1 /*
2 * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2018-2020, Oracle and/or its affiliates. All rights reserved.
4 *
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
9 */
10
11 /* Tests of the EVP_KDF_CTX APIs */
12
13 #include <stdio.h>
14 #include <string.h>
15
16 #include <openssl/evp.h>
17 #include <openssl/kdf.h>
18 #include <openssl/core_names.h>
19 #include "internal/numbers.h"
20 #include "testutil.h"
21
22
get_kdfbyname_libctx(OSSL_LIB_CTX * libctx,const char * name)23 static EVP_KDF_CTX *get_kdfbyname_libctx(OSSL_LIB_CTX *libctx, const char *name)
24 {
25 EVP_KDF *kdf = EVP_KDF_fetch(libctx, name, NULL);
26 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
27
28 EVP_KDF_free(kdf);
29 return kctx;
30 }
31
get_kdfbyname(const char * name)32 static EVP_KDF_CTX *get_kdfbyname(const char *name)
33 {
34 return get_kdfbyname_libctx(NULL, name);
35 }
36
construct_tls1_prf_params(const char * digest,const char * secret,const char * seed)37 static OSSL_PARAM *construct_tls1_prf_params(const char *digest, const char *secret,
38 const char *seed)
39 {
40 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 4);
41 OSSL_PARAM *p = params;
42
43 if (params == NULL)
44 return NULL;
45
46 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
47 (char *)digest, 0);
48 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
49 (unsigned char *)secret,
50 strlen(secret));
51 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
52 (unsigned char *)seed,
53 strlen(seed));
54 *p = OSSL_PARAM_construct_end();
55
56 return params;
57 }
58
test_kdf_tls1_prf(void)59 static int test_kdf_tls1_prf(void)
60 {
61 int ret;
62 EVP_KDF_CTX *kctx = NULL;
63 unsigned char out[16];
64 OSSL_PARAM *params;
65 static const unsigned char expected[sizeof(out)] = {
66 0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
67 0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
68 };
69
70 params = construct_tls1_prf_params("sha256", "secret", "seed");
71
72 ret = TEST_ptr(params)
73 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
74 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
75 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
76
77 EVP_KDF_CTX_free(kctx);
78 OPENSSL_free(params);
79 return ret;
80 }
81
test_kdf_tls1_prf_invalid_digest(void)82 static int test_kdf_tls1_prf_invalid_digest(void)
83 {
84 int ret;
85 EVP_KDF_CTX *kctx = NULL;
86 OSSL_PARAM *params;
87
88 params = construct_tls1_prf_params("blah", "secret", "seed");
89
90 ret = TEST_ptr(params)
91 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
92 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
93
94 EVP_KDF_CTX_free(kctx);
95 OPENSSL_free(params);
96 return ret;
97 }
98
test_kdf_tls1_prf_zero_output_size(void)99 static int test_kdf_tls1_prf_zero_output_size(void)
100 {
101 int ret;
102 EVP_KDF_CTX *kctx = NULL;
103 unsigned char out[16];
104 OSSL_PARAM *params;
105
106 params = construct_tls1_prf_params("sha256", "secret", "seed");
107
108 /* Negative test - derive should fail */
109 ret = TEST_ptr(params)
110 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
111 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
112 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
113
114 EVP_KDF_CTX_free(kctx);
115 OPENSSL_free(params);
116 return ret;
117 }
118
test_kdf_tls1_prf_empty_secret(void)119 static int test_kdf_tls1_prf_empty_secret(void)
120 {
121 int ret;
122 EVP_KDF_CTX *kctx = NULL;
123 unsigned char out[16];
124 OSSL_PARAM *params;
125
126 params = construct_tls1_prf_params("sha256", "", "seed");
127
128 ret = TEST_ptr(params)
129 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
130 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
131
132 EVP_KDF_CTX_free(kctx);
133 OPENSSL_free(params);
134 return ret;
135 }
136
test_kdf_tls1_prf_1byte_secret(void)137 static int test_kdf_tls1_prf_1byte_secret(void)
138 {
139 int ret;
140 EVP_KDF_CTX *kctx = NULL;
141 unsigned char out[16];
142 OSSL_PARAM *params;
143
144 params = construct_tls1_prf_params("sha256", "1", "seed");
145
146 ret = TEST_ptr(params)
147 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
148 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
149
150 EVP_KDF_CTX_free(kctx);
151 OPENSSL_free(params);
152 return ret;
153 }
154
test_kdf_tls1_prf_empty_seed(void)155 static int test_kdf_tls1_prf_empty_seed(void)
156 {
157 int ret;
158 EVP_KDF_CTX *kctx = NULL;
159 unsigned char out[16];
160 OSSL_PARAM *params;
161
162 params = construct_tls1_prf_params("sha256", "secret", "");
163
164 /* Negative test - derive should fail */
165 ret = TEST_ptr(params)
166 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
167 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
168 && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0);
169
170 EVP_KDF_CTX_free(kctx);
171 OPENSSL_free(params);
172 return ret;
173 }
174
test_kdf_tls1_prf_1byte_seed(void)175 static int test_kdf_tls1_prf_1byte_seed(void)
176 {
177 int ret;
178 EVP_KDF_CTX *kctx = NULL;
179 unsigned char out[16];
180 OSSL_PARAM *params;
181
182 params = construct_tls1_prf_params("sha256", "secret", "1");
183
184 ret = TEST_ptr(params)
185 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
186 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
187
188 EVP_KDF_CTX_free(kctx);
189 OPENSSL_free(params);
190 return ret;
191 }
192
construct_hkdf_params(char * digest,char * key,size_t keylen,char * salt,char * info)193 static OSSL_PARAM *construct_hkdf_params(char *digest, char *key,
194 size_t keylen, char *salt, char *info)
195 {
196 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
197 OSSL_PARAM *p = params;
198
199 if (params == NULL)
200 return NULL;
201
202 if (digest != NULL)
203 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
204 digest, 0);
205 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
206 salt, strlen(salt));
207 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
208 (unsigned char *)key, keylen);
209 if (info != NULL)
210 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
211 info, strlen(info));
212 else
213 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
214 "EXTRACT_ONLY", 0);
215 *p = OSSL_PARAM_construct_end();
216
217 return params;
218 }
219
test_kdf_hkdf(void)220 static int test_kdf_hkdf(void)
221 {
222 int ret;
223 EVP_KDF_CTX *kctx = NULL;
224 unsigned char out[10];
225 OSSL_PARAM *params;
226 static const unsigned char expected[sizeof(out)] = {
227 0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
228 };
229
230 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
231
232 ret = TEST_ptr(params)
233 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
234 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
235 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
236
237 EVP_KDF_CTX_free(kctx);
238 OPENSSL_free(params);
239 return ret;
240 }
241
do_kdf_hkdf_gettables(int expand_only,int has_digest)242 static int do_kdf_hkdf_gettables(int expand_only, int has_digest)
243 {
244 int ret = 0;
245 size_t sz = 0;
246 OSSL_PARAM *params;
247 OSSL_PARAM params_get[2];
248 const OSSL_PARAM *gettables, *p;
249 EVP_KDF_CTX *kctx = NULL;
250
251 if (!TEST_ptr(params = construct_hkdf_params(
252 has_digest ? "sha256" : NULL,
253 "secret", 6, "salt",
254 expand_only ? NULL : "label"))
255 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
256 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
257 goto err;
258
259 /* Check OSSL_KDF_PARAM_SIZE is gettable */
260 if (!TEST_ptr(gettables = EVP_KDF_CTX_gettable_params(kctx))
261 || !TEST_ptr(p = OSSL_PARAM_locate_const(gettables, OSSL_KDF_PARAM_SIZE)))
262 goto err;
263
264 /* Get OSSL_KDF_PARAM_SIZE as a size_t */
