aead_test.cc revision fdeb488e6332a17729db5a04236e48a46a019272 
1/* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15#include <stdint.h>
16#include <string.h>
17
18#include <vector>
19
20#include <openssl/aead.h>
21#include <openssl/crypto.h>
22#include <openssl/err.h>
23
24#include "../test/file_test.h"
25#include "../test/scoped_types.h"
26#include "../test/stl_compat.h"
27
28
29// This program tests an AEAD against a series of test vectors from a file,
30// using the FileTest format. As an example, here's a valid test case:
31//
32//   KEY: 5a19f3173586b4c42f8412f4d5a786531b3231753e9e00998aec12fda8df10e4
33//   NONCE: 978105dfce667bf4
34//   IN: 6a4583908d
35//   AD: b654574932
36//   CT: 5294265a60
37//   TAG: 1d45758621762e061368e68868e2f929
38
39static bool TestAEAD(FileTest *t, void *arg) {
40  const EVP_AEAD *aead = reinterpret_cast<const EVP_AEAD*>(arg);
41
42  std::vector<uint8_t> key, nonce, in, ad, ct, tag;
43  if (!t->GetBytes(&key, "KEY") ||
44      !t->GetBytes(&nonce, "NONCE") ||
45      !t->GetBytes(&in, "IN") ||
46      !t->GetBytes(&ad, "AD") ||
47      !t->GetBytes(&ct, "CT") ||
48      !t->GetBytes(&tag, "TAG")) {
49    return false;
50  }
51
52  ScopedEVP_AEAD_CTX ctx;
53  if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead,
54                                        bssl::vector_data(&key), key.size(),
55                                        tag.size(), evp_aead_seal)) {
56    t->PrintLine("Failed to init AEAD.");
57    return false;
58  }
59
60  std::vector<uint8_t> out(in.size() + EVP_AEAD_max_overhead(aead));
61  if (!t->HasAttribute("NO_SEAL")) {
62    size_t out_len;
63    if (!EVP_AEAD_CTX_seal(ctx.get(), bssl::vector_data(&out), &out_len,
64                           out.size(), bssl::vector_data(&nonce), nonce.size(),
65                           bssl::vector_data(&in), in.size(),
66                           bssl::vector_data(&ad), ad.size())) {
67      t->PrintLine("Failed to run AEAD.");
68      return false;
69    }
70    out.resize(out_len);
71
72    if (out.size() != ct.size() + tag.size()) {
73      t->PrintLine("Bad output length: %u vs %u.", (unsigned)out_len,
74                   (unsigned)(ct.size() + tag.size()));
75      return false;
76    }
77    if (!t->ExpectBytesEqual(bssl::vector_data(&ct), ct.size(),
78                             bssl::vector_data(&out), ct.size()) ||
79        !t->ExpectBytesEqual(bssl::vector_data(&tag), tag.size(),
80                             bssl::vector_data(&out) + ct.size(), tag.size())) {
81      return false;
82    }
83  } else {
84    out.resize(ct.size() + tag.size());
85    memcpy(bssl::vector_data(&out), bssl::vector_data(&ct), ct.size());
86    memcpy(bssl::vector_data(&out) + ct.size(), bssl::vector_data(&tag),
87           tag.size());
88  }
89
90  // The "stateful" AEADs for implementing pre-AEAD cipher suites need to be
91  // reset after each operation.
92  ctx.Reset();
93  if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead,
94                                        bssl::vector_data(&key), key.size(),
95                                        tag.size(), evp_aead_open)) {
96    t->PrintLine("Failed to init AEAD.");
97    return false;
98  }
99
100  std::vector<uint8_t> out2(out.size());
101  size_t out2_len;
102  int ret = EVP_AEAD_CTX_open(ctx.get(),
103                              bssl::vector_data(&out2), &out2_len, out2.size(),
104                              bssl::vector_data(&nonce), nonce.size(),
105                              bssl::vector_data(&out), out.size(),
106                              bssl::vector_data(&ad), ad.size());
107  if (t->HasAttribute("FAILS")) {
108    if (ret) {
109      t->PrintLine("Decrypted bad data.");
110      return false;
111    }
112    ERR_clear_error();
113    return true;
114  }
115
116  if (!ret) {
117    t->PrintLine("Failed to decrypt.");
118    return false;
119  }
120  out2.resize(out2_len);
121  if (!t->ExpectBytesEqual(bssl::vector_data(&in), in.size(),
122                           bssl::vector_data(&out2), out2.size())) {
123    return false;
124  }
125
126  // The "stateful" AEADs for implementing pre-AEAD cipher suites need to be
127  // reset after each operation.
128  ctx.Reset();
129  if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead,
130                                        bssl::vector_data(&key), key.size(),
131                                        tag.size(), evp_aead_open)) {
132    t->PrintLine("Failed to init AEAD.");
133    return false;
134  }
135
136  // Garbage at the end isn't ignored.
137  out.push_back(0);
138  out2.resize(out.size());
139  if (EVP_AEAD_CTX_open(ctx.get(), bssl::vector_data(&out2), &out2_len,
140                        out2.size(), bssl::vector_data(&nonce), nonce.size(),
141                        bssl::vector_data(&out), out.size(),
142                        bssl::vector_data(&ad), ad.size())) {
143    t->PrintLine("Decrypted bad data with trailing garbage.");
144    return false;
145  }
146  ERR_clear_error();
147
148  // The "stateful" AEADs for implementing pre-AEAD cipher suites need to be
149  // reset after each operation.
150  ctx.Reset();
151  if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead,
152                                        bssl::vector_data(&key), key.size(),
153                                        tag.size(), evp_aead_open)) {
154    t->PrintLine("Failed to init AEAD.");
155    return false;
156  }
157
158  // Verify integrity is checked.
