X-Git-Url: https://www.bearssl.org/gitweb//home/git/?p=BearSSL;a=blobdiff_plain;f=test%2Ftest_crypto.c;h=95edd244fb14ebf63ec5617fdf610c51da700921;hp=10faa9cb715a03bf657d9b53799174959242338c;hb=5db2d48b128326704cd33aff56c8b46e463f3bf6;hpb=6dd8c51ba7e8ca106ede7ff58b5c507042bbf6eb

diff --git a/test/test_crypto.c b/test/test_crypto.c
index 10faa9c..95edd24 100644
--- a/test/test_crypto.c
+++ b/test/test_crypto.c
@@ -591,7 +591,7 @@ test_HMAC_CT(const br_hash_class *digest_class,
 
 	br_hmac_key_init(&kc, digest_class, key, key_len);
 
-	for (u = 0; u < 130; u ++) {
+	for (u = 0; u < 2; u ++) {
 		for (v = 0; v < 130; v ++) {
 			size_t min_len, max_len;
 			size_t w;
@@ -3157,7 +3157,6 @@ test_AES_generic(char *name,
 			data_len = hextobin(plain, KAT_AES_CTR[u + 2]);
 			hextobin(cipher, KAT_AES_CTR[u + 3]);
 			vc->init(xc, key, key_len);
-
 			memcpy(buf, plain, data_len);
 			vc->run(xc, iv, 1, buf, data_len);
 			check_equals("KAT CTR AES (1)", buf, cipher, data_len);
@@ -3271,6 +3270,60 @@ test_AES_ct64(void)
 		1, 1);
 }
 
+static void
+test_AES_x86ni(void)
+{
+	const br_block_cbcenc_class *x_cbcenc;
+	const br_block_cbcdec_class *x_cbcdec;
+	const br_block_ctr_class *x_ctr;
+	int hcbcenc, hcbcdec, hctr;
+
+	x_cbcenc = br_aes_x86ni_cbcenc_get_vtable();
+	x_cbcdec = br_aes_x86ni_cbcdec_get_vtable();
+	x_ctr = br_aes_x86ni_ctr_get_vtable();
+	hcbcenc = (x_cbcenc != NULL);
+	hcbcdec = (x_cbcdec != NULL);
+	hctr = (x_ctr != NULL);
+	if (hcbcenc != hctr || hcbcdec != hctr) {
+		fprintf(stderr, "AES_x86ni availability mismatch (%d/%d/%d)\n",
+			hcbcenc, hcbcdec, hctr);
+		exit(EXIT_FAILURE);
+	}
+	if (hctr) {
+		test_AES_generic("AES_x86ni",
+			x_cbcenc, x_cbcdec, x_ctr, 1, 1);
+	} else {
+		printf("Test AES_x86ni: UNAVAILABLE\n");
+	}
+}
+
+static void
+test_AES_pwr8(void)
+{
+	const br_block_cbcenc_class *x_cbcenc;
+	const br_block_cbcdec_class *x_cbcdec;
+	const br_block_ctr_class *x_ctr;
+	int hcbcenc, hcbcdec, hctr;
+
+	x_cbcenc = br_aes_pwr8_cbcenc_get_vtable();
+	x_cbcdec = br_aes_pwr8_cbcdec_get_vtable();
+	x_ctr = br_aes_pwr8_ctr_get_vtable();
+	hcbcenc = (x_cbcenc != NULL);
+	hcbcdec = (x_cbcdec != NULL);
+	hctr = (x_ctr != NULL);
+	if (hcbcenc != hctr || hcbcdec != hctr) {
+		fprintf(stderr, "AES_pwr8 availability mismatch (%d/%d/%d)\n",
+			hcbcenc, hcbcdec, hctr);
+		exit(EXIT_FAILURE);
+	}
+	if (hctr) {
+		test_AES_generic("AES_pwr8",
+			x_cbcenc, x_cbcdec, x_ctr, 1, 1);
+	} else {
+		printf("Test AES_pwr8: UNAVAILABLE\n");
+	}
+}
+
 /*
  * DES known-answer tests. Order: plaintext, key, ciphertext.
  * (mostly from NIST SP 800-20).
@@ -4113,11 +4166,13 @@ static const struct {
 };
 
 static void
-test_Poly1305_ctmul(void)
+test_Poly1305_inner(const char *name, br_poly1305_run ipoly,
+	br_poly1305_run iref)
 {
 	size_t u;
+	br_hmac_drbg_context rng;
 
