksig functions */
  2149. {
  2150. ed25519_signature_t manual_sig;
  2151. char *prefixed_msg;
  2152. /* Generate a signature with a prefixed msg. */
  2153. tt_int_op(0, OP_EQ, ed25519_sign_prefixed(&sig1, msg, msg_len,
  2154. "always in the mood",
  2155. &kp1));
  2156. /* First, check that ed25519_sign_prefixed() returns the exact same sig as
  2157. if we had manually prefixed the msg ourselves. */
  2158. tor_asprintf(&prefixed_msg, "%s%s", "always in the mood", msg);
  2159. tt_int_op(0, OP_EQ, ed25519_sign(&manual_sig, (uint8_t *)prefixed_msg,
  2160. strlen(prefixed_msg), &kp1));
  2161. tor_free(prefixed_msg);
  2162. tt_assert(fast_memeq(sig1.sig, manual_sig.sig, sizeof(sig1.sig)));
  2163. /* Test that prefixed checksig verifies it properly. */
  2164. tt_int_op(0, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len,
  2165. "always in the mood",
  2166. &pub1));
  2167. /* Test that checksig with wrong prefix fails. */
  2168. tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len,
  2169. "always in the moo",
  2170. &pub1));
  2171. tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len,
  2172. "always in the moon",
  2173. &pub1));
  2174. tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len,
  2175. "always in the mood!",
  2176. &pub1));
  2177. }
  2178. done:
  2179. ;
  2180. }
  2181. static void
  2182. test_crypto_ed25519_test_vectors(void *arg)
  2183. {
  2184. char *mem_op_hex_tmp=NULL;
  2185. int i;
  2186. struct {
  2187. const char *sk;
  2188. const char *pk;
  2189. const char *sig;
  2190. const char *msg;
  2191. } items[] = {
  2192. /* These test vectors were generated with the "ref" implementation of
  2193. * ed25519 from SUPERCOP-20130419 */
  2194. { "4c6574277320686f706520746865726520617265206e6f206275677320696e20",
  2195. "f3e0e493b30f56e501aeb868fc912fe0c8b76621efca47a78f6d75875193dd87",
  2196. "b5d7fd6fd3adf643647ce1fe87a2931dedd1a4e38e6c662bedd35cdd80bfac51"
  2197. "1b2c7d1ee6bd929ac213014e1a8dc5373854c7b25dbe15ec96bf6c94196fae06",
  2198. "506c6561736520657863757365206d7920667269656e642e2048652069736e2774"
  2199. "204e554c2d7465726d696e617465642e"
  2200. },
  2201. { "74686520696d706c656d656e746174696f6e20776869636820617265206e6f74",
  2202. "407f0025a1e1351a4cb68e92f5c0ebaf66e7aaf93a4006a4d1a66e3ede1cfeac",
  2203. "02884fde1c3c5944d0ecf2d133726fc820c303aae695adceabf3a1e01e95bf28"
  2204. "da88c0966f5265e9c6f8edc77b3b96b5c91baec3ca993ccd21a3f64203600601",
  2205. "506c6561736520657863757365206d7920667269656e642e2048652069736e2774"
  2206. "204e554c2d7465726d696e617465642e"
  2207. },
  2208. { "6578706f73656420627920456e676c697368207465787420617320696e707574",
  2209. "61681cb5fbd69f9bc5a462a21a7ab319011237b940bc781cdc47fcbe327e7706",
  2210. "6a127d0414de7510125d4bc214994ffb9b8857a46330832d05d1355e882344ad"
  2211. "f4137e3ca1f13eb9cc75c887ef2309b98c57528b4acd9f6376c6898889603209",
  2212. "506c6561736520657863757365206d7920667269656e642e2048652069736e2774"
  2213. "204e554c2d7465726d696e617465642e"
  2214. },
  2215. /* These come from "sign.input" in ed25519's page */
  2216. { "5b5a619f8ce1c66d7ce26e5a2ae7b0c04febcd346d286c929e19d0d5973bfef9",
  2217. "6fe83693d011d111131c4f3fbaaa40a9d3d76b30012ff73bb0e39ec27ab18257",
  2218. "0f9ad9793033a2fa06614b277d37381e6d94f65ac2a5a94558d09ed6ce922258"
  2219. "c1a567952e863ac94297aec3c0d0c8ddf71084e504860bb6ba27449b55adc40e",
  2220. "5a8d9d0a22357e6655f9c785"
  2221. },
  2222. { "940c89fe40a81dafbdb2416d14ae469119869744410c3303bfaa0241dac57800",
  2223. "a2eb8c0501e30bae0cf842d2bde8dec7386f6b7fc3981b8c57c9792bb94cf2dd",
  2224. "d8bb64aad8c9955a115a793addd24f7f2b077648714f49c4694ec995b330d09d"
  2225. "640df310f447fd7b6cb5c14f9fe9f490bcf8cfadbfd2169c8ac20d3b8af49a0c",
  2226. "b87d3813e03f58cf19fd0b6395"
  2227. },
  2228. { "9acad959d216212d789a119252ebfe0c96512a23c73bd9f3b202292d6916a738",
  2229. "cf3af898467a5b7a52d33d53bc037e2642a8da996903fc252217e9c033e2f291",
  2230. "6ee3fe81e23c60eb2312b2006b3b25e6838e02106623f844c44edb8dafd66ab0"
  2231. "671087fd195df5b8f58a1d6e52af42908053d55c7321010092748795ef94cf06",
  2232. "55c7fa434f5ed8cdec2b7aeac173",
  2233. },
  2234. { "d5aeee41eeb0e9d1bf8337f939587ebe296161e6bf5209f591ec939e1440c300",
  2235. "fd2a565723163e29f53c9de3d5e8fbe36a7ab66e1439ec4eae9c0a604af291a5",
  2236. "f68d04847e5b249737899c014d31c805c5007a62c0a10d50bb1538c5f3550395"
  2237. "1fbc1e08682f2cc0c92efe8f4985dec61dcbd54d4b94a22547d24451271c8b00",
  2238. "0a688e79be24f866286d4646b5d81c"
  2239. },
  2240. /* These come from draft-irtf-cfrg-eddsa-05 section 7.1 */
  2241. {
  2242. "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",
