1 /* Copyright (c) 2015, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <stdint.h>
16 #include <stdio.h>
17 #include <string.h>
18
19 #include <gtest/gtest.h>
20
21 #include <openssl/curve25519.h>
22
23 #include "../internal.h"
24 #include "../test/file_test.h"
25 #include "../test/test_util.h"
26
27
TEST(X25519Test,TestVector)28 TEST(X25519Test, TestVector) {
29 // Taken from https://tools.ietf.org/html/rfc7748#section-5.2
30 static const uint8_t kScalar1[32] = {
31 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d, 0x3b, 0x16, 0x15,
32 0x4b, 0x82, 0x46, 0x5e, 0xdd, 0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc,
33 0x5a, 0x18, 0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4,
34 };
35 static const uint8_t kPoint1[32] = {
36 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb, 0x35, 0x94, 0xc1,
37 0xa4, 0x24, 0xb1, 0x5f, 0x7c, 0x72, 0x66, 0x24, 0xec, 0x26, 0xb3,
38 0x35, 0x3b, 0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c,
39 };
40
41 uint8_t out[32];
42 EXPECT_TRUE(X25519(out, kScalar1, kPoint1));
43
44 static const uint8_t kExpected1[32] = {
45 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90, 0x8e, 0x94, 0xea,
46 0x4d, 0xf2, 0x8d, 0x08, 0x4f, 0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c,
47 0x71, 0xf7, 0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52,
48 };
49 EXPECT_EQ(Bytes(kExpected1), Bytes(out));
50
51 static const uint8_t kScalar2[32] = {
52 0x4b, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c, 0x5a, 0xd2, 0x26,
53 0x91, 0x95, 0x7d, 0x6a, 0xf5, 0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea,
54 0x01, 0xd4, 0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x0d,
55 };
56 static const uint8_t kPoint2[32] = {
57 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3, 0xf4, 0xb7, 0x95,
58 0x9d, 0x05, 0x38, 0xae, 0x2c, 0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0,
59 0x3c, 0x3e, 0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x93,
60 };
61
62 EXPECT_TRUE(X25519(out, kScalar2, kPoint2));
63
64 static const uint8_t kExpected2[32] = {
65 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d, 0x7a, 0xad, 0xe4,
66 0x5c, 0xb4, 0xb8, 0x73, 0xf8, 0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f,
67 0xa1, 0x52, 0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57,
68 };
69 EXPECT_EQ(Bytes(kExpected2), Bytes(out));
70 }
71
TEST(X25519Test,SmallOrder)72 TEST(X25519Test, SmallOrder) {
73 static const uint8_t kSmallOrderPoint[32] = {
74 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3,
75 0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32,
76 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8,
77 };
78
79 uint8_t out[32], private_key[32];
80 OPENSSL_memset(private_key, 0x11, sizeof(private_key));
81
82 OPENSSL_memset(out, 0xff, sizeof(out));
83 EXPECT_FALSE(X25519(out, private_key, kSmallOrderPoint))
84 << "X25519 returned success with a small-order input.";
85
86 // For callers which don't check, |out| should still be filled with zeros.
87 static const uint8_t kZeros[32] = {0};
88 EXPECT_EQ(Bytes(kZeros), Bytes(out));
89 }
90
TEST(X25519Test,Iterated)91 TEST(X25519Test, Iterated) {
92 // Taken from https://tools.ietf.org/html/rfc7748#section-5.2.
93 uint8_t scalar[32] = {9}, point[32] = {9}, out[32];
94
95 for (unsigned i = 0; i < 1000; i++) {
96 EXPECT_TRUE(X25519(out, scalar, point));
97 OPENSSL_memcpy(point, scalar, sizeof(point));
98 OPENSSL_memcpy(scalar, out, sizeof(scalar));
99 }
100
101 static const uint8_t kExpected[32] = {
102 0x68, 0x4c, 0xf5, 0x9b, 0xa8, 0x33, 0x09, 0x55, 0x28, 0x00, 0xef,
103 0x56, 0x6f, 0x2f, 0x4d, 0x3c, 0x1c, 0x38, 0x87, 0xc4, 0x93, 0x60,
104 0xe3, 0x87, 0x5f, 0x2e, 0xb9, 0x4d, 0x99, 0x53, 0x2c, 0x51,
105 };
106
107 EXPECT_EQ(Bytes(kExpected), Bytes(scalar));
108 }
109
TEST(X25519Test,DISABLED_IteratedLarge)110 TEST(X25519Test, DISABLED_IteratedLarge) {
111 // Taken from https://tools.ietf.org/html/rfc7748#section-5.2.
112 uint8_t scalar[32] = {9}, point[32] = {9}, out[32];
113
114 for (unsigned i = 0; i < 1000000; i++) {
115 EXPECT_TRUE(X25519(out, scalar, point));
116 OPENSSL_memcpy(point, scalar, sizeof(point));
117 OPENSSL_memcpy(scalar, out, sizeof(scalar));
118 }
119
120 static const uint8_t kExpected[32] = {
121 0x7c, 0x39, 0x11, 0xe0, 0xab, 0x25, 0x86, 0xfd, 0x86, 0x44, 0x97,
122 0x29, 0x7e, 0x57, 0x5e, 0x6f, 0x3b, 0xc6, 0x01, 0xc0, 0x88, 0x3c,
123 0x30, 0xdf, 0x5f, 0x4d, 0xd2, 0xd2, 0x4f, 0x66, 0x54, 0x24,
124 };
125
126 EXPECT_EQ(Bytes(kExpected), Bytes(scalar));
127 }
128
TEST(X25519Test,Wycheproof)129 TEST(X25519Test, Wycheproof) {
130 FileTestGTest("third_party/wycheproof_testvectors/x25519_test.txt",
131 [](FileTest *t) {
132 t->IgnoreInstruction("curve");
133 t->IgnoreAttribute("curve");
134
135 // Our implementation tolerates the Wycheproof "acceptable"
136 // inputs. Wycheproof's valid vs. acceptable criteria does not match our
137 // X25519 return value, so we test only the overall output.
138 t->IgnoreAttribute("result");
139
140 std::vector<uint8_t> priv, pub, shared;
141 ASSERT_TRUE(t->GetBytes(&priv, "private"));
142 ASSERT_TRUE(t->GetBytes(&pub, "public"));
143 ASSERT_TRUE(t->GetBytes(&shared, "shared"));
144 ASSERT_EQ(32u, priv.size());
145 ASSERT_EQ(32u, pub.size());
146 uint8_t secret[32];
147 X25519(secret, priv.data(), pub.data());
148 EXPECT_EQ(Bytes(secret), Bytes(shared));
149 });
150 }
151