1 /* 2 * Written by Dr Stephen N Henson (steve (at) openssl.org) for the OpenSSL 3 * project. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2015 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing (at) OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 */ 53 54 #include <limits.h> 55 #include <stdlib.h> 56 #include <string.h> 57 58 #include <algorithm> 59 #include <string> 60 #include <vector> 61 62 #include <gtest/gtest.h> 63 64 #include <openssl/cipher.h> 65 #include <openssl/err.h> 66 #include <openssl/span.h> 67 68 #include "../test/file_test.h" 69 #include "../test/test_util.h" 70 #include "../test/wycheproof_util.h" 71 72 73 static const EVP_CIPHER *GetCipher(const std::string &name) { 74 if (name == "DES-CBC") { 75 return EVP_des_cbc(); 76 } else if (name == "DES-ECB") { 77 return EVP_des_ecb(); 78 } else if (name == "DES-EDE") { 79 return EVP_des_ede(); 80 } else if (name == "DES-EDE3") { 81 return EVP_des_ede3(); 82 } else if (name == "DES-EDE-CBC") { 83 return EVP_des_ede_cbc(); 84 } else if (name == "DES-EDE3-CBC") { 85 return EVP_des_ede3_cbc(); 86 } else if (name == "RC4") { 87 return EVP_rc4(); 88 } else if (name == "AES-128-ECB") { 89 return EVP_aes_128_ecb(); 90 } else if (name == "AES-256-ECB") { 91 return EVP_aes_256_ecb(); 92 } else if (name == "AES-128-CBC") { 93 return EVP_aes_128_cbc(); 94 } else if (name == "AES-128-GCM") { 95 return EVP_aes_128_gcm(); 96 } else if (name == "AES-128-OFB") { 97 return EVP_aes_128_ofb(); 98 } else if (name == "AES-192-CBC") { 99 return EVP_aes_192_cbc(); 100 } else if (name == "AES-192-CTR") { 101 return EVP_aes_192_ctr(); 102 } else if (name == "AES-192-ECB") { 103 return EVP_aes_192_ecb(); 104 } else if (name == "AES-192-OFB") { 105 return EVP_aes_192_ofb(); 106 } else if (name == "AES-256-CBC") { 107 return EVP_aes_256_cbc(); 108 } else if (name == "AES-128-CTR") { 109 return EVP_aes_128_ctr(); 110 } else if (name == "AES-256-CTR") { 111 return EVP_aes_256_ctr(); 112 } else if (name == "AES-256-GCM") { 113 return EVP_aes_256_gcm(); 114 } else if (name == "AES-256-OFB") { 115 return EVP_aes_256_ofb(); 116 } 117 return nullptr; 118 } 119 120 static bool DoCipher(EVP_CIPHER_CTX *ctx, std::vector<uint8_t> *out, 121 bssl::Span<const uint8_t> in, size_t chunk) { 122 size_t max_out = in.size(); 123 if ((EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_NO_PADDING) == 0 && 124 EVP_CIPHER_CTX_encrypting(ctx)) { 125 unsigned block_size = EVP_CIPHER_CTX_block_size(ctx); 126 max_out += block_size - (max_out % block_size); 127 } 128 out->resize(max_out); 129 130 size_t total = 0; 131 int len; 132 while (!in.empty()) { 133 size_t todo = chunk == 0 ? in.size() : std::min(in.size(), chunk); 134 EXPECT_LE(todo, static_cast<size_t>(INT_MAX)); 135 if (!EVP_CipherUpdate(ctx, out->data() + total, &len, in.data(), 136 static_cast<int>(todo))) { 137 return false; 138 } 139 EXPECT_GE(len, 0); 140 total += static_cast<size_t>(len); 141 in = in.subspan(todo); 142 } 143 if (!EVP_CipherFinal_ex(ctx, out->data() + total, &len)) { 144 return false; 145 } 146 EXPECT_GE(len, 0); 147 total += static_cast<size_t>(len); 148 out->resize(total); 149 return true; 150 } 151 152 static void TestOperation(FileTest *t, const EVP_CIPHER *cipher, bool encrypt, 153 size_t chunk_size, const std::vector<uint8_t> &key, 154 const std::vector<uint8_t> &iv, 155 const std::vector<uint8_t> &plaintext, 156 const std::vector<uint8_t> &ciphertext, 157 const std::vector<uint8_t> &aad, 158 const std::vector<uint8_t> &tag) { 159 const std::vector<uint8_t> *in, *out; 160 if (encrypt) { 161 in = &plaintext; 162 out = &ciphertext; 163 } else { 164 in = &ciphertext; 165 out = &plaintext; 166 } 167 168 bool is_aead = EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE; 169 170 bssl::ScopedEVP_CIPHER_CTX ctx; 171 ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, nullptr, nullptr, nullptr, 172 encrypt ? 