  2243. "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
  2244. "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e06522490155"
  2245. "5fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b",
  2246. ""
  2247. },
  2248. {
  2249. "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb",
  2250. "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",
  2251. "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da"
  2252. "085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00",
  2253. "72"
  2254. },
  2255. {
  2256. "f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5",
  2257. "278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e",
  2258. "0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350"
  2259. "aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03",
  2260. "08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98"
  2261. "fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d8"
  2262. "79de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d"
  2263. "658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc"
  2264. "1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4fe"
  2265. "ba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e"
  2266. "06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbef"
  2267. "efd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7"
  2268. "aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed1"
  2269. "85ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2"
  2270. "d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24"
  2271. "554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f270"
  2272. "88d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc"
  2273. "2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b07"
  2274. "07e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128ba"
  2275. "b27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51a"
  2276. "ddd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429e"
  2277. "c96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb7"
  2278. "51fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c"
  2279. "42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8"
  2280. "ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34df"
  2281. "f7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08"
  2282. "d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649"
  2283. "de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e4"
  2284. "88acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a3"
  2285. "2ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e"
  2286. "6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5f"
  2287. "b93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b5"
  2288. "0d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1"
  2289. "369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380d"
  2290. "b2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c"
  2291. "0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0"
  2292. },
  2293. {
  2294. "833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42",
  2295. "ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf",
  2296. "dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b589"
  2297. "09351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704",
  2298. "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a"
  2299. "2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f"
  2300. },
  2301. { NULL, NULL, NULL, NULL}
  2302. };
  2303. (void)arg;
  2304. for (i = 0; items[i].pk; ++i) {
  2305. ed25519_keypair_t kp;
  2306. ed25519_signature_t sig;
  2307. uint8_t sk_seed[32];
  2308. uint8_t *msg;
  2309. size_t msg_len;
  2310. base16_decode((char*)sk_seed, sizeof(sk_seed),
  2311. items[i].sk, 64);
  2312. ed25519_secret_key_from_seed(&kp.seckey, sk_seed);
  2313. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&kp.pubkey, &kp.seckey));
  2314. test_memeq_hex(kp.pubkey.pubkey, items[i].pk);
  2315. msg_len = strlen(items[i].msg) / 2;
  2316. msg = tor_malloc(msg_len);
  2317. base16_decode((char*)msg, msg_len, items[i].msg, strlen(items[i].msg));
  2318. tt_int_op(0, OP_EQ, ed25519_sign(&sig, msg, msg_len, &kp));
  2319. test_memeq_hex(sig.sig, items[i].sig);
  2320. tor_free(msg);
  2321. }
  2322. done:
  2323. tor_free(mem_op_hex_tmp);
  2324. }
  2325. static void
  2326. test_crypto_ed25519_encode(void *arg)
  2327. {
  2328. char buf[ED25519_SIG_BASE64_LEN+1];
  2329. ed25519_keypair_t kp;
  2330. ed25519_public_key_t pk;
  2331. ed25519_signature_t sig1, sig2;
  2332. char *mem_op_hex_tmp = NULL;
  2333. (void) arg;
  2334. /* Test roundtrip. */
  2335. tt_int_op(0, OP_EQ, ed25519_keypair_generate(&kp, 0));
