1 /*
2 * Written by Dr Stephen N Henson ([email protected]) for the OpenSSL
3 * project.
4 */
5 /* ====================================================================
6 * Copyright (c) 2015 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * [email protected].
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 */
53
54 #include <limits.h>
55 #include <stdlib.h>
56 #include <string.h>
57
58 #include <algorithm>
59 #include <string>
60 #include <vector>
61
62 #include <gtest/gtest.h>
63
64 #include <openssl/aes.h>
65 #include <openssl/cipher.h>
66 #include <openssl/err.h>
67 #include <openssl/nid.h>
68 #include <openssl/rand.h>
69 #include <openssl/sha.h>
70 #include <openssl/span.h>
71
72 #include "../internal.h"
73 #include "../test/file_test.h"
74 #include "../test/test_util.h"
75 #include "../test/wycheproof_util.h"
76 #include "./internal.h"
77
78
GetCipher(const std::string & name)79 static const EVP_CIPHER *GetCipher(const std::string &name) {
80 if (name == "DES-CBC") {
81 return EVP_des_cbc();
82 } else if (name == "DES-ECB") {
83 return EVP_des_ecb();
84 } else if (name == "DES-EDE") {
85 return EVP_des_ede();
86 } else if (name == "DES-EDE3") {
87 return EVP_des_ede3();
88 } else if (name == "DES-EDE-CBC") {
89 return EVP_des_ede_cbc();
90 } else if (name == "DES-EDE3-CBC") {
91 return EVP_des_ede3_cbc();
92 } else if (name == "RC4") {
93 return EVP_rc4();
94 } else if (name == "AES-128-ECB") {
95 return EVP_aes_128_ecb();
96 } else if (name == "AES-256-ECB") {
97 return EVP_aes_256_ecb();
98 } else if (name == "AES-128-CBC") {
99 return EVP_aes_128_cbc();
100 } else if (name == "AES-128-GCM") {
101 return EVP_aes_128_gcm();
102 } else if (name == "AES-128-OFB") {
103 return EVP_aes_128_ofb();
104 } else if (name == "AES-192-CBC") {
105 return EVP_aes_192_cbc();
106 } else if (name == "AES-192-CTR") {
107 return EVP_aes_192_ctr();
108 } else if (name == "AES-192-ECB") {
109 return EVP_aes_192_ecb();
110 } else if (name == "AES-192-GCM") {
111 return EVP_aes_192_gcm();
112 } else if (name == "AES-192-OFB") {
113 return EVP_aes_192_ofb();
114 } else if (name == "AES-256-CBC") {
115 return EVP_aes_256_cbc();
116 } else if (name == "AES-128-CTR") {
117 return EVP_aes_128_ctr();
118 } else if (name == "AES-256-CTR") {
119 return EVP_aes_256_ctr();
120 } else if (name == "AES-256-GCM") {
121 return EVP_aes_256_gcm();
122 } else if (name == "AES-256-OFB") {
123 return EVP_aes_256_ofb();
124 }
125 return nullptr;
126 }
127
128 enum class Operation {
129 // kBoth tests both encryption and decryption.
130 kBoth,
131 // kEncrypt tests encryption. The result of encryption should always
132 // successfully decrypt, so this should only be used if the test file has a
133 // matching decrypt-only vector.
134 kEncrypt,
135 // kDecrypt tests decryption. This should only be used if the test file has a
136 // matching encrypt-only input, or if multiple ciphertexts are valid for
137 // a given plaintext and this is a non-canonical ciphertext.
138 kDecrypt,
139 // kInvalidDecrypt tests decryption and expects it to fail, e.g. due to
140 // invalid tag or padding.
141 kInvalidDecrypt,
142 };
143
OperationToString(Operation op)144 static const char *OperationToString(Operation op) {
145 switch (op) {
146 case Operation::kBoth:
147 return "Both";
148 case Operation::kEncrypt:
149 return "Encrypt";
150 case Operation::kDecrypt:
151 return "Decrypt";
152 case Operation::kInvalidDecrypt:
153 return "InvalidDecrypt";
154 }
155 abort();
156 }
157
158 // MaybeCopyCipherContext, if |copy| is true, replaces |*ctx| with a, hopefully
159 // equivalent, copy of it.
MaybeCopyCipherContext(bool copy,bssl::UniquePtr<EVP_CIPHER_CTX> * ctx)160 static bool MaybeCopyCipherContext(bool copy,
161 bssl::UniquePtr<EVP_CIPHER_CTX> *ctx) {
162 if (!copy) {
163 return true;
164 }
165 bssl::UniquePtr<EVP_CIPHER_CTX> ctx2(EVP_CIPHER_CTX_new());
166 if (!ctx2 || !EVP_CIPHER_CTX_copy(ctx2.get(), ctx->get())) {
167 return false;
168 }
169 *ctx = std::move(ctx2);
170 return true;
171 }
172
TestCipherAPI(const EVP_CIPHER * cipher,Operation op,bool padding,bool copy,bool in_place,bool use_evp_cipher,size_t chunk_size,bssl::Span<const uint8_t> key,bssl::Span<const uint8_t> iv,bssl::Span<const uint8_t> plaintext,bssl::Span<const uint8_t> ciphertext,bssl::Span<const uint8_t> aad,bssl::Span<const uint8_t> tag)173 static void TestCipherAPI(const EVP_CIPHER *cipher, Operation op, bool padding,
174 bool copy, bool in_place, bool use_evp_cipher,
175 size_t chunk_size, bssl::Span<const uint8_t> key,
176 bssl::Span<const uint8_t> iv,
177 bssl::Span<const uint8_t> plaintext,
178 bssl::Span<const uint8_t> ciphertext,
179 bssl::Span<const uint8_t> aad,
180 bssl::Span<const uint8_t> tag) {
181 bool encrypt = op == Operation::kEncrypt;
182 bool is_custom_cipher =
183 EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_CUSTOM_CIPHER;
184 bssl::Span<const uint8_t> in = encrypt ? plaintext : ciphertext;
185 bssl::Span<const uint8_t> expected = encrypt ? ciphertext : plaintext;
186 bool is_aead = EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE;
187
188 // Some |EVP_CIPHER|s take a variable-length key, and need to first be
189 // configured with the key length, which requires configuring the cipher.
