crypton 1.1.4 → 1.1.5

raw patch · 16 files changed

+588/−27 lines, 16 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG.md +13/−0
• Crypto/Cipher/AES.hs +1/−1
• Crypto/Cipher/AES/Primitive.hs +52/−3
• Crypto/Cipher/Types/AEAD.hs +16/−0
• Crypto/KDF/BCryptPBKDF.hs +2/−2
• Crypto/Number/ModArithmetic.hs +7/−7
• Crypto/PubKey/RSA/PKCS15.hs +85/−1
• Crypto/Random/Entropy/Unix.hs +6/−5
• cbits/crypton_aes.c +9/−4
• cbits/crypton_aes.h +1/−1
• cbits/p256/p256.c +10/−1
• crypton.cabal +1/−1
• tests/BCrypt.hs +1/−1
• tests/KAT_AES.hs +45/−0
• tests/KAT_AES/KATOCB3.hs +325/−0
• tests/KAT_PubKey/P256.hs +14/−0

@@ -1,5 +1,18 @@ # CHANGELOG for crypton +## 1.1.5++* fix(aead): reject undersized tags+  [#80](https://github.com/kazu-yamamoto/crypton/pull/80)+* fix(aes): refuse a zero-length AES-GCM IV+  [#79](https://github.com/kazu-yamamoto/crypton/pull/79)+* fix(p256): prevent crashes when validating valid points+  [#78](https://github.com/kazu-yamamoto/crypton/pull/78)+* feat(asn1): add SHA-3 HashAlgorithmASN1 instances for PKCS#1 v1.5+  [#77](https://github.com/kazu-yamamoto/crypton/pull/77)+* OCB3 conformance+  [#76](https://github.com/kazu-yamamoto/crypton/pull/76)+ ## 1.1.4  * Generic instance for RSA PublicKey and PrivateKey

@@ -55,7 +55,7 @@     ; cbcEncrypt (CSTR aes) (IV iv) = encryptCBC aes (IV iv) \     ; cbcDecrypt (CSTR aes) (IV iv) = decryptCBC aes (IV iv) \     ; ctrCombine (CSTR aes) (IV iv) = encryptCTR aes (IV iv) \-    ; aeadInit AEAD_GCM (CSTR aes) iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv) \+    ; aeadInit AEAD_GCM (CSTR aes) iv = gcmAeadInit aes iv \     ; aeadInit AEAD_OCB (CSTR aes) iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv) \     ; aeadInit (AEAD_CCM n m l) (CSTR aes) iv = AEAD (ccmMode aes) <$> ccmInit aes iv n m l \     ; aeadInit _        _          _  = CryptoFailed CryptoError_AEADModeNotSupported \