  2336. tt_int_op(0, OP_EQ, ed25519_public_to_base64(buf, &kp.pubkey));
  2337. tt_int_op(ED25519_BASE64_LEN, OP_EQ, strlen(buf));
  2338. tt_int_op(0, OP_EQ, ed25519_public_from_base64(&pk, buf));
  2339. tt_mem_op(kp.pubkey.pubkey, OP_EQ, pk.pubkey, ED25519_PUBKEY_LEN);
  2340. tt_int_op(0, OP_EQ, ed25519_sign(&sig1, (const uint8_t*)"ABC", 3, &kp));
  2341. tt_int_op(0, OP_EQ, ed25519_signature_to_base64(buf, &sig1));
  2342. tt_int_op(0, OP_EQ, ed25519_signature_from_base64(&sig2, buf));
  2343. tt_mem_op(sig1.sig, OP_EQ, sig2.sig, ED25519_SIG_LEN);
  2344. /* Test known value. */
  2345. tt_int_op(0, OP_EQ, ed25519_public_from_base64(&pk,
  2346. "lVIuIctLjbGZGU5wKMNXxXlSE3cW4kaqkqm04u6pxvM"));
  2347. test_memeq_hex(pk.pubkey,
  2348. "95522e21cb4b8db199194e7028c357c57952137716e246aa92a9b4e2eea9c6f3");
  2349. done:
  2350. tor_free(mem_op_hex_tmp);
  2351. }
  2352. static void
  2353. test_crypto_ed25519_convert(void *arg)
  2354. {
  2355. const uint8_t msg[] =
  2356. "The eyes are not here / There are no eyes here.";
  2357. const int N = 30;
  2358. int i;
  2359. (void)arg;
  2360. for (i = 0; i < N; ++i) {
  2361. curve25519_keypair_t curve25519_keypair;
  2362. ed25519_keypair_t ed25519_keypair;
  2363. ed25519_public_key_t ed25519_pubkey;
  2364. int bit=0;
  2365. ed25519_signature_t sig;
  2366. tt_int_op(0,OP_EQ,curve25519_keypair_generate(&curve25519_keypair, i&1));
  2367. tt_int_op(0,OP_EQ,ed25519_keypair_from_curve25519_keypair(
  2368. &ed25519_keypair, &bit, &curve25519_keypair));
  2369. tt_int_op(0,OP_EQ,ed25519_public_key_from_curve25519_public_key(
  2370. &ed25519_pubkey, &curve25519_keypair.pubkey, bit));
  2371. tt_mem_op(ed25519_pubkey.pubkey, OP_EQ, ed25519_keypair.pubkey.pubkey, 32);
  2372. tt_int_op(0,OP_EQ,ed25519_sign(&sig, msg, sizeof(msg), &ed25519_keypair));
  2373. tt_int_op(0,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg),
  2374. &ed25519_pubkey));
  2375. tt_int_op(-1,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg)-1,
  2376. &ed25519_pubkey));
  2377. sig.sig[0] ^= 15;
  2378. tt_int_op(-1,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg),
  2379. &ed25519_pubkey));
  2380. }
  2381. done:
  2382. ;
  2383. }
  2384. static void
  2385. test_crypto_ed25519_blinding(void *arg)
  2386. {
  2387. const uint8_t msg[] =
  2388. "Eyes I dare not meet in dreams / In death's dream kingdom";
  2389. const int N = 30;
  2390. int i;
  2391. (void)arg;
  2392. for (i = 0; i < N; ++i) {
  2393. uint8_t blinding[32];
  2394. ed25519_keypair_t ed25519_keypair;
  2395. ed25519_keypair_t ed25519_keypair_blinded;
  2396. ed25519_public_key_t ed25519_pubkey_blinded;
  2397. ed25519_signature_t sig;
  2398. crypto_rand((char*) blinding, sizeof(blinding));
  2399. tt_int_op(0,OP_EQ,ed25519_keypair_generate(&ed25519_keypair, 0));
  2400. tt_int_op(0,OP_EQ,ed25519_keypair_blind(&ed25519_keypair_blinded,
  2401. &ed25519_keypair, blinding));
  2402. tt_int_op(0,OP_EQ,ed25519_public_blind(&ed25519_pubkey_blinded,
  2403. &ed25519_keypair.pubkey, blinding));
  2404. tt_mem_op(ed25519_pubkey_blinded.pubkey, OP_EQ,
  2405. ed25519_keypair_blinded.pubkey.pubkey, 32);
  2406. tt_int_op(0,OP_EQ,ed25519_sign(&sig, msg, sizeof(msg),
  2407. &ed25519_keypair_blinded));
  2408. tt_int_op(0,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg),
  2409. &ed25519_pubkey_blinded));
  2410. tt_int_op(-1,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg)-1,
  2411. &ed25519_pubkey_blinded));
  2412. sig.sig[0] ^= 15;
  2413. tt_int_op(-1,OP_EQ,ed25519_checksig(&sig, msg, sizeof(msg),
  2414. &ed25519_pubkey_blinded));
  2415. }
  2416. done:
  2417. ;
  2418. }
  2419. /** Test that our blinding functions will fail if we pass them bad pubkeys */
  2420. static void
  2421. test_crypto_ed25519_blinding_fail(void *arg)
  2422. {
  2423. int retval;
  2424. uint8_t param[32] = {2};
  2425. ed25519_public_key_t pub;
  2426. ed25519_public_key_t pub_blinded;
  2427. (void)arg;
  2428. /* This point is not on the curve: the blind routines should fail */
  2429. const char badkey[] =
  2430. "e19c65de75c68cf3b7643ea732ba9eb1a3d20d6d57ba223c2ece1df66feb5af0";
  2431. retval = base16_decode((char*)pub.pubkey, sizeof(pub.pubkey),
  2432. badkey, strlen(badkey));
  2433. tt_int_op(retval, OP_EQ, sizeof(pub.pubkey));
  2434. retval = ed25519_public_blind(&pub_blinded, &pub, param);
  2435. tt_int_op(retval, OP_EQ, -1);
  2436. /* This point is legit: blind routines should be happy */
  2437. const char goodkey[] =
  2438. "4ba2e44760dff4c559ef3c38768c1c14a8a54740c782c8d70803e9d6e3ad8794";
  2439. retval = base16_decode((char*)pub.pubkey, sizeof(pub.pubkey),
