1 // Copyright 2017 Google Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/hybrid/hybrid_config.h"
18
19 #include <list>
20 #include <string>
21 #include <utility>
22
23 #include "gmock/gmock.h"
24 #include "gtest/gtest.h"
25 #include "absl/status/status.h"
26 #include "openssl/crypto.h"
27 #include "tink/hybrid/ecies_aead_hkdf_private_key_manager.h"
28 #include "tink/hybrid/ecies_aead_hkdf_public_key_manager.h"
29 #include "tink/hybrid/hybrid_key_templates.h"
30 #include "tink/hybrid_decrypt.h"
31 #include "tink/hybrid_encrypt.h"
32 #include "tink/internal/fips_utils.h"
33 #include "tink/keyset_handle.h"
34 #include "tink/registry.h"
35 #include "tink/util/status.h"
36 #include "tink/util/test_matchers.h"
37 #include "tink/util/test_util.h"
38
39 namespace crypto {
40 namespace tink {
41 namespace {
42
43 using ::crypto::tink::test::DummyHybridDecrypt;
44 using ::crypto::tink::test::DummyHybridEncrypt;
45 using ::crypto::tink::test::IsOk;
46 using ::crypto::tink::test::StatusIs;
47
48 class HybridConfigTest : public ::testing::Test {
49 protected:
SetUp()50 void SetUp() override { Registry::Reset(); }
51 };
52
TEST_F(HybridConfigTest,Basic)53 TEST_F(HybridConfigTest, Basic) {
54 if (internal::IsFipsModeEnabled()) {
55 GTEST_SKIP() << "Not supported in FIPS-only mode";
56 }
57
58 EXPECT_THAT(Registry::get_key_manager<HybridDecrypt>(
59 EciesAeadHkdfPrivateKeyManager().get_key_type())
60 .status(),
61 StatusIs(absl::StatusCode::kNotFound));
62 EXPECT_THAT(Registry::get_key_manager<HybridEncrypt>(
63 EciesAeadHkdfPublicKeyManager().get_key_type())
64 .status(),
65 StatusIs(absl::StatusCode::kNotFound));
66 EXPECT_THAT(HybridConfig::Register(), IsOk());
67 EXPECT_THAT(Registry::get_key_manager<HybridDecrypt>(
68 EciesAeadHkdfPrivateKeyManager().get_key_type())
69 .status(),
70 IsOk());
71 EXPECT_THAT(Registry::get_key_manager<HybridEncrypt>(
72 EciesAeadHkdfPublicKeyManager().get_key_type())
73 .status(),
74 IsOk());
75 }
76
77 // Tests that the HybridEncryptWrapper has been properly registered and we
78 // can wrap primitives.
TEST_F(HybridConfigTest,EncryptWrapperRegistered)79 TEST_F(HybridConfigTest, EncryptWrapperRegistered) {
80 if (internal::IsFipsModeEnabled()) {
81 GTEST_SKIP() << "Not supported in FIPS-only mode";
82 }
83
84 ASSERT_TRUE(HybridConfig::Register().ok());
85
86 google::crypto::tink::KeysetInfo::KeyInfo key_info;
87 key_info.set_status(google::crypto::tink::KeyStatusType::ENABLED);
88 key_info.set_key_id(1234);
89 key_info.set_output_prefix_type(google::crypto::tink::OutputPrefixType::TINK);
90 auto primitive_set = absl::make_unique<PrimitiveSet<HybridEncrypt>>();
91 ASSERT_THAT(
92 primitive_set->set_primary(
93 primitive_set
94 ->AddPrimitive(absl::make_unique<DummyHybridEncrypt>("dummy"),
95 key_info)
96 .value()),
97 IsOk());
98
99 auto wrapped = Registry::Wrap(std::move(primitive_set));
100
101 ASSERT_TRUE(wrapped.ok()) << wrapped.status();
102 auto encryption_result = wrapped.value()->Encrypt("secret", "");
103 ASSERT_TRUE(encryption_result.ok());
104
105 std::string prefix = CryptoFormat::GetOutputPrefix(key_info).value();
106 EXPECT_EQ(
107 encryption_result.value(),
108 absl::StrCat(prefix,
109 DummyHybridEncrypt("dummy").Encrypt("secret", "").value()));
110 }
111
112 // Tests that the HybridDecryptWrapper has been properly registered and we
113 // can wrap primitives.
