Home | History | Annotate | Download | only in curve25519 
      1 /* Copyright (c) 2016, Google Inc.
      2  *
      3  * Permission to use, copy, modify, and/or distribute this software for any
      4  * purpose with or without fee is hereby granted, provided that the above
      5  * copyright notice and this permission notice appear in all copies.
      6  *
      7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
      8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
      9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
     10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
     12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
     13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
     14 
     15 #include <openssl/curve25519.h>
     16 
     17 #include <string>
     18 
     19 #include <stdint.h>
     20 #include <stdio.h>
     21 #include <string.h>
     22 
     23 #include <gtest/gtest.h>
     24 
     25 #include "../internal.h"
     26 #include "../../third_party/fiat/internal.h"
     27 
     28 
     29 // TODO(agl): add tests with fixed vectors once SPAKE2 is nailed down.
     30 
     31 struct SPAKE2Run {
     32   bool Run() {
     33     bssl::UniquePtr<SPAKE2_CTX> alice(SPAKE2_CTX_new(
     34         spake2_role_alice,
     35         reinterpret_cast<const uint8_t *>(alice_names.first.data()),
     36         alice_names.first.size(),
     37         reinterpret_cast<const uint8_t *>(alice_names.second.data()),
     38         alice_names.second.size()));
     39     bssl::UniquePtr<SPAKE2_CTX> bob(SPAKE2_CTX_new(
     40         spake2_role_bob,
     41         reinterpret_cast<const uint8_t *>(bob_names.first.data()),
     42         bob_names.first.size(),
     43         reinterpret_cast<const uint8_t *>(bob_names.second.data()),
     44         bob_names.second.size()));
     45 
     46     if (!alice || !bob) {
     47       return false;
     48     }
     49 
     50     if (alice_disable_password_scalar_hack) {
     51       alice->disable_password_scalar_hack = 1;
     52     }
     53     if (bob_disable_password_scalar_hack) {
     54       bob->disable_password_scalar_hack = 1;
     55     }
     56 
     57     uint8_t alice_msg[SPAKE2_MAX_MSG_SIZE];
     58     uint8_t bob_msg[SPAKE2_MAX_MSG_SIZE];
     59     size_t alice_msg_len, bob_msg_len;
     60 
     61     if (!SPAKE2_generate_msg(
     62             alice.get(), alice_msg, &alice_msg_len, sizeof(alice_msg),
     63             reinterpret_cast<const uint8_t *>(alice_password.data()),
     64             alice_password.size()) ||
     65         !SPAKE2_generate_msg(
     66             bob.get(), bob_msg, &bob_msg_len, sizeof(bob_msg),
     67             reinterpret_cast<const uint8_t *>(bob_password.data()),
     68             bob_password.size())) {
     69       return false;
     70     }
     71 
     72     if (alice_corrupt_msg_bit >= 0 &&
     73         static_cast<size_t>(alice_corrupt_msg_bit) < 8 * alice_msg_len) {
     74       alice_msg[alice_corrupt_msg_bit/8] ^= 1 << (alice_corrupt_msg_bit & 7);
     75     }
     76 
     77     uint8_t alice_key[64], bob_key[64];
     78     size_t alice_key_len, bob_key_len;
     79 
     80     if (!SPAKE2_process_msg(alice.get(), alice_key, &alice_key_len,
     81                             sizeof(alice_key), bob_msg, bob_msg_len) ||
     82         !SPAKE2_process_msg(bob.get(), bob_key, &bob_key_len, sizeof(bob_key),
     83                             alice_msg, alice_msg_len)) {
     84       return false;
     85     }
     86 
     87     key_matches_ = (alice_key_len == bob_key_len &&
     88                     OPENSSL_memcmp(alice_key, bob_key, alice_key_len) == 0);
     89 
     90     return true;
     91   }
     92 
     93   bool key_matches() const {
     94     return key_matches_;
     95   }
     96 
     97   std::string alice_password = "password";
     98   std::string bob_password = "password";
     99   std::pair<std::string, std::string> alice_names = {"alice", "bob"};
    100   std::pair<std::string, std::string> bob_names = {"bob", "alice"};
    101   bool alice_disable_password_scalar_hack = false;
    102   bool bob_disable_password_scalar_hack = false;
    103   int alice_corrupt_msg_bit = -1;
    104 
    105  private:
    106   bool key_matches_ = false;
    107 };
    108 
    109 TEST(SPAKE25519Test, SPAKE2) {
    110   for (unsigned i = 0; i < 20; i++) {
    111     SPAKE2Run spake2;
    112     ASSERT_TRUE(spake2.Run());
    113     EXPECT_TRUE(spake2.key_matches());
    114   }
    115 }
    116 
    117 TEST(SPAKE25519Test, OldAlice) {
    118   for (unsigned i = 0; i < 20; i++) {
    119     SPAKE2Run spake2;
    120     spake2.alice_disable_password_scalar_hack = true;
    121     ASSERT_TRUE(spake2.Run());
    122     EXPECT_TRUE(spake2.key_matches());
    123   }
    124 }
    125 
    126 TEST(SPAKE25519Test, OldBob) {
    127   for (unsigned i = 0; i < 20; i++) {
    128     SPAKE2Run spake2;
    129     spake2.bob_disable_password_scalar_hack = true;
    130     ASSERT_TRUE(spake2.Run());
    131     EXPECT_TRUE(spake2.key_matches());
    132   }
    133 }
    134 
    135 TEST(SPAKE25519Test, WrongPassword) {
    136   SPAKE2Run spake2;
    137   spake2.bob_password = "wrong password";
    138   ASSERT_TRUE(spake2.Run());
    139   EXPECT_FALSE(spake2.key_matches()) << "Key matched for unequal passwords.";
    140 }
    141 
    142 TEST(SPAKE25519Test, WrongNames) {
    143   SPAKE2Run spake2;
    144   spake2.alice_names.second = "charlie";
    145   spake2.bob_names.second = "charlie";
    146   ASSERT_TRUE(spake2.Run());
    147   EXPECT_FALSE(spake2.key_matches()) << "Key matched for unequal names.";
    148 }
    149 
    150 TEST(SPAKE25519Test, CorruptMessages) {
    151   for (int i = 0; i < 8 * SPAKE2_MAX_MSG_SIZE; i++) {
    152     SPAKE2Run spake2;
    153     spake2.alice_corrupt_msg_bit = i;
    154     EXPECT_FALSE(spake2.Run() && spake2.key_matches())
    155         << "Passed after corrupting Alice's message, bit " << i;
    156   }
    157 }
    158