1 /*
2 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <gtest/gtest.h>
11
12 #include <openssl/des.h>
13 #include <openssl/span.h>
14
15 #include "../../crypto/test/test_util.h"
16
17
18 // DES-CFB tests from OpenSSL. OpenSSL has no test vectors for 3DES-CFB at all.
19 // Instead, we repurpose those tests to cover 3DES-CFB by running the inputs
20 // through three times.
21 static const DES_cblock cfb_key = {
22 {0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef}};
23 static const DES_cblock cfb_iv = {
24 {0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, 0xef}};
25 static const uint8_t plain[24] = {
26 0x4e, 0x6f, 0x77, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x74,
27 0x69, 0x6d, 0x65, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x61, 0x6c, 0x6c, 0x20};
28 static const uint8_t cfb_cipher8[24] = {
29 0xf3, 0x1f, 0xda, 0x07, 0x01, 0x14, 0x62, 0xee, 0x18, 0x7f, 0x43, 0xd8,
30 0x0a, 0x7c, 0xd9, 0xb5, 0xb0, 0xd2, 0x90, 0xda, 0x6e, 0x5b, 0x9a, 0x87};
31 static const uint8_t cfb_cipher16[24] = {
32 0xf3, 0x09, 0x87, 0x87, 0x7f, 0x57, 0xf7, 0x3c, 0x36, 0xb6, 0xdb, 0x70,
33 0xd8, 0xd5, 0x34, 0x19, 0xd3, 0x86, 0xb2, 0x23, 0xb7, 0xb2, 0xad, 0x1b};
34 static const uint8_t cfb_cipher32[24] = {
35 0xf3, 0x09, 0x62, 0x49, 0xa4, 0xdf, 0xa4, 0x9f, 0x33, 0xdc, 0x7b, 0xad,
36 0x4c, 0xc8, 0x9f, 0x64, 0xe4, 0x53, 0xe5, 0xec, 0x67, 0x20, 0xda, 0xb6};
37 static const uint8_t cfb_cipher48[24] = {
38 0xf3, 0x09, 0x62, 0x49, 0xc7, 0xf4, 0x30, 0xb5, 0x15, 0xec, 0xbb, 0x85,
39 0x97, 0x5a, 0x13, 0x8c, 0x68, 0x60, 0xe2, 0x38, 0x34, 0x3c, 0xdc, 0x1f};
40 static const uint8_t cfb_cipher64[24] = {
41 0xf3, 0x09, 0x62, 0x49, 0xc7, 0xf4, 0x6e, 0x51, 0xa6, 0x9e, 0x83, 0x9b,
42 0x1a, 0x92, 0xf7, 0x84, 0x03, 0x46, 0x71, 0x33, 0x89, 0x8e, 0xa6, 0x22};
43
44 // Unlike the above test vectors, this test vector was computed by running the
45 // existing implementation and saving the output. OpenSSL lacks tests for this
46 // function, but also implements an incorrect construction in its low-level
47 // APIs. As a result, importing a standard test vector would only test 1/8 of
48 // the output. See discussion in the test.
49 static const uint8_t cfb_cipher1[24] = {
50 0xf3, 0x27, 0xff, 0x2d, 0x80, 0xee, 0x12, 0xbe, 0xb6, 0x74, 0xa3, 0xb4,
51 0xd6, 0xfb, 0x5d, 0x0d, 0x49, 0x18, 0x84, 0xed, 0xfe, 0xca, 0x17, 0x5f};
52
TEST(DESTest,CFB)53 TEST(DESTest, CFB) {
54 DES_key_schedule ks;
55 DES_set_key(&cfb_key, &ks);
56
57 struct {
58 int numbits;
59 const uint8_t (&ciphertext)[24];
60 } kTests[] = {
61 {1, cfb_cipher1}, {8, cfb_cipher8}, {16, cfb_cipher16},
62 {32, cfb_cipher32}, {48, cfb_cipher48}, {64, cfb_cipher64},
63 };
64 for (const auto &t : kTests) {
65 SCOPED_TRACE(t.numbits);
66
67 // |DES_ede3_cfb_encrypt| only supports streaming at segment boundaries.
