src/encrypt/tests.rs

// Copyright 2021 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////

use super::*;
use crate::{
    cbor::value::Value, iana, util::expect_err, CborSerializable, ContentType, CoseKeyBuilder,
    CoseRecipientBuilder, CoseSignatureBuilder, HeaderBuilder, TaggedCborSerializable,
};
use alloc::{
    string::{String, ToString},
    vec,
    vec::Vec,
};

#[test]
fn test_cose_recipient_decode() {
    let tests: Vec<(CoseRecipient, &'static str)> = vec![
        (
            CoseRecipientBuilder::new().build(),
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "f6", // null
            ),
        ),
        (
            CoseRecipientBuilder::new().ciphertext(vec![]).build(),
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
            ),
        ),
        (
            CoseRecipientBuilder::new()
                .ciphertext(vec![])
                .add_recipient(CoseRecipientBuilder::new().build())
                .build(),
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
                "81", // 1-tuple
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "f6", // null
            ),
        ),
    ];

    for (i, (recipient, recipient_data)) in tests.iter().enumerate() {
        let got = recipient.clone().to_vec().unwrap();
        assert_eq!(*recipient_data, hex::encode(&got), "case {}", i);

        let mut got = CoseRecipient::from_slice(&got).unwrap();
        got.protected.original_data = None;
        for recip in &mut got.recipients {
            recip.protected.original_data = None;
        }
        assert_eq!(*recipient, got);
    }
}

#[test]
fn test_cose_recipient_decode_fail() {
    let tests = [
        (
            concat!(
                "a2",   // 2-map (should be tuple)
                "40",   // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0",   // 0-map
                "4161", // 1-bstr
                "40",   // 0-bstr
            ),
            "expected array",
        ),
        (
            concat!(
                "82", // 2-tuple (should be 4-tuple)
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
            ),
            "expected array with 3 or 4 items",
        ),
        (
            concat!(
                "84", // 4-tuple
                "80", // 0-tuple (should be bstr)
                "a0", // 0-map
                "40", // 0-bstr
                "80", // 0-arr
            ),
            "expected bstr",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "40", // 0-bstr (should be map)
                "40", // 0-bstr
                "80", // 0-arr
            ),
            "expected map",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "60", // 0-tstr (should be bstr)
                "80", // 0-arr
            ),
            "expected bstr",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
                "40", // 0-bstr
            ),
            "expected array",
        ),
    ];
    for (recipient_data, err_msg) in tests.iter() {
        let data = hex::decode(recipient_data).unwrap();
        let result = CoseRecipient::from_slice(&data);
        expect_err(result, err_msg);
    }
}

#[test]
fn test_cose_encrypt_decode() {
    let tests: Vec<(CoseEncrypt, &'static str)> = vec![
        (
            CoseEncryptBuilder::new().build(),
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "f6", // null
                "80", // 0-tuple
            ),
        ),
        (
            CoseEncryptBuilder::new().ciphertext(vec![]).build(),
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
                "80", // 0-tuple
            ),
        ),
    ];

    for (i, (encrypt, encrypt_data)) in tests.iter().enumerate() {
        let got = encrypt.clone().to_vec().unwrap();
        assert_eq!(*encrypt_data, hex::encode(&got), "case {}", i);

        let mut got = CoseEncrypt::from_slice(&got).unwrap();
        got.protected.original_data = None;
        assert_eq!(*encrypt, got);
    }
}