-	printf("Test Poly1305_ctmul: ");
+	printf("Test %s: ", name);
 	fflush(stdout);
 
 	for (u = 0; KAT_POLY1305[u].skey; u ++) {
@@ -4133,27 +4188,50 @@ test_Poly1305_ctmul(void)
 		hextobin(tag, KAT_POLY1305[u].stag);
 
 		memcpy(data, plain, len);
-		br_poly1305_ctmul_run(key, nonce, data, len,
+		ipoly(key, nonce, data, len,
 			aad, aad_len, tmp, br_chacha20_ct_run, 1);
-		if (memcmp(data, cipher, len) != 0) {
-			fprintf(stderr, "ChaCha20+Poly1305 KAT failed (1)\n");
-			exit(EXIT_FAILURE);
-		}
-		if (memcmp(tmp, tag, 16) != 0) {
-			fprintf(stderr, "ChaCha20+Poly1305 KAT failed (2)\n");
-			exit(EXIT_FAILURE);
-		}
-		br_poly1305_ctmul_run(key, nonce, data, len,
+		check_equals("ChaCha20+Poly1305 KAT (1)", data, cipher, len);
+		check_equals("ChaCha20+Poly1305 KAT (2)", tmp, tag, 16);
+		ipoly(key, nonce, data, len,
 			aad, aad_len, tmp, br_chacha20_ct_run, 0);
-		if (memcmp(data, plain, len) != 0) {
-			fprintf(stderr, "ChaCha20+Poly1305 KAT failed (3)\n");
+		check_equals("ChaCha20+Poly1305 KAT (3)", data, plain, len);
+		check_equals("ChaCha20+Poly1305 KAT (4)", tmp, tag, 16);
+
+		printf(".");
+		fflush(stdout);
+	}
+
+	printf(" ");
+	fflush(stdout);
+
+	/*
+	 * We compare the "ipoly" and "iref" implementations together on
+	 * a bunch of pseudo-random messages.
+	 */
+	br_hmac_drbg_init(&rng, &br_sha256_vtable, "seed for Poly1305", 17);
+	for (u = 0; u < 100; u ++) {
+		unsigned char plain[100], aad[100], tmp[100];
+		unsigned char key[32], iv[12], tag1[16], tag2[16];
+
+		br_hmac_drbg_generate(&rng, key, sizeof key);
+		br_hmac_drbg_generate(&rng, iv, sizeof iv);
+		br_hmac_drbg_generate(&rng, plain, u);
+		br_hmac_drbg_generate(&rng, aad, u);
+		memcpy(tmp, plain, u);
+		memset(tmp + u, 0xFF, (sizeof tmp) - u);
+		ipoly(key, iv, tmp, u, aad, u, tag1,
+			&br_chacha20_ct_run, 1);
+		memset(tmp + u, 0x00, (sizeof tmp) - u);
+		iref(key, iv, tmp, u, aad, u, tag2,
+			&br_chacha20_ct_run, 0);
+		if (memcmp(tmp, plain, u) != 0) {
+			fprintf(stderr, "cross enc/dec failed\n");
 			exit(EXIT_FAILURE);
 		}
-		if (memcmp(tmp, tag, 16) != 0) {
-			fprintf(stderr, "ChaCha20+Poly1305 KAT failed (4)\n");
+		if (memcmp(tag1, tag2, sizeof tag1) != 0) {
+			fprintf(stderr, "cross MAC failed\n");
 			exit(EXIT_FAILURE);
 		}
-
 		printf(".");
 		fflush(stdout);
 	}
@@ -4162,6 +4240,41 @@ test_Poly1305_ctmul(void)
 	fflush(stdout);
 }
 
