1 /* 2 * Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* We need to use some deprecated APIs */ 11 #define OPENSSL_SUPPRESS_DEPRECATED 12 13 #include <stdio.h> 14 #include <stdlib.h> 15 #include <string.h> 16 #include <openssl/bio.h> 17 #include <openssl/conf.h> 18 #include <openssl/crypto.h> 19 #include <openssl/err.h> 20 #include <openssl/evp.h> 21 #include <openssl/x509.h> 22 #include <openssl/pem.h> 23 #include <openssl/kdf.h> 24 #include <openssl/provider.h> 25 #include <openssl/prov_ssl.h> 26 #include <openssl/ssl3.h> 27 #include <openssl/core_names.h> 28 #include <openssl/params.h> 29 #include <openssl/param_build.h> 30 #include <openssl/dsa.h> 31 #include <openssl/dh.h> 32 #include <openssl/aes.h> 33 #include <openssl/decoder.h> 34 #include <openssl/rsa.h> 35 #include <openssl/engine.h> 36 #include <openssl/proverr.h> 37 #include <openssl/rand.h> 38 #include <crypto/ml_kem.h> 39 #include "testutil.h" 40 #include "internal/nelem.h" 41 #include "internal/sizes.h" 42 #include "crypto/evp.h" 43 #include "fake_rsaprov.h" 44 #include "fake_pipelineprov.h" 45 46 #ifdef STATIC_LEGACY 47 OSSL_provider_init_fn ossl_legacy_provider_init; 48 #endif 49 50 static OSSL_LIB_CTX *testctx = NULL; 51 static char *testpropq = NULL; 52 53 static OSSL_PROVIDER *nullprov = NULL; 54 static OSSL_PROVIDER *deflprov = NULL; 55 static OSSL_PROVIDER *lgcyprov = NULL; 56 57 /* 58 * kExampleRSAKeyDER is an RSA private key in ASN.1, DER format. Of course, you 59 * should never use this key anywhere but in an example. 60 */ 61 static const unsigned char kExampleRSAKeyDER[] = { 62 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 63 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 64 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 65 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 66 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 67 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 68 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 69 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 70 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 71 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 72 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 73 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 74 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 75 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 76 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 77 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 78 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 79 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 80 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 81 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 82 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 83 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 84 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 85 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 86 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 87 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 88 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 89 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 90 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 91 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 92 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 93 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 94 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 95 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 96 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 97 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 98 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 99 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 100 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 101 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 102 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 103 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 104 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 105 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 106 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 107 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 108 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 109 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 110 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 111 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 112 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf 113 }; 114 115 /* An invalid key whose prime factors exceed modulus n. */ 116 static const unsigned char kInvalidRSAKeyDER[] = { 117 0x30, 0x80, 0x02, 0x00, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80, 118 0x02, 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 119 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 120 0x02, 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 121 0xff, 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 122 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 123 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa, 124 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 125 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 126 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 127 0xaa, 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 128 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 129 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 130 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 131 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 132 0x07, 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 133 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 134 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 135 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 136 0x15, 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00, 137 0x00, 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15, 138 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9, 139 0x02, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 140 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 141 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 142 0x00, 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 143 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 144 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 145 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 146 0x59, 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59, 147 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 148 0x5d, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 149 0x59, 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 150 0x15, 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 151 0x00, 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea, 152 0xea, 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15, 153 0x15, 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 154 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 155 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07, 156 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 157 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 158 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 159 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 160 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 161 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 162 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 163 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59, 164 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 165 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 166 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 167 0x59, 0x59, 0x59, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80, 0x02, 168 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 169 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 170 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 171 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 172 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 173 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 174 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 175 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 0x31, 176 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 177 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 0xc8, 178 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 0x07, 179 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 180 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 181 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 182 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 183 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 184 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0xec, 185 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 186 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00, 0x00, 187 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15, 0x07, 188 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9, 0x02, 189 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 190 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 191 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 192 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 0x59, 193 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 194 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 195 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 196 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59, 0x59, 197 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x5d, 198 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 199 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 200 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 201 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 202 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15, 0x15, 203 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 204 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0xff, 205 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07, 0x07, 206 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 207 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 208 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 209 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 210 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 211 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 212 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 213 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59, 0x59, 214 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 215 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 216 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 217 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 218 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 219 0x59, 0x59, 0x59, 0x06, 0xce, 0x15, 0x00, 0xfe, 0xf7, 0x52, 0x53, 0x41, 220 0x31, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 221 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 222 0xff, 0xff, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 223 0x2b, 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 224 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 225 0x01, 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 226 0xee, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 227 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 228 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 229 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 230 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 231 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 232 0x15, 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 233 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 234 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x15, 235 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 236 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 237 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 238 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 239 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 240 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 241 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x8f, 242 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 243 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 244 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 245 0x8f, 0x8f, 0x8f, 0x8f, 0x59, 0x59, 0x59, 0x00, 0x00, 0x00, 0x00, 0x00, 246 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc1, 0x3d, 0xc1, 0xc1, 247 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 248 0xc1, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 249 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 250 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x42, 0xa5, 0x02, 0x02, 0x42, 0x02, 251 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0xe8, 0xe8, 0xe8, 0xe8, 252 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 253 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 254 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 255 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 256 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 257 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0x02, 258 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 259 0x21, 0x2b, 0x02, 0x02, 0x02, 0x02, 0x02, 0x21, 0x02, 0x02, 0x32, 0x80, 260 0x02, 0x02, 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02, 261 0x02, 0x02, 0x42, 0x02, 0x12, 0x02, 0x42, 0x02, 0x79, 0x70, 0x65, 0x36, 262 0x28, 0xc8, 0x02, 0x01, 0x81, 0x08, 0xfe, 0x00, 0xf9, 0x02, 0x42, 0x10, 263 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 264 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 265 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 266 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 267 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0xa5, 0x02, 268 0x02, 0x42, 0x02, 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0x02, 269 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 270 0x21, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x32, 0x80, 0x02, 0x02, 271 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02, 0x02, 0x02, 272 0x42, 0x02, 0x12, 0x02, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 273 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x47, 274 0x4f, 0x53, 0x54, 0x20, 0x52, 0x20, 0x33, 0x34, 0x2e, 0x31, 0x31, 0x2d, 275 0x32, 0x30, 0x31, 0x32, 0x20, 0x77, 0x69, 0x74, 0x68, 0x30, 0x80, 0x60, 276 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d, 0x31, 0x32, 277 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a, 0x5b, 0xff, 278 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x00, 0x00, 0x30, 279 0x80, 0x60, 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d, 280 0x31, 0x32, 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a, 281 0x5b, 0xff, 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x33, 282 0x28, 0xc8, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 283 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15, 284 0x15, 0x05, 0x15, 0x95, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 285 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 286 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 287 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 288 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 289 0x02, 0x00, 0x25, 0x02, 0x02, 0x22, 0x3a, 0x02, 0x02, 0x02, 0x42, 0x02, 290 0x02, 0x02, 0x02, 0x02, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 291 0xe2, 0x80 292 }; 293 294 /* 295 * kExampleDSAKeyDER is a DSA private key in ASN.1, DER format. Of course, you 296 * should never use this key anywhere but in an example. 297 */ 298 #ifndef OPENSSL_NO_DSA 299 static const unsigned char kExampleDSAKeyDER[] = { 300 0x30, 0x82, 0x01, 0xba, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0x9a, 301 0x05, 0x6d, 0x33, 0xcd, 0x5d, 0x78, 0xa1, 0xbb, 0xcb, 0x7d, 0x5b, 0x8d, 302 0xb4, 0xcc, 0xbf, 0x03, 0x99, 0x64, 0xde, 0x38, 0x78, 0x06, 0x15, 0x2f, 303 0x86, 0x26, 0x77, 0xf3, 0xb1, 0x85, 0x00, 0xed, 0xfc, 0x28, 0x3a, 0x42, 304 0x4d, 0xab, 0xab, 0xdf, 0xbc, 0x9c, 0x16, 0xd0, 0x22, 0x50, 0xd1, 0x38, 305 0xdd, 0x3f, 0x64, 0x05, 0x9e, 0x68, 0x7a, 0x1e, 0xf1, 0x56, 0xbf, 0x1e, 306 0x2c, 0xc5, 0x97, 0x2a, 0xfe, 0x7a, 0x22, 0xdc, 0x6c, 0x68, 0xb8, 0x2e, 307 0x06, 0xdb, 0x41, 0xca, 0x98, 0xd8, 0x54, 0xc7, 0x64, 0x48, 0x24, 0x04, 308 0x20, 0xbc, 0x59, 0xe3, 0x6b, 0xea, 0x7e, 0xfc, 0x7e, 0xc5, 0x4e, 0xd4, 309 0xd8, 0x3a, 0xed, 0xcd, 0x5d, 0x99, 0xb8, 0x5c, 0xa2, 0x8b, 0xbb, 0x0b, 310 0xac, 0xe6, 0x8e, 0x25, 0x56, 0x22, 0x3a, 0x2d, 0x3a, 0x56, 0x41, 0x14, 311 0x1f, 0x1c, 0x8f, 0x53, 0x46, 0x13, 0x85, 0x02, 0x15, 0x00, 0x98, 0x7e, 312 0x92, 0x81, 0x88, 0xc7, 0x3f, 0x70, 0x49, 0x54, 0xf6, 0x76, 0xb4, 0xa3, 313 0x9e, 0x1d, 0x45, 0x98, 0x32, 0x7f, 0x02, 0x81, 0x80, 0x69, 0x4d, 0xef, 314 0x55, 0xff, 0x4d, 0x59, 0x2c, 0x01, 0xfa, 0x6a, 0x38, 0xe0, 0x70, 0x9f, 315 0x9e, 0x66, 0x8e, 0x3e, 0x8c, 0x52, 0x22, 0x9d, 0x15, 0x7e, 0x3c, 0xef, 316 0x4c, 0x7a, 0x61, 0x26, 0xe0, 0x2b, 0x81, 0x3f, 0xeb, 0xaf, 0x35, 0x38, 317 0x8d, 0xfe, 0xed, 0x46, 0xff, 0x5f, 0x03, 0x9b, 0x81, 0x92, 0xe7, 0x6f, 318 0x76, 0x4f, 0x1d, 0xd9, 0xbb, 0x89, 0xc9, 0x3e, 0xd9, 0x0b, 0xf9, 0xf4, 319 0x78, 0x11, 0x59, 0xc0, 0x1d, 0xcd, 0x0e, 0xa1, 0x6f, 0x15, 0xf1, 0x4d, 320 0xc1, 0xc9, 0x22, 0xed, 0x8d, 0xad, 0x67, 0xc5, 0x4b, 0x95, 0x93, 0x86, 321 0xa6, 0xaf, 0x8a, 0xee, 0x06, 0x89, 0x2f, 0x37, 0x7e, 0x64, 0xaa, 0xf6, 322 0xe7, 0xb1, 0x5a, 0x0a, 0x93, 0x95, 0x5d, 0x3e, 0x53, 0x9a, 0xde, 0x8a, 323 0xc2, 0x95, 0x45, 0x81, 0xbe, 0x5c, 0x2f, 0xc2, 0xb2, 0x92, 0x58, 0x19, 324 0x72, 0x80, 0xe9, 0x79, 0xa1, 0x02, 0x81, 0x80, 0x07, 0xd7, 0x62, 0xff, 325 0xdf, 0x1a, 0x3f, 0xed, 0x32, 0xd4, 0xd4, 0x88, 0x7b, 0x2c, 0x63, 0x7f, 326 0x97, 0xdc, 0x44, 0xd4, 0x84, 0xa2, 0xdd, 0x17, 0x16, 0x85, 0x13, 0xe0, 327 0xac, 0x51, 0x8d, 0x29, 0x1b, 0x75, 0x9a, 0xe4, 0xe3, 0x8a, 0x92, 0x69, 328 0x09, 0x03, 0xc5, 0x68, 0xae, 0x5e, 0x94, 0xfe, 0xc9, 0x92, 0x6c, 0x07, 329 0xb4, 0x1e, 0x64, 0x62, 0x87, 0xc6, 0xa4, 0xfd, 0x0d, 0x5f, 0xe5, 0xf9, 330 0x1b, 0x4f, 0x85, 0x5f, 0xae, 0xf3, 0x11, 0xe5, 0x18, 0xd4, 0x4d, 0x79, 331 0x9f, 0xc4, 0x79, 0x26, 0x04, 0x27, 0xf0, 0x0b, 0xee, 0x2b, 0x86, 0x9f, 332 0x86, 0x61, 0xe6, 0x51, 0xce, 0x04, 0x9b, 0x5d, 0x6b, 0x34, 0x43, 0x8c, 333 0x85, 0x3c, 0xf1, 0x51, 0x9b, 0x08, 0x23, 0x1b, 0xf5, 0x7e, 0x33, 0x12, 334 0xea, 0xab, 0x1f, 0xb7, 0x2d, 0xe2, 0x5f, 0xe6, 0x97, 0x99, 0xb5, 0x45, 335 0x16, 0x5b, 0xc3, 0x41, 0x02, 0x14, 0x61, 0xbf, 0x51, 0x60, 0xcf, 0xc8, 336 0xf1, 0x8c, 0x82, 0x97, 0xf2, 0xf4, 0x19, 0xba, 0x2b, 0xf3, 0x16, 0xbe, 337 0x40, 0x48 338 }; 339 #endif 340 341 /* 342 * kExampleBadRSAKeyDER is an RSA private key in ASN.1, DER format. The private 343 * components are not correct. 344 */ 345 static const unsigned char kExampleBadRSAKeyDER[] = { 346 0x30, 0x82, 0x04, 0x27, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 347 0xa6, 0x1a, 0x1e, 0x6e, 0x7b, 0xee, 0xc6, 0x89, 0x66, 0xe7, 0x93, 0xef, 348 0x54, 0x12, 0x68, 0xea, 0xbf, 0x86, 0x2f, 0xdd, 0xd2, 0x79, 0xb8, 0xa9, 349 0x6e, 0x03, 0xc2, 0xa3, 0xb9, 0xa3, 0xe1, 0x4b, 0x2a, 0xb3, 0xf8, 0xb4, 350 0xcd, 0xea, 0xbe, 0x24, 0xa6, 0x57, 0x5b, 0x83, 0x1f, 0x0f, 0xf2, 0xd3, 351 0xb7, 0xac, 0x7e, 0xd6, 0x8e, 0x6e, 0x1e, 0xbf, 0xb8, 0x73, 0x8c, 0x05, 352 0x56, 0xe6, 0x35, 0x1f, 0xe9, 0x04, 0x0b, 0x09, 0x86, 0x7d, 0xf1, 0x26, 353 0x08, 0x99, 0xad, 0x7b, 0xc8, 0x4d, 0x94, 0xb0, 0x0b, 0x8b, 0x38, 0xa0, 354 0x5c, 0x62, 0xa0, 0xab, 0xd3, 0x8f, 0xd4, 0x09, 0x60, 0x72, 0x1e, 0x33, 355 0x50, 0x80, 0x6e, 0x22, 0xa6, 0x77, 0x57, 0x6b, 0x9a, 0x33, 0x21, 0x66, 356 0x87, 0x6e, 0x21, 0x7b, 0xc7, 0x24, 0x0e, 0xd8, 0x13, 0xdf, 0x83, 0xde, 357 0xcd, 0x40, 0x58, 0x1d, 0x84, 0x86, 0xeb, 0xb8, 0x12, 0x4e, 0xd2, 0xfa, 358 0x80, 0x1f, 0xe4, 0xe7, 0x96, 0x29, 0xb8, 0xcc, 0xce, 0x66, 0x6d, 0x53, 359 0xca, 0xb9, 0x5a, 0xd7, 0xf6, 0x84, 0x6c, 0x2d, 0x9a, 0x1a, 0x14, 0x1c, 360 0x4e, 0x93, 0x39, 0xba, 0x74, 0xed, 0xed, 0x87, 0x87, 0x5e, 0x48, 0x75, 361 0x36, 0xf0, 0xbc, 0x34, 0xfb, 0x29, 0xf9, 0x9f, 0x96, 0x5b, 0x0b, 0xa7, 362 0x54, 0x30, 0x51, 0x29, 0x18, 0x5b, 0x7d, 0xac, 0x0f, 0xd6, 0x5f, 0x7c, 363 0xf8, 0x98, 0x8c, 0xd8, 0x86, 0x62, 0xb3, 0xdc, 0xff, 0x0f, 0xff, 0x7a, 364 0xaf, 0x5c, 0x4c, 0x61, 0x49, 0x2e, 0xc8, 0x95, 0x86, 0xc4, 0x0e, 0x87, 365 0xfc, 0x1d, 0xcf, 0x8b, 0x7c, 0x61, 0xf6, 0xd8, 0xd0, 0x69, 0xf6, 0xcd, 366 0x8a, 0x8c, 0xf6, 0x62, 0xa2, 0x56, 0xa9, 0xe3, 0xd1, 0xcf, 0x4d, 0xa0, 367 0xf6, 0x2d, 0x20, 0x0a, 0x04, 0xb7, 0xa2, 0xf7, 0xb5, 0x99, 0x47, 0x18, 368 0x56, 0x85, 0x87, 0xc7, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x82, 0x01, 369 0x01, 0x00, 0x99, 0x41, 0x38, 0x1a, 0xd0, 0x96, 0x7a, 0xf0, 0x83, 0xd5, 370 0xdf, 0x94, 0xce, 0x89, 0x3d, 0xec, 0x7a, 0x52, 0x21, 0x10, 0x16, 0x06, 371 0xe0, 0xee, 0xd2, 0xe6, 0xfd, 0x4b, 0x7b, 0x19, 0x4d, 0xe1, 0xc0, 0xc0, 372 0xd5, 0x14, 0x5d, 0x79, 0xdd, 0x7e, 0x8b, 0x4b, 0xc6, 0xcf, 0xb0, 0x75, 373 0x52, 0xa3, 0x2d, 0xb1, 0x26, 0x46, 0x68, 0x9c, 0x0a, 0x1a, 0xf2, 0xe1, 374 0x09, 0xac, 0x53, 0x85, 0x8c, 0x36, 0xa9, 0x14, 0x65, 0xea, 0xa0, 0x00, 375 0xcb, 0xe3, 0x3f, 0xc4, 0x2b, 0x61, 0x2e, 0x6b, 0x06, 0x69, 0x77, 0xfd, 376 0x38, 0x7e, 0x1d, 0x3f, 0x92, 0xe7, 0x77, 0x08, 0x19, 0xa7, 0x9d, 0x29, 377 0x2d, 0xdc, 0x42, 0xc6, 0x7c, 0xd7, 0xd3, 0xa8, 0x01, 0x2c, 0xf2, 0xd5, 378 0x82, 0x57, 0xcb, 0x55, 0x3d, 0xe7, 0xaa, 0xd2, 0x06, 0x30, 0x30, 0x05, 379 0xe6, 0xf2, 0x47, 0x86, 0xba, 0xc6, 0x61, 0x64, 0xeb, 0x4f, 0x2a, 0x5e, 380 0x07, 0x29, 0xe0, 0x96, 0xb2, 0x43, 0xff, 0x5f, 0x1a, 0x54, 0x16, 0xcf, 381 0xb5, 0x56, 0x5c, 0xa0, 0x9b, 0x0c, 0xfd, 0xb3, 0xd2, 0xe3, 0x79, 0x1d, 382 0x21, 0xe2, 0xd6, 0x13, 0xc4, 0x74, 0xa6, 0xf5, 0x8e, 0x8e, 0x81, 0xbb, 383 0xb4, 0xad, 0x8a, 0xf0, 0x93, 0x0a, 0xd8, 0x0a, 0x42, 0x36, 0xbc, 0xe5, 384 0x26, 0x2a, 0x0d, 0x5d, 0x57, 0x13, 0xc5, 0x4e, 0x2f, 0x12, 0x0e, 0xef, 385 0xa7, 0x81, 0x1e, 0xc3, 0xa5, 0xdb, 0xc9, 0x24, 0xeb, 0x1a, 0xa1, 0xf9, 386 0xf6, 0xa1, 0x78, 0x98, 0x93, 0x77, 0x42, 0x45, 0x03, 0xe2, 0xc9, 0xa2, 387 0xfe, 0x2d, 0x77, 0xc8, 0xc6, 0xac, 0x9b, 0x98, 0x89, 0x6d, 0x9a, 0xe7, 388 0x61, 0x63, 0xb7, 0xf2, 0xec, 0xd6, 0xb1, 0xa1, 0x6e, 0x0a, 0x1a, 0xff, 389 0xfd, 0x43, 0x28, 0xc3, 0x0c, 0xdc, 0xf2, 0x47, 0x4f, 0x27, 0xaa, 0x99, 390 0x04, 0x8e, 0xac, 0xe8, 0x7c, 0x01, 0x02, 0x04, 0x12, 0x34, 0x56, 0x78, 391 0x02, 0x81, 0x81, 0x00, 0xca, 0x69, 0xe5, 0xbb, 0x3a, 0x90, 0x82, 0xcb, 392 0x82, 0x50, 0x2f, 0x29, 0xe2, 0x76, 0x6a, 0x57, 0x55, 0x45, 0x4e, 0x35, 393 0x18, 0x61, 0xe0, 0x12, 0x70, 0xc0, 0xab, 0xc7, 0x80, 0xa2, 0xd4, 0x46, 394 0x34, 0x03, 0xa0, 0x19, 0x26, 0x23, 0x9e, 0xef, 0x1a, 0xcb, 0x75, 0xd6, 395 0xba, 0x81, 0xf4, 0x7e, 0x52, 0xe5, 0x2a, 0xe8, 0xf1, 0x49, 0x6c, 0x0f, 396 0x1a, 0xa0, 0xf9, 0xc6, 0xe7, 0xec, 0x60, 0xe4, 0xcb, 0x2a, 0xb5, 0x56, 397 0xe9, 0x9c, 0xcd, 0x19, 0x75, 0x92, 0xb1, 0x66, 0xce, 0xc3, 0xd9, 0x3d, 398 0x11, 0xcb, 0xc4, 0x09, 0xce, 0x1e, 0x30, 0xba, 0x2f, 0x60, 0x60, 0x55, 399 0x8d, 0x02, 0xdc, 0x5d, 0xaf, 0xf7, 0x52, 0x31, 0x17, 0x07, 0x53, 0x20, 400 0x33, 0xad, 0x8c, 0xd5, 0x2f, 0x5a, 0xd0, 0x57, 0xd7, 0xd1, 0x80, 0xd6, 401 0x3a, 0x9b, 0x04, 0x4f, 0x35, 0xbf, 0xe7, 0xd5, 0xbc, 0x8f, 0xd4, 0x81, 402 0x02, 0x81, 0x81, 0x00, 0xc0, 0x9f, 0xf8, 0xcd, 0xf7, 0x3f, 0x26, 0x8a, 403 0x3d, 0x4d, 0x2b, 0x0c, 0x01, 0xd0, 0xa2, 0xb4, 0x18, 0xfe, 0xf7, 0x5e, 404 0x2f, 0x06, 0x13, 0xcd, 0x63, 0xaa, 0x12, 0xa9, 0x24, 0x86, 0xe3, 0xf3, 405 0x7b, 0xda, 0x1a, 0x3c, 0xb1, 0x38, 0x80, 0x80, 0xef, 0x64, 0x64, 0xa1, 406 0x9b, 0xfe, 0x76, 0x63, 0x8e, 0x83, 0xd2, 0xd9, 0xb9, 0x86, 0xb0, 0xe6, 407 0xa6, 0x0c, 0x7e, 0xa8, 0x84, 0x90, 0x98, 0x0c, 0x1e, 0xf3, 0x14, 0x77, 408 0xe0, 0x5f, 0x81, 0x08, 0x11, 0x8f, 0xa6, 0x23, 0xc4, 0xba, 0xc0, 0x8a, 409 0xe4, 0xc6, 0xe3, 0x5c, 0xbe, 0xc5, 0xec, 0x2c, 0xb9, 0xd8, 0x8c, 0x4d, 410 0x1a, 0x9d, 0xe7, 0x7c, 0x85, 0x4c, 0x0d, 0x71, 0x4e, 0x72, 0x33, 0x1b, 411 0xfe, 0xa9, 0x17, 0x72, 0x76, 0x56, 0x9d, 0x74, 0x7e, 0x52, 0x67, 0x9a, 412 0x87, 0x9a, 0xdb, 0x30, 0xde, 0xe4, 0x49, 0x28, 0x3b, 0xd2, 0x67, 0xaf, 413 0x02, 0x81, 0x81, 0x00, 0x89, 0x74, 0x9a, 0x8e, 0xa7, 0xb9, 0xa5, 0x28, 414 0xc0, 0x68, 0xe5, 0x6e, 0x63, 0x1c, 0x99, 0x20, 0x8f, 0x86, 0x8e, 0x12, 415 0x9e, 0x69, 0x30, 0xfa, 0x34, 0xd9, 0x92, 0x8d, 0xdb, 0x7c, 0x37, 0xfd, 416 0x28, 0xab, 0x61, 0x98, 0x52, 0x7f, 0x14, 0x1a, 0x39, 0xae, 0xfb, 0x6a, 417 0x03, 0xa3, 0xe6, 0xbd, 0xb6, 0x5b, 0x6b, 0xe5, 0x5e, 0x9d, 0xc6, 0xa5, 418 0x07, 0x27, 0x54, 0x17, 0xd0, 0x3d, 0x84, 0x9b, 0x3a, 0xa0, 0xd9, 0x1e, 419 0x99, 0x6c, 0x63, 0x17, 0xab, 0xf1, 0x1f, 0x49, 0xba, 0x95, 0xe3, 0x3b, 420 0x86, 0x8f, 0x42, 0xa4, 0x89, 0xf5, 0x94, 0x8f, 0x8b, 0x46, 0xbe, 0x84, 421 0xba, 0x4a, 0xbc, 0x0d, 0x5f, 0x46, 0xeb, 0xe8, 0xec, 0x43, 0x8c, 0x1e, 422 0xad, 0x19, 0x69, 0x2f, 0x08, 0x86, 0x7a, 0x3f, 0x7d, 0x0f, 0x07, 0x97, 423 0xf3, 0x9a, 0x7b, 0xb5, 0xb2, 0xc1, 0x8c, 0x95, 0x68, 0x04, 0xa0, 0x81, 424 0x02, 0x81, 0x80, 0x4e, 0xbf, 0x7e, 0x1b, 0xcb, 0x13, 0x61, 0x75, 0x3b, 425 0xdb, 0x59, 0x5f, 0xb1, 0xd4, 0xb8, 0xeb, 0x9e, 0x73, 0xb5, 0xe7, 0xf6, 426 0x89, 0x3d, 0x1c, 0xda, 0xf0, 0x36, 0xff, 0x35, 0xbd, 0x1e, 0x0b, 0x74, 427 0xe3, 0x9e, 0xf0, 0xf2, 0xf7, 0xd7, 0x82, 0xb7, 0x7b, 0x6a, 0x1b, 0x0e, 428 0x30, 0x4a, 0x98, 0x0e, 0xb4, 0xf9, 0x81, 0x07, 0xe4, 0x75, 0x39, 0xe9, 429 0x53, 0xca, 0xbb, 0x5c, 0xaa, 0x93, 0x07, 0x0e, 0xa8, 0x2f, 0xba, 0x98, 430 0x49, 0x30, 0xa7, 0xcc, 0x1a, 0x3c, 0x68, 0x0c, 0xe1, 0xa4, 0xb1, 0x05, 431 0xe6, 0xe0, 0x25, 0x78, 0x58, 0x14, 0x37, 0xf5, 0x1f, 0xe3, 0x22, 0xef, 432 0xa8, 0x0e, 0x22, 0xa0, 0x94, 0x3a, 0xf6, 0xc9, 0x13, 0xe6, 0x06, 0xbf, 433 0x7f, 0x99, 0xc6, 0xcc, 0xd8, 0xc6, 0xbe, 0xd9, 0x2e, 0x24, 0xc7, 0x69, 434 0x8c, 0x95, 0xba, 0xf6, 0x04, 0xb3, 0x0a, 0xf4, 0xcb, 0xf0, 0xce 435 }; 436 437 /* 438 * kExampleBad2RSAKeyDER is an RSA private key in ASN.1, DER format. All 439 * values are 0. 440 */ 441 static const unsigned char kExampleBad2RSAKeyDER[] = { 442 0x30, 0x1b, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 443 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 444 0x01, 0x00, 0x02, 0x01, 0x00 445 }; 446 447 static const unsigned char kMsg[] = { 1, 2, 3, 4 }; 448 449 static const unsigned char kSignature[] = { 450 0xa5, 0xf0, 0x8a, 0x47, 0x5d, 0x3c, 0xb3, 0xcc, 0xa9, 0x79, 0xaf, 0x4d, 451 0x8c, 0xae, 0x4c, 0x14, 0xef, 0xc2, 0x0b, 0x34, 0x36, 0xde, 0xf4, 0x3e, 452 0x3d, 0xbb, 0x4a, 0x60, 0x5c, 0xc8, 0x91, 0x28, 0xda, 0xfb, 0x7e, 0x04, 453 0x96, 0x7e, 0x63, 0x13, 0x90, 0xce, 0xb9, 0xb4, 0x62, 0x7a, 0xfd, 0x09, 454 0x3d, 0xc7, 0x67, 0x78, 0x54, 0x04, 0xeb, 0x52, 0x62, 0x6e, 0x24, 0x67, 455 0xb4, 0x40, 0xfc, 0x57, 0x62, 0xc6, 0xf1, 0x67, 0xc1, 0x97, 0x8f, 0x6a, 456 0xa8, 0xae, 0x44, 0x46, 0x5e, 0xab, 0x67, 0x17, 0x53, 0x19, 0x3a, 0xda, 457 0x5a, 0xc8, 0x16, 0x3e, 0x86, 0xd5, 0xc5, 0x71, 0x2f, 0xfc, 0x23, 0x48, 458 0xd9, 0x0b, 0x13, 0xdd, 0x7b, 0x5a, 0x25, 0x79, 0xef, 0xa5, 0x7b, 0x04, 459 0xed, 0x44, 0xf6, 0x18, 0x55, 0xe4, 0x0a, 0xe9, 0x57, 0x79, 0x5d, 0xd7, 460 0x55, 0xa7, 0xab, 0x45, 0x02, 0x97, 0x60, 0x42 461 }; 462 463 /* 464 * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v1 465 * PrivateKeyInfo. 466 */ 467 static const unsigned char kExampleRSAKeyPKCS8[] = { 468 0x30, 0x82, 0x02, 0x76, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 469 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 470 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 471 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 472 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 473 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 474 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 475 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 476 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 477 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 478 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 479 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 480 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 481 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 482 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 483 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 484 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 485 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 486 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 487 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 488 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 489 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 490 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 491 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 492 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 493 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 494 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 495 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 496 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 497 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 498 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 499 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 500 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 501 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 502 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 503 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 504 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 505 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 506 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 507 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 508 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 509 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 510 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 511 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 512 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 513 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 514 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 515 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 516 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 517 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 518 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 519 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 520 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf 521 }; 522 523 /* 524 * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v2 525 * PrivateKeyInfo (with an optional public key). 526 */ 527 static const unsigned char kExampleRSAKeyPKCS8_v2[] = { 528 0x30, 0x82, 0x03, 0x06, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 529 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 530 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 531 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 532 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 533 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 534 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 535 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 536 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 537 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 538 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 539 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 540 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 541 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 542 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 543 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 544 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 545 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 546 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 547 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 548 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 549 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 550 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 551 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 552 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 553 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 554 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 555 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 556 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 557 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 558 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 559 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 560 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 561 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 562 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 563 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 564 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 565 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 566 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 567 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 568 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 569 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 570 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 571 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 572 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 573 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 574 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 575 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 576 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 577 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 578 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 579 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 580 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf, 581 /* Implicit optional Public key BIT STRING */ 582 0x81, 583 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xf8, 584 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 585 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 586 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 587 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 588 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 589 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 590 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 591 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 592 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 593 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 594 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01 595 }; 596 597 #ifndef OPENSSL_NO_EC 598 /* 599 * kExampleECKeyDER is a sample EC private key encoded as an ECPrivateKey 600 * structure. 