1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright 2025 Google LLC
4 */
5 #include <crypto/poly1305.h>
6 #include "poly1305-testvecs.h"
7
8 /*
9 * A fixed key used when presenting Poly1305 as an unkeyed hash function in
10 * order to reuse hash-test-template.h. At the beginning of the test suite,
11 * this is initialized to bytes generated from a fixed seed.
12 */
13 static u8 test_key[POLY1305_KEY_SIZE];
14
15 /* This probably should be in the actual API, but just define it here for now */
poly1305(const u8 key[POLY1305_KEY_SIZE],const u8 * data,size_t len,u8 out[POLY1305_DIGEST_SIZE])16 static void poly1305(const u8 key[POLY1305_KEY_SIZE], const u8 *data,
17 size_t len, u8 out[POLY1305_DIGEST_SIZE])
18 {
19 struct poly1305_desc_ctx ctx;
20
21 poly1305_init(&ctx, key);
22 poly1305_update(&ctx, data, len);
23 poly1305_final(&ctx, out);
24 }
25
poly1305_init_withtestkey(struct poly1305_desc_ctx * ctx)26 static void poly1305_init_withtestkey(struct poly1305_desc_ctx *ctx)
27 {
28 poly1305_init(ctx, test_key);
29 }
30
poly1305_withtestkey(const u8 * data,size_t len,u8 out[POLY1305_DIGEST_SIZE])31 static void poly1305_withtestkey(const u8 *data, size_t len,
32 u8 out[POLY1305_DIGEST_SIZE])
33 {
34 poly1305(test_key, data, len, out);
35 }
36
37 /* Generate the HASH_KUNIT_CASES using hash-test-template.h. */
38 #define HASH poly1305_withtestkey
39 #define HASH_CTX poly1305_desc_ctx
40 #define HASH_SIZE POLY1305_DIGEST_SIZE
41 #define HASH_INIT poly1305_init_withtestkey
42 #define HASH_UPDATE poly1305_update
43 #define HASH_FINAL poly1305_final
44 #include "hash-test-template.h"
45
poly1305_suite_init(struct kunit_suite * suite)46 static int poly1305_suite_init(struct kunit_suite *suite)
47 {
48 rand_bytes_seeded_from_len(test_key, POLY1305_KEY_SIZE);
49 return hash_suite_init(suite);
50 }
51
poly1305_suite_exit(struct kunit_suite * suite)52 static void poly1305_suite_exit(struct kunit_suite *suite)
53 {
54 hash_suite_exit(suite);
55 }
56
57 /*
58 * Poly1305 test case which uses a key and message consisting only of one bits:
59 *
60 * - Using an all-one-bits r_key tests the key clamping.
61 * - Using an all-one-bits s_key tests carries in implementations of the
62 * addition mod 2**128 during finalization.
63 * - Using all-one-bits message, and to a lesser extent r_key, tends to maximize
64 * any intermediate accumulator values. This increases the chance of
65 * detecting bugs that occur only in rare cases where the accumulator values
66 * get very large, for example the bug fixed by commit 678cce4019d746da
67 * ("crypto: x86/poly1305 - fix overflow during partial reduction").
68 *
69 * Accumulator overflow bugs may be specific to particular update lengths (in
70 * blocks) and/or particular values of the previous acculumator. Note that the
71 * accumulator starts at 0 which gives the lowest chance of an overflow. Thus,
72 * a single all-one-bits test vector may be insufficient.
73 *
74 * Considering that, do the following test: continuously update a single
75 * Poly1305 context with all-one-bits data of varying lengths (0, 16, 32, ...,
76 * 4096 bytes). After each update, generate the MAC from the current context,
77 * and feed that MAC into a separate Poly1305 context. Repeat that entire
78 * sequence of updates 32 times without re-initializing either context,
79 * resulting in a total of 8224 MAC computations from a long-running, cumulative
80 * context. Finally, generate and verify the MAC of all the MACs.
