Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL |
| 3 | * project. |
| 4 | */ |
| 5 | /* ==================================================================== |
| 6 | * Copyright (c) 2015 The OpenSSL Project. All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * |
| 12 | * 1. Redistributions of source code must retain the above copyright |
| 13 | * notice, this list of conditions and the following disclaimer. |
| 14 | * |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in |
| 17 | * the documentation and/or other materials provided with the |
| 18 | * distribution. |
| 19 | * |
| 20 | * 3. All advertising materials mentioning features or use of this |
| 21 | * software must display the following acknowledgment: |
| 22 | * "This product includes software developed by the OpenSSL Project |
| 23 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" |
| 24 | * |
| 25 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| 26 | * endorse or promote products derived from this software without |
| 27 | * prior written permission. For written permission, please contact |
| 28 | * licensing@OpenSSL.org. |
| 29 | * |
| 30 | * 5. Products derived from this software may not be called "OpenSSL" |
| 31 | * nor may "OpenSSL" appear in their names without prior written |
| 32 | * permission of the OpenSSL Project. |
| 33 | * |
| 34 | * 6. Redistributions of any form whatsoever must retain the following |
| 35 | * acknowledgment: |
| 36 | * "This product includes software developed by the OpenSSL Project |
| 37 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" |
| 38 | * |
| 39 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| 40 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 41 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| 42 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| 43 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 44 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 45 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 46 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 47 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| 48 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 49 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| 50 | * OF THE POSSIBILITY OF SUCH DAMAGE. |
| 51 | * ==================================================================== |
| 52 | */ |
| 53 | |
| 54 | #include <stdlib.h> |
| 55 | #include <string.h> |
| 56 | |
| 57 | #include <string> |
| 58 | #include <vector> |
| 59 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 60 | #include <gtest/gtest.h> |
| 61 | |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 62 | #include <openssl/cipher.h> |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 63 | #include <openssl/err.h> |
| 64 | |
| 65 | #include "../test/file_test.h" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 66 | #include "../test/test_util.h" |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 67 | |
| 68 | |
| 69 | static const EVP_CIPHER *GetCipher(const std::string &name) { |
| 70 | if (name == "DES-CBC") { |
| 71 | return EVP_des_cbc(); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 72 | } else if (name == "DES-ECB") { |
| 73 | return EVP_des_ecb(); |
| 74 | } else if (name == "DES-EDE") { |
| 75 | return EVP_des_ede(); |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 76 | } else if (name == "DES-EDE3") { |
| 77 | return EVP_des_ede3(); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 78 | } else if (name == "DES-EDE-CBC") { |
| 79 | return EVP_des_ede_cbc(); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 80 | } else if (name == "DES-EDE3-CBC") { |
| 81 | return EVP_des_ede3_cbc(); |
| 82 | } else if (name == "RC4") { |
| 83 | return EVP_rc4(); |
| 84 | } else if (name == "AES-128-ECB") { |
| 85 | return EVP_aes_128_ecb(); |
| 86 | } else if (name == "AES-256-ECB") { |
| 87 | return EVP_aes_256_ecb(); |
| 88 | } else if (name == "AES-128-CBC") { |
| 89 | return EVP_aes_128_cbc(); |
| 90 | } else if (name == "AES-128-GCM") { |
| 91 | return EVP_aes_128_gcm(); |
| 92 | } else if (name == "AES-128-OFB") { |
| 93 | return EVP_aes_128_ofb(); |
| 94 | } else if (name == "AES-192-CBC") { |
| 95 | return EVP_aes_192_cbc(); |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 96 | } else if (name == "AES-192-CTR") { |
| 97 | return EVP_aes_192_ctr(); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 98 | } else if (name == "AES-192-ECB") { |
| 99 | return EVP_aes_192_ecb(); |
| 100 | } else if (name == "AES-256-CBC") { |
| 101 | return EVP_aes_256_cbc(); |
| 102 | } else if (name == "AES-128-CTR") { |
| 103 | return EVP_aes_128_ctr(); |
| 104 | } else if (name == "AES-256-CTR") { |
| 105 | return EVP_aes_256_ctr(); |
| 106 | } else if (name == "AES-256-GCM") { |
| 107 | return EVP_aes_256_gcm(); |
