123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601 |
- /*
- * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
- #include <string.h>
- #include <openssl/evp.h>
- #include <openssl/kdf.h>
- #include <openssl/rand_drbg.h>
- #include <openssl/core_names.h>
- #include <openssl/param_build.h>
- #include "internal/cryptlib.h"
- #include "internal/nelem.h"
- #include "self_test.h"
- #include "self_test_data.inc"
- #include "../../crypto/rand/rand_local.h"
- #define DRBG_PARAM_ENTROPY "DRBG-ENTROPY"
- #define DRBG_PARAM_NONCE "DRBG-NONCE"
- static int self_test_digest(const ST_KAT_DIGEST *t, OSSL_SELF_TEST *st,
- OPENSSL_CTX *libctx)
- {
- int ok = 0;
- unsigned char out[EVP_MAX_MD_SIZE];
- unsigned int out_len = 0;
- EVP_MD_CTX *ctx = EVP_MD_CTX_new();
- EVP_MD *md = EVP_MD_fetch(libctx, t->algorithm, NULL);
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_DIGEST, t->desc);
- if (ctx == NULL
- || md == NULL
- || !EVP_DigestInit_ex(ctx, md, NULL)
- || !EVP_DigestUpdate(ctx, t->pt, t->pt_len)
- || !EVP_DigestFinal(ctx, out, &out_len))
- goto err;
- /* Optional corruption */
- OSSL_SELF_TEST_oncorrupt_byte(st, out);
- if (out_len != t->expected_len
- || memcmp(out, t->expected, out_len) != 0)
- goto err;
- ok = 1;
- err:
- EVP_MD_free(md);
- EVP_MD_CTX_free(ctx);
- OSSL_SELF_TEST_onend(st, ok);
- return ok;
- }
- /*
- * Helper function to setup a EVP_CipherInit
- * Used to hide the complexity of Authenticated ciphers.
- */
- static int cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
- const ST_KAT_CIPHER *t, int enc)
- {
- unsigned char *in_tag = NULL;
- int pad = 0, tmp;
- /* Flag required for Key wrapping */
- EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);
- if (t->tag == NULL) {
- /* Use a normal cipher init */
- return EVP_CipherInit_ex(ctx, cipher, NULL, t->key, t->iv, enc)
- && EVP_CIPHER_CTX_set_padding(ctx, pad);
- }
- /* The authenticated cipher init */
- if (!enc)
- in_tag = (unsigned char *)t->tag;
- return EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc)
- && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, t->iv_len, NULL)
- && (in_tag == NULL
- || EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, t->tag_len,
- in_tag))
- && EVP_CipherInit_ex(ctx, NULL, NULL, t->key, t->iv, enc)
- && EVP_CIPHER_CTX_set_padding(ctx, pad)
- && EVP_CipherUpdate(ctx, NULL, &tmp, t->aad, t->aad_len);
- }
- /* Test a single KAT for encrypt/decrypt */
- static int self_test_cipher(const ST_KAT_CIPHER *t, OSSL_SELF_TEST *st,
- OPENSSL_CTX *libctx)
- {
- int ret = 0, encrypt = 1, len, ct_len = 0, pt_len = 0;
- EVP_CIPHER_CTX *ctx = NULL;
- EVP_CIPHER *cipher = NULL;
- unsigned char ct_buf[256] = { 0 };
- unsigned char pt_buf[256] = { 0 };
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_CIPHER, t->base.desc);
- ctx = EVP_CIPHER_CTX_new();
- if (ctx == NULL)
- goto err;
- cipher = EVP_CIPHER_fetch(libctx, t->base.algorithm, "");
