1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <gtest/gtest.h>
18 #include <string.h>
19 
20 #include <utils/String8.h>
21 #include <utils/Vector.h>
22 
23 #include "AesCtrDecryptor.h"
24 
25 namespace clearkeydrm {
26 
27 using namespace android;
28 
29 class AesCtrDecryptorTest : public ::testing::Test {
30   protected:
31     typedef uint8_t Key[kBlockSize];
32 
attemptDecrypt(const Key & key,const Iv & iv,const uint8_t * source,uint8_t * destination,const SubSample * subSamples,size_t numSubSamples,size_t * bytesDecryptedOut)33     status_t attemptDecrypt(const Key& key, const Iv& iv, const uint8_t* source,
34                             uint8_t* destination, const SubSample* subSamples,
35                             size_t numSubSamples, size_t* bytesDecryptedOut) {
36         Vector<uint8_t> keyVector;
37         keyVector.appendArray(key, sizeof(key) / sizeof(uint8_t));
38 
39         AesCtrDecryptor decryptor;
40         return decryptor.decrypt(keyVector, iv, source, destination, subSamples,
41                                  numSubSamples, bytesDecryptedOut);
42     }
43 
44     template <size_t totalSize>
attemptDecryptExpectingSuccess(const Key & key,const Iv & iv,const uint8_t * encrypted,const uint8_t * decrypted,const SubSample * subSamples,size_t numSubSamples)45     void attemptDecryptExpectingSuccess(const Key& key, const Iv& iv,
46                                         const uint8_t* encrypted,
47                                         const uint8_t* decrypted,
48                                         const SubSample* subSamples,
49                                         size_t numSubSamples) {
50         uint8_t outputBuffer[totalSize] = {};
51         size_t bytesDecrypted = 0;
52         ASSERT_EQ(android::OK, attemptDecrypt(key, iv, encrypted, outputBuffer,
53                                               subSamples, numSubSamples,
54                                               &bytesDecrypted));
55         EXPECT_EQ(totalSize, bytesDecrypted);
56         EXPECT_EQ(0, memcmp(outputBuffer, decrypted, totalSize));
57     }
58 };
59 
TEST_F(AesCtrDecryptorTest,DecryptsWithEmptyKey)60 TEST_F(AesCtrDecryptorTest, DecryptsWithEmptyKey) {
61     const size_t kTotalSize = 64;
62     const size_t kNumSubsamples = 1;
63 
64     // Test vectors from NIST-800-38A
65     Iv iv = {
66         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
67         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
68     };
69 
70     uint8_t source[kTotalSize] = { 0 };
71     uint8_t destination[kTotalSize] = { 0 };
72     SubSample subSamples[kNumSubsamples] = {
73         {0, 64}
74     };
75 
76     size_t bytesDecrypted = 0;
77     Vector<uint8_t> keyVector;
78     keyVector.clear();
79 
80     AesCtrDecryptor decryptor;
81     ASSERT_EQ(android::ERROR_DRM_DECRYPT, decryptor.decrypt(keyVector, iv,
82               &source[0], &destination[0],
83               &subSamples[0], kNumSubsamples, &bytesDecrypted));
84     ASSERT_EQ(0u, bytesDecrypted);
85 }
86 
TEST_F(AesCtrDecryptorTest,DecryptsWithKeyTooLong)87 TEST_F(AesCtrDecryptorTest, DecryptsWithKeyTooLong) {
88     const size_t kTotalSize = 64;
89     const size_t kNumSubsamples = 1;
90 
91     // Test vectors from NIST-800-38A
92     uint8_t key[kBlockSize * 2] = {
93         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
94         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c,
95         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
96         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
97     };
98 
99     Iv iv = {
100         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
101         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
102     };
103 
104     uint8_t source[kTotalSize] = { 0 };
105     uint8_t destination[kTotalSize] = { 0 };
106     SubSample subSamples[kNumSubsamples] = {
107         {0, 64}
108     };
109 
110     size_t bytesDecrypted = 0;
111     Vector<uint8_t> keyVector;
112     keyVector.appendArray(key, sizeof(key) / sizeof(uint8_t));
113 
114     AesCtrDecryptor decryptor;
115     ASSERT_EQ(android::ERROR_DRM_DECRYPT, decryptor.decrypt(keyVector, iv,
116               &source[0], &destination[0],
117               &subSamples[0], kNumSubsamples, &bytesDecrypted));
118     ASSERT_EQ(0u, bytesDecrypted);
119 }
120 
TEST_F(AesCtrDecryptorTest,DecryptsContiguousEncryptedBlock)121 TEST_F(AesCtrDecryptorTest, DecryptsContiguousEncryptedBlock) {
122     const size_t kTotalSize = 64;
123     const size_t kNumSubsamples = 1;
124 
125     // Test vectors from NIST-800-38A
126     Key key = {
127         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
128         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
129     };
130 
131     Iv iv = {
132         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
133         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
134     };
135 
136     uint8_t encrypted[kTotalSize] = {
137         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
138         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
