src/crypt/AlgorithmTests.c

/* Microsoft Reference Implementation for TPM 2.0
 *
 *  The copyright in this software is being made available under the BSD License,
 *  included below. This software may be subject to other third party and
 *  contributor rights, including patent rights, and no such rights are granted
 *  under this license.
 *
 *  Copyright (c) Microsoft Corporation
 *
 *  All rights reserved.
 *
 *  BSD License
 *
 *  Redistribution and use in source and binary forms, with or without modification,
 *  are permitted provided that the following conditions are met:
 *
 *  Redistributions of source code must retain the above copyright notice, this list
 *  of conditions and the following disclaimer.
 *
 *  Redistributions in binary form must reproduce the above copyright notice, this
 *  list of conditions and the following disclaimer in the documentation and/or
 *  other materials provided with the distribution.
 *
 *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS""
 *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 *  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
 *  ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 *  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 *  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
//** Introduction
// This file contains the code to perform the various self-test functions.
//
// NOTE: In this implementation, large local variables are made static to minimize
// stack usage, which is critical for stack-constrained platforms.

//** Includes and Defines
#include    "Tpm.h"

#define     SELF_TEST_DATA

#if SELF_TEST

// These includes pull in the data structures. They contain data definitions for the
// various tests.
#include    "SelfTest.h"
#include    "SymmetricTest.h"
#include    "RsaTestData.h"
#include    "EccTestData.h"
#include    "HashTestData.h"
#include    "KdfTestData.h"

#define TEST_DEFAULT_TEST_HASH(vector)                                              \
            if(TEST_BIT(DEFAULT_TEST_HASH, g_toTest))                               \
                TestHash(DEFAULT_TEST_HASH, vector);

// Make sure that the algorithm has been tested
#define CLEAR_BOTH(alg)     {   CLEAR_BIT(alg, *toTest);                            \
                                if(toTest != &g_toTest)                             \
                                    CLEAR_BIT(alg, g_toTest); }

#define SET_BOTH(alg)     {   SET_BIT(alg, *toTest);                                \
                                if(toTest != &g_toTest)                             \
                                    SET_BIT(alg, g_toTest); }

#define TEST_BOTH(alg)       ((toTest != &g_toTest)                                 \
                            ? TEST_BIT(alg, *toTest) || TEST_BIT(alg, g_toTest)     \
                            : TEST_BIT(alg, *toTest))

// Can only cancel if doing a list.
#define CHECK_CANCELED                                                              \
    if(_plat__IsCanceled() && toTest != &g_toTest)                                  \
        return TPM_RC_CANCELED;

//** Hash Tests

//*** Description
// The hash test does a known-value HMAC using the specified hash algorithm.

//*** TestHash()
// The hash test function.
static TPM_RC
TestHash(
    TPM_ALG_ID          hashAlg,
    ALGORITHM_VECTOR    *toTest
    )
{
    static TPM2B_DIGEST      computed;  // value computed
    static HMAC_STATE        state;
    UINT16                   digestSize;
    const TPM2B             *testDigest = NULL;
//    TPM2B_TYPE(HMAC_BLOCK, DEFAULT_TEST_HASH_BLOCK_SIZE);

    pAssert(hashAlg != TPM_ALG_NULL);
#define HASH_CASE_FOR_TEST(HASH, hash)        case ALG_##HASH##_VALUE:          \
                                            testDigest = &c_##HASH##_digest.b;  \
                                            break;
    switch(hashAlg)
    {
        FOR_EACH_HASH(HASH_CASE_FOR_TEST)

        default:
            FAIL(FATAL_ERROR_INTERNAL);
    }
    // Clear the to-test bits
    CLEAR_BOTH(hashAlg);

    // If there is an algorithm without test vectors, then assume that things are OK.
    if(testDigest == NULL || testDigest->size == 0)
        return TPM_RC_SUCCESS;

    // Set the HMAC key to twice the digest size
    digestSize = CryptHashGetDigestSize(hashAlg);
    CryptHmacStart(&state, hashAlg, digestSize * 2,
                   (BYTE *)c_hashTestKey.t.buffer);
    CryptDigestUpdate(&state.hashState, 2 * CryptHashGetBlockSize(hashAlg),
                      (BYTE *)c_hashTestData.t.buffer);
    computed.t.size = digestSize;
    CryptHmacEnd(&state, digestSize, computed.t.buffer);
    if((testDigest->size != computed.t.size)
       || (memcmp(testDigest->buffer, computed.t.buffer, computed.b.size) != 0))
        SELF_TEST_FAILURE;
    return TPM_RC_SUCCESS;
}

