e7c1381a6a7260518f8489847cfb364c892c5e6a
[openssl.git] / test / evp_kdf_test.c
1 /*
2  * Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
3  * Copyright (c) 2018-2019, Oracle and/or its affiliates.  All rights reserved.
4  *
5  * Licensed under the Apache License 2.0 (the "License").  You may not use
6  * this file except in compliance with the License.  You can obtain a copy
7  * in the file LICENSE in the source distribution or at
8  * https://www.openssl.org/source/license.html
9  */
10
11 /* Tests of the EVP_KDF_CTX APIs */
12
13 #include <stdio.h>
14 #include <string.h>
15
16 #include <openssl/evp.h>
17 #include <openssl/kdf.h>
18 #include "testutil.h"
19
20 static int test_kdf_tls1_prf(void)
21 {
22     int ret;
23     EVP_KDF_CTX *kctx = NULL;
24     const EVP_KDF *kdf;
25     unsigned char out[16];
26     static const unsigned char expected[sizeof(out)] = {
27         0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
28         0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
29     };
30
31     ret =
32         TEST_ptr(kdf = EVP_get_kdfbyname(SN_tls1_prf))
33         && TEST_ptr(kctx = EVP_KDF_CTX_new(kdf))
34         && TEST_ptr_eq(EVP_KDF_CTX_kdf(kctx), kdf)
35         && TEST_str_eq(EVP_KDF_name(kdf), SN_tls1_prf)
36         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
37         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_TLS_SECRET,
38                                     "secret", (size_t)6), 0)
39         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, "seed",
40                                     (size_t)4), 0)
41         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
42         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
43
44     EVP_KDF_CTX_free(kctx);
45     return ret;
46 }
47
48 static int test_kdf_hkdf(void)
49 {
50     int ret;
51     EVP_KDF_CTX *kctx;
52     unsigned char out[10];
53     static const unsigned char expected[sizeof(out)] = {
54         0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
55     };
56
57     ret =
58         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_HKDF))
59         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
60         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, "salt",
61                                     (size_t)4), 0)
62         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, "secret",
63                                     (size_t)6), 0)
64         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_HKDF_INFO, "label",
65                                     (size_t)5), 0)
66         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
67         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
68
69     EVP_KDF_CTX_free(kctx);
70     return ret;
71 }
72
73 static int test_kdf_pbkdf2(void)
74 {
75     int ret;
76     EVP_KDF_CTX *kctx;
77     unsigned char out[25];
78     size_t len = 0;
79     const unsigned char expected[sizeof(out)] = {
80         0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
81         0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
82         0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
83         0x1c
84     };
85
86     if (sizeof(len) > 32)
87         len = SIZE_MAX;
88
89     ret = TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2))
90           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS,
91                                       "passwordPASSWORDpassword",
92                                       (size_t)24), 0)
93           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,
94                                       "saltSALTsaltSALTsaltSALTsaltSALTsalt",
95                                       (size_t)36), 0)
96           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_ITER, 4096), 0)
97           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()),
98                          0)
99           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE,
100                                             0), 0)
101           && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
102           && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected))
103           /* A key length that is too small should fail */
104           && TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1), 0)
105           /* A key length that is too large should fail */
106           && (len == 0 || TEST_int_eq(EVP_KDF_derive(kctx, out, len), 0))
107           /* Salt length less than 128 bits should fail */
108           && TEST_int_eq(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,
109                                       "123456781234567",
110                                       (size_t)15), 0)
111           /* A small iteration count should fail */
112           && TEST_int_eq(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_ITER, 1), 0)
113           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE,
114                                       1), 0)
115           /* Small salts will pass if the "pkcs5" mode is enabled */
116           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,
117                                       "123456781234567",
118                                       (size_t)15), 0)
119           /* A small iteration count will pass if "pkcs5" mode is enabled */
120           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_ITER, 1), 0)
121           /*
122            * If the "pkcs5" mode is disabled then the small salt and iter will
123            * fail when the derive gets called.
