evp_kdf_test.c 71 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033
  1. /*
  2. * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2018-2020, Oracle and/or its affiliates. All rights reserved.
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. /* Tests of the EVP_KDF_CTX APIs */
  11. #include <stdio.h>
  12. #include <string.h>
  13. #include <openssl/evp.h>
  14. #include <openssl/kdf.h>
  15. #include <openssl/core_names.h>
  16. #include "internal/numbers.h"
  17. #include "testutil.h"
  18. static EVP_KDF_CTX *get_kdfbyname_libctx(OSSL_LIB_CTX *libctx, const char *name)
  19. {
  20. EVP_KDF *kdf = EVP_KDF_fetch(libctx, name, NULL);
  21. EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
  22. EVP_KDF_free(kdf);
  23. return kctx;
  24. }
  25. static EVP_KDF_CTX *get_kdfbyname(const char *name)
  26. {
  27. return get_kdfbyname_libctx(NULL, name);
  28. }
  29. static OSSL_PARAM *construct_tls1_prf_params(const char *digest, const char *secret,
  30. const char *seed)
  31. {
  32. OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 4);
  33. OSSL_PARAM *p = params;
  34. if (params == NULL)
  35. return NULL;
  36. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  37. (char *)digest, 0);
  38. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
  39. (unsigned char *)secret,
  40. strlen(secret));
  41. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
  42. (unsigned char *)seed,
  43. strlen(seed));
  44. *p = OSSL_PARAM_construct_end();
  45. return params;
  46. }
  47. static int test_kdf_tls1_prf(void)
  48. {
  49. int ret;
  50. EVP_KDF_CTX *kctx = NULL;
  51. unsigned char out[16];
  52. OSSL_PARAM *params;
  53. static const unsigned char expected[sizeof(out)] = {
  54. 0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
  55. 0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
  56. };
  57. params = construct_tls1_prf_params("sha256", "secret", "seed");
  58. ret = TEST_ptr(params)
  59. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  60. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  61. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  62. EVP_KDF_CTX_free(kctx);
  63. OPENSSL_free(params);
  64. return ret;
  65. }
  66. static int test_kdf_tls1_prf_invalid_digest(void)
  67. {
  68. int ret;
  69. EVP_KDF_CTX *kctx = NULL;
  70. OSSL_PARAM *params;
  71. params = construct_tls1_prf_params("blah", "secret", "seed");
  72. ret = TEST_ptr(params)
  73. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  74. && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
  75. EVP_KDF_CTX_free(kctx);
  76. OPENSSL_free(params);
  77. return ret;
  78. }
  79. static int test_kdf_tls1_prf_zero_output_size(void)
  80. {
  81. int ret;
  82. EVP_KDF_CTX *kctx = NULL;
  83. unsigned char out[16];
  84. OSSL_PARAM *params;
  85. params = construct_tls1_prf_params("sha256", "secret", "seed");
  86. /* Negative test - derive should fail */
  87. ret = TEST_ptr(params)
  88. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  89. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  90. && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
  91. EVP_KDF_CTX_free(kctx);
  92. OPENSSL_free(params);
  93. return ret;
  94. }
  95. static int test_kdf_tls1_prf_empty_secret(void)
  96. {
  97. int ret;
  98. EVP_KDF_CTX *kctx = NULL;
  99. unsigned char out[16];
  100. OSSL_PARAM *params;
  101. params = construct_tls1_prf_params("sha256", "", "seed");
  102. ret = TEST_ptr(params)
  103. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  104. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  105. EVP_KDF_CTX_free(kctx);
  106. OPENSSL_free(params);
  107. return ret;
  108. }
  109. static int test_kdf_tls1_prf_1byte_secret(void)
  110. {
  111. int ret;
  112. EVP_KDF_CTX *kctx = NULL;
  113. unsigned char out[16];
  114. OSSL_PARAM *params;
  115. params = construct_tls1_prf_params("sha256", "1", "seed");
  116. ret = TEST_ptr(params)
  117. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  118. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  119. EVP_KDF_CTX_free(kctx);
  120. OPENSSL_free(params);
  121. return ret;
  122. }
  123. static int test_kdf_tls1_prf_empty_seed(void)
  124. {
  125. int ret;
  126. EVP_KDF_CTX *kctx = NULL;
  127. unsigned char out[16];
  128. OSSL_PARAM *params;
  129. params = construct_tls1_prf_params("sha256", "secret", "");
  130. /* Negative test - derive should fail */
  131. ret = TEST_ptr(params)
  132. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  133. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  134. && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0);
  135. EVP_KDF_CTX_free(kctx);
  136. OPENSSL_free(params);
  137. return ret;
  138. }
  139. static int test_kdf_tls1_prf_1byte_seed(void)
  140. {
  141. int ret;
  142. EVP_KDF_CTX *kctx = NULL;
  143. unsigned char out[16];
  144. OSSL_PARAM *params;
  145. params = construct_tls1_prf_params("sha256", "secret", "1");
  146. ret = TEST_ptr(params)
  147. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
  148. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  149. EVP_KDF_CTX_free(kctx);
  150. OPENSSL_free(params);
  151. return ret;
  152. }
  153. static OSSL_PARAM *construct_hkdf_params(char *digest, char *key,
  154. size_t keylen, char *salt, char *info)
  155. {
  156. OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
  157. OSSL_PARAM *p = params;
  158. if (params == NULL)
  159. return NULL;
  160. if (digest != NULL)
  161. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  162. digest, 0);
  163. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
  164. salt, strlen(salt));
  165. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
  166. (unsigned char *)key, keylen);
  167. if (info != NULL)
  168. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
  169. info, strlen(info));
  170. else
  171. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
  172. "EXTRACT_ONLY", 0);
  173. *p = OSSL_PARAM_construct_end();
  174. return params;
  175. }
  176. static int test_kdf_hkdf(void)
  177. {
  178. int ret;
  179. EVP_KDF_CTX *kctx = NULL;
  180. unsigned char out[10];
  181. OSSL_PARAM *params;
  182. static const unsigned char expected[sizeof(out)] = {
  183. 0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
  184. };
  185. params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
  186. ret = TEST_ptr(params)
  187. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  188. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  189. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  190. EVP_KDF_CTX_free(kctx);
  191. OPENSSL_free(params);
  192. return ret;
  193. }
  194. static int do_kdf_hkdf_gettables(int expand_only, int has_digest)
  195. {
  196. int ret = 0;
  197. size_t sz = 0;
  198. OSSL_PARAM *params;
  199. OSSL_PARAM params_get[2];
  200. const OSSL_PARAM *gettables, *p;
  201. EVP_KDF_CTX *kctx = NULL;
  202. if (!TEST_ptr(params = construct_hkdf_params(
  203. has_digest ? "sha256" : NULL,
  204. "secret", 6, "salt",
  205. expand_only ? NULL : "label"))
  206. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  207. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
  208. goto err;
  209. /* Check OSSL_KDF_PARAM_SIZE is gettable */
  210. if (!TEST_ptr(gettables = EVP_KDF_CTX_gettable_params(kctx))
  211. || !TEST_ptr(p = OSSL_PARAM_locate_const(gettables, OSSL_KDF_PARAM_SIZE)))
  212. goto err;
  213. /* Get OSSL_KDF_PARAM_SIZE as a size_t */
  214. params_get[0] = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_SIZE, &sz);
  215. params_get[1] = OSSL_PARAM_construct_end();
  216. if (has_digest) {
  217. if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1)
  218. || !TEST_size_t_eq(sz, expand_only ? SHA256_DIGEST_LENGTH : SIZE_MAX))
  219. goto err;
  220. } else {
  221. if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 0))
  222. goto err;
  223. }
  224. /* Get params returns -2 if an unsupported parameter is requested */
  225. params_get[0] = OSSL_PARAM_construct_end();
  226. if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), -2))
  227. goto err;
  228. ret = 1;
  229. err:
  230. EVP_KDF_CTX_free(kctx);
  231. OPENSSL_free(params);
  232. return ret;
  233. }
  234. static int test_kdf_hkdf_gettables(void)
  235. {
  236. return do_kdf_hkdf_gettables(0, 1);
  237. }
  238. static int test_kdf_hkdf_gettables_expandonly(void)
  239. {
  240. return do_kdf_hkdf_gettables(1, 1);
  241. }
  242. static int test_kdf_hkdf_gettables_no_digest(void)
  243. {
  244. return do_kdf_hkdf_gettables(1, 0);
  245. }
  246. static int test_kdf_hkdf_invalid_digest(void)
  247. {
  248. int ret;
  249. EVP_KDF_CTX *kctx = NULL;
  250. OSSL_PARAM *params;
  251. params = construct_hkdf_params("blah", "secret", 6, "salt", "label");
  252. ret = TEST_ptr(params)
  253. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  254. && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
  255. EVP_KDF_CTX_free(kctx);
  256. OPENSSL_free(params);
  257. return ret;
  258. }
  259. static int test_kdf_hkdf_derive_set_params_fail(void)
  260. {
  261. int ret = 0, i = 0;
  262. EVP_KDF_CTX *kctx = NULL;
  263. OSSL_PARAM params[2];
  264. unsigned char out[10];
  265. if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
  266. goto end;
  267. /*
  268. * Set the wrong type for the digest so that it causes a failure
  269. * inside kdf_hkdf_derive() when kdf_hkdf_set_ctx_params() is called
  270. */
  271. params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_DIGEST, &i);
  272. params[1] = OSSL_PARAM_construct_end();
  273. if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), params), 0))
  274. goto end;
  275. ret = 1;
  276. end:
  277. EVP_KDF_CTX_free(kctx);
  278. return ret;
  279. }
  280. static int test_kdf_hkdf_set_invalid_mode(void)
  281. {
  282. int ret = 0, bad_mode = 100;
  283. EVP_KDF_CTX *kctx = NULL;
  284. OSSL_PARAM params[2];
  285. if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
  286. goto end;
  287. params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
  288. "BADMODE", 0);
  289. params[1] = OSSL_PARAM_construct_end();
  290. if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
  291. goto end;
  292. params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &bad_mode);