- if (cipher == NULL)
- goto err;
- /* Encrypt plain text message */
- if (!cipher_init(ctx, cipher, t, encrypt)
- || !EVP_CipherUpdate(ctx, ct_buf, &len, t->base.pt, t->base.pt_len)
- || !EVP_CipherFinal_ex(ctx, ct_buf + len, &ct_len))
- goto err;
- OSSL_SELF_TEST_oncorrupt_byte(st, ct_buf);
- ct_len += len;
- if (ct_len != (int)t->base.expected_len
- || memcmp(t->base.expected, ct_buf, ct_len) != 0)
- goto err;
- if (t->tag != NULL) {
- unsigned char tag[16] = { 0 };
- if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, t->tag_len, tag)
- || memcmp(tag, t->tag, t->tag_len) != 0)
- goto err;
- }
- if (!(cipher_init(ctx, cipher, t, !encrypt)
- && EVP_CipherUpdate(ctx, pt_buf, &len, ct_buf, ct_len)
- && EVP_CipherFinal_ex(ctx, pt_buf + len, &pt_len)))
- goto err;
- pt_len += len;
- if (pt_len != (int)t->base.pt_len
- || memcmp(pt_buf, t->base.pt, pt_len) != 0)
- goto err;
- ret = 1;
- err:
- EVP_CIPHER_free(cipher);
- EVP_CIPHER_CTX_free(ctx);
- OSSL_SELF_TEST_onend(st, ret);
- return ret;
- }
- static int add_params(OSSL_PARAM_BLD *bld, const ST_KAT_PARAM *params,
- BN_CTX *ctx)
- {
- int ret = 0;
- const ST_KAT_PARAM *p;
- if (params == NULL)
- return 1;
- for (p = params; p->data != NULL; ++p)
- {
- switch (p->type) {
- case OSSL_PARAM_UNSIGNED_INTEGER: {
- BIGNUM *bn = BN_CTX_get(ctx);
- if (bn == NULL
- || (BN_bin2bn(p->data, p->data_len, bn) == NULL)
- || !OSSL_PARAM_BLD_push_BN(bld, p->name, bn))
- goto err;
- break;
- }
- case OSSL_PARAM_UTF8_STRING: {
- if (!OSSL_PARAM_BLD_push_utf8_string(bld, p->name, p->data, 0))
- goto err;
- break;
- }
- case OSSL_PARAM_OCTET_STRING: {
- if (!OSSL_PARAM_BLD_push_octet_string(bld, p->name, p->data,
- p->data_len))
- goto err;
- break;
- }
- default:
- break;
- }
- }
- ret = 1;
- err:
- return ret;
- }
- static int self_test_kdf(const ST_KAT_KDF *t, OSSL_SELF_TEST *st,
- OPENSSL_CTX *libctx)
- {
- int ret = 0;
- unsigned char out[64];
- EVP_KDF *kdf = NULL;
- EVP_KDF_CTX *ctx = NULL;
- BN_CTX *bnctx = NULL;
- OSSL_PARAM *params = NULL;
- OSSL_PARAM_BLD *bld = NULL;
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_KDF, t->desc);
- bld = OSSL_PARAM_BLD_new();
- if (bld == NULL)
- goto err;
- kdf = EVP_KDF_fetch(libctx, t->algorithm, "");
- if (kdf == NULL)
- goto err;
- ctx = EVP_KDF_new_ctx(kdf);
- if (ctx == NULL)
- goto err;
- bnctx = BN_CTX_new_ex(libctx);
- if (bnctx == NULL)
- goto err;
- if (!add_params(bld, t->params, bnctx))
- goto err;
- params = OSSL_PARAM_BLD_to_param(bld);
- if (params == NULL)
- goto err;
- if (!EVP_KDF_set_ctx_params(ctx, params))
- goto err;
- if (t->expected_len > sizeof(out))
- goto err;
- if (EVP_KDF_derive(ctx, out, t->expected_len) <= 0)
- goto err;
- OSSL_SELF_TEST_oncorrupt_byte(st, out);
- if (memcmp(out, t->expected, t->expected_len) != 0)
- goto err;
- ret = 1;
- err:
- EVP_KDF_free(kdf);
- EVP_KDF_free_ctx(ctx);