//** Symmetric Test Functions

//*** MakeIv()
// Internal function to make the appropriate IV depending on the mode.
static UINT32
MakeIv(
    TPM_ALG_ID    mode,     // IN: symmetric mode
    UINT32        size,     // IN: block size of the algorithm
    BYTE         *iv        // OUT: IV to fill in
    )
{
    BYTE          i;

    if(mode == TPM_ALG_ECB)
        return 0;
    if(mode == TPM_ALG_CTR)
    {
        // The test uses an IV that has 0xff in the last byte
        for(i = 1; i <= size; i++)
            *iv++ = 0xff - (BYTE)(size - i);
    }
    else
    {
        for(i = 0; i < size; i++)
            *iv++ = i;
    }
    return size;
}

//*** TestSymmetricAlgorithm()
// Function to test a specific algorithm, key size, and mode.
static void
TestSymmetricAlgorithm(
    const SYMMETRIC_TEST_VECTOR     *test,          //
    TPM_ALG_ID                       mode           //
    )
{
    static BYTE                 encrypted[MAX_SYM_BLOCK_SIZE * 2];
    static BYTE                 decrypted[MAX_SYM_BLOCK_SIZE * 2];
    static TPM2B_IV             iv;
//
    // Get the appropriate IV
    iv.t.size = (UINT16)MakeIv(mode, test->ivSize, iv.t.buffer);

    // Encrypt known data
    CryptSymmetricEncrypt(encrypted, test->alg, test->keyBits, test->key, &iv,
                          mode, test->dataInOutSize, test->dataIn);
    // Check that it matches the expected value
    if(!MemoryEqual(encrypted, test->dataOut[mode - TPM_ALG_CTR],
                    test->dataInOutSize))
        SELF_TEST_FAILURE;
    // Reinitialize the iv for decryption
    MakeIv(mode, test->ivSize, iv.t.buffer);
    CryptSymmetricDecrypt(decrypted, test->alg, test->keyBits, test->key, &iv,
                          mode, test->dataInOutSize,
                          test->dataOut[mode - TPM_ALG_CTR]);
    // Make sure that it matches what we started with
    if(!MemoryEqual(decrypted, test->dataIn, test->dataInOutSize))
        SELF_TEST_FAILURE;
}

//*** AllSymsAreDone()
// Checks if both symmetric algorithms have been tested. This is put here
// so that addition of a symmetric algorithm will be relatively easy to handle.
//
//  Return Type: BOOL
//      TRUE(1)         all symmetric algorithms tested
//      FALSE(0)        not all symmetric algorithms tested
static BOOL
AllSymsAreDone(
    ALGORITHM_VECTOR        *toTest
    )
{
    return (!TEST_BOTH(TPM_ALG_AES) && !TEST_BOTH(TPM_ALG_SM4));
}

//*** AllModesAreDone()
// Checks if all the modes have been tested.
//
//  Return Type: BOOL
//      TRUE(1)         all modes tested
//      FALSE(0)        all modes not tested
static BOOL
AllModesAreDone(
    ALGORITHM_VECTOR            *toTest
    )
{
    TPM_ALG_ID                  alg;
    for(alg = SYM_MODE_FIRST; alg <= SYM_MODE_LAST; alg++)
        if(TEST_BOTH(alg))
            return FALSE;
    return TRUE;
}

//*** TestSymmetric()
// If 'alg' is a symmetric block cipher, then all of the modes that are selected are
// tested. If 'alg' is a mode, then all algorithms of that mode are tested.
static TPM_RC
TestSymmetric(
    TPM_ALG_ID                   alg,
    ALGORITHM_VECTOR            *toTest
    )
{
    SYM_INDEX                    index;
    TPM_ALG_ID                   mode;
//
    if(!TEST_BIT(alg, *toTest))
        return TPM_RC_SUCCESS;
    if(alg == TPM_ALG_AES || alg == TPM_ALG_SM4 || alg == TPM_ALG_CAMELLIA)
    {
        // Will test the algorithm for all modes and key sizes
        CLEAR_BOTH(alg);

