Skip to content

Commit 55e5e78

Browse files
dgarskedgarske
authored
Merge pull request #21 from gasbytes/wycheproof-integration
Wycheproof integration
2 parents 40fb6e0 + 9e8418a commit 55e5e78

File tree

5 files changed

+482
-2
lines changed

5 files changed

+482
-2
lines changed

‎rustls-wolfcrypt-provider/Cargo.toml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,10 @@ env_logger = { version = "0.11.6", default-features = false }
2222
wolfcrypt-rs = { path = "../wolfcrypt-rs" }
2323
rustls-pemfile = { version = "2.2.0", default-features = false }
2424
hex = { version = "0.4.3", default-features = false, features = ["alloc"]}
25-
wycheproof = "0.6.0"
25+
wycheproof = { version = "0.6.0", default-features = false, features = [
26+
"aead",
27+
"hkdf",
28+
] }
2629
rayon = "1.10.0"
2730
anyhow = "1.0.95"
2831
num_cpus = "1.16.0"

‎rustls-wolfcrypt-provider/src/aead/aes128gcm.rs‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,7 @@ impl MessageDecrypter for WCTls13Cipher {
401401
#[cfg(test)]
402402
mod tests {
403403
use super::*;
404+
use wycheproof::{aead::TestFlag, TestResult};
404405

405406
#[test]
406407
fn test_aesgcm128() {
@@ -486,4 +487,139 @@ mod tests {
486487
assert_eq!(result_decrypted, plain);
487488
}
488489
}
490+
491+
#[test]
492+
fn test_aesgcm128_wycheproof() {
493+
let test_name = wycheproof::aead::TestName::AesGcm;
494+
let test_set = wycheproof::aead::TestSet::load(test_name).unwrap();
495+
let mut counter = 0;
496+
497+
for group in test_set
498+
.test_groups
499+
.into_iter()
500+
.filter(|group| group.key_size == 128)
501+
.filter(|group| group.nonce_size == 96)
502+
{
503+
for test in group.tests {
504+
counter += 1;
505+
506+
let mut aes_c_type: Aes = unsafe { mem::zeroed() };
507+
let aes_object = unsafe { AesObject::from_ptr(&mut aes_c_type) };
508+
509+
unsafe {
510+
let ret = wc_AesInit(aes_object.as_ptr(), ptr::null_mut(), INVALID_DEVID);
511+
check_if_zero(ret).unwrap();
512+
513+
let ret = wc_AesGcmSetKey(
514+
aes_object.as_ptr(),
515+
test.key.as_ptr(),
516+
test.key.len() as word32,
517+
);
518+
check_if_zero(ret).unwrap();
519+
}
520+
521+
let mut actual_ciphertext = test.pt.to_vec();
522+
let mut actual_tag = [0u8; GCM_TAG_LENGTH];
523+
524+
let encrypt_result = unsafe {
525+
wc_AesGcmEncrypt(
526+
aes_object.as_ptr(),
527+
actual_ciphertext.as_mut_ptr(),
528+
test.pt.as_ptr(),
529+
test.pt.len() as word32,
530+
test.nonce.as_ptr(),
531+
test.nonce.len() as word32,
532+
actual_tag.as_mut_ptr(),
533+
actual_tag.len() as word32,
534+
test.aad.as_ptr(),
535+
test.aad.len() as word32,
536+
)
537+
};
538+
539+
match &test.result {
540+
TestResult::Invalid => {
541+
if test.flags.iter().any(|flag| *flag == TestFlag::ModifiedTag) {
542+
assert_ne!(
543+
actual_tag[..],
544+
test.tag[..],
545+
"Expected incorrect tag. Id {}: {}",
546+
test.tc_id,
547+
test.comment
548+
);
549+
}
550+
}
551+
TestResult::Valid | TestResult::Acceptable => {
552+
assert_eq!(
553+
encrypt_result, 0,
554+
"Encryption failed for test case {}: {}",
555+
test.tc_id, test.comment
556+
);
557+
558+
assert_eq!(
559+
actual_ciphertext[..],
560+
test.ct[..],
561+
"Encryption failed for test case {}: {}",
562+
test.tc_id,
563+
test.comment
564+
);
565+
566+
assert_eq!(
567+
actual_tag[..],
568+
test.tag[..],
569+
"Tag mismatch in test case {}: {}",
570+
test.tc_id,
571+
test.comment
572+
);
573+
}
574+
}
575+
576+
let mut decrypted_data = test.ct.to_vec();
577+
let decrypt_result = unsafe {
578+
wc_AesGcmDecrypt(
579+
aes_object.as_ptr(),
580+
decrypted_data.as_mut_ptr(),
581+
test.ct.as_ptr(),
582+
test.ct.len() as word32,
583+
test.nonce.as_ptr(),
584+
test.nonce.len() as word32,
585+
test.tag.as_ptr(),
586+
test.tag.len() as word32,
587+
test.aad.as_ptr(),
588+
test.aad.len() as word32,
589+
)
590+
};
591+
592+
match &test.result {
593+
TestResult::Invalid => {
594+
assert!(
595+
decrypt_result != 0,
596+
"Decryption should have failed for invalid test case {}: {}",
597+
test.tc_id,
598+
test.comment
599+
);
600+
}
601+
TestResult::Valid | TestResult::Acceptable => {
602+
assert_eq!(
603+
decrypt_result, 0,
604+
"Decryption failed for test case {}: {}",
605+
test.tc_id, test.comment
606+
);
607+
assert_eq!(
608+
decrypted_data[..],
609+
test.pt[..],
610+
"Decryption failed for test case {}: {}",
611+
test.tc_id,
612+
test.comment
613+
);
614+
}
615+
}
616+
}
617+
}
618+
619+
assert!(
620+
counter > 50,
621+
"Insufficient number of tests run: {}",
622+
counter
623+
);
624+
}
489625
}

