1 /*
2 * Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* We need to use some deprecated APIs */
11 #define OPENSSL_SUPPRESS_DEPRECATED
12
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <openssl/bio.h>
17 #include <openssl/conf.h>
18 #include <openssl/crypto.h>
19 #include <openssl/err.h>
20 #include <openssl/evp.h>
21 #include <openssl/x509.h>
22 #include <openssl/pem.h>
23 #include <openssl/kdf.h>
24 #include <openssl/provider.h>
25 #include <openssl/core_names.h>
26 #include <openssl/params.h>
27 #include <openssl/param_build.h>
28 #include <openssl/dsa.h>
29 #include <openssl/dh.h>
30 #include <openssl/aes.h>
31 #include <openssl/decoder.h>
32 #include <openssl/rsa.h>
33 #include <openssl/engine.h>
34 #include <openssl/proverr.h>
35 #include <openssl/rand.h>
36 #include <crypto/ml_kem.h>
37 #include "testutil.h"
38 #include "internal/nelem.h"
39 #include "internal/sizes.h"
40 #include "crypto/evp.h"
41 #include "fake_rsaprov.h"
42 #include "fake_pipelineprov.h"
43
44 #ifdef STATIC_LEGACY
45 OSSL_provider_init_fn ossl_legacy_provider_init;
46 #endif
47
48 static OSSL_LIB_CTX *testctx = NULL;
49 static char *testpropq = NULL;
50
51 static OSSL_PROVIDER *nullprov = NULL;
52 static OSSL_PROVIDER *deflprov = NULL;
53 static OSSL_PROVIDER *lgcyprov = NULL;
54
55 /*
56 * kExampleRSAKeyDER is an RSA private key in ASN.1, DER format. Of course, you
57 * should never use this key anywhere but in an example.
58 */
59 static const unsigned char kExampleRSAKeyDER[] = {
60 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8,
61 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59,
62 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37,
63 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71,
64 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a,
65 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4,
66 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec,
67 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76,
68 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8,
69 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7,
70 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c,
71 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01,
72 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7,
73 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85,
74 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee,
75 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85,
76 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a,
77 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15,
78 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83,
79 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b,
80 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73,
81 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99,
82 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02,
83 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41,
84 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59,
85 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9,
86 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef,
87 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87,
88 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf,
89 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5,
90 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5,
91 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62,
92 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64,
93 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8,
94 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba,
95 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe,
96 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7,
97 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe,
98 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb,
99 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34,
100 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27,
101 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0,
102 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba,
103 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06,
104 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c,
105 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e,
106 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf,
107 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a,
108 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17,
109 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1,
110 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf
111 };
112
113 /* An invalid key whose prime factors exceed modulus n. */
114 static const unsigned char kInvalidRSAKeyDER[] = {
115 0x30, 0x80, 0x02, 0x00, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80,
116 0x02, 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00,
117 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
118 0x02, 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
119 0xff, 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06,
120 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06,
121 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa,
122 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
123 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b,
124 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
125 0xaa, 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01,
126 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee,
127 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
128 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15,
129 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07,
130 0x07, 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07,
131 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
132 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15,
133 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
134 0x15, 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00,
135 0x00, 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15,
136 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9,
137 0x02, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07,
138 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
139 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15,
140 0x00, 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59,
141 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
142 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
143 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
144 0x59, 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59,
145 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
146 0x5d, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
147 0x59, 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15,
148 0x15, 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02,
149 0x00, 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea,
150 0xea, 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15,
151 0x15, 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07,
152 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
153 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07,
154 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
155 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00,
156 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29,
157 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
158 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
159 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
160 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
161 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59,
162 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
163 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
164 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
165 0x59, 0x59, 0x59, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80, 0x02,
166 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00,
167 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
168 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
169 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06,
170 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06,
171 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
172 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
173 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 0x31,
174 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
175 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 0xc8,
176 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 0x07,
177 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
178 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00,
179 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07,
180 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07,
181 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
182 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0xec,
183 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
184 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00, 0x00,
185 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15, 0x07,
186 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9, 0x02,
187 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07,
188 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
189 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00,
190 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 0x59,
191 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
192 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
193 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
194 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59, 0x59,
195 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x5d,
196 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
197 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15,
198 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00,
199 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea,
200 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15, 0x15,
201 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00,
202 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0xff,
203 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07, 0x07,
204 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
205 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02,
206 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07,
207 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
208 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
209 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
210 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
211 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59, 0x59,
212 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
213 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
214 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
215 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
216 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
217 0x59, 0x59, 0x59, 0x06, 0xce, 0x15, 0x00, 0xfe, 0xf7, 0x52, 0x53, 0x41,
218 0x31, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
219 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
220 0xff, 0xff, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
221 0x2b, 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
222 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02,
223 0x01, 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88,
224 0xee, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
225 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15,
226 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15,
227 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07,
228 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
229 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15,
230 0x15, 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
231 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
232 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x15,
233 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07,
234 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07,
235 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
236 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15,
237 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15,
238 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59,
239 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x8f,
240 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f,
241 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f,
242 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f,
243 0x8f, 0x8f, 0x8f, 0x8f, 0x59, 0x59, 0x59, 0x00, 0x00, 0x00, 0x00, 0x00,
244 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc1, 0x3d, 0xc1, 0xc1,
245 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1,
246 0xc1, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
247 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
248 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x42, 0xa5, 0x02, 0x02, 0x42, 0x02,
249 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0xe8, 0xe8, 0xe8, 0xe8,
250 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8,
251 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8,
252 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8,
253 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8,
254 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8,
255 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0x02,
256 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
257 0x21, 0x2b, 0x02, 0x02, 0x02, 0x02, 0x02, 0x21, 0x02, 0x02, 0x32, 0x80,
258 0x02, 0x02, 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02,
259 0x02, 0x02, 0x42, 0x02, 0x12, 0x02, 0x42, 0x02, 0x79, 0x70, 0x65, 0x36,
260 0x28, 0xc8, 0x02, 0x01, 0x81, 0x08, 0xfe, 0x00, 0xf9, 0x02, 0x42, 0x10,
261 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,
262 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,
263 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,
264 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,
265 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0xa5, 0x02,
266 0x02, 0x42, 0x02, 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0x02,
267 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
268 0x21, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x32, 0x80, 0x02, 0x02,
269 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02, 0x02, 0x02,
270 0x42, 0x02, 0x12, 0x02, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
271 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x47,
272 0x4f, 0x53, 0x54, 0x20, 0x52, 0x20, 0x33, 0x34, 0x2e, 0x31, 0x31, 0x2d,
273 0x32, 0x30, 0x31, 0x32, 0x20, 0x77, 0x69, 0x74, 0x68, 0x30, 0x80, 0x60,
274 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d, 0x31, 0x32,
275 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a, 0x5b, 0xff,
276 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x00, 0x00, 0x30,
277 0x80, 0x60, 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d,
278 0x31, 0x32, 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a,
279 0x5b, 0xff, 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x33,
280 0x28, 0xc8, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15,
281 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15,
282 0x15, 0x05, 0x15, 0x95, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00,
283 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
284 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
285 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
286 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00,
287 0x02, 0x00, 0x25, 0x02, 0x02, 0x22, 0x3a, 0x02, 0x02, 0x02, 0x42, 0x02,
288 0x02, 0x02, 0x02, 0x02, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
289 0xe2, 0x80
290 };
291
292 /*
293 * kExampleDSAKeyDER is a DSA private key in ASN.1, DER format. Of course, you
294 * should never use this key anywhere but in an example.
295 */
296 #ifndef OPENSSL_NO_DSA
297 static const unsigned char kExampleDSAKeyDER[] = {
298 0x30, 0x82, 0x01, 0xba, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0x9a,
299 0x05, 0x6d, 0x33, 0xcd, 0x5d, 0x78, 0xa1, 0xbb, 0xcb, 0x7d, 0x5b, 0x8d,
300 0xb4, 0xcc, 0xbf, 0x03, 0x99, 0x64, 0xde, 0x38, 0x78, 0x06, 0x15, 0x2f,
301 0x86, 0x26, 0x77, 0xf3, 0xb1, 0x85, 0x00, 0xed, 0xfc, 0x28, 0x3a, 0x42,
302 0x4d, 0xab, 0xab, 0xdf, 0xbc, 0x9c, 0x16, 0xd0, 0x22, 0x50, 0xd1, 0x38,
303 0xdd, 0x3f, 0x64, 0x05, 0x9e, 0x68, 0x7a, 0x1e, 0xf1, 0x56, 0xbf, 0x1e,
304 0x2c, 0xc5, 0x97, 0x2a, 0xfe, 0x7a, 0x22, 0xdc, 0x6c, 0x68, 0xb8, 0x2e,
305 0x06, 0xdb, 0x41, 0xca, 0x98, 0xd8, 0x54, 0xc7, 0x64, 0x48, 0x24, 0x04,
306 0x20, 0xbc, 0x59, 0xe3, 0x6b, 0xea, 0x7e, 0xfc, 0x7e, 0xc5, 0x4e, 0xd4,
307 0xd8, 0x3a, 0xed, 0xcd, 0x5d, 0x99, 0xb8, 0x5c, 0xa2, 0x8b, 0xbb, 0x0b,
308 0xac, 0xe6, 0x8e, 0x25, 0x56, 0x22, 0x3a, 0x2d, 0x3a, 0x56, 0x41, 0x14,
309 0x1f, 0x1c, 0x8f, 0x53, 0x46, 0x13, 0x85, 0x02, 0x15, 0x00, 0x98, 0x7e,
310 0x92, 0x81, 0x88, 0xc7, 0x3f, 0x70, 0x49, 0x54, 0xf6, 0x76, 0xb4, 0xa3,
311 0x9e, 0x1d, 0x45, 0x98, 0x32, 0x7f, 0x02, 0x81, 0x80, 0x69, 0x4d, 0xef,
312 0x55, 0xff, 0x4d, 0x59, 0x2c, 0x01, 0xfa, 0x6a, 0x38, 0xe0, 0x70, 0x9f,
313 0x9e, 0x66, 0x8e, 0x3e, 0x8c, 0x52, 0x22, 0x9d, 0x15, 0x7e, 0x3c, 0xef,
314 0x4c, 0x7a, 0x61, 0x26, 0xe0, 0x2b, 0x81, 0x3f, 0xeb, 0xaf, 0x35, 0x38,
315 0x8d, 0xfe, 0xed, 0x46, 0xff, 0x5f, 0x03, 0x9b, 0x81, 0x92, 0xe7, 0x6f,
316 0x76, 0x4f, 0x1d, 0xd9, 0xbb, 0x89, 0xc9, 0x3e, 0xd9, 0x0b, 0xf9, 0xf4,
317 0x78, 0x11, 0x59, 0xc0, 0x1d, 0xcd, 0x0e, 0xa1, 0x6f, 0x15, 0xf1, 0x4d,
318 0xc1, 0xc9, 0x22, 0xed, 0x8d, 0xad, 0x67, 0xc5, 0x4b, 0x95, 0x93, 0x86,
319 0xa6, 0xaf, 0x8a, 0xee, 0x06, 0x89, 0x2f, 0x37, 0x7e, 0x64, 0xaa, 0xf6,
320 0xe7, 0xb1, 0x5a, 0x0a, 0x93, 0x95, 0x5d, 0x3e, 0x53, 0x9a, 0xde, 0x8a,
321 0xc2, 0x95, 0x45, 0x81, 0xbe, 0x5c, 0x2f, 0xc2, 0xb2, 0x92, 0x58, 0x19,
322 0x72, 0x80, 0xe9, 0x79, 0xa1, 0x02, 0x81, 0x80, 0x07, 0xd7, 0x62, 0xff,
323 0xdf, 0x1a, 0x3f, 0xed, 0x32, 0xd4, 0xd4, 0x88, 0x7b, 0x2c, 0x63, 0x7f,
324 0x97, 0xdc, 0x44, 0xd4, 0x84, 0xa2, 0xdd, 0x17, 0x16, 0x85, 0x13, 0xe0,
325 0xac, 0x51, 0x8d, 0x29, 0x1b, 0x75, 0x9a, 0xe4, 0xe3, 0x8a, 0x92, 0x69,
326 0x09, 0x03, 0xc5, 0x68, 0xae, 0x5e, 0x94, 0xfe, 0xc9, 0x92, 0x6c, 0x07,
327 0xb4, 0x1e, 0x64, 0x62, 0x87, 0xc6, 0xa4, 0xfd, 0x0d, 0x5f, 0xe5, 0xf9,
328 0x1b, 0x4f, 0x85, 0x5f, 0xae, 0xf3, 0x11, 0xe5, 0x18, 0xd4, 0x4d, 0x79,
329 0x9f, 0xc4, 0x79, 0x26, 0x04, 0x27, 0xf0, 0x0b, 0xee, 0x2b, 0x86, 0x9f,
330 0x86, 0x61, 0xe6, 0x51, 0xce, 0x04, 0x9b, 0x5d, 0x6b, 0x34, 0x43, 0x8c,
331 0x85, 0x3c, 0xf1, 0x51, 0x9b, 0x08, 0x23, 0x1b, 0xf5, 0x7e, 0x33, 0x12,
332 0xea, 0xab, 0x1f, 0xb7, 0x2d, 0xe2, 0x5f, 0xe6, 0x97, 0x99, 0xb5, 0x45,
333 0x16, 0x5b, 0xc3, 0x41, 0x02, 0x14, 0x61, 0xbf, 0x51, 0x60, 0xcf, 0xc8,
334 0xf1, 0x8c, 0x82, 0x97, 0xf2, 0xf4, 0x19, 0xba, 0x2b, 0xf3, 0x16, 0xbe,
335 0x40, 0x48
336 };
337 #endif
338
339 /*
340 * kExampleBadRSAKeyDER is an RSA private key in ASN.1, DER format. The private
341 * components are not correct.
342 */
343 static const unsigned char kExampleBadRSAKeyDER[] = {
344 0x30, 0x82, 0x04, 0x27, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00,
345 0xa6, 0x1a, 0x1e, 0x6e, 0x7b, 0xee, 0xc6, 0x89, 0x66, 0xe7, 0x93, 0xef,
346 0x54, 0x12, 0x68, 0xea, 0xbf, 0x86, 0x2f, 0xdd, 0xd2, 0x79, 0xb8, 0xa9,
347 0x6e, 0x03, 0xc2, 0xa3, 0xb9, 0xa3, 0xe1, 0x4b, 0x2a, 0xb3, 0xf8, 0xb4,
348 0xcd, 0xea, 0xbe, 0x24, 0xa6, 0x57, 0x5b, 0x83, 0x1f, 0x0f, 0xf2, 0xd3,
349 0xb7, 0xac, 0x7e, 0xd6, 0x8e, 0x6e, 0x1e, 0xbf, 0xb8, 0x73, 0x8c, 0x05,
350 0x56, 0xe6, 0x35, 0x1f, 0xe9, 0x04, 0x0b, 0x09, 0x86, 0x7d, 0xf1, 0x26,
351 0x08, 0x99, 0xad, 0x7b, 0xc8, 0x4d, 0x94, 0xb0, 0x0b, 0x8b, 0x38, 0xa0,
352 0x5c, 0x62, 0xa0, 0xab, 0xd3, 0x8f, 0xd4, 0x09, 0x60, 0x72, 0x1e, 0x33,
353 0x50, 0x80, 0x6e, 0x22, 0xa6, 0x77, 0x57, 0x6b, 0x9a, 0x33, 0x21, 0x66,
354 0x87, 0x6e, 0x21, 0x7b, 0xc7, 0x24, 0x0e, 0xd8, 0x13, 0xdf, 0x83, 0xde,
355 0xcd, 0x40, 0x58, 0x1d, 0x84, 0x86, 0xeb, 0xb8, 0x12, 0x4e, 0xd2, 0xfa,
356 0x80, 0x1f, 0xe4, 0xe7, 0x96, 0x29, 0xb8, 0xcc, 0xce, 0x66, 0x6d, 0x53,
357 0xca, 0xb9, 0x5a, 0xd7, 0xf6, 0x84, 0x6c, 0x2d, 0x9a, 0x1a, 0x14, 0x1c,
358 0x4e, 0x93, 0x39, 0xba, 0x74, 0xed, 0xed, 0x87, 0x87, 0x5e, 0x48, 0x75,
359 0x36, 0xf0, 0xbc, 0x34, 0xfb, 0x29, 0xf9, 0x9f, 0x96, 0x5b, 0x0b, 0xa7,
360 0x54, 0x30, 0x51, 0x29, 0x18, 0x5b, 0x7d, 0xac, 0x0f, 0xd6, 0x5f, 0x7c,
361 0xf8, 0x98, 0x8c, 0xd8, 0x86, 0x62, 0xb3, 0xdc, 0xff, 0x0f, 0xff, 0x7a,
362 0xaf, 0x5c, 0x4c, 0x61, 0x49, 0x2e, 0xc8, 0x95, 0x86, 0xc4, 0x0e, 0x87,
363 0xfc, 0x1d, 0xcf, 0x8b, 0x7c, 0x61, 0xf6, 0xd8, 0xd0, 0x69, 0xf6, 0xcd,
364 0x8a, 0x8c, 0xf6, 0x62, 0xa2, 0x56, 0xa9, 0xe3, 0xd1, 0xcf, 0x4d, 0xa0,
365 0xf6, 0x2d, 0x20, 0x0a, 0x04, 0xb7, 0xa2, 0xf7, 0xb5, 0x99, 0x47, 0x18,
366 0x56, 0x85, 0x87, 0xc7, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x82, 0x01,
367 0x01, 0x00, 0x99, 0x41, 0x38, 0x1a, 0xd0, 0x96, 0x7a, 0xf0, 0x83, 0xd5,
368 0xdf, 0x94, 0xce, 0x89, 0x3d, 0xec, 0x7a, 0x52, 0x21, 0x10, 0x16, 0x06,
369 0xe0, 0xee, 0xd2, 0xe6, 0xfd, 0x4b, 0x7b, 0x19, 0x4d, 0xe1, 0xc0, 0xc0,
370 0xd5, 0x14, 0x5d, 0x79, 0xdd, 0x7e, 0x8b, 0x4b, 0xc6, 0xcf, 0xb0, 0x75,
371 0x52, 0xa3, 0x2d, 0xb1, 0x26, 0x46, 0x68, 0x9c, 0x0a, 0x1a, 0xf2, 0xe1,
372 0x09, 0xac, 0x53, 0x85, 0x8c, 0x36, 0xa9, 0x14, 0x65, 0xea, 0xa0, 0x00,
373 0xcb, 0xe3, 0x3f, 0xc4, 0x2b, 0x61, 0x2e, 0x6b, 0x06, 0x69, 0x77, 0xfd,
374 0x38, 0x7e, 0x1d, 0x3f, 0x92, 0xe7, 0x77, 0x08, 0x19, 0xa7, 0x9d, 0x29,
375 0x2d, 0xdc, 0x42, 0xc6, 0x7c, 0xd7, 0xd3, 0xa8, 0x01, 0x2c, 0xf2, 0xd5,
376 0x82, 0x57, 0xcb, 0x55, 0x3d, 0xe7, 0xaa, 0xd2, 0x06, 0x30, 0x30, 0x05,
377 0xe6, 0xf2, 0x47, 0x86, 0xba, 0xc6, 0x61, 0x64, 0xeb, 0x4f, 0x2a, 0x5e,
378 0x07, 0x29, 0xe0, 0x96, 0xb2, 0x43, 0xff, 0x5f, 0x1a, 0x54, 0x16, 0xcf,
379 0xb5, 0x56, 0x5c, 0xa0, 0x9b, 0x0c, 0xfd, 0xb3, 0xd2, 0xe3, 0x79, 0x1d,
380 0x21, 0xe2, 0xd6, 0x13, 0xc4, 0x74, 0xa6, 0xf5, 0x8e, 0x8e, 0x81, 0xbb,
381 0xb4, 0xad, 0x8a, 0xf0, 0x93, 0x0a, 0xd8, 0x0a, 0x42, 0x36, 0xbc, 0xe5,
382 0x26, 0x2a, 0x0d, 0x5d, 0x57, 0x13, 0xc5, 0x4e, 0x2f, 0x12, 0x0e, 0xef,
383 0xa7, 0x81, 0x1e, 0xc3, 0xa5, 0xdb, 0xc9, 0x24, 0xeb, 0x1a, 0xa1, 0xf9,
384 0xf6, 0xa1, 0x78, 0x98, 0x93, 0x77, 0x42, 0x45, 0x03, 0xe2, 0xc9, 0xa2,
385 0xfe, 0x2d, 0x77, 0xc8, 0xc6, 0xac, 0x9b, 0x98, 0x89, 0x6d, 0x9a, 0xe7,
386 0x61, 0x63, 0xb7, 0xf2, 0xec, 0xd6, 0xb1, 0xa1, 0x6e, 0x0a, 0x1a, 0xff,
387 0xfd, 0x43, 0x28, 0xc3, 0x0c, 0xdc, 0xf2, 0x47, 0x4f, 0x27, 0xaa, 0x99,
388 0x04, 0x8e, 0xac, 0xe8, 0x7c, 0x01, 0x02, 0x04, 0x12, 0x34, 0x56, 0x78,
389 0x02, 0x81, 0x81, 0x00, 0xca, 0x69, 0xe5, 0xbb, 0x3a, 0x90, 0x82, 0xcb,
390 0x82, 0x50, 0x2f, 0x29, 0xe2, 0x76, 0x6a, 0x57, 0x55, 0x45, 0x4e, 0x35,
391 0x18, 0x61, 0xe0, 0x12, 0x70, 0xc0, 0xab, 0xc7, 0x80, 0xa2, 0xd4, 0x46,
392 0x34, 0x03, 0xa0, 0x19, 0x26, 0x23, 0x9e, 0xef, 0x1a, 0xcb, 0x75, 0xd6,
393 0xba, 0x81, 0xf4, 0x7e, 0x52, 0xe5, 0x2a, 0xe8, 0xf1, 0x49, 0x6c, 0x0f,
394 0x1a, 0xa0, 0xf9, 0xc6, 0xe7, 0xec, 0x60, 0xe4, 0xcb, 0x2a, 0xb5, 0x56,
395 0xe9, 0x9c, 0xcd, 0x19, 0x75, 0x92, 0xb1, 0x66, 0xce, 0xc3, 0xd9, 0x3d,
396 0x11, 0xcb, 0xc4, 0x09, 0xce, 0x1e, 0x30, 0xba, 0x2f, 0x60, 0x60, 0x55,
397 0x8d, 0x02, 0xdc, 0x5d, 0xaf, 0xf7, 0x52, 0x31, 0x17, 0x07, 0x53, 0x20,
398 0x33, 0xad, 0x8c, 0xd5, 0x2f, 0x5a, 0xd0, 0x57, 0xd7, 0xd1, 0x80, 0xd6,
399 0x3a, 0x9b, 0x04, 0x4f, 0x35, 0xbf, 0xe7, 0xd5, 0xbc, 0x8f, 0xd4, 0x81,
400 0x02, 0x81, 0x81, 0x00, 0xc0, 0x9f, 0xf8, 0xcd, 0xf7, 0x3f, 0x26, 0x8a,
401 0x3d, 0x4d, 0x2b, 0x0c, 0x01, 0xd0, 0xa2, 0xb4, 0x18, 0xfe, 0xf7, 0x5e,
402 0x2f, 0x06, 0x13, 0xcd, 0x63, 0xaa, 0x12, 0xa9, 0x24, 0x86, 0xe3, 0xf3,
403 0x7b, 0xda, 0x1a, 0x3c, 0xb1, 0x38, 0x80, 0x80, 0xef, 0x64, 0x64, 0xa1,
404 0x9b, 0xfe, 0x76, 0x63, 0x8e, 0x83, 0xd2, 0xd9, 0xb9, 0x86, 0xb0, 0xe6,
405 0xa6, 0x0c, 0x7e, 0xa8, 0x84, 0x90, 0x98, 0x0c, 0x1e, 0xf3, 0x14, 0x77,
406 0xe0, 0x5f, 0x81, 0x08, 0x11, 0x8f, 0xa6, 0x23, 0xc4, 0xba, 0xc0, 0x8a,
407 0xe4, 0xc6, 0xe3, 0x5c, 0xbe, 0xc5, 0xec, 0x2c, 0xb9, 0xd8, 0x8c, 0x4d,
408 0x1a, 0x9d, 0xe7, 0x7c, 0x85, 0x4c, 0x0d, 0x71, 0x4e, 0x72, 0x33, 0x1b,
409 0xfe, 0xa9, 0x17, 0x72, 0x76, 0x56, 0x9d, 0x74, 0x7e, 0x52, 0x67, 0x9a,
410 0x87, 0x9a, 0xdb, 0x30, 0xde, 0xe4, 0x49, 0x28, 0x3b, 0xd2, 0x67, 0xaf,
411 0x02, 0x81, 0x81, 0x00, 0x89, 0x74, 0x9a, 0x8e, 0xa7, 0xb9, 0xa5, 0x28,
412 0xc0, 0x68, 0xe5, 0x6e, 0x63, 0x1c, 0x99, 0x20, 0x8f, 0x86, 0x8e, 0x12,
413 0x9e, 0x69, 0x30, 0xfa, 0x34, 0xd9, 0x92, 0x8d, 0xdb, 0x7c, 0x37, 0xfd,
414 0x28, 0xab, 0x61, 0x98, 0x52, 0x7f, 0x14, 0x1a, 0x39, 0xae, 0xfb, 0x6a,
415 0x03, 0xa3, 0xe6, 0xbd, 0xb6, 0x5b, 0x6b, 0xe5, 0x5e, 0x9d, 0xc6, 0xa5,
416 0x07, 0x27, 0x54, 0x17, 0xd0, 0x3d, 0x84, 0x9b, 0x3a, 0xa0, 0xd9, 0x1e,
417 0x99, 0x6c, 0x63, 0x17, 0xab, 0xf1, 0x1f, 0x49, 0xba, 0x95, 0xe3, 0x3b,
418 0x86, 0x8f, 0x42, 0xa4, 0x89, 0xf5, 0x94, 0x8f, 0x8b, 0x46, 0xbe, 0x84,
419 0xba, 0x4a, 0xbc, 0x0d, 0x5f, 0x46, 0xeb, 0xe8, 0xec, 0x43, 0x8c, 0x1e,
420 0xad, 0x19, 0x69, 0x2f, 0x08, 0x86, 0x7a, 0x3f, 0x7d, 0x0f, 0x07, 0x97,
421 0xf3, 0x9a, 0x7b, 0xb5, 0xb2, 0xc1, 0x8c, 0x95, 0x68, 0x04, 0xa0, 0x81,
422 0x02, 0x81, 0x80, 0x4e, 0xbf, 0x7e, 0x1b, 0xcb, 0x13, 0x61, 0x75, 0x3b,
423 0xdb, 0x59, 0x5f, 0xb1, 0xd4, 0xb8, 0xeb, 0x9e, 0x73, 0xb5, 0xe7, 0xf6,
424 0x89, 0x3d, 0x1c, 0xda, 0xf0, 0x36, 0xff, 0x35, 0xbd, 0x1e, 0x0b, 0x74,
425 0xe3, 0x9e, 0xf0, 0xf2, 0xf7, 0xd7, 0x82, 0xb7, 0x7b, 0x6a, 0x1b, 0x0e,
426 0x30, 0x4a, 0x98, 0x0e, 0xb4, 0xf9, 0x81, 0x07, 0xe4, 0x75, 0x39, 0xe9,
427 0x53, 0xca, 0xbb, 0x5c, 0xaa, 0x93, 0x07, 0x0e, 0xa8, 0x2f, 0xba, 0x98,
428 0x49, 0x30, 0xa7, 0xcc, 0x1a, 0x3c, 0x68, 0x0c, 0xe1, 0xa4, 0xb1, 0x05,
429 0xe6, 0xe0, 0x25, 0x78, 0x58, 0x14, 0x37, 0xf5, 0x1f, 0xe3, 0x22, 0xef,
430 0xa8, 0x0e, 0x22, 0xa0, 0x94, 0x3a, 0xf6, 0xc9, 0x13, 0xe6, 0x06, 0xbf,
431 0x7f, 0x99, 0xc6, 0xcc, 0xd8, 0xc6, 0xbe, 0xd9, 0x2e, 0x24, 0xc7, 0x69,
432 0x8c, 0x95, 0xba, 0xf6, 0x04, 0xb3, 0x0a, 0xf4, 0xcb, 0xf0, 0xce
433 };
434
435 /*
436 * kExampleBad2RSAKeyDER is an RSA private key in ASN.1, DER format. All
437 * values are 0.
438 */
439 static const unsigned char kExampleBad2RSAKeyDER[] = {
440 0x30, 0x1b, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02,
441 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02,
442 0x01, 0x00, 0x02, 0x01, 0x00
443 };
444
445 static const unsigned char kMsg[] = { 1, 2, 3, 4 };
446
447 static const unsigned char kSignature[] = {
448 0xa5, 0xf0, 0x8a, 0x47, 0x5d, 0x3c, 0xb3, 0xcc, 0xa9, 0x79, 0xaf, 0x4d,
449 0x8c, 0xae, 0x4c, 0x14, 0xef, 0xc2, 0x0b, 0x34, 0x36, 0xde, 0xf4, 0x3e,
450 0x3d, 0xbb, 0x4a, 0x60, 0x5c, 0xc8, 0x91, 0x28, 0xda, 0xfb, 0x7e, 0x04,
451 0x96, 0x7e, 0x63, 0x13, 0x90, 0xce, 0xb9, 0xb4, 0x62, 0x7a, 0xfd, 0x09,
452 0x3d, 0xc7, 0x67, 0x78, 0x54, 0x04, 0xeb, 0x52, 0x62, 0x6e, 0x24, 0x67,
453 0xb4, 0x40, 0xfc, 0x57, 0x62, 0xc6, 0xf1, 0x67, 0xc1, 0x97, 0x8f, 0x6a,
454 0xa8, 0xae, 0x44, 0x46, 0x5e, 0xab, 0x67, 0x17, 0x53, 0x19, 0x3a, 0xda,
455 0x5a, 0xc8, 0x16, 0x3e, 0x86, 0xd5, 0xc5, 0x71, 0x2f, 0xfc, 0x23, 0x48,
456 0xd9, 0x0b, 0x13, 0xdd, 0x7b, 0x5a, 0x25, 0x79, 0xef, 0xa5, 0x7b, 0x04,
457 0xed, 0x44, 0xf6, 0x18, 0x55, 0xe4, 0x0a, 0xe9, 0x57, 0x79, 0x5d, 0xd7,
458 0x55, 0xa7, 0xab, 0x45, 0x02, 0x97, 0x60, 0x42
459 };
460
461 /*
462 * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v1
463 * PrivateKeyInfo.
464 */
465 static const unsigned char kExampleRSAKeyPKCS8[] = {
466 0x30, 0x82, 0x02, 0x76, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a,
467 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82,
468 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81,
469 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5,
470 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e,
471 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34,
472 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde,
473 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8,
474 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b,
475 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83,
476 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48,
477 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a,
478 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2,
479 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01,
480 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a,
481 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5,
482 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6,
483 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8,
484 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6,
485 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f,
486 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c,
487 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78,
488 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71,
489 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60,
490 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d,
491 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3,
492 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d,
493 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18,
494 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d,
495 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32,
496 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc,
497 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63,
498 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05,
499 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16,
500 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3,
501 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85,
502 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97,
503 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7,
504 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99,
505 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4,
506 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d,
507 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40,
508 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26,
509 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1,
510 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c,
511 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30,
512 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea,
513 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b,
514 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e,
515 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9,
516 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae,
517 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d,
518 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf
519 };
520
521 /*
522 * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v2
523 * PrivateKeyInfo (with an optional public key).
524 */
525 static const unsigned char kExampleRSAKeyPKCS8_v2[] = {
526 0x30, 0x82, 0x03, 0x06, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a,
527 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82,
528 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81,
529 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5,
530 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e,
531 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34,
532 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde,
533 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8,
534 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b,
535 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83,
536 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48,
537 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a,
538 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2,
539 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01,
540 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a,
541 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5,
542 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6,
543 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8,
544 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6,
545 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f,
546 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c,
547 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78,
548 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71,
549 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60,
550 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d,
551 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3,
552 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d,
553 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18,
554 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d,
555 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32,
556 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc,
557 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63,
558 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05,
559 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16,
560 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3,
561 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85,
562 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97,
563 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7,
564 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99,
565 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4,
566 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d,
567 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40,
568 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26,
569 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1,
570 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c,
571 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30,
572 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea,
573 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b,
574 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e,
575 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9,
576 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae,
577 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d,
578 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf,
579 /* Implicit optional Public key BIT STRING */
580 0x81,
581 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xf8,
582 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59,
583 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37,
584 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71,
585 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a,
586 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4,
587 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec,
588 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76,
589 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8,
590 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7,
591 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c,
592 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01
593 };
594
595 #ifndef OPENSSL_NO_EC
596 /*
597 * kExampleECKeyDER is a sample EC private key encoded as an ECPrivateKey
598 * structure.
599 */
600 static const unsigned char kExampleECKeyDER[] = {
601 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a,
602 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08,
603 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a,
604 0x8b, 0xb4, 0x6a, 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
605 0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69,
606 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c,
607 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9,
608 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18,
609 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16,
610 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22,
611 0xc1
612 };
613
614 static const unsigned char kExampleECKeyPKCS8_v2[] = {
615 0x30, 0x81, 0xcb, 0x02, 0x01, 0x01, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86,
616 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
617 0x03, 0x01, 0x07, 0x04, 0x6d, 0x30, 0x6b, 0x02, 0x01, 0x01, 0x04, 0x20,
618 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9,
619 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e,
620 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa1, 0x44, 0x03, 0x42,
621 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f,
622 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d,
623 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7,
624 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2,
625 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94,
626 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1,
627 /* Optional implicit public key BIT STRING */
628 0x81,
629 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97,
630 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9,
631 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a,
632 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e,
633 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e,
634 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1
635 };
636
637 /*
638 * kExampleBadECKeyDER is a sample EC private key encoded as an ECPrivateKey
639 * structure. The private key is equal to the order and will fail to import
640 */
641 static const unsigned char kExampleBadECKeyDER[] = {
642 0x30, 0x66, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48,
643 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03,
644 0x01, 0x07, 0x04, 0x4C, 0x30, 0x4A, 0x02, 0x01, 0x01, 0x04, 0x20, 0xFF,
645 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
646 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3,
647 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51, 0xA1, 0x23, 0x03, 0x21, 0x00,
648 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
649 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84,
650 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51
651 };
652
653 /* prime256v1 */
654 static const unsigned char kExampleECPubKeyDER[] = {
655 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
656 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
657 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53,
658 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8,
659 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7,
660 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b,
661 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20,
662 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5
663 };
664
665 /*
666 * kExampleBadECPubKeyDER is a sample EC public key with a wrong OID
667 * 1.2.840.10045.2.2 instead of 1.2.840.10045.2.1 - EC Public Key
668 */
669 static const unsigned char kExampleBadECPubKeyDER[] = {
670 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
671 0x02, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
672 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53,
673 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8,
674 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7,
675 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b,
676 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20,
677 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5
678 };
679
680 static const unsigned char pExampleECParamDER[] = {
681 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
682 };
683
684 #ifndef OPENSSL_NO_ECX
685 static const unsigned char kExampleED25519KeyDER[] = {
686 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,
687 0x04, 0x22, 0x04, 0x20, 0xba, 0x7b, 0xba, 0x20, 0x1b, 0x02, 0x75, 0x3a,
688 0xe8, 0x88, 0xfe, 0x00, 0xcd, 0x8b, 0xc6, 0xf4, 0x5c, 0x47, 0x09, 0x46,
689 0x66, 0xe4, 0x72, 0x85, 0x25, 0x26, 0x5e, 0x12, 0x33, 0x48, 0xf6, 0x50
690 };
691
692 static const unsigned char kExampleED25519PubKeyDER[] = {
693 0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
694 0xf5, 0xc5, 0xeb, 0x52, 0x3e, 0x7d, 0x07, 0x86, 0xb2, 0x55, 0x07, 0x45,
695 0xef, 0x5b, 0x7c, 0x20, 0xe8, 0x66, 0x28, 0x30, 0x3c, 0x8a, 0x82, 0x40,
696 0x97, 0xa3, 0x08, 0xdc, 0x65, 0x80, 0x39, 0x29
697 };
698
699 #ifndef OPENSSL_NO_DEPRECATED_3_0
700 static const unsigned char kExampleX25519KeyDER[] = {
701 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e,
702 0x04, 0x22, 0x04, 0x20, 0xa0, 0x24, 0x3a, 0x31, 0x24, 0xc3, 0x3f, 0xf6,
703 0x7b, 0x96, 0x0b, 0xd4, 0x8f, 0xd1, 0xee, 0x67, 0xf2, 0x9b, 0x88, 0xac,
704 0x50, 0xce, 0x97, 0x36, 0xdd, 0xaf, 0x25, 0xf6, 0x10, 0x34, 0x96, 0x6e
705 };
706 #endif
707 #endif
708 #endif
709
710 /* kExampleDHKeyDER is a DH private key in ASN.1, DER format. */
711 #ifndef OPENSSL_NO_DEPRECATED_3_0
712 #ifndef OPENSSL_NO_DH
713 static const unsigned char kExampleDHKeyDER[] = {
714 0x30, 0x82, 0x01, 0x21, 0x02, 0x01, 0x00, 0x30, 0x81, 0x95, 0x06, 0x09,
715 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x03, 0x01, 0x30, 0x81, 0x87,
716 0x02, 0x81, 0x81, 0x00, 0xf7, 0x52, 0xc2, 0x68, 0xcc, 0x66, 0xc4, 0x8d,
717 0x03, 0x3f, 0xfa, 0x9c, 0x52, 0xd0, 0xd8, 0x33, 0xf2, 0xe1, 0xc9, 0x9e,
718 0xb7, 0xe7, 0x6e, 0x90, 0x97, 0xeb, 0x92, 0x91, 0x6a, 0x9a, 0x85, 0x63,
719 0x92, 0x79, 0xab, 0xb6, 0x3d, 0x23, 0x58, 0x5a, 0xe8, 0x45, 0x06, 0x81,
720 0x97, 0x77, 0xe1, 0xcc, 0x34, 0x4e, 0xae, 0x36, 0x80, 0xf2, 0xc4, 0x7f,
721 0x8a, 0x52, 0xb8, 0xdb, 0x58, 0xc8, 0x4b, 0x12, 0x4c, 0xf1, 0x4c, 0x53,
722 0xc1, 0x89, 0x39, 0x8d, 0xb6, 0x06, 0xd8, 0xea, 0x7f, 0x2d, 0x36, 0x53,
723 0x96, 0x29, 0xbe, 0xb6, 0x75, 0xfc, 0xe7, 0xf3, 0x36, 0xd6, 0xf4, 0x8f,
724 0x16, 0xa6, 0xc7, 0xec, 0x7b, 0xce, 0x42, 0x8d, 0x48, 0x2e, 0xb7, 0x74,
725 0x00, 0x11, 0x52, 0x61, 0xb4, 0x19, 0x35, 0xec, 0x5c, 0xe4, 0xbe, 0x34,
726 0xc6, 0x59, 0x64, 0x5e, 0x42, 0x61, 0x70, 0x54, 0xf4, 0xe9, 0x6b, 0x53,
727 0x02, 0x01, 0x02, 0x04, 0x81, 0x83, 0x02, 0x81, 0x80, 0x64, 0xc2, 0xe3,
728 0x09, 0x69, 0x37, 0x3c, 0xd2, 0x4a, 0xba, 0xc3, 0x78, 0x6a, 0x9b, 0x8a,
729 0x2a, 0xdb, 0xe7, 0xe6, 0xc0, 0xfa, 0x3a, 0xbe, 0x39, 0x67, 0xc0, 0xa9,
730 0x2a, 0xf0, 0x0a, 0xc1, 0x53, 0x1c, 0xdb, 0xfa, 0x1a, 0x26, 0x98, 0xb0,
731 0x8c, 0xc6, 0x06, 0x4a, 0xa2, 0x48, 0xd3, 0xa4, 0x3b, 0xbd, 0x05, 0x48,
732 0xea, 0x59, 0xdb, 0x18, 0xa4, 0xca, 0x66, 0xd9, 0x5d, 0xb8, 0x95, 0xd1,
733 0xeb, 0x97, 0x3d, 0x66, 0x97, 0x5c, 0x86, 0x8f, 0x7e, 0x90, 0xd3, 0x43,
734 0xd1, 0xa2, 0x0d, 0xcb, 0xe7, 0xeb, 0x90, 0xea, 0x09, 0x40, 0xb1, 0x6f,
735 0xf7, 0x4c, 0xf2, 0x41, 0x83, 0x1d, 0xd0, 0x76, 0xef, 0xaf, 0x55, 0x6f,
736 0x5d, 0xa9, 0xa3, 0x55, 0x81, 0x2a, 0xd1, 0x5d, 0x9d, 0x22, 0x77, 0x97,
737 0x83, 0xde, 0xad, 0xb6, 0x5d, 0x19, 0xc1, 0x53, 0xec, 0xfb, 0xaf, 0x06,
738 0x2e, 0x87, 0x2a, 0x0b, 0x7a
739 };
740 #endif
741 #endif
742
743 static const unsigned char kCFBDefaultKey[] = {
744 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88,
745 0x09, 0xCF, 0x4F, 0x3C
746 };
747
748 static const unsigned char kGCMDefaultKey[32] = { 0 };
749
750 static const unsigned char kGCMResetKey[] = {
751 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 0x6d, 0x6a, 0x8f, 0x94,
752 0x67, 0x30, 0x83, 0x08, 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c,
753 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08
754 };
755
756 static const unsigned char iCFBIV[] = {
757 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
758 0x0C, 0x0D, 0x0E, 0x0F
759 };
760
761 static const unsigned char iGCMDefaultIV[12] = { 0 };
762
763 static const unsigned char iGCMResetIV1[] = {
764 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad
765 };
766
767 static const unsigned char iGCMResetIV2[] = {
768 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88
769 };
770
771 static const unsigned char cfbPlaintext[] = {
772 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11,
773 0x73, 0x93, 0x17, 0x2A
774 };
775 static const unsigned char cfbPlaintext_partial[] = {
776 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11,
777 0x73, 0x93, 0x17, 0x2A, 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96
778 };
779
780 static const unsigned char gcmDefaultPlaintext[16] = { 0 };
781
782 static const unsigned char gcmResetPlaintext[] = {
783 0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09, 0xc5,
784 0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda,
785 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c, 0x3c, 0x0c, 0x95,
786 0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25,
787 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57, 0xba, 0x63, 0x7b, 0x39
788 };
789
790 static const unsigned char cfbCiphertext[] = {
791 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8,
792 0xE8, 0x3C, 0xFB, 0x4A
793 };
794
795 static const unsigned char cfbCiphertext_partial[] = {
796 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8,
797 0xE8, 0x3C, 0xFB, 0x4A, 0x0D, 0x4A, 0x71, 0x82, 0x90, 0xF0, 0x9A, 0x35
798 };
799
800 static const unsigned char ofbCiphertext_partial[] = {
801 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8,
802 0xE8, 0x3C, 0xFB, 0x4A, 0xB2, 0x65, 0x64, 0x38, 0x26, 0xD2, 0xBC, 0x09
803 };
804
805 static const unsigned char gcmDefaultCiphertext[] = {
806 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e, 0x07, 0x4e, 0xc5, 0xd3,
807 0xba, 0xf3, 0x9d, 0x18
808 };
809
810 static const unsigned char gcmResetCiphertext1[] = {
811 0xc3, 0x76, 0x2d, 0xf1, 0xca, 0x78, 0x7d, 0x32, 0xae, 0x47, 0xc1, 0x3b,
812 0xf1, 0x98, 0x44, 0xcb, 0xaf, 0x1a, 0xe1, 0x4d, 0x0b, 0x97, 0x6a, 0xfa,
813 0xc5, 0x2f, 0xf7, 0xd7, 0x9b, 0xba, 0x9d, 0xe0, 0xfe, 0xb5, 0x82, 0xd3,
814 0x39, 0x34, 0xa4, 0xf0, 0x95, 0x4c, 0xc2, 0x36, 0x3b, 0xc7, 0x3f, 0x78,
815 0x62, 0xac, 0x43, 0x0e, 0x64, 0xab, 0xe4, 0x99, 0xf4, 0x7c, 0x9b, 0x1f
816 };
817
818 static const unsigned char gcmResetCiphertext2[] = {
819 0x52, 0x2d, 0xc1, 0xf0, 0x99, 0x56, 0x7d, 0x07, 0xf4, 0x7f, 0x37, 0xa3,
820 0x2a, 0x84, 0x42, 0x7d, 0x64, 0x3a, 0x8c, 0xdc, 0xbf, 0xe5, 0xc0, 0xc9,
821 0x75, 0x98, 0xa2, 0xbd, 0x25, 0x55, 0xd1, 0xaa, 0x8c, 0xb0, 0x8e, 0x48,
822 0x59, 0x0d, 0xbb, 0x3d, 0xa7, 0xb0, 0x8b, 0x10, 0x56, 0x82, 0x88, 0x38,
823 0xc5, 0xf6, 0x1e, 0x63, 0x93, 0xba, 0x7a, 0x0a, 0xbc, 0xc9, 0xf6, 0x62
824 };
825
826 static const unsigned char gcmAAD[] = {
827 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe, 0xef, 0xfe, 0xed, 0xfa, 0xce,
828 0xde, 0xad, 0xbe, 0xef, 0xab, 0xad, 0xda, 0xd2
829 };
830
831 static const unsigned char gcmDefaultTag[] = {
832 0xd0, 0xd1, 0xc8, 0xa7, 0x99, 0x99, 0x6b, 0xf0, 0x26, 0x5b, 0x98, 0xb5,
833 0xd4, 0x8a, 0xb9, 0x19
834 };
835
836 static const unsigned char gcmResetTag1[] = {
837 0x3a, 0x33, 0x7d, 0xbf, 0x46, 0xa7, 0x92, 0xc4, 0x5e, 0x45, 0x49, 0x13,
838 0xfe, 0x2e, 0xa8, 0xf2
839 };
840
841 static const unsigned char gcmResetTag2[] = {
842 0x76, 0xfc, 0x6e, 0xce, 0x0f, 0x4e, 0x17, 0x68, 0xcd, 0xdf, 0x88, 0x53,
843 0xbb, 0x2d, 0x55, 0x1b
844 };
845
846 typedef struct APK_DATA_st {
847 const unsigned char *kder;
848 size_t size;
849 const char *keytype;
850 int evptype;
851 int check;
852 int pub_check;
853 int param_check;
854 int type; /* 0 for private, 1 for public, 2 for params */
855 } APK_DATA;
856
857 static APK_DATA keydata[] = {
858 { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA },
859 { kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8), "RSA", EVP_PKEY_RSA },
860 #ifndef OPENSSL_NO_EC
861 { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC }
862 #endif
863 };
864
865 static APK_DATA keydata_v2[] = {
866 { kExampleRSAKeyPKCS8_v2, sizeof(kExampleRSAKeyPKCS8_v2), "RSA", EVP_PKEY_RSA },
867 #ifndef OPENSSL_NO_EC
868 { kExampleECKeyPKCS8_v2, sizeof(kExampleECKeyPKCS8_v2), "EC", EVP_PKEY_EC }
869 #endif
870 };
871
872 static APK_DATA keycheckdata[] = {
873 { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA, 1, 1, 1,
874 0 },
875 { kExampleBadRSAKeyDER, sizeof(kExampleBadRSAKeyDER), "RSA", EVP_PKEY_RSA,
876 0, 1, 1, 0 },
877 { kExampleBad2RSAKeyDER, sizeof(kExampleBad2RSAKeyDER), "RSA", EVP_PKEY_RSA,
878 0, 0, 1 /* Since there are no "params" in an RSA key this passes */, 0 },
879 #ifndef OPENSSL_NO_EC
880 { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC, 1, 1, 1, 0 },
881 /* group is also associated in our pub key */
882 { kExampleECPubKeyDER, sizeof(kExampleECPubKeyDER), "EC", EVP_PKEY_EC, 0, 1,
883 1, 1 },
884 { pExampleECParamDER, sizeof(pExampleECParamDER), "EC", EVP_PKEY_EC, 0, 0, 1,
885 2 },
886 #ifndef OPENSSL_NO_ECX
887 { kExampleED25519KeyDER, sizeof(kExampleED25519KeyDER), "ED25519",
888 EVP_PKEY_ED25519, 1, 1, 1, 0 },
889 { kExampleED25519PubKeyDER, sizeof(kExampleED25519PubKeyDER), "ED25519",
890 EVP_PKEY_ED25519, 0, 1, 1, 1 },
891 #endif
892 #endif
893 };
894
load_example_key(const char * keytype,const unsigned char * data,size_t data_len)895 static EVP_PKEY *load_example_key(const char *keytype,
896 const unsigned char *data, size_t data_len)
897 {
898 const unsigned char **pdata = &data;
899 EVP_PKEY *pkey = NULL;
900 OSSL_DECODER_CTX *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, keytype, 0,
901 testctx, testpropq);
902
903 /* |pkey| will be NULL on error */
904 (void)OSSL_DECODER_from_data(dctx, pdata, &data_len);
905 OSSL_DECODER_CTX_free(dctx);
906 return pkey;
907 }
908
load_example_rsa_key(void)909 static EVP_PKEY *load_example_rsa_key(void)
910 {
911 return load_example_key("RSA", kExampleRSAKeyDER,
912 sizeof(kExampleRSAKeyDER));
913 }
914
915 #ifndef OPENSSL_NO_DSA
load_example_dsa_key(void)916 static EVP_PKEY *load_example_dsa_key(void)
917 {
918 return load_example_key("DSA", kExampleDSAKeyDER,
919 sizeof(kExampleDSAKeyDER));
920 }
921 #endif
922
923 #ifndef OPENSSL_NO_EC
load_example_ec_key(void)924 static EVP_PKEY *load_example_ec_key(void)
925 {
926 return load_example_key("EC", kExampleECKeyDER,
927 sizeof(kExampleECKeyDER));
928 }
929 #endif
930
931 #ifndef OPENSSL_NO_DEPRECATED_3_0
932
make_bad_rsa_pubkey(void)933 static EVP_PKEY *make_bad_rsa_pubkey(void)
934 {
935 RSA *rsa = NULL;
936 BIGNUM *n = NULL, *e = NULL;
937 EVP_PKEY *pkey = NULL;
938
939 /* Deliberately invalid public key: n = 17, e = 17 */
940 if (!TEST_ptr(pkey = EVP_PKEY_new())
941 || !TEST_ptr(rsa = RSA_new())
942 || !TEST_ptr(n = BN_new())
943 || !TEST_ptr(e = BN_new())
944 || !TEST_true(BN_set_word(n, 17))
945 || !TEST_true(BN_set_word(e, 17))
946 || !TEST_true(RSA_set0_key(rsa, n, e, NULL))
947 || !EVP_PKEY_assign_RSA(pkey, rsa))
948 goto err;
949
950 return pkey;
951 err:
952 BN_free(n);
953 BN_free(e);
954 RSA_free(rsa);
955 return NULL;
956 }
957
958 #ifndef OPENSSL_NO_DH
load_example_dh_key(void)959 static EVP_PKEY *load_example_dh_key(void)
960 {
961 return load_example_key("DH", kExampleDHKeyDER,
962 sizeof(kExampleDHKeyDER));
963 }
964 #endif
965
966 #ifndef OPENSSL_NO_ECX
load_example_ed25519_key(void)967 static EVP_PKEY *load_example_ed25519_key(void)
968 {
969 return load_example_key("ED25519", kExampleED25519KeyDER,
970 sizeof(kExampleED25519KeyDER));
971 }
972
load_example_x25519_key(void)973 static EVP_PKEY *load_example_x25519_key(void)
974 {
975 return load_example_key("X25519", kExampleX25519KeyDER,
976 sizeof(kExampleX25519KeyDER));
977 }
978 #endif
979 #endif /* OPENSSL_NO_DEPRECATED_3_0 */
980
load_example_hmac_key(void)981 static EVP_PKEY *load_example_hmac_key(void)
982 {
983 EVP_PKEY *pkey = NULL;
984 unsigned char key[] = {
985 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
986 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
987 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
988 };
989
990 pkey = EVP_PKEY_new_raw_private_key_ex(testctx, "HMAC",
991 NULL, key, sizeof(key));
992 if (!TEST_ptr(pkey))
993 return NULL;
994
995 return pkey;
996 }
997
test_EVP_set_config_properties(void)998 static int test_EVP_set_config_properties(void)
999 {
1000 char *fetched_properties = NULL;
1001 const char test_propq[] = "test.fizzbuzz=buzzfizz";
1002 int res = 0;
1003
1004 fetched_properties = EVP_get1_default_properties(OSSL_LIB_CTX_get0_global_default());
1005 if (!TEST_ptr(fetched_properties)
1006 || !TEST_str_eq(fetched_properties, test_propq))
1007 goto err;
1008 OPENSSL_free(fetched_properties);
1009 fetched_properties = NULL;
1010
1011 res = 1;
1012 err:
1013 OPENSSL_free(fetched_properties);
1014 return res;
1015 }
1016
test_EVP_set_default_properties(void)1017 static int test_EVP_set_default_properties(void)
1018 {
1019 OSSL_LIB_CTX *ctx;
1020 EVP_MD *md = NULL;
1021 int res = 0;
1022 char *fetched_properties = NULL;
1023 const char test_propq[] = "provider=fizzbang";
1024 const char test_fips_propq[] = "fips=yes,provider=fizzbang";
1025
1026 if (!TEST_ptr(ctx = OSSL_LIB_CTX_new())
1027 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL)))
1028 goto err;
1029 EVP_MD_free(md);
1030 md = NULL;
1031
1032 if (!TEST_true(EVP_set_default_properties(ctx, test_propq))
1033 || !TEST_ptr_null(md = EVP_MD_fetch(ctx, "sha256", NULL))
1034 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", "-provider")))
1035 goto err;
1036 EVP_MD_free(md);
1037 md = NULL;
1038
1039 fetched_properties = EVP_get1_default_properties(ctx);
1040 if (!TEST_ptr(fetched_properties)
1041 || !TEST_str_eq(fetched_properties, test_propq))
1042 goto err;
1043 OPENSSL_free(fetched_properties);
1044 fetched_properties = NULL;
1045
1046 if (!TEST_true(EVP_default_properties_enable_fips(ctx, 1)))
1047 goto err;
1048 fetched_properties = EVP_get1_default_properties(ctx);
1049 if (!TEST_ptr(fetched_properties)
1050 || !TEST_str_eq(fetched_properties, test_fips_propq))
1051 goto err;
1052 OPENSSL_free(fetched_properties);
1053 fetched_properties = NULL;
1054
1055 if (!TEST_true(EVP_default_properties_enable_fips(ctx, 0)))
1056 goto err;
1057
1058 if (!TEST_true(EVP_set_default_properties(ctx, NULL))
1059 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL)))
1060 goto err;
1061 res = 1;
1062 err:
1063 OPENSSL_free(fetched_properties);
1064 EVP_MD_free(md);
1065 OSSL_LIB_CTX_free(ctx);
1066 return res;
1067 }
1068
1069 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC)
make_key_fromdata(char * keytype,OSSL_PARAM * params)1070 static EVP_PKEY *make_key_fromdata(char *keytype, OSSL_PARAM *params)
1071 {
1072 EVP_PKEY_CTX *pctx = NULL;
1073 EVP_PKEY *tmp_pkey = NULL, *pkey = NULL;
1074
1075 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, keytype, testpropq)))
1076 goto err;
1077 /* Check that premature EVP_PKEY_CTX_set_params() fails gracefully */
1078 if (!TEST_int_eq(EVP_PKEY_CTX_set_params(pctx, params), 0)
1079 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
1080 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &tmp_pkey, EVP_PKEY_KEYPAIR,
1081 params),
1082 0))
1083 goto err;
1084
1085 if (!TEST_ptr(tmp_pkey))
1086 goto err;
1087
1088 pkey = tmp_pkey;
1089 tmp_pkey = NULL;
1090 err:
1091 EVP_PKEY_free(tmp_pkey);
1092 EVP_PKEY_CTX_free(pctx);
1093 return pkey;
1094 }
1095
test_selection(EVP_PKEY * pkey,int selection)1096 static int test_selection(EVP_PKEY *pkey, int selection)
1097 {
1098 int testresult = 0;
1099 int ret;
1100 BIO *bio = BIO_new(BIO_s_mem());
1101
1102 ret = PEM_write_bio_PUBKEY(bio, pkey);
1103 if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
1104 if (!TEST_true(ret))
1105 goto err;
1106 } else {
1107 if (!TEST_false(ret))
1108 goto err;
1109 }
1110 ret = PEM_write_bio_PrivateKey_ex(bio, pkey, NULL, NULL, 0, NULL, NULL,
1111 testctx, NULL);
1112 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
1113 if (!TEST_true(ret))
1114 goto err;
1115 } else {
1116 if (!TEST_false(ret))
1117 goto err;
1118 }
1119
1120 testresult = 1;
1121 err:
1122 BIO_free(bio);
1123
1124 return testresult;
1125 }
1126 #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA || !OPENSSL_NO_EC */
1127
1128 /*
1129 * RSASVE (SP 800-56B 7.2) must reject mathematically degenerate inputs:
1130 * a public exponent e <= 1, and a ciphertext c in {0, 1, n - 1}. Outside
1131 * the FIPS module these were previously accepted; the checks now apply to
1132 * every build, so exercise them in the default provider.
