From 4f2fd9c23cc37114184ecf77fd8d5cdcccabc2f9 Mon Sep 17 00:00:00 2001 From: David Garske Date: Thu, 25 Jun 2026 11:26:17 -0700 Subject: [PATCH] test/benchmark/ci: CHAR_BIT != 8 test vectors, NO_MALLOC benchmark, TI C2000 compile CI and docs --- .github/workflows/ti-c2000-compile.yml | 107 ++++++++++++ .wolfssl_known_macro_extras | 7 + IDE/C2000/README.md | 100 ++++++++++++ IDE/C2000/compile.sh | 68 ++++++++ IDE/C2000/user_settings.h | 111 +++++++++++++ IDE/include.am | 1 + wolfcrypt/benchmark/benchmark.c | 32 +++- wolfcrypt/test/test.c | 216 ++++++++++++++----------- 8 files changed, 546 insertions(+), 96 deletions(-) create mode 100644 .github/workflows/ti-c2000-compile.yml create mode 100644 IDE/C2000/README.md create mode 100755 IDE/C2000/compile.sh create mode 100644 IDE/C2000/user_settings.h diff --git a/.github/workflows/ti-c2000-compile.yml b/.github/workflows/ti-c2000-compile.yml new file mode 100644 index 0000000000..9c01f974dd --- /dev/null +++ b/.github/workflows/ti-c2000-compile.yml @@ -0,0 +1,107 @@ +name: TI C2000 (C28x) compile-only + +# Compile-guard for the TI C2000 C28x port (CHAR_BIT == 16). It builds the +# wolfCrypt subset that carries the CHAR_BIT != 8 gated fixes with the TI cl2000 +# code generation tools - no linking, no C2000Ware, no hardware. Purpose: catch +# compile regressions in the octet/SP/ML-DSA gated paths. On-target run-tests +# live on a hardware-in-the-loop runner (there is no public C28x simulator). + +# START OF COMMON SECTION +on: + # Only build when something that can affect the C28x compile changes, so the + # job (and the CGT it pulls) does not burn runner minutes on unrelated PRs. + push: + branches: [ 'master', 'main', 'release/**' ] + paths: + - 'wolfcrypt/src/**' + - 'wolfssl/wolfcrypt/**' + - 'IDE/C2000/**' + - '.github/workflows/ti-c2000-compile.yml' + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + branches: [ '*' ] + paths: + - 'wolfcrypt/src/**' + - 'wolfssl/wolfcrypt/**' + - 'IDE/C2000/**' + - '.github/workflows/ti-c2000-compile.yml' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true +# END OF COMMON SECTION + +jobs: + ti_c2000_compile: + name: cl2000 compile-only + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} + runs-on: ubuntu-22.04 + timeout-minutes: 20 + env: + # TI C2000 code generation tools (cl2000). TI now gates the CGT download + # behind a login (login.ti.com), so there is no stable public direct URL. + # Mirror the installer - ti_cgt_c2000__linux-x64_installer.bin - to a + # location CI can fetch (a wolfSSL release asset or internal server) and + # set the repo/org variable TI_C2000_CGT_URL to it (optionally + # TI_C2000_CGT_SHA256 to pin its hash). When TI_C2000_CGT_URL is unset the + # compile-only guard is skipped and the job succeeds with a notice, so the + # gate never blocks a PR on this external dependency. + CGT_VER: "22.6.2.LTS" + CGT_URL: "${{ vars.TI_C2000_CGT_URL }}" + CGT_SHA256: "${{ vars.TI_C2000_CGT_SHA256 }}" + CGT_DIR: "${{ github.workspace }}/ti-cgt-c2000" + steps: + - uses: actions/checkout@v4 + name: Checkout wolfSSL + + - name: Check CGT source is configured + id: gate + run: | + if [ -z "$CGT_URL" ]; then + echo "::notice::TI_C2000_CGT_URL repo variable is not set - skipping the C2000 cl2000 compile-only guard. TI gates the CGT download behind a login; mirror the installer and set TI_C2000_CGT_URL (and optionally TI_C2000_CGT_SHA256) to enable this job." + echo "skip=true" >> "$GITHUB_OUTPUT" + else + echo "skip=false" >> "$GITHUB_OUTPUT" + fi + + - name: Cache TI C2000 CGT + if: steps.gate.outputs.skip != 'true' + id: cgt-cache + uses: actions/cache@v4 + with: + path: ${{ env.CGT_DIR }} + key: ti-cgt-c2000-${{ env.CGT_VER }} + + - name: Download + install TI C2000 CGT + if: steps.gate.outputs.skip != 'true' && steps.cgt-cache.outputs.cache-hit != 'true' + run: | + set -e + curl -fSL "$CGT_URL" -o /tmp/cgt.bin + # A gated/expired link answers with an HTML login or 404 page (often + # HTTP 200), which would be saved as a bogus "installer"; reject it. + if head -c 512 /tmp/cgt.bin | grep -qiE '> "$GITHUB_OUTPUT" + + - name: Compile-only guard + if: steps.gate.outputs.skip != 'true' + run: | + CGT_ROOT="${{ steps.find-cl.outputs.cgt_root }}" \ + IDE/C2000/compile.sh diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 6452f64e8e..101f963d61 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -849,6 +849,7 @@ WOLFSSL_CLIENT_EXAMPLE WOLFSSL_CONTIKI WOLFSSL_CRL_ALLOW_MISSING_CDP WOLFSSL_DEBUG_TRACE_ERROR_CODES_SUPPORT +WOLFSSL_DILITHIUM_VERIFY_SMALLEST_MEM WOLFSSL_DISABLE_EARLY_SANITY_CHECKS WOLFSSL_DRBG_SHA256 WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID @@ -1262,6 +1263,12 @@ __SUNPRO_CC __SVR4 __TASKING__ __TI_COMPILER_VERSION__ +__TMS320C2000__ +__TMS320C2800__ +__TMS320C28XX__ +__TMS320C54X__ +__TMS320C5500__ +__TMS320C55X__ __TURBOC__ __UNIX__ __USE_GNU diff --git a/IDE/C2000/README.md b/IDE/C2000/README.md new file mode 100644 index 0000000000..f92a62bb50 --- /dev/null +++ b/IDE/C2000/README.md @@ -0,0 +1,100 @@ +# TI C2000 C28x (CHAR_BIT == 16) support + +wolfCrypt builds and runs on the TI C2000 C28x DSP family, a word-addressed +architecture where `CHAR_BIT == 16` (a C `char`/`unsigned char` is 16 bits and +is the smallest addressable unit). Support is gated behind `WOLFSSL_WIDE_BYTE`, +which `wolfssl/wolfcrypt/types.h` auto-enables when `CHAR_BIT != 8` or a known +16-bit-char TI toolchain macro is seen (`__TMS320C28XX__`, `__TMS320C2000__`, +etc.). On normal 8-bit-byte targets none of this code changes behavior. + +## Validated on hardware (LAUNCHXL-F28P55X, TMS320F28P550SJ, cl2000) + +- SHA-1; SHA-224/256, SHA-384/512, SHA-512/224, SHA-512/256 +- SHA3-224/256/384/512, SHAKE128/256 (split-64 Keccak permutation auto-enabled + for `WOLFSSL_WIDE_BYTE`, ~53% faster than the generic C path) +- ML-DSA-44/65/87 (Dilithium) verify and full keygen/sign/verify; + ML-KEM-512/768/1024 (FIPS 203) +- AES-128/192/256 CBC/CTR/CFB/OFB/GCM/XTS; AES-CMAC, AES-CCM, AES-GMAC, + AES-SIV, AES-EAX +- HMAC + HKDF; ChaCha20-Poly1305; Poly1305 +- X25519 + Ed25519; X448 + Ed448 (CURVE448_SMALL/ED448_SMALL byte backend) +- ECDSA + ECDH (SECP256R1, SP math) +- RSA-2048 PKCS#1 v1.5 sign and verify; DH FFDHE-2048 (SP math) + +The on-target acceptance gate is the per-algorithm KAT set the reference example +prints over JTAG (e.g. `ML-DSA-87 verify KAT: PASS`, `X448 a*Bpub: PASS`); the +split-64 Keccak path is additionally validated on a host build with +`-DWC_SHA3_SPLIT64` forced, and the compile-only CI below guards every +`WOLFSSL_WIDE_BYTE` source against build breakage. + +## What `WOLFSSL_WIDE_BYTE` fixes + +The `CHAR_BIT != 8` work falls into a few recurring classes, each a no-op on +8-bit targets: + +- Byte/word aliasing. Serializing a `word32`/`word64` via a `byte*` cast moves + cells, not octets. Replaced with shift-based octet I/O. Shared helpers live in + `wolfcrypt/src/misc.c`: `WordsFromBytesBE32`/`BytesFromWordsBE32`, + `BytesFromWordsLE32`, the 64-bit variants, and octet-correct + `readUnalignedWord32`/`readUnalignedWord64`. `sp_int.c sp_read_unsigned_bin` + uses the endian-/`CHAR_BIT`-agnostic shift loop for its leftover bytes. +- `(byte)x` not truncating to an octet (it keeps 16 bits). Masked with + `WC_OCTET(x)` = `(byte)((x) & 0xFF)` (types.h). Used across the ML-KEM/ML-DSA + encoders, the SP `*_to_bin` serializers, AES `GETBYTE`, base64, and DRBG. +- Integer-promotion bugs. `1U << n` is 16-bit on C28x (use `1UL`); a bit width + written `sizeof(t) * 8` is wrong when `CHAR_BIT != 8` (use `CHAR_BIT * + sizeof(t)`); a `byte` operand promotes to a 16-bit `int`. +- `sizeof` counting cells, not octets. e.g. `CHACHA_CHUNK_BYTES` is `16 * 4`, + not `16 * sizeof(word32)` (= 32 on C28x, which halves the ChaCha block). + +The SP backend file `wolfcrypt/src/sp_c32.c` is generated; the `& 0xFF` octet +masks added to its `sp_*_to_bin_*` serializers are also applied in the SP +generator templates so a regeneration preserves them (tracked separately). + +## cl2000 compiler workarounds + +TI `cl2000` (C28x) miscompiles a couple of ML-DSA 32-bit reductions on this +16-bit target; both are worked around in `dilithium.h`, defaulted on under +`WC_16BIT_CPU` (correct on every target, no-ops off `WC_16BIT_CPU`): + +- `MLDSA_MUL_QINV_WIDE64` -- `mldsa_mont_red()`'s q^-1 step uses a 32x64->64 + widening multiply instead of 32x32->32. +- `MLDSA_MUL_Q_SLOW` -- `mldsa_red()`/`mldsa_mont_red()`'s `* q` step uses shifts + (`q = 2^23 - 2^13 + 1`) instead of a multiply. At `-O2` cl2000 mis-generates + `mldsa_red()`'s multiply-based Barrett reduction: the reduced value stays + correct (the verify KAT passes) but the emitted code adds a stray store that + corrupts memory a later allocation trips on; the shift form avoids it (a + widening multiply does not). Isolated by pinning single functions to `-O1` + with `#pragma FUNCTION_OPTIONS`. + +With both, ML-DSA builds at full `-O2` on the C28x with no per-file overrides. + +## Enabling on your build + +Define a user-settings header (see `IDE/C2000/user_settings.h` for a +minimal CHAR_BIT!