mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-07-05 17:20:48 +02:00
Sean Parkinson
c905033acf
1. Unaligned Buffer Tests Verify correct output when input/output buffers are byte-offset by 1, 2, and 3 bytes. - AES-CBC, AES-CTS, AES-CTR, AES-GCM, AES-CCM, AES-XTS - ChaCha20, ChaCha20-Poly1305 2. In-Place (Overlapping) Buffer Tests Verify correct output when out == in (same pointer for input and output). - AES-CTS, AES-GCM, AES-CCM, AES-XTS - ChaCha20, ChaCha20-Poly1305 3. Cross-Cipher Verification Tests Verify that a higher-level mode produces identical output when manually reconstructed from a lower-level primitive (typically AES-ECB + XOR). - AES-CBC (= ECB + XOR chaining) - AES-CFB (= ECB(ciphertext feedback) + XOR) - AES-OFB (= ECB(output feedback) + XOR) - AES-CTR (= ECB(counter) + XOR with big-endian increment) - AES-GCM (ciphertext portion = CTR starting at counter J0+1) - ChaCha20-Poly1305 (ciphertext = raw ChaCha20 keystream XOR; tag = independent Poly1305) 4. Counter Overflow Tests Verify correct carry propagation when the internal block counter wraps around. - AES-CTR (32-bit big-endian carry across 4 bytes: 0xFFFFFFFE → wrap) - ChaCha20 (32-bit counter: 0xFFFFFFFF → 0x00000000) 5. AEAD Edge Case Tests Verify correct behavior for empty inputs, empty AAD, and invalid auth tag rejection. - Ascon-AEAD128 - AES-CCM - ChaCha20-Poly1305 6. Non-Standard Parameter Tests Verify behavior outside the common fast path. - AES-GCM: non-96-bit nonce lengths (1-byte, 60-byte, variable-length loop, zero-length rejection) 7. Streaming API State Tests Verify mid-stream state behavior and re-initialization after a final call. - AES-GCM stream, AES-XTS stream - ChaCha20-Poly1305 stream
620 lines
25 KiB
C
620 lines
25 KiB
C
/* test_chacha.c
|
|
*
|
|
* Copyright (C) 2006-2026 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
#include <tests/unit.h>
|
|
|
|
#ifdef NO_INLINE
|
|
#include <wolfssl/wolfcrypt/misc.h>
|
|
#else
|
|
#define WOLFSSL_MISC_INCLUDED
|
|
#include <wolfcrypt/src/misc.c>
|
|
#endif
|
|
|
|
#include <wolfssl/wolfcrypt/chacha.h>
|
|
#include <wolfssl/wolfcrypt/types.h>
|
|
#include <tests/api/api.h>
|
|
#include <tests/api/test_chacha.h>
|
|
|
|
/*
|
|
* Testing wc_Chacha_SetKey() and wc_Chacha_SetIV()
|
|
*/
|
|
int test_wc_Chacha_SetKey(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha ctx;
|
|
const byte key[] = {
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01
|
|
};
|
|
word32 keySz = (word32)(sizeof(key)/sizeof(byte));
|
|
byte cipher[128];
|
|
|
|
XMEMSET(cipher, 0, sizeof(cipher));
|
|
ExpectIntEQ(wc_Chacha_SetKey(&ctx, key, keySz), 0);
|
|
/* Test bad args. */
|
|
ExpectIntEQ(wc_Chacha_SetKey(NULL, key, keySz),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
ExpectIntEQ(wc_Chacha_SetKey(&ctx, key, 18), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
|
|
ExpectIntEQ(wc_Chacha_SetIV(&ctx, cipher, 0), 0);
|
|
/* Test bad args. */
|
|
