1 /*
2 * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2018-2020, Oracle and/or its affiliates. All rights reserved.
4 *
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
9 */
10
11 /* Tests of the EVP_KDF_CTX APIs */
12
13 #include <stdio.h>
14 #include <string.h>
15
16 #include <openssl/evp.h>
17 #include <openssl/kdf.h>
18 #include <openssl/core_names.h>
19 #include "internal/numbers.h"
20 #include "testutil.h"
21
get_kdfbyname_libctx(OSSL_LIB_CTX * libctx,const char * name)22 static EVP_KDF_CTX *get_kdfbyname_libctx(OSSL_LIB_CTX *libctx, const char *name)
23 {
24 EVP_KDF *kdf = EVP_KDF_fetch(libctx, name, NULL);
25 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
26
27 EVP_KDF_free(kdf);
28 return kctx;
29 }
30
get_kdfbyname(const char * name)31 static EVP_KDF_CTX *get_kdfbyname(const char *name)
32 {
33 return get_kdfbyname_libctx(NULL, name);
34 }
35
construct_tls1_prf_params(const char * digest,const char * secret,const char * seed)36 static OSSL_PARAM *construct_tls1_prf_params(const char *digest, const char *secret,
37 const char *seed)
38 {
39 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 4);
40 OSSL_PARAM *p = params;
41
42 if (params == NULL)
43 return NULL;
44
45 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
46 (char *)digest, 0);
47 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
48 (unsigned char *)secret,
49 strlen(secret));
50 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
51 (unsigned char *)seed,
52 strlen(seed));
53 *p = OSSL_PARAM_construct_end();
54
55 return params;
56 }
57
test_kdf_tls1_prf(void)58 static int test_kdf_tls1_prf(void)
59 {
60 int ret;
61 EVP_KDF_CTX *kctx = NULL;
62 unsigned char out[16];
63 OSSL_PARAM *params;
64 static const unsigned char expected[sizeof(out)] = {
65 0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
66 0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
67 };
68
69 params = construct_tls1_prf_params("sha256", "secret", "seed");
70
71 ret = TEST_ptr(params)
72 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
73 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
74 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
75
76 EVP_KDF_CTX_free(kctx);
77 OPENSSL_free(params);
78 return ret;
79 }
80
test_kdf_tls1_prf_invalid_digest(void)81 static int test_kdf_tls1_prf_invalid_digest(void)
82 {
83 int ret;
84 EVP_KDF_CTX *kctx = NULL;
85 OSSL_PARAM *params;
86
87 params = construct_tls1_prf_params("blah", "secret", "seed");
88
89 ret = TEST_ptr(params)
90 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
91 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
92
93 EVP_KDF_CTX_free(kctx);
94 OPENSSL_free(params);
95 return ret;
96 }
97
test_kdf_tls1_prf_zero_output_size(void)98 static int test_kdf_tls1_prf_zero_output_size(void)
99 {
100 int ret;
101 EVP_KDF_CTX *kctx = NULL;
102 unsigned char out[16];
103 OSSL_PARAM *params;
104
105 params = construct_tls1_prf_params("sha256", "secret", "seed");
106
107 /* Negative test - derive should fail */
108 ret = TEST_ptr(params)
109 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
110 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
111 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
112
113 EVP_KDF_CTX_free(kctx);
114 OPENSSL_free(params);
115 return ret;
116 }
117
test_kdf_tls1_prf_empty_secret(void)118 static int test_kdf_tls1_prf_empty_secret(void)
119 {
120 int ret;
121 EVP_KDF_CTX *kctx = NULL;
122 unsigned char out[16];
123 OSSL_PARAM *params;
124
125 params = construct_tls1_prf_params("sha256", "", "seed");
126
127 ret = TEST_ptr(params)
128 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
129 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
130
131 EVP_KDF_CTX_free(kctx);
132 OPENSSL_free(params);
133 return ret;
134 }
135
test_kdf_tls1_prf_1byte_secret(void)136 static int test_kdf_tls1_prf_1byte_secret(void)
137 {
138 int ret;
139 EVP_KDF_CTX *kctx = NULL;
140 unsigned char out[16];
141 OSSL_PARAM *params;
142
143 params = construct_tls1_prf_params("sha256", "1", "seed");
144
145 ret = TEST_ptr(params)
146 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
147 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
148
149 EVP_KDF_CTX_free(kctx);
150 OPENSSL_free(params);
151 return ret;
152 }
153
test_kdf_tls1_prf_empty_seed(void)154 static int test_kdf_tls1_prf_empty_seed(void)
155 {
156 int ret;
157 EVP_KDF_CTX *kctx = NULL;
158 unsigned char out[16];
159 OSSL_PARAM *params;
160
161 params = construct_tls1_prf_params("sha256", "secret", "");
162
163 /* Negative test - derive should fail */
164 ret = TEST_ptr(params)
165 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
166 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
167 && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0);
168
169 EVP_KDF_CTX_free(kctx);
170 OPENSSL_free(params);
171 return ret;
172 }
173
test_kdf_tls1_prf_1byte_seed(void)174 static int test_kdf_tls1_prf_1byte_seed(void)
175 {
176 int ret;
177 EVP_KDF_CTX *kctx = NULL;
178 unsigned char out[16];
179 OSSL_PARAM *params;
180
181 params = construct_tls1_prf_params("sha256", "secret", "1");
182
183 ret = TEST_ptr(params)
184 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
185 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
186
187 EVP_KDF_CTX_free(kctx);
188 OPENSSL_free(params);
189 return ret;
190 }
191
construct_hkdf_params(char * digest,char * key,size_t keylen,char * salt,char * info)192 static OSSL_PARAM *construct_hkdf_params(char *digest, char *key,
193 size_t keylen, char *salt, char *info)
194 {
195 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
196 OSSL_PARAM *p = params;
197
198 if (params == NULL)
199 return NULL;
200
201 if (digest != NULL)
202 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
203 digest, 0);
204 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
205 salt, strlen(salt));
206 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
207 (unsigned char *)key, keylen);
208 if (info != NULL)
209 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
210 info, strlen(info));
211 else
212 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
213 "EXTRACT_ONLY", 0);
214 *p = OSSL_PARAM_construct_end();
215
216 return params;
217 }
218
test_kdf_hkdf(void)219 static int test_kdf_hkdf(void)
220 {
221 int ret;
222 EVP_KDF_CTX *kctx = NULL;
223 unsigned char out[10];
224 OSSL_PARAM *params;
225 static const unsigned char expected[sizeof(out)] = {
226 0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
227 };
228
229 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
230
231 ret = TEST_ptr(params)
232 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
233 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
234 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
235
236 EVP_KDF_CTX_free(kctx);
237 OPENSSL_free(params);
238 return ret;
239 }
240
do_kdf_hkdf_gettables(int expand_only,int has_digest)241 static int do_kdf_hkdf_gettables(int expand_only, int has_digest)
242 {
243 int ret = 0;
244 size_t sz = 0;
245 OSSL_PARAM *params;
246 OSSL_PARAM params_get[2];
247 const OSSL_PARAM *gettables, *p;
248 EVP_KDF_CTX *kctx = NULL;
249
250 if (!TEST_ptr(params = construct_hkdf_params(
251 has_digest ? "sha256" : NULL,
252 "secret", 6, "salt",
253 expand_only ? NULL : "label"))
254 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
255 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
256 goto err;
257
258 /* Check OSSL_KDF_PARAM_SIZE is gettable */
259 if (!TEST_ptr(gettables = EVP_KDF_CTX_gettable_params(kctx))
260 || !TEST_ptr(p = OSSL_PARAM_locate_const(gettables, OSSL_KDF_PARAM_SIZE)))
261 goto err;
262
263 /* Get OSSL_KDF_PARAM_SIZE as a size_t */
264 params_get[0] = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_SIZE, &sz);
265 params_get[1] = OSSL_PARAM_construct_end();
266 if (has_digest) {
267 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1)
268 || !TEST_size_t_eq(sz, expand_only ? SHA256_DIGEST_LENGTH : SIZE_MAX))
269 goto err;
270 } else {
271 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 0))
272 goto err;
273 }
274
275 /* Get params returns 1 if an unsupported parameter is requested */
276 params_get[0] = OSSL_PARAM_construct_end();
277 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1))
278 goto err;
279 ret = 1;
280 err:
281 EVP_KDF_CTX_free(kctx);
282 OPENSSL_free(params);
283 return ret;
284 }
285
test_kdf_hkdf_gettables(void)286 static int test_kdf_hkdf_gettables(void)
287 {
288 return do_kdf_hkdf_gettables(0, 1);
289 }
290
test_kdf_hkdf_gettables_expandonly(void)291 static int test_kdf_hkdf_gettables_expandonly(void)
292 {
293 return do_kdf_hkdf_gettables(1, 1);
294 }
295
test_kdf_hkdf_gettables_no_digest(void)296 static int test_kdf_hkdf_gettables_no_digest(void)
297 {
298 return do_kdf_hkdf_gettables(1, 0);
299 }
300
test_kdf_hkdf_invalid_digest(void)301 static int test_kdf_hkdf_invalid_digest(void)
302 {
303 int ret;
304 EVP_KDF_CTX *kctx = NULL;
305 OSSL_PARAM *params;
306
307 params = construct_hkdf_params("blah", "secret", 6, "salt", "label");
308
309 ret = TEST_ptr(params)
310 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
311 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
312
313 EVP_KDF_CTX_free(kctx);
314 OPENSSL_free(params);
315 return ret;
316 }
317