+static void
+test_Poly1305_ctmul(void)
+{
+	test_Poly1305_inner("Poly1305_ctmul", &br_poly1305_ctmul_run,
+		&br_poly1305_i15_run);
+}
+
+static void
+test_Poly1305_ctmul32(void)
+{
+	test_Poly1305_inner("Poly1305_ctmul32", &br_poly1305_ctmul32_run,
+		&br_poly1305_i15_run);
+}
+
+static void
+test_Poly1305_i15(void)
+{
+	test_Poly1305_inner("Poly1305_i15", &br_poly1305_i15_run,
+		&br_poly1305_ctmul_run);
+}
+
+static void
+test_Poly1305_ctmulq(void)
+{
+	br_poly1305_run bp;
+
+	bp = br_poly1305_ctmulq_get();
+	if (bp == 0) {
+		printf("Test Poly1305_ctmulq: UNAVAILABLE\n");
+	} else {
+		test_Poly1305_inner("Poly1305_ctmulq", bp,
+			&br_poly1305_ctmul_run);
+	}
+}
+
 /*
  * A 1024-bit RSA key, generated with OpenSSL.
  */
@@ -4367,6 +4480,14 @@ test_RSA_sign(const char *name, br_rsa_private fpriv,
 	fflush(stdout);
 }
 
+static void
+test_RSA_i15(void)
+{
+	test_RSA_core("RSA i15 core", &br_rsa_i15_public, &br_rsa_i15_private);
+	test_RSA_sign("RSA i15 sign", &br_rsa_i15_private,
+		&br_rsa_i15_pkcs1_sign, &br_rsa_i15_pkcs1_vrfy);
+}
+
 static void
 test_RSA_i31(void)
 {
@@ -4583,6 +4704,31 @@ test_GHASH(const char *name, br_ghash gh)
 		check_equals("KAT GHASH", y, ref, sizeof ref);
 	}
 
+	for (u = 0; u <= 1024; u ++) {
+		unsigned char key[32], iv[12];
+		unsigned char buf[1024 + 32];
+		unsigned char y0[16], y1[16];
+		char tmp[100];
+
+		memset(key, 0, sizeof key);
+		memset(iv, 0, sizeof iv);
+		br_enc32be(key, u);
+		memset(buf, 0, sizeof buf);
+		br_chacha20_ct_run(key, iv, 1, buf, sizeof buf);
+
+		memcpy(y0, buf, 16);
+		br_ghash_ctmul32(y0, buf + 16, buf + 32, u);
+		memcpy(y1, buf, 16);
+		gh(y1, buf + 16, buf + 32, u);
+		sprintf(tmp, "XREF %s (len = %u)", name, (unsigned)u);
+		check_equals(tmp, y0, y1, 16);
+
+		if ((u & 31) == 0) {
+			printf(".");
+			fflush(stdout);
+		}
+	}
+
 	printf("done.\n");
 	fflush(stdout);
 }
@@ -4605,6 +4751,32 @@ test_GHASH_ctmul64(void)
 	test_GHASH("GHASH_ctmul64", br_ghash_ctmul64);
 }
 
