Added EVP_KDF (similiar to the EVP_MAC)
[openssl.git] / test / evp_kdf_test.c
1 /*
2  * Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
3  * Copyright (c) 2018-2019, Oracle and/or its affiliates.  All rights reserved.
4  *
5  * Licensed under the Apache License 2.0 (the "License").  You may not use
6  * this file except in compliance with the License.  You can obtain a copy
7  * in the file LICENSE in the source distribution or at
8  * https://www.openssl.org/source/license.html
9  */
10
11 /* Tests of the EVP_KDF_CTX APIs */
12
13 #include <stdio.h>
14 #include <string.h>
15
16 #include <openssl/evp.h>
17 #include <openssl/kdf.h>
18 #include "testutil.h"
19
20 static int test_kdf_tls1_prf(void)
21 {
22     int ret;
23     EVP_KDF_CTX *kctx = NULL;
24     const EVP_KDF *kdf;
25     unsigned char out[16];
26     const unsigned char expected[sizeof(out)] = {
27         0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
28         0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
29     };
30
31     ret =
32         TEST_ptr(kdf = EVP_get_kdfbyname(SN_tls1_prf))
33         && TEST_ptr(kctx = EVP_KDF_CTX_new(kdf))
34         && TEST_ptr_eq(EVP_KDF_CTX_kdf(kctx), kdf)
35         && TEST_str_eq(EVP_KDF_name(kdf), SN_tls1_prf)
36         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
37         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_TLS_SECRET,
38                                     "secret", (size_t)6), 0)
39         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, "seed",
40                                     (size_t)4), 0)
41         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
42         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
43
44     EVP_KDF_CTX_free(kctx);
45     return ret;
46 }
47
48 static int test_kdf_hkdf(void)
49 {
50     int ret;
51     EVP_KDF_CTX *kctx;
52     unsigned char out[10];
53     const unsigned char expected[sizeof(out)] = {
54         0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
55     };
56
57     ret =
58         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_HKDF))
59         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
60         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, "salt",
61                                     (size_t)4), 0)
62         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, "secret",
63                                     (size_t)6), 0)
64         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_HKDF_INFO, "label",
65                                     (size_t)5), 0)
66         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
67         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
68
69     EVP_KDF_CTX_free(kctx);
70     return ret;
71 }
72
73 static int test_kdf_pbkdf2(void)
74 {
75     int ret;
76     EVP_KDF_CTX *kctx;
77     unsigned char out[32];
78     const unsigned char expected[sizeof(out)] = {
79         0xae, 0x4d, 0x0c, 0x95, 0xaf, 0x6b, 0x46, 0xd3,
80         0x2d, 0x0a, 0xdf, 0xf9, 0x28, 0xf0, 0x6d, 0xd0,
81         0x2a, 0x30, 0x3f, 0x8e, 0xf3, 0xc2, 0x51, 0xdf,
82         0xd6, 0xe2, 0xd8, 0x5a, 0x95, 0x47, 0x4c, 0x43
83     };
84
85     ret =
86         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2))
87         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, "password",
88                                     (size_t)8), 0)
89         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, "salt",
90                                     (size_t)4), 0)
91         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_ITER, 2), 0)
92         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
93         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
94         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
95
96     EVP_KDF_CTX_free(kctx);
97     return ret;
98 }
99
100 #ifndef OPENSSL_NO_SCRYPT
101 static int test_kdf_scrypt(void)
102 {
103     int ret;
104     EVP_KDF_CTX *kctx;
105     unsigned char out[64];
106     const unsigned char expected[sizeof(out)] = {
107         0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
108         0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
109         0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
110         0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
111         0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
112         0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
113         0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
114         0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
115     };
116
117     ret =
118         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SCRYPT))
119         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, "password",
120                                     (size_t)8), 0)
121         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, "NaCl",
122                                     (size_t)4), 0)
123         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_N,
124                                     (uint64_t)1024), 0)
125         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_R,
126                                     (uint32_t)8), 0)
127         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_P,
128                                     (uint32_t)16), 0)
129         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAXMEM_BYTES,
130                                     (uint64_t)16), 0)
131         /* failure test */
132         && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
133         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAXMEM_BYTES,
134                                     (uint64_t)(10 * 1024 * 1024)), 0)
135         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
136         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
137
138     EVP_KDF_CTX_free(kctx);
139     return ret;
140 }
141 #endif /* OPENSSL_NO_SCRYPT */
142
143 static int test_kdf_ss_hash(void)
144 {
145     int ret;
146     EVP_KDF_CTX *kctx = NULL;
147     const unsigned char z[] = {
148         0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e,
149         0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62,
150         0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4,
151         0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9
152     };
153     const unsigned char other[] = {
154         0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e,
155         0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde,
156         0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e,
157         0xe0,0xec,0x3f,0x8d,0xbe
158     };
159     const unsigned char expected[] = {
160         0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8
161     };
162     unsigned char out[14];
163
164     ret =
165         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
166         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha224()), 0)
167         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
168         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
169                                     sizeof(other)), 0)