ExpectIntEQ(wc_Chacha_SetIV(NULL, cipher, 0),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Chacha_SetKey */
|
|
|
|
/*
|
|
* Testing wc_Chacha_Process()
|
|
*/
|
|
int test_wc_Chacha_Process(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc, dec;
|
|
byte cipher[128];
|
|
byte plain[128];
|
|
const byte key[] =
|
|
{
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01
|
|
};
|
|
const char* input = "Everybody gets Friday off.";
|
|
word32 keySz = sizeof(key)/sizeof(byte);
|
|
unsigned long int inlen = XSTRLEN(input);
|
|
|
|
/* Initialize stack variables. */
|
|
XMEMSET(cipher, 0, 128);
|
|
XMEMSET(plain, 0, 128);
|
|
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, keySz), 0);
|
|
ExpectIntEQ(wc_Chacha_SetKey(&dec, key, keySz), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, cipher, 0), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&dec, cipher, 0), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, (byte*)input, (word32)inlen),
|
|
0);
|
|
ExpectIntEQ(wc_Chacha_Process(&dec, plain, cipher, (word32)inlen), 0);
|
|
ExpectIntEQ(XMEMCMP(input, plain, inlen), 0);
|
|
|
|
#if !defined(USE_INTEL_CHACHA_SPEEDUP) && !defined(WOLFSSL_ARMASM)
|
|
/* test checking and using leftovers, currently just in C code */
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, cipher, 0), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&dec, cipher, 0), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, (byte*)input,
|
|
(word32)inlen - 2), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher + (inlen - 2),
|
|
(byte*)input + (inlen - 2), 2), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&dec, plain, (byte*)cipher,
|
|
(word32)inlen - 2), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&dec, cipher + (inlen - 2),
|
|
(byte*)input + (inlen - 2), 2), 0);
|
|
ExpectIntEQ(XMEMCMP(input, plain, inlen), 0);
|
|
|
|
/* check edge cases with counter increment */
|
|
{
|
|
/* expected results collected from wolfSSL 4.3.0 encrypted in one call*/
|
|
const byte expected[] = {
|
|
0x54,0xB1,0xE2,0xD4,0xA2,0x4D,0x52,0x5F,
|
|
0x42,0x04,0x89,0x7C,0x6E,0x2D,0xFC,0x2D,
|
|
0x10,0x25,0xB6,0x92,0x71,0xD5,0xC3,0x20,
|
|
0xE3,0x0E,0xEC,0xF4,0xD8,0x10,0x70,0x29,
|
|
0x2D,0x4C,0x2A,0x56,0x21,0xE1,0xC7,0x37,
|
|
0x0B,0x86,0xF5,0x02,0x8C,0xB8,0xB8,0x38,
|
|
0x41,0xFD,0xDF,0xD9,0xC3,0xE6,0xC8,0x88,
|
|
0x06,0x82,0xD4,0x80,0x6A,0x50,0x69,0xD5,
|
|
0xB9,0xB0,0x2F,0x44,0x36,0x5D,0xDA,0x5E,
|
|
0xDE,0xF6,0xF5,0xFC,0x44,0xDC,0x07,0x51,
|
|
0xA7,0x32,0x42,0xDB,0xCC,0xBD,0xE2,0xE5,
|
|
0x0B,0xB1,0x14,0xFF,0x12,0x80,0x16,0x43,
|
|
0xE7,0x40,0xD5,0xEA,0xC7,0x3F,0x69,0x07,
|
|
0x64,0xD4,0x86,0x6C,0xE2,0x1F,0x8F,0x6E,
|
|
0x35,0x41,0xE7,0xD3,0xB5,0x5D,0xD6,0xD4,
|
|
0x9F,0x00,0xA9,0xAE,0x3D,0x28,0xA5,0x37,
|
|
0x80,0x3D,0x11,0x25,0xE2,0xB6,0x99,0xD9,
|
|
0x9B,0x98,0xE9,0x37,0xB9,0xF8,0xA0,0x04,
|
|
0xDF,0x13,0x49,0x3F,0x19,0x6A,0x45,0x06,
|
|
0x21,0xB4,0xC7,0x3B,0x49,0x45,0xB4,0xC8,
|
|