1133 */
1134
1135 /*
1136 * With e <= 1 the RSA public operation is the identity (or worse), so
1137 * encapsulation setup must reject the key with PROV_R_INVALID_KEY. idx
1138 * selects the exponent: 0 or 1.
1139 */
test_rsasve_degenerate_exponent(int idx)1140 static int test_rsasve_degenerate_exponent(int idx)
1141 {
1142 EVP_PKEY *rsakey = NULL;
1143 EVP_PKEY *pubkey = NULL;
1144 EVP_PKEY_CTX *genctx = NULL;
1145 EVP_PKEY_CTX *ctx = NULL;
1146 OSSL_PARAM_BLD *bld = NULL;
1147 OSSL_PARAM *params = NULL;
1148 BIGNUM *n = NULL;
1149 BIGNUM *e = NULL;
1150 int testresult = 0;
1151
1152 /* Borrow a real modulus; only the exponent is degenerate. */
1153 if (!TEST_ptr(rsakey = load_example_rsa_key())
1154 || !TEST_true(EVP_PKEY_get_bn_param(rsakey, OSSL_PKEY_PARAM_RSA_N, &n)))
1155 goto err;
1156
1157 if (!TEST_ptr(e = BN_new())
1158 || !TEST_true(BN_set_word(e, (BN_ULONG)idx))) /* idx is 0 or 1 */
1159 goto err;
1160
1161 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1162 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n))
1163 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e))
1164 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)))
1165 goto err;
1166
1167 if (!TEST_ptr(genctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL))
1168 || !TEST_int_gt(EVP_PKEY_fromdata_init(genctx), 0)
1169 || !TEST_int_gt(EVP_PKEY_fromdata(genctx, &pubkey, EVP_PKEY_PUBLIC_KEY,
1170 params),
1171 0))
1172 goto err;
1173
1174 ERR_clear_error();
1175 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pubkey, NULL))
1176 || !TEST_int_eq(EVP_PKEY_encapsulate_init(ctx, NULL), 0)
1177 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_INVALID_KEY))
1178 goto err;
1179
1180 testresult = 1;
1181 err:
1182 EVP_PKEY_CTX_free(ctx);
1183 EVP_PKEY_CTX_free(genctx);
1184 EVP_PKEY_free(pubkey);
1185 EVP_PKEY_free(rsakey);
1186 OSSL_PARAM_free(params);
1187 OSSL_PARAM_BLD_free(bld);
1188 BN_free(e);
1189 BN_free(n);
1190 return testresult;
1191 }
1192
1193 /*
1194 * A ciphertext c in {0, 1, n - 1} is a fixed point or trivial case of RSADP,
1195 * so RSASVE recovery must reject it. idx selects the ciphertext: 0, 1, or
1196 * n - 1. The ciphertext length must equal the modulus length.
1197 */
test_rsasve_degenerate_ciphertext(int idx)1198 static int test_rsasve_degenerate_ciphertext(int idx)
1199 {
1200 EVP_PKEY *rsakey = NULL;
1201 EVP_PKEY_CTX *ctx = NULL;
1202 BIGNUM *n = NULL;
1203 unsigned char *ct = NULL;
1204 unsigned char *secret = NULL;
1205 size_t ctlen = 0;
1206 size_t secretlen = 0;
1207 int expected_reason = 0;
1208 int testresult = 0;
1209
1210 if (!TEST_ptr(rsakey = load_example_rsa_key())
1211 || !TEST_true(EVP_PKEY_get_bn_param(rsakey, OSSL_PKEY_PARAM_RSA_N, &n)))
1212 goto err;
1213
1214 ctlen = secretlen = (size_t)EVP_PKEY_get_size(rsakey);
1215 if (!TEST_ptr(ct = OPENSSL_zalloc(ctlen))
1216 || !TEST_ptr(secret = OPENSSL_malloc(secretlen)))
1217 goto err;
1218
1219 switch (idx) {
1220 case 0: /* c = 0 */
1221 expected_reason = RSA_R_DATA_TOO_SMALL;
1222 break;
1223 case 1: /* c = 1 */
1224 ct[ctlen - 1] = 1;
1225 expected_reason = RSA_R_DATA_TOO_SMALL;
1226 break;
1227 case 2: /* c = n - 1 */
1228 if (!TEST_true(BN_sub_word(n, 1))
1229 || !TEST_int_eq(BN_bn2binpad(n, ct, (int)ctlen), (int)ctlen))
1230 goto err;
1231 expected_reason = RSA_R_DATA_TOO_LARGE_FOR_MODULUS;
1232 break;
1233 default:
1234 goto err;
1235 }
1236
1237 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, rsakey, NULL))
1238 || !TEST_int_eq(EVP_PKEY_decapsulate_init(ctx, NULL), 1)
1239 || !TEST_int_eq(EVP_PKEY_CTX_set_kem_op(ctx, "RSASVE"), 1))
1240 goto err;
1241
1242 ERR_clear_error();
1243 if (!TEST_int_eq(EVP_PKEY_decapsulate(ctx, secret, &secretlen, ct, ctlen), 0)
1244 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), expected_reason))
1245 goto err;
1246
1247 testresult = 1;
1248 err:
1249 OPENSSL_free(secret);
1250 OPENSSL_free(ct);
1251 EVP_PKEY_CTX_free(ctx);
1252 EVP_PKEY_free(rsakey);
1253 BN_free(n);
1254 return testresult;
1255 }
1256
1257 /*
1258 * Test combinations of private, public, missing and private + public key
1259 * params to ensure they are all accepted
1260 */
1261 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA)
test_EVP_PKEY_ffc_priv_pub(char * keytype)1262 static int test_EVP_PKEY_ffc_priv_pub(char *keytype)
1263 {
1264 OSSL_PARAM_BLD *bld = NULL;
1265 OSSL_PARAM *params = NULL;
1266 EVP_PKEY *just_params = NULL;
1267 EVP_PKEY *params_and_priv = NULL;
1268 EVP_PKEY *params_and_pub = NULL;
1269 EVP_PKEY *params_and_keypair = NULL;
1270 BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL;
1271 int ret = 0;
1272
1273 /*
1274 * Setup the parameters for our pkey object. For our purposes they don't
1275 * have to actually be *valid* parameters. We just need to set something.
1276 */
1277 if (!TEST_ptr(p = BN_new())
1278 || !TEST_ptr(q = BN_new())
1279 || !TEST_ptr(g = BN_new())
1280 || !TEST_ptr(pub = BN_new())
1281 || !TEST_ptr(priv = BN_new()))
1282 goto err;
1283
1284 /* Test !priv and !pub */
1285 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1286 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
1287 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q))
1288 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)))
1289 goto err;
1290 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1291 || !TEST_ptr(just_params = make_key_fromdata(keytype, params)))
1292 goto err;
1293
1294 OSSL_PARAM_free(params);
1295 OSSL_PARAM_BLD_free(bld);
1296 params = NULL;
1297 bld = NULL;
1298
1299 if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS)
1300 || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR))
1301 goto err;
1302
1303 /* Test priv and !pub */
1304 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1305 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
1306 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q))
1307 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
1308 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
1309 priv)))
1310 goto err;
1311 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1312 || !TEST_ptr(params_and_priv = make_key_fromdata(keytype, params)))
1313 goto err;
1314
1315 OSSL_PARAM_free(params);
1316 OSSL_PARAM_BLD_free(bld);
1317 params = NULL;
1318 bld = NULL;
1319
1320 if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PRIVATE_KEY)
1321 || test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PUBLIC_KEY))
1322 goto err;
1323
1324 /* Test !priv and pub */
1325 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1326 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
1327 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q))
1328 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
1329 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY,
1330 pub)))
1331 goto err;
1332 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1333 || !TEST_ptr(params_and_pub = make_key_fromdata(keytype, params)))
1334 goto err;
1335
1336 OSSL_PARAM_free(params);
1337 OSSL_PARAM_BLD_free(bld);
1338 params = NULL;
1339 bld = NULL;
1340
1341 if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
1342 || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY))
1343 goto err;
1344
1345 /* Test priv and pub */
1346 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1347 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
1348 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q))
1349 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
1350 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY,
1351 pub))
1352 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
1353 priv)))
1354 goto err;
1355 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1356 || !TEST_ptr(params_and_keypair = make_key_fromdata(keytype, params)))
1357 goto err;
1358
1359 if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR))
1360 goto err;
1361
1362 ret = 1;
1363 err:
1364 OSSL_PARAM_free(params);
1365 OSSL_PARAM_BLD_free(bld);
1366 EVP_PKEY_free(just_params);
1367 EVP_PKEY_free(params_and_priv);
1368 EVP_PKEY_free(params_and_pub);
1369 EVP_PKEY_free(params_and_keypair);
1370 BN_free(p);
1371 BN_free(q);
1372 BN_free(g);
1373 BN_free(pub);
1374 BN_free(priv);
1375
1376 return ret;
1377 }
1378 #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA */
1379
1380 /*
1381 * Test combinations of private, public, missing and private + public key
1382 * params to ensure they are all accepted for EC keys
1383 */
1384 #ifndef OPENSSL_NO_EC
1385 static unsigned char ec_priv[] = {
1386 0xe9, 0x25, 0xf7, 0x66, 0x58, 0xa4, 0xdd, 0x99, 0x61, 0xe7, 0xe8, 0x23,
1387 0x85, 0xc2, 0xe8, 0x33, 0x27, 0xc5, 0x5c, 0xeb, 0xdb, 0x43, 0x9f, 0xd5,
1388 0xf2, 0x5a, 0x75, 0x55, 0xd0, 0x2e, 0x6d, 0x16
1389 };
1390 static unsigned char ec_pub[] = {
1391 0x04, 0xad, 0x11, 0x90, 0x77, 0x4b, 0x46, 0xee, 0x72, 0x51, 0x15, 0x97,
1392 0x4a, 0x6a, 0xa7, 0xaf, 0x59, 0xfa, 0x4b, 0xf2, 0x41, 0xc8, 0x3a, 0x81,
1393 0x23, 0xb6, 0x90, 0x04, 0x6c, 0x67, 0x66, 0xd0, 0xdc, 0xf2, 0x15, 0x1d,
1394 0x41, 0x61, 0xb7, 0x95, 0x85, 0x38, 0x5a, 0x84, 0x56, 0xe8, 0xb3, 0x0e,
1395 0xf5, 0xc6, 0x5d, 0xa4, 0x54, 0x26, 0xb0, 0xf7, 0xa5, 0x4a, 0x33, 0xf1,
1396 0x08, 0x09, 0xb8, 0xdb, 0x03
1397 };
1398
test_EC_priv_pub(void)1399 static int test_EC_priv_pub(void)
1400 {
1401 OSSL_PARAM_BLD *bld = NULL;
1402 OSSL_PARAM *params = NULL;
1403 EVP_PKEY *just_params = NULL;
1404 EVP_PKEY *params_and_priv = NULL;
1405 EVP_PKEY *params_and_pub = NULL;
1406 EVP_PKEY *params_and_keypair = NULL;
1407 BIGNUM *priv = NULL;
1408 int ret = 0;
1409 unsigned char *encoded = NULL;
1410 size_t len = 0;
1411 unsigned char buffer[128];
1412
1413 /*
1414 * Setup the parameters for our pkey object. For our purposes they don't
1415 * have to actually be *valid* parameters. We just need to set something.
1416 */
1417 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL)))
1418 goto err;
1419
1420 /* Test !priv and !pub */
1421 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1422 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
1423 OSSL_PKEY_PARAM_GROUP_NAME,
1424 "P-256", 0)))
1425 goto err;
1426 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1427 || !TEST_ptr(just_params = make_key_fromdata("EC", params)))
1428 goto err;
1429
1430 OSSL_PARAM_free(params);
1431 OSSL_PARAM_BLD_free(bld);
1432 params = NULL;
1433 bld = NULL;
1434
1435 if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS)
1436 || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR))
1437 goto err;
1438
1439 /* Test priv and !pub */
1440 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1441 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
1442 OSSL_PKEY_PARAM_GROUP_NAME,
1443 "P-256", 0))
1444 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
1445 priv)))
1446 goto err;
1447 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1448 || !TEST_ptr(params_and_priv = make_key_fromdata("EC", params)))
1449 goto err;
1450
1451 OSSL_PARAM_free(params);
1452 OSSL_PARAM_BLD_free(bld);
1453 params = NULL;
1454 bld = NULL;
1455
1456 /*
1457 * We indicate only parameters here, in spite of having built a key that
1458 * has a private part, because the PEM_write_bio_PrivateKey_ex call is
1459 * expected to fail because it does not support exporting a private EC
1460 * key without a corresponding public key
1461 */
1462 if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS)
1463 || test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PUBLIC_KEY))
1464 goto err;
1465
1466 /* Test !priv and pub */
1467 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1468 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
1469 OSSL_PKEY_PARAM_GROUP_NAME,
1470 "P-256", 0))
1471 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld,
1472 OSSL_PKEY_PARAM_PUB_KEY,
1473 ec_pub, sizeof(ec_pub))))
1474 goto err;
1475 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1476 || !TEST_ptr(params_and_pub = make_key_fromdata("EC", params)))
1477 goto err;
1478
1479 OSSL_PARAM_free(params);
1480 OSSL_PARAM_BLD_free(bld);
1481 params = NULL;
1482 bld = NULL;
1483
1484 if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
1485 || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY))
1486 goto err;
1487
1488 /* Test priv and pub */
1489 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1490 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
1491 OSSL_PKEY_PARAM_GROUP_NAME,
1492 "P-256", 0))
1493 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld,
1494 OSSL_PKEY_PARAM_PUB_KEY,
1495 ec_pub, sizeof(ec_pub)))
1496 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
1497 priv)))
1498 goto err;
1499 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1500 || !TEST_ptr(params_and_keypair = make_key_fromdata("EC", params)))
1501 goto err;
1502
1503 if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR))
1504 goto err;
1505
1506 /* Try key equality */
1507 if (!TEST_int_gt(EVP_PKEY_parameters_eq(just_params, just_params), 0)
1508 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_pub),
1509 0)
1510 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_priv),
1511 0)
1512 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_keypair),
1513 0)
1514 || !TEST_int_gt(EVP_PKEY_eq(params_and_pub, params_and_pub), 0)
1515 || !TEST_int_gt(EVP_PKEY_eq(params_and_priv, params_and_priv), 0)
1516 || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_pub), 0)
1517 || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_priv), 0))
1518 goto err;
1519
1520 /* Positive and negative testcase for EVP_PKEY_get1_encoded_public_key */
1521 if (!TEST_int_gt(EVP_PKEY_get1_encoded_public_key(params_and_pub, &encoded), 0))
1522 goto err;
1523 OPENSSL_free(encoded);
1524 encoded = NULL;
1525 if (!TEST_int_eq(EVP_PKEY_get1_encoded_public_key(just_params, &encoded), 0)) {
1526 OPENSSL_free(encoded);
1527 encoded = NULL;
1528 goto err;
1529 }
1530
1531 /* Positive and negative testcase for EVP_PKEY_get_octet_string_param */
1532 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub,
1533 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1534 buffer, sizeof(buffer), &len),
1535 1)
1536 || !TEST_int_eq(len, 65))
1537 goto err;
1538
1539 len = 0;
1540 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub,
1541 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1542 NULL, 0, &len),
1543 1)
1544 || !TEST_int_eq(len, 65))
1545 goto err;
1546
1547 /* too-short buffer len*/
1548 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub,
1549 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1550 buffer, 10, &len),
1551 0))
1552 goto err;
1553
1554 ret = 1;
1555 err:
1556 OSSL_PARAM_free(params);
1557 OSSL_PARAM_BLD_free(bld);
1558 EVP_PKEY_free(just_params);
1559 EVP_PKEY_free(params_and_priv);
1560 EVP_PKEY_free(params_and_pub);
1561 EVP_PKEY_free(params_and_keypair);
1562 BN_free(priv);
1563
1564 return ret;
1565 }
1566
1567 /* Also test that we can read the EC PUB affine coordinates */
test_evp_get_ec_pub(void)1568 static int test_evp_get_ec_pub(void)
1569 {
1570 OSSL_PARAM_BLD *bld = NULL;
1571 OSSL_PARAM *params = NULL;
1572 unsigned char *pad = NULL;
1573 EVP_PKEY *keypair = NULL;
1574 BIGNUM *priv = NULL;
1575 BIGNUM *x = NULL;
1576 BIGNUM *y = NULL;
1577 int ret = 0;
1578
1579 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL)))
1580 goto err;
1581
1582 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
1583 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
1584 OSSL_PKEY_PARAM_GROUP_NAME,
1585 "P-256", 0))
1586 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld,
1587 OSSL_PKEY_PARAM_PUB_KEY,
1588 ec_pub, sizeof(ec_pub)))
1589 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
1590 priv)))
1591 goto err;
1592
1593 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
1594 || !TEST_ptr(keypair = make_key_fromdata("EC", params)))
1595 goto err;
1596
1597 if (!test_selection(keypair, EVP_PKEY_KEYPAIR))
1598 goto err;
1599
1600 if (!EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_X, &x)
1601 || !EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_Y, &y))
1602 goto err;
1603
1604 if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub))))
1605 goto err;
1606
1607 pad[0] = ec_pub[0];
1608 BN_bn2bin(x, &pad[1]);
1609 BN_bn2bin(y, &pad[33]);
1610 if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0))
1611 goto err;
1612
1613 ret = 1;
1614
1615 err:
1616 OSSL_PARAM_free(params);
1617 OSSL_PARAM_BLD_free(bld);
1618 EVP_PKEY_free(keypair);
1619 OPENSSL_free(pad);
1620 BN_free(priv);
1621 BN_free(x);
1622 BN_free(y);
1623 return ret;
1624 }
1625
1626 /* Test that using a legacy EC key with only a private key in it works */
1627 #ifndef OPENSSL_NO_DEPRECATED_3_0
test_EC_priv_only_legacy(void)1628 static int test_EC_priv_only_legacy(void)
1629 {
1630 BIGNUM *priv = NULL;
1631 int ret = 0;
1632 EC_KEY *eckey = NULL;
1633 EVP_PKEY *pkey = NULL, *dup_pk = NULL;
1634 EVP_MD_CTX *ctx = NULL;
1635
1636 /* Create the low level EC_KEY */
1637 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL)))
1638 goto err;
1639
1640 eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
1641 if (!TEST_ptr(eckey))
1642 goto err;
1643
1644 if (!TEST_true(EC_KEY_set_private_key(eckey, priv)))
1645 goto err;
1646
1647 pkey = EVP_PKEY_new();
1648 if (!TEST_ptr(pkey))
1649 goto err;
1650
1651 if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey)))
1652 goto err;
1653 eckey = NULL;
1654
1655 for (;;) {
1656 ret = 0;
1657 ctx = EVP_MD_CTX_new();
1658 if (!TEST_ptr(ctx))
1659 goto err;
1660
1661 /*
1662 * The EVP_DigestSignInit function should create the key on the
1663 * provider side which is sufficient for this test.
1664 */
1665 if (!TEST_true(EVP_DigestSignInit_ex(ctx, NULL, NULL, testctx,
1666 testpropq, pkey, NULL)))
1667 goto err;
1668 EVP_MD_CTX_free(ctx);
1669 ctx = NULL;
1670
1671 if (dup_pk != NULL)
1672 break;
1673
1674 if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey)))
1675 goto err;
1676 /* EVP_PKEY_eq() returns -2 with missing public keys */
1677 ret = TEST_int_eq(EVP_PKEY_eq(pkey, dup_pk), -2);
1678 EVP_PKEY_free(pkey);
1679 pkey = dup_pk;
1680 if (!ret)
1681 goto err;
1682 }
1683 ret = 1;
1684
1685 err:
1686 EVP_MD_CTX_free(ctx);
1687 EVP_PKEY_free(pkey);
1688 EC_KEY_free(eckey);
1689 BN_free(priv);
1690
1691 return ret;
1692 }
1693
test_evp_get_ec_pub_legacy(void)1694 static int test_evp_get_ec_pub_legacy(void)
1695 {
1696 OSSL_LIB_CTX *libctx = NULL;
1697 unsigned char *pad = NULL;
1698 EVP_PKEY *pkey = NULL;
1699 EC_KEY *eckey = NULL;
1700 BIGNUM *priv = NULL;
1701 BIGNUM *x = NULL;
1702 BIGNUM *y = NULL;
1703 int ret = 0;
1704
1705 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
1706 goto err;
1707
1708 /* Create the legacy key */
1709 if (!TEST_ptr(eckey = EC_KEY_new_by_curve_name_ex(libctx, NULL,
1710 NID_X9_62_prime256v1)))
1711 goto err;
1712
1713 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL)))
1714 goto err;
1715
1716 if (!TEST_true(EC_KEY_set_private_key(eckey, priv)))
1717 goto err;
1718
1719 if (!TEST_ptr(x = BN_bin2bn(&ec_pub[1], 32, NULL)))
1720 goto err;
1721
1722 if (!TEST_ptr(y = BN_bin2bn(&ec_pub[33], 32, NULL)))
1723 goto err;
1724
1725 if (!TEST_true(EC_KEY_set_public_key_affine_coordinates(eckey, x, y)))
1726 goto err;
1727
1728 if (!TEST_ptr(pkey = EVP_PKEY_new()))
1729 goto err;
1730
1731 /* Transfer the legacy key */
1732 if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey)))
1733 goto err;
1734 eckey = NULL;
1735
1736 if (!TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_X, &x))
1737 || !TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_Y, &y)))
1738 goto err;
1739
1740 if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub))))
1741 goto err;
1742
1743 pad[0] = ec_pub[0];
1744 BN_bn2bin(x, &pad[1]);
1745 BN_bn2bin(y, &pad[33]);
1746
1747 if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0))
1748 goto err;
1749
1750 ret = 1;
1751
1752 err:
1753 OSSL_LIB_CTX_free(libctx);
1754 EVP_PKEY_free(pkey);
1755 EC_KEY_free(eckey);
1756 OPENSSL_free(pad);
1757 BN_free(priv);
1758 BN_free(x);
1759 BN_free(y);
1760
1761 return ret;
1762 }
1763 #endif /* OPENSSL_NO_DEPRECATED_3_0 */
1764 #endif /* OPENSSL_NO_EC */
1765
test_EVP_PKEY_sign(int tst)1766 static int test_EVP_PKEY_sign(int tst)
1767 {
1768 int ret = 0;
1769 EVP_PKEY *pkey = NULL;
1770 unsigned char *sig = NULL;
1771 size_t sig_len = 0, shortsig_len = 1;
1772 EVP_PKEY_CTX *ctx = NULL;
1773 unsigned char tbs[] = {
1774 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
1775 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13
1776 };
1777
1778 if (tst == 0) {
1779 if (!TEST_ptr(pkey = load_example_rsa_key()))
1780 goto out;
1781 } else if (tst == 1) {
1782 #ifndef OPENSSL_NO_DSA
1783 if (!TEST_ptr(pkey = load_example_dsa_key()))
1784 goto out;
1785 #else
1786 ret = 1;
1787 goto out;
1788 #endif
1789 } else {
1790 #ifndef OPENSSL_NO_EC
1791 if (!TEST_ptr(pkey = load_example_ec_key()))
1792 goto out;
1793 #else
1794 ret = 1;
1795 goto out;
1796 #endif
1797 }
1798
1799 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL);
1800 if (!TEST_ptr(ctx)
1801 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0)
1802 || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs,
1803 sizeof(tbs)),
1804 0))
1805 goto out;
1806 sig = OPENSSL_malloc(sig_len);
1807 if (!TEST_ptr(sig)
1808 /* Test sending a signature buffer that is too short is rejected */
1809 || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs,
1810 sizeof(tbs)),
1811 0)
1812 || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)),
1813 0)
1814 /* Test the signature round-trips */
1815 || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0)
1816 || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)),
1817 0))
1818 goto out;
1819
1820 ret = 1;
1821 out:
1822 EVP_PKEY_CTX_free(ctx);
1823 OPENSSL_free(sig);
1824 EVP_PKEY_free(pkey);
1825 return ret;
1826 }
1827
1828 #ifndef OPENSSL_NO_DEPRECATED_3_0
test_EVP_PKEY_sign_with_app_method(int tst)1829 static int test_EVP_PKEY_sign_with_app_method(int tst)
1830 {
1831 int ret = 0;
1832 EVP_PKEY *pkey = NULL;
1833 RSA *rsa = NULL;
1834 RSA_METHOD *rsa_meth = NULL;
1835 #ifndef OPENSSL_NO_DSA
1836 DSA *dsa = NULL;
1837 DSA_METHOD *dsa_meth = NULL;
1838 #endif
1839 unsigned char *sig = NULL;
1840 size_t sig_len = 0, shortsig_len = 1;
1841 EVP_PKEY_CTX *ctx = NULL;
1842 unsigned char tbs[] = {
1843 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
1844 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13
1845 };
1846
1847 if (tst == 0) {
1848 if (!TEST_ptr(pkey = load_example_rsa_key()))
1849 goto out;
1850 if (!TEST_ptr(rsa_meth = RSA_meth_dup(RSA_get_default_method())))
1851 goto out;
1852
1853 if (!TEST_ptr(rsa = EVP_PKEY_get1_RSA(pkey))
1854 || !TEST_int_gt(RSA_set_method(rsa, rsa_meth), 0)
1855 || !TEST_int_gt(EVP_PKEY_assign_RSA(pkey, rsa), 0))
1856 goto out;
1857 rsa = NULL; /* now owned by the pkey */
1858 } else {
1859 #ifndef OPENSSL_NO_DSA
1860 if (!TEST_ptr(pkey = load_example_dsa_key()))
1861 goto out;
1862 if (!TEST_ptr(dsa_meth = DSA_meth_dup(DSA_get_default_method())))
1863 goto out;
1864
1865 if (!TEST_ptr(dsa = EVP_PKEY_get1_DSA(pkey))
1866 || !TEST_int_gt(DSA_set_method(dsa, dsa_meth), 0)
1867 || !TEST_int_gt(EVP_PKEY_assign_DSA(pkey, dsa), 0))
1868 goto out;
1869 dsa = NULL; /* now owned by the pkey */
1870 #else
1871 ret = 1;
1872 goto out;
1873 #endif
1874 }
1875
1876 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL);
1877 if (!TEST_ptr(ctx)
1878 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0)
1879 || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs,
1880 sizeof(tbs)),
1881 0))
1882 goto out;
1883 sig = OPENSSL_malloc(sig_len);
1884 if (!TEST_ptr(sig)
1885 /* Test sending a signature buffer that is too short is rejected */
1886 || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs,
1887 sizeof(tbs)),
1888 0)
1889 || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)),
1890 0)
1891 /* Test the signature round-trips */
1892 || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0)
1893 || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)),
1894 0))
1895 goto out;
1896
1897 ret = 1;
1898 out:
1899 EVP_PKEY_CTX_free(ctx);
1900 OPENSSL_free(sig);
1901 EVP_PKEY_free(pkey);
1902 RSA_free(rsa);
1903 RSA_meth_free(rsa_meth);
1904 #ifndef OPENSSL_NO_DSA
1905 DSA_free(dsa);
1906 DSA_meth_free(dsa_meth);
1907 #endif
1908 return ret;
1909 }
1910 #endif /* !OPENSSL_NO_DEPRECATED_3_0 */
1911
1912 /*
1913 * n = 0 => test using legacy cipher
1914 * n = 1 => test using fetched cipher
1915 */
test_EVP_Enveloped(int n)1916 static int test_EVP_Enveloped(int n)
1917 {
1918 int ret = 0;
1919 EVP_CIPHER_CTX *ctx = NULL;
1920 EVP_PKEY *keypair = NULL;
1921 unsigned char *kek = NULL;
1922 unsigned char iv[EVP_MAX_IV_LENGTH];
1923 static const unsigned char msg[] = { 1, 2, 3, 4, 5, 6, 7, 8 };
1924 int len, kek_len, ciphertext_len, plaintext_len;
1925 unsigned char ciphertext[32], plaintext[16];
1926 EVP_CIPHER *type = NULL;
1927
1928 if (nullprov != NULL)
1929 return TEST_skip("Test does not support a non-default library context");
1930
1931 if (n == 0)
1932 type = (EVP_CIPHER *)EVP_aes_256_cbc();
1933 else if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "AES-256-CBC",
1934 testpropq)))
1935 goto err;
1936
1937 if (!TEST_ptr(keypair = load_example_rsa_key())
1938 || !TEST_ptr(kek = OPENSSL_zalloc(EVP_PKEY_get_size(keypair)))
1939 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new())
1940 || !TEST_true(EVP_SealInit(ctx, type, &kek, &kek_len, iv,
1941 &keypair, 1))
1942 || !TEST_true(EVP_SealUpdate(ctx, ciphertext, &ciphertext_len,
1943 msg, sizeof(msg)))
1944 || !TEST_true(EVP_SealFinal(ctx, ciphertext + ciphertext_len,
1945 &len)))
1946 goto err;
1947
1948 ciphertext_len += len;
1949
1950 if (!TEST_true(EVP_OpenInit(ctx, type, kek, kek_len, iv, keypair))
1951 || !TEST_true(EVP_OpenUpdate(ctx, plaintext, &plaintext_len,
1952 ciphertext, ciphertext_len))
1953 || !TEST_true(EVP_OpenFinal(ctx, plaintext + plaintext_len, &len)))
1954 goto err;
1955
1956 plaintext_len += len;
1957 if (!TEST_mem_eq(msg, sizeof(msg), plaintext, plaintext_len))
1958 goto err;
1959
1960 ret = 1;
1961 err:
1962 if (n != 0)
1963 EVP_CIPHER_free(type);
1964 OPENSSL_free(kek);
1965 EVP_PKEY_free(keypair);
1966 EVP_CIPHER_CTX_free(ctx);
1967 return ret;
1968 }
1969
1970 /*
1971 * Test 0: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, RSA)
1972 * Test 1: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, DSA)
1973 * Test 2: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, HMAC)
1974 * Test 3: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, RSA)
1975 * Test 4: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, DSA)
1976 * Test 5: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch diegst, HMAC)
1977 * Test 6: Use an MD BIO to do the Update calls instead (RSA)
1978 * Test 7: Use an MD BIO to do the Update calls instead (DSA)
1979 * Test 8: Use an MD BIO to do the Update calls instead (HMAC)
1980 * Test 9: Use EVP_DigestSign (Implicit fetch digest, RSA, short sig)
1981 * Test 10: Use EVP_DigestSign (Implicit fetch digest, DSA, short sig)
1982 * Test 11: Use EVP_DigestSign (Implicit fetch digest, HMAC, short sig)
1983 * Test 12: Use EVP_DigestSign (Implicit fetch digest, RSA)
1984 * Test 13: Use EVP_DigestSign (Implicit fetch digest, DSA)
1985 * Test 14: Use EVP_DigestSign (Implicit fetch digest, HMAC)
1986 * Test 15-29: Same as above with reinitialization
1987 */
test_EVP_DigestSignInit(int tst)1988 static int test_EVP_DigestSignInit(int tst)
1989 {
1990 int ret = 0;
1991 EVP_PKEY *pkey = NULL;
1992 unsigned char *sig = NULL, *sig2 = NULL;
1993 size_t sig_len = 0, sig2_len = 0, shortsig_len = 1;
1994 EVP_MD_CTX *md_ctx = NULL, *md_ctx_verify = NULL;
1995 EVP_MD_CTX *a_md_ctx = NULL, *a_md_ctx_verify = NULL;
1996 BIO *mdbio = NULL, *membio = NULL;
1997 size_t written;
1998 const EVP_MD *md;
1999 EVP_MD *mdexp = NULL;
2000 int reinit = 0;
2001
2002 if (nullprov != NULL)
2003 return TEST_skip("Test does not support a non-default library context");
2004
2005 if (tst >= 15) {
2006 reinit = 1;
2007 tst -= 15;
2008 }
2009
2010 if (tst >= 6 && tst <= 8) {
2011 membio = BIO_new(BIO_s_mem());
2012 mdbio = BIO_new(BIO_f_md());
2013 if (!TEST_ptr(membio) || !TEST_ptr(mdbio))
2014 goto out;
2015 BIO_push(mdbio, membio);
2016 if (!TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx), 0))
2017 goto out;
2018 } else {
2019 if (!TEST_ptr(a_md_ctx = md_ctx = EVP_MD_CTX_new())
2020 || !TEST_ptr(a_md_ctx_verify = md_ctx_verify = EVP_MD_CTX_new()))
2021 goto out;
2022 }
2023
2024 if (tst % 3 == 0) {
2025 if (!TEST_ptr(pkey = load_example_rsa_key()))
2026 goto out;
2027 } else if (tst % 3 == 1) {
2028 #ifndef OPENSSL_NO_DSA
2029 if (!TEST_ptr(pkey = load_example_dsa_key()))
2030 goto out;
2031 #else
2032 ret = 1;
2033 goto out;
2034 #endif
2035 } else {
2036 if (!TEST_ptr(pkey = load_example_hmac_key()))
2037 goto out;
2038 }
2039
2040 if (tst >= 3 && tst <= 5)
2041 md = mdexp = EVP_MD_fetch(NULL, "SHA256", NULL);
2042 else
2043 md = EVP_sha256();
2044
2045 if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, md, NULL, pkey)))
2046 goto out;
2047
2048 if (reinit && !TEST_true(EVP_DigestSignInit(md_ctx, NULL, NULL, NULL, NULL)))
2049 goto out;
2050
2051 if (tst >= 6 && tst <= 8) {
2052 if (!BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written))
2053 goto out;
2054 } else if (tst < 6) {
2055 if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg))))
2056 goto out;
2057 }
2058
2059 if (tst >= 9) {
2060 /* Determine the size of the signature. */
2061 if (!TEST_true(EVP_DigestSign(md_ctx, NULL, &sig_len, kMsg,
2062 sizeof(kMsg)))
2063 || !TEST_ptr(sig = OPENSSL_malloc(sig_len)))
2064 goto out;
2065 if (tst <= 11) {
2066 /* Test that supply a short sig buffer fails */
2067 if (!TEST_false(EVP_DigestSign(md_ctx, sig, &shortsig_len, kMsg,
2068 sizeof(kMsg))))
2069 goto out;
2070 /*
2071 * We end here because once EVP_DigestSign() has failed you should
2072 * not call it again without re-initing the ctx
2073 */
2074 ret = 1;
2075 goto out;
2076 }
2077 if (!TEST_true(EVP_DigestSign(md_ctx, sig, &sig_len, kMsg,
2078 sizeof(kMsg))))
2079 goto out;
2080 } else {
2081 /* Determine the size of the signature. */
2082 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len))
2083 || !TEST_ptr(sig = OPENSSL_malloc(sig_len))
2084 /*
2085 * Trying to create a signature with a deliberately short
2086 * buffer should fail.
2087 */
2088 || !TEST_false(EVP_DigestSignFinal(md_ctx, sig, &shortsig_len))
2089 || !TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len)))
2090 goto out;
2091 }
2092
2093 /*
2094 * Ensure that the signature round-trips (Verification isn't supported for
2095 * HMAC via EVP_DigestVerify*)
2096 */
2097 if (tst % 3 != 2) {
2098 if (tst >= 6 && tst <= 8) {
2099 if (!TEST_int_gt(BIO_reset(mdbio), 0)
2100 || !TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx_verify), 0))
2101 goto out;
2102 }
2103
2104 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, md,
2105 NULL, pkey)))
2106 goto out;
2107
2108 if (tst >= 6 && tst <= 8) {
2109 if (!TEST_true(BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written)))
2110 goto out;
2111 } else {
2112 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg,
2113 sizeof(kMsg))))
2114 goto out;
2115 }
2116 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
2117 goto out;
2118
2119 /* Multiple calls to EVP_DigestVerifyFinal should work */
2120 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
2121 goto out;
2122 } else {
2123 /*
2124 * For HMAC a doubled call to DigestSignFinal should produce the same
2125 * value as finalization should not happen.
2126 */
2127 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig2_len))
2128 || !TEST_ptr(sig2 = OPENSSL_malloc(sig2_len))
2129 || !TEST_true(EVP_DigestSignFinal(md_ctx, sig2, &sig2_len)))
2130 goto out;
2131
2132 if (!TEST_mem_eq(sig, sig_len, sig2, sig2_len))
2133 goto out;
2134 }
2135
2136 ret = 1;
2137
2138 out:
2139 BIO_free(membio);
2140 BIO_free(mdbio);
2141 EVP_MD_CTX_free(a_md_ctx);
2142 EVP_MD_CTX_free(a_md_ctx_verify);
2143 EVP_PKEY_free(pkey);
2144 OPENSSL_free(sig);
2145 OPENSSL_free(sig2);
2146 EVP_MD_free(mdexp);
2147
2148 return ret;
2149 }
2150
test_EVP_DigestVerifyInit(void)2151 static int test_EVP_DigestVerifyInit(void)
2152 {
2153 int ret = 0;
2154 EVP_PKEY *pkey = NULL;
2155 EVP_MD_CTX *md_ctx = NULL;
2156
2157 if (nullprov != NULL)
2158 return TEST_skip("Test does not support a non-default library context");
2159
2160 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new())
2161 || !TEST_ptr(pkey = load_example_rsa_key()))
2162 goto out;
2163
2164 if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, EVP_sha256(), NULL, pkey))
2165 || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg)))
2166 || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature,
2167 sizeof(kSignature)),
2168 0))
2169 goto out;
2170
2171 /* test with reinitialization */
2172 if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, NULL, NULL, NULL))
2173 || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg)))
2174 || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature,
2175 sizeof(kSignature)),
2176 0))
2177 goto out;
2178 ret = 1;
2179
2180 out:
2181 EVP_MD_CTX_free(md_ctx);
2182 EVP_PKEY_free(pkey);
2183 return ret;
2184 }
2185
2186 #ifndef OPENSSL_NO_EC
test_ecdsa_digestsign_keccak(void)2187 static int test_ecdsa_digestsign_keccak(void)
2188 {
2189 int ret = 0;
2190 EVP_PKEY *pkey = NULL;
2191 EVP_MD_CTX *ctx = NULL;
2192 EVP_MD *md = NULL;
2193
2194 if (nullprov != NULL)
2195 return TEST_skip("Test does not support a non-default library context");
2196
2197 pkey = load_example_ec_key();
2198 if (!TEST_ptr(pkey))
2199 goto err;
2200
2201 /* This would not work with FIPS provider so just use NULL libctx */
2202 md = EVP_MD_fetch(NULL, "KECCAK-256", NULL);
2203 if (!TEST_ptr(md))
2204 goto err;
2205
2206 ctx = EVP_MD_CTX_new();
2207 if (!TEST_ptr(ctx))
2208 goto err;
2209
2210 /*
2211 * Just check EVP_DigestSignInit_ex() works.
2212 */
2213 if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey)))
2214 goto err;
2215
2216 ret = 1;
2217 err:
2218 EVP_MD_CTX_free(ctx);
2219 EVP_PKEY_free(pkey);
2220 EVP_MD_free(md);
2221
2222 return ret;
2223 }
2224 #endif
2225
2226 #ifndef OPENSSL_NO_SIPHASH
2227 /* test SIPHASH MAC via EVP_PKEY with non-default parameters and reinit */
test_siphash_digestsign(void)2228 static int test_siphash_digestsign(void)
2229 {
2230 unsigned char key[16];
2231 unsigned char buf[8], digest[8];
2232 unsigned char expected[8] = {
2233 0x6d, 0x3e, 0x54, 0xc2, 0x2f, 0xf1, 0xfe, 0xe2
2234 };
2235 EVP_PKEY *pkey = NULL;
2236 EVP_MD_CTX *mdctx = NULL;
2237 EVP_PKEY_CTX *ctx = NULL;
2238 int ret = 0;
2239 size_t len = 8;
2240
2241 if (nullprov != NULL)
2242 return TEST_skip("Test does not support a non-default library context");
2243
2244 memset(buf, 0, 8);
2245 memset(key, 1, 16);
2246 if (!TEST_ptr(pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_SIPHASH, NULL,
2247 key, 16)))
2248 goto out;
2249
2250 if (!TEST_ptr(mdctx = EVP_MD_CTX_create()))
2251 goto out;
2252
2253 if (!TEST_true(EVP_DigestSignInit(mdctx, &ctx, NULL, NULL, pkey)))
2254 goto out;
2255 if (!TEST_int_eq(EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_SIGNCTX,
2256 EVP_PKEY_CTRL_SET_DIGEST_SIZE,
2257 8, NULL),
2258 1))
2259 goto out;
2260 /* reinitialize */
2261 if (!TEST_true(EVP_DigestSignInit(mdctx, NULL, NULL, NULL, NULL)))
2262 goto out;
2263 if (!TEST_true(EVP_DigestSignUpdate(mdctx, buf, 8)))
2264 goto out;
2265 if (!TEST_true(EVP_DigestSignFinal(mdctx, digest, &len)))
2266 goto out;
2267 if (!TEST_mem_eq(digest, len, expected, sizeof(expected)))
2268 goto out;
2269
2270 ret = 1;
2271 out:
2272 EVP_PKEY_free(pkey);
2273 EVP_MD_CTX_free(mdctx);
2274 return ret;
2275 }
2276 #endif
2277
2278 /*
2279 * Test corner cases of EVP_DigestInit/Update/Final API call behavior.