265 params_get[0] = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_SIZE, &sz);
266 params_get[1] = OSSL_PARAM_construct_end();
267 if (has_digest) {
268 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1)
269 || !TEST_size_t_eq(sz, expand_only ? SHA256_DIGEST_LENGTH : SIZE_MAX))
270 goto err;
271 } else {
272 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 0))
273 goto err;
274 }
275
276 /* Get params returns -2 if an unsupported parameter is requested */
277 params_get[0] = OSSL_PARAM_construct_end();
278 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), -2))
279 goto err;
280 ret = 1;
281 err:
282 EVP_KDF_CTX_free(kctx);
283 OPENSSL_free(params);
284 return ret;
285 }
286
test_kdf_hkdf_gettables(void)287 static int test_kdf_hkdf_gettables(void)
288 {
289 return do_kdf_hkdf_gettables(0, 1);
290 }
291
test_kdf_hkdf_gettables_expandonly(void)292 static int test_kdf_hkdf_gettables_expandonly(void)
293 {
294 return do_kdf_hkdf_gettables(1, 1);
295 }
296
test_kdf_hkdf_gettables_no_digest(void)297 static int test_kdf_hkdf_gettables_no_digest(void)
298 {
299 return do_kdf_hkdf_gettables(1, 0);
300 }
301
test_kdf_hkdf_invalid_digest(void)302 static int test_kdf_hkdf_invalid_digest(void)
303 {
304 int ret;
305 EVP_KDF_CTX *kctx = NULL;
306 OSSL_PARAM *params;
307
308 params = construct_hkdf_params("blah", "secret", 6, "salt", "label");
309
310 ret = TEST_ptr(params)
311 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
312 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
313
314 EVP_KDF_CTX_free(kctx);
315 OPENSSL_free(params);
316 return ret;
317 }
318
test_kdf_hkdf_derive_set_params_fail(void)319 static int test_kdf_hkdf_derive_set_params_fail(void)
320 {
321 int ret = 0, i = 0;
322 EVP_KDF_CTX *kctx = NULL;
323 OSSL_PARAM params[2];
324 unsigned char out[10];
325
326 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
327 goto end;
328 /*
329 * Set the wrong type for the digest so that it causes a failure
330 * inside kdf_hkdf_derive() when kdf_hkdf_set_ctx_params() is called
331 */
332 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_DIGEST, &i);
333 params[1] = OSSL_PARAM_construct_end();
334 if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), params), 0))
335 goto end;
336 ret = 1;
337 end:
338 EVP_KDF_CTX_free(kctx);
339 return ret;
340 }
341
test_kdf_hkdf_set_invalid_mode(void)342 static int test_kdf_hkdf_set_invalid_mode(void)
343 {
344 int ret = 0, bad_mode = 100;
345 EVP_KDF_CTX *kctx = NULL;
346 OSSL_PARAM params[2];
347
348 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
349 goto end;
350 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
351 "BADMODE", 0);
352 params[1] = OSSL_PARAM_construct_end();
353 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
354 goto end;
355
356 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &bad_mode);
357 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
358 goto end;
359
360 ret = 1;
361 end:
362 EVP_KDF_CTX_free(kctx);
363 return ret;
364 }
365
do_kdf_hkdf_set_invalid_param(const char * key,int type)366 static int do_kdf_hkdf_set_invalid_param(const char *key, int type)
367 {
368 int ret = 0;
369 EVP_KDF_CTX *kctx = NULL;
370 OSSL_PARAM params[2];
371 unsigned char buf[2];
372
373 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
374 goto end;
375 /* Set the wrong type for the key so that it causes a failure */
376 if (type == OSSL_PARAM_UTF8_STRING)
377 params[0] = OSSL_PARAM_construct_utf8_string(key, "BAD", 0);
378 else
379 params[0] = OSSL_PARAM_construct_octet_string(key, buf, sizeof(buf));
380 params[1] = OSSL_PARAM_construct_end();
381 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
382 goto end;
383
384 ret = 1;
385 end:
386 EVP_KDF_CTX_free(kctx);
387 return ret;
388 }
389
test_kdf_hkdf_set_ctx_param_fail(void)390 static int test_kdf_hkdf_set_ctx_param_fail(void)
391 {
392 return do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_MODE,
393 OSSL_PARAM_OCTET_STRING)
394 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_KEY,
395 OSSL_PARAM_UTF8_STRING)
396 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_SALT,
397 OSSL_PARAM_UTF8_STRING)
398 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_INFO,
399 OSSL_PARAM_UTF8_STRING);
400 }
401
test_kdf_hkdf_zero_output_size(void)402 static int test_kdf_hkdf_zero_output_size(void)
403 {
404 int ret;
405 EVP_KDF_CTX *kctx = NULL;
406 unsigned char out[10];
407 OSSL_PARAM *params;
408
409 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
410
411 /* Negative test - derive should fail */
412 ret = TEST_ptr(params)
413 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
414 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
415 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
416
417 EVP_KDF_CTX_free(kctx);
418 OPENSSL_free(params);
419 return ret;
420 }
421
test_kdf_hkdf_empty_key(void)422 static int test_kdf_hkdf_empty_key(void)
423 {
424 int ret;
425 EVP_KDF_CTX *kctx = NULL;
426 unsigned char out[10];
427 OSSL_PARAM *params;
428
429 params = construct_hkdf_params("sha256", "", 0, "salt", "label");
430
431 ret = TEST_ptr(params)
432 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
433 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
434
435 EVP_KDF_CTX_free(kctx);
436 OPENSSL_free(params);
437 return ret;
438 }
439
test_kdf_hkdf_1byte_key(void)440 static int test_kdf_hkdf_1byte_key(void)
441 {
442 int ret;
443 EVP_KDF_CTX *kctx = NULL;
444 unsigned char out[10];
445 OSSL_PARAM *params;
446
447 params = construct_hkdf_params("sha256", "1", 1, "salt", "label");
448
449 ret = TEST_ptr(params)
450 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
451 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
452
453 EVP_KDF_CTX_free(kctx);
454 OPENSSL_free(params);
455 return ret;
456 }
457
test_kdf_hkdf_empty_salt(void)458 static int test_kdf_hkdf_empty_salt(void)
459 {
460 int ret;
461 EVP_KDF_CTX *kctx = NULL;
462 unsigned char out[10];
463 OSSL_PARAM *params;
464
465 params = construct_hkdf_params("sha256", "secret", 6, "", "label");
466
467 ret = TEST_ptr(params)
468 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
469 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
470
471 EVP_KDF_CTX_free(kctx);
472 OPENSSL_free(params);
473 return ret;
474 }
475
construct_pbkdf1_params(char * pass,char * digest,char * salt,unsigned int * iter)476 static OSSL_PARAM *construct_pbkdf1_params(char *pass, char *digest, char *salt,
477 unsigned int *iter)
478 {
479 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
480 OSSL_PARAM *p = params;
481
482 if (params == NULL)
483 return NULL;
484
485 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
486 (unsigned char *)pass, strlen(pass));
487 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
488 (unsigned char *)salt, strlen(salt));
489 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
490 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
491 digest, 0);
492 *p = OSSL_PARAM_construct_end();
493
494 return params;
495 }
496
test_kdf_pbkdf1(void)497 static int test_kdf_pbkdf1(void)
498 {
499 int ret = 0;
500 EVP_KDF_CTX *kctx = NULL;
501 unsigned char out[25];
502 unsigned int iterations = 4096;
503 OSSL_LIB_CTX *libctx = NULL;
504 OSSL_PARAM *params = NULL;
505 OSSL_PROVIDER *legacyprov = NULL;
506 OSSL_PROVIDER *defprov = NULL;
507 const unsigned char expected[sizeof(out)] = {
508 0xfb, 0x83, 0x4d, 0x36, 0x6d, 0xbc, 0x53, 0x87, 0x35, 0x1b, 0x34, 0x75,
509 0x95, 0x88, 0x32, 0x4f, 0x3e, 0x82, 0x81, 0x01, 0x21, 0x93, 0x64, 0x00,
510 0xcc
511 };
512
513 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
514 goto err;
515
516 /* PBKDF1 only available in the legacy provider */
517 legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
518 if (legacyprov == NULL) {