        // A test this algorithm for all modes
        for(index = 0; index < NUM_SYMS; index++)
        {
            if(c_symTestValues[index].alg == alg)
            {
                for(mode = SYM_MODE_FIRST;
                mode <= SYM_MODE_LAST;
                    mode++)
                {
                    if(TEST_BIT(mode, *toTest))
                        TestSymmetricAlgorithm(&c_symTestValues[index], mode);
                }
            }
        }
        // if all the symmetric tests are done
        if(AllSymsAreDone(toTest))
        {
            // all symmetric algorithms tested so no modes should be set
            for(alg = SYM_MODE_FIRST; alg <= SYM_MODE_LAST; alg++)
                CLEAR_BOTH(alg);
        }
    }
    else if(SYM_MODE_FIRST <= alg && alg <= SYM_MODE_LAST)
    {
        // Test this mode for all key sizes and algorithms
        for(index = 0; index < NUM_SYMS; index++)
        {
            // The mode testing only comes into play when doing self tests
            // by command. When doing self tests by command, the block ciphers are
            // tested first. That means that all of their modes would have been
            // tested for all key sizes. If there is no block cipher left to
            // test, then clear this mode bit.
            if(!TEST_BIT(TPM_ALG_AES, *toTest)
               && !TEST_BIT(TPM_ALG_SM4, *toTest))
            {
                CLEAR_BOTH(alg);
            }
            else
            {
                for(index = 0; index < NUM_SYMS; index++)
                {
                    if(TEST_BIT(c_symTestValues[index].alg, *toTest))
                        TestSymmetricAlgorithm(&c_symTestValues[index], alg);
                }
                // have tested this mode for all algorithms
                CLEAR_BOTH(alg);
            }
        }
        if(AllModesAreDone(toTest))
        {
            CLEAR_BOTH(TPM_ALG_AES);
            CLEAR_BOTH(TPM_ALG_SM4);
        }
    }
    else
        pAssert(alg == 0 && alg != 0);
    return TPM_RC_SUCCESS;
}

//** RSA Tests
#if ALG_RSA

//*** Introduction
// The tests are for public key only operations and for private key operations.
// Signature verification and encryption are public key operations. They are tested
// by using a KVT. For signature verification, this means that a known good
// signature is checked by CryptRsaValidateSignature(). If it fails, then the
// TPM enters failure mode. For encryption, the TPM encrypts known values using
// the selected scheme and checks that the returned value matches the expected
// value.
//
// For private key operations, a full scheme check is used. For a signing key, a
// known key is used to sign a known message. Then that signature is verified.
// since the signature may involve use of random values, the signature will be
// different each time and we can't always check that the signature matches a
// known value. The same technique is used for decryption (RSADP/RSAEP).
//
// When an operation uses the public key and the verification has not been
// tested, the TPM will do a KVT.
//
// The test for the signing algorithm is built into the call for the algorithm

//*** RsaKeyInitialize()
// The test key is defined by a public modulus and a private prime. The TPM's RSA
// code computes the second prime and the private exponent.
static void
RsaKeyInitialize(
    OBJECT          *testObject
    )
{
    MemoryCopy2B(&testObject->publicArea.unique.rsa.b, (P2B)&c_rsaPublicModulus,
                 sizeof(c_rsaPublicModulus));
    MemoryCopy2B(&testObject->sensitive.sensitive.rsa.b, (P2B)&c_rsaPrivatePrime,
                 sizeof(testObject->sensitive.sensitive.rsa.t.buffer));
    testObject->publicArea.parameters.rsaDetail.keyBits = RSA_TEST_KEY_SIZE * 8;
    // Use the default exponent
    testObject->publicArea.parameters.rsaDetail.exponent = 0;
}

//*** TestRsaEncryptDecrypt()
// These tests are for a public key encryption that uses a random value.
static TPM_RC
TestRsaEncryptDecrypt(
    TPM_ALG_ID           scheme,            // IN: the scheme
    ALGORITHM_VECTOR    *toTest             //
    )
{
    static TPM2B_PUBLIC_KEY_RSA      testInput;
    static TPM2B_PUBLIC_KEY_RSA      testOutput;
    static OBJECT                    testObject;
    const TPM2B_RSA_TEST_KEY        *kvtValue = NULL;
    TPM_RC                           result = TPM_RC_SUCCESS;
    const TPM2B                     *testLabel = NULL;
    TPMT_RSA_DECRYPT                 rsaScheme;
//
    // Don't need to initialize much of the test object
    RsaKeyInitialize(&testObject);
    rsaScheme.scheme = scheme;
    rsaScheme.details.anySig.hashAlg = DEFAULT_TEST_HASH;
    CLEAR_BOTH(scheme);
    CLEAR_BOTH(TPM_ALG_NULL);
    if(scheme == TPM_ALG_NULL)
    {
        // This is an encryption scheme using the private key without any encoding.
        memcpy(testInput.t.buffer, c_RsaTestValue, sizeof(c_RsaTestValue));
        testInput.t.size = sizeof(c_RsaTestValue);
        if(TPM_RC_SUCCESS != CryptRsaEncrypt(&testOutput, &testInput.b,
                                             &testObject, &rsaScheme, NULL, NULL))
            SELF_TEST_FAILURE;
        if(!MemoryEqual(testOutput.t.buffer, c_RsaepKvt.buffer, c_RsaepKvt.size))
            SELF_TEST_FAILURE;
        MemoryCopy2B(&testInput.b, &testOutput.b, sizeof(testInput.t.buffer));
        if(TPM_RC_SUCCESS != CryptRsaDecrypt(&testOutput.b, &testInput.b,
                                             &testObject, &rsaScheme, NULL))
            SELF_TEST_FAILURE;
        if(!MemoryEqual(testOutput.t.buffer, c_RsaTestValue,
                        sizeof(c_RsaTestValue)))
            SELF_TEST_FAILURE;
    }
    else
    {
        // TPM_ALG_RSAES:
        // This is an decryption scheme using padding according to
        // PKCS#1v2.1, 7.2. This padding uses random bits. To test a public
        // key encryption that uses random data, encrypt a value and then
        // decrypt the value and see that we get the encrypted data back.
        // The hash is not used by this encryption so it can be TMP_ALG_NULL