+static void
+test_GHASH_pclmul(void)
+{
+	br_ghash gh;
+
+	gh = br_ghash_pclmul_get();
+	if (gh == 0) {
+		printf("Test GHASH_pclmul: UNAVAILABLE\n");
+	} else {
+		test_GHASH("GHASH_pclmul", gh);
+	}
+}
+
+static void
+test_GHASH_pwr8(void)
+{
+	br_ghash gh;
+
+	gh = br_ghash_pwr8_get();
+	if (gh == 0) {
+		printf("Test GHASH_pwr8: UNAVAILABLE\n");
+	} else {
+		test_GHASH("GHASH_pwr8", gh);
+	}
+}
+
 static void
 test_EC_inner(const char *sk, const char *sU,
 	const br_ec_impl *impl, int curve)
@@ -4724,6 +4896,20 @@ test_EC_inner(const char *sk, const char *sU,
 			exit(EXIT_FAILURE);
 		}
 
+		/*
+		 * Also recomputed D = z*G with mulgen(). This must
+		 * again match.
+		 */
+		memset(eD, 0, ulen);
+		if (impl->mulgen(eD, bz, nlen, cd->curve) != ulen) {
+			fprintf(stderr, "mulgen() failed: wrong length\n");
+			exit(EXIT_FAILURE);
+		}
+		if (memcmp(eC, eD, nlen) != 0) {
+			fprintf(stderr, "mulgen() / muladd() mismatch\n");
+			exit(EXIT_FAILURE);
+		}
+
 		/*
 		 * Check with x*A = y*B. We do so by setting b = x and y = a.
 		 */
@@ -4813,6 +4999,15 @@ test_EC_KAT(const char *name, const br_ec_impl *impl, uint32_t curve_mask)
 	fflush(stdout);
 }
 
+static void
+test_EC_prime_i15(void)
+{
+	test_EC_KAT("EC_prime_i15", &br_ec_prime_i15,
+		(uint32_t)1 << BR_EC_secp256r1
+		| (uint32_t)1 << BR_EC_secp384r1
+		| (uint32_t)1 << BR_EC_secp521r1);
+}
+
 static void
 test_EC_prime_i31(void)
 {
@@ -4823,12 +5018,123 @@ test_EC_prime_i31(void)
 }
 
 static void
-test_EC_p256_i15(void)
+test_EC_p256_m15(void)
+{
+	test_EC_KAT("EC_p256_m15", &br_ec_p256_m15,
+		(uint32_t)1 << BR_EC_secp256r1);
+}
+
+static void
+test_EC_p256_m31(void)
 {
-	test_EC_KAT("EC_p256_i15", &br_ec_p256_i15,
+	test_EC_KAT("EC_p256_m31", &br_ec_p256_m31,
 		(uint32_t)1 << BR_EC_secp256r1);
 }
 