190 bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
191 ASSERT_TRUE(ctx);
192 ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, /*engine=*/nullptr,
193 /*key=*/nullptr, /*iv=*/nullptr,
194 encrypt ? 1 : 0));
195 ASSERT_TRUE(EVP_CIPHER_CTX_set_key_length(ctx.get(), key.size()));
196 if (!padding) {
197 ASSERT_TRUE(EVP_CIPHER_CTX_set_padding(ctx.get(), 0));
198 }
199
200 // Configure the key.
201 ASSERT_TRUE(MaybeCopyCipherContext(copy, &ctx));
202 ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), /*cipher=*/nullptr,
203 /*engine=*/nullptr, key.data(), /*iv=*/nullptr,
204 /*enc=*/-1));
205
206 // Configure the IV to run the actual operation. Callers that wish to use a
207 // key for multiple, potentially concurrent, operations will likely copy at
208 // this point. The |EVP_CIPHER_CTX| API uses the same type to represent a
209 // pre-computed key schedule and a streaming operation.
210 ASSERT_TRUE(MaybeCopyCipherContext(copy, &ctx));
211 if (is_aead) {
212 ASSERT_LE(iv.size(), size_t{INT_MAX});
213 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN,
214 static_cast<int>(iv.size()), nullptr));
215 ASSERT_EQ(EVP_CIPHER_CTX_iv_length(ctx.get()), iv.size());
216 } else {
217 ASSERT_EQ(iv.size(), EVP_CIPHER_CTX_iv_length(ctx.get()));
218 }
219 ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), /*cipher=*/nullptr,
220 /*engine=*/nullptr,
221 /*key=*/nullptr, iv.data(), /*enc=*/-1));
222
223 if (is_aead && !encrypt) {
224 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_TAG,
225 tag.size(),
226 const_cast<uint8_t *>(tag.data())));
227 }
228
229 // Note: the deprecated |EVP_CIPHER|-based AEAD API is sensitive to whether
230 // parameters are NULL, so it is important to skip the |in| and |aad|
231 // |EVP_CipherUpdate| calls when empty.
232 while (!aad.empty()) {
233 size_t todo =
234 chunk_size == 0 ? aad.size() : std::min(aad.size(), chunk_size);
235 if (use_evp_cipher) {
236 // AEADs always use the "custom cipher" return value convention. Passing a
237 // null output pointer triggers the AAD logic.
238 ASSERT_TRUE(is_custom_cipher);
239 ASSERT_EQ(static_cast<int>(todo),
240 EVP_Cipher(ctx.get(), nullptr, aad.data(), todo));
241 } else {
242 int len;
243 ASSERT_TRUE(EVP_CipherUpdate(ctx.get(), nullptr, &len, aad.data(), todo));
244 // Although it doesn't output anything, |EVP_CipherUpdate| should claim to
245 // output the input length.
246 EXPECT_EQ(len, static_cast<int>(todo));
247 }
248 aad = aad.subspan(todo);
249 }
250
251 // Set up the output buffer.
252 size_t max_out = in.size();
253 size_t block_size = EVP_CIPHER_CTX_block_size(ctx.get());
254 if (block_size > 1 &&
255 (EVP_CIPHER_CTX_flags(ctx.get()) & EVP_CIPH_NO_PADDING) == 0 &&
256 EVP_CIPHER_CTX_encrypting(ctx.get())) {
257 max_out += block_size - (max_out % block_size);
258 }
259 std::vector<uint8_t> result(max_out);
260 if (in_place) {
261 std::copy(in.begin(), in.end(), result.begin());
262 in = bssl::MakeConstSpan(result).first(in.size());
263 }
264
265 size_t total = 0;
266 int len;
267 while (!in.empty()) {
268 size_t todo = chunk_size == 0 ? in.size() : std::min(in.size(), chunk_size);
269 EXPECT_LE(todo, static_cast<size_t>(INT_MAX));
270 ASSERT_TRUE(MaybeCopyCipherContext(copy, &ctx));
271 if (use_evp_cipher) {
272 // |EVP_Cipher| sometimes returns the number of bytes written, or -1 on
273 // error, and sometimes 1 or 0, implicitly writing |in_len| bytes.
274 if (is_custom_cipher) {
275 len = EVP_Cipher(ctx.get(), result.data() + total, in.data(), todo);
276 } else {
277 ASSERT_EQ(
278 1, EVP_Cipher(ctx.get(), result.data() + total, in.data(), todo));
279 len = static_cast<int>(todo);
280 }
281 } else {
282 ASSERT_TRUE(EVP_CipherUpdate(ctx.get(), result.data() + total, &len,
283 in.data(), static_cast<int>(todo)));
284 }
285 ASSERT_GE(len, 0);
286 total += static_cast<size_t>(len);
287 in = in.subspan(todo);
288 }
289 if (op == Operation::kInvalidDecrypt) {
290 if (use_evp_cipher) {
291 // Only the "custom cipher" return value convention can report failures.