=8 config) and build with `WOLFSSL_USER_SETTINGS`. For the SP +math backend on a 16-bit-int target also set `WOLFSSL_SP_MATH`, +`SP_WORD_SIZE 32`, and `WOLFSSL_SP_ALLOW_16BIT_CPU`. + +## Reference example + +A complete bare-metal example with KATs, benchmark, linker scripts, and per- +algorithm build toggles is in wolfSSL Examples: +`embedded/ti-c2000-f28p55x/` (see its `README.md` for the `make` options: +`ECC`, `MLKEM`, `AES`, `AESEXTRA`, `X25519`, `HKDF`, `CHACHA`, `RSA`, `SIGN`, +`BENCH`). + +Representative throughput on the F28P55X at 150 MHz: SHA-256 ~284 KiB/s; SHA3-256 +~264 KiB/s; SHAKE128 ~319 KiB/s; RNG Hash-DRBG ~122 KiB/s. ML-DSA-87 verify +~225 ms/op in ~10.7 KB RAM (zero heap, with `WOLFSSL_MLDSA_VERIFY_SMALLEST_MEM` ++ `WOLFSSL_MLDSA_ASSIGN_KEY`). + +## Continuous integration + +`IDE/C2000/compile.sh` runs `cl2000 --compile_only` over the +`CHAR_BIT != 8` wolfCrypt subset to guard these paths without hardware; +`.github/workflows/ti-c2000-compile.yml` runs it in CI. TI gates the C2000 +code generation tools behind a login, so the workflow fetches the installer +from the `TI_C2000_CGT_URL` repo/org variable (mirror it to a wolfSSL release +asset or internal server; optionally pin `TI_C2000_CGT_SHA256`). When that +variable is unset the job is skipped with a notice rather than failing. diff --git a/IDE/C2000/compile.sh b/IDE/C2000/compile.sh new file mode 100755 index 0000000000..13de96b92f --- /dev/null +++ b/IDE/C2000/compile.sh @@ -0,0 +1,68 @@ +#!/bin/sh +# compile.sh - compile-only guard for the TI C2000 (C28x, CHAR_BIT==16) port. +# +# Builds the wolfCrypt subset that compiles under CHAR_BIT==16 with the TI cl2000 +# code generation tools, using IDE/C2000/user_settings.h. No linking, no +# C2000Ware, no hardware: this only catches compile regressions in the +# CHAR_BIT != 8 gated code paths (SHA-2/3/SHAKE, ML-DSA-87 verify, SP-ECC). +# +# Usage: +# CGT_ROOT=/path/to/ti-cgt-c2000_xx.y.z IDE/C2000/compile.sh +# +# CGT_ROOT must point at a TI C2000 codegen install (the dir containing +# bin/cl2000). The CGT is a free download from TI; in CI it is fetched/cached +# by .github/workflows/ti-c2000-compile.yml. + +set -e + +: "${CGT_ROOT:?set CGT_ROOT to the ti-cgt-c2000 install (dir with bin/cl2000)}" + +# Repo root = two levels up from this script. +SELF_DIR=$(cd "$(dirname "$0")" && pwd) +WOLFROOT=$(cd "$SELF_DIR/../.." && pwd) +CL="$CGT_ROOT/bin/cl2000" + +if [ ! -x "$CL" ]; then + echo "ERROR: cl2000 not found/executable at $CL" >&2 + exit 2 +fi + +OUT=$(mktemp -d) +trap 'rm -rf "$OUT"' EXIT + +INCS="-I$CGT_ROOT/include -I$WOLFROOT -I$SELF_DIR" +CFLAGS="-v28 --abi=eabi --float_support=fpu32 --tmu_support=tmu1 -O2 \ + --define=WOLFSSL_USER_SETTINGS --display_error_number --diag_warning=225" + +# wolfCrypt sources to compile-guard under CHAR_BIT==16. This is the set that +# carries the CHAR_BIT != 8 gated fixes (plus their direct deps) - the +# regression surface for this port. hash.c (an unmodified dispatch wrapper) is +# intentionally omitted: its wc_OidGetHash() OID switch needs the fuller ASN/OID +# config of a real build to avoid a 16-bit-int case-label fold, and it is +# covered by the on-target example build, not by this minimal guard. +SRCS="error wc_port memory logging misc coding \ + sha sha256 sha512 sha3 wc_mldsa random ecc sp_int sp_c32 \ + aes cmac chacha poly1305 \ + curve25519 ed25519 fe_operations ge_operations \ + curve448 ed448 fe_448 ge_448" + +rc=0 +for s in $SRCS; do + printf 'CC %s.c ... ' "$s" + if "$CL" $CFLAGS $INCS --compile_only --skip_assembler \ + --asm_directory="$OUT" --obj_directory="$OUT" \ + "$WOLFROOT/wolfcrypt/src/$s.c" > "$OUT/$s.log" 2>&1; then + echo "ok" + else + echo "FAIL" + cat "$OUT/$s.log" + rc=1 + fi +done + +if [ "$rc" -eq 0 ]; then + echo "TI C2000 compile-only guard: PASS" +else + echo "TI C2000 compile-only guard: FAIL" >&2 +fi +exit "$rc" diff --git a/IDE/C2000/user_settings.h b/IDE/C2000/user_settings.h new file mode 100644 index 0000000000..01978fcbed --- /dev/null +++ b/IDE/C2000/user_settings.h @@ -0,0 +1,111 @@ +/* user_settings.h - minimal wolfCrypt config for the TI C2000 (C28x, + * CHAR_BIT==16) compile-only CI guard. + * + * This is NOT a board config: it has no BSP/device dependencies. Its only job + * is to enable the wolfCrypt subset that carries the CHAR_BIT != 8 gated code + * (SHA-1/2/3/SHAKE, ML-DSA-87 verify, ECDSA/ECDH P-256 via SP math, AES and its + * modes, ChaCha20-Poly1305, X25519/Ed25519, X448/Ed448) so that + * IDE/C2000/compile.sh can compile them with cl2000 and catch regressions. + * cl2000 predefines __TMS320C28XX__, so types.h auto-enables WOLFSSL_WIDE_BYTE; + * we do not set it here. */ +#ifndef TI_C2000_CI_USER_SETTINGS_H +#define TI_C2000_CI_USER_SETTINGS_H + +#define WOLFCRYPT_ONLY /* crypto only - no TLS (no MD5/SHA1 dep) */ +#define WOLFSSL_GENERAL_ALIGNMENT 2 +#define HAVE_LIMITS_H +#define WOLFSSL_NO_ASM +#define NO_INLINE +#define SINGLE_THREADED +#define NO_FILESYSTEM +#define NO_WOLFSSL_DIR +#define NO_MAIN_DRIVER +#define NO_DEV_RANDOM +#define WOLFSSL_IGNORE_FILE_WARN +#define BENCH_EMBEDDED +#define NO_WOLFSSL_MEMORY +#define WOLFSSL_GENSEED_FORTEST /* dev-only seed; no TRNG on this part */ + +/* Hashes (SHA-1 is on by default - NO_SHA is not set) */ +#define WOLFSSL_SHA512 +#define WOLFSSL_SHA384 +#define WOLFSSL_SHA3 +#define WOLFSSL_SHAKE128 +#define WOLFSSL_SHAKE256 + +/* AES + modes (block/key/keystream octet I/O and the XTS tweak carry) */ +#define HAVE_AES_CBC +#define HAVE_AES_DECRYPT +#define WOLFSSL_AES_COUNTER +#define WOLFSSL_AES_CFB +#define WOLFSSL_AES_OFB +#define HAVE_AESGCM +#define GCM_SMALL +#define HAVE_AESCCM +#define WOLFSSL_CMAC +#define WOLFSSL_AES_XTS +#define WOLFSSL_AES_SIV +#define WOLFSSL_AES_EAX +#define WOLFSSL_AES_DIRECT + +/* ChaCha20-Poly1305 (chunk size, keystream and Poly1305 length octet I/O) */ +#define HAVE_CHACHA +#define HAVE_POLY1305 + +/* Curve25519/Ed25519 + Curve448/Ed448 (field serialization octet I/O). 448 + * uses the SMALL byte-array backend (no __uint128_t on this toolchain). */ +#define HAVE_CURVE25519 +#define HAVE_ED25519 +#define HAVE_CURVE448 +#define CURVE448_SMALL +#define HAVE_ED448 +#define ED448_SMALL + +/* ML-DSA-87 verify (smallest-mem streaming verifier) */ +#define WOLFSSL_HAVE_MLDSA +#define WOLFSSL_NO_ML_DSA_44 +#define WOLFSSL_NO_ML_DSA_65 +#define WOLFSSL_MLDSA_NO_ASN1 +#define WOLFSSL_MLDSA_VERIFY_ONLY +#define WOLFSSL_MLDSA_VERIFY_SMALL_MEM +#define WOLFSSL_MLDSA_VERIFY_NO_MALLOC +#define WOLFSSL_MLDSA_VERIFY_SMALLEST_MEM +#undef WOLFSSL_MLDSA_ALIGNMENT +#define WOLFSSL_MLDSA_ALIGNMENT 16 +#define WOLFSSL_SMALL_STACK + +/* ECDSA / ECDH P-256 via SP single-precision math (sp_c32.c) */ +#define HAVE_ECC +#define ECC_USER_CURVES +#define HAVE_ECC256 +#define HAVE_ECC_VERIFY +#define HAVE_ECC_SIGN +#define HAVE_ECC_DHE +#define ECC_TIMING_RESISTANT +#define WOLFSSL_SP_MATH +#define WOLFSSL_HAVE_SP_ECC +#define WOLFSSL_SP_NO_MALLOC +#define WOLFSSL_SP_SMALL +#define SP_WORD_SIZE 32 +#define WOLFSSL_SP_ALLOW_16BIT_CPU + +/* Off: big-int/ASN and legacy algorithms not part of the CHAR_BIT != 8 surface. + * (RSA/DH are validated on hardware but their CHAR_BIT != 8 fixes live in + * sp_int.c/sp_c32.c, already compiled here via ECC.) */ +#define NO_RSA +#define NO_DH +#define NO_DSA +#define NO_ASN +#define NO_CERTS +#define NO_PWDBASED +#define NO_PKCS7 +#define NO_PKCS12 +#define NO_SIG_WRAPPER +#define NO_DES3 +#define NO_RC4 +#define NO_MD4 +#define NO_MD5 +#define NO_ASN_TIME +#define WOLFSSL_USER_CURRTIME + +#endif /* TI_C2000_CI_USER_SETTINGS_H */ diff --git a/IDE/include.am b/IDE/include.am index e70c06fb5a..60b78300ba 100644 --- a/IDE/include.am +++ b/IDE/include.am @@ -13,6 +13,7 @@ EXTRA_DIST+= IDE/Android EXTRA_DIST+= IDE/ARDUINO EXTRA_DIST+= IDE/AURIX +EXTRA_DIST+= IDE/C2000 EXTRA_DIST+= IDE/CRYPTOCELL EXTRA_DIST+= IDE/CSBENCH EXTRA_DIST+= IDE/ECLIPSE diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 9934e77b5f..b9c867cb21 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -2418,6 +2418,14 @@ static int numBlocks = NUM_BLOCKS; * instead of working one out from the block size. */ static int numBlocksSet = 0; static word32 bench_size = BENCH_SIZE; +#ifdef WOLFSSL_NO_MALLOC + /* No heap: file-scope static bench buffers, sized for bench_buf_size plus + * the +16 slack used at the alloc site below (buffers are used as-is; no + * runtime re-alignment beyond XGEN_ALIGN). */ + #define BENCH_MAX_PAD (BENCH_CIPHER_ADD + 16) + static THREAD_LS_T XGEN_ALIGN byte bench_plain_buf[BENCH_SIZE + BENCH_MAX_PAD]; + static THREAD_LS_T XGEN_ALIGN byte bench_cipher_buf[BENCH_SIZE + BENCH_MAX_PAD]; +#endif static int base2 = 1; static int digest_stream = 1; #ifndef NO_HMAC @@ -3867,7 +3875,21 @@ static void* benchmarks_do(void* args) if (bench_buf_size % 16) bench_buf_size += 16 - (bench_buf_size % 16); -#ifdef WOLFSSL_AFALG_XILINX_AES +#ifdef WOLFSSL_NO_MALLOC + /* No heap: point at the static buffers, but bench_size can be raised at + * runtime (benchmark_configure / size paths), so check it fits the fixed + * capacity first - else later writes would overrun the buffer. */ + if ((unsigned long)bench_buf_size + 16UL > + (unsigned long)sizeof(bench_plain_buf)) { + printf("%sBenchmark size %lu exceeds WOLFSSL_NO_MALLOC static buffer " + "(%lu); rebuild with a larger BENCH_SIZE\n", err_prefix, + (unsigned long)bench_buf_size, + (unsigned long)sizeof(bench_plain_buf)); + goto exit; + } + bench_plain = bench_plain_buf; + bench_cipher = bench_cipher_buf; +#elif defined(WOLFSSL_AFALG_XILINX_AES) bench_plain = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16); /* native heap */ bench_cipher = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16); /* native heap */ #else @@ -3980,7 +4002,8 @@ static void* benchmarks_do(void* args) } #endif -#if defined(WOLFSSL_ASYNC_CRYPT) || defined(HAVE_INTEL_QA_SYNC) +#if (defined(WOLFSSL_ASYNC_CRYPT) || defined(HAVE_INTEL_QA_SYNC)) && \ + !defined(WOLFSSL_NO_MALLOC) bench_key = (byte*)XMALLOC(sizeof(bench_key_buf), HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT); bench_iv = (byte*)XMALLOC(sizeof(bench_iv_buf), @@ -4873,9 +4896,12 @@ static void* benchmarks_do(void* args) exit: /* free benchmark buffers */ +#ifndef WOLFSSL_NO_MALLOC + /* under WOLFSSL_NO_MALLOC these point at file-scope static buffers */ XFREE(bench_plain, HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT); XFREE(bench_cipher, HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT); -#ifdef WOLFSSL_ASYNC_CRYPT +#endif +#if defined(WOLFSSL_ASYNC_CRYPT) && !defined(WOLFSSL_NO_MALLOC) XFREE(bench_key, HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT); XFREE(bench_iv, HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT); #endif diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 41c2e71e33..43d4e08468 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -6629,18 +6629,18 @@ exit: static wc_test_ret_t sha512_224_large_hash_test(wc_Sha512* sha) { #ifdef HASH_SIZE_LIMIT - static const char* large_digest = - "\x98\x68\xc3\xd9\xb9\xef\x17\x53" - "\x43\x66\x0e\x60\xdf\x29\xf8\xef" - "\x96\xe3\x93\x34\x8c\x6f\xc0\xeb" - "\x14\x6c\xcf\x6a"; + static const byte large_digest[] = { + 0x98, 0x68, 0xc3, 0xd9, 0xb9, 0xef, 0x17, 0x53, 0x43, 0x66, 0x0e, 0x60, + 0xdf, 0x29, 0xf8, 0xef, 0x96, 0xe3, 0x93, 0x34, 0x8c, 0x6f, 0xc0, 0xeb, + 0x14, 0x6c, 0xcf, 0x6a, 0x00 + }; int times = 20; #else - static const char* large_digest = - "\x26\x5f\x98\xd1\x76\x49\x71\x4e" - "\x82\xb7\x9d\x52\x32\x67\x9d\x56" - "\x91\xf5\x88\xc3\x05\xbb\x3f\x90" - "\xe2\x4e\x85\x05"; + static const byte large_digest[] = { + 0x26, 0x5f, 0x98, 0xd1, 0x76, 0x49, 0x71, 0x4e, 0x82, 0xb7, 0x9d, 0x52, + 0x32, 0x67, 0x9d, 0x56, 0x91, 0xf5, 0x88, 0xc3, 0x05, 0xbb, 0x3f, 0x90, + 0xe2, 0x4e, 0x85, 0x05, 0x00 + }; int times = 100; #endif byte hash[WC_SHA512_224_DIGEST_SIZE]; @@ -6821,18 +6821,18 @@ exit: static wc_test_ret_t sha512_256_large_hash_test(wc_Sha512* sha) { #ifdef HASH_SIZE_LIMIT - static const char* large_digest = - "\x49\xcc\xbc\x7a\x93\x0b\x02\xb8" - "\xad\x9a\x46\x51\x00\x1f\x13\x80" - "\x35\x84\x36\xf1\xf2\x3c\xeb\xd8" - "\x41\xd4\x06\x8b\x1d\x19\xad\x72"; + static const byte large_digest[] = { + 0x49, 0xcc, 0xbc, 0x7a, 0x93, 0x0b, 0x02, 0xb8, 0xad, 0x9a, 0x46, 0x51, + 0x00, 0x1f, 0x13, 0x80, 0x35, 0x84, 0x36, 0xf1, 0xf2, 0x3c, 0xeb, 0xd8, + 0x41, 0xd4, 0x06, 0x8b, 0x1d, 0x19, 0xad, 0x72, 0x00 + }; int times = 20; #else - static const char* large_digest = - "\x7a\xe3\x84\x05\xcb\x06\x22\x08" - "\x7e\x2c\x65\x89\x1f\x26\x45\xfd" - "\xad\xbc\x2e\x29\x83\x12\x84\x4b" - "\xf2\xa0\xde\xbe\x06\x11\xd7\x44"; + static const byte large_digest[] = { + 0x7a, 0xe3, 0x84, 0x05, 0xcb, 0x06, 0x22, 0x08, 0x7e, 0x2c, 0x65, 0x89, + 0x1f, 0x26, 0x45, 0xfd, 0xad, 0xbc, 0x2e, 0x29, 0x83, 0x12, 0x84, 0x4b, + 0xf2, 0xa0, 0xde, 0xbe, 0x06, 0x11, 0xd7, 0x44, 