mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-10 17:51:20 +02:00
Daniele Lacamera
e2568cc39e
Per-module ISO 26262 MC/DC campaign (iso26262-mcdc-per-module). Adds DecisionCoverage-style cases to tests/api/test_chacha.c and test_poly1305.c, plus intel-dispatch white-box supplements mirroring the aes/sha3 technique. chacha.c: BEFORE 6/11 (54.55%) -> AFTER 13/13 (100%). Closed wc_Chacha_SetIV/SetKey's NULL-argument independence pairs, wc_Chacha_Process's input/output NULL-argument pairs (both the portable-C and USE_INTEL_CHACHA_SPEEDUP physical copies), and the (msglen>0 && ctx->left>0) leftover-block decision's msglen==0 side. Also adds an unaligned-key SetKey case (XSTREAM_ALIGN), a half-length key case, and a new test_wc_Chacha_XChachaSetKey covering wc_XChacha_SetKey. Total rose from 11 to 13 once the intelasm variant was fixed (see campaign notes): it carries its own physical copy of the leftover decision that the portable-only union previously missed. poly1305.c: BEFORE 10/14 (71.43%) -> AFTER 12/14 (85.71%). Closed wc_Poly1305Update's (m==NULL && bytes>0) inner AND, both operands. Also adds an addSz==0 case to wc_Poly1305_MAC and a lenToPad==WC_POLY1305_PAD_SZ case to wc_Poly1305_Pad for API robustness. The 2 remaining conditions are structural/dead-code residuals: wc_Poly1305SetKey's compound key==NULL check is shadowed by an earlier unconditional key==NULL guard a few lines above (dead code); wc_Poly1305_Pad's paddingLen<WC_POLY1305_PAD_SZ operand is always true whenever paddingLen>0 (paddingLen is a mod-16 value bounded to 0..15). See campaign baselines.json for full detail.
297 lines
11 KiB
C
297 lines
11 KiB
C
/* test_poly1305.c
|
|
*
|
|
* Copyright (C) 2006-2026 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
#include <tests/unit.h>
|
|
|
|
#ifdef NO_INLINE
|
|
#include <wolfssl/wolfcrypt/misc.h>
|
|
#else
|
|
#define WOLFSSL_MISC_INCLUDED
|
|
#include <wolfcrypt/src/misc.c>
|
|
#endif
|
|
|
|
#include <wolfssl/wolfcrypt/poly1305.h>
|
|
#include <wolfssl/wolfcrypt/types.h>
|
|
#include <tests/api/api.h>
|
|
#include <tests/api/test_poly1305.h>
|
|
|
|
/*
|
|
* unit test for wc_Poly1305SetKey()
|
|
*/
|
|
int test_wc_Poly1305SetKey(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_POLY1305
|
|
Poly1305 ctx;
|
|
const byte key[] =
|
|
{
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01
|
|
};
|
|
word32 keySz = (word32)(sizeof(key)/sizeof(byte));
|
|
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, keySz), 0);
|
|
|
|
/* Test bad args. */
|
|
ExpectIntEQ(wc_Poly1305SetKey(NULL, key,keySz),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, NULL, keySz),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, 18),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Poly1305_SetKey() */
|
|
|
|
/*
|
|
* Unit test for wc_Poly1305Update and wc_Poly1305Final.
|
|
* Uses RFC 8439 2.5.2 test vector.
