blob: 4d7429202474e106918a5bd23d724bf9fbf4149e [file] [log] [blame]
Adam Langleye9ada862015-05-11 17:20:37 -07001/*
2 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 2015 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 */
53
David Benjamin6e899c72016-06-09 18:02:18 -040054#include <openssl/evp.h>
55
Adam Langleye9ada862015-05-11 17:20:37 -070056#include <stdio.h>
57#include <stdint.h>
58#include <stdlib.h>
59#include <string.h>
60
David Benjamin6e899c72016-06-09 18:02:18 -040061OPENSSL_MSVC_PRAGMA(warning(push))
62OPENSSL_MSVC_PRAGMA(warning(disable: 4702))
Kenny Rootb8494592015-09-25 02:29:14 +000063
Adam Langleye9ada862015-05-11 17:20:37 -070064#include <map>
65#include <string>
David Benjamin4969cc92016-04-22 15:02:23 -040066#include <utility>
Adam Langleye9ada862015-05-11 17:20:37 -070067#include <vector>
68
David Benjamin6e899c72016-06-09 18:02:18 -040069OPENSSL_MSVC_PRAGMA(warning(pop))
Kenny Rootb8494592015-09-25 02:29:14 +000070
Robert Sloan8ff03552017-06-14 12:40:58 -070071#include <gtest/gtest.h>
72
Robert Sloana27a6a42017-09-05 08:39:28 -070073#include <openssl/buf.h>
David Benjaminf0c4a6c2016-08-11 13:26:41 -040074#include <openssl/bytestring.h>
Adam Langleye9ada862015-05-11 17:20:37 -070075#include <openssl/crypto.h>
76#include <openssl/digest.h>
Robert Sloanc6ebb282018-04-30 10:10:26 -070077#include <openssl/dsa.h>
Adam Langleye9ada862015-05-11 17:20:37 -070078#include <openssl/err.h>
Robert Sloan69939df2017-01-09 10:53:07 -080079#include <openssl/rsa.h>
Adam Langleye9ada862015-05-11 17:20:37 -070080
81#include "../test/file_test.h"
Robert Sloan8ff03552017-06-14 12:40:58 -070082#include "../test/test_util.h"
Robert Sloanc6ebb282018-04-30 10:10:26 -070083#include "../test/wycheproof_util.h"
Adam Langleye9ada862015-05-11 17:20:37 -070084
85
Kenny Rootb8494592015-09-25 02:29:14 +000086// evp_test dispatches between multiple test types. PrivateKey tests take a key
87// name parameter and single block, decode it as a PEM private key, and save it
88// under that key name. Decrypt, Sign, and Verify tests take a previously
89// imported key name as parameter and test their respective operations.
Adam Langleye9ada862015-05-11 17:20:37 -070090
91static const EVP_MD *GetDigest(FileTest *t, const std::string &name) {
92 if (name == "MD5") {
93 return EVP_md5();
94 } else if (name == "SHA1") {
95 return EVP_sha1();
96 } else if (name == "SHA224") {
97 return EVP_sha224();
98 } else if (name == "SHA256") {
99 return EVP_sha256();
100 } else if (name == "SHA384") {
101 return EVP_sha384();
102 } else if (name == "SHA512") {
103 return EVP_sha512();
104 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700105 ADD_FAILURE() << "Unknown digest: " << name;
Adam Langleye9ada862015-05-11 17:20:37 -0700106 return nullptr;
107}
108
David Benjamin4969cc92016-04-22 15:02:23 -0400109static int GetKeyType(FileTest *t, const std::string &name) {
110 if (name == "RSA") {
111 return EVP_PKEY_RSA;
112 }
113 if (name == "EC") {
114 return EVP_PKEY_EC;
115 }
116 if (name == "DSA") {
117 return EVP_PKEY_DSA;
118 }
Robert Sloan572a4e22017-04-17 10:52:19 -0700119 if (name == "Ed25519") {
120 return EVP_PKEY_ED25519;