124            */
125           && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE,
126                                       0), 0)
127           && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out)), 0);
128
129     EVP_KDF_CTX_free(kctx);
130     return ret;
131 }
132
133 #ifndef OPENSSL_NO_SCRYPT
134 static int test_kdf_scrypt(void)
135 {
136     int ret;
137     EVP_KDF_CTX *kctx;
138     unsigned char out[64];
139     static const unsigned char expected[sizeof(out)] = {
140         0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
141         0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
142         0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
143         0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
144         0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
145         0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
146         0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
147         0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
148     };
149
150     ret =
151         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SCRYPT))
152         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, "password",
153                                     (size_t)8), 0)
154         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, "NaCl",
155                                     (size_t)4), 0)
156         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_N,
157                                     (uint64_t)1024), 0)
158         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_R,
159                                     (uint32_t)8), 0)
160         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_P,
161                                     (uint32_t)16), 0)
162         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAXMEM_BYTES,
163                                     (uint64_t)16), 0)
164         /* failure test */
165         && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
166         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAXMEM_BYTES,
167                                     (uint64_t)(10 * 1024 * 1024)), 0)
168         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
169         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
170
171     EVP_KDF_CTX_free(kctx);
172     return ret;
173 }
174 #endif /* OPENSSL_NO_SCRYPT */
175
176 static int test_kdf_ss_hash(void)
177 {
178     int ret;
179     EVP_KDF_CTX *kctx = NULL;
180     unsigned char out[14];
181     static const unsigned char z[] = {
182         0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e,
183         0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62,
184         0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4,
185         0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9
186     };
187     static const unsigned char other[] = {
188         0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e,
189         0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde,
190         0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e,
191         0xe0,0xec,0x3f,0x8d,0xbe
192     };
193     static const unsigned char expected[sizeof(out)] = {
194         0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8
195     };
196
197     ret =
198         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
199         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha224()), 0)
200         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
201         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
202                                     sizeof(other)), 0)
203         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
204         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
205
206     EVP_KDF_CTX_free(kctx);
207     return ret;
208 }
209
210 static int test_kdf_x963(void)
211 {
212     int ret;
213     EVP_KDF_CTX *kctx = NULL;
214     unsigned char out[1024 / 8];
215     /*
216      * Test data from https://csrc.nist.gov/CSRC/media/Projects/
217      *  Cryptographic-Algorithm-Validation-Program/documents/components/
218      *  800-135testvectors/ansx963_2001.zip
219      */
220     static const unsigned char z[] = {
221         0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad,
222         0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9,
223         0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f,
224         0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f,
225         0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7,
226         0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d
227     };
228     static const unsigned char shared[] = {
229         0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99,
230         0x37, 0x89, 0x5d, 0x31
231     };
232     static const unsigned char expected[sizeof(out)] = {
233         0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b,
234         0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8,
235         0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5,
236         0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e,
237         0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee,
238         0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02,
239         0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7,
240         0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd,
241         0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e,
242         0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc,
243         0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16
244     };
245
246     ret =
247         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_X963))
248         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha512()), 0)
249         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
250         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SHARED_INFO, shared,
251                                     sizeof(shared)), 0)
252         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
253         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
254
255     EVP_KDF_CTX_free(kctx);
256     return ret;
257 }
258
259 static int test_kdf_ss_hmac(void)
260 {
261     int ret;
262     EVP_KDF_CTX *kctx;
263     const EVP_MAC *mac;
264     unsigned char out[16];
265     static const unsigned char z[] = {
266         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
267     };
268     static const unsigned char other[] = {
269         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
270     };
271     static const unsigned char salt[] = {
272         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
273         0x3f,0x89
274     };
275     static const unsigned char expected[sizeof(out)] = {
276         0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63,
277         0x1c,0xa3
278     };
279
280     ret =
281         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
282         && TEST_ptr(mac = EVP_get_macbyname("HMAC"))
283         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC, mac), 0)
284         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD,  EVP_sha256()), 0)
285         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
