1 /* 2 * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2018-2020, Oracle and/or its affiliates. All rights reserved. 4 * 5 * Licensed under the Apache License 2.0 (the "License"). You may not use 6 * this file except in compliance with the License. You can obtain a copy 7 * in the file LICENSE in the source distribution or at 8 * https://www.openssl.org/source/license.html 9 */ 10 11 /* Tests of the EVP_KDF_CTX APIs */ 12 13 #include <stdio.h> 14 #include <string.h> 15 16 #include <openssl/evp.h> 17 #include <openssl/kdf.h> 18 #include <openssl/core_names.h> 19 #include "internal/numbers.h" 20 #include "testutil.h" 21 22 23 static EVP_KDF_CTX *get_kdfbyname_libctx(OSSL_LIB_CTX *libctx, const char *name) 24 { 25 EVP_KDF *kdf = EVP_KDF_fetch(libctx, name, NULL); 26 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf); 27 28 EVP_KDF_free(kdf); 29 return kctx; 30 } 31 32 static EVP_KDF_CTX *get_kdfbyname(const char *name) 33 { 34 return get_kdfbyname_libctx(NULL, name); 35 } 36 37 static OSSL_PARAM *construct_tls1_prf_params(const char *digest, const char *secret, 38 const char *seed) 39 { 40 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 4); 41 OSSL_PARAM *p = params; 42 43 if (params == NULL) 44 return NULL; 45 46 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 47 (char *)digest, 0); 48 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, 49 (unsigned char *)secret, 50 strlen(secret)); 51 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 52 (unsigned char *)seed, 53 strlen(seed)); 54 *p = OSSL_PARAM_construct_end(); 55 56 return params; 57 } 58 59 static int test_kdf_tls1_prf(void) 60 { 61 int ret; 62 EVP_KDF_CTX *kctx = NULL; 63 unsigned char out[16]; 64 OSSL_PARAM *params; 65 static const unsigned char expected[sizeof(out)] = { 66 0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0, 67 0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc 68 }; 69 70 params = construct_tls1_prf_params("sha256", "secret", "seed"); 71 72 ret = TEST_ptr(params) 73 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 74 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 75 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 76 77 EVP_KDF_CTX_free(kctx); 78 OPENSSL_free(params); 79 return ret; 80 } 81 82 static int test_kdf_tls1_prf_invalid_digest(void) 83 { 84 int ret; 85 EVP_KDF_CTX *kctx = NULL; 86 OSSL_PARAM *params; 87 88 params = construct_tls1_prf_params("blah", "secret", "seed"); 89 90 ret = TEST_ptr(params) 91 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 92 && TEST_false(EVP_KDF_CTX_set_params(kctx, params)); 93 94 EVP_KDF_CTX_free(kctx); 95 OPENSSL_free(params); 96 return ret; 97 } 98 99 static int test_kdf_tls1_prf_zero_output_size(void) 100 { 101 int ret; 102 EVP_KDF_CTX *kctx = NULL; 103 unsigned char out[16]; 104 OSSL_PARAM *params; 105 106 params = construct_tls1_prf_params("sha256", "secret", "seed"); 107 108 /* Negative test - derive should fail */ 109 ret = TEST_ptr(params) 110 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 111 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 112 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0); 113 114 EVP_KDF_CTX_free(kctx); 115 OPENSSL_free(params); 116 return ret; 117 } 118 119 static int test_kdf_tls1_prf_empty_secret(void) 120 { 121 int ret; 122 EVP_KDF_CTX *kctx = NULL; 123 unsigned char out[16]; 124 OSSL_PARAM *params; 125 126 params = construct_tls1_prf_params("sha256", "", "seed"); 127 128 ret = TEST_ptr(params) 129 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 130 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 131 132 EVP_KDF_CTX_free(kctx); 133 OPENSSL_free(params); 134 return ret; 135 } 136 137 static int test_kdf_tls1_prf_1byte_secret(void) 138 { 139 int ret; 140 EVP_KDF_CTX *kctx = NULL; 141 unsigned char out[16]; 142 OSSL_PARAM *params; 143 144 params = construct_tls1_prf_params("sha256", "1", "seed"); 145 146 ret = TEST_ptr(params) 147 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 148 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 149 150 EVP_KDF_CTX_free(kctx); 151 OPENSSL_free(params); 152 return ret; 153 } 154 155 static int test_kdf_tls1_prf_empty_seed(void) 156 { 157 int ret; 158 EVP_KDF_CTX *kctx = NULL; 159 unsigned char out[16]; 160 OSSL_PARAM *params; 161 162 params = construct_tls1_prf_params("sha256", "secret", ""); 163 164 /* Negative test - derive should fail */ 165 ret = TEST_ptr(params) 166 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 167 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 168 && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0); 169 170 EVP_KDF_CTX_free(kctx); 171 OPENSSL_free(params); 172 return ret; 173 } 174 175 static int test_kdf_tls1_prf_1byte_seed(void) 176 { 177 int ret; 178 EVP_KDF_CTX *kctx = NULL; 179 unsigned char out[16]; 180 OSSL_PARAM *params; 181 182 params = construct_tls1_prf_params("sha256", "secret", "1"); 183 184 ret = TEST_ptr(params) 185 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF)) 186 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 187 188 EVP_KDF_CTX_free(kctx); 189 OPENSSL_free(params); 190 return ret; 191 } 192 193 static OSSL_PARAM *construct_hkdf_params(char *digest, char *key, 194 size_t keylen, char *salt, char *info) 195 { 196 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5); 197 OSSL_PARAM *p = params; 198 199 if (params == NULL) 200 return NULL; 201 202 if (digest != NULL) 203 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 204 digest, 0); 205 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, 206 salt, strlen(salt)); 207 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, 208 (unsigned char *)key, keylen); 209 if (info != NULL) 210 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, 211 info, strlen(info)); 212 else 213 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, 214 "EXTRACT_ONLY", 0); 215 *p = OSSL_PARAM_construct_end(); 216 217 return params; 218 } 219 220 static int test_kdf_hkdf(void) 221 { 222 int ret; 223 EVP_KDF_CTX *kctx = NULL; 224 unsigned char out[10]; 225 OSSL_PARAM *params; 226 static const unsigned char expected[sizeof(out)] = { 227 0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13 228 }; 229 230 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label"); 231 232 ret = TEST_ptr(params) 233 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 234 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 235 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 236 237 EVP_KDF_CTX_free(kctx); 238 OPENSSL_free(params); 239 return ret; 240 } 241 242 static int do_kdf_hkdf_gettables(int expand_only, int has_digest) 243 { 244 int ret = 0; 245 size_t sz = 0; 246 OSSL_PARAM *params; 247 OSSL_PARAM params_get[2]; 248 const OSSL_PARAM *gettables, *p; 249 EVP_KDF_CTX *kctx = NULL; 250 251 if (!TEST_ptr(params = construct_hkdf_params( 252 has_digest ? "sha256" : NULL, 253 "secret", 6, "salt", 254 expand_only ? NULL : "label")) 255 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 