2280 */
test_EVP_Digest(void)2281 static int test_EVP_Digest(void)
2282 {
2283 int ret = 0;
2284 EVP_MD_CTX *md_ctx = NULL;
2285 unsigned char md[EVP_MAX_MD_SIZE];
2286 EVP_MD *sha256 = NULL;
2287 EVP_MD *shake256 = NULL;
2288
2289 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new()))
2290 goto out;
2291
2292 if (!TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", testpropq))
2293 || !TEST_ptr(shake256 = EVP_MD_fetch(testctx, "shake256", testpropq)))
2294 goto out;
2295
2296 if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL))
2297 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg)))
2298 || !TEST_true(EVP_DigestFinal(md_ctx, md, NULL))
2299 /* EVP_DigestFinal resets the EVP_MD_CTX. */
2300 || !TEST_ptr_eq(EVP_MD_CTX_get0_md(md_ctx), NULL))
2301 goto out;
2302
2303 if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL))
2304 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg)))
2305 || !TEST_true(EVP_DigestFinal_ex(md_ctx, md, NULL))
2306 /* EVP_DigestFinal_ex does not reset the EVP_MD_CTX. */
2307 || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx))
2308 /*
2309 * EVP_DigestInit_ex with NULL type should work on
2310 * pre-initialized context.
2311 */
2312 || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL)))
2313 goto out;
2314
2315 if (!TEST_true(EVP_DigestInit_ex(md_ctx, shake256, NULL))
2316 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg)))
2317 || !TEST_true(EVP_DigestFinalXOF(md_ctx, md, sizeof(md)))
2318 /* EVP_DigestFinalXOF does not reset the EVP_MD_CTX. */
2319 || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx))
2320 || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL)))
2321 goto out;
2322 ret = 1;
2323
2324 out:
2325 EVP_MD_CTX_free(md_ctx);
2326 EVP_MD_free(sha256);
2327 EVP_MD_free(shake256);
2328 return ret;
2329 }
2330
test_EVP_md_null(void)2331 static int test_EVP_md_null(void)
2332 {
2333 int ret = 0;
2334 EVP_MD_CTX *md_ctx = NULL;
2335 const EVP_MD *md_null = EVP_md_null();
2336 unsigned char md_value[EVP_MAX_MD_SIZE];
2337 unsigned int md_len = sizeof(md_value);
2338
2339 if (nullprov != NULL)
2340 return TEST_skip("Test does not support a non-default library context");
2341
2342 if (!TEST_ptr(md_null)
2343 || !TEST_ptr(md_ctx = EVP_MD_CTX_new()))
2344 goto out;
2345
2346 if (!TEST_true(EVP_DigestInit_ex(md_ctx, md_null, NULL))
2347 || !TEST_true(EVP_DigestUpdate(md_ctx, "test", 4))
2348 || !TEST_true(EVP_DigestFinal_ex(md_ctx, md_value, &md_len)))
2349 goto out;
2350
2351 if (!TEST_uint_eq(md_len, 0))
2352 goto out;
2353
2354 ret = 1;
2355 out:
2356 EVP_MD_CTX_free(md_ctx);
2357 return ret;
2358 }
2359
2360 #ifndef OPENSSL_NO_POLY1305
2361 /* Test Poly1305 no-key failures and staged key initialization */
test_evp_mac_poly1305_no_key(void)2362 static int test_evp_mac_poly1305_no_key(void)
2363 {
2364 int ret = 0;
2365 EVP_MAC *mac = NULL;
2366 EVP_MAC_CTX *ctx = NULL;
2367 /* RFC 7539 Poly1305 test vector. */
2368 static const unsigned char staged_data[] = "Cryptographic Forum Research Group";
2369 static const unsigned char expected[16] = {
2370 0xa8, 0x06, 0x1d, 0xc1, 0x30, 0x51, 0x36, 0xc6,
2371 0xc2, 0x2b, 0x8b, 0xaf, 0x0c, 0x01, 0x27, 0xa9
2372 };
2373 unsigned char no_key_data[16] = { 0 };
2374 unsigned char key[32] = {
2375 0x85, 0xd6, 0xbe, 0x78, 0x57, 0x55, 0x6d, 0x33,
2376 0x7f, 0x44, 0x52, 0xfe, 0x42, 0xd5, 0x06, 0xa8,
2377 0x01, 0x03, 0x80, 0x8a, 0xfb, 0x0d, 0xb2, 0xfd,
2378 0x4a, 0xbf, 0xf6, 0xaf, 0x41, 0x49, 0xf5, 0x1b
2379 };
2380 unsigned char out[16];
2381 OSSL_PARAM key_params[2];
2382 OSSL_PARAM null_key_params[2];
2383 size_t outl = 0;
2384
2385 key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
2386 key, sizeof(key));
2387 key_params[1] = OSSL_PARAM_construct_end();
2388 null_key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
2389 NULL, sizeof(key));
2390 null_key_params[1] = OSSL_PARAM_construct_end();
2391
2392 if (!TEST_ptr(mac = EVP_MAC_fetch(testctx, "Poly1305", testpropq))
2393 || !TEST_ptr(ctx = EVP_MAC_CTX_new(mac))
2394 || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1))
2395 goto err;
2396
2397 ERR_clear_error();
2398 if (!TEST_int_eq(EVP_MAC_update(ctx, no_key_data, sizeof(no_key_data)), 0)
2399 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET))
2400 goto err;
2401
2402 /* The failed update must not block staged key initialization. */
2403 if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, key_params), 1)
2404 || !TEST_int_eq(EVP_MAC_update(ctx, staged_data,
2405 sizeof(staged_data) - 1),
2406 1)
2407 || !TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 1)
2408 || !TEST_size_t_eq(outl, sizeof(expected))
2409 || !TEST_mem_eq(out, outl, expected, sizeof(expected)))
2410 goto err;
2411
2412 EVP_MAC_CTX_free(ctx);
2413 ctx = NULL;
2414
2415 if (!TEST_ptr(ctx = EVP_MAC_CTX_new(mac))
2416 || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1))
2417 goto err;
2418
2419 ERR_clear_error();
2420 if (!TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 0)
2421 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET))
2422 goto err;
2423
2424 ERR_clear_error();
2425 if (!TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, null_key_params), 0)
2426 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
2427 PROV_R_INVALID_KEY_LENGTH))
2428 goto err;
2429
2430 ERR_clear_error();
2431 if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, null_key_params), 0)
2432 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
2433 PROV_R_INVALID_KEY_LENGTH))
2434 goto err;
2435
2436 EVP_MAC_CTX_free(ctx);
2437 ctx = NULL;
2438 ret = 1;
2439 err:
2440 EVP_MAC_CTX_free(ctx);
2441 EVP_MAC_free(mac);
2442 return ret;
2443 }
2444 #endif
2445
test_d2i_AutoPrivateKey(int i)2446 static int test_d2i_AutoPrivateKey(int i)
2447 {
2448 int ret = 0;
2449 const unsigned char *p;
2450 EVP_PKEY *pkey = NULL;
2451 const APK_DATA *ak = &keydata[i];
2452 const unsigned char *input = ak->kder;
2453 size_t input_len = ak->size;
2454 int expected_id = ak->evptype;
2455
2456 p = input;
2457 if (!TEST_ptr(pkey = d2i_AutoPrivateKey(NULL, &p, input_len))
2458 || !TEST_ptr_eq(p, input + input_len)
2459 || !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id))
2460 goto done;
2461
2462 ret = 1;
2463
2464 done:
2465 EVP_PKEY_free(pkey);
2466 return ret;
2467 }
2468
2469 #ifndef OPENSSL_NO_EC
2470
2471 static const unsigned char ec_public_sect163k1_validxy[] = {
2472 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
2473 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04,
2474 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69,
2475 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x02, 0xd1, 0x7b,
2476 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3,
2477 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f
2478 };
2479
2480 static const unsigned char ec_public_sect163k1_badx[] = {
2481 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
2482 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04,
2483 0x0a, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69,
2484 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0xb0, 0x02, 0xd1, 0x7b,
2485 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3,
2486 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f
2487 };
2488
2489 static const unsigned char ec_public_sect163k1_bady[] = {
2490 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
2491 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04,
2492 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69,
2493 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x0a, 0xd1, 0x7b,
2494 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3,
2495 0x6a, 0xd8, 0x17, 0x65, 0x41, 0xe6
2496 };
2497
2498 static struct ec_der_pub_keys_st {
2499 const unsigned char *der;
2500 size_t len;
2501 int valid;
2502 } ec_der_pub_keys[] = {
2503 { ec_public_sect163k1_validxy, sizeof(ec_public_sect163k1_validxy), 1 },
2504 { ec_public_sect163k1_badx, sizeof(ec_public_sect163k1_badx), 0 },
2505 { ec_public_sect163k1_bady, sizeof(ec_public_sect163k1_bady), 0 },
2506 };
2507
2508 /*
2509 * Tests the range of the decoded EC char2 public point.
2510 * See ec_GF2m_simple_oct2point().
2511 */
test_invalide_ec_char2_pub_range_decode(int id)2512 static int test_invalide_ec_char2_pub_range_decode(int id)
2513 {
2514 int ret = 0;
2515 EVP_PKEY *pkey;
2516
2517 pkey = load_example_key("EC", ec_der_pub_keys[id].der,
2518 ec_der_pub_keys[id].len);
2519
2520 ret = (ec_der_pub_keys[id].valid && TEST_ptr(pkey))
2521 || TEST_ptr_null(pkey);
2522 EVP_PKEY_free(pkey);
2523 return ret;
2524 }
2525
test_EVP_PKCS82PKEY(void)2526 static int test_EVP_PKCS82PKEY(void)
2527 {
2528 int ret = 0;
2529 const unsigned char *derp = kExampleBadECKeyDER;
2530 PKCS8_PRIV_KEY_INFO *p8inf = NULL;
2531 EVP_PKEY *pkey = NULL;
2532
2533 if (!TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &derp,
2534 sizeof(kExampleBadECKeyDER))))
2535 goto done;
2536
2537 if (!TEST_ptr_eq(derp,
2538 kExampleBadECKeyDER + sizeof(kExampleBadECKeyDER)))
2539 goto done;
2540
2541 if (!TEST_ptr_null(pkey = EVP_PKCS82PKEY(p8inf)))
2542 goto done;
2543
2544 ret = 1;
2545
2546 done:
2547 PKCS8_PRIV_KEY_INFO_free(p8inf);
2548 EVP_PKEY_free(pkey);
2549
2550 return ret;
2551 }
2552
2553 #endif
2554
test_EVP_PKCS82PKEY_v2(int i)2555 static int test_EVP_PKCS82PKEY_v2(int i)
2556 {
2557 int ret = 0;
2558 const unsigned char *p;
2559 const APK_DATA *ak = &keydata_v2[i];
2560 const unsigned char *input = ak->kder;
2561 size_t input_len = ak->size;
2562 PKCS8_PRIV_KEY_INFO *p8inf = NULL;
2563
2564 /* Can we parse PKCS#8 v2, ignoring the public key for now? */
2565 p = input;
2566 p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, input_len);
2567 if (!TEST_ptr(p8inf)
2568 || !TEST_true(p == input + input_len))
2569 goto done;
2570
2571 ret = 1;
2572 done:
2573 PKCS8_PRIV_KEY_INFO_free(p8inf);
2574 return ret;
2575 }
2576
2577 /* Tests loading a bad key in PKCS8 format */
test_EVP_PKCS82PKEY_wrong_tag(void)2578 static int test_EVP_PKCS82PKEY_wrong_tag(void)
2579 {
2580 EVP_PKEY *pkey = NULL;
2581 EVP_PKEY *pkey2 = NULL;
2582 BIO *membio = NULL;
2583 char *membuf = NULL;
2584 PKCS8_PRIV_KEY_INFO *p8inf = NULL;
2585 int ok = 0;
2586
2587 if (testctx != NULL)
2588 /* test not supported with non-default context */
2589 return 1;
2590
2591 if (!TEST_ptr(membio = BIO_new(BIO_s_mem()))
2592 || !TEST_ptr(pkey = load_example_rsa_key())
2593 || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL,
2594 NULL, 0, NULL, NULL),
2595 0)
2596 || !TEST_int_gt(BIO_get_mem_data(membio, &membuf), 0)
2597 || !TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(membio, NULL))
2598 || !TEST_ptr(pkey2 = EVP_PKCS82PKEY(p8inf))
2599 || !TEST_int_eq(ERR_peek_last_error(), 0)) {
2600 goto done;
2601 }
2602
2603 ok = 1;
2604 done:
2605 EVP_PKEY_free(pkey);
2606 EVP_PKEY_free(pkey2);
2607 PKCS8_PRIV_KEY_INFO_free(p8inf);
2608 BIO_free_all(membio);
2609 return ok;
2610 }
2611
2612 /* This uses kExampleRSAKeyDER and kExampleRSAKeyPKCS8 to verify encoding */
test_privatekey_to_pkcs8(void)2613 static int test_privatekey_to_pkcs8(void)
2614 {
2615 EVP_PKEY *pkey = NULL;
2616 BIO *membio = NULL;
2617 char *membuf = NULL;
2618 long membuf_len = 0;
2619 int ok = 0;
2620
2621 if (!TEST_ptr(membio = BIO_new(BIO_s_mem()))
2622 || !TEST_ptr(pkey = load_example_rsa_key())
2623 || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL,
2624 NULL, 0, NULL, NULL),
2625 0)
2626 || !TEST_int_gt(membuf_len = BIO_get_mem_data(membio, &membuf), 0)
2627 || !TEST_ptr(membuf)
2628 || !TEST_mem_eq(membuf, (size_t)membuf_len,
2629 kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8))
2630 /*
2631 * We try to write PEM as well, just to see that it doesn't err, but
2632 * assume that the result is correct.
2633 */
2634 || !TEST_int_gt(PEM_write_bio_PKCS8PrivateKey(membio, pkey, NULL,
2635 NULL, 0, NULL, NULL),
2636 0))
2637 goto done;
2638
2639 ok = 1;
2640 done:
2641 EVP_PKEY_free(pkey);
2642 BIO_free_all(membio);
2643 return ok;
2644 }
2645
2646 #ifndef OPENSSL_NO_EC
2647 static const struct {
2648 int encoding;
2649 const char *encoding_name;
2650 } ec_encodings[] = {
2651 { OPENSSL_EC_EXPLICIT_CURVE, OSSL_PKEY_EC_ENCODING_EXPLICIT },
2652 { OPENSSL_EC_NAMED_CURVE, OSSL_PKEY_EC_ENCODING_GROUP }
2653 };
2654
ec_export_get_encoding_cb(const OSSL_PARAM params[],void * arg)2655 static int ec_export_get_encoding_cb(const OSSL_PARAM params[], void *arg)
2656 {
2657 const OSSL_PARAM *p;
2658 const char *enc_name = NULL;
2659 int *enc = arg;
2660 size_t i;
2661
2662 *enc = -1;
2663
2664 if (!TEST_ptr(p = OSSL_PARAM_locate_const(params,
2665 OSSL_PKEY_PARAM_EC_ENCODING))
2666 || !TEST_true(OSSL_PARAM_get_utf8_string_ptr(p, &enc_name)))
2667 return 0;
2668
2669 for (i = 0; i < OSSL_NELEM(ec_encodings); i++) {
2670 if (OPENSSL_strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) {
2671 *enc = ec_encodings[i].encoding;
2672 break;
2673 }
2674 }
2675
2676 return (*enc != -1);
2677 }
2678
test_EC_keygen_with_enc(int idx)2679 static int test_EC_keygen_with_enc(int idx)
2680 {
2681 EVP_PKEY *params = NULL, *key = NULL;
2682 EVP_PKEY_CTX *pctx = NULL, *kctx = NULL;
2683 int enc;
2684 int ret = 0;
2685
2686 enc = ec_encodings[idx].encoding;
2687
2688 /* Create key parameters */
2689 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "EC", NULL))
2690 || !TEST_int_gt(EVP_PKEY_paramgen_init(pctx), 0)
2691 || !TEST_int_gt(EVP_PKEY_CTX_set_group_name(pctx, "P-256"), 0)
2692 || !TEST_int_gt(EVP_PKEY_CTX_set_ec_param_enc(pctx, enc), 0)
2693 || !TEST_true(EVP_PKEY_paramgen(pctx, ¶ms))
2694 || !TEST_ptr(params))
2695 goto done;
2696
2697 /* Create key */
2698 if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx, params, NULL))
2699 || !TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0)
2700 || !TEST_true(EVP_PKEY_keygen(kctx, &key))
2701 || !TEST_ptr(key))
2702 goto done;
2703
2704 /* Check that the encoding got all the way into the key */
2705 if (!TEST_true(evp_keymgmt_util_export(key, OSSL_KEYMGMT_SELECT_ALL,
2706 ec_export_get_encoding_cb, &enc))
2707 || !TEST_int_eq(enc, ec_encodings[idx].encoding))
2708 goto done;
2709
2710 ret = 1;
2711 done:
2712 EVP_PKEY_free(key);
2713 EVP_PKEY_free(params);
2714 EVP_PKEY_CTX_free(kctx);
2715 EVP_PKEY_CTX_free(pctx);
2716 return ret;
2717 }
2718 #endif
2719
2720 #if !defined(OPENSSL_NO_SM2)
2721
test_EVP_SM2_verify(void)2722 static int test_EVP_SM2_verify(void)
2723 {
2724 const char *pubkey = "-----BEGIN PUBLIC KEY-----\n"
2725 "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEp1KLWq1ZE2jmoAnnBJE1LBGxVr18\n"
2726 "YvvqECWCpXfAQ9qUJ+UmthnUPf0iM3SaXKHe6PlLIDyNlWMWb9RUh/yU3g==\n"
2727 "-----END PUBLIC KEY-----\n";
2728
2729 const char *msg = "message digest";
2730 const char *id = "ALICE123@YAHOO.COM";
2731
2732 const uint8_t signature[] = {
2733 0x30, 0x44, 0x02, 0x20, 0x5b, 0xdb, 0xab, 0x81, 0x4f, 0xbb,
2734 0x8b, 0x69, 0xb1, 0x05, 0x9c, 0x99, 0x3b, 0xb2, 0x45, 0x06,
2735 0x4a, 0x30, 0x15, 0x59, 0x84, 0xcd, 0xee, 0x30, 0x60, 0x36,
2736 0x57, 0x87, 0xef, 0x5c, 0xd0, 0xbe, 0x02, 0x20, 0x43, 0x8d,
2737 0x1f, 0xc7, 0x77, 0x72, 0x39, 0xbb, 0x72, 0xe1, 0xfd, 0x07,
2738 0x58, 0xd5, 0x82, 0xc8, 0x2d, 0xba, 0x3b, 0x2c, 0x46, 0x24,
2739 0xe3, 0x50, 0xff, 0x04, 0xc7, 0xa0, 0x71, 0x9f, 0xa4, 0x70
2740 };
2741
2742 int rc = 0;
2743 BIO *bio = NULL;
2744 EVP_PKEY *pkey = NULL;
2745 EVP_MD_CTX *mctx = NULL;
2746 EVP_PKEY_CTX *pctx = NULL;
2747 EVP_MD *sm3 = NULL;
2748
2749 bio = BIO_new_mem_buf(pubkey, strlen(pubkey));
2750 if (!TEST_true(bio != NULL))
2751 goto done;
2752
2753 pkey = PEM_read_bio_PUBKEY_ex(bio, NULL, NULL, NULL, testctx, testpropq);
2754 if (!TEST_true(pkey != NULL))
2755 goto done;
2756
2757 if (!TEST_true(EVP_PKEY_is_a(pkey, "SM2")))
2758 goto done;
2759
2760 if (!TEST_ptr(mctx = EVP_MD_CTX_new()))
2761 goto done;
2762
2763 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq)))
2764 goto done;
2765
2766 EVP_MD_CTX_set_pkey_ctx(mctx, pctx);
2767
2768 if (!TEST_ptr(sm3 = EVP_MD_fetch(testctx, "sm3", testpropq)))
2769 goto done;
2770
2771 if (!TEST_true(EVP_DigestVerifyInit(mctx, NULL, sm3, NULL, pkey)))
2772 goto done;
2773
2774 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(pctx, id, strlen(id)), 0))
2775 goto done;
2776
2777 if (!TEST_true(EVP_DigestVerifyUpdate(mctx, msg, strlen(msg))))
2778 goto done;
2779
2780 if (!TEST_int_gt(EVP_DigestVerifyFinal(mctx, signature, sizeof(signature)), 0))
2781 goto done;
2782 rc = 1;
2783
2784 done:
2785 BIO_free(bio);
2786 EVP_PKEY_free(pkey);
2787 EVP_PKEY_CTX_free(pctx);
2788 EVP_MD_CTX_free(mctx);
2789 EVP_MD_free(sm3);
2790 return rc;
2791 }
2792
test_EVP_SM2(void)2793 static int test_EVP_SM2(void)
2794 {
2795 int ret = 0;
2796 EVP_PKEY *pkey = NULL;
2797 EVP_PKEY *pkeyparams = NULL;
2798 EVP_PKEY_CTX *pctx = NULL;
2799 EVP_PKEY_CTX *kctx = NULL;
2800 EVP_PKEY_CTX *sctx = NULL;
2801 size_t sig_len = 0;
2802 unsigned char *sig = NULL;
2803 EVP_MD_CTX *md_ctx = NULL;
2804 EVP_MD_CTX *md_ctx_verify = NULL;
2805 EVP_PKEY_CTX *cctx = NULL;
2806 EVP_MD *check_md = NULL;
2807
2808 uint8_t ciphertext[128];
2809 size_t ctext_len = sizeof(ciphertext);
2810 size_t ctext_len_param = 0;
2811 uint8_t plaintext[8];
2812 size_t ptext_len = sizeof(plaintext);
2813 size_t ptext_len_param = 0;
2814
2815 uint8_t sm2_id[] = { 1, 2, 3, 4, 'l', 'e', 't', 't', 'e', 'r' };
2816
2817 OSSL_PARAM sparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
2818 OSSL_PARAM gparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
2819 int i;
2820 char mdname[OSSL_MAX_NAME_SIZE];
2821
2822 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx,
2823 "SM2", testpropq)))
2824 goto done;
2825
2826 if (!TEST_true(EVP_PKEY_paramgen_init(pctx) == 1))
2827 goto done;
2828
2829 if (!TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_sm2), 0))
2830 goto done;
2831
2832 if (!TEST_true(EVP_PKEY_paramgen(pctx, &pkeyparams)))
2833 goto done;
2834
2835 if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx,
2836 pkeyparams, testpropq)))
2837 goto done;
2838
2839 if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0))
2840 goto done;
2841
2842 if (!TEST_true(EVP_PKEY_keygen(kctx, &pkey)))
2843 goto done;
2844
2845 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new()))
2846 goto done;
2847
2848 if (!TEST_ptr(md_ctx_verify = EVP_MD_CTX_new()))
2849 goto done;
2850
2851 if (!TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq)))
2852 goto done;
2853
2854 EVP_MD_CTX_set_pkey_ctx(md_ctx, sctx);
2855 EVP_MD_CTX_set_pkey_ctx(md_ctx_verify, sctx);
2856
2857 if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, "sm3", testpropq)))
2858 goto done;
2859
2860 if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, check_md, NULL, pkey)))
2861 goto done;
2862
2863 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0))
2864 goto done;
2865
2866 if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg))))
2867 goto done;
2868
2869 /* Determine the size of the signature. */
2870 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len)))
2871 goto done;
2872
2873 if (!TEST_ptr(sig = OPENSSL_malloc(sig_len)))
2874 goto done;
2875
2876 if (!TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len)))
2877 goto done;
2878
2879 /* Ensure that the signature round-trips. */
2880
2881 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL,
2882 pkey)))
2883 goto done;
2884
2885 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0))
2886 goto done;
2887
2888 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg))))
2889 goto done;
2890
2891 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
2892 goto done;
2893
2894 /*
2895 * Try verify again with non-matching 0 length id but ensure that it can
2896 * be set on the context and overrides the previous value.
2897 */
2898
2899 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL,
2900 pkey)))
2901 goto done;
2902
2903 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, NULL, 0), 0))
2904 goto done;
2905
2906 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg))))
2907 goto done;
2908
2909 if (!TEST_int_eq(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0))
2910 goto done;
2911
2912 /* now check encryption/decryption */
2913
2914 gparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST,
2915 mdname, sizeof(mdname));
2916 for (i = 0; i < 2; i++) {
2917 const char *mdnames[] = {
2918 #ifndef OPENSSL_NO_SM3
2919 "SM3",
2920 #else
2921 NULL,
2922 #endif
2923 "SHA2-256"
2924 };
2925 EVP_PKEY_CTX_free(cctx);
2926
2927 if (mdnames[i] == NULL)
2928 continue;
2929
2930 sparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST,
2931 (char *)mdnames[i], 0);
2932
2933 if (!TEST_ptr(cctx = EVP_PKEY_CTX_new_from_pkey(testctx,
2934 pkey, testpropq)))
2935 goto done;
2936
2937 if (!TEST_true(EVP_PKEY_encrypt_init(cctx)))
2938 goto done;
2939
2940 if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams)))
2941 goto done;
2942
2943 ctext_len_param = ctext_len;
2944 if (!TEST_true(EVP_PKEY_encrypt(cctx, ciphertext, &ctext_len_param, kMsg,
2945 sizeof(kMsg))))
2946 goto done;
2947
2948 if (!TEST_int_gt(EVP_PKEY_decrypt_init(cctx), 0))
2949 goto done;
2950
2951 if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams)))
2952 goto done;
2953
2954 ptext_len_param = ptext_len;
2955 if (!TEST_int_gt(EVP_PKEY_decrypt(cctx, plaintext, &ptext_len_param, ciphertext,
2956 ctext_len_param),
2957 0))
2958 goto done;
2959
2960 if (!TEST_true(EVP_PKEY_CTX_get_params(cctx, gparams)))
2961 goto done;
2962
2963 /*
2964 * Test we're still using the digest we think we are.
2965 * Because of aliases, the easiest is to fetch the digest and
2966 * check the name with EVP_MD_is_a().
2967 */
2968 EVP_MD_free(check_md);
2969 if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, mdname, testpropq)))
2970 goto done;
2971 if (!TEST_true(EVP_MD_is_a(check_md, mdnames[i]))) {
2972 TEST_info("Fetched md %s isn't %s", mdname, mdnames[i]);
2973 goto done;
2974 }
2975
2976 if (!TEST_true(ptext_len_param == sizeof(kMsg)))
2977 goto done;
2978
2979 if (!TEST_true(memcmp(plaintext, kMsg, sizeof(kMsg)) == 0))
2980 goto done;
2981 }
2982
2983 ret = 1;
2984 done:
2985 EVP_PKEY_CTX_free(pctx);
2986 EVP_PKEY_CTX_free(kctx);
2987 EVP_PKEY_CTX_free(sctx);
2988 EVP_PKEY_CTX_free(cctx);
2989 EVP_PKEY_free(pkey);
2990 EVP_PKEY_free(pkeyparams);
2991 EVP_MD_CTX_free(md_ctx);
2992 EVP_MD_CTX_free(md_ctx_verify);
2993 EVP_MD_free(check_md);
2994 OPENSSL_free(sig);
2995 return ret;
2996 }
2997
2998 #endif
2999
3000 #ifndef OPENSSL_NO_ML_KEM
3001 static const uint8_t ml_kem_seed[] = {
3002 0x7c, 0x99, 0x35, 0xa0, 0xb0, 0x76, 0x94, 0xaa, 0x0c, 0x6d, 0x10, 0xe4,
3003 0xdb, 0x6b, 0x1a, 0xdd, 0x2f, 0xd8, 0x1a, 0x25, 0xcc, 0xb1, 0x48, 0x03,
3004 0x2d, 0xcd, 0x73, 0x99, 0x36, 0x73, 0x7f, 0x2d, 0x86, 0x26, 0xed, 0x79,
3005 0xd4, 0x51, 0x14, 0x08, 0x00, 0xe0, 0x3b, 0x59, 0xb9, 0x56, 0xf8, 0x21,
3006 0x0e, 0x55, 0x60, 0x67, 0x40, 0x7d, 0x13, 0xdc, 0x90, 0xfa, 0x9e, 0x8b,
3007 0x87, 0x2b, 0xfb, 0x8f
3008 };
3009 static const uint8_t ml_kem_512_pubkey[] = {
3010 0x40, 0x08, 0x65, 0xed, 0x10, 0xb6, 0x19, 0xaa, 0x58, 0x11, 0x13, 0x9b,
3011 0xc0, 0x86, 0x82, 0x57, 0x82, 0xb2, 0xb7, 0x12, 0x4f, 0x75, 0x7c, 0x83,
3012 0xae, 0x79, 0x44, 0x44, 0xbc, 0x78, 0xa4, 0x78, 0x96, 0xac, 0xf1, 0x26,
3013 0x2c, 0x81, 0x35, 0x10, 0x77, 0x89, 0x3b, 0xfc, 0x56, 0xf9, 0x04, 0x49,
3014 0xc2, 0xfa, 0x5f, 0x6e, 0x58, 0x6d, 0xd3, 0x7c, 0x0b, 0x9b, 0x58, 0x19,
3015 0x92, 0x63, 0x8c, 0xb7, 0xe7, 0xbc, 0xbb, 0xb9, 0x9a, 0xfe, 0x47, 0x81,
3016 0xd8, 0x0a, 0x50, 0xe6, 0x94, 0x63, 0xfb, 0xd9, 0x88, 0x72, 0x2c, 0x36,
3017 0x35, 0x42, 0x3e, 0x27, 0x46, 0x6c, 0x71, 0xdc, 0xc6, 0x74, 0x52, 0x7c,
3018 0xcd, 0x72, 0x89, 0x68, 0xcb, 0xcd, 0xc0, 0x0c, 0x5c, 0x90, 0x35, 0xbb,
3019 0x0a, 0xf2, 0xc9, 0x92, 0x2c, 0x78, 0x81, 0xa4, 0x1d, 0xd2, 0x87, 0x52,
3020 0x73, 0x92, 0x51, 0x31, 0x23, 0x0f, 0x6c, 0xa5, 0x9e, 0x91, 0x36, 0xb3,
3021 0x9f, 0x95, 0x6c, 0x93, 0xb3, 0xb2, 0xd1, 0x4c, 0x64, 0x1b, 0x08, 0x9e,
3022 0x07, 0xd0, 0xa8, 0x40, 0xc8, 0x93, 0xec, 0xd7, 0x6b, 0xbf, 0x92, 0xc8,
3023 0x05, 0x45, 0x66, 0x68, 0xd0, 0x7c, 0x62, 0x14, 0x91, 0xc5, 0xc0, 0x54,
3024 0x99, 0x1a, 0x65, 0x6f, 0x51, 0x16, 0x19, 0x55, 0x6e, 0xb9, 0x77, 0x82,
3025 0xe2, 0x7a, 0x3c, 0x78, 0x51, 0x24, 0xc7, 0x0b, 0x0d, 0xab, 0xa6, 0xc6,
3026 0x24, 0xd1, 0x8e, 0x0f, 0x97, 0x93, 0xf9, 0x6b, 0xa9, 0xe1, 0x59, 0x9b,
3027 0x17, 0xb3, 0x0d, 0xcc, 0xc0, 0xb4, 0xf3, 0x76, 0x6a, 0x07, 0xb2, 0x3b,
3028 0x25, 0x73, 0x09, 0xcd, 0x76, 0xab, 0xa0, 0x72, 0xc2, 0xb9, 0xc9, 0x74,
3029 0x43, 0x94, 0xc6, 0xab, 0x9c, 0xb6, 0xc5, 0x4a, 0x97, 0xb5, 0xc5, 0x78,
3030 0x61, 0xa5, 0x8d, 0xc0, 0xa0, 0x35, 0x19, 0x83, 0x2e, 0xe3, 0x2a, 0x07,
3031 0x65, 0x4a, 0x07, 0x0c, 0x0c, 0x8c, 0x4e, 0x86, 0x48, 0xad, 0xdc, 0x35,
3032 0x5f, 0x27, 0x4f, 0xc6, 0xb9, 0x2a, 0x08, 0x7b, 0x3f, 0x97, 0x51, 0x92,
3033 0x3e, 0x44, 0x27, 0x4f, 0x85, 0x8c, 0x49, 0xca, 0xba, 0x72, 0xb6, 0x58,
3034 0x51, 0xb3, 0xad, 0xc4, 0x89, 0x36, 0x95, 0x50, 0x97, 0xca, 0xd9, 0x55,
3035 0x3f, 0x5a, 0x26, 0x3f, 0x18, 0x44, 0xb5, 0x2a, 0x02, 0x0f, 0xf7, 0xca,
3036 0x89, 0xe8, 0x81, 0xa0, 0x1b, 0x95, 0xd9, 0x57, 0xa3, 0x15, 0x3c, 0x0a,
3037 0x5e, 0x0a, 0x1c, 0xcd, 0x66, 0xb1, 0x82, 0x1a, 0x2b, 0x86, 0x32, 0x54,
3038 0x6e, 0x24, 0xc7, 0xcb, 0xbc, 0x4c, 0xb0, 0x88, 0x08, 0xca, 0xc3, 0x7f,
3039 0x7d, 0xa6, 0xb1, 0x6f, 0x8a, 0xce, 0xd0, 0x52, 0xcd, 0xb2, 0x56, 0x49,
3040 0x48, 0xf1, 0xab, 0x0f, 0x76, 0x8a, 0x0d, 0x32, 0x86, 0xcc, 0xc7, 0xc3,
3041 0x74, 0x9c, 0x63, 0xc7, 0x81, 0x53, 0x0f, 0xa1, 0xae, 0x67, 0x05, 0x42,
3042 0x85, 0x50, 0x04, 0xa6, 0x45, 0xb5, 0x22, 0x88, 0x1e, 0xc1, 0x41, 0x2b,
3043 0xda, 0xe3, 0x42, 0x08, 0x5a, 0x9d, 0xd5, 0xf8, 0x12, 0x6a, 0xf9, 0x6b,
3044 0xbd, 0xb0, 0xc1, 0xaf, 0x69, 0xa1, 0x55, 0x62, 0xcb, 0x2a, 0x15, 0x5a,
3045 0x10, 0x03, 0x09, 0xd1, 0xb6, 0x41, 0xd0, 0x8b, 0x2d, 0x4e, 0xd1, 0x7b,
3046 0xfb, 0xf0, 0xbc, 0x04, 0x26, 0x5f, 0x9b, 0x10, 0xc1, 0x08, 0xf8, 0x50,
3047 0x30, 0x95, 0x04, 0xd7, 0x72, 0x81, 0x1b, 0xba, 0x8e, 0x2b, 0xe1, 0x62,
3048 0x49, 0xaa, 0x73, 0x7d, 0x87, 0x9f, 0xc7, 0xfb, 0x25, 0x5e, 0xe7, 0xa6,
3049 0xa0, 0xa7, 0x53, 0xbd, 0x93, 0x74, 0x1c, 0x61, 0x65, 0x8e, 0xc0, 0x74,
3050 0xf6, 0xe0, 0x02, 0xb0, 0x19, 0x34, 0x57, 0x69, 0x11, 0x3c, 0xc0, 0x13,
3051 0xff, 0x74, 0x94, 0xba, 0x83, 0x78, 0xb1, 0x1a, 0x17, 0x22, 0x60, 0xaa,
3052 0xa5, 0x34, 0x21, 0xbd, 0xe0, 0x3a, 0x35, 0x58, 0x9d, 0x57, 0xe3, 0x22,
3053 0xfe, 0xfa, 0x41, 0x00, 0xa4, 0x74, 0x39, 0x26, 0xab, 0x7d, 0x62, 0x25,
3054 0x8b, 0x87, 0xb3, 0x1c, 0xcb, 0xb5, 0xe6, 0xb8, 0x9c, 0xb1, 0x0b, 0x27,
3055 0x1a, 0xa0, 0x5d, 0x99, 0x4b, 0xb5, 0x70, 0x8b, 0x23, 0xab, 0x32, 0x7e,
3056 0xcb, 0x93, 0xc0, 0xf3, 0x15, 0x68, 0x69, 0xf0, 0x88, 0x3d, 0xa2, 0x06,
3057 0x4f, 0x79, 0x5e, 0x0e, 0x2a, 0xb7, 0xd3, 0xc6, 0x4d, 0x61, 0xd2, 0x30,
3058 0x3f, 0xc3, 0xa2, 0x9e, 0x16, 0x19, 0x92, 0x3c, 0xa8, 0x01, 0xe5, 0x9f,
3059 0xd7, 0x52, 0xca, 0x6e, 0x76, 0x49, 0xd3, 0x03, 0xc9, 0xd2, 0x07, 0x88,
3060 0xe1, 0x21, 0x46, 0x51, 0xb0, 0x69, 0x95, 0xeb, 0x26, 0x0c, 0x92, 0x9a,
3061 0x13, 0x44, 0xa8, 0x49, 0xb2, 0x5c, 0xa0, 0xa0, 0x1f, 0x1e, 0xb5, 0x29,
3062 0x13, 0x68, 0x6b, 0xba, 0x61, 0x9e, 0x23, 0x71, 0x44, 0x64, 0x03, 0x1a,
3063 0x78, 0x43, 0x92, 0x87, 0xfc, 0xa7, 0x8f, 0x4c, 0x04, 0x76, 0x22, 0x3e,
3064 0xea, 0x61, 0xb7, 0xf2, 0x5a, 0x7c, 0xe4, 0x2c, 0xca, 0x90, 0x1b, 0x2a,
3065 0xea, 0x12, 0x98, 0x17, 0x89, 0x4b, 0xa3, 0x47, 0x08, 0x23, 0x85, 0x4f,
3066 0x3e, 0x5b, 0x28, 0xd8, 0x6b, 0xa9, 0x79, 0xe5, 0x46, 0x71, 0x86, 0x2d,
3067 0x90, 0x47, 0x0b, 0x1e, 0x78, 0x38, 0x97, 0x2a, 0x81, 0xa4, 0x81, 0x07,
3068 0xd6, 0xac, 0x06, 0x11, 0x40, 0x6b, 0x21, 0xfb, 0xcc, 0xe1, 0xdb, 0x77,
3069 0x02, 0xea, 0x9d, 0xd6, 0xba, 0x6e, 0x40, 0x52, 0x7b, 0x9d, 0xc6, 0x63,
3070 0xf3, 0xc9, 0x3b, 0xad, 0x05, 0x6d, 0xc2, 0x85, 0x11, 0xf6, 0x6c, 0x3e,
3071 0x0b, 0x92, 0x8d, 0xb8, 0x87, 0x9d, 0x22, 0xc5, 0x92, 0x68, 0x5c, 0xc7,
3072 0x75, 0xa6, 0xcd, 0x57, 0x4a, 0xc3, 0xbc, 0xe3, 0xb2, 0x75, 0x91, 0xc8,
3073 0x21, 0x92, 0x90, 0x76, 0x35, 0x8a, 0x22, 0x00, 0xb3, 0x77, 0x36, 0x5f,
3074 0x7e, 0xfb, 0x9e, 0x40, 0xc3, 0xbf, 0x0f, 0xf0, 0x43, 0x29, 0x86, 0xae,
3075 0x4b, 0xc1, 0xa2, 0x42, 0xce, 0x99, 0x21, 0xaa, 0x9e, 0x22, 0x44, 0x88,
3076 0x19, 0x58, 0x5d, 0xea, 0x30, 0x8e, 0xb0, 0x39
3077 };
3078 static const uint8_t ml_kem_768_pubkey[] = {
3079 0xa8, 0xe6, 0x51, 0xa1, 0xe6, 0x85, 0xf2, 0x24, 0x78, 0xa8, 0x95, 0x4f,
3080 0x00, 0x7b, 0xc7, 0x71, 0x1b, 0x93, 0x07, 0x72, 0xc7, 0x8f, 0x09, 0x2e,
3081 0x82, 0x87, 0x8e, 0x3e, 0x93, 0x7f, 0x36, 0x79, 0x67, 0x53, 0x29, 0x13,
3082 0xa8, 0xd5, 0x3d, 0xfd, 0xf4, 0xbf, 0xb1, 0xf8, 0x84, 0x67, 0x46, 0x59,
3083 0x67, 0x05, 0xcf, 0x34, 0x51, 0x42, 0xb9, 0x72, 0xa3, 0xf1, 0x63, 0x25,
3084 0xc4, 0x0c, 0x29, 0x52, 0xa3, 0x7b, 0x25, 0x89, 0x7e, 0x5e, 0xf3, 0x5f,
3085 0xba, 0xeb, 0x73, 0xa4, 0xac, 0xbe, 0xb6, 0xa0, 0xb8, 0x99, 0x42, 0xce,
3086 0xb1, 0x95, 0x53, 0x1c, 0xfc, 0x0a, 0x07, 0x99, 0x39, 0x54, 0x48, 0x3e,
3087 0x6c, 0xbc, 0x87, 0xc0, 0x6a, 0xa7, 0x4f, 0xf0, 0xca, 0xc5, 0x20, 0x7e,
3088 0x53, 0x5b, 0x26, 0x0a, 0xa9, 0x8d, 0x11, 0x98, 0xc0, 0x7d, 0xa6, 0x05,
3089 0xc4, 0xd1, 0x10, 0x20, 0xf6, 0xc9, 0xf7, 0xbb, 0x68, 0xbb, 0x34, 0x56,
3090 0xc7, 0x3a, 0x01, 0xb7, 0x10, 0xbc, 0x99, 0xd1, 0x77, 0x39, 0xa5, 0x17,
3091 0x16, 0xaa, 0x01, 0x66, 0x0c, 0x8b, 0x62, 0x8b, 0x2f, 0x56, 0x02, 0xba,
3092 0x65, 0xf0, 0x7e, 0xa9, 0x93, 0x33, 0x6e, 0x89, 0x6e, 0x83, 0xf2, 0xc5,
3093 0x73, 0x1b, 0xbf, 0x03, 0x46, 0x0c, 0x5b, 0x6c, 0x8a, 0xfe, 0xcb, 0x74,
3094 0x8e, 0xe3, 0x91, 0xe9, 0x89, 0x34, 0xa2, 0xc5, 0x7d, 0x4d, 0x06, 0x9f,
3095 0x50, 0xd8, 0x8b, 0x30, 0xd6, 0x96, 0x6f, 0x38, 0xc3, 0x7b, 0xc6, 0x49,
3096 0xb8, 0x26, 0x34, 0xce, 0x77, 0x22, 0x64, 0x5c, 0xcd, 0x62, 0x50, 0x63,
3097 0x36, 0x46, 0x46, 0xd6, 0xd6, 0x99, 0xdb, 0x57, 0xb4, 0x5e, 0xb6, 0x74,
3098 0x65, 0xe1, 0x6d, 0xe4, 0xd4, 0x06, 0xa8, 0x18, 0xb9, 0xea, 0xe1, 0xca,
3099 0x91, 0x6a, 0x25, 0x94, 0x48, 0x97, 0x08, 0xa4, 0x3c, 0xea, 0x88, 0xb0,
3100 0x2a, 0x4c, 0x03, 0xd0, 0x9b, 0x44, 0x81, 0x5c, 0x97, 0x10, 0x1c, 0xaf,
3101 0x50, 0x48, 0xbb, 0xcb, 0x24, 0x7a, 0xe2, 0x36, 0x6c, 0xdc, 0x25, 0x4b,
3102 0xa2, 0x21, 0x29, 0xf4, 0x5b, 0x3b, 0x0e, 0xb3, 0x99, 0xca, 0x91, 0xa3,
3103 0x03, 0x40, 0x28, 0x30, 0xec, 0x01, 0xdb, 0x7b, 0x2c, 0xa4, 0x80, 0xcf,
3104 0x35, 0x04, 0x09, 0xb2, 0x16, 0x09, 0x4b, 0x7b, 0x0c, 0x3a, 0xe3, 0x3c,
3105 0xe1, 0x0a, 0x91, 0x24, 0xe8, 0x96, 0x51, 0xab, 0x90, 0x1e, 0xa2, 0x53,
3106 0xc8, 0x41, 0x5b, 0xd7, 0x82, 0x5f, 0x02, 0xbb, 0x22, 0x93, 0x69, 0xaf,
3107 0x97, 0x20, 0x28, 0xf2, 0x28, 0x75, 0xea, 0x55, 0xaf, 0x16, 0xd3, 0xbc,
3108 0x69, 0xf7, 0x0c, 0x2e, 0xe8, 0xb7, 0x5f, 0x28, 0xb4, 0x7d, 0xd3, 0x91,
3109 0xf9, 0x89, 0xad, 0xe3, 0x14, 0x72, 0x9c, 0x33, 0x1f, 0xa0, 0x4c, 0x19,
3110 0x17, 0xb2, 0x78, 0xc3, 0xeb, 0x60, 0x28, 0x68, 0x51, 0x28, 0x21, 0xad,
3111 0xc8, 0x25, 0xc6, 0x45, 0x77, 0xce, 0x1e, 0x63, 0xb1, 0xd9, 0x64, 0x4a,
3112 0x61, 0x29, 0x48, 0xa3, 0x48, 0x3c, 0x7f, 0x1b, 0x9a, 0x25, 0x80, 0x00,
3113 0xe3, 0x01, 0x96, 0x94, 0x4a, 0x40, 0x36, 0x27, 0x60, 0x9c, 0x76, 0xc7,
3114 0xea, 0x6b, 0x5d, 0xe0, 0x17, 0x64, 0xd2, 0x43, 0x79, 0x11, 0x7b, 0x9e,
3115 0xa2, 0x98, 0x48, 0xdc, 0x55, 0x5c, 0x45, 0x4b, 0xce, 0xae, 0x1b, 0xa5,
3116 0xcc, 0x72, 0xc7, 0x4a, 0xb9, 0x6b, 0x9c, 0x91, 0xb9, 0x10, 0xd2, 0x6b,
3117 0x88, 0xb2, 0x56, 0x39, 0xd4, 0x77, 0x8a, 0xe2, 0x6c, 0x7c, 0x61, 0x51,
3118 0xa1, 0x9c, 0x6c, 0xd7, 0x93, 0x84, 0x54, 0x37, 0x24, 0x65, 0xe4, 0xc5,
3119 0xec, 0x29, 0x24, 0x5a, 0xcb, 0x3d, 0xb5, 0x37, 0x9d, 0xe3, 0xda, 0xbf,
3120 0xa6, 0x29, 0xa7, 0xc0, 0x4a, 0x83, 0x53, 0xa8, 0x53, 0x0c, 0x95, 0xac,
3121 0xb7, 0x32, 0xbb, 0x4b, 0xb8, 0x19, 0x32, 0xbb, 0x2c, 0xa7, 0xa8, 0x48,
3122 0xcd, 0x36, 0x68, 0x01, 0x44, 0x4a, 0xbe, 0x23, 0xc8, 0x3b, 0x36, 0x6a,
3123 0x87, 0xd6, 0xa3, 0xcf, 0x36, 0x09, 0x24, 0xc0, 0x02, 0xba, 0xe9, 0x0a,
3124 0xf6, 0x5c, 0x48, 0x06, 0x0b, 0x37, 0x52, 0xf2, 0xba, 0xdf, 0x1a, 0xb2,
3125 0x72, 0x20, 0x72, 0x55, 0x4a, 0x50, 0x59, 0x75, 0x35, 0x94, 0xe6, 0xa7,
3126 0x02, 0x76, 0x1f, 0xc9, 0x76, 0x84, 0xc8, 0xc4, 0xa7, 0x54, 0x0a, 0x6b,
3127 0x07, 0xfb, 0xc9, 0xde, 0x87, 0xc9, 0x74, 0xaa, 0x88, 0x09, 0xd9, 0x28,