159  out[0] ^= 0x80;
160  out.resize(out.size() - 1);
161  out2.resize(out.size());
162  if (EVP_AEAD_CTX_open(ctx.get(), bssl::vector_data(&out2), &out2_len,
163                        out2.size(), bssl::vector_data(&nonce), nonce.size(),
164                        bssl::vector_data(&out), out.size(),
165                        bssl::vector_data(&ad), ad.size())) {
166    t->PrintLine("Decrypted bad data with corrupted byte.");
167    return false;
168  }
169  ERR_clear_error();
170
171  return true;
172}
173
174static int TestCleanupAfterInitFailure(const EVP_AEAD *aead) {
175  EVP_AEAD_CTX ctx;
176  uint8_t key[128];
177
178  memset(key, 0, sizeof(key));
179  const size_t key_len = EVP_AEAD_key_length(aead);
180  if (key_len > sizeof(key)) {
181    fprintf(stderr, "Key length of AEAD too long.\n");
182    return 0;
183  }
184
185  if (EVP_AEAD_CTX_init(&ctx, aead, key, key_len,
186                        9999 /* a silly tag length to trigger an error */,
187                        NULL /* ENGINE */) != 0) {
188    fprintf(stderr, "A silly tag length didn't trigger an error!\n");
189    return 0;
190  }
191  ERR_clear_error();
192
193  /* Running a second, failed _init should not cause a memory leak. */
194  if (EVP_AEAD_CTX_init(&ctx, aead, key, key_len,
195                        9999 /* a silly tag length to trigger an error */,
196                        NULL /* ENGINE */) != 0) {
197    fprintf(stderr, "A silly tag length didn't trigger an error!\n");
198    return 0;
199  }
200  ERR_clear_error();
201
202  /* Calling _cleanup on an |EVP_AEAD_CTX| after a failed _init should be a
203   * no-op. */
204  EVP_AEAD_CTX_cleanup(&ctx);
205  return 1;
206}
207
208struct AEADName {
209  const char name[40];
210  const EVP_AEAD *(*func)(void);
211};
212
213static const struct AEADName kAEADs[] = {
214  { "aes-128-gcm", EVP_aead_aes_128_gcm },
215  { "aes-256-gcm", EVP_aead_aes_256_gcm },
216  { "chacha20-poly1305", EVP_aead_chacha20_poly1305_rfc7539 },
217  { "chacha20-poly1305-old", EVP_aead_chacha20_poly1305_old },
218  { "rc4-md5-tls", EVP_aead_rc4_md5_tls },
219  { "rc4-sha1-tls", EVP_aead_rc4_sha1_tls },
220  { "aes-128-cbc-sha1-tls", EVP_aead_aes_128_cbc_sha1_tls },
221  { "aes-128-cbc-sha1-tls-implicit-iv", EVP_aead_aes_128_cbc_sha1_tls_implicit_iv },
222  { "aes-128-cbc-sha256-tls", EVP_aead_aes_128_cbc_sha256_tls },
223  { "aes-256-cbc-sha1-tls", EVP_aead_aes_256_cbc_sha1_tls },
224  { "aes-256-cbc-sha1-tls-implicit-iv", EVP_aead_aes_256_cbc_sha1_tls_implicit_iv },
225  { "aes-256-cbc-sha256-tls", EVP_aead_aes_256_cbc_sha256_tls },
226  { "aes-256-cbc-sha384-tls", EVP_aead_aes_256_cbc_sha384_tls },
227  { "des-ede3-cbc-sha1-tls", EVP_aead_des_ede3_cbc_sha1_tls },
228  { "des-ede3-cbc-sha1-tls-implicit-iv", EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv },
229  { "rc4-md5-ssl3", EVP_aead_rc4_md5_ssl3 },
230  { "rc4-sha1-ssl3", EVP_aead_rc4_sha1_ssl3 },
231  { "aes-128-cbc-sha1-ssl3", EVP_aead_aes_128_cbc_sha1_ssl3 },
232  { "aes-256-cbc-sha1-ssl3", EVP_aead_aes_256_cbc_sha1_ssl3 },
233  { "des-ede3-cbc-sha1-ssl3", EVP_aead_des_ede3_cbc_sha1_ssl3 },
234  { "aes-128-key-wrap", EVP_aead_aes_128_key_wrap },
235  { "aes-256-key-wrap", EVP_aead_aes_256_key_wrap },
236  { "aes-128-ctr-hmac-sha256", EVP_aead_aes_128_ctr_hmac_sha256 },
237  { "aes-256-ctr-hmac-sha256", EVP_aead_aes_256_ctr_hmac_sha256 },
238  { "", NULL },
239};
240
241int main(int argc, char **argv) {
242  CRYPTO_library_init();
243
244  if (argc != 3) {
245    fprintf(stderr, "%s <aead> <test file.txt>\n", argv[0]);
246    return 1;
247  }
248
249  const EVP_AEAD *aead;
250  for (unsigned i = 0;; i++) {
251    const struct AEADName &aead_name = kAEADs[i];
252    if (aead_name.func == NULL) {
253      fprintf(stderr, "Unknown AEAD: %s\n", argv[1]);
254      return 2;
255    }
256    if (strcmp(aead_name.name, argv[1]) == 0) {
257      aead = aead_name.func();
258      break;
259    }
260  }
261
262  if (!TestCleanupAfterInitFailure(aead)) {
263    return 1;
264  }
265
266  return FileTestMain(TestAEAD, const_cast<EVP_AEAD*>(aead), argv[2]);
267}
268