139         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
140         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff, 0xfd, 0xff,
141         0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5, 0xd3, 0x5e,
142         0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0, 0x3e, 0xab,
143         0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe, 0x03, 0xd1,
144         0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00, 0x9c, 0xee
145     };
146 
147     uint8_t decrypted[kTotalSize] = {
148         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
149         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
150         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
151         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
152         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
153         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
154         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
155         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
156     };
157 
158     SubSample subSamples[kNumSubsamples] = {
159         {0, 64}
160     };
161 
162     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
163                                                subSamples, kNumSubsamples);
164 }
165 
TEST_F(AesCtrDecryptorTest,DecryptsAlignedBifurcatedEncryptedBlock)166 TEST_F(AesCtrDecryptorTest, DecryptsAlignedBifurcatedEncryptedBlock) {
167     const size_t kTotalSize = 64;
168     const size_t kNumSubsamples = 2;
169 
170     // Test vectors from NIST-800-38A
171     Key key = {
172         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
173         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
174     };
175 
176     Iv iv = {
177         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
178         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
179     };
180 
181     uint8_t encrypted[kTotalSize] = {
182         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
183         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
184         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
185         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff, 0xfd, 0xff,
186         0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5, 0xd3, 0x5e,
187         0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0, 0x3e, 0xab,
188         0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe, 0x03, 0xd1,
189         0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00, 0x9c, 0xee
190     };
191 
192     uint8_t decrypted[kTotalSize] = {
193         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
194         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
195         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
196         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
197         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
198         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
199         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
200         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
201     };
202 
203     SubSample subSamples[kNumSubsamples] = {
204         {0, 32},
205         {0, 32}
206     };
207 
208     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
209                                                subSamples, kNumSubsamples);
210 }
211 
TEST_F(AesCtrDecryptorTest,DecryptsUnalignedBifurcatedEncryptedBlock)212 TEST_F(AesCtrDecryptorTest, DecryptsUnalignedBifurcatedEncryptedBlock) {
213     const size_t kTotalSize = 64;
214     const size_t kNumSubsamples = 2;
215 
216     // Test vectors from NIST-800-38A
217     Key key = {
218         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
219         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
220     };
221 
222     Iv iv = {
223         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
224         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
225     };
226 
227     uint8_t encrypted[kTotalSize] = {
228         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
229         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
230         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
231         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff, 0xfd, 0xff,
232         0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5, 0xd3, 0x5e,
233         0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0, 0x3e, 0xab,
234         0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe, 0x03, 0xd1,
235         0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00, 0x9c, 0xee
236     };
237 
238     uint8_t decrypted[kTotalSize] = {
239         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
240         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
241         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
242         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
243         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
244         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