3128 0xc7, 0xf4, 0xcb, 0xbf, 0x80, 0x45, 0xae, 0xa5, 0xbc, 0x66, 0x78, 0x25,
3129 0xfd, 0x05, 0xa5, 0x21, 0xf1, 0xa4, 0xbf, 0x53, 0x92, 0x10, 0xc7, 0x11,
3130 0x3b, 0xc3, 0x7b, 0x3e, 0x58, 0xb0, 0xcb, 0xfc, 0x53, 0xc8, 0x41, 0xcb,
3131 0xb0, 0x37, 0x1d, 0xe2, 0xe5, 0x11, 0xb9, 0x89, 0xcb, 0x7c, 0x70, 0xc0,
3132 0x23, 0x36, 0x6d, 0x78, 0xf9, 0xc3, 0x7e, 0xf0, 0x47, 0xf8, 0x72, 0x0b,
3133 0xe1, 0xc7, 0x59, 0xa8, 0xd9, 0x6b, 0x93, 0xf6, 0x5a, 0x94, 0x11, 0x4f,
3134 0xfa, 0xf6, 0x0d, 0x9a, 0x81, 0x79, 0x5e, 0x99, 0x5c, 0x71, 0x15, 0x2a,
3135 0x46, 0x91, 0xa5, 0xa6, 0x02, 0xa9, 0xe1, 0xf3, 0x59, 0x9e, 0x37, 0xc7,
3136 0x68, 0xc7, 0xbc, 0x10, 0x89, 0x94, 0xc0, 0x66, 0x9f, 0x3a, 0xdc, 0x95,
3137 0x7d, 0x46, 0xb4, 0xb6, 0x25, 0x69, 0x68, 0xe2, 0x90, 0xd7, 0x89, 0x2e,
3138 0xa8, 0x54, 0x64, 0xee, 0x7a, 0x75, 0x0f, 0x39, 0xc5, 0xe3, 0x15, 0x2c,
3139 0x2d, 0xfc, 0x56, 0xd8, 0xb0, 0xc9, 0x24, 0xba, 0x8a, 0x95, 0x9a, 0x68,
3140 0x09, 0x65, 0x47, 0xf6, 0x64, 0x23, 0xc8, 0x38, 0x98, 0x2a, 0x57, 0x94,
3141 0xb9, 0xe1, 0x53, 0x37, 0x71, 0x33, 0x1a, 0x9a, 0x65, 0x6c, 0x28, 0x82,
3142 0x8b, 0xeb, 0x91, 0x26, 0xa6, 0x0e, 0x95, 0xe8, 0xc5, 0xd9, 0x06, 0x83,
3143 0x2c, 0x77, 0x10, 0x70, 0x55, 0x76, 0xb1, 0xfb, 0x95, 0x07, 0x26, 0x9d,
3144 0xda, 0xf8, 0xc9, 0x5c, 0xe9, 0x71, 0x9b, 0x2c, 0xa8, 0xdd, 0x11, 0x2b,
3145 0xe1, 0x0b, 0xcc, 0x9f, 0x4a, 0x37, 0xbd, 0x1b, 0x1e, 0xee, 0xb3, 0x3e,
3146 0xcd, 0xa7, 0x6a, 0xe9, 0xf6, 0x9a, 0x5d, 0x4b, 0x29, 0x23, 0xa8, 0x69,
3147 0x57, 0x67, 0x1d, 0x61, 0x93, 0x35, 0xbe, 0x1c, 0x4c, 0x2c, 0x77, 0xce,
3148 0x87, 0xc4, 0x1f, 0x98, 0xa8, 0xcc, 0x46, 0x64, 0x60, 0xfa, 0x30, 0x0a,
3149 0xaf, 0x5b, 0x30, 0x1f, 0x0a, 0x1d, 0x09, 0xc8, 0x8e, 0x65, 0xda, 0x4d,
3150 0x8e, 0xe6, 0x4f, 0x68, 0xc0, 0x21, 0x89, 0xbb, 0xb3, 0x58, 0x4b, 0xaf,
3151 0xf7, 0x16, 0xc8, 0x5d, 0xb6, 0x54, 0x04, 0x8a, 0x00, 0x43, 0x33, 0x48,
3152 0x93, 0x93, 0xa0, 0x74, 0x27, 0xcd, 0x3e, 0x21, 0x7e, 0x6a, 0x34, 0x5f,
3153 0x6c, 0x2c, 0x2b, 0x13, 0xc2, 0x7b, 0x33, 0x72, 0x71, 0xc0, 0xb2, 0x7b,
3154 0x2d, 0xba, 0xa0, 0x0d, 0x23, 0x76, 0x00, 0xb5, 0xb5, 0x94, 0xe8, 0xcf,
3155 0x2d, 0xd6, 0x25, 0xea, 0x76, 0xcf, 0x0e, 0xd8, 0x99, 0x12, 0x2c, 0x97,
3156 0x96, 0xb4, 0xb0, 0x18, 0x70, 0x04, 0x25, 0x80, 0x49, 0xa4, 0x77, 0xcd,
3157 0x11, 0xd6, 0x8c, 0x49, 0xb9, 0xa0, 0xe7, 0xb0, 0x0b, 0xce, 0x8c, 0xac,
3158 0x78, 0x64, 0xcb, 0xb3, 0x75, 0x14, 0x00, 0x84, 0x74, 0x4c, 0x93, 0x06,
3159 0x26, 0x94, 0xca, 0x79, 0x5c, 0x4f, 0x40, 0xe7, 0xac, 0xc9, 0xc5, 0xa1,
3160 0x88, 0x40, 0x72, 0xd8, 0xc3, 0x8d, 0xaf, 0xb5, 0x01, 0xee, 0x41, 0x84,
3161 0xdd, 0x5a, 0x81, 0x9e, 0xc2, 0x4e, 0xc1, 0x65, 0x12, 0x61, 0xf9, 0x62,
3162 0xb1, 0x7a, 0x72, 0x15, 0xaa, 0x4a, 0x74, 0x8c, 0x15, 0x83, 0x6c, 0x38,
3163 0x91, 0x37, 0x67, 0x82, 0x04, 0x83, 0x8d, 0x71, 0x95, 0xa8, 0x5b, 0x4f,
3164 0x98, 0xa1, 0xb5, 0x74, 0xc4, 0xcd, 0x79, 0x09, 0xcd, 0x1f, 0x83, 0x3e,
3165 0xff, 0xd1, 0x48, 0x55, 0x43, 0x22, 0x9d, 0x37, 0x48, 0xd9, 0xb5, 0xcd,
3166 0x6c, 0x17, 0xb9, 0xb3, 0xb8, 0x4a, 0xef, 0x8b, 0xce, 0x13, 0xe6, 0x83,
3167 0x73, 0x36, 0x59, 0xc7, 0x95, 0x42, 0xd6, 0x15, 0x78, 0x2a, 0x71, 0xcd,
3168 0xee, 0xe7, 0x92, 0xba, 0xb5, 0x1b, 0xdc, 0x4b, 0xbf, 0xe8, 0x30, 0x8e,
3169 0x66, 0x31, 0x44, 0xed, 0xe8, 0x49, 0x18, 0x30, 0xad, 0x98, 0xb4, 0x63,
3170 0x4f, 0x64, 0xab, 0xa8, 0xb9, 0xc0, 0x42, 0x27, 0x26, 0x53, 0x92, 0x0f,
3171 0x38, 0x0c, 0x1a, 0x17, 0xca, 0x87, 0xce, 0xd7, 0xaa, 0xc4, 0x1c, 0x82,
3172 0x88, 0x87, 0x93, 0x18, 0x1a, 0x6f, 0x76, 0xe1, 0x97, 0xb7, 0xb9, 0x0e,
3173 0xf9, 0x09, 0x43, 0xbb, 0x38, 0x44, 0x91, 0x29, 0x11, 0xd8, 0x55, 0x1e,
3174 0x54, 0x66, 0xc5, 0x76, 0x7a, 0xb0, 0xbc, 0x61, 0xa1, 0xa3, 0xf7, 0x36,
3175 0x16, 0x2e, 0xc0, 0x98, 0xa9, 0x00, 0xb1, 0x2d, 0xd8, 0xfa, 0xbb, 0xfb,
3176 0x3f, 0xe8, 0xcb, 0x1d, 0xc4, 0xe8, 0x31, 0x5f, 0x2a, 0xf0, 0xd3, 0x2f,
3177 0x00, 0x17, 0xae, 0x13, 0x6e, 0x19, 0xf0, 0x28
3178 };
3179 static const uint8_t ml_kem_1024_pubkey[] = {
3180 0x53, 0x79, 0x11, 0x95, 0x7c, 0x12, 0x51, 0x48, 0xa8, 0x7f, 0x41, 0x58,
3181 0x9c, 0xb2, 0x22, 0xd0, 0xd1, 0x92, 0x29, 0xe2, 0xcb, 0x55, 0xe1, 0xa0,
3182 0x44, 0x79, 0x1e, 0x7c, 0xa6, 0x11, 0x92, 0xa4, 0x64, 0x60, 0xc3, 0x18,
3183 0x3d, 0x2b, 0xcd, 0x6d, 0xe0, 0x8a, 0x5e, 0x76, 0x51, 0x60, 0x3a, 0xcc,
3184 0x34, 0x9c, 0xa1, 0x6c, 0xba, 0x18, 0xab, 0xb2, 0x3a, 0x3e, 0x8c, 0x33,
3185 0x0d, 0x74, 0x21, 0x59, 0x8a, 0x62, 0x78, 0xec, 0x7e, 0xbf, 0xab, 0xca,
3186 0x0e, 0xf4, 0x88, 0xb2, 0x29, 0x05, 0x54, 0x75, 0x34, 0x99, 0xc0, 0x45,
3187 0x2e, 0x45, 0x38, 0x15, 0x30, 0x99, 0x55, 0xb8, 0x15, 0x0f, 0xa1, 0xa1,
3188 0xe3, 0x93, 0x38, 0x6d, 0xc1, 0x2f, 0xdb, 0x27, 0xb3, 0x8c, 0x67, 0x45,
3189 0xf2, 0x94, 0x40, 0x16, 0xec, 0x45, 0x7f, 0x39, 0xb1, 0x8d, 0x60, 0x4a,
3190 0x07, 0xa1, 0xab, 0xe0, 0x7b, 0xc8, 0x44, 0x05, 0x0f, 0xfa, 0x8a, 0x06,
3191 0xfa, 0x15, 0x4a, 0x49, 0xd8, 0x8f, 0xac, 0x77, 0x54, 0x52, 0xd6, 0xa7,
3192 0xc0, 0xe5, 0x89, 0xbf, 0xb5, 0xc3, 0x70, 0xc2, 0xc4, 0xb6, 0x20, 0x1d,
3193 0xda, 0x80, 0xc9, 0xab, 0x20, 0x76, 0xec, 0xc0, 0x8b, 0x44, 0x52, 0x2f,
3194 0xda, 0x33, 0x26, 0xf0, 0x33, 0x80, 0x6d, 0xd2, 0x69, 0x3f, 0x31, 0x97,
3195 0x39, 0xf4, 0x0c, 0x4f, 0x42, 0xb2, 0x4a, 0xca, 0x70, 0x98, 0xfb, 0x8f,
3196 0xf5, 0xf9, 0xac, 0x20, 0x29, 0x2d, 0x02, 0xb5, 0x6a, 0xc7, 0x46, 0x80,
3197 0x1a, 0xcc, 0xcc, 0x84, 0x86, 0x3d, 0xee, 0x32, 0x87, 0x84, 0x97, 0xb6,
3198 0x94, 0x38, 0xbf, 0x99, 0x17, 0x76, 0x28, 0x66, 0x50, 0x48, 0x2c, 0x8d,
3199 0x9d, 0x95, 0x87, 0xbc, 0x6a, 0x55, 0xb8, 0x5c, 0x4d, 0x7f, 0xa7, 0x4d,
3200 0x02, 0x65, 0x6b, 0x42, 0x1c, 0x9e, 0x23, 0xe0, 0x3a, 0x48, 0xd4, 0xb7,
3201 0x44, 0x25, 0xc2, 0x6e, 0x4a, 0x20, 0xdd, 0x95, 0x62, 0xa4, 0xda, 0x07,
3202 0x93, 0xf3, 0xa3, 0x52, 0xcc, 0xc0, 0xf1, 0x82, 0x17, 0xd8, 0x68, 0xc7,
3203 0xf5, 0x00, 0x2a, 0xbe, 0x76, 0x8b, 0x1f, 0xc7, 0x3f, 0x05, 0x74, 0x4e,
3204 0x7c, 0xc2, 0x8f, 0x10, 0x34, 0x40, 0x62, 0xc1, 0x0e, 0x08, 0xec, 0xcc,
3205 0xed, 0x3c, 0x1f, 0x7d, 0x39, 0x2c, 0x01, 0xd9, 0x79, 0xdd, 0x71, 0x8d,
3206 0x83, 0x98, 0x37, 0x46, 0x65, 0xa1, 0x6a, 0x98, 0x70, 0x58, 0x5c, 0x39,
3207 0xd5, 0x58, 0x9a, 0x50, 0xe1, 0x33, 0x38, 0x9c, 0x9b, 0x9a, 0x27, 0x6c,
3208 0x02, 0x42, 0x60, 0xd9, 0xfc, 0x77, 0x11, 0xc8, 0x1b, 0x63, 0x37, 0xb5,
3209 0x7d, 0xa3, 0xc3, 0x76, 0xd0, 0xcd, 0x74, 0xe1, 0x4c, 0x73, 0x72, 0x7b,
3210 0x27, 0x66, 0x56, 0xb9, 0xd8, 0xa4, 0xeb, 0x71, 0x89, 0x6f, 0xf5, 0x89,
3211 0xd4, 0xb8, 0x93, 0xe7, 0x11, 0x0f, 0x3b, 0xb9, 0x48, 0xec, 0xe2, 0x91,
3212 0xdd, 0x86, 0xc0, 0xb7, 0x46, 0x8a, 0x67, 0x8c, 0x74, 0x69, 0x80, 0xc1,
3213 0x2a, 0xa6, 0xb9, 0x5e, 0x2b, 0x0c, 0xbe, 0x43, 0x31, 0xbb, 0x24, 0xa3,
3214 0x3a, 0x27, 0x01, 0x53, 0xaa, 0x47, 0x2c, 0x47, 0x31, 0x23, 0x82, 0xca,
3215 0x36, 0x5c, 0x5f, 0x35, 0x25, 0x9d, 0x02, 0x57, 0x46, 0xfc, 0x65, 0x95,
3216 0xfe, 0x63, 0x6c, 0x76, 0x75, 0x10, 0xa6, 0x9c, 0x1e, 0x8a, 0x17, 0x6b,
3217 0x79, 0x49, 0x95, 0x8f, 0x26, 0x97, 0x39, 0x94, 0x97, 0xa2, 0xfc, 0x73,
3218 0x64, 0xa1, 0x2c, 0x81, 0x98, 0x29, 0x52, 0x39, 0xc8, 0x26, 0xcb, 0x50,
3219 0x82, 0x08, 0x60, 0x77, 0x28, 0x2e, 0xd6, 0x28, 0x65, 0x1f, 0xc0, 0x4c,
3220 0x63, 0x9b, 0x43, 0x85, 0x22, 0xa9, 0xde, 0x30, 0x9b, 0x14, 0xb0, 0x86,
3221 0xd6, 0xe9, 0x23, 0xc5, 0x51, 0x62, 0x3b, 0xd7, 0x2a, 0x73, 0x3c, 0xb0,
3222 0xda, 0xbc, 0x54, 0xa9, 0x41, 0x6a, 0x99, 0xe7, 0x2c, 0x9f, 0xda, 0x1c,
3223 0xb3, 0xfb, 0x9b, 0xa0, 0x6b, 0x8a, 0xdb, 0x24, 0x22, 0xd6, 0x8c, 0xad,
3224 0xc5, 0x53, 0xc9, 0x82, 0x02, 0xa1, 0x76, 0x56, 0x47, 0x8a, 0xc0, 0x44,
3225 0xef, 0x34, 0x56, 0x37, 0x8a, 0xbc, 0xe9, 0x99, 0x1e, 0x01, 0x41, 0xba,
3226 0x79, 0x09, 0x4f, 0xa8, 0xf7, 0x7a, 0x30, 0x08, 0x05, 0xd2, 0xd3, 0x2f,
3227 0xfc, 0x62, 0xbf, 0x0c, 0xa4, 0x55, 0x4c, 0x33, 0x0c, 0x2b, 0xb7, 0x04,
3228 0x2d, 0xb3, 0x51, 0x02, 0xf6, 0x8b, 0x1a, 0x00, 0x62, 0x58, 0x38, 0x65,
3229 0x38, 0x1c, 0x74, 0xdd, 0x91, 0x3a, 0xf7, 0x0b, 0x26, 0xcf, 0x09, 0x23,
3230 0xd0, 0xc4, 0xcb, 0x97, 0x16, 0x92, 0x22, 0x25, 0x52, 0xa8, 0xf4, 0xb7,
3231 0x88, 0xb4, 0xaf, 0xd1, 0x34, 0x1a, 0x9d, 0xf4, 0x15, 0xcf, 0x20, 0x39,
3232 0x00, 0xf5, 0xcc, 0xf7, 0xf6, 0x59, 0x88, 0x94, 0x9a, 0x75, 0x58, 0x0d,
3233 0x04, 0x96, 0x39, 0x85, 0x31, 0x00, 0x85, 0x4b, 0x21, 0xf4, 0x01, 0x80,
3234 0x03, 0x50, 0x2b, 0xb1, 0xba, 0x95, 0xf5, 0x56, 0xa5, 0xd6, 0x7c, 0x7e,
3235 0xb5, 0x24, 0x10, 0xeb, 0xa2, 0x88, 0xa6, 0xd0, 0x63, 0x5c, 0xa8, 0xa4,
3236 0xf6, 0xd6, 0x96, 0xd0, 0xa0, 0x20, 0xc8, 0x26, 0x93, 0x8d, 0x34, 0x94,
3237 0x3c, 0x38, 0x08, 0xc7, 0x9c, 0xc0, 0x07, 0x76, 0x85, 0x33, 0x21, 0x6b,
3238 0xc1, 0xb2, 0x9d, 0xa6, 0xc8, 0x12, 0xef, 0xf3, 0x34, 0x0b, 0xaa, 0x8d,
3239 0x2e, 0x65, 0x34, 0x4f, 0x09, 0xbd, 0x47, 0x89, 0x4f, 0x5a, 0x3a, 0x41,
3240 0x18, 0x71, 0x5b, 0x3c, 0x50, 0x20, 0x67, 0x93, 0x27, 0xf9, 0x18, 0x9f,
3241 0x7e, 0x10, 0x85, 0x6b, 0x23, 0x8b, 0xb9, 0xb0, 0xab, 0x4c, 0xa8, 0x5a,
3242 0xbf, 0x4b, 0x21, 0xf5, 0xc7, 0x6b, 0xcc, 0xd7, 0x18, 0x50, 0xb2, 0x2e,
3243 0x04, 0x59, 0x28, 0x27, 0x6a, 0x0f, 0x2e, 0x95, 0x1d, 0xb0, 0x70, 0x7c,
3244 0x6a, 0x11, 0x6d, 0xc1, 0x91, 0x13, 0xfa, 0x76, 0x2d, 0xc5, 0xf2, 0x0b,
3245 0xd5, 0xd2, 0xab, 0x5b, 0xe7, 0x17, 0x44, 0xdc, 0x9c, 0xbd, 0xb5, 0x1e,
3246 0xa7, 0x57, 0x96, 0x3a, 0xac, 0x56, 0xa9, 0x0a, 0x0d, 0x80, 0x23, 0xbe,
3247 0xd1, 0xf5, 0xca, 0xe8, 0xa6, 0x4d, 0xa0, 0x47, 0x27, 0x9b, 0x35, 0x3a,
3248 0x09, 0x6a, 0x83, 0x5b, 0x0b, 0x2b, 0x02, 0x3b, 0x6a, 0xa0, 0x48, 0x98,
3249 0x92, 0x33, 0x07, 0x9a, 0xeb, 0x46, 0x7e, 0x52, 0x2f, 0xa2, 0x7a, 0x58,
3250 0x22, 0x92, 0x1e, 0x5c, 0x55, 0x1b, 0x4f, 0x53, 0x75, 0x36, 0xe4, 0x6f,
3251 0x3a, 0x6a, 0x97, 0xe7, 0x2c, 0x3b, 0x06, 0x31, 0x04, 0xe0, 0x9a, 0x04,
3252 0x05, 0x98, 0x94, 0x0d, 0x87, 0x2f, 0x6d, 0x87, 0x1f, 0x5e, 0xf9, 0xb4,
3253 0x35, 0x50, 0x73, 0xb5, 0x47, 0x69, 0xe4, 0x54, 0x54, 0xe6, 0xa0, 0x81,
3254 0x95, 0x99, 0x40, 0x86, 0x21, 0xab, 0x44, 0x13, 0xb3, 0x55, 0x07, 0xb0,
3255 0xdf, 0x57, 0x8c, 0xe2, 0xd5, 0x11, 0xd5, 0x20, 0x58, 0xd5, 0x74, 0x9d,
3256 0xf3, 0x8b, 0x29, 0xd6, 0xcc, 0x58, 0x87, 0x0c, 0xaf, 0x92, 0xf6, 0x9a,
3257 0x75, 0x16, 0x14, 0x06, 0xe7, 0x1c, 0x5f, 0xf9, 0x24, 0x51, 0xa7, 0x75,
3258 0x22, 0xb8, 0xb2, 0x96, 0x7a, 0x2d, 0x58, 0xa4, 0x9a, 0x81, 0x66, 0x1a,
3259 0xa6, 0x5a, 0xc0, 0x9b, 0x08, 0xc9, 0xfe, 0x45, 0xab, 0xc3, 0x85, 0x1f,
3260 0x99, 0xc7, 0x30, 0xc4, 0x50, 0x03, 0xac, 0xa2, 0xbf, 0x0f, 0x84, 0x24,
3261 0xa1, 0x9b, 0x74, 0x08, 0xa5, 0x37, 0xd5, 0x41, 0xc1, 0x6f, 0x56, 0x82,
3262 0xbf, 0xe3, 0xa7, 0xfa, 0xea, 0x56, 0x4f, 0x12, 0x98, 0x61, 0x1a, 0x7f,
3263 0x5f, 0x60, 0x92, 0x2b, 0xa1, 0x9d, 0xe7, 0x3b, 0x19, 0x17, 0xf1, 0x85,
3264 0x32, 0x73, 0x55, 0x51, 0x99, 0xa6, 0x49, 0x31, 0x8b, 0x50, 0x77, 0x33,
3265 0x45, 0xc9, 0x97, 0x46, 0x08, 0x56, 0x97, 0x2a, 0xcb, 0x43, 0xfc, 0x81,
3266 0xab, 0x63, 0x21, 0xb1, 0xc3, 0x3c, 0x2b, 0xb5, 0x09, 0x8b, 0xd4, 0x89,
3267 0xd6, 0x96, 0xa0, 0xf7, 0x06, 0x79, 0xc1, 0x21, 0x38, 0x73, 0xd0, 0x8b,
3268 0xda, 0xd4, 0x28, 0x44, 0x92, 0x72, 0x16, 0x04, 0x72, 0x05, 0x63, 0x32,
3269 0x12, 0x31, 0x0e, 0xe9, 0xa0, 0x6c, 0xb1, 0x00, 0x16, 0xc8, 0x05, 0x50,
3270 0x3c, 0x34, 0x1a, 0x36, 0xd8, 0x7e, 0x56, 0x07, 0x2e, 0xab, 0xe2, 0x37,
3271 0x31, 0xe3, 0x4a, 0xf7, 0xe2, 0x32, 0x8f, 0x85, 0xcd, 0xb3, 0x70, 0xcc,
3272 0xaf, 0x00, 0x51, 0x5b, 0x64, 0xc9, 0xc5, 0x4b, 0xc8, 0x37, 0x57, 0x84,
3273 0x47, 0xaa, 0xcf, 0xae, 0xd5, 0x96, 0x9a, 0xa3, 0x51, 0xe7, 0xda, 0x4e,
3274 0xfa, 0x7b, 0x11, 0x5c, 0x4c, 0x51, 0xf4, 0xa6, 0x99, 0x77, 0x98, 0x50,
3275 0x29, 0x5c, 0xa7, 0x2d, 0x78, 0x1a, 0xd4, 0x1b, 0xc6, 0x80, 0x53, 0x2b,
3276 0x89, 0xe7, 0x10, 0xe2, 0x18, 0x9e, 0xb3, 0xc5, 0x08, 0x17, 0xba, 0x25,
3277 0x5c, 0x74, 0x74, 0xc9, 0x5c, 0xa9, 0x11, 0x0c, 0xc4, 0x3b, 0x8b, 0xa8,
3278 0xe6, 0x82, 0xc7, 0xfb, 0x7b, 0x0f, 0xdc, 0x26, 0x5c, 0x04, 0x83, 0xa6,
3279 0x5c, 0xa4, 0x51, 0x4e, 0xe4, 0xb8, 0x32, 0xaa, 0xc5, 0x80, 0x0c, 0x3b,
3280 0x08, 0xe7, 0x4f, 0x56, 0x39, 0x51, 0xc1, 0xfb, 0xb2, 0x10, 0x35, 0x3e,
3281 0xfa, 0x1a, 0xa8, 0x66, 0x85, 0x6b, 0xc1, 0xe0, 0x34, 0x73, 0x3b, 0x04,
3282 0x85, 0xda, 0xb1, 0xd0, 0x20, 0xc6, 0xbf, 0x76, 0x5f, 0xf6, 0x0b, 0x3b,
3283 0x80, 0x19, 0x84, 0xa9, 0x0c, 0x2f, 0xe9, 0x70, 0xbf, 0x1d, 0xe9, 0x70,
3284 0x04, 0xa6, 0xcf, 0x44, 0xb4, 0x98, 0x4a, 0xb5, 0x82, 0x58, 0xb4, 0xaf,
3285 0x71, 0x22, 0x1c, 0xd1, 0x75, 0x30, 0xa7, 0x00, 0xc3, 0x29, 0x59, 0xc9,
3286 0x43, 0x63, 0x44, 0xb5, 0x31, 0x6f, 0x09, 0xcc, 0xca, 0x70, 0x29, 0xa2,
3287 0x30, 0xd6, 0x39, 0xdc, 0xb0, 0x22, 0xd8, 0xba, 0x79, 0xba, 0x91, 0xcd,
3288 0x6a, 0xb1, 0x2a, 0xe1, 0x57, 0x9c, 0x50, 0xc7, 0xbb, 0x10, 0xe3, 0x03,
3289 0x01, 0xa6, 0x5c, 0xae, 0x31, 0x01, 0xd4, 0x0c, 0x7b, 0xa9, 0x27, 0xbb,
3290 0x55, 0x31, 0x48, 0xd1, 0x64, 0x70, 0x24, 0xd4, 0xa0, 0x6c, 0x81, 0x66,
3291 0xd0, 0xb0, 0xb8, 0x12, 0x69, 0xb7, 0xd5, 0xf4, 0xb3, 0x4f, 0xb0, 0x22,
3292 0xf6, 0x91, 0x52, 0xf5, 0x14, 0x00, 0x4a, 0x7c, 0x68, 0x53, 0x68, 0x55,
3293 0x23, 0x43, 0xbb, 0x60, 0x36, 0x0f, 0xbb, 0x99, 0x45, 0xed, 0xf4, 0x46,
3294 0xd3, 0x45, 0xbd, 0xca, 0xa7, 0x45, 0x5c, 0x74, 0xba, 0x0a, 0x55, 0x1e,
3295 0x18, 0x46, 0x20, 0xfe, 0xf9, 0x76, 0x88, 0x77, 0x3d, 0x50, 0xb6, 0x43,
3296 0x3c, 0xa7, 0xa7, 0xac, 0x5c, 0xb6, 0xb7, 0xf6, 0x71, 0xa1, 0x53, 0x76,
3297 0xe5, 0xa6, 0x74, 0x7a, 0x62, 0x3f, 0xa7, 0xbc, 0x66, 0x30, 0x37, 0x3f,
3298 0x5b, 0x1b, 0x51, 0x26, 0x90, 0xa6, 0x61, 0x37, 0x78, 0x70, 0xa6, 0x0a,
3299 0x7a, 0x18, 0x96, 0x83, 0xf9, 0xb0, 0xcf, 0x04, 0x66, 0xe1, 0xf7, 0x50,
3300 0x76, 0x26, 0x31, 0xc4, 0xab, 0x09, 0xf5, 0x05, 0xc4, 0x2d, 0xd2, 0x86,
3301 0x33, 0x56, 0x94, 0x72, 0x73, 0x54, 0x42, 0x85, 0x1e, 0x32, 0x16, 0x16,
3302 0xd4, 0x00, 0x98, 0x10, 0x77, 0x7b, 0x6b, 0xd4, 0x6f, 0xa7, 0x22, 0x44,
3303 0x61, 0xa5, 0xcc, 0x27, 0x40, 0x5d, 0xfb, 0xac, 0x0d, 0x39, 0xb0, 0x02,
3304 0xca, 0xb3, 0x34, 0x33, 0xf2, 0xa8, 0x6e, 0xb8, 0xce, 0x91, 0xc1, 0x34,
3305 0xa6, 0x38, 0x6f, 0x86, 0x0a, 0x19, 0x94, 0xeb, 0x4b, 0x68, 0x75, 0xa4,
3306 0x6d, 0x19, 0x55, 0x81, 0xd1, 0x73, 0x85, 0x4b, 0x53, 0xd2, 0x29, 0x3d,
3307 0xf3, 0xe9, 0xa8, 0x22, 0x75, 0x6c, 0xd8, 0xf2, 0x12, 0xb3, 0x25, 0xca,
3308 0x29, 0xb4, 0xf9, 0xf8, 0xcf, 0xba, 0xdf, 0x2e, 0x41, 0x86, 0x9a, 0xbf,
3309 0xba, 0xd1, 0x07, 0x38, 0xad, 0x04, 0xcc, 0x75, 0x2b, 0xc2, 0x0c, 0x39,
3310 0x47, 0x46, 0x85, 0x0e, 0x0c, 0x48, 0x47, 0xdb
3311 };
3312 #endif
3313
3314 static struct keys_st {
3315 int type;
3316 const uint8_t *priv;
3317 const uint8_t *pub;
3318 /* If "name" is non-NULL, create via non-legacy _ex() API */
3319 char *name;
3320 int privlen;
3321 int publen;
3322 } keys[] = {
3323 { EVP_PKEY_HMAC,
3324 (const uint8_t *)"0123456789",
3325 NULL,
3326 NULL, 10, 0 },
3327 { EVP_PKEY_HMAC, (const uint8_t *)"", NULL,
3328 NULL, 0, 0
3329 #ifndef OPENSSL_NO_POLY1305
3330 },
3331 { EVP_PKEY_POLY1305,
3332 (const uint8_t *)"01234567890123456789012345678901",
3333 NULL,
3334 NULL, 32, 0
3335 #endif
3336 #ifndef OPENSSL_NO_SIPHASH
3337 },
3338 { EVP_PKEY_SIPHASH,
3339 (const uint8_t *)"0123456789012345",
3340 NULL,
3341 NULL, 16, 0
3342 #endif
3343 },
3344 #ifndef OPENSSL_NO_ECX
3345 { EVP_PKEY_X25519,
3346 (const uint8_t *)"01234567890123456789012345678901",
3347 (const unsigned char *)"abcdefghijklmnopqrstuvwxyzabcdef",
3348 NULL, 32, 32 },
3349 { EVP_PKEY_ED25519,
3350 (const uint8_t *)"01234567890123456789012345678901",
3351 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdef",
3352 NULL, 32, 32 },
3353 { EVP_PKEY_X448,
3354 (const uint8_t *)"01234567890123456789012345678901234567890123456789012345",
3355 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd",
3356 NULL, 56, 56 },
3357 { EVP_PKEY_ED448,
3358 (const uint8_t *)"012345678901234567890123456789012345678901234567890123456",
3359 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde",
3360 NULL, 57, 57 },
3361 #endif
3362 #ifndef OPENSSL_NO_ML_KEM
3363 { NID_undef, ml_kem_seed, ml_kem_512_pubkey,
3364 "ML-KEM-512", ML_KEM_SEED_BYTES, sizeof(ml_kem_512_pubkey) },
3365 { NID_undef, ml_kem_seed, ml_kem_768_pubkey,
3366 "ML-KEM-768", ML_KEM_SEED_BYTES, sizeof(ml_kem_768_pubkey) },
3367 { NID_undef, ml_kem_seed, ml_kem_1024_pubkey,
3368 "ML-KEM-1024", ML_KEM_SEED_BYTES, sizeof(ml_kem_1024_pubkey) },
3369 #endif
3370 };
3371
3372 #ifndef OPENSSL_NO_ML_KEM
3373 static int
ml_kem_seed_to_priv(const char * alg,const unsigned char * seed,int seedlen,unsigned char ** ret,size_t * retlen)3374 ml_kem_seed_to_priv(const char *alg, const unsigned char *seed, int seedlen,
3375 unsigned char **ret, size_t *retlen)
3376 {
3377 OSSL_PARAM parr[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
3378 EVP_PKEY_CTX *ctx = NULL;
3379 EVP_PKEY *pkey = NULL;
3380 const OSSL_PARAM *p;
3381 OSSL_PARAM *params = NULL;
3382 int selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
3383 int ok = 0;
3384
3385 /* Import the seed to generate a key */
3386 ctx = EVP_PKEY_CTX_new_from_name(testctx, alg, NULL);
3387 if (!TEST_ptr(ctx)
3388 || !TEST_int_gt(EVP_PKEY_fromdata_init(ctx), 0))
3389 goto done;
3390 parr[0] = OSSL_PARAM_construct_octet_string(
3391 OSSL_PKEY_PARAM_ML_KEM_SEED, (unsigned char *)seed, seedlen);
3392 if (!TEST_int_gt(EVP_PKEY_fromdata(ctx, &pkey, selection, parr), 0))
3393 goto done;
3394
3395 /* Export the key to get the encoded form */
3396 if (!TEST_true(EVP_PKEY_todata(pkey, OSSL_KEYMGMT_SELECT_PRIVATE_KEY, ¶ms)))
3397 goto done;
3398
3399 p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY);
3400 if (!TEST_ptr(p)
3401 || !TEST_true(OSSL_PARAM_get_octet_string(p, (void **)ret, 0, retlen)))
3402 goto done;
3403 ok = 1;
3404
3405 done:
3406 EVP_PKEY_free(pkey);
3407 OSSL_PARAM_free(params);
3408 EVP_PKEY_CTX_free(ctx);
3409 return ok;
3410 }
3411 #endif
3412
test_set_get_raw_keys_int(int tst,int pub,int uselibctx)3413 static int test_set_get_raw_keys_int(int tst, int pub, int uselibctx)
3414 {
3415 int ret = 0;
3416 uint8_t *buf = NULL;
3417 const uint8_t *in;
3418 uint8_t shortbuf[1];
3419 size_t inlen, len = 0, shortlen = sizeof(shortbuf);
3420 EVP_PKEY *pkey = NULL;
3421 unsigned char *privalloc = NULL;
3422 const char *name;
3423
3424 /* Check if this algorithm supports public keys */
3425 if (pub && keys[tst].pub == NULL)
3426 return 1;
3427
3428 name = keys[tst].name ? keys[tst].name : OBJ_nid2sn(keys[tst].type);
3429
3430 if (pub) {
3431 #ifndef OPENSSL_NO_EC
3432 inlen = keys[tst].publen;
3433 in = keys[tst].pub;
3434 if (uselibctx || keys[tst].name != NULL) {
3435 pkey = EVP_PKEY_new_raw_public_key_ex(
3436 testctx,
3437 name,
3438 NULL,
3439 in,
3440 inlen);
3441 } else {
3442 pkey = EVP_PKEY_new_raw_public_key(keys[tst].type,
3443 NULL,
3444 in,
3445 inlen);
3446 }
3447 #else
3448 return 1;
3449 #endif
3450 } else {
3451 inlen = keys[tst].privlen;
3452 in = keys[tst].priv;
3453 #ifndef OPENSSL_NO_ML_KEM
3454 if (in == ml_kem_seed) {
3455 if (!TEST_true(ml_kem_seed_to_priv(name, in, inlen,
3456 &privalloc, &inlen)))
3457 goto done;
3458 in = privalloc;
3459 }
3460 #endif
3461 if (uselibctx || keys[tst].name != NULL) {
3462 pkey = EVP_PKEY_new_raw_private_key_ex(
3463 testctx,
3464 name,
3465 NULL,
3466 in,
3467 inlen);
3468 } else {
3469 pkey = EVP_PKEY_new_raw_private_key(keys[tst].type,
3470 NULL,
3471 in,
3472 inlen);
3473 }
3474 }
3475
3476 if (!TEST_ptr(pkey)
3477 || !TEST_int_eq(EVP_PKEY_eq(pkey, pkey), 1)
3478 || (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, NULL, &len)))
3479 || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, NULL, &len)))
3480 || !TEST_true(len == inlen))
3481 goto done;
3482 if (tst != 1) {
3483 /*
3484 * Test that supplying a buffer that is too small fails. Doesn't apply
3485 * to HMAC with a zero length key
3486 */
3487 if ((!pub && !TEST_false(EVP_PKEY_get_raw_private_key(pkey, shortbuf, &shortlen)))
3488 || (pub && !TEST_false(EVP_PKEY_get_raw_public_key(pkey, shortbuf, &shortlen))))
3489 goto done;
3490 }
3491 if (!TEST_ptr(buf = OPENSSL_zalloc(len <= 80 ? 80 : len)))
3492 goto done;
3493 if ((!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, buf, &len)))
3494 || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, buf, &len)))
3495 || !TEST_mem_eq(in, inlen, buf, len))
3496 goto done;
3497
3498 ret = 1;
3499 done:
3500 OPENSSL_free(privalloc);
3501 OPENSSL_free(buf);
3502 EVP_PKEY_free(pkey);
3503 return ret;
3504 }
3505
test_set_get_raw_keys(int tst)3506 static int test_set_get_raw_keys(int tst)
3507 {
3508 return (nullprov != NULL || test_set_get_raw_keys_int(tst, 0, 0))
3509 && test_set_get_raw_keys_int(tst, 0, 1)
3510 && (nullprov != NULL || test_set_get_raw_keys_int(tst, 1, 0))
3511 && test_set_get_raw_keys_int(tst, 1, 1);
3512 }
3513
3514 #ifndef OPENSSL_NO_DEPRECATED_3_0
pkey_custom_check(EVP_PKEY * pkey)3515 static int pkey_custom_check(EVP_PKEY *pkey)
3516 {
3517 return 0xbeef;
3518 }
3519
pkey_custom_pub_check(EVP_PKEY * pkey)3520 static int pkey_custom_pub_check(EVP_PKEY *pkey)
3521 {
3522 return 0xbeef;
3523 }
3524
pkey_custom_param_check(EVP_PKEY * pkey)3525 static int pkey_custom_param_check(EVP_PKEY *pkey)
3526 {
3527 return 0xbeef;
3528 }
3529
3530 static EVP_PKEY_METHOD *custom_pmeth;
3531 #endif
3532
test_EVP_PKEY_check(int i)3533 static int test_EVP_PKEY_check(int i)
3534 {
3535 int ret = 0;
3536 EVP_PKEY *pkey = NULL;
3537 EVP_PKEY_CTX *ctx = NULL;
3538 #ifndef OPENSSL_NO_DEPRECATED_3_0
3539 EVP_PKEY_CTX *ctx2 = NULL;
3540 #endif
3541 const APK_DATA *ak = &keycheckdata[i];
3542 const unsigned char *input = ak->kder;
3543 size_t input_len = ak->size;
3544 int expected_id = ak->evptype;
3545 int expected_check = ak->check;
3546 int expected_pub_check = ak->pub_check;
3547 int expected_param_check = ak->param_check;
3548 int type = ak->type;
3549
3550 if (!TEST_ptr(pkey = load_example_key(ak->keytype, input, input_len)))
3551 goto done;
3552 if (type == 0
3553 && !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id))
3554 goto done;
3555
3556 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq)))
3557 goto done;
3558
3559 if (!TEST_int_eq(EVP_PKEY_check(ctx), expected_check))
3560 goto done;
3561
3562 if (!TEST_int_eq(EVP_PKEY_public_check(ctx), expected_pub_check))
3563 goto done;
3564
3565 if (!TEST_int_eq(EVP_PKEY_param_check(ctx), expected_param_check))
3566 goto done;
3567
3568 #ifndef OPENSSL_NO_DEPRECATED_3_0
3569 ctx2 = EVP_PKEY_CTX_new_id(0xdefaced, NULL);
3570 /* assign the pkey directly, as an internal test */
3571 if (!EVP_PKEY_up_ref(pkey))
3572 goto done;
3573
3574 ctx2->pkey = pkey;
3575
3576 if (!TEST_int_eq(EVP_PKEY_check(ctx2), 0xbeef))
3577 goto done;
3578
3579 if (!TEST_int_eq(EVP_PKEY_public_check(ctx2), 0xbeef))
3580 goto done;
3581
3582 if (!TEST_int_eq(EVP_PKEY_param_check(ctx2), 0xbeef))
3583 goto done;
3584 #endif
3585
3586 ret = 1;
3587
3588 done:
3589 EVP_PKEY_CTX_free(ctx);
3590 #ifndef OPENSSL_NO_DEPRECATED_3_0
3591 EVP_PKEY_CTX_free(ctx2);
3592 #endif
3593 EVP_PKEY_free(pkey);
3594 return ret;
3595 }
3596
3597 #ifndef OPENSSL_NO_CMAC
get_cmac_val(EVP_PKEY * pkey,unsigned char * mac)3598 static int get_cmac_val(EVP_PKEY *pkey, unsigned char *mac)
3599 {
3600 EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
3601 const char msg[] = "Hello World";
3602 size_t maclen = AES_BLOCK_SIZE;
3603 int ret = 1;
3604
3605 if (!TEST_ptr(mdctx)
3606 || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, NULL, testctx,
3607 testpropq, pkey, NULL))
3608 || !TEST_true(EVP_DigestSignUpdate(mdctx, msg, sizeof(msg)))
3609 || !TEST_true(EVP_DigestSignFinal(mdctx, mac, &maclen))
3610 || !TEST_size_t_eq(maclen, AES_BLOCK_SIZE))
3611 ret = 0;
3612
3613 EVP_MD_CTX_free(mdctx);
3614
3615 return ret;
3616 }
test_CMAC_keygen(void)3617 static int test_CMAC_keygen(void)
3618 {
3619 static unsigned char key[] = {
3620 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
3621 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
3622 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
3623 };
3624 EVP_PKEY_CTX *kctx = NULL;
3625 int ret = 0;
3626 EVP_PKEY *pkey = NULL;
3627 unsigned char mac[AES_BLOCK_SIZE];
3628 #if !defined(OPENSSL_NO_DEPRECATED_3_0)
3629 unsigned char mac2[AES_BLOCK_SIZE];
3630 #endif
3631
3632 if (nullprov != NULL)
3633 return TEST_skip("Test does not support a non-default library context");
3634
3635 /*
3636 * This is a legacy method for CMACs, but should still work.
3637 * This verifies that it works without an ENGINE.
3638 */
3639 kctx = EVP_PKEY_CTX_new_id(EVP_PKEY_CMAC, NULL);
3640
3641 /* Test a CMAC key created using the "generated" method */
3642 if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0)
3643 || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN,
3644 EVP_PKEY_CTRL_CIPHER,
3645 0, (void *)EVP_aes_256_cbc()),
3646 0)
3647 || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN,
3648 EVP_PKEY_CTRL_SET_MAC_KEY,
3649 sizeof(key), (void *)key),
3650 0)
3651 || !TEST_int_gt(EVP_PKEY_keygen(kctx, &pkey), 0)
3652 || !TEST_ptr(pkey)
3653 || !TEST_true(get_cmac_val(pkey, mac)))
3654 goto done;
3655
3656 #if !defined(OPENSSL_NO_DEPRECATED_3_0)
3657 EVP_PKEY_free(pkey);
3658
3659 /*
3660 * Test a CMAC key using the direct method, and compare with the mac
3661 * created above.
3662 */
3663 pkey = EVP_PKEY_new_CMAC_key(NULL, key, sizeof(key), EVP_aes_256_cbc());
3664 if (!TEST_ptr(pkey)
3665 || !TEST_true(get_cmac_val(pkey, mac2))
3666 || !TEST_mem_eq(mac, sizeof(mac), mac2, sizeof(mac2)))
3667 goto done;
3668 #endif
3669
3670 ret = 1;
3671
3672 done:
3673 EVP_PKEY_free(pkey);
3674 EVP_PKEY_CTX_free(kctx);
3675 return ret;
3676 }
3677 #endif
3678
test_HKDF(void)3679 static int test_HKDF(void)
3680 {
3681 EVP_PKEY_CTX *pctx;
3682 unsigned char out[20];
3683 size_t outlen;
3684 int i, ret = 0;
3685 unsigned char salt[] = "0123456789";
3686 unsigned char key[] = "012345678901234567890123456789";
3687 unsigned char info[] = "infostring";
3688 const unsigned char expected[] = {
3689 0xe5, 0x07, 0x70, 0x7f, 0xc6, 0x78, 0xd6, 0x54, 0x32, 0x5f, 0x7e, 0xc5,
3690 0x7b, 0x59, 0x3e, 0xd8, 0x03, 0x6b, 0xed, 0xca
3691 };
3692 size_t expectedlen = sizeof(expected);
3693
3694 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq)))
3695 goto done;
3696
3697 /* We do this twice to test reuse of the EVP_PKEY_CTX */
3698 for (i = 0; i < 2; i++) {
3699 outlen = sizeof(out);
3700 memset(out, 0, outlen);
3701
3702 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0)
3703 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0)
3704 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt,
3705 sizeof(salt) - 1),
3706 0)
3707 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key,
3708 sizeof(key) - 1),
3709 0)
3710 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info,
3711 sizeof(info) - 1),
3712 0)
3713 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0)
3714 || !TEST_mem_eq(out, outlen, expected, expectedlen))
3715 goto done;
3716 }
3717
3718 ret = 1;
3719
3720 done:
3721 EVP_PKEY_CTX_free(pctx);
3722
3723 return ret;
3724 }
3725
test_emptyikm_HKDF(void)3726 static int test_emptyikm_HKDF(void)
3727 {
3728 EVP_PKEY_CTX *pctx;
3729 unsigned char out[20];
3730 size_t outlen;
3731 int ret = 0;
3732 unsigned char salt[] = "9876543210";
3733 unsigned char key[] = "";
3734 unsigned char info[] = "stringinfo";
3735 const unsigned char expected[] = {
3736 0x68, 0x81, 0xa5, 0x3e, 0x5b, 0x9c, 0x7b, 0x6f, 0x2e, 0xec, 0xc8, 0x47,
3737 0x7c, 0xfa, 0x47, 0x35, 0x66, 0x82, 0x15, 0x30
3738 };
3739 size_t expectedlen = sizeof(expected);
3740
3741 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq)))
3742 goto done;
3743
3744 outlen = sizeof(out);
3745 memset(out, 0, outlen);
3746
3747 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0)
3748 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0)
3749 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt,
3750 sizeof(salt) - 1),
3751 0)
3752 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key,
3753 sizeof(key) - 1),
3754 0)
3755 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info,
3756 sizeof(info) - 1),
3757 0)
3758 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0)
3759 || !TEST_mem_eq(out, outlen, expected, expectedlen))
3760 goto done;
3761
3762 ret = 1;
3763
3764 done:
3765 EVP_PKEY_CTX_free(pctx);
3766
3767 return ret;
3768 }
3769
test_empty_salt_info_HKDF(void)3770 static int test_empty_salt_info_HKDF(void)
3771 {
3772 EVP_PKEY_CTX *pctx;
3773 unsigned char out[20];
3774 size_t outlen;
3775 int ret = 0;
3776 unsigned char salt[] = "";
3777 unsigned char fake[] = "0123456789";
3778 unsigned char key[] = "012345678901234567890123456789";
3779 unsigned char info[] = "";
3780 const unsigned char expected[] = {
3781 0x67, 0x12, 0xf9, 0x27, 0x8a, 0x8a, 0x3a, 0x8f, 0x7d, 0x2c, 0xa3, 0x6a,
3782 0xaa, 0xe9, 0xb3, 0xb9, 0x52, 0x5f, 0xe0, 0x06
3783 };
3784 size_t expectedlen = sizeof(expected);
3785
3786 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq)))
3787 goto done;
3788
3789 outlen = sizeof(out);
3790 memset(out, 0, outlen);
3791
3792 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0)
3793 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0)
3794 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, fake,
3795 sizeof(fake) - 1),
3796 0)
3797 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt,
3798 sizeof(salt) - 1),
3799 0)
3800 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key,
3801 sizeof(key) - 1),
3802 0)
3803 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info,
3804 sizeof(info) - 1),
3805 0)
3806 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0)
3807 || !TEST_mem_eq(out, outlen, expected, expectedlen))
3808 goto done;
3809
3810 ret = 1;
3811
3812 done:
3813 EVP_PKEY_CTX_free(pctx);
3814
3815 return ret;
3816 }
3817
3818 #ifndef OPENSSL_NO_EC
test_X509_PUBKEY_inplace(void)3819 static int test_X509_PUBKEY_inplace(void)
3820 {
3821 int ret = 0;
3822 X509_PUBKEY *xp = X509_PUBKEY_new_ex(testctx, testpropq);
3823 const unsigned char *p = kExampleECPubKeyDER;
3824 size_t input_len = sizeof(kExampleECPubKeyDER);
3825
3826 if (!TEST_ptr(xp))
3827 goto done;
3828 if (!TEST_ptr(d2i_X509_PUBKEY(&xp, &p, input_len)))
3829 goto done;
3830
3831 if (!TEST_ptr(X509_PUBKEY_get0(xp)))
3832 goto done;
3833
3834 p = kExampleBadECPubKeyDER;
3835 input_len = sizeof(kExampleBadECPubKeyDER);
3836
3837 if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, input_len)))
3838 goto done;
3839
3840 if (!TEST_true(X509_PUBKEY_get0(xp) == NULL))
3841 goto done;
3842
3843 ret = 1;
3844
3845 done:
3846 X509_PUBKEY_free(xp);
3847 return ret;
3848 }
3849
test_X509_PUBKEY_dup(void)3850 static int test_X509_PUBKEY_dup(void)
3851 {
3852 int ret = 0;
3853 X509_PUBKEY *xp = NULL, *xq = NULL;
3854 const unsigned char *p = kExampleECPubKeyDER;
3855 size_t input_len = sizeof(kExampleECPubKeyDER);
3856
3857 xp = X509_PUBKEY_new_ex(testctx, testpropq);
3858 if (!TEST_ptr(xp)
3859 || !TEST_ptr(d2i_X509_PUBKEY(&xp, &p, input_len))
3860 || !TEST_ptr(xq = X509_PUBKEY_dup(xp))
3861 || !TEST_ptr_ne(xp, xq))
3862 goto done;
3863
3864 if (!TEST_ptr(X509_PUBKEY_get0(xq))
3865 || !TEST_ptr(X509_PUBKEY_get0(xp))
3866 || !TEST_ptr_ne(X509_PUBKEY_get0(xq), X509_PUBKEY_get0(xp)))
3867 goto done;
3868
3869 X509_PUBKEY_free(xq);
3870 xq = NULL;
3871 p = kExampleBadECPubKeyDER;
3872 input_len = sizeof(kExampleBadECPubKeyDER);
3873
3874 if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, input_len))
3875 || !TEST_ptr(xq = X509_PUBKEY_dup(xp)))
3876 goto done;
3877
3878 X509_PUBKEY_free(xp);
3879 xp = NULL;
3880 if (!TEST_true(X509_PUBKEY_get0(xq) == NULL))
3881 goto done;
3882
3883 ret = 1;
3884
3885 done:
3886 X509_PUBKEY_free(xp);
3887 X509_PUBKEY_free(xq);
3888 return ret;
3889 }
3890 #endif /* OPENSSL_NO_EC */
3891
3892 /* Test getting and setting parameters on an EVP_PKEY_CTX */
test_EVP_PKEY_CTX_get_set_params(EVP_PKEY * pkey)3893 static int test_EVP_PKEY_CTX_get_set_params(EVP_PKEY *pkey)
3894 {
3895 EVP_MD_CTX *mdctx = NULL;
3896 EVP_PKEY_CTX *ctx = NULL;
3897 const OSSL_PARAM *params;
3898 OSSL_PARAM ourparams[2], *param = ourparams, *param_md;
3899 int ret = 0;
3900 const EVP_MD *md;
3901 char mdname[OSSL_MAX_NAME_SIZE];
3902 char ssl3ms[48];
3903
3904 /* Initialise a sign operation */
3905 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq);
3906 if (!TEST_ptr(ctx)
3907 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0))
3908 goto err;
3909
3910 /*
3911 * We should be able to query the parameters now.
