diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # CHANGELOG for crypton +## 1.1.5 + +* fix(aead): reject undersized tags + [#80](https://github.com/kazu-yamamoto/crypton/pull/80) +* fix(aes): refuse a zero-length AES-GCM IV + [#79](https://github.com/kazu-yamamoto/crypton/pull/79) +* fix(p256): prevent crashes when validating valid points + [#78](https://github.com/kazu-yamamoto/crypton/pull/78) +* feat(asn1): add SHA-3 HashAlgorithmASN1 instances for PKCS#1 v1.5 + [#77](https://github.com/kazu-yamamoto/crypton/pull/77) +* OCB3 conformance + [#76](https://github.com/kazu-yamamoto/crypton/pull/76) + ## 1.1.4 * Generic instance for RSA PublicKey and PrivateKey diff --git a/Crypto/Cipher/AES.hs b/Crypto/Cipher/AES.hs --- a/Crypto/Cipher/AES.hs +++ b/Crypto/Cipher/AES.hs @@ -55,7 +55,7 @@ ; cbcEncrypt (CSTR aes) (IV iv) = encryptCBC aes (IV iv) \ ; cbcDecrypt (CSTR aes) (IV iv) = decryptCBC aes (IV iv) \ ; ctrCombine (CSTR aes) (IV iv) = encryptCTR aes (IV iv) \ - ; aeadInit AEAD_GCM (CSTR aes) iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv) \ + ; aeadInit AEAD_GCM (CSTR aes) iv = gcmAeadInit aes iv \ ; aeadInit AEAD_OCB (CSTR aes) iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv) \ ; aeadInit (AEAD_CCM n m l) (CSTR aes) iv = AEAD (ccmMode aes) <$> ccmInit aes iv n m l \ ; aeadInit _ _ _ = CryptoFailed CryptoError_AEADModeNotSupported \ diff --git a/Crypto/Cipher/AES/Primitive.hs b/Crypto/Cipher/AES/Primitive.hs --- a/Crypto/Cipher/AES/Primitive.hs +++ b/Crypto/Cipher/AES/Primitive.hs @@ -42,10 +42,13 @@ -- * Incremental GCM gcmMode, gcmInit, + gcmAeadInit, -- * Incremental OCB ocbMode, + ocbModeWithTagLength, ocbInit, + ocbInitWithTagLength, -- * CCM ccmMode, @@ -82,7 +85,7 @@ cbcEncrypt = encryptCBC cbcDecrypt = decryptCBC ctrCombine = encryptCTR - aeadInit AEAD_GCM aes iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv) + aeadInit AEAD_GCM aes iv = gcmAeadInit aes iv aeadInit AEAD_OCB aes iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv) aeadInit (AEAD_CCM n m l) aes iv = AEAD (ccmMode aes) <$> ccmInit aes iv n m l aeadInit _ _ _ = CryptoFailed CryptoError_AEADModeNotSupported @@ -90,6 +93,15 @@ xtsEncrypt = encryptXTS xtsDecrypt = decryptXTS +-- | Create an AES AEAD context for GCM, refusing the zero-length IV that +-- SP 800-38D 5.2.1.1 forbids: any length other than 96 bits is fed to +-- GHASH, and for the empty IV that makes J0 the GHASH of the empty +-- string, which leaks the authentication key. +gcmAeadInit :: ByteArrayAccess iv => AES -> iv -> CryptoFailable (AEAD c) +gcmAeadInit aes iv + | B.length iv == 0 = CryptoFailed CryptoError_IvSizeInvalid + | otherwise = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv) + -- | Create an AES AEAD implementation for GCM gcmMode :: AES -> AEADModeImpl AESGCM gcmMode aes = @@ -110,6 +122,15 @@ , aeadImplFinalize = ocbFinish aes } +ocbModeWithTagLength :: AES -> Int -> AEADModeImpl AESOCB +ocbModeWithTagLength aes taglen = + AEADModeImpl + { aeadImplAppendHeader = ocbAppendAAD aes + , aeadImplEncrypt = ocbAppendEncrypt aes + , aeadImplDecrypt = ocbAppendDecrypt aes + , aeadImplFinalize = \ocb _ -> ocbFinish aes ocb taglen + } + -- | Create an AES AEAD implementation for CCM ccmMode :: AES -> AEADModeImpl AESCCM ccmMode aes = @@ -529,9 +550,36 @@ ocbInit ctx iv = unsafeDoIO $ do sm <- B.alloc sizeOCB $ \ocbStPtr -> withKeyAndIV ctx iv $ \k v -> - c_aes_ocb_init (castPtr ocbStPtr) k v (fromIntegral $ B.length iv) + c_aes_ocb_init + (castPtr ocbStPtr) + k + v + (fromIntegral $ B.length iv) + 16 return $ AESOCB sm +-- | initialize an OCB context with a fixed authentication tag