/* * Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ /* We need to use some deprecated APIs */ #define OPENSSL_SUPPRESS_DEPRECATED #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "testutil.h" #include "internal/nelem.h" #include "internal/sizes.h" #include "crypto/evp.h" #include "fake_rsaprov.h" #include "fake_pipelineprov.h" #ifndef OPENSSL_NO_DSA #include "helpers/predefined_dsaparams.h" #endif #ifndef OPENSSL_NO_DH #include "helpers/predefined_dhparams.h" #endif #ifdef STATIC_LEGACY OSSL_provider_init_fn ossl_legacy_provider_init; #endif static OSSL_LIB_CTX *testctx = NULL; static char *testpropq = NULL; static OSSL_PROVIDER *nullprov = NULL; static OSSL_PROVIDER *deflprov = NULL; static OSSL_PROVIDER *lgcyprov = NULL; /* * kExampleRSAKeyDER is an RSA private key in ASN.1, DER format. Of course, you * should never use this key anywhere but in an example. */ static const unsigned char kExampleRSAKeyDER[] = { 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf }; /* An invalid key whose prime factors exceed modulus n. */ static const unsigned char kInvalidRSAKeyDER[] = { 0x30, 0x80, 0x02, 0x00, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80, 0x02, 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9, 0x02, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x5d, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x02, 0x02, 0xb6, 0x00, 0x02, 0x02, 0x04, 0x80, 0x02, 0x00, 0x02, 0x82, 0x08, 0x01, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01, 0x04, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x29, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x0f, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0xe6, 0x15, 0x15, 0x15, 0x15, 0xff, 0x03, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x55, 0x15, 0x15, 0x15, 0x15, 0x11, 0x05, 0x15, 0x15, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0xf9, 0xf8, 0xf9, 0x02, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x6d, 0x61, 0x78, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x51, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0xa5, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x5d, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x01, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x22, 0x00, 0x15, 0x15, 0x15, 0xeb, 0xea, 0xea, 0xea, 0xea, 0xea, 0xea, 0xf1, 0x15, 0x15, 0x15, 0x15, 0x15, 0x40, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x15, 0x30, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x06, 0xce, 0x15, 0x00, 0xfe, 0xf7, 0x52, 0x53, 0x41, 0x31, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0x2b, 0x31, 0xff, 0x44, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xd9, 0xd9, 0xbf, 0x02, 0x01, 0xc8, 0x02, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x88, 0x88, 0x88, 0xee, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x29, 0x07, 0x07, 0x07, 0x4d, 0x00, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x14, 0x15, 0x15, 0xec, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x15, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x15, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x59, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x59, 0x59, 0x59, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc1, 0x3d, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x42, 0xa5, 0x02, 0x02, 0x42, 0x02, 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0xe8, 0x02, 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x21, 0x2b, 0x02, 0x02, 0x02, 0x02, 0x02, 0x21, 0x02, 0x02, 0x32, 0x80, 0x02, 0x02, 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02, 0x02, 0x02, 0x42, 0x02, 0x12, 0x02, 0x42, 0x02, 0x79, 0x70, 0x65, 0x36, 0x28, 0xc8, 0x02, 0x01, 0x81, 0x08, 0xfe, 0x00, 0xf9, 0x02, 0x42, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0xa5, 0x02, 0x02, 0x42, 0x02, 0x02, 0x51, 0x01, 0x02, 0x02, 0xd2, 0x42, 0x02, 0x02, 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x21, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x32, 0x80, 0x02, 0x02, 0x7f, 0x1b, 0x02, 0x00, 0x1f, 0x04, 0xff, 0x80, 0x02, 0x02, 0x02, 0x02, 0x42, 0x02, 0x12, 0x02, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x47, 0x4f, 0x53, 0x54, 0x20, 0x52, 0x20, 0x33, 0x34, 0x2e, 0x31, 0x31, 0x2d, 0x32, 0x30, 0x31, 0x32, 0x20, 0x77, 0x69, 0x74, 0x68, 0x30, 0x80, 0x60, 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d, 0x31, 0x32, 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a, 0x5b, 0xff, 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x00, 0x00, 0x30, 0x80, 0x60, 0x02, 0x82, 0x24, 0x02, 0x02, 0x41, 0x52, 0x49, 0x41, 0x2d, 0x31, 0x32, 0x38, 0x2d, 0x43, 0x46, 0x42, 0x38, 0xff, 0xff, 0xff, 0x3a, 0x5b, 0xff, 0xff, 0x7f, 0x49, 0x74, 0x84, 0x00, 0x00, 0x70, 0x65, 0x33, 0x28, 0xc8, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x15, 0x55, 0x15, 0x15, 0x15, 0x15, 0x15, 0x05, 0x15, 0x95, 0x15, 0x07, 0x07, 0x07, 0x07, 0x07, 0x00, 0x00, 0x00, 0x4d, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x0b, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x15, 0x15, 0x15, 0x15, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x25, 0x02, 0x02, 0x22, 0x3a, 0x02, 0x02, 0x02, 0x42, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xe2, 0x80 }; /* * kExampleDSAKeyDER is a DSA private key in ASN.1, DER format. Of course, you * should never use this key anywhere but in an example. */ #ifndef OPENSSL_NO_DSA static const unsigned char kExampleDSAKeyDER[] = { 0x30, 0x82, 0x01, 0xba, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0x9a, 0x05, 0x6d, 0x33, 0xcd, 0x5d, 0x78, 0xa1, 0xbb, 0xcb, 0x7d, 0x5b, 0x8d, 0xb4, 0xcc, 0xbf, 0x03, 0x99, 0x64, 0xde, 0x38, 0x78, 0x06, 0x15, 0x2f, 0x86, 0x26, 0x77, 0xf3, 0xb1, 0x85, 0x00, 0xed, 0xfc, 0x28, 0x3a, 0x42, 0x4d, 0xab, 0xab, 0xdf, 0xbc, 0x9c, 0x16, 0xd0, 0x22, 0x50, 0xd1, 0x38, 0xdd, 0x3f, 0x64, 0x05, 0x9e, 0x68, 0x7a, 0x1e, 0xf1, 0x56, 0xbf, 0x1e, 0x2c, 0xc5, 0x97, 0x2a, 0xfe, 0x7a, 0x22, 0xdc, 0x6c, 0x68, 0xb8, 0x2e, 0x06, 0xdb, 0x41, 0xca, 0x98, 0xd8, 0x54, 0xc7, 0x64, 0x48, 0x24, 0x04, 0x20, 0xbc, 0x59, 0xe3, 0x6b, 0xea, 0x7e, 0xfc, 0x7e, 0xc5, 0x4e, 0xd4, 0xd8, 0x3a, 0xed, 0xcd, 0x5d, 0x99, 0xb8, 0x5c, 0xa2, 0x8b, 0xbb, 0x0b, 0xac, 0xe6, 0x8e, 0x25, 0x56, 0x22, 0x3a, 0x2d, 0x3a, 0x56, 0x41, 0x14, 0x1f, 0x1c, 0x8f, 0x53, 0x46, 0x13, 0x85, 0x02, 0x15, 0x00, 0x98, 0x7e, 0x92, 0x81, 0x88, 0xc7, 0x3f, 0x70, 0x49, 0x54, 0xf6, 0x76, 0xb4, 0xa3, 0x9e, 0x1d, 0x45, 0x98, 0x32, 0x7f, 0x02, 0x81, 0x80, 0x69, 0x4d, 0xef, 0x55, 0xff, 0x4d, 0x59, 0x2c, 0x01, 0xfa, 0x6a, 0x38, 0xe0, 0x70, 0x9f, 0x9e, 0x66, 0x8e, 0x3e, 0x8c, 0x52, 0x22, 0x9d, 0x15, 0x7e, 0x3c, 0xef, 0x4c, 0x7a, 0x61, 0x26, 0xe0, 0x2b, 0x81, 0x3f, 0xeb, 0xaf, 0x35, 0x38, 0x8d, 0xfe, 0xed, 0x46, 0xff, 0x5f, 0x03, 0x9b, 0x81, 0x92, 0xe7, 0x6f, 0x76, 0x4f, 0x1d, 0xd9, 0xbb, 0x89, 0xc9, 0x3e, 0xd9, 0x0b, 0xf9, 0xf4, 0x78, 0x11, 0x59, 0xc0, 0x1d, 0xcd, 0x0e, 0xa1, 0x6f, 0x15, 0xf1, 0x4d, 0xc1, 0xc9, 0x22, 0xed, 0x8d, 0xad, 0x67, 0xc5, 0x4b, 0x95, 0x93, 0x86, 0xa6, 0xaf, 0x8a, 0xee, 0x06, 0x89, 0x2f, 0x37, 0x7e, 0x64, 0xaa, 0xf6, 0xe7, 0xb1, 0x5a, 0x0a, 0x93, 0x95, 0x5d, 0x3e, 0x53, 0x9a, 0xde, 0x8a, 0xc2, 0x95, 0x45, 0x81, 0xbe, 0x5c, 0x2f, 0xc2, 0xb2, 0x92, 0x58, 0x19, 0x72, 0x80, 0xe9, 0x79, 0xa1, 0x02, 0x81, 0x80, 0x07, 0xd7, 0x62, 0xff, 0xdf, 0x1a, 0x3f, 0xed, 0x32, 0xd4, 0xd4, 0x88, 0x7b, 0x2c, 0x63, 0x7f, 0x97, 0xdc, 0x44, 0xd4, 0x84, 0xa2, 0xdd, 0x17, 0x16, 0x85, 0x13, 0xe0, 0xac, 0x51, 0x8d, 0x29, 0x1b, 0x75, 0x9a, 0xe4, 0xe3, 0x8a, 0x92, 0x69, 0x09, 0x03, 0xc5, 0x68, 0xae, 0x5e, 0x94, 0xfe, 0xc9, 0x92, 0x6c, 0x07, 0xb4, 0x1e, 0x64, 0x62, 0x87, 0xc6, 0xa4, 0xfd, 0x0d, 0x5f, 0xe5, 0xf9, 0x1b, 0x4f, 0x85, 0x5f, 0xae, 0xf3, 0x11, 0xe5, 0x18, 0xd4, 0x4d, 0x79, 0x9f, 0xc4, 0x79, 0x26, 0x04, 0x27, 0xf0, 0x0b, 0xee, 0x2b, 0x86, 0x9f, 0x86, 0x61, 0xe6, 0x51, 0xce, 0x04, 0x9b, 0x5d, 0x6b, 0x34, 0x43, 0x8c, 0x85, 0x3c, 0xf1, 0x51, 0x9b, 0x08, 0x23, 0x1b, 0xf5, 0x7e, 0x33, 0x12, 0xea, 0xab, 0x1f, 0xb7, 0x2d, 0xe2, 0x5f, 0xe6, 0x97, 0x99, 0xb5, 0x45, 0x16, 0x5b, 0xc3, 0x41, 0x02, 0x14, 0x61, 0xbf, 0x51, 0x60, 0xcf, 0xc8, 0xf1, 0x8c, 0x82, 0x97, 0xf2, 0xf4, 0x19, 0xba, 0x2b, 0xf3, 0x16, 0xbe, 0x40, 0x48 }; #endif /* * kExampleBadRSAKeyDER is an RSA private key in ASN.1, DER format. The private * components are not correct. */ static const unsigned char kExampleBadRSAKeyDER[] = { 0x30, 0x82, 0x04, 0x27, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa6, 0x1a, 0x1e, 0x6e, 0x7b, 0xee, 0xc6, 0x89, 0x66, 0xe7, 0x93, 0xef, 0x54, 0x12, 0x68, 0xea, 0xbf, 0x86, 0x2f, 0xdd, 0xd2, 0x79, 0xb8, 0xa9, 0x6e, 0x03, 0xc2, 0xa3, 0xb9, 0xa3, 0xe1, 0x4b, 0x2a, 0xb3, 0xf8, 0xb4, 0xcd, 0xea, 0xbe, 0x24, 0xa6, 0x57, 0x5b, 0x83, 0x1f, 0x0f, 0xf2, 0xd3, 0xb7, 0xac, 0x7e, 0xd6, 0x8e, 0x6e, 0x1e, 0xbf, 0xb8, 0x73, 0x8c, 0x05, 0x56, 0xe6, 0x35, 0x1f, 0xe9, 0x04, 0x0b, 0x09, 0x86, 0x7d, 0xf1, 0x26, 0x08, 0x99, 0xad, 0x7b, 0xc8, 0x4d, 0x94, 0xb0, 0x0b, 0x8b, 0x38, 0xa0, 0x5c, 0x62, 0xa0, 0xab, 0xd3, 0x8f, 0xd4, 0x09, 0x60, 0x72, 0x1e, 0x33, 0x50, 0x80, 0x6e, 0x22, 0xa6, 0x77, 0x57, 0x6b, 0x9a, 0x33, 0x21, 0x66, 0x87, 0x6e, 0x21, 0x7b, 0xc7, 0x24, 0x0e, 0xd8, 0x13, 0xdf, 0x83, 0xde, 0xcd, 0x40, 0x58, 0x1d, 0x84, 0x86, 0xeb, 0xb8, 0x12, 0x4e, 0xd2, 0xfa, 0x80, 0x1f, 0xe4, 0xe7, 0x96, 0x29, 0xb8, 0xcc, 0xce, 0x66, 0x6d, 0x53, 0xca, 0xb9, 0x5a, 0xd7, 0xf6, 0x84, 0x6c, 0x2d, 0x9a, 0x1a, 0x14, 0x1c, 0x4e, 0x93, 0x39, 0xba, 0x74, 0xed, 0xed, 0x87, 0x87, 0x5e, 0x48, 0x75, 0x36, 0xf0, 0xbc, 0x34, 0xfb, 0x29, 0xf9, 0x9f, 0x96, 0x5b, 0x0b, 0xa7, 0x54, 0x30, 0x51, 0x29, 0x18, 0x5b, 0x7d, 0xac, 0x0f, 0xd6, 0x5f, 0x7c, 0xf8, 0x98, 0x8c, 0xd8, 0x86, 0x62, 0xb3, 0xdc, 0xff, 0x0f, 0xff, 0x7a, 0xaf, 0x5c, 0x4c, 0x61, 0x49, 0x2e, 0xc8, 0x95, 0x86, 0xc4, 0x0e, 0x87, 0xfc, 0x1d, 0xcf, 0x8b, 0x7c, 0x61, 0xf6, 0xd8, 0xd0, 0x69, 0xf6, 0xcd, 0x8a, 0x8c, 0xf6, 0x62, 0xa2, 0x56, 0xa9, 0xe3, 0xd1, 0xcf, 0x4d, 0xa0, 0xf6, 0x2d, 0x20, 0x0a, 0x04, 0xb7, 0xa2, 0xf7, 0xb5, 0x99, 0x47, 0x18, 0x56, 0x85, 0x87, 0xc7, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x82, 0x01, 0x01, 0x00, 0x99, 0x41, 0x38, 0x1a, 0xd0, 0x96, 0x7a, 0xf0, 0x83, 0xd5, 0xdf, 0x94, 0xce, 0x89, 0x3d, 0xec, 0x7a, 0x52, 0x21, 0x10, 0x16, 0x06, 0xe0, 0xee, 0xd2, 0xe6, 0xfd, 0x4b, 0x7b, 0x19, 0x4d, 0xe1, 0xc0, 0xc0, 0xd5, 0x14, 0x5d, 0x79, 0xdd, 0x7e, 0x8b, 0x4b, 0xc6, 0xcf, 0xb0, 0x75, 0x52, 0xa3, 0x2d, 0xb1, 0x26, 0x46, 0x68, 0x9c, 0x0a, 0x1a, 0xf2, 0xe1, 0x09, 0xac, 0x53, 0x85, 0x8c, 0x36, 0xa9, 0x14, 0x65, 0xea, 0xa0, 0x00, 0xcb, 0xe3, 0x3f, 0xc4, 0x2b, 0x61, 0x2e, 0x6b, 0x06, 0x69, 0x77, 0xfd, 0x38, 0x7e, 0x1d, 0x3f, 0x92, 0xe7, 0x77, 0x08, 0x19, 0xa7, 0x9d, 0x29, 0x2d, 0xdc, 0x42, 0xc6, 0x7c, 0xd7, 0xd3, 0xa8, 0x01, 0x2c, 0xf2, 0xd5, 0x82, 0x57, 0xcb, 0x55, 0x3d, 0xe7, 0xaa, 0xd2, 0x06, 0x30, 0x30, 0x05, 0xe6, 0xf2, 0x47, 0x86, 0xba, 0xc6, 0x61, 0x64, 0xeb, 0x4f, 0x2a, 0x5e, 0x07, 0x29, 0xe0, 0x96, 0xb2, 0x43, 0xff, 0x5f, 0x1a, 0x54, 0x16, 0xcf, 0xb5, 0x56, 0x5c, 0xa0, 0x9b, 0x0c, 0xfd, 0xb3, 0xd2, 0xe3, 0x79, 0x1d, 0x21, 0xe2, 0xd6, 0x13, 0xc4, 0x74, 0xa6, 0xf5, 0x8e, 0x8e, 0x81, 0xbb, 0xb4, 0xad, 0x8a, 0xf0, 0x93, 0x0a, 0xd8, 0x0a, 0x42, 0x36, 0xbc, 0xe5, 0x26, 0x2a, 0x0d, 0x5d, 0x57, 0x13, 0xc5, 0x4e, 0x2f, 0x12, 0x0e, 0xef, 0xa7, 0x81, 0x1e, 0xc3, 0xa5, 0xdb, 0xc9, 0x24, 0xeb, 0x1a, 0xa1, 0xf9, 0xf6, 0xa1, 0x78, 0x98, 0x93, 0x77, 0x42, 0x45, 0x03, 0xe2, 0xc9, 0xa2, 0xfe, 0x2d, 0x77, 0xc8, 0xc6, 0xac, 0x9b, 0x98, 0x89, 0x6d, 0x9a, 0xe7, 0x61, 0x63, 0xb7, 0xf2, 0xec, 0xd6, 0xb1, 0xa1, 0x6e, 0x0a, 0x1a, 0xff, 0xfd, 0x43, 0x28, 0xc3, 0x0c, 0xdc, 0xf2, 0x47, 0x4f, 0x27, 0xaa, 0x99, 0x04, 0x8e, 0xac, 0xe8, 0x7c, 0x01, 0x02, 0x04, 0x12, 0x34, 0x56, 0x78, 0x02, 0x81, 0x81, 0x00, 0xca, 0x69, 0xe5, 0xbb, 0x3a, 0x90, 0x82, 0xcb, 0x82, 0x50, 0x2f, 0x29, 0xe2, 0x76, 0x6a, 0x57, 0x55, 0x45, 0x4e, 0x35, 0x18, 0x61, 0xe0, 0x12, 0x70, 0xc0, 0xab, 0xc7, 0x80, 0xa2, 0xd4, 0x46, 0x34, 0x03, 0xa0, 0x19, 0x26, 0x23, 0x9e, 0xef, 0x1a, 0xcb, 0x75, 0xd6, 0xba, 0x81, 0xf4, 0x7e, 0x52, 0xe5, 0x2a, 0xe8, 0xf1, 0x49, 0x6c, 0x0f, 0x1a, 0xa0, 0xf9, 0xc6, 0xe7, 0xec, 0x60, 0xe4, 0xcb, 0x2a, 0xb5, 0x56, 0xe9, 0x9c, 0xcd, 0x19, 0x75, 0x92, 0xb1, 0x66, 0xce, 0xc3, 0xd9, 0x3d, 0x11, 0xcb, 0xc4, 0x09, 0xce, 0x1e, 0x30, 0xba, 0x2f, 0x60, 0x60, 0x55, 0x8d, 0x02, 0xdc, 0x5d, 0xaf, 0xf7, 0x52, 0x31, 0x17, 0x07, 0x53, 0x20, 0x33, 0xad, 0x8c, 0xd5, 0x2f, 0x5a, 0xd0, 0x57, 0xd7, 0xd1, 0x80, 0xd6, 0x3a, 0x9b, 0x04, 0x4f, 0x35, 0xbf, 0xe7, 0xd5, 0xbc, 0x8f, 0xd4, 0x81, 0x02, 0x81, 0x81, 0x00, 0xc0, 0x9f, 0xf8, 0xcd, 0xf7, 0x3f, 0x26, 0x8a, 0x3d, 0x4d, 0x2b, 0x0c, 0x01, 0xd0, 0xa2, 0xb4, 0x18, 0xfe, 0xf7, 0x5e, 0x2f, 0x06, 0x13, 0xcd, 0x63, 0xaa, 0x12, 0xa9, 0x24, 0x86, 0xe3, 0xf3, 0x7b, 0xda, 0x1a, 0x3c, 0xb1, 0x38, 0x80, 0x80, 0xef, 0x64, 0x64, 0xa1, 0x9b, 0xfe, 0x76, 0x63, 0x8e, 0x83, 0xd2, 0xd9, 0xb9, 0x86, 0xb0, 0xe6, 0xa6, 0x0c, 0x7e, 0xa8, 0x84, 0x90, 0x98, 0x0c, 0x1e, 0xf3, 0x14, 0x77, 0xe0, 0x5f, 0x81, 0x08, 0x11, 0x8f, 0xa6, 0x23, 0xc4, 0xba, 0xc0, 0x8a, 0xe4, 0xc6, 0xe3, 0x5c, 0xbe, 0xc5, 0xec, 0x2c, 0xb9, 0xd8, 0x8c, 0x4d, 0x1a, 0x9d, 0xe7, 0x7c, 0x85, 0x4c, 0x0d, 0x71, 0x4e, 0x72, 0x33, 0x1b, 0xfe, 0xa9, 0x17, 0x72, 0x76, 0x56, 0x9d, 0x74, 0x7e, 0x52, 0x67, 0x9a, 0x87, 0x9a, 0xdb, 0x30, 0xde, 0xe4, 0x49, 0x28, 0x3b, 0xd2, 0x67, 0xaf, 0x02, 0x81, 0x81, 0x00, 0x89, 0x74, 0x9a, 0x8e, 0xa7, 0xb9, 0xa5, 0x28, 0xc0, 0x68, 0xe5, 0x6e, 0x63, 0x1c, 0x99, 0x20, 0x8f, 0x86, 0x8e, 0x12, 0x9e, 0x69, 0x30, 0xfa, 0x34, 0xd9, 0x92, 0x8d, 0xdb, 0x7c, 0x37, 0xfd, 0x28, 0xab, 0x61, 0x98, 0x52, 0x7f, 0x14, 0x1a, 0x39, 0xae, 0xfb, 0x6a, 0x03, 0xa3, 0xe6, 0xbd, 0xb6, 0x5b, 0x6b, 0xe5, 0x5e, 0x9d, 0xc6, 0xa5, 0x07, 0x27, 0x54, 0x17, 0xd0, 0x3d, 0x84, 0x9b, 0x3a, 0xa0, 0xd9, 0x1e, 0x99, 0x6c, 0x63, 0x17, 0xab, 0xf1, 0x1f, 0x49, 0xba, 0x95, 0xe3, 0x3b, 0x86, 0x8f, 0x42, 0xa4, 0x89, 0xf5, 0x94, 0x8f, 0x8b, 0x46, 0xbe, 0x84, 0xba, 0x4a, 0xbc, 0x0d, 0x5f, 0x46, 0xeb, 0xe8, 0xec, 0x43, 0x8c, 0x1e, 0xad, 0x19, 0x69, 0x2f, 0x08, 0x86, 0x7a, 0x3f, 0x7d, 0x0f, 0x07, 0x97, 0xf3, 0x9a, 0x7b, 0xb5, 0xb2, 0xc1, 0x8c, 0x95, 0x68, 0x04, 0xa0, 0x81, 0x02, 0x81, 0x80, 0x4e, 0xbf, 0x7e, 0x1b, 0xcb, 0x13, 0x61, 0x75, 0x3b, 0xdb, 0x59, 0x5f, 0xb1, 0xd4, 0xb8, 0xeb, 0x9e, 0x73, 0xb5, 0xe7, 0xf6, 0x89, 0x3d, 0x1c, 0xda, 0xf0, 0x36, 0xff, 0x35, 0xbd, 0x1e, 0x0b, 0x74, 0xe3, 0x9e, 0xf0, 0xf2, 0xf7, 0xd7, 0x82, 0xb7, 0x7b, 0x6a, 0x1b, 0x0e, 0x30, 0x4a, 0x98, 0x0e, 0xb4, 0xf9, 0x81, 0x07, 0xe4, 0x75, 0x39, 0xe9, 0x53, 0xca, 0xbb, 0x5c, 0xaa, 0x93, 0x07, 0x0e, 0xa8, 0x2f, 0xba, 0x98, 0x49, 0x30, 0xa7, 0xcc, 0x1a, 0x3c, 0x68, 0x0c, 0xe1, 0xa4, 0xb1, 0x05, 0xe6, 0xe0, 0x25, 0x78, 0x58, 0x14, 0x37, 0xf5, 0x1f, 0xe3, 0x22, 0xef, 0xa8, 0x0e, 0x22, 0xa0, 0x94, 0x3a, 0xf6, 0xc9, 0x13, 0xe6, 0x06, 0xbf, 0x7f, 0x99, 0xc6, 0xcc, 0xd8, 0xc6, 0xbe, 0xd9, 0x2e, 0x24, 0xc7, 0x69, 0x8c, 0x95, 0xba, 0xf6, 0x04, 0xb3, 0x0a, 0xf4, 0xcb, 0xf0, 0xce }; /* * kExampleBad2RSAKeyDER is an RSA private key in ASN.1, DER format. All * values are 0. */ static const unsigned char kExampleBad2RSAKeyDER[] = { 0x30, 0x1b, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00 }; static const unsigned char kMsg[] = { 1, 2, 3, 4 }; static const unsigned char kSignature[] = { 0xa5, 0xf0, 0x8a, 0x47, 0x5d, 0x3c, 0xb3, 0xcc, 0xa9, 0x79, 0xaf, 0x4d, 0x8c, 0xae, 0x4c, 0x14, 0xef, 0xc2, 0x0b, 0x34, 0x36, 0xde, 0xf4, 0x3e, 0x3d, 0xbb, 0x4a, 0x60, 0x5c, 0xc8, 0x91, 0x28, 0xda, 0xfb, 0x7e, 0x04, 0x96, 0x7e, 0x63, 0x13, 0x90, 0xce, 0xb9, 0xb4, 0x62, 0x7a, 0xfd, 0x09, 0x3d, 0xc7, 0x67, 0x78, 0x54, 0x04, 0xeb, 0x52, 0x62, 0x6e, 0x24, 0x67, 0xb4, 0x40, 0xfc, 0x57, 0x62, 0xc6, 0xf1, 0x67, 0xc1, 0x97, 0x8f, 0x6a, 0xa8, 0xae, 0x44, 0x46, 0x5e, 0xab, 0x67, 0x17, 0x53, 0x19, 0x3a, 0xda, 0x5a, 0xc8, 0x16, 0x3e, 0x86, 0xd5, 0xc5, 0x71, 0x2f, 0xfc, 0x23, 0x48, 0xd9, 0x0b, 0x13, 0xdd, 0x7b, 0x5a, 0x25, 0x79, 0xef, 0xa5, 0x7b, 0x04, 0xed, 0x44, 0xf6, 0x18, 0x55, 0xe4, 0x0a, 0xe9, 0x57, 0x79, 0x5d, 0xd7, 0x55, 0xa7, 0xab, 0x45, 0x02, 0x97, 0x60, 0x42 }; /* * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v1 * PrivateKeyInfo. */ static const unsigned char kExampleRSAKeyPKCS8[] = { 0x30, 0x82, 0x02, 0x76, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf }; /* * kExampleRSAKeyPKCS8 is kExampleRSAKeyDER encoded in a PKCS#8 v2 * PrivateKeyInfo (with an optional public key). */ static const unsigned char kExampleRSAKeyPKCS8_v2[] = { 0x30, 0x82, 0x03, 0x06, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x02, 0x60, 0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x74, 0x88, 0x64, 0x3f, 0x69, 0x45, 0x3a, 0x6d, 0xc7, 0x7f, 0xb9, 0xa3, 0xc0, 0x6e, 0xec, 0xdc, 0xd4, 0x5a, 0xb5, 0x32, 0x85, 0x5f, 0x19, 0xd4, 0xf8, 0xd4, 0x3f, 0x3c, 0xfa, 0xc2, 0xf6, 0x5f, 0xee, 0xe6, 0xba, 0x87, 0x74, 0x2e, 0xc7, 0x0c, 0xd4, 0x42, 0xb8, 0x66, 0x85, 0x9c, 0x7b, 0x24, 0x61, 0xaa, 0x16, 0x11, 0xf6, 0xb5, 0xb6, 0xa4, 0x0a, 0xc9, 0x55, 0x2e, 0x81, 0xa5, 0x47, 0x61, 0xcb, 0x25, 0x8f, 0xc2, 0x15, 0x7b, 0x0e, 0x7c, 0x36, 0x9f, 0x3a, 0xda, 0x58, 0x86, 0x1c, 0x5b, 0x83, 0x79, 0xe6, 0x2b, 0xcc, 0xe6, 0xfa, 0x2c, 0x61, 0xf2, 0x78, 0x80, 0x1b, 0xe2, 0xf3, 0x9d, 0x39, 0x2b, 0x65, 0x57, 0x91, 0x3d, 0x71, 0x99, 0x73, 0xa5, 0xc2, 0x79, 0x20, 0x8c, 0x07, 0x4f, 0xe5, 0xb4, 0x60, 0x1f, 0x99, 0xa2, 0xb1, 0x4f, 0x0c, 0xef, 0xbc, 0x59, 0x53, 0x00, 0x7d, 0xb1, 0x02, 0x41, 0x00, 0xfc, 0x7e, 0x23, 0x65, 0x70, 0xf8, 0xce, 0xd3, 0x40, 0x41, 0x80, 0x6a, 0x1d, 0x01, 0xd6, 0x01, 0xff, 0xb6, 0x1b, 0x3d, 0x3d, 0x59, 0x09, 0x33, 0x79, 0xc0, 0x4f, 0xde, 0x96, 0x27, 0x4b, 0x18, 0xc6, 0xd9, 0x78, 0xf1, 0xf4, 0x35, 0x46, 0xe9, 0x7c, 0x42, 0x7a, 0x5d, 0x9f, 0xef, 0x54, 0xb8, 0xf7, 0x9f, 0xc4, 0x33, 0x6c, 0xf3, 0x8c, 0x32, 0x46, 0x87, 0x67, 0x30, 0x7b, 0xa7, 0xac, 0xe3, 0x02, 0x41, 0x00, 0xfc, 0x2c, 0xdf, 0x0c, 0x0d, 0x88, 0xf5, 0xb1, 0x92, 0xa8, 0x93, 0x47, 0x63, 0x55, 0xf5, 0xca, 0x58, 0x43, 0xba, 0x1c, 0xe5, 0x9e, 0xb6, 0x95, 0x05, 0xcd, 0xb5, 0x82, 0xdf, 0xeb, 0x04, 0x53, 0x9d, 0xbd, 0xc2, 0x38, 0x16, 0xb3, 0x62, 0xdd, 0xa1, 0x46, 0xdb, 0x6d, 0x97, 0x93, 0x9f, 0x8a, 0xc3, 0x9b, 0x64, 0x7e, 0x42, 0xe3, 0x32, 0x57, 0x19, 0x1b, 0xd5, 0x6e, 0x85, 0xfa, 0xb8, 0x8d, 0x02, 0x41, 0x00, 0xbc, 0x3d, 0xde, 0x6d, 0xd6, 0x97, 0xe8, 0xba, 0x9e, 0x81, 0x37, 0x17, 0xe5, 0xa0, 0x64, 0xc9, 0x00, 0xb7, 0xe7, 0xfe, 0xf4, 0x29, 0xd9, 0x2e, 0x43, 0x6b, 0x19, 0x20, 0xbd, 0x99, 0x75, 0xe7, 0x76, 0xf8, 0xd3, 0xae, 0xaf, 0x7e, 0xb8, 0xeb, 0x81, 0xf4, 0x9d, 0xfe, 0x07, 0x2b, 0x0b, 0x63, 0x0b, 0x5a, 0x55, 0x90, 0x71, 0x7d, 0xf1, 0xdb, 0xd9, 0xb1, 0x41, 0x41, 0x68, 0x2f, 0x4e, 0x39, 0x02, 0x40, 0x5a, 0x34, 0x66, 0xd8, 0xf5, 0xe2, 0x7f, 0x18, 0xb5, 0x00, 0x6e, 0x26, 0x84, 0x27, 0x14, 0x93, 0xfb, 0xfc, 0xc6, 0x0f, 0x5e, 0x27, 0xe6, 0xe1, 0xe9, 0xc0, 0x8a, 0xe4, 0x34, 0xda, 0xe9, 0xa2, 0x4b, 0x73, 0xbc, 0x8c, 0xb9, 0xba, 0x13, 0x6c, 0x7a, 0x2b, 0x51, 0x84, 0xa3, 0x4a, 0xe0, 0x30, 0x10, 0x06, 0x7e, 0xed, 0x17, 0x5a, 0x14, 0x00, 0xc9, 0xef, 0x85, 0xea, 0x52, 0x2c, 0xbc, 0x65, 0x02, 0x40, 0x51, 0xe3, 0xf2, 0x83, 0x19, 0x9b, 0xc4, 0x1e, 0x2f, 0x50, 0x3d, 0xdf, 0x5a, 0xa2, 0x18, 0xca, 0x5f, 0x2e, 0x49, 0xaf, 0x6f, 0xcc, 0xfa, 0x65, 0x77, 0x94, 0xb5, 0xa1, 0x0a, 0xa9, 0xd1, 0x8a, 0x39, 0x37, 0xf4, 0x0b, 0xa0, 0xd7, 0x82, 0x27, 0x5e, 0xae, 0x17, 0x17, 0xa1, 0x1e, 0x54, 0x34, 0xbf, 0x6e, 0xc4, 0x8e, 0x99, 0x5d, 0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf, /* Implicit optional Public key BIT STRING */ 0x81, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xf8, 0xb8, 0x6c, 0x83, 0xb4, 0xbc, 0xd9, 0xa8, 0x57, 0xc0, 0xa5, 0xb4, 0x59, 0x76, 0x8c, 0x54, 0x1d, 0x79, 0xeb, 0x22, 0x52, 0x04, 0x7e, 0xd3, 0x37, 0xeb, 0x41, 0xfd, 0x83, 0xf9, 0xf0, 0xa6, 0x85, 0x15, 0x34, 0x75, 0x71, 0x5a, 0x84, 0xa8, 0x3c, 0xd2, 0xef, 0x5a, 0x4e, 0xd3, 0xde, 0x97, 0x8a, 0xdd, 0xff, 0xbb, 0xcf, 0x0a, 0xaa, 0x86, 0x92, 0xbe, 0xb8, 0x50, 0xe4, 0xcd, 0x6f, 0x80, 0x33, 0x30, 0x76, 0x13, 0x8f, 0xca, 0x7b, 0xdc, 0xec, 0x5a, 0xca, 0x63, 0xc7, 0x03, 0x25, 0xef, 0xa8, 0x8a, 0x83, 0x58, 0x76, 0x20, 0xfa, 0x16, 0x77, 0xd7, 0x79, 0x92, 0x63, 0x01, 0x48, 0x1a, 0xd8, 0x7b, 0x67, 0xf1, 0x52, 0x55, 0x49, 0x4e, 0xd6, 0x6e, 0x4a, 0x5c, 0xd7, 0x7a, 0x37, 0x36, 0x0c, 0xde, 0xdd, 0x8f, 0x44, 0xe8, 0xc2, 0xa7, 0x2c, 0x2b, 0xb5, 0xaf, 0x64, 0x4b, 0x61, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01 }; #ifndef OPENSSL_NO_EC /* * kExampleECKeyDER is a sample EC private key encoded as an ECPrivateKey * structure. */ static const unsigned char kExampleECKeyDER[] = { 0x30, 0x77, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa0, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1 }; static const unsigned char kExampleECKeyPKCS8_v2[] = { 0x30, 0x81, 0xcb, 0x02, 0x01, 0x01, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x6d, 0x30, 0x6b, 0x02, 0x01, 0x01, 0x04, 0x20, 0x07, 0x0f, 0x08, 0x72, 0x7a, 0xd4, 0xa0, 0x4a, 0x9c, 0xdd, 0x59, 0xc9, 0x4d, 0x89, 0x68, 0x77, 0x08, 0xb5, 0x6f, 0xc9, 0x5d, 0x30, 0x77, 0x0e, 0xe8, 0xd1, 0xc9, 0xce, 0x0a, 0x8b, 0xb4, 0x6a, 0xa1, 0x44, 0x03, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1, /* Optional implicit public key BIT STRING */ 0x81, 0x42, 0x00, 0x04, 0xe6, 0x2b, 0x69, 0xe2, 0xbf, 0x65, 0x9f, 0x97, 0xbe, 0x2f, 0x1e, 0x0d, 0x94, 0x8a, 0x4c, 0xd5, 0x97, 0x6b, 0xb7, 0xa9, 0x1e, 0x0d, 0x46, 0xfb, 0xdd, 0xa9, 0xa9, 0x1e, 0x9d, 0xdc, 0xba, 0x5a, 0x01, 0xe7, 0xd6, 0x97, 0xa8, 0x0a, 0x18, 0xf9, 0xc3, 0xc4, 0xa3, 0x1e, 0x56, 0xe2, 0x7c, 0x83, 0x48, 0xdb, 0x16, 0x1a, 0x1c, 0xf5, 0x1d, 0x7e, 0xf1, 0x94, 0x2d, 0x4b, 0xcf, 0x72, 0x22, 0xc1 }; /* * kExampleBadECKeyDER is a sample EC private key encoded as an ECPrivateKey * structure. The private key is equal to the order and will fail to import */ static const unsigned char kExampleBadECKeyDER[] = { 0x30, 0x66, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x04, 0x4C, 0x30, 0x4A, 0x02, 0x01, 0x01, 0x04, 0x20, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51, 0xA1, 0x23, 0x03, 0x21, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51 }; /* prime256v1 */ static const unsigned char kExampleECPubKeyDER[] = { 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53, 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8, 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7, 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b, 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20, 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5 }; /* * kExampleBadECPubKeyDER is a sample EC public key with a wrong OID * 1.2.840.10045.2.2 instead of 1.2.840.10045.2.1 - EC Public Key */ static const unsigned char kExampleBadECPubKeyDER[] = { 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x02, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xba, 0xeb, 0x83, 0xfb, 0x3b, 0xb2, 0xff, 0x30, 0x53, 0xdb, 0xce, 0x32, 0xf2, 0xac, 0xae, 0x44, 0x0d, 0x3d, 0x13, 0x53, 0xb8, 0xd1, 0x68, 0x55, 0xde, 0x44, 0x46, 0x05, 0xa6, 0xc9, 0xd2, 0x04, 0xb7, 0xe3, 0xa2, 0x96, 0xc8, 0xb2, 0x5e, 0x22, 0x03, 0xd7, 0x03, 0x7a, 0x8b, 0x13, 0x5c, 0x42, 0x49, 0xc2, 0xab, 0x86, 0xd6, 0xac, 0x6b, 0x93, 0x20, 0x56, 0x6a, 0xc6, 0xc8, 0xa5, 0x0b, 0xe5 }; static const unsigned char pExampleECParamDER[] = { 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 }; #ifndef OPENSSL_NO_ECX static const unsigned char kExampleED25519KeyDER[] = { 0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20, 0xba, 0x7b, 0xba, 0x20, 0x1b, 0x02, 0x75, 0x3a, 0xe8, 0x88, 0xfe, 0x00, 0xcd, 0x8b, 0xc6, 0xf4, 0x5c, 0x47, 0x09, 0x46, 0x66, 0xe4, 0x72, 0x85, 0x25, 0x26, 0x5e, 0x12, 0x33, 0x48, 0xf6, 0x50 }; static const unsigned char kExampleED25519PubKeyDER[] = { 0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00, 0xf5, 0xc5, 0xeb, 0x52, 0x3e, 0x7d, 0x07, 0x86, 0xb2, 0x55, 0x07, 0x45, 0xef, 0x5b, 0x7c, 0x20, 0xe8, 0x66, 0x28, 0x30, 0x3c, 0x8a, 0x82, 0x40, 0x97, 0xa3, 0x08, 0xdc, 0x65, 0x80, 0x39, 0x29 }; #endif #endif #ifndef OPENSSL_NO_ML_KEM /* * openssl genpkey -provparam ml-kem.output_formats=seed-only \ * -algorithm ml-kem-512 -outform DER | * xxd -i */ static const unsigned char kMLKEMSeedOnlyDER[] = { 0x30, 0x54, 0x02, 0x01, 0x00, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x04, 0x01, 0x04, 0x42, 0x80, 0x40, 0x21, 0xe4, 0x30, 0x56, 0x08, 0x64, 0xd3, 0xd4, 0x37, 0x33, 0x1c, 0xe5, 0xc9, 0xd8, 0x26, 0x10, 0x9b, 0x4d, 0x58, 0xb4, 0xe2, 0x57, 0x70, 0x0f, 0x28, 0xe2, 0xd2, 0xa8, 0x6b, 0xb6, 0x2b, 0x85, 0x1b, 0x25, 0x39, 0x29, 0xca, 0x6d, 0x9a, 0xf0, 0x11, 0x5d, 0xca, 0xf4, 0xf7, 0x9a, 0x50, 0x39, 0xa7, 0x52, 0x39, 0x5d, 0x84, 0xa9, 0xb9, 0x84, 0x4c, 0xa2, 0xe5, 0x49, 0xd7, 0x81, 0xd1, 0x6d }; #endif #ifndef OPENSSL_NO_ML_DSA /* * openssl genpkey -provparam ml-dsa.output_formats=seed-only \ * -algorithm ml-dsa-44 -outform DER | * xxd -i */ static const unsigned char kMLDSASeedOnlyDER[] = { 0x30, 0x34, 0x02, 0x01, 0x00, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x11, 0x04, 0x22, 0x80, 0x20, 0xc5, 0xbb, 0x12, 0x9c, 0x76, 0xac, 0x6f, 0x03, 0x6c, 0x56, 0x32, 0xf4, 0x66, 0xb8, 0x8c, 0x77, 0x4b, 0xe0, 0xaa, 0x4a, 0xd6, 0xa0, 0x96, 0x12, 0xc3, 0x8c, 0xe7, 0x71, 0xbe, 0xf8, 0xba, 0xbe }; #endif static const unsigned char kCFBDefaultKey[] = { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }; static const unsigned char kGCMDefaultKey[32] = { 0 }; static const unsigned char kGCMResetKey[] = { 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08, 0xfe, 0xff, 0xe9, 0x92, 0x86, 0x65, 0x73, 0x1c, 0x6d, 0x6a, 0x8f, 0x94, 0x67, 0x30, 0x83, 0x08 }; static const unsigned char iCFBIV[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F }; static const unsigned char iGCMDefaultIV[12] = { 0 }; static const unsigned char iGCMResetIV1[] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad }; static const unsigned char iGCMResetIV2[] = { 0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8, 0x88 }; static const unsigned char cfbPlaintext[] = { 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A }; static const unsigned char cfbPlaintext_partial[] = { 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96 }; static const unsigned char gcmDefaultPlaintext[16] = { 0 }; static const unsigned char gcmResetPlaintext[] = { 0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09, 0xc5, 0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda, 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c, 0x3c, 0x0c, 0x95, 0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25, 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57, 0xba, 0x63, 0x7b, 0x39 }; static const unsigned char cfbCiphertext[] = { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A }; static const unsigned char cfbCiphertext_partial[] = { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 0x0D, 0x4A, 0x71, 0x82, 0x90, 0xF0, 0x9A, 0x35 }; static const unsigned char ofbCiphertext_partial[] = { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 0xB2, 0x65, 0x64, 0x38, 0x26, 0xD2, 0xBC, 0x09 }; static const unsigned char gcmDefaultCiphertext[] = { 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e, 0x07, 0x4e, 0xc5, 0xd3, 0xba, 0xf3, 0x9d, 0x18 }; static const unsigned char gcmResetCiphertext1[] = { 0xc3, 0x76, 0x2d, 0xf1, 0xca, 0x78, 0x7d, 0x32, 0xae, 0x47, 0xc1, 0x3b, 0xf1, 0x98, 0x44, 0xcb, 0xaf, 0x1a, 0xe1, 0x4d, 0x0b, 0x97, 0x6a, 0xfa, 0xc5, 0x2f, 0xf7, 0xd7, 0x9b, 0xba, 0x9d, 0xe0, 0xfe, 0xb5, 0x82, 0xd3, 0x39, 0x34, 0xa4, 0xf0, 0x95, 0x4c, 0xc2, 0x36, 0x3b, 0xc7, 0x3f, 0x78, 0x62, 0xac, 0x43, 0x0e, 0x64, 0xab, 0xe4, 0x99, 0xf4, 0x7c, 0x9b, 0x1f }; static const unsigned char gcmResetCiphertext2[] = { 0x52, 0x2d, 0xc1, 0xf0, 0x99, 0x56, 0x7d, 0x07, 0xf4, 0x7f, 0x37, 0xa3, 0x2a, 0x84, 0x42, 0x7d, 0x64, 0x3a, 0x8c, 0xdc, 0xbf, 0xe5, 0xc0, 0xc9, 0x75, 0x98, 0xa2, 0xbd, 0x25, 0x55, 0xd1, 0xaa, 0x8c, 0xb0, 0x8e, 0x48, 0x59, 0x0d, 0xbb, 0x3d, 0xa7, 0xb0, 0x8b, 0x10, 0x56, 0x82, 0x88, 0x38, 0xc5, 0xf6, 0x1e, 0x63, 0x93, 0xba, 0x7a, 0x0a, 0xbc, 0xc9, 0xf6, 0x62 }; static const unsigned char gcmAAD[] = { 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe, 0xef, 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe, 0xef, 0xab, 0xad, 0xda, 0xd2 }; static const unsigned char gcmDefaultTag[] = { 0xd0, 0xd1, 0xc8, 0xa7, 0x99, 0x99, 0x6b, 0xf0, 0x26, 0x5b, 0x98, 0xb5, 0xd4, 0x8a, 0xb9, 0x19 }; static const unsigned char gcmResetTag1[] = { 0x3a, 0x33, 0x7d, 0xbf, 0x46, 0xa7, 0x92, 0xc4, 0x5e, 0x45, 0x49, 0x13, 0xfe, 0x2e, 0xa8, 0xf2 }; static const unsigned char gcmResetTag2[] = { 0x76, 0xfc, 0x6e, 0xce, 0x0f, 0x4e, 0x17, 0x68, 0xcd, 0xdf, 0x88, 0x53, 0xbb, 0x2d, 0x55, 0x1b }; typedef struct APK_DATA_st { const unsigned char *kder; size_t size; const char *keytype; int evptype; int check; int pub_check; int param_check; int type; /* 0 for private, 1 for public, 2 for params */ } APK_DATA; static APK_DATA keydata[] = { { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA }, { kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8), "RSA", EVP_PKEY_RSA }, #ifndef OPENSSL_NO_EC { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC } #endif }; static APK_DATA keydata_v2[] = { { kExampleRSAKeyPKCS8_v2, sizeof(kExampleRSAKeyPKCS8_v2), "RSA", EVP_PKEY_RSA }, #ifndef OPENSSL_NO_EC { kExampleECKeyPKCS8_v2, sizeof(kExampleECKeyPKCS8_v2), "EC", EVP_PKEY_EC } #endif }; static APK_DATA keycheckdata[] = { { kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER), "RSA", EVP_PKEY_RSA, 1, 1, 1, 0 }, { kExampleBadRSAKeyDER, sizeof(kExampleBadRSAKeyDER), "RSA", EVP_PKEY_RSA, 0, 1, 1, 0 }, { kExampleBad2RSAKeyDER, sizeof(kExampleBad2RSAKeyDER), "RSA", EVP_PKEY_RSA, 0, 0, 1 /* Since there are no "params" in an RSA key this passes */, 0 }, #ifndef OPENSSL_NO_EC { kExampleECKeyDER, sizeof(kExampleECKeyDER), "EC", EVP_PKEY_EC, 1, 1, 1, 0 }, /* group is also associated in our pub key */ { kExampleECPubKeyDER, sizeof(kExampleECPubKeyDER), "EC", EVP_PKEY_EC, 0, 1, 1, 1 }, { pExampleECParamDER, sizeof(pExampleECParamDER), "EC", EVP_PKEY_EC, 0, 0, 1, 2 }, #ifndef OPENSSL_NO_ECX { kExampleED25519KeyDER, sizeof(kExampleED25519KeyDER), "ED25519", EVP_PKEY_ED25519, 1, 1, 1, 0 }, { kExampleED25519PubKeyDER, sizeof(kExampleED25519PubKeyDER), "ED25519", EVP_PKEY_ED25519, 0, 1, 1, 1 }, #endif #endif }; static EVP_PKEY *load_example_key(const char *keytype, const unsigned char *data, size_t data_len) { const unsigned char **pdata = &data; EVP_PKEY *pkey = NULL; OSSL_DECODER_CTX *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, keytype, 0, testctx, testpropq); /* |pkey| will be NULL on error */ (void)OSSL_DECODER_from_data(dctx, pdata, &data_len); OSSL_DECODER_CTX_free(dctx); return pkey; } static EVP_PKEY *load_example_rsa_key(void) { return load_example_key("RSA", kExampleRSAKeyDER, sizeof(kExampleRSAKeyDER)); } #ifndef OPENSSL_NO_DSA static EVP_PKEY *load_example_dsa_key(void) { return load_example_key("DSA", kExampleDSAKeyDER, sizeof(kExampleDSAKeyDER)); } #endif #ifndef OPENSSL_NO_EC static EVP_PKEY *load_example_ec_key(void) { return load_example_key("EC", kExampleECKeyDER, sizeof(kExampleECKeyDER)); } #endif #if !defined(OPENSSL_NO_ML_KEM) || !defined(OPENSSL_NO_ML_DSA) static EVP_PKEY *load_ml_key(const char *keytype, const char *input_type, const unsigned char *data, size_t data_len) { const unsigned char **pdata = &data; EVP_PKEY *pkey = NULL; OSSL_DECODER_CTX *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, input_type, "PrivateKeyInfo", keytype, 0, testctx, testpropq); if (!TEST_ptr(dctx)) return NULL; /* Decode, but first check that the context is frozen as expected */ if (TEST_false(OSSL_DECODER_CTX_set_selection(dctx, EVP_PKEY_KEYPAIR)) && TEST_false(OSSL_DECODER_CTX_set_input_type(dctx, "DER")) && TEST_false(OSSL_DECODER_CTX_set_input_structure(dctx, "PrivateKeyInfo")) && TEST_false(OSSL_DECODER_CTX_add_extra(dctx, NULL, NULL))) { /* |pkey| will be NULL on error */ (void)OSSL_DECODER_from_data(dctx, pdata, &data_len); } OSSL_DECODER_CTX_free(dctx); return pkey; } static int store_ml_key(EVP_PKEY *pkey, const char *input_type, const char *fmts, const unsigned char *expect, size_t expectlen) { OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; OSSL_ENCODER_CTX *ectx = NULL; unsigned char *buf = NULL, *der = NULL; size_t len = 0; long derlen; int ret = 0; /* Just-in-time encoding format selection */ params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_OUTPUT_FORMATS, (char *)fmts, 0); ectx = OSSL_ENCODER_CTX_new_for_pkey(pkey, EVP_PKEY_KEYPAIR, input_type, "PrivateKeyInfo", testpropq); if (!TEST_ptr(ectx)) return 0; /* Encode, but first check that the context is frozen as expected */ if (!TEST_false(OSSL_ENCODER_CTX_set_selection(ectx, EVP_PKEY_PUBLIC_KEY)) || !TEST_false(OSSL_ENCODER_CTX_set_output_type(ectx, "PEM")) || !TEST_false(OSSL_ENCODER_CTX_set_output_structure(ectx, "PKCS8")) || !TEST_false(OSSL_ENCODER_CTX_add_extra(ectx, NULL, NULL)) || !TEST_true(OSSL_ENCODER_CTX_set_params(ectx, params)) || !TEST_true(OSSL_ENCODER_to_data(ectx, &buf, &len))) goto end; if (strcmp(input_type, "PEM") == 0) { BIO *pembio = BIO_new_mem_buf(buf, (int)len); char *name = NULL, *header = NULL; if (!TEST_ptr(pembio)) goto end; ret = PEM_read_bio(pembio, &name, &header, &der, &derlen); BIO_free(pembio); if (TEST_true(ret)) { if (!TEST_int_eq(strcmp(name, PEM_STRING_PKCS8INF), 0) || !TEST_true(header == NULL || *header == '\0')) ret = 0; OPENSSL_free(name); OPENSSL_free(header); if (!ret) goto end; } } else { der = buf; derlen = (long)len; } ret = expect != NULL ? TEST_mem_eq(der, (size_t)derlen, expect, expectlen) : TEST_size_t_eq((size_t)derlen, expectlen); end: OSSL_ENCODER_CTX_free(ectx); if (der != buf) OPENSSL_free(der); OPENSSL_free(buf); return ret; } static int test_ml_seed_only(int idx) { const char *alg; const unsigned char *seedonly; EVP_PKEY *pkey = NULL; size_t seedonlysz, privonlysz; const char *outform = (idx & 1) ? "DER" : "PEM"; int ret = 0; if (idx & 2) { #ifndef OPENSSL_NO_ML_DSA alg = "ML-DSA-44"; seedonly = kMLDSASeedOnlyDER; seedonlysz = sizeof(kMLDSASeedOnlyDER); privonlysz = 2588; #else return 0; #endif } else { #ifndef OPENSSL_NO_ML_KEM alg = "ML-KEM-512"; seedonly = kMLKEMSeedOnlyDER; seedonlysz = sizeof(kMLKEMSeedOnlyDER); privonlysz = 1660; #else return 0; #endif } pkey = load_ml_key(alg, "DER", seedonly, seedonlysz); if (!TEST_ptr(pkey)) return 0; /* * Check that the "output_formats" parameter is behaving as expected. * With "seed-only" check full payload, otherwise just the DER length. */ if (store_ml_key(pkey, outform, "seed-only", seedonly, seedonlysz) && store_ml_key(pkey, outform, "bare-seed", NULL, seedonlysz - 2) && store_ml_key(pkey, outform, "priv-only", NULL, privonlysz)) ret = 1; EVP_PKEY_free(pkey); return ret; } #endif #ifndef OPENSSL_NO_ML_KEM static int test_ml_kem_seed_only(int idx) { return test_ml_seed_only(idx); } #endif #ifndef OPENSSL_NO_ML_DSA static int test_ml_dsa_seed_only(int idx) { return test_ml_seed_only(idx + 2); } #endif static EVP_PKEY *load_example_hmac_key(void) { EVP_PKEY *pkey = NULL; unsigned char key[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; pkey = EVP_PKEY_new_raw_private_key_ex(testctx, "HMAC", NULL, key, sizeof(key)); if (!TEST_ptr(pkey)) return NULL; return pkey; } static int test_EVP_set_config_properties(void) { char *fetched_properties = NULL; const char test_propq[] = "test.fizzbuzz=buzzfizz"; int res = 0; fetched_properties = EVP_get1_default_properties(OSSL_LIB_CTX_get0_global_default()); if (!TEST_ptr(fetched_properties) || !TEST_str_eq(fetched_properties, test_propq)) goto err; OPENSSL_free(fetched_properties); fetched_properties = NULL; res = 1; err: OPENSSL_free(fetched_properties); return res; } static int test_EVP_set_default_properties(void) { OSSL_LIB_CTX *ctx; EVP_MD *md = NULL; int res = 0; char *fetched_properties = NULL; const char test_propq[] = "provider=fizzbang"; const char test_fips_propq[] = "fips=yes,provider=fizzbang"; if (!TEST_ptr(ctx = OSSL_LIB_CTX_new()) || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL))) goto err; EVP_MD_free(md); md = NULL; if (!TEST_true(EVP_set_default_properties(ctx, test_propq)) || !TEST_ptr_null(md = EVP_MD_fetch(ctx, "sha256", NULL)) || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", "-provider"))) goto err; EVP_MD_free(md); md = NULL; fetched_properties = EVP_get1_default_properties(ctx); if (!TEST_ptr(fetched_properties) || !TEST_str_eq(fetched_properties, test_propq)) goto err; OPENSSL_free(fetched_properties); fetched_properties = NULL; if (!TEST_true(EVP_default_properties_enable_fips(ctx, 1))) goto err; fetched_properties = EVP_get1_default_properties(ctx); if (!TEST_ptr(fetched_properties) || !TEST_str_eq(fetched_properties, test_fips_propq)) goto err; OPENSSL_free(fetched_properties); fetched_properties = NULL; if (!TEST_true(EVP_default_properties_enable_fips(ctx, 0))) goto err; if (!TEST_true(EVP_set_default_properties(ctx, NULL)) || !TEST_ptr(md = EVP_MD_fetch(ctx, "sha256", NULL))) goto err; res = 1; err: OPENSSL_free(fetched_properties); EVP_MD_free(md); OSSL_LIB_CTX_free(ctx); return res; } #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC) static EVP_PKEY *make_key_fromdata(char *keytype, OSSL_PARAM *params) { EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *tmp_pkey = NULL, *pkey = NULL; if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, keytype, testpropq))) goto err; /* Check that premature EVP_PKEY_CTX_set_params() fails gracefully */ if (!TEST_int_eq(EVP_PKEY_CTX_set_params(pctx, params), 0) || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &tmp_pkey, EVP_PKEY_KEYPAIR, params), 0)) goto err; if (!TEST_ptr(tmp_pkey)) goto err; pkey = tmp_pkey; tmp_pkey = NULL; err: EVP_PKEY_free(tmp_pkey); EVP_PKEY_CTX_free(pctx); return pkey; } static int test_selection(EVP_PKEY *pkey, int selection) { int testresult = 0; int ret; BIO *bio = BIO_new(BIO_s_mem()); if (!TEST_ptr(bio)) goto err; ret = PEM_write_bio_PUBKEY(bio, pkey); if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) { if (!TEST_true(ret)) goto err; } else { if (!TEST_false(ret)) goto err; } ret = PEM_write_bio_PrivateKey_ex(bio, pkey, NULL, NULL, 0, NULL, NULL, testctx, NULL); if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) { if (!TEST_true(ret)) goto err; } else { if (!TEST_false(ret)) goto err; } testresult = 1; err: BIO_free(bio); return testresult; } #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA || !OPENSSL_NO_EC */ /* * Test combinations of private, public, missing and private + public key * params to ensure they are all accepted */ #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_DSA) static int test_EVP_PKEY_ffc_priv_pub(char *keytype) { OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; EVP_PKEY *just_params = NULL; EVP_PKEY *params_and_priv = NULL; EVP_PKEY *params_and_pub = NULL; EVP_PKEY *params_and_keypair = NULL; BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL; int ret = 0; /* * Setup the parameters for our pkey object. For our purposes they don't * have to actually be *valid* parameters. We just need to set something. */ if (!TEST_ptr(p = BN_new()) || !TEST_ptr(q = BN_new()) || !TEST_ptr(g = BN_new()) || !TEST_ptr(pub = BN_new()) || !TEST_ptr(priv = BN_new())) goto err; /* Test !priv and !pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(just_params = make_key_fromdata(keytype, params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR)) goto err; /* Test priv and !pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_priv = make_key_fromdata(keytype, params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PRIVATE_KEY) || test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)) goto err; /* Test !priv and pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_pub = make_key_fromdata(keytype, params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY) || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY)) goto err; /* Test priv and pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_keypair = make_key_fromdata(keytype, params))) goto err; if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR)) goto err; ret = 1; err: OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); EVP_PKEY_free(just_params); EVP_PKEY_free(params_and_priv); EVP_PKEY_free(params_and_pub); EVP_PKEY_free(params_and_keypair); BN_free(p); BN_free(q); BN_free(g); BN_free(pub); BN_free(priv); return ret; } #endif /* !OPENSSL_NO_DH || !OPENSSL_NO_DSA */ /* * Test combinations of private, public, missing and private + public key * params to ensure they are all accepted for EC keys */ #ifndef OPENSSL_NO_EC static unsigned char ec_priv[] = { 0xe9, 0x25, 0xf7, 0x66, 0x58, 0xa4, 0xdd, 0x99, 0x61, 0xe7, 0xe8, 0x23, 0x85, 0xc2, 0xe8, 0x33, 0x27, 0xc5, 0x5c, 0xeb, 0xdb, 0x43, 0x9f, 0xd5, 0xf2, 0x5a, 0x75, 0x55, 0xd0, 0x2e, 0x6d, 0x16 }; static unsigned char ec_pub[] = { 0x04, 0xad, 0x11, 0x90, 0x77, 0x4b, 0x46, 0xee, 0x72, 0x51, 0x15, 0x97, 0x4a, 0x6a, 0xa7, 0xaf, 0x59, 0xfa, 0x4b, 0xf2, 0x41, 0xc8, 0x3a, 0x81, 0x23, 0xb6, 0x90, 0x04, 0x6c, 0x67, 0x66, 0xd0, 0xdc, 0xf2, 0x15, 0x1d, 0x41, 0x61, 0xb7, 0x95, 0x85, 0x38, 0x5a, 0x84, 0x56, 0xe8, 0xb3, 0x0e, 0xf5, 0xc6, 0x5d, 0xa4, 0x54, 0x26, 0xb0, 0xf7, 0xa5, 0x4a, 0x33, 0xf1, 0x08, 0x09, 0xb8, 0xdb, 0x03 }; static int test_EC_priv_pub(void) { OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; EVP_PKEY *just_params = NULL; EVP_PKEY *params_and_priv = NULL; EVP_PKEY *params_and_pub = NULL; EVP_PKEY *params_and_keypair = NULL; BIGNUM *priv = NULL; int ret = 0; unsigned char *encoded = NULL; size_t len = 0; unsigned char buffer[128]; /* * Setup the parameters for our pkey object. For our purposes they don't * have to actually be *valid* parameters. We just need to set something. */ if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) goto err; /* Test !priv and !pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME, "P-256", 0))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(just_params = make_key_fromdata("EC", params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; if (!test_selection(just_params, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS) || test_selection(just_params, OSSL_KEYMGMT_SELECT_KEYPAIR)) goto err; /* Test priv and !pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME, "P-256", 0)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_priv = make_key_fromdata("EC", params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; /* * ossl_ec_key_fromdata() automatically generates the public key on import * if one is not provided, so fail the test if a public key is not * available. */ if (!test_selection(params_and_priv, OSSL_KEYMGMT_SELECT_KEYPAIR)) goto err; /* Test !priv and pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME, "P-256", 0)) || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY, ec_pub, sizeof(ec_pub)))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_pub = make_key_fromdata("EC", params))) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); params = NULL; bld = NULL; if (!test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PUBLIC_KEY) || test_selection(params_and_pub, OSSL_KEYMGMT_SELECT_PRIVATE_KEY)) goto err; /* Test priv and pub */ if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME, "P-256", 0)) || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY, ec_pub, sizeof(ec_pub))) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(params_and_keypair = make_key_fromdata("EC", params))) goto err; if (!test_selection(params_and_keypair, EVP_PKEY_KEYPAIR)) goto err; /* Try key equality */ if (!TEST_int_gt(EVP_PKEY_parameters_eq(just_params, just_params), 0) || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_pub), 0) || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_priv), 0) || !TEST_int_gt(EVP_PKEY_parameters_eq(just_params, params_and_keypair), 0) || !TEST_int_gt(EVP_PKEY_eq(params_and_pub, params_and_pub), 0) || !TEST_int_gt(EVP_PKEY_eq(params_and_priv, params_and_priv), 0) || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_pub), 0) || !TEST_int_gt(EVP_PKEY_eq(params_and_keypair, params_and_priv), 0)) goto err; /* Positive and negative testcase for EVP_PKEY_get1_encoded_public_key */ if (!TEST_size_t_gt(EVP_PKEY_get1_encoded_public_key(params_and_pub, &encoded), 0)) goto err; OPENSSL_free(encoded); encoded = NULL; if (!TEST_size_t_eq(EVP_PKEY_get1_encoded_public_key(just_params, &encoded), 0)) { OPENSSL_free(encoded); encoded = NULL; goto err; } /* Positive and negative testcase for EVP_PKEY_get_octet_string_param */ if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, buffer, sizeof(buffer), &len), 1) || !TEST_size_t_eq(len, 65)) goto err; len = 0; if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, NULL, 0, &len), 1) || !TEST_size_t_eq(len, 65)) goto err; /* too-short buffer len*/ if (!TEST_int_eq(EVP_PKEY_get_octet_string_param(params_and_pub, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, buffer, 10, &len), 0)) goto err; ret = 1; err: OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); EVP_PKEY_free(just_params); EVP_PKEY_free(params_and_priv); EVP_PKEY_free(params_and_pub); EVP_PKEY_free(params_and_keypair); BN_free(priv); return ret; } /* Also test that we can read the EC PUB affine coordinates */ static int test_evp_get_ec_pub(void) { OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; unsigned char *pad = NULL; EVP_PKEY *keypair = NULL; BIGNUM *priv = NULL; BIGNUM *x = NULL; BIGNUM *y = NULL; int ret = 0; if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) goto err; if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME, "P-256", 0)) || !TEST_true(OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY, ec_pub, sizeof(ec_pub))) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(keypair = make_key_fromdata("EC", params))) goto err; if (!test_selection(keypair, EVP_PKEY_KEYPAIR)) goto err; if (!EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_X, &x) || !EVP_PKEY_get_bn_param(keypair, OSSL_PKEY_PARAM_EC_PUB_Y, &y)) goto err; if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub)))) goto err; pad[0] = ec_pub[0]; BN_bn2bin(x, &pad[1]); BN_bn2bin(y, &pad[33]); if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0)) goto err; ret = 1; err: OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); EVP_PKEY_free(keypair); OPENSSL_free(pad); BN_free(priv); BN_free(x); BN_free(y); return ret; } /* Test that using a legacy EC key with only a private key in it works */ #ifndef OPENSSL_NO_DEPRECATED_3_0 static int test_EC_priv_only_legacy(void) { BIGNUM *priv = NULL; int ret = 0; EC_KEY *eckey = NULL; EVP_PKEY *pkey = NULL, *dup_pk = NULL; EVP_MD_CTX *ctx = NULL; /* Create the low level EC_KEY */ if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) goto err; eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); if (!TEST_ptr(eckey)) goto err; if (!TEST_true(EC_KEY_set_private_key(eckey, priv))) goto err; pkey = EVP_PKEY_new(); if (!TEST_ptr(pkey)) goto err; if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey))) goto err; eckey = NULL; for (;;) { ret = 0; ctx = EVP_MD_CTX_new(); if (!TEST_ptr(ctx)) goto err; /* * The EVP_DigestSignInit function should create the key on the * provider side which is sufficient for this test. */ if (!TEST_true(EVP_DigestSignInit_ex(ctx, NULL, NULL, testctx, testpropq, pkey, NULL))) goto err; EVP_MD_CTX_free(ctx); ctx = NULL; if (dup_pk != NULL) break; if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey))) goto err; /* EVP_PKEY_eq() returns -2 with missing public keys */ ret = TEST_int_eq(EVP_PKEY_eq(pkey, dup_pk), -2); EVP_PKEY_free(pkey); pkey = dup_pk; if (!ret) goto err; } ret = 1; err: EVP_MD_CTX_free(ctx); EVP_PKEY_free(pkey); EC_KEY_free(eckey); BN_free(priv); return ret; } static int test_evp_get_ec_pub_legacy(void) { OSSL_LIB_CTX *libctx = NULL; unsigned char *pad = NULL; EVP_PKEY *pkey = NULL; EC_KEY *eckey = NULL; BIGNUM *priv = NULL; BIGNUM *x = NULL; BIGNUM *y = NULL; int ret = 0; if (!TEST_ptr(libctx = OSSL_LIB_CTX_new())) goto err; /* Create the legacy key */ if (!TEST_ptr(eckey = EC_KEY_new_by_curve_name_ex(libctx, NULL, NID_X9_62_prime256v1))) goto err; if (!TEST_ptr(priv = BN_bin2bn(ec_priv, sizeof(ec_priv), NULL))) goto err; if (!TEST_true(EC_KEY_set_private_key(eckey, priv))) goto err; if (!TEST_ptr(x = BN_bin2bn(&ec_pub[1], 32, NULL))) goto err; if (!TEST_ptr(y = BN_bin2bn(&ec_pub[33], 32, NULL))) goto err; if (!TEST_true(EC_KEY_set_public_key_affine_coordinates(eckey, x, y))) goto err; if (!TEST_ptr(pkey = EVP_PKEY_new())) goto err; /* Transfer the legacy key */ if (!TEST_true(EVP_PKEY_assign_EC_KEY(pkey, eckey))) goto err; eckey = NULL; if (!TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_X, &x)) || !TEST_true(EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_Y, &y))) goto err; if (!TEST_ptr(pad = OPENSSL_zalloc(sizeof(ec_pub)))) goto err; pad[0] = ec_pub[0]; BN_bn2bin(x, &pad[1]); BN_bn2bin(y, &pad[33]); if (!TEST_true(memcmp(ec_pub, pad, sizeof(ec_pub)) == 0)) goto err; ret = 1; err: OSSL_LIB_CTX_free(libctx); EVP_PKEY_free(pkey); EC_KEY_free(eckey); OPENSSL_free(pad); BN_free(priv); BN_free(x); BN_free(y); return ret; } #endif /* OPENSSL_NO_DEPRECATED_3_0 */ #endif /* OPENSSL_NO_EC */ static int test_EVP_PKEY_sign(int tst) { int ret = 0; EVP_PKEY *pkey = NULL; unsigned char *sig = NULL; size_t sig_len = 0, shortsig_len = 1; EVP_PKEY_CTX *ctx = NULL; unsigned char tbs[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13 }; if (tst == 0) { if (!TEST_ptr(pkey = load_example_rsa_key())) goto out; } else if (tst == 1) { #ifndef OPENSSL_NO_DSA if (!TEST_ptr(pkey = load_example_dsa_key())) goto out; #else ret = 1; goto out; #endif } else { #ifndef OPENSSL_NO_EC if (!TEST_ptr(pkey = load_example_ec_key())) goto out; #else ret = 1; goto out; #endif } ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL); if (!TEST_ptr(ctx) || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs, sizeof(tbs)), 0)) goto out; sig = OPENSSL_malloc(sig_len); if (!TEST_ptr(sig) /* Test sending a signature buffer that is too short is rejected */ || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs, sizeof(tbs)), 0) || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)), 0) /* Test the signature round-trips */ || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)), 0)) goto out; ret = 1; out: EVP_PKEY_CTX_free(ctx); OPENSSL_free(sig); EVP_PKEY_free(pkey); return ret; } #ifndef OPENSSL_NO_DEPRECATED_3_0 static int test_EVP_PKEY_sign_with_app_method(int tst) { int ret = 0; EVP_PKEY *pkey = NULL; RSA *rsa = NULL; RSA_METHOD *rsa_meth = NULL; #ifndef OPENSSL_NO_DSA DSA *dsa = NULL; DSA_METHOD *dsa_meth = NULL; #endif unsigned char *sig = NULL; size_t sig_len = 0, shortsig_len = 1; EVP_PKEY_CTX *ctx = NULL; unsigned char tbs[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13 }; if (tst == 0) { if (!TEST_ptr(pkey = load_example_rsa_key())) goto out; if (!TEST_ptr(rsa_meth = RSA_meth_dup(RSA_get_default_method()))) goto out; if (!TEST_ptr(rsa = EVP_PKEY_get1_RSA(pkey)) || !TEST_int_gt(RSA_set_method(rsa, rsa_meth), 0) || !TEST_int_gt(EVP_PKEY_assign_RSA(pkey, rsa), 0)) goto out; rsa = NULL; /* now owned by the pkey */ } else { #ifndef OPENSSL_NO_DSA if (!TEST_ptr(pkey = load_example_dsa_key())) goto out; if (!TEST_ptr(dsa_meth = DSA_meth_dup(DSA_get_default_method()))) goto out; if (!TEST_ptr(dsa = EVP_PKEY_get1_DSA(pkey)) || !TEST_int_gt(DSA_set_method(dsa, dsa_meth), 0) || !TEST_int_gt(EVP_PKEY_assign_DSA(pkey, dsa), 0)) goto out; dsa = NULL; /* now owned by the pkey */ #else ret = 1; goto out; #endif } ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL); if (!TEST_ptr(ctx) || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_sign(ctx, NULL, &sig_len, tbs, sizeof(tbs)), 0)) goto out; sig = OPENSSL_malloc(sig_len); if (!TEST_ptr(sig) /* Test sending a signature buffer that is too short is rejected */ || !TEST_int_le(EVP_PKEY_sign(ctx, sig, &shortsig_len, tbs, sizeof(tbs)), 0) || !TEST_int_gt(EVP_PKEY_sign(ctx, sig, &sig_len, tbs, sizeof(tbs)), 0) /* Test the signature round-trips */ || !TEST_int_gt(EVP_PKEY_verify_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_verify(ctx, sig, sig_len, tbs, sizeof(tbs)), 0)) goto out; ret = 1; out: EVP_PKEY_CTX_free(ctx); OPENSSL_free(sig); EVP_PKEY_free(pkey); RSA_free(rsa); RSA_meth_free(rsa_meth); #ifndef OPENSSL_NO_DSA DSA_free(dsa); DSA_meth_free(dsa_meth); #endif return ret; } #endif /* !OPENSSL_NO_DEPRECATED_3_0 */ /* * n = 0 => test using legacy cipher * n = 1 => test using fetched cipher */ static int test_EVP_Enveloped(int n) { int ret = 0; EVP_CIPHER_CTX *ctx = NULL; EVP_PKEY *keypair = NULL; unsigned char *kek = NULL; unsigned char iv[EVP_MAX_IV_LENGTH]; static const unsigned char msg[] = { 1, 2, 3, 4, 5, 6, 7, 8 }; int len, kek_len, ciphertext_len, plaintext_len; unsigned char ciphertext[32], plaintext[16]; EVP_CIPHER *type = NULL; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (n == 0) type = (EVP_CIPHER *)EVP_aes_256_cbc(); else if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "AES-256-CBC", testpropq))) goto err; if (!TEST_ptr(keypair = load_example_rsa_key()) || !TEST_ptr(kek = OPENSSL_zalloc(EVP_PKEY_get_size(keypair))) || !TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_true(EVP_SealInit(ctx, type, &kek, &kek_len, iv, &keypair, 1)) || !TEST_true(EVP_SealUpdate(ctx, ciphertext, &ciphertext_len, msg, sizeof(msg))) || !TEST_true(EVP_SealFinal(ctx, ciphertext + ciphertext_len, &len))) goto err; ciphertext_len += len; if (!TEST_true(EVP_OpenInit(ctx, type, kek, kek_len, iv, keypair)) || !TEST_true(EVP_OpenUpdate(ctx, plaintext, &plaintext_len, ciphertext, ciphertext_len)) || !TEST_true(EVP_OpenFinal(ctx, plaintext + plaintext_len, &len))) goto err; plaintext_len += len; if (!TEST_mem_eq(msg, sizeof(msg), plaintext, plaintext_len)) goto err; ret = 1; err: if (n != 0) EVP_CIPHER_free(type); OPENSSL_free(kek); EVP_PKEY_free(keypair); EVP_CIPHER_CTX_free(ctx); return ret; } /* * Test 0: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, RSA) * Test 1: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, DSA) * Test 2: Standard calls to EVP_DigestSignInit/Update/Final (Implicit fetch digest, HMAC) * Test 3: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, RSA) * Test 4: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch digest, DSA) * Test 5: Standard calls to EVP_DigestSignInit/Update/Final (Explicit fetch diegst, HMAC) * Test 6: Use an MD BIO to do the Update calls instead (RSA) * Test 7: Use an MD BIO to do the Update calls instead (DSA) * Test 8: Use an MD BIO to do the Update calls instead (HMAC) * Test 9: Use EVP_DigestSign (Implicit fetch digest, RSA, short sig) * Test 10: Use EVP_DigestSign (Implicit fetch digest, DSA, short sig) * Test 11: Use EVP_DigestSign (Implicit fetch digest, HMAC, short sig) * Test 12: Use EVP_DigestSign (Implicit fetch digest, RSA) * Test 13: Use EVP_DigestSign (Implicit fetch digest, DSA) * Test 14: Use EVP_DigestSign (Implicit fetch digest, HMAC) * Test 15-29: Same as above with reinitialization */ static int test_EVP_DigestSignInit(int tst) { int ret = 0; EVP_PKEY *pkey = NULL; unsigned char *sig = NULL, *sig2 = NULL; size_t sig_len = 0, sig2_len = 0, shortsig_len = 1; EVP_MD_CTX *md_ctx = NULL, *md_ctx_verify = NULL; EVP_MD_CTX *a_md_ctx = NULL, *a_md_ctx_verify = NULL; BIO *mdbio = NULL, *membio = NULL; size_t written; const EVP_MD *md; EVP_MD *mdexp = NULL; int reinit = 0; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (tst >= 15) { reinit = 1; tst -= 15; } if (tst >= 6 && tst <= 8) { membio = BIO_new(BIO_s_mem()); mdbio = BIO_new(BIO_f_md()); if (!TEST_ptr(membio) || !TEST_ptr(mdbio)) goto out; BIO_push(mdbio, membio); if (!TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx), 0)) goto out; } else { if (!TEST_ptr(a_md_ctx = md_ctx = EVP_MD_CTX_new()) || !TEST_ptr(a_md_ctx_verify = md_ctx_verify = EVP_MD_CTX_new())) goto out; } if (tst % 3 == 0) { if (!TEST_ptr(pkey = load_example_rsa_key())) goto out; } else if (tst % 3 == 1) { #ifndef OPENSSL_NO_DSA if (!TEST_ptr(pkey = load_example_dsa_key())) goto out; #else ret = 1; goto out; #endif } else { if (!TEST_ptr(pkey = load_example_hmac_key())) goto out; } if (tst >= 3 && tst <= 5) md = mdexp = EVP_MD_fetch(NULL, "SHA256", NULL); else md = EVP_sha256(); if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, md, NULL, pkey))) goto out; if (reinit && !TEST_true(EVP_DigestSignInit(md_ctx, NULL, NULL, NULL, NULL))) goto out; if (tst >= 6 && tst <= 8) { if (!BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written)) goto out; } else if (tst < 6) { if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg)))) goto out; } if (tst >= 9) { /* Determine the size of the signature. */ if (!TEST_true(EVP_DigestSign(md_ctx, NULL, &sig_len, kMsg, sizeof(kMsg))) || !TEST_ptr(sig = OPENSSL_malloc(sig_len))) goto out; if (tst <= 11) { /* Test that supply a short sig buffer fails */ if (!TEST_false(EVP_DigestSign(md_ctx, sig, &shortsig_len, kMsg, sizeof(kMsg)))) goto out; /* * We end here because once EVP_DigestSign() has failed you should * not call it again without re-initing the ctx */ ret = 1; goto out; } if (!TEST_true(EVP_DigestSign(md_ctx, sig, &sig_len, kMsg, sizeof(kMsg)))) goto out; } else { /* Determine the size of the signature. */ if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len)) || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) /* * Trying to create a signature with a deliberately short * buffer should fail. */ || !TEST_false(EVP_DigestSignFinal(md_ctx, sig, &shortsig_len)) || !TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len))) goto out; } /* * Ensure that the signature round-trips (Verification isn't supported for * HMAC via EVP_DigestVerify*) */ if (tst % 3 != 2) { if (tst >= 6 && tst <= 8) { if (!TEST_int_gt(BIO_reset(mdbio), 0) || !TEST_int_gt(BIO_get_md_ctx(mdbio, &md_ctx_verify), 0)) goto out; } if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, md, NULL, pkey))) goto out; if (tst >= 6 && tst <= 8) { if (!TEST_true(BIO_write_ex(mdbio, kMsg, sizeof(kMsg), &written))) goto out; } else { if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) goto out; } if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) goto out; /* Multiple calls to EVP_DigestVerifyFinal should work */ if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) goto out; } else { /* * For HMAC a doubled call to DigestSignFinal should produce the same * value as finalization should not happen. */ if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig2_len)) || !TEST_ptr(sig2 = OPENSSL_malloc(sig2_len)) || !TEST_true(EVP_DigestSignFinal(md_ctx, sig2, &sig2_len))) goto out; if (!TEST_mem_eq(sig, sig_len, sig2, sig2_len)) goto out; } ret = 1; out: BIO_free(membio); BIO_free(mdbio); EVP_MD_CTX_free(a_md_ctx); EVP_MD_CTX_free(a_md_ctx_verify); EVP_PKEY_free(pkey); OPENSSL_free(sig); OPENSSL_free(sig2); EVP_MD_free(mdexp); return ret; } static int test_EVP_DigestVerifyInit(void) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_MD_CTX *md_ctx = NULL; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (!TEST_ptr(md_ctx = EVP_MD_CTX_new()) || !TEST_ptr(pkey = load_example_rsa_key())) goto out; if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, EVP_sha256(), NULL, pkey)) || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg))) || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature, sizeof(kSignature)), 0)) goto out; /* test with reinitialization */ if (!TEST_true(EVP_DigestVerifyInit(md_ctx, NULL, NULL, NULL, NULL)) || !TEST_true(EVP_DigestVerifyUpdate(md_ctx, kMsg, sizeof(kMsg))) || !TEST_int_gt(EVP_DigestVerifyFinal(md_ctx, kSignature, sizeof(kSignature)), 0)) goto out; ret = 1; out: EVP_MD_CTX_free(md_ctx); EVP_PKEY_free(pkey); return ret; } #ifndef OPENSSL_NO_EC static int test_ecdsa_digestsign_keccak(void) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_MD_CTX *ctx = NULL; EVP_MD *md = NULL; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); pkey = load_example_ec_key(); if (!TEST_ptr(pkey)) goto err; /* This would not work with FIPS provider so just use NULL libctx */ md = EVP_MD_fetch(NULL, "KECCAK-256", NULL); if (!TEST_ptr(md)) goto err; ctx = EVP_MD_CTX_new(); if (!TEST_ptr(ctx)) goto err; /* * Just check EVP_DigestSignInit_ex() works. */ if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey))) goto err; ret = 1; err: EVP_MD_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_MD_free(md); return ret; } #endif #ifndef OPENSSL_NO_SIPHASH /* test SIPHASH MAC via EVP_PKEY with non-default parameters and reinit */ static int test_siphash_digestsign(void) { unsigned char key[16]; unsigned char buf[8], digest[8]; unsigned char expected[8] = { 0x6d, 0x3e, 0x54, 0xc2, 0x2f, 0xf1, 0xfe, 0xe2 }; EVP_PKEY *pkey = NULL; EVP_MD_CTX *mdctx = NULL; EVP_PKEY_CTX *ctx = NULL; int ret = 0; size_t len = 8; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); memset(buf, 0, 8); memset(key, 1, 16); if (!TEST_ptr(pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_SIPHASH, NULL, key, 16))) goto out; if (!TEST_ptr(mdctx = EVP_MD_CTX_create())) goto out; if (!TEST_true(EVP_DigestSignInit(mdctx, &ctx, NULL, NULL, pkey))) goto out; if (!TEST_int_eq(EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_SIGNCTX, EVP_PKEY_CTRL_SET_DIGEST_SIZE, 8, NULL), 1)) goto out; /* reinitialize */ if (!TEST_true(EVP_DigestSignInit(mdctx, NULL, NULL, NULL, NULL))) goto out; if (!TEST_true(EVP_DigestSignUpdate(mdctx, buf, 8))) goto out; if (!TEST_true(EVP_DigestSignFinal(mdctx, digest, &len))) goto out; if (!TEST_mem_eq(digest, len, expected, sizeof(expected))) goto out; ret = 1; out: EVP_PKEY_free(pkey); EVP_MD_CTX_free(mdctx); return ret; } #endif /* * Test corner cases of EVP_DigestInit/Update/Final API call behavior. */ static int test_EVP_Digest(void) { int ret = 0; EVP_MD_CTX *md_ctx = NULL; unsigned char md[EVP_MAX_MD_SIZE]; EVP_MD *sha256 = NULL; EVP_MD *shake256 = NULL; if (!TEST_ptr(md_ctx = EVP_MD_CTX_new())) goto out; if (!TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", testpropq)) || !TEST_ptr(shake256 = EVP_MD_fetch(testctx, "shake256", testpropq))) goto out; if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL)) || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) || !TEST_true(EVP_DigestFinal(md_ctx, md, NULL)) /* EVP_DigestFinal resets the EVP_MD_CTX. */ || !TEST_ptr_eq(EVP_MD_CTX_get0_md(md_ctx), NULL)) goto out; if (!TEST_true(EVP_DigestInit_ex(md_ctx, sha256, NULL)) || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) || !TEST_true(EVP_DigestFinal_ex(md_ctx, md, NULL)) /* EVP_DigestFinal_ex does not reset the EVP_MD_CTX. */ || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx)) /* * EVP_DigestInit_ex with NULL type should work on * pre-initialized context. */ || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL))) goto out; if (!TEST_true(EVP_DigestInit_ex(md_ctx, shake256, NULL)) || !TEST_true(EVP_DigestUpdate(md_ctx, kMsg, sizeof(kMsg))) || !TEST_true(EVP_DigestFinalXOF(md_ctx, md, sizeof(md))) /* EVP_DigestFinalXOF does not reset the EVP_MD_CTX. */ || !TEST_ptr(EVP_MD_CTX_get0_md(md_ctx)) || !TEST_true(EVP_DigestInit_ex(md_ctx, NULL, NULL))) goto out; ret = 1; out: EVP_MD_CTX_free(md_ctx); EVP_MD_free(sha256); EVP_MD_free(shake256); return ret; } static int test_EVP_md_null(void) { int ret = 0; EVP_MD_CTX *md_ctx = NULL; const EVP_MD *md_null = EVP_md_null(); unsigned char md_value[EVP_MAX_MD_SIZE]; unsigned int md_len = sizeof(md_value); if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (!TEST_ptr(md_null) || !TEST_ptr(md_ctx = EVP_MD_CTX_new())) goto out; if (!TEST_true(EVP_DigestInit_ex(md_ctx, md_null, NULL)) || !TEST_true(EVP_DigestUpdate(md_ctx, "test", 4)) || !TEST_true(EVP_DigestFinal_ex(md_ctx, md_value, &md_len))) goto out; if (!TEST_uint_eq(md_len, 0)) goto out; ret = 1; out: EVP_MD_CTX_free(md_ctx); return ret; } #ifndef OPENSSL_NO_POLY1305 /* Test Poly1305 no-key failures and staged key initialization */ static int test_evp_mac_poly1305_no_key(void) { int ret = 0; EVP_MAC *mac = NULL; EVP_MAC_CTX *ctx = NULL; /* RFC 7539 Poly1305 test vector. */ static const unsigned char staged_data[] = "Cryptographic Forum Research Group"; static const unsigned char expected[16] = { 0xa8, 0x06, 0x1d, 0xc1, 0x30, 0x51, 0x36, 0xc6, 0xc2, 0x2b, 0x8b, 0xaf, 0x0c, 0x01, 0x27, 0xa9 }; unsigned char no_key_data[16] = { 0 }; unsigned char key[32] = { 0x85, 0xd6, 0xbe, 0x78, 0x57, 0x55, 0x6d, 0x33, 0x7f, 0x44, 0x52, 0xfe, 0x42, 0xd5, 0x06, 0xa8, 0x01, 0x03, 0x80, 0x8a, 0xfb, 0x0d, 0xb2, 0xfd, 0x4a, 0xbf, 0xf6, 0xaf, 0x41, 0x49, 0xf5, 0x1b }; unsigned char out[16]; OSSL_PARAM key_params[2]; OSSL_PARAM null_key_params[2]; size_t outl = 0; key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, key, sizeof(key)); key_params[1] = OSSL_PARAM_construct_end(); null_key_params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, NULL, sizeof(key)); null_key_params[1] = OSSL_PARAM_construct_end(); if (!TEST_ptr(mac = EVP_MAC_fetch(testctx, "Poly1305", testpropq)) || !TEST_ptr(ctx = EVP_MAC_CTX_new(mac)) || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1)) goto err; ERR_clear_error(); if (!TEST_int_eq(EVP_MAC_update(ctx, no_key_data, sizeof(no_key_data)), 0) || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET)) goto err; /* The failed update must not block staged key initialization. */ if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, key_params), 1) || !TEST_int_eq(EVP_MAC_update(ctx, staged_data, sizeof(staged_data) - 1), 1) || !TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 1) || !TEST_size_t_eq(outl, sizeof(expected)) || !TEST_mem_eq(out, outl, expected, sizeof(expected))) goto err; EVP_MAC_CTX_free(ctx); ctx = NULL; if (!TEST_ptr(ctx = EVP_MAC_CTX_new(mac)) || !TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, NULL), 1)) goto err; ERR_clear_error(); if (!TEST_int_eq(EVP_MAC_final(ctx, out, &outl, sizeof(out)), 0) || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_NO_KEY_SET)) goto err; ERR_clear_error(); if (!TEST_int_eq(EVP_MAC_init(ctx, NULL, 0, null_key_params), 0) || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_INVALID_KEY_LENGTH)) goto err; ERR_clear_error(); if (!TEST_int_eq(EVP_MAC_CTX_set_params(ctx, null_key_params), 0) || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), PROV_R_INVALID_KEY_LENGTH)) goto err; EVP_MAC_CTX_free(ctx); ctx = NULL; ret = 1; err: EVP_MAC_CTX_free(ctx); EVP_MAC_free(mac); return ret; } #endif static int test_d2i_AutoPrivateKey(int i) { int ret = 0; const unsigned char *p; EVP_PKEY *pkey = NULL; const APK_DATA *ak = &keydata[i]; const unsigned char *input = ak->kder; size_t input_len = ak->size; int expected_id = ak->evptype; p = input; if (!TEST_ptr(pkey = d2i_AutoPrivateKey(NULL, &p, (long)input_len)) || !TEST_ptr_eq(p, input + input_len) || !