Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL |
| 3 | * project. |
| 4 | */ |
| 5 | /* ==================================================================== |
| 6 | * Copyright (c) 2015 The OpenSSL Project. All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * |
| 12 | * 1. Redistributions of source code must retain the above copyright |
| 13 | * notice, this list of conditions and the following disclaimer. |
| 14 | * |
| 15 | * 2. Redistributions in binary form must reproduce the above copyright |
| 16 | * notice, this list of conditions and the following disclaimer in |
| 17 | * the documentation and/or other materials provided with the |
| 18 | * distribution. |
| 19 | * |
| 20 | * 3. All advertising materials mentioning features or use of this |
| 21 | * software must display the following acknowledgment: |
| 22 | * "This product includes software developed by the OpenSSL Project |
| 23 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" |
| 24 | * |
| 25 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| 26 | * endorse or promote products derived from this software without |
| 27 | * prior written permission. For written permission, please contact |
| 28 | * licensing@OpenSSL.org. |
| 29 | * |
| 30 | * 5. Products derived from this software may not be called "OpenSSL" |
| 31 | * nor may "OpenSSL" appear in their names without prior written |
| 32 | * permission of the OpenSSL Project. |
| 33 | * |
| 34 | * 6. Redistributions of any form whatsoever must retain the following |
| 35 | * acknowledgment: |
| 36 | * "This product includes software developed by the OpenSSL Project |
| 37 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" |
| 38 | * |
| 39 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| 40 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 41 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| 42 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| 43 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 44 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 45 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 46 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 47 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| 48 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 49 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| 50 | * OF THE POSSIBILITY OF SUCH DAMAGE. |
| 51 | * ==================================================================== |
| 52 | */ |
| 53 | |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 54 | #include <openssl/evp.h> |
| 55 | |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 56 | #include <stdio.h> |
| 57 | #include <stdint.h> |
| 58 | #include <stdlib.h> |
| 59 | #include <string.h> |
| 60 | |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 61 | OPENSSL_MSVC_PRAGMA(warning(push)) |
| 62 | OPENSSL_MSVC_PRAGMA(warning(disable: 4702)) |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 63 | |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 64 | #include <map> |
| 65 | #include <string> |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 66 | #include <utility> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 67 | #include <vector> |
| 68 | |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 69 | OPENSSL_MSVC_PRAGMA(warning(pop)) |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 70 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 71 | #include <gtest/gtest.h> |
| 72 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 73 | #include <openssl/buf.h> |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 74 | #include <openssl/bytestring.h> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 75 | #include <openssl/crypto.h> |