519 OSSL_LIB_CTX_free(libctx);
520 return TEST_skip("PBKDF1 only available in legacy provider");
521 }
522
523 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
524 goto err;
525
526 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
527 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
528 &iterations);
529
530 if (!TEST_ptr(params)
531 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
532 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
533 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
534 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
535 goto err;
536
537 ret = 1;
538 err:
539 EVP_KDF_CTX_free(kctx);
540 OPENSSL_free(params);
541 OSSL_PROVIDER_unload(defprov);
542 OSSL_PROVIDER_unload(legacyprov);
543 OSSL_LIB_CTX_free(libctx);
544 return ret;
545 }
546
test_kdf_pbkdf1_key_too_long(void)547 static int test_kdf_pbkdf1_key_too_long(void)
548 {
549 int ret = 0;
550 EVP_KDF_CTX *kctx = NULL;
551 unsigned char out[EVP_MAX_MD_SIZE + 1];
552 unsigned int iterations = 4096;
553 OSSL_LIB_CTX *libctx = NULL;
554 OSSL_PARAM *params = NULL;
555 OSSL_PROVIDER *legacyprov = NULL;
556 OSSL_PROVIDER *defprov = NULL;
557
558 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
559 goto err;
560
561 /* PBKDF1 only available in the legacy provider */
562 legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
563 if (legacyprov == NULL) {
564 OSSL_LIB_CTX_free(libctx);
565 return TEST_skip("PBKDF1 only available in legacy provider");
566 }
567
568 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
569 goto err;
570
571 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
572 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
573 &iterations);
574
575 /*
576 * This is the same test sequence as test_kdf_pbkdf1, but we expect
577 * failure here as the requested key size is longer than the digest
578 * can provide
579 */
580 if (!TEST_ptr(params)
581 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
582 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
583 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
584 goto err;
585
586 ret = 1;
587 err:
588 EVP_KDF_CTX_free(kctx);
589 OPENSSL_free(params);
590 OSSL_PROVIDER_unload(defprov);
591 OSSL_PROVIDER_unload(legacyprov);
592 OSSL_LIB_CTX_free(libctx);
593 return ret;
594 }
595
construct_pbkdf2_params(char * pass,char * digest,char * salt,unsigned int * iter,int * mode)596 static OSSL_PARAM *construct_pbkdf2_params(char *pass, char *digest, char *salt,
597 unsigned int *iter, int *mode)
598 {
599 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 6);
600 OSSL_PARAM *p = params;
601
602 if (params == NULL)
603 return NULL;
604
605 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
606 (unsigned char *)pass, strlen(pass));
607 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
608 (unsigned char *)salt, strlen(salt));
609 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
610 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
611 digest, 0);
612 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, mode);
613 *p = OSSL_PARAM_construct_end();
614
615 return params;
616 }
617
test_kdf_pbkdf2(void)618 static int test_kdf_pbkdf2(void)
619 {
620 int ret = 0;
621 EVP_KDF_CTX *kctx = NULL;
622 unsigned char out[25];
623 unsigned int iterations = 4096;
624 int mode = 0;
625 OSSL_PARAM *params;
626 const unsigned char expected[sizeof(out)] = {
627 0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
628 0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
629 0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
630 0x1c
631 };
632
633 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
634 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
635 &iterations, &mode);
636
637 if (!TEST_ptr(params)
638 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
639 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
640 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
641 goto err;
642
643 ret = 1;
644 err:
645 EVP_KDF_CTX_free(kctx);
646 OPENSSL_free(params);
647 return ret;
648 }
649
test_kdf_pbkdf2_small_output(void)650 static int test_kdf_pbkdf2_small_output(void)
651 {
652 int ret = 0;
653 EVP_KDF_CTX *kctx = NULL;
654 unsigned char out[25];
655 unsigned int iterations = 4096;
656 int mode = 0;
657 OSSL_PARAM *params;
658
659 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
660 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
661 &iterations, &mode);
662
663 if (!TEST_ptr(params)
664 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
665 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
666 /* A key length that is too small should fail */
667 || !TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1, NULL), 0))
668 goto err;
669
670 ret = 1;
671 err:
672 EVP_KDF_CTX_free(kctx);
673 OPENSSL_free(params);
674 return ret;
675 }
676
test_kdf_pbkdf2_large_output(void)677 static int test_kdf_pbkdf2_large_output(void)
678 {
679 int ret = 0;
680 EVP_KDF_CTX *kctx = NULL;
681 unsigned char out[25];
682 size_t len = 0;
683 unsigned int iterations = 4096;
684 int mode = 0;
685 OSSL_PARAM *params;
686
687 if (sizeof(len) > 32)
688 len = SIZE_MAX;
689
690 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
691 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
692 &iterations, &mode);
693
694 if (!TEST_ptr(params)
695 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
696 /* A key length that is too large should fail */
697 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
698 || (len != 0 && !TEST_int_eq(EVP_KDF_derive(kctx, out, len, NULL), 0)))
699 goto err;
700
701 ret = 1;
702 err:
703 EVP_KDF_CTX_free(kctx);
704 OPENSSL_free(params);
705 return ret;
706 }
707
test_kdf_pbkdf2_small_salt(void)708 static int test_kdf_pbkdf2_small_salt(void)
709 {
710 int ret = 0;
711 EVP_KDF_CTX *kctx = NULL;
712 unsigned int iterations = 4096;
713 int mode = 0;
714 OSSL_PARAM *params;
715
716 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
717 "saltSALT",
718 &iterations, &mode);
719
720 if (!TEST_ptr(params)
721 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
722 /* A salt that is too small should fail */
723 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
724 goto err;
725
726 ret = 1;
727 err:
728 EVP_KDF_CTX_free(kctx);
729 OPENSSL_free(params);
730 return ret;
731 }
732
test_kdf_pbkdf2_small_iterations(void)733 static int test_kdf_pbkdf2_small_iterations(void)
734 {
735 int ret = 0;
736 EVP_KDF_CTX *kctx = NULL;
737 unsigned int iterations = 1;
738 int mode = 0;
739 OSSL_PARAM *params;
740
741 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
742 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
743 &iterations, &mode);
744
745 if (!TEST_ptr(params)
746 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
747 /* An iteration count that is too small should fail */
748 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
749 goto err;
750
751 ret = 1;
752 err:
753 EVP_KDF_CTX_free(kctx);
754 OPENSSL_free(params);
755 return ret;
756 }
757
test_kdf_pbkdf2_small_salt_pkcs5(void)758 static int test_kdf_pbkdf2_small_salt_pkcs5(void)
759 {
760 int ret = 0;
761 EVP_KDF_CTX *kctx = NULL;
762 unsigned char out[25];
763 unsigned int iterations = 4096;
764 int mode = 1;
765 OSSL_PARAM *params;
766 OSSL_PARAM mode_params[2];
767
768 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
769 "saltSALT",
770 &iterations, &mode);
771
772 if (!TEST_ptr(params)
773 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
774 /* A salt that is too small should pass in pkcs5 mode */
775 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
776 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
777 goto err;
778
779 mode = 0;