3912 */
3913 params = EVP_PKEY_CTX_settable_params(ctx);
3914 if (!TEST_ptr(params)
3915 || !TEST_ptr(OSSL_PARAM_locate_const(params,
3916 OSSL_SIGNATURE_PARAM_DIGEST)))
3917 goto err;
3918
3919 params = EVP_PKEY_CTX_gettable_params(ctx);
3920 if (!TEST_ptr(params)
3921 || !TEST_ptr(OSSL_PARAM_locate_const(params,
3922 OSSL_SIGNATURE_PARAM_ALGORITHM_ID))
3923 || !TEST_ptr(OSSL_PARAM_locate_const(params,
3924 OSSL_SIGNATURE_PARAM_DIGEST)))
3925 goto err;
3926
3927 /*
3928 * Test getting and setting params via EVP_PKEY_CTX_set_params() and
3929 * EVP_PKEY_CTX_get_params()
3930 */
3931 strcpy(mdname, "SHA512");
3932 param_md = param;
3933 *param++ = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST,
3934 mdname, 0);
3935 *param++ = OSSL_PARAM_construct_end();
3936
3937 if (!TEST_true(EVP_PKEY_CTX_set_params(ctx, ourparams)))
3938 goto err;
3939
3940 mdname[0] = '\0';
3941 *param_md = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST,
3942 mdname, sizeof(mdname));
3943 if (!TEST_true(EVP_PKEY_CTX_get_params(ctx, ourparams))
3944 || !TEST_str_eq(mdname, "SHA512"))
3945 goto err;
3946
3947 /*
3948 * Test the TEST_PKEY_CTX_set_signature_md() and
3949 * TEST_PKEY_CTX_get_signature_md() functions
3950 */
3951 if (!TEST_int_gt(EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()), 0)
3952 || !TEST_int_gt(EVP_PKEY_CTX_get_signature_md(ctx, &md), 0)
3953 || !TEST_ptr_eq(md, EVP_sha256()))
3954 goto err;
3955
3956 /*
3957 * Test getting MD parameters via an associated EVP_PKEY_CTX
3958 */
3959 mdctx = EVP_MD_CTX_new();
3960 if (!TEST_ptr(mdctx)
3961 || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, "SHA1", testctx, testpropq,
3962 pkey, NULL)))
3963 goto err;
3964
3965 /*
3966 * We now have an EVP_MD_CTX with an EVP_PKEY_CTX inside it. We should be
3967 * able to obtain the digest's settable parameters from the provider.
3968 */
3969 params = EVP_MD_CTX_settable_params(mdctx);
3970 if (!TEST_ptr(params)
3971 || !TEST_int_eq(strcmp(params[0].key, OSSL_DIGEST_PARAM_SSL3_MS), 0)
3972 /* The final key should be NULL */
3973 || !TEST_ptr_null(params[1].key))
3974 goto err;
3975
3976 param = ourparams;
3977 memset(ssl3ms, 0, sizeof(ssl3ms));
3978 *param++ = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS,
3979 ssl3ms, sizeof(ssl3ms));
3980 *param++ = OSSL_PARAM_construct_end();
3981
3982 if (!TEST_true(EVP_MD_CTX_set_params(mdctx, ourparams)))
3983 goto err;
3984
3985 ret = 1;
3986
3987 err:
3988 EVP_MD_CTX_free(mdctx);
3989 EVP_PKEY_CTX_free(ctx);
3990
3991 return ret;
3992 }
3993
3994 #ifndef OPENSSL_NO_DSA
test_DSA_get_set_params(void)3995 static int test_DSA_get_set_params(void)
3996 {
3997 OSSL_PARAM_BLD *bld = NULL;
3998 OSSL_PARAM *params = NULL;
3999 BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL;
4000 EVP_PKEY_CTX *pctx = NULL;
4001 EVP_PKEY *pkey = NULL;
4002 int ret = 0;
4003
4004 /*
4005 * Setup the parameters for our DSA object. For our purposes they don't
4006 * have to actually be *valid* parameters. We just need to set something.
4007 */
4008 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DSA", NULL))
4009 || !TEST_ptr(bld = OSSL_PARAM_BLD_new())
4010 || !TEST_ptr(p = BN_new())
4011 || !TEST_ptr(q = BN_new())
4012 || !TEST_ptr(g = BN_new())
4013 || !TEST_ptr(pub = BN_new())
4014 || !TEST_ptr(priv = BN_new()))
4015 goto err;
4016 if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
4017 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q))
4018 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
4019 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY,
4020 pub))
4021 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
4022 priv)))
4023 goto err;
4024 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)))
4025 goto err;
4026
4027 if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
4028 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR,
4029 params),
4030 0))
4031 goto err;
4032
4033 if (!TEST_ptr(pkey))
4034 goto err;
4035
4036 ret = test_EVP_PKEY_CTX_get_set_params(pkey);
4037
4038 err:
4039 EVP_PKEY_free(pkey);
4040 EVP_PKEY_CTX_free(pctx);
4041 OSSL_PARAM_free(params);
4042 OSSL_PARAM_BLD_free(bld);
4043 BN_free(p);
4044 BN_free(q);
4045 BN_free(g);
4046 BN_free(pub);
4047 BN_free(priv);
4048
4049 return ret;
4050 }
4051
4052 /*
4053 * Test combinations of private, public, missing and private + public key
4054 * params to ensure they are all accepted
4055 */
test_DSA_priv_pub(void)4056 static int test_DSA_priv_pub(void)
4057 {
4058 return test_EVP_PKEY_ffc_priv_pub("DSA");
4059 }
4060
4061 #endif /* !OPENSSL_NO_DSA */
4062
test_RSA_get_set_params(void)4063 static int test_RSA_get_set_params(void)
4064 {
4065 OSSL_PARAM_BLD *bld = NULL;
4066 OSSL_PARAM *params = NULL;
4067 BIGNUM *n = NULL, *e = NULL, *d = NULL;
4068 EVP_PKEY_CTX *pctx = NULL;
4069 EVP_PKEY *pkey = NULL;
4070 int ret = 0;
4071
4072 /*
4073 * Setup the parameters for our RSA object. For our purposes they don't
4074 * have to actually be *valid* parameters. We just need to set something.
4075 */
4076 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL))
4077 || !TEST_ptr(bld = OSSL_PARAM_BLD_new())
4078 || !TEST_ptr(n = BN_new())
4079 || !TEST_ptr(e = BN_new())
4080 || !TEST_ptr(d = BN_new()))
4081 goto err;
4082 if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n))
4083 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e))
4084 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_D, d)))
4085 goto err;
4086 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)))
4087 goto err;
4088
4089 if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
4090 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR,
4091 params),
4092 0))
4093 goto err;
4094
4095 if (!TEST_ptr(pkey))
4096 goto err;
4097
4098 ret = test_EVP_PKEY_CTX_get_set_params(pkey);
4099
4100 err:
4101 EVP_PKEY_free(pkey);
4102 EVP_PKEY_CTX_free(pctx);
4103 OSSL_PARAM_free(params);
4104 OSSL_PARAM_BLD_free(bld);
4105 BN_free(n);
4106 BN_free(e);
4107 BN_free(d);
4108
4109 return ret;
4110 }
4111
test_RSA_OAEP_set_get_params(void)4112 static int test_RSA_OAEP_set_get_params(void)
4113 {
4114 int ret = 0;
4115 EVP_PKEY *key = NULL;
4116 EVP_PKEY_CTX *key_ctx = NULL;
4117
4118 if (nullprov != NULL)
4119 return TEST_skip("Test does not support a non-default library context");
4120
4121 if (!TEST_ptr(key = load_example_rsa_key())
4122 || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(0, key, 0)))
4123 goto err;
4124
4125 {
4126 int padding = RSA_PKCS1_OAEP_PADDING;
4127 OSSL_PARAM params[4];
4128
4129 params[0] = OSSL_PARAM_construct_int(OSSL_SIGNATURE_PARAM_PAD_MODE, &padding);
4130 params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST,
4131 OSSL_DIGEST_NAME_SHA2_256, 0);
4132 params[2] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST,
4133 OSSL_DIGEST_NAME_SHA1, 0);
4134 params[3] = OSSL_PARAM_construct_end();
4135
4136 if (!TEST_int_gt(EVP_PKEY_encrypt_init_ex(key_ctx, params), 0))
4137 goto err;
4138 }
4139 {
4140 OSSL_PARAM params[3];
4141 char oaepmd[30] = { '\0' };
4142 char mgf1md[30] = { '\0' };
4143
4144 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST,
4145 oaepmd, sizeof(oaepmd));
4146 params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST,
4147 mgf1md, sizeof(mgf1md));
4148 params[2] = OSSL_PARAM_construct_end();
4149
4150 if (!TEST_true(EVP_PKEY_CTX_get_params(key_ctx, params)))
4151 goto err;
4152
4153 if (!TEST_str_eq(oaepmd, OSSL_DIGEST_NAME_SHA2_256)
4154 || !TEST_str_eq(mgf1md, OSSL_DIGEST_NAME_SHA1))
4155 goto err;
4156 }
4157
4158 ret = 1;
4159
4160 err:
4161 EVP_PKEY_free(key);
4162 EVP_PKEY_CTX_free(key_ctx);
4163
4164 return ret;
4165 }
4166
4167 /* https://github.com/openssl/openssl/issues/21288 */
test_RSA_OAEP_set_null_label(void)4168 static int test_RSA_OAEP_set_null_label(void)
4169 {
4170 int ret = 0;
4171 EVP_PKEY *key = NULL;
4172 EVP_PKEY_CTX *key_ctx = NULL;
4173
4174 if (!TEST_ptr(key = load_example_rsa_key())
4175 || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, key, NULL))
4176 || !TEST_true(EVP_PKEY_encrypt_init(key_ctx)))
4177 goto err;
4178
4179 if (!TEST_true(EVP_PKEY_CTX_set_rsa_padding(key_ctx, RSA_PKCS1_OAEP_PADDING)))
4180 goto err;
4181
4182 if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, OPENSSL_strdup("foo"), 0)))
4183 goto err;
4184
4185 if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, NULL, 0)))
4186 goto err;
4187
4188 ret = 1;
4189
4190 err:
4191 EVP_PKEY_free(key);
4192 EVP_PKEY_CTX_free(key_ctx);
4193
4194 return ret;
4195 }
4196
test_RSA_verify_recover_rejects_short_buffer(void)4197 static int test_RSA_verify_recover_rejects_short_buffer(void)
4198 {
4199 int ret = 0;
4200 int recovered_cap = 0;
4201 EVP_PKEY *pkey = NULL;
4202 EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL;
4203 unsigned char *sig = NULL, *recovered = NULL;
4204 size_t sig_len = 0, recovered_len = 0;
4205 unsigned long err = 0;
4206 unsigned char shortbuf[] = { 0xa5, 0x5a };
4207 const unsigned char shortbuf_expected[] = { 0xa5, 0x5a };
4208 unsigned char digest[32];
4209 size_t i;
4210
4211 for (i = 0; i < sizeof(digest); i++)
4212 digest[i] = (unsigned char)i;
4213
4214 if (OSSL_PROVIDER_available(testctx, "fips"))
4215 return TEST_skip("Test skipped for FIPS provider");
4216
4217 if (!TEST_ptr(pkey = load_example_rsa_key())
4218 || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL))
4219 || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0)
4220 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx,
4221 RSA_PKCS1_PADDING),
4222 0)
4223 || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(sign_ctx, EVP_sha256()),
4224 0)
4225 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, digest,
4226 sizeof(digest)),
4227 0)
4228 || !TEST_ptr(sig = OPENSSL_malloc(sig_len))
4229 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, digest,
4230 sizeof(digest)),
4231 0)
4232 || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0)
4233 || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap))
4234 || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey,
4235 NULL))
4236 || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0)
4237 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx,
4238 RSA_PKCS1_PADDING),
4239 0)
4240 || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(verify_ctx, EVP_sha256()),
4241 0))
4242 goto done;
4243
4244 recovered_len = (size_t)recovered_cap;
4245 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered,
4246 &recovered_len, sig, sig_len),
4247 0)
4248 || !TEST_size_t_eq(recovered_len, sizeof(digest))
4249 || !TEST_mem_eq(recovered, recovered_len, digest, sizeof(digest)))
4250 goto done;
4251
4252 ERR_clear_error();
4253 recovered_len = 1;
4254 if (!TEST_int_le(EVP_PKEY_verify_recover(verify_ctx, shortbuf,
4255 &recovered_len, sig, sig_len),
4256 0))
4257 goto done;
4258
4259 err = ERR_peek_error();
4260 if (!TEST_int_eq(ERR_GET_LIB(err), ERR_LIB_PROV)
4261 || !TEST_int_eq(ERR_GET_REASON(err), PROV_R_OUTPUT_BUFFER_TOO_SMALL)
4262 || !TEST_mem_eq(shortbuf, sizeof(shortbuf), shortbuf_expected,
4263 sizeof(shortbuf_expected)))
4264 goto done;
4265
4266 ret = 1;
4267 done:
4268 EVP_PKEY_CTX_free(sign_ctx);
4269 EVP_PKEY_CTX_free(verify_ctx);
4270 EVP_PKEY_free(pkey);
4271 OPENSSL_free(sig);
4272 OPENSSL_free(recovered);
4273 return ret;
4274 }
4275
4276 /*
4277 * A raw RSA PKCS#1 v1.5 signature whose recovered data is empty must be
4278 * recovered successfully with a length of zero, not rejected as an error.
4279 */
test_RSA_verify_recover_empty_payload(void)4280 static int test_RSA_verify_recover_empty_payload(void)
4281 {
4282 int ret = 0;
4283 int recovered_cap = 0;
4284 EVP_PKEY *pkey = NULL;
4285 EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL;
4286 unsigned char *sig = NULL, *recovered = NULL;
4287 size_t sig_len = 0, recovered_len = 0;
4288 /*
4289 * The signed input has zero length, but a valid non-null address is still
4290 * passed so the result does not depend on how lower layers treat NULL for
4291 * zero-length data.
4292 */
4293 const unsigned char empty[] = { 0 };
4294
4295 if (OSSL_PROVIDER_available(testctx, "fips"))
4296 return TEST_skip("Test skipped for FIPS provider");
4297
4298 if (!TEST_ptr(pkey = load_example_rsa_key())
4299 || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL))
4300 || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0)
4301 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx, RSA_PKCS1_PADDING), 0)
4302 /*
4303 * Deliberately do not configure a signature digest so that the raw
4304 * PKCS#1 v1.5 sign and verify-recover paths are exercised.
4305 */
4306 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, empty, 0), 0)
4307 || !TEST_ptr(sig = OPENSSL_malloc(sig_len))
4308 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, empty, 0), 0)
4309 || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0)
4310 || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap))
4311 || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL))
4312 || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0)
4313 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx, RSA_PKCS1_PADDING),
4314 0))
4315 goto done;
4316
4317 /* Size-query call must succeed. */
4318 recovered_len = (size_t)recovered_cap;
4319 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, NULL,
4320 &recovered_len, sig, sig_len),
4321 0))
4322 goto done;
4323
4324 /*
4325 * The actual recovery call is essential: a NULL output buffer would only
4326 * run the size-query path, which never decodes the signature and so would
4327 * not reproduce the regression.
4328 */
4329 recovered_len = (size_t)recovered_cap;
4330 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered,
4331 &recovered_len, sig, sig_len),
4332 0)
4333 || !TEST_size_t_eq(recovered_len, 0))
4334 goto done;
4335
4336 ret = 1;
4337 done:
4338 EVP_PKEY_CTX_free(sign_ctx);
4339 EVP_PKEY_CTX_free(verify_ctx);
4340 EVP_PKEY_free(pkey);
4341 OPENSSL_free(sig);
4342 OPENSSL_free(recovered);
4343 return ret;
4344 }
4345
test_RSA_encrypt(void)4346 static int test_RSA_encrypt(void)
4347 {
4348 int ret = 0;
4349 EVP_PKEY *pkey = NULL;
4350 EVP_PKEY_CTX *pctx = NULL;
4351 unsigned char *cbuf = NULL, *pbuf = NULL;
4352 size_t clen = 0, plen = 0;
4353
4354 if (!TEST_ptr(pkey = load_example_rsa_key())
4355 || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx,
4356 pkey, testpropq))
4357 || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0)
4358 || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0)
4359 || !TEST_ptr(cbuf = OPENSSL_malloc(clen))
4360 || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0))
4361 goto done;
4362
4363 /* Require failure when the output buffer is too small */
4364 plen = clen - 1;
4365 if (!TEST_int_le(EVP_PKEY_encrypt(pctx, cbuf, &plen, kMsg, sizeof(kMsg)), 0))
4366 goto done;
4367 /* flush error stack */
4368 TEST_openssl_errors();
4369
4370 /* Check decryption of encrypted result */
4371 if (!TEST_int_gt(EVP_PKEY_decrypt_init(pctx), 0)
4372 || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0)
4373 || !TEST_ptr(pbuf = OPENSSL_malloc(plen))
4374 || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0)
4375 || !TEST_mem_eq(pbuf, plen, kMsg, sizeof(kMsg))
4376 || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0))
4377 goto done;
4378
4379 ret = 1;
4380 done:
4381 EVP_PKEY_CTX_free(pctx);
4382 EVP_PKEY_free(pkey);
4383 OPENSSL_free(cbuf);
4384 OPENSSL_free(pbuf);
4385 return ret;
4386 }
4387
4388 #ifndef OPENSSL_NO_DEPRECATED_3_0
test_RSA_legacy(void)4389 static int test_RSA_legacy(void)
4390 {
4391 int ret = 0;
4392 BIGNUM *p = NULL;
4393 BIGNUM *q = NULL;
4394 BIGNUM *n = NULL;
4395 BIGNUM *e = NULL;
4396 BIGNUM *d = NULL;
4397 const EVP_MD *md = EVP_sha256();
4398 EVP_MD_CTX *ctx = NULL;
4399 EVP_PKEY *pkey = NULL;
4400 RSA *rsa = NULL;
4401
4402 if (nullprov != NULL)
4403 return TEST_skip("Test does not support a non-default library context");
4404
4405 if (!TEST_ptr(p = BN_dup(BN_value_one()))
4406 || !TEST_ptr(q = BN_dup(BN_value_one()))
4407 || !TEST_ptr(n = BN_dup(BN_value_one()))
4408 || !TEST_ptr(e = BN_dup(BN_value_one()))
4409 || !TEST_ptr(d = BN_dup(BN_value_one())))
4410 goto err;
4411
4412 if (!TEST_ptr(rsa = RSA_new())
4413 || !TEST_ptr(pkey = EVP_PKEY_new())
4414 || !TEST_ptr(ctx = EVP_MD_CTX_new()))
4415 goto err;
4416
4417 if (!TEST_true(RSA_set0_factors(rsa, p, q)))
4418 goto err;
4419 p = NULL;
4420 q = NULL;
4421
4422 if (!TEST_true(RSA_set0_key(rsa, n, e, d)))
4423 goto err;
4424 n = NULL;
4425 e = NULL;
4426 d = NULL;
4427
4428 if (!TEST_true(EVP_PKEY_assign_RSA(pkey, rsa)))
4429 goto err;
4430
4431 rsa = NULL;
4432
4433 if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey)))
4434 goto err;
4435
4436 ret = 1;
4437
4438 err:
4439 RSA_free(rsa);
4440 EVP_MD_CTX_free(ctx);
4441 EVP_PKEY_free(pkey);
4442 BN_free(p);
4443 BN_free(q);
4444 BN_free(n);
4445 BN_free(e);
4446 BN_free(d);
4447
4448 return ret;
4449 }
4450 #endif
4451
4452 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
test_decrypt_null_chunks(void)4453 static int test_decrypt_null_chunks(void)
4454 {
4455 EVP_CIPHER_CTX *ctx = NULL;
4456 EVP_CIPHER *cipher = NULL;
4457 const unsigned char key[32] = {
4458 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
4459 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
4460 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1
4461 };
4462 unsigned char iv[12] = {
4463 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
4464 };
4465 unsigned char msg[] = "It was the best of times, it was the worst of times";
4466 unsigned char ciphertext[80];
4467 unsigned char plaintext[80];
4468 /* We initialise tmp to a non zero value on purpose */
4469 int ctlen, ptlen, tmp = 99;
4470 int ret = 0;
4471 const int enc_offset = 10, dec_offset = 20;
4472
4473 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "ChaCha20-Poly1305", testpropq))
4474 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new())
4475 || !TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL,
4476 key, iv))
4477 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &ctlen, msg,
4478 enc_offset))
4479 /* Deliberate add a zero length update */
4480 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp, NULL,
4481 0))
4482 || !TEST_int_eq(tmp, 0)
4483 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp,
4484 msg + enc_offset,
4485 sizeof(msg) - enc_offset))
4486 || !TEST_int_eq(ctlen += tmp, sizeof(msg))
4487 || !TEST_true(EVP_EncryptFinal(ctx, ciphertext + ctlen, &tmp))
4488 || !TEST_int_eq(tmp, 0))
4489 goto err;
4490
4491 /* Deliberately initialise tmp to a non zero value */
4492 tmp = 99;
4493 if (!TEST_true(EVP_DecryptInit_ex(ctx, cipher, NULL, key, iv))
4494 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext, &ptlen, ciphertext,
4495 dec_offset))
4496 /*
4497 * Deliberately add a zero length update. We also deliberately do
4498 * this at a different offset than for encryption.
4499 */
4500 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp, NULL,
4501 0))
4502 || !TEST_int_eq(tmp, 0)
4503 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp,
4504 ciphertext + dec_offset,
4505 ctlen - dec_offset))
4506 || !TEST_int_eq(ptlen += tmp, sizeof(msg))
4507 || !TEST_true(EVP_DecryptFinal(ctx, plaintext + ptlen, &tmp))
4508 || !TEST_int_eq(tmp, 0)
4509 || !TEST_mem_eq(msg, sizeof(msg), plaintext, ptlen))
4510 goto err;
4511
4512 ret = 1;
4513 err:
4514 EVP_CIPHER_CTX_free(ctx);
4515 EVP_CIPHER_free(cipher);
4516 return ret;
4517 }
4518 #endif /* !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) */
4519
4520 #ifndef OPENSSL_NO_DH
4521 /*
4522 * Test combinations of private, public, missing and private + public key
4523 * params to ensure they are all accepted
4524 */
test_DH_priv_pub(void)4525 static int test_DH_priv_pub(void)
4526 {
4527 return test_EVP_PKEY_ffc_priv_pub("DH");
4528 }
4529
4530 #ifndef OPENSSL_NO_DEPRECATED_3_0
test_EVP_PKEY_set1_DH(void)4531 static int test_EVP_PKEY_set1_DH(void)
4532 {
4533 DH *x942dh = NULL, *noqdh = NULL;
4534 EVP_PKEY *pkey1 = NULL, *pkey2 = NULL;
4535 int ret = 0;
4536 BIGNUM *p, *g = NULL;
4537 BIGNUM *pubkey = NULL;
4538 unsigned char pub[2048 / 8];
4539 size_t len = 0;
4540
4541 if (!TEST_ptr(p = BN_new())
4542 || !TEST_ptr(g = BN_new())
4543 || !TEST_ptr(pubkey = BN_new())
4544 || !TEST_true(BN_set_word(p, 9999))
4545 || !TEST_true(BN_set_word(g, 2))
4546 || !TEST_true(BN_set_word(pubkey, 4321))
4547 || !TEST_ptr(noqdh = DH_new())
4548 || !TEST_true(DH_set0_pqg(noqdh, p, NULL, g))
4549 || !TEST_true(DH_set0_key(noqdh, pubkey, NULL))
4550 || !TEST_ptr(pubkey = BN_new())
4551 || !TEST_true(BN_set_word(pubkey, 4321)))
4552 goto err;
4553 p = g = NULL;
4554
4555 x942dh = DH_get_2048_256();
4556 pkey1 = EVP_PKEY_new();
4557 pkey2 = EVP_PKEY_new();
4558 if (!TEST_ptr(x942dh)
4559 || !TEST_ptr(noqdh)
4560 || !TEST_ptr(pkey1)
4561 || !TEST_ptr(pkey2)
4562 || !TEST_true(DH_set0_key(x942dh, pubkey, NULL)))
4563 goto err;
4564 pubkey = NULL;
4565
4566 if (!TEST_true(EVP_PKEY_set1_DH(pkey1, x942dh))
4567 || !TEST_int_eq(EVP_PKEY_get_id(pkey1), EVP_PKEY_DHX))
4568 goto err;
4569
4570 if (!TEST_true(EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PUB_KEY,
4571 &pubkey))
4572 || !TEST_ptr(pubkey))
4573 goto err;
4574
4575 if (!TEST_true(EVP_PKEY_set1_DH(pkey2, noqdh))
4576 || !TEST_int_eq(EVP_PKEY_get_id(pkey2), EVP_PKEY_DH))
4577 goto err;
4578
4579 if (!TEST_true(EVP_PKEY_get_octet_string_param(pkey2,
4580 OSSL_PKEY_PARAM_PUB_KEY,
4581 pub, sizeof(pub), &len))
4582 || !TEST_size_t_ne(len, 0))
4583 goto err;
4584
4585 ret = 1;
4586 err:
4587 BN_free(p);
4588 BN_free(g);
4589 BN_free(pubkey);
4590 EVP_PKEY_free(pkey1);
4591 EVP_PKEY_free(pkey2);
4592 DH_free(x942dh);
4593 DH_free(noqdh);
4594
4595 return ret;
4596 }
4597 #endif /* !OPENSSL_NO_DEPRECATED_3_0 */
4598
4599 /* Test that DHX (X9.42) rejects a malicious peer key during the
4600 * derivation phase (specifically EVP_PKEY_derive_set_peer) when the
4601 * remote 'q' does not match the local domain parameters but is still
4602 * consistent with the remote key share.
4603 * (CVE-2026-42770)
4604 */
test_dhx_derive_rejects_bad_peer_q(void)4605 static int test_dhx_derive_rejects_bad_peer_q(void)
4606 {
4607 int ret = 0;
4608 EVP_PKEY *local_key = NULL, *remote_key = NULL;
4609 EVP_PKEY_CTX *pctx = NULL, *derive_ctx = NULL;
4610 OSSL_PARAM_BLD *bld = NULL;
4611 OSSL_PARAM *params = NULL;
4612
4613 BIGNUM *p = NULL, *g = NULL;
4614 BIGNUM *q_valid = NULL, *pub_local = NULL, *priv_local = NULL;
4615 BIGNUM *q_bad = NULL, *pub_bad = NULL;
4616
4617 static const unsigned char bin_p[] = {
4618 0x87, 0xa8, 0xe6, 0x1d, 0xb4, 0xb6, 0x66, 0x3c,
4619 0xff, 0xbb, 0xd1, 0x9c, 0x65, 0x19, 0x59, 0x99,
4620 0x8c, 0xee, 0xf6, 0x08, 0x66, 0x0d, 0xd0, 0xf2,
4621 0x5d, 0x2c, 0xee, 0xd4, 0x43, 0x5e, 0x3b, 0x00,
4622 0xe0, 0x0d, 0xf8, 0xf1, 0xd6, 0x19, 0x57, 0xd4,
4623 0xfa, 0xf7, 0xdf, 0x45, 0x61, 0xb2, 0xaa, 0x30,
4624 0x16, 0xc3, 0xd9, 0x11, 0x34, 0x09, 0x6f, 0xaa,
4625 0x3b, 0xf4, 0x29, 0x6d, 0x83, 0x0e, 0x9a, 0x7c,
4626 0x20, 0x9e, 0x0c, 0x64, 0x97, 0x51, 0x7a, 0xbd,
4627 0x5a, 0x8a, 0x9d, 0x30, 0x6b, 0xcf, 0x67, 0xed,
4628 0x91, 0xf9, 0xe6, 0x72, 0x5b, 0x47, 0x58, 0xc0,
4629 0x22, 0xe0, 0xb1, 0xef, 0x42, 0x75, 0xbf, 0x7b,
4630 0x6c, 0x5b, 0xfc, 0x11, 0xd4, 0x5f, 0x90, 0x88,
4631 0xb9, 0x41, 0xf5, 0x4e, 0xb1, 0xe5, 0x9b, 0xb8,
4632 0xbc, 0x39, 0xa0, 0xbf, 0x12, 0x30, 0x7f, 0x5c,
4633 0x4f, 0xdb, 0x70, 0xc5, 0x81, 0xb2, 0x3f, 0x76,
4634 0xb6, 0x3a, 0xca, 0xe1, 0xca, 0xa6, 0xb7, 0x90,
4635 0x2d, 0x52, 0x52, 0x67, 0x35, 0x48, 0x8a, 0x0e,
4636 0xf1, 0x3c, 0x6d, 0x9a, 0x51, 0xbf, 0xa4, 0xab,
4637 0x3a, 0xd8, 0x34, 0x77, 0x96, 0x52, 0x4d, 0x8e,
4638 0xf6, 0xa1, 0x67, 0xb5, 0xa4, 0x18, 0x25, 0xd9,
4639 0x67, 0xe1, 0x44, 0xe5, 0x14, 0x05, 0x64, 0x25,
4640 0x1c, 0xca, 0xcb, 0x83, 0xe6, 0xb4, 0x86, 0xf6,
4641 0xb3, 0xca, 0x3f, 0x79, 0x71, 0x50, 0x60, 0x26,
4642 0xc0, 0xb8, 0x57, 0xf6, 0x89, 0x96, 0x28, 0x56,
4643 0xde, 0xd4, 0x01, 0x0a, 0xbd, 0x0b, 0xe6, 0x21,
4644 0xc3, 0xa3, 0x96, 0x0a, 0x54, 0xe7, 0x10, 0xc3,
4645 0x75, 0xf2, 0x63, 0x75, 0xd7, 0x01, 0x41, 0x03,
4646 0xa4, 0xb5, 0x43, 0x30, 0xc1, 0x98, 0xaf, 0x12,
4647 0x61, 0x16, 0xd2, 0x27, 0x6e, 0x11, 0x71, 0x5f,
4648 0x69, 0x38, 0x77, 0xfa, 0xd7, 0xef, 0x09, 0xca,
4649 0xdb, 0x09, 0x4a, 0xe9, 0x1e, 0x1a, 0x15, 0x97
4650 };
4651 static const unsigned char bin_g[] = {
4652 0x3F, 0xB3, 0x2C, 0x9B, 0x73, 0x13, 0x4D, 0x0B,
4653 0x2E, 0x77, 0x50, 0x66, 0x60, 0xED, 0xBD, 0x48,
4654 0x4C, 0xA7, 0xB1, 0x8F, 0x21, 0xEF, 0x20, 0x54,
4655 0x07, 0xF4, 0x79, 0x3A, 0x1A, 0x0B, 0xA1, 0x25,
4656 0x10, 0xDB, 0xC1, 0x50, 0x77, 0xBE, 0x46, 0x3F,
4657 0xFF, 0x4F, 0xED, 0x4A, 0xAC, 0x0B, 0xB5, 0x55,
4658 0xBE, 0x3A, 0x6C, 0x1B, 0x0C, 0x6B, 0x47, 0xB1,
4659 0xBC, 0x37, 0x73, 0xBF, 0x7E, 0x8C, 0x6F, 0x62,
4660 0x90, 0x12, 0x28, 0xF8, 0xC2, 0x8C, 0xBB, 0x18,
4661 0xA5, 0x5A, 0xE3, 0x13, 0x41, 0x00, 0x0A, 0x65,
4662 0x01, 0x96, 0xF9, 0x31, 0xC7, 0x7A, 0x57, 0xF2,
4663 0xDD, 0xF4, 0x63, 0xE5, 0xE9, 0xEC, 0x14, 0x4B,
4664 0x77, 0x7D, 0xE6, 0x2A, 0xAA, 0xB8, 0xA8, 0x62,
4665 0x8A, 0xC3, 0x76, 0xD2, 0x82, 0xD6, 0xED, 0x38,
4666 0x64, 0xE6, 0x79, 0x82, 0x42, 0x8E, 0xBC, 0x83,
4667 0x1D, 0x14, 0x34, 0x8F, 0x6F, 0x2F, 0x91, 0x93,
4668 0xB5, 0x04, 0x5A, 0xF2, 0x76, 0x71, 0x64, 0xE1,
4669 0xDF, 0xC9, 0x67, 0xC1, 0xFB, 0x3F, 0x2E, 0x55,
4670 0xA4, 0xBD, 0x1B, 0xFF, 0xE8, 0x3B, 0x9C, 0x80,
4671 0xD0, 0x52, 0xB9, 0x85, 0xD1, 0x82, 0xEA, 0x0A,
4672 0xDB, 0x2A, 0x3B, 0x73, 0x13, 0xD3, 0xFE, 0x14,
4673 0xC8, 0x48, 0x4B, 0x1E, 0x05, 0x25, 0x88, 0xB9,
4674 0xB7, 0xD2, 0xBB, 0xD2, 0xDF, 0x01, 0x61, 0x99,
4675 0xEC, 0xD0, 0x6E, 0x15, 0x57, 0xCD, 0x09, 0x15,
4676 0xB3, 0x35, 0x3B, 0xBB, 0x64, 0xE0, 0xEC, 0x37,
4677 0x7F, 0xD0, 0x28, 0x37, 0x0D, 0xF9, 0x2B, 0x52,
4678 0xC7, 0x89, 0x14, 0x28, 0xCD, 0xC6, 0x7E, 0xB6,
4679 0x18, 0x4B, 0x52, 0x3D, 0x1D, 0xB2, 0x46, 0xC3,
4680 0x2F, 0x63, 0x07, 0x84, 0x90, 0xF0, 0x0E, 0xF8,
4681 0xD6, 0x47, 0xD1, 0x48, 0xD4, 0x79, 0x54, 0x51,
4682 0x5E, 0x23, 0x27, 0xCF, 0xEF, 0x98, 0xC5, 0x82,
4683 0x66, 0x4B, 0x4C, 0x0F, 0x6C, 0xC4, 0x16, 0x59
4684 };
4685
4686 static const unsigned char bin_q_valid[] = {
4687 0x8C, 0xF8, 0x36, 0x42, 0xA7, 0x09, 0xA0, 0x97,
4688 0xB4, 0x47, 0x99, 0x76, 0x40, 0x12, 0x9D, 0xA2,
4689 0x99, 0xB1, 0xA4, 0x7D, 0x1E, 0xB3, 0x75, 0x0B,
4690 0xA3, 0x08, 0xB0, 0xFE, 0x64, 0xF5, 0xFB, 0xD3
4691 };
4692 static const unsigned char bin_local_pub[] = {
4693 0x79, 0x6e, 0x15, 0x43, 0x14, 0x70, 0xac, 0x86,
4694 0xfa, 0x8a, 0x78, 0xb8, 0xbc, 0xdd, 0x1f, 0x35,
4695 0x89, 0xdb, 0xf1, 0x5f, 0xfe, 0x0e, 0x0a, 0x7a,
4696 0x41, 0xdd, 0x86, 0x40, 0x88, 0x7f, 0x3c, 0xc3,
4697 0xf0, 0x43, 0x9e, 0x28, 0x1f, 0x4c, 0xf3, 0x80,
4698 0x0b, 0xac, 0x2d, 0xbd, 0xfc, 0xda, 0x58, 0x9b,
4699 0x26, 0xcc, 0x82, 0x85, 0x12, 0x08, 0x5c, 0xe0,
4700 0xd3, 0xe5, 0x7a, 0xa1, 0x3c, 0xd9, 0xe7, 0xa4,
4701 0x66, 0xd8, 0x81, 0xba, 0xce, 0x91, 0xed, 0x10,
4702 0xc6, 0x06, 0x4a, 0xb3, 0x6e, 0x0d, 0x66, 0x36,
4703 0x7c, 0x4b, 0xfe, 0xd5, 0x6a, 0x9f, 0x90, 0x7e,
4704 0x4d, 0xae, 0xc1, 0x67, 0x32, 0xfb, 0x5c, 0x54,
4705 0x89, 0x1c, 0xb0, 0xd2, 0x62, 0x51, 0xfd, 0x61,
4706 0xc3, 0x20, 0x40, 0x77, 0x42, 0x46, 0xb3, 0xf8,
4707 0xbd, 0xcd, 0x5e, 0xf6, 0x0e, 0x68, 0x47, 0xcd,
4708 0xd6, 0x9b, 0xd6, 0xd3, 0x18, 0xd1, 0xcd, 0xa0,
4709 0xe8, 0xa3, 0x0a, 0x71, 0x6d, 0xe4, 0xdc, 0x1a,
4710 0x4e, 0xb9, 0x9b, 0x06, 0x86, 0xb7, 0x71, 0x20,
4711 0xc4, 0xb6, 0x9b, 0x00, 0x05, 0xf6, 0xa8, 0xc3,
4712 0xae, 0x76, 0x8d, 0x23, 0xc0, 0x8c, 0x85, 0xbd,
4713 0x1d, 0x58, 0xf4, 0x0d, 0xc0, 0x13, 0x8d, 0x62,
4714 0x77, 0x43, 0x61, 0x37, 0xae, 0x69, 0x77, 0x9f,
4715 0xdc, 0x21, 0x8c, 0x07, 0x1c, 0x14, 0x82, 0x6f,
4716 0x47, 0x15, 0x62, 0x03, 0x3e, 0x85, 0xff, 0xc9,
4717 0x9a, 0x21, 0x47, 0xd5, 0x39, 0xe2, 0x74, 0x13,
4718 0x6a, 0x4a, 0x1e, 0x7f, 0x1d, 0xb9, 0x75, 0x83,
4719 0xb5, 0x1d, 0xc0, 0x38, 0x5a, 0x52, 0xd7, 0x38,
4720 0x39, 0x63, 0x75, 0x8d, 0x89, 0x33, 0x98, 0xa8,
4721 0xd0, 0x13, 0xfd, 0xba, 0xd2, 0x0d, 0xdf, 0x30,
4722 0xfb, 0xe0, 0x5f, 0xbb, 0x22, 0x49, 0x91, 0x3a,
4723 0xe6, 0x75, 0x1b, 0x6b, 0x24, 0x6a, 0xe5, 0x62,
4724 0x2b, 0xa2, 0x6c, 0x48, 0x27, 0x41, 0x7c, 0x2d
4725 };
4726 static const unsigned char bin_local_priv[] = {
4727 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
4728 0x99, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66,
4729 0x77, 0x88, 0x99, 0x00, 0x11, 0x22, 0x33, 0x44,
4730 0x55, 0x66, 0x77, 0x88, 0x99, 0x00, 0x11, 0x22
4731 };
4732
4733 /* Remote malicious parameters */
4734 static const unsigned char bin_remote_q[] = { 0x09, 0xf5 };
4735 static const unsigned char bin_remote_pub[] = {
4736 0x54, 0xc0, 0x57, 0x90, 0x3d, 0x36, 0x22, 0x35,
4737 0xa6, 0x5c, 0x03, 0xf0, 0x01, 0xd8, 0xa3, 0xea,
4738 0x25, 0x28, 0x36, 0xb3, 0x58, 0x02, 0x50, 0xab,
4739 0xdc, 0x0a, 0x10, 0x83, 0x45, 0x1a, 0xf0, 0x12,
4740 0x6f, 0xd1, 0x50, 0xf9, 0xe8, 0xd2, 0x12, 0xb3,
4741 0x84, 0xae, 0x0c, 0x23, 0xaa, 0x7c, 0x67, 0xfe,
4742 0x85, 0x13, 0x68, 0x11, 0x4c, 0xcc, 0x06, 0x1a,
4743 0x66, 0x1e, 0x98, 0x6b, 0xd7, 0xe6, 0x3d, 0x25,
4744 0x75, 0x13, 0x33, 0x9a, 0x69, 0x14, 0xcb, 0xfa,
4745 0xb2, 0x09, 0xad, 0x79, 0x3e, 0xf2, 0x57, 0x04,
4746 0xcd, 0x53, 0x2d, 0xdf, 0xb7, 0xe6, 0x93, 0xde,
4747 0x70, 0x1d, 0x17, 0xe6, 0x29, 0xef, 0x3c, 0x18,
4748 0x4d, 0x40, 0xd5, 0xfe, 0xa1, 0xf9, 0xed, 0xb8,
4749 0x9c, 0x5b, 0xf8, 0xd7, 0xaa, 0x19, 0xe3, 0x37,
4750 0x4f, 0x80, 0x59, 0x32, 0x15, 0x9c, 0xa7, 0xb5,
4751 0xd5, 0x73, 0xb9, 0xe2, 0xf3, 0xc9, 0x4f, 0xe7,
4752 0x47, 0xc4, 0xa3, 0xb0, 0x9e, 0x31, 0xaf, 0xa3,
4753 0x78, 0x8d, 0x35, 0x83, 0x3a, 0xaf, 0x2a, 0xc8,
4754 0xae, 0x8b, 0xc4, 0x85, 0x00, 0x13, 0x14, 0x64,
4755 0xe7, 0x93, 0xa2, 0xe0, 0x35, 0x2e, 0x7c, 0x3e,
4756 0xd9, 0xda, 0x9f, 0xcf, 0x89, 0xb1, 0x21, 0xbc,
4757 0x1c, 0xee, 0x83, 0xc5, 0x44, 0x21, 0x4c, 0xeb,
4758 0x33, 0x38, 0xb1, 0x4a, 0xc6, 0x89, 0x19, 0x68,
4759 0x35, 0x17, 0x46, 0xea, 0xf6, 0x2b, 0xb5, 0x17,
4760 0xeb, 0x98, 0xfc, 0x63, 0x3d, 0x8d, 0x23, 0x5b,
4761 0xac, 0x37, 0xbc, 0x08, 0xe4, 0x7f, 0x18, 0x51,
4762 0xd0, 0x55, 0x01, 0x94, 0x9a, 0x67, 0x33, 0x96,
4763 0x5a, 0xdb, 0xfe, 0x8e, 0x43, 0xf7, 0xc3, 0xb9,
4764 0x3c, 0xa7, 0x51, 0x5c, 0xd6, 0xab, 0x36, 0xd7,
4765 0xef, 0x26, 0xbb, 0x0f, 0xd6, 0x03, 0x3a, 0xbc,
4766 0x39, 0x61, 0x3e, 0x88, 0x0f, 0xff, 0xc8, 0x72,
4767 0x9b, 0x03, 0xbf, 0xea, 0xdd, 0xf0, 0x88, 0x33
4768 };
4769
4770 if (!TEST_ptr(p = BN_bin2bn(bin_p, sizeof(bin_p), NULL))
4771 || !TEST_ptr(g = BN_bin2bn(bin_g, sizeof(bin_g), NULL)))
4772 goto err;
4773
4774 if (!TEST_ptr(q_valid = BN_bin2bn(bin_q_valid, sizeof(bin_q_valid), NULL))
4775 || !TEST_ptr(pub_local
4776 = BN_bin2bn(bin_local_pub, sizeof(bin_local_pub), NULL))
4777 || !TEST_true(priv_local
4778 = BN_bin2bn(bin_local_priv, sizeof(bin_local_priv), NULL)))
4779 goto err;
4780
4781 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
4782 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
4783 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_valid))
4784 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
4785 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_local))
4786 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv_local))
4787 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)))
4788 goto err;
4789
4790 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq))
4791 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
4792 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &local_key, EVP_PKEY_KEYPAIR, params), 0))
4793 goto err;
4794
4795 OSSL_PARAM_free(params);
4796 OSSL_PARAM_BLD_free(bld);
4797 EVP_PKEY_CTX_free(pctx);
4798 params = NULL;
4799 bld = NULL;
4800 pctx = NULL;
4801
4802 if (!TEST_ptr(q_bad = BN_bin2bn(bin_remote_q, sizeof(bin_remote_q), NULL))
4803 || !TEST_ptr(pub_bad
4804 = BN_bin2bn(bin_remote_pub, sizeof(bin_remote_pub), NULL)))
4805 goto err;
4806
4807 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new())
4808 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p))
4809 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_bad))
4810 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))
4811 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_bad))
4812 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)))
4813 goto err;
4814
4815 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq))
4816 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
4817 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &remote_key, EVP_PKEY_PUBLIC_KEY, params), 0))
4818 goto err;
4819
4820 if (!TEST_ptr(derive_ctx = EVP_PKEY_CTX_new(local_key, NULL))
4821 || !TEST_int_gt(EVP_PKEY_derive_init(derive_ctx), 0))
4822 goto err;
4823
4824 /* reject the remote key share, even if it is self-consistent, correct
4825 * code needs to use local q, not remote-provided q. */
4826 if (!TEST_int_le(EVP_PKEY_derive_set_peer(derive_ctx, remote_key), 0)) {
4827 TEST_error("EVP_PKEY_derive_set_peer incorrectly accepted a peer with malicious 'q'");
4828 goto err;
4829 }
4830
4831 ret = 1;
4832
4833 err:
4834 BN_free(p);
4835 BN_free(g);
4836 BN_free(q_valid);
4837 BN_free(pub_local);
4838 BN_free(priv_local);
4839 BN_free(q_bad);
4840 BN_free(pub_bad);
4841 OSSL_PARAM_free(params);
4842 OSSL_PARAM_BLD_free(bld);
4843 EVP_PKEY_CTX_free(pctx);
4844 EVP_PKEY_CTX_free(derive_ctx);
4845 EVP_PKEY_free(local_key);
4846 EVP_PKEY_free(remote_key);
4847 return ret;
4848 }
4849 #endif /* !OPENSSL_NO_DH */
4850
4851 /*
4852 * We test what happens with an empty template. For the sake of this test,
4853 * the template must be ignored, and we know that's the case for RSA keys
4854 * (this might arguably be a misfeature, but that's what we currently do,
4855 * even in provider code, since that's how the legacy RSA implementation
4856 * does things)
4857 */
test_keygen_with_empty_template(int n)4858 static int test_keygen_with_empty_template(int n)
4859 {
4860 EVP_PKEY_CTX *ctx = NULL;
4861 EVP_PKEY *pkey = NULL;
4862 EVP_PKEY *tkey = NULL;
4863 int ret = 0;
4864
4865 if (nullprov != NULL)
4866 return TEST_skip("Test does not support a non-default library context");
4867
4868 switch (n) {
4869 case 0:
4870 /* We do test with no template at all as well */
4871 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)))
4872 goto err;
4873 break;
4874 case 1:
4875 /* Here we create an empty RSA key that serves as our template */
4876 if (!TEST_ptr(tkey = EVP_PKEY_new())
4877 || !TEST_true(EVP_PKEY_set_type(tkey, EVP_PKEY_RSA))
4878 || !TEST_ptr(ctx = EVP_PKEY_CTX_new(tkey, NULL)))
4879 goto err;
4880 break;
4881 }
4882
4883 if (!TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0)
4884 || !TEST_int_gt(EVP_PKEY_keygen(ctx, &pkey), 0))
4885 goto err;
4886
4887 ret = 1;
4888 err:
4889 EVP_PKEY_CTX_free(ctx);
4890 EVP_PKEY_free(pkey);
4891 EVP_PKEY_free(tkey);
4892 return ret;
4893 }
4894
4895 /*
4896 * Test that we fail if we attempt to use an algorithm that is not available
4897 * in the current library context (unless we are using an algorithm that
4898 * should be made available via legacy codepaths).