| 76 | #include <openssl/digest.h> |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 77 | #include <openssl/dsa.h> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 78 | #include <openssl/err.h> |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 79 | #include <openssl/rsa.h> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 80 | |
| 81 | #include "../test/file_test.h" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 82 | #include "../test/test_util.h" |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 83 | #include "../test/wycheproof_util.h" |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 84 | |
| 85 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 86 | // evp_test dispatches between multiple test types. PrivateKey tests take a key |
| 87 | // name parameter and single block, decode it as a PEM private key, and save it |
| 88 | // under that key name. Decrypt, Sign, and Verify tests take a previously |
| 89 | // imported key name as parameter and test their respective operations. |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 90 | |
| 91 | static const EVP_MD *GetDigest(FileTest *t, const std::string &name) { |
| 92 | if (name == "MD5") { |
| 93 | return EVP_md5(); |
| 94 | } else if (name == "SHA1") { |
| 95 | return EVP_sha1(); |
| 96 | } else if (name == "SHA224") { |
| 97 | return EVP_sha224(); |
| 98 | } else if (name == "SHA256") { |
| 99 | return EVP_sha256(); |
| 100 | } else if (name == "SHA384") { |
| 101 | return EVP_sha384(); |
| 102 | } else if (name == "SHA512") { |
| 103 | return EVP_sha512(); |
| 104 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 105 | ADD_FAILURE() << "Unknown digest: " << name; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 106 | return nullptr; |
| 107 | } |
| 108 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 109 | static int GetKeyType(FileTest *t, const std::string &name) { |
| 110 | if (name == "RSA") { |
| 111 | return EVP_PKEY_RSA; |
| 112 | } |
| 113 | if (name == "EC") { |
| 114 | return EVP_PKEY_EC; |
| 115 | } |
| 116 | if (name == "DSA") { |
| 117 | return EVP_PKEY_DSA; |
| 118 | } |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 119 | if (name == "Ed25519") { |
| 120 | return EVP_PKEY_ED25519; |
| 121 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 122 | ADD_FAILURE() << "Unknown key type: " << name; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 123 | return EVP_PKEY_NONE; |
| 124 | } |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 125 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 126 | static int GetRSAPadding(FileTest *t, int *out, const std::string &name) { |
| 127 | if (name == "PKCS1") { |
| 128 | *out = RSA_PKCS1_PADDING; |
| 129 | return true; |
| 130 | } |
| 131 | if (name == "PSS") { |
| 132 | *out = RSA_PKCS1_PSS_PADDING; |
| 133 | return true; |
| 134 | } |
| 135 | if (name == "OAEP") { |
| 136 | *out = RSA_PKCS1_OAEP_PADDING; |
| 137 | return true; |
| 138 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 139 | ADD_FAILURE() << "Unknown RSA padding mode: " << name; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 140 | return false; |
| 141 | } |
| 142 | |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 143 | using KeyMap = std::map<std::string, bssl::UniquePtr<EVP_PKEY>>; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 144 | |
| 145 | static bool ImportKey(FileTest *t, KeyMap *key_map, |
| 146 | EVP_PKEY *(*parse_func)(CBS *cbs), |
| 147 | int (*marshal_func)(CBB *cbb, const EVP_PKEY *key)) { |
| 148 | std::vector<uint8_t> input; |
| 149 | if (!t->GetBytes(&input, "Input")) { |
| 150 | return false; |
| 151 | } |
| 152 | |
| 153 | CBS cbs; |
| 154 | CBS_init(&cbs, input.data(), input.size()); |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 155 | bssl::UniquePtr<EVP_PKEY> pkey(parse_func(&cbs)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 156 | if (!pkey) { |
| 157 | return false; |