256 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))) 257 goto err; 258 259 /* Check OSSL_KDF_PARAM_SIZE is gettable */ 260 if (!TEST_ptr(gettables = EVP_KDF_CTX_gettable_params(kctx)) 261 || !TEST_ptr(p = OSSL_PARAM_locate_const(gettables, OSSL_KDF_PARAM_SIZE))) 262 goto err; 263 264 /* Get OSSL_KDF_PARAM_SIZE as a size_t */ 265 params_get[0] = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_SIZE, &sz); 266 params_get[1] = OSSL_PARAM_construct_end(); 267 if (has_digest) { 268 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1) 269 || !TEST_size_t_eq(sz, expand_only ? SHA256_DIGEST_LENGTH : SIZE_MAX)) 270 goto err; 271 } else { 272 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 0)) 273 goto err; 274 } 275 276 /* Get params returns -2 if an unsupported parameter is requested */ 277 params_get[0] = OSSL_PARAM_construct_end(); 278 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), -2)) 279 goto err; 280 ret = 1; 281 err: 282 EVP_KDF_CTX_free(kctx); 283 OPENSSL_free(params); 284 return ret; 285 } 286 287 static int test_kdf_hkdf_gettables(void) 288 { 289 return do_kdf_hkdf_gettables(0, 1); 290 } 291 292 static int test_kdf_hkdf_gettables_expandonly(void) 293 { 294 return do_kdf_hkdf_gettables(1, 1); 295 } 296 297 static int test_kdf_hkdf_gettables_no_digest(void) 298 { 299 return do_kdf_hkdf_gettables(1, 0); 300 } 301 302 static int test_kdf_hkdf_invalid_digest(void) 303 { 304 int ret; 305 EVP_KDF_CTX *kctx = NULL; 306 OSSL_PARAM *params; 307 308 params = construct_hkdf_params("blah", "secret", 6, "salt", "label"); 309 310 ret = TEST_ptr(params) 311 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 312 && TEST_false(EVP_KDF_CTX_set_params(kctx, params)); 313 314 EVP_KDF_CTX_free(kctx); 315 OPENSSL_free(params); 316 return ret; 317 } 318 319 static int test_kdf_hkdf_derive_set_params_fail(void) 320 { 321 int ret = 0, i = 0; 322 EVP_KDF_CTX *kctx = NULL; 323 OSSL_PARAM params[2]; 324 unsigned char out[10]; 325 326 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))) 327 goto end; 328 /* 329 * Set the wrong type for the digest so that it causes a failure 330 * inside kdf_hkdf_derive() when kdf_hkdf_set_ctx_params() is called 331 */ 332 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_DIGEST, &i); 333 params[1] = OSSL_PARAM_construct_end(); 334 if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)) 335 goto end; 336 ret = 1; 337 end: 338 EVP_KDF_CTX_free(kctx); 339 return ret; 340 } 341 342 static int test_kdf_hkdf_set_invalid_mode(void) 343 { 344 int ret = 0, bad_mode = 100; 345 EVP_KDF_CTX *kctx = NULL; 346 OSSL_PARAM params[2]; 347 348 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))) 349 goto end; 350 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, 351 "BADMODE", 0); 352 params[1] = OSSL_PARAM_construct_end(); 353 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0)) 354 goto end; 355 356 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &bad_mode); 357 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0)) 358 goto end; 359 360 ret = 1; 361 end: 362 EVP_KDF_CTX_free(kctx); 363 return ret; 364 } 365 366 static int do_kdf_hkdf_set_invalid_param(const char *key, int type) 367 { 368 int ret = 0; 369 EVP_KDF_CTX *kctx = NULL; 370 OSSL_PARAM params[2]; 371 unsigned char buf[2]; 372 373 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))) 374 goto end; 375 /* Set the wrong type for the key so that it causes a failure */ 376 if (type == OSSL_PARAM_UTF8_STRING) 377 params[0] = OSSL_PARAM_construct_utf8_string(key, "BAD", 0); 378 else 379 params[0] = OSSL_PARAM_construct_octet_string(key, buf, sizeof(buf)); 380 params[1] = OSSL_PARAM_construct_end(); 381 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0)) 382 goto end; 383 384 ret = 1; 385 end: 386 EVP_KDF_CTX_free(kctx); 387 return ret; 388 } 389 390 static int test_kdf_hkdf_set_ctx_param_fail(void) 391 { 392 return do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_MODE, 393 OSSL_PARAM_OCTET_STRING) 394 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_KEY, 395 OSSL_PARAM_UTF8_STRING) 396 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_SALT, 397 OSSL_PARAM_UTF8_STRING) 398 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_INFO, 399 OSSL_PARAM_UTF8_STRING); 400 } 401 402 static int test_kdf_hkdf_zero_output_size(void) 403 { 404 int ret; 405 EVP_KDF_CTX *kctx = NULL; 406 unsigned char out[10]; 407 OSSL_PARAM *params; 408 409 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label"); 410 411 /* Negative test - derive should fail */ 412 ret = TEST_ptr(params) 413 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 414 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 415 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0); 416 417 EVP_KDF_CTX_free(kctx); 418 OPENSSL_free(params); 419 return ret; 420 } 421 422 static int test_kdf_hkdf_empty_key(void) 423 { 424 int ret; 425 EVP_KDF_CTX *kctx = NULL; 426 unsigned char out[10]; 427 OSSL_PARAM *params; 428 429 params = construct_hkdf_params("sha256", "", 0, "salt", "label"); 430 431 ret = TEST_ptr(params) 432 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 433 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 434 435 EVP_KDF_CTX_free(kctx); 436 OPENSSL_free(params); 437 return ret; 438 } 439 440 static int test_kdf_hkdf_1byte_key(void) 441 { 442 int ret; 443 EVP_KDF_CTX *kctx = NULL; 444 unsigned char out[10]; 445 OSSL_PARAM *params; 446 447 params = construct_hkdf_params("sha256", "1", 1, "salt", "label"); 448 449 ret = TEST_ptr(params) 450 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 451 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 452 453 EVP_KDF_CTX_free(kctx); 454 OPENSSL_free(params); 455 return ret; 456 } 457 458 static int test_kdf_hkdf_empty_salt(void) 459 { 460 int ret; 461 EVP_KDF_CTX *kctx = NULL; 462 unsigned char out[10]; 463 OSSL_PARAM *params; 464 465 params = construct_hkdf_params("sha256", "secret", 6, "", "label"); 466 467 ret = TEST_ptr(params) 468 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)) 469 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0); 470 471 EVP_KDF_CTX_free(kctx); 472 OPENSSL_free(params); 473 return ret; 474 } 475 476 static OSSL_PARAM *construct_pbkdf1_params(char *pass, char *digest, char *salt, 477 unsigned int *iter) 478 { 479 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5); 480 OSSL_PARAM *p = params; 481 482 if (params == NULL) 483 return NULL; 484 485 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD, 486 (unsigned char *)pass, strlen(pass)); 487 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, 488 (unsigned char *)salt, strlen(salt)); 489 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter); 490 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 491 digest, 0); 492 *p = OSSL_PARAM_construct_end(); 493 494 return params; 495 } 496 497 static int test_kdf_pbkdf1(void) 498 { 499 int ret = 0; 500 EVP_KDF_CTX *kctx = NULL; 501 unsigned char out[25]; 502 