0x00 + }; int times = 100; #endif byte hash[WC_SHA512_256_DIGEST_SIZE]; @@ -7197,9 +7197,11 @@ exit: #ifndef NO_LARGE_HASH_TEST static wc_test_ret_t sha3_224_large_hash_test(wc_Sha3* sha) { - static const char* large_digest = - "\x13\xe5\xd3\x98\x7b\x94\xda\x41\x12\xc7\x1e\x92\x3a\x19" - "\x21\x20\x86\x6f\x24\xbf\x0a\x31\xbc\xfd\xd6\x70\x36\xf3"; + static const byte large_digest[] = { + 0x13, 0xe5, 0xd3, 0x98, 0x7b, 0x94, 0xda, 0x41, 0x12, 0xc7, 0x1e, 0x92, + 0x3a, 0x19, 0x21, 0x20, 0x86, 0x6f, 0x24, 0xbf, 0x0a, 0x31, 0xbc, 0xfd, + 0xd6, 0x70, 0x36, 0xf3, 0x00 + }; byte hash[WC_SHA3_224_DIGEST_SIZE]; byte large_input[1024]; wc_test_ret_t ret; @@ -7411,9 +7413,11 @@ exit: #ifndef NO_LARGE_HASH_TEST static wc_test_ret_t sha3_256_large_hash_test(wc_Sha3* sha) { - static const char* large_digest = - "\xdc\x90\xc0\xb1\x25\xdb\x2c\x34\x81\xa3\xff\xbc\x1e\x2e\x87\xeb" - "\x6d\x70\x85\x61\xe0\xe9\x63\x61\xff\xe5\x84\x4b\x1f\x68\x05\x15"; + static const byte large_digest[] = { + 0xdc, 0x90, 0xc0, 0xb1, 0x25, 0xdb, 0x2c, 0x34, 0x81, 0xa3, 0xff, 0xbc, + 0x1e, 0x2e, 0x87, 0xeb, 0x6d, 0x70, 0x85, 0x61, 0xe0, 0xe9, 0x63, 0x61, + 0xff, 0xe5, 0x84, 0x4b, 0x1f, 0x68, 0x05, 0x15, 0x00 + }; byte hash[WC_SHA3_256_DIGEST_SIZE]; byte large_input[1024]; wc_test_ret_t ret; @@ -7628,10 +7632,12 @@ exit: #ifndef NO_LARGE_HASH_TEST static wc_test_ret_t sha3_384_large_hash_test(wc_Sha3* sha) { - static const char* large_digest = - "\x30\x44\xec\x17\xef\x47\x9f\x55\x36\x11\xd6\x3f\x8a\x31\x5a\x71" - "\x8a\x71\xa7\x1d\x8e\x84\xe8\x6c\x24\x02\x2f\x7a\x08\x4e\xea\xd7" - "\x42\x36\x5d\xa8\xc2\xb7\x42\xad\xec\x19\xfb\xca\xc6\x64\xb3\xa4"; + static const byte large_digest[] = { + 0x30, 0x44, 0xec, 0x17, 0xef, 0x47, 0x9f, 0x55, 0x36, 0x11, 0xd6, 0x3f, + 0x8a, 0x31, 0x5a, 0x71, 0x8a, 0x71, 0xa7, 0x1d, 0x8e, 0x84, 0xe8, 0x6c, + 0x24, 0x02, 0x2f, 0x7a, 0x08, 0x4e, 0xea, 0xd7, 0x42, 0x36, 0x5d, 0xa8, + 0xc2, 0xb7, 0x42, 0xad, 0xec, 0x19, 0xfb, 0xca, 0xc6, 0x64, 0xb3, 0xa4, 0x00 + }; byte hash[WC_SHA3_384_DIGEST_SIZE]; byte large_input[1024]; wc_test_ret_t ret; @@ -7815,11 +7821,14 @@ exit: #ifndef NO_LARGE_HASH_TEST static wc_test_ret_t sha3_512_large_hash_test(wc_Sha3* sha) { - static const char* large_digest = - "\x9c\x13\x26\xb6\x26\xb2\x94\x31\xbc\xf4\x34\xe9\x6f\xf2\xd6\x29" - "\x9a\xd0\x9b\x32\x63\x2f\x18\xa7\x5f\x23\xc9\x60\xc2\x32\x0c\xbc" - "\x57\x77\x33\xf1\x83\x81\x8a\xd3\x15\x7c\x93\xdc\x80\x9f\xed\x61" - "\x41\xa7\x5b\xfd\x32\x0e\x38\x15\xb0\x46\x3b\x7a\x4f\xfd\x44\x88"; + static const byte large_digest[] = { + 0x9c, 0x13, 0x26, 0xb6, 0x26, 0xb2, 0x94, 0x31, 0xbc, 0xf4, 0x34, 0xe9, + 0x6f, 0xf2, 0xd6, 0x29, 0x9a, 0xd0, 0x9b, 0x32, 0x63, 0x2f, 0x18, 0xa7, + 0x5f, 0x23, 0xc9, 0x60, 0xc2, 0x32, 0x0c, 0xbc, 0x57, 0x77, 0x33, 0xf1, + 0x83, 0x81, 0x8a, 0xd3, 0x15, 0x7c, 0x93, 0xdc, 0x80, 0x9f, 0xed, 0x61, + 0x41, 0xa7, 0x5b, 0xfd, 0x32, 0x0e, 0x38, 0x15, 0xb0, 0x46, 0x3b, 0x7a, + 0x4f, 0xfd, 0x44, 0x88, 0x00 + }; byte hash[WC_SHA3_512_DIGEST_SIZE]; byte large_input[1024]; wc_test_ret_t ret; @@ -7965,28 +7974,36 @@ static wc_test_ret_t shake128_absorb_test(wc_Shake* sha, byte *large_input_buf, { wc_test_ret_t ret = 0; int i; - static const char large_digest[] = - "\x2b\xd1\x69\x9f\xb3\x75\x40\x74\xb8\xb2\xd2\x0b\x92\x47\x9b\xfe" - "\xc9\x91\x48\xbe\xda\xa4\x09\xd7\x61\x35\x18\x05\x07\x71\xa5\x61" - "\x4d\xc4\x94\xad\xbe\x04\x7d\xad\x95\x2f\xeb\x2c\xc0\x10\x67\x43" - "\x40\xf1\x4a\x58\x1c\x54\xfa\x24\x1c\x1a\x4e\x8d\x9b\xbc\xea\xa7" - "\x32\xf2\x4c\xc7\x86\x05\x36\xdc\xb4\x42\xd8\x35\xd1\xb4\xa2\x79" - "\xa2\xe6\xee\x67\x4f\xbf\x2a\x93\x41\x88\x25\x56\x29\x90\x1a\x06" - "\xba\xfe\x9f\xa6\x1a\x74\xe8\x7e\x85\x4a\xc8\x58\x60\xb1\x7b\x18" - "\xdf\x77\x59\x46\x04\xc1\xff\x4b\x9b\xcb\xad\xfe\x91\x28\xf0\x01" - "\xc1\x33\xd0\x99\x99\x2e\x0c\x86\x84\x67\x4d\x37\xa4\x42\x45\x10" - "\xdc\x8f\xdb\x6f\xa6\x9b\xee\x8a\x60\xa5\x1f\x95\x3f\x8f\xf5\x31" - "\x4b\x1d\x48\x1e\x45\xff\x79\x5c\xbe\x72\xfc\x56\xed\x6d\x1a\x99" - "\x7f\x23\x7c\xd1\xa5\x50\x9e\xb0\x4d\x61\x37\xa5\xcb\x24\x71\x3b" - "\xa3\x60\x51\x2e\x80\x83\x8b\xe0\x55\x50\xa7\x1e\xcc\x9f\xac\x41" - "\x77\x2c\x79\x22\x30\x09\x1b\x1a\x83\x5b\x2c\x48\xdc\x09\x7d\x59" - "\x0d\xf0\x54\x17\xfb\x5e\x38\x68\xde\xdb\xc5\x93\xab\x17\x5f\x4b" - "\x4d\x6d\xf2\xc7\x4e\x15\x1e\x10\x76\xc4\xcb\x87\xd8\xb7\x9d\xa8" - "\xbf\xc5\x2e\x5e\xfc\xd3\x6c\x45\xd4\x5d\x72\x0f\x66\xeb\x67\x86" - "\xfa\x6c\xd6\x80\xa4\x23\xcb\x5d\xed\x3c\xde\xdc\x5b\x3d\xca\x95" - "\x43\x4b\xdc\xe8\x49\xd3\xe1\x01\xd4\xf1\xe4\x47\xcf\x56\xba\x71" - "\xb4\x69\xed\xe7\xdb\x0f\x89\xd6\xbb\xcd\x1a\xff\xb4\xbe\x72\x26" - "\xdc\x76\x79\xb3\x1a\x4b\xe6\x8d\x9b\x8e\xd9\xe9\xe6\xf9\xff\xa5"; + static