780 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
781 mode_params[1] = OSSL_PARAM_construct_end();
782
783 /* If the "pkcs5" mode is disabled then the derive will now fail */
784 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
785 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
786 goto err;
787
788 ret = 1;
789 err:
790 EVP_KDF_CTX_free(kctx);
791 OPENSSL_free(params);
792 return ret;
793 }
794
test_kdf_pbkdf2_small_iterations_pkcs5(void)795 static int test_kdf_pbkdf2_small_iterations_pkcs5(void)
796 {
797 int ret = 0;
798 EVP_KDF_CTX *kctx = NULL;
799 unsigned char out[25];
800 unsigned int iterations = 1;
801 int mode = 1;
802 OSSL_PARAM *params;
803 OSSL_PARAM mode_params[2];
804
805 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
806 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
807 &iterations, &mode);
808
809 if (!TEST_ptr(params)
810 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
811 /* An iteration count that is too small will pass in pkcs5 mode */
812 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
813 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
814 goto err;
815
816 mode = 0;
817 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
818 mode_params[1] = OSSL_PARAM_construct_end();
819
820 /* If the "pkcs5" mode is disabled then the derive will now fail */
821 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
822 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
823 goto err;
824
825 ret = 1;
826 err:
827 EVP_KDF_CTX_free(kctx);
828 OPENSSL_free(params);
829 return ret;
830 }
831
test_kdf_pbkdf2_invalid_digest(void)832 static int test_kdf_pbkdf2_invalid_digest(void)
833 {
834 int ret = 0;
835 EVP_KDF_CTX *kctx = NULL;
836 unsigned int iterations = 4096;
837 int mode = 0;
838 OSSL_PARAM *params;
839
840 params = construct_pbkdf2_params("passwordPASSWORDpassword", "blah",
841 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
842 &iterations, &mode);
843
844 if (!TEST_ptr(params)
845 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
846 /* Unknown digest should fail */
847 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
848 goto err;
849
850 ret = 1;
851 err:
852 EVP_KDF_CTX_free(kctx);
853 OPENSSL_free(params);
854 return ret;
855 }
856
857 #ifndef OPENSSL_NO_SCRYPT
test_kdf_scrypt(void)858 static int test_kdf_scrypt(void)
859 {
860 int ret;
861 EVP_KDF_CTX *kctx;
862 OSSL_PARAM params[7], *p = params;
863 unsigned char out[64];
864 unsigned int nu = 1024, ru = 8, pu = 16, maxmem = 16;
865 static const unsigned char expected[sizeof(out)] = {
866 0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
867 0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
868 0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
869 0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
870 0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
871 0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
872 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
873 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
874 };
875
876 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
877 (char *)"password", 8);
878 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
879 (char *)"NaCl", 4);
880 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_N, &nu);
881 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_R, &ru);
882 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_P, &pu);
883 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
884 *p = OSSL_PARAM_construct_end();
885
886 ret =
887 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT))
888 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
889 /* failure test *//*
890 && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)*/
891 && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
892 && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1))
893 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
894 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
895
896 EVP_KDF_CTX_free(kctx);
897 return ret;
898 }
899 #endif /* OPENSSL_NO_SCRYPT */
900
test_kdf_ss_hash(void)901 static int test_kdf_ss_hash(void)
902 {
903 int ret;
904 EVP_KDF_CTX *kctx;
905 OSSL_PARAM params[4], *p = params;
906 unsigned char out[14];
907 static unsigned char z[] = {
908 0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e,
909 0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62,
910 0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4,
911 0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9
912 };
913 static unsigned char other[] = {
914 0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e,
915 0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde,
916 0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e,
917 0xe0,0xec,0x3f,0x8d,0xbe
918 };
919 static const unsigned char expected[sizeof(out)] = {
920 0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8
921 };
922
923 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
924 (char *)"sha224", 0);
925 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
926 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
927 sizeof(other));
928 *p = OSSL_PARAM_construct_end();
929
930 ret =
931 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
932 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
933 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
934
935 EVP_KDF_CTX_free(kctx);
936 return ret;
937 }
938
test_kdf_x963(void)939 static int test_kdf_x963(void)
940 {
941 int ret;
942 EVP_KDF_CTX *kctx;
943 OSSL_PARAM params[4], *p = params;
944 unsigned char out[1024 / 8];
945 /*
946 * Test data from https://csrc.nist.gov/CSRC/media/Projects/
947 * Cryptographic-Algorithm-Validation-Program/documents/components/
948 * 800-135testvectors/ansx963_2001.zip
949 */
950 static unsigned char z[] = {
951 0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad,
952 0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9,
953 0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f,
954 0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f,
955 0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7,
956 0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d
957 };
958 static unsigned char shared[] = {
959 0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99,
960 0x37, 0x89, 0x5d, 0x31
961 };
962 static const unsigned char expected[sizeof(out)] = {
963 0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b,
964 0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8,
965 0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5,
966 0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e,
967 0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee,
968 0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02,
969 0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7,
970 0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd,
971 0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e,
972 0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc,
973 0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16
974 };
975
976 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
977 (char *)"sha512", 0);
978 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
979 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, shared,
980 sizeof(shared));
981 *p = OSSL_PARAM_construct_end();
982
983 ret =
984 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X963KDF))
985 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
986 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
987
988 EVP_KDF_CTX_free(kctx);
989 return ret;
990 }
991
992 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
993 /*
994 * KBKDF test vectors from RFC 6803 (Camellia Encryption for Kerberos 5)
995 * section 10.