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id)) goto done; ret = 1; done: EVP_PKEY_free(pkey); return ret; } #ifndef OPENSSL_NO_EC static const unsigned char ec_public_sect163k1_validxy[] = { 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x02, 0xd1, 0x7b, 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f }; static const unsigned char ec_public_sect163k1_badx[] = { 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 0x0a, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0xb0, 0x02, 0xd1, 0x7b, 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 0x6a, 0xd8, 0x17, 0x65, 0x41, 0x2f }; static const unsigned char ec_public_sect163k1_bady[] = { 0x30, 0x40, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x01, 0x03, 0x2c, 0x00, 0x04, 0x02, 0x84, 0x58, 0xa6, 0xd4, 0xa0, 0x35, 0x2b, 0xae, 0xf0, 0xc0, 0x69, 0x05, 0xcf, 0x2a, 0x50, 0x33, 0xf9, 0xe3, 0x92, 0x79, 0x0a, 0xd1, 0x7b, 0x9f, 0x22, 0x00, 0xf0, 0x3b, 0x0e, 0x5d, 0x2e, 0xb7, 0x23, 0x24, 0xf3, 0x6a, 0xd8, 0x17, 0x65, 0x41, 0xe6 }; static struct ec_der_pub_keys_st { const unsigned char *der; size_t len; int valid; } ec_der_pub_keys[] = { { ec_public_sect163k1_validxy, sizeof(ec_public_sect163k1_validxy), 1 }, { ec_public_sect163k1_badx, sizeof(ec_public_sect163k1_badx), 0 }, { ec_public_sect163k1_bady, sizeof(ec_public_sect163k1_bady), 0 }, }; /* * Tests the range of the decoded EC char2 public point. * See ec_GF2m_simple_oct2point(). */ static int test_invalid_ec_char2_pub_range_decode(int id) { int ret = 0; EVP_PKEY *pkey; pkey = load_example_key("EC", ec_der_pub_keys[id].der, ec_der_pub_keys[id].len); ret = (ec_der_pub_keys[id].valid && TEST_ptr(pkey)) || TEST_ptr_null(pkey); EVP_PKEY_free(pkey); return ret; } static int test_EVP_PKCS82PKEY(void) { int ret = 0; const unsigned char *derp = kExampleBadECKeyDER; PKCS8_PRIV_KEY_INFO *p8inf = NULL; EVP_PKEY *pkey = NULL; if (!TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &derp, sizeof(kExampleBadECKeyDER)))) goto done; if (!TEST_ptr_eq(derp, kExampleBadECKeyDER + sizeof(kExampleBadECKeyDER))) goto done; if (!TEST_ptr_null(pkey = EVP_PKCS82PKEY(p8inf))) goto done; ret = 1; done: PKCS8_PRIV_KEY_INFO_free(p8inf); EVP_PKEY_free(pkey); return ret; } #endif static int test_EVP_PKCS82PKEY_v2(int i) { int ret = 0; const unsigned char *p; const APK_DATA *ak = &keydata_v2[i]; const unsigned char *input = ak->kder; size_t input_len = ak->size; PKCS8_PRIV_KEY_INFO *p8inf = NULL; /* Can we parse PKCS#8 v2, ignoring the public key for now? */ p = input; p8inf = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, (long)input_len); if (!TEST_ptr(p8inf) || !TEST_true(p == input + input_len)) goto done; ret = 1; done: PKCS8_PRIV_KEY_INFO_free(p8inf); return ret; } /* Tests loading a bad key in PKCS8 format */ static int test_EVP_PKCS82PKEY_wrong_tag(void) { EVP_PKEY *pkey = NULL; EVP_PKEY *pkey2 = NULL; BIO *membio = NULL; char *membuf = NULL; PKCS8_PRIV_KEY_INFO *p8inf = NULL; int ok = 0; if (testctx != NULL) /* test not supported with non-default context */ return 1; if (!TEST_ptr(membio = BIO_new(BIO_s_mem())) || !TEST_ptr(pkey = load_example_rsa_key()) || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL, NULL, 0, NULL, NULL), 0) || !TEST_int_gt(BIO_get_mem_data(membio, &membuf), 0) || !TEST_ptr(p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(membio, NULL)) || !TEST_ptr(pkey2 = EVP_PKCS82PKEY(p8inf)) || !TEST_int_eq(ERR_peek_last_error(), 0)) { goto done; } ok = 1; done: EVP_PKEY_free(pkey); EVP_PKEY_free(pkey2); PKCS8_PRIV_KEY_INFO_free(p8inf); BIO_free_all(membio); return ok; } /* This uses kExampleRSAKeyDER and kExampleRSAKeyPKCS8 to verify encoding */ static int test_privatekey_to_pkcs8(void) { EVP_PKEY *pkey = NULL; BIO *membio = NULL; char *membuf = NULL; long membuf_len = 0; int ok = 0; if (!TEST_ptr(membio = BIO_new(BIO_s_mem())) || !TEST_ptr(pkey = load_example_rsa_key()) || !TEST_int_gt(i2d_PKCS8PrivateKey_bio(membio, pkey, NULL, NULL, 0, NULL, NULL), 0) || !TEST_int_gt(membuf_len = BIO_get_mem_data(membio, &membuf), 0) || !TEST_ptr(membuf) || !TEST_mem_eq(membuf, (size_t)membuf_len, kExampleRSAKeyPKCS8, sizeof(kExampleRSAKeyPKCS8)) /* * We try to write PEM as well, just to see that it doesn't err, but * assume that the result is correct. */ || !TEST_int_gt(PEM_write_bio_PKCS8PrivateKey(membio, pkey, NULL, NULL, 0, NULL, NULL), 0)) goto done; ok = 1; done: EVP_PKEY_free(pkey); BIO_free_all(membio); return ok; } #ifndef OPENSSL_NO_EC static const struct { int encoding; const char *encoding_name; } ec_encodings[] = { { OPENSSL_EC_EXPLICIT_CURVE, OSSL_PKEY_EC_ENCODING_EXPLICIT }, { OPENSSL_EC_NAMED_CURVE, OSSL_PKEY_EC_ENCODING_GROUP } }; static int ec_export_get_encoding_cb(const OSSL_PARAM params[], void *arg) { const OSSL_PARAM *p; const char *enc_name = NULL; int *enc = arg; size_t i; *enc = -1; if (!TEST_ptr(p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_ENCODING)) || !TEST_true(OSSL_PARAM_get_utf8_string_ptr(p, &enc_name))) return 0; for (i = 0; i < OSSL_NELEM(ec_encodings); i++) { if (OPENSSL_strcasecmp(enc_name, ec_encodings[i].encoding_name) == 0) { *enc = ec_encodings[i].encoding; break; } } return (*enc != -1); } static int test_EC_keygen_with_enc(int idx) { EVP_PKEY *params = NULL, *key = NULL; EVP_PKEY_CTX *pctx = NULL, *kctx = NULL; int enc; int ret = 0; enc = ec_encodings[idx].encoding; /* Create key parameters */ if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "EC", NULL)) || !TEST_int_gt(EVP_PKEY_paramgen_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_group_name(pctx, "P-256"), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_ec_param_enc(pctx, enc), 0) || !TEST_true(EVP_PKEY_paramgen(pctx, ¶ms)) || !TEST_ptr(params)) goto done; /* Create key */ if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx, params, NULL)) || !TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0) || !TEST_true(EVP_PKEY_keygen(kctx, &key)) || !TEST_ptr(key)) goto done; /* Check that the encoding got all the way into the key */ if (!TEST_true(evp_keymgmt_util_export(key, OSSL_KEYMGMT_SELECT_ALL, ec_export_get_encoding_cb, &enc)) || !TEST_int_eq(enc, ec_encodings[idx].encoding)) goto done; ret = 1; done: EVP_PKEY_free(key); EVP_PKEY_free(params); EVP_PKEY_CTX_free(kctx); EVP_PKEY_CTX_free(pctx); return ret; } #endif #if !defined(OPENSSL_NO_SM2) static int test_EVP_SM2_verify(void) { const char *pubkey = "-----BEGIN PUBLIC KEY-----\n" "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEp1KLWq1ZE2jmoAnnBJE1LBGxVr18\n" "YvvqECWCpXfAQ9qUJ+UmthnUPf0iM3SaXKHe6PlLIDyNlWMWb9RUh/yU3g==\n" "-----END PUBLIC KEY-----\n"; const char *msg = "message digest"; const char *id = "ALICE123@YAHOO.COM"; const uint8_t signature[] = { 0x30, 0x44, 0x02, 0x20, 0x5b, 0xdb, 0xab, 0x81, 0x4f, 0xbb, 0x8b, 0x69, 0xb1, 0x05, 0x9c, 0x99, 0x3b, 0xb2, 0x45, 0x06, 0x4a, 0x30, 0x15, 0x59, 0x84, 0xcd, 0xee, 0x30, 0x60, 0x36, 0x57, 0x87, 0xef, 0x5c, 0xd0, 0xbe, 0x02, 0x20, 0x43, 0x8d, 0x1f, 0xc7, 0x77, 0x72, 0x39, 0xbb, 0x72, 0xe1, 0xfd, 0x07, 0x58, 0xd5, 0x82, 0xc8, 0x2d, 0xba, 0x3b, 0x2c, 0x46, 0x24, 0xe3, 0x50, 0xff, 0x04, 0xc7, 0xa0, 0x71, 0x9f, 0xa4, 0x70 }; int rc = 0; BIO *bio = NULL; EVP_PKEY *pkey = NULL; EVP_MD_CTX *mctx = NULL; EVP_PKEY_CTX *pctx = NULL; EVP_MD *sm3 = NULL; bio = BIO_new_mem_buf(pubkey, (int)strlen(pubkey)); if (!TEST_true(bio != NULL)) goto done; pkey = PEM_read_bio_PUBKEY_ex(bio, NULL, NULL, NULL, testctx, testpropq); if (!TEST_true(pkey != NULL)) goto done; if (!TEST_true(EVP_PKEY_is_a(pkey, "SM2"))) goto done; if (!TEST_ptr(mctx = EVP_MD_CTX_new())) goto done; if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) goto done; EVP_MD_CTX_set_pkey_ctx(mctx, pctx); if (!TEST_ptr(sm3 = EVP_MD_fetch(testctx, "sm3", testpropq))) goto done; if (!TEST_true(EVP_DigestVerifyInit(mctx, NULL, sm3, NULL, pkey))) goto done; if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(pctx, id, (int)strlen(id)), 0)) goto done; if (!TEST_true(EVP_DigestVerifyUpdate(mctx, msg, strlen(msg)))) goto done; if (!TEST_int_gt(EVP_DigestVerifyFinal(mctx, signature, sizeof(signature)), 0)) goto done; rc = 1; done: BIO_free(bio); EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(pctx); EVP_MD_CTX_free(mctx); EVP_MD_free(sm3); return rc; } static int test_EVP_SM2(void) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_PKEY *pkeyparams = NULL; EVP_PKEY_CTX *pctx = NULL; EVP_PKEY_CTX *kctx = NULL; EVP_PKEY_CTX *sctx = NULL; size_t sig_len = 0; unsigned char *sig = NULL; EVP_MD_CTX *md_ctx = NULL; EVP_MD_CTX *md_ctx_verify = NULL; EVP_PKEY_CTX *cctx = NULL; EVP_MD *check_md = NULL; uint8_t sm2_id[] = { 0x01, 0x02, 0x03, 0x04, 0x6c, 0x65, 0x74, 0x74, 0x65, 0x72 }; #ifndef OPENSSL_NO_X963KDF uint8_t ciphertext[128]; size_t ctext_len = sizeof(ciphertext); size_t ctext_len_param = 0; uint8_t plaintext[8]; size_t ptext_len = sizeof(plaintext); size_t ptext_len_param = 0; OSSL_PARAM sparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; OSSL_PARAM gparams[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; int i; char mdname[OSSL_MAX_NAME_SIZE]; #endif if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "SM2", testpropq))) goto done; if (!TEST_true(EVP_PKEY_paramgen_init(pctx) == 1)) goto done; if (!TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_sm2), 0)) goto done; if (!TEST_true(EVP_PKEY_paramgen(pctx, &pkeyparams))) goto done; if (!TEST_ptr(kctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkeyparams, testpropq))) goto done; if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0)) goto done; if (!TEST_true(EVP_PKEY_keygen(kctx, &pkey))) goto done; if (!TEST_ptr(md_ctx = EVP_MD_CTX_new())) goto done; if (!TEST_ptr(md_ctx_verify = EVP_MD_CTX_new())) goto done; if (!TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) goto done; EVP_MD_CTX_set_pkey_ctx(md_ctx, sctx); EVP_MD_CTX_set_pkey_ctx(md_ctx_verify, sctx); if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, "sm3", testpropq))) goto done; if (!TEST_true(EVP_DigestSignInit(md_ctx, NULL, check_md, NULL, pkey))) goto done; if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0)) goto done; if (!TEST_true(EVP_DigestSignUpdate(md_ctx, kMsg, sizeof(kMsg)))) goto done; /* Determine the size of the signature. */ if (!TEST_true(EVP_DigestSignFinal(md_ctx, NULL, &sig_len))) goto done; if (!TEST_ptr(sig = OPENSSL_malloc(sig_len))) goto done; if (!TEST_true(EVP_DigestSignFinal(md_ctx, sig, &sig_len))) goto done; /* Ensure that the signature round-trips. */ if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL, pkey))) goto done; if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, sm2_id, sizeof(sm2_id)), 0)) goto done; if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) goto done; if (!TEST_int_gt(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) goto done; /* * Try verify again with non-matching 0 length id but ensure that it can * be set on the context and overrides the previous value. */ if (!TEST_true(EVP_DigestVerifyInit(md_ctx_verify, NULL, check_md, NULL, pkey))) goto done; if (!TEST_int_gt(EVP_PKEY_CTX_set1_id(sctx, NULL, 0), 0)) goto done; if (!TEST_true(EVP_DigestVerifyUpdate(md_ctx_verify, kMsg, sizeof(kMsg)))) goto done; if (!TEST_int_eq(EVP_DigestVerifyFinal(md_ctx_verify, sig, sig_len), 0)) goto done; /* now check encryption/decryption */ #ifndef OPENSSL_NO_X963KDF gparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST, mdname, sizeof(mdname)); for (i = 0; i < 2; i++) { const char *mdnames[] = { #ifndef OPENSSL_NO_SM3 "SM3", #else NULL, #endif "SHA2-256" }; EVP_PKEY_CTX_free(cctx); if (mdnames[i] == NULL) continue; sparams[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_DIGEST, (char *)mdnames[i], 0); if (!TEST_ptr(cctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) goto done; if (!TEST_true(EVP_PKEY_encrypt_init(cctx))) goto done; if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams))) goto done; ctext_len_param = ctext_len; if (!TEST_true(EVP_PKEY_encrypt(cctx, ciphertext, &ctext_len_param, kMsg, sizeof(kMsg)))) goto done; if (!TEST_int_gt(EVP_PKEY_decrypt_init(cctx), 0)) goto done; if (!TEST_true(EVP_PKEY_CTX_set_params(cctx, sparams))) goto done; ptext_len_param = ptext_len; if (!TEST_int_gt(EVP_PKEY_decrypt(cctx, plaintext, &ptext_len_param, ciphertext, ctext_len_param), 0)) goto done; if (!TEST_true(EVP_PKEY_CTX_get_params(cctx, gparams))) goto done; /* * Test we're still using the digest we think we are. * Because of aliases, the easiest is to fetch the digest and * check the name with EVP_MD_is_a(). */ EVP_MD_free(check_md); if (!TEST_ptr(check_md = EVP_MD_fetch(testctx, mdname, testpropq))) goto done; if (!TEST_true(EVP_MD_is_a(check_md, mdnames[i]))) { TEST_info("Fetched md %s isn't %s", mdname, mdnames[i]); goto done; } if (!TEST_true(ptext_len_param == sizeof(kMsg))) goto done; if (!TEST_true(memcmp(plaintext, kMsg, sizeof(kMsg)) == 0)) goto done; } #endif /* OPENSSL_NO_X963KDF */ ret = 1; done: EVP_PKEY_CTX_free(pctx); EVP_PKEY_CTX_free(kctx); EVP_PKEY_CTX_free(sctx); EVP_PKEY_CTX_free(cctx); EVP_PKEY_free(pkey); EVP_PKEY_free(pkeyparams); EVP_MD_CTX_free(md_ctx); EVP_MD_CTX_free(md_ctx_verify); EVP_MD_free(check_md); OPENSSL_free(sig); return ret; } #endif #ifndef OPENSSL_NO_ML_KEM static const uint8_t ml_kem_seed[] = { 0x7c, 0x99, 0x35, 0xa0, 0xb0, 0x76, 0x94, 0xaa, 0x0c, 0x6d, 0x10, 0xe4, 0xdb, 0x6b, 0x1a, 0xdd, 0x2f, 0xd8, 0x1a, 0x25, 0xcc, 0xb1, 0x48, 0x03, 0x2d, 0xcd, 0x73, 0x99, 0x36, 0x73, 0x7f, 0x2d, 0x86, 0x26, 0xed, 0x79, 0xd4, 0x51, 0x14, 0x08, 0x00, 0xe0, 0x3b, 0x59, 0xb9, 0x56, 0xf8, 0x21, 0x0e, 0x55, 0x60, 0x67, 0x40, 0x7d, 0x13, 0xdc, 0x90, 0xfa, 0x9e, 0x8b, 0x87, 0x2b, 0xfb, 0x8f }; static const uint8_t ml_kem_512_pubkey[] = { 0x40, 0x08, 0x65, 0xed, 0x10, 0xb6, 0x19, 0xaa, 0x58, 0x11, 0x13, 0x9b, 0xc0, 0x86, 0x82, 0x57, 0x82, 0xb2, 0xb7, 0x12, 0x4f, 0x75, 0x7c, 0x83, 0xae, 0x79, 0x44, 0x44, 0xbc, 0x78, 0xa4, 0x78, 0x96, 0xac, 0xf1, 0x26, 0x2c, 0x81, 0x35, 0x10, 0x77, 0x89, 0x3b, 0xfc, 0x56, 0xf9, 0x04, 0x49, 0xc2, 0xfa, 0x5f, 0x6e, 0x58, 0x6d, 0xd3, 0x7c, 0x0b, 0x9b, 0x58, 0x19, 0x92, 0x63, 0x8c, 0xb7, 0xe7, 0xbc, 0xbb, 0xb9, 0x9a, 0xfe, 0x47, 0x81, 0xd8, 0x0a, 0x50, 0xe6, 0x94, 0x63, 0xfb, 0xd9, 0x88, 0x72, 0x2c, 0x36, 0x35, 0x42, 0x3e, 0x27, 0x46, 0x6c, 0x71, 0xdc, 0xc6, 0x74, 0x52, 0x7c, 0xcd, 0x72, 0x89, 0x68, 0xcb, 0xcd, 0xc0, 0x0c, 0x5c, 0x90, 0x35, 0xbb, 0x0a, 0xf2, 0xc9, 0x92, 0x2c, 0x78, 0x81, 0xa4, 0x1d, 0xd2, 0x87, 0x52, 0x73, 0x92, 0x51, 0x31, 0x23, 0x0f, 0x6c, 0xa5, 0x9e, 0x91, 0x36, 0xb3, 0x9f, 0x95, 0x6c, 0x93, 0xb3, 0xb2, 0xd1, 0x4c, 0x64, 0x1b, 0x08, 0x9e, 0x07, 0xd0, 0xa8, 0x40, 0xc8, 0x93, 0xec, 0xd7, 0x6b, 0xbf, 0x92, 0xc8, 0x05, 0x45, 0x66, 0x68, 0xd0, 0x7c, 0x62, 0x14, 0x91, 0xc5, 0xc0, 0x54, 0x99, 0x1a, 0x65, 0x6f, 0x51, 0x16, 0x19, 0x55, 0x6e, 0xb9, 0x77, 0x82, 0xe2, 0x7a, 0x3c, 0x78, 0x51, 0x24, 0xc7, 0x0b, 0x0d, 0xab, 0xa6, 0xc6, 0x24, 0xd1, 0x8e, 0x0f, 0x97, 0x93, 0xf9, 0x6b, 0xa9, 0xe1, 0x59, 0x9b, 0x17, 0xb3, 0x0d, 0xcc, 0xc0, 0xb4, 0xf3, 0x76, 0x6a, 0x07, 0xb2, 0x3b, 0x25, 0x73, 0x09, 0xcd, 0x76, 0xab, 0xa0, 0x72, 0xc2, 0xb9, 0xc9, 0x74, 0x43, 0x94, 0xc6, 0xab, 0x9c, 0xb6, 0xc5, 0x4a, 0x97, 0xb5, 0xc5, 0x78, 0x61, 0xa5, 0x8d, 0xc0, 0xa0, 0x35, 0x19, 0x83, 0x2e, 0xe3, 0x2a, 0x07, 0x65, 0x4a, 0x07, 0x0c, 0x0c, 0x8c, 0x4e, 0x86, 0x48, 0xad, 0xdc, 0x35, 0x5f, 0x27, 0x4f, 0xc6, 0xb9, 0x2a, 0x08, 0x7b, 0x3f, 0x97, 0x51, 0x92, 0x3e, 0x44, 0x27, 0x4f, 0x85, 0x8c, 0x49, 0xca, 0xba, 0x72, 0xb6, 0x58, 0x51, 0xb3, 0xad, 0xc4, 0x89, 0x36, 0x95, 0x50, 0x97, 0xca, 0xd9, 0x55, 0x3f, 0x5a, 0x26, 0x3f, 0x18, 0x44, 0xb5, 0x2a, 0x02, 0x0f, 0xf7, 0xca, 0x89, 0xe8, 0x81, 0xa0, 0x1b, 0x95, 0xd9, 0x57, 0xa3, 0x15, 0x3c, 0x0a, 0x5e, 0x0a, 0x1c, 0xcd, 0x66, 0xb1, 0x82, 0x1a, 0x2b, 0x86, 0x32, 0x54, 0x6e, 0x24, 0xc7, 0xcb, 0xbc, 0x4c, 0xb0, 0x88, 0x08, 0xca, 0xc3, 0x7f, 0x7d, 0xa6, 0xb1, 0x6f, 0x8a, 0xce, 0xd0, 0x52, 0xcd, 0xb2, 0x56, 0x49, 0x48, 0xf1, 0xab, 0x0f, 0x76, 0x8a, 0x0d, 0x32, 0x86, 0xcc, 0xc7, 0xc3, 0x74, 0x9c, 0x63, 0xc7, 0x81, 0x53, 0x0f, 0xa1, 0xae, 0x67, 0x05, 0x42, 0x85, 0x50, 0x04, 0xa6, 0x45, 0xb5, 0x22, 0x88, 0x1e, 0xc1, 0x41, 0x2b, 0xda, 0xe3, 0x42, 0x08, 0x5a, 0x9d, 0xd5, 0xf8, 0x12, 0x6a, 0xf9, 0x6b, 0xbd, 0xb0, 0xc1, 0xaf, 0x69, 0xa1, 0x55, 0x62, 0xcb, 0x2a, 0x15, 0x5a, 0x10, 0x03, 0x09, 0xd1, 0xb6, 0x41, 0xd0, 0x8b, 0x2d, 0x4e, 0xd1, 0x7b, 0xfb, 0xf0, 0xbc, 0x04, 0x26, 0x5f, 0x9b, 0x10, 0xc1, 0x08, 0xf8, 0x50, 0x30, 0x95, 0x04, 0xd7, 0x72, 0x81, 0x1b, 0xba, 0x8e, 0x2b, 0xe1, 0x62, 0x49, 0xaa, 0x73, 0x7d, 0x87, 0x9f, 0xc7, 0xfb, 0x25, 0x5e, 0xe7, 0xa6, 0xa0, 0xa7, 0x53, 0xbd, 0x93, 0x74, 0x1c, 0x61, 0x65, 0x8e, 0xc0, 0x74, 0xf6, 0xe0, 0x02, 0xb0, 0x19, 0x34, 0x57, 0x69, 0x11, 0x3c, 0xc0, 0x13, 0xff, 0x74, 0x94, 0xba, 0x83, 0x78, 0xb1, 0x1a, 0x17, 0x22, 0x60, 0xaa, 0xa5, 0x34, 0x21, 0xbd, 0xe0, 0x3a, 0x35, 0x58, 0x9d, 0x57, 0xe3, 0x22, 0xfe, 0xfa, 0x41, 0x00, 0xa4, 0x74, 0x39, 0x26, 0xab, 0x7d, 0x62, 0x25, 0x8b, 0x87, 0xb3, 0x1c, 0xcb, 0xb5, 0xe6, 0xb8, 0x9c, 0xb1, 0x0b, 0x27, 0x1a, 0xa0, 0x5d, 0x99, 0x4b, 0xb5, 0x70, 0x8b, 0x23, 0xab, 0x32, 0x7e, 0xcb, 0x93, 0xc0, 0xf3, 0x15, 0x68, 0x69, 0xf0, 0x88, 0x3d, 0xa2, 0x06, 0x4f, 0x79, 0x5e, 0x0e, 0x2a, 0xb7, 0xd3, 0xc6, 0x4d, 0x61, 0xd2, 0x30, 0x3f, 0xc3, 0xa2, 0x9e, 0x16, 0x19, 0x92, 0x3c, 0xa8, 0x01, 0xe5, 0x9f, 0xd7, 0x52, 0xca, 0x6e, 0x76, 0x49, 0xd3, 0x03, 0xc9, 0xd2, 0x07, 0x88, 0xe1, 0x21, 0x46, 0x51, 0xb0, 0x69, 0x95, 0xeb, 0x26, 0x0c, 0x92, 0x9a, 0x13, 0x44, 0xa8, 0x49, 0xb2, 0x5c, 0xa0, 0xa0, 0x1f, 0x1e, 0xb5, 0x29, 0x13, 0x68, 0x6b, 0xba, 0x61, 0x9e, 0x23, 0x71, 0x44, 0x64, 0x03, 0x1a, 0x78, 0x43, 0x92, 0x87, 0xfc, 0xa7, 0x8f, 0x4c, 0x04, 0x76, 0x22, 0x3e, 0xea, 0x61, 0xb7, 0xf2, 0x5a, 0x7c, 0xe4, 0x2c, 0xca, 0x90, 0x1b, 0x2a, 0xea, 0x12, 0x98, 0x17, 0x89, 0x4b, 0xa3, 0x47, 0x08, 0x23, 0x85, 0x4f, 0x3e, 0x5b, 0x28, 0xd8, 0x6b, 0xa9, 0x79, 0xe5, 0x46, 0x71, 0x86, 0x2d, 0x90, 0x47, 0x0b, 0x1e, 0x78, 0x38, 0x97, 0x2a, 0x81, 0xa4, 0x81, 0x07, 0xd6, 0xac, 0x06, 0x11, 0x40, 0x6b, 0x21, 0xfb, 0xcc, 0xe1, 0xdb, 0x77, 0x02, 0xea, 0x9d, 0xd6, 0xba, 0x6e, 0x40, 0x52, 0x7b, 0x9d, 0xc6, 0x63, 0xf3, 0xc9, 0x3b, 0xad, 0x05, 0x6d, 0xc2, 0x85, 0x11, 0xf6, 0x6c, 0x3e, 0x0b, 0x92, 0x8d, 0xb8, 0x87, 0x9d, 0x22, 0xc5, 0x92, 0x68, 0x5c, 0xc7, 0x75, 0xa6, 0xcd, 0x57, 0x4a, 0xc3, 0xbc, 0xe3, 0xb2, 0x75, 0x91, 0xc8, 0x21, 0x92, 0x90, 0x76, 0x35, 0x8a, 0x22, 0x00, 0xb3, 0x77, 0x36, 0x5f, 0x7e, 0xfb, 0x9e, 0x40, 0xc3, 0xbf, 0x0f, 0xf0, 0x43, 0x29, 0x86, 0xae, 0x4b, 0xc1, 0xa2, 0x42, 0xce, 0x99, 0x21, 0xaa, 0x9e, 0x22, 0x44, 0x88, 0x19, 0x58, 0x5d, 0xea, 0x30, 0x8e, 0xb0, 0x39 }; static const uint8_t ml_kem_768_pubkey[] = { 0xa8, 0xe6, 0x51, 0xa1, 0xe6, 0x85, 0xf2, 0x24, 0x78, 0xa8, 0x95, 0x4f, 0x00, 0x7b, 0xc7, 0x71, 0x1b, 0x93, 0x07, 0x72, 0xc7, 0x8f, 0x09, 0x2e, 0x82, 0x87, 0x8e, 0x3e, 0x93, 0x7f, 0x36, 0x79, 0x67, 0x53, 0x29, 0x13, 0xa8, 0xd5, 0x3d, 0xfd, 0xf4, 0xbf, 0xb1, 0xf8, 0x84, 0x67, 0x46, 0x59, 0x67, 0x05, 0xcf, 0x34, 0x51, 0x42, 0xb9, 0x72, 0xa3, 0xf1, 0x63, 0x25, 0xc4, 0x0c, 0x29, 0x52, 0xa3, 0x7b, 0x25, 0x89, 0x7e, 0x5e, 0xf3, 0x5f, 0xba, 0xeb, 0x73, 0xa4, 0xac, 0xbe, 0xb6, 0xa0, 0xb8, 0x99, 0x42, 0xce, 0xb1, 0x95, 0x53, 0x1c, 0xfc, 0x0a, 0x07, 0x99, 0x39, 0x54, 0x48, 0x3e, 0x6c, 0xbc, 0x87, 0xc0, 0x6a, 0xa7, 0x4f, 0xf0, 0xca, 0xc5, 0x20, 0x7e, 0x53, 0x5b, 0x26, 0x0a, 0xa9, 0x8d, 0x11, 0x98, 0xc0, 0x7d, 0xa6, 0x05, 0xc4, 0xd1, 0x10, 0x20, 0xf6, 0xc9, 0xf7, 0xbb, 0x68, 0xbb, 0x34, 0x56, 0xc7, 0x3a, 0x01, 0xb7, 0x10, 0xbc, 0x99, 0xd1, 0x77, 0x39, 0xa5, 0x17, 0x16, 0xaa, 0x01, 0x66, 0x0c, 0x8b, 0x62, 0x8b, 0x2f, 0x56, 0x02, 0xba, 0x65, 0xf0, 0x7e, 0xa9, 0x93, 0x33, 0x6e, 0x89, 0x6e, 0x83, 0xf2, 0xc5, 0x73, 0x1b, 0xbf, 0x03, 0x46, 0x0c, 0x5b, 0x6c, 0x8a, 0xfe, 0xcb, 0x74, 0x8e, 0xe3, 0x91, 0xe9, 0x89, 0x34, 0xa2, 0xc5, 0x7d, 0x4d, 0x06, 0x9f, 0x50, 0xd8, 0x8b, 0x30, 0xd6, 0x96, 0x6f, 0x38, 0xc3, 0x7b, 0xc6, 0x49, 0xb8, 0x26, 0x34, 0xce, 0x77, 0x22, 0x64, 0x5c, 0xcd, 0x62, 0x50, 0x63, 0x36, 0x46, 0x46, 0xd6, 0xd6, 0x99, 0xdb, 0x57, 0xb4, 0x5e, 0xb6, 0x74, 0x65, 0xe1, 0x6d, 0xe4, 0xd4, 0x06, 0xa8, 0x18, 0xb9, 0xea, 0xe1, 0xca, 0x91, 0x6a, 0x25, 0x94, 0x48, 0x97, 0x08, 0xa4, 0x3c, 0xea, 0x88, 0xb0, 0x2a, 0x4c, 0x03, 0xd0, 0x9b, 0x44, 0x81, 0x5c, 0x97, 0x10, 0x1c, 0xaf, 0x50, 0x48, 0xbb, 0xcb, 0x24, 0x7a, 0xe2, 0x36, 0x6c, 0xdc, 0x25, 0x4b, 0xa2, 0x21, 0x29, 0xf4, 0x5b, 0x3b, 0x0e, 0xb3, 0x99, 0xca, 0x91, 0xa3, 0x03, 0x40, 0x28, 0x30, 0xec, 0x01, 0xdb, 0x7b, 0x2c, 0xa4, 0x80, 0xcf, 0x35, 0x04, 0x09, 0xb2, 0x16, 0x09, 0x4b, 0x7b, 0x0c, 0x3a, 0xe3, 0x3c, 0xe1, 0x0a, 0x91, 0x24, 0xe8, 0x96, 0x51, 0xab, 0x90, 0x1e, 0xa2, 0x53, 0xc8, 0x41, 0x5b, 0xd7, 0x82, 0x5f, 0x02, 0xbb, 0x22, 0x93, 0x69, 0xaf, 0x97, 0x20, 0x28, 0xf2, 0x28, 0x75, 0xea, 0x55, 0xaf, 0x16, 0xd3, 0xbc, 0x69, 0xf7, 0x0c, 0x2e, 0xe8, 0xb7, 0x5f, 0x28, 0xb4, 0x7d, 0xd3, 0x91, 0xf9, 0x89, 0xad, 0xe3, 0x14, 0x72, 0x9c, 0x33, 0x1f, 0xa0, 0x4c, 0x19, 0x17, 0xb2, 0x78, 0xc3, 0xeb, 0x60, 0x28, 0x68, 0x51, 0x28, 0x21, 0xad, 0xc8, 0x25, 0xc6, 0x45, 0x77, 0xce, 0x1e, 0x63, 0xb1, 0xd9, 0x64, 0x4a, 0x61, 0x29, 0x48, 0xa3, 0x48, 0x3c, 0x7f, 0x1b, 0x9a, 0x25, 0x80, 0x00, 0xe3, 0x01, 0x96, 0x94, 0x4a, 0x40, 0x36, 0x27, 0x60, 0x9c, 0x76, 0xc7, 0xea, 0x6b, 0x5d, 0xe0, 0x17, 0x64, 0xd2, 0x43, 0x79, 0x11, 0x7b, 0x9e, 0xa2, 0x98, 0x48, 0xdc, 0x55, 0x5c, 0x45, 0x4b, 0xce, 0xae, 0x1b, 0xa5, 0xcc, 0x72, 0xc7, 0x4a, 0xb9, 0x6b, 0x9c, 0x91, 0xb9, 0x10, 0xd2, 0x6b, 0x88, 0xb2, 0x56, 0x39, 0xd4, 0x77, 0x8a, 0xe2, 0x6c, 0x7c, 0x61, 0x51, 0xa1, 0x9c, 0x6c, 0xd7, 0x93, 0x84, 0x54, 0x37, 0x24, 0x65, 0xe4, 0xc5, 0xec, 0x29, 0x24, 0x5a, 0xcb, 0x3d, 0xb5, 0x37, 0x9d, 0xe3, 0xda, 0xbf, 0xa6, 0x29, 0xa7, 0xc0, 0x4a, 0x83, 0x53, 0xa8, 0x53, 0x0c, 0x95, 0xac, 0xb7, 0x32, 0xbb, 0x4b, 0xb8, 0x19, 0x32, 0xbb, 0x2c, 0xa7, 0xa8, 0x48, 0xcd, 0x36, 0x68, 0x01, 0x44, 0x4a, 0xbe, 0x23, 0xc8, 0x3b, 0x36, 0x6a, 0x87, 0xd6, 0xa3, 0xcf, 0x36, 0x09, 0x24, 0xc0, 0x02, 0xba, 0xe9, 0x0a, 0xf6, 0x5c, 0x48, 0x06, 0x0b, 0x37, 0x52, 0xf2, 0xba, 0xdf, 0x1a, 0xb2, 0x72, 0x20, 0x72, 0x55, 0x4a, 0x50, 0x59, 0x75, 0x35, 0x94, 0xe6, 0xa7, 0x02, 0x76, 0x1f, 0xc9, 0x76, 0x84, 0xc8, 0xc4, 0xa7, 0x54, 0x0a, 0x6b, 0x07, 0xfb, 0xc9, 0xde, 0x87, 0xc9, 0x74, 0xaa, 0x88, 0x09, 0xd9, 0x28, 0xc7, 0xf4, 0xcb, 0xbf, 0x80, 0x45, 0xae, 0xa5, 0xbc, 0x66, 0x78, 0x25, 0xfd, 0x05, 0xa5, 0x21, 0xf1, 0xa4, 0xbf, 0x53, 0x92, 0x10, 0xc7, 0x11, 0x3b, 0xc3, 0x7b, 0x3e, 0x58, 0xb0, 0xcb, 0xfc, 0x53, 0xc8, 0x41, 0xcb, 0xb0, 0x37, 0x1d, 0xe2, 0xe5, 0x11, 0xb9, 0x89, 0xcb, 0x7c, 0x70, 0xc0, 0x23, 0x36, 0x6d, 0x78, 0xf9, 0xc3, 0x7e, 0xf0, 0x47, 0xf8, 0x72, 0x0b, 0xe1, 0xc7, 0x59, 0xa8, 0xd9, 0x6b, 0x93, 0xf6, 0x5a, 0x94, 0x11, 0x4f, 0xfa, 0xf6, 0x0d, 0x9a, 0x81, 0x79, 0x5e, 0x99, 0x5c, 0x71, 0x15, 0x2a, 0x46, 0x91, 0xa5, 0xa6, 0x02, 0xa9, 0xe1, 0xf3, 0x59, 0x9e, 0x37, 0xc7, 0x68, 0xc7, 0xbc, 0x10, 0x89, 0x94, 0xc0, 0x66, 0x9f, 0x3a, 0xdc, 0x95, 0x7d, 0x46, 0xb4, 0xb6, 0x25, 0x69, 0x68, 0xe2, 0x90, 0xd7, 0x89, 0x2e, 0xa8, 0x54, 0x64, 0xee, 0x7a, 0x75, 0x0f, 0x39, 0xc5, 0xe3, 0x15, 0x2c, 0x2d, 0xfc, 0x56, 0xd8, 0xb0, 0xc9, 0x24, 0xba, 0x8a, 0x95, 0x9a, 0x68, 0x09, 0x65, 0x47, 0xf6, 0x64, 0x23, 0xc8, 0x38, 0x98, 0x2a, 0x57, 0x94, 0xb9, 0xe1, 0x53, 0x37, 0x71, 0x33, 0x1a, 0x9a, 0x65, 0x6c, 0x28, 0x82, 0x8b, 0xeb, 0x91, 0x26, 0xa6, 0x0e, 0x95, 0xe8, 0xc5, 0xd9, 0x06, 0x83, 0x2c, 0x77, 0x10, 0x70, 0x55, 0x76, 0xb1, 0xfb, 0x95, 0x07, 0x26, 0x9d, 0xda, 0xf8, 0xc9, 0x5c, 0xe9, 0x71, 0x9b, 0x2c, 0xa8, 0xdd, 0x11, 0x2b, 0xe1, 0x0b, 0xcc, 0x9f, 0x4a, 0x37, 0xbd, 0x1b, 0x1e, 0xee, 0xb3, 0x3e, 0xcd, 0xa7, 0x6a, 0xe9, 0xf6, 0x9a, 0x5d, 0x4b, 0x29, 0x23, 0xa8, 0x69, 0x57, 0x67, 0x1d, 0x61, 0x93, 0x35, 0xbe, 0x1c, 0x4c, 0x2c, 0x77, 0xce, 0x87, 0xc4, 0x1f, 0x98, 0xa8, 0xcc, 0x46, 0x64, 0x60, 0xfa, 0x30, 0x0a, 0xaf, 0x5b, 0x30, 0x1f, 0x0a, 0x1d, 0x09, 0xc8, 0x8e, 0x65, 0xda, 0x4d, 0x8e, 0xe6, 0x4f, 0x68, 0xc0, 0x21, 0x89, 0xbb, 0xb3, 0x58, 0x4b, 0xaf, 0xf7, 0x16, 0xc8, 0x5d, 0xb6, 0x54, 0x04, 0x8a, 0x00, 0x43, 0x33, 0x48, 0x93, 0x93, 0xa0, 0x74, 0x27, 0xcd, 0x3e, 0x21, 0x7e, 0x6a, 0x34, 0x5f, 0x6c, 0x2c, 0x2b, 0x13, 0xc2, 0x7b, 0x33, 0x72, 0x71, 0xc0, 0xb2, 0x7b, 0x2d, 0xba, 0xa0, 0x0d, 0x23, 0x76, 0x00, 0xb5, 0xb5, 0x94, 0xe8, 0xcf, 0x2d, 0xd6, 0x25, 0xea, 0x76, 0xcf, 0x0e, 0xd8, 0x99, 0x12, 0x2c, 0x97, 0x96, 0xb4, 0xb0, 0x18, 0x70, 0x04, 0x25, 0x80, 0x49, 0xa4, 0x77, 0xcd, 0x11, 0xd6, 0x8c, 0x49, 0xb9, 0xa0, 0xe7, 0xb0, 0x0b, 0xce, 0x8c, 0xac, 0x78, 0x64, 0xcb, 0xb3, 0x75, 0x14, 0x00, 0x84, 0x74, 0x4c, 0x93, 0x06, 0x26, 0x94, 0xca, 0x79, 0x5c, 0x4f, 0x40, 0xe7, 0xac, 0xc9, 0xc5, 0xa1, 0x88, 0x40, 0x72, 0xd8, 0xc3, 0x8d, 0xaf, 0xb5, 0x01, 0xee, 0x41, 0x84, 0xdd, 0x5a, 0x81, 0x9e, 0xc2, 0x4e, 0xc1, 0x65, 0x12, 0x61, 0xf9, 0x62, 0xb1, 0x7a, 0x72, 0x15, 0xaa, 0x4a, 0x74, 0x8c, 0x15, 0x83, 0x6c, 0x38, 0x91, 0x37, 0x67, 0x82, 0x04, 0x83, 0x8d, 0x71, 0x95, 0xa8, 0x5b, 0x4f, 0x98, 0xa1, 0xb5, 0x74, 0xc4, 0xcd, 0x79, 0x09, 0xcd, 0x1f, 0x83, 0x3e, 0xff, 0xd1, 0x48, 0x55, 0x43, 0x22, 0x9d, 0x37, 0x48, 0xd9, 0xb5, 0xcd, 0x6c, 0x17, 0xb9, 0xb3, 0xb8, 0x4a, 0xef, 0x8b, 0xce, 0x13, 0xe6, 0x83, 0x73, 0x36, 0x59, 0xc7, 0x95, 0x42, 0xd6, 0x15, 0x78, 0x2a, 0x71, 0xcd, 0xee, 0xe7, 0x92, 0xba, 0xb5, 0x1b, 0xdc, 0x4b, 0xbf, 0xe8, 0x30, 0x8e, 0x66, 0x31, 0x44, 0xed, 0xe8, 0x49, 0x18, 0x30, 0xad, 0x98, 0xb4, 0x63, 0x4f, 0x64, 0xab, 0xa8, 0xb9, 0xc0, 0x42, 0x27, 0x26, 0x53, 0x92, 0x0f, 0x38, 0x0c, 0x1a, 0x17, 0xca, 0x87, 0xce, 0xd7, 0xaa, 0xc4, 0x1c, 0x82, 0x88, 0x87, 0x93, 0x18, 0x1a, 0x6f, 0x76, 0xe1, 0x97, 0xb7, 0xb9, 0x0e, 0xf9, 0x09, 0x43, 0xbb, 0x38, 0x44, 0x91, 0x29, 0x11, 0xd8, 0x55, 0x1e, 0x54, 0x66, 0xc5, 0x76, 0x7a, 0xb0, 0xbc, 0x61, 0xa1, 0xa3, 0xf7, 0x36, 0x16, 0x2e, 0xc0, 0x98, 0xa9, 0x00, 0xb1, 0x2d, 0xd8, 0xfa, 0xbb, 0xfb, 0x3f, 0xe8, 0xcb, 0x1d, 0xc4, 0xe8, 0x31, 0x5f, 0x2a, 0xf0, 0xd3, 0x2f, 0x00, 0x17, 0xae, 0x13, 0x6e, 0x19, 0xf0, 0x28 }; static const uint8_t ml_kem_1024_pubkey[] = { 0x53, 0x79, 0x11, 0x95, 0x7c, 0x12, 0x51, 0x48, 0xa8, 0x7f, 0x41, 0x58, 0x9c, 0xb2, 0x22, 0xd0, 0xd1, 0x92, 0x29, 0xe2, 0xcb, 0x55, 0xe1, 0xa0, 0x44, 0x79, 0x1e, 0x7c, 0xa6, 0x11, 0x92, 0xa4, 0x64, 0x60, 0xc3, 0x18, 0x3d, 0x2b, 0xcd, 0x6d, 0xe0, 0x8a, 0x5e, 0x76, 0x51, 0x60, 0x3a, 0xcc, 0x34, 0x9c, 0xa1, 0x6c, 0xba, 0x18, 0xab, 0xb2, 0x3a, 0x3e, 0x8c, 0x33, 0x0d, 0x74, 0x21, 0x59, 0x8a, 0x62, 0x78, 0xec, 0x7e, 0xbf, 0xab, 0xca, 0x0e, 0xf4, 0x88, 0xb2, 0x29, 0x05, 0x54, 0x75, 0x34, 0x99, 0xc0, 0x45, 0x2e, 0x45, 0x38, 0x15, 0x30, 0x99, 0x55, 0xb8, 0x15, 0x0f, 0xa1, 0xa1, 0xe3, 0x93, 0x38, 0x6d, 0xc1, 0x2f, 0xdb, 0x27, 0xb3, 0x8c, 0x67, 0x45, 0xf2, 0x94, 0x40, 0x16, 0xec, 0x45, 0x7f, 0x39, 0xb1, 0x8d, 0x60, 0x4a, 0x07, 0xa1, 0xab, 0xe0, 0x7b, 0xc8, 0x44, 0x05, 0x0f, 0xfa, 0x8a, 0x06, 0xfa, 0x15, 0x4a, 0x49, 0xd8, 0x8f, 0xac, 0x77, 0x54, 0x52, 0xd6, 0xa7, 0xc0, 0xe5, 0x89, 0xbf, 0xb5, 0xc3, 0x70, 0xc2, 0xc4, 0xb6, 0x20, 0x1d, 0xda, 0x80, 0xc9, 0xab, 0x20, 0x76, 0xec, 0xc0, 0x8b, 0x44, 0x52, 0x2f, 0xda, 0x33, 0x26, 0xf0, 0x33, 0x80, 0x6d, 0xd2, 0x69, 0x3f, 0x31, 0x97, 0x39, 0xf4, 0x0c, 0x4f, 0x42, 0xb2, 0x4a, 0xca, 0x70, 0x98, 0xfb, 0x8f, 0xf5, 0xf9, 0xac, 0x20, 0x29, 0x2d, 0x02, 0xb5, 0x6a, 0xc7, 0x46, 0x80, 0x1a, 0xcc, 0xcc, 0x84, 0x86, 0x3d, 0xee, 0x32, 0x87, 0x84, 0x97, 0xb6, 0x94, 0x38, 0xbf, 0x99, 0x17, 0x76, 0x28, 0x66, 0x50, 0x48, 0x2c, 0x8d, 0x9d, 0x95, 0x87, 0xbc, 0x6a, 0x55, 0xb8, 0x5c, 0x4d, 0x7f, 0xa7, 0x4d, 0x02, 0x65, 0x6b, 0x42, 0x1c, 0x9e, 0x23, 0xe0, 0x3a, 0x48, 0xd4, 0xb7, 0x44, 0x25, 0xc2, 0x6e, 0x4a, 0x20, 0xdd, 0x95, 0x62, 0xa4, 0xda, 0x07, 0x93, 0xf3, 0xa3, 0x52, 0xcc, 0xc0, 0xf1, 0x82, 0x17, 0xd8, 0x68, 0xc7, 0xf5, 0x00, 0x2a, 0xbe, 0x76, 0x8b, 0x1f, 0xc7, 0x3f, 0x05, 0x74, 0x4e, 0x7c, 0xc2, 0x8f, 0x10, 0x34, 0x40, 0x62, 0xc1, 0x0e, 0x08, 0xec, 0xcc, 0xed, 0x3c, 0x1f, 0x7d, 0x39, 0x2c, 0x01, 0xd9, 0x79, 0xdd, 0x71, 0x8d, 0x83, 0x98, 0x37, 0x46, 0x65, 0xa1, 0x6a, 0x98, 0x70, 0x58, 0x5c, 0x39, 0xd5, 0x58, 0x9a, 0x50, 0xe1, 0x33, 0x38, 0x9c, 0x9b, 0x9a, 0x27, 0x6c, 0x02, 0x42, 0x60, 0xd9, 0xfc, 0x77, 0x11, 0xc8, 0x1b, 0x63, 0x37, 0xb5, 0x7d, 0xa3, 0xc3, 0x76, 0xd0, 0xcd, 0x74, 0xe1, 0x4c, 0x73, 0x72, 0x7b, 0x27, 0x66, 0x56, 0xb9, 0xd8, 0xa4, 0xeb, 0x71, 0x89, 0x6f, 0xf5, 0x89, 0xd4, 0xb8, 0x93, 0xe7, 0x11, 0x0f, 0x3b, 0xb9, 0x48, 0xec, 0xe2, 0x91, 0xdd, 0x86, 0xc0, 0xb7, 0x46, 0x8a, 0x67, 0x8c, 0x74, 0x69, 0x80, 0xc1, 0x2a, 0xa6, 0xb9, 0x5e, 0x2b, 0x0c, 0xbe, 0x43, 0x31, 0xbb, 0x24, 0xa3, 0x3a, 0x27, 0x01, 0x53, 0xaa, 0x47, 0x2c, 0x47, 0x31, 0x23, 0x82, 0xca, 0x36, 0x5c, 0x5f, 0x35, 0x25, 0x9d, 0x02, 0x57, 0x46, 0xfc, 0x65, 0x95, 0xfe, 0x63, 0x6c, 0x76, 0x75, 0x10, 0xa6, 0x9c, 0x1e, 0x8a, 0x17, 0x6b, 0x79, 0x49, 0x95, 0x8f, 0x26, 0x97, 0x39, 0x94, 0x97, 0xa2, 0xfc, 0x73, 0x64, 0xa1, 0x2c, 0x81, 0x98, 0x29, 0x52, 0x39, 0xc8, 0x26, 0xcb, 0x50, 0x82, 0x08, 0x60, 0x77, 0x28, 0x2e, 0xd6, 0x28, 0x65, 0x1f, 0xc0, 0x4c, 0x63, 0x9b, 0x43, 0x85, 0x22, 0xa9, 0xde, 0x30, 0x9b, 0x14, 0xb0, 0x86, 0xd6, 0xe9, 0x23, 0xc5, 0x51, 0x62, 0x3b, 0xd7, 0x2a, 0x73, 0x3c, 0xb0, 0xda, 0xbc, 0x54, 0xa9, 0x41, 0x6a, 0x99, 0xe7, 0x2c, 0x9f, 0xda, 0x1c, 0xb3, 0xfb, 0x9b, 0xa0, 0x6b, 0x8a, 0xdb, 0x24, 0x22, 0xd6, 0x8c, 0xad, 0xc5, 0x53, 0xc9, 0x82, 0x02, 0xa1, 0x76, 0x56, 0x47, 0x8a, 0xc0, 0x44, 0xef, 0x34, 0x56, 0x37, 0x8a, 0xbc, 0xe9, 0x99, 0x1e, 0x01, 0x41, 0xba, 0x79, 0x09, 0x4f, 0xa8, 0xf7, 0x7a, 0x30, 0x08, 0x05, 0xd2, 0xd3, 0x2f, 0xfc, 0x62, 0xbf, 0x0c, 0xa4, 0x55, 0x4c, 0x33, 0x0c, 0x2b, 0xb7, 0x04, 0x2d, 0xb3, 0x51, 0x02, 0xf6, 0x8b, 0x1a, 0x00, 0x62, 0x58, 0x38, 0x65, 0x38, 0x1c, 0x74, 0xdd, 0x91, 0x3a, 0xf7, 0x0b, 0x26, 0xcf, 0x09, 0x23, 0xd0, 0xc4, 0xcb, 0x97, 0x16, 0x92, 0x22, 0x25, 0x52, 0xa8, 0xf4, 0xb7, 0x88, 0xb4, 0xaf, 0xd1, 0x34, 0x1a, 0x9d, 0xf4, 0x15, 0xcf, 0x20, 0x39, 0x00, 0xf5, 0xcc, 0xf7, 0xf6, 0x59, 0x88, 0x94, 0x9a, 0x75, 0x58, 0x0d, 0x04, 0x96, 0x39, 0x85, 0x31, 0x00, 0x85, 0x4b, 0x21, 0xf4, 0x01, 0x80, 0x03, 0x50, 0x2b, 0xb1, 0xba, 0x95, 0xf5, 0x56, 0xa5, 0xd6, 0x7c, 0x7e, 0xb5, 0x24, 0x10, 0xeb, 0xa2, 0x88, 0xa6, 0xd0, 0x63, 0x5c, 0xa8, 0xa4, 0xf6, 0xd6, 0x96, 0xd0, 0xa0, 0x20, 0xc8, 0x26, 0x93, 0x8d, 0x34, 0x94, 0x3c, 0x38, 0x08, 0xc7, 0x9c, 0xc0, 0x07, 0x76, 0x85, 0x33, 0x21, 0x6b, 0xc1, 0xb2, 0x9d, 0xa6, 0xc8, 0x12, 0xef, 0xf3, 0x34, 0x0b, 0xaa, 0x8d, 0x2e, 0x65, 0x34, 0x4f, 0x09, 0xbd, 0x47, 0x89, 0x4f, 0x5a, 0x3a, 0x41, 0x18, 0x71, 0x5b, 0x3c, 0x50, 0x20, 0x67, 0x93, 0x27, 0xf9, 0x18, 0x9f, 0x7e, 0x10, 0x85, 0x6b, 0x23, 0x8b, 0xb9, 0xb0, 0xab, 0x4c, 0xa8, 0x5a, 0xbf, 0x4b, 0x21, 0xf5, 0xc7, 0x6b, 0xcc, 0xd7, 0x18, 0x50, 0xb2, 0x2e, 0x04, 0x59, 0x28, 0x27, 0x6a, 0x0f, 0x2e, 0x95, 0x1d, 0xb0, 0x70, 0x7c, 0x6a, 0x11, 0x6d, 0xc1, 0x91, 0x13, 0xfa, 0x76, 0x2d, 0xc5, 0xf2, 0x0b, 0xd5, 0xd2, 0xab, 0x5b, 0xe7, 0x17, 0x44, 0xdc, 0x9c, 0xbd, 0xb5, 0x1e, 0xa7, 0x57, 0x96, 0x3a, 0xac, 0x56, 0xa9, 0x0a, 0x0d, 0x80, 0x23, 0xbe, 0xd1, 0xf5, 0xca, 0xe8, 0xa6, 0x4d, 0xa0, 0x47, 0x27, 0x9b, 0x35, 0x3a, 0x09, 0x6a, 0x83, 0x5b, 0x0b, 0x2b, 0x02, 0x3b, 0x6a, 0xa0, 0x48, 0x98, 0x92, 0x33, 0x07, 0x9a, 0xeb, 0x46, 0x7e, 0x52, 0x2f, 0xa2, 0x7a, 0x58, 0x22, 0x92, 0x1e, 0x5c, 0x55, 0x1b, 0x4f, 0x53, 0x75, 0x36, 0xe4, 0x6f, 0x3a, 0x6a, 0x97, 0xe7, 0x2c, 0x3b, 0x06, 0x31, 0x04, 0xe0, 0x9a, 0x04, 0x05, 0x98, 0x94, 0x0d, 0x87, 0x2f, 0x6d, 0x87, 0x1f, 0x5e, 0xf9, 0xb4, 0x35, 0x50, 0x73, 0xb5, 0x47, 0x69, 0xe4, 0x54, 0x54, 0xe6, 0xa0, 0x81, 0x95, 0x99, 0x40, 0x86, 0x21, 0xab, 0x44, 0x13, 0xb3, 0x55, 0x07, 0xb0, 0xdf, 0x57, 0x8c, 0xe2, 0xd5, 0x11, 0xd5, 0x20, 0x58, 0xd5, 0x74, 0x9d, 0xf3, 0x8b, 0x29, 0xd6, 0xcc, 0x58, 0x87, 0x0c, 0xaf, 0x92, 0xf6, 0x9a, 0x75, 0x16, 0x14, 0x06, 0xe7, 0x1c, 0x5f, 0xf9, 0x24, 0x51, 0xa7, 0x75, 0x22, 0xb8, 0xb2, 0x96, 0x7a, 0x2d, 0x58, 0xa4, 0x9a, 0x81, 0x66, 0x1a, 0xa6, 0x5a, 0xc0, 0x9b, 0x08, 0xc9, 0xfe, 0x45, 0xab, 0xc3, 0x85, 0x1f, 0x99, 0xc7, 0x30, 0xc4, 0x50, 0x03, 0xac, 0xa2, 0xbf, 0x0f, 0x84, 0x24, 0xa1, 0x9b, 0x74, 0x08, 