unsigned int iterations = 4096; 503 OSSL_LIB_CTX *libctx = NULL; 504 OSSL_PARAM *params = NULL; 505 OSSL_PROVIDER *legacyprov = NULL; 506 OSSL_PROVIDER *defprov = NULL; 507 const unsigned char expected[sizeof(out)] = { 508 0xfb, 0x83, 0x4d, 0x36, 0x6d, 0xbc, 0x53, 0x87, 0x35, 0x1b, 0x34, 0x75, 509 0x95, 0x88, 0x32, 0x4f, 0x3e, 0x82, 0x81, 0x01, 0x21, 0x93, 0x64, 0x00, 510 0xcc 511 }; 512 513 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new())) 514 goto err; 515 516 /* PBKDF1 only available in the legacy provider */ 517 legacyprov = OSSL_PROVIDER_load(libctx, "legacy"); 518 if (legacyprov == NULL) { 519 OSSL_LIB_CTX_free(libctx); 520 return TEST_skip("PBKDF1 only available in legacy provider"); 521 } 522 523 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default"))) 524 goto err; 525 526 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256", 527 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 528 &iterations); 529 530 if (!TEST_ptr(params) 531 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1)) 532 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 533 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0) 534 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected))) 535 goto err; 536 537 ret = 1; 538 err: 539 EVP_KDF_CTX_free(kctx); 540 OPENSSL_free(params); 541 OSSL_PROVIDER_unload(defprov); 542 OSSL_PROVIDER_unload(legacyprov); 543 OSSL_LIB_CTX_free(libctx); 544 return ret; 545 } 546 547 static int test_kdf_pbkdf1_key_too_long(void) 548 { 549 int ret = 0; 550 EVP_KDF_CTX *kctx = NULL; 551 unsigned char out[EVP_MAX_MD_SIZE + 1]; 552 unsigned int iterations = 4096; 553 OSSL_LIB_CTX *libctx = NULL; 554 OSSL_PARAM *params = NULL; 555 OSSL_PROVIDER *legacyprov = NULL; 556 OSSL_PROVIDER *defprov = NULL; 557 558 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new())) 559 goto err; 560 561 /* PBKDF1 only available in the legacy provider */ 562 legacyprov = OSSL_PROVIDER_load(libctx, "legacy"); 563 if (legacyprov == NULL) { 564 OSSL_LIB_CTX_free(libctx); 565 return TEST_skip("PBKDF1 only available in legacy provider"); 566 } 567 568 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default"))) 569 goto err; 570 571 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256", 572 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 573 &iterations); 574 575 /* 576 * This is the same test sequence as test_kdf_pbkdf1, but we expect 577 * failure here as the requested key size is longer than the digest 578 * can provide 579 */ 580 if (!TEST_ptr(params) 581 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1)) 582 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 583 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)) 584 goto err; 585 586 ret = 1; 587 err: 588 EVP_KDF_CTX_free(kctx); 589 OPENSSL_free(params); 590 OSSL_PROVIDER_unload(defprov); 591 OSSL_PROVIDER_unload(legacyprov); 592 OSSL_LIB_CTX_free(libctx); 593 return ret; 594 } 595 596 static OSSL_PARAM *construct_pbkdf2_params(char *pass, char *digest, char *salt, 597 unsigned int *iter, int *mode) 598 { 599 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 6); 600 OSSL_PARAM *p = params; 601 602 if (params == NULL) 603 return NULL; 604 605 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD, 606 (unsigned char *)pass, strlen(pass)); 607 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, 608 (unsigned char *)salt, strlen(salt)); 609 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter); 610 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 611 digest, 0); 612 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, mode); 613 *p = OSSL_PARAM_construct_end(); 614 615 return params; 616 } 617 618 static int test_kdf_pbkdf2(void) 619 { 620 int ret = 0; 621 EVP_KDF_CTX *kctx = NULL; 622 unsigned char out[25]; 623 unsigned int iterations = 4096; 624 int mode = 0; 625 OSSL_PARAM *params; 626 const unsigned char expected[sizeof(out)] = { 627 0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f, 628 0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf, 629 0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18, 630 0x1c 631 }; 632 633 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 634 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 635 &iterations, &mode); 636 637 if (!TEST_ptr(params) 638 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 639 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 640 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected))) 641 goto err; 642 643 ret = 1; 644 err: 645 EVP_KDF_CTX_free(kctx); 646 OPENSSL_free(params); 647 return ret; 648 } 649 650 static int test_kdf_pbkdf2_small_output(void) 651 { 652 int ret = 0; 653 EVP_KDF_CTX *kctx = NULL; 654 unsigned char out[25]; 655 unsigned int iterations = 4096; 656 int mode = 0; 657 OSSL_PARAM *params; 658 659 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 660 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 661 &iterations, &mode); 662 663 if (!TEST_ptr(params) 664 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 665 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 666 /* A key length that is too small should fail */ 667 || !TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1, NULL), 0)) 668 goto err; 669 670 ret = 1; 671 err: 672 EVP_KDF_CTX_free(kctx); 673 OPENSSL_free(params); 674 return ret; 675 } 676 677 static int test_kdf_pbkdf2_large_output(void) 678 { 679 int ret = 0; 680 EVP_KDF_CTX *kctx = NULL; 681 unsigned char out[25]; 682 size_t len = 0; 683 unsigned int iterations = 4096; 684 int mode = 0; 685 OSSL_PARAM *params; 686 687 if (sizeof(len) > 32) 688 len = SIZE_MAX; 689 690 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 691 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 692 &iterations, &mode); 693 694 if (!TEST_ptr(params) 695 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 696 /* A key length that is too large should fail */ 697 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 698 || (len != 0 && !TEST_int_eq(EVP_KDF_derive(kctx, out, len, NULL), 0))) 699 goto err; 700 701 ret = 1; 702 err: 703 EVP_KDF_CTX_free(kctx); 704 OPENSSL_free(params); 705 return ret; 706 } 707 708 static int test_kdf_pbkdf2_small_salt(void) 709 { 710 int ret = 0; 711 EVP_KDF_CTX *kctx = NULL; 712 unsigned int iterations = 4096; 713 int mode = 0; 714 OSSL_PARAM *params; 715 716 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 717 "saltSALT", 718 &iterations, &mode); 719 720 if (!TEST_ptr(params) 721 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 722 /* A salt that is too small should fail */ 723 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params))) 724 goto err; 725 726 ret = 1; 727 err: 728 EVP_KDF_CTX_free(kctx); 729 OPENSSL_free(params); 730 return ret; 731 } 732 733 static int test_kdf_pbkdf2_small_iterations(void) 734 { 735 int ret = 0; 736 EVP_KDF_CTX *kctx = NULL; 737 unsigned int iterations = 1; 738 int mode = 0; 739 OSSL_PARAM *params; 740 741 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 