length. +-- +-- The tag length is expressed in bytes and must be in [0..16]. +-- The IV length must be in [1..15] bytes per RFC 7253. +{-# NOINLINE ocbInitWithTagLength #-} +ocbInitWithTagLength :: ByteArrayAccess iv => AES -> iv -> Int -> CryptoFailable AESOCB +ocbInitWithTagLength ctx iv taglen + | taglen < 0 || taglen > 16 = CryptoFailed CryptoError_AuthenticationTagSizeInvalid + | ivlen < 1 || ivlen > 15 = CryptoFailed CryptoError_IvSizeInvalid + | otherwise = CryptoPassed $ unsafeDoIO $ do + sm <- B.alloc sizeOCB $ \ocbStPtr -> + withKeyAndIV ctx iv $ \k v -> + c_aes_ocb_init + (castPtr ocbStPtr) + k + v + (fromIntegral ivlen) + (fromIntegral taglen) + return $ AESOCB sm + where + ivlen = B.length iv + -- | append data which is going to just be authenticated to the OCB context. -- -- need to happen after initialization and before appending encryption/decryption data. @@ -722,7 +770,8 @@ c_aes_gcm_finish :: CString -> Ptr AESGCM -> Ptr AES -> IO () foreign import ccall "crypton_aes.h crypton_aes_ocb_init" - c_aes_ocb_init :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> IO () + c_aes_ocb_init + :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> CUInt -> IO () foreign import ccall "crypton_aes.h crypton_aes_ocb_aad" c_aes_ocb_aad :: Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO () diff --git a/Crypto/Cipher/Types/AEAD.hs b/Crypto/Cipher/Types/AEAD.hs --- a/Crypto/Cipher/Types/AEAD.hs +++ b/Crypto/Cipher/Types/AEAD.hs @@ -69,7 +69,22 @@ (output, aeadFinal) = aeadEncrypt aead input tag = aeadFinalize aeadFinal taglen +-- | The shortest authentication tag any mode here produces, four bytes +-- (@CCM_M4@). Modes that truncate their tag -- GCM and OCB3 -- will +-- compute one of whatever length they are asked for, down to nothing, so +-- 'aeadSimpleDecrypt' refuses a shorter tag than this rather than +-- authenticate fewer bytes than any supported mode ever emits. +minimumTagLength :: Int +minimumTagLength = 4 + -- | Simple AEAD decryptio. +-- +-- The number of bytes compared is the length of @authTag@. That is the +-- caller's choice of tag length, so a caller reading a tag off the wire +-- must check its length against the one it expects: passing an +-- attacker-supplied tag straight in lets the attacker pick how much of it +-- is verified. Tags shorter than 'minimumTagLength' are rejected +-- outright. aeadSimpleDecrypt :: (ByteArrayAccess aad, ByteArray ba) => AEAD a @@ -83,6 +98,7 @@ -> Maybe ba -- ^ Plaintext aeadSimpleDecrypt aeadIni header input authTag + | B.length authTag < minimumTagLength = Nothing | tag == authTag = Just output | otherwise = Nothing where diff --git a/Crypto/KDF/BCryptPBKDF.hs b/Crypto/KDF/BCryptPBKDF.hs --- a/Crypto/KDF/BCryptPBKDF.hs +++ b/Crypto/KDF/BCryptPBKDF.hs @@ -13,7 +13,7 @@ ) where -import Control.Exception (finally) +import qualified Control.Exception as E import Control.Monad (when) import qualified Crypto.Cipher.Blowfish.Box as Blowfish import qualified Crypto.Cipher.Blowfish.Primitive as Blowfish @@ -187,4 +187,4 @@ finallyErase :: ForeignPtr Word8 -> Int -> IO () -> IO () finallyErase fp len action = - action `finally` withForeignPtr fp (\ptr -> memSet ptr 0 len) + action `E.finally` withForeignPtr fp (\ptr -> memSet ptr 0 len) diff --git a/Crypto/Number/ModArithmetic.hs b/Crypto/Number/ModArithmetic.hs --- a/Crypto/Number/ModArithmetic.hs +++ b/Crypto/Number/ModArithmetic.hs @@ -21,7 +21,7 @@ squareRoot, ) where -import Control.Exception (Exception, throw) +import qualified Control.Exception as E import Crypto.Number.Basic import Crypto.Number.Compat @@ -29,7 +29,7 @@ data CoprimesAssertionError = CoprimesAssertionError deriving (Show) -instance Exception CoprimesAssertionError +instance E.Exception CoprimesAssertionError -- | Compute the modular exponentiation of base^exponent using -- algorithms design to avoid side channels and timing measurement @@ -109,7 +109,7 @@ inverseCoprimes :: Integer -> Integer -> Integer inverseCoprimes g m = case inverse g m of - Nothing -> throw CoprimesAssertionError + Nothing -> E.throw CoprimesAssertionError Just i -> i -- | Computes the Jacobi symbol (a/n). @@ -148,7 +148,7 @@ data ModulusAssertionError = ModulusAssertionError deriving (Show) -instance Exception ModulusAssertionError +instance E.Exception ModulusAssertionError -- | Modular square root of @g@ modulo a prime @p@. -- @@ -159,7 +159,7 @@ -- parameters only. squareRoot :: Integer -> Integer -> Maybe Integer squareRoot p - | p < 2 = throw ModulusAssertionError + | p < 2 = E.throw ModulusAssertionError | otherwise = case p `divMod` 8 of (v, 3) -> method1 (2 * v + 1) @@ -167,7 +167,7 @@ (u, 5) -> method2 u (_, 1) -> tonelliShanks p (0, 2) -> \a -> Just (if even a then 0 else 1) - _ -> throw ModulusAssertionError + _ -> E.throw ModulusAssertionError where x `eqMod` y = (x - y) `mod` p == 0 @@ -202,7 +202,7 @@ (expFast aa s p) (expFast n s p) e - | otherwise -> throw ModulusAssertionError + | otherwise -> E.throw ModulusAssertionError where aa = a `mod` p p1 = p - 1 diff --git a/Crypto/PubKey/RSA/PKCS15.hs b/Crypto/PubKey/RSA/PKCS15.hs --- a/Crypto/PubKey/RSA/PKCS15.hs +++ b/Crypto/PubKey/RSA/PKCS15.hs @@ -247,6 +247,90 @@ , 0x04 , 0x20 ] +instance HashAlgorithmASN1 SHA3_224 where + hashDigestASN1 = + addDigestPrefix + [ 0x30 + , 0x2b + , 0x30 + , 0x0b + , 0x06 + , 0x09 + , 0x60 + , 0x86 + , 0x48 + , 0x01 + , 0x65 + , 0x03 + , 0x04 + , 0x02 + , 0x07 + , 0x04 + , 0x1c + ] +instance HashAlgorithmASN1 SHA3_256 where + hashDigestASN1 = + addDigestPrefix + [ 0x30 + , 0x2f + , 0x30 + , 0x0b + , 0x06 + , 0x09 + , 0x60 + , 0x86 + , 0x48 + , 0x01 + , 0x65 + , 0x03 + , 0x04 + , 0x02 + , 0x08 + , 0x04 + , 0x20 + ] +instance HashAlgorithmASN1 SHA3_384 where + hashDigestASN1 = + addDigestPrefix + [ 0x30 + , 0x3f + , 0x30 + , 0x0b + , 0x06 + , 0x09 + , 0x60 + , 0x86 + , 0x48 + , 0x01 + , 0x65 + , 0x03 + , 0x04 + , 0x02 + , 0x09 + , 0x04 + , 0x30 + ] +instance HashAlgorithmASN1 SHA3_512 where + hashDigestASN1 = + addDigestPrefix + [ 0x30 + , 0x4f + , 0x30 + , 0x0b + , 0x06 + , 0x09 + , 0x60 + , 0x86 + , 0x48 + , 0x01 + , 0x65 + , 0x03 + , 0x04 + , 0x02 + , 0x0a + , 0x04 + , 0x40 + ] instance HashAlgorithmASN1 RIPEMD160 where hashDigestASN1 = addDigestPrefix @@ -283,7 +367,7 @@ -- Start Sequence -- ,Start Sequence -- ,OID oid --- ,Null +-- ,optional parameters (Null for SHA-2, absent for SHA-3) -- ,End Sequence -- ,OctetString digest -- ,End Sequence diff --git a/Crypto/Random/Entropy/Unix.hs b/Crypto/Random/Entropy/Unix.hs --- a/Crypto/Random/Entropy/Unix.hs +++ b/Crypto/Random/Entropy/Unix.hs @@ -11,10 +11,11 @@ DevURandom, ) where -import Control.Exception as E +import qualified Control.Exception as E import Crypto.Random.Entropy.Source import Data.Word (Word8) import Foreign.Ptr +import qualified System.IO.Error as E -- import System.Posix.Types (Fd) import System.IO @@ -49,7 +50,7 @@ openDev :: String -> IO (Maybe H) openDev filepath = - (Just `fmap` openAndNoBuffering) `E.catch` \(_ :: IOException) -> return Nothing + (Just `fmap` openAndNoBuffering) `E.catchIOError` \_ -> return Nothing where openAndNoBuffering = do h <- openBinaryFile filepath ReadMode @@ -64,14 +65,14 @@ Just fd -> f fd `E.finally` closeDev fd closeDev :: H -> IO () -closeDev h = hClose h `E.catch` \(_ :: IOException) -> return () +closeDev h = hClose h `E.catchIOError` \_ -> return () gatherDevEntropy :: H -> Ptr Word8 -> Int -> IO Int gatherDevEntropy h ptr sz = (fromIntegral `fmap` hGetBufSome h ptr (fromIntegral sz)) - `E.catch` \(_ :: IOException) -> return 0 + `E.catchIOError` \_ -> return 0 gatherDevEntropyNonBlock :: H -> Ptr Word8 -> Int -> IO Int gatherDevEntropyNonBlock h ptr sz = (fromIntegral `fmap` hGetBufNonBlocking h ptr (fromIntegral sz)) - `E.catch` \(_ :: IOException) -> return 0 + `E.catchIOError` \_ -> return 0 diff --git a/cbits/crypton_aes.c b/cbits/crypton_aes.c --- a/cbits/crypton_aes.c +++ b/cbits/crypton_aes.c @@ -655,7 +655,7 @@ #undef L_CACHED } -void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len) +void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len, uint32_t taglen) { block128 tmp, nonce, ktop; unsigned char stretch[24]; @@ -665,6 +665,9 @@ if (len > 15) { len = 15; } + if (taglen > 16) { + taglen = 16; + } /* create L*, and L$,L0,L1,L2,L3 */ block128_zero(&tmp); @@ -678,9 +681,11 @@ /* create strech from the nonce */ block128_zero(&nonce); - memcpy(nonce.b + 4, iv, 12); - nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1); - nonce.b[16-12-1] |= 0x01; + if (len > 0) { + memcpy(nonce.b + (16 - len), iv, len); + nonce.b[16 - len - 1] |= 0x01; + } + nonce.b[0] |= (unsigned char)(((taglen * 8) % 128) << 1); bottom = nonce.b[15] & 0x3F; nonce.b[15] &= 0xC0; crypton_aes_encrypt_block(&ktop, key, &nonce); diff --git a/cbits/crypton_aes.h b/cbits/crypton_aes.h --- a/cbits/crypton_aes.h +++ b/cbits/crypton_aes.h @@ -109,7 +109,7 @@ void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key); -void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len); +void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len, uint32_t taglen); void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length); void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length); diff --git a/cbits/p256/p256.c b/cbits/p256/p256.c --- a/cbits/p256/p256.c +++ b/cbits/p256/p256.c @@ -104,7 +104,9 @@ borrow += top_c; borrow -= top_a; top_c = (crypton_p256_digit)borrow; - assert((borrow >> P256_BITSPERDIGIT) == 0); + /* A borrow out is a legitimate outcome: the quotient estimate in + crypton_p256_modmul can exceed the true quotient by one. Report it in + the returned top digit (all ones) and let the caller correct. */ return top_c; } @@ -177,6 +179,13 @@ // Subtract reducer from top | tmp. top = subTop(top_reducer, reducer, top, tmp + i); + + // The quotient estimate above can exceed the true quotient by one -- + // with 64-bit digits, whenever the low half of top is zero and the + // digits below it are small -- and the subtraction then borrows. The + // deficit is always less than MOD, so adding MOD back once restores + // the invariant. + top = addM(MOD, top, tmp + i, 0 - (top >> (P256_BITSPERDIGIT - 1))); // top is now either 0 or 1. Make it 0, fixed-timing. assert(top <= 1); diff --git a/crypton.cabal b/crypton.cabal --- a/crypton.cabal +++ b/crypton.cabal @@ -1,6 +1,6 @@ cabal-version: 1.18 name: crypton -version: 1.1.4 +version: 1.1.5 license: BSD3 license-file: LICENSE copyright: Vincent Hanquez diff --git a/tests/BCrypt.hs b/tests/BCrypt.hs --- a/tests/BCrypt.hs +++ b/tests/BCrypt.hs @@ -34,7 +34,7 @@ \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\ \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\ \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\ - \\x00\x01\x02\x03\x04\x05" -- chars after 72 are ignored as usual + \chars after 72 are ignored as usual" ) , ( "$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy" diff --git a/tests/KAT_AES.hs b/tests/KAT_AES.hs --- a/tests/KAT_AES.hs +++ b/tests/KAT_AES.hs @@ -5,6 +5,8 @@ import BlockCipher import qualified Crypto.Cipher.AES as AES import Crypto.Cipher.Types +import Crypto.Error +import qualified Data.ByteArray as BA import qualified Data.ByteString as B import Data.Maybe import Imports @@ -113,12 +115,55 @@ , kat_AEAD = map toKatGCM KATGCM.vectors_aes256_enc } +-- SP 800-38D 5.2.1.1: 1 <= len(IV) <= 2^64 - 1. A zero-length IV makes +-- J0 the GHASH of the empty string, which leaks the authentication key. +aeadIVLengthTests :: TestTree +aeadIVLengthTests = + testGroup + "AEAD IV length" + [ testCase "96-bit IV accepted" $ + True @=? isRight (initWith (B.replicate 12 0)) + , testCase "8-bit IV accepted" $ + True @=? isRight (initWith (B.replicate 1 0)) + , testCase "empty IV rejected" $ + Left CryptoError_IvSizeInvalid @=? initWith B.empty + ] + where + ctx = throwCryptoError (cipherInit (B.replicate 16 0)) :: AES.AES128 + initWith iv = + eitherCryptoError (() <$ aeadInit AEAD_GCM ctx (iv :: ByteString)) + isRight = either (const False) (const True) + +aeadTagLengthTests :: TestTree +aeadTagLengthTests = + testGroup + "AEAD tag length" + [ testCase "full tag verifies" $ Just message @=? openWith fullTag + , testCase "empty tag rejected" $ Nothing @=? openWith B.empty + , testCase "1-byte tag rejected" $ Nothing @=? openWith (B.take 1 fullTag) + , testCase "3-byte tag rejected" $ Nothing @=? openWith (B.take 3 fullTag) + , testCase "wrong tag rejected" $ + Nothing @=? openWith (B.map (+ 1) fullTag) + ] + where + key = B.replicate 16 0 + iv = B.replicate 12 0 + aad = "additional data" :: ByteString + message = "authenticated message" :: ByteString + ctx = throwCryptoError (cipherInit key) :: AES.AES128 + aead = throwCryptoError (aeadInit AEAD_GCM ctx iv) + (AuthTag tag, ciphertext) = aeadSimpleEncrypt aead aad message 16 + fullTag = BA.convert tag :: ByteString + openWith t = aeadSimpleDecrypt aead aad ciphertext (AuthTag (BA.convert t)) + tests = testGroup "AES" [ testBlockCipher kats128 (undefined :: AES.AES128) , testBlockCipher kats192 (undefined :: AES.AES192) , testBlockCipher kats256 (undefined :: AES.AES256) + , aeadIVLengthTests + , aeadTagLengthTests {- , testProperty "genCtr" $ \(key, iv1) -> let (bs1, iv2) = AES.genCounter key iv1 32 diff --git a/tests/KAT_AES/KATOCB3.hs b/tests/KAT_AES/KATOCB3.hs --- a/tests/KAT_AES/KATOCB3.hs +++ b/tests/KAT_AES/KATOCB3.hs @@ -18,7 +18,47 @@ key1 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" nonce1 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b" +key2 = "\x0f\x0e\x0d\x0c\x0b\x0a\x09\x08\x07\x06\x05\x04\x03\x02\x01\x00" +nonce2 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d" +nonce_rfc7253_00 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x00" +nonce_rfc7253_01 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x01" +nonce_rfc7253_02 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x02" +nonce_rfc7253_03 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x03" +nonce_rfc7253_04 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x04" +nonce_rfc7253_05 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x05" +nonce_rfc7253_06 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x06" +nonce_rfc7253_07 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x07" +nonce_rfc7253_08 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x08" +nonce_rfc7253_09 = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x09" +nonce_rfc7253_0a = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0a" +nonce_rfc7253_0b = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0b" +nonce_rfc7253_0c = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0c" +nonce_rfc7253_0d = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d" +nonce_rfc7253_0e = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0e" +nonce_rfc7253_0f = "\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0f" +nonce_dkg_120_00 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x00" +nonce_dkg_120_01 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x01" +nonce_dkg_120_02 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x02" +nonce_dkg_120_03 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x03" +nonce_dkg_120_04 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x04" +nonce_dkg_120_05 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x05" +nonce_dkg_120_06 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x06" +nonce_dkg_120_07 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x07" +nonce_dkg_120_08 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x08" +nonce_dkg_120_09 = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x09" +nonce_dkg_120_0a = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0a" +nonce_dkg_120_0b = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0b" +nonce_dkg_120_0c = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0c" +nonce_dkg_120_0d = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0d" +nonce_dkg_120_0e = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0e" +nonce_dkg_120_0f = "\xee\xdd\xcc\xbb\xaa\x99\x88\x77\x66\x55\x44\x33\x22\x11\x0f" +bytes8 = "\x00\x01\x02\x03\x04\x05\x06\x07" +bytes16 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" +bytes24 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17" +bytes32 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f" +bytes40 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27" + vectors_aes128_enc :: [KATOCB3] vectors_aes128_enc = [ @@ -66,4 +106,289 @@ , 16 , "\x77\x6c\x99\x24\xd6\x72\x3a\x1f\xc4\x52\x45\x32\xac\x3e\x5b\xeb" ) + {- Disabled: 96-bit tag vector + , ( key2 + , nonce2 + , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27" + , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27" + , "\x17\x92\xa4\xe3\x1e\x07\x55\xfb\x03\xe3\x1b\x22\x11\x6e\x6c\x2d\xdf\x9e\xfd\x6e\x33\xd5\x36\xf1\xa0\x12\x4b\x0a\x55\xba\xe8\x84\xed\x93\x48\x15\x29\xc7\x6b\x6a" + , 12 + , "\xd0\xc5\x15\xf4\xd1\xcd\xd4\xfd\xac\x4f\x02\xaa" + ) + -} + ] ++ vectors_rfc7253_aes128_tag128 + ++ vectors_dkg_nonce120_aes128 + +vectors_rfc7253_aes128_tag128 :: [KATOCB3] +vectors_rfc7253_aes128_tag128 = + [ ( key1 + , nonce_rfc7253_00 + , "" + , "" + , "" + , 16 + , "\x78\x54\x07\xbf\xff\xc8\xad\x9e\xdc\xc5\x52\x0a\xc9\x11\x1e\xe6" + ) + , ( key1 + , nonce_rfc7253_01 + , bytes8 + , bytes8 + , "\x68\x20\xb3\x65\x7b\x6f\x61\x5a" + , 16 + , "\x57\x25\xbd\xa0\xd3\xb4\xeb\x3a\x25\x7c\x9a\xf1\xf8\xf0\x30\x09" + ) + , ( key1 + , nonce_rfc7253_02 + , bytes8 + , "" + , "" + , 16 + , "\x81\x01\x7f\x82\x03\xf0\x81\x27\x71\x52\xfa\xde\x69\x4a\x0a\x00" + ) + , ( key1 + , nonce_rfc7253_03 + , "" + , bytes8 + , "\x45\xdd\x69\xf8\xf5\xaa\xe7\x24" + , 16 + , "\x14\x05\x4c\xd1\xf3\x5d\x82\x76\x0b\x2c\xd0\x0d\x2f\x99\xbf\xa9" + ) + , ( key1 + , nonce_rfc7253_04 + , bytes16 + , bytes16 + , "\x57\x1d\x53\x5b\x60\xb2\x77\x18\x8b\xe5\x14\x71\x70\xa9\xa2\x2c" + , 16 + , "\x3a\xd7\xa4\xff\x38\x35\xb8\xc5\x70\x1c\x1c\xce\xc8\xfc\x33\x58" + ) + , ( key1 + , nonce_rfc7253_05 + , bytes16 + , "" + , "" + , 16 + , "\x8c\xf7\x61\xb6\x90\x2e\xf7\x64\x46\x2a\xd8\x64\x98\xca\x6b\x97" + ) + , ( key1 + , nonce_rfc7253_06 + , "" + , bytes16 + , "\x5c\xe8\x8e\xc2\xe0\x69\x27\x06\xa9\x15\xc0\x0a\xeb\x8b\x23\x96" + , 