@@ -42,10 +42,13 @@     -- * Incremental GCM     gcmMode,     gcmInit,+    gcmAeadInit,      -- * Incremental OCB     ocbMode,+    ocbModeWithTagLength,     ocbInit,+    ocbInitWithTagLength,      -- * CCM     ccmMode,@@ -82,7 +85,7 @@     cbcEncrypt = encryptCBC     cbcDecrypt = decryptCBC     ctrCombine = encryptCTR-    aeadInit AEAD_GCM aes iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv)+    aeadInit AEAD_GCM aes iv = gcmAeadInit aes iv     aeadInit AEAD_OCB aes iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv)     aeadInit (AEAD_CCM n m l) aes iv = AEAD (ccmMode aes) <$> ccmInit aes iv n m l     aeadInit _ _ _ = CryptoFailed CryptoError_AEADModeNotSupported@@ -90,6 +93,15 @@     xtsEncrypt = encryptXTS     xtsDecrypt = decryptXTS +-- | Create an AES AEAD context for GCM, refusing the zero-length IV that+-- SP 800-38D 5.2.1.1 forbids: any length other than 96 bits is fed to+-- GHASH, and for the empty IV that makes J0 the GHASH of the empty+-- string, which leaks the authentication key.+gcmAeadInit :: ByteArrayAccess iv => AES -> iv -> CryptoFailable (AEAD c)+gcmAeadInit aes iv+    | B.length iv == 0 = CryptoFailed CryptoError_IvSizeInvalid+    | otherwise = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv)+ -- | Create an AES AEAD implementation for GCM gcmMode :: AES -> AEADModeImpl AESGCM gcmMode aes =@@ -110,6 +122,15 @@         , aeadImplFinalize = ocbFinish aes         } +ocbModeWithTagLength :: AES -> Int -> AEADModeImpl AESOCB+ocbModeWithTagLength aes taglen =+    AEADModeImpl+        { aeadImplAppendHeader = ocbAppendAAD aes+        , aeadImplEncrypt = ocbAppendEncrypt aes+        , aeadImplDecrypt = ocbAppendDecrypt aes+        , aeadImplFinalize = \ocb _ -> ocbFinish aes ocb taglen+        }+ -- | Create an AES AEAD implementation for CCM ccmMode :: AES -> AEADModeImpl AESCCM ccmMode aes =@@ -529,9 +550,36 @@ ocbInit ctx iv = unsafeDoIO $ do     sm <- B.alloc sizeOCB $ \ocbStPtr ->         withKeyAndIV ctx iv $ \k v ->-            c_aes_ocb_init (castPtr ocbStPtr) k v (fromIntegral $ B.length iv)+            c_aes_ocb_init+                (castPtr ocbStPtr)+                k+                v+                (fromIntegral $ B.length iv)+                16     return $ AESOCB sm +-- | initialize an OCB context with a fixed authentication tag length.+--+-- The tag length is expressed in bytes and must be in [0..16].+-- The IV length must be in [1..15] bytes per RFC 7253.+{-# NOINLINE ocbInitWithTagLength #-}+ocbInitWithTagLength :: ByteArrayAccess iv => AES -> iv -> Int -> CryptoFailable AESOCB+ocbInitWithTagLength ctx iv taglen+    | taglen < 0 || taglen > 16 = CryptoFailed CryptoError_AuthenticationTagSizeInvalid+    | ivlen < 1 || ivlen > 15 = CryptoFailed CryptoError_IvSizeInvalid+    | otherwise = CryptoPassed $ unsafeDoIO $ do+        sm <- B.alloc sizeOCB $ \ocbStPtr ->+            withKeyAndIV ctx iv $ \k v ->+                c_aes_ocb_init+                    (castPtr ocbStPtr)+                    k+                    v+                    (fromIntegral ivlen)+                    (fromIntegral taglen)+        return $ AESOCB sm+  where+    ivlen = B.length iv+ -- | append data which is going to just be authenticated to the OCB context. -- -- need to happen after initialization and before appending encryption/decryption data.@@ -722,7 +770,8 @@     c_aes_gcm_finish :: CString -> Ptr AESGCM -> Ptr AES -> IO ()  foreign import ccall "crypton_aes.h crypton_aes_ocb_init"-    c_aes_ocb_init :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()+    c_aes_ocb_init+        :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> CUInt -> IO ()  foreign import ccall "crypton_aes.h crypton_aes_ocb_aad"     c_aes_ocb_aad :: Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()

@@ -69,7 +69,22 @@     (output, aeadFinal) = aeadEncrypt aead input     tag = aeadFinalize aeadFinal taglen +-- | The shortest authentication tag any mode here produces, four bytes+-- (@CCM_M4@).  Modes that truncate their tag -- GCM and OCB3 -- will+-- compute one of whatever length they are asked for, down to nothing, so+-- 'aeadSimpleDecrypt' refuses a shorter tag than this rather than+-- authenticate fewer bytes than any supported mode ever emits.+minimumTagLength :: Int+minimumTagLength = 4+ -- | Simple AEAD decryptio.+--+-- The number of bytes compared is the length of @authTag@.  That is the+-- caller's choice of tag length, so a caller reading a tag off the wire+-- must check its length against the one it expects: passing an+-- attacker-supplied tag straight in lets the attacker pick how much of it+-- is verified.  Tags shorter than 'minimumTagLength' are rejected+-- outright. aeadSimpleDecrypt     :: (ByteArrayAccess aad, ByteArray ba)     => AEAD a@@ -83,6 +98,7 @@     -> Maybe ba     -- ^ Plaintext aeadSimpleDecrypt aeadIni header input authTag+    | B.length authTag < minimumTagLength = Nothing     | tag == authTag = Just output     | otherwise = Nothing   where

@@ -13,7 +13,7 @@ ) where -import Control.Exception (finally)+import qualified Control.Exception as E import Control.Monad (when) import qualified Crypto.Cipher.Blowfish.Box as Blowfish import qualified Crypto.Cipher.Blowfish.Primitive as Blowfish@@ -187,4 +187,4 @@  finallyErase :: ForeignPtr Word8 -> Int -> IO () -> IO () finallyErase fp len action =-    action `finally` withForeignPtr fp (\ptr -> memSet ptr 0 len)+    action `E.finally` withForeignPtr fp (\ptr -> memSet ptr 0 len)