996 */
test_kdf_kbkdf_6803_128(void)997 static int test_kdf_kbkdf_6803_128(void)
998 {
999 int ret = 0, i, p;
1000 EVP_KDF_CTX *kctx;
1001 OSSL_PARAM params[7];
1002 static unsigned char input_key[] = {
1003 0x57, 0xD0, 0x29, 0x72, 0x98, 0xFF, 0xD9, 0xD3,
1004 0x5D, 0xE5, 0xA4, 0x7F, 0xB4, 0xBD, 0xE2, 0x4B,
1005 };
1006 static unsigned char constants[][5] = {
1007 { 0x00, 0x00, 0x00, 0x02, 0x99 },
1008 { 0x00, 0x00, 0x00, 0x02, 0xaa },
1009 { 0x00, 0x00, 0x00, 0x02, 0x55 },
1010 };
1011 static unsigned char outputs[][16] = {
1012 {0xD1, 0x55, 0x77, 0x5A, 0x20, 0x9D, 0x05, 0xF0,
1013 0x2B, 0x38, 0xD4, 0x2A, 0x38, 0x9E, 0x5A, 0x56},
1014 {0x64, 0xDF, 0x83, 0xF8, 0x5A, 0x53, 0x2F, 0x17,
1015 0x57, 0x7D, 0x8C, 0x37, 0x03, 0x57, 0x96, 0xAB},
1016 {0x3E, 0x4F, 0xBD, 0xF3, 0x0F, 0xB8, 0x25, 0x9C,
1017 0x42, 0x5C, 0xB6, 0xC9, 0x6F, 0x1F, 0x46, 0x35}
1018 };
1019 static unsigned char iv[16] = { 0 };
1020 unsigned char result[16] = { 0 };
1021
1022 for (i = 0; i < 3; i++) {
1023 p = 0;
1024 params[p++] = OSSL_PARAM_construct_utf8_string(
1025 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-128-CBC", 0);
1026 params[p++] = OSSL_PARAM_construct_utf8_string(
1027 OSSL_KDF_PARAM_MAC, "CMAC", 0);
1028 params[p++] = OSSL_PARAM_construct_utf8_string(
1029 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
1030 params[p++] = OSSL_PARAM_construct_octet_string(
1031 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1032 params[p++] = OSSL_PARAM_construct_octet_string(
1033 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
1034 params[p++] = OSSL_PARAM_construct_octet_string(
1035 OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
1036 params[p] = OSSL_PARAM_construct_end();
1037
1038 kctx = get_kdfbyname("KBKDF");
1039 ret = TEST_ptr(kctx)
1040 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
1041 params), 0)
1042 && TEST_mem_eq(result, sizeof(result), outputs[i],
1043 sizeof(outputs[i]));
1044 EVP_KDF_CTX_free(kctx);
1045 if (ret != 1)
1046 return ret;
1047 }
1048
1049 return ret;
1050 }
1051
test_kdf_kbkdf_6803_256(void)1052 static int test_kdf_kbkdf_6803_256(void)
1053 {
1054 int ret = 0, i, p;
1055 EVP_KDF_CTX *kctx;
1056 OSSL_PARAM params[7];
1057 static unsigned char input_key[] = {
1058 0xB9, 0xD6, 0x82, 0x8B, 0x20, 0x56, 0xB7, 0xBE,
1059 0x65, 0x6D, 0x88, 0xA1, 0x23, 0xB1, 0xFA, 0xC6,
1060 0x82, 0x14, 0xAC, 0x2B, 0x72, 0x7E, 0xCF, 0x5F,
1061 0x69, 0xAF, 0xE0, 0xC4, 0xDF, 0x2A, 0x6D, 0x2C,
1062 };
1063 static unsigned char constants[][5] = {
1064 { 0x00, 0x00, 0x00, 0x02, 0x99 },
1065 { 0x00, 0x00, 0x00, 0x02, 0xaa },
1066 { 0x00, 0x00, 0x00, 0x02, 0x55 },
1067 };
1068 static unsigned char outputs[][32] = {
1069 {0xE4, 0x67, 0xF9, 0xA9, 0x55, 0x2B, 0xC7, 0xD3,
1070 0x15, 0x5A, 0x62, 0x20, 0xAF, 0x9C, 0x19, 0x22,
1071 0x0E, 0xEE, 0xD4, 0xFF, 0x78, 0xB0, 0xD1, 0xE6,
1072 0xA1, 0x54, 0x49, 0x91, 0x46, 0x1A, 0x9E, 0x50,
1073 },
1074 {0x41, 0x2A, 0xEF, 0xC3, 0x62, 0xA7, 0x28, 0x5F,
1075 0xC3, 0x96, 0x6C, 0x6A, 0x51, 0x81, 0xE7, 0x60,
1076 0x5A, 0xE6, 0x75, 0x23, 0x5B, 0x6D, 0x54, 0x9F,
1077 0xBF, 0xC9, 0xAB, 0x66, 0x30, 0xA4, 0xC6, 0x04,
1078 },
1079 {0xFA, 0x62, 0x4F, 0xA0, 0xE5, 0x23, 0x99, 0x3F,
1080 0xA3, 0x88, 0xAE, 0xFD, 0xC6, 0x7E, 0x67, 0xEB,
1081 0xCD, 0x8C, 0x08, 0xE8, 0xA0, 0x24, 0x6B, 0x1D,
1082 0x73, 0xB0, 0xD1, 0xDD, 0x9F, 0xC5, 0x82, 0xB0,
1083 },
1084 };
1085 static unsigned char iv[16] = { 0 };
1086 unsigned char result[32] = { 0 };
1087
1088 for (i = 0; i < 3; i++) {
1089 p = 0;
1090 params[p++] = OSSL_PARAM_construct_utf8_string(
1091 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-256-CBC", 0);
1092 params[p++] = OSSL_PARAM_construct_utf8_string(
1093 OSSL_KDF_PARAM_MAC, "CMAC", 0);
1094 params[p++] = OSSL_PARAM_construct_utf8_string(
1095 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
1096 params[p++] = OSSL_PARAM_construct_octet_string(
1097 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1098 params[p++] = OSSL_PARAM_construct_octet_string(
1099 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
1100 params[p++] = OSSL_PARAM_construct_octet_string(
1101 OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
1102 params[p] = OSSL_PARAM_construct_end();
1103
1104 kctx = get_kdfbyname("KBKDF");
1105 ret = TEST_ptr(kctx)
1106 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
1107 params), 0)
1108 && TEST_mem_eq(result, sizeof(result), outputs[i],
1109 sizeof(outputs[i]));
1110 EVP_KDF_CTX_free(kctx);
1111 if (ret != 1)
1112 return ret;
1113 }
1114
1115 return ret;
1116 }
1117 #endif
1118
construct_kbkdf_params(char * digest,char * mac,unsigned char * key,size_t keylen,char * salt,char * info)1119 static OSSL_PARAM *construct_kbkdf_params(char *digest, char *mac, unsigned char *key,
1120 size_t keylen, char *salt, char *info)
1121 {
1122 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 7);
1123 OSSL_PARAM *p = params;
1124
1125 if (params == NULL)
1126 return NULL;
1127
1128 *p++ = OSSL_PARAM_construct_utf8_string(
1129 OSSL_KDF_PARAM_DIGEST, digest, 0);
1130 *p++ = OSSL_PARAM_construct_utf8_string(
1131 OSSL_KDF_PARAM_MAC, mac, 0);
1132 *p++ = OSSL_PARAM_construct_utf8_string(
1133 OSSL_KDF_PARAM_MODE, "COUNTER", 0);
1134 *p++ = OSSL_PARAM_construct_octet_string(
1135 OSSL_KDF_PARAM_KEY, key, keylen);
1136 *p++ = OSSL_PARAM_construct_octet_string(
1137 OSSL_KDF_PARAM_SALT, salt, strlen(salt));
1138 *p++ = OSSL_PARAM_construct_octet_string(
1139 OSSL_KDF_PARAM_INFO, info, strlen(info));
1140 *p = OSSL_PARAM_construct_end();
1141
1142 return params;
1143 }
1144
test_kdf_kbkdf_invalid_digest(void)1145 static int test_kdf_kbkdf_invalid_digest(void)
1146 {
1147 int ret;
1148 EVP_KDF_CTX *kctx;
1149 OSSL_PARAM *params;
1150
1151 static unsigned char key[] = {0x01};
1152
1153 params = construct_kbkdf_params("blah", "HMAC", key, 1, "prf", "test");
1154 if (!TEST_ptr(params))
1155 return 0;
1156
1157 /* Negative test case - set_params should fail */
1158 kctx = get_kdfbyname("KBKDF");
1159 ret = TEST_ptr(kctx)
1160 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1161
1162 EVP_KDF_CTX_free(kctx);
1163 OPENSSL_free(params);
1164 return ret;
1165 }
1166
test_kdf_kbkdf_invalid_mac(void)1167 static int test_kdf_kbkdf_invalid_mac(void)
1168 {
1169 int ret;
1170 EVP_KDF_CTX *kctx;
1171 OSSL_PARAM *params;
1172
1173 static unsigned char key[] = {0x01};
1174
1175 params = construct_kbkdf_params("sha256", "blah", key, 1, "prf", "test");
1176 if (!TEST_ptr(params))
1177 return 0;
1178
1179 /* Negative test case - set_params should fail */
1180 kctx = get_kdfbyname("KBKDF");
1181 ret = TEST_ptr(kctx)
1182 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1183
1184 EVP_KDF_CTX_free(kctx);
1185 OPENSSL_free(params);
1186 return ret;
1187 }
1188
test_kdf_kbkdf_empty_key(void)1189 static int test_kdf_kbkdf_empty_key(void)
1190 {
1191 int ret;
1192 EVP_KDF_CTX *kctx;
1193 OSSL_PARAM *params;