  293. if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
  294. goto end;
  295. ret = 1;
  296. end:
  297. EVP_KDF_CTX_free(kctx);
  298. return ret;
  299. }
  300. static int do_kdf_hkdf_set_invalid_param(const char *key, int type)
  301. {
  302. int ret = 0;
  303. EVP_KDF_CTX *kctx = NULL;
  304. OSSL_PARAM params[2];
  305. unsigned char buf[2];
  306. if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
  307. goto end;
  308. /* Set the wrong type for the key so that it causes a failure */
  309. if (type == OSSL_PARAM_UTF8_STRING)
  310. params[0] = OSSL_PARAM_construct_utf8_string(key, "BAD", 0);
  311. else
  312. params[0] = OSSL_PARAM_construct_octet_string(key, buf, sizeof(buf));
  313. params[1] = OSSL_PARAM_construct_end();
  314. if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
  315. goto end;
  316. ret = 1;
  317. end:
  318. EVP_KDF_CTX_free(kctx);
  319. return ret;
  320. }
  321. static int test_kdf_hkdf_set_ctx_param_fail(void)
  322. {
  323. return do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_MODE,
  324. OSSL_PARAM_OCTET_STRING)
  325. && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_KEY,
  326. OSSL_PARAM_UTF8_STRING)
  327. && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_SALT,
  328. OSSL_PARAM_UTF8_STRING)
  329. && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_INFO,
  330. OSSL_PARAM_UTF8_STRING);
  331. }
  332. static int test_kdf_hkdf_zero_output_size(void)
  333. {
  334. int ret;
  335. EVP_KDF_CTX *kctx = NULL;
  336. unsigned char out[10];
  337. OSSL_PARAM *params;
  338. params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
  339. /* Negative test - derive should fail */
  340. ret = TEST_ptr(params)
  341. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  342. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  343. && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
  344. EVP_KDF_CTX_free(kctx);
  345. OPENSSL_free(params);
  346. return ret;
  347. }
  348. static int test_kdf_hkdf_empty_key(void)
  349. {
  350. int ret;
  351. EVP_KDF_CTX *kctx = NULL;
  352. unsigned char out[10];
  353. OSSL_PARAM *params;
  354. params = construct_hkdf_params("sha256", "", 0, "salt", "label");
  355. ret = TEST_ptr(params)
  356. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  357. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  358. EVP_KDF_CTX_free(kctx);
  359. OPENSSL_free(params);
  360. return ret;
  361. }
  362. static int test_kdf_hkdf_1byte_key(void)
  363. {
  364. int ret;
  365. EVP_KDF_CTX *kctx = NULL;
  366. unsigned char out[10];
  367. OSSL_PARAM *params;
  368. params = construct_hkdf_params("sha256", "1", 1, "salt", "label");
  369. ret = TEST_ptr(params)
  370. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  371. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  372. EVP_KDF_CTX_free(kctx);
  373. OPENSSL_free(params);
  374. return ret;
  375. }
  376. static int test_kdf_hkdf_empty_salt(void)
  377. {
  378. int ret;
  379. EVP_KDF_CTX *kctx = NULL;
  380. unsigned char out[10];
  381. OSSL_PARAM *params;
  382. params = construct_hkdf_params("sha256", "secret", 6, "", "label");
  383. ret = TEST_ptr(params)
  384. && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
  385. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
  386. EVP_KDF_CTX_free(kctx);
  387. OPENSSL_free(params);
  388. return ret;
  389. }
  390. static OSSL_PARAM *construct_pbkdf1_params(char *pass, char *digest, char *salt,
  391. unsigned int *iter)
  392. {
  393. OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
  394. OSSL_PARAM *p = params;
  395. if (params == NULL)
  396. return NULL;
  397. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
  398. (unsigned char *)pass, strlen(pass));
  399. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
  400. (unsigned char *)salt, strlen(salt));
  401. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
  402. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  403. digest, 0);
  404. *p = OSSL_PARAM_construct_end();
  405. return params;
  406. }
  407. static int test_kdf_pbkdf1(void)
  408. {
  409. int ret = 0;
  410. EVP_KDF_CTX *kctx = NULL;
  411. unsigned char out[25];
  412. unsigned int iterations = 4096;
  413. OSSL_LIB_CTX *libctx = NULL;
  414. OSSL_PARAM *params = NULL;
  415. OSSL_PROVIDER *legacyprov = NULL;
  416. OSSL_PROVIDER *defprov = NULL;
  417. const unsigned char expected[sizeof(out)] = {
  418. 0xfb, 0x83, 0x4d, 0x36, 0x6d, 0xbc, 0x53, 0x87, 0x35, 0x1b, 0x34, 0x75,
  419. 0x95, 0x88, 0x32, 0x4f, 0x3e, 0x82, 0x81, 0x01, 0x21, 0x93, 0x64, 0x00,
  420. 0xcc
  421. };
  422. if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
  423. goto err;
  424. /* PBKDF1 only available in the legacy provider */
  425. legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
  426. if (legacyprov == NULL) {
  427. OSSL_LIB_CTX_free(libctx);
  428. return TEST_skip("PBKDF1 only available in legacy provider");
  429. }
  430. if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
  431. goto err;
  432. params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
  433. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  434. &iterations);
  435. if (!TEST_ptr(params)
  436. || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
  437. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  438. || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
  439. || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
  440. goto err;
  441. ret = 1;
  442. err:
  443. EVP_KDF_CTX_free(kctx);
  444. OPENSSL_free(params);
  445. OSSL_PROVIDER_unload(defprov);
  446. OSSL_PROVIDER_unload(legacyprov);
  447. OSSL_LIB_CTX_free(libctx);
  448. return ret;
  449. }
  450. static int test_kdf_pbkdf1_key_too_long(void)
  451. {
  452. int ret = 0;
  453. EVP_KDF_CTX *kctx = NULL;
  454. unsigned char out[EVP_MAX_MD_SIZE + 1];
  455. unsigned int iterations = 4096;
  456. OSSL_LIB_CTX *libctx = NULL;
  457. OSSL_PARAM *params = NULL;
  458. OSSL_PROVIDER *legacyprov = NULL;
  459. OSSL_PROVIDER *defprov = NULL;
  460. if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
  461. goto err;
  462. /* PBKDF1 only available in the legacy provider */
  463. legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
  464. if (legacyprov == NULL) {
  465. OSSL_LIB_CTX_free(libctx);
  466. return TEST_skip("PBKDF1 only available in legacy provider");
  467. }
  468. if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
  469. goto err;
  470. params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
  471. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  472. &iterations);
  473. /*
  474. * This is the same test sequence as test_kdf_pbkdf1, but we expect
  475. * failure here as the requested key size is longer than the digest
  476. * can provide
  477. */
  478. if (!TEST_ptr(params)
  479. || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
  480. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  481. || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  482. goto err;
  483. ret = 1;
  484. err:
  485. EVP_KDF_CTX_free(kctx);
  486. OPENSSL_free(params);
  487. OSSL_PROVIDER_unload(defprov);
  488. OSSL_PROVIDER_unload(legacyprov);
  489. OSSL_LIB_CTX_free(libctx);
  490. return ret;
  491. }
  492. static OSSL_PARAM *construct_pbkdf2_params(char *pass, char *digest, char *salt,
  493. unsigned int *iter, int *mode)
  494. {
  495. OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 6);
  496. OSSL_PARAM *p = params;
  497. if (params == NULL)
  498. return NULL;
  499. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
  500. (unsigned char *)pass, strlen(pass));
  501. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
  502. (unsigned char *)salt, strlen(salt));
  503. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
  504. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  505. digest, 0);
  506. *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, mode);
  507. *p = OSSL_PARAM_construct_end();
  508. return params;
  509. }
  510. static int test_kdf_pbkdf2(void)
  511. {
  512. int ret = 0;
  513. EVP_KDF_CTX *kctx = NULL;
  514. unsigned char out[25];
  515. unsigned int iterations = 4096;
  516. int mode = 0;
  517. OSSL_PARAM *params;
  518. const unsigned char expected[sizeof(out)] = {
  519. 0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
  520. 0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
  521. 0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
  522. 0x1c
  523. };
  524. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  525. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  526. &iterations, &mode);
  527. if (!TEST_ptr(params)
  528. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  529. || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  530. || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
  531. goto err;
  532. ret = 1;
  533. err:
  534. EVP_KDF_CTX_free(kctx);
  535. OPENSSL_free(params);
  536. return ret;
  537. }
  538. static int test_kdf_pbkdf2_small_output(void)
  539. {
  540. int ret = 0;
  541. EVP_KDF_CTX *kctx = NULL;
  542. unsigned char out[25];
  543. unsigned int iterations = 4096;
  544. int mode = 0;
  545. OSSL_PARAM *params;
  546. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  547. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  548. &iterations, &mode);
  549. if (!TEST_ptr(params)
  550. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  551. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  552. /* A key length that is too small should fail */
  553. || !TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1, NULL), 0))
  554. goto err;
  555. ret = 1;
  556. err:
  557. EVP_KDF_CTX_free(kctx);
  558. OPENSSL_free(params);
  559. return ret;
  560. }
  561. static int test_kdf_pbkdf2_large_output(void)
  562. {
  563. int ret = 0;
  564. EVP_KDF_CTX *kctx = NULL;
  565. unsigned char out[25];
  566. size_t len = 0;
  567. unsigned int iterations = 4096;
  568. int mode = 0;
  569. OSSL_PARAM *params;
  570. if (sizeof(len) > 32)
  571. len = SIZE_MAX;
  572. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  573. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  574. &iterations, &mode);
  575. if (!TEST_ptr(params)
  576. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  577. /* A key length that is too large should fail */