292 // Passing all nulls should act like |EVP_CipherFinal_ex|.
293 ASSERT_TRUE(is_custom_cipher);
294 EXPECT_EQ(-1, EVP_Cipher(ctx.get(), nullptr, nullptr, 0));
295 } else {
296 // Invalid padding and invalid tags all appear as a failed
297 // |EVP_CipherFinal_ex|.
298 EXPECT_FALSE(EVP_CipherFinal_ex(ctx.get(), result.data() + total, &len));
299 }
300 } else {
301 if (use_evp_cipher) {
302 if (is_custom_cipher) {
303 // Only the "custom cipher" convention has an |EVP_CipherFinal_ex|
304 // equivalent.
305 len = EVP_Cipher(ctx.get(), nullptr, nullptr, 0);
306 } else {
307 len = 0;
308 }
309 } else {
310 ASSERT_TRUE(EVP_CipherFinal_ex(ctx.get(), result.data() + total, &len));
311 }
312 ASSERT_GE(len, 0);
313 total += static_cast<size_t>(len);
314 result.resize(total);
315 EXPECT_EQ(Bytes(expected), Bytes(result));
316 if (encrypt && is_aead) {
317 uint8_t rtag[16];
318 ASSERT_LE(tag.size(), sizeof(rtag));
319 ASSERT_TRUE(MaybeCopyCipherContext(copy, &ctx));
320 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_GET_TAG,
321 tag.size(), rtag));
322 EXPECT_EQ(Bytes(tag), Bytes(rtag, tag.size()));
323 }
324 }
325 }
326
TestLowLevelAPI(const EVP_CIPHER * cipher,Operation op,bool in_place,size_t chunk_size,bssl::Span<const uint8_t> key,bssl::Span<const uint8_t> iv,bssl::Span<const uint8_t> plaintext,bssl::Span<const uint8_t> ciphertext)327 static void TestLowLevelAPI(
328 const EVP_CIPHER *cipher, Operation op, bool in_place, size_t chunk_size,
329 bssl::Span<const uint8_t> key, bssl::Span<const uint8_t> iv,
330 bssl::Span<const uint8_t> plaintext, bssl::Span<const uint8_t> ciphertext) {
331 bool encrypt = op == Operation::kEncrypt;
332 bssl::Span<const uint8_t> in = encrypt ? plaintext : ciphertext;
333 bssl::Span<const uint8_t> expected = encrypt ? ciphertext : plaintext;
334 int nid = EVP_CIPHER_nid(cipher);
335 bool is_ctr = nid == NID_aes_128_ctr || nid == NID_aes_192_ctr ||
336 nid == NID_aes_256_ctr;
337 bool is_cbc = nid == NID_aes_128_cbc || nid == NID_aes_192_cbc ||
338 nid == NID_aes_256_cbc;
339 bool is_ofb = nid == NID_aes_128_ofb128 || nid == NID_aes_192_ofb128 ||
340 nid == NID_aes_256_ofb128;
341 if (!is_ctr && !is_cbc && !is_ofb) {
342 return;
343 }
344
345 // Invalid ciphertexts are not possible in any of the ciphers where this API
346 // applies.
347 ASSERT_NE(op, Operation::kInvalidDecrypt);
348
349 AES_KEY aes;
350 if (encrypt || !is_cbc) {
351 ASSERT_EQ(0, AES_set_encrypt_key(key.data(), key.size() * 8, &aes));
352 } else {
353 ASSERT_EQ(0, AES_set_decrypt_key(key.data(), key.size() * 8, &aes));
354 }
355
356 std::vector<uint8_t> result;
357 if (in_place) {
358 result.assign(in.begin(), in.end());
359 } else {
360 result.resize(expected.size());
361 }
362 bssl::Span<uint8_t> out = bssl::MakeSpan(result);
363 // Input and output sizes for all the low-level APIs should match.
364 ASSERT_EQ(in.size(), out.size());
365
366 // The low-level APIs all use block-size IVs.
367 ASSERT_EQ(iv.size(), size_t{AES_BLOCK_SIZE});
368 uint8_t ivec[AES_BLOCK_SIZE];
369 OPENSSL_memcpy(ivec, iv.data(), iv.size());
370
371 if (is_ctr) {
372 unsigned num = 0;
373 uint8_t ecount_buf[AES_BLOCK_SIZE];
374 if (chunk_size == 0) {
375 AES_ctr128_encrypt(in.data(), out.data(), in.size(), &aes, ivec,
376 ecount_buf, &num);
377 } else {
378 do {
379 size_t todo = std::min(in.size(), chunk_size);
380 AES_ctr128_encrypt(in.data(), out.data(), todo, &aes, ivec, ecount_buf,
381 &num);
382 in = in.subspan(todo);
383 out = out.subspan(todo);
384 } while (!in.empty());
385 }
386 EXPECT_EQ(Bytes(expected), Bytes(result));
387 } else if (is_cbc && chunk_size % AES_BLOCK_SIZE == 0) {
388 // Note |AES_cbc_encrypt| requires block-aligned chunks.