  2440. goodkey, strlen(goodkey));
  2441. tt_int_op(retval, OP_EQ, sizeof(pub.pubkey));
  2442. retval = ed25519_public_blind(&pub_blinded, &pub, param);
  2443. tt_int_op(retval, OP_EQ, 0);
  2444. done:
  2445. ;
  2446. }
  2447. static void
  2448. test_crypto_ed25519_testvectors(void *arg)
  2449. {
  2450. unsigned i;
  2451. char *mem_op_hex_tmp = NULL;
  2452. (void)arg;
  2453. for (i = 0; i < ARRAY_LENGTH(ED25519_SECRET_KEYS); ++i) {
  2454. uint8_t sk[32];
  2455. ed25519_secret_key_t esk;
  2456. ed25519_public_key_t pk, blind_pk, pkfromcurve;
  2457. ed25519_keypair_t keypair, blind_keypair;
  2458. curve25519_keypair_t curvekp;
  2459. uint8_t blinding_param[32];
  2460. ed25519_signature_t sig;
  2461. int sign;
  2462. memset(&curvekp, 0xd0, sizeof(curvekp));
  2463. #define DECODE(p,s) base16_decode((char*)(p),sizeof(p),(s),strlen(s))
  2464. #define EQ(a,h) test_memeq_hex((const char*)(a), (h))
  2465. tt_int_op(sizeof(sk), OP_EQ, DECODE(sk, ED25519_SECRET_KEYS[i]));
  2466. tt_int_op(sizeof(blinding_param), OP_EQ, DECODE(blinding_param,
  2467. ED25519_BLINDING_PARAMS[i]));
  2468. tt_int_op(0, OP_EQ, ed25519_secret_key_from_seed(&esk, sk));
  2469. EQ(esk.seckey, ED25519_EXPANDED_SECRET_KEYS[i]);
  2470. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pk, &esk));
  2471. EQ(pk.pubkey, ED25519_PUBLIC_KEYS[i]);
  2472. memcpy(&curvekp.seckey.secret_key, esk.seckey, 32);
  2473. curve25519_public_key_generate(&curvekp.pubkey, &curvekp.seckey);
  2474. tt_int_op(0, OP_EQ,
  2475. ed25519_keypair_from_curve25519_keypair(&keypair, &sign, &curvekp));
  2476. tt_int_op(0, OP_EQ, ed25519_public_key_from_curve25519_public_key(
  2477. &pkfromcurve, &curvekp.pubkey, sign));
  2478. tt_mem_op(keypair.pubkey.pubkey, OP_EQ, pkfromcurve.pubkey, 32);
  2479. EQ(curvekp.pubkey.public_key, ED25519_CURVE25519_PUBLIC_KEYS[i]);
  2480. /* Self-signing */
  2481. memcpy(&keypair.seckey, &esk, sizeof(esk));
  2482. memcpy(&keypair.pubkey, &pk, sizeof(pk));
  2483. tt_int_op(0, OP_EQ, ed25519_sign(&sig, pk.pubkey, 32, &keypair));
  2484. EQ(sig.sig, ED25519_SELF_SIGNATURES[i]);
  2485. /* Blinding */
  2486. tt_int_op(0, OP_EQ,
  2487. ed25519_keypair_blind(&blind_keypair, &keypair, blinding_param));
  2488. tt_int_op(0, OP_EQ,
  2489. ed25519_public_blind(&blind_pk, &pk, blinding_param));
  2490. EQ(blind_keypair.seckey.seckey, ED25519_BLINDED_SECRET_KEYS[i]);
  2491. EQ(blind_pk.pubkey, ED25519_BLINDED_PUBLIC_KEYS[i]);
  2492. tt_mem_op(blind_pk.pubkey, OP_EQ, blind_keypair.pubkey.pubkey, 32);
  2493. #undef DECODE
  2494. #undef EQ
  2495. }
  2496. done:
  2497. tor_free(mem_op_hex_tmp);
  2498. }
  2499. static void
  2500. test_crypto_ed25519_storage(void *arg)
  2501. {
  2502. (void)arg;
  2503. ed25519_keypair_t *keypair = NULL;
  2504. ed25519_public_key_t pub;
  2505. ed25519_secret_key_t sec;
  2506. char *fname_1 = tor_strdup(get_fname("ed_seckey_1"));
  2507. char *fname_2 = tor_strdup(get_fname("ed_pubkey_2"));
  2508. char *contents = NULL;
  2509. char *tag = NULL;
  2510. keypair = tor_malloc_zero(sizeof(ed25519_keypair_t));
  2511. tt_int_op(0,OP_EQ,ed25519_keypair_generate(keypair, 0));
  2512. tt_int_op(0,OP_EQ,
  2513. ed25519_seckey_write_to_file(&keypair->seckey, fname_1, "foo"));
  2514. tt_int_op(0,OP_EQ,
  2515. ed25519_pubkey_write_to_file(&keypair->pubkey, fname_2, "bar"));
  2516. tt_int_op(-1, OP_EQ, ed25519_pubkey_read_from_file(&pub, &tag, fname_1));
  2517. tt_ptr_op(tag, OP_EQ, NULL);
  2518. tt_int_op(-1, OP_EQ, ed25519_seckey_read_from_file(&sec, &tag, fname_2));
  2519. tt_ptr_op(tag, OP_EQ, NULL);
  2520. tt_int_op(0, OP_EQ, ed25519_pubkey_read_from_file(&pub, &tag, fname_2));
  2521. tt_str_op(tag, OP_EQ, "bar");
  2522. tor_free(tag);
  2523. tt_int_op(0, OP_EQ, ed25519_seckey_read_from_file(&sec, &tag, fname_1));
  2524. tt_str_op(tag, OP_EQ, "foo");
  2525. tor_free(tag);
  2526. /* whitebox test: truncated keys. */
  2527. tt_int_op(0, OP_EQ, do_truncate(fname_1, 40));
  2528. tt_int_op(0, OP_EQ, do_truncate(fname_2, 40));
  2529. tt_int_op(-1, OP_EQ, ed25519_pubkey_read_from_file(&pub, &tag, fname_2));
  2530. tt_ptr_op(tag, OP_EQ, NULL);
  2531. tor_free(tag);
  2532. tt_int_op(-1, OP_EQ, ed25519_seckey_read_from_file(&sec, &tag, fname_1));
  2533. tt_ptr_op(tag, OP_EQ, NULL);
  2534. done:
  2535. tor_free(fname_1);
  2536. tor_free(fname_2);
  2537. tor_free(contents);
  2538. tor_free(tag);
  2539. ed25519_keypair_free(keypair);
  2540. }
  2541. static void
  2542. test_crypto_siphash(void *arg)
  2543. {
  2544. /* From the reference implementation, taking
  2545. k = 00 01 02 ... 0f
  2546. and in = 00; 00 01; 00 01 02; ...