1194
1195 static unsigned char key[] = {0x01};
1196 unsigned char result[32] = { 0 };
1197
1198 params = construct_kbkdf_params("sha256", "HMAC", key, 0, "prf", "test");
1199 if (!TEST_ptr(params))
1200 return 0;
1201
1202 /* Negative test case - derive should fail */
1203 kctx = get_kdfbyname("KBKDF");
1204 ret = TEST_ptr(kctx)
1205 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1206 && TEST_int_eq(EVP_KDF_derive(kctx, result, sizeof(result), NULL), 0);
1207
1208 EVP_KDF_CTX_free(kctx);
1209 OPENSSL_free(params);
1210 return ret;
1211 }
1212
test_kdf_kbkdf_1byte_key(void)1213 static int test_kdf_kbkdf_1byte_key(void)
1214 {
1215 int ret;
1216 EVP_KDF_CTX *kctx;
1217 OSSL_PARAM *params;
1218
1219 static unsigned char key[] = {0x01};
1220 unsigned char result[32] = { 0 };
1221
1222 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test");
1223 if (!TEST_ptr(params))
1224 return 0;
1225
1226 kctx = get_kdfbyname("KBKDF");
1227 ret = TEST_ptr(kctx)
1228 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0);
1229
1230 EVP_KDF_CTX_free(kctx);
1231 OPENSSL_free(params);
1232 return ret;
1233 }
1234
test_kdf_kbkdf_zero_output_size(void)1235 static int test_kdf_kbkdf_zero_output_size(void)
1236 {
1237 int ret;
1238 EVP_KDF_CTX *kctx;
1239 OSSL_PARAM *params;
1240
1241 static unsigned char key[] = {0x01};
1242 unsigned char result[32] = { 0 };
1243
1244 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test");
1245 if (!TEST_ptr(params))
1246 return 0;
1247
1248 /* Negative test case - derive should fail */
1249 kctx = get_kdfbyname("KBKDF");
1250 ret = TEST_ptr(kctx)
1251 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1252 && TEST_int_eq(EVP_KDF_derive(kctx, result, 0, NULL), 0);
1253
1254 EVP_KDF_CTX_free(kctx);
1255 OPENSSL_free(params);
1256 return ret;
1257 }
1258
1259 /* Two test vectors from RFC 8009 (AES Encryption with HMAC-SHA2 for Kerberos
1260 * 5) appendix A. */
test_kdf_kbkdf_8009_prf1(void)1261 static int test_kdf_kbkdf_8009_prf1(void)
1262 {
1263 int ret, i = 0;
1264 EVP_KDF_CTX *kctx;
1265 OSSL_PARAM params[6];
1266 char *label = "prf", *digest = "sha256", *prf_input = "test",
1267 *mac = "HMAC";
1268 static unsigned char input_key[] = {
1269 0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28,
1270 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C,
1271 };
1272 static unsigned char output[] = {
1273 0x9D, 0x18, 0x86, 0x16, 0xF6, 0x38, 0x52, 0xFE,
1274 0x86, 0x91, 0x5B, 0xB8, 0x40, 0xB4, 0xA8, 0x86,
1275 0xFF, 0x3E, 0x6B, 0xB0, 0xF8, 0x19, 0xB4, 0x9B,
1276 0x89, 0x33, 0x93, 0xD3, 0x93, 0x85, 0x42, 0x95,
1277 };
1278 unsigned char result[sizeof(output)] = { 0 };
1279
1280 params[i++] = OSSL_PARAM_construct_utf8_string(
1281 OSSL_KDF_PARAM_DIGEST, digest, 0);
1282 params[i++] = OSSL_PARAM_construct_utf8_string(
1283 OSSL_KDF_PARAM_MAC, mac, 0);
1284 params[i++] = OSSL_PARAM_construct_octet_string(
1285 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1286 params[i++] = OSSL_PARAM_construct_octet_string(
1287 OSSL_KDF_PARAM_SALT, label, strlen(label));
1288 params[i++] = OSSL_PARAM_construct_octet_string(
1289 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1290 params[i] = OSSL_PARAM_construct_end();
1291
1292 kctx = get_kdfbyname("KBKDF");
1293 ret = TEST_ptr(kctx)
1294 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1295 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1296
1297 EVP_KDF_CTX_free(kctx);
1298 return ret;
1299 }
1300
test_kdf_kbkdf_8009_prf2(void)1301 static int test_kdf_kbkdf_8009_prf2(void)
1302 {
1303 int ret, i = 0;
1304 EVP_KDF_CTX *kctx;
1305 OSSL_PARAM params[6];
1306 char *label = "prf", *digest = "sha384", *prf_input = "test",
1307 *mac = "HMAC";
1308 static unsigned char input_key[] = {
1309 0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D,
1310 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
1311 0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0,
1312 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52,
1313 };
1314 static unsigned char output[] = {
1315 0x98, 0x01, 0xF6, 0x9A, 0x36, 0x8C, 0x2B, 0xF6,
1316 0x75, 0xE5, 0x95, 0x21, 0xE1, 0x77, 0xD9, 0xA0,
1317 0x7F, 0x67, 0xEF, 0xE1, 0xCF, 0xDE, 0x8D, 0x3C,
1318 0x8D, 0x6F, 0x6A, 0x02, 0x56, 0xE3, 0xB1, 0x7D,
1319 0xB3, 0xC1, 0xB6, 0x2A, 0xD1, 0xB8, 0x55, 0x33,
1320 0x60, 0xD1, 0x73, 0x67, 0xEB, 0x15, 0x14, 0xD2,
1321 };
1322 unsigned char result[sizeof(output)] = { 0 };
1323
1324 params[i++] = OSSL_PARAM_construct_utf8_string(
1325 OSSL_KDF_PARAM_DIGEST, digest, 0);
1326 params[i++] = OSSL_PARAM_construct_utf8_string(
1327 OSSL_KDF_PARAM_MAC, mac, 0);
1328 params[i++] = OSSL_PARAM_construct_octet_string(
1329 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1330 params[i++] = OSSL_PARAM_construct_octet_string(
1331 OSSL_KDF_PARAM_SALT, label, strlen(label));
1332 params[i++] = OSSL_PARAM_construct_octet_string(
1333 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1334 params[i] = OSSL_PARAM_construct_end();
1335
1336 kctx = get_kdfbyname("KBKDF");
1337 ret = TEST_ptr(kctx)
1338 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1339 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1340
1341 EVP_KDF_CTX_free(kctx);
1342 return ret;
1343 }
1344
1345 #if !defined(OPENSSL_NO_CMAC)
1346 /*
1347 * Test vector taken from
1348 * https://csrc.nist.gov/CSRC/media/Projects/
1349 * Cryptographic-Algorithm-Validation-Program/documents/KBKDF800-108/CounterMode.zip
1350 * Note: Only 32 bit counter is supported ([RLEN=32_BITS])
1351 */
test_kdf_kbkdf_fixedinfo(void)1352 static int test_kdf_kbkdf_fixedinfo(void)
1353 {
1354 int ret;
1355 EVP_KDF_CTX *kctx;
1356 OSSL_PARAM params[8], *p = params;
1357 static char *cipher = "AES128";
1358 static char *mac = "CMAC";
1359 static char *mode = "COUNTER";
1360 int use_l = 0;
1361 int use_separator = 0;
1362
1363 static unsigned char input_key[] = {
1364 0xc1, 0x0b, 0x15, 0x2e, 0x8c, 0x97, 0xb7, 0x7e,
1365 0x18, 0x70, 0x4e, 0x0f, 0x0b, 0xd3, 0x83, 0x05,
1366 };
1367 static unsigned char fixed_input[] = {
1368 0x98, 0xcd, 0x4c, 0xbb, 0xbe, 0xbe, 0x15, 0xd1,
1369 0x7d, 0xc8, 0x6e, 0x6d, 0xba, 0xd8, 0x00, 0xa2,
1370 0xdc, 0xbd, 0x64, 0xf7, 0xc7, 0xad, 0x0e, 0x78,
1371 0xe9, 0xcf, 0x94, 0xff, 0xdb, 0xa8, 0x9d, 0x03,
1372 0xe9, 0x7e, 0xad, 0xf6, 0xc4, 0xf7, 0xb8, 0x06,
1373 0xca, 0xf5, 0x2a, 0xa3, 0x8f, 0x09, 0xd0, 0xeb,
1374 0x71, 0xd7, 0x1f, 0x49, 0x7b, 0xcc, 0x69, 0x06,
1375 0xb4, 0x8d, 0x36, 0xc4,
1376
1377 };
1378 static unsigned char output[] = {
1379 0x26, 0xfa, 0xf6, 0x19, 0x08, 0xad, 0x9e, 0xe8,
1380 0x81, 0xb8, 0x30, 0x5c, 0x22, 0x1d, 0xb5, 0x3f,
1381 };
1382 unsigned char result[sizeof(output)] = { 0 };
1383
1384 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
1385 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
1386 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, mode, 0);