#[test]
fn test_cose_encrypt_decode_fail() {
    let tests = [
        (
            concat!(
                "a2",   // 2-map (should be tuple)
                "40",   // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0",   // 0-map
                "4161", // 1-bstr
                "40",   // 0-bstr
            ),
            "expected array",
        ),
        (
            concat!(
                "83", // 3-tuple (should be 4-tuple)
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
            ),
            "expected array with 4 items",
        ),
        (
            concat!(
                "84", // 4-tuple
                "80", // 0-tuple (should be bstr)
                "a0", // 0-map
                "40", // 0-bstr
                "80", // 0-arr
            ),
            "expected bstr",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "40", // 0-bstr (should be map)
                "40", // 0-bstr
                "80", // 0-arr
            ),
            "expected map",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "60", // 0-tstr (should be bstr)
                "80", // 0-arr
            ),
            "expected bstr",
        ),
        (
            concat!(
                "84", // 4-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
                "40", // 0-bstr
            ),
            "expected array",
        ),
    ];
    for (encrypt_data, err_msg) in tests.iter() {
        let data = hex::decode(encrypt_data).unwrap();
        let result = CoseEncrypt::from_slice(&data);
        expect_err(result, err_msg);
    }
}
#[test]
fn test_rfc8152_cose_encrypt_decode() {
    // COSE_Encrypt structures from RFC 8152 section C.3.
    let tests: Vec<(CoseEncrypt, &'static str)> = vec![
        (
            CoseEncryptBuilder::new()
                .protected(
                    HeaderBuilder::new()
                        .algorithm(iana::Algorithm::A128GCM)
                        .build(),
                )
                .unprotected(
                    HeaderBuilder::new()
                        .iv(hex::decode("c9cf4df2fe6c632bf7886413").unwrap())
                        .build(),
                )
                .ciphertext(
                    hex::decode(
                        "7adbe2709ca818fb415f1e5df66f4e1a51053ba6d65a1a0c52a357da7a644b8070a151b0",
                    )
                    .unwrap(),
                )
                .add_recipient(
                    CoseRecipientBuilder::new()
                        .protected(
                            HeaderBuilder::new()
                                .algorithm(iana::Algorithm::ECDH_ES_HKDF_256)
                                .build(),
                        )
                        .unprotected(
                            HeaderBuilder::new()
                                .value(iana::HeaderAlgorithmParameter::EphemeralKey as i64,
                                       CoseKeyBuilder::new_ec2_pub_key_y_sign(iana::EllipticCurve::P_256,
                                                                              hex::decode("98f50a4ff6c05861c8860d13a638ea56c3f5ad7590bbfbf054e1c7b4d91d6280").unwrap(),
                                                                              true)
                                       .build().to_cbor_value().unwrap())
                                .key_id(b"[email protected]".to_vec())
                                .build(),
                        )
                        .ciphertext(vec![])
                        .build(),
                )
                .build(),
            // Note: contents of maps have been re-ordered from the RFC to canonical ordering.
            concat!(
                "d860",
                "84", "43", "a10101",
                "a1", "05", "4c", "c9cf4df2fe6c632bf7886413",
                "5824", "7adbe2709ca818fb415f1e5df66f4e1a51053ba6d65a1a0c52a357da7a644b8070a151b0",
                "81",
                "83",
                "44", "a1013818",
                "a2",
                "04",
                "5824", "6d65726961646f632e6272616e64796275636b406275636b6c616e642e6578616d706c65",
                "20",
                "a4",
                "01", "02",
                "20", "01",
                "21", "5820", "98f50a4ff6c05861c8860d13a638ea56c3f5ad7590bbfbf054e1c7b4d91d6280",
                "22", "f5",
                "40",
            ),
        ),
        (
            CoseEncryptBuilder::new()
                .protected(HeaderBuilder::new().algorithm(iana::Algorithm::AES_CCM_16_64_128).build())
                .unprotected(HeaderBuilder::new().iv(hex::decode("89f52f65a1c580933b5261a76c").unwrap()).build())
                .ciphertext(hex::decode("753548a19b1307084ca7b2056924ed95f2e3b17006dfe931b687b847").unwrap())
                .add_recipient(CoseRecipientBuilder::new()
                               .protected(HeaderBuilder::new().algorithm(iana::Algorithm::Direct_HKDF_SHA_256).build())
                               .unprotected(
                                   HeaderBuilder::new()
                                       .key_id(b"our-secret".to_vec())
                                       .value(iana::HeaderAlgorithmParameter::Salt as i64,
                                              Value::Bytes(b"aabbccddeeffgghh".to_vec()))
                                       .build())
                               .ciphertext(vec![])
                               .build())
                .build(),
            // Note: contents of maps have been re-ordered from the RFC to canonical ordering.
            concat!(
                "d860",
                "84",
                "43",
                "a1010a",
                "a1",
                "05",
                "4d", "89f52f65a1c580933b5261a76c",
                "581c", "753548a19b1307084ca7b2056924ed95f2e3b17006dfe931b687b847",
                "81",
                "83",
                "43",
                "a10129",
                "a2",
                "04", "4a", "6f75722d736563726574",
                "33", "50", "61616262636364646565666667676868",
                "40",
            ),
        ),