  2547. */
  2548. const uint8_t VECTORS[64][8] =
  2549. {
  2550. { 0x31, 0x0e, 0x0e, 0xdd, 0x47, 0xdb, 0x6f, 0x72, },
  2551. { 0xfd, 0x67, 0xdc, 0x93, 0xc5, 0x39, 0xf8, 0x74, },
  2552. { 0x5a, 0x4f, 0xa9, 0xd9, 0x09, 0x80, 0x6c, 0x0d, },
  2553. { 0x2d, 0x7e, 0xfb, 0xd7, 0x96, 0x66, 0x67, 0x85, },
  2554. { 0xb7, 0x87, 0x71, 0x27, 0xe0, 0x94, 0x27, 0xcf, },
  2555. { 0x8d, 0xa6, 0x99, 0xcd, 0x64, 0x55, 0x76, 0x18, },
  2556. { 0xce, 0xe3, 0xfe, 0x58, 0x6e, 0x46, 0xc9, 0xcb, },
  2557. { 0x37, 0xd1, 0x01, 0x8b, 0xf5, 0x00, 0x02, 0xab, },
  2558. { 0x62, 0x24, 0x93, 0x9a, 0x79, 0xf5, 0xf5, 0x93, },
  2559. { 0xb0, 0xe4, 0xa9, 0x0b, 0xdf, 0x82, 0x00, 0x9e, },
  2560. { 0xf3, 0xb9, 0xdd, 0x94, 0xc5, 0xbb, 0x5d, 0x7a, },
  2561. { 0xa7, 0xad, 0x6b, 0x22, 0x46, 0x2f, 0xb3, 0xf4, },
  2562. { 0xfb, 0xe5, 0x0e, 0x86, 0xbc, 0x8f, 0x1e, 0x75, },
  2563. { 0x90, 0x3d, 0x84, 0xc0, 0x27, 0x56, 0xea, 0x14, },
  2564. { 0xee, 0xf2, 0x7a, 0x8e, 0x90, 0xca, 0x23, 0xf7, },
  2565. { 0xe5, 0x45, 0xbe, 0x49, 0x61, 0xca, 0x29, 0xa1, },
  2566. { 0xdb, 0x9b, 0xc2, 0x57, 0x7f, 0xcc, 0x2a, 0x3f, },
  2567. { 0x94, 0x47, 0xbe, 0x2c, 0xf5, 0xe9, 0x9a, 0x69, },
  2568. { 0x9c, 0xd3, 0x8d, 0x96, 0xf0, 0xb3, 0xc1, 0x4b, },
  2569. { 0xbd, 0x61, 0x79, 0xa7, 0x1d, 0xc9, 0x6d, 0xbb, },
  2570. { 0x98, 0xee, 0xa2, 0x1a, 0xf2, 0x5c, 0xd6, 0xbe, },
  2571. { 0xc7, 0x67, 0x3b, 0x2e, 0xb0, 0xcb, 0xf2, 0xd0, },
  2572. { 0x88, 0x3e, 0xa3, 0xe3, 0x95, 0x67, 0x53, 0x93, },
  2573. { 0xc8, 0xce, 0x5c, 0xcd, 0x8c, 0x03, 0x0c, 0xa8, },
  2574. { 0x94, 0xaf, 0x49, 0xf6, 0xc6, 0x50, 0xad, 0xb8, },
  2575. { 0xea, 0xb8, 0x85, 0x8a, 0xde, 0x92, 0xe1, 0xbc, },
  2576. { 0xf3, 0x15, 0xbb, 0x5b, 0xb8, 0x35, 0xd8, 0x17, },
  2577. { 0xad, 0xcf, 0x6b, 0x07, 0x63, 0x61, 0x2e, 0x2f, },
  2578. { 0xa5, 0xc9, 0x1d, 0xa7, 0xac, 0xaa, 0x4d, 0xde, },
  2579. { 0x71, 0x65, 0x95, 0x87, 0x66, 0x50, 0xa2, 0xa6, },
  2580. { 0x28, 0xef, 0x49, 0x5c, 0x53, 0xa3, 0x87, 0xad, },
  2581. { 0x42, 0xc3, 0x41, 0xd8, 0xfa, 0x92, 0xd8, 0x32, },
  2582. { 0xce, 0x7c, 0xf2, 0x72, 0x2f, 0x51, 0x27, 0x71, },
  2583. { 0xe3, 0x78, 0x59, 0xf9, 0x46, 0x23, 0xf3, 0xa7, },
  2584. { 0x38, 0x12, 0x05, 0xbb, 0x1a, 0xb0, 0xe0, 0x12, },
  2585. { 0xae, 0x97, 0xa1, 0x0f, 0xd4, 0x34, 0xe0, 0x15, },
  2586. { 0xb4, 0xa3, 0x15, 0x08, 0xbe, 0xff, 0x4d, 0x31, },
  2587. { 0x81, 0x39, 0x62, 0x29, 0xf0, 0x90, 0x79, 0x02, },
  2588. { 0x4d, 0x0c, 0xf4, 0x9e, 0xe5, 0xd4, 0xdc, 0xca, },
  2589. { 0x5c, 0x73, 0x33, 0x6a, 0x76, 0xd8, 0xbf, 0x9a, },
  2590. { 0xd0, 0xa7, 0x04, 0x53, 0x6b, 0xa9, 0x3e, 0x0e, },
  2591. { 0x92, 0x59, 0x58, 0xfc, 0xd6, 0x42, 0x0c, 0xad, },
  2592. { 0xa9, 0x15, 0xc2, 0x9b, 0xc8, 0x06, 0x73, 0x18, },
  2593. { 0x95, 0x2b, 0x79, 0xf3, 0xbc, 0x0a, 0xa6, 0xd4, },
  2594. { 0xf2, 0x1d, 0xf2, 0xe4, 0x1d, 0x45, 0x35, 0xf9, },
  2595. { 0x87, 0x57, 0x75, 0x19, 0x04, 0x8f, 0x53, 0xa9, },
  2596. { 0x10, 0xa5, 0x6c, 0xf5, 0xdf, 0xcd, 0x9a, 0xdb, },
  2597. { 0xeb, 0x75, 0x09, 0x5c, 0xcd, 0x98, 0x6c, 0xd0, },
  2598. { 0x51, 0xa9, 0xcb, 0x9e, 0xcb, 0xa3, 0x12, 0xe6, },
  2599. { 0x96, 0xaf, 0xad, 0xfc, 0x2c, 0xe6, 0x66, 0xc7, },
  2600. { 0x72, 0xfe, 0x52, 0x97, 0x5a, 0x43, 0x64, 0xee, },
  2601. { 0x5a, 0x16, 0x45, 0xb2, 0x76, 0xd5, 0x92, 0xa1, },
  2602. { 0xb2, 0x74, 0xcb, 0x8e, 0xbf, 0x87, 0x87, 0x0a, },