0xa5, 0x37, 0xd5, 0x41, 0xc1, 0x6f, 0x56, 0x82, 0xbf, 0xe3, 0xa7, 0xfa, 0xea, 0x56, 0x4f, 0x12, 0x98, 0x61, 0x1a, 0x7f, 0x5f, 0x60, 0x92, 0x2b, 0xa1, 0x9d, 0xe7, 0x3b, 0x19, 0x17, 0xf1, 0x85, 0x32, 0x73, 0x55, 0x51, 0x99, 0xa6, 0x49, 0x31, 0x8b, 0x50, 0x77, 0x33, 0x45, 0xc9, 0x97, 0x46, 0x08, 0x56, 0x97, 0x2a, 0xcb, 0x43, 0xfc, 0x81, 0xab, 0x63, 0x21, 0xb1, 0xc3, 0x3c, 0x2b, 0xb5, 0x09, 0x8b, 0xd4, 0x89, 0xd6, 0x96, 0xa0, 0xf7, 0x06, 0x79, 0xc1, 0x21, 0x38, 0x73, 0xd0, 0x8b, 0xda, 0xd4, 0x28, 0x44, 0x92, 0x72, 0x16, 0x04, 0x72, 0x05, 0x63, 0x32, 0x12, 0x31, 0x0e, 0xe9, 0xa0, 0x6c, 0xb1, 0x00, 0x16, 0xc8, 0x05, 0x50, 0x3c, 0x34, 0x1a, 0x36, 0xd8, 0x7e, 0x56, 0x07, 0x2e, 0xab, 0xe2, 0x37, 0x31, 0xe3, 0x4a, 0xf7, 0xe2, 0x32, 0x8f, 0x85, 0xcd, 0xb3, 0x70, 0xcc, 0xaf, 0x00, 0x51, 0x5b, 0x64, 0xc9, 0xc5, 0x4b, 0xc8, 0x37, 0x57, 0x84, 0x47, 0xaa, 0xcf, 0xae, 0xd5, 0x96, 0x9a, 0xa3, 0x51, 0xe7, 0xda, 0x4e, 0xfa, 0x7b, 0x11, 0x5c, 0x4c, 0x51, 0xf4, 0xa6, 0x99, 0x77, 0x98, 0x50, 0x29, 0x5c, 0xa7, 0x2d, 0x78, 0x1a, 0xd4, 0x1b, 0xc6, 0x80, 0x53, 0x2b, 0x89, 0xe7, 0x10, 0xe2, 0x18, 0x9e, 0xb3, 0xc5, 0x08, 0x17, 0xba, 0x25, 0x5c, 0x74, 0x74, 0xc9, 0x5c, 0xa9, 0x11, 0x0c, 0xc4, 0x3b, 0x8b, 0xa8, 0xe6, 0x82, 0xc7, 0xfb, 0x7b, 0x0f, 0xdc, 0x26, 0x5c, 0x04, 0x83, 0xa6, 0x5c, 0xa4, 0x51, 0x4e, 0xe4, 0xb8, 0x32, 0xaa, 0xc5, 0x80, 0x0c, 0x3b, 0x08, 0xe7, 0x4f, 0x56, 0x39, 0x51, 0xc1, 0xfb, 0xb2, 0x10, 0x35, 0x3e, 0xfa, 0x1a, 0xa8, 0x66, 0x85, 0x6b, 0xc1, 0xe0, 0x34, 0x73, 0x3b, 0x04, 0x85, 0xda, 0xb1, 0xd0, 0x20, 0xc6, 0xbf, 0x76, 0x5f, 0xf6, 0x0b, 0x3b, 0x80, 0x19, 0x84, 0xa9, 0x0c, 0x2f, 0xe9, 0x70, 0xbf, 0x1d, 0xe9, 0x70, 0x04, 0xa6, 0xcf, 0x44, 0xb4, 0x98, 0x4a, 0xb5, 0x82, 0x58, 0xb4, 0xaf, 0x71, 0x22, 0x1c, 0xd1, 0x75, 0x30, 0xa7, 0x00, 0xc3, 0x29, 0x59, 0xc9, 0x43, 0x63, 0x44, 0xb5, 0x31, 0x6f, 0x09, 0xcc, 0xca, 0x70, 0x29, 0xa2, 0x30, 0xd6, 0x39, 0xdc, 0xb0, 0x22, 0xd8, 0xba, 0x79, 0xba, 0x91, 0xcd, 0x6a, 0xb1, 0x2a, 0xe1, 0x57, 0x9c, 0x50, 0xc7, 0xbb, 0x10, 0xe3, 0x03, 0x01, 0xa6, 0x5c, 0xae, 0x31, 0x01, 0xd4, 0x0c, 0x7b, 0xa9, 0x27, 0xbb, 0x55, 0x31, 0x48, 0xd1, 0x64, 0x70, 0x24, 0xd4, 0xa0, 0x6c, 0x81, 0x66, 0xd0, 0xb0, 0xb8, 0x12, 0x69, 0xb7, 0xd5, 0xf4, 0xb3, 0x4f, 0xb0, 0x22, 0xf6, 0x91, 0x52, 0xf5, 0x14, 0x00, 0x4a, 0x7c, 0x68, 0x53, 0x68, 0x55, 0x23, 0x43, 0xbb, 0x60, 0x36, 0x0f, 0xbb, 0x99, 0x45, 0xed, 0xf4, 0x46, 0xd3, 0x45, 0xbd, 0xca, 0xa7, 0x45, 0x5c, 0x74, 0xba, 0x0a, 0x55, 0x1e, 0x18, 0x46, 0x20, 0xfe, 0xf9, 0x76, 0x88, 0x77, 0x3d, 0x50, 0xb6, 0x43, 0x3c, 0xa7, 0xa7, 0xac, 0x5c, 0xb6, 0xb7, 0xf6, 0x71, 0xa1, 0x53, 0x76, 0xe5, 0xa6, 0x74, 0x7a, 0x62, 0x3f, 0xa7, 0xbc, 0x66, 0x30, 0x37, 0x3f, 0x5b, 0x1b, 0x51, 0x26, 0x90, 0xa6, 0x61, 0x37, 0x78, 0x70, 0xa6, 0x0a, 0x7a, 0x18, 0x96, 0x83, 0xf9, 0xb0, 0xcf, 0x04, 0x66, 0xe1, 0xf7, 0x50, 0x76, 0x26, 0x31, 0xc4, 0xab, 0x09, 0xf5, 0x05, 0xc4, 0x2d, 0xd2, 0x86, 0x33, 0x56, 0x94, 0x72, 0x73, 0x54, 0x42, 0x85, 0x1e, 0x32, 0x16, 0x16, 0xd4, 0x00, 0x98, 0x10, 0x77, 0x7b, 0x6b, 0xd4, 0x6f, 0xa7, 0x22, 0x44, 0x61, 0xa5, 0xcc, 0x27, 0x40, 0x5d, 0xfb, 0xac, 0x0d, 0x39, 0xb0, 0x02, 0xca, 0xb3, 0x34, 0x33, 0xf2, 0xa8, 0x6e, 0xb8, 0xce, 0x91, 0xc1, 0x34, 0xa6, 0x38, 0x6f, 0x86, 0x0a, 0x19, 0x94, 0xeb, 0x4b, 0x68, 0x75, 0xa4, 0x6d, 0x19, 0x55, 0x81, 0xd1, 0x73, 0x85, 0x4b, 0x53, 0xd2, 0x29, 0x3d, 0xf3, 0xe9, 0xa8, 0x22, 0x75, 0x6c, 0xd8, 0xf2, 0x12, 0xb3, 0x25, 0xca, 0x29, 0xb4, 0xf9, 0xf8, 0xcf, 0xba, 0xdf, 0x2e, 0x41, 0x86, 0x9a, 0xbf, 0xba, 0xd1, 0x07, 0x38, 0xad, 0x04, 0xcc, 0x75, 0x2b, 0xc2, 0x0c, 0x39, 0x47, 0x46, 0x85, 0x0e, 0x0c, 0x48, 0x47, 0xdb }; #endif static struct keys_st { int type; const uint8_t *priv; const uint8_t *pub; /* If "name" is non-NULL, create via non-legacy _ex() API */ char *name; int privlen; int publen; } keys[] = { { EVP_PKEY_HMAC, (const uint8_t *)"0123456789", NULL, NULL, 10, 0 }, { EVP_PKEY_HMAC, (const uint8_t *)"", NULL, NULL, 0, 0 #ifndef OPENSSL_NO_POLY1305 }, { EVP_PKEY_POLY1305, (const uint8_t *)"01234567890123456789012345678901", NULL, NULL, 32, 0 #endif #ifndef OPENSSL_NO_SIPHASH }, { EVP_PKEY_SIPHASH, (const uint8_t *)"0123456789012345", NULL, NULL, 16, 0 #endif }, #ifndef OPENSSL_NO_ECX { EVP_PKEY_X25519, (const uint8_t *)"01234567890123456789012345678901", (const unsigned char *)"abcdefghijklmnopqrstuvwxyzabcdef", NULL, 32, 32 }, { EVP_PKEY_ED25519, (const uint8_t *)"01234567890123456789012345678901", (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdef", NULL, 32, 32 }, { EVP_PKEY_X448, (const uint8_t *)"01234567890123456789012345678901234567890123456789012345", (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd", NULL, 56, 56 }, { EVP_PKEY_ED448, (const uint8_t *)"012345678901234567890123456789012345678901234567890123456", (const uint8_t *)"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde", NULL, 57, 57 }, #endif #ifndef OPENSSL_NO_ML_KEM { NID_undef, ml_kem_seed, ml_kem_512_pubkey, "ML-KEM-512", ML_KEM_SEED_BYTES, sizeof(ml_kem_512_pubkey) }, { NID_undef, ml_kem_seed, ml_kem_768_pubkey, "ML-KEM-768", ML_KEM_SEED_BYTES, sizeof(ml_kem_768_pubkey) }, { NID_undef, ml_kem_seed, ml_kem_1024_pubkey, "ML-KEM-1024", ML_KEM_SEED_BYTES, sizeof(ml_kem_1024_pubkey) }, #endif }; #ifndef OPENSSL_NO_ML_KEM static int ml_kem_seed_to_priv(const char *alg, const unsigned char *seed, size_t seedlen, unsigned char **ret, size_t *retlen) { OSSL_PARAM parr[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; EVP_PKEY_CTX *ctx = NULL; EVP_PKEY *pkey = NULL; const OSSL_PARAM *p; OSSL_PARAM *params = NULL; int selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY; int ok = 0; /* Import the seed to generate a key */ ctx = EVP_PKEY_CTX_new_from_name(testctx, alg, NULL); if (!TEST_ptr(ctx) || !TEST_int_gt(EVP_PKEY_fromdata_init(ctx), 0)) goto done; parr[0] = OSSL_PARAM_construct_octet_string( OSSL_PKEY_PARAM_ML_KEM_SEED, (unsigned char *)seed, seedlen); if (!TEST_int_gt(EVP_PKEY_fromdata(ctx, &pkey, selection, parr), 0)) goto done; /* Export the key to get the encoded form */ if (!TEST_true(EVP_PKEY_todata(pkey, OSSL_KEYMGMT_SELECT_PRIVATE_KEY, ¶ms))) goto done; p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY); if (!TEST_ptr(p) || !TEST_true(OSSL_PARAM_get_octet_string(p, (void **)ret, 0, retlen))) goto done; ok = 1; done: EVP_PKEY_free(pkey); OSSL_PARAM_free(params); EVP_PKEY_CTX_free(ctx); return ok; } #endif static int test_set_get_raw_keys_int(int tst, int pub, int uselibctx) { int ret = 0; uint8_t *buf = NULL; const uint8_t *in; uint8_t shortbuf[1]; size_t inlen, len = 0, shortlen = sizeof(shortbuf); EVP_PKEY *pkey = NULL; unsigned char *privalloc = NULL; const char *name; /* Check if this algorithm supports public keys */ if (pub && keys[tst].pub == NULL) return 1; name = keys[tst].name ? keys[tst].name : OBJ_nid2sn(keys[tst].type); if (pub) { #ifndef OPENSSL_NO_EC inlen = keys[tst].publen; in = keys[tst].pub; if (uselibctx || keys[tst].name != NULL) { pkey = EVP_PKEY_new_raw_public_key_ex( testctx, name, NULL, in, inlen); } else { pkey = EVP_PKEY_new_raw_public_key(keys[tst].type, NULL, in, inlen); } #else return 1; #endif } else { inlen = keys[tst].privlen; in = keys[tst].priv; #ifndef OPENSSL_NO_ML_KEM if (in == ml_kem_seed) { if (!TEST_true(ml_kem_seed_to_priv(name, in, inlen, &privalloc, &inlen))) goto done; in = privalloc; } #endif if (uselibctx || keys[tst].name != NULL) { pkey = EVP_PKEY_new_raw_private_key_ex( testctx, name, NULL, in, inlen); } else { pkey = EVP_PKEY_new_raw_private_key(keys[tst].type, NULL, in, inlen); } } if (!TEST_ptr(pkey) || !TEST_int_eq(EVP_PKEY_eq(pkey, pkey), 1) || (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, NULL, &len))) || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, NULL, &len))) || !TEST_true(len == inlen)) goto done; if (tst != 1) { /* * Test that supplying a buffer that is too small fails. Doesn't apply * to HMAC with a zero length key */ if ((!pub && !TEST_false(EVP_PKEY_get_raw_private_key(pkey, shortbuf, &shortlen))) || (pub && !TEST_false(EVP_PKEY_get_raw_public_key(pkey, shortbuf, &shortlen)))) goto done; } if (!TEST_ptr(buf = OPENSSL_zalloc(len <= 80 ? 80 : len))) goto done; if ((!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, buf, &len))) || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, buf, &len))) || !TEST_mem_eq(in, inlen, buf, len)) goto done; ret = 1; done: OPENSSL_free(privalloc); OPENSSL_free(buf); EVP_PKEY_free(pkey); return ret; } static int test_set_get_raw_keys(int tst) { return (nullprov != NULL || test_set_get_raw_keys_int(tst, 0, 0)) && test_set_get_raw_keys_int(tst, 0, 1) && (nullprov != NULL || test_set_get_raw_keys_int(tst, 1, 0)) && test_set_get_raw_keys_int(tst, 1, 1); } static int test_set_get_raw_keys_mfail(int idx) { const uint8_t *in; size_t inlen, len = 0; EVP_PKEY *pkey = NULL; unsigned char *buf = NULL; unsigned char *privalloc = NULL; const char *name; int ok = 0; int ret = 0; name = keys[idx].name != NULL ? keys[idx].name : OBJ_nid2sn(keys[idx].type); inlen = keys[idx].privlen; in = keys[idx].priv; #ifndef OPENSSL_NO_ML_KEM if (in == ml_kem_seed) { if (!TEST_true(ml_kem_seed_to_priv(name, in, inlen, &privalloc, &inlen))) goto err; in = privalloc; } #endif MFAIL_start(); pkey = EVP_PKEY_new_raw_private_key_ex(testctx, name, NULL, in, inlen); if (pkey != NULL && EVP_PKEY_get_raw_private_key(pkey, NULL, &len) && (buf = OPENSSL_malloc(len == 0 ? 1 : len)) != NULL && EVP_PKEY_get_raw_private_key(pkey, buf, &len)) ok = 1; MFAIL_end(); if (!ok) goto err; ret = TEST_mem_eq(in, inlen, buf, len); err: OPENSSL_free(privalloc); OPENSSL_free(buf); EVP_PKEY_free(pkey); return ret; } static int test_EVP_PKEY_check(int i) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; const APK_DATA *ak = &keycheckdata[i]; const unsigned char *input = ak->kder; size_t input_len = ak->size; int expected_id = ak->evptype; int expected_check = ak->check; int expected_pub_check = ak->pub_check; int expected_param_check = ak->param_check; int type = ak->type; if (!TEST_ptr(pkey = load_example_key(ak->keytype, input, input_len))) goto done; if (type == 0 && !TEST_int_eq(EVP_PKEY_get_id(pkey), expected_id)) goto done; if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq))) goto done; if (!TEST_int_eq(EVP_PKEY_check(ctx), expected_check)) goto done; if (!TEST_int_eq(EVP_PKEY_public_check(ctx), expected_pub_check)) goto done; if (!TEST_int_eq(EVP_PKEY_param_check(ctx), expected_param_check)) goto done; ret = 1; done: EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); return ret; } #ifndef OPENSSL_NO_CMAC static int get_cmac_val(EVP_PKEY *pkey, unsigned char *mac) { EVP_MD_CTX *mdctx = EVP_MD_CTX_new(); const char msg[] = "Hello World"; size_t maclen = AES_BLOCK_SIZE; int ret = 1; if (!TEST_ptr(mdctx) || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, NULL, testctx, testpropq, pkey, NULL)) || !TEST_true(EVP_DigestSignUpdate(mdctx, msg, sizeof(msg))) || !TEST_true(EVP_DigestSignFinal(mdctx, mac, &maclen)) || !TEST_size_t_eq(maclen, AES_BLOCK_SIZE)) ret = 0; EVP_MD_CTX_free(mdctx); return ret; } static int test_CMAC_keygen(void) { static unsigned char key[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; EVP_PKEY_CTX *kctx = NULL; int ret = 0; EVP_PKEY *pkey = NULL; unsigned char mac[AES_BLOCK_SIZE]; #if !defined(OPENSSL_NO_DEPRECATED_3_0) unsigned char mac2[AES_BLOCK_SIZE]; #endif if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); /* * This is a legacy method for CMACs, but should still work. */ kctx = EVP_PKEY_CTX_new_id(EVP_PKEY_CMAC, NULL); /* Test a CMAC key created using the "generated" method */ if (!TEST_int_gt(EVP_PKEY_keygen_init(kctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_CIPHER, 0, (void *)EVP_aes_256_cbc()), 0) || !TEST_int_gt(EVP_PKEY_CTX_ctrl(kctx, -1, EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_SET_MAC_KEY, sizeof(key), (void *)key), 0) || !TEST_int_gt(EVP_PKEY_keygen(kctx, &pkey), 0) || !TEST_ptr(pkey) || !TEST_true(get_cmac_val(pkey, mac))) goto done; #if !defined(OPENSSL_NO_DEPRECATED_3_0) EVP_PKEY_free(pkey); /* * Test a CMAC key using the direct method, and compare with the mac * created above. */ pkey = EVP_PKEY_new_CMAC_key(NULL, key, sizeof(key), EVP_aes_256_cbc()); if (!TEST_ptr(pkey) || !TEST_true(get_cmac_val(pkey, mac2)) || !TEST_mem_eq(mac, sizeof(mac), mac2, sizeof(mac2))) goto done; #endif ret = 1; done: EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(kctx); return ret; } #endif static int test_HKDF(void) { EVP_PKEY_CTX *pctx; unsigned char out[20]; size_t outlen; int i, ret = 0; unsigned char salt[] = "0123456789"; unsigned char key[] = "012345678901234567890123456789"; unsigned char info[] = "infostring"; const unsigned char expected[] = { 0xe5, 0x07, 0x70, 0x7f, 0xc6, 0x78, 0xd6, 0x54, 0x32, 0x5f, 0x7e, 0xc5, 0x7b, 0x59, 0x3e, 0xd8, 0x03, 0x6b, 0xed, 0xca }; size_t expectedlen = sizeof(expected); if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) goto done; /* We do this twice to test reuse of the EVP_PKEY_CTX */ for (i = 0; i < 2; i++) { outlen = sizeof(out); memset(out, 0, outlen); if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, sizeof(salt) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, sizeof(key) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, sizeof(info) - 1), 0) || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) || !TEST_mem_eq(out, outlen, expected, expectedlen)) goto done; } ret = 1; done: EVP_PKEY_CTX_free(pctx); return ret; } static int test_emptyikm_HKDF(void) { EVP_PKEY_CTX *pctx; unsigned char out[20]; size_t outlen; int ret = 0; unsigned char salt[] = "9876543210"; unsigned char key[] = ""; unsigned char info[] = "stringinfo"; const unsigned char expected[] = { 0x68, 0x81, 0xa5, 0x3e, 0x5b, 0x9c, 0x7b, 0x6f, 0x2e, 0xec, 0xc8, 0x47, 0x7c, 0xfa, 0x47, 0x35, 0x66, 0x82, 0x15, 0x30 }; size_t expectedlen = sizeof(expected); if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) goto done; outlen = sizeof(out); memset(out, 0, outlen); if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, sizeof(salt) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, sizeof(key) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, sizeof(info) - 1), 0) || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) || !TEST_mem_eq(out, outlen, expected, expectedlen)) goto done; ret = 1; done: EVP_PKEY_CTX_free(pctx); return ret; } static int test_empty_salt_info_HKDF(void) { EVP_PKEY_CTX *pctx; unsigned char out[20]; size_t outlen; int ret = 0; unsigned char salt[] = ""; unsigned char fake[] = "0123456789"; unsigned char key[] = "012345678901234567890123456789"; unsigned char info[] = ""; const unsigned char expected[] = { 0x67, 0x12, 0xf9, 0x27, 0x8a, 0x8a, 0x3a, 0x8f, 0x7d, 0x2c, 0xa3, 0x6a, 0xaa, 0xe9, 0xb3, 0xb9, 0x52, 0x5f, 0xe0, 0x06 }; size_t expectedlen = sizeof(expected); if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq))) goto done; outlen = sizeof(out); memset(out, 0, outlen); if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, fake, sizeof(fake) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, sizeof(salt) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key, sizeof(key) - 1), 0) || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info, sizeof(info) - 1), 0) || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0) || !TEST_mem_eq(out, outlen, expected, expectedlen)) goto done; ret = 1; done: EVP_PKEY_CTX_free(pctx); return ret; } #ifndef OPENSSL_NO_EC static int test_X509_PUBKEY_inplace(void) { int ret = 0; X509_PUBKEY *xp = X509_PUBKEY_new_ex(testctx, testpropq); const unsigned char *p = kExampleECPubKeyDER; size_t input_len = sizeof(kExampleECPubKeyDER); if (!TEST_ptr(xp)) goto done; if (!TEST_ptr(d2i_X509_PUBKEY(&xp, &p, (long)input_len))) goto done; if (!TEST_ptr(X509_PUBKEY_get0(xp))) goto done; p = kExampleBadECPubKeyDER; input_len = sizeof(kExampleBadECPubKeyDER); if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, (long)input_len))) goto done; if (!TEST_true(X509_PUBKEY_get0(xp) == NULL)) goto done; ret = 1; done: X509_PUBKEY_free(xp); return ret; } static int test_X509_PUBKEY_dup(void) { int ret = 0; X509_PUBKEY *xp = NULL, *xq = NULL; const unsigned char *p = kExampleECPubKeyDER; size_t input_len = sizeof(kExampleECPubKeyDER); xp = X509_PUBKEY_new_ex(testctx, testpropq); if (!TEST_ptr(xp) || !TEST_ptr(d2i_X509_PUBKEY(&xp, &p, (long)input_len)) || !TEST_ptr(xq = X509_PUBKEY_dup(xp)) || !TEST_ptr_ne(xp, xq)) goto done; if (!TEST_ptr(X509_PUBKEY_get0(xq)) || !TEST_ptr(X509_PUBKEY_get0(xp)) || !TEST_ptr_ne(X509_PUBKEY_get0(xq), X509_PUBKEY_get0(xp))) goto done; X509_PUBKEY_free(xq); xq = NULL; p = kExampleBadECPubKeyDER; input_len = sizeof(kExampleBadECPubKeyDER); if (!TEST_ptr(xp = d2i_X509_PUBKEY(&xp, &p, (long)input_len)) || !TEST_ptr(xq = X509_PUBKEY_dup(xp))) goto done; X509_PUBKEY_free(xp); xp = NULL; if (!TEST_true(X509_PUBKEY_get0(xq) == NULL)) goto done; ret = 1; done: X509_PUBKEY_free(xp); X509_PUBKEY_free(xq); return ret; } #endif /* OPENSSL_NO_EC */ /* Test getting and setting parameters on an EVP_PKEY_CTX */ static int test_EVP_PKEY_CTX_get_set_params(EVP_PKEY *pkey) { EVP_MD_CTX *mdctx = NULL; EVP_PKEY_CTX *ctx = NULL; const OSSL_PARAM *params; OSSL_PARAM ourparams[2], *param = ourparams, *param_md; int ret = 0; const EVP_MD *md; char mdname[OSSL_MAX_NAME_SIZE]; char ssl3ms[48]; /* Initialise a sign operation */ ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq); if (!TEST_ptr(ctx) || !TEST_int_gt(EVP_PKEY_sign_init(ctx), 0)) goto err; /* * We should be able to query the parameters now. */ params = EVP_PKEY_CTX_settable_params(ctx); if (!TEST_ptr(params) || !TEST_ptr(OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST))) goto err; params = EVP_PKEY_CTX_gettable_params(ctx); if (!TEST_ptr(params) || !TEST_ptr(OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_ALGORITHM_ID)) || !TEST_ptr(OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST))) goto err; /* * Test getting and setting params via EVP_PKEY_CTX_set_params() and * EVP_PKEY_CTX_get_params() */ strcpy(mdname, "SHA512"); param_md = param; *param++ = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, mdname, 0); *param++ = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_PKEY_CTX_set_params(ctx, ourparams))) goto err; mdname[0] = '\0'; *param_md = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, mdname, sizeof(mdname)); if (!TEST_true(EVP_PKEY_CTX_get_params(ctx, ourparams)) || !TEST_str_eq(mdname, "SHA512")) goto err; /* * Test the TEST_PKEY_CTX_set_signature_md() and * TEST_PKEY_CTX_get_signature_md() functions */ if (!TEST_int_gt(EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()), 0) || !TEST_int_gt(EVP_PKEY_CTX_get_signature_md(ctx, &md), 0) || !TEST_ptr_eq(md, EVP_sha256())) goto err; /* * Test getting MD parameters via an associated EVP_PKEY_CTX */ mdctx = EVP_MD_CTX_new(); if (!TEST_ptr(mdctx) || !TEST_true(EVP_DigestSignInit_ex(mdctx, NULL, "SHA1", testctx, testpropq, pkey, NULL))) goto err; /* * We now have an EVP_MD_CTX with an EVP_PKEY_CTX inside it. We should be * able to obtain the digest's settable parameters from the provider. */ params = EVP_MD_CTX_settable_params(mdctx); if (!TEST_ptr(params) || !TEST_int_eq(strcmp(params[0].key, OSSL_DIGEST_PARAM_SSL3_MS), 0) /* The final key should be NULL */ || !TEST_ptr_null(params[1].key)) goto err; param = ourparams; memset(ssl3ms, 0, sizeof(ssl3ms)); *param++ = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS, ssl3ms, sizeof(ssl3ms)); *param++ = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_MD_CTX_set_params(mdctx, ourparams))) goto err; ret = 1; err: EVP_MD_CTX_free(mdctx); EVP_PKEY_CTX_free(ctx); return ret; } #ifndef OPENSSL_NO_DSA static int test_DSA_get_set_params(void) { OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL; EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *pkey = NULL; int ret = 0; /* * Setup the parameters for our DSA object. For our purposes they don't * have to actually be *valid* parameters. We just need to set something. */ if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DSA", NULL)) || !TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_ptr(p = BN_new()) || !TEST_ptr(q = BN_new()) || !TEST_ptr(g = BN_new()) || !TEST_ptr(pub = BN_new()) || !TEST_ptr(priv = BN_new())) goto err; if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) goto err; if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, params), 0)) goto err; if (!TEST_ptr(pkey)) goto err; ret = test_EVP_PKEY_CTX_get_set_params(pkey); err: EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(pctx); OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); BN_free(p); BN_free(q); BN_free(g); BN_free(pub); BN_free(priv); return ret; } /* * Test combinations of private, public, missing and private + public key * params to ensure they are all accepted */ static int test_DSA_priv_pub(void) { return test_EVP_PKEY_ffc_priv_pub("DSA"); } #endif /* !OPENSSL_NO_DSA */ static int test_RSA_get_set_params(void) { OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; BIGNUM *n = NULL, *e = NULL, *d = NULL; EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *pkey = NULL; int ret = 0; /* * Setup the parameters for our RSA object. For our purposes they don't * have to actually be *valid* parameters. We just need to set something. */ if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL)) || !TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_ptr(n = BN_new()) || !TEST_ptr(e = BN_new()) || !TEST_ptr(d = BN_new())) goto err; if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_D, d))) goto err; if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) goto err; if (!TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, params), 0)) goto err; if (!TEST_ptr(pkey)) goto err; ret = test_EVP_PKEY_CTX_get_set_params(pkey); err: EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(pctx); OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); BN_free(n); BN_free(e); BN_free(d); return ret; } static int test_RSA_OAEP_set_get_params(void) { int ret = 0; EVP_PKEY *key = NULL; EVP_PKEY_CTX *key_ctx = NULL; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (!TEST_ptr(key = load_example_rsa_key()) || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(0, key, 0))) goto err; { int padding = RSA_PKCS1_OAEP_PADDING; OSSL_PARAM params[4]; params[0] = OSSL_PARAM_construct_int(OSSL_SIGNATURE_PARAM_PAD_MODE, &padding); params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, OSSL_DIGEST_NAME_SHA2_256, 0); params[2] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST, OSSL_DIGEST_NAME_SHA1, 0); params[3] = OSSL_PARAM_construct_end(); if (!TEST_int_gt(EVP_PKEY_encrypt_init_ex(key_ctx, params), 0)) goto err; } { OSSL_PARAM params[3]; char oaepmd[30] = { '\0' }; char mgf1md[30] = { '\0' }; params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST, oaepmd, sizeof(oaepmd)); params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST, mgf1md, sizeof(mgf1md)); params[2] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_PKEY_CTX_get_params(key_ctx, params))) goto err; if (!TEST_str_eq(oaepmd, OSSL_DIGEST_NAME_SHA2_256) || !TEST_str_eq(mgf1md, OSSL_DIGEST_NAME_SHA1)) goto err; } ret = 1; err: EVP_PKEY_free(key); EVP_PKEY_CTX_free(key_ctx); return ret; } /* https://github.com/openssl/openssl/issues/21288 */ static int test_RSA_OAEP_set_null_label(void) { int ret = 0; EVP_PKEY *key = NULL; EVP_PKEY_CTX *key_ctx = NULL; char *label = NULL; if (!TEST_ptr(key = load_example_rsa_key()) || !TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, key, NULL)) || !TEST_true(EVP_PKEY_encrypt_init(key_ctx))) goto err; if (!TEST_true(EVP_PKEY_CTX_set_rsa_padding(key_ctx, RSA_PKCS1_OAEP_PADDING))) goto err; if (!TEST_ptr(label = OPENSSL_strdup("foo"))) goto err; if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, label, 0))) { OPENSSL_free(label); goto err; } if (!TEST_true(EVP_PKEY_CTX_set0_rsa_oaep_label(key_ctx, NULL, 0))) goto err; ret = 1; err: EVP_PKEY_free(key); EVP_PKEY_CTX_free(key_ctx); return ret; } static int test_RSA_verify_recover_rejects_short_buffer(void) { int ret = 0; int recovered_cap = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL; unsigned char *sig = NULL, *recovered = NULL; size_t sig_len = 0, recovered_len = 0; unsigned long err = 0; unsigned char shortbuf[] = { 0xa5, 0x5a }; const unsigned char shortbuf_expected[] = { 0xa5, 0x5a }; unsigned char digest[32]; size_t i; for (i = 0; i < sizeof(digest); i++) digest[i] = (unsigned char)i; if (OSSL_PROVIDER_available(testctx, "fips")) return TEST_skip("Test skipped for FIPS provider"); if (!TEST_ptr(pkey = load_example_rsa_key()) || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx, RSA_PKCS1_PADDING), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(sign_ctx, EVP_sha256()), 0) || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, digest, sizeof(digest)), 0) || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, digest, sizeof(digest)), 0) || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0) || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap)) || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx, RSA_PKCS1_PADDING), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_signature_md(verify_ctx, EVP_sha256()), 0)) goto done; recovered_len = (size_t)recovered_cap; if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered, &recovered_len, sig, sig_len), 0) || !TEST_size_t_eq(recovered_len, sizeof(digest)) || !TEST_mem_eq(recovered, recovered_len, digest, sizeof(digest))) goto done; ERR_clear_error(); recovered_len = 1; if (!TEST_int_le(EVP_PKEY_verify_recover(verify_ctx, shortbuf, &recovered_len, sig, sig_len), 0)) goto done; err = ERR_peek_error(); if (!TEST_int_eq(ERR_GET_LIB(err), ERR_LIB_PROV) || !TEST_int_eq(ERR_GET_REASON(err), PROV_R_OUTPUT_BUFFER_TOO_SMALL) || !TEST_mem_eq(shortbuf, sizeof(shortbuf), shortbuf_expected, sizeof(shortbuf_expected))) goto done; ret = 1; done: EVP_PKEY_CTX_free(sign_ctx); EVP_PKEY_CTX_free(verify_ctx); EVP_PKEY_free(pkey); OPENSSL_free(sig); OPENSSL_free(recovered); return ret; } /* * A raw RSA PKCS#1 v1.5 signature whose recovered data is empty must be * recovered successfully with a length of zero, not rejected as an error. */ static int test_RSA_verify_recover_empty_payload(void) { int ret = 0; int recovered_cap = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *sign_ctx = NULL, *verify_ctx = NULL; unsigned char *sig = NULL, *recovered = NULL; size_t sig_len = 0, recovered_len = 0; /* * The signed input has zero length, but a valid non-null address is still * passed so the result does not depend on how lower layers treat NULL for * zero-length data. */ const unsigned char empty[] = { 0 }; if (OSSL_PROVIDER_available(testctx, "fips")) return TEST_skip("Test skipped for FIPS provider"); if (!TEST_ptr(pkey = load_example_rsa_key()) || !TEST_ptr(sign_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) || !TEST_int_gt(EVP_PKEY_sign_init(sign_ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(sign_ctx, RSA_PKCS1_PADDING), 0) /* * Deliberately do not configure a signature digest so that the raw * PKCS#1 v1.5 sign and verify-recover paths are exercised. */ || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, NULL, &sig_len, empty, 0), 0) || !TEST_ptr(sig = OPENSSL_malloc(sig_len)) || !TEST_int_gt(EVP_PKEY_sign(sign_ctx, sig, &sig_len, empty, 0), 0) || !TEST_int_gt(recovered_cap = EVP_PKEY_get_size(pkey), 0) || !TEST_ptr(recovered = OPENSSL_malloc(recovered_cap)) || !TEST_ptr(verify_ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) || !TEST_int_gt(EVP_PKEY_verify_recover_init(verify_ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_padding(verify_ctx, RSA_PKCS1_PADDING), 0)) goto done; /* Size-query call must succeed. */ recovered_len = (size_t)recovered_cap; if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, NULL, &recovered_len, sig, sig_len), 0)) goto done; /* * The actual recovery call is essential: a NULL output buffer would only * run the size-query path, which never decodes the signature and so would * not reproduce the regression. */ recovered_len = (size_t)recovered_cap; if (!TEST_int_gt(EVP_PKEY_verify_recover(verify_ctx, recovered, &recovered_len, sig, sig_len), 0) || !TEST_size_t_eq(recovered_len, 0)) goto done; ret = 1; done: EVP_PKEY_CTX_free(sign_ctx); EVP_PKEY_CTX_free(verify_ctx); EVP_PKEY_free(pkey); OPENSSL_free(sig); OPENSSL_free(recovered); return ret; } static int test_RSA_encrypt(void) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *pctx = NULL; unsigned char *cbuf = NULL, *pbuf = NULL; size_t clen = 0, plen = 0; if (!TEST_ptr(pkey = load_example_rsa_key()) || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, testpropq)) || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0) || !TEST_ptr(cbuf = OPENSSL_malloc(clen)) || !TEST_int_gt(EVP_PKEY_encrypt(pctx, cbuf, &clen, kMsg, sizeof(kMsg)), 0)) goto done; /* Require failure when the output buffer is too small */ plen = clen - 1; if (!TEST_int_le(EVP_PKEY_encrypt(pctx, cbuf, &plen, kMsg, sizeof(kMsg)), 0)) goto done; /* flush error stack */ TEST_openssl_errors(); /* Check decryption of encrypted result */ if (!TEST_int_gt(EVP_PKEY_decrypt_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0) || !TEST_ptr(pbuf = OPENSSL_malloc(plen)) || !TEST_int_gt(EVP_PKEY_decrypt(pctx, pbuf, &plen, cbuf, clen), 0) || !TEST_mem_eq(pbuf, plen, kMsg, sizeof(kMsg)) || !TEST_int_gt(EVP_PKEY_encrypt_init(pctx), 0)) goto done; ret = 1; done: EVP_PKEY_CTX_free(pctx); EVP_PKEY_free(pkey); OPENSSL_free(cbuf); OPENSSL_free(pbuf); return ret; } #ifndef OPENSSL_NO_DEPRECATED_3_0 static int test_RSA_legacy(void) { int ret = 0; BIGNUM *p = NULL; BIGNUM *q = NULL; BIGNUM *n = NULL; BIGNUM *e = NULL; BIGNUM *d = NULL; const EVP_MD *md = EVP_sha256(); EVP_MD_CTX *ctx = NULL; EVP_PKEY *pkey = NULL; RSA *rsa = NULL; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); if (!TEST_ptr(p = BN_dup(BN_value_one())) || !TEST_ptr(q = BN_dup(BN_value_one())) || !TEST_ptr(n = BN_dup(BN_value_one())) || !TEST_ptr(e = BN_dup(BN_value_one())) || !TEST_ptr(d = BN_dup(BN_value_one()))) goto err; if (!TEST_ptr(rsa = RSA_new()) || !TEST_ptr(pkey = EVP_PKEY_new()) || !TEST_ptr(ctx = EVP_MD_CTX_new())) goto err; if (!TEST_true(RSA_set0_factors(rsa, p, q))) goto err; p = NULL; q = NULL; if (!TEST_true(RSA_set0_key(rsa, n, e, d))) goto err; n = NULL; e = NULL; d = NULL; if (!TEST_true(EVP_PKEY_assign_RSA(pkey, rsa))) goto err; rsa = NULL; if (!TEST_true(EVP_DigestSignInit(ctx, NULL, md, NULL, pkey))) goto err; ret = 1; err: RSA_free(rsa); EVP_MD_CTX_free(ctx); EVP_PKEY_free(pkey); BN_free(p); BN_free(q); BN_free(n); BN_free(e); BN_free(d); return ret; } #endif #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) static int test_decrypt_null_chunks(void) { EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; const unsigned char key[32] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1 }; unsigned char iv[12] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b }; unsigned char msg[] = "It was the best of times, it was the worst of times"; unsigned char ciphertext[80]; unsigned char plaintext[80]; unsigned char tag[16]; /* We initialise tmp to a non zero value on purpose */ int ctlen, ptlen, tmp = 99; int ret = 0; const int enc_offset = 10, dec_offset = 20; OSSL_PARAM params[2]; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, sizeof(tag)); params[1] = OSSL_PARAM_construct_end(); if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "ChaCha20-Poly1305", testpropq)) || !TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, key, iv)) || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &ctlen, msg, enc_offset)) /* Deliberate add a zero length update */ || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp, NULL, 0)) || !TEST_int_eq(tmp, 0) || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext + ctlen, &tmp, msg + enc_offset, sizeof(msg) - enc_offset)) || !TEST_int_eq(ctlen += tmp, sizeof(msg)) || !TEST_true(EVP_EncryptFinal(ctx, ciphertext + ctlen, &tmp)) || !TEST_int_eq(tmp, 0) || !TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))) goto err; /* Deliberately initialise tmp to a non zero value */ tmp = 99; if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, key, iv, params)) || !TEST_true(EVP_DecryptUpdate(ctx, plaintext, &ptlen, ciphertext, dec_offset)) /* * Deliberately add a zero length update. We also deliberately do * this at a different offset than for encryption. */ || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp, NULL, 0)) || !TEST_int_eq(tmp, 0) || !TEST_true(EVP_DecryptUpdate(ctx, plaintext + ptlen, &tmp, ciphertext + dec_offset, ctlen - dec_offset)) || !TEST_int_eq(ptlen += tmp, sizeof(msg)) || !TEST_true(EVP_DecryptFinal(ctx, plaintext + ptlen, &tmp)) || !TEST_int_eq(tmp, 0) || !TEST_mem_eq(msg, sizeof(msg), plaintext, ptlen)) goto err; ret = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(cipher); return ret; } #endif /* !