| 108 | } else if (name == "AES-256-OFB") { |
| 109 | return EVP_aes_256_ofb(); |
| 110 | } |
| 111 | return nullptr; |
| 112 | } |
| 113 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 114 | static void TestOperation(FileTest *t, const EVP_CIPHER *cipher, bool encrypt, |
| 115 | size_t chunk_size, const std::vector<uint8_t> &key, |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 116 | const std::vector<uint8_t> &iv, |
| 117 | const std::vector<uint8_t> &plaintext, |
| 118 | const std::vector<uint8_t> &ciphertext, |
| 119 | const std::vector<uint8_t> &aad, |
| 120 | const std::vector<uint8_t> &tag) { |
| 121 | const std::vector<uint8_t> *in, *out; |
| 122 | if (encrypt) { |
| 123 | in = &plaintext; |
| 124 | out = &ciphertext; |
| 125 | } else { |
| 126 | in = &ciphertext; |
| 127 | out = &plaintext; |
| 128 | } |
| 129 | |
| 130 | bool is_aead = EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE; |
| 131 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 132 | bssl::ScopedEVP_CIPHER_CTX ctx; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 133 | ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, nullptr, nullptr, nullptr, |
| 134 | encrypt ? 1 : 0)); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 135 | if (t->HasAttribute("IV")) { |
| 136 | if (is_aead) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 137 | ASSERT_TRUE( |
| 138 | EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_IVLEN, iv.size(), 0)); |
| 139 | } else { |
| 140 | ASSERT_EQ(iv.size(), EVP_CIPHER_CTX_iv_length(ctx.get())); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 141 | } |
| 142 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 143 | if (is_aead && !encrypt) { |
| 144 | ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_TAG, tag.size(), |
| 145 | const_cast<uint8_t *>(tag.data()))); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 146 | } |
| 147 | // The ciphers are run with no padding. For each of the ciphers we test, the |
| 148 | // output size matches the input size. |
| 149 | std::vector<uint8_t> result(in->size()); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 150 | ASSERT_EQ(in->size(), out->size()); |
| 151 | int unused, result_len1 = 0, result_len2; |
| 152 | ASSERT_TRUE(EVP_CIPHER_CTX_set_key_length(ctx.get(), key.size())); |
| 153 | ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), nullptr, nullptr, key.data(), |
| 154 | iv.data(), -1)); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 155 | // Note: the deprecated |EVP_CIPHER|-based AES-GCM API is sensitive to whether |
| 156 | // parameters are NULL, so it is important to skip the |in| and |aad| |
| 157 | // |EVP_CipherUpdate| calls when empty. |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 158 | if (!aad.empty()) { |
| 159 | ASSERT_TRUE( |
| 160 | EVP_CipherUpdate(ctx.get(), nullptr, &unused, aad.data(), aad.size())); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 161 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 162 | ASSERT_TRUE(EVP_CIPHER_CTX_set_padding(ctx.get(), 0)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 163 | if (chunk_size != 0) { |
| 164 | for (size_t i = 0; i < in->size();) { |
| 165 | size_t todo = chunk_size; |
| 166 | if (i + todo > in->size()) { |
| 167 | todo = in->size() - i; |
| 168 | } |
| 169 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 170 | int len; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 171 | ASSERT_TRUE(EVP_CipherUpdate(ctx.get(), result.data() + result_len1, &len, |
| 172 | in->data() + i, todo)); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 173 | result_len1 += len; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 174 | i += todo; |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 175 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 176 | } else if (!in->empty()) { |
| 177 | ASSERT_TRUE(EVP_CipherUpdate(ctx.get(), result.data(), &result_len1, |
| 178 | in->data(), in->size())); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 179 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 180 | ASSERT_TRUE( |
| 181 | EVP_CipherFinal_ex(ctx.get(), result.data() + result_len1, &result_len2)); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 182 | result.resize(result_len1 + result_len2); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 183 | EXPECT_EQ(Bytes(*out), Bytes(result)); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 184 | if (encrypt && is_aead) { |
| 185 | uint8_t rtag[16]; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 186 | ASSERT_LE(tag.size(), sizeof(rtag)); |
| 187 | ASSERT_TRUE( |
| 188 | EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_GET_TAG, tag.size(), rtag)); |
| 189 | EXPECT_EQ(Bytes(tag), Bytes(rtag, tag.size())); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 190 | } |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 191 | } |