0x03,0x5B,0x43,0x89,0xBD,0xB3,0x96,0x4B,
|
|
0x17,0x6F,0x85,0xC6,0xCF,0xA6,0x05,0x35,
|
|
0x1E,0x25,0x03,0xBB,0x55,0x0A,0xD5,0x54,
|
|
0x41,0xEA,0xEB,0x50,0x40,0x1B,0x43,0x19,
|
|
0x59,0x1B,0x0E,0x12,0x3E,0xA2,0x71,0xC3,
|
|
0x1A,0xA7,0x11,0x50,0x43,0x9D,0x56,0x3B,
|
|
0x63,0x2F,0x63,0xF1,0x8D,0xAE,0xF3,0x23,
|
|
0xFA,0x1E,0xD8,0x6A,0xE1,0xB2,0x4B,0xF3,
|
|
0xB9,0x13,0x7A,0x72,0x2B,0x6D,0xCC,0x41,
|
|
0x1C,0x69,0x7C,0xCD,0x43,0x6F,0xE4,0xE2,
|
|
0x38,0x99,0xFB,0xC3,0x38,0x92,0x62,0x35,
|
|
0xC0,0x1D,0x60,0xE4,0x4B,0xDD,0x0C,0x14
|
|
};
|
|
const byte iv2[] = {
|
|
0x9D,0xED,0xE7,0x0F,0xEC,0x81,0x51,0xD9,
|
|
0x77,0x39,0x71,0xA6,0x21,0xDF,0xB8,0x93
|
|
};
|
|
byte input2[256];
|
|
int i;
|
|
|
|
for (i = 0; i < 256; i++)
|
|
input2[i] = (byte)i;
|
|
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, iv2, 0), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2, 64), 0);
|
|
ExpectIntEQ(XMEMCMP(expected, cipher, 64), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 64, 128), 0);
|
|
ExpectIntEQ(XMEMCMP(expected + 64, cipher, 128), 0);
|
|
|
|
/* partial */
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 192, 32), 0);
|
|
ExpectIntEQ(XMEMCMP(expected + 192, cipher, 32), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 224, 32), 0);
|
|
ExpectIntEQ(XMEMCMP(expected + 224, cipher, 32), 0);
|
|
}
|
|
#endif
|
|
|
|
/* Test bad args. */
|
|
ExpectIntEQ(wc_Chacha_Process(NULL, cipher, (byte*)input, (word32)inlen),
|
|
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Chacha_Process */
|
|
|
|
|
|
#define CHACHA_LEN 1024
|
|
/*
|
|
* Testing wc_Chacha_Process()
|
|
*/
|
|
int test_wc_Chacha_Process_Chunking(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc;
|
|
WC_DECLARE_VAR(plain, byte, CHACHA_LEN, NULL);
|
|
WC_DECLARE_VAR(cipher, byte, CHACHA_LEN, NULL);
|
|
byte key[CHACHA_MAX_KEY_SZ];
|
|
byte iv[CHACHA_IV_BYTES];
|
|
int i;
|
|
int cnt;
|
|
int sz;
|
|
const byte expected[CHACHA_LEN] = {
|
|
0xbc, 0xf5, 0x3b, 0xf2, 0x75, 0x85, 0x9e, 0x0a,
|
|
0x09, 0x58, 0x83, 0x50, 0x33, 0x12, 0x01, 0xa1,
|
|
0xb4, 0xaf, 0x8a, 0xe8, 0x4d, 0x3d, 0xa5, 0x68,
|
|
0xf7, 0x6d, 0x3e, 0xe0, 0x62, 0x7e, 0x62, 0x66,
|
|
0xdd, 0x07, 0xe9, 0x36, 0x6f, 0x4d, 0xe9, 0x7a,
|
|
0x16, 0x48, 0xa1, 0x83, 0x9e, 0x67, 0x4d, 0xa3,
|
|
0xfe, 0x7e, 0x4a, 0x31, 0xdd, 0xb6, 0x50, 0x39,
|
|
0xd2, 0x2b, 0x93, 0xf2, 0x4d, 0x51, 0x44, 0x42,
|
|
0x5d, 0xf1, 0xd9, 0x24, 0xd7, 0xef, 0x4b, 0xa4,
|
|
0xfd, 0x6a, 0x53, 0xa5, 0x1e, 0x4a, 0xc8, 0x68,
|
|
0x11, 0x69, 0xc6, 0xbd, 0xe1, 0x59, 0xe4, 0xca,
|
|
0x5b, 0xa9, 0x77, 0xfe, 0x4f, 0x82, 0x9f, 0xcf,
|
|
0x55, 0x16, 0x3c, 0xd5, 0x83, 0xee, 0xc7, 0x53,
|
|
0xaf, 0xca, 0x8a, 0xe2, 0xcf, 0xf1, 0x4b, 0x3b,
|
|
0x44, 0xf6, 0xc9, 0x6c, 0x5b, 0xd3, 0x28, 0x8a,
|
|
0x7e, 0x67, 0xaa, 0x9e, 0xad, 0xce, 0x96, 0xc4,
|
|
0x6e, 0x95, 0x8c, 0xf8, 0xf6, 0xb6, 0x42, 0x8e,
|
|
0xe7, 0xab, 0xc8, 0x2c, 0x66, 0x8b, 0x80, 0xcf,
|
|
0x78, 0xfe, 0x35, 0x8b, 0x59, 0x18, 0x45, 0xcb,
|
|