742 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 743 &iterations, &mode); 744 745 if (!TEST_ptr(params) 746 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 747 /* An iteration count that is too small should fail */ 748 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params))) 749 goto err; 750 751 ret = 1; 752 err: 753 EVP_KDF_CTX_free(kctx); 754 OPENSSL_free(params); 755 return ret; 756 } 757 758 static int test_kdf_pbkdf2_small_salt_pkcs5(void) 759 { 760 int ret = 0; 761 EVP_KDF_CTX *kctx = NULL; 762 unsigned char out[25]; 763 unsigned int iterations = 4096; 764 int mode = 1; 765 OSSL_PARAM *params; 766 OSSL_PARAM mode_params[2]; 767 768 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 769 "saltSALT", 770 &iterations, &mode); 771 772 if (!TEST_ptr(params) 773 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 774 /* A salt that is too small should pass in pkcs5 mode */ 775 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 776 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)) 777 goto err; 778 779 mode = 0; 780 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode); 781 mode_params[1] = OSSL_PARAM_construct_end(); 782 783 /* If the "pkcs5" mode is disabled then the derive will now fail */ 784 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params)) 785 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)) 786 goto err; 787 788 ret = 1; 789 err: 790 EVP_KDF_CTX_free(kctx); 791 OPENSSL_free(params); 792 return ret; 793 } 794 795 static int test_kdf_pbkdf2_small_iterations_pkcs5(void) 796 { 797 int ret = 0; 798 EVP_KDF_CTX *kctx = NULL; 799 unsigned char out[25]; 800 unsigned int iterations = 1; 801 int mode = 1; 802 OSSL_PARAM *params; 803 OSSL_PARAM mode_params[2]; 804 805 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256", 806 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 807 &iterations, &mode); 808 809 if (!TEST_ptr(params) 810 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 811 /* An iteration count that is too small will pass in pkcs5 mode */ 812 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 813 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)) 814 goto err; 815 816 mode = 0; 817 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode); 818 mode_params[1] = OSSL_PARAM_construct_end(); 819 820 /* If the "pkcs5" mode is disabled then the derive will now fail */ 821 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params)) 822 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)) 823 goto err; 824 825 ret = 1; 826 err: 827 EVP_KDF_CTX_free(kctx); 828 OPENSSL_free(params); 829 return ret; 830 } 831 832 static int test_kdf_pbkdf2_invalid_digest(void) 833 { 834 int ret = 0; 835 EVP_KDF_CTX *kctx = NULL; 836 unsigned int iterations = 4096; 837 int mode = 0; 838 OSSL_PARAM *params; 839 840 params = construct_pbkdf2_params("passwordPASSWORDpassword", "blah", 841 "saltSALTsaltSALTsaltSALTsaltSALTsalt", 842 &iterations, &mode); 843 844 if (!TEST_ptr(params) 845 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2)) 846 /* Unknown digest should fail */ 847 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params))) 848 goto err; 849 850 ret = 1; 851 err: 852 EVP_KDF_CTX_free(kctx); 853 OPENSSL_free(params); 854 return ret; 855 } 856 857 #ifndef OPENSSL_NO_SCRYPT 858 static int test_kdf_scrypt(void) 859 { 860 int ret; 861 EVP_KDF_CTX *kctx; 862 OSSL_PARAM params[7], *p = params; 863 unsigned char out[64]; 864 unsigned int nu = 1024, ru = 8, pu = 16, maxmem = 16; 865 static const unsigned char expected[sizeof(out)] = { 866 0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00, 867 0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe, 868 0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30, 869 0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62, 870 0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88, 871 0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda, 872 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d, 873 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40 874 }; 875 876 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD, 877 (char *)"password", 8); 878 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, 879 (char *)"NaCl", 4); 880 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_N, &nu); 881 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_R, &ru); 882 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_P, &pu); 883 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem); 884 *p = OSSL_PARAM_construct_end(); 885 886 ret = 887 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT)) 888 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 889 /* failure test *//* 890 && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)*/ 891 && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024)) 892 && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1)) 893 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0) 894 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 895 896 EVP_KDF_CTX_free(kctx); 897 return ret; 898 } 899 #endif /* OPENSSL_NO_SCRYPT */ 900 901 static int test_kdf_ss_hash(void) 902 { 903 int ret; 904 EVP_KDF_CTX *kctx; 905 OSSL_PARAM params[4], *p = params; 906 unsigned char out[14]; 907 static unsigned char z[] = { 908 0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e, 909 0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62, 910 0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4, 911 0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9 912 }; 913 static unsigned char other[] = { 914 0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e, 915 0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde, 916 0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e, 917 0xe0,0xec,0x3f,0x8d,0xbe 918 }; 919 static const unsigned char expected[sizeof(out)] = { 920 0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8 921 }; 922 923 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 924 (char *)"sha224", 0); 925 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z)); 926 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other, 927 sizeof(other)); 928 *p = OSSL_PARAM_construct_end(); 929 930 ret = 931 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF)) 932 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 933 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 934 935 EVP_KDF_CTX_free(kctx); 936 return ret; 937 } 938 939 static int test_kdf_x963(void) 940 { 941 int ret; 942 EVP_KDF_CTX *kctx; 943 OSSL_PARAM params[4], *p = params; 944 unsigned char out[1024 / 8]; 945 /* 946 * Test data from https://csrc.nist.gov/CSRC/media/Projects/ 947 * Cryptographic-Algorithm-Validation-Program/documents/components/ 948 * 800-135testvectors/ansx963_2001.zip 949 */ 950 static unsigned char z[] = { 951 0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad, 952 0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9, 953 0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f, 