| 192 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 193 | static void TestCipher(FileTest *t) { |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 194 | std::string cipher_str; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 195 | ASSERT_TRUE(t->GetAttribute(&cipher_str, "Cipher")); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 196 | const EVP_CIPHER *cipher = GetCipher(cipher_str); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 197 | ASSERT_TRUE(cipher); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 198 | |
| 199 | std::vector<uint8_t> key, iv, plaintext, ciphertext, aad, tag; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 200 | ASSERT_TRUE(t->GetBytes(&key, "Key")); |
| 201 | ASSERT_TRUE(t->GetBytes(&plaintext, "Plaintext")); |
| 202 | ASSERT_TRUE(t->GetBytes(&ciphertext, "Ciphertext")); |
| 203 | if (EVP_CIPHER_iv_length(cipher) > 0) { |
| 204 | ASSERT_TRUE(t->GetBytes(&iv, "IV")); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 205 | } |
| 206 | if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 207 | ASSERT_TRUE(t->GetBytes(&aad, "AAD")); |
| 208 | ASSERT_TRUE(t->GetBytes(&tag, "Tag")); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 209 | } |
| 210 | |
| 211 | enum { |
| 212 | kEncrypt, |
| 213 | kDecrypt, |
| 214 | kBoth, |
| 215 | } operation = kBoth; |
| 216 | if (t->HasAttribute("Operation")) { |
| 217 | const std::string &str = t->GetAttributeOrDie("Operation"); |
| 218 | if (str == "ENCRYPT") { |
| 219 | operation = kEncrypt; |
| 220 | } else if (str == "DECRYPT") { |
| 221 | operation = kDecrypt; |
| 222 | } else { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 223 | FAIL() << "Unknown operation: " << str; |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 224 | } |
| 225 | } |
| 226 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 227 | const std::vector<size_t> chunk_sizes = {0, 1, 2, 5, 7, 8, 9, 15, 16, |
| 228 | 17, 31, 32, 33, 63, 64, 65, 512}; |
| 229 | |
| 230 | for (size_t chunk_size : chunk_sizes) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 231 | SCOPED_TRACE(chunk_size); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 232 | // By default, both directions are run, unless overridden by the operation. |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 233 | if (operation != kDecrypt) { |
| 234 | SCOPED_TRACE("encrypt"); |
| 235 | TestOperation(t, cipher, true /* encrypt */, chunk_size, key, iv, |
| 236 | plaintext, ciphertext, aad, tag); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 237 | } |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 238 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 239 | if (operation != kEncrypt) { |
| 240 | SCOPED_TRACE("decrypt"); |
| 241 | TestOperation(t, cipher, false /* decrypt */, chunk_size, key, iv, |
| 242 | plaintext, ciphertext, aad, tag); |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 243 | } |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 244 | } |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 245 | } |
| 246 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 247 | TEST(CipherTest, TestVectors) { |
| 248 | FileTestGTest("crypto/cipher_extra/test/cipher_tests.txt", TestCipher); |
| 249 | } |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 250 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 251 | TEST(CipherTest, CAVP_AES_128_CBC) { |
| 252 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_cbc.txt", |
| 253 | TestCipher); |
| 254 | } |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 255 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 256 | TEST(CipherTest, CAVP_AES_128_CTR) { |
| 257 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_ctr.txt", |
| 258 | TestCipher); |
| 259 | } |
| 260 | |
| 261 | TEST(CipherTest, CAVP_AES_192_CBC) { |
| 262 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_cbc.txt", |
| 263 | TestCipher); |
| 264 | } |
| 265 | |
| 266 | TEST(CipherTest, CAVP_AES_192_CTR) { |
| 267 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_ctr.txt", |
| 268 | TestCipher); |
| 269 | } |
| 270 | |
| 271 | TEST(CipherTest, CAVP_AES_256_CBC) { |
| 272 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_cbc.txt", |
| 273 | TestCipher); |
| 274 | } |
| 275 | |
| 276 | TEST(CipherTest, CAVP_AES_256_CTR) { |
| 277 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_ctr.txt", |
| 278 | TestCipher); |
| 279 | } |
| 280 | |
| 281 | TEST(CipherTest, CAVP_TDES_CBC) { |
| 282 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt", TestCipher); |
| 283 | } |
| 284 | |
| 285 | TEST(CipherTest, CAVP_TDES_ECB) { |
| 286 | FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt", TestCipher); |
Adam Langley | f4e4272 | 2015-06-04 17:45:09 -0700 | [diff] [blame] | 287 | } |