601 */ 602 static const unsigned char kExampleECKeyDER[] = { 603 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a, 604 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08, 605 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 606 0x8b, 0xb4, 0x6a, 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 607 0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 608 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 609 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 610 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 611 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 612 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 613 0xc1 614 }; 615 616 static const unsigned char kExampleECKeyPKCS8_v2[] = { 617 0x30, 0x81, 0xcb, 0x02, 0x01, 0x01, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 618 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 619 0x03, 0x01, 0x07, 0x04, 0x6d, 0x30, 0x6b, 0x02, 0x01, 0x01, 0x04, 0x20, 620 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 621 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 622 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa1, 0x44, 0x03, 0x42, 623 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 624 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 625 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 626 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 627 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 628 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1, 629 /* Optional implicit public key BIT STRING */ 630 0x81, 631 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 632 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 633 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 634 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 635 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 636 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1 637 }; 638 639 /* 640 * kExampleBadECKeyDER is a sample EC private key encoded as an ECPrivateKey 641 * structure. The private key is equal to the order and will fail to import 642 */ 643 static const unsigned char kExampleBadECKeyDER[] = { 644 0x30, 0x66, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 645 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 646 0x01, 0x07, 0x04, 0x4C, 0x30, 0x4A, 0x02, 0x01, 0x01, 0x04, 0x20, 0xFF, 647 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 648 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 649 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51, 0xA1, 0x23, 0x03, 0x21, 0x00, 650 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 651 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 652 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51 653 }; 654 655 /* prime256v1 */ 656 static const unsigned char kExampleECPubKeyDER[] = { 657 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 658 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 659 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53, 660 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8, 661 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7, 662 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b, 663 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20, 664 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5 665 }; 666 667 /* 668 * kExampleBadECPubKeyDER is a sample EC public key with a wrong OID 669 * 1.2.840.10045.2.2 instead of 1.2.840.10045.2.1 - EC Public Key 670 */ 671 static const unsigned char kExampleBadECPubKeyDER[] = { 672 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 673 0x02, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 674 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53, 675 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8, 676 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7, 677 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b, 678 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20, 679 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5 680 }; 681 682 static const unsigned char pExampleECParamDER[] = { 683 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 684 }; 685 686 #ifndef OPENSSL_NO_ECX 687 static const unsigned char kExampleED25519KeyDER[] = { 688 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 689 0x04, 0x22, 0x04, 0x20, 0xba, 0x7b, 0xba, 0x20, 0x1b, 0x02, 0x75, 0x3a, 690 0xe8, 0x88, 0xfe, 0x00, 0xcd, 0x8b, 0xc6, 0xf4, 0x5c, 0x47, 0x09, 0x46, 691 0x66, 0xe4, 0x72, 0x85, 0x25, 0x26, 0x5e, 0x12, 0x33, 0x48, 0xf6, 0x50 692 }; 693 694 static const unsigned char kExampleED25519PubKeyDER[] = { 695 0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00, 696 0xf5, 0xc5, 0xeb, 0x52, 0x3e, 0x7d, 0x07, 0x86, 0xb2, 0x55, 0x07, 0x45, 697 0xef, 0x5b, 0x7c, 0x20, 0xe8, 0x66, 0x28, 0x30, 0x3c, 0x8a, 0x82, 0x40, 698 0x97, 0xa3, 0x08, 0xdc, 0x65, 0x80, 0x39, 0x29 699 }; 700 701 #ifndef OPENSSL_NO_DEPRECATED_3_0 702 static const unsigned char kExampleX25519KeyDER[] = { 703 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 704 0x04, 0x22, 0x04, 0x20, 0xa0, 0x24, 0x3a, 0x31, 0x24, 0xc3, 0x3f, 0xf6, 705 0x7b, 0x96, 0x0b, 0xd4, 0x8f, 0xd1, 0xee, 0x67, 0xf2, 0x9b, 0x88, 0xac, 706 0x50, 0xce, 0x97, 0x36, 0xdd, 0xaf, 0x25, 0xf6, 0x10, 0x34, 0x96, 0x6e 707 }; 708 #endif 709 #endif 710 #endif 711 712 /* kExampleDHKeyDER is a DH private key in ASN.1, DER format. */ 713 #ifndef OPENSSL_NO_DEPRECATED_3_0 714 #ifndef OPENSSL_NO_DH 715 static const unsigned char kExampleDHKeyDER[] = { 716 0x30, 0x82, 0x01, 0x21, 0x02, 0x01, 0x00, 0x30, 0x81, 0x95, 0x06, 0x09, 717 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x03, 0x01, 0x30, 0x81, 0x87, 718 0x02, 0x81, 0x81, 0x00, 0xf7, 0x52, 0xc2, 0x68, 0xcc, 0x66, 0xc4, 0x8d, 719 0x03, 0x3f, 0xfa, 0x9c, 0x52, 0xd0, 0xd8, 0x33, 0xf2, 0xe1, 0xc9, 0x9e, 720 0xb7, 0xe7, 0x6e, 0x90, 0x97, 0xeb, 0x92, 0x91, 0x6a, 0x9a, 0x85, 0x63, 721 0x92, 0x79, 0xab, 0xb6, 0x3d, 0x23, 0x58, 0x5a, 0xe8, 0x45, 0x06, 0x81, 722 0x97, 0x77, 0xe1, 0xcc, 0x34, 0x4e, 0xae, 0x36, 0x80, 0xf2, 0xc4, 0x7f, 723 0x8a, 0x52, 0xb8, 0xdb, 0x58, 0xc8, 0x4b, 0x12, 0x4c, 0xf1, 0x4c, 0x53, 724 0xc1, 0x89, 0x39, 0x8d, 0xb6, 0x06, 0xd8, 0xea, 0x7f, 0x2d, 0x36, 0x53, 725 0x96, 0x29, 0xbe, 0xb6, 0x75, 0xfc, 0xe7, 0xf3, 0x36, 0xd6, 0xf4, 0x8f, 726 0x16, 0xa6, 0xc7, 0xec, 0x7b, 0xce, 0x42, 0x8d, 0x48, 0x2e, 0xb7, 0x74, 727 0x00, 0x11, 0x52, 0x61, 0xb4, 0x19, 0x35, 0xec, 0x5c, 0xe4, 0xbe, 0x34, 728 0xc6, 0x59, 0x64, 0x5e, 0x42, 0x61, 0x70, 0x54, 0xf4, 0xe9, 0x6b, 0x53, 729 0x02, 0x01, 0x02, 0x04, 0x81, 0x83, 0x02, 0x81, 0x80, 0x64, 0xc2, 0xe3, 730 0x09, 0x69, 0x37, 0x3c, 0xd2, 0x4a, 0xba, 0xc3, 0x78, 0x6a, 0x9b, 0x8a, 731 0x2a, 0xdb, 0xe7, 0xe6, 0xc0, 0xfa, 0x3a, 0xbe, 0x39, 0x67, 0xc0, 0xa9, 732 0x2a, 0xf0, 0x0a, 0xc1, 0x53, 0x1c, 0xdb, 0xfa, 0x1a, 0x26, 0x98, 0xb0, 733 0x8c, 0xc6, 0x06, 0x4a, 0xa2, 0x48, 0xd3, 0xa4, 0x3b, 0xbd, 0x05, 0x48, 734 0xea, 0x59, 0xdb, 0x18, 0xa4, 0xca, 0x66, 0xd9, 0x5d, 0xb8, 0x95, 0xd1, 735 0xeb, 0x97, 0x3d, 0x66, 0x97, 0x5c, 0x86, 0x8f, 0x7e, 0x90, 0xd3, 0x43, 736 0xd1, 0xa2, 0x0d, 0xcb, 0xe7, 0xeb, 0x90, 0xea, 0x09, 0x40, 0xb1, 0x6f, 737 0xf7, 0x4c, 0xf2, 0x41, 0x83, 0x1d, 0xd0, 0x76, 0xef, 0xaf, 0x55, 0x6f, 738 0x5d, 0xa9, 0xa3, 0x55, 0x81, 0x2a, 0xd1, 0x5d, 0x9d, 0x22, 0x77, 0x97, 739 0x83, 0xde, 0xad, 0xb6, 0x5d, 0x19, 0xc1, 0x53, 0xec, 0xfb, 0xaf, 0x06, 740 0x2e, 0x87, 0x2a, 0x0b, 0x7a 741 }; 742 #endif 743 #endif 744 745 static const unsigned char kCFBDefaultKey[] = { 746 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88, 747 0x09, 0xCF, 0x4F, 0x3C 748 }; 749 750 static const unsigned char kGCMDefaultKey[32] = { 0 }; 751 752 static const unsigned char kGCMResetKey[] = { 753 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 0x6d, 0x6a, 0x8f, 0x94, 754 0x67, 0x30, 0x83, 0x08, 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 755 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08 756 }; 757 758 static const unsigned char iCFBIV[] = { 759 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 760 0x0C, 0x0D, 0x0E, 0x0F 761 }; 762 763 static const unsigned char iGCMDefaultIV[12] = { 0 }; 764 765 static const unsigned char iGCMResetIV1[] = { 766 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad 767 }; 768 769 static const unsigned char iGCMResetIV2[] = { 770 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88 771 }; 772 773 static const unsigned char cfbPlaintext[] = { 774 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 775 0x73, 0x93, 0x17, 0x2A 776 }; 777 static const unsigned char cfbPlaintext_partial[] = { 778 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 779 0x73, 0x93, 0x17, 0x2A, 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96 780 }; 781 782 static const unsigned char gcmDefaultPlaintext[16] = { 0 }; 783 784 static const unsigned char gcmResetPlaintext[] = { 785 0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09, 0xc5, 786 0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda, 787 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c, 0x3c, 0x0c, 0x95, 788 0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25, 789 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57, 0xba, 0x63, 0x7b, 0x39 790 }; 791 792 static const unsigned char cfbCiphertext[] = { 793 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 794 0xE8, 0x3C, 0xFB, 0x4A 795 }; 796 797 static const unsigned char cfbCiphertext_partial[] = { 798 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 799 0xE8, 0x3C, 0xFB, 0x4A, 0x0D, 0x4A, 0x71, 0x82, 0x90, 0xF0, 0x9A, 0x35 800 }; 801 802 static const unsigned char ofbCiphertext_partial[] = { 803 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 804 0xE8, 0x3C, 0xFB, 0x4A, 0xB2, 0x65, 0x64, 0x38, 0x26, 0xD2, 0xBC, 0x09 805 }; 806 807 static const unsigned char gcmDefaultCiphertext[] = { 808 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e, 0x07, 0x4e, 0xc5, 0xd3, 809 0xba, 0xf3, 0x9d, 0x18 810 }; 811 812 static const unsigned char gcmResetCiphertext1[] = { 813 0xc3, 0x76, 0x2d, 0xf1, 0xca, 0x78, 0x7d, 0x32, 0xae, 0x47, 0xc1, 0x3b, 814 0xf1, 0x98, 0x44, 0xcb, 0xaf, 0x1a, 0xe1, 0x4d, 0x0b, 0x97, 0x6a, 0xfa, 815 0xc5, 0x2f, 0xf7, 0xd7, 0x9b, 0xba, 0x9d, 0xe0, 0xfe, 0xb5, 0x82, 0xd3, 816 0x39, 0x34, 0xa4, 0xf0, 0x95, 0x4c, 0xc2, 0x36, 0x3b, 0xc7, 0x3f, 0x78, 817 0x62, 0xac, 0x43, 0x0e, 0x64, 0xab, 0xe4, 0x99, 0xf4, 0x7c, 0x9b, 0x1f 818 }; 819 820 static const unsigned char gcmResetCiphertext2[] = { 821 0x52, 0x2d, 0xc1, 0xf0, 0x99, 0x56, 0x7d, 0x07, 0xf4, 0x7f, 0x37, 0xa3, 822 0x2a, 0x84, 0x42, 0x7d, 0x64, 0x3a, 0x8c, 0xdc, 0xbf, 0xe5, 0xc0, 0xc9, 823 0x75, 0x98, 0xa2, 0xbd, 0x25, 0x55, 0xd1, 0xaa, 0x8c, 0xb0, 0x8e, 0x48, 824 0x59, 0x0d, 0xbb, 0x3d, 0xa7, 0xb0, 0x8b, 0x10, 0x56, 0x82, 0x88, 0x38, 825 0xc5, 0xf6, 0x1e, 0x63, 0x93, 0xba, 0x7a, 0x0a, 0xbc, 0xc9, 0xf6, 0x62 826 }; 827 828 static const unsigned char gcmAAD[] = { 829 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe, 0xef, 0xfe, 0xed, 0xfa, 0xce, 830 0xde, 0xad, 0xbe, 0xef, 0xab, 0xad, 0xda, 0xd2 831 }; 832 833 static const unsigned char gcmDefaultTag[] = { 834 0xd0, 0xd1, 0xc8, 0xa7, 0x99, 0x99, 0x6b, 0xf0, 0x26, 0x5b, 0x98, 0xb5, 835 0xd4, 0x8a, 0xb9, 0x19 836 }; 837 838 static const unsigned char gcmResetTag1[] = { 839 0x3a, 0x33, 0x7d, 0xbf, 0x46, 0xa7, 0x92, 0xc4, 0x5e, 0x45, 0x49, 0x13, 840 0xfe, 0x2e, 0xa8, 0xf2 841 }; 842 843 static const unsigned char gcmResetTag2[] = { 844 0x76, 0xfc, 0x6e, 0xce, 0x0f, 0x4e, 0x17, 0x68, 0xcd, 0xdf, 0x88, 0x53, 845 0xbb, 0x2d, 0x55, 0x1b 846 }; 847 848 typedef struct APK_DATA_st { 849 const unsigned char *kder; 850 size_t size; 851 const char *keytype; 852 int evptype; 853 int check; 854 int pub_check; 855 int param_check; 856 int type; /* 0 for private, 1 for public, 2 for params */ 857 } APK_DATA; 858 859 static APK_DATA keydata[] = { 860 { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA }, 861 { kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8), "RSA", EVP_PKEY_RSA }, 862 #ifndef OPENSSL_NO_EC 863 { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC } 864 #endif 865 }; 866 867 static APK_DATA keydata_v2[] = { 868 { kExampleRSAKeyPKCS8_v2, sizeof(kExampleRSAKeyPKCS8_v2), "RSA", EVP_PKEY_RSA }, 869 #ifndef OPENSSL_NO_EC 870 { kExampleECKeyPKCS8_v2, sizeof(kExampleECKeyPKCS8_v2), "EC", EVP_PKEY_EC } 871 #endif 872 }; 873 874 static APK_DATA keycheckdata[] = { 875 { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA, 1, 1, 1, 876 0 }, 877 { kExampleBadRSAKeyDER, sizeof(kExampleBadRSAKeyDER), "RSA", EVP_PKEY_RSA, 878 0, 1, 1, 0 }, 879 { kExampleBad2RSAKeyDER, sizeof(kExampleBad2RSAKeyDER), "RSA", EVP_PKEY_RSA, 880 0, 0, 1 /* Since there are no "params" in an RSA key this passes */, 0 }, 881 #ifndef OPENSSL_NO_EC 882 { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC, 1, 1, 1, 0 }, 883 /* group is also associated in our pub key */ 884 { kExampleECPubKeyDER, sizeof(kExampleECPubKeyDER), "EC", EVP_PKEY_EC, 0, 1, 885 1, 1 }, 886 { pExampleECParamDER, sizeof(pExampleECParamDER), "EC", EVP_PKEY_EC, 0, 0, 1, 887 2 }, 888 #ifndef OPENSSL_NO_ECX 889 { kExampleED25519KeyDER, sizeof(kExampleED25519KeyDER), "ED25519", 890 EVP_PKEY_ED25519, 1, 1, 1, 0 }, 891 { kExampleED25519PubKeyDER, sizeof(kExampleED25519PubKeyDER), "ED25519", 892 EVP_PKEY_ED25519, 0, 1, 1, 1 }, 893 #endif 894 #endif 895 }; 896 897 static EVP_PKEY *load_example_key(const char *keytype, 898 const unsigned char *data, size_t data_len) 899 { 900 const unsigned char **pdata = &data; 901 EVP_PKEY *pkey = NULL; 902 OSSL_DECODER_CTX *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, keytype, 0, 903 testctx, testpropq); 904 905 /* |pkey| will be NULL on error */ 906 (void)OSSL_DECODER_from_data(dctx, pdata, &data_len); 907 OSSL_DECODER_CTX_free(dctx); 908 return pkey; 909 } 910 911 static EVP_PKEY *load_example_rsa_key(void) 912 { 913 return load_example_key("RSA", kExampleRSAKeyDER, 914 sizeof(kExampleRSAKeyDER)); 915 } 916 917 #ifndef OPENSSL_NO_DSA 918 static EVP_PKEY *load_example_dsa_key(void) 919 { 920 return load_example_key("DSA", kExampleDSAKeyDER, 921 sizeof(kExampleDSAKeyDER)); 922 } 923 #endif 924 925 #ifndef OPENSSL_NO_EC 926 static EVP_PKEY *load_example_ec_key(void) 927 { 928 return load_example_key("EC", kExampleECKeyDER, 929 sizeof(kExampleECKeyDER)); 930 } 931 #endif 932 933 #ifndef OPENSSL_NO_DEPRECATED_3_0 934 935 static EVP_PKEY *make_bad_rsa_pubkey(void) 936 { 937 RSA *rsa = NULL; 938 BIGNUM *n = NULL, *e = NULL; 939 EVP_PKEY *pkey = NULL; 940 941 /* Deliberately invalid public key: n = 17, e = 17 */ 942 if (!TEST_ptr(pkey = EVP_PKEY_new()) 943 || !TEST_ptr(rsa = RSA_new()) 944 || !TEST_ptr(n = BN_new()) 945 || !TEST_ptr(e = BN_new()) 946 || !TEST_true(BN_set_word(n, 17)) 947 || !TEST_true(BN_set_word(e, 17)) 948 || !TEST_true(RSA_set0_key(rsa, n, e, NULL)) 949 || !EVP_PKEY_assign_RSA(pkey, rsa)) 950 goto err; 951 952 return pkey; 953 err: 954 BN_free(n); 955 BN_free(e); 956 RSA_free(rsa); 957 return NULL; 958 } 959 960 #ifndef OPENSSL_NO_DH 961 static EVP_PKEY *load_example_dh_key(void) 962 { 963 return load_example_key("DH", kExampleDHKeyDER, 964 sizeof(kExampleDHKeyDER)); 965 } 966 #endif 967 968 #ifndef OPENSSL_NO_ECX 969 static EVP_PKEY *load_example_ed25519_key(void) 970 { 971 return load_example_key("ED25519", kExampleED25519KeyDER, 972 sizeof(kExampleED25519KeyDER)); 973 } 974 975 static EVP_PKEY *load_example_x25519_key(void) 976 { 977 return load_example_key("X25519", kExampleX25519KeyDER, 978 sizeof(kExampleX25519KeyDER)); 979 } 980 #endif 981 #endif /* OPENSSL_NO_DEPRECATED_3_0 */ 982 983 static EVP_PKEY *load_example_hmac_key(void) 984 { 985 EVP_PKEY *pkey = NULL; 986 unsigned char key[] = { 987 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 988 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 989 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 990 }; 991 992 pkey = EVP_PKEY_new_raw_private_key_ex(testctx, "HMAC", 993 NULL, key, sizeof(key)); 994 if (!TEST_ptr(pkey)) 995 return NULL; 996 997 return pkey; 998 } 999 1000 static int test_EVP_set_config_properties(void) 1001 { 1002 char *fetched_properties = NULL; 1003 const char test_propq[] = "test.fizzbuzz=buzzfizz"; 1004 int res = 0; 1005 1006 fetched_properties = EVP_get1_default_properties(OSSL_LIB_CTX_get0_global_default()); 1007 if (!TEST_ptr(fetched_properties) 1008 || !TEST_str_eq(fetched_properties, test_propq)) 1009 goto err; 1010 OPENSSL_free(fetched_properties); 1011 fetched_properties = NULL; 1012 1013 res = 1; 1014 err: 1015 OPENSSL_free(fetched_properties); 1016 return res; 1017 } 1018 1019 static int test_EVP_set_default_properties(void) 1020 { 1021 OSSL_LIB_CTX *ctx; 1022 EVP_MD *md = NULL; 1023 int res = 0; 1024 char *fetched_properties = NULL; 1025 const char test_propq[] = "provider=fizzbang"; 1026 const char test_fips_propq[] = "fips=yes,provider=fizzbang"; 1027 1028 if (!TEST_ptr(ctx = OSSL_LIB_CTX_new()) 1029 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL))) 1030 goto err; 1031 EVP_MD_free(md); 1032 md = NULL; 1033 1034 if (!TEST_true(EVP_set_default_properties(ctx, test_propq)) 1035 || !TEST_ptr_null(md = EVP_MD_fetch(ctx, "sha256", NULL)) 1036 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", "-provider"))) 1037 goto err; 1038 EVP_MD_free(md); 1039 md = NULL; 1040 1041 fetched_properties = EVP_get1_default_properties(ctx); 1042 if (!TEST_ptr(fetched_properties) 1043 || !TEST_str_eq(fetched_properties, test_propq)) 1044 goto err; 1045 OPENSSL_free(fetched_properties); 1046 fetched_properties = NULL; 1047 1048 if (!TEST_true(EVP_default_properties_enable_fips(ctx, 1))) 1049 goto err; 1050 fetched_properties = EVP_get1_default_properties(ctx); 1051 if (!TEST_ptr(fetched_properties) 1052 || !TEST_str_eq(fetched_properties, test_fips_propq)) 1053 goto err; 1054 OPENSSL_free(fetched_properties); 1055 fetched_properties = NULL; 1056 1057 if (!TEST_true(EVP_default_properties_enable_fips(ctx, 0))) 1058 goto err; 1059 1060 if (!TEST_true(EVP_set_default_properties(ctx, NULL)) 1061 || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL))) 1062 goto err; 1063 res = 1; 1064 err: 1065 OPENSSL_free(fetched_properties); 1066 EVP_MD_free(md); 1067 OSSL_LIB_CTX_free(ctx); 1068 return res; 1069 } 1070 1071 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC) 1072 static EVP_PKEY *make_key_fromdata(char *keytype, OSSL_PARAM *params) 1073 { 1074 EVP_PKEY_CTX *pctx = NULL; 1075 EVP_PKEY *tmp_pkey = NULL, *pkey = NULL; 1076 1077 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, keytype, testpropq))) 1078 goto err; 1079 /* Check that premature EVP_PKEY_CTX_set_params() fails gracefully */ 1080 if (!TEST_int_eq(EVP_PKEY_CTX_set_params(pctx, params), 0) 1081 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) 1082 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &tmp_pkey, EVP_PKEY_KEYPAIR, 1083 params), 1084 0)) 1085 goto err; 1086 1087 if (!TEST_ptr(tmp_pkey)) 1088 goto err; 1089 1090 pkey = tmp_pkey; 1091 tmp_pkey = NULL; 1092 err: 1093 EVP_PKEY_free(tmp_pkey); 1094 EVP_PKEY_CTX_free(pctx); 1095 return pkey; 1096 } 1097 1098 static int test_selection(EVP_PKEY *pkey, int selection) 1099 { 1100 int testresult = 0; 1101 int ret; 1102 BIO *bio = BIO_new(BIO_s_mem()); 1103 1104 ret = PEM_write_bio_PUBKEY(bio, pkey); 1105 if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { 1106 if (!TEST_true(ret)) 1107 goto err; 1108 } else { 1109 if (!TEST_false(ret)) 1110 goto err; 1111 } 1112 ret = PEM_write_bio_PrivateKey_ex(bio, pkey, NULL, NULL, 0, NULL, NULL, 1113 testctx, NULL); 1114 if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { 1115 if (!TEST_true(ret)) 1116 goto err; 1117 } else { 1118 if (!TEST_false(ret)) 1119 goto err; 1120 } 1121 1122 testresult = 1; 1123 err: 1124 BIO_free(bio); 1125 1126 return testresult; 1127 } 1128 #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA || !OPENSSL_NO_EC */ 1129 1130 /* 1131 * RSASVE (SP 800-56B 7.2) must reject mathematically degenerate inputs: 1132 * a public exponent e <= 1, and a ciphertext c in {0, 1, n - 1}. Outside 1133 * the FIPS module these were previously accepted; the checks now apply to 1134 * every build, so exercise them in the default provider. 1135 */ 1136 1137 /* 1138 * With e <= 1 the RSA public operation is the identity (or worse), so 1139 * encapsulation setup must reject the key with PROV_R_INVALID_KEY. idx 1140 * selects the exponent: 0 or 1. 1141 */ 1142 static int test_rsasve_degenerate_exponent(int idx) 1143 { 1144 EVP_PKEY *rsakey = NULL; 1145 EVP_PKEY *pubkey = NULL; 1146 EVP_PKEY_CTX *genctx = NULL; 1147 EVP_PKEY_CTX *ctx = NULL; 1148 OSSL_PARAM_BLD *bld = NULL; 1149 OSSL_PARAM *params = NULL; 1150 BIGNUM *n = NULL; 1151 BIGNUM *e = NULL; 1152 int testresult = 0; 1153 1154 /* Borrow a real modulus; only the exponent is degenerate. */ 1155 if (!TEST_ptr(rsakey = load_example_rsa_key()) 1156 || !TEST_true(EVP_PKEY_get_bn_param(rsakey, OSSL_PKEY_PARAM_RSA_N, &n))) 1157 goto err; 1158 1159 if (!TEST_ptr(e = BN_new()) 1160 || !TEST_true(BN_set_word(e, (BN_ULONG)idx))) /* idx is 0 or 1 */ 1161 goto err; 1162 1163 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1164 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n)) 1165 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e)) 1166 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) 1167 goto err; 1168 1169 if (!TEST_ptr(genctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL)) 1170 || !TEST_int_gt(EVP_PKEY_fromdata_init(genctx), 0) 1171 || !TEST_int_gt(EVP_PKEY_fromdata(genctx, &pubkey, EVP_PKEY_PUBLIC_KEY, 1172 params), 1173 0)) 1174 goto err; 1175 1176 ERR_clear_error(); 1177 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pubkey, NULL)) 1178 || !TEST_int_eq(EVP_PKEY_encapsulate_init(ctx, NULL), 0) 1179 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_INVALID_KEY)) 1180 goto err; 1181 1182 testresult = 1; 1183 err: 1184 EVP_PKEY_CTX_free(ctx); 1185 EVP_PKEY_CTX_free(genctx); 1186 EVP_PKEY_free(pubkey); 1187 EVP_PKEY_free(rsakey); 1188 OSSL_PARAM_free(params); 1189 OSSL_PARAM_BLD_free(bld); 1190 BN_free(e); 1191 BN_free(n); 1192 return testresult; 1193 } 1194 1195 /* 1196 * A ciphertext c in {0, 1, n - 1} is a fixed point or trivial case of RSADP, 1197 * so RSASVE recovery must reject it. idx selects the ciphertext: 0, 1, or 1198 * n - 1. The ciphertext length must equal the modulus length. 1199 */ 1200 static int test_rsasve_degenerate_ciphertext(int idx) 1201 { 1202 EVP_PKEY *rsakey = NULL; 1203 EVP_PKEY_CTX *ctx = NULL; 1204 BIGNUM *n = NULL; 1205 unsigned char *ct = NULL; 1206 unsigned char *secret = NULL; 1207 size_t ctlen = 0; 1208 size_t secretlen = 0; 1209 int expected_reason = 0; 1210 int testresult = 0; 1211 1212 if (!TEST_ptr(rsakey = load_example_rsa_key()) 1213 || !TEST_true(EVP_PKEY_get_bn_param(rsakey, OSSL_PKEY_PARAM_RSA_N, &n))) 1214 goto err; 1215 1216 ctlen = secretlen = (size_t)EVP_PKEY_get_size(rsakey); 1217 if (!TEST_ptr(ct = OPENSSL_zalloc(ctlen)) 1218 || !TEST_ptr(secret = OPENSSL_malloc(secretlen))) 1219 goto err; 1220 1221 switch (idx) { 1222 case 0: /* c = 0 */ 1223 expected_reason = RSA_R_DATA_TOO_SMALL; 1224 break; 1225 case 1: /* c = 1 */ 1226 ct[ctlen - 1] = 1; 1227 expected_reason = RSA_R_DATA_TOO_SMALL; 1228 break; 1229 case 2: /* c = n - 1 */ 1230 if (!TEST_true(BN_sub_word(n, 1)) 1231 || !TEST_int_eq(BN_bn2binpad(n, ct, (int)ctlen), (int)ctlen)) 1232 goto err; 1233 expected_reason = RSA_R_DATA_TOO_LARGE_FOR_MODULUS; 1234 break; 1235 default: 1236 goto err; 1237 } 1238 1239 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, rsakey, NULL)) 1240 || !TEST_int_eq(EVP_PKEY_decapsulate_init(ctx, NULL), 1) 1241 || !TEST_int_eq(EVP_PKEY_CTX_set_kem_op(ctx, "RSASVE"), 1)) 1242 goto err; 1243 1244 ERR_clear_error(); 1245 if (!TEST_int_eq(EVP_PKEY_decapsulate(ctx, secret, &secretlen, ct, ctlen), 0) 1246 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), expected_reason)) 1247 goto err; 1248 1249 testresult = 1; 1250 err: 1251 OPENSSL_free(secret); 1252 OPENSSL_free(ct); 1253 EVP_PKEY_CTX_free(ctx); 1254 EVP_PKEY_free(rsakey); 1255 BN_free(n); 1256 return testresult; 1257 } 1258 1259 /* 1260 * Test combinations of private, public, missing and private + public key 1261 * params to ensure they are all accepted 1262 */ 1263 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA) 1264 static int test_EVP_PKEY_ffc_priv_pub(char *keytype) 1265 { 1266 OSSL_PARAM_BLD *bld = NULL; 1267 OSSL_PARAM *params = NULL; 1268 EVP_PKEY *just_params = NULL; 1269 EVP_PKEY *params_and_priv = NULL; 1270 EVP_PKEY *params_and_pub = NULL; 1271 EVP_PKEY *params_and_keypair = NULL; 1272 BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL; 1273 int ret = 0; 1274 1275 /* 1276 * Setup the parameters for our pkey object. For our purposes they don't 1277 * have to actually be *valid* parameters. We just need to set something. 1278 */ 1279 if (!TEST_ptr(p = BN_new()) 1280 || !TEST_ptr(q = BN_new()) 1281 || !TEST_ptr(g = BN_new()) 1282 || !TEST_ptr(pub = BN_new()) 1283 || !TEST_ptr(priv = BN_new())) 1284 goto err; 1285 1286 /* Test !priv and !pub */ 1287 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1288 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 1289 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) 1290 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))) 1291 goto err; 1292 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1293 || !TEST_ptr(just_params = make_key_fromdata(keytype, params))) 1294 goto err; 1295 1296 OSSL_PARAM_free(params); 1297 OSSL_PARAM_BLD_free(bld); 1298 params = NULL; 1299 bld = NULL; 1300 1301 if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) 1302 || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR)) 1303 goto err; 1304 1305 /* Test priv and !pub */ 1306 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1307 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 1308 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) 1309 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 1310 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 1311 priv))) 1312 goto err; 1313 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1314 || !TEST_ptr(params_and_priv = make_key_fromdata(keytype, params))) 1315 goto err; 1316 1317 OSSL_PARAM_free(params); 1318 OSSL_PARAM_BLD_free(bld); 1319 params = NULL; 1320 bld = NULL; 1321 1322 if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PRIVATE_KEY) 1323 || test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)) 1324 goto err; 1325 1326 /* Test !priv and pub */ 1327 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1328 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 1329 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) 1330 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 1331 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, 1332 pub))) 1333 goto err; 1334 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1335 || !TEST_ptr(params_and_pub = make_key_fromdata(keytype, params))) 1336 goto err; 1337 1338 OSSL_PARAM_free(params); 1339 OSSL_PARAM_BLD_free(bld); 1340 params = NULL; 1341 bld = NULL; 1342 1343 if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY) 1344 || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY)) 1345 goto err; 1346 1347 /* Test priv and pub */ 1348 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1349 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 1350 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) 1351 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 1352 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, 1353 pub)) 1354 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 1355 priv))) 1356 goto err; 1357 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1358 || !TEST_ptr(params_and_keypair = make_key_fromdata(keytype, params))) 1359 goto err; 1360 1361 if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR)) 1362 goto err; 1363 1364 ret = 1; 1365 err: 1366 OSSL_PARAM_free(params); 1367 OSSL_PARAM_BLD_free(bld); 1368 EVP_PKEY_free(just_params); 1369 EVP_PKEY_free(params_and_priv); 1370 EVP_PKEY_free(params_and_pub); 1371 EVP_PKEY_free(params_and_keypair); 1372 BN_free(p); 1373 BN_free(q); 1374 BN_free(g); 1375 BN_free(pub); 1376 BN_free(priv); 1377 1378 return ret; 1379 } 1380 #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA */ 1381 1382 /* 1383 * Test combinations of private, public, missing and private + public key 1384 * params to ensure they are all accepted for EC keys 1385 */ 1386 #ifndef OPENSSL_NO_EC 1387 static unsigned char ec_priv[] = { 1388 0xe9, 0x25, 0xf7, 0x66, 0x58, 0xa4, 0xdd, 0x99, 0x61, 0xe7, 0xe8, 0x23, 1389 0x85, 0xc2, 0xe8, 0x33, 0x27, 0xc5, 0x5c, 0xeb, 0xdb, 0x43, 0x9f, 0xd5, 1390 0xf2, 0x5a, 0x75, 0x55, 0xd0, 0x2e, 0x6d, 0x16 1391 }; 1392 static unsigned char ec_pub[] = { 1393 0x04, 0xad, 0x11, 0x90, 0x77, 0x4b, 0x46, 0xee, 0x72, 0x51, 0x15, 0x97, 1394 0x4a, 0x6a, 0xa7, 0xaf, 0x59, 0xfa, 0x4b, 0xf2, 0x41, 0xc8, 0x3a, 0x81, 1395 0x23, 0xb6, 0x90, 0x04, 0x6c, 0x67, 0x66, 0xd0, 0xdc, 0xf2, 0x15, 0x1d, 1396 0x41, 0x61, 0xb7, 0x95, 0x85, 0x38, 0x5a, 0x84, 0x56, 0xe8, 0xb3, 0x0e, 1397 0xf5, 0xc6, 0x5d, 0xa4, 0x54, 0x26, 0xb0, 0xf7, 0xa5, 0x4a, 0x33, 0xf1, 1398 0x08, 0x09, 0xb8, 0xdb, 0x03 1399 }; 1400 1401 static int test_EC_priv_pub(void) 1402 { 1403 OSSL_PARAM_BLD *bld = NULL; 1404 OSSL_PARAM *params = NULL; 1405 EVP_PKEY *just_params = NULL; 1406 EVP_PKEY *params_and_priv = NULL; 1407 EVP_PKEY *params_and_pub = NULL; 1408 EVP_PKEY *params_and_keypair = NULL; 1409 BIGNUM *priv = NULL; 1410 int ret = 0; 1411 unsigned char *encoded = NULL; 1412 size_t len = 0; 1413 unsigned char buffer[128]; 1414 1415 /* 1416 * Setup the parameters for our pkey object. For our purposes they don't 1417 * have to actually be *valid* parameters. We just need to set something. 1418 */ 1419 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) 1420 goto err; 1421 1422 /* Test !priv and !pub */ 1423 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1424 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, 1425 OSSL_PKEY_PARAM_GROUP_NAME, 1426 "P-256", 0))) 1427 goto err; 1428 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1429 || !TEST_ptr(just_params = make_key_fromdata("EC", params))) 1430 goto err; 1431 1432 OSSL_PARAM_free(params); 1433 OSSL_PARAM_BLD_free(bld); 1434 params = NULL; 1435 bld = NULL; 1436 1437 if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) 1438 || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR)) 1439 goto err; 1440 1441 /* Test priv and !pub */ 1442 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1443 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, 1444 OSSL_PKEY_PARAM_GROUP_NAME, 1445 "P-256", 0)) 1446 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 1447 priv))) 1448 goto err; 1449 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1450 || !TEST_ptr(params_and_priv = make_key_fromdata("EC", params))) 1451 goto err; 1452 1453 OSSL_PARAM_free(params); 1454 OSSL_PARAM_BLD_free(bld); 1455 params = NULL; 1456 bld = NULL; 1457 1458 /* 1459 * We indicate only parameters here, in spite of having built a key that 1460 * has a private part, because the PEM_write_bio_PrivateKey_ex call is 1461 * expected to fail because it does not support exporting a private EC 1462 * key without a corresponding public key 1463 */ 1464 if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) 1465 || test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)) 1466 goto err; 1467 1468 /* Test !priv and pub */ 1469 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1470 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, 1471 OSSL_PKEY_PARAM_GROUP_NAME, 1472 "P-256", 0)) 1473 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, 1474 OSSL_PKEY_PARAM_PUB_KEY, 1475 ec_pub, sizeof(ec_pub)))) 1476 goto err; 1477 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1478 || !TEST_ptr(params_and_pub = make_key_fromdata("EC", params))) 1479 goto err; 1480 1481 OSSL_PARAM_free(params); 1482 OSSL_PARAM_BLD_free(bld); 1483 params = NULL; 1484 bld = NULL; 1485 1486 if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY) 1487 || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY)) 1488 goto err; 1489 1490 /* Test priv and pub */ 1491 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1492 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, 1493 OSSL_PKEY_PARAM_GROUP_NAME, 1494 "P-256", 0)) 1495 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, 1496 OSSL_PKEY_PARAM_PUB_KEY, 1497 ec_pub, sizeof(ec_pub))) 1498 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 1499 priv))) 1500 goto err; 1501 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1502 || !TEST_ptr(params_and_keypair = make_key_fromdata("EC", params))) 1503 goto err; 1504 1505 if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR)) 1506 goto err; 1507 1508 /* Try key equality */ 1509 if (!TEST_int_gt(EVP_PKEY_parameters_eq(just_params, just_params), 0) 1510 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_pub), 1511 0) 1512 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_priv), 1513 0) 1514 || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_keypair), 1515 0) 1516 || !TEST_int_gt(EVP_PKEY_eq(params_and_pub, params_and_pub), 0) 1517 || !TEST_int_gt(EVP_PKEY_eq(params_and_priv, params_and_priv), 0) 1518 || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_pub), 0) 1519 || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_priv), 0)) 1520 goto err; 1521 1522 /* Positive and negative testcase for EVP_PKEY_get1_encoded_public_key */ 1523 if (!TEST_int_gt(EVP_PKEY_get1_encoded_public_key(params_and_pub, &encoded), 0)) 1524 goto err; 1525 OPENSSL_free(encoded); 1526 encoded = NULL; 1527 if (!TEST_int_eq(EVP_PKEY_get1_encoded_public_key(just_params, &encoded), 0)) { 1528 OPENSSL_free(encoded); 1529 encoded = NULL; 1530 goto err; 1531 } 1532 1533 /* Positive and negative testcase for EVP_PKEY_get_octet_string_param */ 1534 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, 1535 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, 1536 buffer, sizeof(buffer), &len), 1537 1) 1538 || !TEST_int_eq(len, 65)) 1539 goto err; 1540 1541 len = 0; 1542 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, 1543 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, 1544 NULL, 0, &len), 1545 1) 1546 || !TEST_int_eq(len, 65)) 1547 goto err; 1548 1549 /* too-short buffer len*/ 1550 if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, 1551 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, 1552 buffer, 10, &len), 1553 0)) 1554 goto err; 1555 1556 ret = 1; 1557 err: 1558 OSSL_PARAM_free(params); 1559 OSSL_PARAM_BLD_free(bld); 1560 EVP_PKEY_free(just_params); 1561 EVP_PKEY_free(params_and_priv); 1562 EVP_PKEY_free(params_and_pub); 1563 EVP_PKEY_free(params_and_keypair); 1564 BN_free(priv); 1565 1566 return ret; 1567 } 1568 1569 /* Also test that we can read the EC PUB affine coordinates */ 1570 static int test_evp_get_ec_pub(void) 1571 { 1572 OSSL_PARAM_BLD *bld = NULL; 1573 OSSL_PARAM *params = NULL; 1574 unsigned char *pad = NULL; 1575 EVP_PKEY *keypair = NULL; 1576 BIGNUM *priv = NULL; 1577 BIGNUM *x = NULL; 1578 BIGNUM *y = NULL; 1579 int ret = 0; 1580 1581 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) 1582 goto err; 1583 1584 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 1585 || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, 1586 OSSL_PKEY_PARAM_GROUP_NAME, 1587 "P-256", 0)) 1588 || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, 1589 OSSL_PKEY_PARAM_PUB_KEY, 1590 ec_pub, sizeof(ec_pub))) 1591 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 1592 priv))) 1593 goto err; 1594 1595 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) 1596 || !TEST_ptr(keypair = make_key_fromdata("EC", params))) 1597 goto err; 1598 1599 if (!test_selection(keypair, EVP_PKEY_KEYPAIR)) 1600 goto err; 1601 1602 if (!EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_X, &x) 1603 || !EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_Y, &y)) 1604 goto err; 1605 1606 if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub)))) 1607 goto err; 1608 1609 pad[0] = ec_pub[0]; 1610 BN_bn2bin(x, &pad[1]); 1611 BN_bn2bin(y, &pad[33]); 1612 if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0)) 1613 goto err; 1614 1615 ret = 1; 1616 1617 err: 1618 OSSL_PARAM_free(params); 1619 OSSL_PARAM_BLD_free(bld); 1620 EVP_PKEY_free(keypair); 1621 OPENSSL_free(pad); 1622 BN_free(priv); 1623 BN_free(x); 1624 BN_free(y); 1625 return ret; 1626 } 1627 1628 /* Test that using a legacy EC key with only a private key in it works */ 1629 #ifndef OPENSSL_NO_DEPRECATED_3_0 1630 static int test_EC_priv_only_legacy(void) 1631 { 1632 BIGNUM *priv = NULL; 1633 int ret = 0; 1634 EC_KEY *eckey = NULL; 1635 EVP_PKEY *pkey = NULL, *dup_pk = NULL; 1636 EVP_MD_CTX *ctx = NULL; 1637 1638 /* Create the low level EC_KEY */ 1639 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) 1640 goto err; 1641 1642 eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); 1643 if (!TEST_ptr(eckey)) 1644 goto err; 1645 1646 if (!TEST_true(EC_KEY_set_private_key(eckey, priv))) 1647 goto err; 1648 1649 pkey = EVP_PKEY_new(); 1650 if (!TEST_ptr(pkey)) 1651 goto err; 1652 1653 if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey))) 1654 goto err; 1655 eckey = NULL; 1656 1657 for (;;) { 1658 ret = 0; 1659 ctx = EVP_MD_CTX_new(); 1660 if (!TEST_ptr(ctx)) 1661 goto err; 1662 1663 /* 1664 * The EVP_DigestSignInit function should create the key on the 1665 * provider side which is sufficient for this test. 1666 */ 1667 if (!TEST_true(EVP_DigestSignInit_ex(ctx, NULL, NULL, testctx, 1668 testpropq, pkey, NULL))) 1669 goto err; 1670 EVP_MD_CTX_free(ctx); 1671 ctx = NULL; 1672 1673 if (dup_pk != NULL) 1674 break; 1675 1676 if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey))) 1677 goto err; 1678 /* EVP_PKEY_eq() returns -2 with missing public keys */ 1679 ret = TEST_int_eq(EVP_PKEY_eq(pkey, dup_pk), -2); 1680 EVP_PKEY_free(pkey); 1681 pkey = dup_pk; 1682 if (!ret) 1683 goto err; 1684 } 1685 ret = 1; 1686 1687 err: 1688 EVP_MD_CTX_free(ctx); 1689 EVP_PKEY_free(pkey); 1690 EC_KEY_free(eckey); 1691 BN_free(priv); 1692 1693 return ret; 1694 } 1695 1696 static int test_evp_get_ec_pub_legacy(void) 1697 { 1698 OSSL_LIB_CTX *libctx = NULL; 1699 unsigned char *pad = NULL; 1700 EVP_PKEY *pkey = NULL; 1701 EC_KEY *eckey = NULL; 1702 BIGNUM *priv = NULL; 1703 BIGNUM *x = NULL; 1704 BIGNUM *y = NULL; 1705 int ret = 0; 1706 1707 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new())) 1708 goto err; 1709 1710 /* Create the legacy key */ 1711 if (!TEST_ptr(eckey = EC_KEY_new_by_curve_name_ex(libctx, NULL, 1712 NID_X9_62_prime256v1))) 1713 goto err; 1714 1715 if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) 1716 goto err; 1717 1718 if (!TEST_true(EC_KEY_set_private_key(eckey, priv))) 1719 goto err; 1720 1721 if (!TEST_ptr(x = BN_bin2bn(&ec_pub[1], 32, NULL))) 1722 goto err; 1723 1724 if (!TEST_ptr(y = BN_bin2bn(&ec_pub[33], 32, NULL))) 1725 goto err; 1726 1727 if (!TEST_true(EC_KEY_set_public_key_affine_coordinates(eckey, x, y))) 1728 goto err; 1729 1730 if (!TEST_ptr(pkey = EVP_PKEY_new())) 1731 goto err; 1732 1733 /* Transfer the legacy key */ 1734 if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey))) 1735 goto err; 1736 eckey = NULL; 1737 1738 if (!TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_X, &x)) 1739 || !TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_Y, &y))) 1740 goto err; 1741 1742 if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub)))) 1743 goto err; 1744 1745 pad[0] = ec_pub[0]; 1746 BN_bn2bin(x, &pad[1]); 1747 BN_bn2bin(y, &pad[33]); 1748 1749 if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0)) 1750 goto err; 1751 1752 ret = 1; 1753 1754 err: 1755 OSSL_LIB_CTX_free(libctx); 1756 EVP_PKEY_free(pkey); 1757 EC_KEY_free(eckey); 1758 OPENSSL_free(pad); 1759 BN_free(priv); 1760 BN_free(x); 1761 BN_free(y); 1762 1763 return ret; 1764 } 1765 #endif /* OPENSSL_NO_DEPRECATED_3_0 */ 1766 #endif /* OPENSSL_NO_EC */ 1767 1768 static int test_EVP_PKEY_sign(int tst) 1769 { 1770 int ret = 0; 1771 EVP_PKEY *pkey = NULL; 1772 unsigned char *sig = NULL; 1773 size_t sig_len = 0, shortsig_len = 1; 1774 EVP_PKEY_CTX *ctx = NULL; 1775 unsigned char tbs[] = { 1776 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 1777 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13 1778 }; 1779 1780 if (tst == 0) { 1781 if (!TEST_ptr(pkey = load_example_rsa_key())) 1782 goto out; 1783 } else if (tst == 1) { 1784 #ifndef OPENSSL_NO_DSA 1785 if (!TEST_ptr(pkey = load_example_dsa_key())) 1786 goto out; 1787 #else 1788 ret = 1; 1789 goto out; 1790 #endif 1791 } else { 1792 #ifndef OPENSSL_NO_EC 1793 if (!TEST_ptr(pkey = load_example_ec_key())) 1794 goto out; 1795 #else 1796 ret = 1; 1797 goto out; 1798 #endif 1799 } 1800 1801 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL); 1802 if (!TEST_ptr(ctx) 1803 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0) 1804 || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs, 1805 sizeof(tbs)), 1806 0)) 1807 goto out; 1808 sig = OPENSSL_malloc(sig_len); 1809 if (!TEST_ptr(sig) 1810 /* Test sending a signature buffer that is too short is rejected */ 1811 || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs, 1812 sizeof(tbs)), 1813 0) 1814 || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)), 1815 0) 1816 /* Test the signature round-trips */ 1817 || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0) 1818 || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)), 1819 0)) 1820 goto out; 1821 1822 ret = 1; 1823 out: 1824 EVP_PKEY_CTX_free(ctx); 1825 OPENSSL_free(sig); 1826 EVP_PKEY_free(pkey); 1827 return ret; 1828 } 1829 1830 #ifndef OPENSSL_NO_DEPRECATED_3_0 1831 static int test_EVP_PKEY_sign_with_app_method(int tst) 1832 { 1833 int ret = 0; 1834 EVP_PKEY *pkey = NULL; 1835 RSA *rsa = NULL; 1836 