  2603. { 0x6f, 0x9b, 0xb4, 0x20, 0x3d, 0xe7, 0xb3, 0x81, },
  2604. { 0xea, 0xec, 0xb2, 0xa3, 0x0b, 0x22, 0xa8, 0x7f, },
  2605. { 0x99, 0x24, 0xa4, 0x3c, 0xc1, 0x31, 0x57, 0x24, },
  2606. { 0xbd, 0x83, 0x8d, 0x3a, 0xaf, 0xbf, 0x8d, 0xb7, },
  2607. { 0x0b, 0x1a, 0x2a, 0x32, 0x65, 0xd5, 0x1a, 0xea, },
  2608. { 0x13, 0x50, 0x79, 0xa3, 0x23, 0x1c, 0xe6, 0x60, },
  2609. { 0x93, 0x2b, 0x28, 0x46, 0xe4, 0xd7, 0x06, 0x66, },
  2610. { 0xe1, 0x91, 0x5f, 0x5c, 0xb1, 0xec, 0xa4, 0x6c, },
  2611. { 0xf3, 0x25, 0x96, 0x5c, 0xa1, 0x6d, 0x62, 0x9f, },
  2612. { 0x57, 0x5f, 0xf2, 0x8e, 0x60, 0x38, 0x1b, 0xe5, },
  2613. { 0x72, 0x45, 0x06, 0xeb, 0x4c, 0x32, 0x8a, 0x95, }
  2614. };
  2615. const struct sipkey K = { UINT64_C(0x0706050403020100),
  2616. UINT64_C(0x0f0e0d0c0b0a0908) };
  2617. uint8_t input[64];
  2618. int i, j;
  2619. (void)arg;
  2620. for (i = 0; i < 64; ++i)
  2621. input[i] = i;
  2622. for (i = 0; i < 64; ++i) {
  2623. uint64_t r = siphash24(input, i, &K);
  2624. for (j = 0; j < 8; ++j) {
  2625. tt_int_op( (r >> (j*8)) & 0xff, OP_EQ, VECTORS[i][j]);
  2626. }
  2627. }
  2628. done:
  2629. ;
  2630. }
  2631. /* We want the likelihood that the random buffer exhibits any regular pattern
  2632. * to be far less than the memory bit error rate in the int return value.
  2633. * Using 2048 bits provides a failure rate of 1/(3 * 10^616), and we call
  2634. * 3 functions, leading to an overall error rate of 1/10^616.
  2635. * This is comparable with the 1/10^603 failure rate of test_crypto_rng_range.
  2636. */
  2637. #define FAILURE_MODE_BUFFER_SIZE (2048/8)
  2638. /** Check crypto_rand for a failure mode where it does nothing to the buffer,
  2639. * or it sets the buffer to all zeroes. Return 0 when the check passes,
  2640. * or -1 when it fails. */
  2641. static int
  2642. crypto_rand_check_failure_mode_zero(void)
  2643. {
  2644. char buf[FAILURE_MODE_BUFFER_SIZE];
  2645. memset(buf, 0, FAILURE_MODE_BUFFER_SIZE);
  2646. crypto_rand(buf, FAILURE_MODE_BUFFER_SIZE);
  2647. for (size_t i = 0; i < FAILURE_MODE_BUFFER_SIZE; i++) {
  2648. if (buf[i] != 0) {
  2649. return 0;
  2650. }
  2651. }
  2652. return -1;
  2653. }
  2654. /** Check crypto_rand for a failure mode where every int64_t in the buffer is
  2655. * the same. Return 0 when the check passes, or -1 when it fails. */
  2656. static int
  2657. crypto_rand_check_failure_mode_identical(void)
  2658. {
  2659. /* just in case the buffer size isn't a multiple of sizeof(int64_t) */
  2660. #define FAILURE_MODE_BUFFER_SIZE_I64 \
  2661. (FAILURE_MODE_BUFFER_SIZE/8)
  2662. #define FAILURE_MODE_BUFFER_SIZE_I64_BYTES \
  2663. (FAILURE_MODE_BUFFER_SIZE_I64*8)
  2664. #if FAILURE_MODE_BUFFER_SIZE_I64 < 2
  2665. #error FAILURE_MODE_BUFFER_SIZE needs to be at least 2*8
  2666. #endif
  2667. int64_t buf[FAILURE_MODE_BUFFER_SIZE_I64];
  2668. memset(buf, 0, FAILURE_MODE_BUFFER_SIZE_I64_BYTES);
  2669. crypto_rand((char *)buf, FAILURE_MODE_BUFFER_SIZE_I64_BYTES);
  2670. for (size_t i = 1; i < FAILURE_MODE_BUFFER_SIZE_I64; i++) {
  2671. if (buf[i] != buf[i-1]) {
  2672. return 0;
  2673. }
  2674. }
  2675. return -1;
  2676. }
  2677. /** Check crypto_rand for a failure mode where it increments the "random"
  2678. * value by 1 for every byte in the buffer. (This is OpenSSL's PREDICT mode.)
