Make util/mk1mf.pl recognise no-weak-ssl-ciphers

[openssl.git] / test / ecdhtest.c

diff --git a/test/ecdhtest.c b/test/ecdhtest.c
index e26fddf08e604a312a8cd93085c5eece54f6dfdb..356f3e939c127ff3ad5f6a5d754cf26d349a4a8f 100644 (file)
--- a/test/ecdhtest.c
+++ b/test/ecdhtest.c
@@ -432,8 +432,7 @@ static int ecdh_kat(BIO *out, const ecdh_kat_t *kat)
         goto err;
     if((Z = OPENSSL_zalloc(Ztmplen)) == NULL)
         goto err;
-    /* Z offset compensates for bn2bin stripping leading 0x00 bytes */
-    if(!BN_bn2bin(bnz, Z + Ztmplen - Zlen))
+    if(!BN_bn2binpad(bnz, Z, Ztmplen))
         goto err;
     if (!ECDH_compute_key(Ztmp, Ztmplen,
                           EC_KEY_get0_public_key(key2), key1, 0))
@@ -462,6 +461,131 @@ static int ecdh_kat(BIO *out, const ecdh_kat_t *kat)
     return rv;
 }
 
+#include "ecdhtest_cavs.h"
+
+/*
+ * NIST SP800-56A co-factor ECDH tests.
+ * KATs taken from NIST documents with parameters:
+ *
+ * - (QCAVSx,QCAVSy) is the public key for CAVS.
+ * - dIUT is the private key for IUT.
+ * - (QIUTx,QIUTy) is the public key for IUT.
+ * - ZIUT is the shared secret KAT.
+ *
+ * CAVS: Cryptographic Algorithm Validation System
+ * IUT: Implementation Under Test
+ *
+ * This function tests two things:
+ *
+ * 1. dIUT * G = (QIUTx,QIUTy)
+ *    i.e. public key for IUT computes correctly.
+ * 2. x-coord of cofactor * dIUT * (QCAVSx,QCAVSy) = ZIUT
+ *    i.e. co-factor ECDH key computes correctly.
+ *
+ * returns zero on failure or unsupported curve. One otherwise.
+ */
+static int ecdh_cavs_kat(BIO *out, const ecdh_cavs_kat_t *kat)
+{
+    int rv = 0, is_char_two = 0;
+    EC_KEY *key1 = NULL;
+    EC_POINT *pub = NULL;
+    const EC_GROUP *group = NULL;
+    BIGNUM *bnz = NULL, *x = NULL, *y = NULL;
+    unsigned char *Ztmp = NULL, *Z = NULL;
+    size_t Ztmplen, Zlen;
+    BIO_puts(out, "Testing ECC CDH Primitive SP800-56A with ");
+    BIO_puts(out, OBJ_nid2sn(kat->nid));
+
+    /* dIUT is IUT's private key */
+    if ((key1 = mk_eckey(kat->nid, kat->dIUT)) == NULL)
+        goto err;
+    /* these are cofactor ECDH KATs */
+    EC_KEY_set_flags(key1, EC_FLAG_COFACTOR_ECDH);
+
+    if ((group = EC_KEY_get0_group(key1)) == NULL)
+        goto err;
+    if ((pub = EC_POINT_new(group)) == NULL)
+        goto err;
+
+    if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_characteristic_two_field)
+        is_char_two = 1;
+
+    /* (QIUTx, QIUTy) is IUT's public key */
+    if(!BN_hex2bn(&x, kat->QIUTx))
+        goto err;
+    if(!BN_hex2bn(&y, kat->QIUTy))
+        goto err;
+    if (is_char_two) {
+#ifdef OPENSSL_NO_EC2M
+        goto err;
+#else
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, pub, x, y, NULL))
+            goto err;
+#endif
+    }
+    else {
+        if (!EC_POINT_set_affine_coordinates_GFp(group, pub, x, y, NULL))
+            goto err;
+    }
+    /* dIUT * G = (QIUTx, QIUTy) should hold */
+    if (EC_POINT_cmp(group, EC_KEY_get0_public_key(key1), pub, NULL))
+        goto err;
+
+    /* (QCAVSx, QCAVSy) is CAVS's public key */
+    if(!BN_hex2bn(&x, kat->QCAVSx))
+        goto err;
+    if(!BN_hex2bn(&y, kat->QCAVSy))
+        goto err;
+    if (is_char_two) {
+#ifdef OPENSSL_NO_EC2M
+        goto err;
+#else
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, pub, x, y, NULL))
+            goto err;
+#endif
+    }
+    else {
+        if (!EC_POINT_set_affine_coordinates_GFp(group, pub, x, y, NULL))
+            goto err;
+    }
+
+    /* ZIUT is the shared secret */
+    if(!BN_hex2bn(&bnz, kat->ZIUT))
+        goto err;
+    Ztmplen = (EC_GROUP_get_degree(EC_KEY_get0_group(key1)) + 7) / 8;
+    Zlen = BN_num_bytes(bnz);
+    if (Zlen > Ztmplen)
+        goto err;
+    if((Ztmp = OPENSSL_zalloc(Ztmplen)) == NULL)
+        goto err;
+    if((Z = OPENSSL_zalloc(Ztmplen)) == NULL)
+        goto err;
+    if(!BN_bn2binpad(bnz, Z, Ztmplen))
+        goto err;
+    if (!ECDH_compute_key(Ztmp, Ztmplen, pub, key1, 0))
+        goto err;
+    /* shared secrets should be identical */
+    if (memcmp(Ztmp, Z, Ztmplen))
+        goto err;
+    rv = 1;
+ err:
+    EC_KEY_free(key1);
+    EC_POINT_free(pub);
+    BN_free(bnz);
+    BN_free(x);
+    BN_free(y);
+    OPENSSL_free(Ztmp);
+    OPENSSL_free(Z);
+    if (rv) {
+        BIO_puts(out, " ok\n");
+    }
+    else {
+        fprintf(stderr, "Error in ECC CDH routines\n");
+        ERR_print_errors_fp(stderr);
+    }
+    return rv;
+}
+
 int main(int argc, char *argv[])
 {
     BN_CTX *ctx = NULL;
@@ -493,6 +617,13 @@ int main(int argc, char *argv[])
     /* NAMED CURVES TESTS */
     for (n = 0; n < crv_len; n++) {
         nid = curves[n].nid;
+        /*
+         * Skipped for X25519 because affine coordinate operations are not
+         * supported for this curve.
+         * Higher level ECDH tests are performed in evptests.txt instead.
+         */
+        if (nid == NID_X25519)
+            continue;
         if (!test_ecdh_curve(nid, ctx, out)) goto err;
     }
 
@@ -502,6 +633,12 @@ int main(int argc, char *argv[])
             goto err;
     }
 
+    /* NIST SP800-56A co-factor ECDH KATs */
+    for (n = 0; n < (sizeof(ecdh_cavs_kats)/sizeof(ecdh_cavs_kat_t)); n++) {
+        if (!ecdh_cavs_kat(out, &ecdh_cavs_kats[n]))
+            goto err;
+    }
+
     ret = 0;
 
  err:
@@ -509,8 +646,7 @@ int main(int argc, char *argv[])
     OPENSSL_free(curves);
     BN_CTX_free(ctx);
     BIO_free(out);
-    CRYPTO_cleanup_all_ex_data();
-    ERR_remove_thread_state(NULL);
+
 #ifndef OPENSSL_NO_CRYPTO_MDEBUG
     if (CRYPTO_mem_leaks_fp(stderr) <= 0)
         ret = 1;