1 : 0)); 173 if (t->HasAttribute("IV")) { 174 if (is_aead) { 175 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN, 176 iv.size(), 0)); 177 } else { 178 ASSERT_EQ(iv.size(), EVP_CIPHER_CTX_iv_length(ctx.get())); 179 } 180 } 181 if (is_aead && !encrypt) { 182 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_TAG, 183 tag.size(), 184 const_cast<uint8_t *>(tag.data()))); 185 } 186 // The ciphers are run with no padding. For each of the ciphers we test, the 187 // output size matches the input size. 188 ASSERT_EQ(in->size(), out->size()); 189 ASSERT_TRUE(EVP_CIPHER_CTX_set_key_length(ctx.get(), key.size())); 190 ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), nullptr, nullptr, key.data(), 191 iv.data(), -1)); 192 // Note: the deprecated |EVP_CIPHER|-based AEAD API is sensitive to whether 193 // parameters are NULL, so it is important to skip the |in| and |aad| 194 // |EVP_CipherUpdate| calls when empty. 195 if (!aad.empty()) { 196 int unused; 197 ASSERT_TRUE( 198 EVP_CipherUpdate(ctx.get(), nullptr, &unused, aad.data(), aad.size())); 199 } 200 ASSERT_TRUE(EVP_CIPHER_CTX_set_padding(ctx.get(), 0)); 201 std::vector<uint8_t> result; 202 ASSERT_TRUE(DoCipher(ctx.get(), &result, *in, chunk_size)); 203 EXPECT_EQ(Bytes(*out), Bytes(result)); 204 if (encrypt && is_aead) { 205 uint8_t rtag[16]; 206 ASSERT_LE(tag.size(), sizeof(rtag)); 207 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_GET_TAG, 208 tag.size(), rtag)); 209 EXPECT_EQ(Bytes(tag), Bytes(rtag, tag.size())); 210 } 211 } 212 213 static void TestCipher(FileTest *t) { 214 std::string cipher_str; 215 ASSERT_TRUE(t->GetAttribute(&cipher_str, "Cipher")); 216 const EVP_CIPHER *cipher = GetCipher(cipher_str); 217 ASSERT_TRUE(cipher); 218 219 std::vector<uint8_t> key, iv, plaintext, ciphertext, aad, tag; 220 ASSERT_TRUE(t->GetBytes(&key, "Key")); 221 ASSERT_TRUE(t->GetBytes(&plaintext, "Plaintext")); 222 ASSERT_TRUE(t->GetBytes(&ciphertext, "Ciphertext")); 223 if (EVP_CIPHER_iv_length(cipher) > 0) { 224 ASSERT_TRUE(t->GetBytes(&iv, "IV")); 225 } 226 if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) { 227 ASSERT_TRUE(t->GetBytes(&aad, "AAD")); 228 ASSERT_TRUE(t->GetBytes(&tag, "Tag")); 229 } 230 231 enum { 232 kEncrypt, 233 kDecrypt, 234 kBoth, 235 } operation = kBoth; 236 if (t->HasAttribute("Operation")) { 237 const std::string &str = t->GetAttributeOrDie("Operation"); 238 if (str == "ENCRYPT") { 239 operation = kEncrypt; 240 } else if (str == "DECRYPT") { 241 operation = kDecrypt; 242 } else { 243 FAIL() << "Unknown operation: " << str; 244 } 245 } 246 247 const std::vector<size_t> chunk_sizes = {0, 1, 2, 5, 7, 8, 9, 15, 16, 248 17, 31, 32, 33, 63, 64, 65, 512}; 249 250 for (size_t chunk_size : chunk_sizes) { 251 SCOPED_TRACE(chunk_size); 252 // By default, both directions are run, unless overridden by the operation. 