121 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700122 ADD_FAILURE() << "Unknown key type: " << name;
David Benjamin4969cc92016-04-22 15:02:23 -0400123 return EVP_PKEY_NONE;
124}
Adam Langleye9ada862015-05-11 17:20:37 -0700125
Robert Sloan69939df2017-01-09 10:53:07 -0800126static int GetRSAPadding(FileTest *t, int *out, const std::string &name) {
127 if (name == "PKCS1") {
128 *out = RSA_PKCS1_PADDING;
129 return true;
130 }
131 if (name == "PSS") {
132 *out = RSA_PKCS1_PSS_PADDING;
133 return true;
134 }
135 if (name == "OAEP") {
136 *out = RSA_PKCS1_OAEP_PADDING;
137 return true;
138 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700139 ADD_FAILURE() << "Unknown RSA padding mode: " << name;
Robert Sloan69939df2017-01-09 10:53:07 -0800140 return false;
141}
142
David Benjaminf0c4a6c2016-08-11 13:26:41 -0400143using KeyMap = std::map<std::string, bssl::UniquePtr<EVP_PKEY>>;
David Benjamin4969cc92016-04-22 15:02:23 -0400144
145static bool ImportKey(FileTest *t, KeyMap *key_map,
146 EVP_PKEY *(*parse_func)(CBS *cbs),
147 int (*marshal_func)(CBB *cbb, const EVP_PKEY *key)) {
148 std::vector<uint8_t> input;
149 if (!t->GetBytes(&input, "Input")) {
150 return false;
151 }
152
153 CBS cbs;
154 CBS_init(&cbs, input.data(), input.size());
David Benjaminf0c4a6c2016-08-11 13:26:41 -0400155 bssl::UniquePtr<EVP_PKEY> pkey(parse_func(&cbs));
David Benjamin4969cc92016-04-22 15:02:23 -0400156 if (!pkey) {
157 return false;
158 }
159
160 std::string key_type;
161 if (!t->GetAttribute(&key_type, "Type")) {
162 return false;
163 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700164 EXPECT_EQ(GetKeyType(t, key_type), EVP_PKEY_id(pkey.get()));
David Benjamin4969cc92016-04-22 15:02:23 -0400165
166 // The key must re-encode correctly.
David Benjamin1b249672016-12-06 18:25:50 -0500167 bssl::ScopedCBB cbb;
David Benjamin4969cc92016-04-22 15:02:23 -0400168 uint8_t *der;
169 size_t der_len;
170 if (!CBB_init(cbb.get(), 0) ||
171 !marshal_func(cbb.get(), pkey.get()) ||
172 !CBB_finish(cbb.get(), &der, &der_len)) {
173 return false;
174 }
David Benjaminf0c4a6c2016-08-11 13:26:41 -0400175 bssl::UniquePtr<uint8_t> free_der(der);
David Benjamin4969cc92016-04-22 15:02:23 -0400176
177 std::vector<uint8_t> output = input;
178 if (t->HasAttribute("Output") &&
179 !t->GetBytes(&output, "Output")) {
180 return false;
181 }
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000182 EXPECT_EQ(Bytes(output), Bytes(der, der_len)) << "Re-encoding the key did not match.";
David Benjamin4969cc92016-04-22 15:02:23 -0400183
184 // Save the key for future tests.
Adam Langleye9ada862015-05-11 17:20:37 -0700185 const std::string &key_name = t->GetParameter();
Robert Sloan8ff03552017-06-14 12:40:58 -0700186 EXPECT_EQ(0u, key_map->count(key_name)) << "Duplicate key: " << key_name;
David Benjamin4969cc92016-04-22 15:02:23 -0400187 (*key_map)[key_name] = std::move(pkey);
Adam Langleye9ada862015-05-11 17:20:37 -0700188 return true;
189}
190
Robert Sloan8ff03552017-06-14 12:40:58 -0700191// SetupContext configures |ctx| based on attributes in |t|, with the exception
192// of the signing digest which must be configured externally.