@@ -21,7 +21,7 @@     squareRoot, ) where -import Control.Exception (Exception, throw)+import qualified Control.Exception as E import Crypto.Number.Basic import Crypto.Number.Compat @@ -29,7 +29,7 @@ data CoprimesAssertionError = CoprimesAssertionError     deriving (Show) -instance Exception CoprimesAssertionError+instance E.Exception CoprimesAssertionError  -- | Compute the modular exponentiation of base^exponent using -- algorithms design to avoid side channels and timing measurement@@ -109,7 +109,7 @@ inverseCoprimes :: Integer -> Integer -> Integer inverseCoprimes g m =     case inverse g m of-        Nothing -> throw CoprimesAssertionError+        Nothing -> E.throw CoprimesAssertionError         Just i -> i  -- | Computes the Jacobi symbol (a/n).@@ -148,7 +148,7 @@ data ModulusAssertionError = ModulusAssertionError     deriving (Show) -instance Exception ModulusAssertionError+instance E.Exception ModulusAssertionError  -- | Modular square root of @g@ modulo a prime @p@. --@@ -159,7 +159,7 @@ -- parameters only. squareRoot :: Integer -> Integer -> Maybe Integer squareRoot p-    | p < 2 = throw ModulusAssertionError+    | p < 2 = E.throw ModulusAssertionError     | otherwise =         case p `divMod` 8 of             (v, 3) -> method1 (2 * v + 1)@@ -167,7 +167,7 @@             (u, 5) -> method2 u             (_, 1) -> tonelliShanks p             (0, 2) -> \a -> Just (if even a then 0 else 1)-            _ -> throw ModulusAssertionError+            _ -> E.throw ModulusAssertionError   where     x `eqMod` y = (x - y) `mod` p == 0 @@ -202,7 +202,7 @@                             (expFast aa s p)                             (expFast n s p)                             e-                | otherwise -> throw ModulusAssertionError+                | otherwise -> E.throw ModulusAssertionError   where     aa = a `mod` p     p1 = p - 1

@@ -247,6 +247,90 @@             , 0x04             , 0x20             ]+instance HashAlgorithmASN1 SHA3_224 where+    hashDigestASN1 =+        addDigestPrefix+            [ 0x30+            , 0x2b+            , 0x30+            , 0x0b+            , 0x06+            , 0x09+            , 0x60+            , 0x86+            , 0x48+            , 0x01+            , 0x65+            , 0x03+            , 0x04+            , 0x02+            , 0x07+            , 0x04+            , 0x1c+            ]+instance HashAlgorithmASN1 SHA3_256 where+    hashDigestASN1 =+        addDigestPrefix+            [ 0x30+            , 0x2f+            , 0x30+            , 0x0b+            , 0x06+            , 0x09+            , 0x60+            , 0x86+            , 0x48+            , 0x01+            , 0x65+            , 0x03+            , 0x04+            , 0x02+            , 0x08+            , 0x04+            , 0x20+            ]+instance HashAlgorithmASN1 SHA3_384 where+    hashDigestASN1 =+        addDigestPrefix+            [ 0x30+            , 0x3f+            , 0x30+            , 0x0b+            , 0x06+            , 0x09+            , 0x60+            , 0x86+            , 0x48+            , 0x01+            , 0x65+            , 0x03+            , 0x04+            , 0x02+            , 0x09+            , 0x04+            , 0x30+            ]+instance HashAlgorithmASN1 SHA3_512 where+    hashDigestASN1 =+        addDigestPrefix+            [ 0x30+            , 0x4f+            , 0x30+            , 0x0b+            , 0x06+            , 0x09+            , 0x60+            , 0x86+            , 0x48+            , 0x01+            , 0x65+            , 0x03+            , 0x04+            , 0x02+            , 0x0a+            , 0x04+            , 0x40+            ] instance HashAlgorithmASN1 RIPEMD160 where     hashDigestASN1 =         addDigestPrefix@@ -283,7 +367,7 @@ --   Start Sequence --     ,Start Sequence --       ,OID oid---       ,Null+--       ,optional parameters (Null for SHA-2, absent for SHA-3) --     ,End Sequence --     ,OctetString digest --   ,End Sequence

@@ -11,10 +11,11 @@     DevURandom, ) where -import Control.Exception as E+import qualified Control.Exception as E import Crypto.Random.Entropy.Source import Data.Word (Word8) import Foreign.Ptr+import qualified System.IO.Error as E  -- import System.Posix.Types (Fd) import System.IO@@ -49,7 +50,7 @@  openDev :: String -> IO (Maybe H) openDev filepath =-    (Just `fmap` openAndNoBuffering) `E.catch` \(_ :: IOException) -> return Nothing+    (Just `fmap` openAndNoBuffering) `E.catchIOError` \_ -> return Nothing   where     openAndNoBuffering = do         h <- openBinaryFile filepath ReadMode@@ -64,14 +65,14 @@             Just fd -> f fd `E.finally` closeDev fd  closeDev :: H -> IO ()-closeDev h = hClose h `E.catch` \(_ :: IOException) -> return ()+closeDev h = hClose h `E.catchIOError` \_ -> return ()  gatherDevEntropy :: H -> Ptr Word8 -> Int -> IO Int gatherDevEntropy h ptr sz =     (fromIntegral `fmap` hGetBufSome h ptr (fromIntegral sz))-        `E.catch` \(_ :: IOException) -> return 0+        `E.catchIOError` \_ -> return 0  gatherDevEntropyNonBlock :: H -> Ptr Word8 -> Int -> IO Int gatherDevEntropyNonBlock h ptr sz =     (fromIntegral `fmap` hGetBufNonBlocking h ptr (fromIntegral sz))-        `E.catch` \(_ :: IOException) -> return 0+        `E.catchIOError` \_ -> return 0