test_kdf_hkdf_derive_set_params_fail(void)318 static int test_kdf_hkdf_derive_set_params_fail(void)
319 {
320 int ret = 0, i = 0;
321 EVP_KDF_CTX *kctx = NULL;
322 OSSL_PARAM params[2];
323 unsigned char out[10];
324
325 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
326 goto end;
327 /*
328 * Set the wrong type for the digest so that it causes a failure
329 * inside kdf_hkdf_derive() when kdf_hkdf_set_ctx_params() is called
330 */
331 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_DIGEST, &i);
332 params[1] = OSSL_PARAM_construct_end();
333 if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), params), 0))
334 goto end;
335 ret = 1;
336 end:
337 EVP_KDF_CTX_free(kctx);
338 return ret;
339 }
340
test_kdf_hkdf_set_invalid_mode(void)341 static int test_kdf_hkdf_set_invalid_mode(void)
342 {
343 int ret = 0, bad_mode = 100;
344 EVP_KDF_CTX *kctx = NULL;
345 OSSL_PARAM params[2];
346
347 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
348 goto end;
349 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
350 "BADMODE", 0);
351 params[1] = OSSL_PARAM_construct_end();
352 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
353 goto end;
354
355 params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &bad_mode);
356 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
357 goto end;
358
359 ret = 1;
360 end:
361 EVP_KDF_CTX_free(kctx);
362 return ret;
363 }
364
do_kdf_hkdf_set_invalid_param(const char * key,int type)365 static int do_kdf_hkdf_set_invalid_param(const char *key, int type)
366 {
367 int ret = 0;
368 EVP_KDF_CTX *kctx = NULL;
369 OSSL_PARAM params[2];
370 unsigned char buf[2];
371
372 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
373 goto end;
374 /* Set the wrong type for the key so that it causes a failure */
375 if (type == OSSL_PARAM_UTF8_STRING)
376 params[0] = OSSL_PARAM_construct_utf8_string(key, "BAD", 0);
377 else
378 params[0] = OSSL_PARAM_construct_octet_string(key, buf, sizeof(buf));
379 params[1] = OSSL_PARAM_construct_end();
380 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
381 goto end;
382
383 ret = 1;
384 end:
385 EVP_KDF_CTX_free(kctx);
386 return ret;
387 }
388
test_kdf_hkdf_set_ctx_param_fail(void)389 static int test_kdf_hkdf_set_ctx_param_fail(void)
390 {
391 return do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_MODE,
392 OSSL_PARAM_OCTET_STRING)
393 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_KEY,
394 OSSL_PARAM_UTF8_STRING)
395 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_SALT,
396 OSSL_PARAM_UTF8_STRING)
397 && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_INFO,
398 OSSL_PARAM_UTF8_STRING);
399 }
400
test_kdf_hkdf_zero_output_size(void)401 static int test_kdf_hkdf_zero_output_size(void)
402 {
403 int ret;
404 EVP_KDF_CTX *kctx = NULL;
405 unsigned char out[10];
406 OSSL_PARAM *params;
407
408 params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
409
410 /* Negative test - derive should fail */
411 ret = TEST_ptr(params)
412 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
413 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
414 && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
415
416 EVP_KDF_CTX_free(kctx);
417 OPENSSL_free(params);
418 return ret;
419 }
420
test_kdf_hkdf_empty_key(void)421 static int test_kdf_hkdf_empty_key(void)
422 {
423 int ret;
424 EVP_KDF_CTX *kctx = NULL;
425 unsigned char out[10];
426 OSSL_PARAM *params;
427
428 params = construct_hkdf_params("sha256", "", 0, "salt", "label");
429
430 ret = TEST_ptr(params)
431 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
432 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
433
434 EVP_KDF_CTX_free(kctx);
435 OPENSSL_free(params);
436 return ret;
437 }
438
test_kdf_hkdf_1byte_key(void)439 static int test_kdf_hkdf_1byte_key(void)
440 {
441 int ret;
442 EVP_KDF_CTX *kctx = NULL;
443 unsigned char out[10];
444 OSSL_PARAM *params;
445
446 params = construct_hkdf_params("sha256", "1", 1, "salt", "label");
447
448 ret = TEST_ptr(params)
449 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
450 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
451
452 EVP_KDF_CTX_free(kctx);
453 OPENSSL_free(params);
454 return ret;
455 }
456
test_kdf_hkdf_empty_salt(void)457 static int test_kdf_hkdf_empty_salt(void)
458 {
459 int ret;
460 EVP_KDF_CTX *kctx = NULL;
461 unsigned char out[10];
462 OSSL_PARAM *params;
463
464 params = construct_hkdf_params("sha256", "secret", 6, "", "label");
465
466 ret = TEST_ptr(params)
467 && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
468 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
469
470 EVP_KDF_CTX_free(kctx);
471 OPENSSL_free(params);
472 return ret;
473 }
474
construct_pbkdf1_params(char * pass,char * digest,char * salt,unsigned int * iter)475 static OSSL_PARAM *construct_pbkdf1_params(char *pass, char *digest, char *salt,
476 unsigned int *iter)
477 {
478 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
479 OSSL_PARAM *p = params;
480
481 if (params == NULL)
482 return NULL;
483
484 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
485 (unsigned char *)pass, strlen(pass));
486 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
487 (unsigned char *)salt, strlen(salt));
488 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
489 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
490 digest, 0);
491 *p = OSSL_PARAM_construct_end();
492
493 return params;
494 }
495
test_kdf_pbkdf1(void)496 static int test_kdf_pbkdf1(void)
497 {
498 int ret = 0;
499 EVP_KDF_CTX *kctx = NULL;
500 unsigned char out[25];
501 unsigned int iterations = 4096;
502 OSSL_LIB_CTX *libctx = NULL;
503 OSSL_PARAM *params = NULL;
504 OSSL_PROVIDER *legacyprov = NULL;
505 OSSL_PROVIDER *defprov = NULL;
506 const unsigned char expected[sizeof(out)] = {
507 0xfb, 0x83, 0x4d, 0x36, 0x6d, 0xbc, 0x53, 0x87, 0x35, 0x1b, 0x34, 0x75,
508 0x95, 0x88, 0x32, 0x4f, 0x3e, 0x82, 0x81, 0x01, 0x21, 0x93, 0x64, 0x00,
509 0xcc
510 };
511
512 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
513 goto err;
514
515 /* PBKDF1 only available in the legacy provider */
516 legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
517 if (legacyprov == NULL) {
518 OSSL_LIB_CTX_free(libctx);
519 return TEST_skip("PBKDF1 only available in legacy provider");
520 }
521
522 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
523 goto err;
524
525 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
526 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
527 &iterations);
528
529 if (!TEST_ptr(params)
530 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
531 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
532 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
533 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
534 goto err;
535
536 ret = 1;
537 err:
538 EVP_KDF_CTX_free(kctx);
539 OPENSSL_free(params);
540 OSSL_PROVIDER_unload(defprov);
541 OSSL_PROVIDER_unload(legacyprov);
542 OSSL_LIB_CTX_free(libctx);
543 return ret;
544 }
545
test_kdf_pbkdf1_key_too_long(void)546 static int test_kdf_pbkdf1_key_too_long(void)
547 {
548 int ret = 0;
549 EVP_KDF_CTX *kctx = NULL;
550 unsigned char out[EVP_MAX_MD_SIZE + 1];
551 unsigned int iterations = 4096;
552 OSSL_LIB_CTX *libctx = NULL;
553 OSSL_PARAM *params = NULL;
554 OSSL_PROVIDER *legacyprov = NULL;
555 OSSL_PROVIDER *defprov = NULL;
556
557 if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
558 goto err;
559
560 /* PBKDF1 only available in the legacy provider */
561 legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
562 if (legacyprov == NULL) {
563 OSSL_LIB_CTX_free(libctx);
564 return TEST_skip("PBKDF1 only available in legacy provider");
565 }
566
567 if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
568 goto err;
569
570 params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
571 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
572 &iterations);
573
574 /*
575 * This is the same test sequence as test_kdf_pbkdf1, but we expect
576 * failure here as the requested key size is longer than the digest
577 * can provide
578 */
579 if (!TEST_ptr(params)
580 || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
581 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
582 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
583 goto err;
584
585 ret = 1;
586 err:
587 EVP_KDF_CTX_free(kctx);
588 OPENSSL_free(params);
589 OSSL_PROVIDER_unload(defprov);
590 OSSL_PROVIDER_unload(legacyprov);
591 OSSL_LIB_CTX_free(libctx);
592 return ret;
593 }
594
construct_pbkdf2_params(char * pass,char * digest,char * salt,unsigned int * iter,int * mode)595 static OSSL_PARAM *construct_pbkdf2_params(char *pass, char *digest, char *salt,
596 unsigned int *iter, int *mode)
597 {
598 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 6);
599 OSSL_PARAM *p = params;
600
601 if (params == NULL)
602 return NULL;
603
604 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
605 (unsigned char *)pass, strlen(pass));
606 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
607 (unsigned char *)salt, strlen(salt));
608 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
609 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
610 digest, 0);
611 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, mode);
612 *p = OSSL_PARAM_construct_end();
613