- BN_CTX_free(bnctx);
- OSSL_PARAM_BLD_free_params(params);
- OSSL_PARAM_BLD_free(bld);
- OSSL_SELF_TEST_onend(st, ret);
- return ret;
- }
- static size_t drbg_kat_entropy_cb(RAND_DRBG *drbg, unsigned char **pout,
- int entropy, size_t min_len, size_t max_len,
- int prediction_resistance)
- {
- OSSL_PARAM *drbg_params = RAND_DRBG_get_callback_data(drbg);
- OSSL_PARAM *p = OSSL_PARAM_locate(drbg_params, DRBG_PARAM_ENTROPY);
- if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
- return 0;
- *pout = (unsigned char *)p->data;
- return p->data_size;
- }
- static size_t drbg_kat_nonce_cb(RAND_DRBG *drbg, unsigned char **pout,
- int entropy, size_t min_len, size_t max_len)
- {
- OSSL_PARAM *drbg_params = RAND_DRBG_get_callback_data(drbg);
- OSSL_PARAM *p = OSSL_PARAM_locate(drbg_params, DRBG_PARAM_NONCE);
- if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
- return 0;
- *pout = (unsigned char *)p->data;
- return p->data_size;
- }
- static int self_test_drbg(const ST_KAT_DRBG *t, OSSL_SELF_TEST *st,
- OPENSSL_CTX *libctx)
- {
- int ret = 0;
- unsigned char out[256];
- RAND_DRBG *drbg = NULL;
- unsigned int flags = 0;
- int prediction_resistance = 1; /* Causes a reseed */
- OSSL_PARAM drbg_params[3] = {
- OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END
- };
- static const unsigned char zero[sizeof(drbg->data)] = { 0 };
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_DRBG, t->desc);
- if (strcmp(t->desc, OSSL_SELF_TEST_DESC_DRBG_HMAC) == 0)
- flags |= RAND_DRBG_FLAG_HMAC;
- drbg = RAND_DRBG_new_ex(libctx, t->nid, flags, NULL);
- if (drbg == NULL)
- goto err;
- if (!RAND_DRBG_set_callback_data(drbg, drbg_params))
- goto err;
- if (!RAND_DRBG_set_callbacks(drbg, drbg_kat_entropy_cb, NULL,
- drbg_kat_nonce_cb, NULL))
- goto err;
- drbg_params[0] =
- OSSL_PARAM_construct_octet_string(DRBG_PARAM_ENTROPY,
- (void *)t->entropyin, t->entropyinlen);
- drbg_params[1] =
- OSSL_PARAM_construct_octet_string(DRBG_PARAM_NONCE,
- (void *)t->nonce, t->noncelen);
- if (!RAND_DRBG_instantiate(drbg, t->persstr, t->persstrlen))
- goto err;
- drbg_params[0] =
- OSSL_PARAM_construct_octet_string(DRBG_PARAM_ENTROPY,
- (void *)t->entropyinpr1,
- t->entropyinpr1len);
- if (!RAND_DRBG_generate(drbg, out, t->expectedlen, prediction_resistance,
- t->entropyaddin1, t->entropyaddin1len))
- goto err;
- drbg_params[0] =
- OSSL_PARAM_construct_octet_string(DRBG_PARAM_ENTROPY,
- (void *)t->entropyinpr2,
- t->entropyinpr2len);
- /* This calls RAND_DRBG_reseed() internally when prediction_resistance = 1 */
- if (!RAND_DRBG_generate(drbg, out, t->expectedlen, prediction_resistance,
- t->entropyaddin2, t->entropyaddin2len))
- goto err;
- OSSL_SELF_TEST_oncorrupt_byte(st, out);
- if (memcmp(out, t->expected, t->expectedlen) != 0)
- goto err;
- if (!RAND_DRBG_uninstantiate(drbg))
- goto err;
- /*
- * Check that the DRBG data has been zeroized after RAND_DRBG_uninstantiate.