@@ -655,7 +655,7 @@ #undef L_CACHED } -void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)+void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len, uint32_t taglen) { 	block128 tmp, nonce, ktop; 	unsigned char stretch[24];@@ -665,6 +665,9 @@ 	if (len > 15) { 		len = 15; 	}+	if (taglen > 16) {+		taglen = 16;+	}  	/* create L*, and L$,L0,L1,L2,L3 */ 	block128_zero(&tmp);@@ -678,9 +681,11 @@  	/* create strech from the nonce */ 	block128_zero(&nonce);-	memcpy(nonce.b + 4, iv, 12);-	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);-	nonce.b[16-12-1] |= 0x01;+	if (len > 0) {+		memcpy(nonce.b + (16 - len), iv, len);+		nonce.b[16 - len - 1] |= 0x01;+	}+	nonce.b[0] |= (unsigned char)(((taglen * 8) % 128) << 1); 	bottom = nonce.b[15] & 0x3F; 	nonce.b[15] &= 0xC0; 	crypton_aes_encrypt_block(&ktop, key, &nonce);

@@ -109,7 +109,7 @@ void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key); -void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);+void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len, uint32_t taglen); void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);

@@ -104,7 +104,9 @@   borrow += top_c;   borrow -= top_a;   top_c = (crypton_p256_digit)borrow;-  assert((borrow >> P256_BITSPERDIGIT) == 0);+  /* A borrow out is a legitimate outcome: the quotient estimate in+     crypton_p256_modmul can exceed the true quotient by one.  Report it in+     the returned top digit (all ones) and let the caller correct. */   return top_c; } @@ -177,6 +179,13 @@      // Subtract reducer from top | tmp.     top = subTop(top_reducer, reducer, top, tmp + i);++    // The quotient estimate above can exceed the true quotient by one --+    // with 64-bit digits, whenever the low half of top is zero and the+    // digits below it are small -- and the subtraction then borrows.  The+    // deficit is always less than MOD, so adding MOD back once restores+    // the invariant.+    top = addM(MOD, top, tmp + i, 0 - (top >> (P256_BITSPERDIGIT - 1)));      // top is now either 0 or 1. Make it 0, fixed-timing.     assert(top <= 1);

@@ -1,6 +1,6 @@ cabal-version:      1.18 name:               crypton-version:            1.1.4+version:            1.1.5 license:            BSD3 license-file:       LICENSE copyright:          Vincent Hanquez <vincent@snarc.org>

@@ -34,7 +34,7 @@           \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\           \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\           \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\-          \\x00\x01\x02\x03\x04\x05" -- chars after 72 are ignored as usual+          \chars after 72 are ignored as usual"         )     ,         ( "$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy"

@@ -5,6 +5,8 @@ import BlockCipher import qualified Crypto.Cipher.AES as AES import Crypto.Cipher.Types+import Crypto.Error+import qualified Data.ByteArray as BA import qualified Data.ByteString as B import Data.Maybe import Imports@@ -113,12 +115,55 @@         , kat_AEAD = map toKatGCM KATGCM.vectors_aes256_enc         } +-- SP 800-38D 5.2.1.1: 1 <= len(IV) <= 2^64 - 1.  A zero-length IV makes+-- J0 the GHASH of the empty string, which leaks the authentication key.+aeadIVLengthTests :: TestTree+aeadIVLengthTests =+    testGroup+        "AEAD IV length"+        [ testCase "96-bit IV accepted" $+            True @=? isRight (initWith (B.replicate 12 0))+        , testCase "8-bit IV accepted" $+            True @=? isRight (initWith (B.replicate 1 0))+        , testCase "empty IV rejected" $+            Left CryptoError_IvSizeInvalid @=? initWith B.empty+        ]+  where+    ctx = throwCryptoError (cipherInit (B.replicate 16 0)) :: AES.AES128+    initWith iv =+        eitherCryptoError (() <$ aeadInit AEAD_GCM ctx (iv :: ByteString))+    isRight = either (const False) (const True)++aeadTagLengthTests :: TestTree+aeadTagLengthTests =+    testGroup+        "AEAD tag length"+        [ testCase "full tag verifies" $ Just message @=? openWith fullTag+        , testCase "empty tag rejected" $ Nothing @=? openWith B.empty+        , testCase "1-byte tag rejected" $ Nothing @=? openWith (B.take 1 fullTag)+        , testCase "3-byte tag rejected" $ Nothing @=? openWith (B.take 3 fullTag)+        , testCase "wrong tag rejected" $+            Nothing @=? openWith (B.map (+ 1) fullTag)+        ]+  where+    key = B.replicate 16 0+    iv = B.replicate 12 0+    aad = "additional data" :: ByteString+    message = "authenticated message" :: ByteString+    ctx = throwCryptoError (cipherInit key) :: AES.AES128+    aead = throwCryptoError (aeadInit AEAD_GCM ctx iv)+    (AuthTag tag, ciphertext) = aeadSimpleEncrypt aead aad message 16+    fullTag = BA.convert tag :: ByteString+    openWith t = aeadSimpleDecrypt aead aad ciphertext (AuthTag (BA.convert t))+ tests =     testGroup         "AES"         [ testBlockCipher kats128 (undefined :: AES.AES128)         , testBlockCipher kats192 (undefined :: AES.AES192)         , testBlockCipher kats256 (undefined :: AES.AES256)+        , aeadIVLengthTests+        , aeadTagLengthTests         {-             , testProperty "genCtr" $ \(key, iv1) ->                 let (bs1, iv2)    = AES.genCounter key iv1 32