245         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
246         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
247     };
248 
249     SubSample subSamples[kNumSubsamples] = {
250         {0, 29},
251         {0, 35}
252     };
253 
254     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
255                                                subSamples, kNumSubsamples);
256 }
257 
TEST_F(AesCtrDecryptorTest,DecryptsOneMixedSubSample)258 TEST_F(AesCtrDecryptorTest, DecryptsOneMixedSubSample) {
259     const size_t kTotalSize = 72;
260     const size_t kNumSubsamples = 1;
261 
262     // Based on test vectors from NIST-800-38A
263     Key key = {
264         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
265         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
266     };
267 
268     Iv iv = {
269         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
270         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
271     };
272 
273     uint8_t encrypted[kTotalSize] = {
274         // 8 clear bytes
275         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
276         // 64 encrypted bytes
277         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
278         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
279         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
280         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff, 0xfd, 0xff,
281         0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5, 0xd3, 0x5e,
282         0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0, 0x3e, 0xab,
283         0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe, 0x03, 0xd1,
284         0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00, 0x9c, 0xee
285     };
286 
287     uint8_t decrypted[kTotalSize] = {
288         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
289         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
290         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
291         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
292         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
293         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
294         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
295         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
296         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
297     };
298 
299     SubSample subSamples[kNumSubsamples] = {
300         {8, 64}
301     };
302 
303     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
304                                                subSamples, kNumSubsamples);
305 }
306 
TEST_F(AesCtrDecryptorTest,DecryptsAlignedMixedSubSamples)307 TEST_F(AesCtrDecryptorTest, DecryptsAlignedMixedSubSamples) {
308     const size_t kTotalSize = 80;
309     const size_t kNumSubsamples = 2;
310 
311     // Based on test vectors from NIST-800-38A
312     Key key = {
313         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
314         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
315     };
316 
317     Iv iv = {
318         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
319         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
320     };
321 
322     uint8_t encrypted[kTotalSize] = {
323         // 8 clear bytes
324         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
325         // 32 encrypted bytes
326         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
327         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
328         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
329         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff, 0xfd, 0xff,
330         // 8 clear bytes
331         0x94, 0xba, 0x88, 0x2e, 0x0e, 0x12, 0x11, 0x55,
332         // 32 encrypted bytes
333         0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5, 0xd3, 0x5e,
334         0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0, 0x3e, 0xab,
335         0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe, 0x03, 0xd1,
336         0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00, 0x9c, 0xee
337     };
338 
339     uint8_t decrypted[kTotalSize] = {
340         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
341         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
342         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
343         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
344         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
345         0x94, 0xba, 0x88, 0x2e, 0x0e, 0x12, 0x11, 0x55,
346         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
347         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
348         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
349         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
350     };
351 
352     SubSample subSamples[kNumSubsamples] = {
353         {8, 32},
354         {8, 32}
355     };
356 
357     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
358                                                subSamples, kNumSubsamples);