389 if (chunk_size == 0) {
390 AES_cbc_encrypt(in.data(), out.data(), in.size(), &aes, ivec, encrypt);
391 } else {
392 do {
393 size_t todo = std::min(in.size(), chunk_size);
394 AES_cbc_encrypt(in.data(), out.data(), todo, &aes, ivec, encrypt);
395 in = in.subspan(todo);
396 out = out.subspan(todo);
397 } while (!in.empty());
398 }
399 EXPECT_EQ(Bytes(expected), Bytes(result));
400 } else if (is_ofb) {
401 int num = 0;
402 if (chunk_size == 0) {
403 AES_ofb128_encrypt(in.data(), out.data(), in.size(), &aes, ivec, &num);
404 } else {
405 do {
406 size_t todo = std::min(in.size(), chunk_size);
407 AES_ofb128_encrypt(in.data(), out.data(), todo, &aes, ivec, &num);
408 in = in.subspan(todo);
409 out = out.subspan(todo);
410 } while (!in.empty());
411 }
412 EXPECT_EQ(Bytes(expected), Bytes(result));
413 }
414 }
415
TestCipher(const EVP_CIPHER * cipher,Operation input_op,bool padding,bssl::Span<const uint8_t> key,bssl::Span<const uint8_t> iv,bssl::Span<const uint8_t> plaintext,bssl::Span<const uint8_t> ciphertext,bssl::Span<const uint8_t> aad,bssl::Span<const uint8_t> tag)416 static void TestCipher(const EVP_CIPHER *cipher, Operation input_op,
417 bool padding, bssl::Span<const uint8_t> key,
418 bssl::Span<const uint8_t> iv,
419 bssl::Span<const uint8_t> plaintext,
420 bssl::Span<const uint8_t> ciphertext,
421 bssl::Span<const uint8_t> aad,
422 bssl::Span<const uint8_t> tag) {
423 size_t block_size = EVP_CIPHER_block_size(cipher);
424 std::vector<Operation> ops;
425 if (input_op == Operation::kBoth) {
426 ops = {Operation::kEncrypt, Operation::kDecrypt};
427 } else {
428 ops = {input_op};
429 }
430 for (Operation op : ops) {
431 SCOPED_TRACE(OperationToString(op));
432 // Zero indicates a single-shot API.
433 static const size_t kChunkSizes[] = {0, 1, 2, 5, 7, 8, 9, 15, 16,
434 17, 31, 32, 33, 63, 64, 65, 512};
435 for (size_t chunk_size : kChunkSizes) {
436 SCOPED_TRACE(chunk_size);
437 if (chunk_size > plaintext.size() && chunk_size > ciphertext.size() &&
438 chunk_size > aad.size()) {
439 continue;
440 }
441 for (bool in_place : {false, true}) {
442 SCOPED_TRACE(in_place);
443 for (bool copy : {false, true}) {
444 SCOPED_TRACE(copy);
445 TestCipherAPI(cipher, op, padding, copy, in_place,
446 /*use_evp_cipher=*/false, chunk_size, key, iv,
447 plaintext, ciphertext, aad, tag);
448 if (!padding && chunk_size % block_size == 0) {
449 TestCipherAPI(cipher, op, padding, copy, in_place,
450 /*use_evp_cipher=*/true, chunk_size, key, iv,
451 plaintext, ciphertext, aad, tag);
452 }
453 }
454 if (!padding) {
455 TestLowLevelAPI(cipher, op, in_place, chunk_size, key, iv, plaintext,
456 ciphertext);
457 }
458 }
459 }
460 }
461 }
462
CipherFileTest(FileTest * t)463 static void CipherFileTest(FileTest *t) {
464 std::string cipher_str;
465 ASSERT_TRUE(t->GetAttribute(&cipher_str, "Cipher"));
466 const EVP_CIPHER *cipher = GetCipher(cipher_str);
467 ASSERT_TRUE(cipher);
468
469 std::vector<uint8_t> key, iv, plaintext, ciphertext, aad, tag;
470 ASSERT_TRUE(t->GetBytes(&key, "Key"));
471 ASSERT_TRUE(t->GetBytes(&plaintext, "Plaintext"));
472 ASSERT_TRUE(t->GetBytes(&ciphertext, "Ciphertext"));
473 if (EVP_CIPHER_iv_length(cipher) > 0) {
474 ASSERT_TRUE(t->GetBytes(&iv, "IV"));
475 }
476 if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) {
477 ASSERT_TRUE(t->GetBytes(&aad, "AAD"));
478 ASSERT_TRUE(t->GetBytes(&tag, "Tag"));
479 }
480
481 Operation op = Operation::kBoth;
482 if (t->HasAttribute("Operation")) {
483 const std::string &str = t->GetAttributeOrDie("Operation");
484 if (str == "Encrypt" || str == "ENCRYPT") {
485 op = Operation::kEncrypt;
486 } else if (str == "Decrypt" || str == "DECRYPT") {
487 op = Operation::kDecrypt;
488 } else if (str == "InvalidDecrypt") {
489 op = Operation::kInvalidDecrypt;
490 } else {
491 FAIL() << "Unknown operation: " << str;
492 }
493 }
494
495 TestCipher(cipher, op, /*padding=*/false, key, iv, plaintext, ciphertext, aad,
496 tag);
497 }
498
TEST(CipherTest,TestVectors)499 TEST(CipherTest, TestVectors) {
500 FileTestGTest("crypto/cipher_extra/test/cipher_tests.txt", CipherFileTest);
501 }
502
TEST(CipherTest,CAVP_AES_128_CBC)503 TEST(CipherTest, CAVP_AES_128_CBC) {
504 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_cbc.txt",
505 CipherFileTest);
506 }
507
TEST(CipherTest,CAVP_AES_128_CTR)508 TEST(CipherTest, CAVP_AES_128_CTR) {
509 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_128_ctr.txt",
510 CipherFileTest);