const byte large_digest[] = { + 0x2b, 0xd1, 0x69, 0x9f, 0xb3, 0x75, 0x40, 0x74, 0xb8, 0xb2, 0xd2, 0x0b, + 0x92, 0x47, 0x9b, 0xfe, 0xc9, 0x91, 0x48, 0xbe, 0xda, 0xa4, 0x09, 0xd7, + 0x61, 0x35, 0x18, 0x05, 0x07, 0x71, 0xa5, 0x61, 0x4d, 0xc4, 0x94, 0xad, + 0xbe, 0x04, 0x7d, 0xad, 0x95, 0x2f, 0xeb, 0x2c, 0xc0, 0x10, 0x67, 0x43, + 0x40, 0xf1, 0x4a, 0x58, 0x1c, 0x54, 0xfa, 0x24, 0x1c, 0x1a, 0x4e, 0x8d, + 0x9b, 0xbc, 0xea, 0xa7, 0x32, 0xf2, 0x4c, 0xc7, 0x86, 0x05, 0x36, 0xdc, + 0xb4, 0x42, 0xd8, 0x35, 0xd1, 0xb4, 0xa2, 0x79, 0xa2, 0xe6, 0xee, 0x67, + 0x4f, 0xbf, 0x2a, 0x93, 0x41, 0x88, 0x25, 0x56, 0x29, 0x90, 0x1a, 0x06, + 0xba, 0xfe, 0x9f, 0xa6, 0x1a, 0x74, 0xe8, 0x7e, 0x85, 0x4a, 0xc8, 0x58, + 0x60, 0xb1, 0x7b, 0x18, 0xdf, 0x77, 0x59, 0x46, 0x04, 0xc1, 0xff, 0x4b, + 0x9b, 0xcb, 0xad, 0xfe, 0x91, 0x28, 0xf0, 0x01, 0xc1, 0x33, 0xd0, 0x99, + 0x99, 0x2e, 0x0c, 0x86, 0x84, 0x67, 0x4d, 0x37, 0xa4, 0x42, 0x45, 0x10, + 0xdc, 0x8f, 0xdb, 0x6f, 0xa6, 0x9b, 0xee, 0x8a, 0x60, 0xa5, 0x1f, 0x95, + 0x3f, 0x8f, 0xf5, 0x31, 0x4b, 0x1d, 0x48, 0x1e, 0x45, 0xff, 0x79, 0x5c, + 0xbe, 0x72, 0xfc, 0x56, 0xed, 0x6d, 0x1a, 0x99, 0x7f, 0x23, 0x7c, 0xd1, + 0xa5, 0x50, 0x9e, 0xb0, 0x4d, 0x61, 0x37, 0xa5, 0xcb, 0x24, 0x71, 0x3b, + 0xa3, 0x60, 0x51, 0x2e, 0x80, 0x83, 0x8b, 0xe0, 0x55, 0x50, 0xa7, 0x1e, + 0xcc, 0x9f, 0xac, 0x41, 0x77, 0x2c, 0x79, 0x22, 0x30, 0x09, 0x1b, 0x1a, + 0x83, 0x5b, 0x2c, 0x48, 0xdc, 0x09, 0x7d, 0x59, 0x0d, 0xf0, 0x54, 0x17, + 0xfb, 0x5e, 0x38, 0x68, 0xde, 0xdb, 0xc5, 0x93, 0xab, 0x17, 0x5f, 0x4b, + 0x4d, 0x6d, 0xf2, 0xc7, 0x4e, 0x15, 0x1e, 0x10, 0x76, 0xc4, 0xcb, 0x87, + 0xd8, 0xb7, 0x9d, 0xa8, 0xbf, 0xc5, 0x2e, 0x5e, 0xfc, 0xd3, 0x6c, 0x45, + 0xd4, 0x5d, 0x72, 0x0f, 0x66, 0xeb, 0x67, 0x86, 0xfa, 0x6c, 0xd6, 0x80, + 0xa4, 0x23, 0xcb, 0x5d, 0xed, 0x3c, 0xde, 0xdc, 0x5b, 0x3d, 0xca, 0x95, + 0x43, 0x4b, 0xdc, 0xe8, 0x49, 0xd3, 0xe1, 0x01, 0xd4, 0xf1, 0xe4, 0x47, + 0xcf, 0x56, 0xba, 0x71, 0xb4, 0x69, 0xed, 0xe7, 0xdb, 0x0f, 0x89, 0xd6, + 0xbb, 0xcd, 0x1a, 0xff, 0xb4, 0xbe, 0x72, 0x26, 0xdc, 0x76, 0x79, 0xb3, + 0x1a, 0x4b, 0xe6, 0x8d, 0x9b, 0x8e, 0xd9, 0xe9, 0xe6, 0xf9, 0xff, 0xa5, 0x00 + }; byte hash[sizeof(large_digest) - 1]; testVector a, b, c, d, e; testVector test_sha[5]; @@ -8152,15 +8169,18 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t shake128_test(void) #else byte large_input[SHAKE128_LARGE_INPUT_BUFSIZ]; #endif - static const char large_digest[] = - "\x88\xd7\x0e\x86\x46\x72\x6b\x3d\x7d\x22\xe1\xa9\x2d\x02\xdb\x35" - "\x92\x4f\x1b\x03\x90\xee\xa3\xce\xd1\x3a\x08\x3a\xd7\x4e\x10\xdf" - "\x09\x67\x33\x35\x4f\xdd\x38\x50\x5b\xcb\x75\xc7\xba\x65\xe5\xe8" - "\xb8\x76\xde\xc5\xee\xd7\xf1\x65\x93\x4e\x5e\xc4\xb1\xd7\x6b\xee" - "\x4b\x57\x48\xf5\x38\x49\x9e\x45\xa0\xf7\x32\xe9\x05\x26\x6a\x10" - "\x70\xd4\x7c\x19\x01\x1f\x6d\x37\xba\x7b\x74\xc2\xbc\xb6\xbc\x74" - "\xa3\x66\x6c\x9b\x11\x84\x9d\x4a\x36\xbc\x8a\x0d\x4c\xe3\x39\xfa" - "\xfa\x1b"; + static const byte large_digest[] = { + 0x88, 0xd7, 0x0e, 0x86, 0x46, 0x72, 0x6b, 0x3d, 0x7d, 0x22, 0xe1, 0xa9, + 0x2d, 0x02, 0xdb, 0x35, 0x92, 0x4f, 0x1b, 0x03, 0x90, 0xee, 0xa3, 0xce, + 0xd1, 0x3a, 0x08, 0x3a, 0xd7, 0x4e, 0x10, 0xdf, 0x09, 0x67, 0x33, 0x35, + 0x4f, 0xdd, 0x38, 0x50, 0x5b, 0xcb, 0x75, 0xc7, 0xba, 0x65, 0xe5, 0xe8, + 0xb8, 0x76, 0xde, 0xc5, 0xee, 0xd7, 0xf1, 0x65, 0x93, 0x4e, 0x5e, 0xc4, + 0xb1, 0xd7, 0x6b, 0xee, 0x4b, 0x57, 0x48, 0xf5, 0x38, 0x49, 0x9e, 0x45, + 0xa0, 0xf7, 0x32, 0xe9, 0x05, 0x26, 0x6a, 0x10, 0x70, 0xd4, 0x7c, 0x19, + 0x01, 0x1f, 0x6d, 0x37, 0xba, 0x7b, 0x74, 0xc2, 0xbc, 0xb6, 0xbc, 0x74, + 0xa3, 0x66, 0x6c, 0x9b, 0x11, 0x84, 0x9d, 0x4a, 0x36, 0xbc, 0x8a, 0x0d, + 0x4c, 0xe3, 0x39, 0xfa, 0xfa, 0x1b, 0x00 + }; /* ** https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE128_Msg0.pdf ** d/e: NIST CAVP - full rate / multi-block output. @@ -8346,24 +8366,31 @@ static wc_test_ret_t shake256_absorb_test(wc_Shake* sha, byte *large_input_buf, { wc_test_ret_t ret = 0; int i; - static const char