        (
            CoseEncryptBuilder::new()
                .protected(HeaderBuilder::new().algorithm(iana::Algorithm::A128GCM).build())
                .unprotected(HeaderBuilder::new()
                             .iv(hex::decode("c9cf4df2fe6c632bf7886413").unwrap())
                             .add_counter_signature(CoseSignatureBuilder::new()
                                                    .protected(HeaderBuilder::new().algorithm(iana::Algorithm::ES512).build())
                                                    .unprotected(HeaderBuilder::new().key_id(b"[email protected]".to_vec()).build())
                                                    .signature(hex::decode("00929663c8789bb28177ae28467e66377da12302d7f9594d2999afa5dfa531294f8896f2b6cdf1740014f4c7f1a358e3a6cf57f4ed6fb02fcf8f7aa989f5dfd07f0700a3a7d8f3c604ba70fa9411bd10c2591b483e1d2c31de003183e434d8fba18f17a4c7e3dfa003ac1cf3d30d44d2533c4989d3ac38c38b71481cc3430c9d65e7ddff").unwrap())
                                                    .build())
                             .build())
                .ciphertext(hex::decode("7adbe2709ca818fb415f1e5df66f4e1a51053ba6d65a1a0c52a357da7a644b8070a151b0").unwrap())
                .add_recipient(CoseRecipientBuilder::new()
                               .protected(
                                   HeaderBuilder::new()
                                       .algorithm(iana::Algorithm::ECDH_ES_HKDF_256)
                                       .build())
                               .unprotected(
                                   HeaderBuilder::new()
                                       .value(iana::HeaderAlgorithmParameter::EphemeralKey as i64,
                                              CoseKeyBuilder::new_ec2_pub_key_y_sign(iana::EllipticCurve::P_256,
                                                                                     hex::decode("98f50a4ff6c05861c8860d13a638ea56c3f5ad7590bbfbf054e1c7b4d91d6280").unwrap(),
                                                                                     true)
                                              .build().to_cbor_value().unwrap())
                                       .key_id(b"[email protected]".to_vec())
                                       .build())
                        .ciphertext(vec![])
                               .build())
                .build(),
            // Note: contents of maps have been re-ordered from the RFC to canonical ordering.
            concat!(
                "d860",
                "84",
                "43",
                "a10101",
                "a2",
                "05",
                "4c", "c9cf4df2fe6c632bf7886413",
                "07",
                "83",
                "44",
                "a1013823",
                "a1",
                "04",
                "581e", "62696c626f2e62616767696e7340686f626269746f6e2e6578616d706c65",
                "5884",
                "00929663c8789bb28177ae28467e66377da12302d7f9594d2999afa5dfa531294f8896f2b6cdf1740014f4c7f1a358e3a6cf57f4ed6fb02fcf8f7aa989f5dfd07f0700a3a7d8f3c604ba70fa9411bd10c2591b483e1d2c31de003183e434d8fba18f17a4c7e3dfa003ac1cf3d30d44d2533c4989d3ac38c38b71481cc3430c9d65e7ddff",
                "5824",
                "7adbe2709ca818fb415f1e5df66f4e1a51053ba6d65a1a0c52a357da7a644b8070a151b0",
                "81",
                "83",
                "44", "a1013818",
                "a2",
                "04",
                "5824", "6d65726961646f632e6272616e64796275636b406275636b6c616e642e6578616d706c65",
                "20",
                "a4",
                "01",
                "02",
                "20",
                "01",
                "21",
                "5820", "98f50a4ff6c05861c8860d13a638ea56c3f5ad7590bbfbf054e1c7b4d91d6280",
                "22",
                "f5",
                "40",
            ),
        ),
        (
            CoseEncryptBuilder::new()
                .protected(HeaderBuilder::new().algorithm(iana::Algorithm::A128GCM).build())
                .unprotected(HeaderBuilder::new().iv(hex::decode("02d1f7e6f26c43d4868d87ce").unwrap()).build())
                .ciphertext(hex::decode("64f84d913ba60a76070a9a48f26e97e863e28529d8f5335e5f0165eee976b4a5f6c6f09d").unwrap())
                .add_recipient(CoseRecipientBuilder::new()
                               .protected(HeaderBuilder::new().algorithm(iana::Algorithm::ECDH_SS_A128KW).build())
                               .unprotected(HeaderBuilder::new()
                                            .key_id(b"[email protected]".to_vec())
                                            .value(
                                                iana::HeaderAlgorithmParameter::StaticKeyId as i64,
                                                Value::Bytes(b"[email protected]".to_vec())
                                            )
                                            .value(
                                                iana::HeaderAlgorithmParameter::PartyUNonce as i64,
                                                Value::Bytes(hex::decode("0101").unwrap())
                                            )
                                            .build())
                               .ciphertext(hex::decode("41e0d76f579dbd0d936a662d54d8582037de2e366fde1c62").unwrap())
                               .build())
                .build(),
            // Note: contents of maps have been re-ordered from the RFC to canonical ordering.
            concat!(
                "d860",
                "84",
                "43",
                "a10101",
                "a1",
                "05",
                "4c", "02d1f7e6f26c43d4868d87ce",
                "5824", "64f84d913ba60a76070a9a48f26e97e863e28529d8f5335e5f0165eee976b4a5f6c6f09d",
                "81",
                "83",
                "44", "a101381f",
                "a3",
                "04",
                "5824", "6d65726961646f632e6272616e64796275636b406275636b6c616e642e6578616d706c65",
                "22",
                "5821", "706572656772696e2e746f6f6b407475636b626f726f7567682e6578616d706c65",
                "35",
                "42",
                "0101",
                "5818", "41e0d76f579dbd0d936a662d54d8582037de2e366fde1c62",
            ),
        ),
    ];