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000193static bool SetupContext(FileTest *t, EVP_PKEY_CTX *ctx) {
Robert Sloan8ff03552017-06-14 12:40:58 -0700194 if (t->HasAttribute("RSAPadding")) {
195 int padding;
196 if (!GetRSAPadding(t, &padding, t->GetAttributeOrDie("RSAPadding")) ||
197 !EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) {
198 return false;
199 }
200 }
201 if (t->HasAttribute("PSSSaltLength") &&
202 !EVP_PKEY_CTX_set_rsa_pss_saltlen(
203 ctx, atoi(t->GetAttributeOrDie("PSSSaltLength").c_str()))) {
204 return false;
205 }
206 if (t->HasAttribute("MGF1Digest")) {
207 const EVP_MD *digest = GetDigest(t, t->GetAttributeOrDie("MGF1Digest"));
208 if (digest == nullptr || !EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, digest)) {
209 return false;
210 }
211 }
Robert Sloana27a6a42017-09-05 08:39:28 -0700212 if (t->HasAttribute("OAEPDigest")) {
213 const EVP_MD *digest = GetDigest(t, t->GetAttributeOrDie("OAEPDigest"));
214 if (digest == nullptr || !EVP_PKEY_CTX_set_rsa_oaep_md(ctx, digest)) {
215 return false;
216 }
217 }
218 if (t->HasAttribute("OAEPLabel")) {
219 std::vector<uint8_t> label;
220 if (!t->GetBytes(&label, "OAEPLabel")) {
221 return false;
222 }
223 // For historical reasons, |EVP_PKEY_CTX_set0_rsa_oaep_label| expects to be
224 // take ownership of the input.
225 bssl::UniquePtr<uint8_t> buf(
226 reinterpret_cast<uint8_t *>(BUF_memdup(label.data(), label.size())));
227 if (!buf ||
228 !EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, buf.get(), label.size())) {
229 return false;
230 }
231 buf.release();
232 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700233 return true;
234}
235
236static bool TestEVP(FileTest *t, KeyMap *key_map) {
Adam Langleye9ada862015-05-11 17:20:37 -0700237 if (t->GetType() == "PrivateKey") {
David Benjamin4969cc92016-04-22 15:02:23 -0400238 return ImportKey(t, key_map, EVP_parse_private_key,
239 EVP_marshal_private_key);
240 }
241
242 if (t->GetType() == "PublicKey") {
243 return ImportKey(t, key_map, EVP_parse_public_key, EVP_marshal_public_key);
Adam Langleye9ada862015-05-11 17:20:37 -0700244 }
245
Robert Sloan8ff03552017-06-14 12:40:58 -0700246 int (*key_op_init)(EVP_PKEY_CTX *ctx) = nullptr;
Adam Langleye9ada862015-05-11 17:20:37 -0700247 int (*key_op)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len,
Robert Sloan572a4e22017-04-17 10:52:19 -0700248 const uint8_t *in, size_t in_len) = nullptr;
Robert Sloan8ff03552017-06-14 12:40:58 -0700249 int (*md_op_init)(EVP_MD_CTX * ctx, EVP_PKEY_CTX * *pctx, const EVP_MD *type,
250 ENGINE *e, EVP_PKEY *pkey) = nullptr;
251 bool is_verify = false;
Adam Langleye9ada862015-05-11 17:20:37 -0700252 if (t->GetType() == "Decrypt") {
253 key_op_init = EVP_PKEY_decrypt_init;
254 key_op = EVP_PKEY_decrypt;
255 } else if (t->GetType() == "Sign") {
256 key_op_init = EVP_PKEY_sign_init;
257 key_op = EVP_PKEY_sign;
258 } else if (t->GetType() == "Verify") {
259 key_op_init = EVP_PKEY_verify_init;
Robert Sloan8ff03552017-06-14 12:40:58 -0700260 is_verify = true;
261 } else if (t->GetType() == "SignMessage") {
262 md_op_init = EVP_DigestSignInit;