511 }
512
TEST(CipherTest,CAVP_AES_192_CBC)513 TEST(CipherTest, CAVP_AES_192_CBC) {
514 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_cbc.txt",
515 CipherFileTest);
516 }
517
TEST(CipherTest,CAVP_AES_192_CTR)518 TEST(CipherTest, CAVP_AES_192_CTR) {
519 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_192_ctr.txt",
520 CipherFileTest);
521 }
522
TEST(CipherTest,CAVP_AES_256_CBC)523 TEST(CipherTest, CAVP_AES_256_CBC) {
524 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_cbc.txt",
525 CipherFileTest);
526 }
527
TEST(CipherTest,CAVP_AES_256_CTR)528 TEST(CipherTest, CAVP_AES_256_CTR) {
529 FileTestGTest("crypto/cipher_extra/test/nist_cavp/aes_256_ctr.txt",
530 CipherFileTest);
531 }
532
TEST(CipherTest,CAVP_TDES_CBC)533 TEST(CipherTest, CAVP_TDES_CBC) {
534 FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt",
535 CipherFileTest);
536 }
537
TEST(CipherTest,CAVP_TDES_ECB)538 TEST(CipherTest, CAVP_TDES_ECB) {
539 FileTestGTest("crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt",
540 CipherFileTest);
541 }
542
TEST(CipherTest,WycheproofAESCBC)543 TEST(CipherTest, WycheproofAESCBC) {
544 FileTestGTest("third_party/wycheproof_testvectors/aes_cbc_pkcs5_test.txt",
545 [](FileTest *t) {
546 t->IgnoreInstruction("type");
547 t->IgnoreInstruction("ivSize");
548
549 std::string key_size;
550 ASSERT_TRUE(t->GetInstruction(&key_size, "keySize"));
551 const EVP_CIPHER *cipher;
552 switch (atoi(key_size.c_str())) {
553 case 128:
554 cipher = EVP_aes_128_cbc();
555 break;
556 case 192:
557 cipher = EVP_aes_192_cbc();
558 break;
559 case 256:
560 cipher = EVP_aes_256_cbc();
561 break;
562 default:
563 FAIL() << "Unsupported key size: " << key_size;
564 }
565
566 std::vector<uint8_t> key, iv, msg, ct;
567 ASSERT_TRUE(t->GetBytes(&key, "key"));
568 ASSERT_TRUE(t->GetBytes(&iv, "iv"));
569 ASSERT_TRUE(t->GetBytes(&msg, "msg"));
570 ASSERT_TRUE(t->GetBytes(&ct, "ct"));
571 WycheproofResult result;
572 ASSERT_TRUE(GetWycheproofResult(t, &result));
573 TestCipher(cipher,
574 result.IsValid() ? Operation::kBoth
575 : Operation::kInvalidDecrypt,
576 /*padding=*/true, key, iv, msg, ct, /*aad=*/{},
577 /*tag=*/{});
578 });
579 }
580
TEST(CipherTest,SHA1WithSecretSuffix)581 TEST(CipherTest, SHA1WithSecretSuffix) {
582 uint8_t buf[SHA_CBLOCK * 4];
583 RAND_bytes(buf, sizeof(buf));
584 // Hashing should run in time independent of the bytes.
585 CONSTTIME_SECRET(buf, sizeof(buf));
586
587 // Exhaustively testing interesting cases in this function is cubic in the
588 // block size, so we test in 3-byte increments.
589 constexpr size_t kSkip = 3;
590 // This value should be less than 8 to test the edge case when the 8-byte
591 // length wraps to the next block.
592 static_assert(kSkip < 8, "kSkip is too large");
593
594 // |EVP_sha1_final_with_secret_suffix| is sensitive to the public length of
595 // the partial block previously hashed. In TLS, this is the HMAC prefix, the
596 // header, and the public minimum padding length.
597 for (size_t prefix = 0; prefix < SHA_CBLOCK; prefix += kSkip) {
598 SCOPED_TRACE(prefix);
599 // The first block is treated differently, so we run with up to three
600 // blocks of length variability.
601 for (size_t max_len = 0; max_len < 3 * SHA_CBLOCK; max_len += kSkip) {
602 SCOPED_TRACE(max_len);
603 for (size_t len = 0; len <= max_len; len += kSkip) {
604 SCOPED_TRACE(len);
605
606 uint8_t expected[SHA_DIGEST_LENGTH];
607 SHA1(buf, prefix + len, expected);
608 CONSTTIME_DECLASSIFY(expected, sizeof(expected));
609
610 // Make a copy of the secret length to avoid interfering with the loop.
611 size_t secret_len = len;
612 CONSTTIME_SECRET(&secret_len, sizeof(secret_len));
613
614 SHA_CTX ctx;
615 SHA1_Init(&ctx);
616 SHA1_Update(&ctx, buf, prefix);
617 uint8_t computed[SHA_DIGEST_LENGTH];
618 ASSERT_TRUE(EVP_sha1_final_with_secret_suffix(
619 &ctx, computed, buf + prefix, secret_len, max_len));
620
621 CONSTTIME_DECLASSIFY(computed, sizeof(computed));
622 EXPECT_EQ(Bytes(expected), Bytes(computed));
623 }
624 }
625 }
626 }
627
TEST(CipherTest,SHA256WithSecretSuffix)628 TEST(CipherTest, SHA256WithSecretSuffix) {
629 uint8_t buf[SHA256_CBLOCK * 4];
630 RAND_bytes(buf, sizeof(buf));
631 // Hashing should run in time independent of the bytes.
632 CONSTTIME_SECRET(buf, sizeof(buf));
633
634 // Exhaustively testing interesting cases in this function is cubic in the
635 // block size, so we test in 3-byte increments.