    for (i, (encrypt, encrypt_data)) in tests.iter().enumerate() {
        let got = encrypt.clone().to_tagged_vec().unwrap();
        assert_eq!(*encrypt_data, hex::encode(&got), "case {}", i);

        let mut got = CoseEncrypt::from_tagged_slice(&got).unwrap();
        got.protected.original_data = None;
        for recip in &mut got.recipients {
            recip.protected.original_data = None;
        }
        for sig in &mut got.unprotected.counter_signatures {
            sig.protected.original_data = None;
        }
        assert_eq!(*encrypt, got);
    }
}

#[test]
fn test_cose_encrypt0_decode() {
    let tests: Vec<(CoseEncrypt0, &'static str)> = vec![
        (
            CoseEncrypt0Builder::new().build(),
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "f6", // null
            ),
        ),
        (
            CoseEncrypt0Builder::new().ciphertext(vec![]).build(),
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "40", // 0-bstr
            ),
        ),
    ];

    for (i, (encrypt, encrypt_data)) in tests.iter().enumerate() {
        let got = encrypt.clone().to_vec().unwrap();
        assert_eq!(*encrypt_data, hex::encode(&got), "case {}", i);

        let mut got = CoseEncrypt0::from_slice(&got).unwrap();
        got.protected.original_data = None;
        assert_eq!(*encrypt, got);
    }
}

#[test]
fn test_cose_encrypt0_decode_fail() {
    let tests = [
        (
            concat!(
                "a2",   // 2-map (should be tuple)
                "40",   // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0",   // 0-map
                "4100", // 1-bstr
                "40",   // 0-bstr
            ),
            "expected array",
        ),
        (
            concat!(
                "82", // 2-tuple (should be 3-tuple)
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
            ),
            "expected array with 3 items",
        ),
        (
            concat!(
                "83", // 3-tuple
                "80", // 0-tuple (should be bstr)
                "a0", // 0-map
                "40", // 0-bstr
            ),
            "expected bstr",
        ),
        (
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "40", // 0-bstr (should be map)
                "40", // 0-bstr
            ),
            "expected map",
        ),
        (
            concat!(
                "83", // 3-tuple
                "40", // 0-bstr (special case for empty protected headers, rather than 41a0)
                "a0", // 0-map
                "60", // 0-tstr (should be bstr)
            ),
            "expected bstr",
        ),
    ];
    for (encrypt_data, err_msg) in tests.iter() {
        let data = hex::decode(encrypt_data).unwrap();
        let result = CoseEncrypt0::from_slice(&data);
        expect_err(result, err_msg);
    }
}