0x18, 0xd4, 0x09, 0x88, 0xa9, 0xf9, 0x27, 0xd1,
|
|
0x3b, 0x9d, 0x2b, 0xff, 0x89, 0x21, 0xb0, 0xd2,
|
|
0xa7, 0x7e, 0x35, 0x61, 0xae, 0x1c, 0xc3, 0x1c,
|
|
0x07, 0x5c, 0x10, 0x5d, 0x71, 0x3a, 0x3a, 0xe8,
|
|
0x4c, 0xba, 0x00, 0xde, 0xd1, 0xf9, 0xa1, 0xae,
|
|
0x7b, 0x91, 0x9d, 0x66, 0x31, 0x18, 0x55, 0x39,
|
|
0xec, 0x1d, 0x83, 0x85, 0x1e, 0x5b, 0x35, 0x17,
|
|
0x2e, 0xbc, 0x7a, 0x22, 0x79, 0x09, 0xa7, 0x02,
|
|
0xf7, 0x3b, 0x93, 0x2c, 0x89, 0x1b, 0x69, 0xde,
|
|
0x80, 0xc8, 0xdf, 0xce, 0xf9, 0xcd, 0xc8, 0x58,
|
|
0xd6, 0x4b, 0x65, 0x9a, 0xc4, 0x4f, 0x27, 0xdb,
|
|
0x9a, 0x6c, 0x3a, 0xef, 0x20, 0x0b, 0x00, 0x5c,
|
|
0x9f, 0x91, 0xc1, 0xf6, 0x80, 0x53, 0x6c, 0x42,
|
|
0xe3, 0xd0, 0xfb, 0x3b, 0x23, 0x75, 0x45, 0xa7,
|
|
0x5b, 0x9b, 0xaa, 0xcd, 0x1e, 0x03, 0x35, 0x68,
|
|
0x17, 0xee, 0xff, 0xd7, 0x4f, 0x77, 0x2f, 0xd0,
|
|
0x1d, 0x5e, 0x89, 0x16, 0x50, 0x6f, 0x22, 0x44,
|
|
0x10, 0x64, 0x37, 0x66, 0x70, 0x7f, 0x4d, 0x58,
|
|
0x36, 0xec, 0x56, 0x4e, 0xfd, 0x22, 0x8d, 0x77,
|
|
0xb1, 0x37, 0x07, 0x13, 0xdf, 0x34, 0x40, 0x1c,
|
|
0x65, 0x95, 0x9b, 0xb9, 0xac, 0x11, 0xfe, 0x7a,
|
|
0xae, 0x1f, 0x17, 0x94, 0xd4, 0xdd, 0x5b, 0x4f,
|
|
0x69, 0xa8, 0x04, 0x8e, 0x80, 0x87, 0x7d, 0x96,
|
|
0x25, 0x37, 0x83, 0x0e, 0xca, 0xa4, 0xb3, 0x29,
|
|
0x2f, 0x4b, 0x83, 0xa4, 0x01, 0x36, 0x0d, 0xdb,
|
|
0xd7, 0x6e, 0x7a, 0x9c, 0x3e, 0x82, 0xc8, 0x5f,
|
|
0x4e, 0xc6, 0xd2, 0x97, 0x64, 0xe6, 0xd9, 0x50,
|
|
0x89, 0xcb, 0x64, 0x33, 0x28, 0x9c, 0x14, 0xf9,
|
|
0x41, 0x33, 0x99, 0x0c, 0x87, 0x6f, 0x00, 0x3f,
|
|
0x00, 0x6f, 0xae, 0xe9, 0x20, 0xc2, 0xcd, 0xb8,
|
|
0x7a, 0x58, 0xde, 0x57, 0x34, 0xda, 0x63, 0xa1,
|
|
0x0b, 0x55, 0xfc, 0x54, 0x2a, 0xed, 0xc0, 0xbc,
|
|
0x29, 0x5f, 0x88, 0x7d, 0x37, 0x3b, 0x48, 0x86,
|
|
0x3f, 0x88, 0xa2, 0xef, 0x55, 0xe6, 0xc4, 0xf8,
|
|
0xb8, 0x11, 0x9e, 0x3a, 0x45, 0x79, 0xac, 0x85,
|
|
0xb2, 0x70, 0x40, 0xd0, 0x66, 0xe7, 0x66, 0xc8,
|
|
0x8e, 0x8f, 0xde, 0xde, 0xf8, 0x50, 0x79, 0x9e,
|
|
0x37, 0x04, 0x07, 0x83, 0x5b, 0xe0, 0x68, 0x5b,
|
|
0x32, 0xbc, 0x6e, 0x50, 0x05, 0xca, 0xf8, 0x3b,
|
|
0xec, 0x15, 0x13, 0xf8, 0x9a, 0xa2, 0x58, 0x98,
|
|
0x03, 0x29, 0x83, 0x7f, 0x11, 0xb4, 0x98, 0x41,
|
|
0xc1, 0xd9, 0x02, 0x6e, 0x2c, 0x45, 0x55, 0xab,
|
|
0xff, 0xcf, 0x23, 0x80, 0xf0, 0x82, 0x73, 0xe9,
|
|
0xe6, 0x8f, 0x1a, 0xd9, 0x70, 0xd6, 0x46, 0x1f,
|
|
0xa8, 0xf8, 0xbd, 0x14, 0xd9, 0x50, 0x59, 0x8e,
|
|
0x46, 0xbf, 0xe2, 0x8a, 0x8e, 0xce, 0xe7, 0x81,
|
|
0xf4, 0x3a, 0xd9, 0x07, 0xd8, 0x1d, 0x29, 0x19,
|
|
0xc1, 0x9d, 0xac, 0x6f, 0xfb, 0xce, 0x95, 0x03,
|
|
0x29, 0xce, 0x4a, 0x60, 0x34, 0x6a, 0x88, 0xc7,
|
|
0x5e, 0x8c, 0x71, 0x29, 0x81, 0x64, 0x2f, 0xfb,
|
|
0xb4, 0x20, 0x08, 0x57, 0xba, 0x50, 0x75, 0x7b,
|
|
0x1e, 0xfa, 0xcc, 0x60, 0xe7, 0x09, 0xab, 0x4e,
|
|
0x46, 0x64, 0xfe, 0x17, 0x00, 0x84, 0x8b, 0xca,
|
|
0xa8, 0xcb, 0x18, 0x5b, 0xa2, 0x04, 0x13, 0x68,
|
|
0x99, 0x02, 0xaf, 0xcb, 0x75, 0xcb, 0x46, 0x61,
|
|
0x66, 0x05, 0xd9, 0x5c, 0x6d, 0x8c, 0xf9, 0x8a,
|
|
0x57, 0xde, 0xf4, 0xb9, 0x5d, 0x51, 0x17, 0x4a,