Robert Sloan572a4e22017-04-17 10:52:19 -0700263 } else if (t->GetType() == "VerifyMessage") {
Robert Sloan8ff03552017-06-14 12:40:58 -0700264 md_op_init = EVP_DigestVerifyInit;
265 is_verify = true;
Robert Sloand1d118f2017-09-11 09:00:48 -0700266 } else if (t->GetType() == "Encrypt") {
267 key_op_init = EVP_PKEY_encrypt_init;
268 key_op = EVP_PKEY_encrypt;
Adam Langleye9ada862015-05-11 17:20:37 -0700269 } else {
Robert Sloan8ff03552017-06-14 12:40:58 -0700270 ADD_FAILURE() << "Unknown test " << t->GetType();
Adam Langleye9ada862015-05-11 17:20:37 -0700271 return false;
272 }
273
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000274 // Load the key.
275 const std::string &key_name = t->GetParameter();
276 if (key_map->count(key_name) == 0) {
277 ADD_FAILURE() << "Could not find key " << key_name;
278 return false;
279 }
280 EVP_PKEY *key = (*key_map)[key_name].get();
281
Robert Sloan8ff03552017-06-14 12:40:58 -0700282 const EVP_MD *digest = nullptr;
Adam Langleye9ada862015-05-11 17:20:37 -0700283 if (t->HasAttribute("Digest")) {
Robert Sloan8ff03552017-06-14 12:40:58 -0700284 digest = GetDigest(t, t->GetAttributeOrDie("Digest"));
285 if (digest == nullptr) {
Robert Sloan69939df2017-01-09 10:53:07 -0800286 return false;
287 }
288 }
Adam Langleye9ada862015-05-11 17:20:37 -0700289
Robert Sloan8ff03552017-06-14 12:40:58 -0700290 // For verify tests, the "output" is the signature. Read it now so that, for
291 // tests which expect a failure in SetupContext, the attribute is still
292 // consumed.
293 std::vector<uint8_t> input, actual, output;
294 if (!t->GetBytes(&input, "Input") ||
295 (is_verify && !t->GetBytes(&output, "Output"))) {
296 return false;
297 }
298
299 if (md_op_init) {
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700300 bssl::ScopedEVP_MD_CTX ctx, copy;
Robert Sloan8ff03552017-06-14 12:40:58 -0700301 EVP_PKEY_CTX *pctx;
302 if (!md_op_init(ctx.get(), &pctx, digest, nullptr, key) ||
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000303 !SetupContext(t, pctx) ||
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700304 !EVP_MD_CTX_copy_ex(copy.get(), ctx.get())) {
Adam Langleye9ada862015-05-11 17:20:37 -0700305 return false;
306 }
Robert Sloan8ff03552017-06-14 12:40:58 -0700307
308 if (is_verify) {
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700309 return EVP_DigestVerify(ctx.get(), output.data(), output.size(),
310 input.data(), input.size()) &&
311 EVP_DigestVerify(copy.get(), output.data(), output.size(),
312 input.data(), input.size());
Robert Sloan8ff03552017-06-14 12:40:58 -0700313 }
314
315 size_t len;
316 if (!EVP_DigestSign(ctx.get(), nullptr, &len, input.data(), input.size())) {
317 return false;
318 }
319 actual.resize(len);
320 if (!EVP_DigestSign(ctx.get(), actual.data(), &len, input.data(),
321 input.size()) ||
322 !t->GetBytes(&output, "Output")) {
323 return false;
324 }
325 actual.resize(len);
326 EXPECT_EQ(Bytes(output), Bytes(actual));
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700327
328 // Repeat the test with |copy|, to check |EVP_MD_CTX_copy_ex| duplicated
329 // everything.