4899 *
4900 * 0: RSA
4901 * 1: SM2
4902 */
test_pkey_ctx_fail_without_provider(int tst)4903 static int test_pkey_ctx_fail_without_provider(int tst)
4904 {
4905 OSSL_LIB_CTX *tmpctx = OSSL_LIB_CTX_new();
4906 OSSL_PROVIDER *tmpnullprov = NULL;
4907 EVP_PKEY_CTX *pctx = NULL;
4908 const char *keytype = NULL;
4909 int expect_null = 0;
4910 int ret = 0;
4911
4912 if (!TEST_ptr(tmpctx))
4913 goto err;
4914
4915 tmpnullprov = OSSL_PROVIDER_load(tmpctx, "null");
4916 if (!TEST_ptr(tmpnullprov))
4917 goto err;
4918
4919 /*
4920 * We check for certain algos in the null provider.
4921 * If an algo is expected to have a provider keymgmt, constructing an
4922 * EVP_PKEY_CTX is expected to fail (return NULL).
4923 * Otherwise, if it's expected to have legacy support, constructing an
4924 * EVP_PKEY_CTX is expected to succeed (return non-NULL).
4925 */
4926 switch (tst) {
4927 case 0:
4928 keytype = "RSA";
4929 expect_null = 1;
4930 break;
4931 case 1:
4932 keytype = "SM2";
4933 expect_null = 1;
4934 #ifdef OPENSSL_NO_EC
4935 TEST_info("EC disable, skipping SM2 check...");
4936 goto end;
4937 #endif
4938 #ifdef OPENSSL_NO_SM2
4939 TEST_info("SM2 disable, skipping SM2 check...");
4940 goto end;
4941 #endif
4942 break;
4943 default:
4944 TEST_error("No test for case %d", tst);
4945 goto err;
4946 }
4947
4948 pctx = EVP_PKEY_CTX_new_from_name(tmpctx, keytype, "");
4949 if (expect_null ? !TEST_ptr_null(pctx) : !TEST_ptr(pctx))
4950 goto err;
4951
4952 #if defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_SM2)
4953 end:
4954 #endif
4955 ret = 1;
4956
4957 err:
4958 EVP_PKEY_CTX_free(pctx);
4959 OSSL_PROVIDER_unload(tmpnullprov);
4960 OSSL_LIB_CTX_free(tmpctx);
4961 return ret;
4962 }
4963
test_rand_agglomeration(void)4964 static int test_rand_agglomeration(void)
4965 {
4966 EVP_RAND *rand;
4967 EVP_RAND_CTX *ctx;
4968 OSSL_PARAM params[3], *p = params;
4969 int res;
4970 unsigned int step = 7;
4971 static unsigned char seed[] = "It does not matter how slowly you go "
4972 "as long as you do not stop.";
4973 unsigned char out[sizeof(seed)];
4974
4975 if (!TEST_int_ne(sizeof(seed) % step, 0)
4976 || !TEST_ptr(rand = EVP_RAND_fetch(testctx, "TEST-RAND", testpropq)))
4977 return 0;
4978 ctx = EVP_RAND_CTX_new(rand, NULL);
4979 EVP_RAND_free(rand);
4980 if (!TEST_ptr(ctx))
4981 return 0;
4982
4983 memset(out, 0, sizeof(out));
4984 *p++ = OSSL_PARAM_construct_octet_string(OSSL_RAND_PARAM_TEST_ENTROPY,
4985 seed, sizeof(seed));
4986 *p++ = OSSL_PARAM_construct_uint(OSSL_RAND_PARAM_MAX_REQUEST, &step);
4987 *p = OSSL_PARAM_construct_end();
4988 res = TEST_true(EVP_RAND_CTX_set_params(ctx, params))
4989 && TEST_true(EVP_RAND_generate(ctx, out, sizeof(out), 0, 1, NULL, 0))
4990 && TEST_mem_eq(seed, sizeof(seed), out, sizeof(out));
4991 EVP_RAND_CTX_free(ctx);
4992 return res;
4993 }
4994
4995 /*
4996 * Test that we correctly return the original or "running" IV after
4997 * an encryption operation.
4998 * Run multiple times for some different relevant algorithms/modes.
4999 */
test_evp_iv_aes(int idx)5000 static int test_evp_iv_aes(int idx)
5001 {
5002 int ret = 0;
5003 EVP_CIPHER_CTX *ctx = NULL;
5004 unsigned char key[16] = {
5005 0x4c, 0x43, 0xdb, 0xdd, 0x42, 0x73, 0x47, 0xd1,
5006 0xe5, 0x62, 0x7d, 0xcd, 0x4d, 0x76, 0x4d, 0x57
5007 };
5008 unsigned char init_iv[EVP_MAX_IV_LENGTH] = {
5009 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82,
5010 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34
5011 };
5012 static const unsigned char msg[] = {
5013 1, 2, 3, 4, 5, 6, 7, 8,
5014 9, 10, 11, 12, 13, 14, 15, 16
5015 };
5016 unsigned char ciphertext[32], oiv[16], iv[16];
5017 unsigned char *ref_iv;
5018 unsigned char cbc_state[16] = {
5019 0x10, 0x2f, 0x05, 0xcc, 0xc2, 0x55, 0x72, 0xb9,
5020 0x88, 0xe6, 0x4a, 0x17, 0x10, 0x74, 0x22, 0x5e
5021 };
5022
5023 unsigned char ofb_state[16] = {
5024 0x76, 0xe6, 0x66, 0x61, 0xd0, 0x8a, 0xe4, 0x64,
5025 0xdd, 0x66, 0xbf, 0x00, 0xf0, 0xe3, 0x6f, 0xfd
5026 };
5027 unsigned char cfb_state[16] = {
5028 0x77, 0xe4, 0x65, 0x65, 0xd5, 0x8c, 0xe3, 0x6c,
5029 0xd4, 0x6c, 0xb4, 0x0c, 0xfd, 0xed, 0x60, 0xed
5030 };
5031 unsigned char gcm_state[12] = {
5032 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b,
5033 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81
5034 };
5035 unsigned char ccm_state[7] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98 };
5036 #ifndef OPENSSL_NO_OCB
5037 unsigned char ocb_state[12] = {
5038 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b,
5039 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81
5040 };
5041 #endif
5042 int len = sizeof(ciphertext);
5043 size_t ivlen, ref_len;
5044 const EVP_CIPHER *type = NULL;
5045 int iv_reset = 0;
5046
5047 if (nullprov != NULL && idx < 6)
5048 return TEST_skip("Test does not support a non-default library context");
5049
5050 switch (idx) {
5051 case 0:
5052 type = EVP_aes_128_cbc();
5053 /* FALLTHROUGH */
5054 case 6:
5055 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cbc", testpropq);
5056 ref_iv = cbc_state;
5057 ref_len = sizeof(cbc_state);
5058 iv_reset = 1;
5059 break;
5060 case 1:
5061 type = EVP_aes_128_ofb();
5062 /* FALLTHROUGH */
5063 case 7:
5064 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ofb", testpropq);
5065 ref_iv = ofb_state;
5066 ref_len = sizeof(ofb_state);
5067 iv_reset = 1;
5068 break;
5069 case 2:
5070 type = EVP_aes_128_cfb();
5071 /* FALLTHROUGH */
5072 case 8:
5073 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq);
5074 ref_iv = cfb_state;
5075 ref_len = sizeof(cfb_state);
5076 iv_reset = 1;
5077 break;
5078 case 3:
5079 type = EVP_aes_128_gcm();
5080 /* FALLTHROUGH */
5081 case 9:
5082 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-gcm", testpropq);
5083 ref_iv = gcm_state;
5084 ref_len = sizeof(gcm_state);
5085 break;
5086 case 4:
5087 type = EVP_aes_128_ccm();
5088 /* FALLTHROUGH */
5089 case 10:
5090 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ccm", testpropq);
5091 ref_iv = ccm_state;
5092 ref_len = sizeof(ccm_state);
5093 break;
5094 #ifdef OPENSSL_NO_OCB
5095 case 5:
5096 case 11:
5097 return 1;
5098 #else
5099 case 5:
5100 type = EVP_aes_128_ocb();
5101 /* FALLTHROUGH */
5102 case 11:
5103 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ocb", testpropq);
5104 ref_iv = ocb_state;
5105 ref_len = sizeof(ocb_state);
5106 break;
5107 #endif
5108 default:
5109 return 0;
5110 }
5111
5112 if (!TEST_ptr(type)
5113 || !TEST_ptr((ctx = EVP_CIPHER_CTX_new()))
5114 || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, init_iv))
5115 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg,
5116 (int)sizeof(msg)))
5117 || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv)))
5118 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv)))
5119 || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len)))
5120 goto err;
5121 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
5122
5123 if (!TEST_int_gt(ivlen, 0))
5124 goto err;
5125
5126 if (!TEST_mem_eq(init_iv, ivlen, oiv, ivlen)
5127 || !TEST_mem_eq(ref_iv, ref_len, iv, ivlen))
5128 goto err;
5129
5130 /* CBC, OFB, and CFB modes: the updated iv must be reset after reinit */
5131 if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL))
5132 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))))
5133 goto err;
5134 if (iv_reset) {
5135 if (!TEST_mem_eq(init_iv, ivlen, iv, ivlen))
5136 goto err;
5137 } else {
5138 if (!TEST_mem_eq(ref_iv, ivlen, iv, ivlen))
5139 goto err;
5140 }
5141
5142 ret = 1;
5143 err:
5144 EVP_CIPHER_CTX_free(ctx);
5145 if (idx >= 6)
5146 EVP_CIPHER_free((EVP_CIPHER *)type);
5147 return ret;
5148 }
5149
5150 #ifndef OPENSSL_NO_DES
test_evp_iv_des(int idx)5151 static int test_evp_iv_des(int idx)
5152 {
5153 int ret = 0;
5154 EVP_CIPHER_CTX *ctx = NULL;
5155 static const unsigned char key[24] = {
5156 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
5157 0xf1, 0xe0, 0xd3, 0xc2, 0xb5, 0xa4, 0x97, 0x86,
5158 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10
5159 };
5160 static const unsigned char init_iv[8] = {
5161 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10
5162 };
5163 static const unsigned char msg[] = {
5164 1, 2, 3, 4, 5, 6, 7, 8,
5165 9, 10, 11, 12, 13, 14, 15, 16
5166 };
5167 unsigned char ciphertext[32], oiv[8], iv[8];
5168 unsigned const char *ref_iv;
5169 static const unsigned char cbc_state_des[8] = {
5170 0x4f, 0xa3, 0x85, 0xcd, 0x8b, 0xf3, 0x06, 0x2a
5171 };
5172 static const unsigned char cbc_state_3des[8] = {
5173 0x35, 0x27, 0x7d, 0x65, 0x6c, 0xfb, 0x50, 0xd9
5174 };
5175 static const unsigned char ofb_state_des[8] = {
5176 0xa7, 0x0d, 0x1d, 0x45, 0xf9, 0x96, 0x3f, 0x2c
5177 };
5178 static const unsigned char ofb_state_3des[8] = {
5179 0xab, 0x16, 0x24, 0xbb, 0x5b, 0xac, 0xed, 0x5e
5180 };
5181 static const unsigned char cfb_state_des[8] = {
5182 0x91, 0xeb, 0x6d, 0x29, 0x4b, 0x08, 0xbd, 0x73
5183 };
5184 static const unsigned char cfb_state_3des[8] = {
5185 0x34, 0xdd, 0xfb, 0x47, 0x33, 0x1c, 0x61, 0xf7
5186 };
5187 int len = sizeof(ciphertext);
5188 size_t ivlen, ref_len;
5189 EVP_CIPHER *type = NULL;
5190
5191 if (lgcyprov == NULL && idx < 3)
5192 return TEST_skip("Test requires legacy provider to be loaded");
5193
5194 switch (idx) {
5195 case 0:
5196 type = EVP_CIPHER_fetch(testctx, "des-cbc", testpropq);
5197 ref_iv = cbc_state_des;
5198 ref_len = sizeof(cbc_state_des);
5199 break;
5200 case 1:
5201 type = EVP_CIPHER_fetch(testctx, "des-ofb", testpropq);
5202 ref_iv = ofb_state_des;
5203 ref_len = sizeof(ofb_state_des);
5204 break;
5205 case 2:
5206 type = EVP_CIPHER_fetch(testctx, "des-cfb", testpropq);
5207 ref_iv = cfb_state_des;
5208 ref_len = sizeof(cfb_state_des);
5209 break;
5210 case 3:
5211 type = EVP_CIPHER_fetch(testctx, "des-ede3-cbc", testpropq);
5212 ref_iv = cbc_state_3des;
5213 ref_len = sizeof(cbc_state_3des);
5214 break;
5215 case 4:
5216 type = EVP_CIPHER_fetch(testctx, "des-ede3-ofb", testpropq);
5217 ref_iv = ofb_state_3des;
5218 ref_len = sizeof(ofb_state_3des);
5219 break;
5220 case 5:
5221 type = EVP_CIPHER_fetch(testctx, "des-ede3-cfb", testpropq);
5222 ref_iv = cfb_state_3des;
5223 ref_len = sizeof(cfb_state_3des);
5224 break;
5225 default:
5226 return 0;
5227 }
5228
5229 if (!TEST_ptr(type)
5230 || !TEST_ptr((ctx = EVP_CIPHER_CTX_new()))
5231 || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, init_iv))
5232 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg,
5233 (int)sizeof(msg)))
5234 || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv)))
5235 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv)))
5236 || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len)))
5237 goto err;
5238 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
5239
5240 if (!TEST_int_gt(ivlen, 0))
5241 goto err;
5242
5243 if (!TEST_mem_eq(init_iv, ivlen, oiv, ivlen)
5244 || !TEST_mem_eq(ref_iv, ref_len, iv, ivlen))
5245 goto err;
5246
5247 if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL))
5248 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))))
5249 goto err;
5250 if (!TEST_mem_eq(init_iv, ivlen, iv, ivlen))
5251 goto err;
5252
5253 ret = 1;
5254 err:
5255 EVP_CIPHER_CTX_free(ctx);
5256 EVP_CIPHER_free(type);
5257 return ret;
5258 }
5259 #endif
5260
5261 #ifndef OPENSSL_NO_BF
test_evp_bf_default_keylen(int idx)5262 static int test_evp_bf_default_keylen(int idx)
5263 {
5264 int ret = 0;
5265 static const char *algos[4] = {
5266 "bf-ecb", "bf-cbc", "bf-cfb", "bf-ofb"
5267 };
5268 int ivlen[4] = { 0, 8, 8, 8 };
5269 EVP_CIPHER *cipher = NULL;
5270
5271 if (lgcyprov == NULL)
5272 return TEST_skip("Test requires legacy provider to be loaded");
5273
5274 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, algos[idx], testpropq))
5275 || !TEST_int_eq(EVP_CIPHER_get_key_length(cipher), 16)
5276 || !TEST_int_eq(EVP_CIPHER_get_iv_length(cipher), ivlen[idx]))
5277 goto err;
5278
5279 ret = 1;
5280 err:
5281 EVP_CIPHER_free(cipher);
5282 return ret;
5283 }
5284 #endif
5285
5286 #ifndef OPENSSL_NO_EC
5287 static int ecpub_nids[] = {
5288 NID_brainpoolP256r1, NID_X9_62_prime256v1,
5289 NID_secp384r1, NID_secp521r1,
5290 #ifndef OPENSSL_NO_EC2M
5291 NID_sect233k1, NID_sect233r1, NID_sect283r1,
5292 NID_sect409k1, NID_sect409r1, NID_sect571k1, NID_sect571r1,
5293 #endif
5294 NID_brainpoolP384r1, NID_brainpoolP512r1
5295 };
5296
test_ecpub(int idx)5297 static int test_ecpub(int idx)
5298 {
5299 int ret = 0, len, savelen;
5300 int nid;
5301 unsigned char buf[1024];
5302 unsigned char *p;
5303 EVP_PKEY *pkey = NULL;
5304 EVP_PKEY_CTX *ctx = NULL;
5305 #ifndef OPENSSL_NO_DEPRECATED_3_0
5306 const unsigned char *q;
5307 EVP_PKEY *pkey2 = NULL;
5308 EC_KEY *ec = NULL;
5309 #endif
5310
5311 if (nullprov != NULL)
5312 return TEST_skip("Test does not support a non-default library context");
5313
5314 nid = ecpub_nids[idx];
5315
5316 ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
5317 if (!TEST_ptr(ctx)
5318 || !TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0)
5319 || !TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid), 0)
5320 || !TEST_true(EVP_PKEY_keygen(ctx, &pkey)))
5321 goto done;
5322 len = i2d_PublicKey(pkey, NULL);
5323 savelen = len;
5324 if (!TEST_int_ge(len, 1)
5325 || !TEST_int_lt(len, 1024))
5326 goto done;
5327 p = buf;
5328 len = i2d_PublicKey(pkey, &p);
5329 if (!TEST_int_ge(len, 1)
5330 || !TEST_int_eq(len, savelen))
5331 goto done;
5332
5333 #ifndef OPENSSL_NO_DEPRECATED_3_0
5334 /* Now try to decode the just-created DER. */
5335 q = buf;
5336 if (!TEST_ptr((pkey2 = EVP_PKEY_new()))
5337 || !TEST_ptr((ec = EC_KEY_new_by_curve_name(nid)))
5338 || !TEST_true(EVP_PKEY_assign_EC_KEY(pkey2, ec)))
5339 goto done;
5340 /* EC_KEY ownership transferred */
5341 ec = NULL;
5342 if (!TEST_ptr(d2i_PublicKey(EVP_PKEY_EC, &pkey2, &q, savelen)))
5343 goto done;
5344 /* The keys should match. */
5345 if (!TEST_int_eq(EVP_PKEY_eq(pkey, pkey2), 1))
5346 goto done;
5347 #endif
5348
5349 ret = 1;
5350
5351 done:
5352 EVP_PKEY_CTX_free(ctx);
5353 EVP_PKEY_free(pkey);
5354 #ifndef OPENSSL_NO_DEPRECATED_3_0
5355 EVP_PKEY_free(pkey2);
5356 EC_KEY_free(ec);
5357 #endif
5358 return ret;
5359 }
5360 #endif
5361
test_EVP_rsa_pss_with_keygen_bits(void)5362 static int test_EVP_rsa_pss_with_keygen_bits(void)
5363 {
5364 int ret = 0;
5365 EVP_PKEY_CTX *ctx = NULL;
5366 EVP_PKEY *pkey = NULL;
5367 EVP_MD *md;
5368
5369 md = EVP_MD_fetch(testctx, "sha256", testpropq);
5370 ret = TEST_ptr(md)
5371 && TEST_ptr((ctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA-PSS", testpropq)))
5372 && TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0)
5373 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 512), 0)
5374 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx, md), 0)
5375 && TEST_true(EVP_PKEY_keygen(ctx, &pkey));
5376
5377 EVP_MD_free(md);
5378 EVP_PKEY_free(pkey);
5379 EVP_PKEY_CTX_free(ctx);
5380 return ret;
5381 }
5382
test_EVP_rsa_pss_set_saltlen(void)5383 static int test_EVP_rsa_pss_set_saltlen(void)
5384 {
5385 int ret = 0;
5386 EVP_PKEY *pkey = NULL;
5387 EVP_PKEY_CTX *pkey_ctx = NULL;
5388 EVP_MD *sha256 = NULL;
5389 EVP_MD_CTX *sha256_ctx = NULL;
5390 int saltlen = 9999; /* buggy EVP_PKEY_CTX_get_rsa_pss_saltlen() didn't update this */
5391 const int test_value = 32;
5392
5393 ret = TEST_ptr(pkey = load_example_rsa_key())
5394 && TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", NULL))
5395 && TEST_ptr(sha256_ctx = EVP_MD_CTX_new())
5396 && TEST_true(EVP_DigestSignInit(sha256_ctx, &pkey_ctx, sha256, NULL, pkey))
5397 && TEST_true(EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING))
5398 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, test_value), 0)
5399 && TEST_int_gt(EVP_PKEY_CTX_get_rsa_pss_saltlen(pkey_ctx, &saltlen), 0)
5400 && TEST_int_eq(saltlen, test_value);
5401
5402 EVP_MD_CTX_free(sha256_ctx);
5403 EVP_PKEY_free(pkey);
5404 EVP_MD_free(sha256);
5405
5406 return ret;
5407 }
5408
test_EVP_rsa_invalid_key(void)5409 static int test_EVP_rsa_invalid_key(void)
5410 {
5411 int ret = 0;
5412 EVP_PKEY *pkey = NULL;
5413
5414 pkey = load_example_key("RSA", kInvalidRSAKeyDER, sizeof(kInvalidRSAKeyDER));
5415 /* we expect to fail to load bogus key */
5416 ret = !TEST_ptr(pkey);
5417 EVP_PKEY_free(pkey);
5418
5419 return ret;
5420 }
5421
5422 static int success = 1;
md_names(const char * name,void * vctx)5423 static void md_names(const char *name, void *vctx)
5424 {
5425 OSSL_LIB_CTX *ctx = (OSSL_LIB_CTX *)vctx;
5426 /* Force a namemap update */
5427 EVP_CIPHER *aes128 = EVP_CIPHER_fetch(ctx, "AES-128-CBC", NULL);
5428
5429 if (!TEST_ptr(aes128))
5430 success = 0;
5431
5432 EVP_CIPHER_free(aes128);
5433 }
5434
5435 /*
5436 * Test that changing the namemap in a user callback works in a names_do_all
5437 * function.
5438 */
test_names_do_all(void)5439 static int test_names_do_all(void)
5440 {
5441 /* We use a custom libctx so that we know the state of the namemap */
5442 OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new();
5443 EVP_MD *sha256 = NULL;
5444 int testresult = 0;
5445
5446 if (!TEST_ptr(ctx))
5447 goto err;
5448
5449 sha256 = EVP_MD_fetch(ctx, "SHA2-256", NULL);
5450 if (!TEST_ptr(sha256))
5451 goto err;
5452
5453 /*
5454 * We loop through all the names for a given digest. This should still work
5455 * even if the namemap changes part way through.
5456 */
5457 if (!TEST_true(EVP_MD_names_do_all(sha256, md_names, ctx)))
5458 goto err;
5459
5460 if (!TEST_true(success))
5461 goto err;
5462
5463 testresult = 1;
5464 err:
5465 EVP_MD_free(sha256);
5466 OSSL_LIB_CTX_free(ctx);
5467 return testresult;
5468 }
5469
5470 typedef struct {
5471 const char *cipher;
5472 const unsigned char *key;
5473 const unsigned char *iv;
5474 const unsigned char *input;
5475 const unsigned char *expected;
5476 const unsigned char *tag;
5477 size_t ivlen; /* 0 if we do not need to set a specific IV len */
5478 size_t inlen;
5479 size_t expectedlen;
5480 size_t taglen;
5481 int keyfirst;
5482 int initenc;
5483 int finalenc;
5484 } EVP_INIT_TEST_st;
5485
5486 static const EVP_INIT_TEST_st evp_init_tests[] = {
5487 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext,
5488 cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext),
5489 0, 1, 0, 1 },
5490 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext,
5491 gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV),
5492 sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext),
5493 sizeof(gcmDefaultTag), 1, 0, 1 },
5494 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext,
5495 cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext),
5496 0, 0, 0, 1 },
5497 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext,
5498 gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV),
5499 sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext),
5500 sizeof(gcmDefaultTag), 0, 0, 1 },
5501 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext,
5502 cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext),
5503 0, 1, 1, 0 },
5504 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext,
5505 gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV),
5506 sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext),
5507 sizeof(gcmDefaultTag), 1, 1, 0 },
5508 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext,
5509 cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext),
5510 0, 0, 1, 0 },
5511 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext,
5512 gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV),
5513 sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext),
5514 sizeof(gcmDefaultTag), 0, 1, 0 }
5515 };
5516
5517 /* use same key, iv and plaintext for cfb and ofb */
5518 static const EVP_INIT_TEST_st evp_reinit_tests[] = {
5519 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial,
5520 cfbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial),
5521 sizeof(cfbCiphertext_partial), 0, 0, 1, 0 },
5522 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext_partial,
5523 cfbPlaintext_partial, NULL, 0, sizeof(cfbCiphertext_partial),
5524 sizeof(cfbPlaintext_partial), 0, 0, 0, 0 },
5525 { "aes-128-ofb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial,
5526 ofbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial),
5527 sizeof(ofbCiphertext_partial), 0, 0, 1, 0 },
5528 { "aes-128-ofb", kCFBDefaultKey, iCFBIV, ofbCiphertext_partial,
5529 cfbPlaintext_partial, NULL, 0, sizeof(ofbCiphertext_partial),
5530 sizeof(cfbPlaintext_partial), 0, 0, 0, 0 },
5531 };
5532
evp_init_seq_set_iv(EVP_CIPHER_CTX * ctx,const EVP_INIT_TEST_st * t)5533 static int evp_init_seq_set_iv(EVP_CIPHER_CTX *ctx, const EVP_INIT_TEST_st *t)
5534 {
5535 int res = 0;
5536
5537 if (t->ivlen != 0) {
5538 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen, NULL), 0))
5539 goto err;
5540 }
5541 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv, -1)))
5542 goto err;
5543 res = 1;
5544 err:
5545 return res;
5546 }
5547
5548 /*
5549 * Test step-wise cipher initialization via EVP_CipherInit_ex where the
5550 * arguments are given one at a time and a final adjustment to the enc
5551 * parameter sets the correct operation.
5552 */
test_evp_init_seq(int idx)5553 static int test_evp_init_seq(int idx)
5554 {
5555 int outlen1, outlen2;
5556 int testresult = 0;
5557 unsigned char outbuf[1024];
5558 unsigned char tag[16];
5559 const EVP_INIT_TEST_st *t = &evp_init_tests[idx];
5560 EVP_CIPHER_CTX *ctx = NULL;
5561 EVP_CIPHER *type = NULL;
5562 size_t taglen = sizeof(tag);
5563 char *errmsg = NULL;
5564
5565 ctx = EVP_CIPHER_CTX_new();
5566 if (ctx == NULL) {
5567 errmsg = "CTX_ALLOC";
5568 goto err;
5569 }
5570 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq))) {
5571 errmsg = "CIPHER_FETCH";
5572 goto err;
5573 }
5574 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, t->initenc))) {
5575 errmsg = "EMPTY_ENC_INIT";
5576 goto err;
5577 }
5578 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) {
5579 errmsg = "PADDING";
5580 goto err;
5581 }
5582 if (t->keyfirst && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) {
5583 errmsg = "KEY_INIT (before iv)";
5584 goto err;
5585 }
5586 if (!evp_init_seq_set_iv(ctx, t)) {
5587 errmsg = "IV_INIT";
5588 goto err;
5589 }
5590 if (t->keyfirst == 0 && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) {
5591 errmsg = "KEY_INIT (after iv)";
5592 goto err;
5593 }
5594 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, t->finalenc))) {
5595 errmsg = "FINAL_ENC_INIT";
5596 goto err;
5597 }
5598 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
5599 errmsg = "CIPHER_UPDATE";
5600 goto err;
5601 }
5602 if (t->finalenc == 0 && t->tag != NULL) {
5603 /* Set expected tag */
5604 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
5605 t->taglen, (void *)t->tag),
5606 0)) {
5607 errmsg = "SET_TAG";
5608 goto err;
5609 }
5610 }
5611 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5612 errmsg = "CIPHER_FINAL";
5613 goto err;
5614 }
5615 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
5616 errmsg = "WRONG_RESULT";
5617 goto err;
5618 }
5619 if (t->finalenc != 0 && t->tag != NULL) {
5620 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) {
5621 errmsg = "GET_TAG";
5622 goto err;
5623 }
5624 if (!TEST_mem_eq(t->tag, t->taglen, tag, taglen)) {
5625 errmsg = "TAG_ERROR";
5626 goto err;
5627 }
5628 }
5629 testresult = 1;
5630 err:
5631 if (errmsg != NULL)
5632 TEST_info("evp_init_test %d: %s", idx, errmsg);
5633 EVP_CIPHER_CTX_free(ctx);
5634 EVP_CIPHER_free(type);
5635 return testresult;
5636 }
5637
5638 /*
5639 * Test re-initialization of cipher context without changing key or iv.
5640 * The result of both iteration should be the same.
5641 */
test_evp_reinit_seq(int idx)5642 static int test_evp_reinit_seq(int idx)
5643 {
5644 int outlen1, outlen2, outlen_final;
5645 int testresult = 0;
5646 unsigned char outbuf1[1024];
5647 unsigned char outbuf2[1024];
5648 const EVP_INIT_TEST_st *t = &evp_reinit_tests[idx];
5649 EVP_CIPHER_CTX *ctx = NULL;
5650 EVP_CIPHER *type = NULL;
5651
5652 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())
5653 || !TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq))
5654 /* setup cipher context */
5655 || !TEST_true(EVP_CipherInit_ex2(ctx, type, t->key, t->iv, t->initenc, NULL))
5656 /* first iteration */
5657 || !TEST_true(EVP_CipherUpdate(ctx, outbuf1, &outlen1, t->input, t->inlen))
5658 || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf1, &outlen_final))
5659 /* check test results iteration 1 */
5660 || !TEST_mem_eq(t->expected, t->expectedlen, outbuf1, outlen1 + outlen_final)
5661 /* now re-init the context (same cipher, key and iv) */
5662 || !TEST_true(EVP_CipherInit_ex2(ctx, NULL, NULL, NULL, -1, NULL))
5663 /* second iteration */
5664 || !TEST_true(EVP_CipherUpdate(ctx, outbuf2, &outlen2, t->input, t->inlen))
5665 || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf2, &outlen_final))
5666 /* check test results iteration 2 */
5667 || !TEST_mem_eq(t->expected, t->expectedlen, outbuf2, outlen2 + outlen_final))
5668 goto err;
5669 testresult = 1;
5670 err:
5671 EVP_CIPHER_CTX_free(ctx);
5672 EVP_CIPHER_free(type);
5673 return testresult;
5674 }
5675
5676 typedef struct {
5677 const unsigned char *input;
5678 const unsigned char *expected;
5679 size_t inlen;
5680 size_t expectedlen;
5681 int enc;
5682 } EVP_RESET_TEST_st;
5683
5684 static const EVP_RESET_TEST_st evp_reset_tests[] = {
5685 { cfbPlaintext, cfbCiphertext,
5686 sizeof(cfbPlaintext), sizeof(cfbCiphertext), 1 },
5687 { cfbCiphertext, cfbPlaintext,
5688 sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0 }
5689 };
5690
5691 /*
5692 * Test a reset of a cipher via EVP_CipherInit_ex after the cipher has already
5693 * been used.
5694 */
test_evp_reset(int idx)5695 static int test_evp_reset(int idx)
5696 {
5697 const EVP_RESET_TEST_st *t = &evp_reset_tests[idx];
5698 int outlen1, outlen2;
5699 int testresult = 0;
5700 unsigned char outbuf[1024];
5701 EVP_CIPHER_CTX *ctx = NULL;
5702 EVP_CIPHER *type = NULL;
5703 char *errmsg = NULL;
5704
5705 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
5706 errmsg = "CTX_ALLOC";
5707 goto err;
5708 }
5709 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq))) {
5710 errmsg = "CIPHER_FETCH";
5711 goto err;
5712 }
5713 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) {
5714 errmsg = "CIPHER_INIT";
5715 goto err;
5716 }
5717 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) {
5718 errmsg = "PADDING";
5719 goto err;
5720 }
5721 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
5722 errmsg = "CIPHER_UPDATE";
5723 goto err;
5724 }
5725 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5726 errmsg = "CIPHER_FINAL";
5727 goto err;
5728 }
5729 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
5730 errmsg = "WRONG_RESULT";
5731 goto err;
5732 }
5733 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, -1))) {
5734 errmsg = "CIPHER_REINIT";
5735 goto err;
5736 }
5737 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) {
5738 errmsg = "CIPHER_UPDATE (reinit)";
5739 goto err;
5740 }
5741 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5742 errmsg = "CIPHER_FINAL (reinit)";
5743 goto err;
5744 }
5745 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) {
5746 errmsg = "WRONG_RESULT (reinit)";
5747 goto err;
5748 }
5749 testresult = 1;
5750 err:
5751 if (errmsg != NULL)
5752 TEST_info("test_evp_reset %d: %s", idx, errmsg);
5753 EVP_CIPHER_CTX_free(ctx);
5754 EVP_CIPHER_free(type);
5755 return testresult;
5756 }
5757
5758 typedef struct {
5759 const char *cipher;
5760 int enc;
5761 } EVP_UPDATED_IV_TEST_st;
5762
5763 static const EVP_UPDATED_IV_TEST_st evp_updated_iv_tests[] = {
5764 { "aes-128-cfb", 1 },
5765 { "aes-128-cfb", 0 },
5766 { "aes-128-cfb1", 1 },
5767 { "aes-128-cfb1", 0 },
5768 { "aes-128-cfb8", 1 },
5769 { "aes-128-cfb8", 0 },
5770 { "aes-128-ofb", 1 },
5771 { "aes-128-ofb", 0 },
5772 { "aes-128-ctr", 1 },
5773 { "aes-128-ctr", 0 },
5774 { "aes-128-cbc", 1 },
5775 { "aes-128-cbc", 0 }
5776 };
5777
5778 /*
5779 * Test that the IV in the context is updated during a crypto operation for CFB
5780 * and OFB.
5781 */
test_evp_updated_iv(int idx)5782 static int test_evp_updated_iv(int idx)
5783 {
5784 const EVP_UPDATED_IV_TEST_st *t = &evp_updated_iv_tests[idx];
5785 int outlen1, outlen2;
5786 int testresult = 0;
5787 unsigned char outbuf[1024];
5788 EVP_CIPHER_CTX *ctx = NULL;
5789 EVP_CIPHER *type = NULL;
5790 unsigned char updated_iv[EVP_MAX_IV_LENGTH];
5791 int iv_len;
5792 char *errmsg = NULL;
5793
5794 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
5795 errmsg = "CTX_ALLOC";
5796 goto err;
5797 }
5798 if ((type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) == NULL) {
5799 TEST_info("cipher %s not supported, skipping", t->cipher);
5800 goto ok;
5801 }
5802
5803 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) {
5804 errmsg = "CIPHER_INIT";
5805 goto err;
5806 }
5807 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) {
5808 errmsg = "PADDING";
5809 goto err;
5810 }
5811 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, cfbPlaintext, sizeof(cfbPlaintext)))) {
5812 errmsg = "CIPHER_UPDATE";
5813 goto err;
5814 }
5815 if (!TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, updated_iv, sizeof(updated_iv)))) {
5816 errmsg = "CIPHER_CTX_GET_UPDATED_IV";
5817 goto err;
5818 }
5819 iv_len = EVP_CIPHER_CTX_get_iv_length(ctx);
5820 if (!TEST_int_ge(iv_len, 0)) {
5821 errmsg = "CIPHER_CTX_GET_IV_LEN";
5822 goto err;
5823 }
5824 if (!TEST_mem_ne(iCFBIV, sizeof(iCFBIV), updated_iv, iv_len)) {
5825 errmsg = "IV_NOT_UPDATED";
5826 goto err;
5827 }
5828 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5829 errmsg = "CIPHER_FINAL";
5830 goto err;
5831 }
5832 ok:
5833 testresult = 1;
5834 err:
5835 if (errmsg != NULL)
5836 TEST_info("test_evp_updated_iv %d: %s", idx, errmsg);
5837 EVP_CIPHER_CTX_free(ctx);
5838 EVP_CIPHER_free(type);
5839 return testresult;
5840 }
5841
5842 typedef struct {
5843 const unsigned char *iv1;
5844 const unsigned char *iv2;
5845 const unsigned char *expected1;
5846 const unsigned char *expected2;
5847 const unsigned char *tag1;
5848 const unsigned char *tag2;
5849 size_t ivlen1;
5850 size_t ivlen2;
5851 size_t expectedlen1;
5852 size_t expectedlen2;
5853 } TEST_GCM_IV_REINIT_st;
5854
5855 static const TEST_GCM_IV_REINIT_st gcm_reinit_tests[] = {
5856 { iGCMResetIV1, iGCMResetIV2, gcmResetCiphertext1, gcmResetCiphertext2,
5857 gcmResetTag1, gcmResetTag2, sizeof(iGCMResetIV1), sizeof(iGCMResetIV2),
5858 sizeof(gcmResetCiphertext1), sizeof(gcmResetCiphertext2) },
5859 { iGCMResetIV2, iGCMResetIV1, gcmResetCiphertext2, gcmResetCiphertext1,
5860 gcmResetTag2, gcmResetTag1, sizeof(iGCMResetIV2), sizeof(iGCMResetIV1),
5861 sizeof(gcmResetCiphertext2), sizeof(gcmResetCiphertext1) }
5862 };
5863
test_gcm_reinit(int idx)5864 static int test_gcm_reinit(int idx)
5865 {
5866 int outlen1, outlen2, outlen3;
5867 int testresult = 0;
5868 unsigned char outbuf[1024];
5869 unsigned char tag[16];
5870 const TEST_GCM_IV_REINIT_st *t = &gcm_reinit_tests[idx];
5871 EVP_CIPHER_CTX *ctx = NULL;
5872 EVP_CIPHER *type = NULL;
5873 size_t taglen = sizeof(tag);
5874 char *errmsg = NULL;
5875
5876 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
5877 errmsg = "CTX_ALLOC";
5878 goto err;
5879 }
5880 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-256-gcm", testpropq))) {
5881 errmsg = "CIPHER_FETCH";
5882 goto err;
5883 }
5884 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, 1))) {
5885 errmsg = "ENC_INIT";
5886 goto err;
5887 }
5888 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen1, NULL), 0)) {
5889 errmsg = "SET_IVLEN1";
5890 goto err;
5891 }
5892 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, kGCMResetKey, t->iv1, 1))) {
5893 errmsg = "SET_IV1";
5894 goto err;
5895 }
5896 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) {
5897 errmsg = "AAD1";
5898 goto err;
5899 }
5900 EVP_CIPHER_CTX_set_padding(ctx, 0);
5901 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext,
5902 sizeof(gcmResetPlaintext)))) {
5903 errmsg = "CIPHER_UPDATE1";
5904 goto err;
5905 }
5906 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5907 errmsg = "CIPHER_FINAL1";
5908 goto err;
5909 }
5910 if (!TEST_mem_eq(t->expected1, t->expectedlen1, outbuf, outlen1 + outlen2)) {
5911 errmsg = "WRONG_RESULT1";
5912 goto err;
5913 }
5914 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) {
5915 errmsg = "GET_TAG1";
5916 goto err;
5917 }
5918 if (!TEST_mem_eq(t->tag1, taglen, tag, taglen)) {
5919 errmsg = "TAG_ERROR1";
5920 goto err;
5921 }
5922 /* Now reinit */
5923 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen2, NULL), 0)) {
5924 errmsg = "SET_IVLEN2";
5925 goto err;
5926 }
5927 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv2, -1))) {
5928 errmsg = "SET_IV2";
5929 goto err;
5930 }
5931 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) {
5932 errmsg = "AAD2";
5933 goto err;
5934 }
5935 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext,
5936 sizeof(gcmResetPlaintext)))) {
5937 errmsg = "CIPHER_UPDATE2";
5938 goto err;
5939 }
5940 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) {
5941 errmsg = "CIPHER_FINAL2";
5942 goto err;
5943 }
5944 if (!TEST_mem_eq(t->expected2, t->expectedlen2, outbuf, outlen1 + outlen2)) {
5945 errmsg = "WRONG_RESULT2";
5946 goto err;
5947 }
5948 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) {
5949 errmsg = "GET_TAG2";
5950 goto err;
5951 }
5952 if (!TEST_mem_eq(t->tag2, taglen, tag, taglen)) {
5953 errmsg = "TAG_ERROR2";
5954 goto err;
5955 }
5956 testresult = 1;
5957 err:
5958 if (errmsg != NULL)
5959 TEST_info("evp_init_test %d: %s", idx, errmsg);
5960 EVP_CIPHER_CTX_free(ctx);
5961 EVP_CIPHER_free(type);
5962 return testresult;
5963 }
5964
5965 static const char *ivlen_change_ciphers[] = {
5966 "AES-256-GCM",
5967 #ifndef OPENSSL_NO_OCB
5968 "AES-256-OCB",
5969 #endif
5970 "AES-256-CCM"
5971 };
5972
5973 /* Negative test for ivlen change after iv being set */
test_ivlen_change(int idx)5974 static int test_ivlen_change(int idx)
5975 {
5976 int outlen;
5977 int res = 0;
5978 unsigned char outbuf[1024];
5979 static const unsigned char iv[] = {
5980 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82,
5981 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34
5982 };
5983 EVP_CIPHER_CTX *ctx = NULL;
5984 EVP_CIPHER *ciph = NULL;
5985 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
5986 size_t ivlen = 13; /* non-default IV length */
5987
5988 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
5989 goto err;
5990
5991 if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, ivlen_change_ciphers[idx],
5992 testpropq)))
5993 goto err;
5994
5995 if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, kGCMDefaultKey, iv, 1)))
5996 goto err;
5997
5998 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext,
5999 sizeof(gcmDefaultPlaintext))))
6000 goto err;
6001
6002 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN,
6003 &ivlen);
6004 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)))
6005 goto err;
6006
6007 ERR_set_mark();
6008 if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext,
6009 sizeof(gcmDefaultPlaintext)))) {
6010 ERR_clear_last_mark();
6011 goto err;
6012 }
6013 ERR_pop_to_mark();
6014
6015 res = 1;
6016 err:
6017 EVP_CIPHER_CTX_free(ctx);
6018 EVP_CIPHER_free(ciph);
6019 return res;
6020 }
6021
6022 static const char *keylen_change_ciphers[] = {
6023 #ifndef OPENSSL_NO_BF
6024 "BF-ECB",
6025 #endif
6026 #ifndef OPENSSL_NO_CAST
6027 "CAST5-ECB",
6028 #endif
6029 #ifndef OPENSSL_NO_RC2
6030 "RC2-ECB",
6031 #endif
6032 #ifndef OPENSSL_NO_RC4
6033 "RC4",
6034 #endif
6035 #ifndef OPENSSL_NO_RC5
6036 "RC5-ECB",
6037 #endif
6038 NULL
6039 };
6040
6041 /* Negative test for keylen change after key was set */
test_keylen_change(int idx)6042 static int test_keylen_change(int idx)
6043 {
6044 int outlen;
6045 int res = 0;
6046 unsigned char outbuf[1024];
6047 static const unsigned char key[] = {
6048 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82,
6049 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34
6050 };
6051 EVP_CIPHER_CTX *ctx = NULL;
6052 EVP_CIPHER *ciph = NULL;
6053 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
6054 size_t keylen = 12; /* non-default key length */
6055
6056 if (lgcyprov == NULL)
6057 return TEST_skip("Test requires legacy provider to be loaded");
6058
6059 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
6060 goto err;
6061
6062 if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, keylen_change_ciphers[idx],
6063 testpropq)))
6064 goto err;
6065
6066 if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, key, NULL, 1)))
6067 goto err;
6068
6069 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext,
6070 sizeof(gcmDefaultPlaintext))))
6071 goto err;
6072
6073 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN,
6074 &keylen);
6075 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)))
6076 goto err;
6077
6078 ERR_set_mark();
6079 if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext,
6080 sizeof(gcmDefaultPlaintext)))) {
6081 ERR_clear_last_mark();
6082 goto err;
6083 }
6084 ERR_pop_to_mark();
6085
6086 res = 1;
6087 err:
6088 EVP_CIPHER_CTX_free(ctx);
6089 EVP_CIPHER_free(ciph);
6090 return res;
6091 }
6092
6093 #ifndef OPENSSL_NO_DEPRECATED_3_0
6094 static EVP_PKEY_METHOD *custom_pmeth = NULL;
6095 static const EVP_PKEY_METHOD *orig_pmeth = NULL;
6096
6097 #define EVP_PKEY_CTRL_MY_COMMAND 9999
6098
custom_pmeth_init(EVP_PKEY_CTX * ctx)6099 static int custom_pmeth_init(EVP_PKEY_CTX *ctx)
6100 {
6101 int (*pinit)(EVP_PKEY_CTX *ctx);
6102
6103 EVP_PKEY_meth_get_init(orig_pmeth, &pinit);
6104 return pinit(ctx);
6105 }
6106
custom_pmeth_cleanup(EVP_PKEY_CTX * ctx)6107 static void custom_pmeth_cleanup(EVP_PKEY_CTX *ctx)
6108 {
6109 void (*pcleanup)(EVP_PKEY_CTX *ctx);
6110
6111 EVP_PKEY_meth_get_cleanup(orig_pmeth, &pcleanup);
6112 pcleanup(ctx);
6113 }
6114
custom_pmeth_sign(EVP_PKEY_CTX * ctx,unsigned char * out,size_t * outlen,const unsigned char * in,size_t inlen)6115 static int custom_pmeth_sign(EVP_PKEY_CTX *ctx, unsigned char *out,
6116 size_t *outlen, const unsigned char *in,
6117 size_t inlen)
6118 {
6119 int (*psign)(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
6120 const unsigned char *tbs, size_t tbslen);
6121
6122 EVP_PKEY_meth_get_sign(orig_pmeth, NULL, &psign);
6123 return psign(ctx, out, outlen, in, inlen);
6124 }
6125
custom_pmeth_digestsign(EVP_MD_CTX * ctx,unsigned char * sig,size_t * siglen,const unsigned char * tbs,size_t tbslen)6126 static int custom_pmeth_digestsign(EVP_MD_CTX *ctx, unsigned char *sig,
6127 size_t *siglen, const unsigned char *tbs,
6128 size_t tbslen)
6129 {
6130 int (*pdigestsign)(EVP_MD_CTX *ctx, unsigned char *sig, size_t *siglen,
6131 const unsigned char *tbs, size_t tbslen);
6132
6133 EVP_PKEY_meth_get_digestsign(orig_pmeth, &pdigestsign);
6134 return pdigestsign(ctx, sig, siglen, tbs, tbslen);
6135 }
6136
custom_pmeth_derive(EVP_PKEY_CTX * ctx,unsigned char * key,size_t * keylen)6137 static int custom_pmeth_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
6138 size_t *keylen)
6139 {
6140 int (*pderive)(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen);
6141
6142 EVP_PKEY_meth_get_derive(orig_pmeth, NULL, &pderive);
6143 return pderive(ctx, key, keylen);
6144 }
6145
custom_pmeth_copy(EVP_PKEY_CTX * dst,const EVP_PKEY_CTX * src)6146 static int custom_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
6147 {
6148 int (*pcopy)(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src);
6149
6150 EVP_PKEY_meth_get_copy(orig_pmeth, &pcopy);
6151 return pcopy(dst, src);
6152 }
6153
6154 static int ctrl_called;
6155
custom_pmeth_ctrl(EVP_PKEY_CTX * ctx,int type,int p1,void * p2)6156 static int custom_pmeth_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
6157 {
6158 int (*pctrl)(EVP_PKEY_CTX *ctx, int type, int p1, void *p2);
6159
6160 EVP_PKEY_meth_get_ctrl(orig_pmeth, &pctrl, NULL);
6161
6162 if (type == EVP_PKEY_CTRL_MY_COMMAND) {
6163 ctrl_called = 1;
6164 return 1;
6165 }
6166
6167 return pctrl(ctx, type, p1, p2);
6168 }
6169
test_custom_pmeth(int idx)6170 static int test_custom_pmeth(int idx)
6171 {
6172 EVP_PKEY_CTX *pctx = NULL;
6173 EVP_MD_CTX *ctx = NULL;
6174 EVP_PKEY *pkey = NULL;
6175 int id, orig_id, orig_flags;
6176 int testresult = 0;
6177 size_t reslen;
6178 unsigned char *res = NULL;
6179 unsigned char msg[] = { 'H', 'e', 'l', 'l', 'o' };
6180 const EVP_MD *md = EVP_sha256();
6181 int doderive = 0;
6182
6183 ctrl_called = 0;
6184
6185 /* We call deprecated APIs so this test doesn't support a custom libctx */
6186 if (testctx != NULL)
6187 return 1;
6188
6189 switch (idx) {
6190 case 0:
6191 case 6:
6192 id = EVP_PKEY_RSA;
6193 pkey = load_example_rsa_key();
6194 break;
6195 case 1:
6196 case 7:
6197 #ifndef OPENSSL_NO_DSA
6198 id = EVP_PKEY_DSA;
6199 pkey = load_example_dsa_key();
6200 break;
6201 #else
6202 return 1;
6203 #endif
6204 case 2:
6205 case 8:
6206 #ifndef OPENSSL_NO_EC
6207 id = EVP_PKEY_EC;
6208 pkey = load_example_ec_key();
6209 break;
6210 #else
6211 return 1;
6212 #endif
6213 case 3:
6214 case 9:
6215 #ifndef OPENSSL_NO_ECX
6216 id = EVP_PKEY_ED25519;
6217 md = NULL;
6218 pkey = load_example_ed25519_key();
6219 break;
6220 #else
6221 return 1;
6222 #endif
6223 case 4:
6224 case 10:
6225 #ifndef OPENSSL_NO_DH
6226 id = EVP_PKEY_DH;
6227 doderive = 1;
6228 pkey = load_example_dh_key();
6229 break;
6230 #else
6231 return 1;
6232 #endif
6233 case 5:
6234 case 11:
6235 #ifndef OPENSSL_NO_ECX
6236 id = EVP_PKEY_X25519;
6237 doderive = 1;
6238 pkey = load_example_x25519_key();
6239 break;
6240 #else
6241 return 1;
6242 #endif
6243 default:
6244 TEST_error("Should not happen");
6245 goto err;
6246 }
6247
6248 if (!TEST_ptr(pkey))
6249 goto err;
6250
6251 if (idx < 6) {
6252 if (!TEST_true(evp_pkey_is_provided(pkey)))
6253 goto err;
6254 } else {
6255 EVP_PKEY *tmp = pkey;
6256
6257 /* Convert to a legacy key */
6258 pkey = EVP_PKEY_new();
6259 if (!TEST_ptr(pkey)) {
6260 pkey = tmp;
6261 goto err;
6262 }
6263 if (!TEST_true(evp_pkey_copy_downgraded(&pkey, tmp))) {
6264 EVP_PKEY_free(tmp);
6265 goto err;
6266 }
6267 EVP_PKEY_free(tmp);
6268 if (!TEST_true(evp_pkey_is_legacy(pkey)))
6269 goto err;
6270 }
6271
6272 if (!TEST_ptr(orig_pmeth = EVP_PKEY_meth_find(id))
6273 || !TEST_ptr(pkey))
6274 goto err;
6275
6276 EVP_PKEY_meth_get0_info(&orig_id, &orig_flags, orig_pmeth);
6277 if (!TEST_int_eq(orig_id, id)
6278 || !TEST_ptr(custom_pmeth = EVP_PKEY_meth_new(id, orig_flags)))
6279 goto err;
6280
6281 if (id == EVP_PKEY_ED25519) {
6282 EVP_PKEY_meth_set_digestsign(custom_pmeth, custom_pmeth_digestsign);
6283 }
6284 if (id == EVP_PKEY_DH || id == EVP_PKEY_X25519) {
6285 EVP_PKEY_meth_set_derive(custom_pmeth, NULL, custom_pmeth_derive);
6286 } else {
6287 EVP_PKEY_meth_set_sign(custom_pmeth, NULL, custom_pmeth_sign);
6288 }
6289 if (id != EVP_PKEY_ED25519 && id != EVP_PKEY_X25519) {
6290 EVP_PKEY_meth_set_init(custom_pmeth, custom_pmeth_init);
6291 EVP_PKEY_meth_set_cleanup(custom_pmeth, custom_pmeth_cleanup);
6292 EVP_PKEY_meth_set_copy(custom_pmeth, custom_pmeth_copy);
6293 }
6294 EVP_PKEY_meth_set_ctrl(custom_pmeth, custom_pmeth_ctrl, NULL);
6295 if (!TEST_true(EVP_PKEY_meth_add0(custom_pmeth)))
6296 goto err;
6297
6298 if (doderive) {
6299 pctx = EVP_PKEY_CTX_new(pkey, NULL);
6300 if (!TEST_ptr(pctx)
6301 || !TEST_int_eq(EVP_PKEY_derive_init(pctx), 1)
6302 || !TEST_int_ge(EVP_PKEY_CTX_ctrl(pctx, -1, -1,
6303 EVP_PKEY_CTRL_MY_COMMAND, 0, NULL),
6304 1)
6305 || !TEST_int_eq(ctrl_called, 1)
6306 || !TEST_int_ge(EVP_PKEY_derive_set_peer(pctx, pkey), 1)
6307 || !TEST_int_ge(EVP_PKEY_derive(pctx, NULL, &reslen), 1)
6308 || !TEST_ptr(res = OPENSSL_malloc(reslen))
6309 || !TEST_int_ge(EVP_PKEY_derive(pctx, res, &reslen), 1))
6310 goto err;
6311 } else {
6312 ctx = EVP_MD_CTX_new();
6313 reslen = EVP_PKEY_size(pkey);
6314 res = OPENSSL_malloc(reslen);
6315 if (!TEST_ptr(ctx)
6316 || !TEST_ptr(res)
6317 || !TEST_true(EVP_DigestSignInit(ctx, &pctx, md, NULL, pkey))
6318 || !TEST_int_ge(EVP_PKEY_CTX_ctrl(pctx, -1, -1,
6319 EVP_PKEY_CTRL_MY_COMMAND, 0, NULL),
6320 1)
6321 || !TEST_int_eq(ctrl_called, 1))
6322 goto err;
6323
6324 if (id == EVP_PKEY_ED25519) {
6325 if (!TEST_true(EVP_DigestSign(ctx, res, &reslen, msg, sizeof(msg))))
6326 goto err;
6327 } else {
6328 if (!TEST_true(EVP_DigestUpdate(ctx, msg, sizeof(msg)))
6329 || !TEST_true(EVP_DigestSignFinal(ctx, res, &reslen)))
6330 goto err;
6331 }
6332 }
6333
6334 testresult = 1;
6335 err:
6336 OPENSSL_free(res);
6337 EVP_MD_CTX_free(ctx);
6338 if (doderive)
6339 EVP_PKEY_CTX_free(pctx);
6340 EVP_PKEY_free(pkey);
6341 EVP_PKEY_meth_remove(custom_pmeth);
6342 EVP_PKEY_meth_free(custom_pmeth);
6343 custom_pmeth = NULL;
6344 return testresult;
6345 }
6346
test_evp_md_cipher_meth(void)6347 static int test_evp_md_cipher_meth(void)
6348 {
6349 EVP_MD *md = EVP_MD_meth_dup(EVP_sha256());
6350 EVP_CIPHER *ciph = EVP_CIPHER_meth_dup(EVP_aes_128_cbc());
6351 int testresult = 0;
6352
6353 if (!TEST_ptr(md) || !TEST_ptr(ciph))
6354 goto err;
6355
6356 testresult = 1;
6357
6358 err:
6359 EVP_MD_meth_free(md);
6360 EVP_CIPHER_meth_free(ciph);
6361
6362 return testresult;
6363 }
6364
6365 typedef struct {
6366 int data;
6367 } custom_dgst_ctx;
6368
6369 static int custom_md_init_called = 0;
6370 static int custom_md_cleanup_called = 0;
6371
custom_md_init(EVP_MD_CTX * ctx)6372 static int custom_md_init(EVP_MD_CTX *ctx)
6373 {
6374 custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx);
6375
6376 if (p == NULL)
6377 return 0;
6378
6379 custom_md_init_called++;
6380 return 1;
6381 }
6382
custom_md_cleanup(EVP_MD_CTX * ctx)6383 static int custom_md_cleanup(EVP_MD_CTX *ctx)
6384 {
6385 custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx);
6386
6387 if (p == NULL)
6388 /* Nothing to do */
6389 return 1;
6390
6391 custom_md_cleanup_called++;
6392 return 1;
6393 }
6394
test_custom_md_meth(void)6395 static int test_custom_md_meth(void)
6396 {
6397 ASN1_OBJECT *o = NULL;
6398 EVP_MD_CTX *mdctx = NULL;
6399 EVP_MD *tmp = NULL;
6400 char mess[] = "Test Message\n";
6401 unsigned char md_value[EVP_MAX_MD_SIZE];
6402 unsigned int md_len;
6403 int testresult = 0;
6404 int nid;
6405
6406 /*
6407 * We are testing deprecated functions. We don't support a non-default
6408 * library context in this test.