|
|
0x8c, 0x42, 0xca, 0x0d, 0x7f, 0x92, 0x69, 0x0d,
|
|
0x88, 0x2b, 0xc6, 0xee, 0xbd, 0x5a, 0x32, 0x17,
|
|
0x84, 0xef, 0xf9, 0xd9, 0x51, 0x33, 0x57, 0x2f,
|
|
0x87, 0xf8, 0xda, 0x3c, 0x3c, 0x14, 0xa9, 0x26,
|
|
0xad, 0x19, 0xfd, 0x14, 0x5e, 0x33, 0x92, 0xb1,
|
|
0xe1, 0xd7, 0xfb, 0x1e, 0x55, 0x40, 0xe5, 0x80,
|
|
0x9b, 0x8e, 0x4b, 0x88, 0x58, 0x77, 0xa9, 0xd2,
|
|
0xbf, 0x40, 0x90, 0xbe, 0x8f, 0x1f, 0xa7, 0x8a,
|
|
0xaf, 0x8e, 0x03, 0x93, 0x4d, 0x8a, 0x73, 0x8e,
|
|
0x76, 0x67, 0x43, 0x37, 0xc1, 0x76, 0x87, 0x50,
|
|
0x37, 0xc4, 0x02, 0x4a, 0x53, 0x1a, 0x5b, 0xe8,
|
|
0x5f, 0xc8, 0x28, 0xad, 0xd3, 0x8a, 0x97, 0x53,
|
|
0xa3, 0xf6, 0x48, 0xba, 0x05, 0x18, 0x56, 0x90,
|
|
0xa9, 0x95, 0xd8, 0xac, 0xe9, 0xd5, 0x6c, 0xe3,
|
|
0x1f, 0xd8, 0xfc, 0xc5, 0x27, 0x19, 0xab, 0x4a,
|
|
0xc4, 0x36, 0xc9, 0xe9, 0xaa, 0x30, 0xef, 0x8e,
|
|
0x9e, 0x01, 0x18, 0x68, 0xe9, 0x06, 0xf8, 0x54,
|
|
0xe5, 0xe2, 0xec, 0xde, 0x52, 0xfc, 0x3b, 0xdd,
|
|
0xe9, 0xc7, 0xc8, 0x2b, 0x93, 0xd4, 0xdb, 0x28,
|
|
0x72, 0x06, 0x07, 0xd1, 0xba, 0x05, 0x23, 0xa6,
|
|
0x41, 0x42, 0x55, 0x6a, 0x6e, 0x6f, 0x6c, 0x40,
|
|
0x6a, 0x19, 0xa4, 0xd5, 0xa2, 0x11, 0xb5, 0x2b,
|
|
0x16, 0x4a, 0xe3, 0x41, 0xf3, 0xaf, 0x93, 0xbd,
|
|
0xc8, 0xd9, 0x26, 0x43, 0x71, 0x56, 0xd2, 0x5e,
|
|
0xf5, 0xa8, 0x3c, 0x64, 0x83, 0x04, 0x89, 0x62,
|
|
0x20, 0xd3, 0xe9, 0x8e, 0x60, 0xcd, 0xec, 0xd9,
|
|
0xce, 0x89, 0xf0, 0x5c, 0xf2, 0x26, 0x72, 0x51,
|
|
0xd5, 0x16, 0x7b, 0xef, 0x19, 0x10, 0xb4, 0xce,
|
|
0x60, 0x47, 0xab, 0x98, 0x86, 0xbd, 0x39, 0xb7,
|
|
0xc9, 0x29, 0x38, 0x1a, 0xc1, 0x5c, 0xab, 0x77,
|
|
0xea, 0xe9, 0xf4, 0x7f, 0x6a, 0x06, 0xf7, 0xc0,
|
|
0x0b, 0x17, 0x1f, 0x2f, 0xce, 0x07, 0x1b, 0x33,
|
|
0x68, 0x4d, 0x64, 0x6a, 0x28, 0x6d, 0x1d, 0xc6,
|
|
0x54, 0x5c, 0xa2, 0x69, 0xf9, 0xb4, 0x62, 0xc9,
|
|
0x71, 0xf5, 0xd1, 0xb7, 0x7b, 0x02, 0x81, 0x6d,
|
|
0x4b, 0x1f, 0x62, 0xc5, 0xce, 0x2e, 0xc6, 0x2a,
|
|
0x1d, 0x6f, 0xc7, 0xc1, 0x99, 0x48, 0x7b, 0xc7,
|
|
0xf3, 0x53, 0xb7, 0x02, 0x7f, 0x82, 0xda, 0xfa,
|
|
0xce, 0xd3, 0x54, 0xf8, 0x9b, 0x30, 0x6f, 0xed,
|
|
0x6c, 0xec, 0x1c, 0x21, 0x49, 0x04, 0x51, 0xae,
|
|
0xd0, 0x3f, 0xb1, 0xfb, 0x78, 0x1a, 0x6f, 0x35,
|
|
0xc8, 0x3f, 0x4c, 0x43, 0x71, 0xe9, 0xb8, 0xd7,
|
|
0x74, 0xca, 0x46, 0x68, 0xeb, 0xd9, 0xa3, 0x94,
|
|
0x6e, 0x9d, 0xea, 0x57, 0x22, 0x1e, 0x15, 0x27,
|
|
0x40, 0xd4, 0x0c, 0x32, 0x40, 0xc0, 0x40, 0x8a,
|
|
0x1e, 0x2e, 0x1a, 0x58, 0x84, 0xa0, 0xc3, 0x68,
|
|
0x96, 0xfe, 0xb0, 0x96, 0x6c, 0x04, 0x61, 0x35,
|
|
0x4a, 0x78, 0xc5, 0xeb, 0x50, 0xca, 0xcb, 0x22,
|
|
0x7b, 0x53, 0x02, 0xfa, 0x63, 0x28, 0x10, 0x68,
|
|
0x77, 0xab, 0xda, 0x7d, 0xd1, 0xc2, 0x3f, 0x95,
|
|
0xa6, 0x5a, 0x92, 0x56, 0xb3, 0xb0, 0x29, 0x7e,
|
|
0x0c, 0xb3, 0xc9, 0x39, 0x0f, 0x1f, 0x51, 0x9d
|
|
};
|
|
|
|
WC_ALLOC_VAR_EX(plain, byte, CHACHA_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER,
|
|
ExpectNotNull(plain); goto cleanup);
|
|
WC_ALLOC_VAR_EX(cipher, byte, CHACHA_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER,