        // TPM_ALG_OAEP:
        // This is also an decryption scheme and it also uses a
        // pseudo-random
        // value. However, this also uses a hash algorithm. So, we may need
        // to test that algorithm before use.
        if(scheme == TPM_ALG_OAEP)
        {
            TEST_DEFAULT_TEST_HASH(toTest);
            kvtValue = &c_OaepKvt;
            testLabel = OAEP_TEST_STRING;
        }
        else if(scheme == TPM_ALG_RSAES)
        {
            kvtValue = &c_RsaesKvt;
            testLabel = NULL;
        }
        else
            SELF_TEST_FAILURE;
        // Only use a digest-size portion of the test value
        memcpy(testInput.t.buffer, c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE);
        testInput.t.size = DEFAULT_TEST_DIGEST_SIZE;

        // See if the encryption works
        if(TPM_RC_SUCCESS != CryptRsaEncrypt(&testOutput, &testInput.b,
                                             &testObject, &rsaScheme, testLabel,
                                             NULL))
            SELF_TEST_FAILURE;
        MemoryCopy2B(&testInput.b, &testOutput.b, sizeof(testInput.t.buffer));
        // see if we can decrypt this value and get the original data back
        if(TPM_RC_SUCCESS != CryptRsaDecrypt(&testOutput.b, &testInput.b,
                                             &testObject, &rsaScheme, testLabel))
            SELF_TEST_FAILURE;
        // See if the results compare
        if(testOutput.t.size != DEFAULT_TEST_DIGEST_SIZE
           || !MemoryEqual(testOutput.t.buffer, c_RsaTestValue,
                           DEFAULT_TEST_DIGEST_SIZE))
            SELF_TEST_FAILURE;
        // Now check that the decryption works on a known value
        MemoryCopy2B(&testInput.b, (P2B)kvtValue,
                     sizeof(testInput.t.buffer));
        if(TPM_RC_SUCCESS != CryptRsaDecrypt(&testOutput.b, &testInput.b,
                                             &testObject, &rsaScheme, testLabel))
            SELF_TEST_FAILURE;
        if(testOutput.t.size != DEFAULT_TEST_DIGEST_SIZE
           || !MemoryEqual(testOutput.t.buffer, c_RsaTestValue,
                           DEFAULT_TEST_DIGEST_SIZE))
            SELF_TEST_FAILURE;
    }
    return result;
}

//*** TestRsaSignAndVerify()
// This function does the testing of the RSA sign and verification functions. This
// test does a KVT.
static TPM_RC
TestRsaSignAndVerify(
    TPM_ALG_ID               scheme,
    ALGORITHM_VECTOR        *toTest
    )
{
    TPM_RC                      result = TPM_RC_SUCCESS;
    static OBJECT               testObject;
    static TPM2B_DIGEST         testDigest;
    static TPMT_SIGNATURE       testSig;

    // Do a sign and signature verification.
    // RSASSA:
    // This is a signing scheme according to PKCS#1-v2.1 8.2. It does not
    // use random data so there is a KVT for the signing operation. On
    // first use of the scheme for signing, use the TPM's RSA key to
    // sign a portion of c_RsaTestData and compare the results to c_RsassaKvt. Then
    // decrypt the data to see that it matches the starting value. This verifies
    // the signature with a KVT

    // Clear the bits indicating that the function has not been checked. This is to
    // prevent looping
    CLEAR_BOTH(scheme);
    CLEAR_BOTH(TPM_ALG_NULL);
    CLEAR_BOTH(TPM_ALG_RSA);