  578. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  579. || (len != 0 && !TEST_int_eq(EVP_KDF_derive(kctx, out, len, NULL), 0)))
  580. goto err;
  581. ret = 1;
  582. err:
  583. EVP_KDF_CTX_free(kctx);
  584. OPENSSL_free(params);
  585. return ret;
  586. }
  587. static int test_kdf_pbkdf2_small_salt(void)
  588. {
  589. int ret = 0;
  590. EVP_KDF_CTX *kctx = NULL;
  591. unsigned int iterations = 4096;
  592. int mode = 0;
  593. OSSL_PARAM *params;
  594. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  595. "saltSALT",
  596. &iterations, &mode);
  597. if (!TEST_ptr(params)
  598. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  599. /* A salt that is too small should fail */
  600. || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
  601. goto err;
  602. ret = 1;
  603. err:
  604. EVP_KDF_CTX_free(kctx);
  605. OPENSSL_free(params);
  606. return ret;
  607. }
  608. static int test_kdf_pbkdf2_small_iterations(void)
  609. {
  610. int ret = 0;
  611. EVP_KDF_CTX *kctx = NULL;
  612. unsigned int iterations = 1;
  613. int mode = 0;
  614. OSSL_PARAM *params;
  615. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  616. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  617. &iterations, &mode);
  618. if (!TEST_ptr(params)
  619. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  620. /* An iteration count that is too small should fail */
  621. || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
  622. goto err;
  623. ret = 1;
  624. err:
  625. EVP_KDF_CTX_free(kctx);
  626. OPENSSL_free(params);
  627. return ret;
  628. }
  629. static int test_kdf_pbkdf2_small_salt_pkcs5(void)
  630. {
  631. int ret = 0;
  632. EVP_KDF_CTX *kctx = NULL;
  633. unsigned char out[25];
  634. unsigned int iterations = 4096;
  635. int mode = 1;
  636. OSSL_PARAM *params;
  637. OSSL_PARAM mode_params[2];
  638. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  639. "saltSALT",
  640. &iterations, &mode);
  641. if (!TEST_ptr(params)
  642. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  643. /* A salt that is too small should pass in pkcs5 mode */
  644. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  645. || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  646. goto err;
  647. mode = 0;
  648. mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
  649. mode_params[1] = OSSL_PARAM_construct_end();
  650. /* If the "pkcs5" mode is disabled then the derive will now fail */
  651. if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
  652. || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  653. goto err;
  654. ret = 1;
  655. err:
  656. EVP_KDF_CTX_free(kctx);
  657. OPENSSL_free(params);
  658. return ret;
  659. }
  660. static int test_kdf_pbkdf2_small_iterations_pkcs5(void)
  661. {
  662. int ret = 0;
  663. EVP_KDF_CTX *kctx = NULL;
  664. unsigned char out[25];
  665. unsigned int iterations = 1;
  666. int mode = 1;
  667. OSSL_PARAM *params;
  668. OSSL_PARAM mode_params[2];
  669. params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
  670. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  671. &iterations, &mode);
  672. if (!TEST_ptr(params)
  673. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  674. /* An iteration count that is too small will pass in pkcs5 mode */
  675. || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  676. || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  677. goto err;
  678. mode = 0;
  679. mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
  680. mode_params[1] = OSSL_PARAM_construct_end();
  681. /* If the "pkcs5" mode is disabled then the derive will now fail */
  682. if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
  683. || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  684. goto err;
  685. ret = 1;
  686. err:
  687. EVP_KDF_CTX_free(kctx);
  688. OPENSSL_free(params);
  689. return ret;
  690. }
  691. static int test_kdf_pbkdf2_invalid_digest(void)
  692. {
  693. int ret = 0;
  694. EVP_KDF_CTX *kctx = NULL;
  695. unsigned int iterations = 4096;
  696. int mode = 0;
  697. OSSL_PARAM *params;
  698. params = construct_pbkdf2_params("passwordPASSWORDpassword", "blah",
  699. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  700. &iterations, &mode);
  701. if (!TEST_ptr(params)
  702. || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
  703. /* Unknown digest should fail */
  704. || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
  705. goto err;
  706. ret = 1;
  707. err:
  708. EVP_KDF_CTX_free(kctx);
  709. OPENSSL_free(params);
  710. return ret;
  711. }
  712. #ifndef OPENSSL_NO_SCRYPT
  713. static int test_kdf_scrypt(void)
  714. {
  715. int ret;
  716. EVP_KDF_CTX *kctx;
  717. OSSL_PARAM params[7], *p = params;
  718. unsigned char out[64];
  719. unsigned int nu = 1024, ru = 8, pu = 16, maxmem = 16;
  720. static const unsigned char expected[sizeof(out)] = {
  721. 0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
  722. 0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
  723. 0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
  724. 0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
  725. 0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
  726. 0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
  727. 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
  728. 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
  729. };
  730. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
  731. (char *)"password", 8);
  732. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
  733. (char *)"NaCl", 4);
  734. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_N, &nu);
  735. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_R, &ru);
  736. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_P, &pu);
  737. *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
  738. *p = OSSL_PARAM_construct_end();
  739. ret =
  740. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT))
  741. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  742. /* failure test *//*
  743. && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)*/
  744. && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
  745. && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1))
  746. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
  747. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  748. EVP_KDF_CTX_free(kctx);
  749. return ret;
  750. }
  751. #endif /* OPENSSL_NO_SCRYPT */
  752. static int test_kdf_ss_hash(void)
  753. {
  754. int ret;
  755. EVP_KDF_CTX *kctx;
  756. OSSL_PARAM params[4], *p = params;
  757. unsigned char out[14];
  758. static unsigned char z[] = {
  759. 0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e,
  760. 0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62,
  761. 0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4,
  762. 0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9
  763. };
  764. static unsigned char other[] = {
  765. 0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e,
  766. 0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde,
  767. 0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e,
  768. 0xe0,0xec,0x3f,0x8d,0xbe
  769. };
  770. static const unsigned char expected[sizeof(out)] = {
  771. 0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8
  772. };
  773. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  774. (char *)"sha224", 0);
  775. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
  776. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
  777. sizeof(other));
  778. *p = OSSL_PARAM_construct_end();
  779. ret =
  780. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
  781. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  782. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  783. EVP_KDF_CTX_free(kctx);
  784. return ret;
  785. }
  786. static int test_kdf_x963(void)
  787. {
  788. int ret;
  789. EVP_KDF_CTX *kctx;
  790. OSSL_PARAM params[4], *p = params;
  791. unsigned char out[1024 / 8];
  792. /*
  793. * Test data from https://csrc.nist.gov/CSRC/media/Projects/
  794. * Cryptographic-Algorithm-Validation-Program/documents/components/
  795. * 800-135testvectors/ansx963_2001.zip
  796. */
  797. static unsigned char z[] = {
  798. 0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad,
  799. 0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9,
  800. 0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f,
  801. 0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f,
  802. 0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7,
  803. 0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d
  804. };
  805. static unsigned char shared[] = {
  806. 0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99,
  807. 0x37, 0x89, 0x5d, 0x31
  808. };
  809. static const unsigned char expected[sizeof(out)] = {
  810. 0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b,
  811. 0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8,
  812. 0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5,
  813. 0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e,
  814. 0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee,
  815. 0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02,
  816. 0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7,
  817. 0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd,
  818. 0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e,
  819. 0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc,
  820. 0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16
  821. };
  822. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  823. (char *)"sha512", 0);
  824. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
  825. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, shared,
  826. sizeof(shared));
  827. *p = OSSL_PARAM_construct_end();
  828. ret =
  829. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X963KDF))
  830. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  831. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  832. EVP_KDF_CTX_free(kctx);
  833. return ret;
  834. }
  835. #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
  836. /*
  837. * KBKDF test vectors from RFC 6803 (Camellia Encryption for Kerberos 5)
  838. * section 10.