|
|
ExpectNotNull(cipher); goto cleanup);
|
|
|
|
XMEMSET(plain, 0xa5, CHACHA_LEN);
|
|
for (i = 0; i < (int)sizeof(key); i++) {
|
|
key[i] = (byte)i;
|
|
}
|
|
for (i = 0; i < (int)sizeof(iv); i++) {
|
|
iv[i] = (byte)(i + 0x40);
|
|
}
|
|
|
|
for (sz = 1; sz < CHACHA_LEN; sz++) {
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, (word32)sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, iv, 0), 0);
|
|
|
|
for (cnt = 0; cnt + sz <= CHACHA_LEN; cnt += sz) {
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher + cnt, plain + cnt, sz),
|
|
0);
|
|
}
|
|
if (cnt < CHACHA_LEN) {
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher + cnt, plain + cnt,
|
|
CHACHA_LEN - cnt), 0);
|
|
}
|
|
ExpectBufEQ(cipher, expected, (int)sizeof(expected));
|
|
}
|
|
|
|
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
|
|
cleanup:
|
|
#endif
|
|
WC_FREE_VAR_EX(plain, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
|
WC_FREE_VAR_EX(cipher, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Chacha_Process */
|
|
|
|
|
|
|
|
#include <wolfssl/wolfcrypt/random.h>
|
|
|
|
#define MC_CIPHER_TEST_COUNT 100
|
|
#define MC_CHACHA_MAX_DATA_SZ 1024
|
|
|
|
/* Monte Carlo test for ChaCha20: random key, IV, and plaintext each
|
|
* iteration */
|
|
int test_wc_Chacha_MonteCarlo(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc, dec;
|
|
WC_RNG rng;
|
|
byte key[CHACHA_MAX_KEY_SZ];
|
|
byte nonce[CHACHA_IV_BYTES];
|
|
word32 plainLen = 0;
|
|
int i;
|
|
WC_DECLARE_VAR(plain, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
WC_DECLARE_VAR(cipher, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
WC_DECLARE_VAR(decrypted, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
|
|
WC_ALLOC_VAR(plain, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
WC_ALLOC_VAR(cipher, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
WC_ALLOC_VAR(decrypted, byte, MC_CHACHA_MAX_DATA_SZ, NULL);
|
|
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
|
|
ExpectNotNull(plain);
|
|
ExpectNotNull(cipher);
|
|
ExpectNotNull(decrypted);
|
|
#endif
|
|
|
|
XMEMSET(&enc, 0, sizeof(enc));
|
|
XMEMSET(&dec, 0, sizeof(dec));
|
|
XMEMSET(&rng, 0, sizeof(rng));
|
|
|
|
ExpectIntEQ(wc_InitRng(&rng), 0);
|
|
|
|
for (i = 0; i < MC_CIPHER_TEST_COUNT && EXPECT_SUCCESS(); i++) {
|
|
ExpectIntEQ(wc_RNG_GenerateBlock(&rng, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_RNG_GenerateBlock(&rng, nonce, sizeof(nonce)), 0);
|
|
ExpectIntEQ(wc_RNG_GenerateBlock(&rng, (byte*)&plainLen,
|
|
sizeof(plainLen)), 0);
|
|
plainLen = (plainLen % MC_CHACHA_MAX_DATA_SZ) + 1;
|
|
ExpectIntEQ(wc_RNG_GenerateBlock(&rng, plain, plainLen), 0);
|
|
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetKey(&dec, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&dec, nonce, 0), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher, plain, plainLen), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&dec, decrypted, cipher, plainLen), 0);