954 0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f, 955 0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7, 956 0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d 957 }; 958 static unsigned char shared[] = { 959 0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99, 960 0x37, 0x89, 0x5d, 0x31 961 }; 962 static const unsigned char expected[sizeof(out)] = { 963 0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b, 964 0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8, 965 0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5, 966 0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e, 967 0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee, 968 0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02, 969 0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7, 970 0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd, 971 0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e, 972 0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc, 973 0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16 974 }; 975 976 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 977 (char *)"sha512", 0); 978 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z)); 979 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, shared, 980 sizeof(shared)); 981 *p = OSSL_PARAM_construct_end(); 982 983 ret = 984 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X963KDF)) 985 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 986 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 987 988 EVP_KDF_CTX_free(kctx); 989 return ret; 990 } 991 992 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA) 993 /* 994 * KBKDF test vectors from RFC 6803 (Camellia Encryption for Kerberos 5) 995 * section 10. 996 */ 997 static int test_kdf_kbkdf_6803_128(void) 998 { 999 int ret = 0, i, p; 1000 EVP_KDF_CTX *kctx; 1001 OSSL_PARAM params[7]; 1002 static unsigned char input_key[] = { 1003 0x57, 0xD0, 0x29, 0x72, 0x98, 0xFF, 0xD9, 0xD3, 1004 0x5D, 0xE5, 0xA4, 0x7F, 0xB4, 0xBD, 0xE2, 0x4B, 1005 }; 1006 static unsigned char constants[][5] = { 1007 { 0x00, 0x00, 0x00, 0x02, 0x99 }, 1008 { 0x00, 0x00, 0x00, 0x02, 0xaa }, 1009 { 0x00, 0x00, 0x00, 0x02, 0x55 }, 1010 }; 1011 static unsigned char outputs[][16] = { 1012 {0xD1, 0x55, 0x77, 0x5A, 0x20, 0x9D, 0x05, 0xF0, 1013 0x2B, 0x38, 0xD4, 0x2A, 0x38, 0x9E, 0x5A, 0x56}, 1014 {0x64, 0xDF, 0x83, 0xF8, 0x5A, 0x53, 0x2F, 0x17, 1015 0x57, 0x7D, 0x8C, 0x37, 0x03, 0x57, 0x96, 0xAB}, 1016 {0x3E, 0x4F, 0xBD, 0xF3, 0x0F, 0xB8, 0x25, 0x9C, 1017 0x42, 0x5C, 0xB6, 0xC9, 0x6F, 0x1F, 0x46, 0x35} 1018 }; 1019 static unsigned char iv[16] = { 0 }; 1020 unsigned char result[16] = { 0 }; 1021 1022 for (i = 0; i < 3; i++) { 1023 p = 0; 1024 params[p++] = OSSL_PARAM_construct_utf8_string( 1025 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-128-CBC", 0); 1026 params[p++] = OSSL_PARAM_construct_utf8_string( 1027 OSSL_KDF_PARAM_MAC, "CMAC", 0); 1028 params[p++] = OSSL_PARAM_construct_utf8_string( 1029 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0); 1030 params[p++] = OSSL_PARAM_construct_octet_string( 1031 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key)); 1032 params[p++] = OSSL_PARAM_construct_octet_string( 1033 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i])); 1034 params[p++] = OSSL_PARAM_construct_octet_string( 1035 OSSL_KDF_PARAM_SEED, iv, sizeof(iv)); 1036 params[p] = OSSL_PARAM_construct_end(); 1037 1038 kctx = get_kdfbyname("KBKDF"); 1039 ret = TEST_ptr(kctx) 1040 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), 1041 params), 0) 1042 && TEST_mem_eq(result, sizeof(result), outputs[i], 1043 sizeof(outputs[i])); 1044 EVP_KDF_CTX_free(kctx); 1045 if (ret != 1) 1046 return ret; 1047 } 1048 1049 return ret; 1050 } 1051 1052 static int test_kdf_kbkdf_6803_256(void) 1053 { 1054 int ret = 0, i, p; 1055 EVP_KDF_CTX *kctx; 1056 OSSL_PARAM params[7]; 1057 static unsigned char input_key[] = { 1058 0xB9, 0xD6, 0x82, 0x8B, 0x20, 0x56, 0xB7, 0xBE, 1059 0x65, 0x6D, 0x88, 0xA1, 0x23, 0xB1, 0xFA, 0xC6, 1060 0x82, 0x14, 0xAC, 0x2B, 0x72, 0x7E, 0xCF, 0x5F, 1061 0x69, 0xAF, 0xE0, 0xC4, 0xDF, 0x2A, 0x6D, 0x2C, 1062 }; 1063 static unsigned char constants[][5] = { 1064 { 0x00, 0x00, 0x00, 0x02, 0x99 }, 1065 { 0x00, 0x00, 0x00, 0x02, 0xaa }, 1066 { 0x00, 0x00, 0x00, 0x02, 0x55 }, 1067 }; 1068 static unsigned char outputs[][32] = { 1069 {0xE4, 0x67, 0xF9, 0xA9, 0x55, 0x2B, 0xC7, 0xD3, 1070 0x15, 0x5A, 0x62, 0x20, 0xAF, 0x9C, 0x19, 0x22, 1071 0x0E, 0xEE, 0xD4, 0xFF, 0x78, 0xB0, 0xD1, 0xE6, 1072 0xA1, 0x54, 0x49, 0x91, 0x46, 0x1A, 0x9E, 0x50, 1073 }, 1074 {0x41, 0x2A, 0xEF, 0xC3, 0x62, 0xA7, 0x28, 0x5F, 1075 0xC3, 0x96, 0x6C, 0x6A, 0x51, 0x81, 0xE7, 0x60, 1076 0x5A, 0xE6, 0x75, 0x23, 0x5B, 0x6D, 0x54, 0x9F, 1077 0xBF, 0xC9, 0xAB, 0x66, 0x30, 0xA4, 0xC6, 0x04, 1078 }, 1079 {0xFA, 0x62, 0x4F, 0xA0, 0xE5, 0x23, 0x99, 0x3F, 1080 0xA3, 0x88, 0xAE, 0xFD, 0xC6, 0x7E, 0x67, 0xEB, 1081 0xCD, 0x8C, 0x08, 0xE8, 0xA0, 0x24, 0x6B, 0x1D, 1082 0x73, 0xB0, 0xD1, 0xDD, 0x9F, 0xC5, 0x82, 0xB0, 1083 }, 1084 }; 1085 static unsigned char iv[16] = { 0 }; 1086 unsigned char result[32] = { 0 }; 1087 1088 for (i = 0; i < 3; i++) { 1089 p = 0; 1090 params[p++] = OSSL_PARAM_construct_utf8_string( 1091 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-256-CBC", 0); 1092 params[p++] = OSSL_PARAM_construct_utf8_string( 1093 OSSL_KDF_PARAM_MAC, "CMAC", 0); 1094 params[p++] = OSSL_PARAM_construct_utf8_string( 1095 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0); 1096 params[p++] = OSSL_PARAM_construct_octet_string( 1097 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key)); 1098 params[p++] = OSSL_PARAM_construct_octet_string( 1099 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i])); 1100 params[p++] = OSSL_PARAM_construct_octet_string( 1101 OSSL_KDF_PARAM_SEED, iv, sizeof(iv)); 1102 params[p] = OSSL_PARAM_construct_end(); 1103 1104 kctx = get_kdfbyname("KBKDF"); 1105 ret = TEST_ptr(kctx) 1106 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), 1107 params), 0) 1108 && TEST_mem_eq(result, sizeof(result), outputs[i], 1109 sizeof(outputs[i])); 1110 EVP_KDF_CTX_free(kctx); 1111 if (ret != 1) 1112 return ret; 1113 } 1114 1115 return ret; 1116 } 1117 #endif 1118 1119 static OSSL_PARAM *construct_kbkdf_params(char *digest, char *mac, unsigned char *key, 1120 size_t keylen, char *salt, char *info) 1121 { 1122 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 7); 1123 OSSL_PARAM *p = params; 1124 1125 if (params == NULL) 1126 return NULL; 1127 1128 *p++ = OSSL_PARAM_construct_utf8_string( 1129 OSSL_KDF_PARAM_DIGEST, digest, 0); 1130 *p++ = OSSL_PARAM_construct_utf8_string( 1131 OSSL_KDF_PARAM_MAC, mac, 0); 1132 *p++ = OSSL_PARAM_construct_utf8_string( 1133 OSSL_KDF_PARAM_MODE, "COUNTER", 0); 1134 *p++ = OSSL_PARAM_construct_octet_string( 1135 OSSL_KDF_PARAM_KEY, key, keylen); 1136 *p++ = OSSL_PARAM_construct_octet_string( 1137 OSSL_KDF_PARAM_SALT, salt, strlen(salt)); 1138 *p++ = OSSL_PARAM_construct_octet_string( 