636 constexpr size_t kSkip = 3;
637 // This value should be less than 8 to test the edge case when the 8-byte
638 // length wraps to the next block.
639 static_assert(kSkip < 8, "kSkip is too large");
640
641 // |EVP_sha256_final_with_secret_suffix| is sensitive to the public length of
642 // the partial block previously hashed. In TLS, this is the HMAC prefix, the
643 // header, and the public minimum padding length.
644 for (size_t prefix = 0; prefix < SHA256_CBLOCK; prefix += kSkip) {
645 SCOPED_TRACE(prefix);
646 // The first block is treated differently, so we run with up to three
647 // blocks of length variability.
648 for (size_t max_len = 0; max_len < 3 * SHA256_CBLOCK; max_len += kSkip) {
649 SCOPED_TRACE(max_len);
650 for (size_t len = 0; len <= max_len; len += kSkip) {
651 SCOPED_TRACE(len);
652
653 uint8_t expected[SHA256_DIGEST_LENGTH];
654 SHA256(buf, prefix + len, expected);
655 CONSTTIME_DECLASSIFY(expected, sizeof(expected));
656
657 // Make a copy of the secret length to avoid interfering with the loop.
658 size_t secret_len = len;
659 CONSTTIME_SECRET(&secret_len, sizeof(secret_len));
660
661 SHA256_CTX ctx;
662 SHA256_Init(&ctx);
663 SHA256_Update(&ctx, buf, prefix);
664 uint8_t computed[SHA256_DIGEST_LENGTH];
665 ASSERT_TRUE(EVP_sha256_final_with_secret_suffix(
666 &ctx, computed, buf + prefix, secret_len, max_len));
667
668 CONSTTIME_DECLASSIFY(computed, sizeof(computed));
669 EXPECT_EQ(Bytes(expected), Bytes(computed));
670 }
671 }
672 }
673 }
674
TEST(CipherTest,GetCipher)675 TEST(CipherTest, GetCipher) {
676 const EVP_CIPHER *cipher = EVP_get_cipherbynid(NID_aes_128_gcm);
677 ASSERT_TRUE(cipher);
678 EXPECT_EQ(NID_aes_128_gcm, EVP_CIPHER_nid(cipher));
679
680 cipher = EVP_get_cipherbyname("aes-128-gcm");
681 ASSERT_TRUE(cipher);
682 EXPECT_EQ(NID_aes_128_gcm, EVP_CIPHER_nid(cipher));
683
684 cipher = EVP_get_cipherbyname("AES-128-GCM");
685 ASSERT_TRUE(cipher);
686 EXPECT_EQ(NID_aes_128_gcm, EVP_CIPHER_nid(cipher));
687
688 // We support a tcpdump-specific alias for 3DES.
689 cipher = EVP_get_cipherbyname("3des");
690 ASSERT_TRUE(cipher);
691 EXPECT_EQ(NID_des_ede3_cbc, EVP_CIPHER_nid(cipher));
692 }
693
694 // Test the AES-GCM EVP_CIPHER's internal IV management APIs. OpenSSH uses these
695 // APIs.
TEST(CipherTest,GCMIncrementingIV)696 TEST(CipherTest, GCMIncrementingIV) {
697 const EVP_CIPHER *kCipher = EVP_aes_128_gcm();
698 static const uint8_t kKey[16] = {0, 1, 2, 3, 4, 5, 6, 7,
699 8, 9, 10, 11, 12, 13, 14, 15};
700 static const uint8_t kInput[] = {'h', 'e', 'l', 'l', 'o'};
701
702 auto expect_iv = [&](EVP_CIPHER_CTX *ctx, bssl::Span<const uint8_t> iv,
703 bool enc) {
704 // Make a reference ciphertext.
705 bssl::ScopedEVP_CIPHER_CTX ref;
706 ASSERT_TRUE(EVP_EncryptInit_ex(ref.get(), kCipher, /*impl=*/nullptr,
707 kKey, /*iv=*/nullptr));
708 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ref.get(), EVP_CTRL_AEAD_SET_IVLEN,
709 static_cast<int>(iv.size()), nullptr));
710 ASSERT_TRUE(EVP_EncryptInit_ex(ref.get(), /*cipher=*/nullptr,
711 /*impl=*/nullptr, /*key=*/nullptr,
712 iv.data()));
713 uint8_t ciphertext[sizeof(kInput)];
714 int ciphertext_len;
715 ASSERT_TRUE(EVP_EncryptUpdate(ref.get(), ciphertext, &ciphertext_len,
716 kInput, sizeof(kInput)));
717 int extra_len;
718 ASSERT_TRUE(EVP_EncryptFinal_ex(ref.get(), nullptr, &extra_len));
719 ASSERT_EQ(extra_len, 0);
720 uint8_t tag[16];
721 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ref.get(), EVP_CTRL_AEAD_GET_TAG,
722 sizeof(tag), tag));
723
724 if (enc) {
725 uint8_t actual[sizeof(kInput)];
726 int actual_len;
727 ASSERT_TRUE(
728 EVP_EncryptUpdate(ctx, actual, &actual_len, kInput, sizeof(kInput)));
729 ASSERT_TRUE(EVP_EncryptFinal_ex(ctx, nullptr, &extra_len));
730 ASSERT_EQ(extra_len, 0);
731 EXPECT_EQ(Bytes(actual, actual_len), Bytes(ciphertext, ciphertext_len));
732 uint8_t actual_tag[16];
733 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG,
734 sizeof(actual_tag), actual_tag));
735 EXPECT_EQ(Bytes(actual_tag), Bytes(tag));
736 } else {
737 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, sizeof(tag),
738 const_cast<uint8_t *>(tag)));
739 uint8_t actual[sizeof(kInput)];
740 int actual_len;
741 ASSERT_TRUE(EVP_DecryptUpdate(ctx, actual, &actual_len, ciphertext,
742 sizeof(ciphertext)));
743 ASSERT_TRUE(EVP_DecryptFinal_ex(ctx, nullptr, &extra_len));
744 ASSERT_EQ(extra_len, 0);
745 EXPECT_EQ(Bytes(actual, actual_len), Bytes(kInput));
746 }
747 };
748
749 {
750 // Passing in a fixed IV length of -1 sets the whole IV, but then configures
751 // |EVP_CIPHER_CTX| to increment the bottom 8 bytes of the IV.