|
|
ExpectBufEQ(decrypted, plain, plainLen);
|
|
}
|
|
|
|
wc_FreeRng(&rng);
|
|
WC_FREE_VAR(plain, NULL);
|
|
WC_FREE_VAR(cipher, NULL);
|
|
WC_FREE_VAR(decrypted, NULL);
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
}
|
|
|
|
/*******************************************************************************
|
|
* ChaCha20 counter overflow
|
|
******************************************************************************/
|
|
|
|
/*
|
|
* Verify that the ChaCha20 block counter (X[12], a 32-bit value) wraps
|
|
* correctly from 0xFFFFFFFF back to 0x00000000.
|
|
*
|
|
* We set the counter to 0xFFFFFFFF and encrypt 65 bytes in a single call,
|
|
* which requires two 64-byte key-stream blocks. We then re-encrypt the same
|
|
* data as two separate calls - 64 bytes at counter=0xFFFFFFFF and 1 byte at
|
|
* counter=0x00000000 - and confirm the outputs match.
|
|
*/
|
|
int test_wc_Chacha_CounterOverflow(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc;
|
|
static const byte key[CHACHA_MAX_KEY_SZ] = {
|
|
0x00,0x01,0x02,0x03, 0x04,0x05,0x06,0x07,
|
|
0x08,0x09,0x0a,0x0b, 0x0c,0x0d,0x0e,0x0f,
|
|
0x10,0x11,0x12,0x13, 0x14,0x15,0x16,0x17,
|
|
0x18,0x19,0x1a,0x1b, 0x1c,0x1d,0x1e,0x1f
|
|
};
|
|
static const byte nonce[CHACHA_IV_BYTES] = {
|
|
0x00,0x00,0x00,0x09, 0x00,0x00,0x00,0x4a, 0x00,0x00,0x00,0x00
|
|
};
|
|
/* 65 bytes of zeroed plaintext - easy to verify, no KAT needed. */
|
|
static const byte plain[65] = { 0 };
|
|
/* combined: single call spanning the 0xFFFFFFFF->0x00000000 boundary */
|
|
byte cipher_combined[65];
|
|
/* per-block: block at counter=0xFFFFFFFF (64 bytes) */
|
|
byte cipher_b0[64];
|
|
/* per-block: first byte of block at counter=0x00000000 (1 byte) */
|
|
byte cipher_b1[1];
|
|
|
|
XMEMSET(&enc, 0, sizeof(enc));
|
|
|
|
/* Encrypt 65 bytes in one shot, starting at counter 0xFFFFFFFF. */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0xFFFFFFFFUL), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher_combined, plain, 65), 0);
|
|
|
|
/* First 64 bytes: key-stream block at counter 0xFFFFFFFF. */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0xFFFFFFFFUL), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher_b0, plain, 64), 0);
|
|
|
|
/* Byte 65: first byte of key-stream block at counter 0x00000000. */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0x00000000UL), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, cipher_b1, plain + 64, 1), 0);
|
|
|
|
/* Combined output must match per-block results. */
|
|
ExpectBufEQ(cipher_combined, cipher_b0, 64);
|
|
ExpectBufEQ(cipher_combined + 64, cipher_b1, 1);
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
}
|
|
|
|
/*
|
|
* Verify that wc_Chacha_Process works correctly when the output buffer is the
|
|
* same as the input buffer (in-place operation). ChaCha20 XORs the keystream
|
|
* onto the input byte-by-byte, so in == out is always safe.