614 return params;
615 }
616
test_kdf_pbkdf2(void)617 static int test_kdf_pbkdf2(void)
618 {
619 int ret = 0;
620 EVP_KDF_CTX *kctx = NULL;
621 unsigned char out[25];
622 unsigned int iterations = 4096;
623 int mode = 0;
624 OSSL_PARAM *params;
625 const unsigned char expected[sizeof(out)] = {
626 0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
627 0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
628 0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
629 0x1c
630 };
631
632 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
633 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
634 &iterations, &mode);
635
636 if (!TEST_ptr(params)
637 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
638 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
639 || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
640 goto err;
641
642 ret = 1;
643 err:
644 EVP_KDF_CTX_free(kctx);
645 OPENSSL_free(params);
646 return ret;
647 }
648
test_kdf_pbkdf2_small_output(void)649 static int test_kdf_pbkdf2_small_output(void)
650 {
651 int ret = 0;
652 EVP_KDF_CTX *kctx = NULL;
653 unsigned char out[25];
654 unsigned int iterations = 4096;
655 int mode = 0;
656 OSSL_PARAM *params;
657
658 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
659 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
660 &iterations, &mode);
661
662 if (!TEST_ptr(params)
663 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
664 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
665 /* A key length that is too small should fail */
666 || !TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1, NULL), 0))
667 goto err;
668
669 ret = 1;
670 err:
671 EVP_KDF_CTX_free(kctx);
672 OPENSSL_free(params);
673 return ret;
674 }
675
test_kdf_pbkdf2_large_output(void)676 static int test_kdf_pbkdf2_large_output(void)
677 {
678 int ret = 0;
679 EVP_KDF_CTX *kctx = NULL;
680 unsigned char out[25];
681 size_t len = 0;
682 unsigned int iterations = 4096;
683 int mode = 0;
684 OSSL_PARAM *params;
685
686 if (sizeof(len) > 32)
687 len = SIZE_MAX;
688
689 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
690 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
691 &iterations, &mode);
692
693 if (!TEST_ptr(params)
694 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
695 /* A key length that is too large should fail */
696 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
697 || (len != 0 && !TEST_int_eq(EVP_KDF_derive(kctx, out, len, NULL), 0)))
698 goto err;
699
700 ret = 1;
701 err:
702 EVP_KDF_CTX_free(kctx);
703 OPENSSL_free(params);
704 return ret;
705 }
706
test_kdf_pbkdf2_small_salt(void)707 static int test_kdf_pbkdf2_small_salt(void)
708 {
709 int ret = 0;
710 EVP_KDF_CTX *kctx = NULL;
711 unsigned int iterations = 4096;
712 int mode = 0;
713 OSSL_PARAM *params;
714
715 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
716 "saltSALT",
717 &iterations, &mode);
718
719 if (!TEST_ptr(params)
720 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
721 /* A salt that is too small should fail */
722 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
723 goto err;
724
725 ret = 1;
726 err:
727 EVP_KDF_CTX_free(kctx);
728 OPENSSL_free(params);
729 return ret;
730 }
731
test_kdf_pbkdf2_small_iterations(void)732 static int test_kdf_pbkdf2_small_iterations(void)
733 {
734 int ret = 0;
735 EVP_KDF_CTX *kctx = NULL;
736 unsigned int iterations = 1;
737 int mode = 0;
738 OSSL_PARAM *params;
739
740 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
741 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
742 &iterations, &mode);
743
744 if (!TEST_ptr(params)
745 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
746 /* An iteration count that is too small should fail */
747 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
748 goto err;
749
750 ret = 1;
751 err:
752 EVP_KDF_CTX_free(kctx);
753 OPENSSL_free(params);
754 return ret;
755 }
756
test_kdf_pbkdf2_small_salt_pkcs5(void)757 static int test_kdf_pbkdf2_small_salt_pkcs5(void)
758 {
759 int ret = 0;
760 EVP_KDF_CTX *kctx = NULL;
761 unsigned char out[25];
762 unsigned int iterations = 4096;
763 int mode = 1;
764 OSSL_PARAM *params;
765 OSSL_PARAM mode_params[2];
766
767 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
768 "saltSALT",
769 &iterations, &mode);
770
771 if (!TEST_ptr(params)
772 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
773 /* A salt that is too small should pass in pkcs5 mode */
774 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
775 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
776 goto err;
777
778 mode = 0;
779 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
780 mode_params[1] = OSSL_PARAM_construct_end();
781
782 /* If the "pkcs5" mode is disabled then the derive will now fail */
783 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
784 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
785 goto err;
786
787 ret = 1;
788 err:
789 EVP_KDF_CTX_free(kctx);
790 OPENSSL_free(params);
791 return ret;
792 }
793
test_kdf_pbkdf2_small_iterations_pkcs5(void)794 static int test_kdf_pbkdf2_small_iterations_pkcs5(void)
795 {
796 int ret = 0;
797 EVP_KDF_CTX *kctx = NULL;
798 unsigned char out[25];
799 unsigned int iterations = 1;
800 int mode = 1;
801 OSSL_PARAM *params;
802 OSSL_PARAM mode_params[2];
803
804 params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
805 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
806 &iterations, &mode);
807
808 if (!TEST_ptr(params)
809 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
810 /* An iteration count that is too small will pass in pkcs5 mode */
811 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
812 || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
813 goto err;
814
815 mode = 0;
816 mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
817 mode_params[1] = OSSL_PARAM_construct_end();
818
819 /* If the "pkcs5" mode is disabled then the derive will now fail */
820 if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
821 || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
822 goto err;
823
824 ret = 1;
825 err:
826 EVP_KDF_CTX_free(kctx);
827 OPENSSL_free(params);
828 return ret;
829 }
830
test_kdf_pbkdf2_invalid_digest(void)831 static int test_kdf_pbkdf2_invalid_digest(void)
832 {
833 int ret = 0;
834 EVP_KDF_CTX *kctx = NULL;
835 unsigned int iterations = 4096;
836 int mode = 0;
837 OSSL_PARAM *params;
838
839 params = construct_pbkdf2_params("passwordPASSWORDpassword", "blah",
840 "saltSALTsaltSALTsaltSALTsaltSALTsalt",
841 &iterations, &mode);
842
843 if (!TEST_ptr(params)
844 || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
845 /* Unknown digest should fail */
846 || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
847 goto err;
848
849 ret = 1;
850 err:
851 EVP_KDF_CTX_free(kctx);
852 OPENSSL_free(params);
853 return ret;
854 }
855
856 #ifndef OPENSSL_NO_SCRYPT
test_kdf_scrypt(void)857 static int test_kdf_scrypt(void)
858 {
859 int i, ret;
860 EVP_KDF_CTX *kctx;
861 OSSL_PARAM params[7], *p = params;
862 unsigned char out[64];
863 unsigned int nu = 1024, ru = 8, pu = 16, maxmem = 16;
864 static const unsigned char expected[sizeof(out)] = {
865 0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
866 0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
867 0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
868 0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
869 0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
870 0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
871 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
872 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
873 };
874
875 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
876 (char *)"password", 8);
877 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
878 (char *)"NaCl", 4);
879 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_N, &nu);
880 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_R, &ru);
881 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_P, &pu);
882 *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
883 *p = OSSL_PARAM_construct_end();
884
885 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT));
886 for (i = 0; ret && i < 2; ++i) {
887 ret = ret
888 && TEST_true(EVP_KDF_CTX_set_params(kctx, params));
889 if (i == 0)
890 ret = ret
891 && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
892 && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
893 && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1));
894 ret = ret
895 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
896 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
897 if (i == 0)
898 EVP_KDF_CTX_reset(kctx);
899 }
900
901 EVP_KDF_CTX_free(kctx);
902 return ret;
903 }
904 #endif /* OPENSSL_NO_SCRYPT */
905
test_kdf_ss_hash(void)906 static int test_kdf_ss_hash(void)
907 {
908 int ret;
909 EVP_KDF_CTX *kctx;
910 OSSL_PARAM params[4], *p = params;
911 unsigned char out[14];
912 static unsigned char z[] = {
913 0x6d, 0xbd, 0xc2, 0x3f, 0x04, 0x54, 0x88, 0xe4, 0x06, 0x27, 0x57, 0xb0, 0x6b, 0x9e,
914 0xba, 0xe1, 0x83, 0xfc, 0x5a, 0x59, 0x46, 0xd8, 0x0d, 0xb9, 0x3f, 0xec, 0x6f, 0x62,
915 0xec, 0x07, 0xe3, 0x72, 0x7f, 0x01, 0x26, 0xae, 0xd1, 0x2c, 0xe4, 0xb2, 0x62, 0xf4,