#[test]
fn test_rfc8152_cose_encrypt0_decode() {
    // COSE_Encrypt0 structures from RFC 8152 section C.4.
    let tests: Vec<(CoseEncrypt0, &'static str)> = vec![
        (
            CoseEncrypt0Builder::new()
                .protected(
                    HeaderBuilder::new()
                        .algorithm(iana::Algorithm::AES_CCM_16_64_128)
                        .build(),
                )
                .unprotected(
                    HeaderBuilder::new()
                        .iv(hex::decode("89f52f65a1c580933b5261a78c").unwrap())
                        .build(),
                )
                .ciphertext(
                    hex::decode("5974e1b99a3a4cc09a659aa2e9e7fff161d38ce71cb45ce460ffb569")
                        .unwrap(),
                )
                .build(),
            concat!(
                "d0",
                "83",
                "43",
                "a1010a",
                "a1",
                "05",
                "4d",
                "89f52f65a1c580933b5261a78c",
                "581c",
                "5974e1b99a3a4cc09a659aa2e9e7fff161d38ce71cb45ce460ffb569",
            ),
        ),
        (
            CoseEncrypt0Builder::new()
                .protected(
                    HeaderBuilder::new()
                        .algorithm(iana::Algorithm::AES_CCM_16_64_128)
                        .build(),
                )
                .unprotected(
                    HeaderBuilder::new()
                        .partial_iv(hex::decode("61a7").unwrap())
                        .build(),
                )
                .ciphertext(
                    hex::decode("252a8911d465c125b6764739700f0141ed09192de139e053bd09abca")
                        .unwrap(),
                )
                .build(),
            concat!(
                "d0",
                "83",
                "43",
                "a1010a",
                "a1",
                "06",
                "42",
                "61a7",
                "581c",
                "252a8911d465c125b6764739700f0141ed09192de139e053bd09abca",
            ),
        ),
    ];

    for (i, (encrypt, encrypt_data)) in tests.iter().enumerate() {
        let got = encrypt.clone().to_tagged_vec().unwrap();
        assert_eq!(*encrypt_data, hex::encode(&got), "case {}", i);

        let mut got = CoseEncrypt0::from_tagged_slice(&got).unwrap();
        got.protected.original_data = None;
        assert_eq!(*encrypt, got);
    }
}

struct FakeCipher {}

impl FakeCipher {
    fn encrypt(&self, plaintext: &[u8], additional_data: &[u8]) -> Result<Vec<u8>, String> {
        let mut result = vec![];
        result.extend_from_slice(&(plaintext.len() as u32).to_be_bytes());
        result.extend_from_slice(plaintext);
        result.extend_from_slice(additional_data);
        Ok(result)
    }

    fn decrypt(&self, ciphertext: &[u8], additional_data: &[u8]) -> Result<Vec<u8>, String> {
        if ciphertext.len() < 4 {
            return Err("not long enough".to_owned());
        }
        let pt_len =
            u32::from_be_bytes([ciphertext[0], ciphertext[1], ciphertext[2], ciphertext[3]])
                as usize;
        let pt = &ciphertext[4..4 + pt_len];
        let recovered_aad = &ciphertext[4 + pt_len..];
        if recovered_aad != additional_data {
            return Err("aad doesn't match".to_owned());
        }
        Ok(pt.to_vec())
    }
    fn fail_encrypt(&self, _plaintext: &[u8], _additional_data: &[u8]) -> Result<Vec<u8>, String> {
        Err("failed".to_string())
    }
}