| 158 | } |
| 159 | |
| 160 | std::string key_type; |
| 161 | if (!t->GetAttribute(&key_type, "Type")) { |
| 162 | return false; |
| 163 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 164 | EXPECT_EQ(GetKeyType(t, key_type), EVP_PKEY_id(pkey.get())); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 165 | |
| 166 | // The key must re-encode correctly. |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 167 | bssl::ScopedCBB cbb; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 168 | uint8_t *der; |
| 169 | size_t der_len; |
| 170 | if (!CBB_init(cbb.get(), 0) || |
| 171 | !marshal_func(cbb.get(), pkey.get()) || |
| 172 | !CBB_finish(cbb.get(), &der, &der_len)) { |
| 173 | return false; |
| 174 | } |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 175 | bssl::UniquePtr<uint8_t> free_der(der); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 176 | |
| 177 | std::vector<uint8_t> output = input; |
| 178 | if (t->HasAttribute("Output") && |
| 179 | !t->GetBytes(&output, "Output")) { |
| 180 | return false; |
| 181 | } |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 182 | EXPECT_EQ(Bytes(output), Bytes(der, der_len)) << "Re-encoding the key did not match."; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 183 | |
| 184 | // Save the key for future tests. |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 185 | const std::string &key_name = t->GetParameter(); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 186 | EXPECT_EQ(0u, key_map->count(key_name)) << "Duplicate key: " << key_name; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 187 | (*key_map)[key_name] = std::move(pkey); |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 188 | return true; |
| 189 | } |
| 190 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 191 | // SetupContext configures |ctx| based on attributes in |t|, with the exception |
| 192 | // of the signing digest which must be configured externally. |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 193 | static bool SetupContext(FileTest *t, EVP_PKEY_CTX *ctx) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 194 | if (t->HasAttribute("RSAPadding")) { |
| 195 | int padding; |
| 196 | if (!GetRSAPadding(t, &padding, t->GetAttributeOrDie("RSAPadding")) || |
| 197 | !EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) { |
| 198 | return false; |
| 199 | } |
| 200 | } |
| 201 | if (t->HasAttribute("PSSSaltLength") && |
| 202 | !EVP_PKEY_CTX_set_rsa_pss_saltlen( |
| 203 | ctx, atoi(t->GetAttributeOrDie("PSSSaltLength").c_str()))) { |
| 204 | return false; |
| 205 | } |
| 206 | if (t->HasAttribute("MGF1Digest")) { |
| 207 | const EVP_MD *digest = GetDigest(t, t->GetAttributeOrDie("MGF1Digest")); |
| 208 | if (digest == nullptr || !EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, digest)) { |
| 209 | return false; |
| 210 | } |
| 211 | } |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 212 | if (t->HasAttribute("OAEPDigest")) { |
| 213 | const EVP_MD *digest = GetDigest(t, t->GetAttributeOrDie("OAEPDigest")); |
| 214 | if (digest == nullptr || !EVP_PKEY_CTX_set_rsa_oaep_md(ctx, digest)) { |
| 215 | return false; |
| 216 | } |
| 217 | } |
| 218 | if (t->HasAttribute("OAEPLabel")) { |
| 219 | std::vector<uint8_t> label; |
| 220 | if (!t->GetBytes(&label, "OAEPLabel")) { |
| 221 | return false; |
| 222 | } |
| 223 | // For historical reasons, |EVP_PKEY_CTX_set0_rsa_oaep_label| expects to be |
| 224 | // take ownership of the input. |
| 225 | bssl::UniquePtr<uint8_t> buf( |
| 226 | reinterpret_cast<uint8_t *>(BUF_memdup(label.data(), label.size()))); |
| 227 | if (!buf || |
| 228 | !EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, buf.get(), label.size())) { |
| 229 | return false; |
| 230 | } |
| 231 | buf.release(); |
| 232 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 233 | return true; |
