ec_internal_test.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385
  1. /*
  2. * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Low level APIs are deprecated for public use, but still ok for internal use.
  11. */
  12. #include "internal/deprecated.h"
  13. #include "internal/nelem.h"
  14. #include "testutil.h"
  15. #include <openssl/ec.h>
  16. #include "ec_local.h"
  17. #include <openssl/objects.h>
  18. static size_t crv_len = 0;
  19. static EC_builtin_curve *curves = NULL;
  20. /* sanity checks field_inv function pointer in EC_METHOD */
  21. static int group_field_tests(const EC_GROUP *group, BN_CTX *ctx)
  22. {
  23. BIGNUM *a = NULL, *b = NULL, *c = NULL;
  24. int ret = 0;
  25. if (group->meth->field_inv == NULL || group->meth->field_mul == NULL)
  26. return 1;
  27. BN_CTX_start(ctx);
  28. a = BN_CTX_get(ctx);
  29. b = BN_CTX_get(ctx);
  30. if (!TEST_ptr(c = BN_CTX_get(ctx))
  31. /* 1/1 = 1 */
  32. || !TEST_true(group->meth->field_inv(group, b, BN_value_one(), ctx))
  33. || !TEST_true(BN_is_one(b))
  34. /* (1/a)*a = 1 */
  35. || !TEST_true(BN_rand(a, BN_num_bits(group->field) - 1,
  36. BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY))
  37. || !TEST_true(group->meth->field_inv(group, b, a, ctx))
  38. || (group->meth->field_encode &&
  39. !TEST_true(group->meth->field_encode(group, a, a, ctx)))
  40. || (group->meth->field_encode &&
  41. !TEST_true(group->meth->field_encode(group, b, b, ctx)))
  42. || !TEST_true(group->meth->field_mul(group, c, a, b, ctx))
  43. || (group->meth->field_decode &&
  44. !TEST_true(group->meth->field_decode(group, c, c, ctx)))
  45. || !TEST_true(BN_is_one(c)))
  46. goto err;
  47. /* 1/0 = error */
  48. BN_zero(a);
  49. if (!TEST_false(group->meth->field_inv(group, b, a, ctx))
  50. || !TEST_true(ERR_GET_LIB(ERR_peek_last_error()) == ERR_LIB_EC)
  51. || !TEST_true(ERR_GET_REASON(ERR_peek_last_error()) ==
  52. EC_R_CANNOT_INVERT)
  53. /* 1/p = error */
  54. || !TEST_false(group->meth->field_inv(group, b, group->field, ctx))
  55. || !TEST_true(ERR_GET_LIB(ERR_peek_last_error()) == ERR_LIB_EC)
  56. || !TEST_true(ERR_GET_REASON(ERR_peek_last_error()) ==
  57. EC_R_CANNOT_INVERT))
  58. goto err;
  59. ERR_clear_error();
  60. ret = 1;
  61. err:
  62. BN_CTX_end(ctx);
  63. return ret;
  64. }
  65. /* wrapper for group_field_tests for explicit curve params and EC_METHOD */
  66. static int field_tests(const EC_METHOD *meth, const unsigned char *params,
  67. int len)
  68. {
  69. BN_CTX *ctx = NULL;
  70. BIGNUM *p = NULL, *a = NULL, *b = NULL;
  71. EC_GROUP *group = NULL;
  72. int ret = 0;
  73. if (!TEST_ptr(ctx = BN_CTX_new()))
  74. return 0;
  75. BN_CTX_start(ctx);
  76. p = BN_CTX_get(ctx);
  77. a = BN_CTX_get(ctx);
  78. if (!TEST_ptr(b = BN_CTX_get(ctx))
  79. || !TEST_ptr(group = EC_GROUP_new(meth))
  80. || !TEST_true(BN_bin2bn(params, len, p))
  81. || !TEST_true(BN_bin2bn(params + len, len, a))
  82. || !TEST_true(BN_bin2bn(params + 2 * len, len, b))
  83. || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
  84. || !group_field_tests(group, ctx))
  85. goto err;
  86. ret = 1;
  87. err:
  88. BN_CTX_end(ctx);
  89. BN_CTX_free(ctx);
  90. if (group != NULL)
  91. EC_GROUP_free(group);
  92. return ret;
  93. }
  94. /* NIST prime curve P-256 */
  95. static const unsigned char params_p256[] = {
  96. /* p */
  97. 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
  98. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
  99. 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
  100. /* a */
  101. 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
  102. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
  103. 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
  104. /* b */
  105. 0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3, 0xEB, 0xBD, 0x55,
  106. 0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06, 0xB0, 0xCC, 0x53, 0xB0, 0xF6,
  107. 0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2, 0x60, 0x4B
  108. };
  109. #ifndef OPENSSL_NO_EC2M
  110. /* NIST binary curve B-283 */
  111. static const unsigned char params_b283[] = {
  112. /* p */
  113. 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  114. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  115. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0xA1,
  116. /* a */