  839. */
  840. static int test_kdf_kbkdf_6803_128(void)
  841. {
  842. int ret = 0, i, p;
  843. EVP_KDF_CTX *kctx;
  844. OSSL_PARAM params[7];
  845. static unsigned char input_key[] = {
  846. 0x57, 0xD0, 0x29, 0x72, 0x98, 0xFF, 0xD9, 0xD3,
  847. 0x5D, 0xE5, 0xA4, 0x7F, 0xB4, 0xBD, 0xE2, 0x4B,
  848. };
  849. static unsigned char constants[][5] = {
  850. { 0x00, 0x00, 0x00, 0x02, 0x99 },
  851. { 0x00, 0x00, 0x00, 0x02, 0xaa },
  852. { 0x00, 0x00, 0x00, 0x02, 0x55 },
  853. };
  854. static unsigned char outputs[][16] = {
  855. {0xD1, 0x55, 0x77, 0x5A, 0x20, 0x9D, 0x05, 0xF0,
  856. 0x2B, 0x38, 0xD4, 0x2A, 0x38, 0x9E, 0x5A, 0x56},
  857. {0x64, 0xDF, 0x83, 0xF8, 0x5A, 0x53, 0x2F, 0x17,
  858. 0x57, 0x7D, 0x8C, 0x37, 0x03, 0x57, 0x96, 0xAB},
  859. {0x3E, 0x4F, 0xBD, 0xF3, 0x0F, 0xB8, 0x25, 0x9C,
  860. 0x42, 0x5C, 0xB6, 0xC9, 0x6F, 0x1F, 0x46, 0x35}
  861. };
  862. static unsigned char iv[16] = { 0 };
  863. unsigned char result[16] = { 0 };
  864. for (i = 0; i < 3; i++) {
  865. p = 0;
  866. params[p++] = OSSL_PARAM_construct_utf8_string(
  867. OSSL_KDF_PARAM_CIPHER, "CAMELLIA-128-CBC", 0);
  868. params[p++] = OSSL_PARAM_construct_utf8_string(
  869. OSSL_KDF_PARAM_MAC, "CMAC", 0);
  870. params[p++] = OSSL_PARAM_construct_utf8_string(
  871. OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
  872. params[p++] = OSSL_PARAM_construct_octet_string(
  873. OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
  874. params[p++] = OSSL_PARAM_construct_octet_string(
  875. OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
  876. params[p++] = OSSL_PARAM_construct_octet_string(
  877. OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
  878. params[p] = OSSL_PARAM_construct_end();
  879. kctx = get_kdfbyname("KBKDF");
  880. ret = TEST_ptr(kctx)
  881. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
  882. params), 0)
  883. && TEST_mem_eq(result, sizeof(result), outputs[i],
  884. sizeof(outputs[i]));
  885. EVP_KDF_CTX_free(kctx);
  886. if (ret != 1)
  887. return ret;
  888. }
  889. return ret;
  890. }
  891. static int test_kdf_kbkdf_6803_256(void)
  892. {
  893. int ret = 0, i, p;
  894. EVP_KDF_CTX *kctx;
  895. OSSL_PARAM params[7];
  896. static unsigned char input_key[] = {
  897. 0xB9, 0xD6, 0x82, 0x8B, 0x20, 0x56, 0xB7, 0xBE,
  898. 0x65, 0x6D, 0x88, 0xA1, 0x23, 0xB1, 0xFA, 0xC6,
  899. 0x82, 0x14, 0xAC, 0x2B, 0x72, 0x7E, 0xCF, 0x5F,
  900. 0x69, 0xAF, 0xE0, 0xC4, 0xDF, 0x2A, 0x6D, 0x2C,
  901. };
  902. static unsigned char constants[][5] = {
  903. { 0x00, 0x00, 0x00, 0x02, 0x99 },
  904. { 0x00, 0x00, 0x00, 0x02, 0xaa },
  905. { 0x00, 0x00, 0x00, 0x02, 0x55 },
  906. };
  907. static unsigned char outputs[][32] = {
  908. {0xE4, 0x67, 0xF9, 0xA9, 0x55, 0x2B, 0xC7, 0xD3,
  909. 0x15, 0x5A, 0x62, 0x20, 0xAF, 0x9C, 0x19, 0x22,
  910. 0x0E, 0xEE, 0xD4, 0xFF, 0x78, 0xB0, 0xD1, 0xE6,
  911. 0xA1, 0x54, 0x49, 0x91, 0x46, 0x1A, 0x9E, 0x50,
  912. },
  913. {0x41, 0x2A, 0xEF, 0xC3, 0x62, 0xA7, 0x28, 0x5F,
  914. 0xC3, 0x96, 0x6C, 0x6A, 0x51, 0x81, 0xE7, 0x60,
  915. 0x5A, 0xE6, 0x75, 0x23, 0x5B, 0x6D, 0x54, 0x9F,
  916. 0xBF, 0xC9, 0xAB, 0x66, 0x30, 0xA4, 0xC6, 0x04,
  917. },
  918. {0xFA, 0x62, 0x4F, 0xA0, 0xE5, 0x23, 0x99, 0x3F,
  919. 0xA3, 0x88, 0xAE, 0xFD, 0xC6, 0x7E, 0x67, 0xEB,
  920. 0xCD, 0x8C, 0x08, 0xE8, 0xA0, 0x24, 0x6B, 0x1D,
  921. 0x73, 0xB0, 0xD1, 0xDD, 0x9F, 0xC5, 0x82, 0xB0,
  922. },
  923. };
  924. static unsigned char iv[16] = { 0 };
  925. unsigned char result[32] = { 0 };
  926. for (i = 0; i < 3; i++) {
  927. p = 0;
  928. params[p++] = OSSL_PARAM_construct_utf8_string(
  929. OSSL_KDF_PARAM_CIPHER, "CAMELLIA-256-CBC", 0);
  930. params[p++] = OSSL_PARAM_construct_utf8_string(
  931. OSSL_KDF_PARAM_MAC, "CMAC", 0);
  932. params[p++] = OSSL_PARAM_construct_utf8_string(
  933. OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
  934. params[p++] = OSSL_PARAM_construct_octet_string(
  935. OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
  936. params[p++] = OSSL_PARAM_construct_octet_string(
  937. OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
  938. params[p++] = OSSL_PARAM_construct_octet_string(
  939. OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
  940. params[p] = OSSL_PARAM_construct_end();
  941. kctx = get_kdfbyname("KBKDF");
  942. ret = TEST_ptr(kctx)
  943. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
  944. params), 0)
  945. && TEST_mem_eq(result, sizeof(result), outputs[i],
  946. sizeof(outputs[i]));
  947. EVP_KDF_CTX_free(kctx);
  948. if (ret != 1)
  949. return ret;
  950. }
  951. return ret;
  952. }
  953. #endif
  954. static OSSL_PARAM *construct_kbkdf_params(char *digest, char *mac, unsigned char *key,
  955. size_t keylen, char *salt, char *info, int *r)
  956. {
  957. OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 8);
  958. OSSL_PARAM *p = params;
  959. if (params == NULL)
  960. return NULL;
  961. *p++ = OSSL_PARAM_construct_utf8_string(
  962. OSSL_KDF_PARAM_DIGEST, digest, 0);
  963. *p++ = OSSL_PARAM_construct_utf8_string(
  964. OSSL_KDF_PARAM_MAC, mac, 0);
  965. *p++ = OSSL_PARAM_construct_utf8_string(
  966. OSSL_KDF_PARAM_MODE, "COUNTER", 0);
  967. *p++ = OSSL_PARAM_construct_octet_string(
  968. OSSL_KDF_PARAM_KEY, key, keylen);
  969. *p++ = OSSL_PARAM_construct_octet_string(
  970. OSSL_KDF_PARAM_SALT, salt, strlen(salt));
  971. *p++ = OSSL_PARAM_construct_octet_string(
  972. OSSL_KDF_PARAM_INFO, info, strlen(info));
  973. *p++ = OSSL_PARAM_construct_int(
  974. OSSL_KDF_PARAM_KBKDF_R, r);
  975. *p = OSSL_PARAM_construct_end();
  976. return params;
  977. }
  978. static int test_kdf_kbkdf_invalid_digest(void)
  979. {
  980. int ret;
  981. EVP_KDF_CTX *kctx;
  982. OSSL_PARAM *params;
  983. static unsigned char key[] = {0x01};
  984. int r = 32;
  985. params = construct_kbkdf_params("blah", "HMAC", key, 1, "prf", "test", &r);
  986. if (!TEST_ptr(params))
  987. return 0;
  988. /* Negative test case - set_params should fail */
  989. kctx = get_kdfbyname("KBKDF");
  990. ret = TEST_ptr(kctx)
  991. && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
  992. EVP_KDF_CTX_free(kctx);
  993. OPENSSL_free(params);
  994. return ret;
  995. }
  996. static int test_kdf_kbkdf_invalid_mac(void)
  997. {
  998. int ret;
  999. EVP_KDF_CTX *kctx;
  1000. OSSL_PARAM *params;
  1001. static unsigned char key[] = {0x01};
  1002. int r = 32;
  1003. params = construct_kbkdf_params("sha256", "blah", key, 1, "prf", "test", &r);
  1004. if (!TEST_ptr(params))
  1005. return 0;
  1006. /* Negative test case - set_params should fail */
  1007. kctx = get_kdfbyname("KBKDF");
  1008. ret = TEST_ptr(kctx)
  1009. && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
  1010. EVP_KDF_CTX_free(kctx);
  1011. OPENSSL_free(params);
  1012. return ret;
  1013. }
  1014. static int test_kdf_kbkdf_invalid_r(void)
  1015. {
  1016. int ret;
  1017. EVP_KDF_CTX *kctx;
  1018. OSSL_PARAM *params;
  1019. static unsigned char key[] = {0x01};
  1020. int r = 31;
  1021. params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
  1022. if (!TEST_ptr(params))
  1023. return 0;
  1024. /* Negative test case - derive should fail */
  1025. kctx = get_kdfbyname("KBKDF");
  1026. ret = TEST_ptr(kctx)
  1027. && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
  1028. EVP_KDF_CTX_free(kctx);
  1029. OPENSSL_free(params);
  1030. return ret;
  1031. }
  1032. static int test_kdf_kbkdf_empty_key(void)
  1033. {
  1034. int ret;
  1035. EVP_KDF_CTX *kctx;
  1036. OSSL_PARAM *params;
  1037. static unsigned char key[] = {0x01};
  1038. unsigned char result[32] = { 0 };
  1039. int r = 32;
  1040. params = construct_kbkdf_params("sha256", "HMAC", key, 0, "prf", "test", &r);
  1041. if (!TEST_ptr(params))
  1042. return 0;
  1043. /* Negative test case - derive should fail */
  1044. kctx = get_kdfbyname("KBKDF");
  1045. ret = TEST_ptr(kctx)
  1046. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  1047. && TEST_int_eq(EVP_KDF_derive(kctx, result, sizeof(result), NULL), 0);
