1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright 2025 Google LLC 4 */ 5 #include <crypto/poly1305.h> 6 #include "poly1305-testvecs.h" 7 8 /* 9 * A fixed key used when presenting Poly1305 as an unkeyed hash function in 10 * order to reuse hash-test-template.h. At the beginning of the test suite, 11 * this is initialized to bytes generated from a fixed seed. 12 */ 13 static u8 test_key[POLY1305_KEY_SIZE]; 14 15 /* This probably should be in the actual API, but just define it here for now */ 16 static void poly1305(const u8 key[POLY1305_KEY_SIZE], const u8 *data, 17 size_t len, u8 out[POLY1305_DIGEST_SIZE]) 18 { 19 struct poly1305_desc_ctx ctx; 20 21 poly1305_init(&ctx, key); 22 poly1305_update(&ctx, data, len); 23 poly1305_final(&ctx, out); 24 } 25 26 static void poly1305_init_withtestkey(struct poly1305_desc_ctx *ctx) 27 { 28 poly1305_init(ctx, test_key); 29 } 30 31 static void poly1305_withtestkey(const u8 *data, size_t len, 32 u8 out[POLY1305_DIGEST_SIZE]) 33 { 34 poly1305(test_key, data, len, out); 35 } 36 37 /* Generate the HASH_KUNIT_CASES using hash-test-template.h. */ 38 #define HASH poly1305_withtestkey 39 #define HASH_CTX poly1305_desc_ctx 40 #define HASH_SIZE POLY1305_DIGEST_SIZE 41 #define HASH_INIT poly1305_init_withtestkey 42 #define HASH_UPDATE poly1305_update 43 #define HASH_FINAL poly1305_final 44 #include "hash-test-template.h" 45 46 static int poly1305_suite_init(struct kunit_suite *suite) 47 { 48 rand_bytes_seeded_from_len(test_key, POLY1305_KEY_SIZE); 49 return 0; 50 } 51 52 /* 53 * Poly1305 test case which uses a key and message consisting only of one bits: 54 * 55 * - Using an all-one-bits r_key tests the key clamping. 56 * - Using an all-one-bits s_key tests carries in implementations of the 57 * addition mod 2**128 during finalization. 58 * - Using all-one-bits message, and to a lesser extent r_key, tends to maximize 59 * any intermediate accumulator values. This increases the chance of 60 * detecting bugs that occur only in rare cases where the accumulator values 61 * get very large, for example the bug fixed by commit 678cce4019d746da 62 * ("crypto: x86/poly1305 - fix overflow during partial reduction"). 63 * 64 * Accumulator overflow bugs may be specific to particular update lengths (in 65 * blocks) and/or particular values of the previous acculumator. Note that the 66 * accumulator starts at 0 which gives the lowest chance of an overflow. Thus, 67 * a single all-one-bits test vector may be insufficient. 68 * 69 * Considering that, do the following test: continuously update a single 70 * Poly1305 context with all-one-bits data of varying lengths (0, 16, 32, ..., 71 * 4096 bytes). After each update, generate the MAC from the current context, 72 * and feed that MAC into a separate Poly1305 context. Repeat that entire 73 * sequence of updates 32 times without re-initializing either context, 74 * resulting in a total of 8224 MAC computations from a long-running, cumulative 75 * context. Finally, generate and verify the MAC of all the MACs. 76 */ 77 static void test_poly1305_allones_keys_and_message(struct kunit *test) 78 { 79 const size_t max_len = 4096; 80 u8 *data = alloc_buf(test, max_len); 81 struct poly1305_desc_ctx mac_ctx, macofmacs_ctx; 82 u8 mac[POLY1305_DIGEST_SIZE]; 83 84 memset(data, 0xff, max_len); 85 86 poly1305_init(&mac_ctx, data); 87 poly1305_init(&macofmacs_ctx, data); 88 for (int i = 0; i < 32; i++) { 89 for (size_t len = 0; len <= max_len; len += 16) { 90 struct poly1305_desc_ctx tmp_ctx; 91 92 poly1305_update(&mac_ctx, data, len); 93 tmp_ctx = mac_ctx; 94 poly1305_final(&tmp_ctx, mac); 95 poly1305_update(&macofmacs_ctx, mac, 96 POLY1305_DIGEST_SIZE); 97 } 98 } 99 poly1305_final(&macofmacs_ctx, mac); 100 KUNIT_ASSERT_MEMEQ(test, mac, poly1305_allones_macofmacs, 101 POLY1305_DIGEST_SIZE); 102 } 103 104 /* 105 * Poly1305 test case which uses r_key=1, s_key=0, and a 48-byte message 106 * consisting of three blocks with integer values [2**128 - i, 0, 0]. In this 107 * case, the result of the polynomial evaluation is 2**130 - i. For small 108 * values of i, this is very close to the modulus 2**130 - 5, which helps catch 109 * edge case bugs in the modular reduction logic. 110 */ 111 static void test_poly1305_reduction_edge_cases(struct kunit *test) 112 { 113 static const u8 key[POLY1305_KEY_SIZE] = { 1 }; /* r_key=1, s_key=0 */ 114 u8 data[3 * POLY1305_BLOCK_SIZE] = {}; 115 u8 expected_mac[POLY1305_DIGEST_SIZE]; 116 u8 actual_mac[POLY1305_DIGEST_SIZE]; 117 118 for (int i = 1; i <= 10; i++) { 119 /* Set the first data block to 2**128 - i. */ 120 data[0] = -i; 121 memset(&data[1], 0xff, POLY1305_BLOCK_SIZE - 1); 122 123 /* 124 * Assuming s_key=0, the expected MAC as an integer is 125 * (2**130 - i mod 2**130 - 5) + 0 mod 2**128. If 1 <= i <= 5, 126 * that's 5 - i. If 6 <= i <= 10, that's 2**128 - i. 127 */ 128 if (i <= 5) { 129 expected_mac[0] = 5 - i; 130 memset(&expected_mac[1], 0, POLY1305_DIGEST_SIZE - 1); 131 } else { 132 expected_mac[0] = -i; 133 memset(&expected_mac[1], 0xff, 134 POLY1305_DIGEST_SIZE - 1); 135 } 136 137 /* Compute and verify the MAC. */ 138 poly1305(key, data, sizeof(data), actual_mac); 139 KUNIT_ASSERT_MEMEQ(test, actual_mac, expected_mac, 140 POLY1305_DIGEST_SIZE); 141 } 142 } 143 144 static struct kunit_case poly1305_test_cases[] = { 145 HASH_KUNIT_CASES, 146 KUNIT_CASE(test_poly1305_allones_keys_and_message), 147 KUNIT_CASE(test_poly1305_reduction_edge_cases), 148 KUNIT_CASE(benchmark_hash), 149 {}, 150 }; 151 152 static struct kunit_suite poly1305_test_suite = { 153 .name = "poly1305", 154 .test_cases = poly1305_test_cases, 155 .suite_init = poly1305_suite_init, 156 }; 157 kunit_test_suite(poly1305_test_suite); 158 159 MODULE_DESCRIPTION("KUnit tests and benchmark for Poly1305"); 160 MODULE_LICENSE("GPL"); 161