1 // Copyright 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16 #include "tink/prf/prf_config.h"
17
18 #include <list>
19
20 #include "gmock/gmock.h"
21 #include "gtest/gtest.h"
22 #include "absl/status/status.h"
23 #include "tink/internal/fips_utils.h"
24 #include "tink/keyset_handle.h"
25 #include "tink/prf/hmac_prf_key_manager.h"
26 #include "tink/prf/prf_key_templates.h"
27 #include "tink/prf/prf_set.h"
28 #include "tink/registry.h"
29 #include "tink/util/status.h"
30 #include "tink/util/test_matchers.h"
31 #include "tink/util/test_util.h"
32
33 namespace crypto {
34 namespace tink {
35 namespace {
36
37 using ::crypto::tink::test::IsOk;
38 using ::crypto::tink::test::StatusIs;
39
40 class PrfConfigTest : public ::testing::Test {
41 protected:
SetUp()42 void SetUp() override { Registry::Reset(); }
43 };
44
TEST_F(PrfConfigTest,RegisterWorks)45 TEST_F(PrfConfigTest, RegisterWorks) {
46 if (internal::IsFipsModeEnabled()) {
47 GTEST_SKIP() << "Not supported in FIPS-only mode";
48 }
49
50 EXPECT_THAT(Registry::get_key_manager<Prf>(HmacPrfKeyManager().get_key_type())
51 .status(),
52 StatusIs(absl::StatusCode::kNotFound));
53 EXPECT_THAT(PrfConfig::Register(), IsOk());
54 EXPECT_THAT(Registry::get_key_manager<Prf>(HmacPrfKeyManager().get_key_type())
55 .status(),
56 IsOk());
57 }
58
59 // FIPS-only mode tests
TEST_F(PrfConfigTest,RegisterNonFipsTemplates)60 TEST_F(PrfConfigTest, RegisterNonFipsTemplates) {
61 if (!internal::IsFipsModeEnabled() || !internal::IsFipsEnabledInSsl()) {
62 GTEST_SKIP() << "Only supported in FIPS-only mode";
63 }
64
65 EXPECT_THAT(PrfConfig::Register(), IsOk());
66
67 std::list<google::crypto::tink::KeyTemplate> non_fips_key_templates;
68 non_fips_key_templates.push_back(PrfKeyTemplates::HkdfSha256());
69 non_fips_key_templates.push_back(PrfKeyTemplates::AesCmac());
70
71 for (auto key_template : non_fips_key_templates) {
72 auto new_keyset_handle_result = KeysetHandle::GenerateNew(key_template);
73 EXPECT_THAT(new_keyset_handle_result.status(),
74 StatusIs(absl::StatusCode::kNotFound));
75 }
76 }
77
TEST_F(PrfConfigTest,RegisterFipsValidTemplates)78 TEST_F(PrfConfigTest, RegisterFipsValidTemplates) {
79 if (!internal::IsFipsModeEnabled() || !internal::IsFipsEnabledInSsl()) {
80 GTEST_SKIP() << "Only supported in FIPS-only mode";
81 }
82
83 EXPECT_THAT(PrfConfig::Register(), IsOk());
84
85 std::list<google::crypto::tink::KeyTemplate> fips_key_templates;
86 fips_key_templates.push_back(PrfKeyTemplates::HmacSha256());
87 fips_key_templates.push_back(PrfKeyTemplates::HmacSha512());
88
89 for (auto key_template : fips_key_templates) {
90 auto new_keyset_handle_result = KeysetHandle::GenerateNew(key_template);
91 EXPECT_THAT(new_keyset_handle_result, IsOk());
92 }
93 }
94
95 } // namespace
96 } // namespace tink
97 } // namespace crypto
98