‎rustls-wolfcrypt-provider/src/aead/aes256gcm.rs‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,7 @@ impl MessageDecrypter for WCTls13Cipher {
401401
#[cfg(test)]
402402
mod tests {
403403
use super::*;
404+
use wycheproof::{aead::TestFlag, TestResult};
404405

405406
#[test]
406407
fn test_aesgcm256() {
@@ -491,4 +492,139 @@ mod tests {
491492
assert_eq!(result_decrypted, plain);
492493
}
493494
}
495+
496+
#[test]
497+
fn test_aesgcm256_wycheproof() {
498+
let test_name = wycheproof::aead::TestName::AesGcm;
499+
let test_set = wycheproof::aead::TestSet::load(test_name).unwrap();
500+
let mut counter = 0;
501+
502+
for group in test_set
503+
.test_groups
504+
.into_iter()
505+
.filter(|group| group.key_size == 256)
506+
.filter(|group| group.nonce_size == 96)
507+
{
508+
for test in group.tests {
509+
counter += 1;
510+
511+
let mut aes_c_type: Aes = unsafe { mem::zeroed() };
512+
let aes_object = unsafe { AesObject::from_ptr(&mut aes_c_type) };
513+
514+
unsafe {
515+
let ret = wc_AesInit(aes_object.as_ptr(), ptr::null_mut(), INVALID_DEVID);
516+
check_if_zero(ret).unwrap();
517+
518+
let ret = wc_AesGcmSetKey(
519+
aes_object.as_ptr(),
520+
test.key.as_ptr(),
521+
test.key.len() as word32,
522+
);
523+
check_if_zero(ret).unwrap();
524+
}
525+
526+
let mut actual_ciphertext = test.pt.to_vec();
527+
let mut actual_tag = [0u8; GCM_TAG_LENGTH];
528+
529+
let encrypt_result = unsafe {
530+
wc_AesGcmEncrypt(
531+
aes_object.as_ptr(),
532+
actual_ciphertext.as_mut_ptr(),
533+
test.pt.as_ptr(),
534+
test.pt.len() as word32,
535+
test.nonce.as_ptr(),
536+
test.nonce.len() as word32,
537+
actual_tag.as_mut_ptr(),
538+
actual_tag.len() as word32,
539+
test.aad.as_ptr(),
540+
test.aad.len() as word32,
541+
)
542+
};
543+
544+
match &test.result {
545+
TestResult::Invalid => {
546+
if test.flags.iter().any(|flag| *flag == TestFlag::ModifiedTag) {
547+
assert_ne!(
548+
actual_tag[..],
549+
test.tag[..],
550+
"Expected incorrect tag. Id {}: {}",
551+
test.tc_id,
552+
test.comment
553+
);
554+
}
555+
}
556+
TestResult::Valid | TestResult::Acceptable => {
557+
assert_eq!(
558+
encrypt_result, 0,
559+
"Encryption failed for test case {}: {}",
560+
test.tc_id, test.comment
561+
);
562+
563+
assert_eq!(
564+
actual_ciphertext[..],
565+
test.ct[..],
566+
"Encryption failed for test case {}: {}",
567+
test.tc_id,
568+
test.comment
569+
);
570+
571+
assert_eq!(
572+
actual_tag[..],
573+
test.tag[..],
574+
"Tag mismatch in test case {}: {}",
575+
test.tc_id,
576+
test.comment
577+
);
578+
}
579+
}
580+
581+
let mut decrypted_data = test.ct.to_vec();
582+
let decrypt_result = unsafe {
583+
wc_AesGcmDecrypt(
584+
aes_object.as_ptr(),
585+
decrypted_data.as_mut_ptr(),
586+
test.ct.as_ptr(),
587+
test.ct.len() as word32,
588+
test.nonce.as_ptr(),
589+
test.nonce.len() as word32,
590+
test.tag.as_ptr(),
591+
test.tag.len() as word32,
592+
test.aad.as_ptr(),
593+
test.aad.len() as word32,
594+
)
595+
};
596+
597+
match &test.result {
598+
TestResult::Invalid => {
599+
assert!(
600+
decrypt_result != 0,
601+
"Decryption should have failed for invalid test case {}: {}",
602+
test.tc_id,
603+
test.comment
604+
);
605+
}
606+
TestResult::Valid | TestResult::Acceptable => {
607+
assert_eq!(
608+
decrypt_result, 0,
609+
"Decryption failed for test case {}: {}",
610+
test.tc_id, test.comment
611+
);
612+
assert_eq!(
613+
decrypted_data[..],
614+
test.pt[..],
615+
"Decryption failed for test case {}: {}",
616+
test.tc_id,
617+
test.comment
618+
);
619+
}
620+
}
621+
}
622+
}
623+
624+
assert!(
625+
counter > 50,
626+
"Insufficient number of tests run: {}",
627+
counter
628+
);
629+
}
494630
}

0 commit comments

Comments
 (0)