RSA_METHOD *rsa_meth = NULL; 1837 #ifndef OPENSSL_NO_DSA 1838 DSA *dsa = NULL; 1839 DSA_METHOD *dsa_meth = NULL; 1840 #endif 1841 unsigned char *sig = NULL; 1842 size_t sig_len = 0, shortsig_len = 1; 1843 EVP_PKEY_CTX *ctx = NULL; 1844 unsigned char tbs[] = { 1845 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 1846 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13 1847 }; 1848 1849 if (tst == 0) { 1850 if (!TEST_ptr(pkey = load_example_rsa_key())) 1851 goto out; 1852 if (!TEST_ptr(rsa_meth = RSA_meth_dup(RSA_get_default_method()))) 1853 goto out; 1854 1855 if (!TEST_ptr(rsa = EVP_PKEY_get1_RSA(pkey)) 1856 || !TEST_int_gt(RSA_set_method(rsa, rsa_meth), 0) 1857 || !TEST_int_gt(EVP_PKEY_assign_RSA(pkey, rsa), 0)) 1858 goto out; 1859 rsa = NULL; /* now owned by the pkey */ 1860 } else { 1861 #ifndef OPENSSL_NO_DSA 1862 if (!TEST_ptr(pkey = load_example_dsa_key())) 1863 goto out; 1864 if (!TEST_ptr(dsa_meth = DSA_meth_dup(DSA_get_default_method()))) 1865 goto out; 1866 1867 if (!TEST_ptr(dsa = EVP_PKEY_get1_DSA(pkey)) 1868 || !TEST_int_gt(DSA_set_method(dsa, dsa_meth), 0) 1869 || !TEST_int_gt(EVP_PKEY_assign_DSA(pkey, dsa), 0)) 1870 goto out; 1871 dsa = NULL; /* now owned by the pkey */ 1872 #else 1873 ret = 1; 1874 goto out; 1875 #endif 1876 } 1877 1878 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL); 1879 if (!TEST_ptr(ctx) 1880 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0) 1881 || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs, 1882 sizeof(tbs)), 1883 0)) 1884 goto out; 1885 sig = OPENSSL_malloc(sig_len); 1886 if (!TEST_ptr(sig) 1887 /* Test sending a signature buffer that is too short is rejected */ 1888 || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs, 1889 sizeof(tbs)), 1890 0) 1891 || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)), 1892 0) 1893 /* Test the signature round-trips */ 1894 || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0) 1895 || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)), 1896 0)) 1897 goto out; 1898 1899 ret = 1; 1900 out: 1901 EVP_PKEY_CTX_free(ctx); 1902 OPENSSL_free(sig); 1903 EVP_PKEY_free(pkey); 1904 RSA_free(rsa); 1905 RSA_meth_free(rsa_meth); 1906 #ifndef OPENSSL_NO_DSA 1907 DSA_free(dsa); 1908 DSA_meth_free(dsa_meth); 1909 #endif 1910 return ret; 1911 } 1912 #endif /* !OPENSSL_NO_DEPRECATED_3_0 */ 1913 1914 /* 1915 * n = 0 => test using legacy cipher 1916 * n = 1 => test using fetched cipher 1917 */ 1918 static int test_EVP_Enveloped(int n) 1919 { 1920 int ret = 0; 1921 EVP_CIPHER_CTX *ctx = NULL; 1922 EVP_PKEY *keypair = NULL; 1923 unsigned char *kek = NULL; 1924 unsigned char iv[EVP_MAX_IV_LENGTH]; 1925 static const unsigned char msg[] = { 1, 2, 3, 4, 5, 6, 7, 8 }; 1926 int len, kek_len, ciphertext_len, plaintext_len; 1927 unsigned char ciphertext[32], plaintext[16]; 1928 EVP_CIPHER *type = NULL; 1929 1930 if (nullprov != NULL) 1931 return TEST_skip("Test does not support a non-default library context"); 1932 1933 if (n == 0) 1934 type = (EVP_CIPHER *)EVP_aes_256_cbc(); 1935 else if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "AES-256-CBC", 1936 testpropq))) 1937 goto err; 1938 1939 if (!TEST_ptr(keypair = load_example_rsa_key()) 1940 || !TEST_ptr(kek = OPENSSL_zalloc(EVP_PKEY_get_size(keypair))) 1941 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 1942 || !TEST_true(EVP_SealInit(ctx, type, &kek, &kek_len, iv, 1943 &keypair, 1)) 1944 || !TEST_true(EVP_SealUpdate(ctx, ciphertext, &ciphertext_len, 1945 msg, sizeof(msg))) 1946 || !TEST_true(EVP_SealFinal(ctx, ciphertext + ciphertext_len, 1947 &len))) 1948 goto err; 1949 1950 ciphertext_len += len; 1951 1952 if (!TEST_true(EVP_OpenInit(ctx, type, kek, kek_len, iv, keypair)) 1953 || !TEST_true(EVP_OpenUpdate(ctx, plaintext, &plaintext_len, 1954 ciphertext, ciphertext_len)) 1955 || !TEST_true(EVP_OpenFinal(ctx, plaintext + plaintext_len, &len))) 1956 goto err; 1957 1958 plaintext_len += len; 1959 if (!TEST_mem_eq(msg, sizeof(msg), plaintext, plaintext_len)) 1960 goto err; 1961 1962 ret = 1; 1963 err: 1964 if (n != 0) 1965 EVP_CIPHER_free(type); 1966 OPENSSL_free(kek); 1967 EVP_PKEY_free(keypair); 1968 EVP_CIPHER_CTX_free(ctx); 1969 return ret; 1970 } 1971 1972 /* 1973 * Test 0: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, RSA) 1974 * Test 1: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, DSA) 1975 * Test 2: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, HMAC) 1976 * Test 3: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, RSA) 1977 * Test 4: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, DSA) 1978 * Test 5: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch diegst, HMAC) 1979 * Test 6: Use an MD BIO to do the Update calls instead (RSA) 1980 * Test 7: Use an MD BIO to do the Update calls instead (DSA) 1981 * Test 8: Use an MD BIO to do the Update calls instead (HMAC) 1982 * Test 9: Use EVP_DigestSign (Implicit fetch digest, RSA, short sig) 1983 * Test 10: Use EVP_DigestSign (Implicit fetch digest, DSA, short sig) 1984 * Test 11: Use EVP_DigestSign (Implicit fetch digest, HMAC, short sig) 1985 * Test 12: Use EVP_DigestSign (Implicit fetch digest, RSA) 1986 * Test 13: Use EVP_DigestSign (Implicit fetch digest, DSA) 1987 * Test 14: Use EVP_DigestSign (Implicit fetch digest, HMAC) 1988 * Test 15-29: Same as above with reinitialization 1989 */ 1990 static int test_EVP_DigestSignInit(int tst) 1991 { 1992 int ret = 0; 1993 EVP_PKEY *pkey = NULL; 1994 unsigned char *sig = NULL, *sig2 = NULL; 1995 size_t sig_len = 0, sig2_len = 0, shortsig_len = 1; 1996 EVP_MD_CTX *md_ctx = NULL, *md_ctx_verify = NULL; 1997 EVP_MD_CTX *a_md_ctx = NULL, *a_md_ctx_verify = NULL; 1998 BIO *mdbio = NULL, *membio = NULL; 1999 size_t written; 2000 const EVP_MD *md; 2001 EVP_MD *mdexp = NULL; 2002 int reinit = 0; 2003 2004 if (nullprov != NULL) 2005 return TEST_skip("Test does not support a non-default library context"); 2006 2007 if (tst >= 15) { 2008 reinit = 1; 2009 tst -= 15; 2010 } 2011 2012 if (tst >= 6 && tst <= 8) { 2013 membio = BIO_new(BIO_s_mem()); 2014 mdbio = BIO_new(BIO_f_md()); 2015 if (!TEST_ptr(membio) || !TEST_ptr(mdbio)) 2016 goto out; 2017 BIO_push(mdbio, membio); 2018 if (!TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx), 0)) 2019 goto out; 2020 } else { 2021 if (!TEST_ptr(a_md_ctx = md_ctx = EVP_MD_CTX_new()) 2022 || !TEST_ptr(a_md_ctx_verify = md_ctx_verify = EVP_MD_CTX_new())) 2023 goto out; 2024 } 2025 2026 if (tst % 3 == 0) { 2027 if (!TEST_ptr(pkey = load_example_rsa_key())) 2028 goto out; 2029 } else if (tst % 3 == 1) { 2030 #ifndef OPENSSL_NO_DSA 2031 if (!TEST_ptr(pkey = load_example_dsa_key())) 2032 goto out; 2033 #else 2034 ret = 1; 2035 goto out; 2036 #endif 2037 } else { 2038 if (!TEST_ptr(pkey = load_example_hmac_key())) 2039 goto out; 2040 } 2041 2042 if (tst >= 3 && tst <= 5) 2043 md = mdexp = EVP_MD_fetch(NULL, "SHA256", NULL); 2044 else 2045 md = EVP_sha256(); 2046 2047 if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, md, NULL, pkey))) 2048 goto out; 2049 2050 if (reinit && !TEST_true(EVP_DigestSignInit(md_ctx, NULL, NULL, NULL, NULL))) 2051 goto out; 2052 2053 if (tst >= 6 && tst <= 8) { 2054 if (!BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written)) 2055 goto out; 2056 } else if (tst < 6) { 2057 if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg)))) 2058 goto out; 2059 } 2060 2061 if (tst >= 9) { 2062 /* Determine the size of the signature. */ 2063 if (!TEST_true(EVP_DigestSign(md_ctx, NULL, &sig_len, kMsg, 2064 sizeof(kMsg))) 2065 || !TEST_ptr(sig = OPENSSL_malloc(sig_len))) 2066 goto out; 2067 if (tst <= 11) { 2068 /* Test that supply a short sig buffer fails */ 2069 if (!TEST_false(EVP_DigestSign(md_ctx, sig, &shortsig_len, kMsg, 2070 sizeof(kMsg)))) 2071 goto out; 2072 /* 2073 * We end here because once EVP_DigestSign() has failed you should 2074 * not call it again without re-initing the ctx 2075 */ 2076 ret = 1; 2077 goto out; 2078 } 2079 if (!TEST_true(EVP_DigestSign(md_ctx, sig, &sig_len, kMsg, 2080 sizeof(kMsg)))) 2081 goto out; 2082 } else { 2083 /* Determine the size of the signature. */ 2084 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len)) 2085 || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) 2086 /* 2087 * Trying to create a signature with a deliberately short 2088 * buffer should fail. 2089 */ 2090 || !TEST_false(EVP_DigestSignFinal(md_ctx, sig, &shortsig_len)) 2091 || !TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len))) 2092 goto out; 2093 } 2094 2095 /* 2096 * Ensure that the signature round-trips (Verification isn't supported for 2097 * HMAC via EVP_DigestVerify*) 2098 */ 2099 if (tst % 3 != 2) { 2100 if (tst >= 6 && tst <= 8) { 2101 if (!TEST_int_gt(BIO_reset(mdbio), 0) 2102 || !TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx_verify), 0)) 2103 goto out; 2104 } 2105 2106 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, md, 2107 NULL, pkey))) 2108 goto out; 2109 2110 if (tst >= 6 && tst <= 8) { 2111 if (!TEST_true(BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written))) 2112 goto out; 2113 } else { 2114 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, 2115 sizeof(kMsg)))) 2116 goto out; 2117 } 2118 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) 2119 goto out; 2120 2121 /* Multiple calls to EVP_DigestVerifyFinal should work */ 2122 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) 2123 goto out; 2124 } else { 2125 /* 2126 * For HMAC a doubled call to DigestSignFinal should produce the same 2127 * value as finalization should not happen. 2128 */ 2129 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig2_len)) 2130 || !TEST_ptr(sig2 = OPENSSL_malloc(sig2_len)) 2131 || !TEST_true(EVP_DigestSignFinal(md_ctx, sig2, &sig2_len))) 2132 goto out; 2133 2134 if (!TEST_mem_eq(sig, sig_len, sig2, sig2_len)) 2135 goto out; 2136 } 2137 2138 ret = 1; 2139 2140 out: 2141 BIO_free(membio); 2142 BIO_free(mdbio); 2143 EVP_MD_CTX_free(a_md_ctx); 2144 EVP_MD_CTX_free(a_md_ctx_verify); 2145 EVP_PKEY_free(pkey); 2146 OPENSSL_free(sig); 2147 OPENSSL_free(sig2); 2148 EVP_MD_free(mdexp); 2149 2150 return ret; 2151 } 2152 2153 static int test_EVP_DigestVerifyInit(void) 2154 { 2155 int ret = 0; 2156 EVP_PKEY *pkey = NULL; 2157 EVP_MD_CTX *md_ctx = NULL; 2158 2159 if (nullprov != NULL) 2160 return TEST_skip("Test does not support a non-default library context"); 2161 2162 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new()) 2163 || !TEST_ptr(pkey = load_example_rsa_key())) 2164 goto out; 2165 2166 if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, EVP_sha256(), NULL, pkey)) 2167 || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg))) 2168 || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature, 2169 sizeof(kSignature)), 2170 0)) 2171 goto out; 2172 2173 /* test with reinitialization */ 2174 if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, NULL, NULL, NULL)) 2175 || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg))) 2176 || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature, 2177 sizeof(kSignature)), 2178 0)) 2179 goto out; 2180 ret = 1; 2181 2182 out: 2183 EVP_MD_CTX_free(md_ctx); 2184 EVP_PKEY_free(pkey); 2185 return ret; 2186 } 2187 2188 #ifndef OPENSSL_NO_EC 2189 static int test_ecdsa_digestsign_keccak(void) 2190 { 2191 int ret = 0; 2192 EVP_PKEY *pkey = NULL; 2193 EVP_MD_CTX *ctx = NULL; 2194 EVP_MD *md = NULL; 2195 2196 if (nullprov != NULL) 2197 return TEST_skip("Test does not support a non-default library context"); 2198 2199 pkey = load_example_ec_key(); 2200 if (!TEST_ptr(pkey)) 2201 goto err; 2202 2203 /* This would not work with FIPS provider so just use NULL libctx */ 2204 md = EVP_MD_fetch(NULL, "KECCAK-256", NULL); 2205 if (!TEST_ptr(md)) 2206 goto err; 2207 2208 ctx = EVP_MD_CTX_new(); 2209 if (!TEST_ptr(ctx)) 2210 goto err; 2211 2212 /* 2213 * Just check EVP_DigestSignInit_ex() works. 2214 */ 2215 if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey))) 2216 goto err; 2217 2218 ret = 1; 2219 err: 2220 EVP_MD_CTX_free(ctx); 2221 EVP_PKEY_free(pkey); 2222 EVP_MD_free(md); 2223 2224 return ret; 2225 } 2226 #endif 2227 2228 #ifndef OPENSSL_NO_SIPHASH 2229 /* test SIPHASH MAC via EVP_PKEY with non-default parameters and reinit */ 2230 static int test_siphash_digestsign(void) 2231 { 2232 unsigned char key[16]; 2233 unsigned char buf[8], digest[8]; 2234 unsigned char expected[8] = { 2235 0x6d, 0x3e, 0x54, 0xc2, 0x2f, 0xf1, 0xfe, 0xe2 2236 }; 2237 EVP_PKEY *pkey = NULL; 2238 EVP_MD_CTX *mdctx = NULL; 2239 EVP_PKEY_CTX *ctx = NULL; 2240 int ret = 0; 2241 size_t len = 8; 2242 2243 if (nullprov != NULL) 2244 return TEST_skip("Test does not support a non-default library context"); 2245 2246 memset(buf, 0, 8); 2247 memset(key, 1, 16); 2248 if (!TEST_ptr(pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_SIPHASH, NULL, 2249 key, 16))) 2250 goto out; 2251 2252 if (!TEST_ptr(mdctx = EVP_MD_CTX_create())) 2253 goto out; 2254 2255 if (!TEST_true(EVP_DigestSignInit(mdctx, &ctx, NULL, NULL, pkey))) 2256 goto out; 2257 if (!TEST_int_eq(EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_SIGNCTX, 2258 EVP_PKEY_CTRL_SET_DIGEST_SIZE, 2259 8, NULL), 2260 1)) 2261 goto out; 2262 /* reinitialize */ 2263 if (!TEST_true(EVP_DigestSignInit(mdctx, NULL, NULL, NULL, NULL))) 2264 goto out; 2265 if (!TEST_true(EVP_DigestSignUpdate(mdctx, buf, 8))) 2266 goto out; 2267 if (!TEST_true(EVP_DigestSignFinal(mdctx, digest, &len))) 2268 goto out; 2269 if (!TEST_mem_eq(digest, len, expected, sizeof(expected))) 2270 goto out; 2271 2272 ret = 1; 2273 out: 2274 EVP_PKEY_free(pkey); 2275 EVP_MD_CTX_free(mdctx); 2276 return ret; 2277 } 2278 #endif 2279 2280 /* 2281 * Test corner cases of EVP_DigestInit/Update/Final API call behavior. 2282 */ 2283 static int test_EVP_Digest(void) 2284 { 2285 int ret = 0; 2286 EVP_MD_CTX *md_ctx = NULL; 2287 unsigned char md[EVP_MAX_MD_SIZE]; 2288 EVP_MD *sha256 = NULL; 2289 EVP_MD *shake256 = NULL; 2290 2291 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new())) 2292 goto out; 2293 2294 if (!TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", testpropq)) 2295 || !TEST_ptr(shake256 = EVP_MD_fetch(testctx, "shake256", testpropq))) 2296 goto out; 2297 2298 if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL)) 2299 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) 2300 || !TEST_true(EVP_DigestFinal(md_ctx, md, NULL)) 2301 /* EVP_DigestFinal resets the EVP_MD_CTX. */ 2302 || !TEST_ptr_eq(EVP_MD_CTX_get0_md(md_ctx), NULL)) 2303 goto out; 2304 2305 if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL)) 2306 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) 2307 || !TEST_true(EVP_DigestFinal_ex(md_ctx, md, NULL)) 2308 /* EVP_DigestFinal_ex does not reset the EVP_MD_CTX. */ 2309 || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx)) 2310 /* 2311 * EVP_DigestInit_ex with NULL type should work on 2312 * pre-initialized context. 2313 */ 2314 || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL))) 2315 goto out; 2316 2317 if (!TEST_true(EVP_DigestInit_ex(md_ctx, shake256, NULL)) 2318 || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) 2319 || !TEST_true(EVP_DigestFinalXOF(md_ctx, md, sizeof(md))) 2320 /* EVP_DigestFinalXOF does not reset the EVP_MD_CTX. */ 2321 || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx)) 2322 || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL))) 2323 goto out; 2324 ret = 1; 2325 2326 out: 2327 EVP_MD_CTX_free(md_ctx); 2328 EVP_MD_free(sha256); 2329 EVP_MD_free(shake256); 2330 return ret; 2331 } 2332 2333 static int test_EVP_md_null(void) 2334 { 2335 int ret = 0; 2336 EVP_MD_CTX *md_ctx = NULL; 2337 const EVP_MD *md_null = EVP_md_null(); 2338 unsigned char md_value[EVP_MAX_MD_SIZE]; 2339 unsigned int md_len = sizeof(md_value); 2340 2341 if (nullprov != NULL) 2342 return TEST_skip("Test does not support a non-default library context"); 2343 2344 if (!TEST_ptr(md_null) 2345 || !TEST_ptr(md_ctx = EVP_MD_CTX_new())) 2346 goto out; 2347 2348 if (!TEST_true(EVP_DigestInit_ex(md_ctx, md_null, NULL)) 2349 || !TEST_true(EVP_DigestUpdate(md_ctx, "test", 4)) 2350 || !TEST_true(EVP_DigestFinal_ex(md_ctx, md_value, &md_len))) 2351 goto out; 2352 2353 if (!TEST_uint_eq(md_len, 0)) 2354 goto out; 2355 2356 ret = 1; 2357 out: 2358 EVP_MD_CTX_free(md_ctx); 2359 return ret; 2360 } 2361 2362 #ifndef OPENSSL_NO_POLY1305 2363 /* Test Poly1305 no-key failures and staged key initialization */ 2364 static int test_evp_mac_poly1305_no_key(void) 2365 { 2366 int ret = 0; 2367 EVP_MAC *mac = NULL; 2368 EVP_MAC_CTX *ctx = NULL; 2369 /* RFC 7539 Poly1305 test vector. */ 2370 static const unsigned char staged_data[] = "Cryptographic Forum Research Group"; 2371 static const unsigned char expected[16] = { 2372 0xa8, 0x06, 0x1d, 0xc1, 0x30, 0x51, 0x36, 0xc6, 2373 0xc2, 0x2b, 0x8b, 0xaf, 0x0c, 0x01, 0x27, 0xa9 2374 }; 2375 unsigned char no_key_data[16] = { 0 }; 2376 unsigned char key[32] = { 2377 0x85, 0xd6, 0xbe, 0x78, 0x57, 0x55, 0x6d, 0x33, 2378 0x7f, 0x44, 0x52, 0xfe, 0x42, 0xd5, 0x06, 0xa8, 2379 0x01, 0x03, 0x80, 0x8a, 0xfb, 0x0d, 0xb2, 0xfd, 2380 0x4a, 0xbf, 0xf6, 0xaf, 0x41, 0x49, 0xf5, 0x1b 2381 }; 2382 unsigned char out[16]; 2383 OSSL_PARAM key_params[2]; 2384 OSSL_PARAM null_key_params[2]; 2385 size_t outl = 0; 2386 2387 key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, 2388 key, sizeof(key)); 2389 key_params[1] = OSSL_PARAM_construct_end(); 2390 null_key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, 2391 NULL, sizeof(key)); 2392 null_key_params[1] = OSSL_PARAM_construct_end(); 2393 2394 if (!TEST_ptr(mac = EVP_MAC_fetch(testctx, "Poly1305", testpropq)) 2395 || !TEST_ptr(ctx = EVP_MAC_CTX_new(mac)) 2396 || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1)) 2397 goto err; 2398 2399 ERR_clear_error(); 2400 if (!TEST_int_eq(EVP_MAC_update(ctx, no_key_data, sizeof(no_key_data)), 0) 2401 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET)) 2402 goto err; 2403 2404 /* The failed update must not block staged key initialization. */ 2405 if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, key_params), 1) 2406 || !TEST_int_eq(EVP_MAC_update(ctx, staged_data, 2407 sizeof(staged_data) - 1), 2408 1) 2409 || !TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 1) 2410 || !TEST_size_t_eq(outl, sizeof(expected)) 2411 || !TEST_mem_eq(out, outl, expected, sizeof(expected))) 2412 goto err; 2413 2414 EVP_MAC_CTX_free(ctx); 2415 ctx = NULL; 2416 2417 if (!TEST_ptr(ctx = EVP_MAC_CTX_new(mac)) 2418 || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1)) 2419 goto err; 2420 2421 ERR_clear_error(); 2422 if (!TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 0) 2423 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET)) 2424 goto err; 2425 2426 ERR_clear_error(); 2427 if (!TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, null_key_params), 0) 2428 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), 2429 PROV_R_INVALID_KEY_LENGTH)) 2430 goto err; 2431 2432 ERR_clear_error(); 2433 if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, null_key_params), 0) 2434 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), 2435 PROV_R_INVALID_KEY_LENGTH)) 2436 goto err; 2437 2438 EVP_MAC_CTX_free(ctx); 2439 ctx = NULL; 2440 ret = 1; 2441 err: 2442 EVP_MAC_CTX_free(ctx); 2443 EVP_MAC_free(mac); 2444 return ret; 2445 } 2446 #endif 2447 2448 static int test_d2i_AutoPrivateKey(int i) 2449 { 2450 int ret = 0; 2451 const unsigned char *p; 2452 EVP_PKEY *pkey = NULL; 2453 const APK_DATA *ak = &keydata[i]; 2454 const unsigned char *input = ak->kder; 2455 size_t input_len = ak->size; 2456 int expected_id = ak->evptype; 2457 2458 p = input; 2459 if (!TEST_ptr(pkey = d2i_AutoPrivateKey(NULL, &p, input_len)) 2460 || !TEST_ptr_eq(p, input + input_len) 2461 || !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id)) 2462 goto done; 2463 2464 ret = 1; 2465 2466 done: 2467 EVP_PKEY_free(pkey); 2468 return ret; 2469 } 2470 2471 #ifndef OPENSSL_NO_EC 2472 2473 static const unsigned char ec_public_sect163k1_validxy[] = { 2474 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 2475 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 2476 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 2477 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x02, 0xd1, 0x7b, 2478 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 2479 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f 2480 }; 2481 2482 static const unsigned char ec_public_sect163k1_badx[] = { 2483 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 2484 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 2485 0x0a, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 2486 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0xb0, 0x02, 0xd1, 0x7b, 2487 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 2488 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f 2489 }; 2490 2491 static const unsigned char ec_public_sect163k1_bady[] = { 2492 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 2493 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 2494 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 2495 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x0a, 0xd1, 0x7b, 2496 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 2497 0x6a, 0xd8, 0x17, 0x65, 0x41, 0xe6 2498 }; 2499 2500 static struct ec_der_pub_keys_st { 2501 const unsigned char *der; 2502 size_t len; 2503 int valid; 2504 } ec_der_pub_keys[] = { 2505 { ec_public_sect163k1_validxy, sizeof(ec_public_sect163k1_validxy), 1 }, 2506 { ec_public_sect163k1_badx, sizeof(ec_public_sect163k1_badx), 0 }, 2507 { ec_public_sect163k1_bady, sizeof(ec_public_sect163k1_bady), 0 }, 2508 }; 2509 2510 /* 2511 * Tests the range of the decoded EC char2 public point. 2512 * See ec_GF2m_simple_oct2point(). 2513 */ 2514 static int test_invalide_ec_char2_pub_range_decode(int id) 2515 { 2516 int ret = 0; 2517 EVP_PKEY *pkey; 2518 2519 pkey = load_example_key("EC", ec_der_pub_keys[id].der, 2520 ec_der_pub_keys[id].len); 2521 2522 ret = (ec_der_pub_keys[id].valid && TEST_ptr(pkey)) 2523 || TEST_ptr_null(pkey); 2524 EVP_PKEY_free(pkey); 2525 return ret; 2526 } 2527 2528 static int test_EVP_PKCS82PKEY(void) 2529 { 2530 int ret = 0; 2531 const unsigned char *derp = kExampleBadECKeyDER; 2532 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 2533 EVP_PKEY *pkey = NULL; 2534 2535 if (!TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &derp, 2536 sizeof(kExampleBadECKeyDER)))) 2537 goto done; 2538 2539 if (!TEST_ptr_eq(derp, 2540 kExampleBadECKeyDER + sizeof(kExampleBadECKeyDER))) 2541 goto done; 2542 2543 if (!TEST_ptr_null(pkey = EVP_PKCS82PKEY(p8inf))) 2544 goto done; 2545 2546 ret = 1; 2547 2548 done: 2549 PKCS8_PRIV_KEY_INFO_free(p8inf); 2550 EVP_PKEY_free(pkey); 2551 2552 return ret; 2553 } 2554 2555 #endif 2556 2557 static int test_EVP_PKCS82PKEY_v2(int i) 2558 { 2559 int ret = 0; 2560 const unsigned char *p; 2561 const APK_DATA *ak = &keydata_v2[i]; 2562 const unsigned char *input = ak->kder; 2563 size_t input_len = ak->size; 2564 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 2565 2566 /* Can we parse PKCS#8 v2, ignoring the public key for now? */ 2567 p = input; 2568 p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, input_len); 2569 if (!TEST_ptr(p8inf) 2570 || !TEST_true(p == input + input_len)) 2571 goto done; 2572 2573 ret = 1; 2574 done: 2575 PKCS8_PRIV_KEY_INFO_free(p8inf); 2576 return ret; 2577 } 2578 2579 /* Tests loading a bad key in PKCS8 format */ 2580 static int test_EVP_PKCS82PKEY_wrong_tag(void) 2581 { 2582 EVP_PKEY *pkey = NULL; 2583 EVP_PKEY *pkey2 = NULL; 2584 BIO *membio = NULL; 2585 char *membuf = NULL; 2586 PKCS8_PRIV_KEY_INFO *p8inf = NULL; 2587 int ok = 0; 2588 2589 if (testctx != NULL) 2590 /* test not supported with non-default context */ 2591 return 1; 2592 2593 if (!TEST_ptr(membio = BIO_new(BIO_s_mem())) 2594 || !TEST_ptr(pkey = load_example_rsa_key()) 2595 || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL, 2596 NULL, 0, NULL, NULL), 2597 0) 2598 || !TEST_int_gt(BIO_get_mem_data(membio, &membuf), 0) 2599 || !TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(membio, NULL)) 2600 || !TEST_ptr(pkey2 = EVP_PKCS82PKEY(p8inf)) 2601 || !TEST_int_eq(ERR_peek_last_error(), 0)) { 2602 goto done; 2603 } 2604 2605 ok = 1; 2606 done: 2607 EVP_PKEY_free(pkey); 2608 EVP_PKEY_free(pkey2); 2609 PKCS8_PRIV_KEY_INFO_free(p8inf); 2610 BIO_free_all(membio); 2611 return ok; 2612 } 2613 2614 /* This uses kExampleRSAKeyDER and kExampleRSAKeyPKCS8 to verify encoding */ 2615 static int test_privatekey_to_pkcs8(void) 2616 { 2617 EVP_PKEY *pkey = NULL; 2618 BIO *membio = NULL; 2619 char *membuf = NULL; 2620 long membuf_len = 0; 2621 int ok = 0; 2622 2623 if (!TEST_ptr(membio = BIO_new(BIO_s_mem())) 2624 || !TEST_ptr(pkey = load_example_rsa_key()) 2625 || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL, 2626 NULL, 0, NULL, NULL), 2627 0) 2628 || !TEST_int_gt(membuf_len = BIO_get_mem_data(membio, &membuf), 0) 2629 || !TEST_ptr(membuf) 2630 || !TEST_mem_eq(membuf, (size_t)membuf_len, 2631 kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8)) 2632 /* 2633 * We try to write PEM as well, just to see that it doesn't err, but 2634 * assume that the result is correct. 2635 */ 2636 || !TEST_int_gt(PEM_write_bio_PKCS8PrivateKey(membio, pkey, NULL, 2637 NULL, 0, NULL, NULL), 2638 0)) 2639 goto done; 2640 2641 ok = 1; 2642 done: 2643 EVP_PKEY_free(pkey); 2644 BIO_free_all(membio); 2645 return ok; 2646 } 2647 2648 #ifndef OPENSSL_NO_EC 2649 static const struct { 2650 int encoding; 2651 const char *encoding_name; 2652 } ec_encodings[] = { 2653 { OPENSSL_EC_EXPLICIT_CURVE, OSSL_PKEY_EC_ENCODING_EXPLICIT }, 2654 { OPENSSL_EC_NAMED_CURVE, OSSL_PKEY_EC_ENCODING_GROUP } 2655 }; 2656 2657 static int ec_export_get_encoding_cb(const OSSL_PARAM params[], void *arg) 2658 { 2659 const OSSL_PARAM *p; 2660 const char *enc_name = NULL; 2661 int *enc = arg; 2662 size_t i; 2663 2664 *enc = -1; 2665 2666 if (!TEST_ptr(p = OSSL_PARAM_locate_const(params, 2667 OSSL_PKEY_PARAM_EC_ENCODING)) 2668 || !TEST_true(OSSL_PARAM_get_utf8_string_ptr(p, &enc_name))) 2669 return 0; 2670 2671 for (i = 0; i < OSSL_NELEM(ec_encodings); i++) { 2672 if (OPENSSL_strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) { 2673 *enc = ec_encodings[i].encoding; 2674 break; 2675 } 2676 } 2677 2678 return (*enc != -1); 2679 } 2680 2681 static int test_EC_keygen_with_enc(int idx) 2682 { 2683 EVP_PKEY *params = NULL, *key = NULL; 2684 EVP_PKEY_CTX *pctx = NULL, *kctx = NULL; 2685 int enc; 2686 int ret = 0; 2687 2688 enc = ec_encodings[idx].encoding; 2689 2690 /* Create key parameters */ 2691 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "EC", NULL)) 2692 || !TEST_int_gt(EVP_PKEY_paramgen_init(pctx), 0) 2693 || !TEST_int_gt(EVP_PKEY_CTX_set_group_name(pctx, "P-256"), 0) 2694 || !TEST_int_gt(EVP_PKEY_CTX_set_ec_param_enc(pctx, enc), 0) 2695 || !TEST_true(EVP_PKEY_paramgen(pctx, ¶ms)) 2696 || !TEST_ptr(params)) 2697 goto done; 2698 2699 /* Create key */ 2700 if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx, params, NULL)) 2701 || !TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0) 2702 || !TEST_true(EVP_PKEY_keygen(kctx, &key)) 2703 || !TEST_ptr(key)) 2704 goto done; 2705 2706 /* Check that the encoding got all the way into the key */ 2707 if (!TEST_true(evp_keymgmt_util_export(key, OSSL_KEYMGMT_SELECT_ALL, 2708 ec_export_get_encoding_cb, &enc)) 2709 || !TEST_int_eq(enc, ec_encodings[idx].encoding)) 2710 goto done; 2711 2712 ret = 1; 2713 done: 2714 EVP_PKEY_free(key); 2715 EVP_PKEY_free(params); 2716 EVP_PKEY_CTX_free(kctx); 2717 EVP_PKEY_CTX_free(pctx); 2718 return ret; 2719 } 2720 #endif 2721 2722 #if !defined(OPENSSL_NO_SM2) 2723 2724 static int test_EVP_SM2_verify(void) 2725 { 2726 const char *pubkey = "-----BEGIN PUBLIC KEY-----\n" 2727 "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEp1KLWq1ZE2jmoAnnBJE1LBGxVr18\n" 2728 "YvvqECWCpXfAQ9qUJ+UmthnUPf0iM3SaXKHe6PlLIDyNlWMWb9RUh/yU3g==\n" 2729 "-----END PUBLIC KEY-----\n"; 2730 2731 const char *msg = "message digest"; 2732 const char *id = "ALICE123@YAHOO.COM"; 2733 2734 const uint8_t signature[] = { 2735 0x30, 0x44, 0x02, 0x20, 0x5b, 0xdb, 0xab, 0x81, 0x4f, 0xbb, 2736 0x8b, 0x69, 0xb1, 0x05, 0x9c, 0x99, 0x3b, 0xb2, 0x45, 0x06, 2737 0x4a, 0x30, 0x15, 0x59, 0x84, 0xcd, 0xee, 0x30, 0x60, 0x36, 2738 0x57, 0x87, 0xef, 0x5c, 0xd0, 0xbe, 0x02, 0x20, 0x43, 0x8d, 2739 0x1f, 0xc7, 0x77, 0x72, 0x39, 0xbb, 0x72, 0xe1, 0xfd, 0x07, 2740 0x58, 0xd5, 0x82, 0xc8, 0x2d, 0xba, 0x3b, 0x2c, 0x46, 0x24, 2741 0xe3, 0x50, 0xff, 0x04, 0xc7, 0xa0, 0x71, 0x9f, 0xa4, 0x70 2742 }; 2743 2744 int rc = 0; 2745 BIO *bio = NULL; 2746 EVP_PKEY *pkey = NULL; 2747 EVP_MD_CTX *mctx = NULL; 2748 EVP_PKEY_CTX *pctx = NULL; 2749 EVP_MD *sm3 = NULL; 2750 2751 bio = BIO_new_mem_buf(pubkey, strlen(pubkey)); 2752 if (!TEST_true(bio != NULL)) 2753 goto done; 2754 2755 pkey = PEM_read_bio_PUBKEY_ex(bio, NULL, NULL, NULL, testctx, testpropq); 2756 if (!TEST_true(pkey != NULL)) 2757 goto done; 2758 2759 if (!TEST_true(EVP_PKEY_is_a(pkey, "SM2"))) 2760 goto done; 2761 2762 if (!TEST_ptr(mctx = EVP_MD_CTX_new())) 2763 goto done; 2764 2765 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) 2766 goto done; 2767 2768 EVP_MD_CTX_set_pkey_ctx(mctx, pctx); 2769 2770 if (!TEST_ptr(sm3 = EVP_MD_fetch(testctx, "sm3", testpropq))) 2771 goto done; 2772 2773 if (!TEST_true(EVP_DigestVerifyInit(mctx, NULL, sm3, NULL, pkey))) 2774 goto done; 2775 2776 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(pctx, id, strlen(id)), 0)) 2777 goto done; 2778 2779 if (!TEST_true(EVP_DigestVerifyUpdate(mctx, msg, strlen(msg)))) 2780 goto done; 2781 2782 if (!TEST_int_gt(EVP_DigestVerifyFinal(mctx, signature, sizeof(signature)), 0)) 2783 goto done; 2784 rc = 1; 2785 2786 done: 2787 BIO_free(bio); 2788 EVP_PKEY_free(pkey); 2789 EVP_PKEY_CTX_free(pctx); 2790 EVP_MD_CTX_free(mctx); 2791 EVP_MD_free(sm3); 2792 return rc; 2793 } 2794 2795 static int test_EVP_SM2(void) 2796 { 2797 int ret = 0; 2798 EVP_PKEY *pkey = NULL; 2799 EVP_PKEY *pkeyparams = NULL; 2800 EVP_PKEY_CTX *pctx = NULL; 2801 EVP_PKEY_CTX *kctx = NULL; 2802 EVP_PKEY_CTX *sctx = NULL; 2803 size_t sig_len = 0; 2804 unsigned char *sig = NULL; 2805 EVP_MD_CTX *md_ctx = NULL; 2806 EVP_MD_CTX *md_ctx_verify = NULL; 2807 EVP_PKEY_CTX *cctx = NULL; 2808 EVP_MD *check_md = NULL; 2809 2810 uint8_t ciphertext[128]; 2811 size_t ctext_len = sizeof(ciphertext); 2812 size_t ctext_len_param = 0; 2813 uint8_t plaintext[8]; 2814 size_t ptext_len = sizeof(plaintext); 2815 size_t ptext_len_param = 0; 2816 2817 uint8_t sm2_id[] = { 1, 2, 3, 4, 'l', 'e', 't', 't', 'e', 'r' }; 2818 2819 OSSL_PARAM sparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; 2820 OSSL_PARAM gparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; 2821 int i; 2822 char mdname[OSSL_MAX_NAME_SIZE]; 2823 2824 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, 2825 "SM2", testpropq))) 2826 goto done; 2827 2828 if (!TEST_true(EVP_PKEY_paramgen_init(pctx) == 1)) 2829 goto done; 2830 2831 if (!TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_sm2), 0)) 2832 goto done; 2833 2834 if (!TEST_true(EVP_PKEY_paramgen(pctx, &pkeyparams))) 2835 goto done; 2836 2837 if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx, 2838 pkeyparams, testpropq))) 2839 goto done; 2840 2841 if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0)) 2842 goto done; 2843 2844 if (!TEST_true(EVP_PKEY_keygen(kctx, &pkey))) 2845 goto done; 2846 2847 if (!TEST_ptr(md_ctx = EVP_MD_CTX_new())) 2848 goto done; 2849 2850 if (!TEST_ptr(md_ctx_verify = EVP_MD_CTX_new())) 2851 goto done; 2852 2853 if (!TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) 2854 goto done; 2855 2856 EVP_MD_CTX_set_pkey_ctx(md_ctx, sctx); 2857 EVP_MD_CTX_set_pkey_ctx(md_ctx_verify, sctx); 2858 2859 if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, "sm3", testpropq))) 2860 goto done; 2861 2862 if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, check_md, NULL, pkey))) 2863 goto done; 2864 2865 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0)) 2866 goto done; 2867 2868 if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg)))) 2869 goto done; 2870 2871 /* Determine the size of the signature. */ 2872 if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len))) 2873 goto done; 2874 2875 if (!TEST_ptr(sig = OPENSSL_malloc(sig_len))) 2876 goto done; 2877 2878 if (!TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len))) 2879 goto done; 2880 2881 /* Ensure that the signature round-trips. */ 2882 2883 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL, 2884 pkey))) 2885 goto done; 2886 2887 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0)) 2888 goto done; 2889 2890 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) 2891 goto done; 2892 2893 if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) 2894 goto done; 2895 2896 /* 2897 * Try verify again with non-matching 0 length id but ensure that it can 2898 * be set on the context and overrides the previous value. 2899 */ 2900 2901 if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL, 2902 pkey))) 2903 goto done; 2904 2905 if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, NULL, 0), 0)) 2906 goto done; 2907 2908 if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) 2909 goto done; 2910 2911 if (!TEST_int_eq(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) 2912 goto done; 2913 2914 /* now check encryption/decryption */ 2915 2916 gparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST, 2917 mdname, sizeof(mdname)); 2918 for (i = 0; i < 2; i++) { 2919 const char *mdnames[] = { 2920 #ifndef OPENSSL_NO_SM3 2921 "SM3", 2922 #else 2923 NULL, 2924 #endif 2925 "SHA2-256" 2926 }; 2927 EVP_PKEY_CTX_free(cctx); 2928 2929 if (mdnames[i] == NULL) 2930 continue; 2931 2932 sparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST, 2933 (char *)mdnames[i], 0); 2934 2935 if (!TEST_ptr(cctx = EVP_PKEY_CTX_new_from_pkey(testctx, 2936 pkey, testpropq))) 2937 goto done; 2938 2939 if (!TEST_true(EVP_PKEY_encrypt_init(cctx))) 2940 goto done; 2941 2942 if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams))) 2943 goto done; 2944 2945 ctext_len_param = ctext_len; 2946 if (!TEST_true(EVP_PKEY_encrypt(cctx, ciphertext, &ctext_len_param, kMsg, 2947 sizeof(kMsg)))) 2948 goto done; 2949 2950 if (!TEST_int_gt(EVP_PKEY_decrypt_init(cctx), 0)) 2951 goto done; 2952 2953 if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams))) 2954 goto done; 2955 2956 ptext_len_param = ptext_len; 2957 if (!TEST_int_gt(EVP_PKEY_decrypt(cctx, plaintext, &ptext_len_param, ciphertext, 2958 ctext_len_param), 2959 0)) 2960 goto done; 2961 2962 if (!TEST_true(EVP_PKEY_CTX_get_params(cctx, gparams))) 2963 goto done; 2964 2965 /* 2966 * Test we're still using the digest we think we are. 2967 * Because of aliases, the easiest is to fetch the digest and 2968 * check the name with EVP_MD_is_a(). 