  117. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  118. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  119. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
  120. /* b */
  121. 0x02, 0x7B, 0x68, 0x0A, 0xC8, 0xB8, 0x59, 0x6D, 0xA5, 0xA4, 0xAF, 0x8A,
  122. 0x19, 0xA0, 0x30, 0x3F, 0xCA, 0x97, 0xFD, 0x76, 0x45, 0x30, 0x9F, 0xA2,
  123. 0xA5, 0x81, 0x48, 0x5A, 0xF6, 0x26, 0x3E, 0x31, 0x3B, 0x79, 0xA2, 0xF5
  124. };
  125. #endif
  126. /* test EC_GFp_simple_method directly */
  127. static int field_tests_ecp_simple(void)
  128. {
  129. TEST_info("Testing EC_GFp_simple_method()\n");
  130. return field_tests(EC_GFp_simple_method(), params_p256,
  131. sizeof(params_p256) / 3);
  132. }
  133. /* test EC_GFp_mont_method directly */
  134. static int field_tests_ecp_mont(void)
  135. {
  136. TEST_info("Testing EC_GFp_mont_method()\n");
  137. return field_tests(EC_GFp_mont_method(), params_p256,
  138. sizeof(params_p256) / 3);
  139. }
  140. #ifndef OPENSSL_NO_EC2M
  141. /* test EC_GF2m_simple_method directly */
  142. static int field_tests_ec2_simple(void)
  143. {
  144. TEST_info("Testing EC_GF2m_simple_method()\n");
  145. return field_tests(EC_GF2m_simple_method(), params_b283,
  146. sizeof(params_b283) / 3);
  147. }
  148. #endif
  149. /* test default method for a named curve */
  150. static int field_tests_default(int n)
  151. {
  152. BN_CTX *ctx = NULL;
  153. EC_GROUP *group = NULL;
  154. int nid = curves[n].nid;
  155. int ret = 0;
  156. TEST_info("Testing curve %s\n", OBJ_nid2sn(nid));
  157. if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))
  158. || !TEST_ptr(ctx = BN_CTX_new())
  159. || !group_field_tests(group, ctx))
  160. goto err;
  161. ret = 1;
  162. err:
  163. if (group != NULL)
  164. EC_GROUP_free(group);
  165. if (ctx != NULL)
  166. BN_CTX_free(ctx);
  167. return ret;
  168. }
  169. #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
  170. /*
  171. * Tests a point known to cause an incorrect underflow in an old version of
  172. * ecp_nist521.c
  173. */
  174. static int underflow_test(void)
  175. {
  176. BN_CTX *ctx = NULL;
  177. EC_GROUP *grp = NULL;
  178. EC_POINT *P = NULL, *Q = NULL, *R = NULL;
  179. BIGNUM *x1 = NULL, *y1 = NULL, *z1 = NULL, *x2 = NULL, *y2 = NULL;
  180. BIGNUM *k = NULL;
  181. int testresult = 0;
  182. const char *x1str =
  183. "1534f0077fffffe87e9adcfe000000000000000000003e05a21d2400002e031b1f4"
  184. "b80000c6fafa4f3c1288798d624a247b5e2ffffffffffffffefe099241900004";
  185. const char *p521m1 =
  186. "1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  187. "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe";
  188. ctx = BN_CTX_new();
  189. if (!TEST_ptr(ctx))
  190. return 0;
  191. BN_CTX_start(ctx);
  192. x1 = BN_CTX_get(ctx);
  193. y1 = BN_CTX_get(ctx);
  194. z1 = BN_CTX_get(ctx);
  195. x2 = BN_CTX_get(ctx);
  196. y2 = BN_CTX_get(ctx);
  197. k = BN_CTX_get(ctx);
  198. if (!TEST_ptr(k))
  199. goto err;
  200. grp = EC_GROUP_new_by_curve_name(NID_secp521r1);
  201. P = EC_POINT_new(grp);
  202. Q = EC_POINT_new(grp);
  203. R = EC_POINT_new(grp);
  204. if (!TEST_ptr(grp) || !TEST_ptr(P) || !TEST_ptr(Q) || !TEST_ptr(R))
  205. goto err;
  206. if (!TEST_int_gt(BN_hex2bn(&x1, x1str), 0)
  207. || !TEST_int_gt(BN_hex2bn(&y1, p521m1), 0)
  208. || !TEST_int_gt(BN_hex2bn(&z1, p521m1), 0)
  209. || !TEST_int_gt(BN_hex2bn(&k, "02"), 0)
  210. || !TEST_true(ossl_ec_GFp_simple_set_Jprojective_coordinates_GFp(grp, P, x1,
  211. y1, z1, ctx))
  212. || !TEST_true(EC_POINT_mul(grp, Q, NULL, P, k, ctx))
  213. || !TEST_true(EC_POINT_get_affine_coordinates(grp, Q, x1, y1, ctx))
  214. || !TEST_true(EC_POINT_dbl(grp, R, P, ctx))
  215. || !TEST_true(EC_POINT_get_affine_coordinates(grp, R, x2, y2, ctx)))
  216. goto err;
  217. if (!TEST_int_eq(BN_cmp(x1, x2), 0)
  218. || !TEST_int_eq(BN_cmp(y1, y2), 0))
  219. goto err;
  220. testresult = 1;
  221. err:
  222. BN_CTX_end(ctx);
  223. EC_POINT_free(P);
  224. EC_POINT_free(Q);
  225. EC_POINT_free(R);
  226. EC_GROUP_free(grp);
  227. BN_CTX_free(ctx);
  228. return testresult;
  229. }
  230. #endif
  231. /*
  232. * Tests behavior of the decoded_from_explicit_params flag and API
  233. */
  234. static int decoded_flag_test(void)
  235. {
  236. EC_GROUP *grp;
  237. EC_GROUP *grp_copy = NULL;
  238. ECPARAMETERS *ecparams = NULL;
  239. ECPKPARAMETERS *ecpkparams = NULL;