|
|
*/
|
|
int test_wc_Poly1305UpdateFinal(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_POLY1305
|
|
/* RFC 8439 2.5.2 test vector */
|
|
const byte key[] = {
|
|
0x85,0xd6,0xbe,0x78,0x57,0x55,0x6d,0x33,
|
|
0x7f,0x44,0x52,0xfe,0x42,0xd5,0x06,0xa8,
|
|
0x01,0x03,0x80,0x8a,0xfb,0x0d,0xb2,0xfd,
|
|
0x4a,0xbf,0xf6,0xaf,0x41,0x49,0xf5,0x1b
|
|
};
|
|
/* "Cryptographic Forum Research Group" */
|
|
const byte msg[] = {
|
|
0x43,0x72,0x79,0x70,0x74,0x6f,0x67,0x72,
|
|
0x61,0x70,0x68,0x69,0x63,0x20,0x46,0x6f,
|
|
0x72,0x75,0x6d,0x20,0x52,0x65,0x73,0x65,
|
|
0x61,0x72,0x63,0x68,0x20,0x47,0x72,0x6f,
|
|
0x75,0x70
|
|
};
|
|
const byte expected[] = {
|
|
0xa8,0x06,0x1d,0xc1,0x30,0x51,0x36,0xc6,
|
|
0xc2,0x2b,0x8b,0xaf,0x0c,0x01,0x27,0xa9
|
|
};
|
|
Poly1305 ctx;
|
|
byte tag[WC_POLY1305_MAC_SZ];
|
|
|
|
/* Single update */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, msg, sizeof(msg)), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag), 0);
|
|
ExpectBufEQ(tag, expected, sizeof(expected));
|
|
|
|
/* Multi-chunk update produces the same result */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, msg, 16), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, msg + 16, sizeof(msg) - 16), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag), 0);
|
|
ExpectBufEQ(tag, expected, sizeof(expected));
|
|
|
|
/* Bad args */
|
|
ExpectIntEQ(wc_Poly1305Update(NULL, msg, sizeof(msg)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305Final(NULL, tag),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, NULL),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
|
|
/* ctx valid, m == NULL, bytes > 0: independence pair closing the inner
|
|
* (m == NULL && bytes > 0) AND's 2nd operand (bytes > 0) with m == NULL
|
|
* held true, and the outer OR's ctx==NULL operand held false. */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, NULL, sizeof(msg)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
/* ctx valid, m == NULL, bytes == 0: valid no-op call. Independence pair
|
|
* for the inner AND's 1st operand (m == NULL) held true while bytes > 0
|
|
* flips to false -- the whole AND (and so the OR) goes false. */
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, NULL, 0), 0);
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Poly1305UpdateFinal */
|
|
|
|
/*
|
|
* Unit test for wc_Poly1305_MAC.
|
|
* Uses RFC 7539 2.8.2 test vector.
|
|
*/
|
|
int test_wc_Poly1305_MAC(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_POLY1305
|
|
const byte key[] = {
|
|
0x7b,0xac,0x2b,0x25,0x2d,0xb4,0x47,0xaf,
|
|
0x09,0xb6,0x7a,0x55,0xa4,0xe9,0x55,0x84,
|
|
0x0a,0xe1,0xd6,0x73,0x10,0x75,0xd9,0xeb,
|
|
0x2a,0x93,0x75,0x78,0x3e,0xd5,0x53,0xff
|
|
};
|
|
const byte aad[] = {
|
|
0x50,0x51,0x52,0x53,0xc0,0xc1,0xc2,0xc3,
|
|
0xc4,0xc5,0xc6,0xc7
|
|
};
|
|
const byte input[] = {
|
|
0xd3,0x1a,0x8d,0x34,0x64,0x8e,0x60,0xdb,
|
|
0x7b,0x86,0xaf,0xbc,0x53,0xef,0x7e,0xc2,
|
|
0xa4,0xad,0xed,0x51,0x29,0x6e,0x08,0xfe,
|
|
0xa9,0xe2,0xb5,0xa7,0x36,0xee,0x62,0xd6,
|
|
0x3d,0xbe,0xa4,0x5e,0x8c,0xa9,0x67,0x12,
|
|
0x82,0xfa,0xfb,0x69,0xda,0x92,0x72,0x8b,
|
|
0x1a,0x71,0xde,0x0a,0x9e,0x06,0x0b,0x29,
|
|
0x05,0xd6,0xa5,0xb6,0x7e,0xcd,0x3b,0x36,
|
|
0x92,0xdd,0xbd,0x7f,0x2d,0x77,0x8b,0x8c,
|
|
0x98,0x03,0xae,0xe3,0x28,0x09,0x1b,0x58,
|
|
0xfa,0xb3,0x24,0xe4,0xfa,0xd6,0x75,0x94,
|
|
0x55,0x85,0x80,0x8b,0x48,0x31,0xd7,0xbc,
|
|
0x3f,0xf4,0xde,0xf0,0x8e,0x4b,0x7a,0x9d,
|
|
0xe5,0x76,0xd2,0x65,0x86,0xce,0xc6,0x4b,
|
|
0x61,0x16
|
|
};
|
|
const byte expected[] = {
|
|
0x1a,0xe1,0x0b,0x59,0x4f,0x09,0xe2,0x6a,
|
|
0x7e,0x90,0x2e,0xcb,0xd0,0x60,0x06,0x91
|
|
};
|
|
Poly1305 ctx;
|
|
byte tag[WC_POLY1305_MAC_SZ];
|
|
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, aad, sizeof(aad),
|
|
input, sizeof(input),
|
|
tag, sizeof(tag)), 0);
|
|
ExpectBufEQ(tag, expected, sizeof(expected));
|
|
|
|
/* Bad args */
|
|
ExpectIntEQ(wc_Poly1305_MAC(NULL, aad, sizeof(aad),
|
|
input, sizeof(input), tag, sizeof(tag)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, aad, sizeof(aad),
|
|
NULL, sizeof(input), tag, sizeof(tag)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, aad, sizeof(aad),
|
|
input, sizeof(input), NULL, sizeof(tag)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
/* tagSz too small */
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, aad, sizeof(aad),
|
|
input, sizeof(input),
|
|
tag, WC_POLY1305_MAC_SZ - 1),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
/* non-NULL additional with addSz > 0 but additional == NULL */
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, NULL, 1,
|
|
input, sizeof(input), tag, sizeof(tag)),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
/* addSz == 0: the additional-data block is skipped entirely (additional
|
|
* may legitimately be NULL here too). */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305_MAC(&ctx, NULL, 0,
|
|
input, sizeof(input), tag, sizeof(tag)), 0);
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Poly1305_MAC */
|
|
|
|
/*
|
|
* Unit test for wc_Poly1305_Pad and wc_Poly1305_EncodeSizes /
|
|
* wc_Poly1305_EncodeSizes64.