  2679. * Return 0 when the check passes, or -1 when it fails. */
  2680. static int
  2681. crypto_rand_check_failure_mode_predict(void)
  2682. {
  2683. unsigned char buf[FAILURE_MODE_BUFFER_SIZE];
  2684. memset(buf, 0, FAILURE_MODE_BUFFER_SIZE);
  2685. crypto_rand((char *)buf, FAILURE_MODE_BUFFER_SIZE);
  2686. for (size_t i = 1; i < FAILURE_MODE_BUFFER_SIZE; i++) {
  2687. /* check if the last byte was incremented by 1, including integer
  2688. * wrapping */
  2689. if (buf[i] - buf[i-1] != 1 && buf[i-1] - buf[i] != 255) {
  2690. return 0;
  2691. }
  2692. }
  2693. return -1;
  2694. }
  2695. #undef FAILURE_MODE_BUFFER_SIZE
  2696. /** Test that our ed25519 validation function rejects evil public keys and
  2697. * accepts good ones. */
  2698. static void
  2699. test_crypto_ed25519_validation(void *arg)
  2700. {
  2701. (void) arg;
  2702. int retval;
  2703. ed25519_public_key_t pub1;
  2704. /* See https://lists.torproject.org/pipermail/tor-dev/2017-April/012230.html
  2705. for a list of points with torsion components in ed25519. */
  2706. { /* Point with torsion component (order 8l) */
  2707. const char badkey[] =
  2708. "300ef2e64e588e1df55b48e4da0416ffb64cc85d5b00af6463d5cc6c2b1c185e";
  2709. retval = base16_decode((char*)pub1.pubkey, sizeof(pub1.pubkey),
  2710. badkey, strlen(badkey));
  2711. tt_int_op(retval, OP_EQ, sizeof(pub1.pubkey));
  2712. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, -1);
  2713. }
  2714. { /* Point with torsion component (order 4l) */
  2715. const char badkey[] =
  2716. "f43e3a046db8749164c6e69b193f1e942c7452e7d888736f40b98093d814d5e7";
  2717. retval = base16_decode((char*)pub1.pubkey, sizeof(pub1.pubkey),
  2718. badkey, strlen(badkey));
  2719. tt_int_op(retval, OP_EQ, sizeof(pub1.pubkey));
  2720. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, -1);
  2721. }
  2722. { /* Point with torsion component (order 2l) */
  2723. const char badkey[] =
  2724. "c9fff3af0471c28e33e98c2043e44f779d0427b1e37c521a6bddc011ed1869af";
  2725. retval = base16_decode((char*)pub1.pubkey, sizeof(pub1.pubkey),
  2726. badkey, strlen(badkey));
  2727. tt_int_op(retval, OP_EQ, sizeof(pub1.pubkey));
  2728. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, -1);
  2729. }
  2730. { /* This point is not even on the curve */
  2731. const char badkey[] =
  2732. "e19c65de75c68cf3b7643ea732ba9eb1a3d20d6d57ba223c2ece1df66feb5af0";
  2733. retval = base16_decode((char*)pub1.pubkey, sizeof(pub1.pubkey),
  2734. badkey, strlen(badkey));
  2735. tt_int_op(retval, OP_EQ, sizeof(pub1.pubkey));
  2736. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, -1);
  2737. }
  2738. { /* This one is a good key */
  2739. const char goodkey[] =
  2740. "4ba2e44760dff4c559ef3c38768c1c14a8a54740c782c8d70803e9d6e3ad8794";
  2741. retval = base16_decode((char*)pub1.pubkey, sizeof(pub1.pubkey),
  2742. goodkey, strlen(goodkey));
  2743. tt_int_op(retval, OP_EQ, sizeof(pub1.pubkey));
  2744. tt_int_op(ed25519_validate_pubkey(&pub1), OP_EQ, 0);
  2745. }
  2746. done: ;
  2747. }
  2748. static void
  2749. test_crypto_failure_modes(void *arg)
  2750. {
  2751. int rv = 0;
  2752. (void)arg;
  2753. rv = crypto_early_init();
  2754. tt_int_op(rv, OP_EQ, 0);
  2755. /* Check random works */
  2756. rv = crypto_rand_check_failure_mode_zero();
  2757. tt_int_op(rv, OP_EQ, 0);
  2758. rv = crypto_rand_check_failure_mode_identical();
  2759. tt_int_op(rv, OP_EQ, 0);
  2760. rv = crypto_rand_check_failure_mode_predict();
  2761. tt_int_op(rv, OP_EQ, 0);
  2762. done:
  2763. ;
  2764. }
  2765. #define CRYPTO_LEGACY(name) \
  2766. { #name, test_crypto_ ## name , 0, NULL, NULL }
  2767. #define ED25519_TEST_ONE(name, fl, which) \