330 if (!EVP_DigestSign(copy.get(), nullptr, &len, input.data(),
331 input.size())) {
332 return false;
333 }
334 actual.resize(len);
335 if (!EVP_DigestSign(copy.get(), actual.data(), &len, input.data(),
336 input.size()) ||
337 !t->GetBytes(&output, "Output")) {
338 return false;
339 }
340 actual.resize(len);
341 EXPECT_EQ(Bytes(output), Bytes(actual));
Adam Langleye9ada862015-05-11 17:20:37 -0700342 return true;
343 }
344
Robert Sloan8ff03552017-06-14 12:40:58 -0700345 bssl::UniquePtr<EVP_PKEY_CTX> ctx(EVP_PKEY_CTX_new(key, nullptr));
346 if (!ctx ||
347 !key_op_init(ctx.get()) ||
348 (digest != nullptr &&
349 !EVP_PKEY_CTX_set_signature_md(ctx.get(), digest)) ||
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000350 !SetupContext(t, ctx.get())) {
Robert Sloan8ff03552017-06-14 12:40:58 -0700351 return false;
352 }
353
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700354 bssl::UniquePtr<EVP_PKEY_CTX> copy(EVP_PKEY_CTX_dup(ctx.get()));
355 if (!copy) {
356 return false;
357 }
358
Robert Sloan8ff03552017-06-14 12:40:58 -0700359 if (is_verify) {
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700360 return EVP_PKEY_verify(ctx.get(), output.data(), output.size(),
361 input.data(), input.size()) &&
362 EVP_PKEY_verify(copy.get(), output.data(), output.size(),
363 input.data(), input.size());
Robert Sloan8ff03552017-06-14 12:40:58 -0700364 }
365
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700366 for (EVP_PKEY_CTX *pctx : {ctx.get(), copy.get()}) {
367 size_t len;
368 if (!key_op(pctx, nullptr, &len, input.data(), input.size())) {
369 return false;
370 }
371 actual.resize(len);
372 if (!key_op(pctx, actual.data(), &len, input.data(), input.size())) {
373 return false;
374 }
Robert Sloand1d118f2017-09-11 09:00:48 -0700375
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700376 if (t->HasAttribute("CheckDecrypt")) {
377 // Encryption is non-deterministic, so we check by decrypting.
378 size_t plaintext_len;
379 bssl::UniquePtr<EVP_PKEY_CTX> decrypt_ctx(EVP_PKEY_CTX_new(key, nullptr));
380 if (!decrypt_ctx ||
381 !EVP_PKEY_decrypt_init(decrypt_ctx.get()) ||
382 (digest != nullptr &&
383 !EVP_PKEY_CTX_set_signature_md(decrypt_ctx.get(), digest)) ||
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000384 !SetupContext(t, decrypt_ctx.get()) ||
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700385 !EVP_PKEY_decrypt(decrypt_ctx.get(), nullptr, &plaintext_len,
386 actual.data(), actual.size())) {
387 return false;
388 }
389 output.resize(plaintext_len);
390 if (!EVP_PKEY_decrypt(decrypt_ctx.get(), output.data(), &plaintext_len,
391 actual.data(), actual.size())) {
392 ADD_FAILURE() << "Could not decrypt result.";
393 return false;
394 }
395 output.resize(plaintext_len);
396 EXPECT_EQ(Bytes(input), Bytes(output)) << "Decrypted result mismatch.";
397 } else if (t->HasAttribute("CheckVerify")) {
398 // Some signature schemes are non-deterministic, so we check by verifying.