    RsaKeyInitialize(&testObject);
    memcpy(testDigest.t.buffer, (BYTE *)c_RsaTestValue, DEFAULT_TEST_DIGEST_SIZE);
    testDigest.t.size = DEFAULT_TEST_DIGEST_SIZE;
    testSig.sigAlg = scheme;
    testSig.signature.rsapss.hash = DEFAULT_TEST_HASH;

    // RSAPSS:
    // This is a signing scheme a according to PKCS#1-v2.2 8.1 it uses
    // random data in the signature so there is no KVT for the signing
    // operation. To test signing, the TPM will use the TPM's RSA key
    // to sign a portion of c_RsaTestValue and then it will verify the
    // signature. For verification, c_RsapssKvt is verified before the
    // user signature blob is verified. The worst case for testing of this
    // algorithm is two private and one public key operation.

    // The process is to sign known data. If RSASSA is being done, verify that the
    // signature matches the precomputed value. For both, use the signed value and
    // see that the verification says that it is a good signature. Then
    // if testing RSAPSS, do a verify of a known good signature. This ensures that
    // the validation function works.

    if(TPM_RC_SUCCESS != CryptRsaSign(&testSig, &testObject, &testDigest, NULL))
        SELF_TEST_FAILURE;
    // For RSASSA, make sure the results is what we are looking for
    if(testSig.sigAlg == TPM_ALG_RSASSA)
    {
        if(testSig.signature.rsassa.sig.t.size != RSA_TEST_KEY_SIZE
           || !MemoryEqual(c_RsassaKvt.buffer,
                           testSig.signature.rsassa.sig.t.buffer,
                           RSA_TEST_KEY_SIZE))
            SELF_TEST_FAILURE;
    }
    // See if the TPM will validate its own signatures
    if(TPM_RC_SUCCESS != CryptRsaValidateSignature(&testSig, &testObject,
                                                   &testDigest))
        SELF_TEST_FAILURE;
    // If this is RSAPSS, check the verification with known signature
    // Have to copy because  CrytpRsaValidateSignature() eats the signature
    if(TPM_ALG_RSAPSS == scheme)
    {
        MemoryCopy2B(&testSig.signature.rsapss.sig.b, (P2B)&c_RsapssKvt,
                     sizeof(testSig.signature.rsapss.sig.t.buffer));
        if(TPM_RC_SUCCESS != CryptRsaValidateSignature(&testSig, &testObject,
                                                       &testDigest))
            SELF_TEST_FAILURE;
    }
    return result;
}

//*** TestRSA()
// Function uses the provided vector to indicate which tests to run. It will clear
// the vector after each test is run and also clear g_toTest
static TPM_RC
TestRsa(
    TPM_ALG_ID               alg,
    ALGORITHM_VECTOR        *toTest
    )
{
    TPM_RC                  result = TPM_RC_SUCCESS;
//
    switch(alg)
    {
        case TPM_ALG_NULL:
        // This is the RSAEP/RSADP function. If we are processing a list, don't
        // need to test these now because any other test will validate
        // RSAEP/RSADP. Can tell this is list of test by checking to see if
        // 'toTest' is pointing at g_toTest. If so, this is an isolated test
        // an need to go ahead and do the test;
            if((toTest == &g_toTest)
               || (!TEST_BIT(TPM_ALG_RSASSA, *toTest)
                   && !TEST_BIT(TPM_ALG_RSAES, *toTest)
                   && !TEST_BIT(TPM_ALG_RSAPSS, *toTest)
                   && !TEST_BIT(TPM_ALG_OAEP, *toTest)))
               // Not running a list of tests or no other tests on the list
               // so run the test now
                result = TestRsaEncryptDecrypt(alg, toTest);
            // if not running the test now, leave the bit on, just in case things
            // get interrupted
            break;
        case TPM_ALG_OAEP:
        case TPM_ALG_RSAES:
            result = TestRsaEncryptDecrypt(alg, toTest);
            break;
        case TPM_ALG_RSAPSS:
        case TPM_ALG_RSASSA:
            result = TestRsaSignAndVerify(alg, toTest);
            break;
        default:
            SELF_TEST_FAILURE;
    }
    return result;
}

#endif // ALG_RSA

//** ECC Tests

#if ALG_ECC

//*** LoadEccParameter()
// This function is mostly for readability and type checking
static void
LoadEccParameter(
    TPM2B_ECC_PARAMETER          *to,       // target
    const TPM2B_EC_TEST          *from      // source
    )
{
    MemoryCopy2B(&to->b, &from->b, sizeof(to->t.buffer));
}