253 if (operation != kDecrypt) { 254 SCOPED_TRACE("encrypt"); 255 TestOperation(t, cipher, true /* encrypt */, chunk_size, key, iv, 256 plaintext, ciphertext, aad, tag); 257 } 258 259 if (operation != kEncrypt) { 260 SCOPED_TRACE("decrypt"); 261 TestOperation(t, cipher, false /* decrypt */, chunk_size, key, iv, 262 plaintext, ciphertext, aad, tag); 263 } 264 } 265 } 266 267 TEST(CipherTest, TestVectors) { 268 FileTestGTest("crypto/cipher_extra/test/cipher_tests.txt", TestCipher); 269 } 270 271 TEST(CipherTest, CAVP_AES_128_CBC) { 272 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_cbc.txt", 273 TestCipher); 274 } 275 276 TEST(CipherTest, CAVP_AES_128_CTR) { 277 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_ctr.txt", 278 TestCipher); 279 } 280 281 TEST(CipherTest, CAVP_AES_192_CBC) { 282 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_cbc.txt", 283 TestCipher); 284 } 285 286 TEST(CipherTest, CAVP_AES_192_CTR) { 287 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_ctr.txt", 288 TestCipher); 289 } 290 291 TEST(CipherTest, CAVP_AES_256_CBC) { 292 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_cbc.txt", 293 TestCipher); 294 } 295 296 TEST(CipherTest, CAVP_AES_256_CTR) { 297 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_ctr.txt", 298 TestCipher); 299 } 300 301 TEST(CipherTest, CAVP_TDES_CBC) { 302 FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt", TestCipher); 303 } 304 305 TEST(CipherTest, CAVP_TDES_ECB) { 306 FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt", TestCipher); 307 } 308 309 TEST(CipherTest, WycheproofAESCBC) { 310 FileTestGTest("third_party/wycheproof_testvectors/aes_cbc_pkcs5_test.txt", 311 [](FileTest *t) { 312 t->IgnoreInstruction("type"); 313 t->IgnoreInstruction("ivSize"); 314 315 std::string key_size; 316 ASSERT_TRUE(t->GetInstruction(&key_size, "keySize")); 317 const EVP_CIPHER *cipher; 318 switch (atoi(key_size.c_str())) { 319 case 128: 320 cipher = EVP_aes_128_cbc(); 321 break; 322 case 192: 323 cipher = EVP_aes_192_cbc(); 324 break; 325 case 256: 326 cipher = EVP_aes_256_cbc(); 327 break; 328 default: 329 FAIL() << "Unsupported key size: " << key_size; 330 } 331 332 std::vector<uint8_t> key, iv, msg, ct; 333 ASSERT_TRUE(t->GetBytes(&key, "key")); 334 ASSERT_TRUE(t->GetBytes(&iv, "iv")); 335 ASSERT_TRUE(t->GetBytes(&msg, "msg")); 336 ASSERT_TRUE(t->GetBytes(&ct, "ct")); 337 ASSERT_EQ(EVP_CIPHER_key_length(cipher), key.size()); 338 ASSERT_EQ(EVP_CIPHER_iv_length(cipher), iv.size()); 339 WycheproofResult result; 340 ASSERT_TRUE(GetWycheproofResult(t, &result)); 341 342 bssl::ScopedEVP_CIPHER_CTX ctx; 343 std::vector<uint8_t> out; 344 const std::vector<size_t> chunk_sizes = {0, 1, 2, 5, 7, 8, 9, 15, 16, 345 17, 31, 32, 33, 63, 64, 65, 512}; 346 for (size_t chunk : chunk_sizes) { 347 SCOPED_TRACE(chunk); 348 if (result == WycheproofResult::kValid) { 349 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), cipher, nullptr, key.data(), 350 iv.data())); 351 ASSERT_TRUE(DoCipher(ctx.get(), &out, ct, chunk)); 352 EXPECT_EQ(Bytes(msg), Bytes(out)); 353 354 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), cipher, nullptr, key.data(), 355 iv.data())); 356 ASSERT_TRUE(DoCipher(ctx.get(), &out, msg, chunk)); 357 EXPECT_EQ(Bytes(ct), Bytes(out)); 358 } else { 359 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), cipher, nullptr, key.data(), 360 iv.data())); 361 EXPECT_FALSE(DoCipher(ctx.get(), &out, ct, chunk)); 362 } 363 } 364 }); 365 } 366