359 }
360 
TEST_F(AesCtrDecryptorTest,DecryptsUnalignedMixedSubSamples)361 TEST_F(AesCtrDecryptorTest, DecryptsUnalignedMixedSubSamples) {
362     const size_t kTotalSize = 80;
363     const size_t kNumSubsamples = 2;
364 
365     // Based on test vectors from NIST-800-38A
366     Key key = {
367         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
368         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
369     };
370 
371     Iv iv = {
372         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
373         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
374     };
375 
376     uint8_t encrypted[kTotalSize] = {
377         // 8 clear bytes
378         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
379         // 30 encrypted bytes
380         0x87, 0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26,
381         0x1b, 0xef, 0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
382         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
383         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff,
384         // 8 clear bytes
385         0x94, 0xba, 0x88, 0x2e, 0x0e, 0x12, 0x11, 0x55,
386         // 34 encrypted bytes
387         0xfd, 0xff, 0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5,
388         0xd3, 0x5e, 0x5b, 0x4f, 0x09, 0x02, 0x0d, 0xb0,
389         0x3e, 0xab, 0x1e, 0x03, 0x1d, 0xda, 0x2f, 0xbe,
390         0x03, 0xd1, 0x79, 0x21, 0x70, 0xa0, 0xf3, 0x00,
391         0x9c, 0xee
392     };
393 
394     uint8_t decrypted[kTotalSize] = {
395         0xf0, 0x13, 0xca, 0xc7, 0x00, 0x64, 0x0b, 0xbb,
396         0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
397         0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
398         0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
399         0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x94, 0xba,
400         0x88, 0x2e, 0x0e, 0x12, 0x11, 0x55, 0x8e, 0x51,
401         0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
402         0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
403         0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
404         0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
405     };
406 
407     SubSample subSamples[kNumSubsamples] = {
408         {8, 30},
409         {8, 34}
410     };
411 
412     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
413                                                subSamples, kNumSubsamples);
414 }
415 
TEST_F(AesCtrDecryptorTest,DecryptsComplexMixedSubSamples)416 TEST_F(AesCtrDecryptorTest, DecryptsComplexMixedSubSamples) {
417     const size_t kTotalSize = 72;
418     const size_t kNumSubsamples = 6;
419 
420     // Based on test vectors from NIST-800-38A
421     Key key = {
422         0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
423         0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
424     };
425 
426     Iv iv = {
427         0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
428         0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
429     };
430 
431     uint8_t encrypted[kTotalSize] = {
432         // 4 clear bytes
433         0xf0, 0x13, 0xca, 0xc7,
434         // 1 encrypted bytes
435         0x87,
436         // 9 encrypted bytes
437         0x4d, 0x61, 0x91, 0xb6, 0x20, 0xe3, 0x26, 0x1b,
438         0xef,
439         // 11 clear bytes
440         0x81, 0x4f, 0x24, 0x87, 0x0e, 0xde, 0xba, 0xad,
441         0x11, 0x9b, 0x46,
442         // 20 encrypted bytes
443         0x68, 0x64, 0x99, 0x0d, 0xb6, 0xce,
444         0x98, 0x06, 0xf6, 0x6b, 0x79, 0x70, 0xfd, 0xff,
445         0x86, 0x17, 0x18, 0x7b, 0xb9, 0xff,
446         // 8 clear bytes
447         0x94, 0xba, 0x88, 0x2e, 0x0e, 0x12, 0x11, 0x55,
448         // 3 clear bytes
449         0x10, 0xf5, 0x22,
450         // 14 encrypted bytes
451         0xfd, 0xff, 0x5a, 0xe4, 0xdf, 0x3e, 0xdb, 0xd5,
452         0xd3, 0x5e, 0x5b, 0x4f, 0x09, 0x02,
453         // 2 clear bytes
454         0x02, 0x01
455     };
456 
457     uint8_t decrypted[kTotalSize] = {
458         0xf0, 0x13, 0xca, 0xc7, 0x6b, 0xc1, 0xbe, 0xe2,
459         0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x81, 0x4f,
460         0x24, 0x87, 0x0e, 0xde, 0xba, 0xad, 0x11, 0x9b,
461         0x46, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a, 0xae,
462         0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c, 0x9e,
463         0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x94, 0xba, 0x88,
464         0x2e, 0x0e, 0x12, 0x11, 0x55, 0x10, 0xf5, 0x22,
465         0x8e, 0x51, 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c,
466         0xe4, 0x11, 0xe5, 0xfb, 0xc1, 0x19, 0x02, 0x01
467     };
468 
469     SubSample subSamples[kNumSubsamples] = {
470         {4, 1},
471         {0, 9},
472         {11, 20},
473         {8, 0},
474         {3, 14},
475         {2, 0}
476     };
477 
478     attemptDecryptExpectingSuccess<kTotalSize>(key, iv, encrypted, decrypted,
479                                                subSamples, kNumSubsamples);
480 }
481 
482 }  // namespace clearkeydrm
483