6409 */
6410 if (testctx != NULL)
6411 return TEST_skip("Non-default libctx");
6412
6413 custom_md_init_called = custom_md_cleanup_called = 0;
6414
6415 nid = OBJ_create("1.3.6.1.4.1.16604.998866.1", "custom-md", "custom-md");
6416 if (!TEST_int_ne(nid, NID_undef))
6417 goto err;
6418 tmp = EVP_MD_meth_new(nid, NID_undef);
6419 if (!TEST_ptr(tmp))
6420 goto err;
6421
6422 if (!TEST_true(EVP_MD_meth_set_init(tmp, custom_md_init))
6423 || !TEST_true(EVP_MD_meth_set_cleanup(tmp, custom_md_cleanup))
6424 || !TEST_true(EVP_MD_meth_set_app_datasize(tmp,
6425 sizeof(custom_dgst_ctx))))
6426 goto err;
6427
6428 mdctx = EVP_MD_CTX_new();
6429 if (!TEST_ptr(mdctx)
6430 /*
6431 * Initing our custom md and then initing another md should
6432 * result in the init and cleanup functions of the custom md
6433 * being called.
6434 */
6435 || !TEST_true(EVP_DigestInit_ex(mdctx, tmp, NULL))
6436 || !TEST_true(EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL))
6437 || !TEST_true(EVP_DigestUpdate(mdctx, mess, strlen(mess)))
6438 || !TEST_true(EVP_DigestFinal_ex(mdctx, md_value, &md_len))
6439 || !TEST_int_eq(custom_md_init_called, 1)
6440 || !TEST_int_eq(custom_md_cleanup_called, 1))
6441 goto err;
6442
6443 if (!TEST_int_eq(OBJ_create("1.3.6.1.4.1.16604.998866.1",
6444 "custom-md", "custom-md"),
6445 NID_undef)
6446 || !TEST_int_eq(ERR_GET_LIB(ERR_peek_error()), ERR_LIB_OBJ)
6447 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), OBJ_R_OID_EXISTS))
6448 goto err;
6449
6450 o = ASN1_OBJECT_create(nid, (unsigned char *)"\53\6\1\4\1\201\201\134\274\373\122\1", 12,
6451 "custom-md", "custom-md");
6452 if (!TEST_int_eq(OBJ_add_object(o), nid))
6453 goto err;
6454
6455 testresult = 1;
6456 err:
6457 ASN1_OBJECT_free(o);
6458 EVP_MD_CTX_free(mdctx);
6459 EVP_MD_meth_free(tmp);
6460 return testresult;
6461 }
6462
6463 typedef struct {
6464 int data;
6465 } custom_ciph_ctx;
6466
6467 static int custom_ciph_init_called = 0;
6468 static int custom_ciph_cleanup_called = 0;
6469
custom_ciph_init(EVP_CIPHER_CTX * ctx,const unsigned char * key,const unsigned char * iv,int enc)6470 static int custom_ciph_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
6471 const unsigned char *iv, int enc)
6472 {
6473 custom_ciph_ctx *p = EVP_CIPHER_CTX_get_cipher_data(ctx);
6474
6475 if (p == NULL)
6476 return 0;
6477
6478 custom_ciph_init_called++;
6479 return 1;
6480 }
6481
custom_ciph_cleanup(EVP_CIPHER_CTX * ctx)6482 static int custom_ciph_cleanup(EVP_CIPHER_CTX *ctx)
6483 {
6484 custom_ciph_ctx *p = EVP_CIPHER_CTX_get_cipher_data(ctx);
6485
6486 if (p == NULL)
6487 /* Nothing to do */
6488 return 1;
6489
6490 custom_ciph_cleanup_called++;
6491 return 1;
6492 }
6493
test_custom_ciph_meth(void)6494 static int test_custom_ciph_meth(void)
6495 {
6496 EVP_CIPHER_CTX *ciphctx = NULL;
6497 EVP_CIPHER *tmp = NULL;
6498 int testresult = 0;
6499 int nid;
6500
6501 /*
6502 * We are testing deprecated functions. We don't support a non-default
6503 * library context in this test.
6504 */
6505 if (testctx != NULL)
6506 return TEST_skip("Non-default libctx");
6507
6508 custom_ciph_init_called = custom_ciph_cleanup_called = 0;
6509
6510 nid = OBJ_create("1.3.6.1.4.1.16604.998866.2", "custom-ciph", "custom-ciph");
6511 if (!TEST_int_ne(nid, NID_undef))
6512 goto err;
6513 tmp = EVP_CIPHER_meth_new(nid, 16, 16);
6514 if (!TEST_ptr(tmp))
6515 goto err;
6516
6517 if (!TEST_true(EVP_CIPHER_meth_set_init(tmp, custom_ciph_init))
6518 || !TEST_true(EVP_CIPHER_meth_set_flags(tmp, EVP_CIPH_ALWAYS_CALL_INIT))
6519 || !TEST_true(EVP_CIPHER_meth_set_cleanup(tmp, custom_ciph_cleanup))
6520 || !TEST_true(EVP_CIPHER_meth_set_impl_ctx_size(tmp,
6521 sizeof(custom_ciph_ctx))))
6522 goto err;
6523
6524 ciphctx = EVP_CIPHER_CTX_new();
6525 if (!TEST_ptr(ciphctx)
6526 /*
6527 * Initing our custom cipher and then initing another cipher
6528 * should result in the init and cleanup functions of the custom
6529 * cipher being called.
6530 */
6531 || !TEST_true(EVP_CipherInit_ex(ciphctx, tmp, NULL, NULL, NULL, 1))
6532 || !TEST_true(EVP_CipherInit_ex(ciphctx, EVP_aes_128_cbc(), NULL,
6533 NULL, NULL, 1))
6534 || !TEST_int_eq(custom_ciph_init_called, 1)
6535 || !TEST_int_eq(custom_ciph_cleanup_called, 1))
6536 goto err;
6537
6538 testresult = 1;
6539 err:
6540 EVP_CIPHER_CTX_free(ciphctx);
6541 EVP_CIPHER_meth_free(tmp);
6542 return testresult;
6543 }
6544
test_rsasve_kem_with_invalid_pub_key(void)6545 static int test_rsasve_kem_with_invalid_pub_key(void)
6546 {
6547 RSA *rsa = NULL;
6548 EVP_PKEY *pkey = NULL;
6549 EVP_PKEY_CTX *ctx = NULL;
6550 unsigned char *ct = NULL;
6551 unsigned char *secret = NULL;
6552 size_t ctlen = 0, secretlen = 0;
6553 int testresult = 0;
6554
6555 if (nullprov != NULL) {
6556 testresult = TEST_skip("Test does not support a non-default library context");
6557 goto err;
6558 }
6559
6560 if (!TEST_ptr(pkey = make_bad_rsa_pubkey()))
6561 goto err;
6562
6563 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL))
6564 || !TEST_int_eq(EVP_PKEY_encapsulate_init(ctx, NULL), 1)
6565 || !TEST_int_eq(EVP_PKEY_CTX_set_kem_op(ctx, "RSASVE"), 1)
6566 || !TEST_int_eq(EVP_PKEY_encapsulate(ctx, NULL, &ctlen, NULL, &secretlen), 1)
6567 || !TEST_ptr(ct = OPENSSL_malloc(ctlen))
6568 || !TEST_ptr(secret = OPENSSL_malloc(secretlen)))
6569 goto err;
6570
6571 if (!TEST_int_eq(EVP_PKEY_encapsulate(ctx, ct, &ctlen, secret, &secretlen), 0))
6572 goto err;
6573
6574 testresult = 1;
6575
6576 err:
6577 OPENSSL_free(secret);
6578 OPENSSL_free(ct);
6579 EVP_PKEY_CTX_free(ctx);
6580 RSA_free(rsa);
6581 EVP_PKEY_free(pkey);
6582 return testresult;
6583 }
6584
6585 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
6586 /* Test we can create a signature keys with an associated ENGINE */
test_signatures_with_engine(int tst)6587 static int test_signatures_with_engine(int tst)
6588 {
6589 ENGINE *e;
6590 const char *engine_id = "dasync";
6591 EVP_PKEY *pkey = NULL;
6592 const unsigned char badcmackey[] = { 0x00, 0x01 };
6593 const unsigned char cmackey[] = {
6594 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
6595 0x0c, 0x0d, 0x0e, 0x0f
6596 };
6597 const unsigned char ed25519key[] = {
6598 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
6599 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
6600 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
6601 };
6602 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 };
6603 int testresult = 0;
6604 EVP_MD_CTX *ctx = NULL;
6605 unsigned char *mac = NULL;
6606 size_t maclen = 0;
6607 int ret;
6608
6609 #ifdef OPENSSL_NO_CMAC
6610 /* Skip CMAC tests in a no-cmac build */
6611 if (tst <= 1)
6612 return 1;
6613 #endif
6614 #ifdef OPENSSL_NO_ECX
6615 /* Skip ECX tests in a no-ecx build */
6616 if (tst == 2)
6617 return 1;
6618 #endif
6619
6620 if (!TEST_ptr(e = ENGINE_by_id(engine_id)))
6621 return 0;
6622
6623 if (!TEST_true(ENGINE_init(e))) {
6624 ENGINE_free(e);
6625 return 0;
6626 }
6627
6628 switch (tst) {
6629 case 0:
6630 pkey = EVP_PKEY_new_CMAC_key(e, cmackey, sizeof(cmackey),
6631 EVP_aes_128_cbc());
6632 break;
6633 case 1:
6634 pkey = EVP_PKEY_new_CMAC_key(e, badcmackey, sizeof(badcmackey),
6635 EVP_aes_128_cbc());
6636 break;
6637 case 2:
6638 pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, e, ed25519key,
6639 sizeof(ed25519key));
6640 break;
6641 default:
6642 TEST_error("Invalid test case");
6643 goto err;
6644 }
6645 if (!TEST_ptr(pkey))
6646 goto err;
6647
6648 if (!TEST_ptr(ctx = EVP_MD_CTX_new()))
6649 goto err;
6650
6651 ret = EVP_DigestSignInit(ctx, NULL, tst == 2 ? NULL : EVP_sha256(), NULL,
6652 pkey);
6653 if (tst == 0) {
6654 if (!TEST_true(ret))
6655 goto err;
6656
6657 if (!TEST_true(EVP_DigestSignUpdate(ctx, msg, sizeof(msg)))
6658 || !TEST_true(EVP_DigestSignFinal(ctx, NULL, &maclen)))
6659 goto err;
6660
6661 if (!TEST_ptr(mac = OPENSSL_malloc(maclen)))
6662 goto err;
6663
6664 if (!TEST_true(EVP_DigestSignFinal(ctx, mac, &maclen)))
6665 goto err;
6666 } else {
6667 /* We used a bad key. We expect a failure here */
6668 if (!TEST_false(ret))
6669 goto err;
6670 }
6671
6672 testresult = 1;
6673 err:
6674 EVP_MD_CTX_free(ctx);
6675 OPENSSL_free(mac);
6676 EVP_PKEY_free(pkey);
6677 ENGINE_finish(e);
6678 ENGINE_free(e);
6679
6680 return testresult;
6681 }
6682
test_cipher_with_engine(void)6683 static int test_cipher_with_engine(void)
6684 {
6685 ENGINE *e;
6686 const char *engine_id = "dasync";
6687 const unsigned char keyiv[] = {
6688 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
6689 0x0c, 0x0d, 0x0e, 0x0f
6690 };
6691 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 };
6692 int testresult = 0;
6693 EVP_CIPHER_CTX *ctx = NULL, *ctx2 = NULL;
6694 unsigned char buf[AES_BLOCK_SIZE];
6695 int len = 0;
6696
6697 if (!TEST_ptr(e = ENGINE_by_id(engine_id)))
6698 return 0;
6699
6700 if (!TEST_true(ENGINE_init(e))) {
6701 ENGINE_free(e);
6702 return 0;
6703 }
6704
6705 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())
6706 || !TEST_ptr(ctx2 = EVP_CIPHER_CTX_new()))
6707 goto err;
6708
6709 if (!TEST_true(EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), e, keyiv, keyiv)))
6710 goto err;
6711
6712 /* Copy the ctx, and complete the operation with the new ctx */
6713 if (!TEST_true(EVP_CIPHER_CTX_copy(ctx2, ctx)))
6714 goto err;
6715
6716 if (!TEST_true(EVP_EncryptUpdate(ctx2, buf, &len, msg, sizeof(msg)))
6717 || !TEST_true(EVP_EncryptFinal_ex(ctx2, buf + len, &len)))
6718 goto err;
6719
6720 testresult = 1;
6721 err:
6722 EVP_CIPHER_CTX_free(ctx);
6723 EVP_CIPHER_CTX_free(ctx2);
6724 ENGINE_finish(e);
6725 ENGINE_free(e);
6726
6727 return testresult;
6728 }
6729 #endif /* OPENSSL_NO_DYNAMIC_ENGINE */
6730 #endif /* OPENSSL_NO_DEPRECATED_3_0 */
6731
6732 #ifndef OPENSSL_NO_ECX
6733 static int ecxnids[] = {
6734 NID_X25519,
6735 NID_X448,
6736 NID_ED25519,
6737 NID_ED448
6738 };
6739
6740 /* Test that creating ECX keys with a short private key fails as expected */
test_ecx_short_keys(int tst)6741 static int test_ecx_short_keys(int tst)
6742 {
6743 unsigned char ecxkeydata = 1;
6744 EVP_PKEY *pkey;
6745
6746 pkey = EVP_PKEY_new_raw_private_key_ex(testctx, OBJ_nid2sn(ecxnids[tst]),
6747 NULL, &ecxkeydata, 1);
6748 if (!TEST_ptr_null(pkey)) {
6749 EVP_PKEY_free(pkey);
6750 return 0;
6751 }
6752
6753 return 1;
6754 }
6755 #endif
6756
6757 typedef enum OPTION_choice {
6758 OPT_ERR = -1,
6759 OPT_EOF = 0,
6760 OPT_CONTEXT,
6761 OPT_CONFIG_FILE,
6762 OPT_TEST_ENUM
6763 } OPTION_CHOICE;
6764
test_get_options(void)6765 const OPTIONS *test_get_options(void)
6766 {
6767 static const OPTIONS options[] = {
6768 OPT_TEST_OPTIONS_DEFAULT_USAGE,
6769 { "context", OPT_CONTEXT, '-', "Explicitly use a non-default library context" },
6770 { "config", OPT_CONFIG_FILE, '<',
6771 "The configuration file to use for the libctx" },
6772 { NULL }
6773 };
6774 return options;
6775 }
6776
6777 #ifndef OPENSSL_NO_ECX
6778 /* Test that trying to sign with a public key errors out gracefully */
test_ecx_not_private_key(int tst)6779 static int test_ecx_not_private_key(int tst)
6780 {
6781 EVP_PKEY *pkey = NULL;
6782
6783 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 };
6784 int testresult = 0;
6785 EVP_MD_CTX *ctx = NULL;
6786 unsigned char *mac = NULL;
6787 size_t maclen = 0;
6788 const uint8_t *pubkey;
6789 size_t pubkeylen;
6790
6791 switch (keys[tst].type) {
6792 case NID_X25519:
6793 case NID_X448:
6794 case NID_undef:
6795 return TEST_skip("signing not supported for X25519/X448/ML-KEM");
6796 }
6797
6798 /* Check if this algorithm supports public keys */
6799 if (keys[tst].pub == NULL)
6800 return TEST_skip("no public key present");
6801
6802 pubkey = keys[tst].pub;
6803 pubkeylen = keys[tst].publen;
6804
6805 pkey = EVP_PKEY_new_raw_public_key_ex(testctx, OBJ_nid2sn(keys[tst].type),
6806 NULL, pubkey, pubkeylen);
6807 if (!TEST_ptr(pkey))
6808 goto err;
6809
6810 if (!TEST_ptr(ctx = EVP_MD_CTX_new()))
6811 goto err;
6812
6813 if (EVP_DigestSignInit(ctx, NULL, NULL, NULL, pkey) != 1)
6814 goto check_err;
6815
6816 if (EVP_DigestSign(ctx, NULL, &maclen, msg, sizeof(msg)) != 1)
6817 goto check_err;
6818
6819 if (!TEST_ptr(mac = OPENSSL_malloc(maclen)))
6820 goto err;
6821
6822 if (!TEST_int_eq(EVP_DigestSign(ctx, mac, &maclen, msg, sizeof(msg)), 0))
6823 goto err;
6824
6825 check_err:
6826 /*
6827 * Currently only EVP_DigestSign will throw PROV_R_NOT_A_PRIVATE_KEY,
6828 * but we relax the check to allow error also thrown by
6829 * EVP_DigestSignInit and EVP_DigestSign.
6830 */
6831 if (ERR_GET_REASON(ERR_peek_error()) == PROV_R_NOT_A_PRIVATE_KEY) {
6832 testresult = 1;
6833 ERR_clear_error();
6834 }
6835
6836 err:
6837 EVP_MD_CTX_free(ctx);
6838 OPENSSL_free(mac);
6839 EVP_PKEY_free(pkey);
6840
6841 return testresult;
6842 }
6843 #endif /* OPENSSL_NO_ECX */
6844
test_sign_continuation(void)6845 static int test_sign_continuation(void)
6846 {
6847 OSSL_PROVIDER *fake_rsa = NULL;
6848 int testresult = 0;
6849 EVP_PKEY *pkey = NULL;
6850 EVP_PKEY_CTX *pctx = NULL;
6851 EVP_MD_CTX *mctx = NULL;
6852 const char sigbuf[] = "To Be Signed";
6853 unsigned char signature[256];
6854 size_t siglen = 256;
6855 static int nodupnum = 1;
6856 static const OSSL_PARAM nodup_params[] = {
6857 OSSL_PARAM_int("NO_DUP", &nodupnum),
6858 OSSL_PARAM_END
6859 };
6860
6861 if (!TEST_ptr(fake_rsa = fake_rsa_start(testctx)))
6862 return 0;
6863
6864 /* Construct a pkey using precise propq to use our provider */
6865 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA",
6866 "provider=fake-rsa"))
6867 || !TEST_true(EVP_PKEY_fromdata_init(pctx))
6868 || !TEST_true(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, NULL))
6869 || !TEST_ptr(pkey))
6870 goto end;
6871
6872 /* First test it continues (classic behavior) */
6873 if (!TEST_ptr(mctx = EVP_MD_CTX_new())
6874 || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx,
6875 NULL, pkey, NULL))
6876 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf)))
6877 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen))
6878 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf)))
6879 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen)))
6880 goto end;
6881
6882 EVP_MD_CTX_free(mctx);
6883
6884 /* try again but failing the continuation */
6885 if (!TEST_ptr(mctx = EVP_MD_CTX_new())
6886 || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx,
6887 NULL, pkey, nodup_params))
6888 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf)))
6889 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen))
6890 || !TEST_false(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf)))
6891 || !TEST_false(EVP_DigestSignFinal(mctx, signature, &siglen)))
6892 goto end;
6893
6894 testresult = 1;
6895
6896 end:
6897 EVP_MD_CTX_free(mctx);
6898 EVP_PKEY_free(pkey);
6899 EVP_PKEY_CTX_free(pctx);
6900 fake_rsa_finish(fake_rsa);
6901 return testresult;
6902 }
6903
aes_gcm_encrypt(const unsigned char * gcm_key,size_t gcm_key_s,const unsigned char * gcm_iv,size_t gcm_ivlen,const unsigned char * gcm_pt,size_t gcm_pt_s,const unsigned char * gcm_aad,size_t gcm_aad_s,const unsigned char * gcm_ct,size_t gcm_ct_s,const unsigned char * gcm_tag,size_t gcm_tag_s)6904 static int aes_gcm_encrypt(const unsigned char *gcm_key, size_t gcm_key_s,
6905 const unsigned char *gcm_iv, size_t gcm_ivlen,
6906 const unsigned char *gcm_pt, size_t gcm_pt_s,
6907 const unsigned char *gcm_aad, size_t gcm_aad_s,
6908 const unsigned char *gcm_ct, size_t gcm_ct_s,
6909 const unsigned char *gcm_tag, size_t gcm_tag_s)
6910 {
6911 int ret = 0;
6912 EVP_CIPHER_CTX *ctx;
6913 EVP_CIPHER *cipher = NULL;
6914 int outlen, tmplen;
6915 unsigned char outbuf[1024];
6916 unsigned char outtag[16];
6917 OSSL_PARAM params[2] = {
6918 OSSL_PARAM_END, OSSL_PARAM_END
6919 };
6920
6921 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())
6922 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "")))
6923 goto err;
6924
6925 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN,
6926 &gcm_ivlen);
6927
6928 if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params))
6929 || (gcm_aad != NULL
6930 && !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen,
6931 gcm_aad, gcm_aad_s)))
6932 || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen,
6933 gcm_pt, gcm_pt_s))
6934 || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen)))
6935 goto err;
6936
6937 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG,
6938 outtag, sizeof(outtag));
6939
6940 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))
6941 || !TEST_mem_eq(outbuf, outlen, gcm_ct, gcm_ct_s)
6942 || !TEST_mem_eq(outtag, gcm_tag_s, gcm_tag, gcm_tag_s))
6943 goto err;
6944
6945 ret = 1;
6946 err:
6947 EVP_CIPHER_free(cipher);
6948 EVP_CIPHER_CTX_free(ctx);
6949
6950 return ret;
6951 }
6952
aes_gcm_decrypt(const unsigned char * gcm_key,size_t gcm_key_s,const unsigned char * gcm_iv,size_t gcm_ivlen,const unsigned char * gcm_pt,size_t gcm_pt_s,const unsigned char * gcm_aad,size_t gcm_aad_s,const unsigned char * gcm_ct,size_t gcm_ct_s,const unsigned char * gcm_tag,size_t gcm_tag_s)6953 static int aes_gcm_decrypt(const unsigned char *gcm_key, size_t gcm_key_s,
6954 const unsigned char *gcm_iv, size_t gcm_ivlen,
6955 const unsigned char *gcm_pt, size_t gcm_pt_s,
6956 const unsigned char *gcm_aad, size_t gcm_aad_s,
6957 const unsigned char *gcm_ct, size_t gcm_ct_s,
6958 const unsigned char *gcm_tag, size_t gcm_tag_s)
6959 {
6960 int ret = 0;
6961 EVP_CIPHER_CTX *ctx;
6962 EVP_CIPHER *cipher = NULL;
6963 int outlen;
6964 unsigned char outbuf[1024];
6965 OSSL_PARAM params[2] = {
6966 OSSL_PARAM_END, OSSL_PARAM_END
6967 };
6968
6969 if ((ctx = EVP_CIPHER_CTX_new()) == NULL)
6970 goto err;
6971
6972 if ((cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "")) == NULL)
6973 goto err;
6974
6975 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN,
6976 &gcm_ivlen);
6977
6978 if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params))
6979 || (gcm_aad != NULL
6980 && !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outlen,
6981 gcm_aad, gcm_aad_s)))
6982 || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen,
6983 gcm_ct, gcm_ct_s))
6984 || !TEST_mem_eq(outbuf, outlen, gcm_pt, gcm_pt_s))
6985 goto err;
6986
6987 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG,
6988 (void *)gcm_tag, gcm_tag_s);
6989
6990 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))
6991 || !TEST_true(EVP_DecryptFinal_ex(ctx, outbuf, &outlen)))
6992 goto err;
6993
6994 ret = 1;
6995 err:
6996 EVP_CIPHER_free(cipher);
6997 EVP_CIPHER_CTX_free(ctx);
6998
6999 return ret;
7000 }
7001
test_aes_gcm_ivlen_change_cve_2023_5363(void)7002 static int test_aes_gcm_ivlen_change_cve_2023_5363(void)
7003 {
7004 /* AES-GCM test data obtained from NIST public test vectors */
7005 static const unsigned char gcm_key[] = {
7006 0xd0, 0xc2, 0x67, 0xc1, 0x9f, 0x30, 0xd8, 0x0b, 0x89, 0x14, 0xbb, 0xbf,
7007 0xb7, 0x2f, 0x73, 0xb8, 0xd3, 0xcd, 0x5f, 0x6a, 0x78, 0x70, 0x15, 0x84,
7008 0x8a, 0x7b, 0x30, 0xe3, 0x8f, 0x16, 0xf1, 0x8b
7009 };
7010 static const unsigned char gcm_iv[] = {
7011 0xb6, 0xdc, 0xda, 0x95, 0xac, 0x99, 0x77, 0x76, 0x25, 0xae, 0x87, 0xf8,
7012 0xa3, 0xa9, 0xdd, 0x64, 0xd7, 0x9b, 0xbd, 0x5f, 0x4a, 0x0e, 0x54, 0xca,
7013 0x1a, 0x9f, 0xa2, 0xe3, 0xf4, 0x5f, 0x5f, 0xc2, 0xce, 0xa7, 0xb6, 0x14,
7014 0x12, 0x6f, 0xf0, 0xaf, 0xfd, 0x3e, 0x17, 0x35, 0x6e, 0xa0, 0x16, 0x09,
7015 0xdd, 0xa1, 0x3f, 0xd8, 0xdd, 0xf3, 0xdf, 0x4f, 0xcb, 0x18, 0x49, 0xb8,
7016 0xb3, 0x69, 0x2c, 0x5d, 0x4f, 0xad, 0x30, 0x91, 0x08, 0xbc, 0xbe, 0x24,
7017 0x01, 0x0f, 0xbe, 0x9c, 0xfb, 0x4f, 0x5d, 0x19, 0x7f, 0x4c, 0x53, 0xb0,
7018 0x95, 0x90, 0xac, 0x7b, 0x1f, 0x7b, 0xa0, 0x99, 0xe1, 0xf3, 0x48, 0x54,
7019 0xd0, 0xfc, 0xa9, 0xcc, 0x91, 0xf8, 0x1f, 0x9b, 0x6c, 0x9a, 0xe0, 0xdc,
7020 0x63, 0xea, 0x7d, 0x2a, 0x4a, 0x7d, 0xa5, 0xed, 0x68, 0x57, 0x27, 0x6b,
7021 0x68, 0xe0, 0xf2, 0xb8, 0x51, 0x50, 0x8d, 0x3d
7022 };
7023 static const unsigned char gcm_pt[] = {
7024 0xb8, 0xb6, 0x88, 0x36, 0x44, 0xe2, 0x34, 0xdf, 0x24, 0x32, 0x91, 0x07,
7025 0x4f, 0xe3, 0x6f, 0x81
7026 };
7027 static const unsigned char gcm_ct[] = {
7028 0xff, 0x4f, 0xb3, 0xf3, 0xf9, 0xa2, 0x51, 0xd4, 0x82, 0xc2, 0xbe, 0xf3,
7029 0xe2, 0xd0, 0xec, 0xed
7030 };
7031 static const unsigned char gcm_tag[] = {
7032 0xbd, 0x06, 0x38, 0x09, 0xf7, 0xe1, 0xc4, 0x72, 0x0e, 0xf2, 0xea, 0x63,
7033 0xdb, 0x99, 0x6c, 0x21
7034 };
7035
7036 return aes_gcm_encrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv),
7037 gcm_pt, sizeof(gcm_pt), NULL, 0,
7038 gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag))
7039 && aes_gcm_decrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv),
7040 gcm_pt, sizeof(gcm_pt), NULL, 0,
7041 gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag));
7042 }
7043
7044 #ifndef OPENSSL_NO_RC4
rc4_encrypt(const unsigned char * rc4_key,size_t rc4_key_s,const unsigned char * rc4_pt,size_t rc4_pt_s,const unsigned char * rc4_ct,size_t rc4_ct_s)7045 static int rc4_encrypt(const unsigned char *rc4_key, size_t rc4_key_s,
7046 const unsigned char *rc4_pt, size_t rc4_pt_s,
7047 const unsigned char *rc4_ct, size_t rc4_ct_s)
7048 {
7049 int ret = 0;
7050 EVP_CIPHER_CTX *ctx;
7051 EVP_CIPHER *cipher = NULL;
7052 int outlen, tmplen;
7053 unsigned char outbuf[1024];
7054 OSSL_PARAM params[2] = {
7055 OSSL_PARAM_END, OSSL_PARAM_END
7056 };
7057
7058 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())
7059 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "RC4", "")))
7060 goto err;
7061
7062 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN,
7063 &rc4_key_s);
7064
7065 if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, rc4_key, NULL, params))
7066 || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen,
7067 rc4_pt, rc4_pt_s))
7068 || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen)))
7069 goto err;
7070
7071 if (!TEST_mem_eq(outbuf, outlen, rc4_ct, rc4_ct_s))
7072 goto err;
7073
7074 ret = 1;
7075 err:
7076 EVP_CIPHER_free(cipher);
7077 EVP_CIPHER_CTX_free(ctx);
7078
7079 return ret;
7080 }
7081
rc4_decrypt(const unsigned char * rc4_key,size_t rc4_key_s,const unsigned char * rc4_pt,size_t rc4_pt_s,const unsigned char * rc4_ct,size_t rc4_ct_s)7082 static int rc4_decrypt(const unsigned char *rc4_key, size_t rc4_key_s,
7083 const unsigned char *rc4_pt, size_t rc4_pt_s,
7084 const unsigned char *rc4_ct, size_t rc4_ct_s)
7085 {
7086 int ret = 0;
7087 EVP_CIPHER_CTX *ctx;
7088 EVP_CIPHER *cipher = NULL;
7089 int outlen;
7090 unsigned char outbuf[1024];
7091 OSSL_PARAM params[2] = {
7092 OSSL_PARAM_END, OSSL_PARAM_END
7093 };
7094
7095 if ((ctx = EVP_CIPHER_CTX_new()) == NULL)
7096 goto err;
7097
7098 if ((cipher = EVP_CIPHER_fetch(testctx, "RC4", "")) == NULL)
7099 goto err;
7100
7101 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN,
7102 &rc4_key_s);
7103
7104 if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, rc4_key, NULL, params))
7105 || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen,
7106 rc4_ct, rc4_ct_s))
7107 || !TEST_mem_eq(outbuf, outlen, rc4_pt, rc4_pt_s))
7108 goto err;
7109
7110 ret = 1;
7111 err:
7112 EVP_CIPHER_free(cipher);
7113 EVP_CIPHER_CTX_free(ctx);
7114
7115 return ret;
7116 }
7117
test_aes_rc4_keylen_change_cve_2023_5363(void)7118 static int test_aes_rc4_keylen_change_cve_2023_5363(void)
7119 {
7120 /* RC4 test data obtained from RFC 6229 */
7121 static const struct {
7122 unsigned char key[5];
7123 unsigned char padding[11];
7124 } rc4_key = {
7125 { /* Five bytes of key material */
7126 0x83, 0x32, 0x22, 0x77, 0x2a },
7127 { /* Random padding to 16 bytes */
7128 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a, 0xaa, 0x32, 0x91 }
7129 };
7130 static const unsigned char rc4_pt[] = {
7131 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
7132 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
7133 };
7134 static const unsigned char rc4_ct[] = {
7135 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a,
7136 0x2e, 0x87, 0x9e, 0x92, 0xa4, 0x97, 0xef, 0xda
7137 };
7138
7139 if (lgcyprov == NULL)
7140 return TEST_skip("Test requires legacy provider to be loaded");
7141
7142 return rc4_encrypt(rc4_key.key, sizeof(rc4_key.key),
7143 rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct))
7144 && rc4_decrypt(rc4_key.key, sizeof(rc4_key.key),
7145 rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct));
7146 }
7147 #endif
7148
test_aes_gcm_siv_empty_data(void)7149 static int test_aes_gcm_siv_empty_data(void)
7150 {
7151 unsigned char key[16] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
7152 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10 };
7153 unsigned char nonce[12] = { 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11,
7154 0x22, 0x33, 0x44, 0x55 };
7155 unsigned char aad[33] = "this AAD was never authenticated";
7156 unsigned char zero_tag[16] = { 0 };
7157 unsigned char real_tag[16];
7158 unsigned char out[16];
7159 int outl, ret = 0;
7160 EVP_CIPHER_CTX *ctx = NULL;
7161 EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-GCM-SIV", NULL);
7162
7163 if (c == NULL) {
7164 return TEST_skip("AES-128-GCM-SIV cipher is not available");
7165 }
7166
7167 /* Compute the CORRECT tag for (key,nonce,aad,pt="") via encrypt */
7168 ctx = EVP_CIPHER_CTX_new();
7169 if (!TEST_ptr(ctx)
7170 || !TEST_true(EVP_EncryptInit_ex2(ctx, c, key, nonce, NULL))
7171 || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD */
7172 || !TEST_true(EVP_EncryptUpdate(ctx, out, &outl, aad, 0)) /* empty PT, out!=NULL */
7173 || !TEST_true(EVP_EncryptFinal_ex(ctx, out, &outl))
7174 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, real_tag)))
7175 goto err;
7176 EVP_CIPHER_CTX_free(ctx);
7177
7178 /* SANITY: decrypt with CORRECT tag and an explicit empty-PT Update */
7179 ctx = EVP_CIPHER_CTX_new();
7180 if (!TEST_ptr(ctx)
7181 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL))
7182 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag))
7183 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad)))
7184 || !TEST_true(EVP_DecryptUpdate(ctx, out, &outl, aad, 0)) /* force aes_gcm_siv_decrypt(len=0) */
7185 || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl)))
7186 goto err;
7187 EVP_CIPHER_CTX_free(ctx);
7188
7189 /* FORGERY A: AAD only, NO ciphertext Update, ALL-ZERO tag */
7190 ctx = EVP_CIPHER_CTX_new();
7191 if (!TEST_ptr(ctx)
7192 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL))
7193 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag))
7194 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD only, out==NULL */
7195 || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl)))
7196 goto err;
7197 EVP_CIPHER_CTX_free(ctx);
7198
7199 /* FORGERY B: no AAD, no Update at all, ALL-ZERO tag */
7200 ctx = EVP_CIPHER_CTX_new();
7201 if (!TEST_ptr(ctx)
7202 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL))
7203 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag))
7204 || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl)))
7205 goto err;
7206 EVP_CIPHER_CTX_free(ctx);
7207
7208 /* CONTROL: AAD only, NO ciphertext Update, CORRECT tag */
7209 ctx = EVP_CIPHER_CTX_new();
7210 if (!TEST_ptr(ctx)
7211 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL))
7212 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag))
7213 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad)))
7214 || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl)))
7215 goto err;
7216 EVP_CIPHER_CTX_free(ctx);
7217 ctx = NULL;
7218
7219 ret = 1;
7220 err:
7221 EVP_CIPHER_CTX_free(ctx);
7222
7223 EVP_CIPHER_free(c);
7224 return ret;
7225 }
7226
7227 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
test_chacha20_poly1305_late_aad(void)7228 static int test_chacha20_poly1305_late_aad(void)
7229 {
7230 EVP_CIPHER_CTX *ctx = NULL;
7231 EVP_CIPHER *c = NULL;
7232 unsigned char key[32] = { 0 };
7233 unsigned char iv[12] = { 0 };
7234 unsigned char aad[4] = "aad";
7235 unsigned char msg[8] = "message";
7236 unsigned char out[32];
7237 int len, test;
7238
7239 test = TEST_ptr(ctx = EVP_CIPHER_CTX_new())
7240 && TEST_ptr(c = EVP_CIPHER_fetch(testctx, "ChaCha20-Poly1305", testpropq))
7241 && TEST_true(EVP_EncryptInit_ex2(ctx, c, key, iv, NULL))
7242 && TEST_true(EVP_EncryptUpdate(ctx, NULL, &len, aad, sizeof(aad)))
7243 && TEST_true(EVP_EncryptUpdate(ctx, out, &len, msg, sizeof(msg)))
7244 && TEST_false(EVP_EncryptUpdate(ctx, NULL, &len, aad, sizeof(aad)));
7245
7246 EVP_CIPHER_free(c);
7247 EVP_CIPHER_CTX_free(ctx);
7248 return test;
7249 }
7250 #endif
7251 /*
7252 * AES-SIV reuse-without-rekey:
7253 * msg1: legit non-empty CT, tag verifies, final_ret=0
7254 * msg2: no reinit (or reinit with key=NULL), set forged tag,
7255 * AAD only, DecryptFinal -> does stale final_ret leak through?
7256 */
test_aes_siv_ctx_reuse(void)7257 static int test_aes_siv_ctx_reuse(void)
7258 {
7259 unsigned char key[32] = { 7 }; /* AES-128-SIV => 2*16 */
7260 unsigned char pt[9] = "payload!";
7261 unsigned char ct[9], tagbuf[16], out[16], zero16[16] = { 0 };
7262 unsigned char aad[14] = "forged header";
7263 int outl, ret = 0;
7264 EVP_CIPHER_CTX *e = NULL, *d = NULL;
7265 EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-SIV", NULL);
7266
7267 if (c == NULL) {
7268 return TEST_skip("AES-128-SIV cipher is not available");
7269 }
7270
7271 /* produce a valid (ct,tag) for msg1 */
7272 e = EVP_CIPHER_CTX_new();
7273 if (!TEST_ptr(e)
7274 || !TEST_true(EVP_EncryptInit_ex2(e, c, key, NULL, NULL))
7275 || !TEST_true(EVP_EncryptUpdate(e, NULL, &outl, (unsigned char *)"hdr1", 4))
7276 || !TEST_true(EVP_EncryptUpdate(e, ct, &outl, pt, sizeof(pt)))
7277 || !TEST_true(EVP_EncryptFinal_ex(e, out, &outl))
7278 || !TEST_true(EVP_CIPHER_CTX_ctrl(e, EVP_CTRL_AEAD_GET_TAG, 16, tagbuf))) {
7279 EVP_CIPHER_CTX_free(e);
7280 goto err;
7281 }
7282 EVP_CIPHER_CTX_free(e);
7283
7284 /* msg1 decrypt */
7285 d = EVP_CIPHER_CTX_new();
7286 if (!TEST_ptr(d)
7287 || !TEST_true(EVP_DecryptInit_ex2(d, c, key, NULL, NULL))
7288 || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, tagbuf))
7289 || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, (unsigned char *)"hdr1", 4))
7290 || !TEST_true(EVP_DecryptUpdate(d, out, &outl, ct, sizeof(ct)))
7291 || !TEST_true(EVP_DecryptFinal_ex(d, out, &outl)))
7292 goto err;
7293
7294 /* msg2 on SAME ctx, reinit with key=NULL => initkey skipped, final_ret should be reset */
7295 if (!TEST_true(EVP_DecryptInit_ex2(d, NULL, NULL, NULL, NULL))
7296 || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, zero16))
7297 || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, aad, sizeof(aad))) /* forged AAD */
7298 || !TEST_false(EVP_DecryptFinal_ex(d, out, &outl)))
7299 goto err;
7300
7301 ret = 1;
7302
7303 err:
7304 EVP_CIPHER_CTX_free(d);
7305 EVP_CIPHER_free(c);
7306 return ret;
7307 }
7308
test_invalid_ctx_for_digest(void)7309 static int test_invalid_ctx_for_digest(void)
7310 {
7311 int ret;
7312 EVP_MD_CTX *mdctx;
7313
7314 mdctx = EVP_MD_CTX_new();
7315 if (!TEST_ptr(mdctx))
7316 return 0;
7317
7318 if (!TEST_int_eq(EVP_DigestUpdate(mdctx, "test", sizeof("test") - 1), 0))
7319 ret = 0;
7320 else
7321 ret = 1;
7322
7323 EVP_MD_CTX_free(mdctx);
7324
7325 return ret;
7326 }
7327
test_evp_cipher_negative_length(void)7328 static int test_evp_cipher_negative_length(void)
7329 {
7330 EVP_CIPHER_CTX *ctx = NULL;
7331 EVP_CIPHER *cipher = NULL;
7332 unsigned char key[16] = { 0 };
7333 unsigned char iv[16] = { 0 };
7334 unsigned char buffer[32] = { 0 };
7335 int outl = 0;
7336 int ret = 0;
7337
7338 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
7339 goto end;
7340
7341 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-128-CBC", testpropq)))
7342 goto end;
7343
7344 /* Initialize encryption context */
7345 if (!TEST_int_eq(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL), 1))
7346 goto end;
7347
7348 /* Test EVP_EncryptUpdate with negative length - should fail */
7349 if (!TEST_int_eq(EVP_EncryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0))
7350 goto end;
7351
7352 /* Reinitialize for decryption */
7353 if (!TEST_int_eq(EVP_DecryptInit_ex2(ctx, cipher, key, iv, NULL), 1))
7354 goto end;
7355
7356 /* Test EVP_DecryptUpdate with negative length - should fail */
7357 if (!TEST_int_eq(EVP_DecryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0))
7358 goto end;
7359
7360 ret = 1;
7361 end:
7362 EVP_CIPHER_free(cipher);
7363 EVP_CIPHER_CTX_free(ctx);
7364 return ret;
7365 }
7366
7367 /*
7368 * Cross-driver round-trip test for AEAD one-shot vs streaming paths.