//*** LoadEccPoint()
static void
LoadEccPoint(
    TPMS_ECC_POINT               *point,    // target
    const TPM2B_EC_TEST          *x,        // source
    const TPM2B_EC_TEST          *y
    )
{
    MemoryCopy2B(&point->x.b, (TPM2B *)x, sizeof(point->x.t.buffer));
    MemoryCopy2B(&point->y.b, (TPM2B *)y, sizeof(point->y.t.buffer));
}

//*** TestECDH()
// This test does a KVT on a point multiply.
static TPM_RC
TestECDH(
    TPM_ALG_ID          scheme,         // IN: for consistency
    ALGORITHM_VECTOR    *toTest         // IN/OUT: modified after test is run
    )
{
    static TPMS_ECC_POINT       Z;
    static TPMS_ECC_POINT       Qe;
    static TPM2B_ECC_PARAMETER  ds;
    TPM_RC                      result = TPM_RC_SUCCESS;
//
    NOT_REFERENCED(scheme);
    CLEAR_BOTH(TPM_ALG_ECDH);
    LoadEccParameter(&ds, &c_ecTestKey_ds);
    LoadEccPoint(&Qe, &c_ecTestKey_QeX, &c_ecTestKey_QeY);
    if(TPM_RC_SUCCESS != CryptEccPointMultiply(&Z, c_testCurve, &Qe, &ds,
                                               NULL, NULL))
        SELF_TEST_FAILURE;
    if(!MemoryEqual2B(&c_ecTestEcdh_X.b, &Z.x.b)
       || !MemoryEqual2B(&c_ecTestEcdh_Y.b, &Z.y.b))
        SELF_TEST_FAILURE;
    return result;
}

//*** TestEccSignAndVerify()
static TPM_RC
TestEccSignAndVerify(
    TPM_ALG_ID                   scheme,
    ALGORITHM_VECTOR            *toTest
    )
{
    static OBJECT                testObject;
    static TPMT_SIGNATURE        testSig;
    static TPMT_ECC_SCHEME       eccScheme;

    testSig.sigAlg = scheme;
    testSig.signature.ecdsa.hash = DEFAULT_TEST_HASH;

    eccScheme.scheme = scheme;
    eccScheme.details.anySig.hashAlg = DEFAULT_TEST_HASH;

    CLEAR_BOTH(scheme);
    CLEAR_BOTH(TPM_ALG_ECDH);

    // ECC signature verification testing uses a KVT.
    switch(scheme)
    {
        case TPM_ALG_ECDSA:
            LoadEccParameter(&testSig.signature.ecdsa.signatureR, &c_TestEcDsa_r);
            LoadEccParameter(&testSig.signature.ecdsa.signatureS, &c_TestEcDsa_s);
            break;
        case TPM_ALG_ECSCHNORR:
            LoadEccParameter(&testSig.signature.ecschnorr.signatureR,
                             &c_TestEcSchnorr_r);
            LoadEccParameter(&testSig.signature.ecschnorr.signatureS,
                             &c_TestEcSchnorr_s);
            break;
        case TPM_ALG_SM2:
            // don't have a test for SM2
            return TPM_RC_SUCCESS;
        default:
            SELF_TEST_FAILURE;
            break;
    }
    TEST_DEFAULT_TEST_HASH(toTest);

    // Have to copy the key. This is because the size used in the test vectors
    // is the size of the ECC parameter for the test key while the size of a point
    // is TPM dependent
    MemoryCopy2B(&testObject.sensitive.sensitive.ecc.b, &c_ecTestKey_ds.b,
                 sizeof(testObject.sensitive.sensitive.ecc.t.buffer));
    LoadEccPoint(&testObject.publicArea.unique.ecc, &c_ecTestKey_QsX,
                 &c_ecTestKey_QsY);
    testObject.publicArea.parameters.eccDetail.curveID = c_testCurve;

    if(TPM_RC_SUCCESS != CryptEccValidateSignature(&testSig, &testObject,
                                                   (TPM2B_DIGEST *)&c_ecTestValue.b))
    {
        SELF_TEST_FAILURE;
    }
    CHECK_CANCELED;

    // Now sign and verify some data
    if(TPM_RC_SUCCESS != CryptEccSign(&testSig, &testObject,
                                      (TPM2B_DIGEST *)&c_ecTestValue,
                                      &eccScheme, NULL))
        SELF_TEST_FAILURE;

    CHECK_CANCELED;

    if(TPM_RC_SUCCESS != CryptEccValidateSignature(&testSig, &testObject,
                                                   (TPM2B_DIGEST *)&c_ecTestValue))
        SELF_TEST_FAILURE;