#[test]
fn test_cose_recipient_roundtrip() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    for context in &[
        EncryptionContext::EncRecipient,
        EncryptionContext::MacRecipient,
        EncryptionContext::RecRecipient,
    ] {
        let protected = HeaderBuilder::new()
            .algorithm(iana::Algorithm::ES256)
            .key_id(b"11".to_vec())
            .build();

        let mut recipient = CoseRecipientBuilder::new()
            .protected(protected)
            .create_ciphertext(*context, pt, external_aad, |pt, aad| {
                cipher.encrypt(pt, aad).unwrap()
            })
            .build();

        let recovered_pt = recipient
            .decrypt(*context, external_aad, |ct, aad| cipher.decrypt(ct, aad))
            .unwrap();
        assert_eq!(&pt[..], recovered_pt);

        // Changing an unprotected header leaves the ciphertext decipherable.
        recipient.unprotected.content_type = Some(ContentType::Text("text/plain".to_owned()));
        assert!(recipient
            .decrypt(*context, external_aad, |ct, aad| {
                cipher.decrypt(ct, aad)
            })
            .is_ok());

        // Providing a different `aad` means the ciphertext won't validate.
        assert!(recipient
            .decrypt(*context, b"not aad", |ct, aad| { cipher.decrypt(ct, aad) })
            .is_err());

        // Changing a protected header invalidates the ciphertext.
        recipient.protected = ProtectedHeader::default();
        assert!(recipient
            .decrypt(*context, external_aad, |ct, aad| {
                cipher.decrypt(ct, aad)
            })
            .is_err());
    }
}

#[test]
fn test_cose_recipient_noncanonical() {
    let pt = b"aa";
    let aad = b"bb";
    let cipher = FakeCipher {};
    let context = EncryptionContext::EncRecipient;

    // Build an empty protected header from a non-canonical input of 41a0 rather than 40.
    let protected = ProtectedHeader::from_cbor_bstr(Value::Bytes(vec![0xa0])).unwrap();
    assert_eq!(protected.header, Header::default());
    assert_eq!(protected.original_data, Some(vec![0xa0]));

    let mut recipient = CoseRecipient {
        protected: protected.clone(),
        ..Default::default()
    };
    let internal_aad = crate::encrypt::enc_structure_data(context, protected, aad);
    recipient.ciphertext = Some(cipher.encrypt(pt, &internal_aad).unwrap());

    // Deciphering the ciphertext should still succeed, because the `ProtectedHeader`
    // includes the wire data and uses it for building the decryption input.
    let recovered_pt = recipient
        .decrypt(context, aad, |ct, aad| cipher.decrypt(ct, aad))
        .unwrap();
    assert_eq!(&pt[..], recovered_pt);

    // However, if we attempt to build the same decryption inputs by hand (thus not including the
    // non-canonical wire data)...
    let recreated_recipient = CoseRecipientBuilder::new()
        .ciphertext(recipient.ciphertext.unwrap())
        .build();

    // ...then the transplanted cipher text will not decipher, because the re-building of the
    // inputs will use the canonical encoding of the protected header, which is not what was
    // originally used for the input.
    assert!(recreated_recipient
        .decrypt(context, aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_err());
}

#[test]
fn test_cose_recipient_result() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let protected = HeaderBuilder::new()
        .algorithm(iana::Algorithm::ES256)
        .key_id(b"11".to_vec())
        .build();
    let _recipient = CoseRecipientBuilder::new()
        .protected(protected.clone())
        .try_create_ciphertext(
            EncryptionContext::EncRecipient,
            pt,
            external_aad,
            |pt, aad| cipher.encrypt(pt, aad),
        )
        .unwrap()
        .build();
    let status = CoseRecipientBuilder::new()
        .protected(protected)
        .try_create_ciphertext(
            EncryptionContext::EncRecipient,
            pt,
            external_aad,
            |pt, aad| cipher.fail_encrypt(pt, aad),
        );
    expect_err(status, "failed");
}

#[test]
#[should_panic]
fn test_cose_recipient_missing_ciphertext() {
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let recipient = CoseRecipient::default();

