1 /*
2  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3  * project.
4  */
5 /* ====================================================================
6  * Copyright (c) 2015 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  */
53 
54 #include <limits.h>
55 #include <stdlib.h>
56 #include <string.h>
57 
58 #include <algorithm>
59 #include <string>
60 #include <vector>
61 
62 #include <gtest/gtest.h>
63 
64 #include <openssl/cipher.h>
65 #include <openssl/err.h>
66 #include <openssl/span.h>
67 
68 #include "../test/file_test.h"
69 #include "../test/test_util.h"
70 #include "../test/wycheproof_util.h"
71 
72 
GetCipher(const std::string & name)73 static const EVP_CIPHER *GetCipher(const std::string &name) {
74   if (name == "DES-CBC") {
75     return EVP_des_cbc();
76   } else if (name == "DES-ECB") {
77     return EVP_des_ecb();
78   } else if (name == "DES-EDE") {
79     return EVP_des_ede();
80   } else if (name == "DES-EDE3") {
81     return EVP_des_ede3();
82   } else if (name == "DES-EDE-CBC") {
83     return EVP_des_ede_cbc();
84   } else if (name == "DES-EDE3-CBC") {
85     return EVP_des_ede3_cbc();
86   } else if (name == "RC4") {
87     return EVP_rc4();
88   } else if (name == "AES-128-ECB") {
89     return EVP_aes_128_ecb();
90   } else if (name == "AES-256-ECB") {
91     return EVP_aes_256_ecb();
92   } else if (name == "AES-128-CBC") {
93     return EVP_aes_128_cbc();
94   } else if (name == "AES-128-GCM") {
95     return EVP_aes_128_gcm();
96   } else if (name == "AES-128-OFB") {
97     return EVP_aes_128_ofb();
98   } else if (name == "AES-192-CBC") {
99     return EVP_aes_192_cbc();
100   } else if (name == "AES-192-CTR") {
101     return EVP_aes_192_ctr();
102   } else if (name == "AES-192-ECB") {
103     return EVP_aes_192_ecb();
104   } else if (name == "AES-192-OFB") {
105     return EVP_aes_192_ofb();
106   } else if (name == "AES-256-CBC") {
107     return EVP_aes_256_cbc();
108   } else if (name == "AES-128-CTR") {
109     return EVP_aes_128_ctr();
110   } else if (name == "AES-256-CTR") {
111     return EVP_aes_256_ctr();
112   } else if (name == "AES-256-GCM") {
113     return EVP_aes_256_gcm();
114   } else if (name == "AES-256-OFB") {
115     return EVP_aes_256_ofb();
116   }
117   return nullptr;
118 }
119 
DoCipher(EVP_CIPHER_CTX * ctx,std::vector<uint8_t> * out,bssl::Span<const uint8_t> in,size_t chunk)120 static bool DoCipher(EVP_CIPHER_CTX *ctx, std::vector<uint8_t> *out,
121                      bssl::Span<const uint8_t> in, size_t chunk) {
122   size_t max_out = in.size();
123   if ((EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_NO_PADDING) == 0 &&
124       EVP_CIPHER_CTX_encrypting(ctx)) {
125     unsigned block_size = EVP_CIPHER_CTX_block_size(ctx);
126     max_out += block_size - (max_out % block_size);
127   }
128   out->resize(max_out);
129 
130   size_t total = 0;
131   int len;
132   while (!in.empty()) {
133     size_t todo = chunk == 0 ? in.size() : std::min(in.size(), chunk);
134     EXPECT_LE(todo, static_cast<size_t>(INT_MAX));
135     if (!EVP_CipherUpdate(ctx, out->data() + total, &len, in.data(),
136                           static_cast<int>(todo))) {
137       return false;
138     }
139     EXPECT_GE(len, 0);
140     total += static_cast<size_t>(len);
141     in = in.subspan(todo);
142   }
143   if (!EVP_CipherFinal_ex(ctx, out->data() + total, &len)) {
144     return false;
145   }
146   EXPECT_GE(len, 0);
147   total += static_cast<size_t>(len);
148   out->resize(total);
149   return true;
150 }
151 
TestOperation(FileTest * t,const EVP_CIPHER * cipher,bool encrypt,size_t chunk_size,const std::vector<uint8_t> & key,const std::vector<uint8_t> & iv,const std::vector<uint8_t> & plaintext,const std::vector<uint8_t> & ciphertext,const std::vector<uint8_t> & aad,const std::vector<uint8_t> & tag)152 static void TestOperation(FileTest *t, const EVP_CIPHER *cipher, bool encrypt,
153                           size_t chunk_size, const std::vector<uint8_t> &key,
154                           const std::vector<uint8_t> &iv,
155                           const std::vector<uint8_t> &plaintext,
156                           const std::vector<uint8_t> &ciphertext,
157                           const std::vector<uint8_t> &aad,
158                           const std::vector<uint8_t> &tag) {
159   const std::vector<uint8_t> *in, *out;
160   if (encrypt) {
161     in = &plaintext;
162     out = &ciphertext;
163   } else {
164     in = &ciphertext;
165     out = &plaintext;
166   }
167 
168   bool is_aead = EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE;
169 
170   bssl::ScopedEVP_CIPHER_CTX ctx;
171   ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, nullptr, nullptr, nullptr,
172                          encrypt ? 1 : 0));
173   if (t->HasAttribute("IV")) {
174     if (is_aead) {
175       ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN,
176                                       iv.size(), 0));
177     } else {
178       ASSERT_EQ(iv.size(), EVP_CIPHER_CTX_iv_length(ctx.get()));
179     }
180   }
181   if (is_aead && !encrypt) {
182     ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_TAG,
183                                     tag.size(),
184                                     const_cast<uint8_t *>(tag.data())));
185   }
186   // The ciphers are run with no padding. For each of the ciphers we test, the
187   // output size matches the input size.