    CHECK_CANCELED;

    return TPM_RC_SUCCESS;
}

//*** TestKDFa()
static TPM_RC
TestKDFa(
    ALGORITHM_VECTOR        *toTest
    )
{
    static TPM2B_KDF_TEST_KEY   keyOut;
    UINT32                      counter = 0;
//
    CLEAR_BOTH(TPM_ALG_KDF1_SP800_108);

    keyOut.t.size = CryptKDFa(KDF_TEST_ALG, &c_kdfTestKeyIn.b, &c_kdfTestLabel.b,
                              &c_kdfTestContextU.b, &c_kdfTestContextV.b,
                              TEST_KDF_KEY_SIZE * 8, keyOut.t.buffer,
                              &counter, FALSE);
    if (   keyOut.t.size != TEST_KDF_KEY_SIZE
        || !MemoryEqual(keyOut.t.buffer, c_kdfTestKeyOut.t.buffer,
                        TEST_KDF_KEY_SIZE))
        SELF_TEST_FAILURE;

    return TPM_RC_SUCCESS;
}

//*** TestEcc()
static TPM_RC
TestEcc(
    TPM_ALG_ID              alg,
    ALGORITHM_VECTOR        *toTest
    )
{
    TPM_RC                  result = TPM_RC_SUCCESS;
    NOT_REFERENCED(toTest);
    switch(alg)
    {
        case TPM_ALG_ECC:
        case TPM_ALG_ECDH:
            // If this is in a loop then see if another test is going to deal with
            // this.
            // If toTest is not a self-test list
            if((toTest == &g_toTest)
                // or this is the only ECC test in the list
               || !(TEST_BIT(TPM_ALG_ECDSA, *toTest)
                    || TEST_BIT(ALG_ECSCHNORR, *toTest)
                    || TEST_BIT(TPM_ALG_SM2, *toTest)))
            {
                result = TestECDH(alg, toTest);
            }
            break;
        case TPM_ALG_ECDSA:
        case TPM_ALG_ECSCHNORR:
        case TPM_ALG_SM2:
            result = TestEccSignAndVerify(alg, toTest);
            break;
        default:
            SELF_TEST_FAILURE;
            break;
    }
    return result;
}

#endif // ALG_ECC

//*** TestAlgorithm()
// Dispatches to the correct test function for the algorithm or gets a list of
// testable algorithms.
//
// If 'toTest' is not NULL, then the test decisions are based on the algorithm
// selections in 'toTest'. Otherwise, 'g_toTest' is used. When bits are clear in
// 'g_toTest' they will also be cleared 'toTest'.
//
// If there doesn't happen to be a test for the algorithm, its associated bit is
// quietly cleared.
//
// If 'alg' is zero (TPM_ALG_ERROR), then the toTest vector is cleared of any bits
// for which there is no test (i.e. no tests are actually run but the vector is
// cleared).
//
// Note: 'toTest' will only ever have bits set for implemented algorithms but 'alg'
// can be anything.
//
//  Return Type: TPM_RC
//      TPM_RC_CANCELED     test was canceled
LIB_EXPORT
TPM_RC
TestAlgorithm(
    TPM_ALG_ID               alg,
    ALGORITHM_VECTOR        *toTest
    )
{
    TPM_ALG_ID              first = (alg == TPM_ALG_ERROR) ? TPM_ALG_FIRST : alg;
    TPM_ALG_ID              last = (alg == TPM_ALG_ERROR) ? TPM_ALG_LAST : alg;
    BOOL                    doTest = (alg != TPM_ALG_ERROR);
    TPM_RC                  result = TPM_RC_SUCCESS;

    if(toTest == NULL)
        toTest = &g_toTest;