170         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
171         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
172
173     EVP_KDF_CTX_free(kctx);
174     return ret;
175 }
176
177 static int test_kdf_ss_hmac(void)
178 {
179     int ret;
180     EVP_KDF_CTX *kctx;
181     const EVP_MAC *mac;
182
183     const unsigned char z[] = {
184         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
185     };
186     const unsigned char other[] = {
187         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
188     };
189     const unsigned char salt[] = {
190         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
191         0x3f,0x89
192     };
193     const unsigned char expected[] = {
194         0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63,
195         0x1c,0xa3
196     };
197     unsigned char out[16];
198
199     ret =
200         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
201         && TEST_ptr(mac = EVP_get_macbyname("HMAC"))
202         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC, mac), 0)
203         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD,  EVP_sha256()), 0)
204         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z, sizeof(z)), 0)
205         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
206                                     sizeof(other)), 0)
207         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, salt,
208                                     sizeof(salt)), 0)
209         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
210         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
211
212     EVP_KDF_CTX_free(kctx);
213     return ret;
214 }
215
216 static int test_kdf_ss_kmac(void)
217 {
218     int ret;
219     EVP_KDF_CTX *kctx;
220     unsigned char out[64];
221     const EVP_MAC *mac;
222
223     const unsigned char z[] = {
224         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
225     };
226     const unsigned char other[] = {
227         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
228     };
229     const unsigned char salt[] = {
230         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
231         0x3f,0x89
232     };
233     const unsigned char expected[] = {
234         0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd,
235         0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2,
236         0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4,
237         0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95,
238         0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03
239     };
240
241     ret =
242         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SS))
243         && TEST_ptr(mac = EVP_get_macbyname("KMAC128"))
244         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC, mac), 0)
245         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, z,
246                                     sizeof(z)), 0)
247         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSKDF_INFO, other,
248                                     sizeof(other)), 0)
249         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT, salt,
250                                     sizeof(salt)), 0)
251         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAC_SIZE,
252                                     (size_t)20), 0)
253         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
254         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
255
256     EVP_KDF_CTX_free(kctx);
257     return ret;
258 }
259
260 static int test_kdf_sshkdf(void)
261 {
262     int ret;
263     EVP_KDF_CTX *kctx;
264     unsigned char out[8];
265     /* Test data from NIST CAVS 14.1 test vectors */
266     const unsigned char key[] = {
267         0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
268         0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
269         0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
270         0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
271         0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
272         0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
273         0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
274         0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
275         0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
276         0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
277         0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
278         0x4e
279     };
280     const unsigned char xcghash[] = {
281         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
282         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
283         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
284     };
285     const unsigned char sessid[] = {
286         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
287         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
288         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
289     };
290     const unsigned char expected[sizeof(out)] = {
291         0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
292     };
293
294     ret =
295         TEST_ptr(kctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF))
296         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, EVP_sha256()), 0)
297         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, key,
298                                     sizeof(key)), 0)
299         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
300                                     xcghash, sizeof(xcghash)), 0)
301         && TEST_int_gt(EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
302                                     sessid, sizeof(sessid)), 0)
303         && TEST_int_gt(
304                 EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE,
305                             (int)EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV), 0)
306         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out)), 0)
307         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
308
309     EVP_KDF_CTX_free(kctx);
310     return ret;
311 }
312
313 static int test_kdf_get_kdf(void)
314 {
315     const EVP_KDF *kdf1, *kdf2;
316     ASN1_OBJECT *obj;
317
318     return
319         TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
320         && TEST_ptr(kdf1 = EVP_get_kdfbyname(LN_id_pbkdf2))
321         && TEST_ptr(kdf2 = EVP_get_kdfbyobj(obj))
322         && TEST_ptr_eq(kdf1, kdf2)
323         && TEST_ptr(kdf1 = EVP_get_kdfbyname(SN_tls1_prf))
324         && TEST_ptr(kdf2 = EVP_get_kdfbyname(LN_tls1_prf))
325         && TEST_ptr_eq(kdf1, kdf2)
326         && TEST_ptr(kdf2 = EVP_get_kdfbynid(NID_tls1_prf))
327         && TEST_ptr_eq(kdf1, kdf2);
328 }
329
330 int setup_tests(void)
331 {
332     ADD_TEST(test_kdf_get_kdf);
333     ADD_TEST(test_kdf_tls1_prf);
334     ADD_TEST(test_kdf_hkdf);
335     ADD_TEST(test_kdf_pbkdf2);
336 #ifndef OPENSSL_NO_SCRYPT
337     ADD_TEST(test_kdf_scrypt);
338 #endif
339     ADD_TEST(test_kdf_ss_hash);
340     ADD_TEST(test_kdf_ss_hmac);
341     ADD_TEST(test_kdf_ss_kmac);
342     ADD_TEST(test_kdf_sshkdf);
343     return 1;
344 }