752 static const uint8_t kIV1[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
753 static const uint8_t kIV2[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13};
754 static const uint8_t kIV3[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 14};
755 static const uint8_t kIV4[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 15};
756
757 bssl::ScopedEVP_CIPHER_CTX ctx;
758 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
759 /*iv=*/nullptr));
760 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, -1,
761 const_cast<uint8_t *>(kIV1)));
762
763 // EVP_CTRL_GCM_IV_GEN both configures and returns the IV.
764 uint8_t iv[12];
765 ASSERT_TRUE(
766 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
767 EXPECT_EQ(Bytes(iv), Bytes(kIV1));
768 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV1, /*enc=*/true));
769
770 // Continuing to run EVP_CTRL_GCM_IV_GEN should increment the IV.
771 ASSERT_TRUE(
772 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
773 EXPECT_EQ(Bytes(iv), Bytes(kIV2));
774 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV2, /*enc=*/true));
775
776 // Passing in a shorter length outputs the suffix portion.
777 uint8_t suffix[8];
778 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN,
779 sizeof(suffix), suffix));
780 EXPECT_EQ(Bytes(suffix),
781 Bytes(bssl::MakeConstSpan(kIV3).last(sizeof(suffix))));
782 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV3, /*enc=*/true));
783
784 // A length of -1 returns the whole IV.
785 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, -1, iv));
786 EXPECT_EQ(Bytes(iv), Bytes(kIV4));
787 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV4, /*enc=*/true));
788 }
789
790 {
791 // Similar to the above, but for decrypting.
792 static const uint8_t kIV1[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
793 static const uint8_t kIV2[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13};
794
795 bssl::ScopedEVP_CIPHER_CTX ctx;
796 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
797 /*iv=*/nullptr));
798 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, -1,
799 const_cast<uint8_t *>(kIV1)));
800
801 uint8_t iv[12];
802 ASSERT_TRUE(
803 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
804 EXPECT_EQ(Bytes(iv), Bytes(kIV1));
805 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV1, /*enc=*/false));
806
807 ASSERT_TRUE(
808 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
809 EXPECT_EQ(Bytes(iv), Bytes(kIV2));
810 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV2, /*enc=*/false));
811 }
812
813 {
814 // Test that only the bottom 8 bytes are used as a counter.
815 static const uint8_t kIV1[12] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
816 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
817 static const uint8_t kIV2[12] = {0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
818 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
819 static const uint8_t kIV3[12] = {0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
820 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
821
822 bssl::ScopedEVP_CIPHER_CTX ctx;
823 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
824 /*iv=*/nullptr));
825 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, -1,
826 const_cast<uint8_t *>(kIV1)));
827
828 uint8_t iv[12];
829 ASSERT_TRUE(
830 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
831 EXPECT_EQ(Bytes(iv), Bytes(kIV1));
832 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV1, /*enc=*/true));
833
834 ASSERT_TRUE(
835 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
836 EXPECT_EQ(Bytes(iv), Bytes(kIV2));
837 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV2, /*enc=*/true));
838
839 ASSERT_TRUE(
840 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
841 EXPECT_EQ(Bytes(iv), Bytes(kIV3));
842 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV3, /*enc=*/true));
843 }
844
845 {
846 // Test with a longer IV length.
847 static const uint8_t kIV1[16] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
848 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
849 0xff, 0xff, 0xff, 0xff};
850 static const uint8_t kIV2[16] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
851 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
852 0x00, 0x00, 0x00, 0x00};
853 static const uint8_t kIV3[16] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
854 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
855 0x00, 0x00, 0x00, 0x01};
856
857 bssl::ScopedEVP_CIPHER_CTX ctx;
858 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
859 /*iv=*/nullptr));
860 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN,
861 sizeof(kIV1), nullptr));
862 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, -1,
863 const_cast<uint8_t *>(kIV1)));
864
865 uint8_t iv[16];
866 ASSERT_TRUE(
867 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
868 EXPECT_EQ(Bytes(iv), Bytes(kIV1));
869 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV1, /*enc=*/true));
870
871 ASSERT_TRUE(
872 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
873 EXPECT_EQ(Bytes(iv), Bytes(kIV2));
874 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV2, /*enc=*/true));
875
876 ASSERT_TRUE(
877 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN, sizeof(iv), iv));
878 EXPECT_EQ(Bytes(iv), Bytes(kIV3));
879 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV3, /*enc=*/true));
880 }
881
882 {
883 // When decrypting, callers are expected to configure the fixed half and
884 // invocation half separately. The two will get stitched together into the
885 // final IV.