|
|
* These are exercised via wc_Poly1305_MAC in normal use; test them directly
|
|
* by verifying the tag changes when data is artificially padded/encoded.
|
|
*/
|
|
int test_wc_Poly1305_PadEncodeSizes(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_POLY1305
|
|
const byte key[] = {
|
|
0x85,0xd6,0xbe,0x78,0x57,0x55,0x6d,0x33,
|
|
0x7f,0x44,0x52,0xfe,0x42,0xd5,0x06,0xa8,
|
|
0x01,0x03,0x80,0x8a,0xfb,0x0d,0xb2,0xfd,
|
|
0x4a,0xbf,0xf6,0xaf,0x41,0x49,0xf5,0x1b
|
|
};
|
|
const byte data[] = { 0x01, 0x02, 0x03, 0x04, 0x05 }; /* 5 bytes */
|
|
Poly1305 ctx;
|
|
byte tag1[WC_POLY1305_MAC_SZ];
|
|
byte tag2[WC_POLY1305_MAC_SZ];
|
|
|
|
/* Build tag1: data + manual Pad + EncodeSizes(5, 5) */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, data, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_Pad(&ctx, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes(&ctx,
|
|
(word32)sizeof(data),
|
|
(word32)sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag1), 0);
|
|
|
|
/* Build tag2 same way - must match */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, data, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_Pad(&ctx, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes(&ctx,
|
|
(word32)sizeof(data),
|
|
(word32)sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag2), 0);
|
|
ExpectBufEQ(tag1, tag2, sizeof(tag1));
|
|
|
|
/* Omitting the pad must produce a different tag */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, data, sizeof(data)), 0);
|
|
/* intentionally skip Pad */
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes(&ctx,
|
|
(word32)sizeof(data),
|
|
(word32)sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag2), 0);
|
|
/* tags must differ */
|
|
ExpectIntNE(XMEMCMP(tag1, tag2, sizeof(tag1)), 0);
|
|
|
|
#ifdef WORD64_AVAILABLE
|
|
/* wc_Poly1305_EncodeSizes64: same data as 64-bit sizes, same result */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305Update(&ctx, data, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_Pad(&ctx, sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes64(&ctx,
|
|
(word64)sizeof(data),
|
|
(word64)sizeof(data)), 0);
|
|
ExpectIntEQ(wc_Poly1305Final(&ctx, tag2), 0);
|
|
ExpectBufEQ(tag1, tag2, sizeof(tag1));
|
|
#endif
|
|
|
|
/* Pad lenToPad == 0 is a no-op */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305_Pad(&ctx, 0), 0);
|
|
|
|
/* Pad lenToPad already a multiple of WC_POLY1305_PAD_SZ (16): distinct
|
|
* from lenToPad==0 above -- this takes the lenToPad != 0 branch but
|
|
* computes paddingLen == 0 ((-(int)lenToPad) & 15 == 0), the FALSE side
|
|
* of the (paddingLen > 0) decision. (paddingLen < WC_POLY1305_PAD_SZ is
|
|
* structurally always true whenever paddingLen > 0 is true -- the mod-16
|
|
* formula bounds paddingLen to 0..15 -- so that operand's FALSE side is
|
|
* an unsatisfiable residual; see campaign RESIDUALS notes.) */
|
|
ExpectIntEQ(wc_Poly1305SetKey(&ctx, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Poly1305_Pad(&ctx, 16), 0);
|
|
|
|
/* Bad args */
|
|
ExpectIntEQ(wc_Poly1305_Pad(NULL, 1),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes(NULL, 1, 1),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
#ifdef WORD64_AVAILABLE
|
|
ExpectIntEQ(wc_Poly1305_EncodeSizes64(NULL, 1, 1),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
#endif
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Poly1305_PadEncodeSizes */
|
|
|