Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Utilities for constant-time cryptography. |
| 3 | * |
| 4 | * Author: Emilia Kasper (emilia@openssl.org) |
| 5 | * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley |
| 6 | * (Google). |
| 7 | * ==================================================================== |
| 8 | * Copyright (c) 2014 The OpenSSL Project. All rights reserved. |
| 9 | * |
| 10 | * Redistribution and use in source and binary forms, with or without |
| 11 | * modification, are permitted provided that the following conditions |
| 12 | * are met: |
| 13 | * 1. Redistributions of source code must retain the copyright |
| 14 | * notice, this list of conditions and the following disclaimer. |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in the |
| 17 | * documentation and/or other materials provided with the distribution. |
| 18 | * 3. All advertising materials mentioning features or use of this software |
| 19 | * must display the following acknowledgement: |
| 20 | * "This product includes cryptographic software written by |
| 21 | * Eric Young (eay@cryptsoft.com)" |
| 22 | * The word 'cryptographic' can be left out if the rouines from the library |
| 23 | * being used are not cryptographic related :-). |
| 24 | * 4. If you include any Windows specific code (or a derivative thereof) from |
| 25 | * the apps directory (application code) you must include an acknowledgement: |
| 26 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| 27 | * |
| 28 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| 29 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 30 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 31 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| 32 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 33 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 34 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 35 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 36 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 37 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 38 | * SUCH DAMAGE. |
| 39 | * |
| 40 | * The licence and distribution terms for any publically available version or |
| 41 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
| 42 | * copied and put under another distribution licence |
| 43 | * [including the GNU Public Licence.] |
| 44 | */ |
| 45 | |
| 46 | #include "internal.h" |
| 47 | |
| 48 | #include <limits.h> |
| 49 | #include <stdio.h> |
| 50 | #include <stdlib.h> |
| 51 | |
Robert Sloan | 6f79a50 | 2017-04-03 09:16:40 -0700 | [diff] [blame] | 52 | #include <limits> |
| 53 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 54 | #include <gtest/gtest.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 55 | |
Robert Sloan | 49d063b | 2018-04-03 11:30:38 -0700 | [diff] [blame] | 56 | #include <openssl/mem.h> |
| 57 | #include <openssl/rand.h> |
| 58 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 59 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 60 | static uint8_t FromBool8(bool b) { |
| 61 | return b ? CONSTTIME_TRUE_8 : CONSTTIME_FALSE_8; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 62 | } |
| 63 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 64 | static crypto_word_t FromBoolW(bool b) { |
| 65 | return b ? CONSTTIME_TRUE_W : CONSTTIME_FALSE_W; |
Robert Sloan | 6f79a50 | 2017-04-03 09:16:40 -0700 | [diff] [blame] | 66 | } |
| 67 | |
| 68 | static const uint8_t test_values_8[] = {0, 1, 2, 20, 32, 127, 128, 129, 255}; |
| 69 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 70 | static crypto_word_t test_values_w[] = { |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 71 | 0, |
| 72 | 1, |
| 73 | 1024, |
| 74 | 12345, |
| 75 | 32000, |
Robert Sloan | 6f79a50 | 2017-04-03 09:16:40 -0700 | [diff] [blame] | 76 | #if defined(OPENSSL_64_BIT) |
| 77 | 0xffffffff / 2 - 1, |
| 78 | 0xffffffff / 2, |
| 79 | 0xffffffff / 2 + 1, |
| 80 | 0xffffffff - 1, |
| 81 | 0xffffffff, |
| 82 | #endif |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 83 | std::numeric_limits<crypto_word_t>::max() / 2 - 1, |
| 84 | std::numeric_limits<crypto_word_t>::max() / 2, |
| 85 | std::numeric_limits<crypto_word_t>::max() / 2 + 1, |
| 86 | std::numeric_limits<crypto_word_t>::max() - 1, |
| 87 | std::numeric_limits<crypto_word_t>::max(), |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 88 | }; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 89 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 90 | static int signed_test_values[] = { |