+const struct {
+	const char *scalar;
+	const char *u_in;
+	const char *u_out;
+} C25519_KAT[] = {
+	{ "A546E36BF0527C9D3B16154B82465EDD62144C0AC1FC5A18506A2244BA449AC4",
+	  "E6DB6867583030DB3594C1A424B15F7C726624EC26B3353B10A903A6D0AB1C4C",
+	  "C3DA55379DE9C6908E94EA4DF28D084F32ECCF03491C71F754B4075577A28552" },
+	{ "4B66E9D4D1B4673C5AD22691957D6AF5C11B6421E0EA01D42CA4169E7918BA0D",
+	  "E5210F12786811D3F4B7959D0538AE2C31DBE7106FC03C3EFC4CD549C715A493",
+	  "95CBDE9476E8907D7AADE45CB4B873F88B595A68799FA152E6F8F7647AAC7957" },
+	{ 0, 0, 0 }
+};
+
+static void
+test_EC_c25519(const char *name, const br_ec_impl *iec)
+{
+	unsigned char bu[32], bk[32], br[32];
+	size_t v;
+	int i;
+
+	printf("Test %s: ", name);
+	fflush(stdout);
+	for (v = 0; C25519_KAT[v].scalar; v ++) {
+		hextobin(bk, C25519_KAT[v].scalar);
+		hextobin(bu, C25519_KAT[v].u_in);
+		hextobin(br, C25519_KAT[v].u_out);
+		if (!iec->mul(bu, sizeof bu, bk, sizeof bk, BR_EC_curve25519)) {
+			fprintf(stderr, "Curve25519 multiplication failed\n");
+			exit(EXIT_FAILURE);
+		}
+		if (memcmp(bu, br, sizeof bu) != 0) {
+			fprintf(stderr, "Curve25519 failed KAT\n");
+			exit(EXIT_FAILURE);
+		}
+		printf(".");
+		fflush(stdout);
+	}
+	printf(" ");
+	fflush(stdout);
+
+	memset(bu, 0, sizeof bu);
+	bu[0] = 0x09;
+	memcpy(bk, bu, sizeof bu);
+	for (i = 1; i <= 1000; i ++) {
+		if (!iec->mul(bu, sizeof bu, bk, sizeof bk, BR_EC_curve25519)) {
+			fprintf(stderr, "Curve25519 multiplication failed"
+				" (iter=%d)\n", i);
+			exit(EXIT_FAILURE);
+		}
+		for (v = 0; v < sizeof bu; v ++) {
+			unsigned t;
+
+			t = bu[v];
+			bu[v] = bk[v];
+			bk[v] = t;
+		}
+		if (i == 1 || i == 1000) {
+			const char *sref;
+
+			sref = (i == 1)
+				? "422C8E7A6227D7BCA1350B3E2BB7279F7897B87BB6854B783C60E80311AE3079"
+				: "684CF59BA83309552800EF566F2F4D3C1C3887C49360E3875F2EB94D99532C51";
+			hextobin(br, sref);
+			if (memcmp(bk, br, sizeof bk) != 0) {
+				fprintf(stderr,
+					"Curve25519 failed KAT (iter=%d)\n", i);
+				exit(EXIT_FAILURE);
+			}
+		}
+		if (i % 100 == 0) {
+			printf(".");
+			fflush(stdout);
+		}
+	}
+
+	printf(" done.\n");
+	fflush(stdout);
+}
+
+static void
+test_EC_c25519_i15(void)
+{
+	test_EC_c25519("EC_c25519_i15", &br_ec_c25519_i15);
+}
+
+static void
+test_EC_c25519_i31(void)
+{
+	test_EC_c25519("EC_c25519_i31", &br_ec_c25519_i31);
+}
+
+static void
+test_EC_c25519_m15(void)
+{
+	test_EC_c25519("EC_c25519_m15", &br_ec_c25519_m15);
+}
+
+static void
+test_EC_c25519_m31(void)
+{
+	test_EC_c25519("EC_c25519_m31", &br_ec_c25519_m31);
+}
+
 static const unsigned char EC_P256_PUB_POINT[] = {
 	0x04, 0x60, 0xFE, 0xD4, 0xBA, 0x25, 0x5A, 0x9D,
 	0x31, 0xC9, 0x61, 0xEB, 0x74, 0xC6, 0x35, 0x6D,
@@ -5201,7 +5507,8 @@ const ecdsa_kat_vector ECDSA_KAT[] = {
 };
 
 static void
-test_ECDSA_KAT(br_ecdsa_sign sign, br_ecdsa_vrfy vrfy, int asn1)
+test_ECDSA_KAT(const br_ec_impl *iec,
+	br_ecdsa_sign sign, br_ecdsa_vrfy vrfy, int asn1)
 {
 	size_t u;
 
@@ -5228,28 +5535,28 @@ test_ECDSA_KAT(br_ecdsa_sign sign, br_ecdsa_vrfy vrfy, int asn1)
 			sig_len = hextobin(sig, kv->sraw);
 		}
 