7369 *
7370 * The streaming path (EVP_CipherUpdate/Final, dispatched to
7371 * OSSL_FUNC_CIPHER_UPDATE/_FINAL) is treated as the oracle. For each
7372 * AEAD configuration we encrypt and decrypt the same (key, iv, aad, pt),
7373 * driving the body in two combinations:
7374 *
7375 * 1. body encrypt via EVP_Cipher() (one-shot, OSSL_FUNC_CIPHER_CIPHER),
7376 * body decrypt via EVP_CipherUpdate (streaming).
7377 * 2. body encrypt via EVP_CipherUpdate, body decrypt via EVP_Cipher().
7378 *
7379 * Both combinations must recover the plaintext and verify the tag. AAD
7380 * is always fed via EVP_CipherUpdate(NULL, ...): OCB's one-shot is body
7381 * only and the asymmetric "AAD streaming, body one-shot" call shape is
7382 * the natural pattern a caller reaching for EVP_Cipher() for throughput
7383 * would write anyway.
7384 *
7385 * CVE-2026-45445 (AES-OCB EVP_Cipher() ignored IV) was a silent failure
7386 * in this matrix: the one-shot encrypt path produced ciphertext under
7387 * Offset_0 = 0 regardless of IV, which the streaming decrypt path then
7388 * could not verify. Adding this cross-check catches the same class of
7389 * bug for any future AEAD whose one-shot dispatch diverges from its
7390 * streaming dispatch.
7391 */
7392 typedef struct {
7393 const char *name; /* EVP_CIPHER fetch name */
7394 size_t keylen;
7395 size_t ivlen;
7396 size_t taglen;
7397 int is_ccm; /* needs length-up-front + tag-before-body dance */
7398 } AEAD_ONESHOT_CFG;
7399
7400 static const AEAD_ONESHOT_CFG aead_oneshot_cfgs[] = {
7401 { "AES-128-GCM", 16, 12, 16, 0 },
7402 { "AES-256-GCM", 32, 12, 16, 0 },
7403 { "AES-128-CCM", 16, 12, 16, 1 },
7404 { "AES-256-CCM", 32, 12, 16, 1 },
7405 { "AES-128-OCB", 16, 12, 16, 0 },
7406 { "AES-256-OCB", 32, 12, 16, 0 },
7407 { "ChaCha20-Poly1305", 32, 12, 16, 0 }
7408 };
7409
7410 static const AEAD_ONESHOT_CFG aead_oneshot_zerolen_cfgs[] = {
7411 { "AES-128-OCB", 16, 12, 16, 0 },
7412 { "ChaCha20-Poly1305", 32, 12, 16, 0 },
7413 { "AES-128-GCM-SIV", 16, 12, 16, 0 }
7414 };
7415
7416 /*
7417 * Drive an encrypt or decrypt operation. AAD always via EVP_CipherUpdate.
7418 * Body via EVP_Cipher() when oneshot_body is non-zero, EVP_CipherUpdate
7419 * otherwise. On encrypt, fills *out and the caller-provided tag buffer.
7420 * On decrypt, reads from in and verifies tag; returns 0 if verification
7421 * fails (the test asserts the expected outcome).
7422 */
aead_oneshot_op(const AEAD_ONESHOT_CFG * cfg,int enc,int oneshot_body,const unsigned char * key,const unsigned char * iv,const unsigned char * aad,size_t aad_len,const unsigned char * in,size_t in_len,unsigned char * out,unsigned char * tag,const char ** why)7423 static int aead_oneshot_op(const AEAD_ONESHOT_CFG *cfg, int enc,
7424 int oneshot_body, const unsigned char *key,
7425 const unsigned char *iv, const unsigned char *aad,
7426 size_t aad_len, const unsigned char *in, size_t in_len,
7427 unsigned char *out, unsigned char *tag, const char **why)
7428 {
7429 EVP_CIPHER_CTX *ctx = NULL;
7430 EVP_CIPHER *cipher = NULL;
7431 int outl = 0, tmpl = 0;
7432 int ok = 0;
7433 int body_rv;
7434
7435 *why = NULL;
7436
7437 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq))) {
7438 *why = "CIPHER_FETCH";
7439 goto end;
7440 }
7441 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
7442 *why = "CTX_NEW";
7443 goto end;
7444 }
7445 if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))) {
7446 *why = "INIT_CIPHER";
7447 goto end;
7448 }
7449 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
7450 (int)cfg->ivlen, NULL),
7451 0)) {
7452 *why = "SET_IVLEN";
7453 goto end;
7454 }
7455 if (cfg->is_ccm) {
7456 /* Placeholder taglen on encrypt, real tag on decrypt; both before key+iv. */
7457 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
7458 (int)cfg->taglen, enc ? NULL : tag),
7459 0)) {
7460 *why = "CCM_SET_TAG";
7461 goto end;
7462 }
7463 }
7464 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))) {
7465 *why = "INIT_KEY_IV";
7466 goto end;
7467 }
7468 if (cfg->is_ccm) {
7469 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, NULL, (int)in_len))) {
7470 *why = "CCM_LEN_DECL";
7471 goto end;
7472 }
7473 }
7474 if (aad_len > 0
7475 && !TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, (int)aad_len))) {
7476 *why = "AAD";
7477 goto end;
7478 }
7479 if (!enc && !cfg->is_ccm
7480 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
7481 (int)cfg->taglen, tag),
7482 0)) {
7483 *why = "SET_TAG";
7484 goto end;
7485 }
7486
7487 if (oneshot_body) {
7488 body_rv = EVP_Cipher(ctx, out, in, (unsigned int)in_len);
7489 if (cfg->is_ccm && !enc) {
7490 /* CCM decrypt: 0 means tag verify failed, < 0 means error. */
7491 if (!TEST_int_gt(body_rv, 0)) {
7492 *why = "ONESHOT_DECRYPT";
7493 goto end;
7494 }
7495 } else {
7496 if (!TEST_int_ge(body_rv, 0)) {
7497 *why = "ONESHOT_BODY";
7498 goto end;
7499 }
7500 }
7501 outl = (int)in_len;
7502 } else {
7503 if (!TEST_true(EVP_CipherUpdate(ctx, out, &outl, in, (int)in_len))) {
7504 *why = enc ? "STREAM_BODY_ENC" : "STREAM_BODY_DEC";
7505 goto end;
7506 }
7507 }
7508
7509 if (!cfg->is_ccm) {
7510 if (!TEST_true(EVP_CipherFinal_ex(ctx, out + outl, &tmpl))) {
7511 *why = enc ? "FINAL_ENC" : "FINAL_DEC";
7512 goto end;
7513 }
7514 }
7515
7516 if (enc) {
7517 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG,
7518 (int)cfg->taglen, tag),
7519 0)) {
7520 *why = "GET_TAG";
7521 goto end;
7522 }
7523 }
7524 ok = 1;
7525 end:
7526 EVP_CIPHER_CTX_free(ctx);
7527 EVP_CIPHER_free(cipher);
7528 return ok;
7529 }
7530
7531 /*
7532 * For each AEAD row we run two AAD modes, and within each AAD mode two
7533 * cross-driver round trips:
7534 *
7535 * aad_mode 0: no AAD. Critical for catching the OCB-style bug: any
7536 * EVP_CipherUpdate(NULL, aad, ...) call before the body
7537 * would itself pass through the (correct) streaming
7538 * handler and apply the buffered IV, masking the one-shot
7539 * handler's failure to do so. With aad_len == 0 we make
7540 * EVP_Cipher() the very first cipher operation on the
7541 * context, which is the shape the bug requires.
7542 *
7543 * aad_mode 1: with AAD via streaming. Catches divergence between the
7544 * drivers when AAD is in play.
7545 *
7546 * leg 0: encrypt-oneshot + decrypt-streaming
7547 * leg 1: encrypt-streaming + decrypt-oneshot
7548 *
7549 * The test index encodes (cipher, aad_mode) so a failure points at both.
7550 */
test_aead_oneshot_roundtrip(int idx)7551 static int test_aead_oneshot_roundtrip(int idx)
7552 {
7553 static const unsigned char fixed_key[32] = {
7554 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
7555 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
7556 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
7557 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
7558 };
7559 static const unsigned char fixed_iv[12] = {
7560 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab
7561 };
7562 static const unsigned char fixed_aad[] = "extra:context";
7563 static const unsigned char fixed_pt[] = "THE QUICK BROWN FOX JUMPS OVER LAZY!!";
7564 const AEAD_ONESHOT_CFG *cfg = &aead_oneshot_cfgs[idx / 2];
7565 int with_aad = idx % 2;
7566 size_t aad_len = with_aad ? sizeof(fixed_aad) - 1 : 0;
7567 size_t pt_len = sizeof(fixed_pt) - 1;
7568 EVP_CIPHER *probe = NULL;
7569 unsigned char ct[64], pt[64];
7570 unsigned char tag_oneshot[16], tag_stream[16];
7571 const char *why = NULL;
7572 int leg, ok = 0;
7573
7574 /*
7575 * Probe for the cipher: a build with no-ocb / no-chacha / etc. will
7576 * not have it, and we treat that as a pass (nothing to test here).
7577 */
7578 ERR_set_mark();
7579 probe = EVP_CIPHER_fetch(testctx, cfg->name, testpropq);
7580 ERR_pop_to_mark();
7581 if (probe == NULL) {
7582 TEST_info("skipping, '%s' is not available", cfg->name);
7583 return 1;
7584 }
7585 EVP_CIPHER_free(probe);
7586
7587 for (leg = 0; leg <= 1; leg++) {
7588 int enc_oneshot = (leg == 0);
7589 unsigned char *tag = enc_oneshot ? tag_oneshot : tag_stream;
7590
7591 memset(ct, 0, sizeof(ct));
7592 memset(pt, 0, sizeof(pt));
7593 memset(tag, 0, cfg->taglen);
7594
7595 if (!aead_oneshot_op(cfg, /*enc=*/1, /*oneshot_body=*/enc_oneshot,
7596 fixed_key, fixed_iv, fixed_aad, aad_len,
7597 fixed_pt, pt_len, ct, tag, &why)) {
7598 TEST_error("%s (%s): encrypt leg %d (%s body) failed at %s",
7599 cfg->name, with_aad ? "with AAD" : "no AAD",
7600 leg, enc_oneshot ? "oneshot" : "stream",
7601 why ? why : "?");
7602 goto end;
7603 }
7604 if (!aead_oneshot_op(cfg, /*enc=*/0, /*oneshot_body=*/!enc_oneshot,
7605 fixed_key, fixed_iv, fixed_aad, aad_len,
7606 ct, pt_len, pt, tag, &why)) {
7607 TEST_error("%s (%s): decrypt leg %d (%s body) failed at %s",
7608 cfg->name, with_aad ? "with AAD" : "no AAD",
7609 leg, enc_oneshot ? "stream" : "oneshot",
7610 why ? why : "?");
7611 goto end;
7612 }
7613 if (!TEST_mem_eq(pt, pt_len, fixed_pt, pt_len)) {
7614 TEST_error("%s (%s): leg %d: recovered plaintext differs",
7615 cfg->name, with_aad ? "with AAD" : "no AAD", leg);
7616 goto end;
7617 }
7618 }
7619
7620 /*
7621 * Both legs share the same (key, iv, aad, pt) and must therefore
7622 * agree on the tag bit-for-bit, regardless of which driver computed
7623 * it. This catches the OCB-style failure where the one-shot path
7624 * silently emits a different ciphertext/tag from the streaming path.
7625 */
7626 if (!TEST_mem_eq(tag_oneshot, cfg->taglen, tag_stream, cfg->taglen)) {
7627 TEST_error("%s (%s): oneshot-encrypt tag != streaming-encrypt tag",
7628 cfg->name, with_aad ? "with AAD" : "no AAD");
7629 goto end;
7630 }
7631 ok = 1;
7632 end:
7633 return ok;
7634 }
7635
aead_oneshot_zerolen_ctx(const EVP_CIPHER * cipher,int enc,const unsigned char * key,const unsigned char * iv,const unsigned char * aad,size_t aad_len,const unsigned char * tag,size_t tag_len)7636 static EVP_CIPHER_CTX *aead_oneshot_zerolen_ctx(const EVP_CIPHER *cipher,
7637 int enc, const unsigned char *key, const unsigned char *iv,
7638 const unsigned char *aad, size_t aad_len,
7639 const unsigned char *tag, size_t tag_len)
7640 {
7641 EVP_CIPHER_CTX *ctx = NULL;
7642 int outl = 0;
7643
7644 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())
7645 || !TEST_true(EVP_CipherInit_ex2(ctx, cipher, key, iv, enc, NULL))
7646 || (aad_len > 0
7647 && !TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad,
7648 (int)aad_len)))
7649 || (!enc
7650 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
7651 (int)tag_len, (void *)tag),
7652 0))) {
7653 EVP_CIPHER_CTX_free(ctx);
7654 return NULL;
7655 }
7656 return ctx;
7657 }
7658
7659 /*
7660 * For these built-in provider implementations, a NULL-input EVP_Cipher() call
7661 * must produce or check the empty-message tag even when no payload Update was
7662 * made.
7663 */
test_aead_oneshot_zerolen(int idx)7664 static int test_aead_oneshot_zerolen(int idx)
7665 {
7666 static const unsigned char key[32] = {
7667 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
7668 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
7669 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
7670 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
7671 };
7672 static const unsigned char iv[12] = {
7673 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
7674 0xa8, 0xa9, 0xaa, 0xab
7675 };
7676 static const unsigned char aad[] = "empty message context";
7677 const AEAD_ONESHOT_CFG *cfg = &aead_oneshot_zerolen_cfgs[idx / 2];
7678 int with_aad = idx % 2;
7679 size_t aad_len = with_aad ? sizeof(aad) - 1 : 0;
7680 EVP_CIPHER *cipher = NULL;
7681 EVP_CIPHER_CTX *ctx_oracle = NULL, *ctx_oneshot = NULL;
7682 EVP_CIPHER_CTX *ctx_dec = NULL, *ctx_dec_bad = NULL;
7683 static const unsigned char empty = 0;
7684 unsigned char out[16] = { 0 };
7685 unsigned char tag_oracle[16] = { 0 };
7686 unsigned char tag_oneshot[16] = { 0 };
7687 unsigned char tag_bad[16] = { 0 };
7688 int outl = 0, ret = 0;
7689
7690 ERR_set_mark();
7691 cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq);
7692 ERR_pop_to_mark();
7693 if (cipher == NULL)
7694 return TEST_skip("'%s' is not available", cfg->name);
7695
7696 /*
7697 * The explicit zero-length Update provides an oracle that also works on
7698 * the unpatched GCM-SIV implementation, whose empty Final cannot generate
7699 * a tag.
7700 */
7701 ctx_oracle = aead_oneshot_zerolen_ctx(cipher, 1, key, iv, aad, aad_len,
7702 NULL, cfg->taglen);
7703 if (!TEST_ptr(ctx_oracle)
7704 || !TEST_true(EVP_EncryptUpdate(ctx_oracle, out, &outl, &empty, 0))
7705 || !TEST_true(EVP_EncryptFinal_ex(ctx_oracle, out, &outl))
7706 || !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx_oracle, EVP_CTRL_AEAD_GET_TAG,
7707 (int)cfg->taglen, tag_oracle),
7708 0))
7709 goto end;
7710
7711 ctx_dec = aead_oneshot_zerolen_ctx(cipher, 0, key, iv, aad, aad_len,
7712 tag_oracle, cfg->taglen);
7713 if (!TEST_ptr(ctx_dec)
7714 || !TEST_int_ge(EVP_Cipher(ctx_dec, out, NULL, 0), 0))
7715 goto end;
7716
7717 memcpy(tag_bad, tag_oracle, cfg->taglen);
7718 tag_bad[0] ^= 1;
7719 ctx_dec_bad = aead_oneshot_zerolen_ctx(cipher, 0, key, iv, aad, aad_len,
7720 tag_bad, cfg->taglen);
7721 if (!TEST_ptr(ctx_dec_bad)
7722 || !TEST_int_lt(EVP_Cipher(ctx_dec_bad, out, NULL, 0), 0))
7723 goto end;
7724
7725 ctx_oneshot = aead_oneshot_zerolen_ctx(cipher, 1, key, iv, aad, aad_len,
7726 NULL, cfg->taglen);
7727 if (!TEST_ptr(ctx_oneshot)
7728 || !TEST_int_ge(EVP_Cipher(ctx_oneshot, out, NULL, 0), 0)
7729 || !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx_oneshot, EVP_CTRL_AEAD_GET_TAG,
7730 (int)cfg->taglen, tag_oneshot),
7731 0)
7732 || !TEST_mem_eq(tag_oneshot, cfg->taglen,
7733 tag_oracle, cfg->taglen))
7734 goto end;
7735
7736 ret = 1;
7737 end:
7738 if (!ret)
7739 TEST_info("zero-length %s test failed (%s)", cfg->name,
7740 with_aad ? "with AAD" : "no AAD");
7741 EVP_CIPHER_CTX_free(ctx_oracle);
7742 EVP_CIPHER_CTX_free(ctx_oneshot);
7743 EVP_CIPHER_CTX_free(ctx_dec);
7744 EVP_CIPHER_CTX_free(ctx_dec_bad);
7745 EVP_CIPHER_free(cipher);
7746 return ret;
7747 }
7748
7749 static const AEAD_ONESHOT_CFG ccm_empty_final_cfgs[] = {
7750 { "AES-128-CCM", 16, 12, 16, 1 },
7751 { "AES-192-CCM", 24, 12, 16, 1 },
7752 { "AES-256-CCM", 32, 12, 16, 1 },
7753 { "ARIA-128-CCM", 16, 12, 16, 1 },
7754 { "ARIA-192-CCM", 24, 12, 16, 1 },
7755 { "ARIA-256-CCM", 32, 12, 16, 1 },
7756 { "SM4-CCM", 16, 12, 16, 1 }
7757 };
7758
7759 /*
7760 * Finalize CCM after declaring an empty payload and supplying AAD, without a
7761 * payload Update. Return one for authentication success, zero for an
7762 * authentication failure, and minus one for any other failure.
7763 */
ccm_empty_final_op(const AEAD_ONESHOT_CFG * cfg,int enc,int oneshot_final,const unsigned char * key,const unsigned char * iv,const unsigned char * aad,size_t aad_len,unsigned char * tag,const char ** why)7764 static int ccm_empty_final_op(const AEAD_ONESHOT_CFG *cfg, int enc,
7765 int oneshot_final, const unsigned char *key, const unsigned char *iv,
7766 const unsigned char *aad, size_t aad_len, unsigned char *tag,
7767 const char **why)
7768 {
7769 EVP_CIPHER_CTX *ctx = NULL;
7770 EVP_CIPHER *cipher = NULL;
7771 unsigned char out[1] = { 0 };
7772 int outl = 0, rv;
7773 int ret = -1;
7774
7775 *why = NULL;
7776
7777 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq))) {
7778 *why = "CIPHER_FETCH";
7779 goto end;
7780 }
7781 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) {
7782 *why = "CTX_NEW";
7783 goto end;
7784 }
7785 if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))) {
7786 *why = "INIT_CIPHER";
7787 goto end;
7788 }
7789 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
7790 (int)cfg->ivlen, NULL),
7791 0)) {
7792 *why = "SET_IVLEN";
7793 goto end;
7794 }
7795 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
7796 (int)cfg->taglen, enc ? NULL : tag),
7797 0)) {
7798 *why = "SET_TAG";
7799 goto end;
7800 }
7801 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))) {
7802 *why = "INIT_KEY_IV";
7803 goto end;
7804 }
7805 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, NULL, 0))) {
7806 *why = "LENGTH";
7807 goto end;
7808 }
7809 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, (int)aad_len))) {
7810 *why = "AAD";
7811 goto end;
7812 }
7813
7814 if (oneshot_final) {
7815 rv = EVP_Cipher(ctx, out, NULL, 0);
7816 ret = rv >= 0;
7817 if (ret && rv != 0) {
7818 *why = "ONESHOT_FINAL_LENGTH";
7819 ret = -1;
7820 goto end;
7821 }
7822 } else {
7823 ret = EVP_CipherFinal_ex(ctx, out, &outl) > 0;
7824 if (ret && outl != 0) {
7825 *why = "STREAM_FINAL_LENGTH";
7826 ret = -1;
7827 goto end;
7828 }
7829 }
7830
7831 if (ret && enc
7832 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG,
7833 (int)cfg->taglen, tag),
7834 0)) {
7835 *why = "GET_TAG";
7836 ret = -1;
7837 }
7838
7839 end:
7840 EVP_CIPHER_CTX_free(ctx);
7841 EVP_CIPHER_free(cipher);
7842 return ret;
7843 }
7844
test_ccm_empty_final(int idx)7845 static int test_ccm_empty_final(int idx)
7846 {
7847 static const unsigned char fixed_key[32] = {
7848 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
7849 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
7850 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
7851 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
7852 };
7853 static const unsigned char fixed_iv[12] = {
7854 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5,
7855 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab
7856 };
7857 static const unsigned char fixed_aad[] = "CCM empty-payload Final regression";
7858 const AEAD_ONESHOT_CFG *cfg = &ccm_empty_final_cfgs[idx];
7859 EVP_CIPHER *probe = NULL;
7860 unsigned char tag_stream[16], tag_oneshot[16], bad_tag[16];
7861 const char *why = NULL;
7862 int rv, ok = 0;
7863
7864 ERR_set_mark();
7865 probe = EVP_CIPHER_fetch(testctx, cfg->name, testpropq);
7866 ERR_pop_to_mark();
7867 if (probe == NULL) {
7868 TEST_info("skipping, '%s' is not available", cfg->name);
7869 return 1;
7870 }
7871 EVP_CIPHER_free(probe);
7872
7873 memset(tag_stream, 0, sizeof(tag_stream));
7874 rv = ccm_empty_final_op(cfg, 1, 0, fixed_key, fixed_iv, fixed_aad,
7875 sizeof(fixed_aad) - 1, tag_stream, &why);
7876 if (!TEST_int_eq(rv, 1)) {
7877 TEST_error("%s: streaming encryption failed at %s",
7878 cfg->name, why ? why : "FINAL");
7879 goto end;
7880 }
7881
7882 memset(tag_oneshot, 0, sizeof(tag_oneshot));
7883 rv = ccm_empty_final_op(cfg, 1, 1, fixed_key, fixed_iv, fixed_aad,
7884 sizeof(fixed_aad) - 1, tag_oneshot, &why);
7885 if (!TEST_int_eq(rv, 1)) {
7886 TEST_error("%s: one-shot encryption failed at %s",
7887 cfg->name, why ? why : "FINAL");
7888 goto end;
7889 }
7890 if (!TEST_mem_eq(tag_stream, cfg->taglen, tag_oneshot, cfg->taglen)) {
7891 TEST_error("%s: streaming and one-shot tags differ", cfg->name);
7892 goto end;
7893 }
7894
7895 rv = ccm_empty_final_op(cfg, 0, 0, fixed_key, fixed_iv, fixed_aad,
7896 sizeof(fixed_aad) - 1, tag_stream, &why);
7897 if (!TEST_int_eq(rv, 1)) {
7898 TEST_error("%s: streaming verification failed at %s",
7899 cfg->name, why ? why : "FINAL");
7900 goto end;
7901 }
7902 rv = ccm_empty_final_op(cfg, 0, 1, fixed_key, fixed_iv, fixed_aad,
7903 sizeof(fixed_aad) - 1, tag_stream, &why);
7904 if (!TEST_int_eq(rv, 1)) {
7905 TEST_error("%s: one-shot verification failed at %s",
7906 cfg->name, why ? why : "FINAL");
7907 goto end;
7908 }
7909
7910 memcpy(bad_tag, tag_stream, cfg->taglen);
7911 bad_tag[0] ^= 1;
7912 rv = ccm_empty_final_op(cfg, 0, 0, fixed_key, fixed_iv, fixed_aad,
7913 sizeof(fixed_aad) - 1, bad_tag, &why);
7914 if (!TEST_int_eq(rv, 0)) {
7915 TEST_error("%s: streaming Final accepted an invalid tag", cfg->name);
7916 goto end;
7917 }
7918 ERR_clear_error();
7919 rv = ccm_empty_final_op(cfg, 0, 1, fixed_key, fixed_iv, fixed_aad,
7920 sizeof(fixed_aad) - 1, bad_tag, &why);
7921 if (!TEST_int_eq(rv, 0)) {
7922 TEST_error("%s: one-shot Final accepted an invalid tag", cfg->name);
7923 goto end;
7924 }
7925 ERR_clear_error();
7926
7927 ok = 1;
7928 end:
7929 return ok;
7930 }
7931
7932 #ifndef OPENSSL_NO_DES
test_EVP_CIPHER_get_type_des_ede3(void)7933 static int test_EVP_CIPHER_get_type_des_ede3(void)
7934 {
7935 const EVP_CIPHER *cipher = NULL;
7936 int base_type, variant_type, nid;
7937 int ret = 0;
7938
7939 /* Get the base type from CFB64 (should be NID_des_ede3_cfb64) */
7940 cipher = EVP_des_ede3_cfb64();
7941 base_type = EVP_CIPHER_get_type(cipher);
7942
7943 /* Test CFB64 - should map to the same base_type */
7944 variant_type = EVP_CIPHER_get_type(cipher);
7945 nid = EVP_CIPHER_get_nid(cipher);
7946
7947 /* Verify the returned type */
7948 if (!TEST_int_eq(variant_type, base_type))
7949 goto end;
7950
7951 /* Verify that variant_type and nid are same for 64-bit variants */
7952 if (!TEST_int_eq(variant_type, nid))
7953 goto end;
7954
7955 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type))
7956 goto end;
7957
7958 /* Test CFB8 - should map to the same base_type */
7959 cipher = EVP_des_ede3_cfb8();
7960 variant_type = EVP_CIPHER_get_type(cipher);
7961 nid = EVP_CIPHER_get_nid(cipher);
7962
7963 /* Verify the returned type */
7964 if (!TEST_int_eq(variant_type, base_type))
7965 goto end;
7966
7967 /* Verify that variant_type and nid are different for variants */
7968 if (!TEST_int_ne(variant_type, nid))
7969 goto end;
7970
7971 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type))
7972 goto end;
7973
7974 /* Test CFB1 - should map to the same base_type */
7975 cipher = EVP_des_ede3_cfb1();
7976 variant_type = EVP_CIPHER_get_type(cipher);
7977 nid = EVP_CIPHER_get_nid(cipher);
7978
7979 /* Verify the returned type */
7980 if (!TEST_int_eq(variant_type, base_type))
7981 goto end;
7982
7983 /* Verify that variant_type and nid are different for variants */
7984 if (!TEST_int_ne(variant_type, nid))
7985 goto end;
7986
7987 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type))
7988 goto end;
7989
7990 ret = 1;
7991 end:
7992 return ret;
7993 }
7994 #endif /*OPENSSL_NO_DES */
7995
test_evp_cipher_pipeline(void)7996 static int test_evp_cipher_pipeline(void)
7997 {
7998 OSSL_PROVIDER *fake_pipeline = NULL;
7999 int testresult = 0;
8000 EVP_CIPHER *cipher = NULL;
8001 EVP_CIPHER *pipeline_cipher = NULL;
8002 EVP_CIPHER_CTX *ctx = NULL;
8003 unsigned char key[32];
8004 size_t keylen = 32;
8005 size_t ivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_FIXED_IV_LEN;
8006 size_t taglen = EVP_GCM_TLS_TAG_LEN;
8007 unsigned char *iv_array[EVP_MAX_PIPES], *tag_array[EVP_MAX_PIPES];
8008 unsigned char *plaintext_array[EVP_MAX_PIPES];
8009 unsigned char *ciphertext_array_p[EVP_MAX_PIPES];
8010 void **aead_tags = (void **)&tag_array;
8011 unsigned char *temp[EVP_MAX_PIPES];
8012 size_t outsize_array[EVP_MAX_PIPES], outlen_array[EVP_MAX_PIPES];
8013 size_t ciphertextlen_array[EVP_MAX_PIPES];
8014 size_t inlen_array[EVP_MAX_PIPES];
8015 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
8016 unsigned char *ciphertext, *exp_plaintext, *tag;
8017 size_t numpipes, plaintextlen, i;
8018
8019 if (!TEST_ptr(fake_pipeline = fake_pipeline_start(testctx)))
8020 return 0;
8021 if (!TEST_ptr(pipeline_cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM",
8022 "provider=fake-pipeline"))
8023 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM",
8024 "provider!=fake-pipeline"))
8025 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
8026 goto end;
8027 memset(key, 0x01, sizeof(key));
8028
8029 /* Negative tests */
8030 if (!TEST_false(EVP_CIPHER_can_pipeline(cipher, 1)))
8031 goto end;
8032 if (!TEST_false(EVP_CIPHER_can_pipeline(EVP_aes_256_gcm(), 1)))
8033 goto end;
8034 if (!TEST_false(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher,
8035 key, keylen,
8036 EVP_MAX_PIPES + 1, NULL, 0)))
8037 goto end;
8038
8039 /* Positive tests */
8040 for (numpipes = 1; numpipes <= EVP_MAX_PIPES; numpipes++) {
8041 for (plaintextlen = 1; plaintextlen <= 256; plaintextlen++) {
8042 size_t ciphertextlen = 0;
8043 int outlen = 0;
8044
8045 /* Cleanup to be able to error out */
8046 memset(iv_array, 0, sizeof(iv_array));
8047 memset(plaintext_array, 0, sizeof(plaintext_array));
8048 memset(ciphertext_array_p, 0, sizeof(ciphertext_array_p));
8049 memset(tag_array, 0, sizeof(tag_array));
8050 ciphertext = NULL;
8051 exp_plaintext = NULL;
8052 tag = NULL;
8053
8054 /* Allocate fresh buffers with exact size to catch buffer overwrites */
8055 for (i = 0; i < numpipes; i++) {
8056 if (!TEST_ptr(iv_array[i] = OPENSSL_malloc(ivlen))
8057 || !TEST_ptr(plaintext_array[i] = OPENSSL_malloc(plaintextlen))
8058 || !TEST_ptr(ciphertext_array_p[i] = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH))
8059 || !TEST_ptr(tag_array[i] = OPENSSL_malloc(taglen)))
8060 goto err;
8061
8062 memset(iv_array[i], i + 33, ivlen);
8063 memset(plaintext_array[i], i + 1, plaintextlen);
8064 inlen_array[i] = plaintextlen;
8065 outlen_array[i] = 0;
8066 ciphertextlen_array[i] = 0;
8067 outsize_array[i] = plaintextlen + EVP_MAX_BLOCK_LENGTH;
8068 }
8069 if (!TEST_ptr(ciphertext = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH))
8070 || !TEST_ptr(tag = OPENSSL_malloc(taglen))
8071 || !TEST_ptr(exp_plaintext = OPENSSL_malloc(plaintextlen)))
8072 goto err;
8073
8074 /* Encrypt using pipeline API */
8075 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx))
8076 || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 1))
8077 || !TEST_true(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher,
8078 key, keylen, numpipes,
8079 (const unsigned char **)iv_array,
8080 ivlen))
8081 /* reuse plaintext for AAD as it won't affect test */
8082 || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL,
8083 (const unsigned char **)plaintext_array,
8084 inlen_array))
8085 || !TEST_true(EVP_CipherPipelineUpdate(ctx, ciphertext_array_p,
8086 outlen_array, outsize_array,
8087 (const unsigned char **)plaintext_array,
8088 inlen_array)))
8089 goto err;
8090
8091 for (i = 0; i < numpipes; i++) {
8092 ciphertextlen_array[i] = outlen_array[i];
8093 temp[i] = ciphertext_array_p[i] + ciphertextlen_array[i];
8094 outsize_array[i] = outsize_array[i] - ciphertextlen_array[i];
8095 }
8096
8097 if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array)))
8098 goto err;
8099
8100 for (i = 0; i < numpipes; i++)
8101 ciphertextlen_array[i] += outlen_array[i];
8102
8103 params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG,
8104 (void **)&aead_tags, taglen);
8105 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params)))
8106 goto err;
8107
8108 /* Encrypt using non-pipeline API and compare */
8109 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)))
8110 goto err;
8111
8112 for (i = 0; i < numpipes; i++) {
8113 if (!TEST_true(EVP_EncryptInit(ctx, cipher, key, iv_array[i]))
8114 || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen,
8115 plaintext_array[i],
8116 plaintextlen))
8117 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &outlen,
8118 plaintext_array[i],
8119 plaintextlen)))
8120 goto err;
8121 ciphertextlen = outlen;
8122
8123 if (!TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext + outlen, &outlen)))
8124 goto err;
8125 ciphertextlen += outlen;
8126
8127 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG,
8128 (void *)tag, taglen);
8129 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params)))
8130 goto err;
8131
8132 if (!TEST_mem_eq(ciphertext_array_p[i], ciphertextlen_array[i],
8133 ciphertext, ciphertextlen)
8134 || !TEST_mem_eq(tag_array[i], taglen, tag, taglen))
8135 goto err;
8136 }
8137
8138 for (i = 0; i < numpipes; i++)
8139 outsize_array[i] = plaintextlen;
8140
8141 /* Decrypt using pipeline API and compare */
8142 params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG,
8143 (void **)&aead_tags, taglen);
8144 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx))
8145 || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 0))
8146 || !TEST_true(EVP_CipherPipelineDecryptInit(ctx, pipeline_cipher,
8147 key, keylen, numpipes,
8148 (const unsigned char **)iv_array,
8149 ivlen))
8150 || !TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))
8151 || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL,
8152 (const unsigned char **)plaintext_array,
8153 inlen_array))
8154 || !TEST_true(EVP_CipherPipelineUpdate(ctx, plaintext_array,
8155 outlen_array, outsize_array,
8156 (const unsigned char **)ciphertext_array_p,
8157 ciphertextlen_array)))
8158 goto err;
8159
8160 for (i = 0; i < numpipes; i++) {
8161 temp[i] = plaintext_array[i] + outlen_array[i];
8162 outsize_array[i] = outsize_array[i] - outlen_array[i];
8163 }
8164
8165 if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array)))
8166 goto err;
8167
8168 for (i = 0; i < numpipes; i++) {
8169 memset(exp_plaintext, i + 1, plaintextlen);
8170 if (!TEST_mem_eq(plaintext_array[i], plaintextlen,
8171 exp_plaintext, plaintextlen))
8172 goto err;
8173 }
8174
8175 for (i = 0; i < numpipes; i++) {
8176 OPENSSL_free(iv_array[i]);
8177 OPENSSL_free(plaintext_array[i]);
8178 OPENSSL_free(ciphertext_array_p[i]);
8179 OPENSSL_free(tag_array[i]);
8180 }
8181 OPENSSL_free(exp_plaintext);
8182 OPENSSL_free(ciphertext);
8183 OPENSSL_free(tag);
8184 }
8185 }
8186
8187 testresult = 1;
8188 goto end;
8189
8190 err:
8191 for (i = 0; i < numpipes; i++) {
8192 OPENSSL_free(iv_array[i]);
8193 OPENSSL_free(plaintext_array[i]);
8194 OPENSSL_free(ciphertext_array_p[i]);
8195 OPENSSL_free(tag_array[i]);
8196 }
8197 OPENSSL_free(exp_plaintext);
8198 OPENSSL_free(ciphertext);
8199 OPENSSL_free(tag);
8200 end:
8201 EVP_CIPHER_CTX_free(ctx);
8202 EVP_CIPHER_free(cipher);
8203 EVP_CIPHER_free(pipeline_cipher);
8204 fake_pipeline_finish(fake_pipeline);
8205 return testresult;
8206 }
8207
setup_tests(void)8208 int setup_tests(void)
8209 {
8210 char *config_file = NULL;
8211 OPTION_CHOICE o;
8212
8213 while ((o = opt_next()) != OPT_EOF) {
8214 switch (o) {
8215 case OPT_CONTEXT:
8216 /* Set up an alternate library context */
8217 testctx = OSSL_LIB_CTX_new();
8218 if (!TEST_ptr(testctx))
8219 return 0;
8220 #ifdef STATIC_LEGACY
8221 /*
8222 * This test is always statically linked against libcrypto. We must not
8223 * attempt to load legacy.so that might be dynamically linked against
8224 * libcrypto. Instead we use a built-in version of the legacy provider.
8225 */
8226 if (!OSSL_PROVIDER_add_builtin(testctx, "legacy", ossl_legacy_provider_init))
8227 return 0;
8228 #endif
8229 /* Swap the libctx to test non-default context only */
8230 nullprov = OSSL_PROVIDER_load(NULL, "null");
8231 deflprov = OSSL_PROVIDER_load(testctx, "default");
8232 #ifndef OPENSSL_SYS_TANDEM
8233 lgcyprov = OSSL_PROVIDER_load(testctx, "legacy");
8234 #endif
8235 break;
8236 case OPT_CONFIG_FILE:
8237 config_file = opt_arg();
8238 if (!test_get_libctx(&testctx, &nullprov, config_file, NULL, NULL))
8239 return 0;
8240 break;
8241 case OPT_TEST_CASES:
8242 break;
8243 default:
8244 return 0;
8245 }
8246 }
8247
8248 if (config_file != NULL) {
8249 ADD_TEST(test_EVP_set_config_properties);
8250 return 1;
8251 }
8252
8253 ADD_TEST(test_EVP_set_default_properties);
8254 ADD_ALL_TESTS(test_EVP_DigestSignInit, 30);
8255 ADD_TEST(test_EVP_DigestVerifyInit);
8256 #ifndef OPENSSL_NO_EC
8257 ADD_TEST(test_ecdsa_digestsign_keccak);
8258 #endif
8259 #ifndef OPENSSL_NO_SIPHASH
8260 ADD_TEST(test_siphash_digestsign);
8261 #endif
8262 ADD_TEST(test_EVP_Digest);
8263 ADD_TEST(test_EVP_md_null);
8264 #ifndef OPENSSL_NO_POLY1305
8265 ADD_TEST(test_evp_mac_poly1305_no_key);
8266 #endif
8267 ADD_ALL_TESTS(test_EVP_PKEY_sign, 3);
8268 #ifndef OPENSSL_NO_DEPRECATED_3_0
8269 ADD_ALL_TESTS(test_EVP_PKEY_sign_with_app_method, 2);
8270 #endif
8271 ADD_ALL_TESTS(test_EVP_Enveloped, 2);
8272 ADD_ALL_TESTS(test_d2i_AutoPrivateKey, OSSL_NELEM(keydata));
8273 ADD_TEST(test_privatekey_to_pkcs8);
8274 ADD_TEST(test_EVP_PKCS82PKEY_wrong_tag);
8275 ADD_ALL_TESTS(test_EVP_PKCS82PKEY_v2, OSSL_NELEM(keydata_v2));
8276 #ifndef OPENSSL_NO_EC
8277 ADD_TEST(test_EVP_PKCS82PKEY);
8278 #endif
8279 #ifndef OPENSSL_NO_EC
8280 ADD_ALL_TESTS(test_EC_keygen_with_enc, OSSL_NELEM(ec_encodings));
8281 #endif
8282 #if !defined(OPENSSL_NO_SM2)
8283 ADD_TEST(test_EVP_SM2);
8284 ADD_TEST(test_EVP_SM2_verify);
8285 #endif
8286 ADD_ALL_TESTS(test_set_get_raw_keys, OSSL_NELEM(keys));
8287 #ifndef OPENSSL_NO_DEPRECATED_3_0
8288 custom_pmeth = EVP_PKEY_meth_new(0xdefaced, 0);
8289 if (!TEST_ptr(custom_pmeth))
8290 return 0;
8291 EVP_PKEY_meth_set_check(custom_pmeth, pkey_custom_check);
8292 EVP_PKEY_meth_set_public_check(custom_pmeth, pkey_custom_pub_check);
8293 EVP_PKEY_meth_set_param_check(custom_pmeth, pkey_custom_param_check);
8294 if (!TEST_int_eq(EVP_PKEY_meth_add0(custom_pmeth), 1))
8295 return 0;
8296 #endif
8297 ADD_ALL_TESTS(test_EVP_PKEY_check, OSSL_NELEM(keycheckdata));
8298 #ifndef OPENSSL_NO_CMAC
8299 ADD_TEST(test_CMAC_keygen);
8300 #endif
8301 ADD_TEST(test_HKDF);
8302 ADD_TEST(test_emptyikm_HKDF);
8303 ADD_TEST(test_empty_salt_info_HKDF);
8304 #ifndef OPENSSL_NO_EC
8305 ADD_TEST(test_X509_PUBKEY_inplace);
8306 ADD_TEST(test_X509_PUBKEY_dup);
8307 ADD_ALL_TESTS(test_invalide_ec_char2_pub_range_decode,
8308 OSSL_NELEM(ec_der_pub_keys));
8309 #endif
8310 #ifndef OPENSSL_NO_DSA
8311 ADD_TEST(test_DSA_get_set_params);
8312 ADD_TEST(test_DSA_priv_pub);
8313 #endif
8314 ADD_TEST(test_RSA_get_set_params);
8315 ADD_TEST(test_RSA_OAEP_set_get_params);
8316 ADD_TEST(test_RSA_OAEP_set_null_label);
8317 ADD_TEST(test_RSA_verify_recover_rejects_short_buffer);
8318 ADD_TEST(test_RSA_verify_recover_empty_payload);
8319 ADD_TEST(test_RSA_encrypt);
8320 #ifndef OPENSSL_NO_DEPRECATED_3_0
8321 ADD_TEST(test_RSA_legacy);
8322 #endif
8323 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
8324 ADD_TEST(test_decrypt_null_chunks);
8325 ADD_TEST(test_chacha20_poly1305_late_aad);
8326 #endif
8327 #ifndef OPENSSL_NO_DH
8328 ADD_TEST(test_DH_priv_pub);
8329 #ifndef OPENSSL_NO_DEPRECATED_3_0
8330 ADD_TEST(test_EVP_PKEY_set1_DH);
8331 #endif
8332 ADD_TEST(test_dhx_derive_rejects_bad_peer_q);
8333 #endif
8334 #ifndef OPENSSL_NO_EC
8335 ADD_TEST(test_EC_priv_pub);
8336 ADD_TEST(test_evp_get_ec_pub);
8337 #ifndef OPENSSL_NO_DEPRECATED_3_0
8338 ADD_TEST(test_EC_priv_only_legacy);
8339 ADD_TEST(test_evp_get_ec_pub_legacy);
8340 #endif
8341 #endif
8342 ADD_ALL_TESTS(test_keygen_with_empty_template, 2);
8343 ADD_ALL_TESTS(test_pkey_ctx_fail_without_provider, 2);
8344
8345 ADD_TEST(test_rand_agglomeration);
8346 ADD_ALL_TESTS(test_evp_iv_aes, 12);
8347 #ifndef OPENSSL_NO_DES
8348 ADD_ALL_TESTS(test_evp_iv_des, 6);
8349 ADD_TEST(test_EVP_CIPHER_get_type_des_ede3);
8350 #endif /* OPENSSL_NO_DES */
8351 #ifndef OPENSSL_NO_BF
8352 ADD_ALL_TESTS(test_evp_bf_default_keylen, 4);
8353 #endif
8354 ADD_TEST(test_EVP_rsa_pss_with_keygen_bits);
8355 ADD_TEST(test_EVP_rsa_pss_set_saltlen);
8356 ADD_TEST(test_EVP_rsa_invalid_key);
8357 #ifndef OPENSSL_NO_EC
8358 ADD_ALL_TESTS(test_ecpub, OSSL_NELEM(ecpub_nids));
8359 #endif
8360
8361 ADD_TEST(test_names_do_all);
8362
8363 ADD_ALL_TESTS(test_evp_init_seq, OSSL_NELEM(evp_init_tests));
8364 ADD_ALL_TESTS(test_evp_reset, OSSL_NELEM(evp_reset_tests));
8365 ADD_ALL_TESTS(test_evp_reinit_seq, OSSL_NELEM(evp_reinit_tests));
8366 ADD_ALL_TESTS(test_gcm_reinit, OSSL_NELEM(gcm_reinit_tests));
8367 ADD_ALL_TESTS(test_evp_updated_iv, OSSL_NELEM(evp_updated_iv_tests));
8368 ADD_ALL_TESTS(test_ivlen_change, OSSL_NELEM(ivlen_change_ciphers));
8369 if (OSSL_NELEM(keylen_change_ciphers) - 1 > 0)
8370 ADD_ALL_TESTS(test_keylen_change, OSSL_NELEM(keylen_change_ciphers) - 1);
8371
8372 #ifndef OPENSSL_NO_DEPRECATED_3_0
8373 ADD_ALL_TESTS(test_custom_pmeth, 12);
8374 ADD_TEST(test_evp_md_cipher_meth);
8375 ADD_TEST(test_custom_md_meth);
8376 ADD_TEST(test_custom_ciph_meth);
8377 ADD_TEST(test_rsasve_kem_with_invalid_pub_key);
8378
8379 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
8380 /* Tests only support the default libctx */
8381 if (testctx == NULL) {
8382 #ifndef OPENSSL_NO_EC
8383 ADD_ALL_TESTS(test_signatures_with_engine, 3);
8384 #else
8385 ADD_ALL_TESTS(test_signatures_with_engine, 2);
8386 #endif
8387 ADD_TEST(test_cipher_with_engine);
8388 }
8389 #endif
8390 #endif
8391
8392 #ifndef OPENSSL_NO_ECX
8393 ADD_ALL_TESTS(test_ecx_short_keys, OSSL_NELEM(ecxnids));
8394 ADD_ALL_TESTS(test_ecx_not_private_key, OSSL_NELEM(keys));
8395 #endif
8396
8397 ADD_TEST(test_sign_continuation);
8398
8399 /* Test cases for CVE-2023-5363 */
8400 ADD_TEST(test_aes_gcm_ivlen_change_cve_2023_5363);
8401 #ifndef OPENSSL_NO_RC4
8402 ADD_TEST(test_aes_rc4_keylen_change_cve_2023_5363);
8403 #endif
8404
8405 ADD_ALL_TESTS(test_aead_oneshot_roundtrip, 2 * OSSL_NELEM(aead_oneshot_cfgs));
8406 ADD_ALL_TESTS(test_aead_oneshot_zerolen,
8407 2 * OSSL_NELEM(aead_oneshot_zerolen_cfgs));
8408
8409 ADD_ALL_TESTS(test_rsasve_degenerate_exponent, 2);
8410 ADD_ALL_TESTS(test_rsasve_degenerate_ciphertext, 3);
8411 ADD_ALL_TESTS(test_ccm_empty_final, OSSL_NELEM(ccm_empty_final_cfgs));
8412
8413 /* Test cases for CVE-2026-45446 */
8414 ADD_TEST(test_aes_gcm_siv_empty_data);
8415 ADD_TEST(test_aes_siv_ctx_reuse);
8416
8417 ADD_TEST(test_invalid_ctx_for_digest);
8418
8419 ADD_TEST(test_evp_cipher_negative_length);
8420
8421 ADD_TEST(test_evp_cipher_pipeline);
8422
8423 return 1;
8424 }
8425
cleanup_tests(void)8426 void cleanup_tests(void)
8427 {
8428 OSSL_PROVIDER_unload(nullprov);
8429 OSSL_PROVIDER_unload(deflprov);
8430 #ifndef OPENSSL_SYS_TANDEM
8431 OSSL_PROVIDER_unload(lgcyprov);
8432 #endif
8433 OSSL_LIB_CTX_free(testctx);
8434 }
8435