68 // Segments, however, are measured in bits, not bytes. When the segment is
69 // not a whole number of bytes, OpenSSL's low-level functions do not
70 // implement CFB correctly. CFB-n ultimately computes a sequence of E(I_i)
71 // blocks, extracts n bits from each block to XOR into the next n bits of
72 // plaintext. OpenSSL computes the correct sequence of blocks, but then
73 // rounds n up to a byte boundary when consuming input.
74 //
75 // It essentially interprets CFB-1 as a funny CFB-8, with the wrong amount
76 // of cipher feedback. To get the real CFB-1 out of OpenSSL's CFB-1, you put
77 // each plaintext bit as into its byte, with bit at the MSB, then mask off
78 // all but the MSB of each ciphertext byte. OpenSSL's |EVP_des_ede3_cfb1|
79 // does this transformation internally, to work around this bug.
80 //
81 // In case anyone is relying on the remaining bits, we test all the output
82 // bits of the OpenSSL version. However, for such callers, it is unclear if
83 // this version has been sufficiently analyzed.
84 size_t offset = (t.numbits + 7) / 8;
85 for (size_t split = 0; split < sizeof(plain); split += offset) {
86 SCOPED_TRACE(split);
87 uint8_t out[sizeof(plain)];
88 DES_cblock iv = cfb_iv;
89 DES_ede3_cfb_encrypt(plain, out, t.numbits, split, &ks, &ks, &ks, &iv,
90 DES_ENCRYPT);
91 DES_ede3_cfb_encrypt(plain + split, out + split, t.numbits,
92 sizeof(plain) - split, &ks, &ks, &ks, &iv,
93 DES_ENCRYPT);
94 EXPECT_EQ(Bytes(out), Bytes(t.ciphertext));
95
96 iv = cfb_iv;
97 DES_ede3_cfb_encrypt(t.ciphertext, out, t.numbits, split, &ks, &ks, &ks,
98 &iv, DES_DECRYPT);
99 DES_ede3_cfb_encrypt(t.ciphertext + split, out + split, t.numbits,
100 sizeof(plain) - split, &ks, &ks, &ks, &iv,
101 DES_DECRYPT);
102 EXPECT_EQ(Bytes(out), Bytes(plain));
103 }
104 }
105 }
106
TEST(DESTest,CFB64)107 TEST(DESTest, CFB64) {
108 DES_key_schedule ks;
109 DES_set_key(&cfb_key, &ks);
110
111 // Unlike the generic CFB API, the CFB64 API can be split within a block
112 // boundary.
113 for (size_t split = 0; split <= sizeof(plain); split++) {
114 SCOPED_TRACE(split);
115 uint8_t out[sizeof(plain)];
116 DES_cblock iv = cfb_iv;
117 int n = 0;
118 DES_ede3_cfb64_encrypt(plain, out, split, &ks, &ks, &ks, &iv, &n,
119 DES_ENCRYPT);
120 DES_ede3_cfb64_encrypt(plain + split, out + split, sizeof(plain) - split,
121 &ks, &ks, &ks, &iv, &n, DES_ENCRYPT);
122 EXPECT_EQ(Bytes(out), Bytes(cfb_cipher64));
123
124 n = 0;
125 iv = cfb_iv;
126 DES_ede3_cfb64_encrypt(cfb_cipher64, out, split, &ks, &ks, &ks, &iv, &n,
127 DES_DECRYPT);
128 DES_ede3_cfb64_encrypt(cfb_cipher64 + split, out + split,
129 sizeof(cfb_cipher64) - split, &ks, &ks, &ks, &iv, &n,
130 DES_DECRYPT);
131 EXPECT_EQ(Bytes(out), Bytes(plain));
132 }
133 }
134