286         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
287                                     sizeof(other)), 0)
288         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, salt,
289                                     sizeof(salt)), 0)
290         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
291         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
292
293     EVP_KDF_CTX_free(kctx);
294     return ret;
295 }
296
297 static int test_kdf_ss_kmac(void)
298 {
299     int ret;
300     EVP_KDF_CTX *kctx;
301     unsigned char out[64];
302     const EVP_MAC *mac;
303     static const unsigned char z[] = {
304         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
305     };
306     static const unsigned char other[] = {
307         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
308     };
309     static const unsigned char salt[] = {
310         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
311         0x3f,0x89
312     };
313     static const unsigned char expected[sizeof(out)] = {
314         0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd,
315         0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2,
316         0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4,
317         0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95,
318         0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03
319     };
320
321     ret =
322         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
323         && TEST_ptr(mac = EVP_get_macbyname("KMAC128"))
324         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC, mac), 0)
325         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z,
326                                     sizeof(z)), 0)
327         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
328                                     sizeof(other)), 0)
329         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, salt,
330                                     sizeof(salt)), 0)
331         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC_SIZE,
332                                     (size_t)20), 0)
333         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
334         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
335
336     EVP_KDF_CTX_free(kctx);
337     return ret;
338 }
339
340 static int test_kdf_sshkdf(void)
341 {
342     int ret;
343     EVP_KDF_CTX *kctx;
344     unsigned char out[8];
345     /* Test data from NIST CAVS 14.1 test vectors */
346     static const unsigned char key[] = {
347         0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
348         0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
349         0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
350         0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
351         0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
352         0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
353         0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
354         0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
355         0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
356         0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
357         0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
358         0x4e
359     };
360     static const unsigned char xcghash[] = {
361         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
362         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
363         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
364     };
365     static const unsigned char sessid[] = {
366         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
367         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
368         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
369     };
370     static const unsigned char expected[sizeof(out)] = {
371         0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
372     };
373
374     ret =
375         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF))
376         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
377         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, key,
378                                     sizeof(key)), 0)
379         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
380                                     xcghash, sizeof(xcghash)), 0)
381         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
382                                     sessid, sizeof(sessid)), 0)
383         && TEST_int_gt(
384                 EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE,
385                             (int)EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV), 0)
386         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
387         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
388
389     EVP_KDF_CTX_free(kctx);
390     return ret;
391 }
392
393 static int test_kdf_get_kdf(void)
394 {
395     const EVP_KDF *kdf1, *kdf2;
396     ASN1_OBJECT *obj;
397
398     return
399         TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
400         && TEST_ptr(kdf1 = EVP_get_kdfbyname(LN_id_pbkdf2))
401         && TEST_ptr(kdf2 = EVP_get_kdfbyobj(obj))
402         && TEST_ptr_eq(kdf1, kdf2)
403         && TEST_ptr(kdf1 = EVP_get_kdfbyname(SN_tls1_prf))
404         && TEST_ptr(kdf2 = EVP_get_kdfbyname(LN_tls1_prf))
405         && TEST_ptr_eq(kdf1, kdf2)
406         && TEST_ptr(kdf2 = EVP_get_kdfbynid(NID_tls1_prf))
407         && TEST_ptr_eq(kdf1, kdf2);
408 }
409
410 #ifndef OPENSSL_NO_CMS
411 static int test_kdf_x942_asn1(void)
412 {
413     int ret;
414     EVP_KDF_CTX *kctx = NULL;
415     unsigned char out[24];
416     /* RFC2631 Section 2.1.6 Test data */
417     static const unsigned char z[] = {
418         0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,
419         0x0e,0x0f,0x10,0x11,0x12,0x13
420     };
421     static const unsigned char expected[sizeof(out)] = {
422         0xa0,0x96,0x61,0x39,0x23,0x76,0xf7,0x04,
423         0x4d,0x90,0x52,0xa3,0x97,0x88,0x32,0x46,
424         0xb6,0x7f,0x5f,0x1e,0xf6,0x3e,0xb5,0xfb
425     };
426
427     ret =
428         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_X942))
429         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha1()), 0)
430         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
431         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_CEK_ALG,
432                                     SN_id_smime_alg_CMS3DESwrap), 0)
433         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
434         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
435
436     EVP_KDF_CTX_free(kctx);
437     return ret;
438 }
439 #endif /* OPENSSL_NO_CMS */
440
441 int setup_tests(void)
442 {
443     ADD_TEST(test_kdf_get_kdf);
444     ADD_TEST(test_kdf_tls1_prf);
445     ADD_TEST(test_kdf_hkdf);
446     ADD_TEST(test_kdf_pbkdf2);
447 #ifndef OPENSSL_NO_SCRYPT
448     ADD_TEST(test_kdf_scrypt);
449 #endif
450     ADD_TEST(test_kdf_ss_hash);
451     ADD_TEST(test_kdf_ss_hmac);
452     ADD_TEST(test_kdf_ss_kmac);
453     ADD_TEST(test_kdf_sshkdf);
454     ADD_TEST(test_kdf_x963);
455 #ifndef OPENSSL_NO_CMS
456     ADD_TEST(test_kdf_x942_asn1);
457 #endif
458     return 1;
459 }