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) */ #ifndef OPENSSL_NO_DH /* * Test combinations of private, public, missing and private + public key * params to ensure they are all accepted */ static int test_DH_priv_pub(void) { return test_EVP_PKEY_ffc_priv_pub("DH"); } #ifndef OPENSSL_NO_DEPRECATED_3_0 static int test_EVP_PKEY_set1_DH(void) { DH *x942dh = NULL, *noqdh = NULL; EVP_PKEY *pkey1 = NULL, *pkey2 = NULL; int ret = 0; BIGNUM *p, *g = NULL; BIGNUM *pubkey = NULL; unsigned char pub[2048 / 8]; size_t len = 0; if (!TEST_ptr(p = BN_new()) || !TEST_ptr(g = BN_new()) || !TEST_ptr(pubkey = BN_new()) || !TEST_true(BN_set_word(p, 9999)) || !TEST_true(BN_set_word(g, 2)) || !TEST_true(BN_set_word(pubkey, 4321)) || !TEST_ptr(noqdh = DH_new()) || !TEST_true(DH_set0_pqg(noqdh, p, NULL, g)) || !TEST_true(DH_set0_key(noqdh, pubkey, NULL)) || !TEST_ptr(pubkey = BN_new()) || !TEST_true(BN_set_word(pubkey, 4321))) goto err; p = g = NULL; x942dh = DH_get_2048_256(); pkey1 = EVP_PKEY_new(); pkey2 = EVP_PKEY_new(); if (!TEST_ptr(x942dh) || !TEST_ptr(noqdh) || !TEST_ptr(pkey1) || !TEST_ptr(pkey2) || !TEST_true(DH_set0_key(x942dh, pubkey, NULL))) goto err; pubkey = NULL; if (!TEST_true(EVP_PKEY_set1_DH(pkey1, x942dh)) || !TEST_int_eq(EVP_PKEY_get_id(pkey1), EVP_PKEY_DHX)) goto err; if (!TEST_true(EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PUB_KEY, &pubkey)) || !TEST_ptr(pubkey)) goto err; if (!TEST_true(EVP_PKEY_set1_DH(pkey2, noqdh)) || !TEST_int_eq(EVP_PKEY_get_id(pkey2), EVP_PKEY_DH)) goto err; if (!TEST_true(EVP_PKEY_get_octet_string_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, pub, sizeof(pub), &len)) || !TEST_size_t_ne(len, 0)) goto err; ret = 1; err: BN_free(p); BN_free(g); BN_free(pubkey); EVP_PKEY_free(pkey1); EVP_PKEY_free(pkey2); DH_free(x942dh); DH_free(noqdh); return ret; } #endif /* !OPENSSL_NO_DEPRECATED_3_0 */ /* Test that DHX (X9.42) rejects a malicious peer key during the * derivation phase (specifically EVP_PKEY_derive_set_peer) when the * remote 'q' does not match the local domain parameters but is still * consistent with the remote key share. * (CVE-2026-42770) */ static int test_dhx_derive_rejects_bad_peer_q(void) { int ret = 0; EVP_PKEY *local_key = NULL, *remote_key = NULL; EVP_PKEY_CTX *pctx = NULL, *derive_ctx = NULL; OSSL_PARAM_BLD *bld = NULL; OSSL_PARAM *params = NULL; BIGNUM *p = NULL, *g = NULL; BIGNUM *q_valid = NULL, *pub_local = NULL, *priv_local = NULL; BIGNUM *q_bad = NULL, *pub_bad = NULL; const char *hex_p = "87a8e61db4b6663cffbbd19c651959998ceef608660dd0f25d2ceed4435e3b00" "e00df8f1d61957d4faf7df4561b2aa3016c3d91134096faa3bf4296d830e9a7c" "209e0c6497517abd5a8a9d306bcf67ed91f9e6725b4758c022e0b1ef4275bf7b" "6c5bfc11d45f9088b941f54eb1e59bb8bc39a0bf12307f5c4fdb70c581b23f76" "b63acae1caa6b7902d52526735488a0ef13c6d9a51bfa4ab3ad8347796524d8e" "f6a167b5a41825d967e144e5140564251ccacb83e6b486f6b3ca3f7971506026" "c0b857f689962856ded4010abd0be621c3a3960a54e710c375f26375d7014103" "a4b54330c198af126116d2276e11715f693877fad7ef09cadb094ae91e1a1597"; const char *hex_g = "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA125" "10DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62" "901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B" "777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193" "B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0A" "DB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915" "B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C3" "2F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"; const char *hex_q_valid = "8CF83642A709A097B447997640129DA299B1A47D1EB3750BA308B0FE64F5FBD3"; const char *hex_local_pub = "796e15431470ac86fa8a78b8bcdd1f3589dbf15ffe0e0a7a41dd8640887f3cc3" "f0439e281f4cf3800bac2dbdfcda589b26cc828512085ce0d3e57aa13cd9e7a4" "66d881bace91ed10c6064ab36e0d66367c4bfed56a9f907e4daec16732fb5c54" "891cb0d26251fd61c32040774246b3f8bdcd5ef60e6847cdd69bd6d318d1cda0" "e8a30a716de4dc1a4eb99b0686b77120c4b69b0005f6a8c3ae768d23c08c85bd" "1d58f40dc0138d6277436137ae69779fdc218c071c14826f471562033e85ffc9" "9a2147d539e274136a4a1e7f1db97583b51dc0385a52d7383963758d893398a8" "d013fdbad20ddf30fbe05fbb2249913ae6751b6b246ae5622ba26c4827417c2d"; const char *hex_local_priv = "1122334455667788990011223344556677889900112233445566778899001122"; /* Remote malicious parameters */ const char *hex_remote_q = "09f5"; const char *hex_remote_pub = "54c057903d362235a65c03f001d8a3ea252836b3580250abdc0a1083451af012" "6fd150f9e8d212b384ae0c23aa7c67fe851368114ccc061a661e986bd7e63d25" "7513339a6914cbfab209ad793ef25704cd532ddfb7e693de701d17e629ef3c18" "4d40d5fea1f9edb89c5bf8d7aa19e3374f805932159ca7b5d573b9e2f3c94fe7" "47c4a3b09e31afa3788d35833aaf2ac8ae8bc48500131464e793a2e0352e7c3e" "d9da9fcf89b121bc1cee83c544214ceb3338b14ac6891968351746eaf62bb517" "eb98fc633d8d235bac37bc08e47f1851d05501949a6733965adbfe8e43f7c3b9" "3ca7515cd6ab36d7ef26bb0fd6033abc39613e880fffc8729b03bfeaddf08833"; if (!TEST_true(BN_hex2bn(&p, hex_p)) || !TEST_true(BN_hex2bn(&g, hex_g))) goto err; if (!TEST_true(BN_hex2bn(&q_valid, hex_q_valid)) || !TEST_true(BN_hex2bn(&pub_local, hex_local_pub)) || !TEST_true(BN_hex2bn(&priv_local, hex_local_priv))) goto err; if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_valid)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_local)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv_local)) || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) goto err; if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq)) || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &local_key, EVP_PKEY_KEYPAIR, params), 0)) goto err; OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); EVP_PKEY_CTX_free(pctx); params = NULL; bld = NULL; pctx = NULL; if (!TEST_true(BN_hex2bn(&q_bad, hex_remote_q)) || !TEST_true(BN_hex2bn(&pub_bad, hex_remote_pub))) goto err; if (!TEST_ptr(bld = OSSL_PARAM_BLD_new()) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q_bad)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g)) || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_bad)) || !TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))) goto err; if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "DHX", testpropq)) || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &remote_key, EVP_PKEY_PUBLIC_KEY, params), 0)) goto err; if (!TEST_ptr(derive_ctx = EVP_PKEY_CTX_new(local_key, NULL)) || !TEST_int_gt(EVP_PKEY_derive_init(derive_ctx), 0)) goto err; /* reject the remote key share, even if it is self-consistent, correct * code needs to use local q, not remote-provided q. */ if (!TEST_int_le(EVP_PKEY_derive_set_peer(derive_ctx, remote_key), 0)) { TEST_error("EVP_PKEY_derive_set_peer incorrectly accepted a peer with malicious 'q'"); goto err; } ret = 1; err: BN_free(p); BN_free(g); BN_free(q_valid); BN_free(pub_local); BN_free(priv_local); BN_free(q_bad); BN_free(pub_bad); OSSL_PARAM_free(params); OSSL_PARAM_BLD_free(bld); EVP_PKEY_CTX_free(pctx); EVP_PKEY_CTX_free(derive_ctx); EVP_PKEY_free(local_key); EVP_PKEY_free(remote_key); return ret; } #endif /* !OPENSSL_NO_DH */ /* * We test what happens with an empty template. For the sake of this test, * the template must be ignored, and we know that's the case for RSA keys * (this might arguably be a misfeature, but that's what we currently do, * even in provider code, since that's how the legacy RSA implementation * does things) */ static int test_keygen_with_empty_template(int n) { EVP_PKEY_CTX *ctx = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY *tkey = NULL; int ret = 0; if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); switch (n) { case 0: /* We do test with no template at all as well */ if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL))) goto err; break; case 1: /* Here we create an empty RSA key that serves as our template */ if (!TEST_ptr(tkey = EVP_PKEY_new()) || !TEST_true(EVP_PKEY_set_type(tkey, EVP_PKEY_RSA)) || !TEST_ptr(ctx = EVP_PKEY_CTX_new(tkey, NULL))) goto err; break; } if (!TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_keygen(ctx, &pkey), 0)) goto err; ret = 1; err: EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_PKEY_free(tkey); return ret; } /* * Test that we fail if we attempt to use an algorithm that is not available * in the current library context (unless we are using an algorithm that * should be made available via legacy codepaths). * * 0: RSA * 1: SM2 */ static int test_pkey_ctx_fail_without_provider(int tst) { OSSL_LIB_CTX *tmpctx = OSSL_LIB_CTX_new(); OSSL_PROVIDER *tmpnullprov = NULL; EVP_PKEY_CTX *pctx = NULL; const char *keytype = NULL; int expect_null = 0; int ret = 0; if (!TEST_ptr(tmpctx)) goto err; tmpnullprov = OSSL_PROVIDER_load(tmpctx, "null"); if (!TEST_ptr(tmpnullprov)) goto err; /* * We check for certain algos in the null provider. * If an algo is expected to have a provider keymgmt, constructing an * EVP_PKEY_CTX is expected to fail (return NULL). * Otherwise, if it's expected to have legacy support, constructing an * EVP_PKEY_CTX is expected to succeed (return non-NULL). */ switch (tst) { case 0: keytype = "RSA"; expect_null = 1; break; case 1: keytype = "SM2"; expect_null = 1; #ifdef OPENSSL_NO_EC TEST_info("EC disable, skipping SM2 check..."); goto end; #endif #ifdef OPENSSL_NO_SM2 TEST_info("SM2 disable, skipping SM2 check..."); goto end; #endif break; default: TEST_error("No test for case %d", tst); goto err; } pctx = EVP_PKEY_CTX_new_from_name(tmpctx, keytype, ""); if (expect_null ? !TEST_ptr_null(pctx) : !TEST_ptr(pctx)) goto err; #if defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_SM2) end: #endif ret = 1; err: EVP_PKEY_CTX_free(pctx); OSSL_PROVIDER_unload(tmpnullprov); OSSL_LIB_CTX_free(tmpctx); return ret; } static int test_rand_agglomeration(void) { EVP_RAND *rand; EVP_RAND_CTX *ctx; OSSL_PARAM params[3], *p = params; int res; unsigned int step = 7; static unsigned char seed[] = "It does not matter how slowly you go " "as long as you do not stop."; unsigned char out[sizeof(seed)]; if (!TEST_int_ne(sizeof(seed) % step, 0) || !TEST_ptr(rand = EVP_RAND_fetch(testctx, "TEST-RAND", testpropq))) return 0; ctx = EVP_RAND_CTX_new(rand, NULL); EVP_RAND_free(rand); if (!TEST_ptr(ctx)) return 0; memset(out, 0, sizeof(out)); *p++ = OSSL_PARAM_construct_octet_string(OSSL_RAND_PARAM_TEST_ENTROPY, seed, sizeof(seed)); *p++ = OSSL_PARAM_construct_uint(OSSL_RAND_PARAM_MAX_REQUEST, &step); *p = OSSL_PARAM_construct_end(); res = TEST_true(EVP_RAND_CTX_set_params(ctx, params)) && TEST_true(EVP_RAND_generate(ctx, out, sizeof(out), 0, 1, NULL, 0)) && TEST_mem_eq(seed, sizeof(seed), out, sizeof(out)); EVP_RAND_CTX_free(ctx); return res; } /* * Test that we correctly return the original or "running" IV after * an encryption operation. * Run multiple times for some different relevant algorithms/modes. */ static int test_evp_iv_aes(int idx) { int ret = 0; EVP_CIPHER_CTX *ctx = NULL; unsigned char key[16] = { 0x4c, 0x43, 0xdb, 0xdd, 0x42, 0x73, 0x47, 0xd1, 0xe5, 0x62, 0x7d, 0xcd, 0x4d, 0x76, 0x4d, 0x57 }; unsigned char init_iv[EVP_MAX_IV_LENGTH] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 }; static const unsigned char msg[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 }; unsigned char ciphertext[32], oiv1[16], oiv[16], iv[16], uiv[16]; unsigned char *ref_iv, *start_iv = init_iv; unsigned char cbc_state[16] = { 0x10, 0x2f, 0x05, 0xcc, 0xc2, 0x55, 0x72, 0xb9, 0x88, 0xe6, 0x4a, 0x17, 0x10, 0x74, 0x22, 0x5e }; unsigned char ofb_state[16] = { 0x76, 0xe6, 0x66, 0x61, 0xd0, 0x8a, 0xe4, 0x64, 0xdd, 0x66, 0xbf, 0x00, 0xf0, 0xe3, 0x6f, 0xfd }; unsigned char cfb_state[16] = { 0x77, 0xe4, 0x65, 0x65, 0xd5, 0x8c, 0xe3, 0x6c, 0xd4, 0x6c, 0xb4, 0x0c, 0xfd, 0xed, 0x60, 0xed }; unsigned char gcm_state[12] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81 }; unsigned char ccm_state[7] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98 }; #ifndef OPENSSL_NO_OCB unsigned char ocb_state[12] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81 }; #endif int len = sizeof(ciphertext); size_t ivlen, ref_len; const EVP_CIPHER *type = NULL; int iv_reset = 0; if (nullprov != NULL && idx < 6) return TEST_skip("Test does not support a non-default library context"); switch (idx) { case 0: type = EVP_aes_128_cbc(); /* FALLTHROUGH */ case 6: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cbc", testpropq); ref_iv = cbc_state; ref_len = sizeof(cbc_state); iv_reset = 1; break; case 1: type = EVP_aes_128_ofb(); /* FALLTHROUGH */ case 7: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ofb", testpropq); ref_iv = ofb_state; ref_len = sizeof(ofb_state); iv_reset = 1; break; case 2: type = EVP_aes_128_cfb(); /* FALLTHROUGH */ case 8: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq); ref_iv = cfb_state; ref_len = sizeof(cfb_state); iv_reset = 1; break; case 3: type = EVP_aes_128_gcm(); /* FALLTHROUGH */ case 9: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-gcm", testpropq); ref_iv = gcm_state; ref_len = sizeof(gcm_state); break; case 12: ref_iv = NULL; ref_len = 0; start_iv = NULL; /* This will cause a random iv to be generated internally */ type = EVP_CIPHER_fetch(testctx, "aes-128-gcm", testpropq); break; case 4: type = EVP_aes_128_ccm(); /* FALLTHROUGH */ case 10: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ccm", testpropq); ref_iv = ccm_state; ref_len = sizeof(ccm_state); break; #ifdef OPENSSL_NO_OCB case 5: case 11: return 1; #else case 5: type = EVP_aes_128_ocb(); /* FALLTHROUGH */ case 11: type = (type != NULL) ? type : EVP_CIPHER_fetch(testctx, "aes-128-ocb", testpropq); ref_iv = ocb_state; ref_len = sizeof(ocb_state); break; #endif default: return 0; } if (!TEST_ptr(type) || !TEST_ptr((ctx = EVP_CIPHER_CTX_new())) || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, start_iv)) || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv1, sizeof(oiv1))) || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg, (int)sizeof(msg))) || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv))) || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))) || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len))) goto err; ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); if (!TEST_size_t_gt(ivlen, 0)) goto err; if (start_iv == NULL) start_iv = oiv1; if (!TEST_mem_eq(start_iv, ivlen, oiv, ivlen) || (ref_iv != NULL && !TEST_mem_eq(ref_iv, ref_len, iv, ivlen))) goto err; /* CBC, OFB, and CFB modes: the updated iv must be reset after reinit */ if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL)) || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, uiv, sizeof(uiv)))) goto err; if (iv_reset) { if (!TEST_mem_eq(start_iv, ivlen, uiv, ivlen)) goto err; } else { if (!TEST_mem_eq(uiv, ivlen, iv, ivlen)) goto err; } ret = 1; err: EVP_CIPHER_CTX_free(ctx); if (idx >= 6) EVP_CIPHER_free((EVP_CIPHER *)type); return ret; } #ifndef OPENSSL_NO_DES static int test_evp_iv_des(int idx) { int ret = 0; EVP_CIPHER_CTX *ctx = NULL; static const unsigned char key[24] = { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0xf1, 0xe0, 0xd3, 0xc2, 0xb5, 0xa4, 0x97, 0x86, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 }; static const unsigned char init_iv[8] = { 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 }; static const unsigned char msg[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 }; unsigned char ciphertext[32], oiv[8], iv[8]; unsigned const char *ref_iv; static const unsigned char cbc_state_des[8] = { 0x4f, 0xa3, 0x85, 0xcd, 0x8b, 0xf3, 0x06, 0x2a }; static const unsigned char cbc_state_3des[8] = { 0x35, 0x27, 0x7d, 0x65, 0x6c, 0xfb, 0x50, 0xd9 }; static const unsigned char ofb_state_des[8] = { 0xa7, 0x0d, 0x1d, 0x45, 0xf9, 0x96, 0x3f, 0x2c }; static const unsigned char ofb_state_3des[8] = { 0xab, 0x16, 0x24, 0xbb, 0x5b, 0xac, 0xed, 0x5e }; static const unsigned char cfb_state_des[8] = { 0x91, 0xeb, 0x6d, 0x29, 0x4b, 0x08, 0xbd, 0x73 }; static const unsigned char cfb_state_3des[8] = { 0x34, 0xdd, 0xfb, 0x47, 0x33, 0x1c, 0x61, 0xf7 }; int len = sizeof(ciphertext); size_t ivlen, ref_len; EVP_CIPHER *type = NULL; if (lgcyprov == NULL && idx < 3) return TEST_skip("Test requires legacy provider to be loaded"); switch (idx) { case 0: type = EVP_CIPHER_fetch(testctx, "des-cbc", testpropq); ref_iv = cbc_state_des; ref_len = sizeof(cbc_state_des); break; case 1: type = EVP_CIPHER_fetch(testctx, "des-ofb", testpropq); ref_iv = ofb_state_des; ref_len = sizeof(ofb_state_des); break; case 2: type = EVP_CIPHER_fetch(testctx, "des-cfb", testpropq); ref_iv = cfb_state_des; ref_len = sizeof(cfb_state_des); break; case 3: type = EVP_CIPHER_fetch(testctx, "des-ede3-cbc", testpropq); ref_iv = cbc_state_3des; ref_len = sizeof(cbc_state_3des); break; case 4: type = EVP_CIPHER_fetch(testctx, "des-ede3-ofb", testpropq); ref_iv = ofb_state_3des; ref_len = sizeof(ofb_state_3des); break; case 5: type = EVP_CIPHER_fetch(testctx, "des-ede3-cfb", testpropq); ref_iv = cfb_state_3des; ref_len = sizeof(cfb_state_3des); break; default: return 0; } if (!TEST_ptr(type) || !TEST_ptr((ctx = EVP_CIPHER_CTX_new())) || !TEST_true(EVP_EncryptInit_ex(ctx, type, NULL, key, init_iv)) || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &len, msg, (int)sizeof(msg))) || !TEST_true(EVP_CIPHER_CTX_get_original_iv(ctx, oiv, sizeof(oiv))) || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv))) || !TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext, &len))) goto err; ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); if (!TEST_size_t_gt(ivlen, 0)) goto err; if (!TEST_mem_eq(init_iv, ivlen, oiv, ivlen) || !TEST_mem_eq(ref_iv, ref_len, iv, ivlen)) goto err; if (!TEST_true(EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, NULL)) || !TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, iv, sizeof(iv)))) goto err; if (!TEST_mem_eq(init_iv, ivlen, iv, ivlen)) goto err; ret = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return ret; } #endif #ifndef OPENSSL_NO_BF static int test_evp_bf_default_keylen(int idx) { int ret = 0; static const char *algos[4] = { "bf-ecb", "bf-cbc", "bf-cfb", "bf-ofb" }; int ivlen[4] = { 0, 8, 8, 8 }; EVP_CIPHER *cipher = NULL; if (lgcyprov == NULL) return TEST_skip("Test requires legacy provider to be loaded"); if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, algos[idx], testpropq)) || !TEST_int_eq(EVP_CIPHER_get_key_length(cipher), 16) || !TEST_int_eq(EVP_CIPHER_get_iv_length(cipher), ivlen[idx])) goto err; ret = 1; err: EVP_CIPHER_free(cipher); return ret; } #endif #ifndef OPENSSL_NO_EC static int ecpub_nids[] = { NID_brainpoolP256r1, NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1, #ifndef OPENSSL_NO_EC2M NID_sect233k1, NID_sect233r1, NID_sect283r1, NID_sect409k1, NID_sect409r1, NID_sect571k1, NID_sect571r1, #endif NID_brainpoolP384r1, NID_brainpoolP512r1 }; static int test_ecpub(int idx) { int ret = 0, len, savelen; int nid; unsigned char buf[1024]; unsigned char *p; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; #ifndef OPENSSL_NO_DEPRECATED_3_0 const unsigned char *q; EVP_PKEY *pkey2 = NULL; EC_KEY *ec = NULL; #endif if (nullprov != NULL) return TEST_skip("Test does not support a non-default library context"); nid = ecpub_nids[idx]; ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); if (!TEST_ptr(ctx) || !TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid), 0) || !TEST_true(EVP_PKEY_keygen(ctx, &pkey))) goto done; len = i2d_PublicKey(pkey, NULL); savelen = len; if (!TEST_int_ge(len, 1) || !TEST_int_lt(len, 1024)) goto done; p = buf; len = i2d_PublicKey(pkey, &p); if (!TEST_int_ge(len, 1) || !TEST_int_eq(len, savelen)) goto done; #ifndef OPENSSL_NO_DEPRECATED_3_0 /* Now try to decode the just-created DER. */ q = buf; if (!TEST_ptr((pkey2 = EVP_PKEY_new())) || !TEST_ptr((ec = EC_KEY_new_by_curve_name(nid))) || !TEST_true(EVP_PKEY_assign_EC_KEY(pkey2, ec))) goto done; /* EC_KEY ownership transferred */ ec = NULL; if (!TEST_ptr(d2i_PublicKey(EVP_PKEY_EC, &pkey2, &q, savelen))) goto done; /* The keys should match. */ if (!TEST_int_eq(EVP_PKEY_eq(pkey, pkey2), 1)) goto done; #endif ret = 1; done: EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); #ifndef OPENSSL_NO_DEPRECATED_3_0 EVP_PKEY_free(pkey2); EC_KEY_free(ec); #endif return ret; } #endif static int test_EVP_rsa_pss_with_keygen_bits(void) { int ret = 0; EVP_PKEY_CTX *ctx = NULL; EVP_PKEY *pkey = NULL; EVP_MD *md; md = EVP_MD_fetch(testctx, "sha256", testpropq); ret = TEST_ptr(md) && TEST_ptr((ctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA-PSS", testpropq))) && TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0) && TEST_int_gt(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 512), 0) && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx, md), 0) && TEST_true(EVP_PKEY_keygen(ctx, &pkey)); EVP_MD_free(md); EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(ctx); return ret; } static int test_EVP_rsa_pss_set_saltlen(void) { int ret = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *pkey_ctx = NULL; EVP_MD *sha256 = NULL; EVP_MD_CTX *sha256_ctx = NULL; int saltlen = 9999; /* buggy EVP_PKEY_CTX_get_rsa_pss_saltlen() didn't update this */ const int test_value = 32; ret = TEST_ptr(pkey = load_example_rsa_key()) && TEST_ptr(sha256 = EVP_MD_fetch(testctx, "sha256", NULL)) && TEST_ptr(sha256_ctx = EVP_MD_CTX_new()) && TEST_true(EVP_DigestSignInit(sha256_ctx, &pkey_ctx, sha256, NULL, pkey)) && TEST_true(EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING)) && TEST_int_gt(EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, test_value), 0) && TEST_int_gt(EVP_PKEY_CTX_get_rsa_pss_saltlen(pkey_ctx, &saltlen), 0) && TEST_int_eq(saltlen, test_value); EVP_MD_CTX_free(sha256_ctx); EVP_PKEY_free(pkey); EVP_MD_free(sha256); return ret; } static int test_EVP_rsa_invalid_key(void) { int ret = 0; EVP_PKEY *pkey = NULL; pkey = load_example_key("RSA", kInvalidRSAKeyDER, sizeof(kInvalidRSAKeyDER)); /* we expect to fail to load bogus key */ ret = !TEST_ptr(pkey); EVP_PKEY_free(pkey); return ret; } static int success = 1; static void md_names(const char *name, void *vctx) { OSSL_LIB_CTX *ctx = (OSSL_LIB_CTX *)vctx; /* Force a namemap update */ EVP_CIPHER *aes128 = EVP_CIPHER_fetch(ctx, "AES-128-CBC", NULL); if (!TEST_ptr(aes128)) success = 0; EVP_CIPHER_free(aes128); } /* * Test that changing the namemap in a user callback works in a names_do_all * function. */ static int test_names_do_all(void) { /* We use a custom libctx so that we know the state of the namemap */ OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new(); EVP_MD *sha256 = NULL; int testresult = 0; if (!TEST_ptr(ctx)) goto err; sha256 = EVP_MD_fetch(ctx, "SHA2-256", NULL); if (!TEST_ptr(sha256)) goto err; /* * We loop through all the names for a given digest. This should still work * even if the namemap changes part way through. */ if (!TEST_true(EVP_MD_names_do_all(sha256, md_names, ctx))) goto err; if (!TEST_true(success)) goto err; testresult = 1; err: EVP_MD_free(sha256); OSSL_LIB_CTX_free(ctx); return testresult; } typedef struct { const char *cipher; const unsigned char *key; const unsigned char *iv; const unsigned char *input; const unsigned char *expected; const unsigned char *tag; size_t ivlen; /* 0 if we do not need to set a specific IV len */ size_t inlen; size_t expectedlen; size_t taglen; int keyfirst; int initenc; int finalenc; } EVP_INIT_TEST_st; static const EVP_INIT_TEST_st evp_init_tests[] = { { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext, cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext), 0, 1, 0, 1 }, { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext, gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV), sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultTag), 1, 0, 1 }, { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext, cfbCiphertext, NULL, 0, sizeof(cfbPlaintext), sizeof(cfbCiphertext), 0, 0, 0, 1 }, { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultPlaintext, gcmDefaultCiphertext, gcmDefaultTag, sizeof(iGCMDefaultIV), sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultTag), 0, 0, 1 }, { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext, cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0, 1, 1, 0 }, { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext, gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV), sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultTag), 1, 1, 0 }, { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext, cfbPlaintext, NULL, 0, sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0, 0, 1, 0 }, { "aes-256-gcm", kGCMDefaultKey, iGCMDefaultIV, gcmDefaultCiphertext, gcmDefaultPlaintext, gcmDefaultTag, sizeof(iGCMDefaultIV), sizeof(gcmDefaultCiphertext), sizeof(gcmDefaultPlaintext), sizeof(gcmDefaultTag), 0, 1, 0 } }; /* use same key, iv and plaintext for cfb and ofb */ static const EVP_INIT_TEST_st evp_reinit_tests[] = { { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial, cfbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial), sizeof(cfbCiphertext_partial), 0, 0, 1, 0 }, { "aes-128-cfb", kCFBDefaultKey, iCFBIV, cfbCiphertext_partial, cfbPlaintext_partial, NULL, 0, sizeof(cfbCiphertext_partial), sizeof(cfbPlaintext_partial), 0, 0, 0, 0 }, { "aes-128-ofb", kCFBDefaultKey, iCFBIV, cfbPlaintext_partial, ofbCiphertext_partial, NULL, 0, sizeof(cfbPlaintext_partial), sizeof(ofbCiphertext_partial), 0, 0, 1, 0 }, { "aes-128-ofb", kCFBDefaultKey, iCFBIV, ofbCiphertext_partial, cfbPlaintext_partial, NULL, 0, sizeof(ofbCiphertext_partial), sizeof(cfbPlaintext_partial), 0, 0, 0, 0 }, }; static int evp_init_seq_set_iv(EVP_CIPHER_CTX *ctx, const EVP_INIT_TEST_st *t) { int res = 0; if (t->ivlen != 0) { if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, (int)t->ivlen, NULL), 0)) goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv, -1))) goto err; res = 1; err: return res; } /* * Dynamically discover all applicable ciphers and verify multi-step * init works correctly. This test should require zero maintenance when new * ciphers are added, as the discovery loop handles them. * This test focuses on verifying that ciphers do not reuse a key when it is * changed under the same context in different steps. */ /* maximum AEAD tag buffer size, exceeds AES-CBC-HMAC-SHA512 */ #define EVPTEST_TAG_LEN_MAX EVP_MAX_MD_SIZE /* default AEAD tag length for standard modes (GCM, CCM, OCB, etc.) */ #define EVPTEST_TAG_LEN_DEFAULT 16 typedef struct { const EVP_CIPHER *ciph; const char *name; int keylen; int ivlen; int mode; int taglen; } EVP_CIPHER_TEST_INFO; static EVP_CIPHER_TEST_INFO *cipher_list = NULL; static int cipher_list_n = 0; static int seen_name(const char *name) { int i = 0; if (name == NULL) { return 1; } for (i = 0; i < cipher_list_n; i++) { if (OPENSSL_strcasecmp(cipher_list[i].name, name) == 0) return 1; } return 0; } static void collect_cipher_cb(EVP_CIPHER *ciph, void *arg) { EVP_CIPHER_TEST_INFO *info = NULL; const char *name0 = NULL; int taglen = 0; size_t *allocated = arg; if (ciph == NULL) return; name0 = EVP_CIPHER_get0_name(ciph); taglen = (EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0 ? EVPTEST_TAG_LEN_DEFAULT : 0; if (name0 == NULL || seen_name(name0)) return; if (EVP_CIPHER_get_iv_length(ciph) <= 0) return; if (EVP_CIPHER_get_mode(ciph) == EVP_CIPH_SIV_MODE) return; /* * Exclude ETM ciphers that only exist on ARM. * * These are special-purpose TLS ciphers with a different initialization * order that breaks this test's logic. */ if (EVP_CIPHER_is_a(ciph, "AES-128-CBC-HMAC-SHA1-ETM") || EVP_CIPHER_is_a(ciph, "AES-128-CBC-HMAC-SHA256-ETM") || EVP_CIPHER_is_a(ciph, "AES-128-CBC-HMAC-SHA512-ETM") || EVP_CIPHER_is_a(ciph, "AES-192-CBC-HMAC-SHA1-ETM") || EVP_CIPHER_is_a(ciph, "AES-192-CBC-HMAC-SHA256-ETM") || EVP_CIPHER_is_a(ciph, "AES-192-CBC-HMAC-SHA512-ETM") || EVP_CIPHER_is_a(ciph, "AES-256-CBC-HMAC-SHA1-ETM") || EVP_CIPHER_is_a(ciph, "AES-256-CBC-HMAC-SHA256-ETM") || EVP_CIPHER_is_a(ciph, "AES-256-CBC-HMAC-SHA512-ETM")) return; /* First pass only counts ciphers to allocate memory */ if (allocated != NULL) { (*allocated)++; return; } info = &cipher_list[cipher_list_n]; if (!EVP_CIPHER_up_ref(ciph)) return; info->ciph = ciph; info->name = name0; info->keylen = EVP_CIPHER_get_key_length(ciph); info->ivlen = EVP_CIPHER_get_iv_length(ciph); info->mode = EVP_CIPHER_get_mode(ciph); info->taglen = taglen; cipher_list_n++; } static int setup_cipher_list(void) { size_t cipher_list_size = 0; cipher_list = NULL; cipher_list_n = 0; /* first pass goes through counting only for allocating */ EVP_CIPHER_do_all_provided(NULL, collect_cipher_cb, &cipher_list_size); if (!TEST_size_t_gt(cipher_list_size, 0)) return 0; cipher_list = OPENSSL_malloc(cipher_list_size * sizeof(*cipher_list)); if (!TEST_ptr(cipher_list)) return 0; EVP_CIPHER_do_all_provided(NULL, collect_cipher_cb, NULL); return TEST_true(cipher_list_n > 0); } static void cleanup_cipher_list(void) { int i; if (cipher_list == NULL) return; for (i = 0; i < cipher_list_n; i++) { if (cipher_list[i].ciph != NULL) EVP_CIPHER_free((EVP_CIPHER *)cipher_list[i].ciph); } OPENSSL_free(cipher_list); cipher_list = NULL; cipher_list_n = 0; } /*- * This test verifies that initializing a cipher with a key and IV in * different steps is the same as initializing the cipher in a single step */ static int test_evp_diff_order_init(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_keyiv = NULL; /* used to test multi step init KEY->IV */ EVP_CIPHER_CTX *ctx_ivkey = NULL; /* used to test multi step init IV->KEY */ EVP_CIPHER_CTX *ctx_onestep = NULL; /* base test with single step init */ OSSL_PARAM ivparams[2]; OSSL_PARAM tagparams[2]; OSSL_PARAM get_tagparams[2]; int ivlen = info->ivlen; unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; size_t pt_size = 0, j = 0; unsigned char pt[128] = { 0 }; unsigned char ct_keyiv[128] = { 0 }; int ct_keyiv_len = 0; int ct_keyiv_fin_len = 0; unsigned char ct_ivkey[128] = { 0 }; int ct_ivkey_len = 0; int ct_ivkey_fin_len = 0; unsigned char ct_onestep[128] = { 0 }; int ct_onestep_len = 0; int ct_onestep_fin_len = 0; int taglen = info->taglen; unsigned char tag_keyiv[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_ivkey[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_onestep[EVPTEST_TAG_LEN_MAX] = { 0 }; int blocksz = 0, tmplen = 0, testresult = 1, i = 0; char *errmsg = NULL; ivparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_IVLEN, &ivlen); ivparams[1] = OSSL_PARAM_construct_end(); tagparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_TAGLEN, &taglen); tagparams[1] = OSSL_PARAM_construct_end(); blocksz = EVP_CIPHER_get_block_size(info->ciph); pt_size = (blocksz > 1) ? (size_t)blocksz * 2 : 31; if (!TEST_ptr(ctx_keyiv = EVP_CIPHER_CTX_new())) { errmsg = "CTX_KEYIV_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_keyiv, info->ciph, NULL, NULL, NULL))) { errmsg = "KEYIV_INIT"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_keyiv, ivparams))) { errmsg = "CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_keyiv, tagparams))) { errmsg = "CCM_SET_TAGLEN"; goto err; } } for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); /* Initialize first with key->IV */ if (!TEST_true(EVP_EncryptInit_ex(ctx_keyiv, NULL, NULL, key, NULL))) { errmsg = "INIT_KEY_ONLY"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_keyiv, NULL, NULL, NULL, iv))) { errmsg = "INIT_IV_ONLY"; goto err; } /* disable padding for non-aead block-aligned pt */ if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_keyiv, 0); for (j = 0; j < pt_size; j++) pt[j] = (unsigned char)(0xA0); if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_keyiv, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_keyiv, ct_keyiv, &ct_keyiv_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_keyiv, ct_keyiv + ct_keyiv_len, &ct_keyiv_fin_len))) { errmsg = "ENCRYPT_FINAL"; goto err; } ct_keyiv_len += ct_keyiv_fin_len; if (info->taglen > 0) { /* override taglen from context if available */ int tl = EVP_CIPHER_CTX_get_tag_length(ctx_keyiv); if (tl > 0) taglen = tl; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_keyiv, taglen); get_tagparams[1] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx_keyiv, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } } /* INIT IV then KEY ctx_ivkey */ if (!TEST_ptr(ctx_ivkey = EVP_CIPHER_CTX_new())) { errmsg = "CTX_IVKEY_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_ivkey, info->ciph, NULL, NULL, NULL))) { errmsg = "IVKEY_INIT"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_ivkey, ivparams))) { errmsg = "CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_ivkey, tagparams))) { errmsg = "CCM_SET_TAGLEN"; goto err; } } /* Initialize first with IV */ if (!TEST_true(EVP_EncryptInit_ex(ctx_ivkey, NULL, NULL, NULL, iv))) { errmsg = "INIT_IV_ONLY"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_ivkey, NULL, NULL, key, NULL))) { errmsg = "INIT_KEY_ONLY"; goto err; } if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_ivkey, 0); if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_ivkey, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_ivkey, ct_ivkey, &ct_ivkey_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_ivkey, ct_ivkey + ct_ivkey_len, &ct_ivkey_fin_len))) { errmsg = "ENCRYPT_FINAL"; goto err; } ct_ivkey_len += ct_ivkey_fin_len; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_ivkey, taglen); if (info->taglen > 0 && !TEST_true(EVP_CIPHER_CTX_get_params(ctx_ivkey, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } /* single step initialization */ if (!TEST_ptr(ctx_onestep = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ONESTEP_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_onestep, info->ciph, NULL, NULL, NULL))) { errmsg = "ONESTEP_INIT"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_onestep, ivparams))) { errmsg = "CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_onestep, tagparams))) { errmsg = "CCM_SET_TAGLEN"; goto err; } } /* Initialize in a single step */ if (!TEST_true(EVP_EncryptInit_ex(ctx_onestep, NULL, NULL, key, iv))) { errmsg = "SINGLE_STEP_IV"; goto err; } if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_onestep, 0); if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_onestep, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_onestep, ct_onestep, &ct_onestep_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_onestep, ct_onestep + ct_onestep_len, &ct_onestep_fin_len))) { errmsg = "ENCRYPT_FINAL_ONE_STEP"; goto err; } ct_onestep_len += ct_onestep_fin_len; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_onestep, taglen); if (info->taglen > 0 && !TEST_true(EVP_CIPHER_CTX_get_params(ctx_onestep, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } /* Compare single-call vs key->iv */ if (!TEST_int_eq(ct_onestep_len, ct_keyiv_len) || !TEST_mem_eq(ct_onestep, ct_onestep_len, ct_keyiv, ct_keyiv_len)) { errmsg = "CT_MISMATCH_SINGLE_vs_KEYIV"; goto err; } /* Compare single-call vs iv->key */ if (!TEST_int_eq(ct_onestep_len, ct_ivkey_len) || !TEST_mem_eq(ct_onestep, ct_onestep_len, ct_ivkey, ct_ivkey_len)) { errmsg = "CT_MISMATCH_SINGLE_vs_IVKEY"; goto err; } if (info->taglen > 0 && !TEST_mem_eq(tag_onestep, taglen, tag_keyiv, taglen)) { errmsg = "TAG_MISMATCH_SINGLE_vs_KEYIV"; goto err; } if (info->taglen > 0 && !TEST_mem_eq(tag_onestep, taglen, tag_ivkey, taglen)) { errmsg = "TAG_MISMATCH_SINGLE_vs_IVKEY"; goto err; } err: if (errmsg != NULL) { TEST_info("evp_multi_step_integrity_test %d, %s: %s", idx, errmsg, info->name); testresult = 0; } EVP_CIPHER_CTX_free(ctx_keyiv); EVP_CIPHER_CTX_free(ctx_ivkey); EVP_CIPHER_CTX_free(ctx_onestep); return testresult; } /*- * A zero-length AEAD message driven through the one-shot EVP_Cipher() interface * must agree with the streaming EVP_CipherFinal_ex() path. This checks: * - an empty message yields the same tag via both interfaces * - the true tag passes verification on decrypt * - the modified tag fails verification on decrypt */ static int test_evp_oneshot_aead_zerolen(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_stream = NULL; /* reference: final only */ EVP_CIPHER_CTX *ctx_oneshot = NULL; /* encrypt via EVP_Cipher(in == NULL) */ EVP_CIPHER_CTX *ctx_dec = NULL; /* decrypt via EVP_Cipher(in == NULL) */ EVP_CIPHER_CTX *ctx_dec_bad = NULL; /* decrypt with a corrupted tag */ EVP_CIPHER_CTX *ctx_dec_s = NULL; /* streaming decrypt */ EVP_CIPHER_CTX *ctx_dec_s_bad = NULL; /* streaming decrypt, corrupted tag */ OSSL_PARAM get_tagparams[2]; OSSL_PARAM set_tagparams[2]; int taglen = info->taglen; unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; unsigned char ct[16] = { 0 }; /* scratch out; AEAD finalize writes no data */ int finlen = 0, oneshot_flen = 0, dec_flen = 0; unsigned char tag_stream[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_oneshot[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_bad[EVPTEST_TAG_LEN_MAX] = { 0 }; int i = 0, testresult = 1; char *errmsg = NULL; /* filter out various modes */ if (info->taglen == 0 || info->mode == EVP_CIPH_CCM_MODE || info->mode == EVP_CIPH_OCB_MODE || info->mode == EVP_CIPH_GCM_SIV_MODE /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA256") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA256") || EVP_CIPHER_is_a(info->ciph, "ChaCha20-Poly1305")) return 1; for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); /* reference: streaming finalize of an empty message */ if (!TEST_ptr(ctx_stream = EVP_CIPHER_CTX_new())) { errmsg = "STREAM_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex2(ctx_stream, info->ciph, key, iv, NULL))) { errmsg = "STREAM_INIT"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_stream, ct, &finlen))) { errmsg = "STREAM_FINAL"; goto err; } /* clamp to the negotiated tag length if the cipher reports one */ i = EVP_CIPHER_CTX_get_tag_length(ctx_stream); if (i > 0) taglen = i; /* bound the memcpy, should never happen but helps static analysis */ if (taglen > EVPTEST_TAG_LEN_MAX) { errmsg = "TAGLEN_EXCEEDS_BUF"; goto err; } get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_stream, taglen); get_tagparams[1] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx_stream, get_tagparams))) { errmsg = "STREAM_GET_TAG"; goto err; } /* one-shot encrypt: finalize the empty message with in == NULL */ if (!TEST_ptr(ctx_oneshot = EVP_CIPHER_CTX_new())) { errmsg = "ONESHOT_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex2(ctx_oneshot, info->ciph, key, iv, NULL))) { errmsg = "ONESHOT_INIT"; goto err; } oneshot_flen = EVP_Cipher(ctx_oneshot, ct, NULL, 0); if (!TEST_int_ge(oneshot_flen, 0)) { errmsg = "ONESHOT_FINAL_NULL"; goto err; } get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_oneshot, taglen); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx_oneshot, get_tagparams))) { errmsg = "ONESHOT_GET_TAG"; goto err; } if (!TEST_mem_eq(tag_oneshot, taglen, tag_stream, taglen)) { errmsg = "TAG_MISMATCH_ONESHOT_vs_STREAM"; goto err; } /* one-shot decrypt: the correct tag must verify via in == NULL */ if (!TEST_ptr(ctx_dec = EVP_CIPHER_CTX_new())) { errmsg = "DEC_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec, info->ciph, key, iv, NULL))) { errmsg = "DEC_INIT"; goto err; } set_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_stream, taglen); set_tagparams[1] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec, set_tagparams))) { errmsg = "DEC_SET_TAG"; goto err; } dec_flen = EVP_Cipher(ctx_dec, ct, NULL, 0); if (!TEST_int_ge(dec_flen, 0)) { errmsg = "DEC_VERIFY_NULL"; goto err; } /* * ...and a corrupted tag must be rejected. EVP_Cipher() returns < 0 on a * failed one-shot, so a non-negative result here means verification was * skipped or wrongly accepted the bad tag. */ memcpy(tag_bad, tag_stream, taglen); tag_bad[0] ^= 0x01; if (!TEST_ptr(ctx_dec_bad = EVP_CIPHER_CTX_new())) { errmsg = "DEC_BAD_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec_bad, info->ciph, key, iv, NULL))) { errmsg = "DEC_BAD_INIT"; goto err; } set_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_bad, taglen); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec_bad, set_tagparams))) { errmsg = "DEC_BAD_SET_TAG"; goto err; } if (!TEST_int_lt(EVP_Cipher(ctx_dec_bad, ct, NULL, 0), 0)) { errmsg = "DEC_BADTAG_NOT_REJECTED"; goto err; } /* streaming decrypt: the correct tag must verify via EVP_DecryptFinal_ex */ if (!TEST_ptr(ctx_dec_s = EVP_CIPHER_CTX_new())) { errmsg = "DEC_STREAM_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec_s, info->ciph, key, iv, NULL))) { errmsg = "DEC_STREAM_INIT"; goto err; } set_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_stream, taglen); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec_s, set_tagparams))) { errmsg = "DEC_STREAM_SET_TAG"; goto err; } if (!TEST_true(EVP_DecryptFinal_ex(ctx_dec_s, ct, &finlen))) { errmsg = "DEC_STREAM_VERIFY"; goto err; } /* streaming decrypt: a corrupted tag must be rejected */ if (!TEST_ptr(ctx_dec_s_bad = EVP_CIPHER_CTX_new())) { errmsg = "DEC_STREAM_BAD_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec_s_bad, info->ciph, key, iv, NULL))) { errmsg = "DEC_STREAM_BAD_INIT"; goto err; } set_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_bad, taglen); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec_s_bad, set_tagparams))) { errmsg = "DEC_STREAM_BAD_SET_TAG"; goto err; } if (!TEST_false(EVP_DecryptFinal_ex(ctx_dec_s_bad, ct, &finlen))) { errmsg = "DEC_STREAM_BADTAG_NOT_REJECTED"; goto err; } err: if (errmsg != NULL) { TEST_info("test_evp_oneshot_aead_zerolen %d, %s: %s", idx, errmsg, info->name); testresult = 0; } EVP_CIPHER_CTX_free(ctx_stream); EVP_CIPHER_CTX_free(ctx_oneshot); EVP_CIPHER_CTX_free(ctx_dec); EVP_CIPHER_CTX_free(ctx_dec_bad); EVP_CIPHER_CTX_free(ctx_dec_s); EVP_CIPHER_CTX_free(ctx_dec_s_bad); return testresult; } /* * With AEAD ciphers, a tag is an input for decryption (the value to verify) * and an output of encryption (the generated value). Therefore: * - supplying a tag value while encrypting must fail * - reading a tag while decrypting must fail * - error codes should be consistent across all AEADs */ static int test_evp_aead_tag_direction(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_enc = NULL; /* set tag while encrypting: must fail */ EVP_CIPHER_CTX *ctx_dec = NULL; /* get tag while decrypting: must fail */ OSSL_PARAM tagparams[2]; unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; unsigned char tag[EVPTEST_TAG_LEN_MAX] = { 0 }; int i = 0, testresult = 0, expected = 0; char *errmsg = NULL; unsigned long err_code = 0; /* filter out various modes */ if (info->taglen == 0 /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA256") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA256")) return 1; for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); /* * a tag value supplied while encrypting must be rejected. data is non-NULL * so this is a value-set, not the data == NULL tag-length query. */ if (!TEST_ptr(ctx_enc = EVP_CIPHER_CTX_new())) { errmsg = "ENC_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex2(ctx_enc, info->ciph, key, iv, NULL))) { errmsg = "ENC_INIT"; goto err; } tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, info->taglen); tagparams[1] = OSSL_PARAM_construct_end(); ERR_set_mark(); if (!TEST_false(EVP_CIPHER_CTX_set_params(ctx_enc, tagparams))) { ERR_clear_last_mark(); errmsg = "ENC_SET_TAG_NOT_REJECTED"; goto err; } err_code = ERR_peek_last_error(); if (!TEST_int_eq(ERR_GET_LIB(err_code), ERR_LIB_PROV) || !TEST_int_eq(ERR_GET_REASON(err_code), PROV_R_TAG_NOT_NEEDED)) { ERR_clear_last_mark(); expected = PROV_R_TAG_NOT_NEEDED; errmsg = "ENC_SET_TAG_WRONG_REASON"; goto err; } ERR_pop_to_mark(); /* a tag read while decrypting must be rejected */ if (!TEST_ptr(ctx_dec = EVP_CIPHER_CTX_new())) { errmsg = "DEC_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec, info->ciph, key, iv, NULL))) { errmsg = "DEC_INIT"; goto err; } tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, info->taglen); tagparams[1] = OSSL_PARAM_construct_end(); /* set a tag so the get below is exercised with one present */ if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec, tagparams))) { errmsg = "DEC_SET_TAG_REJECTED"; goto err; } /* but a tag must never be readable back while decrypting */ ERR_set_mark(); if (!TEST_false(EVP_CIPHER_CTX_get_params(ctx_dec, tagparams))) { ERR_clear_last_mark(); errmsg = "DEC_GET_TAG_NOT_REJECTED"; goto err; } err_code = ERR_peek_last_error(); if (!TEST_int_eq(ERR_GET_LIB(err_code), ERR_LIB_PROV) || !TEST_int_eq(ERR_GET_REASON(err_code), PROV_R_TAG_NOT_SET)) { ERR_clear_last_mark(); expected = PROV_R_TAG_NOT_SET; errmsg = "DEC_GET_TAG_WRONG_REASON"; goto err; } ERR_pop_to_mark(); testresult = 1; err: if (errmsg != NULL) { if (expected != 0) TEST_info("test_evp_aead_tag_direction %d, %s: %s" " (expected reason %d, got %d)", idx, errmsg, info->name, expected, ERR_GET_REASON(err_code)); else TEST_info("test_evp_aead_tag_direction %d, %s: %s", idx, errmsg, info->name); } EVP_CIPHER_CTX_free(ctx_enc); EVP_CIPHER_CTX_free(ctx_dec); return testresult; } /* * With AEAD ciphers, associated data must precede the payload. Once plaintext * or ciphertext processing has begun, a further AAD update (out == NULL) must * be rejected, and the rejection must be reported the same way across every * AEAD: ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER. The invariant is * checked in both the encrypt and decrypt directions. */ static int test_evp_aead_late_aad(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_enc = NULL; /* late AAD after plaintext: must fail */ EVP_CIPHER_CTX *ctx_dec = NULL; /* late AAD after ciphertext: must fail */ unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; unsigned char aad[] = "aad"; unsigned char msg[] = "message"; unsigned char out[sizeof(msg) + EVP_MAX_BLOCK_LENGTH]; int i = 0, len = 0, testresult = 0, expected = 0; char *errmsg = NULL; unsigned long err_code = 0; if (info->taglen == 0 /* skip non-AEAD */ || info->mode == EVP_CIPH_GCM_MODE /* rejects, raises 102 PROV_R_CIPHER_OPERATION_FAILED */ || info->mode == EVP_CIPH_CCM_MODE /* fails at first AAD */ || info->mode == EVP_CIPH_OCB_MODE /* accepts late AAD */ /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA1") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-128-CBC-HMAC-SHA256") /* skip TLS stitched MTE cipher */ || EVP_CIPHER_is_a(info->ciph, "AES-256-CBC-HMAC-SHA256")) return 1; for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); /* encrypt: aad, then plaintext, then a late aad update must be rejected */ if (!TEST_ptr(ctx_enc = EVP_CIPHER_CTX_new())) { errmsg = "ENC_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex2(ctx_enc, info->ciph, key, iv, NULL))) { errmsg = "ENC_INIT"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_enc, NULL, &len, aad, sizeof(aad)))) { errmsg = "ENC_AAD"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_enc, out, &len, msg, sizeof(msg)))) { errmsg = "ENC_PLAINTEXT"; goto err; } ERR_set_mark(); if (!TEST_false(EVP_EncryptUpdate(ctx_enc, NULL, &len, aad, sizeof(aad)))) { ERR_clear_last_mark(); errmsg = "ENC_LATE_AAD_NOT_REJECTED"; goto err; } err_code = ERR_peek_last_error(); if (!TEST_int_eq(ERR_GET_LIB(err_code), ERR_LIB_PROV) || !TEST_int_eq(ERR_GET_REASON(err_code), PROV_R_UPDATE_CALL_OUT_OF_ORDER)) { ERR_clear_last_mark(); expected = PROV_R_UPDATE_CALL_OUT_OF_ORDER; errmsg = "ENC_LATE_AAD_WRONG_REASON"; goto err; } ERR_pop_to_mark(); /* decrypt: same sequence, late aad after ciphertext must be rejected */ if (!TEST_ptr(ctx_dec = EVP_CIPHER_CTX_new())) { errmsg = "DEC_ALLOC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex2(ctx_dec, info->ciph, key, iv, NULL))) { errmsg = "DEC_INIT"; goto err; } if (!TEST_true(EVP_DecryptUpdate(ctx_dec, NULL, &len, aad, sizeof(aad)))) { errmsg = "DEC_AAD"; goto err; } /* the ciphertext content is irrelevant; the tag is never finalized here */ if (!TEST_true(EVP_DecryptUpdate(ctx_dec, out, &len, msg, sizeof(msg)))) { errmsg = "DEC_CIPHERTEXT"; goto err; } ERR_set_mark(); if (!TEST_false(EVP_DecryptUpdate(ctx_dec, NULL, &len, aad, sizeof(aad)))) { ERR_clear_last_mark(); errmsg = "DEC_LATE_AAD_NOT_REJECTED"; goto err; } err_code = ERR_peek_last_error(); if (!TEST_int_eq(ERR_GET_LIB(err_code), ERR_LIB_PROV) || !TEST_int_eq(ERR_GET_REASON(err_code), PROV_R_UPDATE_CALL_OUT_OF_ORDER)) { ERR_clear_last_mark(); expected = PROV_R_UPDATE_CALL_OUT_OF_ORDER; errmsg = "DEC_LATE_AAD_WRONG_REASON"; goto err; } ERR_pop_to_mark(); testresult = 1; err: if (errmsg != NULL) { if (expected != 0) TEST_info("test_evp_aead_late_aad %d, %s: %s" " (expected reason %d, got %d)", idx, errmsg, info->name, expected, ERR_GET_REASON(err_code)); else TEST_info("test_evp_aead_late_aad %d, %s: %s", idx, errmsg, info->name); } EVP_CIPHER_CTX_free(ctx_enc); EVP_CIPHER_CTX_free(ctx_dec); return testresult; } /* * Verify stale key is not being used after providing a new key in multiple steps. * This test performs a full round of encryption and then changes the * key and then the IV in a multi-step init. * This is compared to another context without reinitialization to check * if the new key is loaded correctly. */ static int test_evp_stale_key_reinit(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_reinit = NULL; /* used to test multi step init KEY->IV */ EVP_CIPHER_CTX *ctx_onestep = NULL; /* base test with single step init */ OSSL_PARAM ivparams[2]; OSSL_PARAM tagparams[2]; OSSL_PARAM get_tagparams[2]; int ivlen = info->ivlen; unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char key2[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; unsigned char iv2[EVP_MAX_IV_LENGTH] = { 0 }; size_t pt_size = 0, j = 0; unsigned char pt[128] = { 0 }; unsigned char ct[128] = { 0 }; int ct_len = 0; int ct_fin_len = 0; unsigned char ct_reinit[128] = { 0 }; int ct_reinit_len = 0; int ct_reinit_fin_len = 0; unsigned char ct_onestep[128] = { 0 }; int ct_onestep_len = 0; int ct_onestep_fin_len = 0; int taglen = info->taglen; unsigned char tag[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_reinit[EVPTEST_TAG_LEN_MAX] = { 0 }; unsigned char tag_onestep[EVPTEST_TAG_LEN_MAX] = { 0 }; int blocksz = 0, tmplen = 0, testresult = 1, i = 0; char *errmsg = NULL; ivparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_IVLEN, &ivlen); ivparams[1] = OSSL_PARAM_construct_end(); tagparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_TAGLEN, &taglen); tagparams[1] = OSSL_PARAM_construct_end(); blocksz = EVP_CIPHER_get_block_size(info->ciph); pt_size = (blocksz > 1) ? (size_t)blocksz * 2 : 31; for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->keylen && i < (int)sizeof(key2); i++) key2[i] = (unsigned char)(0xF0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv2); i++) iv2[i] = (unsigned char)(0xDA + i); for (j = 0; j < pt_size; j++) pt[j] = (unsigned char)(0xA7); if (!TEST_ptr(ctx_reinit = EVP_CIPHER_CTX_new())) { errmsg = "CTX_REINIT_ALLOC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_reinit, info->ciph, NULL, NULL, NULL))) { errmsg = "CTX_FIRST_INIT"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_reinit, ivparams))) { errmsg = "CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_reinit, tagparams))) { errmsg = "CCM_SET_TAGLEN"; goto err; } } /* Initialize first with key */ if (!TEST_true(EVP_EncryptInit_ex(ctx_reinit, NULL, NULL, key, iv))) { errmsg = "FIRST_KEY_INIT"; goto err; } /* disable padding for non-aead block-aligned pt */ if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_reinit, 0); if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_reinit, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_reinit, ct, &ct_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_reinit, ct + ct_len, &ct_fin_len))) { errmsg = "ENCRYPT_FINAL"; goto err; } ct_len += ct_fin_len; if (info->taglen > 0) { /* override taglen from context if available */ int tl = EVP_CIPHER_CTX_get_tag_length(ctx_reinit); if (tl > 0) taglen = tl; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, taglen); get_tagparams[1] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx_reinit, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } } /* use same context with a different key and iv in multiple steps */ if (!TEST_true(EVP_EncryptInit_ex(ctx_reinit, NULL, NULL, key2, NULL))) { errmsg = "REINIT_KEY"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_reinit, NULL, NULL, NULL, iv2))) { errmsg = "REINIT_IV"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_reinit, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_reinit, ct_reinit, &ct_reinit_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_reinit, ct_reinit + ct_reinit_len, &ct_reinit_fin_len))) { errmsg = "ENCRYPT_FINAL"; goto err; } ct_reinit_len += ct_reinit_fin_len; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_reinit, taglen); if (info->taglen > 0 && !TEST_true(EVP_CIPHER_CTX_get_params(ctx_reinit, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } /* Initialize in a single step */ if (!TEST_ptr(ctx_onestep = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC_BASE_CASE"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_onestep, info->ciph, NULL, NULL, NULL))) { errmsg = "BASE_CASE_INIT"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_onestep, ivparams))) { errmsg = "CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_onestep, tagparams))) { errmsg = "CCM_SET_TAGLEN"; goto err; } } if (!TEST_true(EVP_EncryptInit_ex(ctx_onestep, NULL, NULL, key2, iv2))) { errmsg = "SINGLE_STEP_INIT"; goto err; } if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_onestep, 0); if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_onestep, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_onestep, ct_onestep, &ct_onestep_len, pt, (int)pt_size))) { errmsg = "ENCRYPT_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_onestep, ct_onestep + ct_onestep_len, &ct_onestep_fin_len))) { errmsg = "ENCRYPT_FINAL_ONE_STEP"; goto err; } ct_onestep_len += ct_onestep_fin_len; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag_onestep, taglen); if (info->taglen > 0 && !TEST_true(EVP_CIPHER_CTX_get_params(ctx_onestep, get_tagparams))) { errmsg = "AEAD_GET_TAG"; goto err; } /* Compare single-call vs key->iv */ if (!TEST_int_eq(ct_reinit_len, ct_onestep_len) || !TEST_mem_eq(ct_reinit, ct_reinit_len, ct_onestep, ct_onestep_len)) { errmsg = "CT_MISMATCH_SINGLE_vs_REINIT"; goto err; } if (info->taglen > 0 && !TEST_mem_eq(tag_onestep, taglen, tag_reinit, taglen)) { errmsg = "TAG_MISMATCH_SINGLE_vs_REINIT"; goto err; } err: if (errmsg != NULL) { TEST_info("evp_stale_key_integrity_test %d, %s: %s", idx, errmsg, info->name); testresult = 0; } EVP_CIPHER_CTX_free(ctx_onestep); EVP_CIPHER_CTX_free(ctx_reinit); return testresult; } /* * Decrypt roundtrip: * Encrypt single-call, decrypt via multi-step init, verify plaintext recovery. * For AEAD ciphers this also exercises tag verification. * The goal is to test that EVP behaves the same when initializing the key * in different steps or in a single one in decryption. */ static int test_evp_decrypt_roundtrip_multistep(int idx) { const EVP_CIPHER_TEST_INFO *info = &cipher_list[idx]; EVP_CIPHER_CTX *ctx_enc = NULL; /* single-call encrypt */ EVP_CIPHER_CTX *ctx_dec = NULL; /* multi-step decrypt (KEY -> IV) */ OSSL_PARAM ivparams[2]; OSSL_PARAM tagparams[2]; OSSL_PARAM get_tagparams[2]; int ivlen = info->ivlen; unsigned char key[EVP_MAX_KEY_LENGTH] = { 0 }; unsigned char iv[EVP_MAX_IV_LENGTH] = { 0 }; size_t pt_size = 0, j = 0; unsigned char pt[128] = { 0 }; unsigned char ct[128] = { 0 }; int ct_len = 0; int ct_fin_len = 0; unsigned char rt[128] = { 0 }; /* recovered plaintext */ int rt_len = 0; int rt_fin_len = 0; int taglen = info->taglen; unsigned char tag[EVPTEST_TAG_LEN_MAX] = { 0 }; int blocksz = 0, tmplen = 0, testresult = 1, i = 0; char *errmsg = NULL; blocksz = EVP_CIPHER_get_block_size(info->ciph); pt_size = (blocksz > 1) ? (size_t)blocksz * 2 : 31; ivparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_IVLEN, &ivlen); ivparams[1] = OSSL_PARAM_construct_end(); tagparams[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_AEAD_TAGLEN, &taglen); tagparams[1] = OSSL_PARAM_construct_end(); for (i = 0; i < info->keylen && i < (int)sizeof(key); i++) key[i] = (unsigned char)(0xA0 + i); for (i = 0; i < info->ivlen && i < (int)sizeof(iv); i++) iv[i] = (unsigned char)(0xB0 + i); for (j = 0; j < pt_size; j++) pt[j] = (unsigned char)(0xA7); /* Encrypt: single-call init */ if (!TEST_ptr(ctx_enc = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC_ENC"; goto err; } if (!TEST_true(EVP_EncryptInit_ex(ctx_enc, info->ciph, NULL, NULL, NULL))) { errmsg = "ENC_INIT_ALG"; goto err; } if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_enc, ivparams))) { errmsg = "ENC_CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_enc, tagparams))) { errmsg = "ENC_CCM_SET_TAGLEN"; goto err; } } if (!TEST_true(EVP_EncryptInit_ex(ctx_enc, NULL, NULL, key, iv))) { errmsg = "ENC_INIT_KEYIV"; goto err; } /* disable padding for non-aead block-aligned pt */ if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_enc, 0); /* CCM requires declaring plaintext length before actual EncryptUpdate */ if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_EncryptUpdate(ctx_enc, NULL, &tmplen, NULL, (int)pt_size))) { errmsg = "ENC_CCM_DECLARE_PTLEN"; goto err; } if (!TEST_true(EVP_EncryptUpdate(ctx_enc, ct, &ct_len, pt, (int)pt_size))) { errmsg = "ENC_UPDATE"; goto err; } if (!TEST_true(EVP_EncryptFinal_ex(ctx_enc, ct + ct_len, &ct_fin_len))) { errmsg = "ENC_FINAL"; goto err; } ct_len += ct_fin_len; if (info->taglen > 0) { /* override taglen from context if available */ int tl = EVP_CIPHER_CTX_get_tag_length(ctx_enc); if (tl > 0) taglen = tl; get_tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, taglen); get_tagparams[1] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx_enc, get_tagparams))) { errmsg = "ENC_AEAD_GET_TAG"; goto err; } } /* Decrypt: multi-step init (KEY -> IV) */ if (!TEST_ptr(ctx_dec = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC_DEC"; goto err; } if (!TEST_true(EVP_DecryptInit_ex(ctx_dec, info->ciph, NULL, NULL, NULL))) { errmsg = "DEC_INIT_ALG"; goto err; } tagparams[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, tag, (size_t)taglen); /* CCM requires tag before init */ if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE) { if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec, ivparams))) { errmsg = "DEC_CCM_SET_IVLEN"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec, tagparams))) { errmsg = "DEC_CCM_SET_TAG"; goto err; } } /* key-only then iv-only */ if (!TEST_true(EVP_DecryptInit_ex(ctx_dec, NULL, NULL, key, NULL))) { errmsg = "DEC_INIT_KEY_ONLY"; goto err; } if (!TEST_true(EVP_DecryptInit_ex(ctx_dec, NULL, NULL, NULL, iv))) { errmsg = "DEC_INIT_IV_ONLY"; goto err; } /*- * Non-CCM AEADs: set tag after multi-step init, reinit can clear * provider tag state (e.g. ETM ciphers). */ if (info->taglen > 0 && info->mode != EVP_CIPH_CCM_MODE && !TEST_true(EVP_CIPHER_CTX_set_params(ctx_dec, tagparams))) { errmsg = "DEC_AEAD_SET_TAG"; goto err; } if (info->taglen == 0 && blocksz > 1) EVP_CIPHER_CTX_set_padding(ctx_dec, 0); /* CCM requires declaring ct (or pt) len before DecryptUpdate */ if (info->taglen > 0 && info->mode == EVP_CIPH_CCM_MODE && !TEST_true(EVP_DecryptUpdate(ctx_dec, NULL, &tmplen, NULL, ct_len))) { errmsg = "DEC_CCM_DECLARE_CTLEN"; goto err; } if (!TEST_true(EVP_DecryptUpdate(ctx_dec, rt, &rt_len, ct, ct_len))) { errmsg = "DEC_UPDATE"; goto err; } if (!TEST_true(EVP_DecryptFinal_ex(ctx_dec, rt + rt_len, &rt_fin_len))) { /* For AEAD this is where tag verification failure is reported */ errmsg = "DEC_FINAL_OR_TAG_VERIFY"; goto err; } rt_len += rt_fin_len; /* Compare recovered plaintext */ if (!TEST_size_t_eq((size_t)rt_len, pt_size) || !TEST_mem_eq(rt, (size_t)rt_len, pt, pt_size)) { errmsg = "PLAINTEXT_MISMATCH"; goto err; } err: if (errmsg != NULL) { TEST_info("evp_decrypt_roundtrip_multistep %d, %s: %s", idx, errmsg, info->name); testresult = 0; } EVP_CIPHER_CTX_free(ctx_enc); EVP_CIPHER_CTX_free(ctx_dec); return testresult; } /* * Test step-wise cipher initialization via EVP_CipherInit_ex where the * arguments are given one at a time and a final adjustment to the enc * parameter sets the correct operation. */ static int test_evp_init_seq(int idx) { int outlen1, outlen2; int testresult = 0; unsigned char outbuf[1024]; unsigned char tag[16]; const EVP_INIT_TEST_st *t = &evp_init_tests[idx]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *type = NULL; size_t taglen = sizeof(tag); char *errmsg = NULL; ctx = EVP_CIPHER_CTX_new(); if (ctx == NULL) { errmsg = "CTX_ALLOC"; goto err; } if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq))) { errmsg = "CIPHER_FETCH"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, t->initenc))) { errmsg = "EMPTY_ENC_INIT"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { errmsg = "PADDING"; goto err; } if (t->keyfirst && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) { errmsg = "KEY_INIT (before iv)"; goto err; } if (!evp_init_seq_set_iv(ctx, t)) { errmsg = "IV_INIT"; goto err; } if (t->keyfirst == 0 && !TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, t->key, NULL, -1))) { errmsg = "KEY_INIT (after iv)"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, t->finalenc))) { errmsg = "FINAL_ENC_INIT"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, (int)t->inlen))) { errmsg = "CIPHER_UPDATE"; goto err; } if (t->finalenc == 0 && t->tag != NULL) { /* Set expected tag */ if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)t->taglen, (void *)t->tag), 0)) { errmsg = "SET_TAG"; goto err; } } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL"; goto err; } if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { errmsg = "WRONG_RESULT"; goto err; } if (t->finalenc != 0 && t->tag != NULL) { if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, (int)taglen, tag), 0)) { errmsg = "GET_TAG"; goto err; } if (!TEST_mem_eq(t->tag, t->taglen, tag, taglen)) { errmsg = "TAG_ERROR"; goto err; } } testresult = 1; err: if (errmsg != NULL) TEST_info("evp_init_test %d: %s", idx, errmsg); EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return testresult; } /* * Test re-initialization of cipher context without changing key or iv. * The result of both iteration should be the same. */ static int test_evp_reinit_seq(int idx) { int outlen1, outlen2, outlen_final; int testresult = 0; unsigned char outbuf1[1024]; unsigned char outbuf2[1024]; const EVP_INIT_TEST_st *t = &evp_reinit_tests[idx]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *type = NULL; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_ptr(type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) /* setup cipher context */ || !TEST_true(EVP_CipherInit_ex2(ctx, type, t->key, t->iv, t->initenc, NULL)) /* first iteration */ || !TEST_true(EVP_CipherUpdate(ctx, outbuf1, &outlen1, t->input, (int)t->inlen)) || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf1, &outlen_final)) /* check test results iteration 1 */ || !TEST_mem_eq(t->expected, t->expectedlen, outbuf1, outlen1 + outlen_final) /* now re-init the context (same cipher, key and iv) */ || !TEST_true(EVP_CipherInit_ex2(ctx, NULL, NULL, NULL, -1, NULL)) /* second iteration */ || !TEST_true(EVP_CipherUpdate(ctx, outbuf2, &outlen2, t->input, (int)t->inlen)) || !TEST_true(EVP_CipherFinal_ex(ctx, outbuf2, &outlen_final)) /* check test results iteration 2 */ || !TEST_mem_eq(t->expected, t->expectedlen, outbuf2, outlen2 + outlen_final)) goto err; testresult = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return testresult; } typedef struct { const unsigned char *input; const unsigned char *expected; size_t inlen; size_t expectedlen; int enc; } EVP_RESET_TEST_st; static const EVP_RESET_TEST_st evp_reset_tests[] = { { cfbPlaintext, cfbCiphertext, sizeof(cfbPlaintext), sizeof(cfbCiphertext), 1 }, { cfbCiphertext, cfbPlaintext, sizeof(cfbCiphertext), sizeof(cfbPlaintext), 0 } }; /* * Test a reset of a cipher via EVP_CipherInit_ex after the cipher has already * been used. */ static int test_evp_reset(int idx) { const EVP_RESET_TEST_st *t = &evp_reset_tests[idx]; int outlen1, outlen2; int testresult = 0; unsigned char outbuf[1024]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *type = NULL; char *errmsg = NULL; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC"; goto err; } if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-128-cfb", testpropq))) { errmsg = "CIPHER_FETCH"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) { errmsg = "CIPHER_INIT"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { errmsg = "PADDING"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, (int)t->inlen))) { errmsg = "CIPHER_UPDATE"; goto err; } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL"; goto err; } if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { errmsg = "WRONG_RESULT"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, NULL, -1))) { errmsg = "CIPHER_REINIT"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, t->input, (int)t->inlen))) { errmsg = "CIPHER_UPDATE (reinit)"; goto err; } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL (reinit)"; goto err; } if (!TEST_mem_eq(t->expected, t->expectedlen, outbuf, outlen1 + outlen2)) { errmsg = "WRONG_RESULT (reinit)"; goto err; } testresult = 1; err: if (errmsg != NULL) TEST_info("test_evp_reset %d: %s", idx, errmsg); EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return testresult; } typedef struct { const char *cipher; int enc; } EVP_UPDATED_IV_TEST_st; static const EVP_UPDATED_IV_TEST_st evp_updated_iv_tests[] = { { "aes-128-cfb", 1 }, { "aes-128-cfb", 0 }, { "aes-128-cfb1", 1 }, { "aes-128-cfb1", 0 }, { "aes-128-cfb8", 1 }, { "aes-128-cfb8", 0 }, { "aes-128-ofb", 1 }, { "aes-128-ofb", 0 }, { "aes-128-ctr", 1 }, { "aes-128-ctr", 0 }, { "aes-128-cbc", 1 }, { "aes-128-cbc", 0 } }; /* * Test that the IV in the context is updated during a crypto operation for CFB * and OFB. */ static int test_evp_updated_iv(int idx) { const EVP_UPDATED_IV_TEST_st *t = &evp_updated_iv_tests[idx]; int outlen1, outlen2; int testresult = 0; unsigned char outbuf[1024]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *type = NULL; unsigned char updated_iv[EVP_MAX_IV_LENGTH]; int iv_len; char *errmsg = NULL; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC"; goto err; } if ((type = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) == NULL) { TEST_info("cipher %s not supported, skipping", t->cipher); goto ok; } if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, kCFBDefaultKey, iCFBIV, t->enc))) { errmsg = "CIPHER_INIT"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_set_padding(ctx, 0))) { errmsg = "PADDING"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, cfbPlaintext, sizeof(cfbPlaintext)))) { errmsg = "CIPHER_UPDATE"; goto err; } if (!TEST_true(EVP_CIPHER_CTX_get_updated_iv(ctx, updated_iv, sizeof(updated_iv)))) { errmsg = "CIPHER_CTX_GET_UPDATED_IV"; goto err; } else { if (fips_provider_version_ge(testctx, 3, 6, 0) && !TEST_false(ERR_peek_error())) { errmsg = "CIPHER_CTX_GET_UPDATED_IV_SILENT_ERROR"; goto err; } } iv_len = EVP_CIPHER_CTX_get_iv_length(ctx); if (!TEST_int_ge(iv_len, 0)) { errmsg = "CIPHER_CTX_GET_IV_LEN"; goto err; } if (!TEST_mem_ne(iCFBIV, sizeof(iCFBIV), updated_iv, iv_len)) { errmsg = "IV_NOT_UPDATED"; goto err; } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL"; goto err; } ok: testresult = 1; err: if (errmsg != NULL) TEST_info("test_evp_updated_iv %d: %s", idx, errmsg); EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return testresult; } typedef struct { const char *cipher; } EVP_FINAL_NO_TAG_TEST_st; static const EVP_FINAL_NO_TAG_TEST_st evp_final_no_tag[] = { { "chacha20-poly1305" }, { "aes-256-gcm" } }; static int test_evp_final_no_tag(int idx) { const EVP_FINAL_NO_TAG_TEST_st *t = &evp_final_no_tag[idx]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; unsigned char tag[16]; unsigned char data[5] = { 1, 1, 1, 1, 1 }; uint32_t data_len = 5; unsigned char ctext[1024], plaintext[1024]; int ctext_len = 0, len = 0, testresult = 0; unsigned char key[] = { 0xc9, 0xee, 0xa3, 0x0c, 0x1c, 0x59, 0x0c, 0x8b, 0xd8, 0xbb, 0xa1, 0x1c, 0xbc, 0x3a, 0x56, 0xe7, 0xb7, 0xe1, 0x9f, 0xfd, 0x3b, 0x4a, 0xa3, 0xd5, 0xc4, 0xdc, 0x2e, 0x62, 0xe6, 0x75, 0x15, 0x5c }; unsigned char iv[16] = { 0x03, 0x2d, 0x79, 0xef, 0xed, 0x2e, 0xad, 0x3e, 0x0b, 0xdc, 0x8f, 0x57, 0x0d, 0x0e, 0x0f, 0x10 }; if ((cipher = EVP_CIPHER_fetch(testctx, t->cipher, testpropq)) == NULL) { TEST_info("cipher %s not supported, skipping", t->cipher); goto ok; } if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; if (!TEST_true(EVP_EncryptInit_ex(ctx, cipher, NULL, key, iv))) goto err; if (!TEST_true(EVP_EncryptUpdate(ctx, ctext, &len, data, data_len))) goto err; ctext_len = len; if (!TEST_true(EVP_EncryptFinal_ex(ctx, ctext + len, &len))) goto err; ctext_len += len; if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, tag), 0)) goto err; EVP_CIPHER_CTX_free(ctx); if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; if (!TEST_true(EVP_DecryptInit_ex(ctx, cipher, NULL, key, iv))) goto err; if (!TEST_true(EVP_DecryptUpdate(ctx, plaintext, &len, ctext, ctext_len))) goto err; if (!TEST_mem_eq(plaintext, 5, data, 5)) goto err; /* * The tag must be set before decrypting the data; here we expect failure * for each of the defined ciphers. */ if (!TEST_false(EVP_DecryptFinal_ex(ctx, ctext + len, &len))) goto err; ok: testresult = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(cipher); return testresult; } typedef struct { const unsigned char *iv1; const unsigned char *iv2; const unsigned char *expected1; const unsigned char *expected2; const unsigned char *tag1; const unsigned char *tag2; size_t ivlen1; size_t ivlen2; size_t expectedlen1; size_t expectedlen2; } TEST_GCM_IV_REINIT_st; static const TEST_GCM_IV_REINIT_st gcm_reinit_tests[] = { { iGCMResetIV1, iGCMResetIV2, gcmResetCiphertext1, gcmResetCiphertext2, gcmResetTag1, gcmResetTag2, sizeof(iGCMResetIV1), sizeof(iGCMResetIV2), sizeof(gcmResetCiphertext1), sizeof(gcmResetCiphertext2) }, { iGCMResetIV2, iGCMResetIV1, gcmResetCiphertext2, gcmResetCiphertext1, gcmResetTag2, gcmResetTag1, sizeof(iGCMResetIV2), sizeof(iGCMResetIV1), sizeof(gcmResetCiphertext2), sizeof(gcmResetCiphertext1) } }; static int test_gcm_reinit(int idx) { int outlen1, outlen2, outlen3; int testresult = 0; unsigned char outbuf[1024]; unsigned char tag[16]; const TEST_GCM_IV_REINIT_st *t = &gcm_reinit_tests[idx]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *type = NULL; size_t taglen = sizeof(tag); char *errmsg = NULL; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { errmsg = "CTX_ALLOC"; goto err; } if (!TEST_ptr(type = EVP_CIPHER_fetch(testctx, "aes-256-gcm", testpropq))) { errmsg = "CIPHER_FETCH"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, type, NULL, NULL, NULL, 1))) { errmsg = "ENC_INIT"; goto err; } if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, (int)t->ivlen1, NULL), 0)) { errmsg = "SET_IVLEN1"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, kGCMResetKey, t->iv1, 1))) { errmsg = "SET_IV1"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) { errmsg = "AAD1"; goto err; } EVP_CIPHER_CTX_set_padding(ctx, 0); if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext, sizeof(gcmResetPlaintext)))) { errmsg = "CIPHER_UPDATE1"; goto err; } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL1"; goto err; } if (!TEST_mem_eq(t->expected1, t->expectedlen1, outbuf, outlen1 + outlen2)) { errmsg = "WRONG_RESULT1"; goto err; } if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, (int)taglen, tag), 0)) { errmsg = "GET_TAG1"; goto err; } if (!TEST_mem_eq(t->tag1, taglen, tag, taglen)) { errmsg = "TAG_ERROR1"; goto err; } /* Now reinit */ if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, (int)t->ivlen2, NULL), 0)) { errmsg = "SET_IVLEN2"; goto err; } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, NULL, t->iv2, -1))) { errmsg = "SET_IV2"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outlen3, gcmAAD, sizeof(gcmAAD)))) { errmsg = "AAD2"; goto err; } if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen1, gcmResetPlaintext, sizeof(gcmResetPlaintext)))) { errmsg = "CIPHER_UPDATE2"; goto err; } if (!TEST_true(EVP_CipherFinal_ex(ctx, outbuf + outlen1, &outlen2))) { errmsg = "CIPHER_FINAL2"; goto err; } if (!TEST_mem_eq(t->expected2, t->expectedlen2, outbuf, outlen1 + outlen2)) { errmsg = "WRONG_RESULT2"; goto err; } if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, (int)taglen, tag), 0)) { errmsg = "GET_TAG2"; goto err; } if (!TEST_mem_eq(t->tag2, taglen, tag, taglen)) { errmsg = "TAG_ERROR2"; goto err; } testresult = 1; err: if (errmsg != NULL) TEST_info("evp_init_test %d: %s", idx, errmsg); EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(type); return testresult; } static const char *ivlen_change_ciphers[] = { "AES-256-GCM", #ifndef OPENSSL_NO_OCB "AES-256-OCB", #endif "AES-256-CCM" }; /* Negative test for ivlen change after iv being set */ static int test_ivlen_change(int idx) { int outlen; int res = 0; unsigned char outbuf[1024]; static const unsigned char iv[] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 }; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *ciph = NULL; OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; size_t ivlen = 13; /* non-default IV length */ if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, ivlen_change_ciphers[idx], testpropq))) goto err; if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, kGCMDefaultKey, iv, 1))) goto err; if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, &ivlen); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))) goto err; ERR_set_mark(); if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) { ERR_clear_last_mark(); goto err; } ERR_pop_to_mark(); res = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(ciph); return res; } static const char *iv_state_ciphers[] = { "AES-256-GCM", #ifndef OPENSSL_NO_OCB "AES-256-OCB", #endif #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) "ChaCha20-Poly1305", #endif }; /* Negative test for IV_STATE_FINISHED (avoid IV reuse) */ static int test_iv_reuse(int idx) { int outlen; int res = 0; unsigned char outbuf[64]; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *ciph = NULL; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, iv_state_ciphers[idx], testpropq))) goto err; /* Use the cipher: Init, Update, Final. */ if (!TEST_true(EVP_EncryptInit_ex2(ctx, ciph, kGCMDefaultKey, iGCMDefaultIV, NULL))) goto err; if (!TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) goto err; if (!TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &outlen))) goto err; /* Without IV change, EncryptUpdate must be rejected */ ERR_set_mark(); if (!TEST_false(EVP_EncryptUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) { ERR_clear_last_mark(); goto err; } ERR_pop_to_mark(); res = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(ciph); return res; } static const char *keylen_change_ciphers[] = { #ifndef OPENSSL_NO_BF "BF-ECB", #endif #ifndef OPENSSL_NO_CAST "CAST5-ECB", #endif #ifndef OPENSSL_NO_RC2 "RC2-ECB", #endif #ifndef OPENSSL_NO_RC4 "RC4", #endif #ifndef OPENSSL_NO_RC5 "RC5-ECB", #endif NULL }; /* Negative test for keylen change after key was set */ static int test_keylen_change(int idx) { int outlen; int res = 0; unsigned char outbuf[1024]; static const unsigned char key[] = { 0x57, 0x71, 0x7d, 0xad, 0xdb, 0x9b, 0x98, 0x82, 0x5a, 0x55, 0x91, 0x81, 0x42, 0xa8, 0x89, 0x34 }; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *ciph = NULL; OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END }; size_t keylen = 12; /* non-default key length */ if (lgcyprov == NULL) return TEST_skip("Test requires legacy provider to be loaded"); if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; if (!TEST_ptr(ciph = EVP_CIPHER_fetch(testctx, keylen_change_ciphers[idx], testpropq))) goto err; if (!TEST_true(EVP_CipherInit_ex(ctx, ciph, NULL, key, NULL, 1))) goto err; if (!TEST_true(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &keylen); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params))) goto err; ERR_set_mark(); if (!TEST_false(EVP_CipherUpdate(ctx, outbuf, &outlen, gcmDefaultPlaintext, sizeof(gcmDefaultPlaintext)))) { ERR_clear_last_mark(); goto err; } ERR_pop_to_mark(); res = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(ciph); return res; } #ifndef OPENSSL_NO_ECX static int ecxnids[] = { NID_X25519, NID_X448, NID_ED25519, NID_ED448 }; /* Test that creating ECX keys with a short private key fails as expected */ static int test_ecx_short_keys(int tst) { unsigned char ecxkeydata = 1; EVP_PKEY *pkey; pkey = EVP_PKEY_new_raw_private_key_ex(testctx, OBJ_nid2sn(ecxnids[tst]), NULL, &ecxkeydata, 1); if (!TEST_ptr_null(pkey)) { EVP_PKEY_free(pkey); return 0; } return 1; } #endif typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_CONTEXT, OPT_CONFIG_FILE, OPT_TEST_ENUM } OPTION_CHOICE; const OPTIONS *test_get_options(void) { static const OPTIONS options[] = { OPT_TEST_OPTIONS_DEFAULT_USAGE, { "context", OPT_CONTEXT, '-', "Explicitly use a non-default library context" }, { "config", OPT_CONFIG_FILE, '<', "The configuration file to use for the libctx" }, { NULL } }; return options; } #ifndef OPENSSL_NO_ECX /* Test that trying to sign with a public key errors out gracefully */ static int test_ecx_not_private_key(int tst) { EVP_PKEY *pkey = NULL; const unsigned char msg[] = { 0x00, 0x01, 0x02, 0x03 }; int testresult = 0; EVP_MD_CTX *ctx = NULL; unsigned char *mac = NULL; size_t maclen = 0; const uint8_t *pubkey; size_t pubkeylen; switch (keys[tst].type) { case NID_X25519: case NID_X448: case NID_undef: return TEST_skip("signing not supported for X25519/X448/ML-KEM"); } /* Check if this algorithm supports public keys */ if (keys[tst].pub == NULL) return TEST_skip("no public key present"); pubkey = keys[tst].pub; pubkeylen = keys[tst].publen; pkey = EVP_PKEY_new_raw_public_key_ex(testctx, OBJ_nid2sn(keys[tst].type), NULL, pubkey, pubkeylen); if (!TEST_ptr(pkey)) goto err; if (!TEST_ptr(ctx = EVP_MD_CTX_new())) goto err; if (EVP_DigestSignInit(ctx, NULL, NULL, NULL, pkey) != 1) goto check_err; if (EVP_DigestSign(ctx, NULL, &maclen, msg, sizeof(msg)) != 1) goto check_err; if (!TEST_ptr(mac = OPENSSL_malloc(maclen))) goto err; if (!TEST_int_eq(EVP_DigestSign(ctx, mac, &maclen, msg, sizeof(msg)), 0)) goto err; check_err: /* * Currently only EVP_DigestSign will throw PROV_R_NOT_A_PRIVATE_KEY, * but we relax the check to allow error also thrown by * EVP_DigestSignInit and EVP_DigestSign. */ if (ERR_GET_REASON(ERR_peek_error()) == PROV_R_NOT_A_PRIVATE_KEY) { testresult = 1; ERR_clear_error(); } err: EVP_MD_CTX_free(ctx); OPENSSL_free(mac); EVP_PKEY_free(pkey); return testresult; } #endif /* OPENSSL_NO_ECX */ static int test_sign_continuation(void) { OSSL_PROVIDER *fake_rsa = NULL; int testresult = 0; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *pctx = NULL; EVP_MD_CTX *mctx = NULL; const char sigbuf[] = "To Be Signed"; unsigned char signature[256]; size_t siglen = 256; static int nodupnum = 1; static const OSSL_PARAM nodup_params[] = { OSSL_PARAM_int("NO_DUP", &nodupnum), OSSL_PARAM_END }; if (!TEST_ptr(fake_rsa = fake_rsa_start(testctx))) return 0; /* Construct a pkey using precise propq to use our provider */ if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", "provider=fake-rsa")) || !TEST_true(EVP_PKEY_fromdata_init(pctx)) || !TEST_true(EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR, NULL)) || !TEST_ptr(pkey)) goto end; /* First test it continues (classic behavior) */ if (!TEST_ptr(mctx = EVP_MD_CTX_new()) || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx, NULL, pkey, NULL)) || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen)) || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen))) goto end; EVP_MD_CTX_free(mctx); /* try again but failing the continuation */ if (!TEST_ptr(mctx = EVP_MD_CTX_new()) || !TEST_true(EVP_DigestSignInit_ex(mctx, NULL, NULL, testctx, NULL, pkey, nodup_params)) || !TEST_true(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) || !TEST_true(EVP_DigestSignFinal(mctx, signature, &siglen)) || !TEST_false(EVP_DigestSignUpdate(mctx, sigbuf, sizeof(sigbuf))) || !TEST_false(EVP_DigestSignFinal(mctx, signature, &siglen))) goto end; testresult = 1; end: EVP_MD_CTX_free(mctx); EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(pctx); fake_rsa_finish(fake_rsa); return testresult; } #ifndef OPENSSL_NO_EC /* * Test that EVP_PKEY_sign_init_ex2() with a mismatched key/signature algorithm * (e.g. RSA key with ECDSA signature) correctly fails. */ static int test_EVP_PKEY_sign_init_mismatched_key_alg(void) { EVP_PKEY *rsa_key = NULL; EVP_PKEY_CTX *ctx = NULL; EVP_PKEY_CTX *pkey_ctx = NULL; EVP_SIGNATURE *ecdsa_sig = NULL; int testresult = 0; /* Generate an RSA key */ if (!TEST_ptr(pkey_ctx = EVP_PKEY_CTX_new_from_name(testctx, "RSA", NULL)) || !TEST_int_gt(EVP_PKEY_keygen_init(pkey_ctx), 0) || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_keygen_bits(pkey_ctx, 2048), 0) || !TEST_int_gt(EVP_PKEY_keygen(pkey_ctx, &rsa_key), 0)) goto end; EVP_PKEY_CTX_free(pkey_ctx); pkey_ctx = NULL; /* Fetch ECDSA signature algorithm - incompatible with RSA key */ if (!TEST_ptr(ecdsa_sig = EVP_SIGNATURE_fetch(testctx, "ECDSA", NULL))) goto end; /* Try to init sign with mismatched key/algorithm - this should fail */ if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, rsa_key, NULL))) goto end; /* This should fail with -2 (operation not supported for key type) */ if (!TEST_int_eq(EVP_PKEY_sign_init_ex2(ctx, ecdsa_sig, NULL), -2)) goto end; testresult = 1; end: EVP_PKEY_CTX_free(ctx); EVP_PKEY_CTX_free(pkey_ctx); EVP_SIGNATURE_free(ecdsa_sig); EVP_PKEY_free(rsa_key); return testresult; } #endif static int aes_gcm_encrypt(const unsigned char *gcm_key, size_t gcm_key_s, const unsigned char *gcm_iv, size_t gcm_ivlen, const unsigned char *gcm_pt, size_t gcm_pt_s, const unsigned char *gcm_aad, size_t gcm_aad_s, const unsigned char *gcm_ct, size_t gcm_ct_s, const unsigned char *gcm_tag, size_t gcm_tag_s) { int ret = 0; EVP_CIPHER_CTX *ctx; EVP_CIPHER *cipher = NULL; int outlen, tmplen; unsigned char outbuf[1024]; unsigned char outtag[16]; OSSL_PARAM params[4] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END }; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", ""))) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, &gcm_ivlen); if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params)) || (gcm_aad != NULL && !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen, gcm_aad, (int)gcm_aad_s))) || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen, gcm_pt, (int)gcm_pt_s)) || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen))) goto err; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, outtag, sizeof(outtag)); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params)) || !TEST_mem_eq(outbuf, outlen, gcm_ct, gcm_ct_s) || !TEST_mem_eq(outtag, gcm_tag_s, gcm_tag, gcm_tag_s)) goto err; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_IV, NULL, 0); params[1] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_UPDATED_IV, NULL, 0); params[2] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, NULL, 0); params[3] = OSSL_PARAM_construct_end(); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params)) || !TEST_size_t_eq(params[0].return_size, gcm_ivlen) || !TEST_size_t_eq(params[1].return_size, gcm_ivlen) || !TEST_size_t_eq(params[2].return_size, sizeof(outtag))) ret = 1; err: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } static int aes_gcm_decrypt(const unsigned char *gcm_key, size_t gcm_key_s, const unsigned char *gcm_iv, size_t gcm_ivlen, const unsigned char *gcm_pt, size_t gcm_pt_s, const unsigned char *gcm_aad, size_t gcm_aad_s, const unsigned char *gcm_ct, size_t gcm_ct_s, const unsigned char *gcm_tag, size_t gcm_tag_s) { int ret = 0; EVP_CIPHER_CTX *ctx; EVP_CIPHER *cipher = NULL; int outlen; unsigned char outbuf[1024]; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; if ((ctx = EVP_CIPHER_CTX_new()) == NULL) goto err; if ((cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "")) == NULL) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN, &gcm_ivlen); if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, gcm_key, gcm_iv, params)) || (gcm_aad != NULL && !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outlen, gcm_aad, (int)gcm_aad_s))) || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen, gcm_ct, (int)gcm_ct_s)) || !TEST_mem_eq(outbuf, outlen, gcm_pt, gcm_pt_s)) goto err; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, (void *)gcm_tag, gcm_tag_s); if (!TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)) || !TEST_true(EVP_DecryptFinal_ex(ctx, outbuf, &outlen))) goto err; ret = 1; err: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } static int test_aes_gcm_ivlen_change_cve_2023_5363(void) { /* AES-GCM test data obtained from NIST public test vectors */ static const unsigned char gcm_key[] = { 0xd0, 0xc2, 0x67, 0xc1, 0x9f, 0x30, 0xd8, 0x0b, 0x89, 0x14, 0xbb, 0xbf, 0xb7, 0x2f, 0x73, 0xb8, 0xd3, 0xcd, 0x5f, 0x6a, 0x78, 0x70, 0x15, 0x84, 0x8a, 0x7b, 0x30, 0xe3, 0x8f, 0x16, 0xf1, 0x8b }; static const unsigned char gcm_iv[] = { 0xb6, 0xdc, 0xda, 0x95, 0xac, 0x99, 0x77, 0x76, 0x25, 0xae, 0x87, 0xf8, 0xa3, 0xa9, 0xdd, 0x64, 0xd7, 0x9b, 0xbd, 0x5f, 0x4a, 0x0e, 0x54, 0xca, 0x1a, 0x9f, 0xa2, 0xe3, 0xf4, 0x5f, 0x5f, 0xc2, 0xce, 0xa7, 0xb6, 0x14, 0x12, 0x6f, 0xf0, 0xaf, 0xfd, 0x3e, 0x17, 0x35, 0x6e, 0xa0, 0x16, 0x09, 0xdd, 0xa1, 0x3f, 0xd8, 0xdd, 0xf3, 0xdf, 0x4f, 0xcb, 0x18, 0x49, 0xb8, 0xb3, 0x69, 0x2c, 0x5d, 0x4f, 0xad, 0x30, 0x91, 0x08, 0xbc, 0xbe, 0x24, 0x01, 0x0f, 0xbe, 0x9c, 0xfb, 0x4f, 0x5d, 0x19, 0x7f, 0x4c, 0x53, 0xb0, 0x95, 0x90, 0xac, 0x7b, 0x1f, 0x7b, 0xa0, 0x99, 0xe1, 0xf3, 0x48, 0x54, 0xd0, 0xfc, 0xa9, 0xcc, 0x91, 0xf8, 0x1f, 0x9b, 0x6c, 0x9a, 0xe0, 0xdc, 0x63, 0xea, 0x7d, 0x2a, 0x4a, 0x7d, 0xa5, 0xed, 0x68, 0x57, 0x27, 0x6b, 0x68, 0xe0, 0xf2, 0xb8, 0x51, 0x50, 0x8d, 0x3d }; static const unsigned char gcm_pt[] = { 0xb8, 0xb6, 0x88, 0x36, 0x44, 0xe2, 0x34, 0xdf, 0x24, 0x32, 0x91, 0x07, 0x4f, 0xe3, 0x6f, 0x81 }; static const unsigned char gcm_ct[] = { 0xff, 0x4f, 0xb3, 0xf3, 0xf9, 0xa2, 0x51, 0xd4, 0x82, 0xc2, 0xbe, 0xf3, 0xe2, 0xd0, 0xec, 0xed }; static const unsigned char gcm_tag[] = { 0xbd, 0x06, 0x38, 0x09, 0xf7, 0xe1, 0xc4, 0x72, 0x0e, 0xf2, 0xea, 0x63, 0xdb, 0x99, 0x6c, 0x21 }; return aes_gcm_encrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv), gcm_pt, sizeof(gcm_pt), NULL, 0, gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag)) && aes_gcm_decrypt(gcm_key, sizeof(gcm_key), gcm_iv, sizeof(gcm_iv), gcm_pt, sizeof(gcm_pt), NULL, 0, gcm_ct, sizeof(gcm_ct), gcm_tag, sizeof(gcm_tag)); } #ifndef OPENSSL_NO_RC4 static int rc4_encrypt(const unsigned char *rc4_key, size_t rc4_key_s, const unsigned char *rc4_pt, size_t rc4_pt_s, const unsigned char *rc4_ct, size_t rc4_ct_s) { int ret = 0; EVP_CIPHER_CTX *ctx; EVP_CIPHER *cipher = NULL; int outlen, tmplen; unsigned char outbuf[1024]; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "RC4", ""))) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &rc4_key_s); if (!TEST_true(EVP_EncryptInit_ex2(ctx, cipher, rc4_key, NULL, params)) || !TEST_true(EVP_EncryptUpdate(ctx, outbuf, &outlen, rc4_pt, (int)rc4_pt_s)) || !TEST_true(EVP_EncryptFinal_ex(ctx, outbuf, &tmplen))) goto err; if (!TEST_mem_eq(outbuf, outlen, rc4_ct, rc4_ct_s)) goto err; ret = 1; err: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } static int rc4_decrypt(const unsigned char *rc4_key, size_t rc4_key_s, const unsigned char *rc4_pt, size_t rc4_pt_s, const unsigned char *rc4_ct, size_t rc4_ct_s) { int ret = 0; EVP_CIPHER_CTX *ctx; EVP_CIPHER *cipher = NULL; int outlen; unsigned char outbuf[1024]; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; if ((ctx = EVP_CIPHER_CTX_new()) == NULL) goto err; if ((cipher = EVP_CIPHER_fetch(testctx, "RC4", "")) == NULL) goto err; params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_KEYLEN, &rc4_key_s); if (!TEST_true(EVP_DecryptInit_ex2(ctx, cipher, rc4_key, NULL, params)) || !TEST_true(EVP_DecryptUpdate(ctx, outbuf, &outlen, rc4_ct, (int)rc4_ct_s)) || !TEST_mem_eq(outbuf, outlen, rc4_pt, rc4_pt_s)) goto err; ret = 1; err: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } static int test_aes_rc4_keylen_change_cve_2023_5363(void) { /* RC4 test data obtained from RFC 6229 */ static const struct { unsigned char key[5]; unsigned char padding[11]; } rc4_key = { { /* Five bytes of key material */ 0x83, 0x32, 0x22, 0x77, 0x2a }, { /* Random padding to 16 bytes */ 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a, 0xaa, 0x32, 0x91 } }; static const unsigned char rc4_pt[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; static const unsigned char rc4_ct[] = { 0x80, 0xad, 0x97, 0xbd, 0xc9, 0x73, 0xdf, 0x8a, 0x2e, 0x87, 0x9e, 0x92, 0xa4, 0x97, 0xef, 0xda }; if (lgcyprov == NULL) return TEST_skip("Test requires legacy provider to be loaded"); return rc4_encrypt(rc4_key.key, sizeof(rc4_key.key), rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct)) && rc4_decrypt(rc4_key.key, sizeof(rc4_key.key), rc4_pt, sizeof(rc4_pt), rc4_ct, sizeof(rc4_ct)); } #endif static int test_aes_gcm_siv_empty_data(void) { unsigned char key[16] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10 }; unsigned char nonce[12] = { 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55 }; unsigned char aad[33] = "this AAD was never authenticated"; unsigned char zero_tag[16] = { 0 }; unsigned char real_tag[16]; unsigned char out[16]; int outl, ret = 0; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-GCM-SIV", NULL); if (c == NULL) { return TEST_skip("AES-128-GCM-SIV cipher is not available"); } /* Compute the CORRECT tag for (key,nonce,aad,pt="") via encrypt */ ctx = EVP_CIPHER_CTX_new(); if (!TEST_ptr(ctx) || !TEST_true(EVP_EncryptInit_ex2(ctx, c, key, nonce, NULL)) || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD */ || !TEST_true(EVP_EncryptUpdate(ctx, out, &outl, aad, 0)) /* empty PT, out!=NULL */ || !TEST_true(EVP_EncryptFinal_ex(ctx, out, &outl)) || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, real_tag))) goto err; EVP_CIPHER_CTX_free(ctx); /* SANITY: decrypt with CORRECT tag and an explicit empty-PT Update */ ctx = EVP_CIPHER_CTX_new(); if (!TEST_ptr(ctx) || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag)) || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) || !TEST_true(EVP_DecryptUpdate(ctx, out, &outl, aad, 0)) /* force aes_gcm_siv_decrypt(len=0) */ || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl))) goto err; EVP_CIPHER_CTX_free(ctx); /* FORGERY A: AAD only, NO ciphertext Update, ALL-ZERO tag */ ctx = EVP_CIPHER_CTX_new(); if (!TEST_ptr(ctx) || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag)) || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) /* AAD only, out==NULL */ || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl))) goto err; EVP_CIPHER_CTX_free(ctx); /* FORGERY B: no AAD, no Update at all, ALL-ZERO tag */ ctx = EVP_CIPHER_CTX_new(); if (!TEST_ptr(ctx) || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, zero_tag)) || !TEST_false(EVP_DecryptFinal_ex(ctx, out, &outl))) goto err; EVP_CIPHER_CTX_free(ctx); /* CONTROL: AAD only, NO ciphertext Update, CORRECT tag */ ctx = EVP_CIPHER_CTX_new(); if (!TEST_ptr(ctx) || !TEST_true(EVP_DecryptInit_ex2(ctx, c, key, nonce, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, real_tag)) || !TEST_true(EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) || !TEST_true(EVP_DecryptFinal_ex(ctx, out, &outl))) goto err; EVP_CIPHER_CTX_free(ctx); ctx = NULL; ret = 1; err: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(c); return ret; } /* * AES-SIV reuse-without-rekey: * msg1: legit non-empty CT, tag verifies, final_ret=0 * msg2: no reinit (or reinit with key=NULL), set forged tag, * AAD only, DecryptFinal -> does stale final_ret leak through? */ static int test_aes_siv_ctx_reuse(void) { unsigned char key[32] = { 7 }; /* AES-128-SIV => 2*16 */ unsigned char pt[9] = "payload!"; unsigned char ct[9], tagbuf[16], out[16], zero16[16] = { 0 }; unsigned char aad[14] = "forged header"; int outl, ret = 0; EVP_CIPHER_CTX *e = NULL, *d = NULL; EVP_CIPHER *c = EVP_CIPHER_fetch(NULL, "AES-128-SIV", NULL); if (c == NULL) { return TEST_skip("AES-128-SIV cipher is not available"); } /* produce a valid (ct,tag) for msg1 */ e = EVP_CIPHER_CTX_new(); if (!TEST_ptr(e) || !TEST_true(EVP_EncryptInit_ex2(e, c, key, NULL, NULL)) || !TEST_true(EVP_EncryptUpdate(e, NULL, &outl, (unsigned char *)"hdr1", 4)) || !TEST_true(EVP_EncryptUpdate(e, ct, &outl, pt, sizeof(pt))) || !TEST_true(EVP_EncryptFinal_ex(e, out, &outl)) || !TEST_true(EVP_CIPHER_CTX_ctrl(e, EVP_CTRL_AEAD_GET_TAG, 16, tagbuf))) { EVP_CIPHER_CTX_free(e); goto err; } EVP_CIPHER_CTX_free(e); /* msg1 decrypt */ d = EVP_CIPHER_CTX_new(); if (!TEST_ptr(d) || !TEST_true(EVP_DecryptInit_ex2(d, c, key, NULL, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, tagbuf)) || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, (unsigned char *)"hdr1", 4)) || !TEST_true(EVP_DecryptUpdate(d, out, &outl, ct, sizeof(ct))) || !TEST_true(EVP_DecryptFinal_ex(d, out, &outl))) goto err; /* msg2 on SAME ctx, reinit with key=NULL => initkey skipped, final_ret should be reset */ if (!TEST_true(EVP_DecryptInit_ex2(d, NULL, NULL, NULL, NULL)) || !TEST_true(EVP_CIPHER_CTX_ctrl(d, EVP_CTRL_AEAD_SET_TAG, 16, zero16)) || !TEST_true(EVP_DecryptUpdate(d, NULL, &outl, aad, sizeof(aad))) /* forged AAD */ || !TEST_false(EVP_DecryptFinal_ex(d, out, &outl))) goto err; ret = 1; err: EVP_CIPHER_CTX_free(d); EVP_CIPHER_free(c); return ret; } static int test_invalid_ctx_for_digest(void) { int ret; EVP_MD_CTX *mdctx; mdctx = EVP_MD_CTX_new(); if (!TEST_ptr(mdctx)) return 0; if (!TEST_int_eq(EVP_DigestUpdate(mdctx, "test", sizeof("test") - 1), 0)) ret = 0; else ret = 1; EVP_MD_CTX_free(mdctx); return ret; } static int test_evp_cipher_negative_length(void) { EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; unsigned char key[16] = { 0 }; unsigned char iv[16] = { 0 }; unsigned char buffer[32] = { 0 }; int outl = 0; int ret = 0; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto end; if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-128-CBC", testpropq))) goto end; /* Initialize encryption context */ if (!TEST_int_eq(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL), 1)) goto end; /* Test EVP_EncryptUpdate with negative length - should fail */ if (!TEST_int_eq(EVP_EncryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0)) goto end; /* Reinitialize for decryption */ if (!TEST_int_eq(EVP_DecryptInit_ex2(ctx, cipher, key, iv, NULL), 1)) goto end; /* Test EVP_DecryptUpdate with negative length - should fail */ if (!TEST_int_eq(EVP_DecryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0)) goto end; ret = 1; end: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } static int test_aes_xts_rejects_missing_iv(void) { static const unsigned char key[32] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; static const unsigned char in[32] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99, 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11, 0x00 }; static const unsigned char iv[16] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 }; EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; unsigned char out[sizeof(in)]; int outl = 0; int ret = 0; if ((cipher = EVP_CIPHER_fetch(testctx, "AES-128-XTS", testpropq)) == NULL) return TEST_skip("AES-128-XTS cipher is not available"); /* Initialize with a valid IV as a positive control */ if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()) || !TEST_true(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL)) || !TEST_true(EVP_EncryptUpdate(ctx, out, &outl, in, sizeof(in))) || !TEST_int_eq(outl, (int)sizeof(in))) goto err; EVP_CIPHER_CTX_free(ctx); ctx = NULL; outl = 0; if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto err; /* Initialize with a NULL IV, which may fail immediately */ ERR_set_mark(); if (!EVP_EncryptInit_ex2(ctx, cipher, key, NULL, NULL)) { ERR_pop_to_mark(); ret = 1; goto err; } /* Test EVP_EncryptUpdate after NULL IV initialization, which should fail */ if (!TEST_false(EVP_EncryptUpdate(ctx, out, &outl, in, sizeof(in)))) { ERR_clear_last_mark(); goto err; } ERR_pop_to_mark(); ret = 1; err: EVP_CIPHER_free(cipher); EVP_CIPHER_CTX_free(ctx); return ret; } /* * Cross-driver round-trip test for AEAD one-shot vs streaming paths. * * The streaming path (EVP_CipherUpdate/Final, dispatched to * OSSL_FUNC_CIPHER_UPDATE/_FINAL) is treated as the oracle. For each * AEAD configuration we encrypt and decrypt the same (key, iv, aad, pt), * driving the body in two combinations: * * 1. body encrypt via EVP_Cipher() (one-shot, OSSL_FUNC_CIPHER_CIPHER), * body decrypt via EVP_CipherUpdate (streaming). * 2. body encrypt via EVP_CipherUpdate, body decrypt via EVP_Cipher(). * * Both combinations must recover the plaintext and verify the tag. AAD * is always fed via EVP_CipherUpdate(NULL, ...): OCB's one-shot is body * only and the asymmetric "AAD streaming, body one-shot" call shape is * the natural pattern a caller reaching for EVP_Cipher() for throughput * would write anyway. * * CVE-2026-45445 (AES-OCB EVP_Cipher() ignored IV) was a silent failure * in this matrix: the one-shot encrypt path produced ciphertext under * Offset_0 = 0 regardless of IV, which