1 /* Copyright (c) 2018, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 // cavp_kas_test processes NIST CAVP ECC KAS test vector request files and
16 // emits the corresponding response.
17
18 #include <vector>
19
20 #include <openssl/bn.h>
21 #include <openssl/crypto.h>
22 #include <openssl/digest.h>
23 #include <openssl/ecdh.h>
24 #include <openssl/ecdsa.h>
25 #include <openssl/ec_key.h>
26 #include <openssl/err.h>
27 #include <openssl/nid.h>
28 #include <openssl/sha.h>
29 #include <openssl/span.h>
30
31 #include "../crypto/internal.h"
32 #include "../crypto/test/file_test.h"
33 #include "../crypto/test/test_util.h"
34 #include "cavp_test_util.h"
35
36
TestKAS(FileTest * t,void * arg)37 static bool TestKAS(FileTest *t, void *arg) {
38 const bool validate = *reinterpret_cast<bool *>(arg);
39
40 int nid = NID_undef;
41 size_t digest_len = 0;
42
43 if (t->HasInstruction("EB - SHA224")) {
44 nid = NID_secp224r1;
45 digest_len = SHA224_DIGEST_LENGTH;
46 } else if (t->HasInstruction("EC - SHA256")) {
47 nid = NID_X9_62_prime256v1;
48 digest_len = SHA256_DIGEST_LENGTH;
49 } else if (t->HasInstruction("ED - SHA384")) {
50 nid = NID_secp384r1;
51 digest_len = SHA384_DIGEST_LENGTH;
52 } else if (t->HasInstruction("EE - SHA512")) {
53 nid = NID_secp521r1;
54 digest_len = SHA512_DIGEST_LENGTH;
55 } else {
56 return false;
57 }
58
59 if (!t->HasAttribute("COUNT")) {
60 return false;
61 }
62
63 bssl::UniquePtr<BIGNUM> their_x(GetBIGNUM(t, "QeCAVSx"));
64 bssl::UniquePtr<BIGNUM> their_y(GetBIGNUM(t, "QeCAVSy"));
65 bssl::UniquePtr<EC_KEY> ec_key(EC_KEY_new_by_curve_name(nid));
66 bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
67 if (!their_x || !their_y || !ec_key || !ctx) {
68 return false;
69 }
70
71 const EC_GROUP *const group = EC_KEY_get0_group(ec_key.get());
72 bssl::UniquePtr<EC_POINT> their_point(EC_POINT_new(group));
73 if (!their_point ||
74 !EC_POINT_set_affine_coordinates_GFp(
75 group, their_point.get(), their_x.get(), their_y.get(), ctx.get())) {
76 return false;
77 }
78
79 if (validate) {
80 bssl::UniquePtr<BIGNUM> our_k(GetBIGNUM(t, "deIUT"));
81 if (!our_k ||
82 !EC_KEY_set_private_key(ec_key.get(), our_k.get()) ||
83 // These attributes are ignored.
84 !t->HasAttribute("QeIUTx") ||
85 !t->HasAttribute("QeIUTy")) {
86 return false;
87 }
88 } else if (!EC_KEY_generate_key(ec_key.get())) {
89 return false;
90 }
91
92 uint8_t digest[EVP_MAX_MD_SIZE];
93 if (!ECDH_compute_key_fips(digest, digest_len, their_point.get(),
94 ec_key.get())) {
95 return false;
96 }
97
98 if (validate) {
99 std::vector<uint8_t> expected_shared_bytes;
100 if (!t->GetBytes(&expected_shared_bytes, "CAVSHashZZ")) {
101 return false;
102 }
103 const bool ok =
104 digest_len == expected_shared_bytes.size() &&
105 OPENSSL_memcmp(digest, expected_shared_bytes.data(), digest_len) == 0;
106
107 printf("%sIUTHashZZ = %s\r\nResult = %c\r\n\r\n\r\n",
108 t->CurrentTestToString().c_str(),
109 EncodeHex(bssl::MakeConstSpan(digest, digest_len)).c_str(),
110 ok ? 'P' : 'F');
111 } else {
112 const EC_POINT *pub = EC_KEY_get0_public_key(ec_key.get());
113 bssl::UniquePtr<BIGNUM> x(BN_new());
114 bssl::UniquePtr<BIGNUM> y(BN_new());
115 if (!x || !y ||
116 !EC_POINT_get_affine_coordinates_GFp(group, pub, x.get(), y.get(),
117 ctx.get())) {
118 return false;
119 }
120 bssl::UniquePtr<char> x_hex(BN_bn2hex(x.get()));
121 bssl::UniquePtr<char> y_hex(BN_bn2hex(y.get()));
122
123 printf("%sQeIUTx = %s\r\nQeIUTy = %s\r\nHashZZ = %s\r\n",
124 t->CurrentTestToString().c_str(), x_hex.get(), y_hex.get(),
125 EncodeHex(bssl::MakeConstSpan(digest, digest_len)).c_str());
126 }
127
128 return true;
129 }
130
cavp_kas_test_main(int argc,char ** argv)131 int cavp_kas_test_main(int argc, char **argv) {
132 if (argc != 3) {
133 fprintf(stderr, "usage: %s (validity|function) <test file>\n",
134 argv[0]);
135 return 1;
136 }
137
138 bool validity;
139 if (strcmp(argv[1], "validity") == 0) {
140 validity = true;
141 } else if (strcmp(argv[1], "function") == 0) {
142 validity = false;
143 } else {
144 fprintf(stderr, "Unknown test type: %s\n", argv[1]);
145 return 1;
146 }
147
148 FileTest::Options opts;
149 opts.path = argv[2];
150 opts.arg = &validity;
151 opts.callback = TestKAS;
152 opts.silent = true;
153 opts.comment_callback = EchoComment;
154 opts.is_kas_test = true;
155 return FileTestMain(opts);
156 }
157