1139 OSSL_KDF_PARAM_INFO, info, strlen(info)); 1140 *p = OSSL_PARAM_construct_end(); 1141 1142 return params; 1143 } 1144 1145 static int test_kdf_kbkdf_invalid_digest(void) 1146 { 1147 int ret; 1148 EVP_KDF_CTX *kctx; 1149 OSSL_PARAM *params; 1150 1151 static unsigned char key[] = {0x01}; 1152 1153 params = construct_kbkdf_params("blah", "HMAC", key, 1, "prf", "test"); 1154 if (!TEST_ptr(params)) 1155 return 0; 1156 1157 /* Negative test case - set_params should fail */ 1158 kctx = get_kdfbyname("KBKDF"); 1159 ret = TEST_ptr(kctx) 1160 && TEST_false(EVP_KDF_CTX_set_params(kctx, params)); 1161 1162 EVP_KDF_CTX_free(kctx); 1163 OPENSSL_free(params); 1164 return ret; 1165 } 1166 1167 static int test_kdf_kbkdf_invalid_mac(void) 1168 { 1169 int ret; 1170 EVP_KDF_CTX *kctx; 1171 OSSL_PARAM *params; 1172 1173 static unsigned char key[] = {0x01}; 1174 1175 params = construct_kbkdf_params("sha256", "blah", key, 1, "prf", "test"); 1176 if (!TEST_ptr(params)) 1177 return 0; 1178 1179 /* Negative test case - set_params should fail */ 1180 kctx = get_kdfbyname("KBKDF"); 1181 ret = TEST_ptr(kctx) 1182 && TEST_false(EVP_KDF_CTX_set_params(kctx, params)); 1183 1184 EVP_KDF_CTX_free(kctx); 1185 OPENSSL_free(params); 1186 return ret; 1187 } 1188 1189 static int test_kdf_kbkdf_empty_key(void) 1190 { 1191 int ret; 1192 EVP_KDF_CTX *kctx; 1193 OSSL_PARAM *params; 1194 1195 static unsigned char key[] = {0x01}; 1196 unsigned char result[32] = { 0 }; 1197 1198 params = construct_kbkdf_params("sha256", "HMAC", key, 0, "prf", "test"); 1199 if (!TEST_ptr(params)) 1200 return 0; 1201 1202 /* Negative test case - derive should fail */ 1203 kctx = get_kdfbyname("KBKDF"); 1204 ret = TEST_ptr(kctx) 1205 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 1206 && TEST_int_eq(EVP_KDF_derive(kctx, result, sizeof(result), NULL), 0); 1207 1208 EVP_KDF_CTX_free(kctx); 1209 OPENSSL_free(params); 1210 return ret; 1211 } 1212 1213 static int test_kdf_kbkdf_1byte_key(void) 1214 { 1215 int ret; 1216 EVP_KDF_CTX *kctx; 1217 OSSL_PARAM *params; 1218 1219 static unsigned char key[] = {0x01}; 1220 unsigned char result[32] = { 0 }; 1221 1222 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test"); 1223 if (!TEST_ptr(params)) 1224 return 0; 1225 1226 kctx = get_kdfbyname("KBKDF"); 1227 ret = TEST_ptr(kctx) 1228 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0); 1229 1230 EVP_KDF_CTX_free(kctx); 1231 OPENSSL_free(params); 1232 return ret; 1233 } 1234 1235 static int test_kdf_kbkdf_zero_output_size(void) 1236 { 1237 int ret; 1238 EVP_KDF_CTX *kctx; 1239 OSSL_PARAM *params; 1240 1241 static unsigned char key[] = {0x01}; 1242 unsigned char result[32] = { 0 }; 1243 1244 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test"); 1245 if (!TEST_ptr(params)) 1246 return 0; 1247 1248 /* Negative test case - derive should fail */ 1249 kctx = get_kdfbyname("KBKDF"); 1250 ret = TEST_ptr(kctx) 1251 && TEST_true(EVP_KDF_CTX_set_params(kctx, params)) 1252 && TEST_int_eq(EVP_KDF_derive(kctx, result, 0, NULL), 0); 1253 1254 EVP_KDF_CTX_free(kctx); 1255 OPENSSL_free(params); 1256 return ret; 1257 } 1258 1259 /* Two test vectors from RFC 8009 (AES Encryption with HMAC-SHA2 for Kerberos 1260 * 5) appendix A. */ 1261 static int test_kdf_kbkdf_8009_prf1(void) 1262 { 1263 int ret, i = 0; 1264 EVP_KDF_CTX *kctx; 1265 OSSL_PARAM params[6]; 1266 char *label = "prf", *digest = "sha256", *prf_input = "test", 1267 *mac = "HMAC"; 1268 static unsigned char input_key[] = { 1269 0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28, 1270 0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C, 1271 }; 1272 static unsigned char output[] = { 1273 0x9D, 0x18, 0x86, 0x16, 0xF6, 0x38, 0x52, 0xFE, 1274 0x86, 0x91, 0x5B, 0xB8, 0x40, 0xB4, 0xA8, 0x86, 1275 0xFF, 0x3E, 0x6B, 0xB0, 0xF8, 0x19, 0xB4, 0x9B, 1276 0x89, 0x33, 0x93, 0xD3, 0x93, 0x85, 0x42, 0x95, 1277 }; 1278 unsigned char result[sizeof(output)] = { 0 }; 1279 1280 params[i++] = OSSL_PARAM_construct_utf8_string( 1281 OSSL_KDF_PARAM_DIGEST, digest, 0); 1282 params[i++] = OSSL_PARAM_construct_utf8_string( 1283 OSSL_KDF_PARAM_MAC, mac, 0); 1284 params[i++] = OSSL_PARAM_construct_octet_string( 1285 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key)); 1286 params[i++] = OSSL_PARAM_construct_octet_string( 1287 OSSL_KDF_PARAM_SALT, label, strlen(label)); 1288 params[i++] = OSSL_PARAM_construct_octet_string( 1289 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input)); 1290 params[i] = OSSL_PARAM_construct_end(); 1291 1292 kctx = get_kdfbyname("KBKDF"); 1293 ret = TEST_ptr(kctx) 1294 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0) 1295 && TEST_mem_eq(result, sizeof(result), output, sizeof(output)); 1296 1297 EVP_KDF_CTX_free(kctx); 1298 return ret; 1299 } 1300 1301 static int test_kdf_kbkdf_8009_prf2(void) 1302 { 1303 int ret, i = 0; 1304 EVP_KDF_CTX *kctx; 1305 OSSL_PARAM params[6]; 1306 char *label = "prf", *digest = "sha384", *prf_input = "test", 1307 *mac = "HMAC"; 1308 static unsigned char input_key[] = { 1309 0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D, 1310 0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98, 1311 0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0, 1312 0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52, 1313 }; 1314 static unsigned char output[] = { 1315 0x98, 0x01, 0xF6, 0x9A, 0x36, 0x8C, 0x2B, 0xF6, 1316 0x75, 0xE5, 0x95, 0x21, 0xE1, 0x77, 0xD9, 0xA0, 1317 0x7F, 0x67, 0xEF, 0xE1, 0xCF, 0xDE, 0x8D, 0x3C, 1318 0x8D, 0x6F, 0x6A, 0x02, 0x56, 0xE3, 0xB1, 0x7D, 1319 0xB3, 0xC1, 0xB6, 0x2A, 0xD1, 0xB8, 0x55, 0x33, 1320 0x60, 0xD1, 0x73, 0x67, 0xEB, 0x15, 0x14, 0xD2, 1321 }; 1322 unsigned char result[sizeof(output)] = { 0 }; 1323 1324 params[i++] = OSSL_PARAM_construct_utf8_string( 1325 OSSL_KDF_PARAM_DIGEST, digest, 0); 1326 params[i++] = OSSL_PARAM_construct_utf8_string( 1327 OSSL_KDF_PARAM_MAC, mac, 0); 1328 params[i++] = OSSL_PARAM_construct_octet_string( 1329 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key)); 1330 params[i++] = OSSL_PARAM_construct_octet_string( 1331 OSSL_KDF_PARAM_SALT, label, strlen(label)); 1332 params[i++] = OSSL_PARAM_construct_octet_string( 1333 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input)); 1334 params[i] = OSSL_PARAM_construct_end(); 1335 1336 kctx = get_kdfbyname("KBKDF"); 1337 ret = TEST_ptr(kctx) 1338 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0) 1339 && TEST_mem_eq(result, sizeof(result), output, sizeof(output)); 1340 1341 EVP_KDF_CTX_free(kctx); 1342 return ret; 1343 } 1344 1345 #if !defined(OPENSSL_NO_CMAC) 1346 /* 1347 * Test vector taken from 1348 * https://csrc.nist.gov/CSRC/media/Projects/ 1349 * Cryptographic-Algorithm-Validation-Program/documents/KBKDF800-108/CounterMode.zip 1350 * Note: Only 32 bit counter is supported ([RLEN=32_BITS]) 1351 */ 1352 static int test_kdf_kbkdf_fixedinfo(void) 1353 { 1354 int ret; 1355 EVP_KDF_CTX *kctx; 1356 OSSL_PARAM params[8], *p = params; 1357 static char *cipher = "AES128"; 1358 static