2969 */ 2970 EVP_MD_free(check_md); 2971 if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, mdname, testpropq))) 2972 goto done; 2973 if (!TEST_true(EVP_MD_is_a(check_md, mdnames[i]))) { 2974 TEST_info("Fetched md %s isn't %s", mdname, mdnames[i]); 2975 goto done; 2976 } 2977 2978 if (!TEST_true(ptext_len_param == sizeof(kMsg))) 2979 goto done; 2980 2981 if (!TEST_true(memcmp(plaintext, kMsg, sizeof(kMsg)) == 0)) 2982 goto done; 2983 } 2984 2985 ret = 1; 2986 done: 2987 EVP_PKEY_CTX_free(pctx); 2988 EVP_PKEY_CTX_free(kctx); 2989 EVP_PKEY_CTX_free(sctx); 2990 EVP_PKEY_CTX_free(cctx); 2991 EVP_PKEY_free(pkey); 2992 EVP_PKEY_free(pkeyparams); 2993 EVP_MD_CTX_free(md_ctx); 2994 EVP_MD_CTX_free(md_ctx_verify); 2995 EVP_MD_free(check_md); 2996 OPENSSL_free(sig); 2997 return ret; 2998 } 2999 3000 #endif 3001 3002 #ifndef OPENSSL_NO_ML_KEM 3003 static const uint8_t ml_kem_seed[] = { 3004 0x7c, 0x99, 0x35, 0xa0, 0xb0, 0x76, 0x94, 0xaa, 0x0c, 0x6d, 0x10, 0xe4, 3005 0xdb, 0x6b, 0x1a, 0xdd, 0x2f, 0xd8, 0x1a, 0x25, 0xcc, 0xb1, 0x48, 0x03, 3006 0x2d, 0xcd, 0x73, 0x99, 0x36, 0x73, 0x7f, 0x2d, 0x86, 0x26, 0xed, 0x79, 3007 0xd4, 0x51, 0x14, 0x08, 0x00, 0xe0, 0x3b, 0x59, 0xb9, 0x56, 0xf8, 0x21, 3008 0x0e, 0x55, 0x60, 0x67, 0x40, 0x7d, 0x13, 0xdc, 0x90, 0xfa, 0x9e, 0x8b, 3009 0x87, 0x2b, 0xfb, 0x8f 3010 }; 3011 static const uint8_t ml_kem_512_pubkey[] = { 3012 0x40, 0x08, 0x65, 0xed, 0x10, 0xb6, 0x19, 0xaa, 0x58, 0x11, 0x13, 0x9b, 3013 0xc0, 0x86, 0x82, 0x57, 0x82, 0xb2, 0xb7, 0x12, 0x4f, 0x75, 0x7c, 0x83, 3014 0xae, 0x79, 0x44, 0x44, 0xbc, 0x78, 0xa4, 0x78, 0x96, 0xac, 0xf1, 0x26, 3015 0x2c, 0x81, 0x35, 0x10, 0x77, 0x89, 0x3b, 0xfc, 0x56, 0xf9, 0x04, 0x49, 3016 0xc2, 0xfa, 0x5f, 0x6e, 0x58, 0x6d, 0xd3, 0x7c, 0x0b, 0x9b, 0x58, 0x19, 3017 0x92, 0x63, 0x8c, 0xb7, 0xe7, 0xbc, 0xbb, 0xb9, 0x9a, 0xfe, 0x47, 0x81, 3018 0xd8, 0x0a, 0x50, 0xe6, 0x94, 0x63, 0xfb, 0xd9, 0x88, 0x72, 0x2c, 0x36, 3019 0x35, 0x42, 0x3e, 0x27, 0x46, 0x6c, 0x71, 0xdc, 0xc6, 0x74, 0x52, 0x7c, 3020 0xcd, 0x72, 0x89, 0x68, 0xcb, 0xcd, 0xc0, 0x0c, 0x5c, 0x90, 0x35, 0xbb, 3021 0x0a, 0xf2, 0xc9, 0x92, 0x2c, 0x78, 0x81, 0xa4, 0x1d, 0xd2, 0x87, 0x52, 3022 0x73, 0x92, 0x51, 0x31, 0x23, 0x0f, 0x6c, 0xa5, 0x9e, 0x91, 0x36, 0xb3, 3023 0x9f, 0x95, 0x6c, 0x93, 0xb3, 0xb2, 0xd1, 0x4c, 0x64, 0x1b, 0x08, 0x9e, 3024 0x07, 0xd0, 0xa8, 0x40, 0xc8, 0x93, 0xec, 0xd7, 0x6b, 0xbf, 0x92, 0xc8, 3025 0x05, 0x45, 0x66, 0x68, 0xd0, 0x7c, 0x62, 0x14, 0x91, 0xc5, 0xc0, 0x54, 3026 0x99, 0x1a, 0x65, 0x6f, 0x51, 0x16, 0x19, 0x55, 0x6e, 0xb9, 0x77, 0x82, 3027 0xe2, 0x7a, 0x3c, 0x78, 0x51, 0x24, 0xc7, 0x0b, 0x0d, 0xab, 0xa6, 0xc6, 3028 0x24, 0xd1, 0x8e, 0x0f, 0x97, 0x93, 0xf9, 0x6b, 0xa9, 0xe1, 0x59, 0x9b, 3029 0x17, 0xb3, 0x0d, 0xcc, 0xc0, 0xb4, 0xf3, 0x76, 0x6a, 0x07, 0xb2, 0x3b, 3030 0x25, 0x73, 0x09, 0xcd, 0x76, 0xab, 0xa0, 0x72, 0xc2, 0xb9, 0xc9, 0x74, 3031 0x43, 0x94, 0xc6, 0xab, 0x9c, 0xb6, 0xc5, 0x4a, 0x97, 0xb5, 0xc5, 0x78, 3032 0x61, 0xa5, 0x8d, 0xc0, 0xa0, 0x35, 0x19, 0x83, 0x2e, 0xe3, 0x2a, 0x07, 3033 0x65, 0x4a, 0x07, 0x0c, 0x0c, 0x8c, 0x4e, 0x86, 0x48, 0xad, 0xdc, 0x35, 3034 0x5f, 0x27, 0x4f, 0xc6, 0xb9, 0x2a, 0x08, 0x7b, 0x3f, 0x97, 0x51, 0x92, 3035 0x3e, 0x44, 0x27, 0x4f, 0x85, 0x8c, 0x49, 0xca, 0xba, 0x72, 0xb6, 0x58, 3036 0x51, 0xb3, 0xad, 0xc4, 0x89, 0x36, 0x95, 0x50, 0x97, 0xca, 0xd9, 0x55, 3037 0x3f, 0x5a, 0x26, 0x3f, 0x18, 0x44, 0xb5, 0x2a, 0x02, 0x0f, 0xf7, 0xca, 3038 0x89, 0xe8, 0x81, 0xa0, 0x1b, 0x95, 0xd9, 0x57, 0xa3, 0x15, 0x3c, 0x0a, 3039 0x5e, 0x0a, 0x1c, 0xcd, 0x66, 0xb1, 0x82, 0x1a, 0x2b, 0x86, 0x32, 0x54, 3040 0x6e, 0x24, 0xc7, 0xcb, 0xbc, 0x4c, 0xb0, 0x88, 0x08, 0xca, 0xc3, 0x7f, 3041 0x7d, 0xa6, 0xb1, 0x6f, 0x8a, 0xce, 0xd0, 0x52, 0xcd, 0xb2, 0x56, 0x49, 3042 0x48, 0xf1, 0xab, 0x0f, 0x76, 0x8a, 0x0d, 0x32, 0x86, 0xcc, 0xc7, 0xc3, 3043 0x74, 0x9c, 0x63, 0xc7, 0x81, 0x53, 0x0f, 0xa1, 0xae, 0x67, 0x05, 0x42, 3044 0x85, 0x50, 0x04, 0xa6, 0x45, 0xb5, 0x22, 0x88, 0x1e, 0xc1, 0x41, 0x2b, 3045 0xda, 0xe3, 0x42, 0x08, 0x5a, 0x9d, 0xd5, 0xf8, 0x12, 0x6a, 0xf9, 0x6b, 3046 0xbd, 0xb0, 0xc1, 0xaf, 0x69, 0xa1, 0x55, 0x62, 0xcb, 0x2a, 0x15, 0x5a, 3047 0x10, 0x03, 0x09, 0xd1, 0xb6, 0x41, 0xd0, 0x8b, 0x2d, 0x4e, 0xd1, 0x7b, 3048 0xfb, 0xf0, 0xbc, 0x04, 0x26, 0x5f, 0x9b, 0x10, 0xc1, 0x08, 0xf8, 0x50, 3049 0x30, 0x95, 0x04, 0xd7, 0x72, 0x81, 0x1b, 0xba, 0x8e, 0x2b, 0xe1, 0x62, 3050 0x49, 0xaa, 0x73, 0x7d, 0x87, 0x9f, 0xc7, 0xfb, 0x25, 0x5e, 0xe7, 0xa6, 3051 0xa0, 0xa7, 0x53, 0xbd, 0x93, 0x74, 0x1c, 0x61, 0x65, 0x8e, 0xc0, 0x74, 3052 0xf6, 0xe0, 0x02, 0xb0, 0x19, 0x34, 0x57, 0x69, 0x11, 0x3c, 0xc0, 0x13, 3053 0xff, 0x74, 0x94, 0xba, 0x83, 0x78, 0xb1, 0x1a, 0x17, 0x22, 0x60, 0xaa, 3054 0xa5, 0x34, 0x21, 0xbd, 0xe0, 0x3a, 0x35, 0x58, 0x9d, 0x57, 0xe3, 0x22, 3055 0xfe, 0xfa, 0x41, 0x00, 0xa4, 0x74, 0x39, 0x26, 0xab, 0x7d, 0x62, 0x25, 3056 0x8b, 0x87, 0xb3, 0x1c, 0xcb, 0xb5, 0xe6, 0xb8, 0x9c, 0xb1, 0x0b, 0x27, 3057 0x1a, 0xa0, 0x5d, 0x99, 0x4b, 0xb5, 0x70, 0x8b, 0x23, 0xab, 0x32, 0x7e, 3058 0xcb, 0x93, 0xc0, 0xf3, 0x15, 0x68, 0x69, 0xf0, 0x88, 0x3d, 0xa2, 0x06, 3059 0x4f, 0x79, 0x5e, 0x0e, 0x2a, 0xb7, 0xd3, 0xc6, 0x4d, 0x61, 0xd2, 0x30, 3060 0x3f, 0xc3, 0xa2, 0x9e, 0x16, 0x19, 0x92, 0x3c, 0xa8, 0x01, 0xe5, 0x9f, 3061 0xd7, 0x52, 0xca, 0x6e, 0x76, 0x49, 0xd3, 0x03, 0xc9, 0xd2, 0x07, 0x88, 3062 0xe1, 0x21, 0x46, 0x51, 0xb0, 0x69, 0x95, 0xeb, 0x26, 0x0c, 0x92, 0x9a, 3063 0x13, 0x44, 0xa8, 0x49, 0xb2, 0x5c, 0xa0, 0xa0, 0x1f, 0x1e, 0xb5, 0x29, 3064 0x13, 0x68, 0x6b, 0xba, 0x61, 0x9e, 0x23, 0x71, 0x44, 0x64, 0x03, 0x1a, 3065 0x78, 0x43, 0x92, 0x87, 0xfc, 0xa7, 0x8f, 0x4c, 0x04, 0x76, 0x22, 0x3e, 3066 0xea, 0x61, 0xb7, 0xf2, 0x5a, 0x7c, 0xe4, 0x2c, 0xca, 0x90, 0x1b, 0x2a, 3067 0xea, 0x12, 0x98, 0x17, 0x89, 0x4b, 0xa3, 0x47, 0x08, 0x23, 0x85, 0x4f, 3068 0x3e, 0x5b, 0x28, 0xd8, 0x6b, 0xa9, 0x79, 0xe5, 0x46, 0x71, 0x86, 0x2d, 3069 0x90, 0x47, 0x0b, 0x1e, 0x78, 0x38, 0x97, 0x2a, 0x81, 0xa4, 0x81, 0x07, 3070 0xd6, 0xac, 0x06, 0x11, 0x40, 0x6b, 0x21, 0xfb, 0xcc, 0xe1, 0xdb, 0x77, 3071 0x02, 0xea, 0x9d, 0xd6, 0xba, 0x6e, 0x40, 0x52, 0x7b, 0x9d, 0xc6, 0x63, 3072 0xf3, 0xc9, 0x3b, 0xad, 0x05, 0x6d, 0xc2, 0x85, 0x11, 0xf6, 0x6c, 0x3e, 3073 0x0b, 0x92, 0x8d, 0xb8, 0x87, 0x9d, 0x22, 0xc5, 0x92, 0x68, 0x5c, 0xc7, 3074 0x75, 0xa6, 0xcd, 0x57, 0x4a, 0xc3, 0xbc, 0xe3, 0xb2, 0x75, 0x91, 0xc8, 3075 0x21, 0x92, 0x90, 0x76, 0x35, 0x8a, 0x22, 0x00, 0xb3, 0x77, 0x36, 0x5f, 3076 0x7e, 0xfb, 0x9e, 0x40, 0xc3, 0xbf, 0x0f, 0xf0, 0x43, 0x29, 0x86, 0xae, 3077 0x4b, 0xc1, 0xa2, 0x42, 0xce, 0x99, 0x21, 0xaa, 0x9e, 0x22, 0x44, 0x88, 3078 0x19, 0x58, 0x5d, 0xea, 0x30, 0x8e, 0xb0, 0x39 3079 }; 3080 static const uint8_t ml_kem_768_pubkey[] = { 3081 0xa8, 0xe6, 0x51, 0xa1, 0xe6, 0x85, 0xf2, 0x24, 0x78, 0xa8, 0x95, 0x4f, 3082 0x00, 0x7b, 0xc7, 0x71, 0x1b, 0x93, 0x07, 0x72, 0xc7, 0x8f, 0x09, 0x2e, 3083 0x82, 0x87, 0x8e, 0x3e, 0x93, 0x7f, 0x36, 0x79, 0x67, 0x53, 0x29, 0x13, 3084 0xa8, 0xd5, 0x3d, 0xfd, 0xf4, 0xbf, 0xb1, 0xf8, 0x84, 0x67, 0x46, 0x59, 3085 0x67, 0x05, 0xcf, 0x34, 0x51, 0x42, 0xb9, 0x72, 0xa3, 0xf1, 0x63, 0x25, 3086 0xc4, 0x0c, 0x29, 0x52, 0xa3, 0x7b, 0x25, 0x89, 0x7e, 0x5e, 0xf3, 0x5f, 3087 0xba, 0xeb, 0x73, 0xa4, 0xac, 0xbe, 0xb6, 0xa0, 0xb8, 0x99, 0x42, 0xce, 3088 0xb1, 0x95, 0x53, 0x1c, 0xfc, 0x0a, 0x07, 0x99, 0x39, 0x54, 0x48, 0x3e, 3089 0x6c, 0xbc, 0x87, 0xc0, 0x6a, 0xa7, 0x4f, 0xf0, 0xca, 0xc5, 0x20, 0x7e, 3090 0x53, 0x5b, 0x26, 0x0a, 0xa9, 0x8d, 0x11, 0x98, 0xc0, 0x7d, 0xa6, 0x05, 3091 0xc4, 0xd1, 0x10, 0x20, 0xf6, 0xc9, 0xf7, 0xbb, 0x68, 0xbb, 0x34, 0x56, 3092 0xc7, 0x3a, 0x01, 0xb7, 0x10, 0xbc, 0x99, 0xd1, 0x77, 0x39, 0xa5, 0x17, 3093 0x16, 0xaa, 0x01, 0x66, 0x0c, 0x8b, 0x62, 0x8b, 0x2f, 0x56, 0x02, 0xba, 3094 0x65, 0xf0, 0x7e, 0xa9, 0x93, 0x33, 0x6e, 0x89, 0x6e, 0x83, 0xf2, 0xc5, 3095 0x73, 0x1b, 0xbf, 0x03, 0x46, 0x0c, 0x5b, 0x6c, 0x8a, 0xfe, 0xcb, 0x74, 3096 0x8e, 0xe3, 0x91, 0xe9, 0x89, 0x34, 0xa2, 0xc5, 0x7d, 0x4d, 0x06, 0x9f, 3097 0x50, 0xd8, 0x8b, 0x30, 0xd6, 0x96, 0x6f, 0x38, 0xc3, 0x7b, 0xc6, 0x49, 3098 0xb8, 0x26, 0x34, 0xce, 0x77, 0x22, 0x64, 0x5c, 0xcd, 0x62, 0x50, 0x63, 3099 0x36, 0x46, 0x46, 0xd6, 0xd6, 0x99, 0xdb, 0x57, 0xb4, 0x5e, 0xb6, 0x74, 3100 0x65, 0xe1, 0x6d, 0xe4, 0xd4, 0x06, 0xa8, 0x18, 0xb9, 0xea, 0xe1, 0xca, 3101 0x91, 0x6a, 0x25, 0x94, 0x48, 0x97, 0x08, 0xa4, 0x3c, 0xea, 0x88, 0xb0, 3102 0x2a, 0x4c, 0x03, 0xd0, 0x9b, 0x44, 0x81, 0x5c, 0x97, 0x10, 0x1c, 0xaf, 3103 0x50, 0x48, 0xbb, 0xcb, 0x24, 0x7a, 0xe2, 0x36, 0x6c, 0xdc, 0x25, 0x4b, 3104 0xa2, 0x21, 0x29, 0xf4, 0x5b, 0x3b, 0x0e, 0xb3, 0x99, 0xca, 0x91, 0xa3, 3105 0x03, 0x40, 0x28, 0x30, 0xec, 0x01, 0xdb, 0x7b, 0x2c, 0xa4, 0x80, 0xcf, 3106 0x35, 0x04, 0x09, 0xb2, 0x16, 0x09, 0x4b, 0x7b, 0x0c, 0x3a, 0xe3, 0x3c, 3107 0xe1, 0x0a, 0x91, 0x24, 0xe8, 0x96, 0x51, 0xab, 0x90, 0x1e, 0xa2, 0x53, 3108 0xc8, 0x41, 0x5b, 0xd7, 0x82, 0x5f, 0x02, 0xbb, 0x22, 0x93, 0x69, 0xaf, 3109 0x97, 0x20, 0x28, 0xf2, 0x28, 0x75, 0xea, 0x55, 0xaf, 0x16, 0xd3, 0xbc, 3110 0x69, 0xf7, 0x0c, 0x2e, 0xe8, 0xb7, 0x5f, 0x28, 0xb4, 0x7d, 0xd3, 0x91, 3111 0xf9, 0x89, 0xad, 0xe3, 0x14, 0x72, 0x9c, 0x33, 0x1f, 0xa0, 0x4c, 0x19, 3112 0x17, 0xb2, 0x78, 0xc3, 0xeb, 0x60, 0x28, 0x68, 0x51, 0x28, 0x21, 0xad, 3113 0xc8, 0x25, 0xc6, 0x45, 0x77, 0xce, 0x1e, 0x63, 0xb1, 0xd9, 0x64, 0x4a, 3114 0x61, 0x29, 0x48, 0xa3, 0x48, 0x3c, 0x7f, 0x1b, 0x9a, 0x25, 0x80, 0x00, 3115 0xe3, 0x01, 0x96, 0x94, 0x4a, 0x40, 0x36, 0x27, 0x60, 0x9c, 0x76, 0xc7, 3116 0xea, 0x6b, 0x5d, 0xe0, 0x17, 0x64, 0xd2, 0x43, 0x79, 0x11, 0x7b, 0x9e, 3117 0xa2, 0x98, 0x48, 0xdc, 0x55, 0x5c, 0x45, 0x4b, 0xce, 0xae, 0x1b, 0xa5, 3118 0xcc, 0x72, 0xc7, 0x4a, 0xb9, 0x6b, 0x9c, 0x91, 0xb9, 0x10, 0xd2, 0x6b, 3119 0x88, 0xb2, 0x56, 0x39, 0xd4, 0x77, 0x8a, 0xe2, 0x6c, 0x7c, 0x61, 0x51, 3120 0xa1, 0x9c, 0x6c, 0xd7, 0x93, 0x84, 0x54, 0x37, 0x24, 0x65, 0xe4, 0xc5, 3121 0xec, 0x29, 0x24, 0x5a, 0xcb, 0x3d, 0xb5, 0x37, 0x9d, 0xe3, 0xda, 0xbf, 3122 0xa6, 0x29, 0xa7, 0xc0, 0x4a, 0x83, 0x53, 0xa8, 0x53, 0x0c, 0x95, 0xac, 3123 0xb7, 0x32, 0xbb, 0x4b, 0xb8, 0x19, 0x32, 0xbb, 0x2c, 0xa7, 0xa8, 0x48, 3124 0xcd, 0x36, 0x68, 0x01, 0x44, 0x4a, 0xbe, 0x23, 0xc8, 0x3b, 0x36, 0x6a, 3125 0x87, 0xd6, 0xa3, 0xcf, 0x36, 0x09, 0x24, 0xc0, 0x02, 0xba, 0xe9, 0x0a, 3126 0xf6, 0x5c, 0x48, 0x06, 0x0b, 0x37, 0x52, 0xf2, 0xba, 0xdf, 0x1a, 0xb2, 3127 0x72, 0x20, 0x72, 0x55, 0x4a, 0x50, 0x59, 0x75, 0x35, 0x94, 0xe6, 0xa7, 3128 0x02, 0x76, 0x1f, 0xc9, 0x76, 0x84, 0xc8, 0xc4, 0xa7, 0x54, 0x0a, 0x6b, 3129 0x07, 0xfb, 0xc9, 0xde, 0x87, 0xc9, 0x74, 0xaa, 0x88, 0x09, 0xd9, 0x28, 3130 0xc7, 0xf4, 0xcb, 0xbf, 0x80, 0x45, 0xae, 0xa5, 0xbc, 0x66, 0x78, 0x25, 3131 0xfd, 0x05, 0xa5, 0x21, 0xf1, 0xa4, 0xbf, 0x53, 0x92, 0x10, 0xc7, 0x11, 3132 0x3b, 0xc3, 0x7b, 0x3e, 0x58, 0xb0, 0xcb, 0xfc, 0x53, 0xc8, 0x41, 0xcb, 3133 0xb0, 0x37, 0x1d, 0xe2, 0xe5, 0x11, 0xb9, 0x89, 0xcb, 0x7c, 0x70, 0xc0, 3134 0x23, 0x36, 0x6d, 0x78, 0xf9, 0xc3, 0x7e, 0xf0, 0x47, 0xf8, 0x72, 0x0b, 3135 0xe1, 0xc7, 0x59, 0xa8, 0xd9, 0x6b, 0x93, 0xf6, 0x5a, 0x94, 0x11, 0x4f, 3136 0xfa, 0xf6, 0x0d, 0x9a, 0x81, 0x79, 0x5e, 0x99, 0x5c, 0x71, 0x15, 0x2a, 3137 0x46, 0x91, 0xa5, 0xa6, 0x02, 0xa9, 0xe1, 0xf3, 0x59, 0x9e, 0x37, 0xc7, 3138 0x68, 0xc7, 0xbc, 0x10, 0x89, 0x94, 0xc0, 0x66, 0x9f, 0x3a, 0xdc, 0x95, 3139 0x7d, 0x46, 0xb4, 0xb6, 0x25, 0x69, 0x68, 0xe2, 0x90, 0xd7, 0x89, 0x2e, 3140 0xa8, 0x54, 0x64, 0xee, 0x7a, 0x75, 0x0f, 0x39, 0xc5, 0xe3, 0x15, 0x2c, 3141 0x2d, 0xfc, 0x56, 0xd8, 0xb0, 0xc9, 0x24, 0xba, 0x8a, 0x95, 0x9a, 0x68, 3142 0x09, 0x65, 0x47, 0xf6, 0x64, 0x23, 0xc8, 0x38, 0x98, 0x2a, 0x57, 0x94, 3143 0xb9, 0xe1, 0x53, 0x37, 0x71, 0x33, 0x1a, 0x9a, 0x65, 0x6c, 0x28, 0x82, 3144 0x8b, 0xeb, 0x91, 0x26, 0xa6, 0x0e, 0x95, 0xe8, 0xc5, 0xd9, 0x06, 0x83, 3145 0x2c, 0x77, 0x10, 0x70, 0x55, 0x76, 0xb1, 0xfb, 0x95, 0x07, 0x26, 0x9d, 3146 0xda, 0xf8, 0xc9, 0x5c, 0xe9, 0x71, 0x9b, 0x2c, 0xa8, 0xdd, 0x11, 0x2b, 3147 0xe1, 0x0b, 0xcc, 0x9f, 0x4a, 0x37, 0xbd, 0x1b, 0x1e, 0xee, 0xb3, 0x3e, 3148 0xcd, 0xa7, 0x6a, 0xe9, 0xf6, 0x9a, 0x5d, 0x4b, 0x29, 0x23, 0xa8, 0x69, 3149 0x57, 0x67, 0x1d, 0x61, 0x93, 0x35, 0xbe, 0x1c, 0x4c, 0x2c, 0x77, 0xce, 3150 0x87, 0xc4, 0x1f, 0x98, 0xa8, 0xcc, 0x46, 0x64, 0x60, 0xfa, 0x30, 0x0a, 3151 0xaf, 0x5b, 0x30, 0x1f, 0x0a, 0x1d, 0x09, 0xc8, 0x8e, 0x65, 0xda, 0x4d, 3152 0x8e, 0xe6, 0x4f, 0x68, 0xc0, 0x21, 0x89, 0xbb, 0xb3, 0x58, 0x4b, 0xaf, 3153 0xf7, 0x16, 0xc8, 0x5d, 0xb6, 0x54, 0x04, 0x8a, 0x00, 0x43, 0x33, 0x48, 3154 0x93, 0x93, 0xa0, 0x74, 0x27, 0xcd, 0x3e, 0x21, 0x7e, 0x6a, 0x34, 0x5f, 3155 0x6c, 0x2c, 0x2b, 0x13, 0xc2, 0x7b, 0x33, 0x72, 0x71, 0xc0, 0xb2, 0x7b, 3156 0x2d, 0xba, 0xa0, 0x0d, 0x23, 0x76, 0x00, 0xb5, 0xb5, 0x94, 0xe8, 0xcf, 3157 0x2d, 0xd6, 0x25, 0xea, 0x76, 0xcf, 0x0e, 0xd8, 0x99, 0x12, 0x2c, 0x97, 3158 0x96, 0xb4, 0xb0, 0x18, 0x70, 0x04, 0x25, 0x80, 0x49, 0xa4, 0x77, 0xcd, 3159 0x11, 0xd6, 0x8c, 0x49, 0xb9, 0xa0, 0xe7, 0xb0, 0x0b, 0xce, 0x8c, 0xac, 3160 0x78, 0x64, 0xcb, 0xb3, 0x75, 0x14, 0x00, 0x84, 0x74, 0x4c, 0x93, 0x06, 3161 0x26, 0x94, 0xca, 0x79, 0x5c, 0x4f, 0x40, 0xe7, 0xac, 0xc9, 0xc5, 0xa1, 3162 0x88, 0x40, 0x72, 0xd8, 0xc3, 0x8d, 0xaf, 0xb5, 0x01, 0xee, 0x41, 0x84, 3163 0xdd, 0x5a, 0x81, 0x9e, 0xc2, 0x4e, 0xc1, 0x65, 0x12, 0x61, 0xf9, 0x62, 3164 0xb1, 0x7a, 0x72, 0x15, 0xaa, 0x4a, 0x74, 0x8c, 0x15, 0x83, 0x6c, 0x38, 3165 0x91, 0x37, 0x67, 0x82, 0x04, 0x83, 0x8d, 0x71, 0x95, 0xa8, 0x5b, 0x4f, 3166 0x98, 0xa1, 0xb5, 0x74, 0xc4, 0xcd, 0x79, 0x09, 0xcd, 0x1f, 0x83, 0x3e, 3167 0xff, 0xd1, 0x48, 0x55, 0x43, 0x22, 0x9d, 0x37, 0x48, 0xd9, 0xb5, 0xcd, 3168 0x6c, 0x17, 0xb9, 0xb3, 0xb8, 0x4a, 0xef, 0x8b, 0xce, 0x13, 0xe6, 0x83, 3169 0x73, 0x36, 0x59, 0xc7, 0x95, 0x42, 0xd6, 0x15, 0x78, 0x2a, 0x71, 0xcd, 3170 0xee, 0xe7, 0x92, 0xba, 0xb5, 0x1b, 0xdc, 0x4b, 0xbf, 0xe8, 0x30, 0x8e, 3171 0x66, 0x31, 0x44, 0xed, 0xe8, 0x49, 0x18, 0x30, 0xad, 0x98, 0xb4, 0x63, 3172 0x4f, 0x64, 0xab, 0xa8, 0xb9, 0xc0, 0x42, 0x27, 0x26, 0x53, 0x92, 0x0f, 3173 0x38, 0x0c, 0x1a, 0x17, 0xca, 0x87, 0xce, 0xd7, 0xaa, 0xc4, 0x1c, 0x82, 3174 0x88, 0x87, 0x93, 0x18, 0x1a, 0x6f, 0x76, 0xe1, 0x97, 0xb7, 0xb9, 0x0e, 3175 0xf9, 0x09, 0x43, 0xbb, 0x38, 0x44, 0x91, 0x29, 0x11, 0xd8, 0x55, 0x1e, 3176 0x54, 0x66, 0xc5, 0x76, 0x7a, 0xb0, 0xbc, 0x61, 0xa1, 0xa3, 0xf7, 0x36, 3177 0x16, 0x2e, 0xc0, 0x98, 0xa9, 0x00, 0xb1, 0x2d, 0xd8, 0xfa, 0xbb, 0xfb, 3178 0x3f, 0xe8, 0xcb, 0x1d, 0xc4, 0xe8, 0x31, 0x5f, 0x2a, 0xf0, 0xd3, 0x2f, 3179 0x00, 0x17, 0xae, 0x13, 0x6e, 0x19, 0xf0, 0x28 3180 }; 3181 static const uint8_t ml_kem_1024_pubkey[] = { 3182 0x53, 0x79, 0x11, 0x95, 0x7c, 0x12, 0x51, 0x48, 0xa8, 0x7f, 0x41, 0x58, 3183 0x9c, 0xb2, 0x22, 0xd0, 0xd1, 0x92, 0x29, 0xe2, 0xcb, 0x55, 0xe1, 0xa0, 3184 0x44, 0x79, 0x1e, 0x7c, 0xa6, 0x11, 0x92, 0xa4, 0x64, 0x60, 0xc3, 0x18, 3185 0x3d, 0x2b, 0xcd, 0x6d, 0xe0, 0x8a, 0x5e, 0x76, 0x51, 0x60, 0x3a, 0xcc, 3186 0x34, 0x9c, 0xa1, 0x6c, 0xba, 0x18, 0xab, 0xb2, 0x3a, 0x3e, 0x8c, 0x33, 3187 0x0d, 0x74, 0x21, 0x59, 0x8a, 0x62, 0x78, 0xec, 0x7e, 0xbf, 0xab, 0xca, 3188 0x0e, 0xf4, 0x88, 0xb2, 0x29, 0x05, 0x54, 0x75, 0x34, 0x99, 0xc0, 0x45, 3189 0x2e, 0x45, 0x38, 0x15, 0x30, 0x99, 0x55, 0xb8, 0x15, 0x0f, 0xa1, 0xa1, 3190 0xe3, 0x93, 0x38, 0x6d, 0xc1, 0x2f, 0xdb, 0x27, 0xb3, 0x8c, 0x67, 0x45, 3191 0xf2, 0x94, 0x40, 0x16, 0xec, 0x45, 0x7f, 0x39, 0xb1, 0x8d, 0x60, 0x4a, 3192 0x07, 0xa1, 0xab, 0xe0, 0x7b, 0xc8, 0x44, 0x05, 0x0f, 0xfa, 0x8a, 0x06, 3193 0xfa, 0x15, 0x4a, 0x49, 0xd8, 0x8f, 0xac, 0x77, 0x54, 0x52, 0xd6, 0xa7, 3194 0xc0, 0xe5, 0x89, 0xbf, 0xb5, 0xc3, 0x70, 0xc2, 0xc4, 0xb6, 0x20, 0x1d, 3195 0xda, 0x80, 0xc9, 0xab, 0x20, 0x76, 0xec, 0xc0, 0x8b, 0x44, 0x52, 0x2f, 3196 0xda, 0x33, 0x26, 0xf0, 0x33, 0x80, 0x6d, 0xd2, 0x69, 0x3f, 0x31, 0x97, 3197 0x39, 0xf4, 0x0c, 0x4f, 0x42, 0xb2, 0x4a, 0xca, 0x70, 0x98, 0xfb, 0x8f, 3198 0xf5, 0xf9, 0xac, 0x20, 0x29, 0x2d, 0x02, 0xb5, 0x6a, 0xc7, 0x46, 0x80, 3199 0x1a, 0xcc, 0xcc, 0x84, 0x86, 0x3d, 0xee, 0x32, 0x87, 0x84, 0x97, 0xb6, 3200 0x94, 0x38, 0xbf, 0x99, 0x17, 0x76, 0x28, 0x66, 0x50, 0x48, 0x2c, 0x8d, 3201 0x9d, 0x95, 0x87, 0xbc, 0x6a, 0x55, 0xb8, 0x5c, 0x4d, 0x7f, 0xa7, 0x4d, 3202 0x02, 0x65, 0x6b, 0x42, 0x1c, 0x9e, 0x23, 0xe0, 0x3a, 0x48, 0xd4, 0xb7, 3203 0x44, 0x25, 0xc2, 0x6e, 0x4a, 0x20, 0xdd, 0x95, 0x62, 0xa4, 0xda, 0x07, 3204 0x93, 0xf3, 0xa3, 0x52, 0xcc, 0xc0, 0xf1, 0x82, 0x17, 0xd8, 0x68, 0xc7, 3205 0xf5, 0x00, 0x2a, 0xbe, 0x76, 0x8b, 0x1f, 0xc7, 0x3f, 0x05, 0x74, 0x4e, 3206 0x7c, 0xc2, 0x8f, 0x10, 0x34, 0x40, 0x62, 0xc1, 0x0e, 0x08, 0xec, 0xcc, 3207 0xed, 0x3c, 0x1f, 0x7d, 0x39, 0x2c, 0x01, 0xd9, 0x79, 0xdd, 0x71, 0x8d, 3208 0x83, 0x98, 0x37, 0x46, 0x65, 0xa1, 0x6a, 0x98, 0x70, 0x58, 0x5c, 0x39, 3209 0xd5, 0x58, 0x9a, 0x50, 0xe1, 0x33, 0x38, 0x9c, 0x9b, 0x9a, 0x27, 0x6c, 3210 0x02, 0x42, 0x60, 0xd9, 0xfc, 0x77, 0x11, 0xc8, 0x1b, 0x63, 0x37, 0xb5, 3211 0x7d, 0xa3, 0xc3, 0x76, 0xd0, 0xcd, 0x74, 0xe1, 0x4c, 0x73, 0x72, 0x7b, 3212 0x27, 0x66, 0x56, 0xb9, 0xd8, 0xa4, 0xeb, 0x71, 0x89, 0x6f, 0xf5, 0x89, 3213 0xd4, 0xb8, 0x93, 0xe7, 0x11, 0x0f, 0x3b, 0xb9, 0x48, 0xec, 0xe2, 0x91, 3214 0xdd, 0x86, 0xc0, 0xb7, 0x46, 0x8a, 0x67, 0x8c, 0x74, 0x69, 0x80, 0xc1, 3215 0x2a, 0xa6, 0xb9, 0x5e, 0x2b, 0x0c, 0xbe, 0x43, 0x31, 0xbb, 0x24, 0xa3, 3216 0x3a, 0x27, 0x01, 0x53, 0xaa, 0x47, 0x2c, 0x47, 0x31, 0x23, 0x82, 0xca, 3217 0x36, 0x5c, 0x5f, 0x35, 0x25, 0x9d, 0x02, 0x57, 0x46, 0xfc, 0x65, 0x95, 3218 0xfe, 0x63, 0x6c, 0x76, 0x75, 0x10, 0xa6, 0x9c, 0x1e, 0x8a, 0x17, 0x6b, 3219 0x79, 0x49, 0x95, 0x8f, 0x26, 0x97, 0x39, 0x94, 0x97, 0xa2, 0xfc, 0x73, 3220 0x64, 0xa1, 0x2c, 0x81, 0x98, 0x29, 0x52, 0x39, 0xc8, 0x26, 0xcb, 0x50, 3221 0x82, 0x08, 0x60, 0x77, 0x28, 0x2e, 0xd6, 0x28, 0x65, 0x1f, 0xc0, 0x4c, 3222 0x63, 0x9b, 0x43, 0x85, 0x22, 0xa9, 0xde, 0x30, 0x9b, 0x14, 0xb0, 0x86, 3223 0xd6, 0xe9, 0x23, 0xc5, 0x51, 0x62, 0x3b, 0xd7, 0x2a, 0x73, 0x3c, 0xb0, 3224 0xda, 0xbc, 0x54, 0xa9, 0x41, 0x6a, 0x99, 0xe7, 0x2c, 0x9f, 0xda, 0x1c, 3225 0xb3, 0xfb, 0x9b, 0xa0, 0x6b, 0x8a, 0xdb, 0x24, 0x22, 0xd6, 0x8c, 0xad, 3226 0xc5, 0x53, 0xc9, 0x82, 0x02, 0xa1, 0x76, 0x56, 0x47, 0x8a, 0xc0, 0x44, 3227 0xef, 0x34, 0x56, 0x37, 0x8a, 0xbc, 0xe9, 0x99, 0x1e, 0x01, 0x41, 0xba, 3228 0x79, 0x09, 0x4f, 0xa8, 0xf7, 0x7a, 0x30, 0x08, 0x05, 0xd2, 0xd3, 0x2f, 3229 0xfc, 0x62, 0xbf, 0x0c, 0xa4, 0x55, 0x4c, 0x33, 0x0c, 0x2b, 0xb7, 0x04, 3230 0x2d, 0xb3, 0x51, 0x02, 0xf6, 0x8b, 0x1a, 0x00, 0x62, 0x58, 0x38, 0x65, 3231 0x38, 0x1c, 0x74, 0xdd, 0x91, 0x3a, 0xf7, 0x0b, 0x26, 0xcf, 0x09, 0x23, 3232 0xd0, 0xc4, 0xcb, 0x97, 0x16, 0x92, 0x22, 0x25, 0x52, 0xa8, 0xf4, 0xb7, 3233 0x88, 0xb4, 0xaf, 0xd1, 0x34, 0x1a, 0x9d, 0xf4, 0x15, 0xcf, 0x20, 0x39, 3234 0x00, 0xf5, 0xcc, 0xf7, 0xf6, 0x59, 0x88, 0x94, 0x9a, 0x75, 0x58, 0x0d, 3235 0x04, 0x96, 0x39, 0x85, 0x31, 0x00, 0x85, 0x4b, 0x21, 0xf4, 0x01, 0x80, 3236 0x03, 0x50, 0x2b, 0xb1, 0xba, 0x95, 0xf5, 0x56, 0xa5, 0xd6, 0x7c, 0x7e, 3237 0xb5, 0x24, 0x10, 0xeb, 0xa2, 0x88, 0xa6, 0xd0, 0x63, 0x5c, 0xa8, 0xa4, 3238 0xf6, 0xd6, 0x96, 0xd0, 0xa0, 0x20, 0xc8, 0x26, 0x93, 0x8d, 0x34, 0x94, 3239 0x3c, 0x38, 0x08, 0xc7, 0x9c, 0xc0, 0x07, 0x76, 0x85, 0x33, 0x21, 0x6b, 3240 0xc1, 0xb2, 0x9d, 0xa6, 0xc8, 0x12, 0xef, 0xf3, 0x34, 0x0b, 0xaa, 0x8d, 3241 0x2e, 0x65, 0x34, 0x4f, 0x09, 0xbd, 0x47, 0x89, 0x4f, 0x5a, 0x3a, 0x41, 3242 0x18, 0x71, 0x5b, 0x3c, 0x50, 0x20, 0x67, 0x93, 0x27, 0xf9, 0x18, 0x9f, 3243 0x7e, 0x10, 0x85, 0x6b, 0x23, 0x8b, 0xb9, 0xb0, 0xab, 0x4c, 0xa8, 0x5a, 3244 0xbf, 0x4b, 0x21, 0xf5, 0xc7, 0x6b, 0xcc, 0xd7, 0x18, 0x50, 0xb2, 0x2e, 3245 0x04, 0x59, 0x28, 0x27, 0x6a, 0x0f, 0x2e, 0x95, 0x1d, 0xb0, 0x70, 0x7c, 3246 0x6a, 0x11, 0x6d, 0xc1, 0x91, 0x13, 0xfa, 0x76, 0x2d, 0xc5, 0xf2, 0x0b, 3247 0xd5, 0xd2, 0xab, 0x5b, 0xe7, 0x17, 0x44, 0xdc, 0x9c, 0xbd, 0xb5, 0x1e, 3248 0xa7, 0x57, 0x96, 0x3a, 0xac, 0x56, 0xa9, 0x0a, 0x0d, 0x80, 0x23, 0xbe, 3249 0xd1, 0xf5, 0xca, 0xe8, 0xa6, 0x4d, 0xa0, 0x47, 0x27, 0x9b, 0x35, 0x3a, 3250 0x09, 0x6a, 0x83, 0x5b, 0x0b, 0x2b, 0x02, 0x3b, 0x6a, 0xa0, 0x48, 0x98, 3251 0x92, 0x33, 0x07, 0x9a, 0xeb, 0x46, 0x7e, 0x52, 0x2f, 0xa2, 0x7a, 0x58, 3252 0x22, 0x92, 0x1e, 0x5c, 0x55, 0x1b, 0x4f, 0x53, 0x75, 0x36, 0xe4, 0x6f, 3253 0x3a, 0x6a, 0x97, 0xe7, 0x2c, 0x3b, 0x06, 0x31, 0x04, 0xe0, 0x9a, 0x04, 3254 0x05, 0x98, 0x94, 0x0d, 0x87, 0x2f, 0x6d, 0x87, 0x1f, 0x5e, 0xf9, 0xb4, 3255 0x35, 0x50, 0x73, 0xb5, 0x47, 0x69, 0xe4, 0x54, 0x54, 0xe6, 0xa0, 0x81, 3256 0x95, 0x99, 0x40, 0x86, 0x21, 0xab, 0x44, 0x13, 0xb3, 0x55, 0x07, 0xb0, 3257 0xdf, 0x57, 0x8c, 0xe2, 0xd5, 0x11, 0xd5, 0x20, 0x58, 0xd5, 0x74, 0x9d, 3258 0xf3, 0x8b, 0x29, 0xd6, 0xcc, 0x58, 0x87, 0x0c, 0xaf, 0x92, 0xf6, 0x9a, 3259 0x75, 0x16, 0x14, 0x06, 0xe7, 0x1c, 0x5f, 0xf9, 0x24, 0x51, 0xa7, 0x75, 3260 0x22, 0xb8, 0xb2, 0x96, 0x7a, 0x2d, 0x58, 0xa4, 0x9a, 0x81, 0x66, 0x1a, 3261 0xa6, 0x5a, 0xc0, 0x9b, 0x08, 0xc9, 0xfe, 0x45, 0xab, 0xc3, 0x85, 0x1f, 3262 0x99, 0xc7, 0x30, 0xc4, 0x50, 0x03, 0xac, 0xa2, 0xbf, 0x0f, 0x84, 0x24, 3263 0xa1, 0x9b, 0x74, 0x08, 0xa5, 0x37, 0xd5, 0x41, 0xc1, 0x6f, 0x56, 0x82, 3264 0xbf, 0xe3, 0xa7, 0xfa, 0xea, 0x56, 0x4f, 0x12, 0x98, 0x61, 0x1a, 0x7f, 3265 0x5f, 0x60, 0x92, 0x2b, 0xa1, 0x9d, 0xe7, 0x3b, 0x19, 0x17, 0xf1, 0x85, 3266 0x32, 0x73, 0x55, 0x51, 0x99, 0xa6, 0x49, 0x31, 0x8b, 0x50, 0x77, 0x33, 3267 0x45, 0xc9, 0x97, 0x46, 0x08, 0x56, 0x97, 0x2a, 0xcb, 0x43, 0xfc, 0x81, 3268 0xab, 0x63, 0x21, 0xb1, 0xc3, 0x3c, 0x2b, 0xb5, 0x09, 0x8b, 0xd4, 0x89, 3269 0xd6, 0x96, 0xa0, 0xf7, 0x06, 0x79, 0xc1, 0x21, 0x38, 0x73, 0xd0, 0x8b, 3270 0xda, 0xd4, 0x28, 0x44, 0x92, 0x72, 0x16, 0x04, 0x72, 0x05, 0x63, 0x32, 3271 0x12, 0x31, 0x0e, 0xe9, 0xa0, 0x6c, 0xb1, 0x00, 0x16, 0xc8, 0x05, 0x50, 3272 0x3c, 0x34, 0x1a, 0x36, 0xd8, 0x7e, 0x56, 0x07, 0x2e, 0xab, 0xe2, 0x37, 3273 0x31, 0xe3, 0x4a, 0xf7, 0xe2, 0x32, 0x8f, 0x85, 0xcd, 0xb3, 0x70, 0xcc, 3274 0xaf, 0x00, 0x51, 0x5b, 0x64, 0xc9, 0xc5, 0x4b, 0xc8, 0x37, 0x57, 0x84, 3275 0x47, 0xaa, 0xcf, 0xae, 0xd5, 0x96, 0x9a, 0xa3, 0x51, 0xe7, 0xda, 0x4e, 3276 0xfa, 0x7b, 0x11, 0x5c, 0x4c, 0x51, 0xf4, 0xa6, 0x99, 0x77, 0x98, 0x50, 3277 0x29, 0x5c, 0xa7, 0x2d, 0x78, 0x1a, 0xd4, 0x1b, 0xc6, 0x80, 0x53, 0x2b, 3278 0x89, 0xe7, 0x10, 0xe2, 0x18, 0x9e, 0xb3, 0xc5, 0x08, 0x17, 0xba, 0x25, 3279 0x5c, 0x74, 0x74, 0xc9, 0x5c, 0xa9, 0x11, 0x0c, 0xc4, 0x3b, 0x8b, 0xa8, 3280 0xe6, 0x82, 0xc7, 0xfb, 0x7b, 0x0f, 0xdc, 0x26, 0x5c, 0x04, 0x83, 0xa6, 3281 0x5c, 0xa4, 0x51, 0x4e, 0xe4, 0xb8, 0x32, 0xaa, 0xc5, 0x80, 0x0c, 0x3b, 3282 0x08, 0xe7, 0x4f, 0x56, 0x39, 0x51, 0xc1, 0xfb, 0xb2, 0x10, 0x35, 0x3e, 3283 0xfa, 0x1a, 0xa8, 0x66, 0x85, 0x6b, 0xc1, 0xe0, 0x34, 0x73, 0x3b, 0x04, 3284 0x85, 0xda, 0xb1, 0xd0, 0x20, 0xc6, 0xbf, 0x76, 0x5f, 0xf6, 0x0b, 0x3b, 3285 0x80, 0x19, 0x84, 0xa9, 0x0c, 0x2f, 0xe9, 0x70, 0xbf, 0x1d, 0xe9, 0x70, 3286 0x04, 0xa6, 0xcf, 0x44, 0xb4, 0x98, 0x4a, 0xb5, 0x82, 0x58, 0xb4, 0xaf, 3287 0x71, 0x22, 0x1c, 0xd1, 0x75, 0x30, 0xa7, 0x00, 0xc3, 0x29, 0x59, 0xc9, 3288 0x43, 0x63, 0x44, 0xb5, 0x31, 0x6f, 0x09, 0xcc, 0xca, 0x70, 0x29, 0xa2, 3289 0x30, 0xd6, 0x39, 0xdc, 0xb0, 0x22, 0xd8, 0xba, 0x79, 0xba, 0x91, 0xcd, 3290 0x6a, 0xb1, 0x2a, 0xe1, 0x57, 0x9c, 0x50, 0xc7, 0xbb, 0x10, 0xe3, 0x03, 3291 0x01, 0xa6, 0x5c, 0xae, 0x31, 0x01, 0xd4, 0x0c, 0x7b, 0xa9, 0x27, 0xbb, 3292 0x55, 0x31, 0x48, 0xd1, 0x64, 0x70, 0x24, 0xd4, 0xa0, 0x6c, 0x81, 0x66, 3293 0xd0, 0xb0, 0xb8, 0x12, 0x69, 0xb7, 0xd5, 0xf4, 0xb3, 0x4f, 0xb0, 0x22, 3294 0xf6, 0x91, 0x52, 0xf5, 0x14, 0x00, 0x4a, 0x7c, 0x68, 0x53, 0x68, 0x55, 3295 0x23, 0x43, 0xbb, 0x60, 0x36, 0x0f, 0xbb, 0x99, 0x45, 0xed, 0xf4, 0x46, 3296 0xd3, 0x45, 0xbd, 0xca, 0xa7, 0x45, 0x5c, 0x74, 0xba, 0x0a, 0x55, 0x1e, 3297 0x18, 0x46, 0x20, 0xfe, 0xf9, 0x76, 0x88, 0x77, 0x3d, 0x50, 0xb6, 0x43, 3298 0x3c, 0xa7, 0xa7, 0xac, 0x5c, 0xb6, 0xb7, 0xf6, 0x71, 0xa1, 0x53, 0x76, 3299 0xe5, 0xa6, 0x74, 0x7a, 0x62, 0x3f, 0xa7, 0xbc, 0x66, 0x30, 0x37, 0x3f, 3300 0x5b, 0x1b, 0x51, 0x26, 0x90, 0xa6, 0x61, 0x37, 0x78, 0x70, 0xa6, 0x0a, 3301 0x7a, 0x18, 0x96, 0x83, 0xf9, 0xb0, 0xcf, 0x04, 0x66, 0xe1, 0xf7, 0x50, 3302 0x76, 0x26, 0x31, 0xc4, 0xab, 0x09, 0xf5, 0x05, 0xc4, 0x2d, 0xd2, 0x86, 3303 0x33, 0x56, 0x94, 0x72, 0x73, 0x54, 0x42, 0x85, 0x1e, 0x32, 0x16, 0x16, 3304 0xd4, 0x00, 0x98, 0x10, 0x77, 0x7b, 0x6b, 0xd4, 0x6f, 0xa7, 0x22, 0x44, 3305 0x61, 0xa5, 0xcc, 0x27, 0x40, 0x5d, 0xfb, 0xac, 0x0d, 0x39, 0xb0, 0x02, 3306 0xca, 0xb3, 0x34, 0x33, 0xf2, 0xa8, 0x6e, 0xb8, 0xce, 0x91, 0xc1, 0x34, 3307 0xa6, 0x38, 0x6f, 0x86, 0x0a, 0x19, 0x94, 0xeb, 0x4b, 0x68, 0x75, 0xa4, 3308 0x6d, 0x19, 0x55, 0x81, 0xd1, 0x73, 0x85, 0x4b, 0x53, 0xd2, 0x29, 0x3d, 3309 0xf3, 0xe9, 0xa8, 0x22, 0x75, 0x6c, 0xd8, 0xf2, 0x12, 0xb3, 0x25, 0xca, 3310 0x29, 0xb4, 0xf9, 0xf8, 0xcf, 0xba, 0xdf, 0x2e, 0x41, 0x86, 0x9a, 0xbf, 3311 0xba, 0xd1, 0x07, 0x38, 0xad, 0x04, 0xcc, 0x75, 0x2b, 0xc2, 0x0c, 0x39, 3312 0x47, 0x46, 0x85, 0x0e, 0x0c, 0x48, 0x47, 0xdb 3313 }; 3314 #endif 3315 3316 static struct keys_st { 3317 int type; 3318 const uint8_t *priv; 3319 const uint8_t *pub; 3320 /* If "name" is non-NULL, create via non-legacy _ex() API */ 3321 char *name; 3322 int privlen; 3323 int publen; 3324 } keys[] = { 3325 { EVP_PKEY_HMAC, 3326 (const uint8_t *)"0123456789", 3327 NULL, 3328 NULL, 10, 0 }, 3329 { EVP_PKEY_HMAC, (const uint8_t *)"", NULL, 3330 NULL, 0, 0 3331 #ifndef OPENSSL_NO_POLY1305 3332 }, 3333 { EVP_PKEY_POLY1305, 3334 (const uint8_t *)"01234567890123456789012345678901", 3335 NULL, 3336 NULL, 32, 0 3337 #endif 3338 #ifndef OPENSSL_NO_SIPHASH 3339 }, 3340 { EVP_PKEY_SIPHASH, 3341 (const uint8_t *)"0123456789012345", 3342 NULL, 3343 NULL, 16, 0 3344 #endif 3345 }, 3346 #ifndef OPENSSL_NO_ECX 3347 { EVP_PKEY_X25519, 3348 (const uint8_t *)"01234567890123456789012345678901", 3349 (const unsigned char *)"abcdefghijklmnopqrstuvwxyzabcdef", 3350 NULL, 32, 32 }, 3351 { EVP_PKEY_ED25519, 3352 (const uint8_t *)"01234567890123456789012345678901", 3353 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdef", 3354 NULL, 32, 32 }, 3355 { EVP_PKEY_X448, 3356 (const uint8_t *)"01234567890123456789012345678901234567890123456789012345", 3357 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd", 3358 NULL, 56, 56 }, 3359 { EVP_PKEY_ED448, 3360 (const uint8_t *)"012345678901234567890123456789012345678901234567890123456", 3361 (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde", 3362 NULL, 57, 57 }, 3363 #endif 3364 #ifndef OPENSSL_NO_ML_KEM 3365 { NID_undef, ml_kem_seed, ml_kem_512_pubkey, 3366 "ML-KEM-512", ML_KEM_SEED_BYTES, sizeof(ml_kem_512_pubkey) }, 3367 { NID_undef, ml_kem_seed, ml_kem_768_pubkey, 3368 "ML-KEM-768", ML_KEM_SEED_BYTES, sizeof(ml_kem_768_pubkey) }, 3369 { NID_undef, ml_kem_seed, ml_kem_1024_pubkey, 3370 "ML-KEM-1024", ML_KEM_SEED_BYTES, sizeof(ml_kem_1024_pubkey) }, 3371 #endif 3372 }; 3373 3374 #ifndef OPENSSL_NO_ML_KEM 3375 static int 3376 ml_kem_seed_to_priv(const char *alg, const unsigned char *seed, int seedlen, 3377 unsigned char **ret, size_t *retlen) 3378 { 3379 OSSL_PARAM parr[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; 3380 EVP_PKEY_CTX *ctx = NULL; 3381 EVP_PKEY *pkey = NULL; 3382 const OSSL_PARAM *p; 3383 OSSL_PARAM *params = NULL; 3384 int selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY; 3385 int ok = 0; 3386 3387 /* Import the seed to generate a key */ 3388 ctx = EVP_PKEY_CTX_new_from_name(testctx, alg, NULL); 3389 if (!TEST_ptr(ctx) 3390 || !TEST_int_gt(EVP_PKEY_fromdata_init(ctx), 0)) 3391 goto done; 3392 parr[0] = OSSL_PARAM_construct_octet_string( 3393 OSSL_PKEY_PARAM_ML_KEM_SEED, (unsigned char *)seed, seedlen); 3394 if (!TEST_int_gt(EVP_PKEY_fromdata(ctx, &pkey, selection, parr), 0)) 3395 goto done; 3396 3397 /* Export the key to get the encoded form */ 3398 if (!TEST_true(EVP_PKEY_todata(pkey, OSSL_KEYMGMT_SELECT_PRIVATE_KEY, ¶ms))) 3399 goto done; 3400 3401 p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY); 3402 if (!TEST_ptr(p) 3403 || !TEST_true(OSSL_PARAM_get_octet_string(p, (void **)ret, 0, retlen))) 3404 goto done; 3405 ok = 1; 3406 3407 done: 3408 EVP_PKEY_free(pkey); 3409 OSSL_PARAM_free(params); 3410 EVP_PKEY_CTX_free(ctx); 3411 return ok; 3412 } 3413 #endif 3414 3415 static int test_set_get_raw_keys_int(int tst, int pub, int uselibctx) 3416 { 3417 int ret = 0; 3418 uint8_t *buf = NULL; 3419 const uint8_t *in; 3420 uint8_t shortbuf[1]; 3421 size_t inlen, len = 0, shortlen = sizeof(shortbuf); 3422 EVP_PKEY *pkey = NULL; 3423 unsigned char *privalloc = NULL; 3424 const char *name; 3425 3426 /* Check if this algorithm supports public keys */ 3427 if (pub && keys[tst].pub == NULL) 3428 return 1; 3429 3430 name = keys[tst].name ? keys[tst].name : OBJ_nid2sn(keys[tst].type); 3431 3432 if (pub) { 3433 #ifndef OPENSSL_NO_EC 3434 inlen = keys[tst].publen; 3435 in = keys[tst].pub; 3436 if (uselibctx || keys[tst].name != NULL) { 3437 pkey = EVP_PKEY_new_raw_public_key_ex( 3438 testctx, 3439 name, 3440 NULL, 3441 in, 3442 inlen); 3443 } else { 3444 pkey = EVP_PKEY_new_raw_public_key(keys[tst].type, 3445 NULL, 3446 in, 3447 inlen); 3448 } 3449 #else 3450 return 1; 3451 #endif 3452 } else { 3453 inlen = keys[tst].privlen; 3454 in = keys[tst].priv; 3455 #ifndef OPENSSL_NO_ML_KEM 3456 if (in == ml_kem_seed) { 3457 if (!TEST_true(ml_kem_seed_to_priv(name, in, inlen, 3458 &privalloc, &inlen))) 3459 goto done; 3460 in = privalloc; 3461 } 3462 #endif 3463 if (uselibctx || keys[tst].name != NULL) { 3464 pkey = EVP_PKEY_new_raw_private_key_ex( 3465 testctx, 3466 name, 3467 NULL, 3468 in, 3469 inlen); 3470 } else { 3471 pkey = EVP_PKEY_new_raw_private_key(keys[tst].type, 3472 NULL, 3473 in, 3474 inlen); 3475 } 3476 } 3477 3478 if (!TEST_ptr(pkey) 3479 || !TEST_int_eq(EVP_PKEY_eq(pkey, pkey), 1) 3480 || (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, NULL, &len))) 3481 || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, NULL, &len))) 3482 || !TEST_true(len == inlen)) 3483 goto done; 3484 if (tst != 1) { 3485 /* 3486 * Test that supplying a buffer that is too small fails. Doesn't apply 3487 * to HMAC with a zero length key 3488 */ 3489 if ((!pub && !TEST_false(EVP_PKEY_get_raw_private_key(pkey, shortbuf, &shortlen))) 3490 || (pub && !TEST_false(EVP_PKEY_get_raw_public_key(pkey, shortbuf, &shortlen)))) 3491 goto done; 3492 } 3493 if (!TEST_ptr(buf = OPENSSL_zalloc(len <= 80 ? 80 : len))) 3494 goto done; 3495 if ((!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, buf, &len))) 3496 || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, buf, &len))) 3497 || !TEST_mem_eq(in, inlen, buf, len)) 3498 goto done; 3499 3500 ret = 1; 3501 done: 3502 OPENSSL_free(privalloc); 3503 OPENSSL_free(buf); 3504 EVP_PKEY_free(pkey); 3505 return ret; 3506 } 3507 3508 static int test_set_get_raw_keys(int tst) 3509 { 3510 return (nullprov != NULL || test_set_get_raw_keys_int(tst, 0, 0)) 3511 && test_set_get_raw_keys_int(tst, 0, 1) 3512 && (nullprov != NULL || test_set_get_raw_keys_int(tst, 1, 0)) 3513 && test_set_get_raw_keys_int(tst, 1, 1); 3514 } 3515 3516 #ifndef OPENSSL_NO_DEPRECATED_3_0 3517 static int pkey_custom_check(EVP_PKEY *pkey) 3518 { 3519 return 0xbeef; 3520 } 3521 3522 static int pkey_custom_pub_check(EVP_PKEY *pkey) 3523 { 3524 return 0xbeef; 3525 } 3526 3527 static int pkey_custom_param_check(EVP_PKEY *pkey) 3528 { 3529 return 0xbeef; 3530 } 3531 3532 static EVP_PKEY_METHOD *custom_pmeth; 3533 #endif 3534 3535 static int test_EVP_PKEY_check(int i) 3536 { 3537 int ret = 0; 3538 EVP_PKEY *pkey = NULL; 3539 EVP_PKEY_CTX *ctx = NULL; 3540 #ifndef OPENSSL_NO_DEPRECATED_3_0 3541 EVP_PKEY_CTX *ctx2 = NULL; 3542 #endif 3543 const APK_DATA *ak = &keycheckdata[i]; 3544 const unsigned char *input = ak->kder; 3545 size_t input_len = ak->size; 3546 int expected_id = ak->evptype; 3547 int expected_check = ak->check; 3548 int expected_pub_check = ak->pub_check; 3549 int expected_param_check = ak->param_check; 3550 int type = ak->type; 3551 3552 if (!TEST_ptr(pkey = load_example_key(ak->keytype, input, input_len))) 3553 goto done; 3554 if (type == 0 3555 && !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id)) 3556 goto done; 3557 3558 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) 3559 goto done; 3560 3561 if (!TEST_int_eq(EVP_PKEY_check(ctx), expected_check)) 3562 goto done; 3563 3564 if (!TEST_int_eq(EVP_PKEY_public_check(ctx), expected_pub_check)) 3565 goto done; 3566 3567 if (!TEST_int_eq(EVP_PKEY_param_check(ctx), expected_param_check)) 3568 goto done; 3569 3570 #ifndef OPENSSL_NO_DEPRECATED_3_0 3571 ctx2 = EVP_PKEY_CTX_new_id(0xdefaced, NULL); 3572 /* assign the pkey directly, as an internal test */ 3573 if (!EVP_PKEY_up_ref(pkey)) 3574 goto done; 3575 3576 ctx2->pkey = pkey; 3577 3578 if (!TEST_int_eq(EVP_PKEY_check(ctx2), 0xbeef)) 3579 goto done; 3580 3581 if (!TEST_int_eq(EVP_PKEY_public_check(ctx2), 0xbeef)) 3582 goto done; 3583 3584 if (!TEST_int_eq(EVP_PKEY_param_check(ctx2), 0xbeef)) 3585 goto done; 3586 #endif 3587 3588 ret = 1; 3589 3590 done: 3591 EVP_PKEY_CTX_free(ctx); 3592 #ifndef OPENSSL_NO_DEPRECATED_3_0 3593 EVP_PKEY_CTX_free(ctx2); 3594 #endif 3595 EVP_PKEY_free(pkey); 3596 return ret; 3597 } 3598 3599 #ifndef OPENSSL_NO_CMAC 3600 static int get_cmac_val(EVP_PKEY *pkey, unsigned char *mac) 3601 { 3602 EVP_MD_CTX *mdctx = EVP_MD_CTX_new(); 3603 const char msg[] = "Hello World"; 3604 size_t maclen = AES_BLOCK_SIZE; 3605 int ret = 1; 3606 3607 if (!TEST_ptr(mdctx) 3608 || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, NULL, testctx, 3609 testpropq, pkey, NULL)) 3610 || !TEST_true(EVP_DigestSignUpdate(mdctx, msg, sizeof(msg))) 3611 || !TEST_true(EVP_DigestSignFinal(mdctx, mac, &maclen)) 3612 || !TEST_size_t_eq(maclen, AES_BLOCK_SIZE)) 3613 ret = 0; 3614 3615 EVP_MD_CTX_free(mdctx); 3616 3617 return ret; 3618 } 3619 static int test_CMAC_keygen(void) 3620 { 3621 static unsigned char key[] = { 3622 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 3623 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 3624 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 3625 }; 3626 EVP_PKEY_CTX *kctx = NULL; 3627 int ret = 0; 3628 EVP_PKEY *pkey = NULL; 3629 unsigned char mac[AES_BLOCK_SIZE]; 3630 #if !defined(OPENSSL_NO_DEPRECATED_3_0) 3631 unsigned char mac2[AES_BLOCK_SIZE]; 3632 #endif 3633 3634 if (nullprov != NULL) 3635 return TEST_skip("Test does not support a non-default library context"); 3636 3637 /* 3638 * This is a legacy method for CMACs, but should still work. 3639 * This verifies that it works without an ENGINE. 3640 */ 3641 kctx = EVP_PKEY_CTX_new_id(EVP_PKEY_CMAC, NULL); 3642 3643 /* Test a CMAC key created using the "generated" method */ 3644 if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0) 3645 || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN, 3646 EVP_PKEY_CTRL_CIPHER, 3647 0, (void *)EVP_aes_256_cbc()), 3648 0) 3649 || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN, 3650 EVP_PKEY_CTRL_SET_MAC_KEY, 3651 sizeof(key), (void *)key), 3652 0) 3653 || !TEST_int_gt(EVP_PKEY_keygen(kctx, &pkey), 0) 3654 || !TEST_ptr(pkey) 3655 || !TEST_true(get_cmac_val(pkey, mac))) 3656 goto done; 3657 3658 #if !defined(OPENSSL_NO_DEPRECATED_3_0) 3659 EVP_PKEY_free(pkey); 3660 3661 /* 3662 * Test a CMAC key using the direct method, and compare with the mac 3663 * created above. 3664 */ 3665 pkey = EVP_PKEY_new_CMAC_key(NULL, key, sizeof(key), EVP_aes_256_cbc()); 3666 if (!TEST_ptr(pkey) 3667 || !TEST_true(get_cmac_val(pkey, mac2)) 3668 || !TEST_mem_eq(mac, sizeof(mac), mac2, sizeof(mac2))) 3669 goto done; 3670 #endif 3671 3672 ret = 1; 3673 3674 done: 3675 EVP_PKEY_free(pkey); 3676 EVP_PKEY_CTX_free(kctx); 3677 return ret; 3678 } 3679 #endif 3680 3681 static int test_HKDF(void) 3682 { 3683 EVP_PKEY_CTX *pctx; 3684 unsigned char out[20]; 3685 size_t outlen; 3686 int i, ret = 0; 3687 unsigned char salt[] = "0123456789"; 3688 unsigned char key[] = "012345678901234567890123456789"; 3689 unsigned char info[] = "infostring"; 3690 const unsigned char expected[] = { 3691 0xe5, 0x07, 0x70, 0x7f, 0xc6, 0x78, 0xd6, 0x54, 0x32, 0x5f, 0x7e, 0xc5, 3692 0x7b, 0x59, 0x3e, 0xd8, 0x03, 0x6b, 0xed, 0xca 3693 }; 3694 size_t expectedlen = sizeof(expected); 3695 3696 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) 3697 goto done; 3698 3699 /* We do this twice to test reuse of the EVP_PKEY_CTX */ 3700 for (i = 0; i < 2; i++) { 3701 outlen = sizeof(out); 3702 memset(out, 0, outlen); 3703 3704 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) 3705 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) 3706 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, 3707 sizeof(salt) - 1), 3708 0) 3709 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, 3710 sizeof(key) - 1), 3711 0) 3712 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, 3713 sizeof(info) - 1), 3714 0) 3715 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) 3716 || !TEST_mem_eq(out, outlen, expected, expectedlen)) 3717 goto done; 3718 } 3719 3720 ret = 1; 3721 3722 done: 3723 EVP_PKEY_CTX_free(pctx); 3724 3725 return ret; 3726 } 3727 3728 static int test_emptyikm_HKDF(void) 3729 { 3730 EVP_PKEY_CTX *pctx; 3731 unsigned char out[20]; 3732 size_t outlen; 3733 int ret = 0; 3734 unsigned char salt[] = "9876543210"; 3735 unsigned char key[] = ""; 3736 unsigned char info[] = "stringinfo"; 3737 const unsigned char expected[] = { 3738 0x68, 0x81, 0xa5, 0x3e, 0x5b, 0x9c, 0x7b, 0x6f, 0x2e, 0xec, 0xc8, 0x47, 3739 0x7c, 0xfa, 0x47, 0x35, 0x66, 0x82, 0x15, 0x30 3740 }; 3741 size_t expectedlen = sizeof(expected); 3742 3743 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) 3744 goto done; 3745 3746 outlen = sizeof(out); 3747 memset(out, 0, outlen); 3748 3749 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) 3750 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) 3751 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, 3752 sizeof(salt) - 1), 3753 0) 3754 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, 3755 sizeof(key) - 1), 3756 0) 3757 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, 3758 sizeof(info) - 1), 3759 0) 3760 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) 3761 || !TEST_mem_eq(out, outlen, expected, expectedlen)) 3762 goto done; 3763 3764 ret = 1; 3765 3766 done: 3767 EVP_PKEY_CTX_free(pctx); 3768 3769 return ret; 3770 } 3771 3772 static int test_empty_salt_info_HKDF(void) 3773 { 3774 EVP_PKEY_CTX *pctx; 3775 unsigned char out[20]; 3776 size_t outlen; 3777 int ret = 0; 3778 unsigned char salt[] = ""; 3779 unsigned char fake[] = "0123456789"; 3780 unsigned char key[] = "012345678901234567890123456789"; 3781 unsigned char info[] = ""; 3782 const unsigned char expected[] = { 3783 0x67, 0x12, 0xf9, 0x27, 0x8a, 0x8a, 0x3a, 0x8f, 0x7d, 0x2c, 0xa3, 0x6a, 3784 0xaa, 0xe9, 0xb3, 0xb9, 0x52, 0x5f, 0xe0, 0x06 3785 }; 3786 size_t expectedlen = sizeof(expected); 3787 3788 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) 3789 goto done; 3790 3791 outlen = sizeof(out); 3792 memset(out, 0, outlen); 3793 3794 if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) 3795 || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) 3796 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, fake, 3797 sizeof(fake) - 1), 3798 0) 3799 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, 3800 sizeof(salt) - 1), 3801 0) 3802 || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, 3803 sizeof(key) - 1), 3804 0) 3805 || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, 3806 sizeof(info) - 1), 3807 0) 3808 || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) 3809 || !TEST_mem_eq(out, outlen, expected, expectedlen)) 3810 goto done; 3811 3812 ret = 1; 3813 3814 done: 3815 EVP_PKEY_CTX_free(pctx); 3816 3817 return ret; 3818 } 3819 3820 #ifndef OPENSSL_NO_EC 3821 static int test_X509_PUBKEY_inplace(void) 3822 { 3823 int ret = 0; 3824 X509_PUBKEY *xp = X509_PUBKEY_new_ex(testctx, testpropq); 3825 const unsigned char *p = kExampleECPubKeyDER; 3826 size_t input_len = sizeof(kExampleECPubKeyDER); 3827 3828 if (!TEST_ptr(xp)) 3829 goto done; 3830 if (!TEST_ptr(d2i_X509_PUBKEY(&xp, &p, input_len))) 3831 goto done; 3832 3833 if (!TEST_ptr(X509_PUBKEY_get0(xp))) 3834 goto done; 3835 3836 p = kExampleBadECPubKeyDER; 3837 input_len = sizeof(kExampleBadECPubKeyDER); 3838 3839 if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, input_len))) 3840 goto done; 3841 3842 if (!TEST_true(X509_PUBKEY_get0(xp) == NULL)) 3843 goto done; 3844 3845 ret = 1; 3846 3847 done: 3848 X509_PUBKEY_free(xp); 3849 return ret; 3850 } 3851 3852 static int test_X509_PUBKEY_dup(void) 3853 { 3854 int ret = 0; 3855 X509_PUBKEY *xp = NULL, *xq = NULL; 3856 const unsigned char *p = kExampleECPubKeyDER; 3857 size_t input_len = sizeof(kExampleECPubKeyDER); 3858 3859 xp = X509_PUBKEY_new_ex(testctx, testpropq); 3860 if (!TEST_ptr(xp) 3861 || !TEST_ptr(d2i_X509_PUBKEY(&xp, &p, input_len)) 3862 || !TEST_ptr(xq = X509_PUBKEY_dup(xp)) 3863 || !TEST_ptr_ne(xp, xq)) 3864 goto done; 3865 3866 if (!TEST_ptr(X509_PUBKEY_get0(xq)) 3867 || !TEST_ptr(X509_PUBKEY_get0(xp)) 3868 || !TEST_ptr_ne(X509_PUBKEY_get0(xq), X509_PUBKEY_get0(xp))) 3869 goto done; 3870 3871 X509_PUBKEY_free(xq); 3872 xq = NULL; 3873 p = kExampleBadECPubKeyDER; 3874 input_len = sizeof(kExampleBadECPubKeyDER); 3875 3876 if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, input_len)) 3877 || !TEST_ptr(xq = X509_PUBKEY_dup(xp))) 3878 goto done; 3879 3880 X509_PUBKEY_free(xp); 3881 xp = NULL; 3882 if (!TEST_true(X509_PUBKEY_get0(xq) == NULL)) 3883 goto done; 3884 3885 ret = 1; 3886 3887 done: 3888 X509_PUBKEY_free(xp); 3889 X509_PUBKEY_free(xq); 3890 return ret; 3891 } 3892 #endif /* OPENSSL_NO_EC */ 3893 3894 /* Test getting and setting parameters on an EVP_PKEY_CTX */ 3895 static int test_EVP_PKEY_CTX_get_set_params(EVP_PKEY *pkey) 3896 { 3897 EVP_MD_CTX *mdctx = NULL; 3898 EVP_PKEY_CTX *ctx = NULL; 3899 const OSSL_PARAM *params; 3900 OSSL_PARAM ourparams[2], *param = ourparams, *param_md; 3901 int ret = 0; 3902 const EVP_MD *md; 3903 char mdname[OSSL_MAX_NAME_SIZE]; 3904 char ssl3ms[48]; 3905 3906 /* Initialise a sign operation */ 3907 ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq); 3908 if (!TEST_ptr(ctx) 3909 || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0)) 3910 goto err; 3911 3912 /* 3913 * We should be able to query the parameters now. 3914 */ 3915 params = EVP_PKEY_CTX_settable_params(ctx); 3916 if (!TEST_ptr(params) 3917 || !TEST_ptr(OSSL_PARAM_locate_const(params, 3918 OSSL_SIGNATURE_PARAM_DIGEST))) 3919 goto err; 3920 3921 params = EVP_PKEY_CTX_gettable_params(ctx); 3922 if (!TEST_ptr(params) 3923 || !TEST_ptr(OSSL_PARAM_locate_const(params, 3924 OSSL_SIGNATURE_PARAM_ALGORITHM_ID)) 3925 || !TEST_ptr(OSSL_PARAM_locate_const(params, 3926 OSSL_SIGNATURE_PARAM_DIGEST))) 3927 goto err; 3928 3929 /* 3930 * Test getting and setting params via EVP_PKEY_CTX_set_params() and 3931 * EVP_PKEY_CTX_get_params() 3932 */ 3933 strcpy(mdname, "SHA512"); 3934 param_md = param; 3935 *param++ = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, 3936 mdname, 0); 3937 *param++ = OSSL_PARAM_construct_end(); 3938 3939 if (!TEST_true(EVP_PKEY_CTX_set_params(ctx, ourparams))) 3940 goto err; 3941 3942 mdname[0] = '\0'; 3943 *param_md = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, 3944 mdname, sizeof(mdname)); 3945 if (!TEST_true(EVP_PKEY_CTX_get_params(ctx, ourparams)) 3946 || !TEST_str_eq(mdname, "SHA512")) 3947 goto err; 3948 3949 /* 3950 * Test the TEST_PKEY_CTX_set_signature_md() and 3951 * TEST_PKEY_CTX_get_signature_md() functions 3952 */ 3953 if (!TEST_int_gt(EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()), 0) 3954 || !TEST_int_gt(EVP_PKEY_CTX_get_signature_md(ctx, &md), 0) 3955 || !TEST_ptr_eq(md, EVP_sha256())) 3956 goto err; 3957 3958 /* 3959 * Test getting MD parameters via an associated EVP_PKEY_CTX 3960 */ 3961 mdctx = EVP_MD_CTX_new(); 3962 if (!TEST_ptr(mdctx) 3963 || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, "SHA1", testctx, testpropq, 3964 pkey, NULL))) 3965 goto err; 3966 3967 /* 3968 * We now have an EVP_MD_CTX with an EVP_PKEY_CTX inside it. We should be 3969 * able to obtain the digest's settable parameters from the provider. 