    // This is kind of strange. This function will either run a test of the selected
    // algorithm or just clear a bit if there is no test for the algorithm. So,
    // either this loop will be executed once for the selected algorithm or once for
    // each of the possible algorithms. If it is executed more than once ('alg' ==
    // ALG_ERROR), then no test will be run but bits will be cleared for
    // unimplemented algorithms. This was done this way so that there is only one
    // case statement with all of the algorithms. It was easier to have one case
    // statement than to have multiple ones to manage whenever an algorithm ID is
    // added.
    for(alg = first; (alg <= last); alg++)
    {
        // if 'alg' was TPM_ALG_ERROR, then we will be cycling through
        // values, some of which may not be implemented. If the bit in toTest
        // happens to be set, then we could either generated an assert, or just
        // silently CLEAR it. Decided to just clear.
        if(!TEST_BIT(alg, g_implementedAlgorithms))
        {
            CLEAR_BIT(alg, *toTest);
            continue;
        }
        // Process whatever is left.
        // NOTE: since this switch will only be called if the algorithm is
        // implemented, it is not necessary to modify this list except to comment
        // out the algorithms for which there is no test
        switch(alg)
        {
        // Symmetric block ciphers
#if ALG_AES
            case TPM_ALG_AES:
#endif  // ALG_AES
#if ALG_SM4
            // if SM4 is implemented, its test is like other block ciphers but there
            // aren't any test vectors for it yet
//            case TPM_ALG_SM4:
#endif  // ALG_SM4
#if ALG_CAMELLIA
            // no test vectors for camellia
//            case TPM_ALG_CAMELLIA:
#endif
        // Symmetric modes
#if     !ALG_CFB
#   error   CFB is required in all TPM implementations
#endif // !ALG_CFB
            case TPM_ALG_CFB:
                if(doTest)
                    result = TestSymmetric(alg, toTest);
                break;
#if ALG_CTR
            case TPM_ALG_CTR:
#endif // ALG_CRT
#if ALG_OFB
            case TPM_ALG_OFB:
#endif // ALG_OFB
#if ALG_CBC
            case TPM_ALG_CBC:
#endif // ALG_CBC
#if ALG_ECB
            case TPM_ALG_ECB:
#endif
                if(doTest)
                    result = TestSymmetric(alg, toTest);
                else
                    // If doing the initialization of g_toTest vector, only need
                    // to test one of the modes for the symmetric algorithms. If
                    // initializing for a SelfTest(FULL_TEST), allow all the modes.
                    if(toTest == &g_toTest)
                        CLEAR_BIT(alg, *toTest);
                break;
#if     !ALG_HMAC
#   error   HMAC is required in all TPM implementations
#endif
            case TPM_ALG_HMAC:
                // Clear the bit that indicates that HMAC is required because
                // HMAC is used as the basic test for all hash algorithms.
                CLEAR_BOTH(alg);
                // Testing HMAC means test the default hash
                if(doTest)
                    TestHash(DEFAULT_TEST_HASH, toTest);
                else
                    // If not testing, then indicate that the hash needs to be
                    // tested because this uses HMAC
                    SET_BOTH(DEFAULT_TEST_HASH);
                break;
// Have to use two arguments for the macro even though only the first is used in the
// expansion.
#define HASH_CASE_TEST(HASH, hash)                                                   \
            case ALG_##HASH##_VALUE:
                FOR_EACH_HASH(HASH_CASE_TEST)
#undef HASH_CASE_TEST
                if(doTest)
                    result = TestHash(alg, toTest);
                break;
    // RSA-dependent
#if ALG_RSA
            case TPM_ALG_RSA:
                CLEAR_BOTH(alg);
                if(doTest)
                    result = TestRsa(TPM_ALG_NULL, toTest);
                else
                    SET_BOTH(TPM_ALG_NULL);
                break;
            case TPM_ALG_RSASSA:
            case TPM_ALG_RSAES:
            case TPM_ALG_RSAPSS:
            case TPM_ALG_OAEP:
            case TPM_ALG_NULL:    // used or RSADP
                if(doTest)
                    result = TestRsa(alg, toTest);
                break;
#endif // ALG_RSA
#if ALG_KDF1_SP800_108
            case TPM_ALG_KDF1_SP800_108:
                if(doTest)
                    result = TestKDFa(toTest);
                break;
#endif // ALG_KDF1_SP800_108
#if ALG_ECC
    // ECC dependent but no tests
    //        case TPM_ALG_ECDAA:
    //        case TPM_ALG_ECMQV:
    //        case TPM_ALG_KDF1_SP800_56a:
    //        case TPM_ALG_KDF2:
    //        case TPM_ALG_MGF1:
            case TPM_ALG_ECC:
                CLEAR_BOTH(alg);
                if(doTest)
                    result = TestEcc(TPM_ALG_ECDH, toTest);
                else
                    SET_BOTH(TPM_ALG_ECDH);
                break;
            case TPM_ALG_ECDSA:
            case TPM_ALG_ECDH:
            case TPM_ALG_ECSCHNORR:
//            case TPM_ALG_SM2:
                if(doTest)
                    result = TestEcc(alg, toTest);
                break;
#endif // ALG_ECC
            default:
                CLEAR_BIT(alg, *toTest);
                break;
        }
        if(result != TPM_RC_SUCCESS)
            break;
    }
    return result;
}

#endif // SELF_TESTS