188   ASSERT_EQ(in->size(), out->size());
189   ASSERT_TRUE(EVP_CIPHER_CTX_set_key_length(ctx.get(), key.size()));
190   ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), nullptr, nullptr, key.data(),
191                                 iv.data(), -1));
192   // Note: the deprecated |EVP_CIPHER|-based AEAD API is sensitive to whether
193   // parameters are NULL, so it is important to skip the |in| and |aad|
194   // |EVP_CipherUpdate| calls when empty.
195   if (!aad.empty()) {
196     int unused;
197     ASSERT_TRUE(
198         EVP_CipherUpdate(ctx.get(), nullptr, &unused, aad.data(), aad.size()));
199   }
200   ASSERT_TRUE(EVP_CIPHER_CTX_set_padding(ctx.get(), 0));
201   std::vector<uint8_t> result;
202   ASSERT_TRUE(DoCipher(ctx.get(), &result, *in, chunk_size));
203   EXPECT_EQ(Bytes(*out), Bytes(result));
204   if (encrypt && is_aead) {
205     uint8_t rtag[16];
206     ASSERT_LE(tag.size(), sizeof(rtag));
207     ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_GET_TAG,
208                                     tag.size(), rtag));
209     EXPECT_EQ(Bytes(tag), Bytes(rtag, tag.size()));
210   }
211 }
212 
TestCipher(FileTest * t)213 static void TestCipher(FileTest *t) {
214   std::string cipher_str;
215   ASSERT_TRUE(t->GetAttribute(&cipher_str, "Cipher"));
216   const EVP_CIPHER *cipher = GetCipher(cipher_str);
217   ASSERT_TRUE(cipher);
218 
219   std::vector<uint8_t> key, iv, plaintext, ciphertext, aad, tag;
220   ASSERT_TRUE(t->GetBytes(&key, "Key"));
221   ASSERT_TRUE(t->GetBytes(&plaintext, "Plaintext"));
222   ASSERT_TRUE(t->GetBytes(&ciphertext, "Ciphertext"));
223   if (EVP_CIPHER_iv_length(cipher) > 0) {
224     ASSERT_TRUE(t->GetBytes(&iv, "IV"));
225   }
226   if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) {
227     ASSERT_TRUE(t->GetBytes(&aad, "AAD"));
228     ASSERT_TRUE(t->GetBytes(&tag, "Tag"));
229   }
230 
231   enum {
232     kEncrypt,
233     kDecrypt,
234     kBoth,
235   } operation = kBoth;
236   if (t->HasAttribute("Operation")) {
237     const std::string &str = t->GetAttributeOrDie("Operation");
238     if (str == "ENCRYPT") {
239       operation = kEncrypt;
240     } else if (str == "DECRYPT") {
241       operation = kDecrypt;
242     } else {
243       FAIL() << "Unknown operation: " << str;
244     }
245   }
246 
247   const std::vector<size_t> chunk_sizes = {0,  1,  2,  5,  7,  8,  9,  15, 16,
248                                            17, 31, 32, 33, 63, 64, 65, 512};
249 
250   for (size_t chunk_size : chunk_sizes) {
251     SCOPED_TRACE(chunk_size);
252     // By default, both directions are run, unless overridden by the operation.