3970 */ 3971 params = EVP_MD_CTX_settable_params(mdctx); 3972 if (!TEST_ptr(params) 3973 || !TEST_int_eq(strcmp(params[0].key, OSSL_DIGEST_PARAM_SSL3_MS), 0) 3974 /* The final key should be NULL */ 3975 || !TEST_ptr_null(params[1].key)) 3976 goto err; 3977 3978 param = ourparams; 3979 memset(ssl3ms, 0, sizeof(ssl3ms)); 3980 *param++ = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS, 3981 ssl3ms, sizeof(ssl3ms)); 3982 *param++ = OSSL_PARAM_construct_end(); 3983 3984 if (!TEST_true(EVP_MD_CTX_set_params(mdctx, ourparams))) 3985 goto err; 3986 3987 ret = 1; 3988 3989 err: 3990 EVP_MD_CTX_free(mdctx); 3991 EVP_PKEY_CTX_free(ctx); 3992 3993 return ret; 3994 } 3995 3996 #ifndef OPENSSL_NO_DSA 3997 static int test_DSA_get_set_params(void) 3998 { 3999 OSSL_PARAM_BLD *bld = NULL; 4000 OSSL_PARAM *params = NULL; 4001 BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL; 4002 EVP_PKEY_CTX *pctx = NULL; 4003 EVP_PKEY *pkey = NULL; 4004 int ret = 0; 4005 4006 /* 4007 * Setup the parameters for our DSA object. For our purposes they don't 4008 * have to actually be *valid* parameters. We just need to set something. 4009 */ 4010 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DSA", NULL)) 4011 || !TEST_ptr(bld = OSSL_PARAM_BLD_new()) 4012 || !TEST_ptr(p = BN_new()) 4013 || !TEST_ptr(q = BN_new()) 4014 || !TEST_ptr(g = BN_new()) 4015 || !TEST_ptr(pub = BN_new()) 4016 || !TEST_ptr(priv = BN_new())) 4017 goto err; 4018 if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 4019 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) 4020 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 4021 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, 4022 pub)) 4023 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, 4024 priv))) 4025 goto err; 4026 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) 4027 goto err; 4028 4029 if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) 4030 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, 4031 params), 4032 0)) 4033 goto err; 4034 4035 if (!TEST_ptr(pkey)) 4036 goto err; 4037 4038 ret = test_EVP_PKEY_CTX_get_set_params(pkey); 4039 4040 err: 4041 EVP_PKEY_free(pkey); 4042 EVP_PKEY_CTX_free(pctx); 4043 OSSL_PARAM_free(params); 4044 OSSL_PARAM_BLD_free(bld); 4045 BN_free(p); 4046 BN_free(q); 4047 BN_free(g); 4048 BN_free(pub); 4049 BN_free(priv); 4050 4051 return ret; 4052 } 4053 4054 /* 4055 * Test combinations of private, public, missing and private + public key 4056 * params to ensure they are all accepted 4057 */ 4058 static int test_DSA_priv_pub(void) 4059 { 4060 return test_EVP_PKEY_ffc_priv_pub("DSA"); 4061 } 4062 4063 #endif /* !OPENSSL_NO_DSA */ 4064 4065 static int test_RSA_get_set_params(void) 4066 { 4067 OSSL_PARAM_BLD *bld = NULL; 4068 OSSL_PARAM *params = NULL; 4069 BIGNUM *n = NULL, *e = NULL, *d = NULL; 4070 EVP_PKEY_CTX *pctx = NULL; 4071 EVP_PKEY *pkey = NULL; 4072 int ret = 0; 4073 4074 /* 4075 * Setup the parameters for our RSA object. For our purposes they don't 4076 * have to actually be *valid* parameters. We just need to set something. 4077 */ 4078 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL)) 4079 || !TEST_ptr(bld = OSSL_PARAM_BLD_new()) 4080 || !TEST_ptr(n = BN_new()) 4081 || !TEST_ptr(e = BN_new()) 4082 || !TEST_ptr(d = BN_new())) 4083 goto err; 4084 if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n)) 4085 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e)) 4086 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_D, d))) 4087 goto err; 4088 if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) 4089 goto err; 4090 4091 if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) 4092 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, 4093 params), 4094 0)) 4095 goto err; 4096 4097 if (!TEST_ptr(pkey)) 4098 goto err; 4099 4100 ret = test_EVP_PKEY_CTX_get_set_params(pkey); 4101 4102 err: 4103 EVP_PKEY_free(pkey); 4104 EVP_PKEY_CTX_free(pctx); 4105 OSSL_PARAM_free(params); 4106 OSSL_PARAM_BLD_free(bld); 4107 BN_free(n); 4108 BN_free(e); 4109 BN_free(d); 4110 4111 return ret; 4112 } 4113 4114 static int test_RSA_OAEP_set_get_params(void) 4115 { 4116 int ret = 0; 4117 EVP_PKEY *key = NULL; 4118 EVP_PKEY_CTX *key_ctx = NULL; 4119 4120 if (nullprov != NULL) 4121 return TEST_skip("Test does not support a non-default library context"); 4122 4123 if (!TEST_ptr(key = load_example_rsa_key()) 4124 || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(0, key, 0))) 4125 goto err; 4126 4127 { 4128 int padding = RSA_PKCS1_OAEP_PADDING; 4129 OSSL_PARAM params[4]; 4130 4131 params[0] = OSSL_PARAM_construct_int(OSSL_SIGNATURE_PARAM_PAD_MODE, &padding); 4132 params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, 4133 OSSL_DIGEST_NAME_SHA2_256, 0); 4134 params[2] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST, 4135 OSSL_DIGEST_NAME_SHA1, 0); 4136 params[3] = OSSL_PARAM_construct_end(); 4137 4138 if (!TEST_int_gt(EVP_PKEY_encrypt_init_ex(key_ctx, params), 0)) 4139 goto err; 4140 } 4141 { 4142 OSSL_PARAM params[3]; 4143 char oaepmd[30] = { '\0' }; 4144 char mgf1md[30] = { '\0' }; 4145 4146 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, 4147 oaepmd, sizeof(oaepmd)); 4148 params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST, 4149 mgf1md, sizeof(mgf1md)); 4150 params[2] = OSSL_PARAM_construct_end(); 4151 4152 if (!TEST_true(EVP_PKEY_CTX_get_params(key_ctx, params))) 4153 goto err; 4154 4155 if (!TEST_str_eq(oaepmd, OSSL_DIGEST_NAME_SHA2_256) 4156 || !TEST_str_eq(mgf1md, OSSL_DIGEST_NAME_SHA1)) 4157 goto err; 4158 } 4159 4160 ret = 1; 4161 4162 err: 4163 EVP_PKEY_free(key); 4164 EVP_PKEY_CTX_free(key_ctx); 4165 4166 return ret; 4167 } 4168 4169 /* https://github.com/openssl/openssl/issues/21288 */ 4170 static int test_RSA_OAEP_set_null_label(void) 4171 { 4172 int ret = 0; 4173 EVP_PKEY *key = NULL; 4174 EVP_PKEY_CTX *key_ctx = NULL; 4175 4176 if (!TEST_ptr(key = load_example_rsa_key()) 4177 || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, key, NULL)) 4178 || !TEST_true(EVP_PKEY_encrypt_init(key_ctx))) 4179 goto err; 4180 4181 if (!TEST_true(EVP_PKEY_CTX_set_rsa_padding(key_ctx, RSA_PKCS1_OAEP_PADDING))) 4182 goto err; 4183 4184 if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, OPENSSL_strdup("foo"), 0))) 4185 goto err; 4186 4187 if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, NULL, 0))) 4188 goto err; 4189 4190 ret = 1; 4191 4192 err: 4193 EVP_PKEY_free(key); 4194 EVP_PKEY_CTX_free(key_ctx); 4195 4196 return ret; 4197 } 4198 4199 static int test_RSA_verify_recover_rejects_short_buffer(void) 4200 { 4201 int ret = 0; 4202 int recovered_cap = 0; 4203 EVP_PKEY *pkey = NULL; 4204 EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL; 4205 unsigned char *sig = NULL, *recovered = NULL; 4206 size_t sig_len = 0, recovered_len = 0; 4207 unsigned long err = 0; 4208 unsigned char shortbuf[] = { 0xa5, 0x5a }; 4209 const unsigned char shortbuf_expected[] = { 0xa5, 0x5a }; 4210 unsigned char digest[32]; 4211 size_t i; 4212 4213 for (i = 0; i < sizeof(digest); i++) 4214 digest[i] = (unsigned char)i; 4215 4216 if (OSSL_PROVIDER_available(testctx, "fips")) 4217 return TEST_skip("Test skipped for FIPS provider"); 4218 4219 if (!TEST_ptr(pkey = load_example_rsa_key()) 4220 || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) 4221 || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0) 4222 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx, 4223 RSA_PKCS1_PADDING), 4224 0) 4225 || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(sign_ctx, EVP_sha256()), 4226 0) 4227 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, digest, 4228 sizeof(digest)), 4229 0) 4230 || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) 4231 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, digest, 4232 sizeof(digest)), 4233 0) 4234 || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0) 4235 || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap)) 4236 || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, 4237 NULL)) 4238 || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0) 4239 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx, 4240 RSA_PKCS1_PADDING), 4241 0) 4242 || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(verify_ctx, EVP_sha256()), 4243 0)) 4244 goto done; 4245 4246 recovered_len = (size_t)recovered_cap; 4247 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered, 4248 &recovered_len, sig, sig_len), 4249 0) 4250 || !TEST_size_t_eq(recovered_len, sizeof(digest)) 4251 || !TEST_mem_eq(recovered, recovered_len, digest, sizeof(digest))) 4252 goto done; 4253 4254 ERR_clear_error(); 4255 recovered_len = 1; 4256 if (!TEST_int_le(EVP_PKEY_verify_recover(verify_ctx, shortbuf, 4257 &recovered_len, sig, sig_len), 4258 0)) 4259 goto done; 4260 4261 err = ERR_peek_error(); 4262 if (!TEST_int_eq(ERR_GET_LIB(err), ERR_LIB_PROV) 4263 || !TEST_int_eq(ERR_GET_REASON(err), PROV_R_OUTPUT_BUFFER_TOO_SMALL) 4264 || !TEST_mem_eq(shortbuf, sizeof(shortbuf), shortbuf_expected, 4265 sizeof(shortbuf_expected))) 4266 goto done; 4267 4268 ret = 1; 4269 done: 4270 EVP_PKEY_CTX_free(sign_ctx); 4271 EVP_PKEY_CTX_free(verify_ctx); 4272 EVP_PKEY_free(pkey); 4273 OPENSSL_free(sig); 4274 OPENSSL_free(recovered); 4275 return ret; 4276 } 4277 4278 /* 4279 * A raw RSA PKCS#1 v1.5 signature whose recovered data is empty must be 4280 * recovered successfully with a length of zero, not rejected as an error. 4281 */ 4282 static int test_RSA_verify_recover_empty_payload(void) 4283 { 4284 int ret = 0; 4285 int recovered_cap = 0; 4286 EVP_PKEY *pkey = NULL; 4287 EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL; 4288 unsigned char *sig = NULL, *recovered = NULL; 4289 size_t sig_len = 0, recovered_len = 0; 4290 /* 4291 * The signed input has zero length, but a valid non-null address is still 4292 * passed so the result does not depend on how lower layers treat NULL for 4293 * zero-length data. 4294 */ 4295 const unsigned char empty[] = { 0 }; 4296 4297 if (OSSL_PROVIDER_available(testctx, "fips")) 4298 return TEST_skip("Test skipped for FIPS provider"); 4299 4300 if (!TEST_ptr(pkey = load_example_rsa_key()) 4301 || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) 4302 || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0) 4303 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx, RSA_PKCS1_PADDING), 0) 4304 /* 4305 * Deliberately do not configure a signature digest so that the raw 4306 * PKCS#1 v1.5 sign and verify-recover paths are exercised. 4307 */ 4308 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, empty, 0), 0) 4309 || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) 4310 || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, empty, 0), 0) 4311 || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0) 4312 || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap)) 4313 || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) 4314 || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0) 4315 || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx, RSA_PKCS1_PADDING), 4316 0)) 4317 goto done; 4318 4319 /* Size-query call must succeed. */ 4320 recovered_len = (size_t)recovered_cap; 4321 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, NULL, 4322 &recovered_len, sig, sig_len), 4323 0)) 4324 goto done; 4325 4326 /* 4327 * The actual recovery call is essential: a NULL output buffer would only 4328 * run the size-query path, which never decodes the signature and so would 4329 * not reproduce the regression. 4330 */ 4331 recovered_len = (size_t)recovered_cap; 4332 if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered, 4333 &recovered_len, sig, sig_len), 4334 0) 4335 || !TEST_size_t_eq(recovered_len, 0)) 4336 goto done; 4337 4338 ret = 1; 4339 done: 4340 EVP_PKEY_CTX_free(sign_ctx); 4341 EVP_PKEY_CTX_free(verify_ctx); 4342 EVP_PKEY_free(pkey); 4343 OPENSSL_free(sig); 4344 OPENSSL_free(recovered); 4345 return ret; 4346 } 4347 4348 static int test_RSA_encrypt(void) 4349 { 4350 int ret = 0; 4351 EVP_PKEY *pkey = NULL; 4352 EVP_PKEY_CTX *pctx = NULL; 4353 unsigned char *cbuf = NULL, *pbuf = NULL; 4354 size_t clen = 0, plen = 0; 4355 4356 if (!TEST_ptr(pkey = load_example_rsa_key()) 4357 || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx, 4358 pkey, testpropq)) 4359 || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0) 4360 || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0) 4361 || !TEST_ptr(cbuf = OPENSSL_malloc(clen)) 4362 || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0)) 4363 goto done; 4364 4365 /* Require failure when the output buffer is too small */ 4366 plen = clen - 1; 4367 if (!TEST_int_le(EVP_PKEY_encrypt(pctx, cbuf, &plen, kMsg, sizeof(kMsg)), 0)) 4368 goto done; 4369 /* flush error stack */ 4370 TEST_openssl_errors(); 4371 4372 /* Check decryption of encrypted result */ 4373 if (!TEST_int_gt(EVP_PKEY_decrypt_init(pctx), 0) 4374 || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0) 4375 || !TEST_ptr(pbuf = OPENSSL_malloc(plen)) 4376 || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0) 4377 || !TEST_mem_eq(pbuf, plen, kMsg, sizeof(kMsg)) 4378 || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0)) 4379 goto done; 4380 4381 ret = 1; 4382 done: 4383 EVP_PKEY_CTX_free(pctx); 4384 EVP_PKEY_free(pkey); 4385 OPENSSL_free(cbuf); 4386 OPENSSL_free(pbuf); 4387 return ret; 4388 } 4389 4390 #ifndef OPENSSL_NO_DEPRECATED_3_0 4391 static int test_RSA_legacy(void) 4392 { 4393 int ret = 0; 4394 BIGNUM *p = NULL; 4395 BIGNUM *q = NULL; 4396 BIGNUM *n = NULL; 4397 BIGNUM *e = NULL; 4398 BIGNUM *d = NULL; 4399 const EVP_MD *md = EVP_sha256(); 4400 EVP_MD_CTX *ctx = NULL; 4401 EVP_PKEY *pkey = NULL; 4402 RSA *rsa = NULL; 4403 4404 if (nullprov != NULL) 4405 return TEST_skip("Test does not support a non-default library context"); 4406 4407 if (!TEST_ptr(p = BN_dup(BN_value_one())) 4408 || !TEST_ptr(q = BN_dup(BN_value_one())) 4409 || !TEST_ptr(n = BN_dup(BN_value_one())) 4410 || !TEST_ptr(e = BN_dup(BN_value_one())) 4411 || !TEST_ptr(d = BN_dup(BN_value_one()))) 4412 goto err; 4413 4414 if (!TEST_ptr(rsa = RSA_new()) 4415 || !TEST_ptr(pkey = EVP_PKEY_new()) 4416 || !TEST_ptr(ctx = EVP_MD_CTX_new())) 4417 goto err; 4418 4419 if (!TEST_true(RSA_set0_factors(rsa, p, q))) 4420 goto err; 4421 p = NULL; 4422 q = NULL; 4423 4424 if (!TEST_true(RSA_set0_key(rsa, n, e, d))) 4425 goto err; 4426 n = NULL; 4427 e = NULL; 4428 d = NULL; 4429 4430 if (!TEST_true(EVP_PKEY_assign_RSA(pkey, rsa))) 4431 goto err; 4432 4433 rsa = NULL; 4434 4435 if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey))) 4436 goto err; 4437 4438 ret = 1; 4439 4440 err: 4441 RSA_free(rsa); 4442 EVP_MD_CTX_free(ctx); 4443 EVP_PKEY_free(pkey); 4444 BN_free(p); 4445 BN_free(q); 4446 BN_free(n); 4447 BN_free(e); 4448 BN_free(d); 4449 4450 return ret; 4451 } 4452 #endif 4453 4454 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) 4455 static int test_decrypt_null_chunks(void) 4456 { 4457 EVP_CIPHER_CTX *ctx = NULL; 4458 EVP_CIPHER *cipher = NULL; 4459 const unsigned char key[32] = { 4460 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 4461 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 4462 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1 4463 }; 4464 unsigned char iv[12] = { 4465 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b 4466 }; 4467 unsigned char msg[] = "It was the best of times, it was the worst of times"; 4468 unsigned char ciphertext[80]; 4469 unsigned char plaintext[80]; 4470 /* We initialise tmp to a non zero value on purpose */ 4471 int ctlen, ptlen, tmp = 99; 4472 int ret = 0; 4473 const int enc_offset = 10, dec_offset = 20; 4474 4475 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "ChaCha20-Poly1305", testpropq)) 4476 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 4477 || !TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, 4478 key, iv)) 4479 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &ctlen, msg, 4480 enc_offset)) 4481 /* Deliberate add a zero length update */ 4482 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp, NULL, 4483 0)) 4484 || !TEST_int_eq(tmp, 0) 4485 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp, 4486 msg + enc_offset, 4487 sizeof(msg) - enc_offset)) 4488 || !TEST_int_eq(ctlen += tmp, sizeof(msg)) 4489 || !TEST_true(EVP_EncryptFinal(ctx, ciphertext + ctlen, &tmp)) 4490 || !TEST_int_eq(tmp, 0)) 4491 goto err; 4492 4493 /* Deliberately initialise tmp to a non zero value */ 4494 tmp = 99; 4495 if (!TEST_true(EVP_DecryptInit_ex(ctx, cipher, NULL, key, iv)) 4496 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext, &ptlen, ciphertext, 4497 dec_offset)) 4498 /* 4499 * Deliberately add a zero length update. We also deliberately do 4500 * this at a different offset than for encryption. 4501 */ 4502 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp, NULL, 4503 0)) 4504 || !TEST_int_eq(tmp, 0) 4505 || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp, 4506 ciphertext + dec_offset, 4507 ctlen - dec_offset)) 4508 || !TEST_int_eq(ptlen += tmp, sizeof(msg)) 4509 || !TEST_true(EVP_DecryptFinal(ctx, plaintext + ptlen, &tmp)) 4510 || !TEST_int_eq(tmp, 0) 4511 || !TEST_mem_eq(msg, sizeof(msg), plaintext, ptlen)) 4512 goto err; 4513 4514 ret = 1; 4515 err: 4516 EVP_CIPHER_CTX_free(ctx); 4517 EVP_CIPHER_free(cipher); 4518 return ret; 4519 } 4520 #endif /* !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) */ 4521 4522 #ifndef OPENSSL_NO_DH 4523 /* 4524 * Test combinations of private, public, missing and private + public key 4525 * params to ensure they are all accepted 4526 */ 4527 static int test_DH_priv_pub(void) 4528 { 4529 return test_EVP_PKEY_ffc_priv_pub("DH"); 4530 } 4531 4532 #ifndef OPENSSL_NO_DEPRECATED_3_0 4533 static int test_EVP_PKEY_set1_DH(void) 4534 { 4535 DH *x942dh = NULL, *noqdh = NULL; 4536 EVP_PKEY *pkey1 = NULL, *pkey2 = NULL; 4537 int ret = 0; 4538 BIGNUM *p, *g = NULL; 4539 BIGNUM *pubkey = NULL; 4540 unsigned char pub[2048 / 8]; 4541 size_t len = 0; 4542 4543 if (!TEST_ptr(p = BN_new()) 4544 || !TEST_ptr(g = BN_new()) 4545 || !TEST_ptr(pubkey = BN_new()) 4546 || !TEST_true(BN_set_word(p, 9999)) 4547 || !TEST_true(BN_set_word(g, 2)) 4548 || !TEST_true(BN_set_word(pubkey, 4321)) 4549 || !TEST_ptr(noqdh = DH_new()) 4550 || !TEST_true(DH_set0_pqg(noqdh, p, NULL, g)) 4551 || !TEST_true(DH_set0_key(noqdh, pubkey, NULL)) 4552 || !TEST_ptr(pubkey = BN_new()) 4553 || !TEST_true(BN_set_word(pubkey, 4321))) 4554 goto err; 4555 p = g = NULL; 4556 4557 x942dh = DH_get_2048_256(); 4558 pkey1 = EVP_PKEY_new(); 4559 pkey2 = EVP_PKEY_new(); 4560 if (!TEST_ptr(x942dh) 4561 || !TEST_ptr(noqdh) 4562 || !TEST_ptr(pkey1) 4563 || !TEST_ptr(pkey2) 4564 || !TEST_true(DH_set0_key(x942dh, pubkey, NULL))) 4565 goto err; 4566 pubkey = NULL; 4567 4568 if (!TEST_true(EVP_PKEY_set1_DH(pkey1, x942dh)) 4569 || !TEST_int_eq(EVP_PKEY_get_id(pkey1), EVP_PKEY_DHX)) 4570 goto err; 4571 4572 if (!TEST_true(EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PUB_KEY, 4573 &pubkey)) 4574 || !TEST_ptr(pubkey)) 4575 goto err; 4576 4577 if (!TEST_true(EVP_PKEY_set1_DH(pkey2, noqdh)) 4578 || !TEST_int_eq(EVP_PKEY_get_id(pkey2), EVP_PKEY_DH)) 4579 goto err; 4580 4581 if (!TEST_true(EVP_PKEY_get_octet_string_param(pkey2, 4582 OSSL_PKEY_PARAM_PUB_KEY, 4583 pub, sizeof(pub), &len)) 4584 || !TEST_size_t_ne(len, 0)) 4585 goto err; 4586 4587 ret = 1; 4588 err: 4589 BN_free(p); 4590 BN_free(g); 4591 BN_free(pubkey); 4592 EVP_PKEY_free(pkey1); 4593 EVP_PKEY_free(pkey2); 4594 DH_free(x942dh); 4595 DH_free(noqdh); 4596 4597 return ret; 4598 } 4599 #endif /* !OPENSSL_NO_DEPRECATED_3_0 */ 4600 4601 /* Test that DHX (X9.42) rejects a malicious peer key during the 4602 * derivation phase (specifically EVP_PKEY_derive_set_peer) when the 4603 * remote 'q' does not match the local domain parameters but is still 4604 * consistent with the remote key share. 4605 * (CVE-2026-42770) 4606 */ 4607 static int test_dhx_derive_rejects_bad_peer_q(void) 4608 { 4609 int ret = 0; 4610 EVP_PKEY *local_key = NULL, *remote_key = NULL; 4611 EVP_PKEY_CTX *pctx = NULL, *derive_ctx = NULL; 4612 OSSL_PARAM_BLD *bld = NULL; 4613 OSSL_PARAM *params = NULL; 4614 4615 BIGNUM *p = NULL, *g = NULL; 4616 BIGNUM *q_valid = NULL, *pub_local = NULL, *priv_local = NULL; 4617 BIGNUM *q_bad = NULL, *pub_bad = NULL; 4618 4619 static const unsigned char bin_p[] = { 4620 0x87, 0xa8, 0xe6, 0x1d, 0xb4, 0xb6, 0x66, 0x3c, 4621 0xff, 0xbb, 0xd1, 0x9c, 0x65, 0x19, 0x59, 0x99, 4622 0x8c, 0xee, 0xf6, 0x08, 0x66, 0x0d, 0xd0, 0xf2, 4623 0x5d, 0x2c, 0xee, 0xd4, 0x43, 0x5e, 0x3b, 0x00, 4624 0xe0, 0x0d, 0xf8, 0xf1, 0xd6, 0x19, 0x57, 0xd4, 4625 0xfa, 0xf7, 0xdf, 0x45, 0x61, 0xb2, 0xaa, 0x30, 4626 0x16, 0xc3, 0xd9, 0x11, 0x34, 0x09, 0x6f, 0xaa, 4627 0x3b, 0xf4, 0x29, 0x6d, 0x83, 0x0e, 0x9a, 0x7c, 4628 0x20, 0x9e, 0x0c, 0x64, 0x97, 0x51, 0x7a, 0xbd, 4629 0x5a, 0x8a, 0x9d, 0x30, 0x6b, 0xcf, 0x67, 0xed, 4630 0x91, 0xf9, 0xe6, 0x72, 0x5b, 0x47, 0x58, 0xc0, 4631 0x22, 0xe0, 0xb1, 0xef, 0x42, 0x75, 0xbf, 0x7b, 4632 0x6c, 0x5b, 0xfc, 0x11, 0xd4, 0x5f, 0x90, 0x88, 4633 0xb9, 0x41, 0xf5, 0x4e, 0xb1, 0xe5, 0x9b, 0xb8, 4634 0xbc, 0x39, 0xa0, 0xbf, 0x12, 0x30, 0x7f, 0x5c, 4635 0x4f, 0xdb, 0x70, 0xc5, 0x81, 0xb2, 0x3f, 0x76, 4636 0xb6, 0x3a, 0xca, 0xe1, 0xca, 0xa6, 0xb7, 0x90, 4637 0x2d, 0x52, 0x52, 0x67, 0x35, 0x48, 0x8a, 0x0e, 4638 0xf1, 0x3c, 0x6d, 0x9a, 0x51, 0xbf, 0xa4, 0xab, 4639 0x3a, 0xd8, 0x34, 0x77, 0x96, 0x52, 0x4d, 0x8e, 4640 0xf6, 0xa1, 0x67, 0xb5, 0xa4, 0x18, 0x25, 0xd9, 4641 0x67, 0xe1, 0x44, 0xe5, 0x14, 0x05, 0x64, 0x25, 4642 0x1c, 0xca, 0xcb, 0x83, 0xe6, 0xb4, 0x86, 0xf6, 4643 0xb3, 0xca, 0x3f, 0x79, 0x71, 0x50, 0x60, 0x26, 4644 0xc0, 0xb8, 0x57, 0xf6, 0x89, 0x96, 0x28, 0x56, 4645 0xde, 0xd4, 0x01, 0x0a, 0xbd, 0x0b, 0xe6, 0x21, 4646 0xc3, 0xa3, 0x96, 0x0a, 0x54, 0xe7, 0x10, 0xc3, 4647 0x75, 0xf2, 0x63, 0x75, 0xd7, 0x01, 0x41, 0x03, 4648 0xa4, 0xb5, 0x43, 0x30, 0xc1, 0x98, 0xaf, 0x12, 4649 0x61, 0x16, 0xd2, 0x27, 0x6e, 0x11, 0x71, 0x5f, 4650 0x69, 0x38, 0x77, 0xfa, 0xd7, 0xef, 0x09, 0xca, 4651 0xdb, 0x09, 0x4a, 0xe9, 0x1e, 0x1a, 0x15, 0x97 4652 }; 4653 static const unsigned char bin_g[] = { 4654 0x3F, 0xB3, 0x2C, 0x9B, 0x73, 0x13, 0x4D, 0x0B, 4655 0x2E, 0x77, 0x50, 0x66, 0x60, 0xED, 0xBD, 0x48, 4656 0x4C, 0xA7, 0xB1, 0x8F, 0x21, 0xEF, 0x20, 0x54, 4657 0x07, 0xF4, 0x79, 0x3A, 0x1A, 0x0B, 0xA1, 0x25, 4658 0x10, 0xDB, 0xC1, 0x50, 0x77, 0xBE, 0x46, 0x3F, 4659 0xFF, 0x4F, 0xED, 0x4A, 0xAC, 0x0B, 0xB5, 0x55, 4660 0xBE, 0x3A, 0x6C, 0x1B, 0x0C, 0x6B, 0x47, 0xB1, 4661 0xBC, 0x37, 0x73, 0xBF, 0x7E, 0x8C, 0x6F, 0x62, 4662 0x90, 0x12, 0x28, 0xF8, 0xC2, 0x8C, 0xBB, 0x18, 4663 0xA5, 0x5A, 0xE3, 0x13, 0x41, 0x00, 0x0A, 0x65, 4664 0x01, 0x96, 0xF9, 0x31, 0xC7, 0x7A, 0x57, 0xF2, 4665 0xDD, 0xF4, 0x63, 0xE5, 0xE9, 0xEC, 0x14, 0x4B, 4666 0x77, 0x7D, 0xE6, 0x2A, 0xAA, 0xB8, 0xA8, 0x62, 4667 0x8A, 0xC3, 0x76, 0xD2, 0x82, 0xD6, 0xED, 0x38, 4668 0x64, 0xE6, 0x79, 0x82, 0x42, 0x8E, 0xBC, 0x83, 4669 0x1D, 0x14, 0x34, 0x8F, 0x6F, 0x2F, 0x91, 0x93, 4670 0xB5, 0x04, 0x5A, 0xF2, 0x76, 0x71, 0x64, 0xE1, 4671 0xDF, 0xC9, 0x67, 0xC1, 0xFB, 0x3F, 0x2E, 0x55, 4672 0xA4, 0xBD, 0x1B, 0xFF, 0xE8, 0x3B, 0x9C, 0x80, 4673 0xD0, 0x52, 0xB9, 0x85, 0xD1, 0x82, 0xEA, 0x0A, 4674 0xDB, 0x2A, 0x3B, 0x73, 0x13, 0xD3, 0xFE, 0x14, 4675 0xC8, 0x48, 0x4B, 0x1E, 0x05, 0x25, 0x88, 0xB9, 4676 0xB7, 0xD2, 0xBB, 0xD2, 0xDF, 0x01, 0x61, 0x99, 4677 0xEC, 0xD0, 0x6E, 0x15, 0x57, 0xCD, 0x09, 0x15, 4678 0xB3, 0x35, 0x3B, 0xBB, 0x64, 0xE0, 0xEC, 0x37, 4679 0x7F, 0xD0, 0x28, 0x37, 0x0D, 0xF9, 0x2B, 0x52, 4680 0xC7, 0x89, 0x14, 0x28, 0xCD, 0xC6, 0x7E, 0xB6, 4681 0x18, 0x4B, 0x52, 0x3D, 0x1D, 0xB2, 0x46, 0xC3, 4682 0x2F, 0x63, 0x07, 0x84, 0x90, 0xF0, 0x0E, 0xF8, 4683 0xD6, 0x47, 0xD1, 0x48, 0xD4, 0x79, 0x54, 0x51, 4684 0x5E, 0x23, 0x27, 0xCF, 0xEF, 0x98, 0xC5, 0x82, 4685 0x66, 0x4B, 0x4C, 0x0F, 0x6C, 0xC4, 0x16, 0x59 4686 }; 4687 4688 static const unsigned char bin_q_valid[] = { 4689 0x8C, 0xF8, 0x36, 0x42, 0xA7, 0x09, 0xA0, 0x97, 4690 0xB4, 0x47, 0x99, 0x76, 0x40, 0x12, 0x9D, 0xA2, 4691 0x99, 0xB1, 0xA4, 0x7D, 0x1E, 0xB3, 0x75, 0x0B, 4692 0xA3, 0x08, 0xB0, 0xFE, 0x64, 0xF5, 0xFB, 0xD3 4693 }; 4694 static const unsigned char bin_local_pub[] = { 4695 0x79, 0x6e, 0x15, 0x43, 0x14, 0x70, 0xac, 0x86, 4696 0xfa, 0x8a, 0x78, 0xb8, 0xbc, 0xdd, 0x1f, 0x35, 4697 0x89, 0xdb, 0xf1, 0x5f, 0xfe, 0x0e, 0x0a, 0x7a, 4698 0x41, 0xdd, 0x86, 0x40, 0x88, 0x7f, 0x3c, 0xc3, 4699 0xf0, 0x43, 0x9e, 0x28, 0x1f, 0x4c, 0xf3, 0x80, 4700 0x0b, 0xac, 0x2d, 0xbd, 0xfc, 0xda, 0x58, 0x9b, 4701 0x26, 0xcc, 0x82, 0x85, 0x12, 0x08, 0x5c, 0xe0, 4702 0xd3, 0xe5, 0x7a, 0xa1, 0x3c, 0xd9, 0xe7, 0xa4, 4703 0x66, 0xd8, 0x81, 0xba, 0xce, 0x91, 0xed, 0x10, 4704 0xc6, 0x06, 0x4a, 0xb3, 0x6e, 0x0d, 0x66, 0x36, 4705 0x7c, 0x4b, 0xfe, 0xd5, 0x6a, 0x9f, 0x90, 0x7e, 4706 0x4d, 0xae, 0xc1, 0x67, 0x32, 0xfb, 0x5c, 0x54, 4707 0x89, 0x1c, 0xb0, 0xd2, 0x62, 0x51, 0xfd, 0x61, 4708 0xc3, 0x20, 0x40, 0x77, 0x42, 0x46, 0xb3, 0xf8, 4709 0xbd, 0xcd, 0x5e, 0xf6, 0x0e, 0x68, 0x47, 0xcd, 4710 0xd6, 0x9b, 0xd6, 0xd3, 0x18, 0xd1, 0xcd, 0xa0, 4711 0xe8, 0xa3, 0x0a, 0x71, 0x6d, 0xe4, 0xdc, 0x1a, 4712 0x4e, 0xb9, 0x9b, 0x06, 0x86, 0xb7, 0x71, 0x20, 4713 0xc4, 0xb6, 0x9b, 0x00, 0x05, 0xf6, 0xa8, 0xc3, 4714 0xae, 0x76, 0x8d, 0x23, 0xc0, 0x8c, 0x85, 0xbd, 4715 0x1d, 0x58, 0xf4, 0x0d, 0xc0, 0x13, 0x8d, 0x62, 4716 0x77, 0x43, 0x61, 0x37, 0xae, 0x69, 0x77, 0x9f, 4717 0xdc, 0x21, 0x8c, 0x07, 0x1c, 0x14, 0x82, 0x6f, 4718 0x47, 0x15, 0x62, 0x03, 0x3e, 0x85, 0xff, 0xc9, 4719 0x9a, 0x21, 0x47, 0xd5, 0x39, 0xe2, 0x74, 0x13, 4720 0x6a, 0x4a, 0x1e, 0x7f, 0x1d, 0xb9, 0x75, 0x83, 4721 0xb5, 0x1d, 0xc0, 0x38, 0x5a, 0x52, 0xd7, 0x38, 4722 0x39, 0x63, 0x75, 0x8d, 0x89, 0x33, 0x98, 0xa8, 4723 0xd0, 0x13, 0xfd, 0xba, 0xd2, 0x0d, 0xdf, 0x30, 4724 0xfb, 0xe0, 0x5f, 0xbb, 0x22, 0x49, 0x91, 0x3a, 4725 0xe6, 0x75, 0x1b, 0x6b, 0x24, 0x6a, 0xe5, 0x62, 4726 0x2b, 0xa2, 0x6c, 0x48, 0x27, 0x41, 0x7c, 0x2d 4727 }; 4728 static const unsigned char bin_local_priv[] = { 4729 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 4730 0x99, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 4731 0x77, 0x88, 0x99, 0x00, 0x11, 0x22, 0x33, 0x44, 4732 0x55, 0x66, 0x77, 0x88, 0x99, 0x00, 0x11, 0x22 4733 }; 4734 4735 /* Remote malicious parameters */ 4736 static const unsigned char bin_remote_q[] = { 0x09, 0xf5 }; 4737 static const unsigned char bin_remote_pub[] = { 4738 0x54, 0xc0, 0x57, 0x90, 0x3d, 0x36, 0x22, 0x35, 4739 0xa6, 0x5c, 0x03, 0xf0, 0x01, 0xd8, 0xa3, 0xea, 4740 0x25, 0x28, 0x36, 0xb3, 0x58, 0x02, 0x50, 0xab, 4741 0xdc, 0x0a, 0x10, 0x83, 0x45, 0x1a, 0xf0, 0x12, 4742 0x6f, 0xd1, 0x50, 0xf9, 0xe8, 0xd2, 0x12, 0xb3, 4743 0x84, 0xae, 0x0c, 0x23, 0xaa, 0x7c, 0x67, 0xfe, 4744 0x85, 0x13, 0x68, 0x11, 0x4c, 0xcc, 0x06, 0x1a, 4745 0x66, 0x1e, 0x98, 0x6b, 0xd7, 0xe6, 0x3d, 0x25, 4746 0x75, 0x13, 0x33, 0x9a, 0x69, 0x14, 0xcb, 0xfa, 4747 0xb2, 0x09, 0xad, 0x79, 0x3e, 0xf2, 0x57, 0x04, 4748 0xcd, 0x53, 0x2d, 0xdf, 0xb7, 0xe6, 0x93, 0xde, 4749 0x70, 0x1d, 0x17, 0xe6, 0x29, 0xef, 0x3c, 0x18, 4750 0x4d, 0x40, 0xd5, 0xfe, 0xa1, 0xf9, 0xed, 0xb8, 4751 0x9c, 0x5b, 0xf8, 0xd7, 0xaa, 0x19, 0xe3, 0x37, 4752 0x4f, 0x80, 0x59, 0x32, 0x15, 0x9c, 0xa7, 0xb5, 4753 0xd5, 0x73, 0xb9, 0xe2, 0xf3, 0xc9, 0x4f, 0xe7, 4754 0x47, 0xc4, 0xa3, 0xb0, 0x9e, 0x31, 0xaf, 0xa3, 4755 0x78, 0x8d, 0x35, 0x83, 0x3a, 0xaf, 0x2a, 0xc8, 4756 0xae, 0x8b, 0xc4, 0x85, 0x00, 0x13, 0x14, 0x64, 4757 0xe7, 0x93, 0xa2, 0xe0, 0x35, 0x2e, 0x7c, 0x3e, 4758 0xd9, 0xda, 0x9f, 0xcf, 0x89, 0xb1, 0x21, 0xbc, 4759 0x1c, 0xee, 0x83, 0xc5, 0x44, 0x21, 0x4c, 0xeb, 4760 0x33, 0x38, 0xb1, 0x4a, 0xc6, 0x89, 0x19, 0x68, 4761 0x35, 0x17, 0x46, 0xea, 0xf6, 0x2b, 0xb5, 0x17, 4762 0xeb, 0x98, 0xfc, 0x63, 0x3d, 0x8d, 0x23, 0x5b, 4763 0xac, 0x37, 0xbc, 0x08, 0xe4, 0x7f, 0x18, 0x51, 4764 0xd0, 0x55, 0x01, 0x94, 0x9a, 0x67, 0x33, 0x96, 4765 0x5a, 0xdb, 0xfe, 0x8e, 0x43, 0xf7, 0xc3, 0xb9, 4766 0x3c, 0xa7, 0x51, 0x5c, 0xd6, 0xab, 0x36, 0xd7, 4767 0xef, 0x26, 0xbb, 0x0f, 0xd6, 0x03, 0x3a, 0xbc, 4768 0x39, 0x61, 0x3e, 0x88, 0x0f, 0xff, 0xc8, 0x72, 4769 0x9b, 0x03, 0xbf, 0xea, 0xdd, 0xf0, 0x88, 0x33 4770 }; 4771 4772 if (!TEST_ptr(p = BN_bin2bn(bin_p, sizeof(bin_p), NULL)) 4773 || !TEST_ptr(g = BN_bin2bn(bin_g, sizeof(bin_g), NULL))) 4774 goto err; 4775 4776 if (!TEST_ptr(q_valid = BN_bin2bn(bin_q_valid, sizeof(bin_q_valid), NULL)) 4777 || !TEST_ptr(pub_local 4778 = BN_bin2bn(bin_local_pub, sizeof(bin_local_pub), NULL)) 4779 || !TEST_true(priv_local 4780 = BN_bin2bn(bin_local_priv, sizeof(bin_local_priv), NULL))) 4781 goto err; 4782 4783 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 4784 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 4785 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_valid)) 4786 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 4787 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_local)) 4788 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv_local)) 4789 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) 4790 goto err; 4791 4792 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq)) 4793 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) 4794 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &local_key, EVP_PKEY_KEYPAIR, params), 0)) 4795 goto err; 4796 4797 OSSL_PARAM_free(params); 4798 OSSL_PARAM_BLD_free(bld); 4799 EVP_PKEY_CTX_free(pctx); 4800 params = NULL; 4801 bld = NULL; 4802 pctx = NULL; 4803 4804 if (!TEST_ptr(q_bad = BN_bin2bn(bin_remote_q, sizeof(bin_remote_q), NULL)) 4805 || !TEST_ptr(pub_bad 4806 = BN_bin2bn(bin_remote_pub, sizeof(bin_remote_pub), NULL))) 4807 goto err; 4808 4809 if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) 4810 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) 4811 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_bad)) 4812 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) 4813 || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_bad)) 4814 || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) 4815 goto err; 4816 4817 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq)) 4818 || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) 4819 || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &remote_key, EVP_PKEY_PUBLIC_KEY, params), 0)) 4820 goto err; 4821 4822 if (!TEST_ptr(derive_ctx = EVP_PKEY_CTX_new(local_key, NULL)) 4823 || !TEST_int_gt(EVP_PKEY_derive_init(derive_ctx), 0)) 4824 goto err; 4825 4826 /* reject the remote key share, even if it is self-consistent, correct 4827 * code needs to use local q, not remote-provided q. */ 4828 if (!TEST_int_le(EVP_PKEY_derive_set_peer(derive_ctx, remote_key), 0)) { 4829 TEST_error("EVP_PKEY_derive_set_peer incorrectly accepted a peer with malicious 'q'"); 4830 goto err; 4831 } 4832 4833 ret = 1; 4834 4835 err: 4836 BN_free(p); 4837 BN_free(g); 4838 BN_free(q_valid); 4839 BN_free(pub_local); 4840 BN_free(priv_local); 4841 BN_free(q_bad); 4842 BN_free(pub_bad); 4843 OSSL_PARAM_free(params); 4844 OSSL_PARAM_BLD_free(bld); 4845 EVP_PKEY_CTX_free(pctx); 4846 EVP_PKEY_CTX_free(derive_ctx); 4847 EVP_PKEY_free(local_key); 4848 EVP_PKEY_free(remote_key); 4849 return ret; 4850 } 4851 #endif /* !OPENSSL_NO_DH */ 4852 4853 /* 4854 * We test what happens with an empty template. For the sake of this test, 4855 * the template must be ignored, and we know that's the case for RSA keys 4856 * (this might arguably be a misfeature, but that's what we currently do, 4857 * even in provider code, since that's how the legacy RSA implementation 4858 * does things) 4859 */ 4860 static int test_keygen_with_empty_template(int n) 4861 { 4862 EVP_PKEY_CTX *ctx = NULL; 4863 EVP_PKEY *pkey = NULL; 4864 EVP_PKEY *tkey = NULL; 4865 int ret = 0; 4866 4867 if (nullprov != NULL) 4868 return TEST_skip("Test does not support a non-default library context"); 4869 4870 switch (n) { 4871 case 0: 4872 /* We do test with no template at all as well */ 4873 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL))) 4874 goto err; 4875 break; 4876 case 1: 4877 /* Here we create an empty RSA key that serves as our template */ 4878 if (!TEST_ptr(tkey = EVP_PKEY_new()) 4879 || !TEST_true(EVP_PKEY_set_type(tkey, EVP_PKEY_RSA)) 4880 || !TEST_ptr(ctx = EVP_PKEY_CTX_new(tkey, NULL))) 4881 goto err; 4882 break; 4883 } 4884 4885 if (!TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) 4886 || !TEST_int_gt(EVP_PKEY_keygen(ctx, &pkey), 0)) 4887 goto err; 4888 4889 ret = 1; 4890 err: 4891 EVP_PKEY_CTX_free(ctx); 4892 EVP_PKEY_free(pkey); 4893 EVP_PKEY_free(tkey); 4894 return ret; 4895 } 4896 4897 /* 4898 * Test that we fail if we attempt to use an algorithm that is not available 4899 * in the current library context (unless we are using an algorithm that 4900 * should be made available via legacy codepaths). 4901 * 4902 * 0: RSA 4903 * 1: SM2 4904 */ 4905 static int test_pkey_ctx_fail_without_provider(int tst) 4906 { 4907 OSSL_LIB_CTX *tmpctx = OSSL_LIB_CTX_new(); 4908 OSSL_PROVIDER *tmpnullprov = NULL; 4909 EVP_PKEY_CTX *pctx = NULL; 4910 const char *keytype = NULL; 4911 int expect_null = 0; 4912 int ret = 0; 4913 4914 if (!TEST_ptr(tmpctx)) 4915 goto err; 4916 4917 tmpnullprov = OSSL_PROVIDER_load(tmpctx, "null"); 4918 if (!TEST_ptr(tmpnullprov)) 4919 goto err; 4920 4921 /* 4922 * We check for certain algos in the null provider. 4923 * If an algo is expected to have a provider keymgmt, constructing an 4924 * EVP_PKEY_CTX is expected to fail (return NULL). 4925 * Otherwise, if it's expected to have legacy support, constructing an 4926 * EVP_PKEY_CTX is expected to succeed (return non-NULL). 4927 */ 4928 switch (tst) { 4929 case 0: 4930 keytype = "RSA"; 4931 expect_null = 1; 4932 break; 4933 case 1: 4934 keytype = "SM2"; 4935 expect_null = 1; 4936 #ifdef OPENSSL_NO_EC 4937 TEST_info("EC disable, skipping SM2 check..."); 4938 goto end; 4939 #endif 4940 #ifdef OPENSSL_NO_SM2 4941 TEST_info("SM2 disable, skipping SM2 check..."); 4942 goto end; 4943 #endif 4944 break; 4945 default: 4946 TEST_error("No test for case %d", tst); 4947 goto err; 4948 } 4949 4950 pctx = EVP_PKEY_CTX_new_from_name(tmpctx, keytype, ""); 4951 if (expect_null ? !TEST_ptr_null(pctx) : !TEST_ptr(pctx)) 4952 goto err; 4953 4954 #if defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_SM2) 4955 end: 4956 #endif 4957 ret = 1; 4958 4959 err: 4960 EVP_PKEY_CTX_free(pctx); 4961 OSSL_PROVIDER_unload(tmpnullprov); 4962 OSSL_LIB_CTX_free(tmpctx); 4963 return ret; 4964 } 4965 4966 static int test_rand_agglomeration(void) 4967 { 4968 EVP_RAND *rand; 4969 EVP_RAND_CTX *ctx; 4970 OSSL_PARAM params[3], *p = params; 4971 int res; 4972 unsigned int step = 7; 4973 static unsigned char seed[] = "It does not matter how slowly you go " 4974 "as long as you do not stop."; 4975 unsigned char out[sizeof(seed)]; 4976 4977 if (!TEST_int_ne(sizeof(seed) % step, 0) 4978 || !TEST_ptr(rand = EVP_RAND_fetch(testctx, "TEST-RAND", testpropq))) 4979 return 0; 4980 ctx = EVP_RAND_CTX_new(rand, NULL); 4981 EVP_RAND_free(rand); 4982 if (!TEST_ptr(ctx)) 4983 return 0; 4984 4985 memset(out, 0, sizeof(out)); 4986 *p++ = OSSL_PARAM_construct_octet_string(OSSL_RAND_PARAM_TEST_ENTROPY, 4987 seed, sizeof(seed)); 4988 *p++ = OSSL_PARAM_construct_uint(OSSL_RAND_PARAM_MAX_REQUEST, &step); 4989 *p = OSSL_PARAM_construct_end(); 4990 res = TEST_true(EVP_RAND_CTX_set_params(ctx, params)) 4991 && TEST_true(EVP_RAND_generate(ctx, out, sizeof(out), 0, 1, NULL, 0)) 4992 && TEST_mem_eq(seed, sizeof(seed), out, sizeof(out)); 4993 EVP_RAND_CTX_free(ctx); 4994 return res; 4995 } 4996 4997 /* 4998 * Test that we correctly return the original or "running" IV after 4999 * an encryption operation. 5000 * Run multiple times for some different relevant algorithms/modes. 