| 234 | } |
| 235 | |
| 236 | static bool TestEVP(FileTest *t, KeyMap *key_map) { |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 237 | if (t->GetType() == "PrivateKey") { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 238 | return ImportKey(t, key_map, EVP_parse_private_key, |
| 239 | EVP_marshal_private_key); |
| 240 | } |
| 241 | |
| 242 | if (t->GetType() == "PublicKey") { |
| 243 | return ImportKey(t, key_map, EVP_parse_public_key, EVP_marshal_public_key); |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 244 | } |
| 245 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 246 | int (*key_op_init)(EVP_PKEY_CTX *ctx) = nullptr; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 247 | int (*key_op)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len, |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 248 | const uint8_t *in, size_t in_len) = nullptr; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 249 | int (*md_op_init)(EVP_MD_CTX * ctx, EVP_PKEY_CTX * *pctx, const EVP_MD *type, |
| 250 | ENGINE *e, EVP_PKEY *pkey) = nullptr; |
| 251 | bool is_verify = false; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 252 | if (t->GetType() == "Decrypt") { |
| 253 | key_op_init = EVP_PKEY_decrypt_init; |
| 254 | key_op = EVP_PKEY_decrypt; |
| 255 | } else if (t->GetType() == "Sign") { |
| 256 | key_op_init = EVP_PKEY_sign_init; |
| 257 | key_op = EVP_PKEY_sign; |
| 258 | } else if (t->GetType() == "Verify") { |
| 259 | key_op_init = EVP_PKEY_verify_init; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 260 | is_verify = true; |
| 261 | } else if (t->GetType() == "SignMessage") { |
| 262 | md_op_init = EVP_DigestSignInit; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 263 | } else if (t->GetType() == "VerifyMessage") { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 264 | md_op_init = EVP_DigestVerifyInit; |
| 265 | is_verify = true; |
Robert Sloan | d1d118f | 2017-09-11 09:00:48 -0700 | [diff] [blame] | 266 | } else if (t->GetType() == "Encrypt") { |
| 267 | key_op_init = EVP_PKEY_encrypt_init; |
| 268 | key_op = EVP_PKEY_encrypt; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 269 | } else { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 270 | ADD_FAILURE() << "Unknown test " << t->GetType(); |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 271 | return false; |
| 272 | } |
| 273 | |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 274 | // Load the key. |
| 275 | const std::string &key_name = t->GetParameter(); |
| 276 | if (key_map->count(key_name) == 0) { |
| 277 | ADD_FAILURE() << "Could not find key " << key_name; |
| 278 | return false; |
| 279 | } |
| 280 | EVP_PKEY *key = (*key_map)[key_name].get(); |
| 281 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 282 | const EVP_MD *digest = nullptr; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 283 | if (t->HasAttribute("Digest")) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 284 | digest = GetDigest(t, t->GetAttributeOrDie("Digest")); |
| 285 | if (digest == nullptr) { |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 286 | return false; |
| 287 | } |
| 288 | } |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 289 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 290 | // For verify tests, the "output" is the signature. Read it now so that, for |
| 291 | // tests which expect a failure in SetupContext, the attribute is still |
| 292 | // consumed. |
| 293 | std::vector<uint8_t> input, actual, output; |
| 294 | if (!t->GetBytes(&input, "Input") || |
| 295 | (is_verify && !t->GetBytes(&output, "Output"))) { |
| 296 | return false; |
| 297 | } |
| 298 | |
| 299 | if (md_op_init) { |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 300 | bssl::ScopedEVP_MD_CTX ctx, copy; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 301 | EVP_PKEY_CTX *pctx; |