253     if (operation != kDecrypt) {
254       SCOPED_TRACE("encrypt");
255       TestOperation(t, cipher, true /* encrypt */, chunk_size, key, iv,
256                     plaintext, ciphertext, aad, tag);
257     }
258 
259     if (operation != kEncrypt) {
260       SCOPED_TRACE("decrypt");
261       TestOperation(t, cipher, false /* decrypt */, chunk_size, key, iv,
262                     plaintext, ciphertext, aad, tag);
263     }
264   }
265 }
266 
TEST(CipherTest,TestVectors)267 TEST(CipherTest, TestVectors) {
268   FileTestGTest("crypto/cipher_extra/test/cipher_tests.txt", TestCipher);
269 }
270 
TEST(CipherTest,CAVP_AES_128_CBC)271 TEST(CipherTest, CAVP_AES_128_CBC) {
272   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_cbc.txt",
273                 TestCipher);
274 }
275 
TEST(CipherTest,CAVP_AES_128_CTR)276 TEST(CipherTest, CAVP_AES_128_CTR) {
277   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_ctr.txt",
278                 TestCipher);
279 }
280 
TEST(CipherTest,CAVP_AES_192_CBC)281 TEST(CipherTest, CAVP_AES_192_CBC) {
282   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_cbc.txt",
283                 TestCipher);
284 }
285 
TEST(CipherTest,CAVP_AES_192_CTR)286 TEST(CipherTest, CAVP_AES_192_CTR) {
287   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_ctr.txt",
288                 TestCipher);
289 }
290 
TEST(CipherTest,CAVP_AES_256_CBC)291 TEST(CipherTest, CAVP_AES_256_CBC) {
292   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_cbc.txt",
293                 TestCipher);
294 }
295 
TEST(CipherTest,CAVP_AES_256_CTR)296 TEST(CipherTest, CAVP_AES_256_CTR) {
297   FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_ctr.txt",
298                 TestCipher);
299 }
300 
TEST(CipherTest,CAVP_TDES_CBC)301 TEST(CipherTest, CAVP_TDES_CBC) {
302   FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt", TestCipher);
303 }
304 
TEST(CipherTest,CAVP_TDES_ECB)305 TEST(CipherTest, CAVP_TDES_ECB) {
306   FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt", TestCipher);
307 }
308 
TEST(CipherTest,WycheproofAESCBC)309 TEST(CipherTest, WycheproofAESCBC) {
310   FileTestGTest("third_party/wycheproof_testvectors/aes_cbc_pkcs5_test.txt",
311                 [](FileTest *t) {
312     t->IgnoreInstruction("type");
313     t->IgnoreInstruction("ivSize");
314 
315     std::string key_size;
316     ASSERT_TRUE(t->GetInstruction(&key_size, "keySize"));
317     const EVP_CIPHER *cipher;
318     switch (atoi(key_size.c_str())) {
319       case 128:
320         cipher = EVP_aes_128_cbc();
321         break;
322       case 192:
323         cipher = EVP_aes_192_cbc();
324         break;
325       case 256:
326         cipher = EVP_aes_256_cbc();
327         break;
328       default:
329         FAIL() << "Unsupported key size: " << key_size;
330     }
331 
332     std::vector<uint8_t> key, iv, msg, ct;
333     ASSERT_TRUE(t->GetBytes(&key, "key"));
334     ASSERT_TRUE(t->GetBytes(&iv, "iv"));
335     ASSERT_TRUE(t->GetBytes(&msg, "msg"));
336     ASSERT_TRUE(t->GetBytes(&ct, "ct"));
337     ASSERT_EQ(EVP_CIPHER_key_length(cipher), key.size());
338     ASSERT_EQ(EVP_CIPHER_iv_length(cipher), iv.size());
339     WycheproofResult result;
340     ASSERT_TRUE(GetWycheproofResult(t, &result));
341 
342     bssl::ScopedEVP_CIPHER_CTX ctx;
343     std::vector<uint8_t> out;
344     const std::vector<size_t> chunk_sizes = {0,  1,  2,  5,  7,  8,  9,  15, 16,
345                                              17, 31, 32, 33, 63, 64, 65, 512};
346     for (size_t chunk : chunk_sizes) {
347       SCOPED_TRACE(chunk);
348       if (result == WycheproofResult::kValid) {
349         ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), cipher, nullptr, key.data(),
350                                        iv.data()));
351         ASSERT_TRUE(DoCipher(ctx.get(), &out, ct, chunk));
352         EXPECT_EQ(Bytes(msg), Bytes(out));
353 
354         ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), cipher, nullptr, key.data(),
355                                        iv.data()));
356         ASSERT_TRUE(DoCipher(ctx.get(), &out, msg, chunk));
357         EXPECT_EQ(Bytes(ct), Bytes(out));
358       } else {
359         ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), cipher, nullptr, key.data(),
360                                        iv.data()));
361         EXPECT_FALSE(DoCipher(ctx.get(), &out, ct, chunk));
362       }
363     }
364   });
365 }
366