- */
- if (memcmp((unsigned char *)&drbg->data, zero, sizeof(drbg->data)) != 0)
- goto err;
- ret = 1;
- err:
- RAND_DRBG_free(drbg);
- OSSL_SELF_TEST_onend(st, ret);
- return ret;
- }
- static int self_test_ka(const ST_KAT_KAS *t,
- OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int ret = 0;
- EVP_PKEY_CTX *kactx = NULL, *dctx = NULL;
- EVP_PKEY *pkey = NULL, *peerkey = NULL;
- OSSL_PARAM *params = NULL;
- OSSL_PARAM *params_peer = NULL;
- unsigned char secret[256];
- size_t secret_len;
- OSSL_PARAM_BLD *bld = NULL;
- BN_CTX *bnctx = NULL;
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_KA, t->desc);
- bnctx = BN_CTX_new_ex(libctx);
- if (bnctx == NULL)
- goto err;
- bld = OSSL_PARAM_BLD_new();
- if (bld == NULL)
- goto err;
- if (!add_params(bld, t->key_group, bnctx)
- || !add_params(bld, t->key_host_data, bnctx))
- goto err;
- params = OSSL_PARAM_BLD_to_param(bld);
- if (!add_params(bld, t->key_group, bnctx)
- || !add_params(bld, t->key_peer_data, bnctx))
- goto err;
- params_peer = OSSL_PARAM_BLD_to_param(bld);
- if (params == NULL || params_peer == NULL)
- goto err;
- /* Create a EVP_PKEY_CTX to load the DH keys into */
- kactx = EVP_PKEY_CTX_new_from_name(libctx, t->algorithm, "");
- if (kactx == NULL)
- goto err;
- if (EVP_PKEY_key_fromdata_init(kactx) <= 0
- || EVP_PKEY_fromdata(kactx, &pkey, params) <= 0)
- goto err;
- if (EVP_PKEY_key_fromdata_init(kactx) <= 0
- || EVP_PKEY_fromdata(kactx, &peerkey, params_peer) <= 0)
- goto err;
- /* Create a EVP_PKEY_CTX to perform key derivation */
- dctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, NULL);
- if (dctx == NULL)
- goto err;
- if (EVP_PKEY_derive_init(dctx) <= 0
- || EVP_PKEY_derive_set_peer(dctx, peerkey) <= 0
- || EVP_PKEY_derive(dctx, secret, &secret_len) <= 0)
- goto err;
- OSSL_SELF_TEST_oncorrupt_byte(st, secret);
- if (secret_len != t->expected_len
- || memcmp(secret, t->expected, t->expected_len) != 0)
- goto err;
- ret = 1;
- err:
- BN_CTX_free(bnctx);
- EVP_PKEY_free(pkey);
- EVP_PKEY_free(peerkey);
- EVP_PKEY_CTX_free(kactx);
- EVP_PKEY_CTX_free(dctx);
- OSSL_PARAM_BLD_free_params(params_peer);
- OSSL_PARAM_BLD_free_params(params);
- OSSL_PARAM_BLD_free(bld);
- OSSL_SELF_TEST_onend(st, ret);
- return ret;
- }
- static int self_test_sign(const ST_KAT_SIGN *t,
- OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int ret = 0;
- OSSL_PARAM *params = NULL, *params_sig = NULL;
- OSSL_PARAM_BLD *bld = NULL;
- EVP_PKEY_CTX *sctx = NULL, *kctx = NULL;
- EVP_PKEY *pkey = NULL;
- unsigned char sig[256];
- BN_CTX *bnctx = NULL;
- size_t siglen = 0;
- static const unsigned char dgst[] = {
- 0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81,
- 0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,
- 0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69
- };
- OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_SIGNATURE, t->desc);
- bnctx = BN_CTX_new_ex(libctx);
- if (bnctx == NULL)
- goto err;
- bld = OSSL_PARAM_BLD_new();
- if (bld == NULL)
- goto err;
- if (!add_params(bld, t->key, bnctx))
- goto err;
- params = OSSL_PARAM_BLD_to_param(bld);
- /* Create a EVP_PKEY_CTX to load the DSA key into */
- kctx = EVP_PKEY_CTX_new_from_name(libctx, t->algorithm, "");
- if (kctx == NULL || params == NULL)
- goto err;
- if (EVP_PKEY_key_fromdata_init(kctx) <= 0