399 bssl::UniquePtr<EVP_PKEY_CTX> verify_ctx(EVP_PKEY_CTX_new(key, nullptr));
400 if (!verify_ctx ||
401 !EVP_PKEY_verify_init(verify_ctx.get()) ||
402 (digest != nullptr &&
403 !EVP_PKEY_CTX_set_signature_md(verify_ctx.get(), digest)) ||
Srinivas Paladugudd42a612019-08-09 19:30:39 +0000404 !SetupContext(t, verify_ctx.get())) {
Robert Sloanf63bd1f2019-04-16 09:26:20 -0700405 return false;
406 }
407 if (t->HasAttribute("VerifyPSSSaltLength")) {
408 if (!EVP_PKEY_CTX_set_rsa_pss_saltlen(
409 verify_ctx.get(),
410 atoi(t->GetAttributeOrDie("VerifyPSSSaltLength").c_str()))) {
411 return false;
412 }
413 }
414 EXPECT_TRUE(EVP_PKEY_verify(verify_ctx.get(), actual.data(),
415 actual.size(), input.data(), input.size()))
416 << "Could not verify result.";
417 } else {
418 // By default, check by comparing the result against Output.
419 if (!t->GetBytes(&output, "Output")) {
420 return false;
421 }
422 actual.resize(len);
423 EXPECT_EQ(Bytes(output), Bytes(actual));
Robert Sloand1d118f2017-09-11 09:00:48 -0700424 }
Robert Sloand1d118f2017-09-11 09:00:48 -0700425 }
Adam Langleye9ada862015-05-11 17:20:37 -0700426 return true;
427}
428
Robert Sloan8ff03552017-06-14 12:40:58 -0700429TEST(EVPTest, TestVectors) {
430 KeyMap key_map;
431 FileTestGTest("crypto/evp/evp_tests.txt", [&](FileTest *t) {
432 bool result = TestEVP(t, &key_map);
433 if (t->HasAttribute("Error")) {
434 ASSERT_FALSE(result) << "Operation unexpectedly succeeded.";
435 uint32_t err = ERR_peek_error();
436 EXPECT_EQ(t->GetAttributeOrDie("Error"), ERR_reason_error_string(err));
437 } else if (!result) {
438 ADD_FAILURE() << "Operation unexpectedly failed.";
Robert Sloan8ff03552017-06-14 12:40:58 -0700439 }
440 });
Adam Langleye9ada862015-05-11 17:20:37 -0700441}
Robert Sloanc6ebb282018-04-30 10:10:26 -0700442
443static void RunWycheproofTest(const char *path) {
444 SCOPED_TRACE(path);
445 FileTestGTest(path, [](FileTest *t) {
446 t->IgnoreInstruction("key.type");
447 // Extra ECDSA fields.
448 t->IgnoreInstruction("key.curve");
449 t->IgnoreInstruction("key.keySize");
450 t->IgnoreInstruction("key.wx");
451 t->IgnoreInstruction("key.wy");
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100452 t->IgnoreInstruction("key.uncompressed");
Robert Sloanc6ebb282018-04-30 10:10:26 -0700453 // Extra RSA fields.
454 t->IgnoreInstruction("e");
455 t->IgnoreInstruction("keyAsn");
456 t->IgnoreInstruction("keysize");
457 t->IgnoreInstruction("n");
458 t->IgnoreAttribute("padding");
Robert Sloan4c22c5f2019-03-01 15:53:37 -0800459 t->IgnoreInstruction("keyJwk.alg");
460 t->IgnoreInstruction("keyJwk.e");
461 t->IgnoreInstruction("keyJwk.kid");
462 t->IgnoreInstruction("keyJwk.kty");
463 t->IgnoreInstruction("keyJwk.n");
Robert Sloanc6ebb282018-04-30 10:10:26 -0700464 // Extra EdDSA fields.