916 0x7d, 0x48, 0xd5, 0x42, 0x87, 0xf8, 0x1d, 0x47, 0x4c, 0x7c, 0x3b, 0x18, 0x50, 0xe9
917 };
918 static unsigned char other[] = {
919 0xa1, 0xb2, 0xc3, 0xd4, 0xe5, 0x43, 0x41, 0x56, 0x53, 0x69, 0x64, 0x3c, 0x83, 0x2e,
920 0x98, 0x49, 0xdc, 0xdb, 0xa7, 0x1e, 0x9a, 0x31, 0x39, 0xe6, 0x06, 0xe0, 0x95, 0xde,
921 0x3c, 0x26, 0x4a, 0x66, 0xe9, 0x8a, 0x16, 0x58, 0x54, 0xcd, 0x07, 0x98, 0x9b, 0x1e,
922 0xe0, 0xec, 0x3f, 0x8d, 0xbe
923 };
924 static const unsigned char expected[sizeof(out)] = {
925 0xa4, 0x62, 0xde, 0x16, 0xa8, 0x9d, 0xe8, 0x46, 0x6e, 0xf5, 0x46, 0x0b, 0x47, 0xb8
926 };
927
928 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
929 (char *)"sha224", 0);
930 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
931 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
932 sizeof(other));
933 *p = OSSL_PARAM_construct_end();
934
935 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
936 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
937 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
938
939 EVP_KDF_CTX_free(kctx);
940 return ret;
941 }
942
test_kdf_x963(void)943 static int test_kdf_x963(void)
944 {
945 int ret;
946 EVP_KDF_CTX *kctx;
947 OSSL_PARAM params[4], *p = params;
948 unsigned char out[1024 / 8];
949 /*
950 * Test data from https://csrc.nist.gov/CSRC/media/Projects/
951 * Cryptographic-Algorithm-Validation-Program/documents/components/
952 * 800-135testvectors/ansx963_2001.zip
953 */
954 static unsigned char z[] = {
955 0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad,
956 0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9,
957 0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f,
958 0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f,
959 0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7,
960 0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d
961 };
962 static unsigned char shared[] = {
963 0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99,
964 0x37, 0x89, 0x5d, 0x31
965 };
966 static const unsigned char expected[sizeof(out)] = {
967 0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b,
968 0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8,
969 0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5,
970 0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e,
971 0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee,
972 0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02,
973 0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7,
974 0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd,
975 0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e,
976 0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc,
977 0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16
978 };
979
980 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
981 (char *)"sha512", 0);
982 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
983 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, shared,
984 sizeof(shared));
985 *p = OSSL_PARAM_construct_end();
986
987 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X963KDF))
988 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
989 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
990
991 EVP_KDF_CTX_free(kctx);
992 return ret;
993 }
994
995 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
996 /*
997 * KBKDF test vectors from RFC 6803 (Camellia Encryption for Kerberos 5)
998 * section 10.
999 */
test_kdf_kbkdf_6803_128(void)1000 static int test_kdf_kbkdf_6803_128(void)
1001 {
1002 int ret = 0, i, p;
1003 EVP_KDF_CTX *kctx;
1004 OSSL_PARAM params[7];
1005 static unsigned char input_key[] = {
1006 0x57,
1007 0xD0,
1008 0x29,
1009 0x72,
1010 0x98,
1011 0xFF,
1012 0xD9,
1013 0xD3,
1014 0x5D,
1015 0xE5,
1016 0xA4,
1017 0x7F,
1018 0xB4,
1019 0xBD,
1020 0xE2,
1021 0x4B,
1022 };
1023 static unsigned char constants[][5] = {
1024 { 0x00, 0x00, 0x00, 0x02, 0x99 },
1025 { 0x00, 0x00, 0x00, 0x02, 0xaa },
1026 { 0x00, 0x00, 0x00, 0x02, 0x55 },
1027 };
1028 static unsigned char outputs[][16] = {
1029 { 0xD1, 0x55, 0x77, 0x5A, 0x20, 0x9D, 0x05, 0xF0,
1030 0x2B, 0x38, 0xD4, 0x2A, 0x38, 0x9E, 0x5A, 0x56 },
1031 { 0x64, 0xDF, 0x83, 0xF8, 0x5A, 0x53, 0x2F, 0x17,
1032 0x57, 0x7D, 0x8C, 0x37, 0x03, 0x57, 0x96, 0xAB },
1033 { 0x3E, 0x4F, 0xBD, 0xF3, 0x0F, 0xB8, 0x25, 0x9C,
1034 0x42, 0x5C, 0xB6, 0xC9, 0x6F, 0x1F, 0x46, 0x35 }
1035 };
1036 static unsigned char iv[16] = { 0 };
1037 unsigned char result[16] = { 0 };
1038
1039 for (i = 0; i < 3; i++) {
1040 p = 0;
1041 params[p++] = OSSL_PARAM_construct_utf8_string(
1042 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-128-CBC", 0);
1043 params[p++] = OSSL_PARAM_construct_utf8_string(
1044 OSSL_KDF_PARAM_MAC, "CMAC", 0);
1045 params[p++] = OSSL_PARAM_construct_utf8_string(
1046 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
1047 params[p++] = OSSL_PARAM_construct_octet_string(
1048 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1049 params[p++] = OSSL_PARAM_construct_octet_string(
1050 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
1051 params[p++] = OSSL_PARAM_construct_octet_string(
1052 OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
1053 params[p] = OSSL_PARAM_construct_end();
1054
1055 kctx = get_kdfbyname("KBKDF");
1056 ret = TEST_ptr(kctx)
1057 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
1058 params),
1059 0)
1060 && TEST_mem_eq(result, sizeof(result), outputs[i],
1061 sizeof(outputs[i]));
1062 EVP_KDF_CTX_free(kctx);
1063 if (ret != 1)
1064 return ret;
1065 }
1066
1067 return ret;
1068 }
1069
test_kdf_kbkdf_6803_256(void)1070 static int test_kdf_kbkdf_6803_256(void)
1071 {
1072 int ret = 0, i, p;
1073 EVP_KDF_CTX *kctx;
1074 OSSL_PARAM params[7];
1075 static unsigned char input_key[] = {
1076 0xB9,
1077 0xD6,
1078 0x82,
1079 0x8B,
1080 0x20,
1081 0x56,
1082 0xB7,
1083 0xBE,
1084 0x65,
1085 0x6D,
1086 0x88,
1087 0xA1,
1088 0x23,
1089 0xB1,
1090 0xFA,
1091 0xC6,
1092 0x82,
1093 0x14,
1094 0xAC,
1095 0x2B,
1096 0x72,
1097 0x7E,
1098 0xCF,
1099 0x5F,
1100 0x69,
1101 0xAF,
1102 0xE0,
1103 0xC4,
1104 0xDF,
1105 0x2A,
1106 0x6D,
1107 0x2C,
1108 };
1109 static unsigned char constants[][5] = {
1110 { 0x00, 0x00, 0x00, 0x02, 0x99 },
1111 { 0x00, 0x00, 0x00, 0x02, 0xaa },
1112 { 0x00, 0x00, 0x00, 0x02, 0x55 },
1113 };
1114 static unsigned char outputs[][32] = {
1115 {
1116 0xE4,
1117 0x67,
1118 0xF9,
1119 0xA9,
1120 0x55,
1121 0x2B,
1122 0xC7,
1123 0xD3,
1124 0x15,
1125 0x5A,
1126 0x62,
1127 0x20,
1128 0xAF,
1129 0x9C,
1130 0x19,
1131 0x22,
1132 0x0E,
1133 0xEE,
1134 0xD4,
1135 0xFF,
1136 0x78,
1137 0xB0,
1138 0xD1,
1139 0xE6,
1140 0xA1,
1141 0x54,
1142 0x49,
1143 0x91,
1144 0x46,
1145 0x1A,
1146 0x9E,
1147 0x50,
1148 },
1149 {
1150 0x41,
1151 0x2A,
1152 0xEF,
1153 0xC3,
1154 0x62,
1155 0xA7,
1156 0x28,
1157 0x5F,
1158 0xC3,
1159 0x96,
1160 0x6C,
1161 0x6A,
1162 0x51,
1163 0x81,
1164 0xE7,
1165 0x60,
1166 0x5A,
1167 0xE6,
1168 0x75,
1169 0x23,
1170 0x5B,
1171 0x6D,
1172 0x54,
1173 0x9F,
1174 0xBF,
1175 0xC9,
1176 0xAB,
1177 0x66,
1178 0x30,
1179 0xA4,
1180 0xC6,
1181 0x04,
1182 },
1183 {
1184 0xFA,
1185 0x62,
1186 0x4F,
1187 0xA0,
1188 0xE5,
1189 0x23,
1190 0x99,
1191 0x3F,
1192 0xA3,
1193 0x88,
1194 0xAE,
1195 0xFD,
1196 0xC6,
1197 0x7E,
1198 0x67,
1199 0xEB,
1200 0xCD,
1201 0x8C,
1202 0x08,
1203 0xE8,
1204 0xA0,
1205 0x24,
1206 0x6B,
1207 0x1D,
1208 0x73,
1209 0xB0,
1210 0xD1,
1211 0xDD,
1212 0x9F,
1213 0xC5,
1214 0x82,
1215 0xB0,
1216 },
1217 };
1218 static unsigned char iv[16] = { 0 };
1219 unsigned char result[32] = { 0 };
1220
1221 for (i = 0; i < 3; i++) {
1222 p = 0;
1223 params[p++] = OSSL_PARAM_construct_utf8_string(
1224 OSSL_KDF_PARAM_CIPHER, "CAMELLIA-256-CBC", 0);
1225 params[p++] = OSSL_PARAM_construct_utf8_string(
1226 OSSL_KDF_PARAM_MAC, "CMAC", 0);
1227 params[p++] = OSSL_PARAM_construct_utf8_string(
1228 OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
1229 params[p++] = OSSL_PARAM_construct_octet_string(
1230 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1231 params[p++] = OSSL_PARAM_construct_octet_string(
1232 OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
1233 params[p++] = OSSL_PARAM_construct_octet_string(
1234 OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
1235 params[p] = OSSL_PARAM_construct_end();
1236
1237 kctx = get_kdfbyname("KBKDF");
1238 ret = TEST_ptr(kctx)
1239 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
1240 params),
1241 0)
1242 && TEST_mem_eq(result, sizeof(result), outputs[i],
1243 sizeof(outputs[i]));
1244 EVP_KDF_CTX_free(kctx);
1245 if (ret != 1)
1246 return ret;
1247 }
1248
1249 return ret;
1250 }
1251 #endif
1252
construct_kbkdf_params(char * digest,char * mac,unsigned char * key,size_t keylen,char * salt,char * info,int * r)1253 static OSSL_PARAM *construct_kbkdf_params(char *digest, char *mac, unsigned char *key,
1254 size_t keylen, char *salt, char *info, int *r)
1255 {
1256 OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 8);
1257 OSSL_PARAM *p = params;
1258
1259 if (params == NULL)
1260 return NULL;
1261
1262 *p++ = OSSL_PARAM_construct_utf8_string(
1263 OSSL_KDF_PARAM_DIGEST, digest, 0);
1264 *p++ = OSSL_PARAM_construct_utf8_string(
1265 OSSL_KDF_PARAM_MAC, mac, 0);
1266 *p++ = OSSL_PARAM_construct_utf8_string(
1267 OSSL_KDF_PARAM_MODE, "COUNTER", 0);
1268 *p++ = OSSL_PARAM_construct_octet_string(
1269 OSSL_KDF_PARAM_KEY, key, keylen);