- || EVP_PKEY_fromdata(kctx, &pkey, params) <= 0)
- goto err;
- /* Create a EVP_PKEY_CTX to use for the signing operation */
- sctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, NULL);
- if (sctx == NULL
- || EVP_PKEY_sign_init(sctx) <= 0)
- goto err;
- /* set signature parameters */
- if (!OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_SIGNATURE_PARAM_DIGEST,
- t->mdalgorithm,
- strlen(t->mdalgorithm) + 1))
- goto err;
- params_sig = OSSL_PARAM_BLD_to_param(bld);
- if (EVP_PKEY_CTX_set_params(sctx, params_sig) <= 0)
- goto err;
- if (EVP_PKEY_sign(sctx, sig, &siglen, dgst, sizeof(dgst)) <= 0
- || EVP_PKEY_verify_init(sctx) <= 0
- || EVP_PKEY_CTX_set_params(sctx, params_sig) <= 0)
- goto err;
- /*
- * Used by RSA, for other key types where the signature changes, we
- * can only use the verify.
- */
- if (t->sig_expected != NULL
- && (siglen != t->sig_expected_len
- || memcmp(sig, t->sig_expected, t->sig_expected_len) != 0))
- goto err;
- OSSL_SELF_TEST_oncorrupt_byte(st, sig);
- if (EVP_PKEY_verify(sctx, sig, siglen, dgst, sizeof(dgst)) <= 0)
- goto err;
- ret = 1;
- err:
- BN_CTX_free(bnctx);
- EVP_PKEY_free(pkey);
- EVP_PKEY_CTX_free(kctx);
- EVP_PKEY_CTX_free(sctx);
- OSSL_PARAM_BLD_free_params(params);
- OSSL_PARAM_BLD_free_params(params_sig);
- OSSL_PARAM_BLD_free(bld);
- OSSL_SELF_TEST_onend(st, ret);
- return ret;
- }
- /*
- * Test a data driven list of KAT's for digest algorithms.
- * All tests are run regardless of if they fail or not.
- * Return 0 if any test fails.
- */
- static int self_test_digests(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_digest_tests); ++i) {
- if (!self_test_digest(&st_kat_digest_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- static int self_test_ciphers(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_cipher_tests); ++i) {
- if (!self_test_cipher(&st_kat_cipher_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- static int self_test_kdfs(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_kdf_tests); ++i) {
- if (!self_test_kdf(&st_kat_kdf_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- static int self_test_drbgs(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_drbg_tests); ++i) {
- if (!self_test_drbg(&st_kat_drbg_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- static int self_test_kas(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_kas_tests); ++i) {
- if (!self_test_ka(&st_kat_kas_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- static int self_test_signatures(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int i, ret = 1;
- for (i = 0; i < (int)OSSL_NELEM(st_kat_sign_tests); ++i) {
- if (!self_test_sign(&st_kat_sign_tests[i], st, libctx))
- ret = 0;
- }
- return ret;
- }
- /*
- * Run the algorithm KAT's.
- * Return 1 is successful, otherwise return 0.
- * This runs all the tests regardless of if any fail.
- */
- int SELF_TEST_kats(OSSL_SELF_TEST *st, OPENSSL_CTX *libctx)
- {
- int ret = 1;
- if (!self_test_digests(st, libctx))
- ret = 0;
- if (!self_test_ciphers(st, libctx))
- ret = 0;
- if (!self_test_signatures(st, libctx))
- ret = 0;
- if (!self_test_kdfs(st, libctx))
- ret = 0;
- if (!self_test_drbgs(st, libctx))
- ret = 0;
- if (!self_test_kas(st, libctx))
- ret = 0;
- return ret;
- }
|