16 + , "\xf4\x0e\x1c\x74\x3f\x52\x43\x6b\xdf\x06\xd8\xfa\x1e\xca\x34\x3d" + ) + , ( key1 + , nonce_rfc7253_07 + , bytes24 + , bytes24 + , "\x1c\xa2\x20\x73\x08\xc8\x7c\x01\x07\x56\x10\x4d\x88\x40\xce\x19\x52\xf0\x96\x73\xa4\x48\xa1\x22" + , 16 + , "\xc9\x2c\x62\x24\x10\x51\xf5\x73\x56\xd7\xf3\xc9\x0b\xb0\xe0\x7f" + ) + , ( key1 + , nonce_rfc7253_08 + , bytes24 + , "" + , "" + , 16 + , "\x6d\xc2\x25\xa0\x71\xfc\x1b\x9f\x7c\x69\xf9\x3b\x0f\x1e\x10\xde" + ) + , ( key1 + , nonce_rfc7253_09 + , "" + , bytes24 + , "\x22\x1b\xd0\xde\x7f\xa6\xfe\x99\x3e\xcc\xd7\x69\x46\x0a\x0a\xf2\xd6\xcd\xed\x0c\x39\x5b\x1c\x3c" + , 16 + , "\xe7\x25\xf3\x24\x94\xb9\xf9\x14\xd8\x5c\x0b\x1e\xb3\x83\x57\xff" + ) + , ( key1 + , nonce_rfc7253_0a + , bytes32 + , bytes32 + , "\xbd\x6f\x6c\x49\x62\x01\xc6\x92\x96\xc1\x1e\xfd\x13\x8a\x46\x7a\xbd\x3c\x70\x79\x24\xb9\x64\xde\xaf\xfc\x40\x31\x9a\xf5\xa4\x85" + , 16 + , "\x40\xfb\xba\x18\x6c\x55\x53\xc6\x8a\xd9\xf5\x92\xa7\x9a\x42\x40" + ) + , ( key1 + , nonce_rfc7253_0b + , bytes32 + , "" + , "" + , 16 + , "\xfe\x80\x69\x0b\xee\x8a\x48\x5d\x11\xf3\x29\x65\xbc\x9d\x2a\x32" + ) + , ( key1 + , nonce_rfc7253_0c + , "" + , bytes32 + , "\x29\x42\xbf\xc7\x73\xbd\xa2\x3c\xab\xc6\xac\xfd\x9b\xfd\x58\x35\xbd\x30\x0f\x09\x73\x79\x2e\xf4\x60\x40\xc5\x3f\x14\x32\xbc\xdf" + , 16 + , "\xb5\xe1\xdd\xe3\xbc\x18\xa5\xf8\x40\xb5\x2e\x65\x34\x44\xd5\xdf" + ) + , ( key1 + , nonce_rfc7253_0d + , bytes40 + , bytes40 + , "\xd5\xca\x91\x74\x84\x10\xc1\x75\x1f\xf8\xa2\xf6\x18\x25\x5b\x68\xa0\xa1\x2e\x09\x3f\xf4\x54\x60\x6e\x59\xf9\xc1\xd0\xdd\xc5\x4b\x65\xe8\x62\x8e\x56\x8b\xad\x7a" + , 16 + , "\xed\x07\xba\x06\xa4\xa6\x94\x83\xa7\x03\x54\x90\xc5\x76\x9e\x60" + ) + , ( key1 + , nonce_rfc7253_0e + , bytes40 + , "" + , "" + , 16 + , "\xc5\xcd\x9d\x18\x50\xc1\x41\xe3\x58\x64\x99\x94\xee\x70\x1b\x68" + ) + , ( key1 + , nonce_rfc7253_0f + , "" + , bytes40 + , "\x44\x12\x92\x34\x93\xc5\x7d\x5d\xe0\xd7\x00\xf7\x53\xcc\xe0\xd1\xd2\xd9\x50\x60\x12\x2e\x9f\x15\xa5\xdd\xbf\xc5\x78\x7e\x50\xb5\xcc\x55\xee\x50\x7b\xcb\x08\x4e" + , 16 + , "\x47\x9a\xd3\x63\xac\x36\x6b\x95\xa9\x8c\xa5\xf3\x00\x0b\x14\x79" + ) + ] + +vectors_dkg_nonce120_aes128 :: [KATOCB3] +vectors_dkg_nonce120_aes128 = + [ ( key1 + , nonce_dkg_120_00 + , "" + , "" + , "" + , 16 + , "\x75\x2a\xcd\x21\x32\xc4\x1e\x02\x0e\x41\xfb\x22\x3e\xfd\x77\xb6" + ) + , ( key1 + , nonce_dkg_120_01 + , bytes8 + , bytes8 + , "\x20\x1f\xe4\xd8\x9e\xa7\xbd\x1e" + , 16 + , "\xb5\xb1\x57\x7d\xb1\x62\x83\xb8\xae\xd1\x71\x5a\xd6\xbe\x51\x49" + ) + , ( key1 + , nonce_dkg_120_02 + , bytes8 + , "" + , "" + , 16 + , "\x71\x09\x60\xb9\xee\x00\xb8\xf4\x4d\x2e\x81\x20\xaa\xba\x63\xae" + ) + , ( key1 + , nonce_dkg_120_03 + , "" + , bytes8 + , "\x08\x4e\x86\x95\x70\x19\x4b\xd2" + , 16 + , "\x50\x32\xfe\x9e\x53\x28\xe4\x5d\x50\x7e\x74\xf3\x36\x6e\x20\xd2" + ) + , ( key1 + , nonce_dkg_120_04 + , bytes16 + , bytes16 + , "\x96\x76\xee\x37\xfd\x64\x5c\x07\xc0\xd4\xf7\x0a\xab\xf6\x86\x68" + , 16 + , "\x8e\x39\xb2\xfb\x3f\xc4\xff\x30\xdc\xd1\x82\x7b\x36\xa2\x98\xd3" + ) + , ( key1 + , nonce_dkg_120_05 + , bytes16 + , "" + , "" + , 16 + , "\x9d\x51\x0f\x56\xed\xf7\x2f\xfa\x34\x96\x9b\xce\xf9\x1e\x6d\xe9" + ) + , ( key1 + , nonce_dkg_120_06 + , "" + , bytes16 + , "\xd5\xe1\x5a\xa1\xd2\x32\xab\x57\xf2\x34\x36\x6d\xff\xb2\x55\x74" + , 16 + , "\xa3\x63\x6a\x5f\x3e\x34\x33\xea\x45\x90\xcb\xf4\xf9\xac\x1f\x4d" + ) + , ( key1 + , nonce_dkg_120_07 + , bytes24 + , bytes24 + , "\x1c\x4b\x67\x77\xb7\xf1\x37\xc3\x09\x71\xa9\x3d\xe3\xc5\x6c\xc7\x35\x68\x6a\x6f\x77\x03\x14\x2f" + , 16 + , "\xab\x8a\xcc\x98\x7c\x14\x06\xdf\xf9\x62\x73\xc5\x37\x6e\x62\x10" + ) + , ( key1 + , nonce_dkg_120_08 + , bytes24 + , "" + , "" + , 16 + , "\x96\xe6\x70\xc0\x23\x8f\xb9\x69\xb7\xac\xe4\xab\xaf\x74\x38\xc7" + ) + , ( key1 + , nonce_dkg_120_09 + , "" + , bytes24 + , "\x12\x90\xa6\x86\xd8\x25\xf7\x12\xe5\x94\xbe\x40\x39\xc0\x4d\x3e\x44\xf7\xd1\x34\x2b\x84\xff\xca" + , 16 + , "\xd6\x8b\xbd\xfa\x04\xb5\x80\xea\x9a\x01\xe2\xf4\x56\x53\x99\xc3" + ) + , ( key1 + , nonce_dkg_120_0a + , bytes32 + , bytes32 + , "\xfb\xdf\xc1\x1f\x74\x92\x17\xbb\x7f\xae\x5d\x40\x36\xb8\xf2\x28\x03\x71\x2e\xff\x9e\xf9\x43\x42\xfe\x1b\x68\x49\x68\xd0\xe3\xe3" + , 16 + , "\x81\xa2\x77\xda\xab\x83\x57\x94\x06\xa0\x1e\x26\x75\xa0\x82\xc9" + ) + , ( key1 + , nonce_dkg_120_0b + , bytes32 + , "" + , "" + , 16 + , "\x90\xcd\xa8\xa0\x51\x61\xd2\x87\x33\x61\x37\x4b\x76\xf9\x54\x30" + ) + , ( key1 + , nonce_dkg_120_0c + , "" + , bytes32 + , "\xd1\x32\x0a\xf4\xb6\xff\x8a\xfe\xec\xee\x79\x21\x39\x5d\x4e\x86\x92\x71\x77\x53\xee\x15\xf5\x03\x8e\xb6\x74\xda\x43\xd6\xea\x8d" + , 16 + , "\xbe\x78\x31\xe7\x23\xbe\x47\x1f\x62\xd9\xe7\xf4\x9a\x7d\x3b\x32" + ) + , ( key1 + , nonce_dkg_120_0d + , bytes40 + , bytes40 + , "\x5c\x79\xf1\xc4\xb9\xa2\x04\xed\x33\x23\x61\x6d\x57\x6f\xc5\x00\xe4\xa7\x19\x39\xf0\x3a\x3c\x3d\xe2\xc0\x97\xaf\x2c\x6c\x81\xdc\x3f\x03\x09\xe7\x60\x82\xb1\xf5" + , 16 + , "\x0f\xf8\x52\x29\x59\xff\xe4\x1f\x37\xef\x50\x7e\x90\x76\xd3\x2c" + ) + , ( key1 + , nonce_dkg_120_0e + , bytes40 + , "" + , "" + , 16 + , "\x3b\xf1\x58\xb7\xde\x76\xc5\x15\x1e\xf6\x08\x6a\x82\x5d\x0c\xc4" + ) + , ( key1 + , nonce_dkg_120_0f + , "" + , bytes40 + , "\x34\xda\x59\xd2\xeb\x08\xf4\x78\x22\xd4\x8c\x85\xb6\xa1\xd2\x36\x94\xe1\xd3\xde\x68\x0d\x61\x6d\x7b\x1b\x59\x47\x2c\x13\xe3\x69\xc6\x8d\xca\x69\x9d\xa1\x68\x6a" + , 16 + , "\x33\x9d\x54\x52\x80\x36\x32\x81\x0b\x08\x40\xe6\x80\x4a\xb0\x20" + ) + {- Disabled: 96-bit tag vector + , ( key2 + , nonce_dkg_120_0d + , bytes40 + , bytes40 + , "\x07\xe9\x03\xbf\xc4\x95\x52\x41\x1a\xbc\x86\x5f\x5e\xce\x60\xf6\xfa\xd1\xf5\xa9\xf1\x4d\x30\x70\xfa\x2f\x13\x08\xa5\x63\x20\x7f\xfe\x14\xc1\xee\xa4\x4b\x22\x05" + , 12 + , "\x9c\x74\x84\x31\x9d\x8a\x2c\x53\xc2\x36\xa7\xb3" + ) + -} ] diff --git a/tests/KAT_PubKey/P256.hs b/tests/KAT_PubKey/P256.hs --- a/tests/KAT_PubKey/P256.hs +++ b/tests/KAT_PubKey/P256.hs @@ -73,6 +73,14 @@ xR = 0x72b13dd4354b6b81745195e98cc5ba6970349191ac476bd4553cf35a545a067e yR = 0x8d585cbb2e1327d75241a8a122d7620dc33b13315aa5c9d46d013011744ac264 +-- Two points on the curve whose validation reduces a product whose top +-- digit has a zero low half: x = 2^96, and an x with a repeating bit +-- pattern. Wycheproof ecdh_secp256r1_ecpoint tcId 74 and 93. +xU = 0x0000000000000000000000000000000000000001000000000000000000000000 +yU = 0x7d12de58d54423eb85ae8d157ae416fb004a7eb522ac1b67047ef3cdf9acdc3f +xV = 0x8000003ffffff0000007fffffe000000ffffffc000001ffffff8000003fffffc +yV = 0x0c3527bd081c1c07b313bc1a0c3f845fb2fe22557699ccc8f1354e61a27b7f88 + tests = testGroup "P256" @@ -142,6 +150,12 @@ , testCase "valid-point-1" $ casePointIsValid (xS, yS) , testCase "valid-point-2" $ casePointIsValid (xR, yR) , testCase "valid-point-3" $ casePointIsValid (xT, yT) + , -- The quotient estimate in crypton_p256_modmul can exceed the + -- true quotient, and the resulting borrow used to abort the + -- process on an assertion inside the reduction rather than + -- being corrected. Both points below are on the curve. + testCase "valid-point-reduction-1" $ casePointIsValid (xU, yU) + , testCase "valid-point-reduction-2" $ casePointIsValid (xV, yV) , testCase "point-add-1" $ let s = P256.pointFromIntegers (xS, yS) t = P256.pointFromIntegers (xT, yT)