5001 */ 5002 static int test_evp_iv_aes(int idx) 5003 { 5004 int ret = 0; 5005 EVP_CIPHER_CTX *ctx = NULL; 5006 unsigned char key[16] = { 5007 0x4c, 0x43, 0xdb, 0xdd, 0x42, 0x73, 0x47, 0xd1, 5008 0xe5, 0x62, 0x7d, 0xcd, 0x4d, 0x76, 0x4d, 0x57 5009 }; 5010 unsigned char init_iv[EVP_MAX_IV_LENGTH] = { 5011 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 5012 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 5013 }; 5014 static const unsigned char msg[] = { 5015 1, 2, 3, 4, 5, 6, 7, 8, 5016 9, 10, 11, 12, 13, 14, 15, 16 5017 }; 5018 unsigned char ciphertext[32], oiv[16], iv[16]; 5019 unsigned char *ref_iv; 5020 unsigned char cbc_state[16] = { 5021 0x10, 0x2f, 0x05, 0xcc, 0xc2, 0x55, 0x72, 0xb9, 5022 0x88, 0xe6, 0x4a, 0x17, 0x10, 0x74, 0x22, 0x5e 5023 }; 5024 5025 unsigned char ofb_state[16] = { 5026 0x76, 0xe6, 0x66, 0x61, 0xd0, 0x8a, 0xe4, 0x64, 5027 0xdd, 0x66, 0xbf, 0x00, 0xf0, 0xe3, 0x6f, 0xfd 5028 }; 5029 unsigned char cfb_state[16] = { 5030 0x77, 0xe4, 0x65, 0x65, 0xd5, 0x8c, 0xe3, 0x6c, 5031 0xd4, 0x6c, 0xb4, 0x0c, 0xfd, 0xed, 0x60, 0xed 5032 }; 5033 unsigned char gcm_state[12] = { 5034 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 5035 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81 5036 }; 5037 unsigned char ccm_state[7] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98 }; 5038 #ifndef OPENSSL_NO_OCB 5039 unsigned char ocb_state[12] = { 5040 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 5041 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81 5042 }; 5043 #endif 5044 int len = sizeof(ciphertext); 5045 size_t ivlen, ref_len; 5046 const EVP_CIPHER *type = NULL; 5047 int iv_reset = 0; 5048 5049 if (nullprov != NULL && idx < 6) 5050 return TEST_skip("Test does not support a non-default library context"); 5051 5052 switch (idx) { 5053 case 0: 5054 type = EVP_aes_128_cbc(); 5055 /* FALLTHROUGH */ 5056 case 6: 5057 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cbc", testpropq); 5058 ref_iv = cbc_state; 5059 ref_len = sizeof(cbc_state); 5060 iv_reset = 1; 5061 break; 5062 case 1: 5063 type = EVP_aes_128_ofb(); 5064 /* FALLTHROUGH */ 5065 case 7: 5066 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ofb", testpropq); 5067 ref_iv = ofb_state; 5068 ref_len = sizeof(ofb_state); 5069 iv_reset = 1; 5070 break; 5071 case 2: 5072 type = EVP_aes_128_cfb(); 5073 /* FALLTHROUGH */ 5074 case 8: 5075 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq); 5076 ref_iv = cfb_state; 5077 ref_len = sizeof(cfb_state); 5078 iv_reset = 1; 5079 break; 5080 case 3: 5081 type = EVP_aes_128_gcm(); 5082 /* FALLTHROUGH */ 5083 case 9: 5084 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-gcm", testpropq); 5085 ref_iv = gcm_state; 5086 ref_len = sizeof(gcm_state); 5087 break; 5088 case 4: 5089 type = EVP_aes_128_ccm(); 5090 /* FALLTHROUGH */ 5091 case 10: 5092 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ccm", testpropq); 5093 ref_iv = ccm_state; 5094 ref_len = sizeof(ccm_state); 5095 break; 5096 #ifdef OPENSSL_NO_OCB 5097 case 5: 5098 case 11: 5099 return 1; 5100 #else 5101 case 5: 5102 type = EVP_aes_128_ocb(); 5103 /* FALLTHROUGH */ 5104 case 11: 5105 type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ocb", testpropq); 5106 ref_iv = ocb_state; 5107 ref_len = sizeof(ocb_state); 5108 break; 5109 #endif 5110 default: 5111 return 0; 5112 } 5113 5114 if (!TEST_ptr(type) 5115 || !TEST_ptr((ctx = EVP_CIPHER_CTX_new())) 5116 || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, init_iv)) 5117 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg, 5118 (int)sizeof(msg))) 5119 || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv))) 5120 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))) 5121 || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len))) 5122 goto err; 5123 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); 5124 5125 if (!TEST_int_gt(ivlen, 0)) 5126 goto err; 5127 5128 if (!TEST_mem_eq(init_iv, ivlen, oiv, ivlen) 5129 || !TEST_mem_eq(ref_iv, ref_len, iv, ivlen)) 5130 goto err; 5131 5132 /* CBC, OFB, and CFB modes: the updated iv must be reset after reinit */ 5133 if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL)) 5134 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv)))) 5135 goto err; 5136 if (iv_reset) { 5137 if (!TEST_mem_eq(init_iv, ivlen, iv, ivlen)) 5138 goto err; 5139 } else { 5140 if (!TEST_mem_eq(ref_iv, ivlen, iv, ivlen)) 5141 goto err; 5142 } 5143 5144 ret = 1; 5145 err: 5146 EVP_CIPHER_CTX_free(ctx); 5147 if (idx >= 6) 5148 EVP_CIPHER_free((EVP_CIPHER *)type); 5149 return ret; 5150 } 5151 5152 #ifndef OPENSSL_NO_DES 5153 static int test_evp_iv_des(int idx) 5154 { 5155 int ret = 0; 5156 EVP_CIPHER_CTX *ctx = NULL; 5157 static const unsigned char key[24] = { 5158 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 5159 0xf1, 0xe0, 0xd3, 0xc2, 0xb5, 0xa4, 0x97, 0x86, 5160 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 5161 }; 5162 static const unsigned char init_iv[8] = { 5163 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 5164 }; 5165 static const unsigned char msg[] = { 5166 1, 2, 3, 4, 5, 6, 7, 8, 5167 9, 10, 11, 12, 13, 14, 15, 16 5168 }; 5169 unsigned char ciphertext[32], oiv[8], iv[8]; 5170 unsigned const char *ref_iv; 5171 static const unsigned char cbc_state_des[8] = { 5172 0x4f, 0xa3, 0x85, 0xcd, 0x8b, 0xf3, 0x06, 0x2a 5173 }; 5174 static const unsigned char cbc_state_3des[8] = { 5175 0x35, 0x27, 0x7d, 0x65, 0x6c, 0xfb, 0x50, 0xd9 5176 }; 5177 static const unsigned char ofb_state_des[8] = { 5178 0xa7, 0x0d, 0x1d, 0x45, 0xf9, 0x96, 0x3f, 0x2c 5179 }; 5180 static const unsigned char ofb_state_3des[8] = { 5181 0xab, 0x16, 0x24, 0xbb, 0x5b, 0xac, 0xed, 0x5e 5182 }; 5183 static const unsigned char cfb_state_des[8] = { 5184 0x91, 0xeb, 0x6d, 0x29, 0x4b, 0x08, 0xbd, 0x73 5185 }; 5186 static const unsigned char cfb_state_3des[8] = { 5187 0x34, 0xdd, 0xfb, 0x47, 0x33, 0x1c, 0x61, 0xf7 5188 }; 5189 int len = sizeof(ciphertext); 5190 size_t ivlen, ref_len; 5191 EVP_CIPHER *type = NULL; 5192 5193 if (lgcyprov == NULL && idx < 3) 5194 return TEST_skip("Test requires legacy provider to be loaded"); 5195 5196 switch (idx) { 5197 case 0: 5198 type = EVP_CIPHER_fetch(testctx, "des-cbc", testpropq); 5199 ref_iv = cbc_state_des; 5200 ref_len = sizeof(cbc_state_des); 5201 break; 5202 case 1: 5203 type = EVP_CIPHER_fetch(testctx, "des-ofb", testpropq); 5204 ref_iv = ofb_state_des; 5205 ref_len = sizeof(ofb_state_des); 5206 break; 5207 case 2: 5208 type = EVP_CIPHER_fetch(testctx, "des-cfb", testpropq); 5209 ref_iv = cfb_state_des; 5210 ref_len = sizeof(cfb_state_des); 5211 break; 5212 case 3: 5213 type = EVP_CIPHER_fetch(testctx, "des-ede3-cbc", testpropq); 5214 ref_iv = cbc_state_3des; 5215 ref_len = sizeof(cbc_state_3des); 5216 break; 5217 case 4: 5218 type = EVP_CIPHER_fetch(testctx, "des-ede3-ofb", testpropq); 5219 ref_iv = ofb_state_3des; 5220 ref_len = sizeof(ofb_state_3des); 5221 break; 5222 case 5: 5223 type = EVP_CIPHER_fetch(testctx, "des-ede3-cfb", testpropq); 5224 ref_iv = cfb_state_3des; 5225 ref_len = sizeof(cfb_state_3des); 5226 break; 5227 default: 5228 return 0; 5229 } 5230 5231 if (!TEST_ptr(type) 5232 || !TEST_ptr((ctx = EVP_CIPHER_CTX_new())) 5233 || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, init_iv)) 5234 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg, 5235 (int)sizeof(msg))) 5236 || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv))) 5237 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))) 5238 || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len))) 5239 goto err; 5240 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); 5241 5242 if (!TEST_int_gt(ivlen, 0)) 5243 goto err; 5244 5245 if (!TEST_mem_eq(init_iv, ivlen, oiv, ivlen) 5246 || !TEST_mem_eq(ref_iv, ref_len, iv, ivlen)) 5247 goto err; 5248 5249 if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL)) 5250 || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv)))) 5251 goto err; 5252 if (!TEST_mem_eq(init_iv, ivlen, iv, ivlen)) 5253 goto err; 5254 5255 ret = 1; 5256 err: 5257 EVP_CIPHER_CTX_free(ctx); 5258 EVP_CIPHER_free(type); 5259 return ret; 5260 } 5261 #endif 5262 5263 #ifndef OPENSSL_NO_BF 5264 static int test_evp_bf_default_keylen(int idx) 5265 { 5266 int ret = 0; 5267 static const char *algos[4] = { 5268 "bf-ecb", "bf-cbc", "bf-cfb", "bf-ofb" 5269 }; 5270 int ivlen[4] = { 0, 8, 8, 8 }; 5271 EVP_CIPHER *cipher = NULL; 5272 5273 if (lgcyprov == NULL) 5274 return TEST_skip("Test requires legacy provider to be loaded"); 5275 5276 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, algos[idx], testpropq)) 5277 || !TEST_int_eq(EVP_CIPHER_get_key_length(cipher), 16) 5278 || !TEST_int_eq(EVP_CIPHER_get_iv_length(cipher), ivlen[idx])) 5279 goto err; 5280 5281 ret = 1; 5282 err: 5283 EVP_CIPHER_free(cipher); 5284 return ret; 5285 } 5286 #endif 5287 5288 #ifndef OPENSSL_NO_EC 5289 static int ecpub_nids[] = { 5290 NID_brainpoolP256r1, NID_X9_62_prime256v1, 5291 NID_secp384r1, NID_secp521r1, 5292 #ifndef OPENSSL_NO_EC2M 5293 NID_sect233k1, NID_sect233r1, NID_sect283r1, 5294 NID_sect409k1, NID_sect409r1, NID_sect571k1, NID_sect571r1, 5295 #endif 5296 NID_brainpoolP384r1, NID_brainpoolP512r1 5297 }; 5298 5299 static int test_ecpub(int idx) 5300 { 5301 int ret = 0, len, savelen; 5302 int nid; 5303 unsigned char buf[1024]; 5304 unsigned char *p; 5305 EVP_PKEY *pkey = NULL; 5306 EVP_PKEY_CTX *ctx = NULL; 5307 #ifndef OPENSSL_NO_DEPRECATED_3_0 5308 const unsigned char *q; 5309 EVP_PKEY *pkey2 = NULL; 5310 EC_KEY *ec = NULL; 5311 #endif 5312 5313 if (nullprov != NULL) 5314 return TEST_skip("Test does not support a non-default library context"); 5315 5316 nid = ecpub_nids[idx]; 5317 5318 ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); 5319 if (!TEST_ptr(ctx) 5320 || !TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) 5321 || !TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid), 0) 5322 || !TEST_true(EVP_PKEY_keygen(ctx, &pkey))) 5323 goto done; 5324 len = i2d_PublicKey(pkey, NULL); 5325 savelen = len; 5326 if (!TEST_int_ge(len, 1) 5327 || !TEST_int_lt(len, 1024)) 5328 goto done; 5329 p = buf; 5330 len = i2d_PublicKey(pkey, &p); 5331 if (!TEST_int_ge(len, 1) 5332 || !TEST_int_eq(len, savelen)) 5333 goto done; 5334 5335 #ifndef OPENSSL_NO_DEPRECATED_3_0 5336 /* Now try to decode the just-created DER. */ 5337 q = buf; 5338 if (!TEST_ptr((pkey2 = EVP_PKEY_new())) 5339 || !TEST_ptr((ec = EC_KEY_new_by_curve_name(nid))) 5340 || !TEST_true(EVP_PKEY_assign_EC_KEY(pkey2, ec))) 5341 goto done; 5342 /* EC_KEY ownership transferred */ 5343 ec = NULL; 5344 if (!TEST_ptr(d2i_PublicKey(EVP_PKEY_EC, &pkey2, &q, savelen))) 5345 goto done; 5346 /* The keys should match. */ 5347 if (!TEST_int_eq(EVP_PKEY_eq(pkey, pkey2), 1)) 5348 goto done; 5349 #endif 5350 5351 ret = 1; 5352 5353 done: 5354 EVP_PKEY_CTX_free(ctx); 5355 EVP_PKEY_free(pkey); 5356 #ifndef OPENSSL_NO_DEPRECATED_3_0 5357 EVP_PKEY_free(pkey2); 5358 EC_KEY_free(ec); 5359 #endif 5360 return ret; 5361 } 5362 #endif 5363 5364 static int test_EVP_rsa_pss_with_keygen_bits(void) 5365 { 5366 int ret = 0; 5367 EVP_PKEY_CTX *ctx = NULL; 5368 EVP_PKEY *pkey = NULL; 5369 EVP_MD *md; 5370 5371 md = EVP_MD_fetch(testctx, "sha256", testpropq); 5372 ret = TEST_ptr(md) 5373 && TEST_ptr((ctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA-PSS", testpropq))) 5374 && TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) 5375 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 512), 0) 5376 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx, md), 0) 5377 && TEST_true(EVP_PKEY_keygen(ctx, &pkey)); 5378 5379 EVP_MD_free(md); 5380 EVP_PKEY_free(pkey); 5381 EVP_PKEY_CTX_free(ctx); 5382 return ret; 5383 } 5384 5385 static int test_EVP_rsa_pss_set_saltlen(void) 5386 { 5387 int ret = 0; 5388 EVP_PKEY *pkey = NULL; 5389 EVP_PKEY_CTX *pkey_ctx = NULL; 5390 EVP_MD *sha256 = NULL; 5391 EVP_MD_CTX *sha256_ctx = NULL; 5392 int saltlen = 9999; /* buggy EVP_PKEY_CTX_get_rsa_pss_saltlen() didn't update this */ 5393 const int test_value = 32; 5394 5395 ret = TEST_ptr(pkey = load_example_rsa_key()) 5396 && TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", NULL)) 5397 && TEST_ptr(sha256_ctx = EVP_MD_CTX_new()) 5398 && TEST_true(EVP_DigestSignInit(sha256_ctx, &pkey_ctx, sha256, NULL, pkey)) 5399 && TEST_true(EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING)) 5400 && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, test_value), 0) 5401 && TEST_int_gt(EVP_PKEY_CTX_get_rsa_pss_saltlen(pkey_ctx, &saltlen), 0) 5402 && TEST_int_eq(saltlen, test_value); 5403 5404 EVP_MD_CTX_free(sha256_ctx); 5405 EVP_PKEY_free(pkey); 5406 EVP_MD_free(sha256); 5407 5408 return ret; 5409 } 5410 5411 static int test_EVP_rsa_invalid_key(void) 5412 { 5413 int ret = 0; 5414 EVP_PKEY *pkey = NULL; 5415 5416 pkey = load_example_key("RSA", kInvalidRSAKeyDER, sizeof(kInvalidRSAKeyDER)); 5417 /* we expect to fail to load bogus key */ 5418 ret = !TEST_ptr(pkey); 5419 EVP_PKEY_free(pkey); 5420 5421 return ret; 5422 } 5423 5424 static int success = 1; 5425 static void md_names(const char *name, void *vctx) 5426 { 5427 OSSL_LIB_CTX *ctx = (OSSL_LIB_CTX *)vctx; 5428 /* Force a namemap update */ 5429 EVP_CIPHER *aes128 = EVP_CIPHER_fetch(ctx, "AES-128-CBC", NULL); 5430 5431 if (!TEST_ptr(aes128)) 5432 success = 0; 5433 5434 EVP_CIPHER_free(aes128); 5435 } 5436 5437 /* 5438 * Test that changing the namemap in a user callback works in a names_do_all 5439 * function. 5440 */ 5441 static int test_names_do_all(void) 5442 { 5443 /* We use a custom libctx so that we know the state of the namemap */ 5444 OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new(); 5445 EVP_MD *sha256 = NULL; 5446 int testresult = 0; 5447 5448 if (!TEST_ptr(ctx)) 5449 goto err; 5450 5451 sha256 = EVP_MD_fetch(ctx, "SHA2-256", NULL); 5452 if (!TEST_ptr(sha256)) 5453 goto err; 5454 5455 /* 5456 * We loop through all the names for a given digest. This should still work 5457 * even if the namemap changes part way through. 5458 */ 5459 if (!TEST_true(EVP_MD_names_do_all(sha256, md_names, ctx))) 5460 goto err; 5461 5462 if (!TEST_true(success)) 5463 goto err; 5464 5465 testresult = 1; 5466 err: 5467 EVP_MD_free(sha256); 5468 OSSL_LIB_CTX_free(ctx); 5469 return testresult; 5470 } 5471 5472 typedef struct { 5473 const char *cipher; 5474 const unsigned char *key; 5475 const unsigned char *iv; 5476 const unsigned char *input; 5477 const unsigned char *expected; 5478 const unsigned char *tag; 5479 size_t ivlen; /* 0 if we do not need to set a specific IV len */ 5480 size_t inlen; 5481 size_t expectedlen; 5482 size_t taglen; 5483 int keyfirst; 5484 int initenc; 5485 int finalenc; 5486 } EVP_INIT_TEST_st; 5487 5488 static const EVP_INIT_TEST_st evp_init_tests[] = { 5489 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext, 5490 cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext), 5491 0, 1, 0, 1 }, 5492 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext, 5493 gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV), 5494 sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext), 5495 sizeof(gcmDefaultTag), 1, 0, 1 }, 5496 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext, 5497 cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext), 5498 0, 0, 0, 1 }, 5499 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext, 5500 gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV), 5501 sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext), 5502 sizeof(gcmDefaultTag), 0, 0, 1 }, 5503 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext, 5504 cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext), 5505 0, 1, 1, 0 }, 5506 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext, 5507 gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV), 5508 sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext), 5509 sizeof(gcmDefaultTag), 1, 1, 0 }, 5510 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext, 5511 cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext), 5512 0, 0, 1, 0 }, 5513 { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext, 5514 gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV), 5515 sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext), 5516 sizeof(gcmDefaultTag), 0, 1, 0 } 5517 }; 5518 5519 /* use same key, iv and plaintext for cfb and ofb */ 5520 static const EVP_INIT_TEST_st evp_reinit_tests[] = { 5521 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial, 5522 cfbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial), 5523 sizeof(cfbCiphertext_partial), 0, 0, 1, 0 }, 5524 { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext_partial, 5525 cfbPlaintext_partial, NULL, 0, sizeof(cfbCiphertext_partial), 5526 sizeof(cfbPlaintext_partial), 0, 0, 0, 0 }, 5527 { "aes-128-ofb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial, 5528 ofbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial), 5529 sizeof(ofbCiphertext_partial), 0, 0, 1, 0 }, 5530 { "aes-128-ofb", kCFBDefaultKey, iCFBIV, ofbCiphertext_partial, 5531 cfbPlaintext_partial, NULL, 0, sizeof(ofbCiphertext_partial), 5532 sizeof(cfbPlaintext_partial), 0, 0, 0, 0 }, 5533 }; 5534 5535 static int evp_init_seq_set_iv(EVP_CIPHER_CTX *ctx, const EVP_INIT_TEST_st *t) 5536 { 5537 int res = 0; 5538 5539 if (t->ivlen != 0) { 5540 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen, NULL), 0)) 5541 goto err; 5542 } 5543 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv, -1))) 5544 goto err; 5545 res = 1; 5546 err: 5547 return res; 5548 } 5549 5550 /* 5551 * Test step-wise cipher initialization via EVP_CipherInit_ex where the 5552 * arguments are given one at a time and a final adjustment to the enc 5553 * parameter sets the correct operation. 5554 */ 5555 static int test_evp_init_seq(int idx) 5556 { 5557 int outlen1, outlen2; 5558 int testresult = 0; 5559 unsigned char outbuf[1024]; 5560 unsigned char tag[16]; 5561 const EVP_INIT_TEST_st *t = &evp_init_tests[idx]; 5562 EVP_CIPHER_CTX *ctx = NULL; 5563 EVP_CIPHER *type = NULL; 5564 size_t taglen = sizeof(tag); 5565 char *errmsg = NULL; 5566 5567 ctx = EVP_CIPHER_CTX_new(); 5568 if (ctx == NULL) { 5569 errmsg = "CTX_ALLOC"; 5570 goto err; 5571 } 5572 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq))) { 5573 errmsg = "CIPHER_FETCH"; 5574 goto err; 5575 } 5576 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, t->initenc))) { 5577 errmsg = "EMPTY_ENC_INIT"; 5578 goto err; 5579 } 5580 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { 5581 errmsg = "PADDING"; 5582 goto err; 5583 } 5584 if (t->keyfirst && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) { 5585 errmsg = "KEY_INIT (before iv)"; 5586 goto err; 5587 } 5588 if (!evp_init_seq_set_iv(ctx, t)) { 5589 errmsg = "IV_INIT"; 5590 goto err; 5591 } 5592 if (t->keyfirst == 0 && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) { 5593 errmsg = "KEY_INIT (after iv)"; 5594 goto err; 5595 } 5596 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, t->finalenc))) { 5597 errmsg = "FINAL_ENC_INIT"; 5598 goto err; 5599 } 5600 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) { 5601 errmsg = "CIPHER_UPDATE"; 5602 goto err; 5603 } 5604 if (t->finalenc == 0 && t->tag != NULL) { 5605 /* Set expected tag */ 5606 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 5607 t->taglen, (void *)t->tag), 5608 0)) { 5609 errmsg = "SET_TAG"; 5610 goto err; 5611 } 5612 } 5613 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5614 errmsg = "CIPHER_FINAL"; 5615 goto err; 5616 } 5617 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { 5618 errmsg = "WRONG_RESULT"; 5619 goto err; 5620 } 5621 if (t->finalenc != 0 && t->tag != NULL) { 5622 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) { 5623 errmsg = "GET_TAG"; 5624 goto err; 5625 } 5626 if (!TEST_mem_eq(t->tag, t->taglen, tag, taglen)) { 5627 errmsg = "TAG_ERROR"; 5628 goto err; 5629 } 5630 } 5631 testresult = 1; 5632 err: 5633 if (errmsg != NULL) 5634 TEST_info("evp_init_test %d: %s", idx, errmsg); 5635 EVP_CIPHER_CTX_free(ctx); 5636 EVP_CIPHER_free(type); 5637 return testresult; 5638 } 5639 5640 /* 5641 * Test re-initialization of cipher context without changing key or iv. 5642 * The result of both iteration should be the same. 5643 */ 5644 static int test_evp_reinit_seq(int idx) 5645 { 5646 int outlen1, outlen2, outlen_final; 5647 int testresult = 0; 5648 unsigned char outbuf1[1024]; 5649 unsigned char outbuf2[1024]; 5650 const EVP_INIT_TEST_st *t = &evp_reinit_tests[idx]; 5651 EVP_CIPHER_CTX *ctx = NULL; 5652 EVP_CIPHER *type = NULL; 5653 5654 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 5655 || !TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) 5656 /* setup cipher context */ 5657 || !TEST_true(EVP_CipherInit_ex2(ctx, type, t->key, t->iv, t->initenc, NULL)) 5658 /* first iteration */ 5659 || !TEST_true(EVP_CipherUpdate(ctx, outbuf1, &outlen1, t->input, t->inlen)) 5660 || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf1, &outlen_final)) 5661 /* check test results iteration 1 */ 5662 || !TEST_mem_eq(t->expected, t->expectedlen, outbuf1, outlen1 + outlen_final) 5663 /* now re-init the context (same cipher, key and iv) */ 5664 || !TEST_true(EVP_CipherInit_ex2(ctx, NULL, NULL, NULL, -1, NULL)) 5665 /* second iteration */ 5666 || !TEST_true(EVP_CipherUpdate(ctx, outbuf2, &outlen2, t->input, t->inlen)) 5667 || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf2, &outlen_final)) 5668 /* check test results iteration 2 */ 5669 || !TEST_mem_eq(t->expected, t->expectedlen, outbuf2, outlen2 + outlen_final)) 5670 goto err; 5671 testresult = 1; 5672 err: 5673 EVP_CIPHER_CTX_free(ctx); 5674 EVP_CIPHER_free(type); 5675 return testresult; 5676 } 5677 5678 typedef struct { 5679 const unsigned char *input; 5680 const unsigned char *expected; 5681 size_t inlen; 5682 size_t expectedlen; 5683 int enc; 5684 } EVP_RESET_TEST_st; 5685 5686 static const EVP_RESET_TEST_st evp_reset_tests[] = { 5687 { cfbPlaintext, cfbCiphertext, 5688 sizeof(cfbPlaintext), sizeof(cfbCiphertext), 1 }, 5689 { cfbCiphertext, cfbPlaintext, 5690 sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0 } 5691 }; 5692 5693 /* 5694 * Test a reset of a cipher via EVP_CipherInit_ex after the cipher has already 5695 * been used. 5696 */ 5697 static int test_evp_reset(int idx) 5698 { 5699 const EVP_RESET_TEST_st *t = &evp_reset_tests[idx]; 5700 int outlen1, outlen2; 5701 int testresult = 0; 5702 unsigned char outbuf[1024]; 5703 EVP_CIPHER_CTX *ctx = NULL; 5704 EVP_CIPHER *type = NULL; 5705 char *errmsg = NULL; 5706 5707 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { 5708 errmsg = "CTX_ALLOC"; 5709 goto err; 5710 } 5711 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq))) { 5712 errmsg = "CIPHER_FETCH"; 5713 goto err; 5714 } 5715 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) { 5716 errmsg = "CIPHER_INIT"; 5717 goto err; 5718 } 5719 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { 5720 errmsg = "PADDING"; 5721 goto err; 5722 } 5723 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) { 5724 errmsg = "CIPHER_UPDATE"; 5725 goto err; 5726 } 5727 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5728 errmsg = "CIPHER_FINAL"; 5729 goto err; 5730 } 5731 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { 5732 errmsg = "WRONG_RESULT"; 5733 goto err; 5734 } 5735 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, -1))) { 5736 errmsg = "CIPHER_REINIT"; 5737 goto err; 5738 } 5739 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, t->inlen))) { 5740 errmsg = "CIPHER_UPDATE (reinit)"; 5741 goto err; 5742 } 5743 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5744 errmsg = "CIPHER_FINAL (reinit)"; 5745 goto err; 5746 } 5747 if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { 5748 errmsg = "WRONG_RESULT (reinit)"; 5749 goto err; 5750 } 5751 testresult = 1; 5752 err: 5753 if (errmsg != NULL) 5754 TEST_info("test_evp_reset %d: %s", idx, errmsg); 5755 EVP_CIPHER_CTX_free(ctx); 5756 EVP_CIPHER_free(type); 5757 return testresult; 5758 } 5759 5760 typedef struct { 5761 const char *cipher; 5762 int enc; 5763 } EVP_UPDATED_IV_TEST_st; 5764 5765 static const EVP_UPDATED_IV_TEST_st evp_updated_iv_tests[] = { 5766 { "aes-128-cfb", 1 }, 5767 { "aes-128-cfb", 0 }, 5768 { "aes-128-cfb1", 1 }, 5769 { "aes-128-cfb1", 0 }, 5770 { "aes-128-cfb8", 1 }, 5771 { "aes-128-cfb8", 0 }, 5772 { "aes-128-ofb", 1 }, 5773 { "aes-128-ofb", 0 }, 5774 { "aes-128-ctr", 1 }, 5775 { "aes-128-ctr", 0 }, 5776 { "aes-128-cbc", 1 }, 5777 { "aes-128-cbc", 0 } 5778 }; 5779 5780 /* 5781 * Test that the IV in the context is updated during a crypto operation for CFB 5782 * and OFB. 5783 */ 5784 static int test_evp_updated_iv(int idx) 5785 { 5786 const EVP_UPDATED_IV_TEST_st *t = &evp_updated_iv_tests[idx]; 5787 int outlen1, outlen2; 5788 int testresult = 0; 5789 unsigned char outbuf[1024]; 5790 EVP_CIPHER_CTX *ctx = NULL; 5791 EVP_CIPHER *type = NULL; 5792 unsigned char updated_iv[EVP_MAX_IV_LENGTH]; 5793 int iv_len; 5794 char *errmsg = NULL; 5795 5796 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { 5797 errmsg = "CTX_ALLOC"; 5798 goto err; 5799 } 5800 if ((type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) == NULL) { 5801 TEST_info("cipher %s not supported, skipping", t->cipher); 5802 goto ok; 5803 } 5804 5805 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) { 5806 errmsg = "CIPHER_INIT"; 5807 goto err; 5808 } 5809 if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { 5810 errmsg = "PADDING"; 5811 goto err; 5812 } 5813 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, cfbPlaintext, sizeof(cfbPlaintext)))) { 5814 errmsg = "CIPHER_UPDATE"; 5815 goto err; 5816 } 5817 if (!TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, updated_iv, sizeof(updated_iv)))) { 5818 errmsg = "CIPHER_CTX_GET_UPDATED_IV"; 5819 goto err; 5820 } 5821 iv_len = EVP_CIPHER_CTX_get_iv_length(ctx); 5822 if (!TEST_int_ge(iv_len, 0)) { 5823 errmsg = "CIPHER_CTX_GET_IV_LEN"; 5824 goto err; 5825 } 5826 if (!TEST_mem_ne(iCFBIV, sizeof(iCFBIV), updated_iv, iv_len)) { 5827 errmsg = "IV_NOT_UPDATED"; 5828 goto err; 5829 } 5830 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5831 errmsg = "CIPHER_FINAL"; 5832 goto err; 5833 } 5834 ok: 5835 testresult = 1; 5836 err: 5837 if (errmsg != NULL) 5838 TEST_info("test_evp_updated_iv %d: %s", idx, errmsg); 5839 EVP_CIPHER_CTX_free(ctx); 5840 EVP_CIPHER_free(type); 5841 return testresult; 5842 } 5843 5844 typedef struct { 5845 const unsigned char *iv1; 5846 const unsigned char *iv2; 5847 const unsigned char *expected1; 5848 const unsigned char *expected2; 5849 const unsigned char *tag1; 5850 const unsigned char *tag2; 5851 size_t ivlen1; 5852 size_t ivlen2; 5853 size_t expectedlen1; 5854 size_t expectedlen2; 5855 } TEST_GCM_IV_REINIT_st; 5856 5857 static const TEST_GCM_IV_REINIT_st gcm_reinit_tests[] = { 5858 { iGCMResetIV1, iGCMResetIV2, gcmResetCiphertext1, gcmResetCiphertext2, 5859 gcmResetTag1, gcmResetTag2, sizeof(iGCMResetIV1), sizeof(iGCMResetIV2), 5860 sizeof(gcmResetCiphertext1), sizeof(gcmResetCiphertext2) }, 5861 { iGCMResetIV2, iGCMResetIV1, gcmResetCiphertext2, gcmResetCiphertext1, 5862 gcmResetTag2, gcmResetTag1, sizeof(iGCMResetIV2), sizeof(iGCMResetIV1), 5863 sizeof(gcmResetCiphertext2), sizeof(gcmResetCiphertext1) } 5864 }; 5865 5866 static int test_gcm_reinit(int idx) 5867 { 5868 int outlen1, outlen2, outlen3; 5869 int testresult = 0; 5870 unsigned char outbuf[1024]; 5871 unsigned char tag[16]; 5872 const TEST_GCM_IV_REINIT_st *t = &gcm_reinit_tests[idx]; 5873 EVP_CIPHER_CTX *ctx = NULL; 5874 EVP_CIPHER *type = NULL; 5875 size_t taglen = sizeof(tag); 5876 char *errmsg = NULL; 5877 5878 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { 5879 errmsg = "CTX_ALLOC"; 5880 goto err; 5881 } 5882 if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-256-gcm", testpropq))) { 5883 errmsg = "CIPHER_FETCH"; 5884 goto err; 5885 } 5886 if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, 1))) { 5887 errmsg = "ENC_INIT"; 5888 goto err; 5889 } 5890 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen1, NULL), 0)) { 5891 errmsg = "SET_IVLEN1"; 5892 goto err; 5893 } 5894 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, kGCMResetKey, t->iv1, 1))) { 5895 errmsg = "SET_IV1"; 5896 goto err; 5897 } 5898 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) { 5899 errmsg = "AAD1"; 5900 goto err; 5901 } 5902 EVP_CIPHER_CTX_set_padding(ctx, 0); 5903 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext, 5904 sizeof(gcmResetPlaintext)))) { 5905 errmsg = "CIPHER_UPDATE1"; 5906 goto err; 5907 } 5908 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5909 errmsg = "CIPHER_FINAL1"; 5910 goto err; 5911 } 5912 if (!TEST_mem_eq(t->expected1, t->expectedlen1, outbuf, outlen1 + outlen2)) { 5913 errmsg = "WRONG_RESULT1"; 5914 goto err; 5915 } 5916 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) { 5917 errmsg = "GET_TAG1"; 5918 goto err; 5919 } 5920 if (!TEST_mem_eq(t->tag1, taglen, tag, taglen)) { 5921 errmsg = "TAG_ERROR1"; 5922 goto err; 5923 } 5924 /* Now reinit */ 5925 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, t->ivlen2, NULL), 0)) { 5926 errmsg = "SET_IVLEN2"; 5927 goto err; 5928 } 5929 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv2, -1))) { 5930 errmsg = "SET_IV2"; 5931 goto err; 5932 } 5933 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) { 5934 errmsg = "AAD2"; 5935 goto err; 5936 } 5937 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext, 5938 sizeof(gcmResetPlaintext)))) { 5939 errmsg = "CIPHER_UPDATE2"; 5940 goto err; 5941 } 5942 if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { 5943 errmsg = "CIPHER_FINAL2"; 5944 goto err; 5945 } 5946 if (!TEST_mem_eq(t->expected2, t->expectedlen2, outbuf, outlen1 + outlen2)) { 5947 errmsg = "WRONG_RESULT2"; 5948 goto err; 5949 } 5950 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag), 0)) { 5951 errmsg = "GET_TAG2"; 5952 goto err; 5953 } 5954 if (!TEST_mem_eq(t->tag2, taglen, tag, taglen)) { 5955 errmsg = "TAG_ERROR2"; 5956 goto err; 5957 } 5958 testresult = 1; 5959 err: 5960 if (errmsg != NULL) 5961 TEST_info("evp_init_test %d: %s", idx, errmsg); 5962 EVP_CIPHER_CTX_free(ctx); 5963 EVP_CIPHER_free(type); 5964 return testresult; 5965 } 5966 5967 static const char *ivlen_change_ciphers[] = { 5968 "AES-256-GCM", 5969 #ifndef OPENSSL_NO_OCB 5970 "AES-256-OCB", 5971 #endif 5972 "AES-256-CCM" 5973 }; 5974 5975 /* Negative test for ivlen change after iv being set */ 5976 static int test_ivlen_change(int idx) 5977 { 5978 int outlen; 5979 int res = 0; 5980 unsigned char outbuf[1024]; 5981 static const unsigned char iv[] = { 5982 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 5983 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 5984 }; 5985 EVP_CIPHER_CTX *ctx = NULL; 5986 EVP_CIPHER *ciph = NULL; 5987 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; 5988 size_t ivlen = 13; /* non-default IV length */ 5989 5990 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) 5991 goto err; 5992 5993 if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, ivlen_change_ciphers[idx], 5994 testpropq))) 5995 goto err; 5996 5997 if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, kGCMDefaultKey, iv, 1))) 5998 goto err; 5999 6000 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, 6001 sizeof(gcmDefaultPlaintext)))) 6002 goto err; 6003 6004 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, 6005 &ivlen); 6006 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))) 6007 goto err; 6008 6009 ERR_set_mark(); 6010 if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, 6011 sizeof(gcmDefaultPlaintext)))) { 6012 ERR_clear_last_mark(); 6013 goto err; 6014 } 6015 ERR_pop_to_mark(); 6016 6017 res = 1; 6018 err: 6019 EVP_CIPHER_CTX_free(ctx); 6020 EVP_CIPHER_free(ciph); 6021 return res; 6022 } 6023 6024 static const char *keylen_change_ciphers[] = { 6025 #ifndef OPENSSL_NO_BF 6026 "BF-ECB", 6027 #endif 6028 #ifndef OPENSSL_NO_CAST 6029 "CAST5-ECB", 6030 #endif 6031 #ifndef OPENSSL_NO_RC2 6032 "RC2-ECB", 6033 #endif 6034 #ifndef OPENSSL_NO_RC4 6035 "RC4", 6036 #endif 6037 #ifndef OPENSSL_NO_RC5 6038 "RC5-ECB", 6039 #endif 6040 NULL 6041 }; 6042 6043 /* Negative test for keylen change after key was set */ 6044 static int test_keylen_change(int idx) 6045 { 6046 int outlen; 6047 int res = 0; 6048 unsigned char outbuf[1024]; 6049 static const unsigned char key[] = { 6050 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 6051 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 6052 }; 6053 EVP_CIPHER_CTX *ctx = NULL; 6054 EVP_CIPHER *ciph = NULL; 6055 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; 6056 size_t keylen = 12; /* non-default key length */ 6057 6058 if (lgcyprov == NULL) 6059 return TEST_skip("Test requires legacy provider to be loaded"); 6060 6061 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) 6062 goto err; 6063 6064 if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, keylen_change_ciphers[idx], 6065 testpropq))) 6066 goto err; 6067 6068 if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, key, NULL, 1))) 6069 goto err; 6070 6071 if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, 6072 sizeof(gcmDefaultPlaintext)))) 6073 goto err; 6074 6075 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, 6076 &keylen); 6077 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))) 6078 goto err; 6079 6080 ERR_set_mark(); 6081 if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, 6082 sizeof(gcmDefaultPlaintext)))) { 6083 ERR_clear_last_mark(); 6084 goto err; 6085 } 6086 ERR_pop_to_mark(); 6087 6088 res = 1; 6089 err: 6090 EVP_CIPHER_CTX_free(ctx); 6091 EVP_CIPHER_free(ciph); 6092 return res; 6093 } 6094 6095 #ifndef OPENSSL_NO_DEPRECATED_3_0 6096 static EVP_PKEY_METHOD *custom_pmeth = NULL; 6097 static const EVP_PKEY_METHOD *orig_pmeth = NULL; 6098 6099 #define EVP_PKEY_CTRL_MY_COMMAND 9999 6100 6101 static int custom_pmeth_init(EVP_PKEY_CTX *ctx) 6102 { 6103 int (*pinit)(EVP_PKEY_CTX *ctx); 6104 6105 EVP_PKEY_meth_get_init(orig_pmeth, &pinit); 6106 return pinit(ctx); 6107 } 6108 6109 static void custom_pmeth_cleanup(EVP_PKEY_CTX *ctx) 6110 { 6111 void (*pcleanup)(EVP_PKEY_CTX *ctx); 6112 6113 EVP_PKEY_meth_get_cleanup(orig_pmeth, &pcleanup); 6114 pcleanup(ctx); 6115 } 6116 6117 static int custom_pmeth_sign(EVP_PKEY_CTX *ctx, unsigned char *out, 6118 size_t *outlen, const unsigned char *in, 6119 size_t inlen) 6120 { 6121 int (*psign)(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen, 6122 const unsigned char *tbs, size_t tbslen); 6123 6124 EVP_PKEY_meth_get_sign(orig_pmeth, NULL, &psign); 6125 return psign(ctx, out, outlen, in, inlen); 6126 } 6127 6128 static int custom_pmeth_digestsign(EVP_MD_CTX *ctx, unsigned char *sig, 6129 size_t *siglen, const unsigned char *tbs, 6130 size_t tbslen) 6131 { 6132 int (*pdigestsign)(EVP_MD_CTX *ctx, unsigned char *sig, size_t *siglen, 6133 const unsigned char *tbs, size_t tbslen); 6134 6135 EVP_PKEY_meth_get_digestsign(orig_pmeth, &pdigestsign); 6136 return pdigestsign(ctx, sig, siglen, tbs, tbslen); 6137 } 6138 6139 static int custom_pmeth_derive(EVP_PKEY_CTX *ctx, unsigned char *key, 6140 size_t *keylen) 6141 { 6142 int (*pderive)(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen); 6143 6144 EVP_PKEY_meth_get_derive(orig_pmeth, NULL, &pderive); 6145 return pderive(ctx, key, keylen); 6146 } 6147 6148 static int custom_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) 6149 { 6150 int (*pcopy)(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src); 6151 6152 EVP_PKEY_meth_get_copy(orig_pmeth, &pcopy); 6153 return pcopy(dst, src); 6154 } 6155 6156 static int ctrl_called; 6157 6158 static int custom_pmeth_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) 6159 { 6160 int (*pctrl)(EVP_PKEY_CTX *ctx, int type, int p1, void *p2); 6161 6162 EVP_PKEY_meth_get_ctrl(orig_pmeth, &pctrl, NULL); 6163 6164 if (type == EVP_PKEY_CTRL_MY_COMMAND) { 6165 ctrl_called = 1; 6166 return 1; 6167 } 6168 6169 return pctrl(ctx, type, p1, p2); 6170 } 6171 6172 static int test_custom_pmeth(int idx) 6173 { 6174 EVP_PKEY_CTX *pctx = NULL; 6175 EVP_MD_CTX *ctx = NULL; 6176 EVP_PKEY *pkey = NULL; 6177 int id, orig_id, orig_flags; 6178 int testresult = 0; 6179 size_t reslen; 6180 unsigned char *res = NULL; 6181 unsigned char msg[] = { 'H', 'e', 'l', 'l', 'o' }; 6182 const EVP_MD *md = EVP_sha256(); 6183 int doderive = 0; 6184 6185 ctrl_called = 0; 6186 6187 /* We call deprecated APIs so this test doesn't support a custom libctx */ 6188 if (testctx != NULL) 6189 return 1; 6190 6191 switch (idx) { 6192 case 0: 6193 case 6: 6194 id = EVP_PKEY_RSA; 6195 pkey = load_example_rsa_key(); 6196 break; 6197 case 1: 6198 case 7: 6199 #ifndef OPENSSL_NO_DSA 6200 id = EVP_PKEY_DSA; 6201 pkey = load_example_dsa_key(); 6202 break; 6203 #else 6204 return 1; 6205 #endif 6206 case 2: 6207 case 8: 6208 #ifndef OPENSSL_NO_EC 6209 id = EVP_PKEY_EC; 6210 pkey = load_example_ec_key(); 6211 break; 6212 #else 6213 return 1; 6214 #endif 6215 case 3: 6216 case 9: 6217 #ifndef OPENSSL_NO_ECX 6218 id = EVP_PKEY_ED25519; 6219 md = NULL; 6220 pkey = load_example_ed25519_key(); 6221 break; 6222 #else 6223 return 1; 6224 #endif 6225 case 4: 6226 case 10: 6227 #ifndef OPENSSL_NO_DH 6228 id = EVP_PKEY_DH; 6229 doderive = 1; 6230 pkey = load_example_dh_key(); 6231 break; 6232 #else 6233 return 1; 6234 #endif 6235 case 5: 6236 case 11: 6237 #ifndef OPENSSL_NO_ECX 6238 id = EVP_PKEY_X25519; 6239 doderive = 1; 6240 pkey = load_example_x25519_key(); 6241 break; 6242 #else 6243 return 1; 6244 #endif 6245 default: 6246 TEST_error("Should not happen"); 6247 goto err; 6248 } 6249 6250 if (!TEST_ptr(pkey)) 6251 goto err; 6252 6253 if (idx < 6) { 6254 if (!TEST_true(evp_pkey_is_provided(pkey))) 6255 goto err; 6256 } else { 6257 EVP_PKEY *tmp = pkey; 6258 6259 /* Convert to a legacy key */ 6260 pkey = EVP_PKEY_new(); 6261 if (!TEST_ptr(pkey)) { 6262 pkey = tmp; 6263 goto err; 6264 } 6265 if (!TEST_true(evp_pkey_copy_downgraded(&pkey, tmp))) { 6266 EVP_PKEY_free(tmp); 6267 goto err; 6268 } 6269 EVP_PKEY_free(tmp); 6270 if (!TEST_true(evp_pkey_is_legacy(pkey))) 6271 goto err; 6272 } 6273 6274 if (!TEST_ptr(orig_pmeth = EVP_PKEY_meth_find(id)) 6275 || !TEST_ptr(pkey)) 6276 goto err; 6277 6278 EVP_PKEY_meth_get0_info(&orig_id, &orig_flags, orig_pmeth); 6279 if (!TEST_int_eq(orig_id, id) 6280 || !TEST_ptr(custom_pmeth = EVP_PKEY_meth_new(id, orig_flags))) 6281 goto err; 6282 6283 if (id == EVP_PKEY_ED25519) { 6284 EVP_PKEY_meth_set_digestsign(custom_pmeth, custom_pmeth_digestsign); 6285 } 6286 if (id == EVP_PKEY_DH || id == EVP_PKEY_X25519) { 6287 EVP_PKEY_meth_set_derive(custom_pmeth, NULL, custom_pmeth_derive); 6288 } else { 6289 EVP_PKEY_meth_set_sign(custom_pmeth, NULL, custom_pmeth_sign); 6290 } 6291 if (id != EVP_PKEY_ED25519 && id != EVP_PKEY_X25519) { 6292 EVP_PKEY_meth_set_init(custom_pmeth, custom_pmeth_init); 6293 EVP_PKEY_meth_set_cleanup(custom_pmeth, custom_pmeth_cleanup); 6294 EVP_PKEY_meth_set_copy(custom_pmeth, custom_pmeth_copy); 6295 } 6296 EVP_PKEY_meth_set_ctrl(custom_pmeth, custom_pmeth_ctrl, NULL); 6297 if (!TEST_true(EVP_PKEY_meth_add0(custom_pmeth))) 6298 goto err; 6299 6300 if (doderive) { 6301 pctx = EVP_PKEY_CTX_new(pkey, NULL); 6302 if (!TEST_ptr(pctx) 6303 || !TEST_int_eq(EVP_PKEY_derive_init(pctx), 1) 6304 || !TEST_int_ge(EVP_PKEY_CTX_ctrl(pctx, -1, -1, 6305 EVP_PKEY_CTRL_MY_COMMAND, 0, NULL), 6306 1) 6307 || !TEST_int_eq(ctrl_called, 1) 6308 || !TEST_int_ge(EVP_PKEY_derive_set_peer(pctx, pkey), 1) 6309 || !TEST_int_ge(EVP_PKEY_derive(pctx, NULL, &reslen), 1) 6310 || !TEST_ptr(res = OPENSSL_malloc(reslen)) 6311 || !TEST_int_ge(EVP_PKEY_derive(pctx, res, &reslen), 1)) 6312 goto err; 6313 } else { 6314 ctx = EVP_MD_CTX_new(); 6315 reslen = EVP_PKEY_size(pkey); 6316 res = OPENSSL_malloc(reslen); 6317 if (!TEST_ptr(ctx) 6318 || !TEST_ptr(res) 6319 || !TEST_true(EVP_DigestSignInit(ctx, &pctx, md, NULL, pkey)) 6320 || !TEST_int_ge(EVP_PKEY_CTX_ctrl(pctx, -1, -1, 6321 EVP_PKEY_CTRL_MY_COMMAND, 0, NULL), 6322 1) 6323 || !TEST_int_eq(ctrl_called, 1)) 6324 goto err; 6325 6326 if (id == EVP_PKEY_ED25519) { 6327 if (!TEST_true(EVP_DigestSign(ctx, res, &reslen, msg, sizeof(msg)))) 6328 goto err; 6329 } else { 6330 if (!TEST_true(EVP_DigestUpdate(ctx, msg, sizeof(msg))) 6331 || !TEST_true(EVP_DigestSignFinal(ctx, res, &reslen))) 6332 goto err; 6333 } 6334 } 6335 6336 testresult = 1; 6337 err: 6338 OPENSSL_free(res); 6339 EVP_MD_CTX_free(ctx); 6340 if (doderive) 6341 EVP_PKEY_CTX_free(pctx); 6342 EVP_PKEY_free(pkey); 6343 EVP_PKEY_meth_remove(custom_pmeth); 6344 EVP_PKEY_meth_free(custom_pmeth); 6345 custom_pmeth = NULL; 6346 return testresult; 6347 } 6348 6349 static int test_evp_md_cipher_meth(void) 6350 { 6351 EVP_MD *md = EVP_MD_meth_dup(EVP_sha256()); 6352 EVP_CIPHER *ciph = EVP_CIPHER_meth_dup(EVP_aes_128_cbc()); 6353 int testresult = 0; 6354 6355 if (!TEST_ptr(md) || !TEST_ptr(ciph)) 6356 goto err; 6357 6358 testresult = 1; 6359 6360 err: 6361 EVP_MD_meth_free(md); 6362 EVP_CIPHER_meth_free(ciph); 6363 6364 return testresult; 6365 } 6366 6367 typedef struct { 6368 int data; 6369 } custom_dgst_ctx; 6370 6371 static int custom_md_init_called = 0; 6372 static int custom_md_cleanup_called = 0; 6373 6374 static int custom_md_init(EVP_MD_CTX *ctx) 6375 { 6376 custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx); 6377 6378 if (p == NULL) 6379 return 0; 6380 6381 custom_md_init_called++; 6382 return 1; 6383 } 6384 6385 static int custom_md_cleanup(EVP_MD_CTX *ctx) 6386 { 6387 custom_dgst_ctx *p = EVP_MD_CTX_md_data(ctx); 6388 6389 if (p == NULL) 6390 /* Nothing to do */ 6391 return 1; 6392 6393 custom_md_cleanup_called++; 6394 return 1; 6395 } 6396 6397 static int test_custom_md_meth(void) 6398 { 6399 ASN1_OBJECT *o = NULL; 6400 EVP_MD_CTX *mdctx = NULL; 6401 EVP_MD *tmp = NULL; 6402 char mess[] = "Test Message\n"; 6403 unsigned char md_value[EVP_MAX_MD_SIZE]; 6404 unsigned int md_len; 6405 int testresult = 0; 6406 int nid; 6407 6408 /* 6409 * We are testing deprecated functions. We don't support a non-default 6410 * library context in this test. 6411 */ 6412 if (testctx != NULL) 6413 return TEST_skip("Non-default libctx"); 6414 6415 custom_md_init_called = custom_md_cleanup_called = 0; 6416 6417 nid = OBJ_create("1.3.6.1.4.1.16604.998866.1", "custom-md", "custom-md"); 6418 if (!TEST_int_ne(nid, NID_undef)) 6419 goto err; 6420 tmp = EVP_MD_meth_new(nid, NID_undef); 6421 if (!TEST_ptr(tmp)) 6422 goto err; 6423 6424 if (!TEST_true(EVP_MD_meth_set_init(tmp, custom_md_init)) 6425 || !TEST_true(EVP_MD_meth_set_cleanup(tmp, custom_md_cleanup)) 6426 || !TEST_true(EVP_MD_meth_set_app_datasize(tmp, 6427 sizeof(custom_dgst_ctx)))) 6428 goto err; 6429 6430 mdctx = EVP_MD_CTX_new(); 6431 if (!TEST_ptr(mdctx) 6432 /* 6433 * Initing our custom md and then initing another md should 6434 * result in the init and cleanup functions of the custom md 6435 * being called. 