| 302 | if (!md_op_init(ctx.get(), &pctx, digest, nullptr, key) || |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 303 | !SetupContext(t, pctx) || |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 304 | !EVP_MD_CTX_copy_ex(copy.get(), ctx.get())) { |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 305 | return false; |
| 306 | } |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 307 | |
| 308 | if (is_verify) { |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 309 | return EVP_DigestVerify(ctx.get(), output.data(), output.size(), |
| 310 | input.data(), input.size()) && |
| 311 | EVP_DigestVerify(copy.get(), output.data(), output.size(), |
| 312 | input.data(), input.size()); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 313 | } |
| 314 | |
| 315 | size_t len; |
| 316 | if (!EVP_DigestSign(ctx.get(), nullptr, &len, input.data(), input.size())) { |
| 317 | return false; |
| 318 | } |
| 319 | actual.resize(len); |
| 320 | if (!EVP_DigestSign(ctx.get(), actual.data(), &len, input.data(), |
| 321 | input.size()) || |
| 322 | !t->GetBytes(&output, "Output")) { |
| 323 | return false; |
| 324 | } |
| 325 | actual.resize(len); |
| 326 | EXPECT_EQ(Bytes(output), Bytes(actual)); |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 327 | |
| 328 | // Repeat the test with |copy|, to check |EVP_MD_CTX_copy_ex| duplicated |
| 329 | // everything. |
| 330 | if (!EVP_DigestSign(copy.get(), nullptr, &len, input.data(), |
| 331 | input.size())) { |
| 332 | return false; |
| 333 | } |
| 334 | actual.resize(len); |
| 335 | if (!EVP_DigestSign(copy.get(), actual.data(), &len, input.data(), |
| 336 | input.size()) || |
| 337 | !t->GetBytes(&output, "Output")) { |
| 338 | return false; |
| 339 | } |
| 340 | actual.resize(len); |
| 341 | EXPECT_EQ(Bytes(output), Bytes(actual)); |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 342 | return true; |
| 343 | } |
| 344 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 345 | bssl::UniquePtr<EVP_PKEY_CTX> ctx(EVP_PKEY_CTX_new(key, nullptr)); |
| 346 | if (!ctx || |
| 347 | !key_op_init(ctx.get()) || |
| 348 | (digest != nullptr && |
| 349 | !EVP_PKEY_CTX_set_signature_md(ctx.get(), digest)) || |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 350 | !SetupContext(t, ctx.get())) { |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 351 | return false; |
| 352 | } |
| 353 | |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 354 | bssl::UniquePtr<EVP_PKEY_CTX> copy(EVP_PKEY_CTX_dup(ctx.get())); |
| 355 | if (!copy) { |
| 356 | return false; |
| 357 | } |
| 358 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 359 | if (is_verify) { |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 360 | return EVP_PKEY_verify(ctx.get(), output.data(), output.size(), |
| 361 | input.data(), input.size()) && |
| 362 | EVP_PKEY_verify(copy.get(), output.data(), output.size(), |
| 363 | input.data(), input.size()); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 364 | } |
| 365 | |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 366 | for (EVP_PKEY_CTX *pctx : {ctx.get(), copy.get()}) { |
| 367 | size_t len; |
| 368 | if (!key_op(pctx, nullptr, &len, input.data(), input.size())) { |
| 369 | return false; |
| 370 | } |
| 371 | actual.resize(len); |
| 372 | if (!key_op(pctx, actual.data(), &len, input.data(), input.size())) { |
| 373 | return false; |
| 374 | } |
Robert Sloan | d1d118f | 2017-09-11 09:00:48 -0700 | [diff] [blame] | 375 | |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 376 | if (t->HasAttribute("CheckDecrypt")) { |
| 377 | // Encryption is non-deterministic, so we check by decrypting. |
| 378 | size_t plaintext_len; |
| 379 | bssl::UniquePtr<EVP_PKEY_CTX> decrypt_ctx(EVP_PKEY_CTX_new(key, nullptr)); |
| 380 | if (!decrypt_ctx || |
