1 /*
2 * Utilities for constant-time cryptography.
3 *
4 * Author: Emilia Kasper ([email protected])
5 * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley
6 * (Google).
7 * ====================================================================
8 * Copyright (c) 2014 The OpenSSL Project. All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * "This product includes cryptographic software written by
21 * Eric Young ([email protected])"
22 * The word 'cryptographic' can be left out if the rouines from the library
23 * being used are not cryptographic related :-).
24 * 4. If you include any Windows specific code (or a derivative thereof) from
25 * the apps directory (application code) you must include an acknowledgement:
26 * "This product includes software written by Tim Hudson ([email protected])"
27 *
28 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * SUCH DAMAGE.
39 *
40 * The licence and distribution terms for any publically available version or
41 * derivative of this code cannot be changed. i.e. this code cannot simply be
42 * copied and put under another distribution licence
43 * [including the GNU Public Licence.]
44 */
45
46 #include "internal.h"
47
48 int bssl_constant_time_test_main(void);
49
test_binary_op_w(crypto_word_t (* op)(crypto_word_t a,crypto_word_t b),crypto_word_t a,crypto_word_t b,int is_true)50 static int test_binary_op_w(crypto_word_t (*op)(crypto_word_t a, crypto_word_t b),
51 crypto_word_t a, crypto_word_t b, int is_true) {
52 crypto_word_t c = op(a, b);
53 if (is_true && c != CONSTTIME_TRUE_W) {
54 return 1;
55 } else if (!is_true && c != CONSTTIME_FALSE_W) {
56 return 1;
57 }
58 return 0;
59 }
60
test_is_zero_w(crypto_word_t a)61 static int test_is_zero_w(crypto_word_t a) {
62 crypto_word_t c = constant_time_is_zero_w(a);
63 if (a == 0 && c != CONSTTIME_TRUE_W) {
64 return 1;
65 } else if (a != 0 && c != CONSTTIME_FALSE_W) {
66 return 1;
67 }
68
69 c = constant_time_is_nonzero_w(a);
70 if (a == 0 && c != CONSTTIME_FALSE_W) {
71 return 1;
72 } else if (a != 0 && c != CONSTTIME_TRUE_W) {
73 return 1;
74 }
75
76 return 0;
77 }
78
test_select_w(crypto_word_t a,crypto_word_t b)79 static int test_select_w(crypto_word_t a, crypto_word_t b) {
80 crypto_word_t selected = constant_time_select_w(CONSTTIME_TRUE_W, a, b);
81 if (selected != a) {
82 return 1;
83 }
84 selected = constant_time_select_w(CONSTTIME_FALSE_W, a, b);
85 if (selected != b) {
86 return 1;
87 }
88 return 0;
89 }
90
91 static crypto_word_t test_values_w[] = {
92 0,
93 1,
94 1024,
95 12345,
96 32000,
97 #if defined(OPENSSL_64_BIT)
98 0xffffffff / 2 - 1,
99 0xffffffff / 2,
100 0xffffffff / 2 + 1,
101 0xffffffff - 1,
102 0xffffffff,
103 #endif
104 SIZE_MAX / 2 - 1,
105 SIZE_MAX / 2,
106 SIZE_MAX / 2 + 1,
107 SIZE_MAX - 1,
108 SIZE_MAX
109 };
110
bssl_constant_time_test_main(void)111 int bssl_constant_time_test_main(void) {
112 int num_failed = 0;
113
114 for (size_t i = 0;
115 i < sizeof(test_values_w) / sizeof(test_values_w[0]); ++i) {
116 crypto_word_t a = test_values_w[i];
117 num_failed += test_is_zero_w(a);
118 for (size_t j = 0;
119 j < sizeof(test_values_w) / sizeof(test_values_w[0]); ++j) {
120 crypto_word_t b = test_values_w[j];
121 num_failed += test_binary_op_w(&constant_time_eq_w, a, b, a == b);
122 num_failed += test_binary_op_w(&constant_time_eq_w, b, a, b == a);
123 num_failed += test_select_w(a, b);
124 }
125 }
126
127 return num_failed == 0;
128 }
129
130 // Exposes `constant_time_conditional_memcpy` to Rust for tests only.
bssl_constant_time_test_conditional_memcpy(uint8_t dst[256],const uint8_t src[256],crypto_word_t b)131 void bssl_constant_time_test_conditional_memcpy(uint8_t dst[256], const uint8_t src[256],
132 crypto_word_t b) {
133 constant_time_conditional_memcpy(dst, src, 256, b);
134 }
135
136 // Exposes `constant_time_conditional_memxor` to Rust for tests only.
bssl_constant_time_test_conditional_memxor(uint8_t dst[256],const uint8_t src[256],crypto_word_t b)137 void bssl_constant_time_test_conditional_memxor(uint8_t dst[256],
138 const uint8_t src[256],
139 crypto_word_t b) {
140 constant_time_conditional_memxor(dst, src, 256, b);
141 }
142