1 /* Copyright (c) 2018, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 // cavp_kas_test processes NIST CAVP ECC KAS test vector request files and
16 // emits the corresponding response.
17 
18 #include <vector>
19 
20 #include <openssl/bn.h>
21 #include <openssl/crypto.h>
22 #include <openssl/digest.h>
23 #include <openssl/ecdh.h>
24 #include <openssl/ecdsa.h>
25 #include <openssl/ec_key.h>
26 #include <openssl/err.h>
27 #include <openssl/nid.h>
28 #include <openssl/sha.h>
29 
30 #include "../crypto/internal.h"
31 #include "../crypto/test/file_test.h"
32 #include "cavp_test_util.h"
33 
34 
TestKAS(FileTest * t,void * arg)35 static bool TestKAS(FileTest *t, void *arg) {
36   const bool validate = *reinterpret_cast<bool *>(arg);
37 
38   int nid = NID_undef;
39   size_t digest_len = 0;
40 
41   if (t->HasInstruction("EB - SHA224")) {
42     nid = NID_secp224r1;
43     digest_len = SHA224_DIGEST_LENGTH;
44   } else if (t->HasInstruction("EC - SHA256")) {
45     nid = NID_X9_62_prime256v1;
46     digest_len = SHA256_DIGEST_LENGTH;
47   } else if (t->HasInstruction("ED - SHA384")) {
48     nid = NID_secp384r1;
49     digest_len = SHA384_DIGEST_LENGTH;
50   } else if (t->HasInstruction("EE - SHA512")) {
51     nid = NID_secp521r1;
52     digest_len = SHA512_DIGEST_LENGTH;
53   } else {
54     return false;
55   }
56 
57   if (!t->HasAttribute("COUNT")) {
58     return false;
59   }
60 
61   bssl::UniquePtr<BIGNUM> their_x(GetBIGNUM(t, "QeCAVSx"));
62   bssl::UniquePtr<BIGNUM> their_y(GetBIGNUM(t, "QeCAVSy"));
63   bssl::UniquePtr<EC_KEY> ec_key(EC_KEY_new_by_curve_name(nid));
64   bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
65   if (!their_x || !their_y || !ec_key || !ctx) {
66     return false;
67   }
68 
69   const EC_GROUP *const group = EC_KEY_get0_group(ec_key.get());
70   bssl::UniquePtr<EC_POINT> their_point(EC_POINT_new(group));
71   if (!their_point ||
72       !EC_POINT_set_affine_coordinates_GFp(
73           group, their_point.get(), their_x.get(), their_y.get(), ctx.get())) {
74     return false;
75   }
76 
77   if (validate) {
78     bssl::UniquePtr<BIGNUM> our_k(GetBIGNUM(t, "deIUT"));
79     if (!our_k ||
80         !EC_KEY_set_private_key(ec_key.get(), our_k.get()) ||
81         // These attributes are ignored.
82         !t->HasAttribute("QeIUTx") ||
83         !t->HasAttribute("QeIUTy")) {
84       return false;
85     }
86   } else if (!EC_KEY_generate_key(ec_key.get())) {
87     return false;
88   }
89 
90   uint8_t digest[EVP_MAX_MD_SIZE];
91   if (!ECDH_compute_key_fips(digest, digest_len, their_point.get(),
92                              ec_key.get())) {
93     return false;
94   }
95 
96   if (validate) {
97     std::vector<uint8_t> expected_shared_bytes;
98     if (!t->GetBytes(&expected_shared_bytes, "CAVSHashZZ")) {
99       return false;
100     }
101     const bool ok =
102         digest_len == expected_shared_bytes.size() &&
103         OPENSSL_memcmp(digest, expected_shared_bytes.data(), digest_len) == 0;
104 
105     printf("%sIUTHashZZ = %s\r\nResult = %c\r\n\r\n\r\n",
106            t->CurrentTestToString().c_str(),
107            EncodeHex(digest, digest_len).c_str(), ok ? 'P' : 'F');
108   } else {
109     const EC_POINT *pub = EC_KEY_get0_public_key(ec_key.get());
110     bssl::UniquePtr<BIGNUM> x(BN_new());
111     bssl::UniquePtr<BIGNUM> y(BN_new());
112     if (!x || !y ||
113         !EC_POINT_get_affine_coordinates_GFp(group, pub, x.get(), y.get(),
114                                              ctx.get())) {
115       return false;
116     }
117     bssl::UniquePtr<char> x_hex(BN_bn2hex(x.get()));
118     bssl::UniquePtr<char> y_hex(BN_bn2hex(y.get()));
119 
120     printf("%sQeIUTx = %s\r\nQeIUTy = %s\r\nHashZZ = %s\r\n",
121            t->CurrentTestToString().c_str(), x_hex.get(), y_hex.get(),
122            EncodeHex(digest, digest_len).c_str());
123   }
124 
125   return true;
126 }
127 
cavp_kas_test_main(int argc,char ** argv)128 int cavp_kas_test_main(int argc, char **argv) {
129   if (argc != 3) {
130     fprintf(stderr, "usage: %s (validity|function) <test file>\n",
131             argv[0]);
132     return 1;
133   }
134 
135   bool validity;
136   if (strcmp(argv[1], "validity") == 0) {
137     validity = true;
138   } else if (strcmp(argv[1], "function") == 0) {
139     validity = false;
140   } else {
141     fprintf(stderr, "Unknown test type: %s\n", argv[1]);
142     return 1;
143   }
144 
145   FileTest::Options opts;
146   opts.path = argv[2];
147   opts.arg = &validity;
148   opts.callback = TestKAS;
149   opts.silent = true;
150   opts.comment_callback = EchoComment;
151   opts.is_kas_test = true;
152   return FileTestMain(opts);
153 }
154