6436 */ 6437 || !TEST_true(EVP_DigestInit_ex(mdctx, tmp, NULL)) 6438 || !TEST_true(EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL)) 6439 || !TEST_true(EVP_DigestUpdate(mdctx, mess, strlen(mess))) 6440 || !TEST_true(EVP_DigestFinal_ex(mdctx, md_value, &md_len)) 6441 || !TEST_int_eq(custom_md_init_called, 1) 6442 || !TEST_int_eq(custom_md_cleanup_called, 1)) 6443 goto err; 6444 6445 if (!TEST_int_eq(OBJ_create("1.3.6.1.4.1.16604.998866.1", 6446 "custom-md", "custom-md"), 6447 NID_undef) 6448 || !TEST_int_eq(ERR_GET_LIB(ERR_peek_error()), ERR_LIB_OBJ) 6449 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), OBJ_R_OID_EXISTS)) 6450 goto err; 6451 6452 o = ASN1_OBJECT_create(nid, (unsigned char *)"\53\6\1\4\1\201\201\134\274\373\122\1", 12, 6453 "custom-md", "custom-md"); 6454 if (!TEST_int_eq(OBJ_add_object(o), nid)) 6455 goto err; 6456 6457 testresult = 1; 6458 err: 6459 ASN1_OBJECT_free(o); 6460 EVP_MD_CTX_free(mdctx); 6461 EVP_MD_meth_free(tmp); 6462 return testresult; 6463 } 6464 6465 typedef struct { 6466 int data; 6467 } custom_ciph_ctx; 6468 6469 static int custom_ciph_init_called = 0; 6470 static int custom_ciph_cleanup_called = 0; 6471 6472 static int custom_ciph_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, 6473 const unsigned char *iv, int enc) 6474 { 6475 custom_ciph_ctx *p = EVP_CIPHER_CTX_get_cipher_data(ctx); 6476 6477 if (p == NULL) 6478 return 0; 6479 6480 custom_ciph_init_called++; 6481 return 1; 6482 } 6483 6484 static int custom_ciph_cleanup(EVP_CIPHER_CTX *ctx) 6485 { 6486 custom_ciph_ctx *p = EVP_CIPHER_CTX_get_cipher_data(ctx); 6487 6488 if (p == NULL) 6489 /* Nothing to do */ 6490 return 1; 6491 6492 custom_ciph_cleanup_called++; 6493 return 1; 6494 } 6495 6496 static int test_custom_ciph_meth(void) 6497 { 6498 EVP_CIPHER_CTX *ciphctx = NULL; 6499 EVP_CIPHER *tmp = NULL; 6500 int testresult = 0; 6501 int nid; 6502 6503 /* 6504 * We are testing deprecated functions. We don't support a non-default 6505 * library context in this test. 6506 */ 6507 if (testctx != NULL) 6508 return TEST_skip("Non-default libctx"); 6509 6510 custom_ciph_init_called = custom_ciph_cleanup_called = 0; 6511 6512 nid = OBJ_create("1.3.6.1.4.1.16604.998866.2", "custom-ciph", "custom-ciph"); 6513 if (!TEST_int_ne(nid, NID_undef)) 6514 goto err; 6515 tmp = EVP_CIPHER_meth_new(nid, 16, 16); 6516 if (!TEST_ptr(tmp)) 6517 goto err; 6518 6519 if (!TEST_true(EVP_CIPHER_meth_set_init(tmp, custom_ciph_init)) 6520 || !TEST_true(EVP_CIPHER_meth_set_flags(tmp, EVP_CIPH_ALWAYS_CALL_INIT)) 6521 || !TEST_true(EVP_CIPHER_meth_set_cleanup(tmp, custom_ciph_cleanup)) 6522 || !TEST_true(EVP_CIPHER_meth_set_impl_ctx_size(tmp, 6523 sizeof(custom_ciph_ctx)))) 6524 goto err; 6525 6526 ciphctx = EVP_CIPHER_CTX_new(); 6527 if (!TEST_ptr(ciphctx) 6528 /* 6529 * Initing our custom cipher and then initing another cipher 6530 * should result in the init and cleanup functions of the custom 6531 * cipher being called. 6532 */ 6533 || !TEST_true(EVP_CipherInit_ex(ciphctx, tmp, NULL, NULL, NULL, 1)) 6534 || !TEST_true(EVP_CipherInit_ex(ciphctx, EVP_aes_128_cbc(), NULL, 6535 NULL, NULL, 1)) 6536 || !TEST_int_eq(custom_ciph_init_called, 1) 6537 || !TEST_int_eq(custom_ciph_cleanup_called, 1)) 6538 goto err; 6539 6540 testresult = 1; 6541 err: 6542 EVP_CIPHER_CTX_free(ciphctx); 6543 EVP_CIPHER_meth_free(tmp); 6544 return testresult; 6545 } 6546 6547 static int test_rsasve_kem_with_invalid_pub_key(void) 6548 { 6549 RSA *rsa = NULL; 6550 EVP_PKEY *pkey = NULL; 6551 EVP_PKEY_CTX *ctx = NULL; 6552 unsigned char *ct = NULL; 6553 unsigned char *secret = NULL; 6554 size_t ctlen = 0, secretlen = 0; 6555 int testresult = 0; 6556 6557 if (nullprov != NULL) { 6558 testresult = TEST_skip("Test does not support a non-default library context"); 6559 goto err; 6560 } 6561 6562 if (!TEST_ptr(pkey = make_bad_rsa_pubkey())) 6563 goto err; 6564 6565 if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) 6566 || !TEST_int_eq(EVP_PKEY_encapsulate_init(ctx, NULL), 1) 6567 || !TEST_int_eq(EVP_PKEY_CTX_set_kem_op(ctx, "RSASVE"), 1) 6568 || !TEST_int_eq(EVP_PKEY_encapsulate(ctx, NULL, &ctlen, NULL, &secretlen), 1) 6569 || !TEST_ptr(ct = OPENSSL_malloc(ctlen)) 6570 || !TEST_ptr(secret = OPENSSL_malloc(secretlen))) 6571 goto err; 6572 6573 if (!TEST_int_eq(EVP_PKEY_encapsulate(ctx, ct, &ctlen, secret, &secretlen), 0)) 6574 goto err; 6575 6576 testresult = 1; 6577 6578 err: 6579 OPENSSL_free(secret); 6580 OPENSSL_free(ct); 6581 EVP_PKEY_CTX_free(ctx); 6582 RSA_free(rsa); 6583 EVP_PKEY_free(pkey); 6584 return testresult; 6585 } 6586 6587 #ifndef OPENSSL_NO_DYNAMIC_ENGINE 6588 /* Test we can create a signature keys with an associated ENGINE */ 6589 static int test_signatures_with_engine(int tst) 6590 { 6591 ENGINE *e; 6592 const char *engine_id = "dasync"; 6593 EVP_PKEY *pkey = NULL; 6594 const unsigned char badcmackey[] = { 0x00, 0x01 }; 6595 const unsigned char cmackey[] = { 6596 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 6597 0x0c, 0x0d, 0x0e, 0x0f 6598 }; 6599 const unsigned char ed25519key[] = { 6600 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 6601 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 6602 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 6603 }; 6604 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; 6605 int testresult = 0; 6606 EVP_MD_CTX *ctx = NULL; 6607 unsigned char *mac = NULL; 6608 size_t maclen = 0; 6609 int ret; 6610 6611 #ifdef OPENSSL_NO_CMAC 6612 /* Skip CMAC tests in a no-cmac build */ 6613 if (tst <= 1) 6614 return 1; 6615 #endif 6616 #ifdef OPENSSL_NO_ECX 6617 /* Skip ECX tests in a no-ecx build */ 6618 if (tst == 2) 6619 return 1; 6620 #endif 6621 6622 if (!TEST_ptr(e = ENGINE_by_id(engine_id))) 6623 return 0; 6624 6625 if (!TEST_true(ENGINE_init(e))) { 6626 ENGINE_free(e); 6627 return 0; 6628 } 6629 6630 switch (tst) { 6631 case 0: 6632 pkey = EVP_PKEY_new_CMAC_key(e, cmackey, sizeof(cmackey), 6633 EVP_aes_128_cbc()); 6634 break; 6635 case 1: 6636 pkey = EVP_PKEY_new_CMAC_key(e, badcmackey, sizeof(badcmackey), 6637 EVP_aes_128_cbc()); 6638 break; 6639 case 2: 6640 pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, e, ed25519key, 6641 sizeof(ed25519key)); 6642 break; 6643 default: 6644 TEST_error("Invalid test case"); 6645 goto err; 6646 } 6647 if (!TEST_ptr(pkey)) 6648 goto err; 6649 6650 if (!TEST_ptr(ctx = EVP_MD_CTX_new())) 6651 goto err; 6652 6653 ret = EVP_DigestSignInit(ctx, NULL, tst == 2 ? NULL : EVP_sha256(), NULL, 6654 pkey); 6655 if (tst == 0) { 6656 if (!TEST_true(ret)) 6657 goto err; 6658 6659 if (!TEST_true(EVP_DigestSignUpdate(ctx, msg, sizeof(msg))) 6660 || !TEST_true(EVP_DigestSignFinal(ctx, NULL, &maclen))) 6661 goto err; 6662 6663 if (!TEST_ptr(mac = OPENSSL_malloc(maclen))) 6664 goto err; 6665 6666 if (!TEST_true(EVP_DigestSignFinal(ctx, mac, &maclen))) 6667 goto err; 6668 } else { 6669 /* We used a bad key. We expect a failure here */ 6670 if (!TEST_false(ret)) 6671 goto err; 6672 } 6673 6674 testresult = 1; 6675 err: 6676 EVP_MD_CTX_free(ctx); 6677 OPENSSL_free(mac); 6678 EVP_PKEY_free(pkey); 6679 ENGINE_finish(e); 6680 ENGINE_free(e); 6681 6682 return testresult; 6683 } 6684 6685 static int test_cipher_with_engine(void) 6686 { 6687 ENGINE *e; 6688 const char *engine_id = "dasync"; 6689 const unsigned char keyiv[] = { 6690 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 6691 0x0c, 0x0d, 0x0e, 0x0f 6692 }; 6693 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; 6694 int testresult = 0; 6695 EVP_CIPHER_CTX *ctx = NULL, *ctx2 = NULL; 6696 unsigned char buf[AES_BLOCK_SIZE]; 6697 int len = 0; 6698 6699 if (!TEST_ptr(e = ENGINE_by_id(engine_id))) 6700 return 0; 6701 6702 if (!TEST_true(ENGINE_init(e))) { 6703 ENGINE_free(e); 6704 return 0; 6705 } 6706 6707 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 6708 || !TEST_ptr(ctx2 = EVP_CIPHER_CTX_new())) 6709 goto err; 6710 6711 if (!TEST_true(EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), e, keyiv, keyiv))) 6712 goto err; 6713 6714 /* Copy the ctx, and complete the operation with the new ctx */ 6715 if (!TEST_true(EVP_CIPHER_CTX_copy(ctx2, ctx))) 6716 goto err; 6717 6718 if (!TEST_true(EVP_EncryptUpdate(ctx2, buf, &len, msg, sizeof(msg))) 6719 || !TEST_true(EVP_EncryptFinal_ex(ctx2, buf + len, &len))) 6720 goto err; 6721 6722 testresult = 1; 6723 err: 6724 EVP_CIPHER_CTX_free(ctx); 6725 EVP_CIPHER_CTX_free(ctx2); 6726 ENGINE_finish(e); 6727 ENGINE_free(e); 6728 6729 return testresult; 6730 } 6731 #endif /* OPENSSL_NO_DYNAMIC_ENGINE */ 6732 #endif /* OPENSSL_NO_DEPRECATED_3_0 */ 6733 6734 #if !defined(OPENSSL_NO_MULTIBLOCK) 6735 static int test_aes_cbc_hmac_sha_reject_multiblock_params(const OSSL_PARAM *params) 6736 { 6737 static const unsigned char key[16] = { 0 }; 6738 static const unsigned char iv[16] = { 0 }; 6739 EVP_CIPHER *cipher = NULL; 6740 EVP_CIPHER_CTX *ctx = NULL; 6741 int ret = 0; 6742 6743 cipher = EVP_CIPHER_fetch(testctx, "AES-128-CBC-HMAC-SHA256", 6744 "provider=default"); 6745 if (cipher == NULL) { 6746 ERR_clear_error(); 6747 return TEST_skip("AES-CBC-HMAC-SHA multiblock cipher is not available"); 6748 } 6749 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 6750 || !TEST_true(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL)) 6751 || !TEST_false(EVP_CIPHER_CTX_set_params(ctx, params))) 6752 goto end; 6753 6754 ERR_clear_error(); 6755 ret = 1; 6756 end: 6757 EVP_CIPHER_CTX_free(ctx); 6758 EVP_CIPHER_free(cipher); 6759 return ret; 6760 } 6761 6762 static int test_aes_cbc_hmac_sha_short_multiblock_aad(void) 6763 { 6764 unsigned char aad[EVP_AEAD_TLS1_AAD_LEN - 1] = { 0 }; 6765 unsigned int interleave = 4; 6766 OSSL_PARAM params[3], *p = params; 6767 6768 *p++ = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_AAD, 6769 aad, sizeof(aad)); 6770 *p++ = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_INTERLEAVE, 6771 &interleave); 6772 *p = OSSL_PARAM_construct_end(); 6773 6774 return test_aes_cbc_hmac_sha_reject_multiblock_params(params); 6775 } 6776 6777 static int test_aes_cbc_hmac_sha_large_multiblock_aad(void) 6778 { 6779 static const unsigned int oversized_len = SSL3_RT_MAX_PLAIN_LENGTH + 1; 6780 unsigned char aad[EVP_AEAD_TLS1_AAD_LEN] = { 0 }; 6781 unsigned int interleave = 4; 6782 OSSL_PARAM params[3], *p = params; 6783 6784 *p++ = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_AAD, 6785 aad, sizeof(aad)); 6786 *p++ = OSSL_PARAM_construct_uint(OSSL_CIPHER_PARAM_TLS1_MULTIBLOCK_INTERLEAVE, 6787 &interleave); 6788 *p = OSSL_PARAM_construct_end(); 6789 6790 aad[9] = (unsigned char)(TLS1_2_VERSION >> 8); 6791 aad[10] = (unsigned char)TLS1_2_VERSION; 6792 aad[11] = (unsigned char)(oversized_len >> 8); 6793 aad[12] = (unsigned char)oversized_len; 6794 6795 return test_aes_cbc_hmac_sha_reject_multiblock_params(params); 6796 } 6797 #endif 6798 6799 #ifndef OPENSSL_NO_ECX 6800 static int ecxnids[] = { 6801 NID_X25519, 6802 NID_X448, 6803 NID_ED25519, 6804 NID_ED448 6805 }; 6806 6807 /* Test that creating ECX keys with a short private key fails as expected */ 6808 static int test_ecx_short_keys(int tst) 6809 { 6810 unsigned char ecxkeydata = 1; 6811 EVP_PKEY *pkey; 6812 6813 pkey = EVP_PKEY_new_raw_private_key_ex(testctx, OBJ_nid2sn(ecxnids[tst]), 6814 NULL, &ecxkeydata, 1); 6815 if (!TEST_ptr_null(pkey)) { 6816 EVP_PKEY_free(pkey); 6817 return 0; 6818 } 6819 6820 return 1; 6821 } 6822 #endif 6823 6824 typedef enum OPTION_choice { 6825 OPT_ERR = -1, 6826 OPT_EOF = 0, 6827 OPT_CONTEXT, 6828 OPT_CONFIG_FILE, 6829 OPT_TEST_ENUM 6830 } OPTION_CHOICE; 6831 6832 const OPTIONS *test_get_options(void) 6833 { 6834 static const OPTIONS options[] = { 6835 OPT_TEST_OPTIONS_DEFAULT_USAGE, 6836 { "context", OPT_CONTEXT, '-', "Explicitly use a non-default library context" }, 6837 { "config", OPT_CONFIG_FILE, '<', 6838 "The configuration file to use for the libctx" }, 6839 { NULL } 6840 }; 6841 return options; 6842 } 6843 6844 #ifndef OPENSSL_NO_ECX 6845 /* Test that trying to sign with a public key errors out gracefully */ 6846 static int test_ecx_not_private_key(int tst) 6847 { 6848 EVP_PKEY *pkey = NULL; 6849 6850 const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; 6851 int testresult = 0; 6852 EVP_MD_CTX *ctx = NULL; 6853 unsigned char *mac = NULL; 6854 size_t maclen = 0; 6855 const uint8_t *pubkey; 6856 size_t pubkeylen; 6857 6858 switch (keys[tst].type) { 6859 case NID_X25519: 6860 case NID_X448: 6861 case NID_undef: 6862 return TEST_skip("signing not supported for X25519/X448/ML-KEM"); 6863 } 6864 6865 /* Check if this algorithm supports public keys */ 6866 if (keys[tst].pub == NULL) 6867 return TEST_skip("no public key present"); 6868 6869 pubkey = keys[tst].pub; 6870 pubkeylen = keys[tst].publen; 6871 6872 pkey = EVP_PKEY_new_raw_public_key_ex(testctx, OBJ_nid2sn(keys[tst].type), 6873 NULL, pubkey, pubkeylen); 6874 if (!TEST_ptr(pkey)) 6875 goto err; 6876 6877 if (!TEST_ptr(ctx = EVP_MD_CTX_new())) 6878 goto err; 6879 6880 if (EVP_DigestSignInit(ctx, NULL, NULL, NULL, pkey) != 1) 6881 goto check_err; 6882 6883 if (EVP_DigestSign(ctx, NULL, &maclen, msg, sizeof(msg)) != 1) 6884 goto check_err; 6885 6886 if (!TEST_ptr(mac = OPENSSL_malloc(maclen))) 6887 goto err; 6888 6889 if (!TEST_int_eq(EVP_DigestSign(ctx, mac, &maclen, msg, sizeof(msg)), 0)) 6890 goto err; 6891 6892 check_err: 6893 /* 6894 * Currently only EVP_DigestSign will throw PROV_R_NOT_A_PRIVATE_KEY, 6895 * but we relax the check to allow error also thrown by 6896 * EVP_DigestSignInit and EVP_DigestSign. 6897 */ 6898 if (ERR_GET_REASON(ERR_peek_error()) == PROV_R_NOT_A_PRIVATE_KEY) { 6899 testresult = 1; 6900 ERR_clear_error(); 6901 } 6902 6903 err: 6904 EVP_MD_CTX_free(ctx); 6905 OPENSSL_free(mac); 6906 EVP_PKEY_free(pkey); 6907 6908 return testresult; 6909 } 6910 #endif /* OPENSSL_NO_ECX */ 6911 6912 static int test_sign_continuation(void) 6913 { 6914 OSSL_PROVIDER *fake_rsa = NULL; 6915 int testresult = 0; 6916 EVP_PKEY *pkey = NULL; 6917 EVP_PKEY_CTX *pctx = NULL; 6918 EVP_MD_CTX *mctx = NULL; 6919 const char sigbuf[] = "To Be Signed"; 6920 unsigned char signature[256]; 6921 size_t siglen = 256; 6922 static int nodupnum = 1; 6923 static const OSSL_PARAM nodup_params[] = { 6924 OSSL_PARAM_int("NO_DUP", &nodupnum), 6925 OSSL_PARAM_END 6926 }; 6927 6928 if (!TEST_ptr(fake_rsa = fake_rsa_start(testctx))) 6929 return 0; 6930 6931 /* Construct a pkey using precise propq to use our provider */ 6932 if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", 6933 "provider=fake-rsa")) 6934 || !TEST_true(EVP_PKEY_fromdata_init(pctx)) 6935 || !TEST_true(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, NULL)) 6936 || !TEST_ptr(pkey)) 6937 goto end; 6938 6939 /* First test it continues (classic behavior) */ 6940 if (!TEST_ptr(mctx = EVP_MD_CTX_new()) 6941 || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx, 6942 NULL, pkey, NULL)) 6943 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) 6944 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen)) 6945 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) 6946 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen))) 6947 goto end; 6948 6949 EVP_MD_CTX_free(mctx); 6950 6951 /* try again but failing the continuation */ 6952 if (!TEST_ptr(mctx = EVP_MD_CTX_new()) 6953 || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx, 6954 NULL, pkey, nodup_params)) 6955 || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) 6956 || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen)) 6957 || !TEST_false(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) 6958 || !TEST_false(EVP_DigestSignFinal(mctx, signature, &siglen))) 6959 goto end; 6960 6961 testresult = 1; 6962 6963 end: 6964 EVP_MD_CTX_free(mctx); 6965 EVP_PKEY_free(pkey); 6966 EVP_PKEY_CTX_free(pctx); 6967 fake_rsa_finish(fake_rsa); 6968 return testresult; 6969 } 6970 6971 static int aes_gcm_encrypt(const unsigned char *gcm_key, size_t gcm_key_s, 6972 const unsigned char *gcm_iv, size_t gcm_ivlen, 6973 const unsigned char *gcm_pt, size_t gcm_pt_s, 6974 const unsigned char *gcm_aad, size_t gcm_aad_s, 6975 const unsigned char *gcm_ct, size_t gcm_ct_s, 6976 const unsigned char *gcm_tag, size_t gcm_tag_s) 6977 { 6978 int ret = 0; 6979 EVP_CIPHER_CTX *ctx; 6980 EVP_CIPHER *cipher = NULL; 6981 int outlen, tmplen; 6982 unsigned char outbuf[1024]; 6983 unsigned char outtag[16]; 6984 OSSL_PARAM params[2] = { 6985 OSSL_PARAM_END, OSSL_PARAM_END 6986 }; 6987 6988 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 6989 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", ""))) 6990 goto err; 6991 6992 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, 6993 &gcm_ivlen); 6994 6995 if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params)) 6996 || (gcm_aad != NULL 6997 && !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen, 6998 gcm_aad, gcm_aad_s))) 6999 || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen, 7000 gcm_pt, gcm_pt_s)) 7001 || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen))) 7002 goto err; 7003 7004 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, 7005 outtag, sizeof(outtag)); 7006 7007 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params)) 7008 || !TEST_mem_eq(outbuf, outlen, gcm_ct, gcm_ct_s) 7009 || !TEST_mem_eq(outtag, gcm_tag_s, gcm_tag, gcm_tag_s)) 7010 goto err; 7011 7012 ret = 1; 7013 err: 7014 EVP_CIPHER_free(cipher); 7015 EVP_CIPHER_CTX_free(ctx); 7016 7017 return ret; 7018 } 7019 7020 static int aes_gcm_decrypt(const unsigned char *gcm_key, size_t gcm_key_s, 7021 const unsigned char *gcm_iv, size_t gcm_ivlen, 7022 const unsigned char *gcm_pt, size_t gcm_pt_s, 7023 const unsigned char *gcm_aad, size_t gcm_aad_s, 7024 const unsigned char *gcm_ct, size_t gcm_ct_s, 7025 const unsigned char *gcm_tag, size_t gcm_tag_s) 7026 { 7027 int ret = 0; 7028 EVP_CIPHER_CTX *ctx; 7029 EVP_CIPHER *cipher = NULL; 7030 int outlen; 7031 unsigned char outbuf[1024]; 7032 OSSL_PARAM params[2] = { 7033 OSSL_PARAM_END, OSSL_PARAM_END 7034 }; 7035 7036 if ((ctx = EVP_CIPHER_CTX_new()) == NULL) 7037 goto err; 7038 7039 if ((cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "")) == NULL) 7040 goto err; 7041 7042 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, 7043 &gcm_ivlen); 7044 7045 if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params)) 7046 || (gcm_aad != NULL 7047 && !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outlen, 7048 gcm_aad, gcm_aad_s))) 7049 || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen, 7050 gcm_ct, gcm_ct_s)) 7051 || !TEST_mem_eq(outbuf, outlen, gcm_pt, gcm_pt_s)) 7052 goto err; 7053 7054 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, 7055 (void *)gcm_tag, gcm_tag_s); 7056 7057 if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)) 7058 || !TEST_true(EVP_DecryptFinal_ex(ctx, outbuf, &outlen))) 7059 goto err; 7060 7061 ret = 1; 7062 err: 7063 EVP_CIPHER_free(cipher); 7064 EVP_CIPHER_CTX_free(ctx); 7065 7066 return ret; 7067 } 7068 7069 static int test_aes_gcm_ivlen_change_cve_2023_5363(void) 7070 { 7071 /* AES-GCM test data obtained from NIST public test vectors */ 7072 static const unsigned char gcm_key[] = { 7073 0xd0, 0xc2, 0x67, 0xc1, 0x9f, 0x30, 0xd8, 0x0b, 0x89, 0x14, 0xbb, 0xbf, 7074 0xb7, 0x2f, 0x73, 0xb8, 0xd3, 0xcd, 0x5f, 0x6a, 0x78, 0x70, 0x15, 0x84, 7075 0x8a, 0x7b, 0x30, 0xe3, 0x8f, 0x16, 0xf1, 0x8b 7076 }; 7077 static const unsigned char gcm_iv[] = { 7078 0xb6, 0xdc, 0xda, 0x95, 0xac, 0x99, 0x77, 0x76, 0x25, 0xae, 0x87, 0xf8, 7079 0xa3, 0xa9, 0xdd, 0x64, 0xd7, 0x9b, 0xbd, 0x5f, 0x4a, 0x0e, 0x54, 0xca, 7080 0x1a, 0x9f, 0xa2, 0xe3, 0xf4, 0x5f, 0x5f, 0xc2, 0xce, 0xa7, 0xb6, 0x14, 7081 0x12, 0x6f, 0xf0, 0xaf, 0xfd, 0x3e, 0x17, 0x35, 0x6e, 0xa0, 0x16, 0x09, 7082 0xdd, 0xa1, 0x3f, 0xd8, 0xdd, 0xf3, 0xdf, 0x4f, 0xcb, 0x18, 0x49, 0xb8, 7083 0xb3, 0x69, 0x2c, 0x5d, 0x4f, 0xad, 0x30, 0x91, 0x08, 0xbc, 0xbe, 0x24, 7084 0x01, 0x0f, 0xbe, 0x9c, 0xfb, 0x4f, 0x5d, 0x19, 0x7f, 0x4c, 0x53, 0xb0, 7085 0x95, 0x90, 0xac, 0x7b, 0x1f, 0x7b, 0xa0, 0x99, 0xe1, 0xf3, 0x48, 0x54, 7086 0xd0, 0xfc, 0xa9, 0xcc, 0x91, 0xf8, 0x1f, 0x9b, 0x6c, 0x9a, 0xe0, 0xdc, 7087 0x63, 0xea, 0x7d, 0x2a, 0x4a, 0x7d, 0xa5, 0xed, 0x68, 0x57, 0x27, 0x6b, 7088 0x68, 0xe0, 0xf2, 0xb8, 0x51, 0x50, 0x8d, 0x3d 7089 }; 7090 static const unsigned char gcm_pt[] = { 7091 0xb8, 0xb6, 0x88, 0x36, 0x44, 0xe2, 0x34, 0xdf, 0x24, 0x32, 0x91, 0x07, 7092 0x4f, 0xe3, 0x6f, 0x81 7093 }; 7094 static const unsigned char gcm_ct[] = { 7095 0xff, 0x4f, 0xb3, 0xf3, 0xf9, 0xa2, 0x51, 0xd4, 0x82, 0xc2, 0xbe, 0xf3, 7096 0xe2, 0xd0, 0xec, 0xed 7097 }; 7098 static const unsigned char gcm_tag[] = { 7099 0xbd, 0x06, 0x38, 0x09, 0xf7, 0xe1, 0xc4, 0x72, 0x0e, 0xf2, 0xea, 0x63, 7100 0xdb, 0x99, 0x6c, 0x21 7101 }; 7102 7103 return aes_gcm_encrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv), 7104 gcm_pt, sizeof(gcm_pt), NULL, 0, 7105 gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag)) 7106 && aes_gcm_decrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv), 7107 gcm_pt, sizeof(gcm_pt), NULL, 0, 7108 gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag)); 7109 } 7110 7111 #ifndef OPENSSL_NO_RC4 7112 static int rc4_encrypt(const unsigned char *rc4_key, size_t rc4_key_s, 7113 const unsigned char *rc4_pt, size_t rc4_pt_s, 7114 const unsigned char *rc4_ct, size_t rc4_ct_s) 7115 { 7116 int ret = 0; 7117 EVP_CIPHER_CTX *ctx; 7118 EVP_CIPHER *cipher = NULL; 7119 int outlen, tmplen; 7120 unsigned char outbuf[1024]; 7121 OSSL_PARAM params[2] = { 7122 OSSL_PARAM_END, OSSL_PARAM_END 7123 }; 7124 7125 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 7126 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "RC4", ""))) 7127 goto err; 7128 7129 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, 7130 &rc4_key_s); 7131 7132 if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, rc4_key, NULL, params)) 7133 || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen, 7134 rc4_pt, rc4_pt_s)) 7135 || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen))) 7136 goto err; 7137 7138 if (!TEST_mem_eq(outbuf, outlen, rc4_ct, rc4_ct_s)) 7139 goto err; 7140 7141 ret = 1; 7142 err: 7143 EVP_CIPHER_free(cipher); 7144 EVP_CIPHER_CTX_free(ctx); 7145 7146 return ret; 7147 } 7148 7149 static int rc4_decrypt(const unsigned char *rc4_key, size_t rc4_key_s, 7150 const unsigned char *rc4_pt, size_t rc4_pt_s, 7151 const unsigned char *rc4_ct, size_t rc4_ct_s) 7152 { 7153 int ret = 0; 7154 EVP_CIPHER_CTX *ctx; 7155 EVP_CIPHER *cipher = NULL; 7156 int outlen; 7157 unsigned char outbuf[1024]; 7158 OSSL_PARAM params[2] = { 7159 OSSL_PARAM_END, OSSL_PARAM_END 7160 }; 7161 7162 if ((ctx = EVP_CIPHER_CTX_new()) == NULL) 7163 goto err; 7164 7165 if ((cipher = EVP_CIPHER_fetch(testctx, "RC4", "")) == NULL) 7166 goto err; 7167 7168 params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, 7169 &rc4_key_s); 7170 7171 if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, rc4_key, NULL, params)) 7172 || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen, 7173 rc4_ct, rc4_ct_s)) 7174 || !TEST_mem_eq(outbuf, outlen, rc4_pt, rc4_pt_s)) 7175 goto err; 7176 7177 ret = 1; 7178 err: 7179 EVP_CIPHER_free(cipher); 7180 EVP_CIPHER_CTX_free(ctx); 7181 7182 return ret; 7183 } 7184 7185 static int test_aes_rc4_keylen_change_cve_2023_5363(void) 7186 { 7187 /* RC4 test data obtained from RFC 6229 */ 7188 static const struct { 7189 unsigned char key[5]; 7190 unsigned char padding[11]; 7191 } rc4_key = { 7192 { /* Five bytes of key material */ 7193 0x83, 0x32, 0x22, 0x77, 0x2a }, 7194 { /* Random padding to 16 bytes */ 7195 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a, 0xaa, 0x32, 0x91 } 7196 }; 7197 static const unsigned char rc4_pt[] = { 7198 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 7199 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 7200 }; 7201 static const unsigned char rc4_ct[] = { 7202 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a, 7203 0x2e, 0x87, 0x9e, 0x92, 0xa4, 0x97, 0xef, 0xda 7204 }; 7205 7206 if (lgcyprov == NULL) 7207 return TEST_skip("Test requires legacy provider to be loaded"); 7208 7209 return rc4_encrypt(rc4_key.key, sizeof(rc4_key.key), 7210 rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct)) 7211 && rc4_decrypt(rc4_key.key, sizeof(rc4_key.key), 7212 rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct)); 7213 } 7214 #endif 7215 7216 static int test_aes_gcm_siv_empty_data(void) 7217 { 7218 unsigned char key[16] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 7219 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10 }; 7220 unsigned char nonce[12] = { 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 7221 0x22, 0x33, 0x44, 0x55 }; 7222 unsigned char aad[33] = "this AAD was never authenticated"; 7223 unsigned char zero_tag[16] = { 0 }; 7224 unsigned char real_tag[16]; 7225 unsigned char out[16]; 7226 int outl, ret = 0; 7227 EVP_CIPHER_CTX *ctx = NULL; 7228 EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-GCM-SIV", NULL); 7229 7230 if (c == NULL) { 7231 return TEST_skip("AES-128-GCM-SIV cipher is not available"); 7232 } 7233 7234 /* Compute the CORRECT tag for (key,nonce,aad,pt="") via encrypt */ 7235 ctx = EVP_CIPHER_CTX_new(); 7236 if (!TEST_ptr(ctx) 7237 || !TEST_true(EVP_EncryptInit_ex2(ctx, c, key, nonce, NULL)) 7238 || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD */ 7239 || !TEST_true(EVP_EncryptUpdate(ctx, out, &outl, aad, 0)) /* empty PT, out!=NULL */ 7240 || !TEST_true(EVP_EncryptFinal_ex(ctx, out, &outl)) 7241 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, real_tag))) 7242 goto err; 7243 EVP_CIPHER_CTX_free(ctx); 7244 7245 /* SANITY: decrypt with CORRECT tag and an explicit empty-PT Update */ 7246 ctx = EVP_CIPHER_CTX_new(); 7247 if (!TEST_ptr(ctx) 7248 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) 7249 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag)) 7250 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) 7251 || !TEST_true(EVP_DecryptUpdate(ctx, out, &outl, aad, 0)) /* force aes_gcm_siv_decrypt(len=0) */ 7252 || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl))) 7253 goto err; 7254 EVP_CIPHER_CTX_free(ctx); 7255 7256 /* FORGERY A: AAD only, NO ciphertext Update, ALL-ZERO tag */ 7257 ctx = EVP_CIPHER_CTX_new(); 7258 if (!TEST_ptr(ctx) 7259 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) 7260 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag)) 7261 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD only, out==NULL */ 7262 || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl))) 7263 goto err; 7264 EVP_CIPHER_CTX_free(ctx); 7265 7266 /* FORGERY B: no AAD, no Update at all, ALL-ZERO tag */ 7267 ctx = EVP_CIPHER_CTX_new(); 7268 if (!TEST_ptr(ctx) 7269 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) 7270 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag)) 7271 || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl))) 7272 goto err; 7273 EVP_CIPHER_CTX_free(ctx); 7274 7275 /* CONTROL: AAD only, NO ciphertext Update, CORRECT tag */ 7276 ctx = EVP_CIPHER_CTX_new(); 7277 if (!TEST_ptr(ctx) 7278 || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) 7279 || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag)) 7280 || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) 7281 || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl))) 7282 goto err; 7283 EVP_CIPHER_CTX_free(ctx); 7284 ctx = NULL; 7285 7286 ret = 1; 7287 err: 7288 EVP_CIPHER_CTX_free(ctx); 7289 7290 EVP_CIPHER_free(c); 7291 return ret; 7292 } 7293 7294 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) 7295 static int test_chacha20_poly1305_late_aad(void) 7296 { 7297 EVP_CIPHER_CTX *ctx = NULL; 7298 EVP_CIPHER *c = NULL; 7299 unsigned char key[32] = { 0 }; 7300 unsigned char iv[12] = { 0 }; 7301 unsigned char aad[4] = "aad"; 7302 unsigned char msg[8] = "message"; 7303 unsigned char out[32]; 7304 int len, test; 7305 7306 test = TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 7307 && TEST_ptr(c = EVP_CIPHER_fetch(testctx, "ChaCha20-Poly1305", testpropq)) 7308 && TEST_true(EVP_EncryptInit_ex2(ctx, c, key, iv, NULL)) 7309 && TEST_true(EVP_EncryptUpdate(ctx, NULL, &len, aad, sizeof(aad))) 7310 && TEST_true(EVP_EncryptUpdate(ctx, out, &len, msg, sizeof(msg))) 7311 && TEST_false(EVP_EncryptUpdate(ctx, NULL, &len, aad, sizeof(aad))); 7312 7313 EVP_CIPHER_free(c); 7314 EVP_CIPHER_CTX_free(ctx); 7315 return test; 7316 } 7317 #endif 7318 /* 7319 * AES-SIV reuse-without-rekey: 7320 * msg1: legit non-empty CT, tag verifies, final_ret=0 7321 * msg2: no reinit (or reinit with key=NULL), set forged tag, 7322 * AAD only, DecryptFinal -> does stale final_ret leak through? 7323 */ 7324 static int test_aes_siv_ctx_reuse(void) 7325 { 7326 unsigned char key[32] = { 7 }; /* AES-128-SIV => 2*16 */ 7327 unsigned char pt[9] = "payload!"; 7328 unsigned char ct[9], tagbuf[16], out[16], zero16[16] = { 0 }; 7329 unsigned char aad[14] = "forged header"; 7330 int outl, ret = 0; 7331 EVP_CIPHER_CTX *e = NULL, *d = NULL; 7332 EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-SIV", NULL); 7333 7334 if (c == NULL) { 7335 return TEST_skip("AES-128-SIV cipher is not available"); 7336 } 7337 7338 /* produce a valid (ct,tag) for msg1 */ 7339 e = EVP_CIPHER_CTX_new(); 7340 if (!TEST_ptr(e) 7341 || !TEST_true(EVP_EncryptInit_ex2(e, c, key, NULL, NULL)) 7342 || !TEST_true(EVP_EncryptUpdate(e, NULL, &outl, (unsigned char *)"hdr1", 4)) 7343 || !TEST_true(EVP_EncryptUpdate(e, ct, &outl, pt, sizeof(pt))) 7344 || !TEST_true(EVP_EncryptFinal_ex(e, out, &outl)) 7345 || !TEST_true(EVP_CIPHER_CTX_ctrl(e, EVP_CTRL_AEAD_GET_TAG, 16, tagbuf))) { 7346 EVP_CIPHER_CTX_free(e); 7347 goto err; 7348 } 7349 EVP_CIPHER_CTX_free(e); 7350 7351 /* msg1 decrypt */ 7352 d = EVP_CIPHER_CTX_new(); 7353 if (!TEST_ptr(d) 7354 || !TEST_true(EVP_DecryptInit_ex2(d, c, key, NULL, NULL)) 7355 || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, tagbuf)) 7356 || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, (unsigned char *)"hdr1", 4)) 7357 || !TEST_true(EVP_DecryptUpdate(d, out, &outl, ct, sizeof(ct))) 7358 || !TEST_true(EVP_DecryptFinal_ex(d, out, &outl))) 7359 goto err; 7360 7361 /* msg2 on SAME ctx, reinit with key=NULL => initkey skipped, final_ret should be reset */ 7362 if (!TEST_true(EVP_DecryptInit_ex2(d, NULL, NULL, NULL, NULL)) 7363 || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, zero16)) 7364 || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, aad, sizeof(aad))) /* forged AAD */ 7365 || !TEST_false(EVP_DecryptFinal_ex(d, out, &outl))) 7366 goto err; 7367 7368 ret = 1; 7369 7370 err: 7371 EVP_CIPHER_CTX_free(d); 7372 EVP_CIPHER_free(c); 7373 return ret; 7374 } 7375 7376 static int test_aes_siv_ctx_dec_retval(void) 7377 { 7378 unsigned char key[32] = { 7 }; 7379 unsigned char in[6] = "input"; 7380 unsigned char ct[6] = { 0 }; 7381 7382 unsigned char tagbuf[16], out[16] = { 0 }; 7383 int len, ret = 0; 7384 EVP_CIPHER_CTX *enc_ctx = NULL; 7385 EVP_CIPHER_CTX *dec_ctx = NULL; 7386 7387 EVP_CIPHER *cipher = EVP_CIPHER_fetch(NULL, "AES-128-SIV", NULL); 7388 7389 if (cipher == NULL) 7390 return TEST_skip("AES-128-SIV cipher is not available"); 7391 7392 enc_ctx = EVP_CIPHER_CTX_new(); 7393 if (!TEST_ptr(enc_ctx) 7394 || !TEST_true(EVP_EncryptInit_ex(enc_ctx, cipher, NULL, key, NULL)) 7395 || !TEST_true(EVP_EncryptUpdate(enc_ctx, ct, &len, in, sizeof(in))) 7396 || !TEST_true(EVP_CIPHER_CTX_ctrl(enc_ctx, EVP_CTRL_AEAD_GET_TAG, sizeof(tagbuf), tagbuf)) 7397 || !TEST_true(EVP_EncryptFinal_ex(enc_ctx, ct + len, &len))) 7398 goto err; 7399 7400 dec_ctx = EVP_CIPHER_CTX_new(); 7401 if (!TEST_ptr(dec_ctx) 7402 || !TEST_true(EVP_DecryptInit_ex(dec_ctx, cipher, NULL, key, NULL)) 7403 || !TEST_true(EVP_CIPHER_CTX_ctrl(dec_ctx, EVP_CTRL_AEAD_SET_TAG, 7404 sizeof(tagbuf), tagbuf)) 7405 || !TEST_true(EVP_DecryptUpdate(dec_ctx, out, &len, ct, sizeof(in))) 7406 || !TEST_true(EVP_DecryptFinal_ex(dec_ctx, out + len, &len)) 7407 || !TEST_true(0 == memcmp(out, in, sizeof(in)))) { 7408 goto err; 7409 } 7410 7411 /* 7412 * Positive usecase successful, 7413 * provoke the error, by repeating decrypt on same context. 7414 */ 7415 if (!TEST_false(EVP_DecryptUpdate(dec_ctx, out, &len, ct, sizeof(ct))) 7416 || (!TEST_false(EVP_DecryptFinal_ex(dec_ctx, out + len, &len)))) 7417 goto err; 7418 7419 ret = 1; 7420 7421 err: 7422 EVP_CIPHER_CTX_free(dec_ctx); 7423 EVP_CIPHER_CTX_free(enc_ctx); 7424 EVP_CIPHER_free(cipher); 7425 return ret; 7426 } 7427 7428 static int test_aes_siv_ctx_enc_retval(void) 7429 { 7430 unsigned char key[32] = { 7 }; 7431 unsigned char in[6] = "input"; 7432 unsigned char ct[6] = { 0 }; 7433 7434 unsigned char tagbuf[16]; 7435 int len, ret = 0; 7436 EVP_CIPHER_CTX *enc_ctx = NULL; 7437 7438 EVP_CIPHER *cipher = EVP_CIPHER_fetch(NULL, "AES-128-SIV", NULL); 7439 7440 if (cipher == NULL) 7441 return TEST_skip("AES-128-SIV cipher is not available"); 7442 7443 enc_ctx = EVP_CIPHER_CTX_new(); 7444 if (!TEST_ptr(enc_ctx) 7445 || !TEST_true(EVP_EncryptInit_ex(enc_ctx, cipher, NULL, key, NULL)) 7446 || !TEST_true(EVP_EncryptUpdate(enc_ctx, ct, &len, in, sizeof(in))) 7447 || !TEST_true(EVP_CIPHER_CTX_ctrl(enc_ctx, EVP_CTRL_AEAD_GET_TAG, sizeof(tagbuf), tagbuf)) 7448 || !TEST_true(EVP_EncryptFinal_ex(enc_ctx, ct + len, &len))) 7449 goto err; 7450 7451 /* 7452 * Encryption is fine, provoke error by repeating encrypt on same context. */ 7453 if (!TEST_false(EVP_EncryptUpdate(enc_ctx, ct, &len, in, sizeof(in))) 7454 || !TEST_false(EVP_EncryptFinal_ex(enc_ctx, ct + len, &len))) 7455 goto err; 7456 7457 ret = 1; 7458 err: 7459 EVP_CIPHER_CTX_free(enc_ctx); 7460 EVP_CIPHER_free(cipher); 7461 return ret; 7462 } 7463 7464 static int test_invalid_ctx_for_digest(void) 7465 { 7466 int ret; 7467 EVP_MD_CTX *mdctx; 7468 7469 mdctx = EVP_MD_CTX_new(); 7470 if (!TEST_ptr(mdctx)) 7471 return 0; 7472 7473 if (!TEST_int_eq(EVP_DigestUpdate(mdctx, "test", sizeof("test") - 1), 0)) 7474 ret = 0; 7475 else 7476 ret = 1; 7477 7478 EVP_MD_CTX_free(mdctx); 7479 7480 return ret; 7481 } 7482 7483 static int test_evp_cipher_negative_length(void) 7484 { 7485 EVP_CIPHER_CTX *ctx = NULL; 7486 EVP_CIPHER *cipher = NULL; 7487 unsigned char key[16] = { 0 }; 7488 unsigned char iv[16] = { 0 }; 7489 unsigned char buffer[32] = { 0 }; 7490 int outl = 0; 7491 int ret = 0; 7492 7493 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) 7494 goto end; 7495 7496 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-128-CBC", testpropq))) 7497 goto end; 7498 7499 /* Initialize encryption context */ 7500 if (!TEST_int_eq(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL), 1)) 7501 goto end; 7502 7503 /* Test EVP_EncryptUpdate with negative length - should fail */ 7504 if (!TEST_int_eq(EVP_EncryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0)) 7505 goto end; 7506 7507 /* Reinitialize for decryption */ 7508 if (!TEST_int_eq(EVP_DecryptInit_ex2(ctx, cipher, key, iv, NULL), 1)) 7509 goto end; 7510 7511 /* Test EVP_DecryptUpdate with negative length - should fail */ 7512 if (!TEST_int_eq(EVP_DecryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0)) 7513 goto end; 7514 7515 ret = 1; 7516 end: 7517 EVP_CIPHER_free(cipher); 7518 EVP_CIPHER_CTX_free(ctx); 7519 return ret; 7520 } 7521 7522 /* 7523 * Cross-driver round-trip test for AEAD one-shot vs streaming paths. 