    // No ciphertext has been set, do decryption will panic.
    let _result = recipient.decrypt(EncryptionContext::EncRecipient, external_aad, |ct, aad| {
        cipher.decrypt(ct, aad)
    });
}

#[test]
#[should_panic]
fn test_cose_recipient_builder_invalid_context() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    // Can't use a non-recipient context.
    let _recipient = CoseRecipientBuilder::new()
        .create_ciphertext(
            EncryptionContext::CoseEncrypt,
            pt,
            external_aad,
            |pt, aad| cipher.encrypt(pt, aad).unwrap(),
        )
        .build();
}

#[test]
#[should_panic]
fn test_cose_recipient_decrypt_invalid_context() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let recipient = CoseRecipientBuilder::new()
        .create_ciphertext(
            EncryptionContext::EncRecipient,
            pt,
            external_aad,
            |pt, aad| cipher.encrypt(pt, aad).unwrap(),
        )
        .build();

    // Can't use a non-recipient context.
    let _result = recipient.decrypt(EncryptionContext::CoseEncrypt, external_aad, |ct, aad| {
        cipher.decrypt(ct, aad)
    });
}

#[test]
fn test_cose_encrypt_roundtrip() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let protected = HeaderBuilder::new()
        .algorithm(iana::Algorithm::ES256)
        .key_id(b"11".to_vec())
        .build();
    let mut encrypt = CoseEncryptBuilder::new()
        .protected(protected)
        .create_ciphertext(pt, external_aad, |pt, aad| cipher.encrypt(pt, aad).unwrap())
        .build();

    let recovered_pt = encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .unwrap();
    assert_eq!(&pt[..], recovered_pt);

    // Changing an unprotected header leaves the ciphertext decipherable.
    encrypt.unprotected.content_type = Some(ContentType::Text("text/plain".to_owned()));
    assert!(encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_ok());

    // Providing a different `aad` means the signature won't validate.
    assert!(encrypt
        .decrypt(b"not aad", |ct, aad| cipher.decrypt(ct, aad))
        .is_err());

    // Changing a protected header invalidates the ciphertext.
    encrypt.protected = ProtectedHeader::default();
    assert!(encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_err());
}

#[test]
fn test_cose_encrypt_noncanonical() {
    let pt = b"aa";
    let external_aad = b"bb";
    let cipher = FakeCipher {};

    // Build an empty protected header from a non-canonical input of 41a0 rather than 40.
    let protected = ProtectedHeader::from_cbor_bstr(Value::Bytes(vec![0xa0])).unwrap();
    assert_eq!(protected.header, Header::default());
    assert_eq!(protected.original_data, Some(vec![0xa0]));

    let mut encrypt = CoseEncrypt {
        protected: protected.clone(),
        ..Default::default()
    };
    let aad = enc_structure_data(
        EncryptionContext::CoseEncrypt,
        protected.clone(),
        external_aad,
    );
    encrypt.ciphertext = Some(cipher.encrypt(pt, &aad).unwrap());

    // Deciphering the ciphertext should still succeed, because the `ProtectedHeader`
    // includes the wire data and uses it for building the decryption input.
    let recovered_pt = encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .unwrap();
    assert_eq!(&pt[..], recovered_pt);

    // However, if we attempt to build the same decryption inputs by hand (thus not including the
    // non-canonical wire data)...
    let recreated_encrypt = CoseEncryptBuilder::new()
        .protected(protected.header)
        .ciphertext(encrypt.ciphertext.unwrap())
        .build();

    // ...then the transplanted cipher text will not decipher, because the re-building of the
    // inputs will use the canonical encoding of the protected header, which is not what was
    // originally used for the input.
    assert!(recreated_encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_err());
}

#[test]
fn test_cose_encrypt_status() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let protected = HeaderBuilder::new()
        .algorithm(iana::Algorithm::ES256)
        .key_id(b"11".to_vec())
        .build();
    let _encrypt = CoseEncryptBuilder::new()
        .protected(protected.clone())
        .try_create_ciphertext(pt, external_aad, |pt, aad| cipher.encrypt(pt, aad))
        .unwrap()
        .build();
    let status = CoseEncryptBuilder::new()
        .protected(protected)
        .try_create_ciphertext(pt, external_aad, |pt, aad| cipher.fail_encrypt(pt, aad));
    expect_err(status, "failed");
}