886 const uint8_t kIV[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
887
888 bssl::ScopedEVP_CIPHER_CTX ctx;
889 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
890 /*iv=*/nullptr));
891 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 4,
892 const_cast<uint8_t *>(kIV)));
893 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_IV_INV, 8,
894 const_cast<uint8_t *>(kIV + 4)));
895 // EVP_CTRL_GCM_SET_IV_INV is sufficient to configure the IV. There is no
896 // need to call EVP_CTRL_GCM_IV_GEN.
897 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV, /*enc=*/false));
898 }
899
900 {
901 // Stitching together a decryption IV that exceeds the standard IV length.
902 const uint8_t kIV[16] = {1, 2, 3, 4, 5, 6, 7, 8,
903 9, 10, 11, 12, 13, 14, 15, 16};
904
905 bssl::ScopedEVP_CIPHER_CTX ctx;
906 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
907 /*iv=*/nullptr));
908 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN,
909 sizeof(kIV), nullptr));
910
911 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 4,
912 const_cast<uint8_t *>(kIV)));
913 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_SET_IV_INV, 12,
914 const_cast<uint8_t *>(kIV + 4)));
915 // EVP_CTRL_GCM_SET_IV_INV is sufficient to configure the IV. There is no
916 // need to call EVP_CTRL_GCM_IV_GEN.
917 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), kIV, /*enc=*/false));
918 }
919
920 {
921 // Fixed IVs must be at least 4 bytes and admit at least an 8 byte counter.
922 const uint8_t kIV[16] = {1, 2, 3, 4, 5, 6, 7, 8,
923 9, 10, 11, 12, 13, 14, 15, 16};
924
925 bssl::ScopedEVP_CIPHER_CTX ctx;
926 ASSERT_TRUE(EVP_DecryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
927 /*iv=*/nullptr));
928
929 // This means the default IV length only allows a 4/8 split.
930 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 0,
931 const_cast<uint8_t *>(kIV)));
932 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 3,
933 const_cast<uint8_t *>(kIV)));
934 EXPECT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 4,
935 const_cast<uint8_t *>(kIV)));
936 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 5,
937 const_cast<uint8_t *>(kIV)));
938 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 16,
939 const_cast<uint8_t *>(kIV)));
940
941 // A longer IV allows a wider range.
942 ASSERT_TRUE(
943 EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN, 16, nullptr));
944 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 0,
945 const_cast<uint8_t *>(kIV)));
946 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 3,
947 const_cast<uint8_t *>(kIV)));
948 EXPECT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 4,
949 const_cast<uint8_t *>(kIV)));
950 EXPECT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 6,
951 const_cast<uint8_t *>(kIV)));
952 EXPECT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 8,
953 const_cast<uint8_t *>(kIV)));
954 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 9,
955 const_cast<uint8_t *>(kIV)));
956 EXPECT_FALSE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED, 16,
957 const_cast<uint8_t *>(kIV)));
958 }
959
960 {
961 // When encrypting, setting a fixed IV randomizes the counter portion.
962 const uint8_t kFixedIV[4] = {1, 2, 3, 4};
963 bssl::ScopedEVP_CIPHER_CTX ctx;
964 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
965 /*iv=*/nullptr));
966 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED,
967 sizeof(kFixedIV),
968 const_cast<uint8_t *>(kFixedIV)));
969 uint8_t counter[8];
970 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN,
971 sizeof(counter), counter));
972
973 uint8_t iv[12];
974 memcpy(iv, kFixedIV, sizeof(kFixedIV));
975 memcpy(iv + sizeof(kFixedIV), counter, sizeof(counter));
976 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), iv, /*enc=*/true));
977
978 // The counter continues to act as a counter.
979 uint8_t counter2[8];
980 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN,
981 sizeof(counter2), counter2));
982 EXPECT_EQ(CRYPTO_load_u64_be(counter2), CRYPTO_load_u64_be(counter) + 1);
983 memcpy(iv + sizeof(kFixedIV), counter2, sizeof(counter2));
984 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), iv, /*enc=*/true));
985 }
986
987 {
988 // Same as above, but with a larger IV.
989 const uint8_t kFixedIV[8] = {1, 2, 3, 4, 5, 6, 7, 8};
990 bssl::ScopedEVP_CIPHER_CTX ctx;
991 ASSERT_TRUE(EVP_EncryptInit_ex(ctx.get(), kCipher, /*impl=*/nullptr, kKey,
992 /*iv=*/nullptr));
993 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IVLEN,
994 sizeof(kFixedIV) + 8, nullptr));
995 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_AEAD_SET_IV_FIXED,
996 sizeof(kFixedIV),
997 const_cast<uint8_t *>(kFixedIV)));
998 uint8_t counter[8];
999 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN,
1000 sizeof(counter), counter));
1001
1002 uint8_t iv[16];
1003 memcpy(iv, kFixedIV, sizeof(kFixedIV));
1004 memcpy(iv + sizeof(kFixedIV), counter, sizeof(counter));
1005 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), iv, /*enc=*/true));
1006
1007 // The counter continues to act as a counter.
1008 uint8_t counter2[8];
1009 ASSERT_TRUE(EVP_CIPHER_CTX_ctrl(ctx.get(), EVP_CTRL_GCM_IV_GEN,
1010 sizeof(counter2), counter2));
1011 EXPECT_EQ(CRYPTO_load_u64_be(counter2), CRYPTO_load_u64_be(counter) + 1);
1012 memcpy(iv + sizeof(kFixedIV), counter2, sizeof(counter2));
1013 ASSERT_NO_FATAL_FAILURE(expect_iv(ctx.get(), iv, /*enc=*/true));
1014 }
1015 }
1016