1387 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, input_key,
1388 sizeof(input_key));
1389 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
1390 fixed_input, sizeof(fixed_input));
1391 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &use_l);
1392 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR,
1393 &use_separator);
1394 *p = OSSL_PARAM_construct_end();
1395
1396 kctx = get_kdfbyname("KBKDF");
1397 ret = TEST_ptr(kctx)
1398 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1399 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1400
1401 EVP_KDF_CTX_free(kctx);
1402 return ret;
1403 }
1404 #endif /* OPENSSL_NO_CMAC */
1405
test_kdf_ss_hmac(void)1406 static int test_kdf_ss_hmac(void)
1407 {
1408 int ret;
1409 EVP_KDF_CTX *kctx;
1410 OSSL_PARAM params[6], *p = params;
1411 unsigned char out[16];
1412 static unsigned char z[] = {
1413 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
1414 };
1415 static unsigned char other[] = {
1416 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
1417 };
1418 static unsigned char salt[] = {
1419 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
1420 0x3f,0x89
1421 };
1422 static const unsigned char expected[sizeof(out)] = {
1423 0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63,
1424 0x1c,0xa3
1425 };
1426
1427 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1428 (char *)OSSL_MAC_NAME_HMAC, 0);
1429 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1430 (char *)"sha256", 0);
1431 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1432 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1433 sizeof(other));
1434 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1435 sizeof(salt));
1436 *p = OSSL_PARAM_construct_end();
1437
1438 ret =
1439 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1440 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1441 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1442
1443 EVP_KDF_CTX_free(kctx);
1444 return ret;
1445 }
1446
test_kdf_ss_kmac(void)1447 static int test_kdf_ss_kmac(void)
1448 {
1449 int ret;
1450 EVP_KDF_CTX *kctx;
1451 OSSL_PARAM params[7], *p = params;
1452 unsigned char out[64];
1453 size_t mac_size = 20;
1454 static unsigned char z[] = {
1455 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
1456 };
1457 static unsigned char other[] = {
1458 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
1459 };
1460 static unsigned char salt[] = {
1461 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
1462 0x3f,0x89
1463 };
1464 static const unsigned char expected[sizeof(out)] = {
1465 0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd,
1466 0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2,
1467 0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4,
1468 0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95,
1469 0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03
1470 };
1471
1472 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1473 (char *)OSSL_MAC_NAME_KMAC128, 0);
1474 /* The digest parameter is not needed here and should be ignored */
1475 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1476 (char *)"SHA256", 0);
1477 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1478 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1479 sizeof(other));
1480 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1481 sizeof(salt));
1482 *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, &mac_size);
1483 *p = OSSL_PARAM_construct_end();
1484
1485 ret =
1486 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1487 && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), 0)
1488 && TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1)
1489 /* The bug fix for KMAC returning SIZE_MAX was added in 3.0.8 */
1490 && (fips_provider_version_lt(NULL, 3, 0, 8)
1491 || TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX))
1492 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
1493 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1494
1495 EVP_KDF_CTX_free(kctx);
1496 return ret;
1497 }
1498
test_kdf_sshkdf(void)1499 static int test_kdf_sshkdf(void)
1500 {
1501 int ret;
1502 EVP_KDF_CTX *kctx;
1503 OSSL_PARAM params[6], *p = params;
1504 char kdftype = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
1505 unsigned char out[8];
1506 /* Test data from NIST CAVS 14.1 test vectors */
1507 static unsigned char key[] = {
1508 0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
1509 0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
1510 0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
1511 0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
1512 0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
1513 0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
1514 0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
1515 0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
1516 0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
1517 0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
1518 0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
1519 0x4e
1520 };
1521 static unsigned char xcghash[] = {
1522 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
1523 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
1524 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
1525 };
1526 static unsigned char sessid[] = {
1527 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
1528 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
1529 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
1530 };
1531 static const unsigned char expected[sizeof(out)] = {
1532 0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
1533 };
1534
1535 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1536 (char *)"sha256", 0);
1537 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
1538 sizeof(key));
1539 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_XCGHASH,
1540 xcghash, sizeof(xcghash));
1541 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
1542 sessid, sizeof(sessid));
1543 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE,
1544 &kdftype, sizeof(kdftype));
1545 *p = OSSL_PARAM_construct_end();
1546
1547 ret =
1548 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSHKDF))
1549 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1550 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1551
1552 EVP_KDF_CTX_free(kctx);
1553 return ret;
1554 }
1555
test_kdfs_same(EVP_KDF * kdf1,EVP_KDF * kdf2)1556 static int test_kdfs_same( EVP_KDF *kdf1, EVP_KDF *kdf2)
1557 {
1558 /* Fast path in case the two are the same algorithm pointer */
1559 if (kdf1 == kdf2)
1560 return 1;
1561 /*
1562 * Compare their names and providers instead.
1563 * This is necessary in a non-caching build (or a cache flush during fetch)
1564 * because without the algorithm in the cache, fetching it a second time
1565 * will result in a different pointer.