large_digest[] = - "\x21\x25\x8e\xae\x6e\x4f\xa7\xe1\xb9\x6d\xa7\xc9\x7d\x46\x03\x69" - "\x29\x0d\x81\x49\xba\x5d\xaf\x37\xfd\xeb\x25\x52\x1d\xd9\xbd\x65" - "\xfa\x99\xb9\xd1\x70\x6b\xeb\xd4\xc1\x2c\xea\x24\x20\x27\xa7\xcd" - "\xfa\xe1\x81\xd9\xd5\xc1\x1c\xc7\xe9\x70\xc3\xc7\x21\x6f\x32\x22" - "\xe3\x27\xdb\x58\x5e\xea\x18\x2d\x63\x4d\x14\x6c\x94\xcf\x2b\x7e" - "\x6e\x2a\x74\xf3\xe0\xac\xb3\xb2\xcc\xef\x38\xe9\xe7\x35\xb3\xc5" - "\x77\x9d\xff\xe3\x08\x8e\xf8\x2c\x89\xbb\x45\x22\x16\x99\x91\xc0" - "\xe7\x71\x57\x75\xc5\xb1\xc6\xaf\x27\xcb\x64\x8c\xc4\xee\x3d\x5f" - "\x4c\x35\xfb\x1c\xf3\xf8\x0e\xfd\x5e\xfc\x07\xd8\x4d\x55\x32\x49" - "\x45\x0d\xab\x4a\x49\xc4\x83\xde\xd2\x50\xc9\x33\x8f\x85\xcd\x93" - "\x7a\xe6\x6b\xb4\x36\xf3\xb4\x02\x6e\x85\x9f\xda\x1c\xa5\x71\x43" - "\x2f\x3b\xfc\x09\xe7\xc0\x3c\xa4\xd1\x83\xb7\x41\x11\x1c\xa0\x48" - "\x3d\x0e\xda\xbc\x03\xfe\xb2\x3b\x17\xee\x48\xe8\x44\xba\x24\x08" - "\xd9\xdc\xfd\x01\x39\xd2\xe8\xc7\x31\x01\x25\xae\xe8\x01\xc6\x1a" - "\xb7\x90\x0d\x1e\xfc\x47\xc0\x78\x28\x17\x66\xf3\x61\xc5\xe6\x11" - "\x13\x46\x23\x5e\x1d\xc3\x83\x25\x66\x6c\x68\x1b\x30\xdd\xc4\xe6" - "\x83\x8b\x0f\x23\x58\x7e\x06\x5f\x4a\x2b\xed\xc9\x6c\x97\x68\x44"; + static const byte large_digest[] = { + 0x21, 0x25, 0x8e, 0xae, 0x6e, 0x4f, 0xa7, 0xe1, 0xb9, 0x6d, 0xa7, 0xc9, + 0x7d, 0x46, 0x03, 0x69, 0x29, 0x0d, 0x81, 0x49, 0xba, 0x5d, 0xaf, 0x37, + 0xfd, 0xeb, 0x25, 0x52, 0x1d, 0xd9, 0xbd, 0x65, 0xfa, 0x99, 0xb9, 0xd1, + 0x70, 0x6b, 0xeb, 0xd4, 0xc1, 0x2c, 0xea, 0x24, 0x20, 0x27, 0xa7, 0xcd, + 0xfa, 0xe1, 0x81, 0xd9, 0xd5, 0xc1, 0x1c, 0xc7, 0xe9, 0x70, 0xc3, 0xc7, + 0x21, 0x6f, 0x32, 0x22, 0xe3, 0x27, 0xdb, 0x58, 0x5e, 0xea, 0x18, 0x2d, + 0x63, 0x4d, 0x14, 0x6c, 0x94, 0xcf, 0x2b, 0x7e, 0x6e, 0x2a, 0x74, 0xf3, + 0xe0, 0xac, 0xb3, 0xb2, 0xcc, 0xef, 0x38, 0xe9, 0xe7, 0x35, 0xb3, 0xc5, + 0x77, 0x9d, 0xff, 0xe3, 0x08, 0x8e, 0xf8, 0x2c, 0x89, 0xbb, 0x45, 0x22, + 0x16, 0x99, 0x91, 0xc0, 0xe7, 0x71, 0x57, 0x75, 0xc5, 0xb1, 0xc6, 0xaf, + 0x27, 0xcb, 0x64, 0x8c, 0xc4, 0xee, 0x3d, 0x5f, 0x4c, 0x35, 0xfb, 0x1c, + 0xf3, 0xf8, 0x0e, 0xfd, 0x5e, 0xfc, 0x07, 0xd8, 0x4d, 0x55, 0x32, 0x49, + 0x45, 0x0d, 0xab, 0x4a, 0x49, 0xc4, 0x83, 0xde, 0xd2, 0x50, 0xc9, 0x33, + 0x8f, 0x85, 0xcd, 0x93, 0x7a, 0xe6, 0x6b, 0xb4, 0x36, 0xf3, 0xb4, 0x02, + 0x6e, 0x85, 0x9f, 0xda, 0x1c, 0xa5, 0x71, 0x43, 0x2f, 0x3b, 0xfc, 0x09, + 0xe7, 0xc0, 0x3c, 0xa4, 0xd1, 0x83, 0xb7, 0x41, 0x11, 0x1c, 0xa0, 0x48, + 0x3d, 0x0e, 0xda, 0xbc, 0x03, 0xfe, 0xb2, 0x3b, 0x17, 0xee, 0x48, 0xe8, + 0x44, 0xba, 0x24, 0x08, 0xd9, 0xdc, 0xfd, 0x01, 0x39, 0xd2, 0xe8, 0xc7, + 0x31, 0x01, 0x25, 0xae, 0xe8, 0x01, 0xc6, 0x1a, 0xb7, 0x90, 0x0d, 0x1e, + 0xfc, 0x47, 0xc0, 0x78, 0x28, 0x17, 0x66, 0xf3, 0x61, 0xc5, 0xe6, 0x11, + 0x13, 0x46, 0x23, 0x5e, 0x1d, 0xc3, 0x83, 0x25, 0x66, 0x6c, 0x68, 0x1b, + 0x30, 0xdd, 0xc4, 0xe6, 0x83, 0x8b, 0x0f, 0x23, 0x58, 0x7e, 0x06, 0x5f, + 0x4a, 0x2b, 0xed, 0xc9, 0x6c, 0x97, 0x68, 0x44, 0x00 + }; byte hash[sizeof(large_digest) - 1]; testVector a, b, c, d, e; testVector test_sha[5]; @@ -8517,15 +8544,18 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t shake256_test(void) #else byte large_input[SHAKE256_LARGE_INPUT_BUFSIZ]; #endif - static const char large_digest[] = - "\x90\x32\x4a\xcc\xd1\xdf\xb8\x0b\x79\x1f\xb8\xc8\x5b\x54\xc8\xe7" - "\x45\xf5\x60\x6b\x38\x26\xb2\x0a\xee\x38\x01\xf3\xd9\xfa\x96\x9f" - "\x6a\xd7\x15\xdf\xb6\xc2\xf4\x20\x33\x44\x55\xe8\x2a\x09\x2b\x68" - "\x2e\x18\x65\x5e\x65\x93\x28\xbc\xb1\x9e\xe2\xb1\x92\xea\x98\xac" - "\x21\xef\x4c\xe1\xb4\xb7\xbe\x81\x5c\x1d\xd3\xb7\x17\xe5\xbb\xc5" - "\x8c\x68\xb7\xfb\xac\x55\x8a\x9b\x4d\x91\xe4\x9f\x72\xbb\x6e\x38" - "\xaf\x21\x7d\x21\xaa\x98\x4e\x75\xc4\xb4\x1c\x7c\x50\x45\x54\xf9" - "\xea\x26"; + static const byte large_digest[] = { + 0x90, 0x32, 0x4a, 0xcc, 0xd1, 0xdf, 0xb8, 0x0b, 0x79, 0x1f, 0xb8, 0xc8, + 0x5b, 0x54, 0xc8, 0xe7, 0x45, 0xf5, 0x60, 0x6b, 0x38, 0x26, 0xb2, 0x0a, + 0xee, 0x38, 0x01, 0xf3, 0xd9, 0xfa, 0x96, 0x9f, 0x6a, 0xd7, 0x15, 0xdf, + 0xb6, 0xc2, 0xf4, 0x20, 0x33, 0x44, 0x55, 0xe8, 0x2a, 0x09, 0x2b, 0x68, + 0x2e, 0x18, 0x65, 0x5e, 0x65, 0x93, 0x28, 0xbc, 0xb1, 0x9e, 0xe2, 0xb1, + 0x92, 0xea, 0x98, 0xac, 0x21, 0xef, 0x4c, 0xe1, 0xb4, 0xb7, 0xbe, 0x81, + 0x5c, 0x1d, 0xd3, 0xb7, 0x17, 0xe5, 0xbb, 0xc5, 0x8c, 0x68, 0xb7, 0xfb, + 0xac, 0x55, 0x8a, 0x9b, 0x4d, 0x91, 0xe4, 0x9f, 0x72, 0xbb, 0x6e, 0x38, + 0xaf, 0x21, 0x7d, 0x21, 0xaa, 0x98, 0x4e, 0x75, 0xc4, 0xb4, 0x1c, 0x7c, + 0x50, 0x45, 0x54, 0xf9, 0xea, 0x26, 0x00 + }; /* ** https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE256_Msg0.pdf ** d/e: NIST CAVP - full rate / multi-block output.