  1048. EVP_KDF_CTX_free(kctx);
  1049. OPENSSL_free(params);
  1050. return ret;
  1051. }
  1052. static int test_kdf_kbkdf_1byte_key(void)
  1053. {
  1054. int ret;
  1055. EVP_KDF_CTX *kctx;
  1056. OSSL_PARAM *params;
  1057. static unsigned char key[] = {0x01};
  1058. unsigned char result[32] = { 0 };
  1059. int r = 32;
  1060. params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
  1061. if (!TEST_ptr(params))
  1062. return 0;
  1063. kctx = get_kdfbyname("KBKDF");
  1064. ret = TEST_ptr(kctx)
  1065. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0);
  1066. EVP_KDF_CTX_free(kctx);
  1067. OPENSSL_free(params);
  1068. return ret;
  1069. }
  1070. static int test_kdf_kbkdf_zero_output_size(void)
  1071. {
  1072. int ret;
  1073. EVP_KDF_CTX *kctx;
  1074. OSSL_PARAM *params;
  1075. static unsigned char key[] = {0x01};
  1076. unsigned char result[32] = { 0 };
  1077. int r = 32;
  1078. params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
  1079. if (!TEST_ptr(params))
  1080. return 0;
  1081. /* Negative test case - derive should fail */
  1082. kctx = get_kdfbyname("KBKDF");
  1083. ret = TEST_ptr(kctx)
  1084. && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
  1085. && TEST_int_eq(EVP_KDF_derive(kctx, result, 0, NULL), 0);
  1086. EVP_KDF_CTX_free(kctx);
  1087. OPENSSL_free(params);
  1088. return ret;
  1089. }
  1090. /* Two test vectors from RFC 8009 (AES Encryption with HMAC-SHA2 for Kerberos
  1091. * 5) appendix A. */
  1092. static int test_kdf_kbkdf_8009_prf1(void)
  1093. {
  1094. int ret, i = 0;
  1095. EVP_KDF_CTX *kctx;
  1096. OSSL_PARAM params[6];
  1097. char *label = "prf", *digest = "sha256", *prf_input = "test",
  1098. *mac = "HMAC";
  1099. static unsigned char input_key[] = {
  1100. 0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28,
  1101. 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C,
  1102. };
  1103. static unsigned char output[] = {
  1104. 0x9D, 0x18, 0x86, 0x16, 0xF6, 0x38, 0x52, 0xFE,
  1105. 0x86, 0x91, 0x5B, 0xB8, 0x40, 0xB4, 0xA8, 0x86,
  1106. 0xFF, 0x3E, 0x6B, 0xB0, 0xF8, 0x19, 0xB4, 0x9B,
  1107. 0x89, 0x33, 0x93, 0xD3, 0x93, 0x85, 0x42, 0x95,
  1108. };
  1109. unsigned char result[sizeof(output)] = { 0 };
  1110. params[i++] = OSSL_PARAM_construct_utf8_string(
  1111. OSSL_KDF_PARAM_DIGEST, digest, 0);
  1112. params[i++] = OSSL_PARAM_construct_utf8_string(
  1113. OSSL_KDF_PARAM_MAC, mac, 0);
  1114. params[i++] = OSSL_PARAM_construct_octet_string(
  1115. OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
  1116. params[i++] = OSSL_PARAM_construct_octet_string(
  1117. OSSL_KDF_PARAM_SALT, label, strlen(label));
  1118. params[i++] = OSSL_PARAM_construct_octet_string(
  1119. OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
  1120. params[i] = OSSL_PARAM_construct_end();
  1121. kctx = get_kdfbyname("KBKDF");
  1122. ret = TEST_ptr(kctx)
  1123. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
  1124. && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
  1125. EVP_KDF_CTX_free(kctx);
  1126. return ret;
  1127. }
  1128. static int test_kdf_kbkdf_8009_prf2(void)
  1129. {
  1130. int ret, i = 0;
  1131. EVP_KDF_CTX *kctx;
  1132. OSSL_PARAM params[6];
  1133. char *label = "prf", *digest = "sha384", *prf_input = "test",
  1134. *mac = "HMAC";
  1135. static unsigned char input_key[] = {
  1136. 0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D,
  1137. 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
  1138. 0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0,
  1139. 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52,
  1140. };
  1141. static unsigned char output[] = {
  1142. 0x98, 0x01, 0xF6, 0x9A, 0x36, 0x8C, 0x2B, 0xF6,
  1143. 0x75, 0xE5, 0x95, 0x21, 0xE1, 0x77, 0xD9, 0xA0,
  1144. 0x7F, 0x67, 0xEF, 0xE1, 0xCF, 0xDE, 0x8D, 0x3C,
  1145. 0x8D, 0x6F, 0x6A, 0x02, 0x56, 0xE3, 0xB1, 0x7D,
  1146. 0xB3, 0xC1, 0xB6, 0x2A, 0xD1, 0xB8, 0x55, 0x33,
  1147. 0x60, 0xD1, 0x73, 0x67, 0xEB, 0x15, 0x14, 0xD2,
  1148. };
  1149. unsigned char result[sizeof(output)] = { 0 };
  1150. params[i++] = OSSL_PARAM_construct_utf8_string(
  1151. OSSL_KDF_PARAM_DIGEST, digest, 0);
  1152. params[i++] = OSSL_PARAM_construct_utf8_string(
  1153. OSSL_KDF_PARAM_MAC, mac, 0);
  1154. params[i++] = OSSL_PARAM_construct_octet_string(
  1155. OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
  1156. params[i++] = OSSL_PARAM_construct_octet_string(
  1157. OSSL_KDF_PARAM_SALT, label, strlen(label));
  1158. params[i++] = OSSL_PARAM_construct_octet_string(
  1159. OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
  1160. params[i] = OSSL_PARAM_construct_end();
  1161. kctx = get_kdfbyname("KBKDF");
  1162. ret = TEST_ptr(kctx)
  1163. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
  1164. && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
  1165. EVP_KDF_CTX_free(kctx);
  1166. return ret;
  1167. }
  1168. #if !defined(OPENSSL_NO_CMAC)
  1169. /*
  1170. * Test vector taken from
  1171. * https://csrc.nist.gov/CSRC/media/Projects/
  1172. * Cryptographic-Algorithm-Validation-Program/documents/KBKDF800-108/CounterMode.zip
  1173. */
  1174. static int test_kdf_kbkdf_fixedinfo(void)
  1175. {
  1176. int ret;
  1177. EVP_KDF_CTX *kctx;
  1178. OSSL_PARAM params[8], *p = params;
  1179. static char *cipher = "AES128";
  1180. static char *mac = "CMAC";
  1181. static char *mode = "COUNTER";
  1182. int use_l = 0;
  1183. int use_separator = 0;
  1184. static unsigned char input_key[] = {
  1185. 0xc1, 0x0b, 0x15, 0x2e, 0x8c, 0x97, 0xb7, 0x7e,
  1186. 0x18, 0x70, 0x4e, 0x0f, 0x0b, 0xd3, 0x83, 0x05,
  1187. };
  1188. static unsigned char fixed_input[] = {
  1189. 0x98, 0xcd, 0x4c, 0xbb, 0xbe, 0xbe, 0x15, 0xd1,
  1190. 0x7d, 0xc8, 0x6e, 0x6d, 0xba, 0xd8, 0x00, 0xa2,
  1191. 0xdc, 0xbd, 0x64, 0xf7, 0xc7, 0xad, 0x0e, 0x78,
  1192. 0xe9, 0xcf, 0x94, 0xff, 0xdb, 0xa8, 0x9d, 0x03,
  1193. 0xe9, 0x7e, 0xad, 0xf6, 0xc4, 0xf7, 0xb8, 0x06,
  1194. 0xca, 0xf5, 0x2a, 0xa3, 0x8f, 0x09, 0xd0, 0xeb,
  1195. 0x71, 0xd7, 0x1f, 0x49, 0x7b, 0xcc, 0x69, 0x06,
  1196. 0xb4, 0x8d, 0x36, 0xc4,
  1197. };
  1198. static unsigned char output[] = {
  1199. 0x26, 0xfa, 0xf6, 0x19, 0x08, 0xad, 0x9e, 0xe8,
  1200. 0x81, 0xb8, 0x30, 0x5c, 0x22, 0x1d, 0xb5, 0x3f,
  1201. };
  1202. unsigned char result[sizeof(output)] = { 0 };
  1203. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
  1204. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
  1205. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, mode, 0);
  1206. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, input_key,
  1207. sizeof(input_key));
  1208. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
  1209. fixed_input, sizeof(fixed_input));
  1210. *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &use_l);
  1211. *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR,
  1212. &use_separator);
  1213. *p = OSSL_PARAM_construct_end();
  1214. kctx = get_kdfbyname("KBKDF");
  1215. ret = TEST_ptr(kctx)
  1216. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
  1217. && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
  1218. EVP_KDF_CTX_free(kctx);
  1219. return ret;
  1220. }
  1221. #endif /* OPENSSL_NO_CMAC */
  1222. static int test_kdf_kbkdf_kmac(void)
  1223. {
  1224. int ret;
  1225. EVP_KDF_CTX *kctx;
  1226. OSSL_PARAM params[5], *p = params;
  1227. static char *mac = "KMAC256";
  1228. static unsigned char input_key[] = {
  1229. 0xDD, 0x81, 0xEF, 0xC8, 0x2C, 0xDD, 0xEC, 0x51,
  1230. 0xC4, 0x09, 0xBD, 0x8C, 0xCB, 0xAF, 0x94, 0xF6,
  1231. 0x5F, 0xFA, 0x7B, 0x92, 0xF1, 0x11, 0xF9, 0x40,
  1232. 0x2B, 0x0D, 0x6A, 0xE0, 0x5E, 0x44, 0x92, 0x34,
  1233. 0xF0, 0x3B, 0xBA, 0xF5, 0x4F, 0xEF, 0x19, 0x45,
  1234. 0xDA
  1235. };
  1236. static unsigned char context[] = {
  1237. 0x81, 0xA1, 0xFE, 0x39, 0x91, 0xEE, 0x3F, 0xD3,
  1238. 0x90, 0x4E, 0x82, 0xE6, 0x13, 0x20, 0xEC, 0x6B,
  1239. 0x6E, 0x14, 0x0B, 0xBA, 0x95, 0x5D, 0x0B, 0x52,
  1240. 0x8E, 0x27, 0x67, 0xB3, 0xE0, 0x77, 0x05, 0x15,