| 381 | !EVP_PKEY_decrypt_init(decrypt_ctx.get()) || |
| 382 | (digest != nullptr && |
| 383 | !EVP_PKEY_CTX_set_signature_md(decrypt_ctx.get(), digest)) || |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 384 | !SetupContext(t, decrypt_ctx.get()) || |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 385 | !EVP_PKEY_decrypt(decrypt_ctx.get(), nullptr, &plaintext_len, |
| 386 | actual.data(), actual.size())) { |
| 387 | return false; |
| 388 | } |
| 389 | output.resize(plaintext_len); |
| 390 | if (!EVP_PKEY_decrypt(decrypt_ctx.get(), output.data(), &plaintext_len, |
| 391 | actual.data(), actual.size())) { |
| 392 | ADD_FAILURE() << "Could not decrypt result."; |
| 393 | return false; |
| 394 | } |
| 395 | output.resize(plaintext_len); |
| 396 | EXPECT_EQ(Bytes(input), Bytes(output)) << "Decrypted result mismatch."; |
| 397 | } else if (t->HasAttribute("CheckVerify")) { |
| 398 | // Some signature schemes are non-deterministic, so we check by verifying. |
| 399 | bssl::UniquePtr<EVP_PKEY_CTX> verify_ctx(EVP_PKEY_CTX_new(key, nullptr)); |
| 400 | if (!verify_ctx || |
| 401 | !EVP_PKEY_verify_init(verify_ctx.get()) || |
| 402 | (digest != nullptr && |
| 403 | !EVP_PKEY_CTX_set_signature_md(verify_ctx.get(), digest)) || |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 404 | !SetupContext(t, verify_ctx.get())) { |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 405 | return false; |
| 406 | } |
| 407 | if (t->HasAttribute("VerifyPSSSaltLength")) { |
| 408 | if (!EVP_PKEY_CTX_set_rsa_pss_saltlen( |
| 409 | verify_ctx.get(), |
| 410 | atoi(t->GetAttributeOrDie("VerifyPSSSaltLength").c_str()))) { |
| 411 | return false; |
| 412 | } |
| 413 | } |
| 414 | EXPECT_TRUE(EVP_PKEY_verify(verify_ctx.get(), actual.data(), |
| 415 | actual.size(), input.data(), input.size())) |
| 416 | << "Could not verify result."; |
| 417 | } else { |
| 418 | // By default, check by comparing the result against Output. |
| 419 | if (!t->GetBytes(&output, "Output")) { |
| 420 | return false; |
| 421 | } |
| 422 | actual.resize(len); |
| 423 | EXPECT_EQ(Bytes(output), Bytes(actual)); |
Robert Sloan | d1d118f | 2017-09-11 09:00:48 -0700 | [diff] [blame] | 424 | } |
Robert Sloan | d1d118f | 2017-09-11 09:00:48 -0700 | [diff] [blame] | 425 | } |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 426 | return true; |
| 427 | } |
| 428 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 429 | TEST(EVPTest, TestVectors) { |
| 430 | KeyMap key_map; |
| 431 | FileTestGTest("crypto/evp/evp_tests.txt", [&](FileTest *t) { |
| 432 | bool result = TestEVP(t, &key_map); |
| 433 | if (t->HasAttribute("Error")) { |
| 434 | ASSERT_FALSE(result) << "Operation unexpectedly succeeded."; |
| 435 | uint32_t err = ERR_peek_error(); |
| 436 | EXPECT_EQ(t->GetAttributeOrDie("Error"), ERR_reason_error_string(err)); |
| 437 | } else if (!result) { |
| 438 | ADD_FAILURE() << "Operation unexpectedly failed."; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 439 | } |
| 440 | }); |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 441 | } |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 442 | |
| 443 | static void RunWycheproofTest(const char *path) { |
| 444 | SCOPED_TRACE(path); |
| 445 | FileTestGTest(path, [](FileTest *t) { |
| 446 | t->IgnoreInstruction("key.type"); |
| 447 | // Extra ECDSA fields. |
| 448 | t->IgnoreInstruction("key.curve"); |
| 449 | t->IgnoreInstruction("key.keySize"); |
| 450 | t->IgnoreInstruction("key.wx"); |
| 451 | t->IgnoreInstruction("key.wy"); |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 452 | t->IgnoreInstruction("key.uncompressed"); |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 453 | // Extra RSA fields. |
| 454 | t->IgnoreInstruction("e"); |
| 455 | t->IgnoreInstruction("keyAsn"); |
| 456 | t->IgnoreInstruction("keysize"); |