1270 *p++ = OSSL_PARAM_construct_octet_string(
1271 OSSL_KDF_PARAM_SALT, salt, strlen(salt));
1272 *p++ = OSSL_PARAM_construct_octet_string(
1273 OSSL_KDF_PARAM_INFO, info, strlen(info));
1274 *p++ = OSSL_PARAM_construct_int(
1275 OSSL_KDF_PARAM_KBKDF_R, r);
1276 *p = OSSL_PARAM_construct_end();
1277
1278 return params;
1279 }
1280
test_kdf_kbkdf_invalid_digest(void)1281 static int test_kdf_kbkdf_invalid_digest(void)
1282 {
1283 int ret;
1284 EVP_KDF_CTX *kctx;
1285 OSSL_PARAM *params;
1286
1287 static unsigned char key[] = { 0x01 };
1288 int r = 32;
1289
1290 params = construct_kbkdf_params("blah", "HMAC", key, 1, "prf", "test", &r);
1291 if (!TEST_ptr(params))
1292 return 0;
1293
1294 /* Negative test case - set_params should fail */
1295 kctx = get_kdfbyname("KBKDF");
1296 ret = TEST_ptr(kctx)
1297 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1298
1299 EVP_KDF_CTX_free(kctx);
1300 OPENSSL_free(params);
1301 return ret;
1302 }
1303
test_kdf_kbkdf_invalid_mac(void)1304 static int test_kdf_kbkdf_invalid_mac(void)
1305 {
1306 int ret;
1307 EVP_KDF_CTX *kctx;
1308 OSSL_PARAM *params;
1309
1310 static unsigned char key[] = { 0x01 };
1311 int r = 32;
1312
1313 params = construct_kbkdf_params("sha256", "blah", key, 1, "prf", "test", &r);
1314 if (!TEST_ptr(params))
1315 return 0;
1316
1317 /* Negative test case - set_params should fail */
1318 kctx = get_kdfbyname("KBKDF");
1319 ret = TEST_ptr(kctx)
1320 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1321
1322 EVP_KDF_CTX_free(kctx);
1323 OPENSSL_free(params);
1324 return ret;
1325 }
1326
test_kdf_kbkdf_invalid_r(void)1327 static int test_kdf_kbkdf_invalid_r(void)
1328 {
1329 int ret;
1330 EVP_KDF_CTX *kctx;
1331 OSSL_PARAM *params;
1332
1333 static unsigned char key[] = { 0x01 };
1334 int r = 31;
1335
1336 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
1337 if (!TEST_ptr(params))
1338 return 0;
1339
1340 /* Negative test case - derive should fail */
1341 kctx = get_kdfbyname("KBKDF");
1342 ret = TEST_ptr(kctx)
1343 && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1344
1345 EVP_KDF_CTX_free(kctx);
1346 OPENSSL_free(params);
1347 return ret;
1348 }
1349
test_kdf_kbkdf_empty_key(void)1350 static int test_kdf_kbkdf_empty_key(void)
1351 {
1352 int ret;
1353 EVP_KDF_CTX *kctx;
1354 OSSL_PARAM *params;
1355
1356 static unsigned char key[] = { 0x01 };
1357 unsigned char result[32] = { 0 };
1358 int r = 32;
1359
1360 params = construct_kbkdf_params("sha256", "HMAC", key, 0, "prf", "test", &r);
1361 if (!TEST_ptr(params))
1362 return 0;
1363
1364 /* Negative test case - derive should fail */
1365 kctx = get_kdfbyname("KBKDF");
1366 ret = TEST_ptr(kctx)
1367 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1368 && TEST_int_eq(EVP_KDF_derive(kctx, result, sizeof(result), NULL), 0);
1369
1370 EVP_KDF_CTX_free(kctx);
1371 OPENSSL_free(params);
1372 return ret;
1373 }
1374
test_kdf_kbkdf_1byte_key(void)1375 static int test_kdf_kbkdf_1byte_key(void)
1376 {
1377 int ret;
1378 EVP_KDF_CTX *kctx;
1379 OSSL_PARAM *params;
1380
1381 static unsigned char key[] = { 0x01 };
1382 unsigned char result[32] = { 0 };
1383 int r = 32;
1384
1385 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
1386 if (!TEST_ptr(params))
1387 return 0;
1388
1389 kctx = get_kdfbyname("KBKDF");
1390 ret = TEST_ptr(kctx)
1391 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0);
1392
1393 EVP_KDF_CTX_free(kctx);
1394 OPENSSL_free(params);
1395 return ret;
1396 }
1397
test_kdf_kbkdf_zero_output_size(void)1398 static int test_kdf_kbkdf_zero_output_size(void)
1399 {
1400 int ret;
1401 EVP_KDF_CTX *kctx;
1402 OSSL_PARAM *params;
1403
1404 static unsigned char key[] = { 0x01 };
1405 unsigned char result[32] = { 0 };
1406 int r = 32;
1407
1408 params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test", &r);
1409 if (!TEST_ptr(params))
1410 return 0;
1411
1412 /* Negative test case - derive should fail */
1413 kctx = get_kdfbyname("KBKDF");
1414 ret = TEST_ptr(kctx)
1415 && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1416 && TEST_int_eq(EVP_KDF_derive(kctx, result, 0, NULL), 0);
1417
1418 EVP_KDF_CTX_free(kctx);
1419 OPENSSL_free(params);
1420 return ret;
1421 }
1422
1423 /* Two test vectors from RFC 8009 (AES Encryption with HMAC-SHA2 for Kerberos
1424 * 5) appendix A. */
test_kdf_kbkdf_8009_prf1(void)1425 static int test_kdf_kbkdf_8009_prf1(void)
1426 {
1427 int ret, i = 0;
1428 EVP_KDF_CTX *kctx;
1429 OSSL_PARAM params[6];
1430 char *label = "prf", *digest = "sha256", *prf_input = "test",
1431 *mac = "HMAC";
1432 static unsigned char input_key[] = {
1433 0x37,
1434 0x05,
1435 0xD9,
1436 0x60,
1437 0x80,
1438 0xC1,
1439 0x77,
1440 0x28,
1441 0xA0,
1442 0xE8,
1443 0x00,
1444 0xEA,
1445 0xB6,
1446 0xE0,
1447 0xD2,
1448 0x3C,
1449 };
1450 static unsigned char output[] = {
1451 0x9D,
1452 0x18,
1453 0x86,
1454 0x16,
1455 0xF6,
1456 0x38,
1457 0x52,
1458 0xFE,
1459 0x86,
1460 0x91,
1461 0x5B,
1462 0xB8,
1463 0x40,
1464 0xB4,
1465 0xA8,
1466 0x86,
1467 0xFF,
1468 0x3E,
1469 0x6B,
1470 0xB0,
1471 0xF8,
1472 0x19,
1473 0xB4,
1474 0x9B,
1475 0x89,
1476 0x33,
1477 0x93,
1478 0xD3,
1479 0x93,
1480 0x85,
1481 0x42,
1482 0x95,
1483 };
1484 unsigned char result[sizeof(output)] = { 0 };
1485
1486 params[i++] = OSSL_PARAM_construct_utf8_string(
1487 OSSL_KDF_PARAM_DIGEST, digest, 0);
1488 params[i++] = OSSL_PARAM_construct_utf8_string(
1489 OSSL_KDF_PARAM_MAC, mac, 0);
1490 params[i++] = OSSL_PARAM_construct_octet_string(
1491 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1492 params[i++] = OSSL_PARAM_construct_octet_string(
1493 OSSL_KDF_PARAM_SALT, label, strlen(label));
1494 params[i++] = OSSL_PARAM_construct_octet_string(
1495 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1496 params[i] = OSSL_PARAM_construct_end();
1497
1498 kctx = get_kdfbyname("KBKDF");
1499 ret = TEST_ptr(kctx)
1500 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1501 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1502
1503 EVP_KDF_CTX_free(kctx);
1504 return ret;
1505 }
1506
test_kdf_kbkdf_8009_prf2(void)1507 static int test_kdf_kbkdf_8009_prf2(void)
1508 {
1509 int ret, i = 0;
1510 EVP_KDF_CTX *kctx;
1511 OSSL_PARAM params[6];
1512 char *label = "prf", *digest = "sha384", *prf_input = "test",
1513 *mac = "HMAC";
1514 static unsigned char input_key[] = {
1515 0x6D,
1516 0x40,
1517 0x4D,
1518 0x37,
1519 0xFA,
1520 0xF7,
1521 0x9F,
1522 0x9D,
1523 0xF0,
1524 0xD3,
1525 0x35,
1526 0x68,
1527 0xD3,
1528 0x20,
1529 0x66,
1530 0x98,
1531 0x00,
1532 0xEB,
1533 0x48,
1534 0x36,
1535 0x47,
1536 0x2E,
1537 0xA8,
1538 0xA0,
1539 0x26,
1540 0xD1,
1541 0x6B,
1542 0x71,
1543 0x82,
1544 0x46,
1545 0x0C,
1546 0x52,
1547 };
1548 static unsigned char output[] = {
1549 0x98,
1550 0x01,
1551 0xF6,
1552 0x9A,
1553 0x36,
1554 0x8C,
1555 0x2B,
1556 0xF6,
1557 0x75,
1558 0xE5,
1559 0x95,
1560 0x21,
1561 0xE1,
1562 0x77,
1563 0xD9,
1564 0xA0,
1565 0x7F,
1566 0x67,
1567 0xEF,
1568 0xE1,
1569 0xCF,
1570 0xDE,
1571 0x8D,
1572 0x3C,
1573 0x8D,
1574 0x6F,
1575 0x6A,
1576 0x02,
1577 0x56,
1578 0xE3,
1579 0xB1,
1580 0x7D,
1581 0xB3,
1582 0xC1,
1583 0xB6,
1584 0x2A,
1585 0xD1,
1586 0xB8,
1587 0x55,
1588 0x33,
1589 0x60,
1590 0xD1,
1591 0x73,
1592 0x67,
1593 0xEB,
1594 0x15,
1595 0x14,
1596 0xD2,
1597 };
1598 unsigned char result[sizeof(output)] = { 0 };
1599
1600 params[i++] = OSSL_PARAM_construct_utf8_string(
1601 OSSL_KDF_PARAM_DIGEST, digest, 0);
1602 params[i++] = OSSL_PARAM_construct_utf8_string(
1603 OSSL_KDF_PARAM_MAC, mac, 0);
1604 params[i++] = OSSL_PARAM_construct_octet_string(
1605 OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1606 params[i++] = OSSL_PARAM_construct_octet_string(
1607 OSSL_KDF_PARAM_SALT, label, strlen(label));
1608 params[i++] = OSSL_PARAM_construct_octet_string(
1609 OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1610 params[i] = OSSL_PARAM_construct_end();
1611
1612 kctx = get_kdfbyname("KBKDF");
1613 ret = TEST_ptr(kctx)
1614 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1615 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1616
1617 EVP_KDF_CTX_free(kctx);
1618 return ret;
1619 }
1620
1621 #if !defined(OPENSSL_NO_CMAC)
1622 /*
1623 * Test vector taken from
1624 * https://csrc.nist.gov/CSRC/media/Projects/
1625 * Cryptographic-Algorithm-Validation-Program/documents/KBKDF800-108/CounterMode.zip
1626 */
test_kdf_kbkdf_fixedinfo(void)1627 static int test_kdf_kbkdf_fixedinfo(void)
1628 {
1629 int ret;
1630 EVP_KDF_CTX *kctx;
1631 OSSL_PARAM params[8], *p = params;
1632 static char *cipher = "AES128";
1633 static char *mac = "CMAC";
1634 static char *mode = "COUNTER";
1635 int use_l = 0;
1636 int use_separator = 0;
1637
1638 static unsigned char input_key[] = {
1639 0xc1,
1640 0x0b,
1641 0x15,
1642 0x2e,
1643 0x8c,
1644 0x97,
1645 0xb7,
1646 0x7e,
1647 0x18,
1648 0x70,
1649 0x4e,
1650 0x0f,
1651 0x0b,
1652 0xd3,
1653 0x83,
1654 0x05,
1655 };
1656 static unsigned char fixed_input[] = {
1657 0x98,
1658 0xcd,
1659 0x4c,
1660 0xbb,
1661 0xbe,
1662 0xbe,
1663 0x15,
1664 0xd1,
1665 0x7d,
1666 0xc8,
1667 0x6e,
1668 0x6d,
1669 0xba,
1670 0xd8,
1671 0x00,
1672 0xa2,
1673 0xdc,
1674 0xbd,
1675 0x64,
1676 0xf7,
1677 0xc7,
1678 0xad,
1679 0x0e,
1680 0x78,
1681 0xe9,
1682 0xcf,
1683 0x94,
1684 0xff,
1685 0xdb,
1686 0xa8,
1687 0x9d,
1688 0x03,
1689 0xe9,
1690 0x7e,
1691 0xad,
1692 0xf6,