@@ -18,7 +18,47 @@  key1 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" nonce1 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b"+key2 = "\x0f\x0e\x0d\x0c\x0b\x0a\x09\x08\x07\x06\x05\x04\x03\x02\x01\x00"+nonce2 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d"+nonce_rfc7253_00 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x00"+nonce_rfc7253_01 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x01"+nonce_rfc7253_02 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x02"+nonce_rfc7253_03 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x03"+nonce_rfc7253_04 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x04"+nonce_rfc7253_05 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x05"+nonce_rfc7253_06 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x06"+nonce_rfc7253_07 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x07"+nonce_rfc7253_08 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x08"+nonce_rfc7253_09 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x09"+nonce_rfc7253_0a = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0a"+nonce_rfc7253_0b = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0b"+nonce_rfc7253_0c = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0c"+nonce_rfc7253_0d = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d"+nonce_rfc7253_0e = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0e"+nonce_rfc7253_0f = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0f"+nonce_dkg_120_00 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x00"+nonce_dkg_120_01 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x01"+nonce_dkg_120_02 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x02"+nonce_dkg_120_03 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x03"+nonce_dkg_120_04 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x04"+nonce_dkg_120_05 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x05"+nonce_dkg_120_06 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x06"+nonce_dkg_120_07 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x07"+nonce_dkg_120_08 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x08"+nonce_dkg_120_09 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x09"+nonce_dkg_120_0a = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0a"+nonce_dkg_120_0b = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0b"+nonce_dkg_120_0c = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0c"+nonce_dkg_120_0d = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d"+nonce_dkg_120_0e = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0e"+nonce_dkg_120_0f = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0f" +bytes8 = "\x00\x01\x02\x03\x04\x05\x06\x07"+bytes16 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"+bytes24 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17"+bytes32 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"+bytes40 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27"+ vectors_aes128_enc :: [KATOCB3] vectors_aes128_enc =     [@@ -66,4 +106,289 @@         , 16         , "\x77\x6c\x99\x24\xd6\x72\x3a\x1f\xc4\x52\x45\x32\xac\x3e\x5b\xeb"         )+    {- Disabled: 96-bit tag vector+    , ( key2+      , nonce2+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27"+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27"+      , "\x17\x92\xa4\xe3\x1e\x07\x55\xfb\x03\xe3\x1b\x22\x11\x6e\x6c\x2d\xdf\x9e\xfd\x6e\x33\xd5\x36\xf1\xa0\x12\x4b\x0a\x55\xba\xe8\x84\xed\x93\x48\x15\x29\xc7\x6b\x6a"+      , 12+      , "\xd0\xc5\x15\xf4\xd1\xcd\xd4\xfd\xac\x4f\x02\xaa"+      )+    -}+    ] ++ vectors_rfc7253_aes128_tag128+        ++ vectors_dkg_nonce120_aes128++vectors_rfc7253_aes128_tag128 :: [KATOCB3]+vectors_rfc7253_aes128_tag128 =+    [ ( key1+      , nonce_rfc7253_00+      , ""+      , ""+      , ""+      , 16+      , "\x78\x54\x07\xbf\xff\xc8\xad\x9e\xdc\xc5\x52\x0a\xc9\x11\x1e\xe6"+      )+    , ( key1+      , nonce_rfc7253_01+      , bytes8+      , bytes8+      , "\x68\x20\xb3\x65\x7b\x6f\x61\x5a"+      , 16+      , "\x57\x25\xbd\xa0\xd3\xb4\xeb\x3a\x25\x7c\x9a\xf1\xf8\xf0\x30\x09"+      )+    , ( key1+      , nonce_rfc7253_02+      , bytes8+      , ""+      , ""+      , 16+      , "\x81\x01\x7f\x82\x03\xf0\x81\x27\x71\x52\xfa\xde\x69\x4a\x0a\x00"+      )+    , ( key1+      , nonce_rfc7253_03+      , ""+      , bytes8+      , "\x45\xdd\x69\xf8\xf5\xaa\xe7\x24"+      , 16+      , "\x14\x05\x4c\xd1\xf3\x5d\x82\x76\x0b\x2c\xd0\x0d\x2f\x99\xbf\xa9"+      )+    , ( key1+      , nonce_rfc7253_04+      , bytes16+      , bytes16+      , "\x57\x1d\x53\x5b\x60\xb2\x77\x18\x8b\xe5\x14\x71\x70\xa9\xa2\x2c"+      , 16+      , "\x3a\xd7\xa4\xff\x38\x35\xb8\xc5\x70\x1c\x1c\xce\xc8\xfc\x33\x58"+      )+    , ( key1+      , nonce_rfc7253_05+      , bytes16+      , ""+      , ""+      , 16+      , "\x8c\xf7\x61\xb6\x90\x2e\xf7\x64\x46\x2a\xd8\x64\x98\xca\x6b\x97"+      )+    , ( key1+      , nonce_rfc7253_06+      , ""+      , bytes16+      , "\x5c\xe8\x8e\xc2\xe0\x69\x27\x06\xa9\x15\xc0\x0a\xeb\x8b\x23\x96"+      , 16+      , "\xf4\x0e\x1c\x74\x3f\x52\x43\x6b\xdf\x06\xd8\xfa\x1e\xca\x34\x3d"+      )+    , ( key1+      , nonce_rfc7253_07+      , bytes24+      , bytes24+      , "\x1c\xa2\x20\x73\x08\xc8\x7c\x01\x07\x56\x10\x4d\x88\x40\xce\x19\x52\xf0\x96\x73\xa4\x48\xa1\x22"+      , 16+      , "\xc9\x2c\x62\x24\x10\x51\xf5\x73\x56\xd7\xf3\xc9\x0b\xb0\xe0\x7f"+      )+    , ( key1+      , nonce_rfc7253_08+      , bytes24+      , ""+      , ""+      , 16+      , "\x6d\xc2\x25\xa0\x71\xfc\x1b\x9f\x7c\x69\xf9\x3b\x0f\x1e\x10\xde"+      )+    , ( key1+      , nonce_rfc7253_09+      , ""+      , bytes24+      , "\x22\x1b\xd0\xde\x7f\xa6\xfe\x99\x3e\xcc\xd7\x69\x46\x0a\x0a\xf2\xd6\xcd\xed\x0c\x39\x5b\x1c\x3c"+      , 16+      , "\xe7\x25\xf3\x24\x94\xb9\xf9\x14\xd8\x5c\x0b\x1e\xb3\x83\x57\xff"+      )+    , ( key1+      , nonce_rfc7253_0a+      , bytes32+      , bytes32+      , "\xbd\x6f\x6c\x49\x62\x01\xc6\x92\x96\xc1\x1e\xfd\x13\x8a\x46\x7a\xbd\x3c\x70\x79\x24\xb9\x64\xde\xaf\xfc\x40\x31\x9a\xf5\xa4\x85"+      , 16+      , "\x40\xfb\xba\x18\x6c\x55\x53\xc6\x8a\xd9\xf5\x92\xa7\x9a\x42\x40"+      )+    , ( key1+      , nonce_rfc7253_0b+      , bytes32+      , ""+      , ""+      , 16+      , "\xfe\x80\x69\x0b\xee\x8a\x48\x5d\x11\xf3\x29\x65\xbc\x9d\x2a\x32"+      )+    , ( key1+      , nonce_rfc7253_0c+      , ""+      , bytes32+      , "\x29\x42\xbf\xc7\x73\xbd\xa2\x3c\xab\xc6\xac\xfd\x9b\xfd\x58\x35\xbd\x30\x0f\x09\x73\x79\x2e\xf4\x60\x40\xc5\x3f\x14\x32\xbc\xdf"+      , 16+      , "\xb5\xe1\xdd\xe3\xbc\x18\xa5\xf8\x40\xb5\x2e\x65\x34\x44\xd5\xdf"+      )+    , ( key1+      , nonce_rfc7253_0d+      , bytes40+      , bytes40+      , "\xd5\xca\x91\x74\x84\x10\xc1\x75\x1f\xf8\xa2\xf6\x18\x25\x5b\x68\xa0\xa1\x2e\x09\x3f\xf4\x54\x60\x6e\x59\xf9\xc1\xd0\xdd\xc5\x4b\x65\xe8\x62\x8e\x56\x8b\xad\x7a"+      , 16+      , "\xed\x07\xba\x06\xa4\xa6\x94\x83\xa7\x03\x54\x90\xc5\x76\x9e\x60"+      )+    , ( key1+      , nonce_rfc7253_0e+      , bytes40+      , ""+      , ""+      , 16+      , "\xc5\xcd\x9d\x18\x50\xc1\x41\xe3\x58\x64\x99\x94\xee\x70\x1b\x68"+      )+    , ( key1+      , nonce_rfc7253_0f+      , ""+      , bytes40+      , "\x44\x12\x92\x34\x93\xc5\x7d\x5d\xe0\xd7\x00\xf7\x53\xcc\xe0\xd1\xd2\xd9\x50\x60\x12\x2e\x9f\x15\xa5\xdd\xbf\xc5\x78\x7e\x50\xb5\xcc\x55\xee\x50\x7b\xcb\x08\x4e"+      , 16+      , "\x47\x9a\xd3\x63\xac\x36\x6b\x95\xa9\x8c\xa5\xf3\x00\x0b\x14\x79"+      )+    ]++vectors_dkg_nonce120_aes128 :: [KATOCB3]+vectors_dkg_nonce120_aes128 =+    [ ( key1+      , nonce_dkg_120_00+      , ""+      , ""+      , ""+      , 16+      , "\x75\x2a\xcd\x21\x32\xc4\x1e\x02\x0e\x41\xfb\x22\x3e\xfd\x77\xb6"+      )+    , ( key1+      , nonce_dkg_120_01+      , bytes8+      , bytes8+      , "\x20\x1f\xe4\xd8\x9e\xa7\xbd\x1e"+      , 16+      , "\xb5\xb1\x57\x7d\xb1\x62\x83\xb8\xae\xd1\x71\x5a\xd6\xbe\x51\x49"+      )+    , ( key1+      , nonce_dkg_120_02+      , bytes8+      , ""+      , ""+      , 16+      , "\x71\x09\x60\xb9\xee\x00\xb8\xf4\x4d\x2e\x81\x20\xaa\xba\x63\xae"+      )+    , ( key1+      , nonce_dkg_120_03+      , ""+      , bytes8+      , "\x08\x4e\x86\x95\x70\x19\x4b\xd2"+      , 16+      , "\x50\x32\xfe\x9e\x53\x28\xe4\x5d\x50\x7e\x74\xf3\x36\x6e\x20\xd2"+      )+    , ( key1+      , nonce_dkg_120_04+      , bytes16+      , bytes16+      , "\x96\x76\xee\x37\xfd\x64\x5c\x07\xc0\xd4\xf7\x0a\xab\xf6\x86\x68"+      , 16+      , "\x8e\x39\xb2\xfb\x3f\xc4\xff\x30\xdc\xd1\x82\x7b\x36\xa2\x98\xd3"+      )+    , ( key1+      , nonce_dkg_120_05+      , bytes16+      , ""+      , ""+      , 16+      , "\x9d\x51\x0f\x56\xed\xf7\x2f\xfa\x34\x96\x9b\xce\xf9\x1e\x6d\xe9"+      )+    , ( key1+      , nonce_dkg_120_06+      , ""+      , bytes16+      , "\xd5\xe1\x5a\xa1\xd2\x32\xab\x57\xf2\x34\x36\x6d\xff\xb2\x55\x74"+      , 16+      , "\xa3\x63\x6a\x5f\x3e\x34\x33\xea\x45\x90\xcb\xf4\xf9\xac\x1f\x4d"+      )+    , ( key1+      , nonce_dkg_120_07+      , bytes24+      , bytes24+      , "\x1c\x4b\x67\x77\xb7\xf1\x37\xc3\x09\x71\xa9\x3d\xe3\xc5\x6c\xc7\x35\x68\x6a\x6f\x77\x03\x14\x2f"+      , 16+      , "\xab\x8a\xcc\x98\x7c\x14\x06\xdf\xf9\x62\x73\xc5\x37\x6e\x62\x10"+      )+    , ( key1+      , nonce_dkg_120_08+      , bytes24+      , ""+      , ""+      , 16+      , "\x96\xe6\x70\xc0\x23\x8f\xb9\x69\xb7\xac\xe4\xab\xaf\x74\x38\xc7"+      )+    , ( key1+      , nonce_dkg_120_09+      , ""+      , bytes24+      , "\x12\x90\xa6\x86\xd8\x25\xf7\x12\xe5\x94\xbe\x40\x39\xc0\x4d\x3e\x44\xf7\xd1\x34\x2b\x84\xff\xca"+      , 16+      , "\xd6\x8b\xbd\xfa\x04\xb5\x80\xea\x9a\x01\xe2\xf4\x56\x53\x99\xc3"+      )+    , ( key1+      , nonce_dkg_120_0a+      , bytes32+      , bytes32+      , "\xfb\xdf\xc1\x1f\x74\x92\x17\xbb\x7f\xae\x5d\x40\x36\xb8\xf2\x28\x03\x71\x2e\xff\x9e\xf9\x43\x42\xfe\x1b\x68\x49\x68\xd0\xe3\xe3"+      , 16+      , "\x81\xa2\x77\xda\xab\x83\x57\x94\x06\xa0\x1e\x26\x75\xa0\x82\xc9"+      )+    , ( key1+      , nonce_dkg_120_0b+      , bytes32+      , ""+      , ""+      , 16+      , "\x90\xcd\xa8\xa0\x51\x61\xd2\x87\x33\x61\x37\x4b\x76\xf9\x54\x30"+      )+    , ( key1+      , nonce_dkg_120_0c+      , ""+      , bytes32+      , "\xd1\x32\x0a\xf4\xb6\xff\x8a\xfe\xec\xee\x79\x21\x39\x5d\x4e\x86\x92\x71\x77\x53\xee\x15\xf5\x03\x8e\xb6\x74\xda\x43\xd6\xea\x8d"+      , 16+      , "\xbe\x78\x31\xe7\x23\xbe\x47\x1f\x62\xd9\xe7\xf4\x9a\x7d\x3b\x32"+      )+    , ( key1+      , nonce_dkg_120_0d+      , bytes40+      , bytes40+      , "\x5c\x79\xf1\xc4\xb9\xa2\x04\xed\x33\x23\x61\x6d\x57\x6f\xc5\x00\xe4\xa7\x19\x39\xf0\x3a\x3c\x3d\xe2\xc0\x97\xaf\x2c\x6c\x81\xdc\x3f\x03\x09\xe7\x60\x82\xb1\xf5"+      , 16+      , "\x0f\xf8\x52\x29\x59\xff\xe4\x1f\x37\xef\x50\x7e\x90\x76\xd3\x2c"+      )+    , ( key1+      , nonce_dkg_120_0e+      , bytes40+      , ""+      , ""+      , 16+      , "\x3b\xf1\x58\xb7\xde\x76\xc5\x15\x1e\xf6\x08\x6a\x82\x5d\x0c\xc4"+      )+    , ( key1+      , nonce_dkg_120_0f+      , ""+      , bytes40+      , "\x34\xda\x59\xd2\xeb\x08\xf4\x78\x22\xd4\x8c\x85\xb6\xa1\xd2\x36\x94\xe1\xd3\xde\x68\x0d\x61\x6d\x7b\x1b\x59\x47\x2c\x13\xe3\x69\xc6\x8d\xca\x69\x9d\xa1\x68\x6a"+      , 16+      , "\x33\x9d\x54\x52\x80\x36\x32\x81\x0b\x08\x40\xe6\x80\x4a\xb0\x20"+      )+    {- Disabled: 96-bit tag vector+    , ( key2+      , nonce_dkg_120_0d+      , bytes40+      , bytes40+      , "\x07\xe9\x03\xbf\xc4\x95\x52\x41\x1a\xbc\x86\x5f\x5e\xce\x60\xf6\xfa\xd1\xf5\xa9\xf1\x4d\x30\x70\xfa\x2f\x13\x08\xa5\x63\x20\x7f\xfe\x14\xc1\xee\xa4\x4b\x22\x05"+      , 12+      , "\x9c\x74\x84\x31\x9d\x8a\x2c\x53\xc2\x36\xa7\xb3"+      )+    -}     ]