| 457 | t->IgnoreInstruction("n"); |
| 458 | t->IgnoreAttribute("padding"); |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 459 | t->IgnoreInstruction("keyJwk.alg"); |
| 460 | t->IgnoreInstruction("keyJwk.e"); |
| 461 | t->IgnoreInstruction("keyJwk.kid"); |
| 462 | t->IgnoreInstruction("keyJwk.kty"); |
| 463 | t->IgnoreInstruction("keyJwk.n"); |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 464 | // Extra EdDSA fields. |
| 465 | t->IgnoreInstruction("key.pk"); |
| 466 | t->IgnoreInstruction("key.sk"); |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 467 | t->IgnoreInstruction("jwk.crv"); |
| 468 | t->IgnoreInstruction("jwk.d"); |
| 469 | t->IgnoreInstruction("jwk.kid"); |
| 470 | t->IgnoreInstruction("jwk.kty"); |
| 471 | t->IgnoreInstruction("jwk.x"); |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 472 | // Extra DSA fields. |
| 473 | t->IgnoreInstruction("key.g"); |
| 474 | t->IgnoreInstruction("key.p"); |
| 475 | t->IgnoreInstruction("key.q"); |
| 476 | t->IgnoreInstruction("key.y"); |
| 477 | |
| 478 | std::vector<uint8_t> der; |
| 479 | ASSERT_TRUE(t->GetInstructionBytes(&der, "keyDer")); |
| 480 | CBS cbs; |
| 481 | CBS_init(&cbs, der.data(), der.size()); |
| 482 | bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs)); |
| 483 | ASSERT_TRUE(key); |
| 484 | |
| 485 | const EVP_MD *md = nullptr; |
| 486 | if (t->HasInstruction("sha")) { |
| 487 | md = GetWycheproofDigest(t, "sha", true); |
| 488 | ASSERT_TRUE(md); |
| 489 | } |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 490 | |
| 491 | bool is_pss = t->HasInstruction("mgf"); |
| 492 | const EVP_MD *mgf1_md = nullptr; |
| 493 | int pss_salt_len = -1; |
| 494 | if (is_pss) { |
| 495 | ASSERT_EQ("MGF1", t->GetInstructionOrDie("mgf")); |
| 496 | mgf1_md = GetWycheproofDigest(t, "mgfSha", true); |
| 497 | |
| 498 | std::string s_len; |
| 499 | ASSERT_TRUE(t->GetInstruction(&s_len, "sLen")); |
| 500 | pss_salt_len = atoi(s_len.c_str()); |
| 501 | } |
| 502 | |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 503 | std::vector<uint8_t> msg; |
| 504 | ASSERT_TRUE(t->GetBytes(&msg, "msg")); |
| 505 | std::vector<uint8_t> sig; |
| 506 | ASSERT_TRUE(t->GetBytes(&sig, "sig")); |
| 507 | WycheproofResult result; |
| 508 | ASSERT_TRUE(GetWycheproofResult(t, &result)); |
| 509 | |
| 510 | if (EVP_PKEY_id(key.get()) == EVP_PKEY_DSA) { |
| 511 | // DSA is deprecated and is not usable via EVP. |
| 512 | DSA *dsa = EVP_PKEY_get0_DSA(key.get()); |
| 513 | uint8_t digest[EVP_MAX_MD_SIZE]; |
| 514 | unsigned digest_len; |
| 515 | ASSERT_TRUE( |
| 516 | EVP_Digest(msg.data(), msg.size(), digest, &digest_len, md, nullptr)); |
| 517 | int valid; |
| 518 | bool sig_ok = DSA_check_signature(&valid, digest, digest_len, sig.data(), |
| 519 | sig.size(), dsa) && |
| 520 | valid; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 521 | if (result == WycheproofResult::kValid) { |
| 522 | EXPECT_TRUE(sig_ok); |
| 523 | } else if (result == WycheproofResult::kInvalid) { |
| 524 | EXPECT_FALSE(sig_ok); |
| 525 | } else { |
| 526 | // this is a legacy signature, which may or may not be accepted. |
| 527 | } |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 528 | } else { |
| 529 | bssl::ScopedEVP_MD_CTX ctx; |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 530 | EVP_PKEY_CTX *pctx; |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 531 | ASSERT_TRUE( |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 532 | EVP_DigestVerifyInit(ctx.get(), &pctx, md, nullptr, key.get())); |
| 533 | if (is_pss) { |
| 534 | ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)); |
| 535 | ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_mgf1_md(pctx, mgf1_md)); |
| 536 | ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, pss_salt_len)); |