1693 0xc4,
1694 0xf7,
1695 0xb8,
1696 0x06,
1697 0xca,
1698 0xf5,
1699 0x2a,
1700 0xa3,
1701 0x8f,
1702 0x09,
1703 0xd0,
1704 0xeb,
1705 0x71,
1706 0xd7,
1707 0x1f,
1708 0x49,
1709 0x7b,
1710 0xcc,
1711 0x69,
1712 0x06,
1713 0xb4,
1714 0x8d,
1715 0x36,
1716 0xc4,
1717
1718 };
1719 static unsigned char output[] = {
1720 0x26,
1721 0xfa,
1722 0xf6,
1723 0x19,
1724 0x08,
1725 0xad,
1726 0x9e,
1727 0xe8,
1728 0x81,
1729 0xb8,
1730 0x30,
1731 0x5c,
1732 0x22,
1733 0x1d,
1734 0xb5,
1735 0x3f,
1736 };
1737 unsigned char result[sizeof(output)] = { 0 };
1738
1739 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
1740 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
1741 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, mode, 0);
1742 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, input_key,
1743 sizeof(input_key));
1744 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
1745 fixed_input, sizeof(fixed_input));
1746 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &use_l);
1747 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR,
1748 &use_separator);
1749 *p = OSSL_PARAM_construct_end();
1750
1751 kctx = get_kdfbyname("KBKDF");
1752 ret = TEST_ptr(kctx)
1753 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1754 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1755
1756 EVP_KDF_CTX_free(kctx);
1757 return ret;
1758 }
1759 #endif /* OPENSSL_NO_CMAC */
1760
test_kdf_kbkdf_kmac(void)1761 static int test_kdf_kbkdf_kmac(void)
1762 {
1763 int ret;
1764 EVP_KDF_CTX *kctx;
1765 OSSL_PARAM params[5], *p = params;
1766 static char *mac = "KMAC256";
1767
1768 static unsigned char input_key[] = {
1769 0xDD, 0x81, 0xEF, 0xC8, 0x2C, 0xDD, 0xEC, 0x51,
1770 0xC4, 0x09, 0xBD, 0x8C, 0xCB, 0xAF, 0x94, 0xF6,
1771 0x5F, 0xFA, 0x7B, 0x92, 0xF1, 0x11, 0xF9, 0x40,
1772 0x2B, 0x0D, 0x6A, 0xE0, 0x5E, 0x44, 0x92, 0x34,
1773 0xF0, 0x3B, 0xBA, 0xF5, 0x4F, 0xEF, 0x19, 0x45,
1774 0xDA
1775 };
1776 static unsigned char context[] = {
1777 0x81, 0xA1, 0xFE, 0x39, 0x91, 0xEE, 0x3F, 0xD3,
1778 0x90, 0x4E, 0x82, 0xE6, 0x13, 0x20, 0xEC, 0x6B,
1779 0x6E, 0x14, 0x0B, 0xBA, 0x95, 0x5D, 0x0B, 0x52,
1780 0x8E, 0x27, 0x67, 0xB3, 0xE0, 0x77, 0x05, 0x15,
1781 0xBD, 0x78, 0xF6, 0xE8, 0x8A, 0x7D, 0x9B, 0x08,
1782 0x20, 0x0F, 0xE9, 0x8D, 0xD6, 0x24, 0x67, 0xE2,
1783 0xCC, 0x6D, 0x42, 0xE6, 0x60, 0x50, 0x20, 0x77,
1784 0x89, 0x89, 0xB7, 0x2D, 0xF7, 0x5F, 0xE2, 0x79,
1785 0xDB, 0x58, 0x0B, 0x7B, 0x02, 0xB9, 0xD9, 0xB0,
1786 0xFA, 0x6B, 0x0B, 0xB6, 0xD4, 0x95, 0xDB, 0x46,
1787 0x55, 0x5F, 0x12, 0xC3, 0xF0, 0xE0, 0x6E, 0xC8,
1788 0xF4, 0xF8, 0xA1, 0x64, 0x2E, 0x96, 0x74, 0x2B,
1789 0xC6, 0xBD, 0x22, 0xB1, 0x6A, 0xBC, 0x41, 0xDF,
1790 0x30, 0x32, 0xC7, 0xCE, 0x18, 0x14, 0x70, 0x2A,
1791 0xED, 0xE5, 0xC4, 0x6B, 0x8A, 0xA8, 0x36, 0xFD,
1792 0x0A, 0x76, 0x38, 0x44, 0x98, 0x0A, 0xE3, 0xC2,
1793 0x3A, 0x24, 0xCB, 0x45, 0xBF, 0xC9, 0x2C, 0x19,
1794 0xCB, 0x9D, 0x6C, 0x27, 0xDE, 0x78, 0x3E, 0x2C,
1795 0x3D, 0x39, 0x6E, 0x11, 0x59, 0xAE, 0x4F, 0x91,
1796 0x03, 0xE2, 0x7B, 0x97, 0xD6, 0x0C, 0x7D, 0x9D,
1797 0x5A, 0xA5, 0x47, 0x57, 0x41, 0xAD, 0x64, 0x5B,
1798 0xF7, 0x1D, 0x1A, 0xDA, 0x3A, 0x39, 0xDF, 0x85,
1799 0x0D, 0x0F, 0x50, 0x15, 0xA7, 0x3D, 0x68, 0x81,
1800 0x7B, 0x0D, 0xF2, 0x24, 0x24, 0x23, 0x37, 0xE5,
1801 0x77, 0xA6, 0x61, 0xBE, 0xFE, 0x4B, 0x3B, 0x8E,
1802 0x4F, 0x15, 0x4F, 0xC1, 0x30, 0xCB, 0x9E, 0xF5,
1803 0x06, 0x9F, 0xBB, 0x0E, 0xF2, 0xF4, 0x43, 0xBB,
1804 0x64, 0x45, 0xA3, 0x7D, 0x3B, 0xB4, 0x70, 0x47,
1805 0xDF, 0x4A, 0xA5, 0xD9, 0x2F, 0xE6, 0x25, 0xC8,
1806 0x1D, 0x43, 0x0A, 0xEA, 0xF9, 0xCC, 0xC7, 0x1F,
1807 0x8A, 0x2D, 0xD8, 0x95, 0x6B, 0x16, 0x30, 0x1D,
1808 0x80, 0x90, 0xA4, 0x23, 0x14, 0x59, 0xD1, 0x5A,
1809 0x00, 0x48, 0x8D, 0xF7, 0xEA, 0x29, 0x23, 0xDF,
1810 0x35, 0x26, 0x25, 0x22, 0x12, 0xC4, 0x4C, 0x09,
1811 0x69, 0xB8, 0xD6, 0x0C, 0x0E, 0x71, 0x90, 0x6C,
1812 0x42, 0x90, 0x02, 0x53, 0xC5, 0x5A, 0xEF, 0x42,
1813 0x66, 0x1D, 0xAF, 0x45, 0xD5, 0x31, 0xD7, 0x61,
1814 0x3A, 0xE6, 0x06, 0xFB, 0x83, 0x72, 0xAD, 0x82,
1815 0xE3, 0x6A, 0x7E, 0x03, 0x9B, 0x37, 0x77, 0xAF,
1816 0x8D, 0x63, 0x28, 0xC2, 0x8A, 0x5E, 0xC6, 0x3B,
1817 0x22, 0xA8, 0x94, 0xC0, 0x46, 0x2F, 0x73, 0xE7,
1818 0xBB, 0x72, 0x44, 0x85, 0x20, 0x1D, 0xD0, 0x6A,
1819 0x52, 0x8C, 0xB1, 0x8B, 0x96, 0x11, 0xEB, 0xFB,
1820 0xDD, 0xF5, 0x74, 0x49, 0x19, 0x93, 0xD3, 0x7F,
1821 0x6C, 0x27, 0x19, 0x54, 0xDD, 0x00, 0x0F, 0x95,
1822 0xF6, 0x14, 0x15, 0x87, 0x32, 0x54, 0xA5, 0x02,
1823 0xAD, 0x41, 0x55, 0x5E, 0xDD, 0x32, 0x62, 0x3B,
1824 0xFC, 0x71, 0xC1, 0x56, 0xC4, 0x6A, 0xFC, 0xD0,
1825 0xF9, 0x77, 0xDA, 0xC5, 0x20, 0x7D, 0xAC, 0xA8,
1826 0xEB, 0x8F, 0xBE, 0xF9, 0x4D, 0xE8, 0x6D, 0x9E,
1827 0x4C, 0x39, 0xB3, 0x15, 0x63, 0xCD, 0xF6, 0x46,
1828 0xEC, 0x3A, 0xD2, 0x89, 0xA9, 0xFA, 0x24, 0xB4,
1829 0x0E, 0x62, 0x6F, 0x9F, 0xF3, 0xF1, 0x3C, 0x61,
1830 0x57, 0xB9, 0x2C, 0xD4, 0x78, 0x4F, 0x76, 0xCF,
1831 0xFB, 0x6A, 0x51, 0xE8, 0x1E, 0x0A, 0x33, 0x69,
1832 0x16, 0xCD, 0xB7, 0x5C, 0xDF, 0x03, 0x62, 0x17,
1833 0x63, 0x37, 0x49, 0xC3, 0xB7, 0x68, 0x09, 0x9E,
1834 0x22, 0xD2, 0x20, 0x96, 0x37, 0x0D, 0x13, 0xA4,
1835 0x96, 0xB1, 0x8D, 0x0B, 0x12, 0x87, 0xEB, 0x57,
1836 0x25, 0x27, 0x08, 0xFC, 0x90, 0x5E, 0x33, 0x77,
1837 0x50, 0x63, 0xE1, 0x8C, 0xF4, 0x0C, 0x80, 0x89,
1838 0x76, 0x63, 0x70, 0x0A, 0x61, 0x59, 0x90, 0x1F,
1839 0xC9, 0x47, 0xBA, 0x12, 0x7B, 0xB2, 0x7A, 0x44,
1840 0xC3, 0x3D, 0xD0, 0x38, 0xF1, 0x7F, 0x02, 0x92
1841 };
1842 static unsigned char label[] = {
1843 0xA5, 0xDE, 0x2A, 0x0A, 0xF0, 0xDA, 0x59, 0x04,
1844 0xCC, 0xFF, 0x50, 0xD3, 0xA5, 0xD2, 0xDE, 0xA3,
1845 0x33, 0xC0, 0x27, 0xED, 0xDC, 0x6A, 0x54, 0x54,
1846 0x95, 0x78, 0x74, 0x0D, 0xE7, 0xB7, 0x92, 0xD6,
1847 0x64, 0xD5, 0xFB, 0x1F, 0x0F, 0x87, 0xFD, 0x65,
1848 0x79, 0x8B, 0x81, 0x83, 0x95, 0x40, 0x7A, 0x19,
1849 0x8D, 0xCA, 0xE0, 0x4A, 0x93, 0xA8
1850 };
1851 static unsigned char output[] = {
1852 0xB5, 0x61, 0xE3, 0x7D, 0x06, 0xD5, 0x34, 0x80,
1853 0x74, 0x61, 0x16, 0x08, 0x6F, 0x89, 0x6F, 0xB1,
1854 0x43, 0xAF, 0x61, 0x28, 0x93, 0xD8, 0xDF, 0xF6,
1855 0xB6, 0x23, 0x43, 0x68, 0xE4, 0x84, 0xF3, 0xED,
1856 0x50, 0xB6, 0x81, 0x6D, 0x50, 0xF4, 0xAF, 0xF2,
1857 0xA5, 0x50, 0x7E, 0x25, 0xBF, 0x05, 0xBE, 0xE7,
1858 0x07, 0xB0, 0x95, 0xC3, 0x04, 0x38, 0xB4, 0xF9,
1859 0xC1, 0x1E, 0x96, 0x08, 0xF4, 0xC9, 0x05, 0x54,
1860 0x4A, 0xB6, 0x81, 0x92, 0x5B, 0x34, 0x8A, 0x45,
1861 0xDD, 0x7D, 0x98, 0x51, 0x1F, 0xD9, 0x90, 0x23,
1862 0x59, 0x97, 0xA2, 0x4E, 0x43, 0x49, 0xEB, 0x4E,
1863 0x86, 0xEC, 0x20, 0x3C, 0x31, 0xFF, 0x49, 0x55,
1864 0x49, 0xF5, 0xF5, 0x16, 0x79, 0xD9, 0x1C, 0x8E,
1865 0x6E, 0xB3, 0x1C, 0xAF, 0xC8, 0xAB, 0x3A, 0x5A,
1866 0xCE, 0xB1, 0xBD, 0x59, 0x69, 0xEE, 0xC0, 0x28,
1867 0x3E, 0x94, 0xD2, 0xCC, 0x91, 0x93, 0x73, 0x6A,
1868 0xD6, 0xB6, 0xC1, 0x42, 0x97, 0xB1, 0x13, 0xCF,
1869 0xF9, 0x55, 0x35, 0x50, 0xFC, 0x86, 0x75, 0x98,
1870 0x9F, 0xFC, 0x96, 0xB1, 0x43, 0x41, 0x8F, 0xFC,
1871 0x31, 0x09, 0x3B, 0x35, 0x22, 0x7B, 0x01, 0x96,
1872 0xA7, 0xF0, 0x78, 0x7B, 0x57, 0x00, 0xF2, 0xE5,
1873 0x92, 0x36, 0xCE, 0x64, 0xFD, 0x65, 0x09, 0xD8,
1874 0xBC, 0x5C, 0x82, 0x5C, 0x4C, 0x62, 0x5B, 0xCE,
1875 0x09, 0xB6, 0xCF, 0x4D, 0xAD, 0x8E, 0xDD, 0x96,
1876 0xB0, 0xCA, 0x52, 0xC1, 0xF4, 0x17, 0x0E, 0x2D,
1877 0x4E, 0xC3, 0xF9, 0x89, 0x1A, 0x24, 0x3D, 0x01,
1878 0xC8, 0x05, 0xBF, 0x7D, 0x2A, 0x46, 0xCD, 0x9A,
1879 0x66, 0xEE, 0x05, 0x78, 0x88, 0x2A, 0xEF, 0x37,
1880 0x9E, 0x72, 0x55, 0xDA, 0x82, 0x7A, 0x9B, 0xE8,
1881 0xF7, 0xA6, 0x74, 0xB8, 0x74, 0x39, 0x03, 0xE8,
1882 0xB9, 0x1F, 0x97, 0x78, 0xB9, 0xD9, 0x37, 0x16,
1883 0xFD, 0x2F, 0x31, 0xDE, 0xCC, 0x06, 0xD6, 0x5A,
1884 0xEB, 0xD1, 0xBB, 0x84, 0x30, 0x16, 0x81, 0xB0,
1885 0x7E, 0x04, 0x8C, 0x06, 0x67, 0xD1, 0x8A, 0x07,
1886 0x33, 0x76, 0x42, 0x8E, 0x87, 0xAB, 0x90, 0x6F,
1887 0x08, 0xED, 0x8D, 0xE8, 0xD0, 0x20, 0x00, 0x7E,
1888 0x3C, 0x4D, 0xA4, 0x40, 0x37, 0x13, 0x0F, 0x00,
1889 0x0C, 0xB7, 0x26, 0x03, 0x93, 0xD0, 0xBB, 0x08,
1890 0xD3, 0xCC, 0xA9, 0x28, 0xC2
1891 };
1892 unsigned char result[sizeof(output)] = { 0 };
1893
1894 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
1895 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
1896 input_key, sizeof(input_key));
1897 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
1898 context, sizeof(context));
1899 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
1900 label, sizeof(label));
1901 *p = OSSL_PARAM_construct_end();
1902
1903 kctx = get_kdfbyname("KBKDF");
1904 ret = TEST_ptr(kctx)
1905 && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX)
1906 && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1907 && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1908
1909 EVP_KDF_CTX_free(kctx);
1910 return ret;
1911 }
1912
test_kdf_ss_hmac(void)1913 static int test_kdf_ss_hmac(void)
1914 {
1915 int ret;
1916 EVP_KDF_CTX *kctx;
1917 OSSL_PARAM params[6], *p = params;
1918 unsigned char out[16];
1919 static unsigned char z[] = {
1920 0xb7, 0x4a, 0x14, 0x9a, 0x16, 0x15, 0x46, 0xf8, 0xc2, 0x0b, 0x06, 0xac, 0x4e, 0xd4
1921 };
1922 static unsigned char other[] = {
1923 0x34, 0x8a, 0x37, 0xa2, 0x7e, 0xf1, 0x28, 0x2f, 0x5f, 0x02, 0x0d, 0xcc
1924 };
1925 static unsigned char salt[] = {
1926 0x36, 0x38, 0x27, 0x1c, 0xcd, 0x68, 0xa2, 0x5d, 0xc2, 0x4e, 0xcd, 0xdd, 0x39, 0xef,
1927 0x3f, 0x89
1928 };
1929 static const unsigned char expected[sizeof(out)] = {
1930 0x44, 0xf6, 0x76, 0xe8, 0x5c, 0x1b, 0x1a, 0x8b, 0xbc, 0x3d, 0x31, 0x92, 0x18, 0x63,