#[test]
#[should_panic]
fn test_cose_encrypt_missing_ciphertext() {
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let encrypt = CoseEncrypt::default();

    // No ciphertext has been set, do decryption will panic.
    let _result = encrypt.decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad));
}

#[test]
fn test_cose_encrypt0_roundtrip() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let protected = HeaderBuilder::new()
        .algorithm(iana::Algorithm::ES256)
        .key_id(b"11".to_vec())
        .build();
    let mut encrypt = CoseEncrypt0Builder::new()
        .protected(protected)
        .create_ciphertext(pt, external_aad, |pt, aad| cipher.encrypt(pt, aad).unwrap())
        .build();

    let recovered_pt = encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .unwrap();
    assert_eq!(&pt[..], recovered_pt);

    // Changing an unprotected header leaves the ciphertext decipherable.
    encrypt.unprotected.content_type = Some(ContentType::Text("text/plain".to_owned()));
    assert!(encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_ok());

    // Providing a different `aad` means the ciphertext won't decrypt.
    assert!(encrypt
        .decrypt(b"not aad", |ct, aad| cipher.decrypt(ct, aad))
        .is_err());

    // Changing a protected header invalidates the ciphertext.
    encrypt.protected = ProtectedHeader::default();
    assert!(encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_err());
}

#[test]
fn test_cose_encrypt0_noncanonical() {
    let pt = b"aa";
    let external_aad = b"bb";
    let cipher = FakeCipher {};

    // Build an empty protected header from a non-canonical input of 41a0 rather than 40.
    let protected = ProtectedHeader::from_cbor_bstr(Value::Bytes(vec![0xa0])).unwrap();
    assert_eq!(protected.header, Header::default());
    assert_eq!(protected.original_data, Some(vec![0xa0]));

    let mut encrypt = CoseEncrypt0 {
        protected: protected.clone(),
        ..Default::default()
    };
    let aad = enc_structure_data(
        EncryptionContext::CoseEncrypt0,
        protected.clone(),
        external_aad,
    );
    encrypt.ciphertext = Some(cipher.encrypt(pt, &aad).unwrap());

    // Deciphering the ciphertext should still succeed, because the `ProtectedHeader`
    // includes the wire data and uses it for building the decryption input.
    let recovered_pt = encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .unwrap();
    assert_eq!(&pt[..], recovered_pt);

    // However, if we attempt to build the same decryption inputs by hand (thus not including the
    // non-canonical wire data)...
    let recreated_encrypt = CoseEncrypt0Builder::new()
        .protected(protected.header)
        .ciphertext(encrypt.ciphertext.unwrap())
        .build();

    // ...then the transplanted cipher text will not decipher, because the re-building of the
    // inputs will use the canonical encoding of the protected header, which is not what was
    // originally used for the input.
    assert!(recreated_encrypt
        .decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad))
        .is_err());
}
#[test]
fn test_cose_encrypt0_status() {
    let pt = b"This is the plaintext";
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let protected = HeaderBuilder::new()
        .algorithm(iana::Algorithm::ES256)
        .key_id(b"11".to_vec())
        .build();
    let _encrypt = CoseEncrypt0Builder::new()
        .protected(protected.clone())
        .try_create_ciphertext(pt, external_aad, |pt, aad| cipher.encrypt(pt, aad))
        .unwrap()
        .build();
    let status = CoseEncrypt0Builder::new()
        .protected(protected)
        .try_create_ciphertext(pt, external_aad, |pt, aad| cipher.fail_encrypt(pt, aad));
    expect_err(status, "failed");
}

#[test]
#[should_panic]
fn test_cose_encrypt0_missing_ciphertext() {
    let external_aad = b"This is the external aad";
    let cipher = FakeCipher {};

    let encrypt = CoseEncrypt0::default();

    // No ciphertext has been set, do decryption will panic.
    let _result = encrypt.decrypt(external_aad, |ct, aad| cipher.decrypt(ct, aad));
}