| 537 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 538 | int ret = EVP_DigestVerify(ctx.get(), sig.data(), sig.size(), msg.data(), |
| 539 | msg.size()); |
| 540 | if (result == WycheproofResult::kValid) { |
| 541 | EXPECT_EQ(1, ret); |
| 542 | } else if (result == WycheproofResult::kInvalid) { |
| 543 | EXPECT_EQ(0, ret); |
| 544 | } else { |
| 545 | // this is a legacy signature, which may or may not be accepted. |
| 546 | EXPECT_TRUE(ret == 1 || ret == 0); |
| 547 | } |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 548 | } |
| 549 | }); |
| 550 | } |
| 551 | |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 552 | TEST(EVPTest, WycheproofDSA) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 553 | RunWycheproofTest("third_party/wycheproof_testvectors/dsa_test.txt"); |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 554 | } |
| 555 | |
| 556 | TEST(EVPTest, WycheproofECDSAP224) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 557 | RunWycheproofTest( |
| 558 | "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha224_test.txt"); |
| 559 | RunWycheproofTest( |
| 560 | "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha256_test.txt"); |
| 561 | RunWycheproofTest( |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 562 | "third_party/wycheproof_testvectors/ecdsa_secp224r1_sha512_test.txt"); |
| 563 | } |
| 564 | |
| 565 | TEST(EVPTest, WycheproofECDSAP256) { |
| 566 | RunWycheproofTest( |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 567 | "third_party/wycheproof_testvectors/ecdsa_secp256r1_sha256_test.txt"); |
| 568 | RunWycheproofTest( |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 569 | "third_party/wycheproof_testvectors/ecdsa_secp256r1_sha512_test.txt"); |
| 570 | } |
| 571 | |
| 572 | TEST(EVPTest, WycheproofECDSAP384) { |
| 573 | RunWycheproofTest( |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 574 | "third_party/wycheproof_testvectors/ecdsa_secp384r1_sha384_test.txt"); |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 575 | } |
| 576 | |
| 577 | TEST(EVPTest, WycheproofECDSAP521) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 578 | RunWycheproofTest( |
| 579 | "third_party/wycheproof_testvectors/ecdsa_secp384r1_sha512_test.txt"); |
| 580 | RunWycheproofTest( |
| 581 | "third_party/wycheproof_testvectors/ecdsa_secp521r1_sha512_test.txt"); |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 582 | } |
| 583 | |
| 584 | TEST(EVPTest, WycheproofEdDSA) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 585 | RunWycheproofTest("third_party/wycheproof_testvectors/eddsa_test.txt"); |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 586 | } |
| 587 | |
| 588 | TEST(EVPTest, WycheproofRSAPKCS1) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 589 | RunWycheproofTest( |
| 590 | "third_party/wycheproof_testvectors/rsa_signature_test.txt"); |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 591 | } |
Robert Sloan | d9e572d | 2018-08-27 12:27:00 -0700 | [diff] [blame] | 592 | |
| 593 | TEST(EVPTest, WycheproofRSAPSS) { |
| 594 | RunWycheproofTest( |
| 595 | "third_party/wycheproof_testvectors/rsa_pss_2048_sha1_mgf1_20_test.txt"); |
| 596 | RunWycheproofTest( |
| 597 | "third_party/wycheproof_testvectors/rsa_pss_2048_sha256_mgf1_0_test.txt"); |
| 598 | RunWycheproofTest( |
| 599 | "third_party/wycheproof_testvectors/" |
| 600 | "rsa_pss_2048_sha256_mgf1_32_test.txt"); |
| 601 | RunWycheproofTest( |
| 602 | "third_party/wycheproof_testvectors/" |
| 603 | "rsa_pss_3072_sha256_mgf1_32_test.txt"); |
| 604 | RunWycheproofTest( |
| 605 | "third_party/wycheproof_testvectors/" |
| 606 | "rsa_pss_4096_sha256_mgf1_32_test.txt"); |
| 607 | RunWycheproofTest( |
| 608 | "third_party/wycheproof_testvectors/" |
| 609 | "rsa_pss_4096_sha512_mgf1_32_test.txt"); |
| 610 | RunWycheproofTest("third_party/wycheproof_testvectors/rsa_pss_misc_test.txt"); |
| 611 | } |