465 t->IgnoreInstruction("key.pk");
466 t->IgnoreInstruction("key.sk");
Robert Sloan4c22c5f2019-03-01 15:53:37 -0800467 t->IgnoreInstruction("jwk.crv");
468 t->IgnoreInstruction("jwk.d");
469 t->IgnoreInstruction("jwk.kid");
470 t->IgnoreInstruction("jwk.kty");
471 t->IgnoreInstruction("jwk.x");
Robert Sloanc6ebb282018-04-30 10:10:26 -0700472 // Extra DSA fields.
473 t->IgnoreInstruction("key.g");
474 t->IgnoreInstruction("key.p");
475 t->IgnoreInstruction("key.q");
476 t->IgnoreInstruction("key.y");
477
478 std::vector<uint8_t> der;
479 ASSERT_TRUE(t->GetInstructionBytes(&der, "keyDer"));
480 CBS cbs;
481 CBS_init(&cbs, der.data(), der.size());
482 bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
483 ASSERT_TRUE(key);
484
485 const EVP_MD *md = nullptr;
486 if (t->HasInstruction("sha")) {
487 md = GetWycheproofDigest(t, "sha", true);
488 ASSERT_TRUE(md);
489 }
Robert Sloand9e572d2018-08-27 12:27:00 -0700490
491 bool is_pss = t->HasInstruction("mgf");
492 const EVP_MD *mgf1_md = nullptr;
493 int pss_salt_len = -1;
494 if (is_pss) {
495 ASSERT_EQ("MGF1", t->GetInstructionOrDie("mgf"));
496 mgf1_md = GetWycheproofDigest(t, "mgfSha", true);
497
498 std::string s_len;
499 ASSERT_TRUE(t->GetInstruction(&s_len, "sLen"));
500 pss_salt_len = atoi(s_len.c_str());
501 }
502
Robert Sloanc6ebb282018-04-30 10:10:26 -0700503 std::vector<uint8_t> msg;
504 ASSERT_TRUE(t->GetBytes(&msg, "msg"));
505 std::vector<uint8_t> sig;
506 ASSERT_TRUE(t->GetBytes(&sig, "sig"));
507 WycheproofResult result;
508 ASSERT_TRUE(GetWycheproofResult(t, &result));
509
510 if (EVP_PKEY_id(key.get()) == EVP_PKEY_DSA) {
511 // DSA is deprecated and is not usable via EVP.
512 DSA *dsa = EVP_PKEY_get0_DSA(key.get());
513 uint8_t digest[EVP_MAX_MD_SIZE];
514 unsigned digest_len;
515 ASSERT_TRUE(
516 EVP_Digest(msg.data(), msg.size(), digest, &digest_len, md, nullptr));
517 int valid;
518 bool sig_ok = DSA_check_signature(&valid, digest, digest_len, sig.data(),
519 sig.size(), dsa) &&
520 valid;
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100521 if (result == WycheproofResult::kValid) {
522 EXPECT_TRUE(sig_ok);
523 } else if (result == WycheproofResult::kInvalid) {
524 EXPECT_FALSE(sig_ok);
525 } else {
526 // this is a legacy signature, which may or may not be accepted.
527 }
Robert Sloanc6ebb282018-04-30 10:10:26 -0700528 } else {
529 bssl::ScopedEVP_MD_CTX ctx;
Robert Sloand9e572d2018-08-27 12:27:00 -0700530 EVP_PKEY_CTX *pctx;
Robert Sloanc6ebb282018-04-30 10:10:26 -0700531 ASSERT_TRUE(
Robert Sloand9e572d2018-08-27 12:27:00 -0700532 EVP_DigestVerifyInit(ctx.get(), &pctx, md, nullptr, key.get()));
533 if (is_pss) {
534 ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING));
535 ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_mgf1_md(pctx, mgf1_md));
536 ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, pss_salt_len));
537 }
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100538 int ret = EVP_DigestVerify(ctx.get(), sig.data(), sig.size(), msg.data(),
539 msg.size());
540 if (result == WycheproofResult::kValid) {
541 EXPECT_EQ(1, ret);
542 } else if (result == WycheproofResult::kInvalid) {
543 EXPECT_EQ(0, ret);
544 } else {
545 // this is a legacy signature, which may or may not be accepted.