81 */
test_poly1305_allones_keys_and_message(struct kunit * test)82 static void test_poly1305_allones_keys_and_message(struct kunit *test)
83 {
84 struct poly1305_desc_ctx mac_ctx, macofmacs_ctx;
85 u8 mac[POLY1305_DIGEST_SIZE];
86
87 static_assert(TEST_BUF_LEN >= 4096);
88 memset(test_buf, 0xff, 4096);
89
90 poly1305_init(&mac_ctx, test_buf);
91 poly1305_init(&macofmacs_ctx, test_buf);
92 for (int i = 0; i < 32; i++) {
93 for (size_t len = 0; len <= 4096; len += 16) {
94 struct poly1305_desc_ctx tmp_ctx;
95
96 poly1305_update(&mac_ctx, test_buf, len);
97 tmp_ctx = mac_ctx;
98 poly1305_final(&tmp_ctx, mac);
99 poly1305_update(&macofmacs_ctx, mac,
100 POLY1305_DIGEST_SIZE);
101 }
102 }
103 poly1305_final(&macofmacs_ctx, mac);
104 KUNIT_ASSERT_MEMEQ(test, mac, poly1305_allones_macofmacs,
105 POLY1305_DIGEST_SIZE);
106 }
107
108 /*
109 * Poly1305 test case which uses r_key=1, s_key=0, and a 48-byte message
110 * consisting of three blocks with integer values [2**128 - i, 0, 0]. In this
111 * case, the result of the polynomial evaluation is 2**130 - i. For small
112 * values of i, this is very close to the modulus 2**130 - 5, which helps catch
113 * edge case bugs in the modular reduction logic.
114 */
test_poly1305_reduction_edge_cases(struct kunit * test)115 static void test_poly1305_reduction_edge_cases(struct kunit *test)
116 {
117 static const u8 key[POLY1305_KEY_SIZE] = { 1 }; /* r_key=1, s_key=0 */
118 u8 data[3 * POLY1305_BLOCK_SIZE] = {};
119 u8 expected_mac[POLY1305_DIGEST_SIZE];
120 u8 actual_mac[POLY1305_DIGEST_SIZE];
121
122 for (int i = 1; i <= 10; i++) {
123 /* Set the first data block to 2**128 - i. */
124 data[0] = -i;
125 memset(&data[1], 0xff, POLY1305_BLOCK_SIZE - 1);
126
127 /*
128 * Assuming s_key=0, the expected MAC as an integer is
129 * (2**130 - i mod 2**130 - 5) + 0 mod 2**128. If 1 <= i <= 5,
130 * that's 5 - i. If 6 <= i <= 10, that's 2**128 - i.
131 */
132 if (i <= 5) {
133 expected_mac[0] = 5 - i;
134 memset(&expected_mac[1], 0, POLY1305_DIGEST_SIZE - 1);
135 } else {
136 expected_mac[0] = -i;
137 memset(&expected_mac[1], 0xff,
138 POLY1305_DIGEST_SIZE - 1);
139 }
140
141 /* Compute and verify the MAC. */
142 poly1305(key, data, sizeof(data), actual_mac);
143 KUNIT_ASSERT_MEMEQ(test, actual_mac, expected_mac,
144 POLY1305_DIGEST_SIZE);
145 }
146 }
147
148 static struct kunit_case poly1305_test_cases[] = {
149 HASH_KUNIT_CASES,
150 KUNIT_CASE(test_poly1305_allones_keys_and_message),
151 KUNIT_CASE(test_poly1305_reduction_edge_cases),
152 KUNIT_CASE(benchmark_hash),
153 {},
154 };
155
156 static struct kunit_suite poly1305_test_suite = {
157 .name = "poly1305",
158 .test_cases = poly1305_test_cases,
159 .suite_init = poly1305_suite_init,
160 .suite_exit = poly1305_suite_exit,
161 };
162 kunit_test_suite(poly1305_test_suite);
163
164 MODULE_DESCRIPTION("KUnit tests and benchmark for Poly1305");
165 MODULE_LICENSE("GPL");
166