  240. EC_KEY *key = NULL;
  241. unsigned char *encodedparams = NULL;
  242. const unsigned char *encp;
  243. int encodedlen;
  244. int testresult = 0;
  245. /* Test EC_GROUP_new not setting the flag */
  246. grp = EC_GROUP_new(EC_GFp_simple_method());
  247. if (!TEST_ptr(grp)
  248. || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
  249. goto err;
  250. EC_GROUP_free(grp);
  251. /* Test EC_GROUP_new_by_curve_name not setting the flag */
  252. grp = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
  253. if (!TEST_ptr(grp)
  254. || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
  255. goto err;
  256. /* Test EC_GROUP_new_from_ecparameters not setting the flag */
  257. if (!TEST_ptr(ecparams = EC_GROUP_get_ecparameters(grp, NULL))
  258. || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecparameters(ecparams))
  259. || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
  260. goto err;
  261. EC_GROUP_free(grp_copy);
  262. grp_copy = NULL;
  263. ECPARAMETERS_free(ecparams);
  264. ecparams = NULL;
  265. /* Test EC_GROUP_new_from_ecpkparameters not setting the flag */
  266. if (!TEST_int_eq(EC_GROUP_get_asn1_flag(grp), OPENSSL_EC_NAMED_CURVE)
  267. || !TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
  268. || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
  269. || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0)
  270. || !TEST_ptr(key = EC_KEY_new())
  271. /* Test EC_KEY_decoded_from_explicit_params on key without a group */
  272. || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), -1)
  273. || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
  274. /* Test EC_KEY_decoded_from_explicit_params negative case */
  275. || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 0))
  276. goto err;
  277. EC_GROUP_free(grp_copy);
  278. grp_copy = NULL;
  279. ECPKPARAMETERS_free(ecpkparams);
  280. ecpkparams = NULL;
  281. /* Test d2i_ECPKParameters with named params not setting the flag */
  282. if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
  283. || !TEST_ptr(encp = encodedparams)
  284. || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
  285. || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
  286. goto err;
  287. EC_GROUP_free(grp_copy);
  288. grp_copy = NULL;
  289. OPENSSL_free(encodedparams);
  290. encodedparams = NULL;
  291. /* Asn1 flag stays set to explicit with EC_GROUP_new_from_ecpkparameters */
  292. EC_GROUP_set_asn1_flag(grp, OPENSSL_EC_EXPLICIT_CURVE);
  293. if (!TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
  294. || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
  295. || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
  296. || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
  297. goto err;
  298. EC_GROUP_free(grp_copy);
  299. grp_copy = NULL;
  300. /* Test d2i_ECPKParameters with explicit params setting the flag */
  301. if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
  302. || !TEST_ptr(encp = encodedparams)
  303. || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
  304. || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
  305. || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 1)
  306. || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
  307. /* Test EC_KEY_decoded_from_explicit_params positive case */
  308. || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 1))
  309. goto err;
  310. testresult = 1;
  311. err:
  312. EC_KEY_free(key);
  313. EC_GROUP_free(grp);
  314. EC_GROUP_free(grp_copy);
  315. ECPARAMETERS_free(ecparams);
  316. ECPKPARAMETERS_free(ecpkparams);
  317. OPENSSL_free(encodedparams);
  318. return testresult;
  319. }
  320. int setup_tests(void)
  321. {
  322. crv_len = EC_get_builtin_curves(NULL, 0);
  323. if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
  324. || !TEST_true(EC_get_builtin_curves(curves, crv_len)))
  325. return 0;
  326. ADD_TEST(field_tests_ecp_simple);
  327. ADD_TEST(field_tests_ecp_mont);
  328. #ifndef OPENSSL_NO_EC2M
  329. ADD_TEST(field_tests_ec2_simple);
  330. #endif
  331. ADD_ALL_TESTS(field_tests_default, crv_len);
  332. #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
  333. ADD_TEST(underflow_test);
  334. #endif
  335. ADD_TEST(decoded_flag_test);
  336. return 1;
  337. }
  338. void cleanup_tests(void)
  339. {
  340. OPENSSL_free(curves);
  341. }