7524 * 7525 * The streaming path (EVP_CipherUpdate/Final, dispatched to 7526 * OSSL_FUNC_CIPHER_UPDATE/_FINAL) is treated as the oracle. For each 7527 * AEAD configuration we encrypt and decrypt the same (key, iv, aad, pt), 7528 * driving the body in two combinations: 7529 * 7530 * 1. body encrypt via EVP_Cipher() (one-shot, OSSL_FUNC_CIPHER_CIPHER), 7531 * body decrypt via EVP_CipherUpdate (streaming). 7532 * 2. body encrypt via EVP_CipherUpdate, body decrypt via EVP_Cipher(). 7533 * 7534 * Both combinations must recover the plaintext and verify the tag. AAD 7535 * is always fed via EVP_CipherUpdate(NULL, ...): OCB's one-shot is body 7536 * only and the asymmetric "AAD streaming, body one-shot" call shape is 7537 * the natural pattern a caller reaching for EVP_Cipher() for throughput 7538 * would write anyway. 7539 * 7540 * CVE-2026-45445 (AES-OCB EVP_Cipher() ignored IV) was a silent failure 7541 * in this matrix: the one-shot encrypt path produced ciphertext under 7542 * Offset_0 = 0 regardless of IV, which the streaming decrypt path then 7543 * could not verify. Adding this cross-check catches the same class of 7544 * bug for any future AEAD whose one-shot dispatch diverges from its 7545 * streaming dispatch. 7546 */ 7547 typedef struct { 7548 const char *name; /* EVP_CIPHER fetch name */ 7549 size_t keylen; 7550 size_t ivlen; 7551 size_t taglen; 7552 int is_ccm; /* needs length-up-front + tag-before-body dance */ 7553 } AEAD_ONESHOT_CFG; 7554 7555 static const AEAD_ONESHOT_CFG aead_oneshot_cfgs[] = { 7556 { "AES-128-GCM", 16, 12, 16, 0 }, 7557 { "AES-256-GCM", 32, 12, 16, 0 }, 7558 { "AES-128-CCM", 16, 12, 16, 1 }, 7559 { "AES-256-CCM", 32, 12, 16, 1 }, 7560 { "AES-128-OCB", 16, 12, 16, 0 }, 7561 { "AES-256-OCB", 32, 12, 16, 0 }, 7562 { "ChaCha20-Poly1305", 32, 12, 16, 0 } 7563 }; 7564 7565 static const AEAD_ONESHOT_CFG aead_oneshot_zerolen_cfgs[] = { 7566 { "AES-128-OCB", 16, 12, 16, 0 }, 7567 { "ChaCha20-Poly1305", 32, 12, 16, 0 }, 7568 { "AES-128-GCM-SIV", 16, 12, 16, 0 } 7569 }; 7570 7571 /* 7572 * Drive an encrypt or decrypt operation. AAD always via EVP_CipherUpdate. 7573 * Body via EVP_Cipher() when oneshot_body is non-zero, EVP_CipherUpdate 7574 * otherwise. On encrypt, fills *out and the caller-provided tag buffer. 7575 * On decrypt, reads from in and verifies tag; returns 0 if verification 7576 * fails (the test asserts the expected outcome). 7577 */ 7578 static int aead_oneshot_op(const AEAD_ONESHOT_CFG *cfg, int enc, 7579 int oneshot_body, const unsigned char *key, 7580 const unsigned char *iv, const unsigned char *aad, 7581 size_t aad_len, const unsigned char *in, size_t in_len, 7582 unsigned char *out, unsigned char *tag, const char **why) 7583 { 7584 EVP_CIPHER_CTX *ctx = NULL; 7585 EVP_CIPHER *cipher = NULL; 7586 int outl = 0, tmpl = 0; 7587 int ok = 0; 7588 int body_rv; 7589 7590 *why = NULL; 7591 7592 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq))) { 7593 *why = "CIPHER_FETCH"; 7594 goto end; 7595 } 7596 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { 7597 *why = "CTX_NEW"; 7598 goto end; 7599 } 7600 if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))) { 7601 *why = "INIT_CIPHER"; 7602 goto end; 7603 } 7604 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 7605 (int)cfg->ivlen, NULL), 7606 0)) { 7607 *why = "SET_IVLEN"; 7608 goto end; 7609 } 7610 if (cfg->is_ccm) { 7611 /* Placeholder taglen on encrypt, real tag on decrypt; both before key+iv. */ 7612 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 7613 (int)cfg->taglen, enc ? NULL : tag), 7614 0)) { 7615 *why = "CCM_SET_TAG"; 7616 goto end; 7617 } 7618 } 7619 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))) { 7620 *why = "INIT_KEY_IV"; 7621 goto end; 7622 } 7623 if (cfg->is_ccm) { 7624 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, NULL, (int)in_len))) { 7625 *why = "CCM_LEN_DECL"; 7626 goto end; 7627 } 7628 } 7629 if (aad_len > 0 7630 && !TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, (int)aad_len))) { 7631 *why = "AAD"; 7632 goto end; 7633 } 7634 if (!enc && !cfg->is_ccm 7635 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 7636 (int)cfg->taglen, tag), 7637 0)) { 7638 *why = "SET_TAG"; 7639 goto end; 7640 } 7641 7642 if (oneshot_body) { 7643 body_rv = EVP_Cipher(ctx, out, in, (unsigned int)in_len); 7644 if (cfg->is_ccm && !enc) { 7645 /* CCM decrypt: 0 means tag verify failed, < 0 means error. */ 7646 if (!TEST_int_gt(body_rv, 0)) { 7647 *why = "ONESHOT_DECRYPT"; 7648 goto end; 7649 } 7650 } else { 7651 if (!TEST_int_ge(body_rv, 0)) { 7652 *why = "ONESHOT_BODY"; 7653 goto end; 7654 } 7655 } 7656 outl = (int)in_len; 7657 } else { 7658 if (!TEST_true(EVP_CipherUpdate(ctx, out, &outl, in, (int)in_len))) { 7659 *why = enc ? "STREAM_BODY_ENC" : "STREAM_BODY_DEC"; 7660 goto end; 7661 } 7662 } 7663 7664 if (!cfg->is_ccm) { 7665 if (!TEST_true(EVP_CipherFinal_ex(ctx, out + outl, &tmpl))) { 7666 *why = enc ? "FINAL_ENC" : "FINAL_DEC"; 7667 goto end; 7668 } 7669 } 7670 7671 if (enc) { 7672 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 7673 (int)cfg->taglen, tag), 7674 0)) { 7675 *why = "GET_TAG"; 7676 goto end; 7677 } 7678 } 7679 ok = 1; 7680 end: 7681 EVP_CIPHER_CTX_free(ctx); 7682 EVP_CIPHER_free(cipher); 7683 return ok; 7684 } 7685 7686 /* 7687 * For each AEAD row we run two AAD modes, and within each AAD mode two 7688 * cross-driver round trips: 7689 * 7690 * aad_mode 0: no AAD. Critical for catching the OCB-style bug: any 7691 * EVP_CipherUpdate(NULL, aad, ...) call before the body 7692 * would itself pass through the (correct) streaming 7693 * handler and apply the buffered IV, masking the one-shot 7694 * handler's failure to do so. With aad_len == 0 we make 7695 * EVP_Cipher() the very first cipher operation on the 7696 * context, which is the shape the bug requires. 7697 * 7698 * aad_mode 1: with AAD via streaming. Catches divergence between the 7699 * drivers when AAD is in play. 7700 * 7701 * leg 0: encrypt-oneshot + decrypt-streaming 7702 * leg 1: encrypt-streaming + decrypt-oneshot 7703 * 7704 * The test index encodes (cipher, aad_mode) so a failure points at both. 7705 */ 7706 static int test_aead_oneshot_roundtrip(int idx) 7707 { 7708 static const unsigned char fixed_key[32] = { 7709 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 7710 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 7711 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 7712 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 7713 }; 7714 static const unsigned char fixed_iv[12] = { 7715 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab 7716 }; 7717 static const unsigned char fixed_aad[] = "extra:context"; 7718 static const unsigned char fixed_pt[] = "THE QUICK BROWN FOX JUMPS OVER LAZY!!"; 7719 const AEAD_ONESHOT_CFG *cfg = &aead_oneshot_cfgs[idx / 2]; 7720 int with_aad = idx % 2; 7721 size_t aad_len = with_aad ? sizeof(fixed_aad) - 1 : 0; 7722 size_t pt_len = sizeof(fixed_pt) - 1; 7723 EVP_CIPHER *probe = NULL; 7724 unsigned char ct[64], pt[64]; 7725 unsigned char tag_oneshot[16], tag_stream[16]; 7726 const char *why = NULL; 7727 int leg, ok = 0; 7728 7729 /* 7730 * Probe for the cipher: a build with no-ocb / no-chacha / etc. will 7731 * not have it, and we treat that as a pass (nothing to test here). 7732 */ 7733 ERR_set_mark(); 7734 probe = EVP_CIPHER_fetch(testctx, cfg->name, testpropq); 7735 ERR_pop_to_mark(); 7736 if (probe == NULL) { 7737 TEST_info("skipping, '%s' is not available", cfg->name); 7738 return 1; 7739 } 7740 EVP_CIPHER_free(probe); 7741 7742 for (leg = 0; leg <= 1; leg++) { 7743 int enc_oneshot = (leg == 0); 7744 unsigned char *tag = enc_oneshot ? tag_oneshot : tag_stream; 7745 7746 memset(ct, 0, sizeof(ct)); 7747 memset(pt, 0, sizeof(pt)); 7748 memset(tag, 0, cfg->taglen); 7749 7750 if (!aead_oneshot_op(cfg, /*enc=*/1, /*oneshot_body=*/enc_oneshot, 7751 fixed_key, fixed_iv, fixed_aad, aad_len, 7752 fixed_pt, pt_len, ct, tag, &why)) { 7753 TEST_error("%s (%s): encrypt leg %d (%s body) failed at %s", 7754 cfg->name, with_aad ? "with AAD" : "no AAD", 7755 leg, enc_oneshot ? "oneshot" : "stream", 7756 why ? why : "?"); 7757 goto end; 7758 } 7759 if (!aead_oneshot_op(cfg, /*enc=*/0, /*oneshot_body=*/!enc_oneshot, 7760 fixed_key, fixed_iv, fixed_aad, aad_len, 7761 ct, pt_len, pt, tag, &why)) { 7762 TEST_error("%s (%s): decrypt leg %d (%s body) failed at %s", 7763 cfg->name, with_aad ? "with AAD" : "no AAD", 7764 leg, enc_oneshot ? "stream" : "oneshot", 7765 why ? why : "?"); 7766 goto end; 7767 } 7768 if (!TEST_mem_eq(pt, pt_len, fixed_pt, pt_len)) { 7769 TEST_error("%s (%s): leg %d: recovered plaintext differs", 7770 cfg->name, with_aad ? "with AAD" : "no AAD", leg); 7771 goto end; 7772 } 7773 } 7774 7775 /* 7776 * Both legs share the same (key, iv, aad, pt) and must therefore 7777 * agree on the tag bit-for-bit, regardless of which driver computed 7778 * it. This catches the OCB-style failure where the one-shot path 7779 * silently emits a different ciphertext/tag from the streaming path. 7780 */ 7781 if (!TEST_mem_eq(tag_oneshot, cfg->taglen, tag_stream, cfg->taglen)) { 7782 TEST_error("%s (%s): oneshot-encrypt tag != streaming-encrypt tag", 7783 cfg->name, with_aad ? "with AAD" : "no AAD"); 7784 goto end; 7785 } 7786 ok = 1; 7787 end: 7788 return ok; 7789 } 7790 7791 static EVP_CIPHER_CTX *aead_oneshot_zerolen_ctx(const EVP_CIPHER *cipher, 7792 int enc, const unsigned char *key, const unsigned char *iv, 7793 const unsigned char *aad, size_t aad_len, 7794 const unsigned char *tag, size_t tag_len) 7795 { 7796 EVP_CIPHER_CTX *ctx = NULL; 7797 int outl = 0; 7798 7799 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) 7800 || !TEST_true(EVP_CipherInit_ex2(ctx, cipher, key, iv, enc, NULL)) 7801 || (aad_len > 0 7802 && !TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, 7803 (int)aad_len))) 7804 || (!enc 7805 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 7806 (int)tag_len, (void *)tag), 7807 0))) { 7808 EVP_CIPHER_CTX_free(ctx); 7809 return NULL; 7810 } 7811 return ctx; 7812 } 7813 7814 /* 7815 * For these built-in provider implementations, a NULL-input EVP_Cipher() call 7816 * must produce or check the empty-message tag even when no payload Update was 7817 * made. 7818 */ 7819 static int test_aead_oneshot_zerolen(int idx) 7820 { 7821 static const unsigned char key[32] = { 7822 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 7823 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 7824 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 7825 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 7826 }; 7827 static const unsigned char iv[12] = { 7828 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 7829 0xa8, 0xa9, 0xaa, 0xab 7830 }; 7831 static const unsigned char aad[] = "empty message context"; 7832 const AEAD_ONESHOT_CFG *cfg = &aead_oneshot_zerolen_cfgs[idx / 2]; 7833 int with_aad = idx % 2; 7834 size_t aad_len = with_aad ? sizeof(aad) - 1 : 0; 7835 EVP_CIPHER *cipher = NULL; 7836 EVP_CIPHER_CTX *ctx_oracle = NULL, *ctx_oneshot = NULL; 7837 EVP_CIPHER_CTX *ctx_dec = NULL, *ctx_dec_bad = NULL; 7838 static const unsigned char empty = 0; 7839 unsigned char out[16] = { 0 }; 7840 unsigned char tag_oracle[16] = { 0 }; 7841 unsigned char tag_oneshot[16] = { 0 }; 7842 unsigned char tag_bad[16] = { 0 }; 7843 int outl = 0, ret = 0; 7844 7845 ERR_set_mark(); 7846 cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq); 7847 ERR_pop_to_mark(); 7848 if (cipher == NULL) 7849 return TEST_skip("'%s' is not available", cfg->name); 7850 7851 /* 7852 * The explicit zero-length Update provides an oracle that also works on 7853 * the unpatched GCM-SIV implementation, whose empty Final cannot generate 7854 * a tag. 7855 */ 7856 ctx_oracle = aead_oneshot_zerolen_ctx(cipher, 1, key, iv, aad, aad_len, 7857 NULL, cfg->taglen); 7858 if (!TEST_ptr(ctx_oracle) 7859 || !TEST_true(EVP_EncryptUpdate(ctx_oracle, out, &outl, &empty, 0)) 7860 || !TEST_true(EVP_EncryptFinal_ex(ctx_oracle, out, &outl)) 7861 || !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx_oracle, EVP_CTRL_AEAD_GET_TAG, 7862 (int)cfg->taglen, tag_oracle), 7863 0)) 7864 goto end; 7865 7866 ctx_dec = aead_oneshot_zerolen_ctx(cipher, 0, key, iv, aad, aad_len, 7867 tag_oracle, cfg->taglen); 7868 if (!TEST_ptr(ctx_dec) 7869 || !TEST_int_ge(EVP_Cipher(ctx_dec, out, NULL, 0), 0)) 7870 goto end; 7871 7872 memcpy(tag_bad, tag_oracle, cfg->taglen); 7873 tag_bad[0] ^= 1; 7874 ctx_dec_bad = aead_oneshot_zerolen_ctx(cipher, 0, key, iv, aad, aad_len, 7875 tag_bad, cfg->taglen); 7876 if (!TEST_ptr(ctx_dec_bad) 7877 || !TEST_int_lt(EVP_Cipher(ctx_dec_bad, out, NULL, 0), 0)) 7878 goto end; 7879 7880 ctx_oneshot = aead_oneshot_zerolen_ctx(cipher, 1, key, iv, aad, aad_len, 7881 NULL, cfg->taglen); 7882 if (!TEST_ptr(ctx_oneshot) 7883 || !TEST_int_ge(EVP_Cipher(ctx_oneshot, out, NULL, 0), 0) 7884 || !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx_oneshot, EVP_CTRL_AEAD_GET_TAG, 7885 (int)cfg->taglen, tag_oneshot), 7886 0) 7887 || !TEST_mem_eq(tag_oneshot, cfg->taglen, 7888 tag_oracle, cfg->taglen)) 7889 goto end; 7890 7891 ret = 1; 7892 end: 7893 if (!ret) 7894 TEST_info("zero-length %s test failed (%s)", cfg->name, 7895 with_aad ? "with AAD" : "no AAD"); 7896 EVP_CIPHER_CTX_free(ctx_oracle); 7897 EVP_CIPHER_CTX_free(ctx_oneshot); 7898 EVP_CIPHER_CTX_free(ctx_dec); 7899 EVP_CIPHER_CTX_free(ctx_dec_bad); 7900 EVP_CIPHER_free(cipher); 7901 return ret; 7902 } 7903 7904 static const AEAD_ONESHOT_CFG ccm_empty_final_cfgs[] = { 7905 { "AES-128-CCM", 16, 12, 16, 1 }, 7906 { "AES-192-CCM", 24, 12, 16, 1 }, 7907 { "AES-256-CCM", 32, 12, 16, 1 }, 7908 { "ARIA-128-CCM", 16, 12, 16, 1 }, 7909 { "ARIA-192-CCM", 24, 12, 16, 1 }, 7910 { "ARIA-256-CCM", 32, 12, 16, 1 }, 7911 { "SM4-CCM", 16, 12, 16, 1 } 7912 }; 7913 7914 /* 7915 * Finalize CCM after declaring an empty payload and supplying AAD, without a 7916 * payload Update. Return one for authentication success, zero for an 7917 * authentication failure, and minus one for any other failure. 7918 */ 7919 static int ccm_empty_final_op(const AEAD_ONESHOT_CFG *cfg, int enc, 7920 int oneshot_final, const unsigned char *key, const unsigned char *iv, 7921 const unsigned char *aad, size_t aad_len, unsigned char *tag, 7922 const char **why) 7923 { 7924 EVP_CIPHER_CTX *ctx = NULL; 7925 EVP_CIPHER *cipher = NULL; 7926 unsigned char out[1] = { 0 }; 7927 int outl = 0, rv; 7928 int ret = -1; 7929 7930 *why = NULL; 7931 7932 if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq))) { 7933 *why = "CIPHER_FETCH"; 7934 goto end; 7935 } 7936 if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { 7937 *why = "CTX_NEW"; 7938 goto end; 7939 } 7940 if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))) { 7941 *why = "INIT_CIPHER"; 7942 goto end; 7943 } 7944 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 7945 (int)cfg->ivlen, NULL), 7946 0)) { 7947 *why = "SET_IVLEN"; 7948 goto end; 7949 } 7950 if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 7951 (int)cfg->taglen, enc ? NULL : tag), 7952 0)) { 7953 *why = "SET_TAG"; 7954 goto end; 7955 } 7956 if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))) { 7957 *why = "INIT_KEY_IV"; 7958 goto end; 7959 } 7960 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, NULL, 0))) { 7961 *why = "LENGTH"; 7962 goto end; 7963 } 7964 if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, (int)aad_len))) { 7965 *why = "AAD"; 7966 goto end; 7967 } 7968 7969 if (oneshot_final) { 7970 rv = EVP_Cipher(ctx, out, NULL, 0); 7971 ret = rv >= 0; 7972 if (ret && rv != 0) { 7973 *why = "ONESHOT_FINAL_LENGTH"; 7974 ret = -1; 7975 goto end; 7976 } 7977 } else { 7978 ret = EVP_CipherFinal_ex(ctx, out, &outl) > 0; 7979 if (ret && outl != 0) { 7980 *why = "STREAM_FINAL_LENGTH"; 7981 ret = -1; 7982 goto end; 7983 } 7984 } 7985 7986 if (ret && enc 7987 && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 7988 (int)cfg->taglen, tag), 7989 0)) { 7990 *why = "GET_TAG"; 7991 ret = -1; 7992 } 7993 7994 end: 7995 EVP_CIPHER_CTX_free(ctx); 7996 EVP_CIPHER_free(cipher); 7997 return ret; 7998 } 7999 8000 static int test_ccm_empty_final(int idx) 8001 { 8002 static const unsigned char fixed_key[32] = { 8003 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 8004 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 8005 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 8006 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 8007 }; 8008 static const unsigned char fixed_iv[12] = { 8009 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 8010 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab 8011 }; 8012 static const unsigned char fixed_aad[] = "CCM empty-payload Final regression"; 8013 const AEAD_ONESHOT_CFG *cfg = &ccm_empty_final_cfgs[idx]; 8014 EVP_CIPHER *probe = NULL; 8015 unsigned char tag_stream[16], tag_oneshot[16], bad_tag[16]; 8016 const char *why = NULL; 8017 int rv, ok = 0; 8018 8019 ERR_set_mark(); 8020 probe = EVP_CIPHER_fetch(testctx, cfg->name, testpropq); 8021 ERR_pop_to_mark(); 8022 if (probe == NULL) { 8023 TEST_info("skipping, '%s' is not available", cfg->name); 8024 return 1; 8025 } 8026 EVP_CIPHER_free(probe); 8027 8028 memset(tag_stream, 0, sizeof(tag_stream)); 8029 rv = ccm_empty_final_op(cfg, 1, 0, fixed_key, fixed_iv, fixed_aad, 8030 sizeof(fixed_aad) - 1, tag_stream, &why); 8031 if (!TEST_int_eq(rv, 1)) { 8032 TEST_error("%s: streaming encryption failed at %s", 8033 cfg->name, why ? why : "FINAL"); 8034 goto end; 8035 } 8036 8037 memset(tag_oneshot, 0, sizeof(tag_oneshot)); 8038 rv = ccm_empty_final_op(cfg, 1, 1, fixed_key, fixed_iv, fixed_aad, 8039 sizeof(fixed_aad) - 1, tag_oneshot, &why); 8040 if (!TEST_int_eq(rv, 1)) { 8041 TEST_error("%s: one-shot encryption failed at %s", 8042 cfg->name, why ? why : "FINAL"); 8043 goto end; 8044 } 8045 if (!TEST_mem_eq(tag_stream, cfg->taglen, tag_oneshot, cfg->taglen)) { 8046 TEST_error("%s: streaming and one-shot tags differ", cfg->name); 8047 goto end; 8048 } 8049 8050 rv = ccm_empty_final_op(cfg, 0, 0, fixed_key, fixed_iv, fixed_aad, 8051 sizeof(fixed_aad) - 1, tag_stream, &why); 8052 if (!TEST_int_eq(rv, 1)) { 8053 TEST_error("%s: streaming verification failed at %s", 8054 cfg->name, why ? why : "FINAL"); 8055 goto end; 8056 } 8057 rv = ccm_empty_final_op(cfg, 0, 1, fixed_key, fixed_iv, fixed_aad, 8058 sizeof(fixed_aad) - 1, tag_stream, &why); 8059 if (!TEST_int_eq(rv, 1)) { 8060 TEST_error("%s: one-shot verification failed at %s", 8061 cfg->name, why ? why : "FINAL"); 8062 goto end; 8063 } 8064 8065 memcpy(bad_tag, tag_stream, cfg->taglen); 8066 bad_tag[0] ^= 1; 8067 rv = ccm_empty_final_op(cfg, 0, 0, fixed_key, fixed_iv, fixed_aad, 8068 sizeof(fixed_aad) - 1, bad_tag, &why); 8069 if (!TEST_int_eq(rv, 0)) { 8070 TEST_error("%s: streaming Final accepted an invalid tag", cfg->name); 8071 goto end; 8072 } 8073 ERR_clear_error(); 8074 rv = ccm_empty_final_op(cfg, 0, 1, fixed_key, fixed_iv, fixed_aad, 8075 sizeof(fixed_aad) - 1, bad_tag, &why); 8076 if (!TEST_int_eq(rv, 0)) { 8077 TEST_error("%s: one-shot Final accepted an invalid tag", cfg->name); 8078 goto end; 8079 } 8080 ERR_clear_error(); 8081 8082 ok = 1; 8083 end: 8084 return ok; 8085 } 8086 8087 #ifndef OPENSSL_NO_DES 8088 static int test_EVP_CIPHER_get_type_des_ede3(void) 8089 { 8090 const EVP_CIPHER *cipher = NULL; 8091 int base_type, variant_type, nid; 8092 int ret = 0; 8093 8094 /* Get the base type from CFB64 (should be NID_des_ede3_cfb64) */ 8095 cipher = EVP_des_ede3_cfb64(); 8096 base_type = EVP_CIPHER_get_type(cipher); 8097 8098 /* Test CFB64 - should map to the same base_type */ 8099 variant_type = EVP_CIPHER_get_type(cipher); 8100 nid = EVP_CIPHER_get_nid(cipher); 8101 8102 /* Verify the returned type */ 8103 if (!TEST_int_eq(variant_type, base_type)) 8104 goto end; 8105 8106 /* Verify that variant_type and nid are same for 64-bit variants */ 8107 if (!TEST_int_eq(variant_type, nid)) 8108 goto end; 8109 8110 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) 8111 goto end; 8112 8113 /* Test CFB8 - should map to the same base_type */ 8114 cipher = EVP_des_ede3_cfb8(); 8115 variant_type = EVP_CIPHER_get_type(cipher); 8116 nid = EVP_CIPHER_get_nid(cipher); 8117 8118 /* Verify the returned type */ 8119 if (!TEST_int_eq(variant_type, base_type)) 8120 goto end; 8121 8122 /* Verify that variant_type and nid are different for variants */ 8123 if (!TEST_int_ne(variant_type, nid)) 8124 goto end; 8125 8126 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) 8127 goto end; 8128 8129 /* Test CFB1 - should map to the same base_type */ 8130 cipher = EVP_des_ede3_cfb1(); 8131 variant_type = EVP_CIPHER_get_type(cipher); 8132 nid = EVP_CIPHER_get_nid(cipher); 8133 8134 /* Verify the returned type */ 8135 if (!TEST_int_eq(variant_type, base_type)) 8136 goto end; 8137 8138 /* Verify that variant_type and nid are different for variants */ 8139 if (!TEST_int_ne(variant_type, nid)) 8140 goto end; 8141 8142 if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) 8143 goto end; 8144 8145 ret = 1; 8146 end: 8147 return ret; 8148 } 8149 #endif /*OPENSSL_NO_DES */ 8150 8151 static int test_evp_cipher_pipeline(void) 8152 { 8153 OSSL_PROVIDER *fake_pipeline = NULL; 8154 int testresult = 0; 8155 EVP_CIPHER *cipher = NULL; 8156 EVP_CIPHER *pipeline_cipher = NULL; 8157 EVP_CIPHER_CTX *ctx = NULL; 8158 unsigned char key[32]; 8159 size_t keylen = 32; 8160 size_t ivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_FIXED_IV_LEN; 8161 size_t taglen = EVP_GCM_TLS_TAG_LEN; 8162 unsigned char *iv_array[EVP_MAX_PIPES], *tag_array[EVP_MAX_PIPES]; 8163 unsigned char *plaintext_array[EVP_MAX_PIPES]; 8164 unsigned char *ciphertext_array_p[EVP_MAX_PIPES]; 8165 void **aead_tags = (void **)&tag_array; 8166 unsigned char *temp[EVP_MAX_PIPES]; 8167 size_t outsize_array[EVP_MAX_PIPES], outlen_array[EVP_MAX_PIPES]; 8168 size_t ciphertextlen_array[EVP_MAX_PIPES]; 8169 size_t inlen_array[EVP_MAX_PIPES]; 8170 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; 8171 unsigned char *ciphertext, *exp_plaintext, *tag; 8172 size_t numpipes, plaintextlen, i; 8173 8174 if (!TEST_ptr(fake_pipeline = fake_pipeline_start(testctx))) 8175 return 0; 8176 if (!TEST_ptr(pipeline_cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", 8177 "provider=fake-pipeline")) 8178 || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", 8179 "provider!=fake-pipeline")) 8180 || !TEST_ptr(ctx = EVP_CIPHER_CTX_new())) 8181 goto end; 8182 memset(key, 0x01, sizeof(key)); 8183 8184 /* Negative tests */ 8185 if (!TEST_false(EVP_CIPHER_can_pipeline(cipher, 1))) 8186 goto end; 8187 if (!TEST_false(EVP_CIPHER_can_pipeline(EVP_aes_256_gcm(), 1))) 8188 goto end; 8189 if (!TEST_false(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher, 8190 key, keylen, 8191 EVP_MAX_PIPES + 1, NULL, 0))) 8192 goto end; 8193 8194 /* Positive tests */ 8195 for (numpipes = 1; numpipes <= EVP_MAX_PIPES; numpipes++) { 8196 for (plaintextlen = 1; plaintextlen <= 256; plaintextlen++) { 8197 size_t ciphertextlen = 0; 8198 int outlen = 0; 8199 8200 /* Cleanup to be able to error out */ 8201 memset(iv_array, 0, sizeof(iv_array)); 8202 memset(plaintext_array, 0, sizeof(plaintext_array)); 8203 memset(ciphertext_array_p, 0, sizeof(ciphertext_array_p)); 8204 memset(tag_array, 0, sizeof(tag_array)); 8205 ciphertext = NULL; 8206 exp_plaintext = NULL; 8207 tag = NULL; 8208 8209 /* Allocate fresh buffers with exact size to catch buffer overwrites */ 8210 for (i = 0; i < numpipes; i++) { 8211 if (!TEST_ptr(iv_array[i] = OPENSSL_malloc(ivlen)) 8212 || !TEST_ptr(plaintext_array[i] = OPENSSL_malloc(plaintextlen)) 8213 || !TEST_ptr(ciphertext_array_p[i] = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH)) 8214 || !TEST_ptr(tag_array[i] = OPENSSL_malloc(taglen))) 8215 goto err; 8216 8217 memset(iv_array[i], i + 33, ivlen); 8218 memset(plaintext_array[i], i + 1, plaintextlen); 8219 inlen_array[i] = plaintextlen; 8220 outlen_array[i] = 0; 8221 ciphertextlen_array[i] = 0; 8222 outsize_array[i] = plaintextlen + EVP_MAX_BLOCK_LENGTH; 8223 } 8224 if (!TEST_ptr(ciphertext = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH)) 8225 || !TEST_ptr(tag = OPENSSL_malloc(taglen)) 8226 || !TEST_ptr(exp_plaintext = OPENSSL_malloc(plaintextlen))) 8227 goto err; 8228 8229 /* Encrypt using pipeline API */ 8230 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)) 8231 || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 1)) 8232 || !TEST_true(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher, 8233 key, keylen, numpipes, 8234 (const unsigned char **)iv_array, 8235 ivlen)) 8236 /* reuse plaintext for AAD as it won't affect test */ 8237 || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL, 8238 (const unsigned char **)plaintext_array, 8239 inlen_array)) 8240 || !TEST_true(EVP_CipherPipelineUpdate(ctx, ciphertext_array_p, 8241 outlen_array, outsize_array, 8242 (const unsigned char **)plaintext_array, 8243 inlen_array))) 8244 goto err; 8245 8246 for (i = 0; i < numpipes; i++) { 8247 ciphertextlen_array[i] = outlen_array[i]; 8248 temp[i] = ciphertext_array_p[i] + ciphertextlen_array[i]; 8249 outsize_array[i] = outsize_array[i] - ciphertextlen_array[i]; 8250 } 8251 8252 if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array))) 8253 goto err; 8254 8255 for (i = 0; i < numpipes; i++) 8256 ciphertextlen_array[i] += outlen_array[i]; 8257 8258 params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG, 8259 (void **)&aead_tags, taglen); 8260 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))) 8261 goto err; 8262 8263 /* Encrypt using non-pipeline API and compare */ 8264 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx))) 8265 goto err; 8266 8267 for (i = 0; i < numpipes; i++) { 8268 if (!TEST_true(EVP_EncryptInit(ctx, cipher, key, iv_array[i])) 8269 || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen, 8270 plaintext_array[i], 8271 plaintextlen)) 8272 || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &outlen, 8273 plaintext_array[i], 8274 plaintextlen))) 8275 goto err; 8276 ciphertextlen = outlen; 8277 8278 if (!TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext + outlen, &outlen))) 8279 goto err; 8280 ciphertextlen += outlen; 8281 8282 params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, 8283 (void *)tag, taglen); 8284 if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))) 8285 goto err; 8286 8287 if (!TEST_mem_eq(ciphertext_array_p[i], ciphertextlen_array[i], 8288 ciphertext, ciphertextlen) 8289 || !TEST_mem_eq(tag_array[i], taglen, tag, taglen)) 8290 goto err; 8291 } 8292 8293 for (i = 0; i < numpipes; i++) 8294 outsize_array[i] = plaintextlen; 8295 8296 /* Decrypt using pipeline API and compare */ 8297 params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG, 8298 (void **)&aead_tags, taglen); 8299 if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)) 8300 || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 0)) 8301 || !TEST_true(EVP_CipherPipelineDecryptInit(ctx, pipeline_cipher, 8302 key, keylen, numpipes, 8303 (const unsigned char **)iv_array, 8304 ivlen)) 8305 || !TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)) 8306 || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL, 8307 (const unsigned char **)plaintext_array, 8308 inlen_array)) 8309 || !TEST_true(EVP_CipherPipelineUpdate(ctx, plaintext_array, 8310 outlen_array, outsize_array, 8311 (const unsigned char **)ciphertext_array_p, 8312 ciphertextlen_array))) 8313 goto err; 8314 8315 for (i = 0; i < numpipes; i++) { 8316 temp[i] = plaintext_array[i] + outlen_array[i]; 8317 outsize_array[i] = outsize_array[i] - outlen_array[i]; 8318 } 8319 8320 if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array))) 8321 goto err; 8322 8323 for (i = 0; i < numpipes; i++) { 8324 memset(exp_plaintext, i + 1, plaintextlen); 8325 if (!TEST_mem_eq(plaintext_array[i], plaintextlen, 8326 exp_plaintext, plaintextlen)) 8327 goto err; 8328 } 8329 8330 for (i = 0; i < numpipes; i++) { 8331 OPENSSL_free(iv_array[i]); 8332 OPENSSL_free(plaintext_array[i]); 8333 OPENSSL_free(ciphertext_array_p[i]); 8334 OPENSSL_free(tag_array[i]); 8335 } 8336 OPENSSL_free(exp_plaintext); 8337 OPENSSL_free(ciphertext); 8338 OPENSSL_free(tag); 8339 } 8340 } 8341 8342 testresult = 1; 8343 goto end; 8344 8345 err: 8346 for (i = 0; i < numpipes; i++) { 8347 OPENSSL_free(iv_array[i]); 8348 OPENSSL_free(plaintext_array[i]); 8349 OPENSSL_free(ciphertext_array_p[i]); 8350 OPENSSL_free(tag_array[i]); 8351 } 8352 OPENSSL_free(exp_plaintext); 8353 OPENSSL_free(ciphertext); 8354 OPENSSL_free(tag); 8355 end: 8356 EVP_CIPHER_CTX_free(ctx); 8357 EVP_CIPHER_free(cipher); 8358 EVP_CIPHER_free(pipeline_cipher); 8359 fake_pipeline_finish(fake_pipeline); 8360 return testresult; 8361 } 8362 8363 int setup_tests(void) 8364 { 8365 char *config_file = NULL; 8366 OPTION_CHOICE o; 8367 8368 while ((o = opt_next()) != OPT_EOF) { 8369 switch (o) { 8370 case OPT_CONTEXT: 8371 /* Set up an alternate library context */ 8372 testctx = OSSL_LIB_CTX_new(); 8373 if (!TEST_ptr(testctx)) 8374 return 0; 8375 #ifdef STATIC_LEGACY 8376 /* 8377 * This test is always statically linked against libcrypto. We must not 8378 * attempt to load legacy.so that might be dynamically linked against 8379 * libcrypto. Instead we use a built-in version of the legacy provider. 8380 */ 8381 if (!OSSL_PROVIDER_add_builtin(testctx, "legacy", ossl_legacy_provider_init)) 8382 return 0; 8383 #endif 8384 /* Swap the libctx to test non-default context only */ 8385 nullprov = OSSL_PROVIDER_load(NULL, "null"); 8386 deflprov = OSSL_PROVIDER_load(testctx, "default"); 8387 #ifndef OPENSSL_SYS_TANDEM 8388 lgcyprov = OSSL_PROVIDER_load(testctx, "legacy"); 8389 #endif 8390 break; 8391 case OPT_CONFIG_FILE: 8392 config_file = opt_arg(); 8393 if (!test_get_libctx(&testctx, &nullprov, config_file, NULL, NULL)) 8394 return 0; 8395 break; 8396 case OPT_TEST_CASES: 8397 break; 8398 default: 8399 return 0; 8400 } 8401 } 8402 8403 if (config_file != NULL) { 8404 ADD_TEST(test_EVP_set_config_properties); 8405 return 1; 8406 } 8407 8408 ADD_TEST(test_EVP_set_default_properties); 8409 ADD_ALL_TESTS(test_EVP_DigestSignInit, 30); 8410 ADD_TEST(test_EVP_DigestVerifyInit); 8411 #ifndef OPENSSL_NO_EC 8412 ADD_TEST(test_ecdsa_digestsign_keccak); 8413 #endif 8414 #ifndef OPENSSL_NO_SIPHASH 8415 ADD_TEST(test_siphash_digestsign); 8416 #endif 8417 ADD_TEST(test_EVP_Digest); 8418 ADD_TEST(test_EVP_md_null); 8419 #ifndef OPENSSL_NO_POLY1305 8420 ADD_TEST(test_evp_mac_poly1305_no_key); 8421 #endif 8422 ADD_ALL_TESTS(test_EVP_PKEY_sign, 3); 8423 #ifndef OPENSSL_NO_DEPRECATED_3_0 8424 ADD_ALL_TESTS(test_EVP_PKEY_sign_with_app_method, 2); 8425 #endif 8426 ADD_ALL_TESTS(test_EVP_Enveloped, 2); 8427 ADD_ALL_TESTS(test_d2i_AutoPrivateKey, OSSL_NELEM(keydata)); 8428 ADD_TEST(test_privatekey_to_pkcs8); 8429 ADD_TEST(test_EVP_PKCS82PKEY_wrong_tag); 8430 ADD_ALL_TESTS(test_EVP_PKCS82PKEY_v2, OSSL_NELEM(keydata_v2)); 8431 #ifndef OPENSSL_NO_EC 8432 ADD_TEST(test_EVP_PKCS82PKEY); 8433 #endif 8434 #ifndef OPENSSL_NO_EC 8435 ADD_ALL_TESTS(test_EC_keygen_with_enc, OSSL_NELEM(ec_encodings)); 8436 #endif 8437 #if !defined(OPENSSL_NO_SM2) 8438 ADD_TEST(test_EVP_SM2); 8439 ADD_TEST(test_EVP_SM2_verify); 8440 #endif 8441 ADD_ALL_TESTS(test_set_get_raw_keys, OSSL_NELEM(keys)); 8442 #ifndef OPENSSL_NO_DEPRECATED_3_0 8443 custom_pmeth = EVP_PKEY_meth_new(0xdefaced, 0); 8444 if (!TEST_ptr(custom_pmeth)) 8445 return 0; 8446 EVP_PKEY_meth_set_check(custom_pmeth, pkey_custom_check); 8447 EVP_PKEY_meth_set_public_check(custom_pmeth, pkey_custom_pub_check); 8448 EVP_PKEY_meth_set_param_check(custom_pmeth, pkey_custom_param_check); 8449 if (!TEST_int_eq(EVP_PKEY_meth_add0(custom_pmeth), 1)) 8450 return 0; 8451 #endif 8452 ADD_ALL_TESTS(test_EVP_PKEY_check, OSSL_NELEM(keycheckdata)); 8453 #ifndef OPENSSL_NO_CMAC 8454 ADD_TEST(test_CMAC_keygen); 8455 #endif 8456 ADD_TEST(test_HKDF); 8457 ADD_TEST(test_emptyikm_HKDF); 8458 ADD_TEST(test_empty_salt_info_HKDF); 8459 #ifndef OPENSSL_NO_EC 8460 ADD_TEST(test_X509_PUBKEY_inplace); 8461 ADD_TEST(test_X509_PUBKEY_dup); 8462 ADD_ALL_TESTS(test_invalide_ec_char2_pub_range_decode, 8463 OSSL_NELEM(ec_der_pub_keys)); 8464 #endif 8465 #ifndef OPENSSL_NO_DSA 8466 ADD_TEST(test_DSA_get_set_params); 8467 ADD_TEST(test_DSA_priv_pub); 8468 #endif 8469 ADD_TEST(test_RSA_get_set_params); 8470 ADD_TEST(test_RSA_OAEP_set_get_params); 8471 ADD_TEST(test_RSA_OAEP_set_null_label); 8472 ADD_TEST(test_RSA_verify_recover_rejects_short_buffer); 8473 ADD_TEST(test_RSA_verify_recover_empty_payload); 8474 ADD_TEST(test_RSA_encrypt); 8475 #ifndef OPENSSL_NO_DEPRECATED_3_0 8476 ADD_TEST(test_RSA_legacy); 8477 #endif 8478 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) 8479 ADD_TEST(test_decrypt_null_chunks); 8480 ADD_TEST(test_chacha20_poly1305_late_aad); 8481 #endif 8482 #ifndef OPENSSL_NO_DH 8483 ADD_TEST(test_DH_priv_pub); 8484 #ifndef OPENSSL_NO_DEPRECATED_3_0 8485 ADD_TEST(test_EVP_PKEY_set1_DH); 8486 #endif 8487 ADD_TEST(test_dhx_derive_rejects_bad_peer_q); 8488 #endif 8489 #ifndef OPENSSL_NO_EC 8490 ADD_TEST(test_EC_priv_pub); 8491 ADD_TEST(test_evp_get_ec_pub); 8492 #ifndef OPENSSL_NO_DEPRECATED_3_0 8493 ADD_TEST(test_EC_priv_only_legacy); 8494 ADD_TEST(test_evp_get_ec_pub_legacy); 8495 #endif 8496 #endif 8497 ADD_ALL_TESTS(test_keygen_with_empty_template, 2); 8498 ADD_ALL_TESTS(test_pkey_ctx_fail_without_provider, 2); 8499 8500 ADD_TEST(test_rand_agglomeration); 8501 ADD_ALL_TESTS(test_evp_iv_aes, 12); 8502 #ifndef OPENSSL_NO_DES 8503 ADD_ALL_TESTS(test_evp_iv_des, 6); 8504 ADD_TEST(test_EVP_CIPHER_get_type_des_ede3); 8505 #endif /* OPENSSL_NO_DES */ 8506 #ifndef OPENSSL_NO_BF 8507 ADD_ALL_TESTS(test_evp_bf_default_keylen, 4); 8508 #endif 8509 ADD_TEST(test_EVP_rsa_pss_with_keygen_bits); 8510 ADD_TEST(test_EVP_rsa_pss_set_saltlen); 8511 ADD_TEST(test_EVP_rsa_invalid_key); 8512 #ifndef OPENSSL_NO_EC 8513 ADD_ALL_TESTS(test_ecpub, OSSL_NELEM(ecpub_nids)); 8514 #endif 8515 8516 ADD_TEST(test_names_do_all); 8517 8518 ADD_ALL_TESTS(test_evp_init_seq, OSSL_NELEM(evp_init_tests)); 8519 ADD_ALL_TESTS(test_evp_reset, OSSL_NELEM(evp_reset_tests)); 8520 ADD_ALL_TESTS(test_evp_reinit_seq, OSSL_NELEM(evp_reinit_tests)); 8521 ADD_ALL_TESTS(test_gcm_reinit, OSSL_NELEM(gcm_reinit_tests)); 8522 ADD_ALL_TESTS(test_evp_updated_iv, OSSL_NELEM(evp_updated_iv_tests)); 8523 ADD_ALL_TESTS(test_ivlen_change, OSSL_NELEM(ivlen_change_ciphers)); 8524 if (OSSL_NELEM(keylen_change_ciphers) - 1 > 0) 8525 ADD_ALL_TESTS(test_keylen_change, OSSL_NELEM(keylen_change_ciphers) - 1); 8526 #if !defined(OPENSSL_NO_MULTIBLOCK) 8527 ADD_TEST(test_aes_cbc_hmac_sha_short_multiblock_aad); 8528 ADD_TEST(test_aes_cbc_hmac_sha_large_multiblock_aad); 8529 #endif 8530 8531 #ifndef OPENSSL_NO_DEPRECATED_3_0 8532 ADD_ALL_TESTS(test_custom_pmeth, 12); 8533 ADD_TEST(test_evp_md_cipher_meth); 8534 ADD_TEST(test_custom_md_meth); 8535 ADD_TEST(test_custom_ciph_meth); 8536 ADD_TEST(test_rsasve_kem_with_invalid_pub_key); 8537 8538 #ifndef OPENSSL_NO_DYNAMIC_ENGINE 8539 /* Tests only support the default libctx */ 8540 if (testctx == NULL) { 8541 #ifndef OPENSSL_NO_EC 8542 ADD_ALL_TESTS(test_signatures_with_engine, 3); 8543 #else 8544 ADD_ALL_TESTS(test_signatures_with_engine, 2); 8545 #endif 8546 ADD_TEST(test_cipher_with_engine); 8547 } 8548 #endif 8549 #endif 8550 8551 #ifndef OPENSSL_NO_ECX 8552 ADD_ALL_TESTS(test_ecx_short_keys, OSSL_NELEM(ecxnids)); 8553 ADD_ALL_TESTS(test_ecx_not_private_key, OSSL_NELEM(keys)); 8554 #endif 8555 8556 ADD_TEST(test_sign_continuation); 8557 8558 /* Test cases for CVE-2023-5363 */ 8559 ADD_TEST(test_aes_gcm_ivlen_change_cve_2023_5363); 8560 #ifndef OPENSSL_NO_RC4 8561 ADD_TEST(test_aes_rc4_keylen_change_cve_2023_5363); 8562 #endif 8563 8564 ADD_ALL_TESTS(test_aead_oneshot_roundtrip, 2 * OSSL_NELEM(aead_oneshot_cfgs)); 8565 ADD_ALL_TESTS(test_aead_oneshot_zerolen, 8566 2 * OSSL_NELEM(aead_oneshot_zerolen_cfgs)); 8567 8568 ADD_ALL_TESTS(test_rsasve_degenerate_exponent, 2); 8569 ADD_ALL_TESTS(test_rsasve_degenerate_ciphertext, 3); 8570 ADD_ALL_TESTS(test_ccm_empty_final, OSSL_NELEM(ccm_empty_final_cfgs)); 8571 8572 /* Test cases for CVE-2026-45446 */ 8573 ADD_TEST(test_aes_gcm_siv_empty_data); 8574 ADD_TEST(test_aes_siv_ctx_reuse); 8575 ADD_TEST(test_aes_siv_ctx_dec_retval); 8576 ADD_TEST(test_aes_siv_ctx_enc_retval); 8577 8578 ADD_TEST(test_invalid_ctx_for_digest); 8579 8580 ADD_TEST(test_evp_cipher_negative_length); 8581 8582 ADD_TEST(test_evp_cipher_pipeline); 8583 8584 return 1; 8585 } 8586 8587 void cleanup_tests(void) 8588 { 8589 OSSL_PROVIDER_unload(nullprov); 8590 OSSL_PROVIDER_unload(deflprov); 8591 #ifndef OPENSSL_SYS_TANDEM 8592 OSSL_PROVIDER_unload(lgcyprov); 8593 #endif 8594 OSSL_LIB_CTX_free(testctx); 8595 } 8596