@@ -73,6 +73,14 @@ xR = 0x72b13dd4354b6b81745195e98cc5ba6970349191ac476bd4553cf35a545a067e yR = 0x8d585cbb2e1327d75241a8a122d7620dc33b13315aa5c9d46d013011744ac264 +-- Two points on the curve whose validation reduces a product whose top+-- digit has a zero low half: x = 2^96, and an x with a repeating bit+-- pattern.  Wycheproof ecdh_secp256r1_ecpoint tcId 74 and 93.+xU = 0x0000000000000000000000000000000000000001000000000000000000000000+yU = 0x7d12de58d54423eb85ae8d157ae416fb004a7eb522ac1b67047ef3cdf9acdc3f+xV = 0x8000003ffffff0000007fffffe000000ffffffc000001ffffff8000003fffffc+yV = 0x0c3527bd081c1c07b313bc1a0c3f845fb2fe22557699ccc8f1354e61a27b7f88+ tests =     testGroup         "P256"@@ -142,6 +150,12 @@             , testCase "valid-point-1" $ casePointIsValid (xS, yS)             , testCase "valid-point-2" $ casePointIsValid (xR, yR)             , testCase "valid-point-3" $ casePointIsValid (xT, yT)+            , -- The quotient estimate in crypton_p256_modmul can exceed the+              -- true quotient, and the resulting borrow used to abort the+              -- process on an assertion inside the reduction rather than+              -- being corrected.  Both points below are on the curve.+              testCase "valid-point-reduction-1" $ casePointIsValid (xU, yU)+            , testCase "valid-point-reduction-2" $ casePointIsValid (xV, yV)             , testCase "point-add-1" $                 let s = P256.pointFromIntegers (xS, yS)                     t = P256.pointFromIntegers (xT, yT)