| 91 | 0, 1, -1, 1024, -1024, 12345, -12345, |
| 92 | 32000, -32000, INT_MAX, INT_MIN, INT_MAX - 1, INT_MIN + 1}; |
| 93 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 94 | TEST(ConstantTimeTest, Test) { |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 95 | for (crypto_word_t a : test_values_w) { |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 96 | SCOPED_TRACE(a); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 97 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 98 | EXPECT_EQ(FromBoolW(a == 0), constant_time_is_zero_w(a)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 99 | EXPECT_EQ(FromBool8(a == 0), constant_time_is_zero_8(a)); |
| 100 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 101 | for (crypto_word_t b : test_values_w) { |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 102 | SCOPED_TRACE(b); |
| 103 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 104 | EXPECT_EQ(FromBoolW(a < b), constant_time_lt_w(a, b)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 105 | EXPECT_EQ(FromBool8(a < b), constant_time_lt_8(a, b)); |
| 106 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 107 | EXPECT_EQ(FromBoolW(a >= b), constant_time_ge_w(a, b)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 108 | EXPECT_EQ(FromBool8(a >= b), constant_time_ge_8(a, b)); |
| 109 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 110 | EXPECT_EQ(FromBoolW(a == b), constant_time_eq_w(a, b)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 111 | EXPECT_EQ(FromBool8(a == b), constant_time_eq_8(a, b)); |
| 112 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 113 | EXPECT_EQ(a, constant_time_select_w(CONSTTIME_TRUE_W, a, b)); |
| 114 | EXPECT_EQ(b, constant_time_select_w(CONSTTIME_FALSE_W, a, b)); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 115 | } |
| 116 | } |
| 117 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 118 | for (int a : signed_test_values) { |
| 119 | SCOPED_TRACE(a); |
| 120 | for (int b : signed_test_values) { |
| 121 | SCOPED_TRACE(b); |
| 122 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 123 | EXPECT_EQ(a, constant_time_select_int(CONSTTIME_TRUE_W, a, b)); |
| 124 | EXPECT_EQ(b, constant_time_select_int(CONSTTIME_FALSE_W, a, b)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 125 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 126 | EXPECT_EQ(FromBoolW(a == b), constant_time_eq_int(a, b)); |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 127 | EXPECT_EQ(FromBool8(a == b), constant_time_eq_int_8(a, b)); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 128 | } |
| 129 | } |
| 130 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 131 | for (uint8_t a : test_values_8) { |
| 132 | SCOPED_TRACE(static_cast<int>(a)); |
| 133 | for (uint8_t b : test_values_8) { |
| 134 | SCOPED_TRACE(static_cast<int>(b)); |
| 135 | EXPECT_EQ(a, constant_time_select_8(CONSTTIME_TRUE_8, a, b)); |
| 136 | EXPECT_EQ(b, constant_time_select_8(CONSTTIME_FALSE_8, a, b)); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 137 | } |
| 138 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 139 | } |
Robert Sloan | 49d063b | 2018-04-03 11:30:38 -0700 | [diff] [blame] | 140 | |
| 141 | TEST(ConstantTimeTest, MemCmp) { |
| 142 | uint8_t buf[256], copy[256]; |
| 143 | RAND_bytes(buf, sizeof(buf)); |
| 144 | |
| 145 | OPENSSL_memcpy(copy, buf, sizeof(buf)); |
| 146 | EXPECT_EQ(0, CRYPTO_memcmp(buf, copy, sizeof(buf))); |
| 147 | |
| 148 | for (size_t i = 0; i < sizeof(buf); i++) { |
| 149 | for (uint8_t bit = 1; bit != 0; bit <<= 1) { |
| 150 | OPENSSL_memcpy(copy, buf, sizeof(buf)); |
| 151 | copy[i] ^= bit; |
| 152 | EXPECT_NE(0, CRYPTO_memcmp(buf, copy, sizeof(buf))); |
| 153 | } |
| 154 | } |
| 155 | } |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 156 | |
| 157 | TEST(ConstantTimeTest, ValueBarrier) { |
| 158 | for (int i = 0; i < 10; i++) { |
| 159 | crypto_word_t word; |
| 160 | RAND_bytes(reinterpret_cast<uint8_t *>(&word), sizeof(word)); |
| 161 | EXPECT_EQ(word, value_barrier_w(word)); |
| 162 | |
| 163 | uint32_t u32; |
| 164 | RAND_bytes(reinterpret_cast<uint8_t *>(&u32), sizeof(u32)); |
| 165 | EXPECT_EQ(u32, value_barrier_u32(u32)); |
| 166 | |
| 167 | uint64_t u64; |
| 168 | RAND_bytes(reinterpret_cast<uint8_t *>(&u64), sizeof(u64)); |
| 169 | EXPECT_EQ(u64, value_barrier_u64(u64)); |
| 170 | } |
| 171 | } |