-		if (vrfy(&br_ec_prime_i31, hash, hash_len,
+		if (vrfy(iec, hash, hash_len,
 			kv->pub, sig, sig_len) != 1)
 		{
 			fprintf(stderr, "ECDSA KAT verify failed (1)\n");
 			exit(EXIT_FAILURE);
 		}
 		hash[0] ^= 0x80;
-		if (vrfy(&br_ec_prime_i31, hash, hash_len,
+		if (vrfy(iec, hash, hash_len,
 			kv->pub, sig, sig_len) != 0)
 		{
 			fprintf(stderr, "ECDSA KAT verify shoud have failed\n");
 			exit(EXIT_FAILURE);
 		}
 		hash[0] ^= 0x80;
-		if (vrfy(&br_ec_prime_i31, hash, hash_len,
+		if (vrfy(iec, hash, hash_len,
 			kv->pub, sig, sig_len) != 1)
 		{
 			fprintf(stderr, "ECDSA KAT verify failed (2)\n");
 			exit(EXIT_FAILURE);
 		}
 
-		sig2_len = sign(&br_ec_prime_i31, kv->hf, hash, kv->priv, sig2);
+		sig2_len = sign(iec, kv->hf, hash, kv->priv, sig2);
 		if (sig2_len == 0) {
 			fprintf(stderr, "ECDSA KAT sign failed\n");
 			exit(EXIT_FAILURE);
@@ -5271,10 +5578,29 @@ test_ECDSA_i31(void)
 	fflush(stdout);
 	printf("[raw]");
 	fflush(stdout);
-	test_ECDSA_KAT(&br_ecdsa_i31_sign_raw, &br_ecdsa_i31_vrfy_raw, 0);
+	test_ECDSA_KAT(&br_ec_prime_i31,
+		&br_ecdsa_i31_sign_raw, &br_ecdsa_i31_vrfy_raw, 0);
+	printf(" [asn1]");
+	fflush(stdout);
+	test_ECDSA_KAT(&br_ec_prime_i31,
+		&br_ecdsa_i31_sign_asn1, &br_ecdsa_i31_vrfy_asn1, 1);
+	printf(" done.\n");
+	fflush(stdout);
+}
+
+static void
+test_ECDSA_i15(void)
+{
+	printf("Test ECDSA/i15: ");
+	fflush(stdout);
+	printf("[raw]");
+	fflush(stdout);
+	test_ECDSA_KAT(&br_ec_prime_i15,
+		&br_ecdsa_i15_sign_raw, &br_ecdsa_i15_vrfy_raw, 0);
 	printf(" [asn1]");
 	fflush(stdout);
-	test_ECDSA_KAT(&br_ecdsa_i31_sign_asn1, &br_ecdsa_i31_vrfy_asn1, 1);
+	test_ECDSA_KAT(&br_ec_prime_i31,
+		&br_ecdsa_i15_sign_asn1, &br_ecdsa_i15_vrfy_asn1, 1);
 	printf(" done.\n");
 	fflush(stdout);
 }
@@ -5339,18 +5665,32 @@ static const struct {
 	STU(AES_small),
 	STU(AES_ct),
 	STU(AES_ct64),
+	STU(AES_pwr8),
+	STU(AES_x86ni),
 	STU(DES_tab),
 	STU(DES_ct),
 	STU(ChaCha20_ct),
 	STU(Poly1305_ctmul),
+	STU(Poly1305_ctmul32),
+	STU(Poly1305_ctmulq),
+	STU(Poly1305_i15),
+	STU(RSA_i15),
 	STU(RSA_i31),
 	STU(RSA_i32),
 	STU(GHASH_ctmul),
 	STU(GHASH_ctmul32),
 	STU(GHASH_ctmul64),
+	STU(GHASH_pclmul),
+	STU(GHASH_pwr8),
+	STU(EC_prime_i15),
 	STU(EC_prime_i31),
-	STU(EC_p256_i15),
-	/* STU(EC_prime_i32), */
+	STU(EC_p256_m15),
+	STU(EC_p256_m31),
+	STU(EC_c25519_i15),
+	STU(EC_c25519_i31),
+	STU(EC_c25519_m15),
+	STU(EC_c25519_m31),
+	STU(ECDSA_i15),
 	STU(ECDSA_i31),
 	{ 0, 0 }
 };