  1241. 0xBD, 0x78, 0xF6, 0xE8, 0x8A, 0x7D, 0x9B, 0x08,
  1242. 0x20, 0x0F, 0xE9, 0x8D, 0xD6, 0x24, 0x67, 0xE2,
  1243. 0xCC, 0x6D, 0x42, 0xE6, 0x60, 0x50, 0x20, 0x77,
  1244. 0x89, 0x89, 0xB7, 0x2D, 0xF7, 0x5F, 0xE2, 0x79,
  1245. 0xDB, 0x58, 0x0B, 0x7B, 0x02, 0xB9, 0xD9, 0xB0,
  1246. 0xFA, 0x6B, 0x0B, 0xB6, 0xD4, 0x95, 0xDB, 0x46,
  1247. 0x55, 0x5F, 0x12, 0xC3, 0xF0, 0xE0, 0x6E, 0xC8,
  1248. 0xF4, 0xF8, 0xA1, 0x64, 0x2E, 0x96, 0x74, 0x2B,
  1249. 0xC6, 0xBD, 0x22, 0xB1, 0x6A, 0xBC, 0x41, 0xDF,
  1250. 0x30, 0x32, 0xC7, 0xCE, 0x18, 0x14, 0x70, 0x2A,
  1251. 0xED, 0xE5, 0xC4, 0x6B, 0x8A, 0xA8, 0x36, 0xFD,
  1252. 0x0A, 0x76, 0x38, 0x44, 0x98, 0x0A, 0xE3, 0xC2,
  1253. 0x3A, 0x24, 0xCB, 0x45, 0xBF, 0xC9, 0x2C, 0x19,
  1254. 0xCB, 0x9D, 0x6C, 0x27, 0xDE, 0x78, 0x3E, 0x2C,
  1255. 0x3D, 0x39, 0x6E, 0x11, 0x59, 0xAE, 0x4F, 0x91,
  1256. 0x03, 0xE2, 0x7B, 0x97, 0xD6, 0x0C, 0x7D, 0x9D,
  1257. 0x5A, 0xA5, 0x47, 0x57, 0x41, 0xAD, 0x64, 0x5B,
  1258. 0xF7, 0x1D, 0x1A, 0xDA, 0x3A, 0x39, 0xDF, 0x85,
  1259. 0x0D, 0x0F, 0x50, 0x15, 0xA7, 0x3D, 0x68, 0x81,
  1260. 0x7B, 0x0D, 0xF2, 0x24, 0x24, 0x23, 0x37, 0xE5,
  1261. 0x77, 0xA6, 0x61, 0xBE, 0xFE, 0x4B, 0x3B, 0x8E,
  1262. 0x4F, 0x15, 0x4F, 0xC1, 0x30, 0xCB, 0x9E, 0xF5,
  1263. 0x06, 0x9F, 0xBB, 0x0E, 0xF2, 0xF4, 0x43, 0xBB,
  1264. 0x64, 0x45, 0xA3, 0x7D, 0x3B, 0xB4, 0x70, 0x47,
  1265. 0xDF, 0x4A, 0xA5, 0xD9, 0x2F, 0xE6, 0x25, 0xC8,
  1266. 0x1D, 0x43, 0x0A, 0xEA, 0xF9, 0xCC, 0xC7, 0x1F,
  1267. 0x8A, 0x2D, 0xD8, 0x95, 0x6B, 0x16, 0x30, 0x1D,
  1268. 0x80, 0x90, 0xA4, 0x23, 0x14, 0x59, 0xD1, 0x5A,
  1269. 0x00, 0x48, 0x8D, 0xF7, 0xEA, 0x29, 0x23, 0xDF,
  1270. 0x35, 0x26, 0x25, 0x22, 0x12, 0xC4, 0x4C, 0x09,
  1271. 0x69, 0xB8, 0xD6, 0x0C, 0x0E, 0x71, 0x90, 0x6C,
  1272. 0x42, 0x90, 0x02, 0x53, 0xC5, 0x5A, 0xEF, 0x42,
  1273. 0x66, 0x1D, 0xAF, 0x45, 0xD5, 0x31, 0xD7, 0x61,
  1274. 0x3A, 0xE6, 0x06, 0xFB, 0x83, 0x72, 0xAD, 0x82,
  1275. 0xE3, 0x6A, 0x7E, 0x03, 0x9B, 0x37, 0x77, 0xAF,
  1276. 0x8D, 0x63, 0x28, 0xC2, 0x8A, 0x5E, 0xC6, 0x3B,
  1277. 0x22, 0xA8, 0x94, 0xC0, 0x46, 0x2F, 0x73, 0xE7,
  1278. 0xBB, 0x72, 0x44, 0x85, 0x20, 0x1D, 0xD0, 0x6A,
  1279. 0x52, 0x8C, 0xB1, 0x8B, 0x96, 0x11, 0xEB, 0xFB,
  1280. 0xDD, 0xF5, 0x74, 0x49, 0x19, 0x93, 0xD3, 0x7F,
  1281. 0x6C, 0x27, 0x19, 0x54, 0xDD, 0x00, 0x0F, 0x95,
  1282. 0xF6, 0x14, 0x15, 0x87, 0x32, 0x54, 0xA5, 0x02,
  1283. 0xAD, 0x41, 0x55, 0x5E, 0xDD, 0x32, 0x62, 0x3B,
  1284. 0xFC, 0x71, 0xC1, 0x56, 0xC4, 0x6A, 0xFC, 0xD0,
  1285. 0xF9, 0x77, 0xDA, 0xC5, 0x20, 0x7D, 0xAC, 0xA8,
  1286. 0xEB, 0x8F, 0xBE, 0xF9, 0x4D, 0xE8, 0x6D, 0x9E,
  1287. 0x4C, 0x39, 0xB3, 0x15, 0x63, 0xCD, 0xF6, 0x46,
  1288. 0xEC, 0x3A, 0xD2, 0x89, 0xA9, 0xFA, 0x24, 0xB4,
  1289. 0x0E, 0x62, 0x6F, 0x9F, 0xF3, 0xF1, 0x3C, 0x61,
  1290. 0x57, 0xB9, 0x2C, 0xD4, 0x78, 0x4F, 0x76, 0xCF,
  1291. 0xFB, 0x6A, 0x51, 0xE8, 0x1E, 0x0A, 0x33, 0x69,
  1292. 0x16, 0xCD, 0xB7, 0x5C, 0xDF, 0x03, 0x62, 0x17,
  1293. 0x63, 0x37, 0x49, 0xC3, 0xB7, 0x68, 0x09, 0x9E,
  1294. 0x22, 0xD2, 0x20, 0x96, 0x37, 0x0D, 0x13, 0xA4,
  1295. 0x96, 0xB1, 0x8D, 0x0B, 0x12, 0x87, 0xEB, 0x57,
  1296. 0x25, 0x27, 0x08, 0xFC, 0x90, 0x5E, 0x33, 0x77,
  1297. 0x50, 0x63, 0xE1, 0x8C, 0xF4, 0x0C, 0x80, 0x89,
  1298. 0x76, 0x63, 0x70, 0x0A, 0x61, 0x59, 0x90, 0x1F,
  1299. 0xC9, 0x47, 0xBA, 0x12, 0x7B, 0xB2, 0x7A, 0x44,
  1300. 0xC3, 0x3D, 0xD0, 0x38, 0xF1, 0x7F, 0x02, 0x92
  1301. };
  1302. static unsigned char label[] = {
  1303. 0xA5, 0xDE, 0x2A, 0x0A, 0xF0, 0xDA, 0x59, 0x04,
  1304. 0xCC, 0xFF, 0x50, 0xD3, 0xA5, 0xD2, 0xDE, 0xA3,
  1305. 0x33, 0xC0, 0x27, 0xED, 0xDC, 0x6A, 0x54, 0x54,
  1306. 0x95, 0x78, 0x74, 0x0D, 0xE7, 0xB7, 0x92, 0xD6,
  1307. 0x64, 0xD5, 0xFB, 0x1F, 0x0F, 0x87, 0xFD, 0x65,
  1308. 0x79, 0x8B, 0x81, 0x83, 0x95, 0x40, 0x7A, 0x19,
  1309. 0x8D, 0xCA, 0xE0, 0x4A, 0x93, 0xA8
  1310. };
  1311. static unsigned char output[] = {
  1312. 0xB5, 0x61, 0xE3, 0x7D, 0x06, 0xD5, 0x34, 0x80,
  1313. 0x74, 0x61, 0x16, 0x08, 0x6F, 0x89, 0x6F, 0xB1,
  1314. 0x43, 0xAF, 0x61, 0x28, 0x93, 0xD8, 0xDF, 0xF6,
  1315. 0xB6, 0x23, 0x43, 0x68, 0xE4, 0x84, 0xF3, 0xED,
  1316. 0x50, 0xB6, 0x81, 0x6D, 0x50, 0xF4, 0xAF, 0xF2,
  1317. 0xA5, 0x50, 0x7E, 0x25, 0xBF, 0x05, 0xBE, 0xE7,
  1318. 0x07, 0xB0, 0x95, 0xC3, 0x04, 0x38, 0xB4, 0xF9,
  1319. 0xC1, 0x1E, 0x96, 0x08, 0xF4, 0xC9, 0x05, 0x54,
  1320. 0x4A, 0xB6, 0x81, 0x92, 0x5B, 0x34, 0x8A, 0x45,
  1321. 0xDD, 0x7D, 0x98, 0x51, 0x1F, 0xD9, 0x90, 0x23,
  1322. 0x59, 0x97, 0xA2, 0x4E, 0x43, 0x49, 0xEB, 0x4E,
  1323. 0x86, 0xEC, 0x20, 0x3C, 0x31, 0xFF, 0x49, 0x55,
  1324. 0x49, 0xF5, 0xF5, 0x16, 0x79, 0xD9, 0x1C, 0x8E,
  1325. 0x6E, 0xB3, 0x1C, 0xAF, 0xC8, 0xAB, 0x3A, 0x5A,
  1326. 0xCE, 0xB1, 0xBD, 0x59, 0x69, 0xEE, 0xC0, 0x28,
  1327. 0x3E, 0x94, 0xD2, 0xCC, 0x91, 0x93, 0x73, 0x6A,
  1328. 0xD6, 0xB6, 0xC1, 0x42, 0x97, 0xB1, 0x13, 0xCF,
  1329. 0xF9, 0x55, 0x35, 0x50, 0xFC, 0x86, 0x75, 0x98,
  1330. 0x9F, 0xFC, 0x96, 0xB1, 0x43, 0x41, 0x8F, 0xFC,
  1331. 0x31, 0x09, 0x3B, 0x35, 0x22, 0x7B, 0x01, 0x96,
  1332. 0xA7, 0xF0, 0x78, 0x7B, 0x57, 0x00, 0xF2, 0xE5,
  1333. 0x92, 0x36, 0xCE, 0x64, 0xFD, 0x65, 0x09, 0xD8,
  1334. 0xBC, 0x5C, 0x82, 0x5C, 0x4C, 0x62, 0x5B, 0xCE,
  1335. 0x09, 0xB6, 0xCF, 0x4D, 0xAD, 0x8E, 0xDD, 0x96,
  1336. 0xB0, 0xCA, 0x52, 0xC1, 0xF4, 0x17, 0x0E, 0x2D,
  1337. 0x4E, 0xC3, 0xF9, 0x89, 0x1A, 0x24, 0x3D, 0x01,
  1338. 0xC8, 0x05, 0xBF, 0x7D, 0x2A, 0x46, 0xCD, 0x9A,
  1339. 0x66, 0xEE, 0x05, 0x78, 0x88, 0x2A, 0xEF, 0x37,
  1340. 0x9E, 0x72, 0x55, 0xDA, 0x82, 0x7A, 0x9B, 0xE8,
  1341. 0xF7, 0xA6, 0x74, 0xB8, 0x74, 0x39, 0x03, 0xE8,
  1342. 0xB9, 0x1F, 0x97, 0x78, 0xB9, 0xD9, 0x37, 0x16,
  1343. 0xFD, 0x2F, 0x31, 0xDE, 0xCC, 0x06, 0xD6, 0x5A,
  1344. 0xEB, 0xD1, 0xBB, 0x84, 0x30, 0x16, 0x81, 0xB0,
  1345. 0x7E, 0x04, 0x8C, 0x06, 0x67, 0xD1, 0x8A, 0x07,
  1346. 0x33, 0x76, 0x42, 0x8E, 0x87, 0xAB, 0x90, 0x6F,
  1347. 0x08, 0xED, 0x8D, 0xE8, 0xD0, 0x20, 0x00, 0x7E,
  1348. 0x3C, 0x4D, 0xA4, 0x40, 0x37, 0x13, 0x0F, 0x00,
  1349. 0x0C, 0xB7, 0x26, 0x03, 0x93, 0xD0, 0xBB, 0x08,
  1350. 0xD3, 0xCC, 0xA9, 0x28, 0xC2
  1351. };
  1352. unsigned char result[sizeof(output)] = { 0 };
  1353. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
  1354. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
  1355. input_key, sizeof(input_key));
  1356. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
  1357. context, sizeof(context));
  1358. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
  1359. label, sizeof(label));
  1360. *p = OSSL_PARAM_construct_end();
  1361. kctx = get_kdfbyname("KBKDF");
  1362. ret = TEST_ptr(kctx)
  1363. && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX)
  1364. && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
  1365. && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
  1366. EVP_KDF_CTX_free(kctx);
  1367. return ret;
  1368. }
  1369. static int test_kdf_ss_hmac(void)
  1370. {
  1371. int ret;
  1372. EVP_KDF_CTX *kctx;
  1373. OSSL_PARAM params[6], *p = params;
  1374. unsigned char out[16];
  1375. static unsigned char z[] = {
  1376. 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
  1377. };
  1378. static unsigned char other[] = {
  1379. 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
  1380. };
  1381. static unsigned char salt[] = {
  1382. 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
  1383. 0x3f,0x89
  1384. };
  1385. static const unsigned char expected[sizeof(out)] = {
  1386. 0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63,
  1387. 0x1c,0xa3
  1388. };
  1389. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
  1390. (char *)OSSL_MAC_NAME_HMAC, 0);
  1391. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  1392. (char *)"sha256", 0);
  1393. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
  1394. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
  1395. sizeof(other));
  1396. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
  1397. sizeof(salt));
  1398. *p = OSSL_PARAM_construct_end();
  1399. ret =
  1400. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