1566 */
1567 return TEST_ptr_eq(EVP_KDF_get0_provider(kdf1), EVP_KDF_get0_provider(kdf2))
1568 && TEST_str_eq(EVP_KDF_get0_name(kdf1), EVP_KDF_get0_name(kdf2));
1569 }
1570
test_kdf_get_kdf(void)1571 static int test_kdf_get_kdf(void)
1572 {
1573 EVP_KDF *kdf1 = NULL, *kdf2 = NULL;
1574 ASN1_OBJECT *obj;
1575 int ok = 1;
1576
1577 if (!TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
1578 || !TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL))
1579 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(OBJ_obj2nid(obj)),
1580 NULL))
1581 || !test_kdfs_same(kdf1, kdf2))
1582 ok = 0;
1583 EVP_KDF_free(kdf1);
1584 kdf1 = NULL;
1585 EVP_KDF_free(kdf2);
1586 kdf2 = NULL;
1587
1588 if (!TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, SN_tls1_prf, NULL))
1589 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, LN_tls1_prf, NULL))
1590 || !test_kdfs_same(kdf1, kdf2))
1591 ok = 0;
1592 /* kdf1 is re-used below, so don't free it here */
1593 EVP_KDF_free(kdf2);
1594 kdf2 = NULL;
1595
1596 if (!TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(NID_tls1_prf), NULL))
1597 || !test_kdfs_same(kdf1, kdf2))
1598 ok = 0;
1599 EVP_KDF_free(kdf1);
1600 kdf1 = NULL;
1601 EVP_KDF_free(kdf2);
1602 kdf2 = NULL;
1603
1604 return ok;
1605 }
1606
1607 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
test_kdf_x942_asn1(void)1608 static int test_kdf_x942_asn1(void)
1609 {
1610 int ret;
1611 EVP_KDF_CTX *kctx = NULL;
1612 OSSL_PARAM params[4], *p = params;
1613 const char *cek_alg = SN_id_smime_alg_CMS3DESwrap;
1614 unsigned char out[24];
1615 /* RFC2631 Section 2.1.6 Test data */
1616 static unsigned char z[] = {
1617 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,
1618 0x0e,0x0f,0x10,0x11,0x12,0x13
1619 };
1620 static const unsigned char expected[sizeof(out)] = {
1621 0xa0,0x96,0x61,0x39,0x23,0x76,0xf7,0x04,
1622 0x4d,0x90,0x52,0xa3,0x97,0x88,0x32,0x46,
1623 0xb6,0x7f,0x5f,0x1e,0xf6,0x3e,0xb5,0xfb
1624 };
1625
1626 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1627 (char *)"sha1", 0);
1628 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z,
1629 sizeof(z));
1630 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CEK_ALG,
1631 (char *)cek_alg, 0);
1632 *p = OSSL_PARAM_construct_end();
1633
1634 ret =
1635 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X942KDF_ASN1))
1636 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1637 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1638
1639 EVP_KDF_CTX_free(kctx);
1640 return ret;
1641 }
1642 #endif /* OPENSSL_NO_CMS */
1643
test_kdf_krb5kdf(void)1644 static int test_kdf_krb5kdf(void)
1645 {
1646 int ret;
1647 EVP_KDF_CTX *kctx;
1648 OSSL_PARAM params[4], *p = params;
1649 unsigned char out[16];
1650 static unsigned char key[] = {
1651 0x42, 0x26, 0x3C, 0x6E, 0x89, 0xF4, 0xFC, 0x28,
1652 0xB8, 0xDF, 0x68, 0xEE, 0x09, 0x79, 0x9F, 0x15
1653 };
1654 static unsigned char constant[] = {
1655 0x00, 0x00, 0x00, 0x02, 0x99
1656 };
1657 static const unsigned char expected[sizeof(out)] = {
1658 0x34, 0x28, 0x0A, 0x38, 0x2B, 0xC9, 0x27, 0x69,
1659 0xB2, 0xDA, 0x2F, 0x9E, 0xF0, 0x66, 0x85, 0x4B
1660 };
1661
1662 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER,
1663 (char *)"AES-128-CBC", 0);
1664 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
1665 sizeof(key));
1666 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT,
1667 constant, sizeof(constant));
1668 *p = OSSL_PARAM_construct_end();
1669
1670 ret =
1671 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KRB5KDF))
1672 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1673 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1674
1675 EVP_KDF_CTX_free(kctx);
1676 return ret;
1677 }
1678
setup_tests(void)1679 int setup_tests(void)
1680 {
1681 ADD_TEST(test_kdf_pbkdf1);
1682 ADD_TEST(test_kdf_pbkdf1_key_too_long);
1683 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
1684 ADD_TEST(test_kdf_kbkdf_6803_128);
1685 ADD_TEST(test_kdf_kbkdf_6803_256);
1686 #endif
1687 ADD_TEST(test_kdf_kbkdf_invalid_digest);
1688 ADD_TEST(test_kdf_kbkdf_invalid_mac);
1689 ADD_TEST(test_kdf_kbkdf_zero_output_size);
1690 ADD_TEST(test_kdf_kbkdf_empty_key);
1691 ADD_TEST(test_kdf_kbkdf_1byte_key);
1692 ADD_TEST(test_kdf_kbkdf_8009_prf1);
1693 ADD_TEST(test_kdf_kbkdf_8009_prf2);
1694 #if !defined(OPENSSL_NO_CMAC)
1695 ADD_TEST(test_kdf_kbkdf_fixedinfo);
1696 #endif
1697 ADD_TEST(test_kdf_get_kdf);
1698 ADD_TEST(test_kdf_tls1_prf);
1699 ADD_TEST(test_kdf_tls1_prf_invalid_digest);
1700 ADD_TEST(test_kdf_tls1_prf_zero_output_size);
1701 ADD_TEST(test_kdf_tls1_prf_empty_secret);
1702 ADD_TEST(test_kdf_tls1_prf_1byte_secret);
1703 ADD_TEST(test_kdf_tls1_prf_empty_seed);
1704 ADD_TEST(test_kdf_tls1_prf_1byte_seed);
1705 ADD_TEST(test_kdf_hkdf);
1706 ADD_TEST(test_kdf_hkdf_invalid_digest);
1707 ADD_TEST(test_kdf_hkdf_zero_output_size);
1708 ADD_TEST(test_kdf_hkdf_empty_key);
1709 ADD_TEST(test_kdf_hkdf_1byte_key);
1710 ADD_TEST(test_kdf_hkdf_empty_salt);
1711 ADD_TEST(test_kdf_hkdf_gettables);
1712 ADD_TEST(test_kdf_hkdf_gettables_expandonly);
1713 ADD_TEST(test_kdf_hkdf_gettables_no_digest);
1714 ADD_TEST(test_kdf_hkdf_derive_set_params_fail);
1715 ADD_TEST(test_kdf_hkdf_set_invalid_mode);
1716 ADD_TEST(test_kdf_hkdf_set_ctx_param_fail);
1717 ADD_TEST(test_kdf_pbkdf2);
1718 ADD_TEST(test_kdf_pbkdf2_small_output);
1719 ADD_TEST(test_kdf_pbkdf2_large_output);
1720 ADD_TEST(test_kdf_pbkdf2_small_salt);
1721 ADD_TEST(test_kdf_pbkdf2_small_iterations);
1722 ADD_TEST(test_kdf_pbkdf2_small_salt_pkcs5);
1723 ADD_TEST(test_kdf_pbkdf2_small_iterations_pkcs5);
1724 ADD_TEST(test_kdf_pbkdf2_invalid_digest);
1725 #ifndef OPENSSL_NO_SCRYPT
1726 ADD_TEST(test_kdf_scrypt);
1727 #endif
1728 ADD_TEST(test_kdf_ss_hash);
1729 ADD_TEST(test_kdf_ss_hmac);
1730 ADD_TEST(test_kdf_ss_kmac);
1731 ADD_TEST(test_kdf_sshkdf);
1732 ADD_TEST(test_kdf_x963);
1733 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
1734 ADD_TEST(test_kdf_x942_asn1);
1735 #endif
1736 ADD_TEST(test_kdf_krb5kdf);
1737 return 1;
1738 }
1739