1931 0x1c, 0xa3
1932 };
1933
1934 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1935 (char *)OSSL_MAC_NAME_HMAC, 0);
1936 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1937 (char *)"sha256", 0);
1938 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1939 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1940 sizeof(other));
1941 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1942 sizeof(salt));
1943 *p = OSSL_PARAM_construct_end();
1944
1945 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1946 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1947 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1948
1949 EVP_KDF_CTX_free(kctx);
1950 return ret;
1951 }
1952
test_kdf_ss_kmac(void)1953 static int test_kdf_ss_kmac(void)
1954 {
1955 int ret;
1956 EVP_KDF_CTX *kctx;
1957 OSSL_PARAM params[7], *p = params;
1958 unsigned char out[64];
1959 size_t mac_size = 20;
1960 static unsigned char z[] = {
1961 0xb7, 0x4a, 0x14, 0x9a, 0x16, 0x15, 0x46, 0xf8, 0xc2, 0x0b, 0x06, 0xac, 0x4e, 0xd4
1962 };
1963 static unsigned char other[] = {
1964 0x34, 0x8a, 0x37, 0xa2, 0x7e, 0xf1, 0x28, 0x2f, 0x5f, 0x02, 0x0d, 0xcc
1965 };
1966 static unsigned char salt[] = {
1967 0x36, 0x38, 0x27, 0x1c, 0xcd, 0x68, 0xa2, 0x5d, 0xc2, 0x4e, 0xcd, 0xdd, 0x39, 0xef,
1968 0x3f, 0x89
1969 };
1970 static const unsigned char expected[sizeof(out)] = {
1971 0xe9, 0xc1, 0x84, 0x53, 0xa0, 0x62, 0xb5, 0x3b, 0xdb, 0xfc, 0xbb, 0x5a, 0x34, 0xbd,
1972 0xb8, 0xe5, 0xe7, 0x07, 0xee, 0xbb, 0x5d, 0xd1, 0x34, 0x42, 0x43, 0xd8, 0xcf, 0xc2,
1973 0xc2, 0xe6, 0x33, 0x2f, 0x91, 0xbd, 0xa5, 0x86, 0xf3, 0x7d, 0xe4, 0x8a, 0x65, 0xd4,
1974 0xc5, 0x14, 0xfd, 0xef, 0xaa, 0x1e, 0x67, 0x54, 0xf3, 0x73, 0xd2, 0x38, 0xe1, 0x95,
1975 0xae, 0x15, 0x7e, 0x1d, 0xe8, 0x14, 0x98, 0x03
1976 };
1977
1978 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1979 (char *)OSSL_MAC_NAME_KMAC128, 0);
1980 /* The digest parameter is not needed here and should be ignored */
1981 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1982 (char *)"SHA256", 0);
1983 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1984 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1985 sizeof(other));
1986 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1987 sizeof(salt));
1988 *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, &mac_size);
1989 *p = OSSL_PARAM_construct_end();
1990
1991 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1992 && TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), 0)
1993 && TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1)
1994 /* The bug fix for KMAC returning SIZE_MAX was added in 3.0.8 */
1995 && (fips_provider_version_lt(NULL, 3, 0, 8)
1996 || TEST_size_t_eq(EVP_KDF_CTX_get_kdf_size(kctx), SIZE_MAX))
1997 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
1998 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1999
2000 EVP_KDF_CTX_free(kctx);
2001 return ret;
2002 }
2003
test_kdf_sshkdf(void)2004 static int test_kdf_sshkdf(void)
2005 {
2006 int ret;
2007 EVP_KDF_CTX *kctx;
2008 OSSL_PARAM params[6], *p = params;
2009 char kdftype = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
2010 unsigned char out[8];
2011 /* Test data from NIST CAVS 14.1 test vectors */
2012 static unsigned char key[] = {
2013 0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
2014 0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
2015 0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
2016 0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
2017 0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
2018 0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
2019 0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
2020 0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
2021 0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
2022 0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
2023 0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
2024 0x4e
2025 };
2026 static unsigned char xcghash[] = {
2027 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
2028 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
2029 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
2030 };
2031 static unsigned char sessid[] = {
2032 0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
2033 0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
2034 0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
2035 };
2036 static const unsigned char expected[sizeof(out)] = {
2037 0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
2038 };
2039
2040 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
2041 (char *)"sha256", 0);
2042 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
2043 sizeof(key));
2044 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_XCGHASH,
2045 xcghash, sizeof(xcghash));
2046 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
2047 sessid, sizeof(sessid));
2048 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE,
2049 &kdftype, sizeof(kdftype));
2050 *p = OSSL_PARAM_construct_end();
2051
2052 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSHKDF))
2053 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
2054 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
2055
2056 EVP_KDF_CTX_free(kctx);
2057 return ret;
2058 }
2059
test_kdfs_same(EVP_KDF * kdf1,EVP_KDF * kdf2)2060 static int test_kdfs_same(EVP_KDF *kdf1, EVP_KDF *kdf2)
2061 {
2062 /* Fast path in case the two are the same algorithm pointer */
2063 if (kdf1 == kdf2)
2064 return 1;
2065 /*
2066 * Compare their names and providers instead.
2067 * This is necessary in a non-caching build (or a cache flush during fetch)
2068 * because without the algorithm in the cache, fetching it a second time
2069 * will result in a different pointer.
2070 */
2071 return TEST_ptr_eq(EVP_KDF_get0_provider(kdf1), EVP_KDF_get0_provider(kdf2))
2072 && TEST_str_eq(EVP_KDF_get0_name(kdf1), EVP_KDF_get0_name(kdf2));
2073 }
2074
test_kdf_get_kdf(void)2075 static int test_kdf_get_kdf(void)
2076 {
2077 EVP_KDF *kdf1 = NULL, *kdf2 = NULL;
2078 ASN1_OBJECT *obj;
2079 int ok = 1;
2080
2081 if (!TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
2082 || !TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL))
2083 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(OBJ_obj2nid(obj)),
2084 NULL))
2085 || !test_kdfs_same(kdf1, kdf2))
2086 ok = 0;
2087 EVP_KDF_free(kdf1);
2088 kdf1 = NULL;
2089 EVP_KDF_free(kdf2);
2090 kdf2 = NULL;
2091
2092 if (!TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, SN_tls1_prf, NULL))
2093 || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, LN_tls1_prf, NULL))
2094 || !test_kdfs_same(kdf1, kdf2))
2095 ok = 0;
2096 /* kdf1 is reused below, so don't free it here */
2097 EVP_KDF_free(kdf2);
2098 kdf2 = NULL;
2099
2100 if (!TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(NID_tls1_prf), NULL))
2101 || !test_kdfs_same(kdf1, kdf2))
2102 ok = 0;
2103 EVP_KDF_free(kdf1);
2104 kdf1 = NULL;
2105 EVP_KDF_free(kdf2);
2106 kdf2 = NULL;
2107
2108 return ok;
2109 }
2110
2111 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
test_kdf_x942_asn1(void)2112 static int test_kdf_x942_asn1(void)
2113 {
2114 int ret;
2115 EVP_KDF_CTX *kctx = NULL;
2116 OSSL_PARAM params[4], *p = params;
2117 const char *cek_alg = SN_id_smime_alg_CMS3DESwrap;
2118 unsigned char out[24];
2119 /* RFC2631 Section 2.1.6 Test data */
2120 static unsigned char z[] = {
2121 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
2122 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13
2123 };
2124 static const unsigned char expected[sizeof(out)] = {
2125 0xa0, 0x96, 0x61, 0x39, 0x23, 0x76, 0xf7, 0x04,
2126 0x4d, 0x90, 0x52, 0xa3, 0x97, 0x88, 0x32, 0x46,
2127 0xb6, 0x7f, 0x5f, 0x1e, 0xf6, 0x3e, 0xb5, 0xfb
2128 };
2129
2130 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
2131 (char *)"sha1", 0);
2132 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z,
2133 sizeof(z));
2134 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CEK_ALG,
2135 (char *)cek_alg, 0);
2136 *p = OSSL_PARAM_construct_end();
2137
2138 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X942KDF_ASN1))
2139 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
2140 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
2141
2142 EVP_KDF_CTX_free(kctx);
2143 return ret;
2144 }
2145 #endif /* OPENSSL_NO_CMS */
2146
test_kdf_krb5kdf(void)2147 static int test_kdf_krb5kdf(void)
2148 {
2149 int ret;
2150 EVP_KDF_CTX *kctx;
2151 OSSL_PARAM params[4], *p = params;
2152 unsigned char out[16];
2153 static unsigned char key[] = {
2154 0x42, 0x26, 0x3C, 0x6E, 0x89, 0xF4, 0xFC, 0x28,
2155 0xB8, 0xDF, 0x68, 0xEE, 0x09, 0x79, 0x9F, 0x15
2156 };
2157 static unsigned char constant[] = {
2158 0x00, 0x00, 0x00, 0x02, 0x99
2159 };
2160 static const unsigned char expected[sizeof(out)] = {
2161 0x34, 0x28, 0x0A, 0x38, 0x2B, 0xC9, 0x27, 0x69,
2162 0xB2, 0xDA, 0x2F, 0x9E, 0xF0, 0x66, 0x85, 0x4B
2163 };
2164
2165 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER,
2166 (char *)"AES-128-CBC", 0);
2167 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
2168 sizeof(key));
2169 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT,
2170 constant, sizeof(constant));
2171 *p = OSSL_PARAM_construct_end();
2172