  1401. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  1402. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  1403. EVP_KDF_CTX_free(kctx);
  1404. return ret;
  1405. }
  1406. static int test_kdf_ss_kmac(void)
  1407. {
  1408. int ret;
  1409. EVP_KDF_CTX *kctx;
  1410. OSSL_PARAM params[7], *p = params;
  1411. unsigned char out[64];
  1412. size_t mac_size = 20;
  1413. static unsigned char z[] = {
  1414. 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
  1415. };
  1416. static unsigned char other[] = {
  1417. 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
  1418. };
  1419. static unsigned char salt[] = {
  1420. 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
  1421. 0x3f,0x89
  1422. };
  1423. static const unsigned char expected[sizeof(out)] = {
  1424. 0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd,
  1425. 0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2,
  1426. 0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4,
  1427. 0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95,
  1428. 0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03
  1429. };
  1430. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
  1431. (char *)OSSL_MAC_NAME_KMAC128, 0);
  1432. /* The digest parameter is not needed here and should be ignored */
  1433. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  1434. (char *)"SHA256", 0);
  1435. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
  1436. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
  1437. sizeof(other));
  1438. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
  1439. sizeof(salt));
  1440. *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, &mac_size);
  1441. *p = OSSL_PARAM_construct_end();
  1442. ret =
  1443. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
  1444. && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), 0)
  1445. && TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1)
  1446. /* The bug fix for KMAC returning SIZE_MAX was added in 3.0.8 */
  1447. && (fips_provider_version_lt(NULL, 3, 0, 8)
  1448. || TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX))
  1449. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
  1450. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  1451. EVP_KDF_CTX_free(kctx);
  1452. return ret;
  1453. }
  1454. static int test_kdf_sshkdf(void)
  1455. {
  1456. int ret;
  1457. EVP_KDF_CTX *kctx;
  1458. OSSL_PARAM params[6], *p = params;
  1459. char kdftype = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
  1460. unsigned char out[8];
  1461. /* Test data from NIST CAVS 14.1 test vectors */
  1462. static unsigned char key[] = {
  1463. 0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
  1464. 0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
  1465. 0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
  1466. 0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
  1467. 0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
  1468. 0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
  1469. 0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
  1470. 0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
  1471. 0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
  1472. 0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
  1473. 0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
  1474. 0x4e
  1475. };
  1476. static unsigned char xcghash[] = {
  1477. 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
  1478. 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
  1479. 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
  1480. };
  1481. static unsigned char sessid[] = {
  1482. 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
  1483. 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
  1484. 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
  1485. };
  1486. static const unsigned char expected[sizeof(out)] = {
  1487. 0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
  1488. };
  1489. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  1490. (char *)"sha256", 0);
  1491. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
  1492. sizeof(key));
  1493. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_XCGHASH,
  1494. xcghash, sizeof(xcghash));
  1495. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
  1496. sessid, sizeof(sessid));
  1497. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE,
  1498. &kdftype, sizeof(kdftype));
  1499. *p = OSSL_PARAM_construct_end();
  1500. ret =
  1501. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSHKDF))
  1502. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  1503. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  1504. EVP_KDF_CTX_free(kctx);
  1505. return ret;
  1506. }
  1507. static int test_kdfs_same(EVP_KDF *kdf1, EVP_KDF *kdf2)
  1508. {
  1509. /* Fast path in case the two are the same algorithm pointer */
  1510. if (kdf1 == kdf2)
  1511. return 1;
  1512. /*
  1513. * Compare their names and providers instead.
  1514. * This is necessary in a non-caching build (or a cache flush during fetch)
  1515. * because without the algorithm in the cache, fetching it a second time
  1516. * will result in a different pointer.
  1517. */
  1518. return TEST_ptr_eq(EVP_KDF_get0_provider(kdf1), EVP_KDF_get0_provider(kdf2))
  1519. && TEST_str_eq(EVP_KDF_get0_name(kdf1), EVP_KDF_get0_name(kdf2));
  1520. }
  1521. static int test_kdf_get_kdf(void)
  1522. {
  1523. EVP_KDF *kdf1 = NULL, *kdf2 = NULL;
  1524. ASN1_OBJECT *obj;
  1525. int ok = 1;
  1526. if (!TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
  1527. || !TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL))
  1528. || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(OBJ_obj2nid(obj)),
  1529. NULL))
  1530. || !test_kdfs_same(kdf1, kdf2))
  1531. ok = 0;
  1532. EVP_KDF_free(kdf1);
  1533. kdf1 = NULL;
  1534. EVP_KDF_free(kdf2);
  1535. kdf2 = NULL;
  1536. if (!TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, SN_tls1_prf, NULL))
  1537. || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, LN_tls1_prf, NULL))
  1538. || !test_kdfs_same(kdf1, kdf2))
  1539. ok = 0;
  1540. /* kdf1 is re-used below, so don't free it here */
  1541. EVP_KDF_free(kdf2);
  1542. kdf2 = NULL;
  1543. if (!TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(NID_tls1_prf), NULL))
  1544. || !test_kdfs_same(kdf1, kdf2))
  1545. ok = 0;
  1546. EVP_KDF_free(kdf1);
  1547. kdf1 = NULL;
  1548. EVP_KDF_free(kdf2);
  1549. kdf2 = NULL;
  1550. return ok;
  1551. }
  1552. #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
  1553. static int test_kdf_x942_asn1(void)
  1554. {
  1555. int ret;
  1556. EVP_KDF_CTX *kctx = NULL;
  1557. OSSL_PARAM params[4], *p = params;
  1558. const char *cek_alg = SN_id_smime_alg_CMS3DESwrap;
  1559. unsigned char out[24];
  1560. /* RFC2631 Section 2.1.6 Test data */
  1561. static unsigned char z[] = {
  1562. 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,
  1563. 0x0e,0x0f,0x10,0x11,0x12,0x13
  1564. };
  1565. static const unsigned char expected[sizeof(out)] = {
  1566. 0xa0,0x96,0x61,0x39,0x23,0x76,0xf7,0x04,
  1567. 0x4d,0x90,0x52,0xa3,0x97,0x88,0x32,0x46,
  1568. 0xb6,0x7f,0x5f,0x1e,0xf6,0x3e,0xb5,0xfb
  1569. };
  1570. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  1571. (char *)"sha1", 0);
  1572. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z,
  1573. sizeof(z));
  1574. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CEK_ALG,
  1575. (char *)cek_alg, 0);
  1576. *p = OSSL_PARAM_construct_end();
  1577. ret =
  1578. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X942KDF_ASN1))
  1579. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  1580. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  1581. EVP_KDF_CTX_free(kctx);
  1582. return ret;
  1583. }
  1584. #endif /* OPENSSL_NO_CMS */
  1585. static int test_kdf_krb5kdf(void)
  1586. {
  1587. int ret;
  1588. EVP_KDF_CTX *kctx;
  1589. OSSL_PARAM params[4], *p = params;