|
|
*/
|
|
int test_wc_Chacha_InPlace(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc;
|
|
static const byte key[CHACHA_MAX_KEY_SZ] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x01
|
|
};
|
|
static const byte nonce[CHACHA_IV_BYTES] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x02
|
|
};
|
|
/* 67 bytes: spans one full block (64) plus a partial block tail */
|
|
static const byte plain[67] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00
|
|
};
|
|
byte ref_ct[sizeof(plain)];
|
|
byte buf[sizeof(plain)];
|
|
|
|
XMEMSET(&enc, 0, sizeof(enc));
|
|
|
|
/* Reference ciphertext with separate in/out buffers */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, ref_ct, plain, sizeof(plain)), 0);
|
|
|
|
/* Encrypt in-place (out == in) - must produce the same ciphertext */
|
|
XMEMCPY(buf, plain, sizeof(buf));
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, buf, buf, sizeof(buf)), 0);
|
|
ExpectBufEQ(buf, ref_ct, sizeof(buf));
|
|
|
|
/* Decrypt in-place (ChaCha20 is symmetric - apply keystream again) */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, buf, buf, sizeof(buf)), 0);
|
|
ExpectBufEQ(buf, plain, sizeof(buf));
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Chacha_InPlace */
|
|
|
|
/*
|
|
* Verify that wc_Chacha_Process produces correct results when both the input
|
|
* and output buffers are byte-offset (unaligned). Tests offsets 1, 2, and 3.
|
|
* A 67-byte plaintext is used (same as InPlace) to exercise both full-block
|
|
* and partial-block tail paths.
|
|
*/
|
|
int test_wc_Chacha_UnalignedBuffers(void)
|
|
{
|
|
EXPECT_DECLS;
|
|
#ifdef HAVE_CHACHA
|
|
ChaCha enc;
|
|
static const byte key[CHACHA_MAX_KEY_SZ] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x01
|
|
};
|
|
static const byte nonce[CHACHA_IV_BYTES] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x02
|
|
};
|
|
static const byte plain[67] = {
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
|
|
0x00,0x00,0x00
|
|
};
|
|
byte ref_ct[sizeof(plain)];
|
|
byte in_buf[sizeof(plain) + 3], out_buf[sizeof(plain) + 3];
|
|
int off;
|
|
|
|
XMEMSET(&enc, 0, sizeof(enc));
|
|
|
|
/* Reference ciphertext with naturally-aligned buffers */
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, ref_ct, plain, sizeof(plain)), 0);
|
|
|
|
/* Encrypt with byte offsets 1, 2, 3 on both in and out */
|
|
for (off = 1; off <= 3 && EXPECT_SUCCESS(); off++) {
|
|
XMEMCPY(in_buf + off, plain, sizeof(plain));
|
|
XMEMSET(out_buf, 0, sizeof(out_buf));
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, out_buf + off, in_buf + off,
|
|
sizeof(plain)), 0);
|
|
ExpectBufEQ(out_buf + off, ref_ct, sizeof(plain));
|
|
}
|
|
|
|
/* Decrypt (ChaCha20 is symmetric) */
|
|
for (off = 1; off <= 3 && EXPECT_SUCCESS(); off++) {
|
|
XMEMCPY(in_buf + off, ref_ct, sizeof(plain));
|
|
XMEMSET(out_buf, 0, sizeof(out_buf));
|
|
ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0);
|
|
ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0);
|
|
ExpectIntEQ(wc_Chacha_Process(&enc, out_buf + off, in_buf + off,
|
|
sizeof(plain)), 0);
|
|
ExpectBufEQ(out_buf + off, plain, sizeof(plain));
|
|
}
|
|
#endif
|
|
return EXPECT_RESULT();
|
|
} /* END test_wc_Chacha_UnalignedBuffers */
|