char *mac = "CMAC"; 1359 static char *mode = "COUNTER"; 1360 int use_l = 0; 1361 int use_separator = 0; 1362 1363 static unsigned char input_key[] = { 1364 0xc1, 0x0b, 0x15, 0x2e, 0x8c, 0x97, 0xb7, 0x7e, 1365 0x18, 0x70, 0x4e, 0x0f, 0x0b, 0xd3, 0x83, 0x05, 1366 }; 1367 static unsigned char fixed_input[] = { 1368 0x98, 0xcd, 0x4c, 0xbb, 0xbe, 0xbe, 0x15, 0xd1, 1369 0x7d, 0xc8, 0x6e, 0x6d, 0xba, 0xd8, 0x00, 0xa2, 1370 0xdc, 0xbd, 0x64, 0xf7, 0xc7, 0xad, 0x0e, 0x78, 1371 0xe9, 0xcf, 0x94, 0xff, 0xdb, 0xa8, 0x9d, 0x03, 1372 0xe9, 0x7e, 0xad, 0xf6, 0xc4, 0xf7, 0xb8, 0x06, 1373 0xca, 0xf5, 0x2a, 0xa3, 0x8f, 0x09, 0xd0, 0xeb, 1374 0x71, 0xd7, 0x1f, 0x49, 0x7b, 0xcc, 0x69, 0x06, 1375 0xb4, 0x8d, 0x36, 0xc4, 1376 1377 }; 1378 static unsigned char output[] = { 1379 0x26, 0xfa, 0xf6, 0x19, 0x08, 0xad, 0x9e, 0xe8, 1380 0x81, 0xb8, 0x30, 0x5c, 0x22, 0x1d, 0xb5, 0x3f, 1381 }; 1382 unsigned char result[sizeof(output)] = { 0 }; 1383 1384 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0); 1385 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0); 1386 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, mode, 0); 1387 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, input_key, 1388 sizeof(input_key)); 1389 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, 1390 fixed_input, sizeof(fixed_input)); 1391 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &use_l); 1392 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR, 1393 &use_separator); 1394 *p = OSSL_PARAM_construct_end(); 1395 1396 kctx = get_kdfbyname("KBKDF"); 1397 ret = TEST_ptr(kctx) 1398 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0) 1399 && TEST_mem_eq(result, sizeof(result), output, sizeof(output)); 1400 1401 EVP_KDF_CTX_free(kctx); 1402 return ret; 1403 } 1404 #endif /* OPENSSL_NO_CMAC */ 1405 1406 static int test_kdf_ss_hmac(void) 1407 { 1408 int ret; 1409 EVP_KDF_CTX *kctx; 1410 OSSL_PARAM params[6], *p = params; 1411 unsigned char out[16]; 1412 static unsigned char z[] = { 1413 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4 1414 }; 1415 static unsigned char other[] = { 1416 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc 1417 }; 1418 static unsigned char salt[] = { 1419 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef, 1420 0x3f,0x89 1421 }; 1422 static const unsigned char expected[sizeof(out)] = { 1423 0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63, 1424 0x1c,0xa3 1425 }; 1426 1427 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, 1428 (char *)OSSL_MAC_NAME_HMAC, 0); 1429 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 1430 (char *)"sha256", 0); 1431 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z)); 1432 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other, 1433 sizeof(other)); 1434 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt, 1435 sizeof(salt)); 1436 *p = OSSL_PARAM_construct_end(); 1437 1438 ret = 1439 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF)) 1440 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 1441 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 1442 1443 EVP_KDF_CTX_free(kctx); 1444 return ret; 1445 } 1446 1447 static int test_kdf_ss_kmac(void) 1448 { 1449 int ret; 1450 EVP_KDF_CTX *kctx; 1451 OSSL_PARAM params[7], *p = params; 1452 unsigned char out[64]; 1453 size_t mac_size = 20; 1454 static unsigned char z[] = { 1455 0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4 1456 }; 1457 static unsigned char other[] = { 1458 0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc 1459 }; 1460 static unsigned char salt[] = { 1461 0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef, 1462 0x3f,0x89 1463 }; 1464 static const unsigned char expected[sizeof(out)] = { 1465 0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd, 1466 0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2, 1467 0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4, 1468 0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95, 1469 0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03 1470 }; 1471 1472 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, 1473 (char *)OSSL_MAC_NAME_KMAC128, 0); 1474 /* The digest parameter is not needed here and should be ignored */ 1475 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 1476 (char *)"SHA256", 0); 1477 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z)); 1478 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other, 1479 sizeof(other)); 1480 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt, 1481 sizeof(salt)); 1482 *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, &mac_size); 1483 *p = OSSL_PARAM_construct_end(); 1484 1485 ret = 1486 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF)) 1487 && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), 0) 1488 && TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1) 1489 /* The bug fix for KMAC returning SIZE_MAX was added in 3.0.8 */ 1490 && (fips_provider_version_lt(NULL, 3, 0, 8) 1491 || TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX)) 1492 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0) 1493 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 1494 1495 EVP_KDF_CTX_free(kctx); 1496 return ret; 1497 } 1498 1499 static int test_kdf_sshkdf(void) 1500 { 1501 int ret; 1502 EVP_KDF_CTX *kctx; 1503 OSSL_PARAM params[6], *p = params; 1504 char kdftype = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV; 1505 unsigned char out[8]; 1506 /* Test data from NIST CAVS 14.1 test vectors */ 1507 static unsigned char key[] = { 1508 0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a, 1509 0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a, 1510 0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa, 1511 0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78, 1512 0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2, 1513 0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90, 1514 0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80, 1515 0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2, 1516 0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08, 1517 0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43, 1518 0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14, 1519 0x4e 1520 }; 1521 static unsigned char xcghash[] = { 1522 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23, 1523 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7, 1524 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42 1525 }; 1526 static unsigned char sessid[] = { 1527 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23, 1528 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7, 1529 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42 1530 }; 1531 static const unsigned char expected[sizeof(out)] = { 1532 0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6 1533 }; 1534 1535 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 1536 (char *)"sha256", 0); 1537 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key, 1538 sizeof(key)); 1539 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_XCGHASH, 1540 xcghash, sizeof(xcghash)); 1541 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_SESSION_ID, 1542 sessid, sizeof(sessid)); 1543 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE, 1544 &kdftype, sizeof(kdftype)); 1545 *p = OSSL_PARAM_construct_end(); 1546 1547 ret = 1548 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSHKDF)) 1549 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 1550 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 1551 1552 EVP_KDF_CTX_free(kctx); 1553 return ret; 1554 } 1555 1556 static int test_kdfs_same( EVP_KDF *kdf1, EVP_KDF *kdf2) 1557 { 1558 /* Fast path in case the two are the same algorithm pointer */ 1559 if (kdf1 == kdf2) 1560 return 1; 1561 /* 1562 * Compare their names and providers instead. 