  1590. unsigned char out[16];
  1591. static unsigned char key[] = {
  1592. 0x42, 0x26, 0x3C, 0x6E, 0x89, 0xF4, 0xFC, 0x28,
  1593. 0xB8, 0xDF, 0x68, 0xEE, 0x09, 0x79, 0x9F, 0x15
  1594. };
  1595. static unsigned char constant[] = {
  1596. 0x00, 0x00, 0x00, 0x02, 0x99
  1597. };
  1598. static const unsigned char expected[sizeof(out)] = {
  1599. 0x34, 0x28, 0x0A, 0x38, 0x2B, 0xC9, 0x27, 0x69,
  1600. 0xB2, 0xDA, 0x2F, 0x9E, 0xF0, 0x66, 0x85, 0x4B
  1601. };
  1602. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER,
  1603. (char *)"AES-128-CBC", 0);
  1604. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
  1605. sizeof(key));
  1606. *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT,
  1607. constant, sizeof(constant));
  1608. *p = OSSL_PARAM_construct_end();
  1609. ret =
  1610. TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KRB5KDF))
  1611. && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
  1612. && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
  1613. EVP_KDF_CTX_free(kctx);
  1614. return ret;
  1615. }
  1616. static int test_kdf_hmac_drbg_settables(void)
  1617. {
  1618. int ret = 0, i = 0, j = 0;
  1619. EVP_KDF_CTX *kctx = NULL;
  1620. const OSSL_PARAM *settableparams;
  1621. OSSL_PARAM params[5];
  1622. static const unsigned char ent[32] = { 0 };
  1623. unsigned char out[32];
  1624. char digestname[32];
  1625. char macname[32];
  1626. EVP_MD *shake256 = NULL;
  1627. /* Test there are settables */
  1628. if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HMACDRBGKDF))
  1629. || !TEST_ptr(settableparams = EVP_KDF_CTX_settable_params(kctx)))
  1630. goto err;
  1631. /* Fail if no params have been set when doing a derive */
  1632. if (!TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
  1633. goto err;
  1634. /* Fail if we pass the wrong type for params */
  1635. params[1] = OSSL_PARAM_construct_end();
  1636. for (i = 0; settableparams[i].key != NULL; ++i) {
  1637. /* Skip "properties" key since it returns 1 unless the digest is also set */
  1638. if (OPENSSL_strcasecmp(settableparams[i].key,
  1639. OSSL_KDF_PARAM_PROPERTIES) != 0) {
  1640. TEST_note("Testing set int into %s fails", settableparams[i].key);
  1641. params[0] = OSSL_PARAM_construct_int(settableparams[i].key, &j);
  1642. if (!TEST_int_le(EVP_KDF_CTX_set_params(kctx, params), 0))
  1643. goto err;
  1644. }
  1645. }
  1646. /* Test that we can set values multiple times */
  1647. params[0] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_ENTROPY,
  1648. (char *)ent, sizeof(ent));
  1649. params[1] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_NONCE,
  1650. (char *)ent, sizeof(ent));
  1651. params[2] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST, "SHA256",
  1652. 0);
  1653. params[3] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_PROPERTIES, "",
  1654. 0);
  1655. params[4] = OSSL_PARAM_construct_end();
  1656. if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1))
  1657. goto err;
  1658. if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1))
  1659. goto err;
  1660. /* Test we can retrieve values back */
  1661. params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
  1662. digestname, sizeof(digestname));
  1663. params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_MAC,
  1664. macname, sizeof(macname));
  1665. params[2] = OSSL_PARAM_construct_end();
  1666. if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params), 1)
  1667. || !TEST_mem_eq(digestname, params[0].return_size, "SHA2-256", 8)
  1668. || !TEST_mem_eq(macname, params[1].return_size, "HMAC", 4))
  1669. goto err;
  1670. /* Test the derive */
  1671. if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 1))
  1672. goto err;
  1673. /* test that XOF digests are not allowed */
  1674. params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
  1675. "shake256", 0);
  1676. params[1] = OSSL_PARAM_construct_end();
  1677. if (!TEST_int_le(EVP_KDF_CTX_set_params(kctx, params), 0))
  1678. goto err;
  1679. ret = 1;
  1680. err:
  1681. EVP_MD_free(shake256);
  1682. EVP_KDF_CTX_free(kctx);
  1683. return ret;
  1684. }
  1685. static int test_kdf_hmac_drbg_gettables(void)
  1686. {
  1687. int ret = 0, i, j = 0;
  1688. EVP_KDF_CTX *kctx = NULL;
  1689. const OSSL_PARAM *gettableparams;
  1690. OSSL_PARAM params[3];
  1691. char buf[64];
  1692. /* Test there are gettables */
  1693. if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HMACDRBGKDF))
  1694. || !TEST_ptr(gettableparams = EVP_KDF_CTX_gettable_params(kctx)))
  1695. goto err;
  1696. /* Fail if we pass the wrong type for params */
  1697. params[1] = OSSL_PARAM_construct_end();
  1698. for (i = 0; gettableparams[i].key != NULL; ++i) {
  1699. params[0] = OSSL_PARAM_construct_int(gettableparams[i].key, &j);
  1700. if (!TEST_int_le(EVP_KDF_CTX_get_params(kctx, params), 0))
  1701. goto err;
  1702. }
  1703. /* fail to get params if they are not set yet */
  1704. for (i = 0; gettableparams[i].key != NULL; ++i) {
  1705. params[0] = OSSL_PARAM_construct_utf8_string(gettableparams[i].key,
  1706. buf, sizeof(buf));
  1707. if (!TEST_int_le(EVP_KDF_CTX_get_params(kctx, params), 0))
  1708. goto err;
  1709. }
  1710. ret = 1;
  1711. err:
  1712. EVP_KDF_CTX_free(kctx);
  1713. return ret;
  1714. }
  1715. int setup_tests(void)
  1716. {
  1717. ADD_TEST(test_kdf_pbkdf1);
  1718. ADD_TEST(test_kdf_pbkdf1_key_too_long);
  1719. #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
  1720. ADD_TEST(test_kdf_kbkdf_6803_128);
  1721. ADD_TEST(test_kdf_kbkdf_6803_256);
  1722. #endif
  1723. ADD_TEST(test_kdf_kbkdf_invalid_digest);
  1724. ADD_TEST(test_kdf_kbkdf_invalid_mac);
  1725. ADD_TEST(test_kdf_kbkdf_invalid_r);
  1726. ADD_TEST(test_kdf_kbkdf_zero_output_size);
  1727. ADD_TEST(test_kdf_kbkdf_empty_key);
  1728. ADD_TEST(test_kdf_kbkdf_1byte_key);
  1729. ADD_TEST(test_kdf_kbkdf_8009_prf1);
  1730. ADD_TEST(test_kdf_kbkdf_8009_prf2);
  1731. #if !defined(OPENSSL_NO_CMAC)
  1732. ADD_TEST(test_kdf_kbkdf_fixedinfo);
  1733. #endif
  1734. if (fips_provider_version_ge(NULL, 3, 1, 0))
  1735. ADD_TEST(test_kdf_kbkdf_kmac);
  1736. ADD_TEST(test_kdf_get_kdf);
  1737. ADD_TEST(test_kdf_tls1_prf);
  1738. ADD_TEST(test_kdf_tls1_prf_invalid_digest);
  1739. ADD_TEST(test_kdf_tls1_prf_zero_output_size);
  1740. ADD_TEST(test_kdf_tls1_prf_empty_secret);
  1741. ADD_TEST(test_kdf_tls1_prf_1byte_secret);
  1742. ADD_TEST(test_kdf_tls1_prf_empty_seed);
  1743. ADD_TEST(test_kdf_tls1_prf_1byte_seed);
  1744. ADD_TEST(test_kdf_hkdf);
  1745. ADD_TEST(test_kdf_hkdf_invalid_digest);
  1746. ADD_TEST(test_kdf_hkdf_zero_output_size);
  1747. ADD_TEST(test_kdf_hkdf_empty_key);
  1748. ADD_TEST(test_kdf_hkdf_1byte_key);
  1749. ADD_TEST(test_kdf_hkdf_empty_salt);
  1750. ADD_TEST(test_kdf_hkdf_gettables);
  1751. ADD_TEST(test_kdf_hkdf_gettables_expandonly);
  1752. ADD_TEST(test_kdf_hkdf_gettables_no_digest);
  1753. ADD_TEST(test_kdf_hkdf_derive_set_params_fail);
  1754. ADD_TEST(test_kdf_hkdf_set_invalid_mode);
  1755. ADD_TEST(test_kdf_hkdf_set_ctx_param_fail);
  1756. ADD_TEST(test_kdf_pbkdf2);
  1757. ADD_TEST(test_kdf_pbkdf2_small_output);
  1758. ADD_TEST(test_kdf_pbkdf2_large_output);
  1759. ADD_TEST(test_kdf_pbkdf2_small_salt);
  1760. ADD_TEST(test_kdf_pbkdf2_small_iterations);
  1761. ADD_TEST(test_kdf_pbkdf2_small_salt_pkcs5);
  1762. ADD_TEST(test_kdf_pbkdf2_small_iterations_pkcs5);
  1763. ADD_TEST(test_kdf_pbkdf2_invalid_digest);
  1764. #ifndef OPENSSL_NO_SCRYPT
  1765. ADD_TEST(test_kdf_scrypt);
  1766. #endif
  1767. ADD_TEST(test_kdf_ss_hash);
  1768. ADD_TEST(test_kdf_ss_hmac);
  1769. ADD_TEST(test_kdf_ss_kmac);
  1770. ADD_TEST(test_kdf_sshkdf);
  1771. ADD_TEST(test_kdf_x963);
  1772. #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
  1773. ADD_TEST(test_kdf_x942_asn1);
  1774. #endif
  1775. ADD_TEST(test_kdf_krb5kdf);
  1776. ADD_TEST(test_kdf_hmac_drbg_settables);
  1777. ADD_TEST(test_kdf_hmac_drbg_gettables);
  1778. return 1;
  1779. }