2173 ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KRB5KDF))
2174 && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
2175 && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
2176
2177 EVP_KDF_CTX_free(kctx);
2178 return ret;
2179 }
2180
test_kdf_hmac_drbg_settables(void)2181 static int test_kdf_hmac_drbg_settables(void)
2182 {
2183 int ret = 0, i = 0, j = 0;
2184 EVP_KDF_CTX *kctx = NULL;
2185 const OSSL_PARAM *settableparams;
2186 OSSL_PARAM params[5];
2187 static const unsigned char ent[32] = { 0 };
2188 unsigned char out[32];
2189 char digestname[32];
2190 char macname[32];
2191 EVP_MD *shake256 = NULL;
2192
2193 /* Test there are settables */
2194 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HMACDRBGKDF))
2195 || !TEST_ptr(settableparams = EVP_KDF_CTX_settable_params(kctx)))
2196 goto err;
2197
2198 /* Fail if no params have been set when doing a derive */
2199 if (!TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
2200 goto err;
2201
2202 /* Fail if we pass the wrong type for params */
2203 params[1] = OSSL_PARAM_construct_end();
2204 for (i = 0; settableparams[i].key != NULL; ++i) {
2205 /* Skip "properties" key since it returns 1 unless the digest is also set */
2206 if (OPENSSL_strcasecmp(settableparams[i].key,
2207 OSSL_KDF_PARAM_PROPERTIES)
2208 != 0) {
2209 TEST_note("Testing set int into %s fails", settableparams[i].key);
2210 params[0] = OSSL_PARAM_construct_int(settableparams[i].key, &j);
2211 if (!TEST_int_le(EVP_KDF_CTX_set_params(kctx, params), 0))
2212 goto err;
2213 }
2214 }
2215 /* Test that we can set values multiple times */
2216 params[0] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_ENTROPY,
2217 (char *)ent, sizeof(ent));
2218 params[1] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_HMACDRBG_NONCE,
2219 (char *)ent, sizeof(ent));
2220 params[2] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST, "SHA256",
2221 0);
2222 params[3] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_PROPERTIES, "",
2223 0);
2224 params[4] = OSSL_PARAM_construct_end();
2225 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1))
2226 goto err;
2227 if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 1))
2228 goto err;
2229 /* Test we can retrieve values back */
2230 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
2231 digestname, sizeof(digestname));
2232 params[1] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_MAC,
2233 macname, sizeof(macname));
2234 params[2] = OSSL_PARAM_construct_end();
2235 if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params), 1)
2236 || !TEST_mem_eq(digestname, params[0].return_size, "SHA2-256", 8)
2237 || !TEST_mem_eq(macname, params[1].return_size, "HMAC", 4))
2238 goto err;
2239
2240 /* Test the derive */
2241 if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 1))
2242 goto err;
2243
2244 /* test that XOF digests are not allowed */
2245 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
2246 "shake256", 0);
2247 params[1] = OSSL_PARAM_construct_end();
2248 if (!TEST_int_le(EVP_KDF_CTX_set_params(kctx, params), 0))
2249 goto err;
2250
2251 ret = 1;
2252 err:
2253 EVP_MD_free(shake256);
2254 EVP_KDF_CTX_free(kctx);
2255 return ret;
2256 }
2257
test_kdf_hmac_drbg_gettables(void)2258 static int test_kdf_hmac_drbg_gettables(void)
2259 {
2260 int ret = 0, i, j = 0;
2261 EVP_KDF_CTX *kctx = NULL;
2262 const OSSL_PARAM *gettableparams;
2263 OSSL_PARAM params[3];
2264 char buf[64];
2265
2266 /* Test there are gettables */
2267 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HMACDRBGKDF))
2268 || !TEST_ptr(gettableparams = EVP_KDF_CTX_gettable_params(kctx)))
2269 goto err;
2270 /* Fail if we pass the wrong type for params */
2271 params[1] = OSSL_PARAM_construct_end();
2272 for (i = 0; gettableparams[i].key != NULL; ++i) {
2273 params[0] = OSSL_PARAM_construct_int(gettableparams[i].key, &j);
2274 if (!TEST_int_le(EVP_KDF_CTX_get_params(kctx, params), 0))
2275 goto err;
2276 }
2277 /* fail to get params if they are not set yet */
2278 for (i = 0; gettableparams[i].key != NULL; ++i) {
2279 params[0] = OSSL_PARAM_construct_utf8_string(gettableparams[i].key,
2280 buf, sizeof(buf));
2281 if (!TEST_int_le(EVP_KDF_CTX_get_params(kctx, params), 0))
2282 goto err;
2283 }
2284 ret = 1;
2285 err:
2286 EVP_KDF_CTX_free(kctx);
2287 return ret;
2288 }
2289
2290 /* Test that changing the KBKDF algorithm from KMAC to HMAC works correctly */
test_kbkdf_mac_change(void)2291 static int test_kbkdf_mac_change(void)
2292 {
2293 int ret = 0;
2294 EVP_KDF_CTX *kctx = NULL;
2295 OSSL_PARAM params[9], *p = params;
2296 /* Test data taken from the evptest corpus */
2297 int l = 0, sep = 0, r = 8;
2298 static /* const */ unsigned char key[] = {
2299 0x3e, 0xdc, 0x6b, 0x5b, 0x8f, 0x7a, 0xad, 0xbd,
2300 0x71, 0x37, 0x32, 0xb4, 0x82, 0xb8, 0xf9, 0x79,
2301 0x28, 0x6e, 0x1e, 0xa3, 0xb8, 0xf8, 0xf9, 0x9c,
2302 0x30, 0xc8, 0x84, 0xcf, 0xe3, 0x34, 0x9b, 0x83
2303 };
2304 static /* const */ unsigned char info[] = {
2305 0x98, 0xe9, 0x98, 0x8b, 0xb4, 0xcc, 0x8b, 0x34,
2306 0xd7, 0x92, 0x2e, 0x1c, 0x68, 0xad, 0x69, 0x2b,
2307 0xa2, 0xa1, 0xd9, 0xae, 0x15, 0x14, 0x95, 0x71,
2308 0x67, 0x5f, 0x17, 0xa7, 0x7a, 0xd4, 0x9e, 0x80,
2309 0xc8, 0xd2, 0xa8, 0x5e, 0x83, 0x1a, 0x26, 0x44,
2310 0x5b, 0x1f, 0x0f, 0xf4, 0x4d, 0x70, 0x84, 0xa1,
2311 0x72, 0x06, 0xb4, 0x89, 0x6c, 0x81, 0x12, 0xda,
2312 0xad, 0x18, 0x60, 0x5a
2313 };
2314 static const unsigned char output[] = {
2315 0x6c, 0x03, 0x76, 0x52, 0x99, 0x06, 0x74, 0xa0,
2316 0x78, 0x44, 0x73, 0x2d, 0x0a, 0xd9, 0x85, 0xf9
2317 };
2318 unsigned char out[sizeof(output)];
2319
2320 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
2321 OSSL_MAC_NAME_KMAC128, 0);
2322 params[1] = OSSL_PARAM_construct_end();
2323 if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KBKDF))
2324 || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
2325 goto err;
2326
2327 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, "COUNTER", 0);
2328 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, "HMAC", 0);
2329 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, "SHA256", 0);
2330 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &l);
2331 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR, &sep);
2332 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_R, &r);
2333 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
2334 key, sizeof(key));
2335 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
2336 info, sizeof(info));
2337 *p = OSSL_PARAM_construct_end();
2338 if (!TEST_true(EVP_KDF_derive(kctx, out, sizeof(out), params))
2339 || !TEST_mem_eq(out, sizeof(out), output, sizeof(output)))
2340 goto err;
2341
2342 ret = 1;
2343 err:
2344 EVP_KDF_CTX_free(kctx);
2345 return ret;
2346 }
2347
setup_tests(void)2348 int setup_tests(void)
2349 {
2350 ADD_TEST(test_kdf_pbkdf1);
2351 ADD_TEST(test_kdf_pbkdf1_key_too_long);
2352 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
2353 ADD_TEST(test_kdf_kbkdf_6803_128);
2354 ADD_TEST(test_kdf_kbkdf_6803_256);
2355 #endif
2356 ADD_TEST(test_kdf_kbkdf_invalid_digest);
2357 ADD_TEST(test_kdf_kbkdf_invalid_mac);
2358 ADD_TEST(test_kdf_kbkdf_invalid_r);
2359 ADD_TEST(test_kdf_kbkdf_zero_output_size);
2360 ADD_TEST(test_kdf_kbkdf_empty_key);
2361 ADD_TEST(test_kdf_kbkdf_1byte_key);
2362 ADD_TEST(test_kdf_kbkdf_8009_prf1);
2363 ADD_TEST(test_kdf_kbkdf_8009_prf2);
2364 #if !defined(OPENSSL_NO_CMAC)
2365 ADD_TEST(test_kdf_kbkdf_fixedinfo);
2366 #endif
2367 if (fips_provider_version_ge(NULL, 3, 1, 0))
2368 ADD_TEST(test_kdf_kbkdf_kmac);
2369 ADD_TEST(test_kdf_get_kdf);
2370 ADD_TEST(test_kdf_tls1_prf);
2371 ADD_TEST(test_kdf_tls1_prf_invalid_digest);
2372 ADD_TEST(test_kdf_tls1_prf_zero_output_size);
2373 ADD_TEST(test_kdf_tls1_prf_empty_secret);
2374 ADD_TEST(test_kdf_tls1_prf_1byte_secret);
2375 ADD_TEST(test_kdf_tls1_prf_empty_seed);
2376 ADD_TEST(test_kdf_tls1_prf_1byte_seed);
2377 ADD_TEST(test_kdf_hkdf);
2378 ADD_TEST(test_kdf_hkdf_invalid_digest);
2379 ADD_TEST(test_kdf_hkdf_zero_output_size);
2380 ADD_TEST(test_kdf_hkdf_empty_key);
2381 ADD_TEST(test_kdf_hkdf_1byte_key);
2382 ADD_TEST(test_kdf_hkdf_empty_salt);
2383 ADD_TEST(test_kdf_hkdf_gettables);
2384 ADD_TEST(test_kdf_hkdf_gettables_expandonly);
2385 ADD_TEST(test_kdf_hkdf_gettables_no_digest);
2386 ADD_TEST(test_kdf_hkdf_derive_set_params_fail);
2387 ADD_TEST(test_kdf_hkdf_set_invalid_mode);
2388 ADD_TEST(test_kdf_hkdf_set_ctx_param_fail);
2389 ADD_TEST(test_kdf_pbkdf2);
2390 ADD_TEST(test_kdf_pbkdf2_small_output);
2391 ADD_TEST(test_kdf_pbkdf2_large_output);
2392 ADD_TEST(test_kdf_pbkdf2_small_salt);
2393 ADD_TEST(test_kdf_pbkdf2_small_iterations);
2394 ADD_TEST(test_kdf_pbkdf2_small_salt_pkcs5);
2395 ADD_TEST(test_kdf_pbkdf2_small_iterations_pkcs5);
2396 ADD_TEST(test_kdf_pbkdf2_invalid_digest);
2397 #ifndef OPENSSL_NO_SCRYPT
2398 ADD_TEST(test_kdf_scrypt);
2399 #endif
2400 ADD_TEST(test_kdf_ss_hash);
2401 ADD_TEST(test_kdf_ss_hmac);
2402 ADD_TEST(test_kdf_ss_kmac);
2403 ADD_TEST(test_kdf_sshkdf);
2404 ADD_TEST(test_kdf_x963);
2405 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
2406 ADD_TEST(test_kdf_x942_asn1);
2407 #endif
2408 ADD_TEST(test_kdf_krb5kdf);
2409 ADD_TEST(test_kdf_hmac_drbg_settables);
2410 ADD_TEST(test_kdf_hmac_drbg_gettables);
2411 ADD_TEST(test_kbkdf_mac_change);
2412 return 1;
2413 }
2414