546 EXPECT_TRUE(ret == 1 || ret == 0);
547 }
Robert Sloanc6ebb282018-04-30 10:10:26 -0700548 }
549 });
550}
551
Robert Sloand9e572d2018-08-27 12:27:00 -0700552TEST(EVPTest, WycheproofDSA) {
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100553 RunWycheproofTest("third_party/wycheproof_testvectors/dsa_test.txt");
Robert Sloand9e572d2018-08-27 12:27:00 -0700554}
555
556TEST(EVPTest, WycheproofECDSAP224) {
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100557 RunWycheproofTest(
558 "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha224_test.txt");
559 RunWycheproofTest(
560 "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha256_test.txt");
561 RunWycheproofTest(
Robert Sloand9e572d2018-08-27 12:27:00 -0700562 "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha512_test.txt");
563}
564
565TEST(EVPTest, WycheproofECDSAP256) {
566 RunWycheproofTest(
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100567 "third_party/wycheproof_testvectors/ecdsa_secp256r1_sha256_test.txt");
568 RunWycheproofTest(
Robert Sloand9e572d2018-08-27 12:27:00 -0700569 "third_party/wycheproof_testvectors/ecdsa_secp256r1_sha512_test.txt");
570}
571
572TEST(EVPTest, WycheproofECDSAP384) {
573 RunWycheproofTest(
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100574 "third_party/wycheproof_testvectors/ecdsa_secp384r1_sha384_test.txt");
Robert Sloand9e572d2018-08-27 12:27:00 -0700575}
576
577TEST(EVPTest, WycheproofECDSAP521) {
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100578 RunWycheproofTest(
579 "third_party/wycheproof_testvectors/ecdsa_secp384r1_sha512_test.txt");
580 RunWycheproofTest(
581 "third_party/wycheproof_testvectors/ecdsa_secp521r1_sha512_test.txt");
Robert Sloand9e572d2018-08-27 12:27:00 -0700582}
583
584TEST(EVPTest, WycheproofEdDSA) {
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100585 RunWycheproofTest("third_party/wycheproof_testvectors/eddsa_test.txt");
Robert Sloand9e572d2018-08-27 12:27:00 -0700586}
587
588TEST(EVPTest, WycheproofRSAPKCS1) {
Adam Vartanianbfcf3a72018-08-10 14:55:24 +0100589 RunWycheproofTest(
590 "third_party/wycheproof_testvectors/rsa_signature_test.txt");
Robert Sloanc6ebb282018-04-30 10:10:26 -0700591}
Robert Sloand9e572d2018-08-27 12:27:00 -0700592
593TEST(EVPTest, WycheproofRSAPSS) {
594 RunWycheproofTest(
595 "third_party/wycheproof_testvectors/rsa_pss_2048_sha1_mgf1_20_test.txt");
596 RunWycheproofTest(
597 "third_party/wycheproof_testvectors/rsa_pss_2048_sha256_mgf1_0_test.txt");
598 RunWycheproofTest(
599 "third_party/wycheproof_testvectors/"
600 "rsa_pss_2048_sha256_mgf1_32_test.txt");
601 RunWycheproofTest(
602 "third_party/wycheproof_testvectors/"
603 "rsa_pss_3072_sha256_mgf1_32_test.txt");
604 RunWycheproofTest(
605 "third_party/wycheproof_testvectors/"
606 "rsa_pss_4096_sha256_mgf1_32_test.txt");
607 RunWycheproofTest(
608 "third_party/wycheproof_testvectors/"
609 "rsa_pss_4096_sha512_mgf1_32_test.txt");
610 RunWycheproofTest("third_party/wycheproof_testvectors/rsa_pss_misc_test.txt");
611}