the streaming decrypt path then * could not verify. Adding this cross-check catches the same class of * bug for any future AEAD whose one-shot dispatch diverges from its * streaming dispatch. */ typedef struct { const char *name; /* EVP_CIPHER fetch name */ size_t keylen; size_t ivlen; size_t taglen; int is_ccm; /* needs length-up-front + tag-before-body dance */ } AEAD_ONESHOT_CFG; static const AEAD_ONESHOT_CFG aead_oneshot_cfgs[] = { { "AES-128-GCM", 16, 12, 16, 0 }, { "AES-256-GCM", 32, 12, 16, 0 }, { "AES-128-CCM", 16, 12, 16, 1 }, { "AES-256-CCM", 32, 12, 16, 1 }, { "AES-128-OCB", 16, 12, 16, 0 }, { "AES-256-OCB", 32, 12, 16, 0 }, { "ChaCha20-Poly1305", 32, 12, 16, 0 } }; /* * Drive an encrypt or decrypt operation. AAD always via EVP_CipherUpdate. * Body via EVP_Cipher() when oneshot_body is non-zero, EVP_CipherUpdate * otherwise. On encrypt, fills *out and the caller-provided tag buffer. * On decrypt, reads from in and verifies tag; returns 0 if verification * fails (the test asserts the expected outcome). */ static int aead_oneshot_op(const AEAD_ONESHOT_CFG *cfg, int enc, int oneshot_body, const unsigned char *key, const unsigned char *iv, const unsigned char *aad, size_t aad_len, const unsigned char *in, size_t in_len, unsigned char *out, unsigned char *tag, const char **why) { EVP_CIPHER_CTX *ctx = NULL; EVP_CIPHER *cipher = NULL; int outl = 0, tmpl = 0; int ok = 0; int body_rv; *why = NULL; if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, cfg->name, testpropq))) { *why = "CIPHER_FETCH"; goto end; } if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new())) { *why = "CTX_NEW"; goto end; } if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))) { *why = "INIT_CIPHER"; goto end; } if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, (int)cfg->ivlen, NULL), 0)) { *why = "SET_IVLEN"; goto end; } if (cfg->is_ccm) { /* Placeholder taglen on encrypt, real tag on decrypt; both before key+iv. */ if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)cfg->taglen, enc ? NULL : tag), 0)) { *why = "CCM_SET_TAG"; goto end; } } if (!TEST_true(EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))) { *why = "INIT_KEY_IV"; goto end; } if (cfg->is_ccm) { if (!TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, NULL, (int)in_len))) { *why = "CCM_LEN_DECL"; goto end; } } if (aad_len > 0 && !TEST_true(EVP_CipherUpdate(ctx, NULL, &outl, aad, (int)aad_len))) { *why = "AAD"; goto end; } if (!enc && !cfg->is_ccm && !TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)cfg->taglen, tag), 0)) { *why = "SET_TAG"; goto end; } if (oneshot_body) { body_rv = EVP_Cipher(ctx, out, in, (unsigned int)in_len); if (cfg->is_ccm && !enc) { /* CCM decrypt: 0 means tag verify failed, < 0 means error. */ if (!TEST_int_gt(body_rv, 0)) { *why = "ONESHOT_DECRYPT"; goto end; } } else { if (!TEST_int_ge(body_rv, 0)) { *why = "ONESHOT_BODY"; goto end; } } outl = (int)in_len; } else { if (!TEST_true(EVP_CipherUpdate(ctx, out, &outl, in, (int)in_len))) { *why = enc ? "STREAM_BODY_ENC" : "STREAM_BODY_DEC"; goto end; } } if (!cfg->is_ccm) { if (!TEST_true(EVP_CipherFinal_ex(ctx, out + outl, &tmpl))) { *why = enc ? "FINAL_ENC" : "FINAL_DEC"; goto end; } } if (enc) { if (!TEST_int_gt(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, (int)cfg->taglen, tag), 0)) { *why = "GET_TAG"; goto end; } } ok = 1; end: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(cipher); return ok; } /* * For each AEAD row we run two AAD modes, and within each AAD mode two * cross-driver round trips: * * aad_mode 0: no AAD. Critical for catching the OCB-style bug: any * EVP_CipherUpdate(NULL, aad, ...) call before the body * would itself pass through the (correct) streaming * handler and apply the buffered IV, masking the one-shot * handler's failure to do so. With aad_len == 0 we make * EVP_Cipher() the very first cipher operation on the * context, which is the shape the bug requires. * * aad_mode 1: with AAD via streaming. Catches divergence between the * drivers when AAD is in play. * * leg 0: encrypt-oneshot + decrypt-streaming * leg 1: encrypt-streaming + decrypt-oneshot * * The test index encodes (cipher, aad_mode) so a failure points at both. */ static int test_aead_oneshot_roundtrip(int idx) { static const unsigned char fixed_key[32] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; static const unsigned char fixed_iv[12] = { 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab }; static const unsigned char fixed_aad[] = "extra:context"; static const unsigned char fixed_pt[] = "THE QUICK BROWN FOX JUMPS OVER LAZY!!"; const AEAD_ONESHOT_CFG *cfg = &aead_oneshot_cfgs[idx / 2]; int with_aad = idx % 2; size_t aad_len = with_aad ? sizeof(fixed_aad) - 1 : 0; size_t pt_len = sizeof(fixed_pt) - 1; EVP_CIPHER *probe = NULL; unsigned char ct[64], pt[64]; unsigned char tag_oneshot[16], tag_stream[16]; const char *why = NULL; int leg, ok = 0; /* * Probe for the cipher: a build with no-ocb / no-chacha / etc. will * not have it, and we treat that as a pass (nothing to test here). */ ERR_set_mark(); probe = EVP_CIPHER_fetch(testctx, cfg->name, testpropq); ERR_pop_to_mark(); if (probe == NULL) { TEST_info("skipping, '%s' is not available", cfg->name); return 1; } EVP_CIPHER_free(probe); for (leg = 0; leg <= 1; leg++) { int enc_oneshot = (leg == 0); unsigned char *tag = enc_oneshot ? tag_oneshot : tag_stream; memset(ct, 0, sizeof(ct)); memset(pt, 0, sizeof(pt)); memset(tag, 0, cfg->taglen); if (!aead_oneshot_op(cfg, /*enc=*/1, /*oneshot_body=*/enc_oneshot, fixed_key, fixed_iv, fixed_aad, aad_len, fixed_pt, pt_len, ct, tag, &why)) { TEST_error("%s (%s): encrypt leg %d (%s body) failed at %s", cfg->name, with_aad ? "with AAD" : "no AAD", leg, enc_oneshot ? "oneshot" : "stream", why ? why : "?"); goto end; } if (!aead_oneshot_op(cfg, /*enc=*/0, /*oneshot_body=*/!enc_oneshot, fixed_key, fixed_iv, fixed_aad, aad_len, ct, pt_len, pt, tag, &why)) { TEST_error("%s (%s): decrypt leg %d (%s body) failed at %s", cfg->name, with_aad ? "with AAD" : "no AAD", leg, enc_oneshot ? "stream" : "oneshot", why ? why : "?"); goto end; } if (!TEST_mem_eq(pt, pt_len, fixed_pt, pt_len)) { TEST_error("%s (%s): leg %d: recovered plaintext differs", cfg->name, with_aad ? "with AAD" : "no AAD", leg); goto end; } } /* * Both legs share the same (key, iv, aad, pt) and must therefore * agree on the tag bit-for-bit, regardless of which driver computed * it. This catches the OCB-style failure where the one-shot path * silently emits a different ciphertext/tag from the streaming path. */ if (!TEST_mem_eq(tag_oneshot, cfg->taglen, tag_stream, cfg->taglen)) { TEST_error("%s (%s): oneshot-encrypt tag != streaming-encrypt tag", cfg->name, with_aad ? "with AAD" : "no AAD"); goto end; } ok = 1; end: return ok; } #ifndef OPENSSL_NO_DES static int test_EVP_CIPHER_get_type_des_ede3(void) { const EVP_CIPHER *cipher = NULL; int base_type, variant_type, nid; int ret = 0; /* Get the base type from CFB64 (should be NID_des_ede3_cfb64) */ cipher = EVP_des_ede3_cfb64(); base_type = EVP_CIPHER_get_type(cipher); /* Test CFB64 - should map to the same base_type */ variant_type = EVP_CIPHER_get_type(cipher); nid = EVP_CIPHER_get_nid(cipher); /* Verify the returned type */ if (!TEST_int_eq(variant_type, base_type)) goto end; /* Verify that variant_type and nid are same for 64-bit variants */ if (!TEST_int_eq(variant_type, nid)) goto end; if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) goto end; /* Test CFB8 - should map to the same base_type */ cipher = EVP_des_ede3_cfb8(); variant_type = EVP_CIPHER_get_type(cipher); nid = EVP_CIPHER_get_nid(cipher); /* Verify the returned type */ if (!TEST_int_eq(variant_type, base_type)) goto end; /* Verify that variant_type and nid are different for variants */ if (!TEST_int_ne(variant_type, nid)) goto end; if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) goto end; /* Test CFB1 - should map to the same base_type */ cipher = EVP_des_ede3_cfb1(); variant_type = EVP_CIPHER_get_type(cipher); nid = EVP_CIPHER_get_nid(cipher); /* Verify the returned type */ if (!TEST_int_eq(variant_type, base_type)) goto end; /* Verify that variant_type and nid are different for variants */ if (!TEST_int_ne(variant_type, nid)) goto end; if (!TEST_int_eq(NID_des_ede3_cfb64, variant_type)) goto end; ret = 1; end: return ret; } #endif /*OPENSSL_NO_DES */ static int test_evp_cipher_pipeline(void) { OSSL_PROVIDER *fake_pipeline = NULL; int testresult = 0; EVP_CIPHER *cipher = NULL; EVP_CIPHER *pipeline_cipher = NULL; EVP_CIPHER_CTX *ctx = NULL; unsigned char key[32]; size_t keylen = 32; size_t ivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_FIXED_IV_LEN; size_t taglen = EVP_GCM_TLS_TAG_LEN; unsigned char *iv_array[EVP_MAX_PIPES], *tag_array[EVP_MAX_PIPES]; unsigned char *plaintext_array[EVP_MAX_PIPES]; unsigned char *ciphertext_array_p[EVP_MAX_PIPES]; void **aead_tags = (void **)&tag_array; unsigned char *temp[EVP_MAX_PIPES]; size_t outsize_array[EVP_MAX_PIPES], outlen_array[EVP_MAX_PIPES]; size_t ciphertextlen_array[EVP_MAX_PIPES]; size_t inlen_array[EVP_MAX_PIPES]; OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END }; unsigned char *ciphertext, *exp_plaintext, *tag; size_t numpipes, plaintextlen, i; if (!TEST_ptr(fake_pipeline = fake_pipeline_start(testctx))) return 0; if (!TEST_ptr(pipeline_cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "provider=fake-pipeline")) || !TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-256-GCM", "provider!=fake-pipeline")) || !TEST_ptr(ctx = EVP_CIPHER_CTX_new())) goto end; memset(key, 0x01, sizeof(key)); /* Negative tests */ if (!TEST_false(EVP_CIPHER_can_pipeline(cipher, 1))) goto end; if (!TEST_false(EVP_CIPHER_can_pipeline(EVP_aes_256_gcm(), 1))) goto end; if (!TEST_false(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher, key, keylen, EVP_MAX_PIPES + 1, NULL, 0))) goto end; /* Positive tests */ for (numpipes = 1; numpipes <= EVP_MAX_PIPES; numpipes++) { for (plaintextlen = 1; plaintextlen <= 256; plaintextlen++) { size_t ciphertextlen = 0; int outlen = 0; /* Cleanup to be able to error out */ memset(iv_array, 0, sizeof(iv_array)); memset(plaintext_array, 0, sizeof(plaintext_array)); memset(ciphertext_array_p, 0, sizeof(ciphertext_array_p)); memset(tag_array, 0, sizeof(tag_array)); ciphertext = NULL; exp_plaintext = NULL; tag = NULL; /* Allocate fresh buffers with exact size to catch buffer overwrites */ for (i = 0; i < numpipes; i++) { if (!TEST_ptr(iv_array[i] = OPENSSL_malloc(ivlen)) || !TEST_ptr(plaintext_array[i] = OPENSSL_malloc(plaintextlen)) || !TEST_ptr(ciphertext_array_p[i] = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH)) || !TEST_ptr(tag_array[i] = OPENSSL_malloc(taglen))) goto err; memset(iv_array[i], (unsigned char)(i + 33), ivlen); memset(plaintext_array[i], (unsigned char)(i + 1), plaintextlen); inlen_array[i] = plaintextlen; outlen_array[i] = 0; ciphertextlen_array[i] = 0; outsize_array[i] = plaintextlen + EVP_MAX_BLOCK_LENGTH; } if (!TEST_ptr(ciphertext = OPENSSL_malloc(plaintextlen + EVP_MAX_BLOCK_LENGTH)) || !TEST_ptr(tag = OPENSSL_malloc(taglen)) || !TEST_ptr(exp_plaintext = OPENSSL_malloc(plaintextlen))) goto err; /* Encrypt using pipeline API */ if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)) || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 1)) || !TEST_true(EVP_CipherPipelineEncryptInit(ctx, pipeline_cipher, key, keylen, numpipes, (const unsigned char **)iv_array, ivlen)) /* reuse plaintext for AAD as it won't affect test */ || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL, (const unsigned char **)plaintext_array, inlen_array)) || !TEST_true(EVP_CipherPipelineUpdate(ctx, ciphertext_array_p, outlen_array, outsize_array, (const unsigned char **)plaintext_array, inlen_array))) goto err; for (i = 0; i < numpipes; i++) { ciphertextlen_array[i] = outlen_array[i]; temp[i] = ciphertext_array_p[i] + ciphertextlen_array[i]; outsize_array[i] = outsize_array[i] - ciphertextlen_array[i]; } if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array))) goto err; for (i = 0; i < numpipes; i++) ciphertextlen_array[i] += outlen_array[i]; params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG, (void **)&aead_tags, taglen); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))) goto err; /* Encrypt using non-pipeline API and compare */ if (!TEST_true(EVP_CIPHER_CTX_reset(ctx))) goto err; for (i = 0; i < numpipes; i++) { if (!TEST_true(EVP_EncryptInit(ctx, cipher, key, iv_array[i])) || !TEST_true(EVP_EncryptUpdate(ctx, NULL, &outlen, plaintext_array[i], (int)plaintextlen)) || !TEST_true(EVP_EncryptUpdate(ctx, ciphertext, &outlen, plaintext_array[i], (int)plaintextlen))) goto err; ciphertextlen = outlen; if (!TEST_true(EVP_EncryptFinal_ex(ctx, ciphertext + outlen, &outlen))) goto err; ciphertextlen += outlen; params[0] = OSSL_PARAM_construct_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, (void *)tag, taglen); if (!TEST_true(EVP_CIPHER_CTX_get_params(ctx, params))) goto err; if (!TEST_mem_eq(ciphertext_array_p[i], ciphertextlen_array[i], ciphertext, ciphertextlen) || !TEST_mem_eq(tag_array[i], taglen, tag, taglen)) goto err; } for (i = 0; i < numpipes; i++) outsize_array[i] = plaintextlen; /* Decrypt using pipeline API and compare */ params[0] = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_PIPELINE_AEAD_TAG, (void **)&aead_tags, taglen); if (!TEST_true(EVP_CIPHER_CTX_reset(ctx)) || !TEST_true(EVP_CIPHER_can_pipeline(pipeline_cipher, 0)) || !TEST_true(EVP_CipherPipelineDecryptInit(ctx, pipeline_cipher, key, keylen, numpipes, (const unsigned char **)iv_array, ivlen)) || !TEST_true(EVP_CIPHER_CTX_set_params(ctx, params)) || !TEST_true(EVP_CipherPipelineUpdate(ctx, NULL, outlen_array, NULL, (const unsigned char **)plaintext_array, inlen_array)) || !TEST_true(EVP_CipherPipelineUpdate(ctx, plaintext_array, outlen_array, outsize_array, (const unsigned char **)ciphertext_array_p, ciphertextlen_array))) goto err; for (i = 0; i < numpipes; i++) { temp[i] = plaintext_array[i] + outlen_array[i]; outsize_array[i] = outsize_array[i] - outlen_array[i]; } if (!TEST_true(EVP_CipherPipelineFinal(ctx, temp, outlen_array, outsize_array))) goto err; for (i = 0; i < numpipes; i++) { memset(exp_plaintext, (unsigned char)(i + 1), plaintextlen); if (!TEST_mem_eq(plaintext_array[i], plaintextlen, exp_plaintext, plaintextlen)) goto err; } for (i = 0; i < numpipes; i++) { OPENSSL_free(iv_array[i]); OPENSSL_free(plaintext_array[i]); OPENSSL_free(ciphertext_array_p[i]); OPENSSL_free(tag_array[i]); } OPENSSL_free(exp_plaintext); OPENSSL_free(ciphertext); OPENSSL_free(tag); } } testresult = 1; goto end; err: for (i = 0; i < numpipes; i++) { OPENSSL_free(iv_array[i]); OPENSSL_free(plaintext_array[i]); OPENSSL_free(ciphertext_array_p[i]); OPENSSL_free(tag_array[i]); } OPENSSL_free(exp_plaintext); OPENSSL_free(ciphertext); OPENSSL_free(tag); end: EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_free(cipher); EVP_CIPHER_free(pipeline_cipher); fake_pipeline_finish(fake_pipeline); return testresult; } #ifndef OPENSSL_NO_DEPRECATED_3_0 static int sign_hits = 0; static int encap_hits = 0; static int flen_ne_ret_hits = 0; static int do_sign_with_method(EVP_PKEY *pkey) { const unsigned char msg[] = "Hello, World!"; unsigned char sig[128]; unsigned int siglen; EVP_MD_CTX *ctx = NULL; int ret = 0; sign_hits = 0; ctx = EVP_MD_CTX_new(); if (!TEST_ptr(ctx)) return 0; if (!TEST_true(EVP_SignInit(ctx, EVP_sha256()))) goto err; if (!TEST_true(EVP_SignUpdate(ctx, msg, sizeof(msg) - 1))) goto err; if (!TEST_true(EVP_SignFinal(ctx, sig, &siglen, pkey))) goto err; /* We expect to see our custom sign function called once */ if (!TEST_int_eq(sign_hits, 1)) goto err; ret = 1; err: EVP_MD_CTX_free(ctx); return ret; } static int rsa_ex_idx = -1; static int (*orig_rsa_priv_enc)(int, const unsigned char *, unsigned char *, RSA *, int); static int tst_rsa_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) { if (strcmp(RSA_get_ex_data(rsa, rsa_ex_idx), "test") != 0) return 0; sign_hits++; return orig_rsa_priv_enc(flen, from, to, rsa, padding); } static int tst_rsa_pub_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) { const char *marker = RSA_get_ex_data(rsa, rsa_ex_idx); if (marker == NULL || strcmp(marker, "kem-test") != 0) return 0; encap_hits++; return -1; } static int tst_rsa_pub_enc_flen_ne_ret(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) { const char *marker = RSA_get_ex_data(rsa, rsa_ex_idx); if (marker == NULL || strcmp(marker, "kem-test-flen-ne-ret") != 0) return 0; flen_ne_ret_hits++; return flen - 1; } /* Test that a low level RSA method still gets used even with a provider */ static int test_low_level_rsa_method(void) { BIGNUM *e = BN_new(); RSA *rsa = NULL; const RSA_METHOD *def = RSA_get_default_method(); RSA_METHOD *method = RSA_meth_dup(def); EVP_PKEY *pkey = NULL; int testresult = 0; if (nullprov != NULL) { testresult = TEST_skip("Test does not support a non-default library context"); goto err; } if (!TEST_ptr(e) || !TEST_ptr(method)) goto err; rsa_ex_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, NULL); if (!TEST_true(BN_set_word(e, RSA_F4))) goto err; rsa = RSA_new(); if (!TEST_ptr(rsa)) goto err; if (!TEST_true(RSA_set_ex_data(rsa, rsa_ex_idx, (void *)"test"))) goto err; if (!TEST_true(RSA_generate_key_ex(rsa, 1024, e, NULL))) goto err; orig_rsa_priv_enc = RSA_meth_get_priv_enc(def); if (!TEST_true(RSA_meth_set_priv_enc(method, tst_rsa_priv_enc))) goto err; if (!TEST_true(RSA_set_method(rsa, method))) goto err; pkey = EVP_PKEY_new(); if (!TEST_ptr(pkey)) goto err; if (!TEST_int_gt(EVP_PKEY_assign_RSA(pkey, rsa), 0)) goto err; rsa = NULL; if (!do_sign_with_method(pkey)) goto err; testresult = 1; err: BN_free(e); RSA_free(rsa); EVP_PKEY_free(pkey); RSA_meth_free(method); return testresult; } static int test_low_level_rsa_kem_public_encrypt_failure(int idx) { RSA *rsa = NULL; const RSA_METHOD *def = RSA_get_default_method(); RSA_METHOD *method = RSA_meth_dup(def); EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *ctx = NULL; unsigned char *ct = NULL; unsigned char *secret = NULL; size_t ctlen = 0, secretlen = 0; int testresult = 0; if (nullprov != NULL) { testresult = TEST_skip("Test does not support a non-default library context"); goto err; } if (!TEST_ptr(method) || !TEST_ptr(pkey = load_example_rsa_key())) goto err; rsa_ex_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, NULL); if (!TEST_int_ne(rsa_ex_idx, -1) || !TEST_ptr(rsa = EVP_PKEY_get1_RSA(pkey))) goto err; switch (idx) { case 0: if (!TEST_true(RSA_set_ex_data(rsa, rsa_ex_idx, (void *)"kem-test")) || !TEST_true(RSA_meth_set_pub_enc(method, tst_rsa_pub_enc))) goto err; break; case 1: if (!TEST_true(RSA_set_ex_data(rsa, rsa_ex_idx, (void *)"kem-test-flen-ne-ret")) || !TEST_true(RSA_meth_set_pub_enc(method, tst_rsa_pub_enc_flen_ne_ret))) goto err; break; default: goto err; }; if (!TEST_true(RSA_set_method(rsa, method)) || !TEST_int_gt(EVP_PKEY_assign_RSA(pkey, rsa), 0)) goto err; rsa = NULL; if (!TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(testctx, pkey, NULL)) || !TEST_int_eq(EVP_PKEY_encapsulate_init(ctx, NULL), 1) || !TEST_int_eq(EVP_PKEY_CTX_set_kem_op(ctx, "RSASVE"), 1) || !TEST_int_eq(EVP_PKEY_encapsulate(ctx, NULL, &ctlen, NULL, &secretlen), 1) || !TEST_ptr(ct = OPENSSL_malloc(ctlen)) || !TEST_ptr(secret = OPENSSL_malloc(secretlen))) goto err; encap_hits = flen_ne_ret_hits = 0; if (!TEST_int_eq(EVP_PKEY_encapsulate(ctx, ct, &ctlen, secret, &secretlen), 0)) goto err; switch (idx) { case 0: if (!TEST_int_eq(encap_hits, 1)) goto err; break; case 1: if (!TEST_int_eq(flen_ne_ret_hits, 1)) goto err; break; default: goto err; } testresult = 1; err: OPENSSL_free(secret); OPENSSL_free(ct); EVP_PKEY_CTX_free(ctx); RSA_free(rsa); EVP_PKEY_free(pkey); RSA_meth_free(method); return testresult; } #ifndef OPENSSL_NO_DSA static int dsa_ex_idx = -1; static DSA_SIG *(*orig_dsa_sign)(const unsigned char *, int, DSA *); static DSA_SIG *tst_dsa_sign(const unsigned char *buf, int len, DSA *dsa) { if (strcmp(DSA_get_ex_data(dsa, dsa_ex_idx), "test") != 0) return 0; sign_hits++; return orig_dsa_sign(buf, len, dsa); } /* Test that a low level DSA method still gets used even with a provider */ static int test_low_level_dsa_method(void) { DSA *dsa = NULL; const DSA_METHOD *def = DSA_get_default_method(); DSA_METHOD *method = DSA_meth_dup(def); EVP_PKEY *pkey = NULL; int testresult = 0; if (nullprov != NULL) { testresult = TEST_skip("Test does not support a non-default library context"); goto err; } if (!TEST_ptr(method)) goto err; dsa_ex_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, NULL); dsa = load_dsa_params(); if (!TEST_ptr(dsa)) goto err; if (!TEST_true(DSA_set_ex_data(dsa, dsa_ex_idx, (void *)"test"))) goto err; if (!TEST_true(DSA_generate_key(dsa))) goto err; orig_dsa_sign = DSA_meth_get_sign(def); if (!TEST_true(DSA_meth_set_sign(method, tst_dsa_sign))) goto err; if (!TEST_true(DSA_set_method(dsa, method))) goto err; pkey = EVP_PKEY_new(); if (!TEST_ptr(pkey)) goto err; if (!TEST_int_gt(EVP_PKEY_assign_DSA(pkey, dsa), 0)) goto err; dsa = NULL; if (!do_sign_with_method(pkey)) goto err; testresult = 1; err: DSA_free(dsa); EVP_PKEY_free(pkey); DSA_meth_free(method); return testresult; } #endif /* OPENSSL_NO_DSA */ #ifndef OPENSSL_NO_EC static int ec_ex_idx = -1; static int (*orig_ec_sign)(int type, const unsigned char *dgst, int dlen, unsigned char *sig, unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey); static int (*orig_ec_sign_setup)(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp); static ECDSA_SIG *(*orig_ec_sign_sig)(const unsigned char *dgst, int dgst_len, const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey); static int tst_ec_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig, unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) { if (strcmp(EC_KEY_get_ex_data(eckey, ec_ex_idx), "test") != 0) return 0; sign_hits++; return orig_ec_sign(type, dgst, dlen, sig, siglen, kinv, r, eckey); } /* Test that a low level EC_KEY method still gets used even with a provider */ static int test_low_level_ec_method(void) { EC_KEY *ec = NULL; const EC_KEY_METHOD *def = EC_KEY_get_default_method(); EC_KEY_METHOD *method = EC_KEY_METHOD_new(def); EVP_PKEY *pkey = NULL; int testresult = 0; if (nullprov != NULL) { testresult = TEST_skip("Test does not support a non-default library context"); goto err; } if (!TEST_ptr(method)) goto err; ec_ex_idx = EC_KEY_get_ex_new_index(0, NULL, NULL, NULL, NULL); if (!TEST_ptr(ec = EC_KEY_new_by_curve_name_ex(NULL, NULL, NID_X9_62_prime256v1))) goto err; if (!TEST_true(EC_KEY_set_ex_data(ec, ec_ex_idx, (void *)"test"))) goto err; if (!TEST_true(EC_KEY_generate_key(ec))) goto err; EC_KEY_METHOD_get_sign(def, &orig_ec_sign, &orig_ec_sign_setup, &orig_ec_sign_sig); EC_KEY_METHOD_set_sign(method, tst_ec_sign, orig_ec_sign_setup, orig_ec_sign_sig); if (!TEST_true(EC_KEY_set_method(ec, method))) goto err; pkey = EVP_PKEY_new(); if (!TEST_ptr(pkey)) goto err; if (!TEST_int_gt(EVP_PKEY_assign_EC_KEY(pkey, ec), 0)) goto err; ec = NULL; if (!do_sign_with_method(pkey)) goto err; testresult = 1; err: EC_KEY_free(ec); EVP_PKEY_free(pkey); EC_KEY_METHOD_free(method); return testresult; } #endif /* OPENSSL_NO_EC */ #ifndef OPENSSL_NO_DH static int dh_ex_idx = -1; static int compute_key_hits = 0; static int (*orig_dh_compute_key)(unsigned char *key, const BIGNUM *pub_key, DH *dh); static int tst_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) { if (strcmp(DH_get_ex_data(dh, dh_ex_idx), "test") != 0) return 0; compute_key_hits++; return orig_dh_compute_key(key, pub_key, dh); } /* Test that a low level DH method still gets used even with a provider */ static int test_low_level_dh_method(void) { DH *dh = NULL; const DH *cdh = NULL; const DH_METHOD *def = DH_get_default_method(); DH_METHOD *method = DH_meth_dup(def); EVP_PKEY *pkey = NULL, *pkeyb = NULL; int testresult = 0; EVP_PKEY_CTX *ctx = NULL; BIGNUM *p = NULL, *g = NULL; unsigned char *buf = NULL; size_t len; if (nullprov != NULL) { testresult = TEST_skip("Test does not support a non-default library context"); goto err; } if (!TEST_ptr(method)) goto err; dh_ex_idx = DH_get_ex_new_index(0, NULL, NULL, NULL, NULL); pkey = get_dh512(NULL); if (!TEST_ptr(pkey)) goto err; cdh = EVP_PKEY_get0_DH(pkey); if (!TEST_ptr(cdh)) goto err; dh = DH_new(); if (!TEST_ptr(dh)) goto err; if (!TEST_true(DH_set_ex_data(dh, dh_ex_idx, (void *)"test"))) goto err; orig_dh_compute_key = DH_meth_get_compute_key(def); if (!TEST_true(DH_meth_set_compute_key(method, tst_dh_compute_key))) goto err; if (!TEST_true(DH_set_method(dh, method))) goto err; p = BN_dup(DH_get0_p(cdh)); g = BN_dup(DH_get0_g(cdh)); if (!TEST_ptr(p) || !TEST_ptr(g)) goto err; if (!TEST_true(DH_set0_pqg(dh, p, NULL, g))) goto err; p = g = NULL; if (!TEST_true(DH_generate_key(dh))) goto err; ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL); if (!TEST_int_gt(EVP_PKEY_keygen_init(ctx), 0)) goto err; if (!TEST_int_gt(EVP_PKEY_keygen(ctx, &pkeyb), 0)) goto err; EVP_PKEY_free(pkey); pkey = NULL; pkey = EVP_PKEY_new(); if (!TEST_ptr(pkey)) goto err; if (!TEST_int_gt(EVP_PKEY_assign_DH(pkey, dh), 0)) goto err; dh = NULL; compute_key_hits = 0; EVP_PKEY_CTX_free(ctx); ctx = EVP_PKEY_CTX_new(pkey, NULL); if (!TEST_ptr(ctx)) return 0; if (!TEST_int_gt(EVP_PKEY_derive_init(ctx), 0)) goto err; if (!TEST_int_gt(EVP_PKEY_derive_set_peer(ctx, pkeyb), 0)) goto err; if (!TEST_int_gt(EVP_PKEY_derive(ctx, NULL, &len), 0)) goto err; buf = OPENSSL_malloc(len); if (!TEST_ptr(buf)) goto err; if (!TEST_int_gt(EVP_PKEY_derive(ctx, buf, &len), 0)) goto err; /* We expect to see our custom compute key function called once */ if (!TEST_int_eq(compute_key_hits, 1)) goto err; testresult = 1; err: BN_free(p); BN_free(g); EVP_PKEY_CTX_free(ctx); EVP_PKEY_free(pkey); EVP_PKEY_free(pkeyb); DH_meth_free(method); DH_free(dh); OPENSSL_free(buf); return testresult; } #endif /* OPENSSL_NO_DH */ #endif /* OPENSSL_NO_DEPRECATED_3_0 */ int setup_tests(void) { char *config_file = NULL; OPTION_CHOICE o; while ((o = opt_next()) != OPT_EOF) { switch (o) { case OPT_CONTEXT: /* Set up an alternate library context */ testctx = OSSL_LIB_CTX_new(); if (!TEST_ptr(testctx)) return 0; #ifdef STATIC_LEGACY /* * This test is always statically linked against libcrypto. We must not * attempt to load legacy.so that might be dynamically linked against * libcrypto. Instead we use a built-in version of the legacy provider. */ if (!OSSL_PROVIDER_add_builtin(testctx, "legacy", ossl_legacy_provider_init)) return 0; #endif /* Swap the libctx to test non-default context only */ nullprov = OSSL_PROVIDER_load(NULL, "null"); deflprov = OSSL_PROVIDER_load(testctx, "default"); #ifndef OPENSSL_SYS_TANDEM lgcyprov = OSSL_PROVIDER_load(testctx, "legacy"); #endif break; case OPT_CONFIG_FILE: config_file = opt_arg(); if (!test_get_libctx(&testctx, &nullprov, config_file, NULL, NULL)) return 0; break; case OPT_TEST_CASES: break; default: return 0; } } if (config_file != NULL) { ADD_TEST(test_EVP_set_config_properties); return 1; } ADD_TEST(test_EVP_set_default_properties); ADD_ALL_TESTS(test_EVP_DigestSignInit, 30); ADD_TEST(test_EVP_DigestVerifyInit); #ifndef OPENSSL_NO_EC ADD_TEST(test_ecdsa_digestsign_keccak); #endif #ifndef OPENSSL_NO_SIPHASH ADD_TEST(test_siphash_digestsign); #endif ADD_TEST(test_EVP_Digest); ADD_TEST(test_EVP_md_null); #ifndef OPENSSL_NO_POLY1305 ADD_TEST(test_evp_mac_poly1305_no_key); #endif ADD_ALL_TESTS(test_EVP_PKEY_sign, 3); #ifndef OPENSSL_NO_DEPRECATED_3_0 ADD_ALL_TESTS(test_EVP_PKEY_sign_with_app_method, 2); #endif #ifndef OPENSSL_NO_EC ADD_TEST(test_EVP_PKEY_sign_init_mismatched_key_alg); #endif ADD_ALL_TESTS(test_EVP_Enveloped, 2); ADD_ALL_TESTS(test_d2i_AutoPrivateKey, OSSL_NELEM(keydata)); ADD_TEST(test_privatekey_to_pkcs8); ADD_TEST(test_EVP_PKCS82PKEY_wrong_tag); ADD_ALL_TESTS(test_EVP_PKCS82PKEY_v2, OSSL_NELEM(keydata_v2)); #ifndef OPENSSL_NO_EC ADD_TEST(test_EVP_PKCS82PKEY); #endif #ifndef OPENSSL_NO_EC ADD_ALL_TESTS(test_EC_keygen_with_enc, OSSL_NELEM(ec_encodings)); #endif #if !defined(OPENSSL_NO_SM2) ADD_TEST(test_EVP_SM2); ADD_TEST(test_EVP_SM2_verify); #endif ADD_ALL_TESTS(test_set_get_raw_keys, OSSL_NELEM(keys)); ADD_MFAIL_ALL_TESTS(test_set_get_raw_keys_mfail, OSSL_NELEM(keys)); ADD_ALL_TESTS(test_EVP_PKEY_check, OSSL_NELEM(keycheckdata)); #ifndef OPENSSL_NO_CMAC ADD_TEST(test_CMAC_keygen); #endif ADD_TEST(test_HKDF); ADD_TEST(test_emptyikm_HKDF); ADD_TEST(test_empty_salt_info_HKDF); #ifndef OPENSSL_NO_EC ADD_TEST(test_X509_PUBKEY_inplace); ADD_TEST(test_X509_PUBKEY_dup); ADD_ALL_TESTS(test_invalid_ec_char2_pub_range_decode, OSSL_NELEM(ec_der_pub_keys)); #endif #ifndef OPENSSL_NO_DSA ADD_TEST(test_DSA_get_set_params); ADD_TEST(test_DSA_priv_pub); #endif ADD_TEST(test_RSA_get_set_params); ADD_TEST(test_RSA_OAEP_set_get_params); ADD_TEST(test_RSA_OAEP_set_null_label); ADD_TEST(test_RSA_verify_recover_rejects_short_buffer); ADD_TEST(test_RSA_verify_recover_empty_payload); ADD_TEST(test_RSA_encrypt); #ifndef OPENSSL_NO_DEPRECATED_3_0 ADD_TEST(test_RSA_legacy); #endif #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) ADD_TEST(test_decrypt_null_chunks); #endif #ifndef OPENSSL_NO_DH ADD_TEST(test_DH_priv_pub); #ifndef OPENSSL_NO_DEPRECATED_3_0 ADD_TEST(test_EVP_PKEY_set1_DH); #endif ADD_TEST(test_dhx_derive_rejects_bad_peer_q); #endif #ifndef OPENSSL_NO_EC ADD_TEST(test_EC_priv_pub); ADD_TEST(test_evp_get_ec_pub); #ifndef OPENSSL_NO_DEPRECATED_3_0 ADD_TEST(test_EC_priv_only_legacy); ADD_TEST(test_evp_get_ec_pub_legacy); #endif #endif ADD_ALL_TESTS(test_keygen_with_empty_template, 2); ADD_ALL_TESTS(test_pkey_ctx_fail_without_provider, 2); ADD_TEST(test_rand_agglomeration); ADD_ALL_TESTS(test_evp_iv_aes, 13); #ifndef OPENSSL_NO_DES ADD_ALL_TESTS(test_evp_iv_des, 6); ADD_TEST(test_EVP_CIPHER_get_type_des_ede3); #endif /* OPENSSL_NO_DES */ #ifndef OPENSSL_NO_BF ADD_ALL_TESTS(test_evp_bf_default_keylen, 4); #endif ADD_TEST(test_EVP_rsa_pss_with_keygen_bits); ADD_TEST(test_EVP_rsa_pss_set_saltlen); ADD_TEST(test_EVP_rsa_invalid_key); #ifndef OPENSSL_NO_EC ADD_ALL_TESTS(test_ecpub, OSSL_NELEM(ecpub_nids)); #endif ADD_TEST(test_names_do_all); setup_cipher_list(); ADD_ALL_TESTS(test_evp_diff_order_init, cipher_list_n); ADD_ALL_TESTS(test_evp_stale_key_reinit, cipher_list_n); ADD_ALL_TESTS(test_evp_decrypt_roundtrip_multistep, cipher_list_n); ADD_ALL_TESTS(test_evp_oneshot_aead_zerolen, cipher_list_n); ADD_ALL_TESTS(test_evp_aead_tag_direction, cipher_list_n); ADD_ALL_TESTS(test_evp_aead_late_aad, cipher_list_n); ADD_ALL_TESTS(test_evp_init_seq, OSSL_NELEM(evp_init_tests)); ADD_ALL_TESTS(test_evp_reset, OSSL_NELEM(evp_reset_tests)); ADD_ALL_TESTS(test_evp_reinit_seq, OSSL_NELEM(evp_reinit_tests)); ADD_ALL_TESTS(test_gcm_reinit, OSSL_NELEM(gcm_reinit_tests)); ADD_ALL_TESTS(test_evp_updated_iv, OSSL_NELEM(evp_updated_iv_tests)); ADD_ALL_TESTS(test_evp_final_no_tag, OSSL_NELEM(evp_final_no_tag)); ADD_ALL_TESTS(test_ivlen_change, OSSL_NELEM(ivlen_change_ciphers)); ADD_ALL_TESTS(test_iv_reuse, OSSL_NELEM(iv_state_ciphers)); if (OSSL_NELEM(keylen_change_ciphers) - 1 > 0) ADD_ALL_TESTS(test_keylen_change, OSSL_NELEM(keylen_change_ciphers) - 1); #ifndef OPENSSL_NO_ECX ADD_ALL_TESTS(test_ecx_short_keys, OSSL_NELEM(ecxnids)); ADD_ALL_TESTS(test_ecx_not_private_key, OSSL_NELEM(keys)); #endif ADD_TEST(test_sign_continuation); /* Test cases for CVE-2023-5363 */ ADD_TEST(test_aes_gcm_ivlen_change_cve_2023_5363); #ifndef OPENSSL_NO_RC4 ADD_TEST(test_aes_rc4_keylen_change_cve_2023_5363); #endif ADD_ALL_TESTS(test_aead_oneshot_roundtrip, 2 * OSSL_NELEM(aead_oneshot_cfgs)); /* Test cases for CVE-2026-45446 */ ADD_TEST(test_aes_gcm_siv_empty_data); ADD_TEST(test_aes_siv_ctx_reuse); ADD_TEST(test_invalid_ctx_for_digest); ADD_TEST(test_evp_cipher_negative_length); ADD_TEST(test_aes_xts_rejects_missing_iv); ADD_TEST(test_evp_cipher_pipeline); #ifndef OPENSSL_NO_ML_KEM ADD_ALL_TESTS(test_ml_kem_seed_only, 2); #endif #ifndef OPENSSL_NO_ML_DSA ADD_ALL_TESTS(test_ml_dsa_seed_only, 2); #endif #ifndef OPENSSL_NO_DEPRECATED_3_0 ADD_TEST(test_low_level_rsa_method); ADD_ALL_TESTS(test_low_level_rsa_kem_public_encrypt_failure, 2); #ifndef OPENSSL_NO_DSA ADD_TEST(test_low_level_dsa_method); #endif #ifndef OPENSSL_NO_EC ADD_TEST(test_low_level_ec_method); #endif #ifndef OPENSSL_NO_DH ADD_TEST(test_low_level_dh_method); #endif #endif /* OPENSSL_NO_DEPRECATED_3_0 */ return 1; } void cleanup_tests(void) { OSSL_PROVIDER_unload(nullprov); OSSL_PROVIDER_unload(deflprov); cleanup_cipher_list(); #ifndef OPENSSL_SYS_TANDEM OSSL_PROVIDER_unload(lgcyprov); #endif OSSL_LIB_CTX_free(testctx); }