1563 * This is necessary in a non-caching build (or a cache flush during fetch) 1564 * because without the algorithm in the cache, fetching it a second time 1565 * will result in a different pointer. 1566 */ 1567 return TEST_ptr_eq(EVP_KDF_get0_provider(kdf1), EVP_KDF_get0_provider(kdf2)) 1568 && TEST_str_eq(EVP_KDF_get0_name(kdf1), EVP_KDF_get0_name(kdf2)); 1569 } 1570 1571 static int test_kdf_get_kdf(void) 1572 { 1573 EVP_KDF *kdf1 = NULL, *kdf2 = NULL; 1574 ASN1_OBJECT *obj; 1575 int ok = 1; 1576 1577 if (!TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2)) 1578 || !TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL)) 1579 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(OBJ_obj2nid(obj)), 1580 NULL)) 1581 || !test_kdfs_same(kdf1, kdf2)) 1582 ok = 0; 1583 EVP_KDF_free(kdf1); 1584 kdf1 = NULL; 1585 EVP_KDF_free(kdf2); 1586 kdf2 = NULL; 1587 1588 if (!TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, SN_tls1_prf, NULL)) 1589 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, LN_tls1_prf, NULL)) 1590 || !test_kdfs_same(kdf1, kdf2)) 1591 ok = 0; 1592 /* kdf1 is re-used below, so don't free it here */ 1593 EVP_KDF_free(kdf2); 1594 kdf2 = NULL; 1595 1596 if (!TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(NID_tls1_prf), NULL)) 1597 || !test_kdfs_same(kdf1, kdf2)) 1598 ok = 0; 1599 EVP_KDF_free(kdf1); 1600 kdf1 = NULL; 1601 EVP_KDF_free(kdf2); 1602 kdf2 = NULL; 1603 1604 return ok; 1605 } 1606 1607 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES) 1608 static int test_kdf_x942_asn1(void) 1609 { 1610 int ret; 1611 EVP_KDF_CTX *kctx = NULL; 1612 OSSL_PARAM params[4], *p = params; 1613 const char *cek_alg = SN_id_smime_alg_CMS3DESwrap; 1614 unsigned char out[24]; 1615 /* RFC2631 Section 2.1.6 Test data */ 1616 static unsigned char z[] = { 1617 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d, 1618 0x0e,0x0f,0x10,0x11,0x12,0x13 1619 }; 1620 static const unsigned char expected[sizeof(out)] = { 1621 0xa0,0x96,0x61,0x39,0x23,0x76,0xf7,0x04, 1622 0x4d,0x90,0x52,0xa3,0x97,0x88,0x32,0x46, 1623 0xb6,0x7f,0x5f,0x1e,0xf6,0x3e,0xb5,0xfb 1624 }; 1625 1626 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 1627 (char *)"sha1", 0); 1628 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, 1629 sizeof(z)); 1630 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CEK_ALG, 1631 (char *)cek_alg, 0); 1632 *p = OSSL_PARAM_construct_end(); 1633 1634 ret = 1635 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X942KDF_ASN1)) 1636 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 1637 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 1638 1639 EVP_KDF_CTX_free(kctx); 1640 return ret; 1641 } 1642 #endif /* OPENSSL_NO_CMS */ 1643 1644 static int test_kdf_krb5kdf(void) 1645 { 1646 int ret; 1647 EVP_KDF_CTX *kctx; 1648 OSSL_PARAM params[4], *p = params; 1649 unsigned char out[16]; 1650 static unsigned char key[] = { 1651 0x42, 0x26, 0x3C, 0x6E, 0x89, 0xF4, 0xFC, 0x28, 1652 0xB8, 0xDF, 0x68, 0xEE, 0x09, 0x79, 0x9F, 0x15 1653 }; 1654 static unsigned char constant[] = { 1655 0x00, 0x00, 0x00, 0x02, 0x99 1656 }; 1657 static const unsigned char expected[sizeof(out)] = { 1658 0x34, 0x28, 0x0A, 0x38, 0x2B, 0xC9, 0x27, 0x69, 1659 0xB2, 0xDA, 0x2F, 0x9E, 0xF0, 0x66, 0x85, 0x4B 1660 }; 1661 1662 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, 1663 (char *)"AES-128-CBC", 0); 1664 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key, 1665 sizeof(key)); 1666 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT, 1667 constant, sizeof(constant)); 1668 *p = OSSL_PARAM_construct_end(); 1669 1670 ret = 1671 TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KRB5KDF)) 1672 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0) 1673 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)); 1674 1675 EVP_KDF_CTX_free(kctx); 1676 return ret; 1677 } 1678 1679 int setup_tests(void) 1680 { 1681 ADD_TEST(test_kdf_pbkdf1); 1682 ADD_TEST(test_kdf_pbkdf1_key_too_long); 1683 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA) 1684 ADD_TEST(test_kdf_kbkdf_6803_128); 1685 ADD_TEST(test_kdf_kbkdf_6803_256); 1686 #endif 1687 ADD_TEST(test_kdf_kbkdf_invalid_digest); 1688 ADD_TEST(test_kdf_kbkdf_invalid_mac); 1689 ADD_TEST(test_kdf_kbkdf_zero_output_size); 1690 ADD_TEST(test_kdf_kbkdf_empty_key); 1691 ADD_TEST(test_kdf_kbkdf_1byte_key); 1692 ADD_TEST(test_kdf_kbkdf_8009_prf1); 1693 ADD_TEST(test_kdf_kbkdf_8009_prf2); 1694 #if !defined(OPENSSL_NO_CMAC) 1695 ADD_TEST(test_kdf_kbkdf_fixedinfo); 1696 #endif 1697 ADD_TEST(test_kdf_get_kdf); 1698 ADD_TEST(test_kdf_tls1_prf); 1699 ADD_TEST(test_kdf_tls1_prf_invalid_digest); 1700 ADD_TEST(test_kdf_tls1_prf_zero_output_size); 1701 ADD_TEST(test_kdf_tls1_prf_empty_secret); 1702 ADD_TEST(test_kdf_tls1_prf_1byte_secret); 1703 ADD_TEST(test_kdf_tls1_prf_empty_seed); 1704 ADD_TEST(test_kdf_tls1_prf_1byte_seed); 1705 ADD_TEST(test_kdf_hkdf); 1706 ADD_TEST(test_kdf_hkdf_invalid_digest); 1707 ADD_TEST(test_kdf_hkdf_zero_output_size); 1708 ADD_TEST(test_kdf_hkdf_empty_key); 1709 ADD_TEST(test_kdf_hkdf_1byte_key); 1710 ADD_TEST(test_kdf_hkdf_empty_salt); 1711 ADD_TEST(test_kdf_hkdf_gettables); 1712 ADD_TEST(test_kdf_hkdf_gettables_expandonly); 1713 ADD_TEST(test_kdf_hkdf_gettables_no_digest); 1714 ADD_TEST(test_kdf_hkdf_derive_set_params_fail); 1715 ADD_TEST(test_kdf_hkdf_set_invalid_mode); 1716 ADD_TEST(test_kdf_hkdf_set_ctx_param_fail); 1717 ADD_TEST(test_kdf_pbkdf2); 1718 ADD_TEST(test_kdf_pbkdf2_small_output); 1719 ADD_TEST(test_kdf_pbkdf2_large_output); 1720 ADD_TEST(test_kdf_pbkdf2_small_salt); 1721 ADD_TEST(test_kdf_pbkdf2_small_iterations); 1722 ADD_TEST(test_kdf_pbkdf2_small_salt_pkcs5); 1723 ADD_TEST(test_kdf_pbkdf2_small_iterations_pkcs5); 1724 ADD_TEST(test_kdf_pbkdf2_invalid_digest); 1725 #ifndef OPENSSL_NO_SCRYPT 1726 ADD_TEST(test_kdf_scrypt); 1727 #endif 1728 ADD_TEST(test_kdf_ss_hash); 1729 ADD_TEST(test_kdf_ss_hmac); 1730 ADD_TEST(test_kdf_ss_kmac); 1731 ADD_TEST(test_kdf_sshkdf); 1732 ADD_TEST(test_kdf_x963); 1733 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES) 1734 ADD_TEST(test_kdf_x942_asn1); 1735 #endif 1736 ADD_TEST(test_kdf_krb5kdf); 1737 return 1; 1738 } 1739