TEST_F(HybridConfigTest,DecryptWrapperRegistered)114 TEST_F(HybridConfigTest, DecryptWrapperRegistered) {
115 if (internal::IsFipsModeEnabled()) {
116 GTEST_SKIP() << "Not supported in FIPS-only mode";
117 }
118
119 ASSERT_TRUE(HybridConfig::Register().ok());
120
121 google::crypto::tink::KeysetInfo::KeyInfo key_info;
122 key_info.set_status(google::crypto::tink::KeyStatusType::ENABLED);
123 key_info.set_key_id(1234);
124 key_info.set_output_prefix_type(google::crypto::tink::OutputPrefixType::TINK);
125 auto primitive_set = absl::make_unique<PrimitiveSet<HybridDecrypt>>();
126 ASSERT_THAT(
127 primitive_set->set_primary(
128 primitive_set
129 ->AddPrimitive(absl::make_unique<DummyHybridDecrypt>("dummy"),
130 key_info)
131 .value()),
132 IsOk());
133
134 auto wrapped = Registry::Wrap(std::move(primitive_set));
135
136 ASSERT_TRUE(wrapped.ok()) << wrapped.status();
137
138 std::string prefix = CryptoFormat::GetOutputPrefix(key_info).value();
139 std::string encryption =
140 DummyHybridEncrypt("dummy").Encrypt("secret", "").value();
141
142 ASSERT_EQ(
143 wrapped.value()->Decrypt(absl::StrCat(prefix, encryption), "").value(),
144 "secret");
145 }
146
147 // FIPS-only mode tests
TEST_F(HybridConfigTest,RegisterNonFipsTemplates)148 TEST_F(HybridConfigTest, RegisterNonFipsTemplates) {
149 if (!internal::IsFipsModeEnabled() || !internal::IsFipsEnabledInSsl()) {
150 GTEST_SKIP() << "Only supported in FIPS-only mode with BoringCrypto";
151 }
152
153 EXPECT_THAT(HybridConfig::Register(), IsOk());
154
155 // Check that we can not retrieve non-FIPS keyset handle
156 std::list<google::crypto::tink::KeyTemplate> non_fips_key_templates;
157 non_fips_key_templates.push_back(
158 HybridKeyTemplates::
159 EciesP256CompressedHkdfHmacSha256Aes128CtrHmacSha256());
160 non_fips_key_templates.push_back(
161 HybridKeyTemplates::EciesP256CompressedHkdfHmacSha256Aes128Gcm());
162 non_fips_key_templates.push_back(
163 HybridKeyTemplates::EciesP256HkdfHmacSha256Aes128CtrHmacSha256());
164 non_fips_key_templates.push_back(
165 HybridKeyTemplates::EciesP256HkdfHmacSha256Aes128Gcm());
166 non_fips_key_templates.push_back(
167 HybridKeyTemplates::
168 EciesP256HkdfHmacSha256Aes128GcmCompressedWithoutPrefix());
169 non_fips_key_templates.push_back(
170 HybridKeyTemplates::EciesX25519HkdfHmacSha256Aes128CtrHmacSha256());
171 non_fips_key_templates.push_back(
172 HybridKeyTemplates::EciesX25519HkdfHmacSha256Aes128Gcm());
173 non_fips_key_templates.push_back(
174 HybridKeyTemplates::EciesX25519HkdfHmacSha256XChaCha20Poly1305());
175
176 for (auto key_template : non_fips_key_templates) {
177 EXPECT_THAT(KeysetHandle::GenerateNew(key_template).status(),
178 StatusIs(absl::StatusCode::kNotFound));
179 }
180 }
181
182 } // namespace
183 } // namespace tink
184 } // namespace crypto
185