  2768. { #name "/ed25519_" which, test_crypto_ed25519_ ## name, (fl), \
  2769. &ed25519_test_setup, (void*)which }
  2770. #define ED25519_TEST(name, fl) \
  2771. ED25519_TEST_ONE(name, (fl), "donna"), \
  2772. ED25519_TEST_ONE(name, (fl), "ref10")
  2773. struct testcase_t crypto_tests[] = {
  2774. CRYPTO_LEGACY(formats),
  2775. CRYPTO_LEGACY(rng),
  2776. { "rng_range", test_crypto_rng_range, 0, NULL, NULL },
  2777. { "rng_strongest", test_crypto_rng_strongest, TT_FORK, NULL, NULL },
  2778. { "rng_strongest_nosyscall", test_crypto_rng_strongest, TT_FORK,
  2779. &passthrough_setup, (void*)"nosyscall" },
  2780. { "rng_strongest_nofallback", test_crypto_rng_strongest, TT_FORK,
  2781. &passthrough_setup, (void*)"nofallback" },
  2782. { "rng_strongest_broken", test_crypto_rng_strongest, TT_FORK,
  2783. &passthrough_setup, (void*)"broken" },
  2784. { "openssl_version", test_crypto_openssl_version, TT_FORK, NULL, NULL },
  2785. { "aes_AES", test_crypto_aes128, TT_FORK, &passthrough_setup, (void*)"aes" },
  2786. { "aes_EVP", test_crypto_aes128, TT_FORK, &passthrough_setup, (void*)"evp" },
  2787. { "aes128_ctr_testvec", test_crypto_aes_ctr_testvec, 0,
  2788. &passthrough_setup, (void*)"128" },
  2789. { "aes192_ctr_testvec", test_crypto_aes_ctr_testvec, 0,
  2790. &passthrough_setup, (void*)"192" },
  2791. { "aes256_ctr_testvec", test_crypto_aes_ctr_testvec, 0,
  2792. &passthrough_setup, (void*)"256" },
  2793. CRYPTO_LEGACY(sha),
  2794. CRYPTO_LEGACY(pk),
  2795. { "pk_fingerprints", test_crypto_pk_fingerprints, TT_FORK, NULL, NULL },
  2796. { "pk_base64", test_crypto_pk_base64, TT_FORK, NULL, NULL },
  2797. { "pk_pem_encrypted", test_crypto_pk_pem_encrypted, TT_FORK, NULL, NULL },
  2798. { "pk_invalid_private_key", test_crypto_pk_invalid_private_key, 0,
  2799. NULL, NULL },
  2800. CRYPTO_LEGACY(digests),
  2801. { "digest_names", test_crypto_digest_names, 0, NULL, NULL },
  2802. { "sha3", test_crypto_sha3, TT_FORK, NULL, NULL},
  2803. { "sha3_xof", test_crypto_sha3_xof, TT_FORK, NULL, NULL},
  2804. { "mac_sha3", test_crypto_mac_sha3, TT_FORK, NULL, NULL},
  2805. CRYPTO_LEGACY(dh),
  2806. { "aes_iv_AES", test_crypto_aes_iv, TT_FORK, &passthrough_setup,
  2807. (void*)"aes" },
  2808. { "aes_iv_EVP", test_crypto_aes_iv, TT_FORK, &passthrough_setup,
  2809. (void*)"evp" },
  2810. CRYPTO_LEGACY(base32_decode),
  2811. { "kdf_TAP", test_crypto_kdf_TAP, 0, NULL, NULL },
  2812. { "hkdf_sha256", test_crypto_hkdf_sha256, 0, NULL, NULL },
  2813. { "hkdf_sha256_testvecs", test_crypto_hkdf_sha256_testvecs, 0, NULL, NULL },
  2814. { "curve25519_impl", test_crypto_curve25519_impl, 0, NULL, NULL },
  2815. { "curve25519_impl_hibit", test_crypto_curve25519_impl, 0, NULL, (void*)"y"},
  2816. { "curve25516_testvec", test_crypto_curve25519_testvec, 0, NULL, NULL },
  2817. { "curve25519_basepoint",
  2818. test_crypto_curve25519_basepoint, TT_FORK, NULL, NULL },
  2819. { "curve25519_wrappers", test_crypto_curve25519_wrappers, 0, NULL, NULL },
  2820. { "curve25519_encode", test_crypto_curve25519_encode, 0, NULL, NULL },
  2821. { "curve25519_persist", test_crypto_curve25519_persist, 0, NULL, NULL },
  2822. ED25519_TEST(simple, 0),
  2823. ED25519_TEST(test_vectors, 0),
  2824. ED25519_TEST(encode, 0),
  2825. ED25519_TEST(convert, 0),
  2826. ED25519_TEST(blinding, 0),
  2827. ED25519_TEST(blinding_fail, 0),
  2828. ED25519_TEST(testvectors, 0),
  2829. ED25519_TEST(validation, 0),
  2830. { "ed25519_storage", test_crypto_ed25519_storage, 0, NULL, NULL },
  2831. { "siphash", test_crypto_siphash, 0, NULL, NULL },
  2832. { "failure_modes", test_crypto_failure_modes, TT_FORK, NULL, NULL },
  2833. END_OF_TESTCASES
  2834. };