1 // Copyright 2021 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ///////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/hybrid/hpke_config.h"
18
19 #include <list>
20 #include <string>
21 #include <utility>
22
23 #include "gmock/gmock.h"
24 #include "gtest/gtest.h"
25 #include "absl/status/status.h"
26 #include "tink/config/tink_fips.h"
27 #include "tink/hybrid/hybrid_key_templates.h"
28 #include "tink/hybrid/internal/hpke_private_key_manager.h"
29 #include "tink/hybrid/internal/hpke_public_key_manager.h"
30 #include "tink/hybrid_decrypt.h"
31 #include "tink/hybrid_encrypt.h"
32 #include "tink/keyset_handle.h"
33 #include "tink/registry.h"
34 #include "tink/util/status.h"
35 #include "tink/util/test_matchers.h"
36 #include "tink/util/test_util.h"
37
38 namespace crypto {
39 namespace tink {
40 namespace {
41
42 using ::crypto::tink::test::IsOk;
43 using ::crypto::tink::test::StatusIs;
44
45 class HpkeConfigTest : public ::testing::Test {
46 protected:
SetUp()47 void SetUp() override { Registry::Reset(); }
48 };
49
TEST_F(HpkeConfigTest,Basic)50 TEST_F(HpkeConfigTest, Basic) {
51 if (IsFipsModeEnabled()) {
52 GTEST_SKIP() << "Not supported in FIPS-only mode";
53 }
54
55 EXPECT_THAT(Registry::get_key_manager<HybridDecrypt>(
56 internal::HpkePrivateKeyManager().get_key_type()).status(),
57 StatusIs(absl::StatusCode::kNotFound));
58 EXPECT_THAT(Registry::get_key_manager<HybridEncrypt>(
59 internal::HpkePublicKeyManager().get_key_type()).status(),
60 StatusIs(absl::StatusCode::kNotFound));
61 EXPECT_THAT(RegisterHpke(), IsOk());
62 EXPECT_THAT(Registry::get_key_manager<HybridDecrypt>(
63 internal::HpkePrivateKeyManager().get_key_type()).status(),
64 IsOk());
65 EXPECT_THAT(Registry::get_key_manager<HybridEncrypt>(
66 internal::HpkePublicKeyManager().get_key_type()).status(),
67 IsOk());
68 }
69
70 // FIPS-only mode tests
TEST_F(HpkeConfigTest,RegisterNonFipsTemplates)71 TEST_F(HpkeConfigTest, RegisterNonFipsTemplates) {
72 if (!IsFipsModeEnabled()) {
73 GTEST_SKIP() << "Only supported in FIPS-only mode";
74 }
75
76 EXPECT_THAT(RegisterHpke(), IsOk());
77
78 // Check that we can not retrieve non-FIPS keyset handle
79 std::list<google::crypto::tink::KeyTemplate> non_fips_key_templates;
80 non_fips_key_templates.push_back(
81 HybridKeyTemplates::HpkeX25519HkdfSha256Aes128Gcm());
82 non_fips_key_templates.push_back(
83 HybridKeyTemplates::HpkeX25519HkdfSha256Aes256Gcm());
84 non_fips_key_templates.push_back(
85 HybridKeyTemplates::HpkeX25519HkdfSha256ChaCha20Poly1305());
86
87 for (auto key_template : non_fips_key_templates) {
88 EXPECT_THAT(KeysetHandle::GenerateNew(key_template).status(),
89 StatusIs(absl::StatusCode::kNotFound));
90 }
91 }
92
93 } // namespace
94 } // namespace tink
95 } // namespace crypto
96