1*2aeef50eSEric Biggers#!/usr/bin/env python3 2*2aeef50eSEric Biggers# SPDX-License-Identifier: GPL-2.0-or-later 3*2aeef50eSEric Biggers# 4*2aeef50eSEric Biggers# Script that generates known-good data used in the AEAD tests. 5*2aeef50eSEric Biggers# 6*2aeef50eSEric Biggers# Requires that python-cryptography be installed. 7*2aeef50eSEric Biggers# 8*2aeef50eSEric Biggers# Copyright 2026 Google LLC 9*2aeef50eSEric Biggers 10*2aeef50eSEric Biggersimport hashlib 11*2aeef50eSEric Biggersimport sys 12*2aeef50eSEric Biggersimport cryptography.hazmat.primitives.ciphers.aead 13*2aeef50eSEric Biggers 14*2aeef50eSEric Biggers 15*2aeef50eSEric Biggers# Deterministically generate 'length' random bytes. 16*2aeef50eSEric Biggersdef rand_bytes(length): 17*2aeef50eSEric Biggers seed = length 18*2aeef50eSEric Biggers out = [] 19*2aeef50eSEric Biggers for _ in range(length): 20*2aeef50eSEric Biggers seed = (seed * 25214903917 + 11) % 2**48 21*2aeef50eSEric Biggers out.append((seed >> 16) % 256) 22*2aeef50eSEric Biggers return bytes(out) 23*2aeef50eSEric Biggers 24*2aeef50eSEric Biggers 25*2aeef50eSEric Biggers# Deterministically generate many different AEAD inputs using exactly the same 26*2aeef50eSEric Biggers# method that the test uses; encrypt them using an independent implementation of 27*2aeef50eSEric Biggers# the algorithm; compute the checksum of all the resulting (ciphertext, authtag) 28*2aeef50eSEric Biggers# pairs concatenated to each other; and print the checksum as a C struct. 29*2aeef50eSEric Biggersdef gen_monte_carlo_checksum(alg): 30*2aeef50eSEric Biggers blake2s = hashlib.blake2s() 31*2aeef50eSEric Biggers for data_len in range(1025): 32*2aeef50eSEric Biggers ad_len = data_len % 293 33*2aeef50eSEric Biggers pt = rand_bytes(data_len) 34*2aeef50eSEric Biggers ad = rand_bytes(ad_len) 35*2aeef50eSEric Biggers if alg == "aes-ccm": 36*2aeef50eSEric Biggers key_len = [16, 24, 32][data_len % 3] 37*2aeef50eSEric Biggers key = rand_bytes(key_len) 38*2aeef50eSEric Biggers nonce = rand_bytes([7, 8, 9, 10, 11, 12, 13][data_len % 7]) 39*2aeef50eSEric Biggers tag_len = [4, 6, 8, 10, 12, 14, 16][data_len % 7] 40*2aeef50eSEric Biggers ccm = cryptography.hazmat.primitives.ciphers.aead.AESCCM( 41*2aeef50eSEric Biggers key, tag_length=tag_len 42*2aeef50eSEric Biggers ) 43*2aeef50eSEric Biggers ct_and_tag = ccm.encrypt(nonce, pt, ad) 44*2aeef50eSEric Biggers 45*2aeef50eSEric Biggers blake2s.update(ct_and_tag) 46*2aeef50eSEric Biggers 47*2aeef50eSEric Biggers name = f"{alg.replace('-', '_')}_monte_carlo_checksum" 48*2aeef50eSEric Biggers value = blake2s.digest() 49*2aeef50eSEric Biggers print(f"static const u8 {name}[BLAKE2S_HASH_SIZE] = {{") 50*2aeef50eSEric Biggers for i in range(0, len(value), 11): 51*2aeef50eSEric Biggers line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 11]) 52*2aeef50eSEric Biggers print(f"{line.rstrip()}") 53*2aeef50eSEric Biggers print("};") 54*2aeef50eSEric Biggers 55*2aeef50eSEric Biggers 56*2aeef50eSEric Biggersif len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm"): 57*2aeef50eSEric Biggers sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm]\n") 58*2aeef50eSEric Biggers sys.exit(1) 59*2aeef50eSEric Biggers 60*2aeef50eSEric Biggersgen_monte_carlo_checksum(sys.argv[1]) 61