From ddc2bd6f015e1eaa5f11730abf8d7761bcfbfe77 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Thu, 20 Sep 2018 19:26:43 +0200 Subject: chacha20: add chunked selftest and test sliding alignments and hchacha20 This ensures we're properly updating state[12] and that we're handling all unaligned acceses (in the jump tables for MIPS). --- src/crypto/zinc/selftest/chacha20.h | 3562 ++++++++++++++++++--------- src/crypto/zinc/selftest/chacha20poly1305.h | 65 +- 2 files changed, 2467 insertions(+), 1160 deletions(-) diff --git a/src/crypto/zinc/selftest/chacha20.h b/src/crypto/zinc/selftest/chacha20.h index 4a0e9b8..8ee242d 100644 --- a/src/crypto/zinc/selftest/chacha20.h +++ b/src/crypto/zinc/selftest/chacha20.h @@ -11,1180 +11,2418 @@ struct chacha20_testvec { size_t ilen; }; -/* - * #!/usr/bin/env python3 - * - * import chacha20 - * import os - * import struct - * - * def encode_blob(blob): - * a = "" - * x = 0 - * for i in blob: - * a += ('0x%02x' % i) + "," - * x += 1 - * if x % 8 == 0: - * a += "\n\t\t " - * else: - * a += " " - * if x % 8 == 0: - * return a[:len(a) - 8] - * return a[:len(a) - 2] - * - * enc = [ ] - * dec = [ ] - * - * def make_vector(plen): - * key = os.urandom(32) - * nonce = os.urandom(8) - * p = os.urandom(plen) - * c = chacha20.chacha20_encrypt(p, key, nonce) - * - * out = "{\n" - * out += "\t.key\t= { " + encode_blob(key) + " },\n" - * out += "\t.nonce\t= " + hex(struct.unpack(" CHACHA20_BLOCK_SIZE + 1 || + !chacha20_testvecs[i].ilen) + continue; + for (j = 1; j < CHACHA20_BLOCK_SIZE; ++j) { + memset(computed_output, 0, sizeof(computed_output)); + memset(&state, 0, sizeof(state)); + memcpy(offset_input + j, chacha20_testvecs[i].input, + chacha20_testvecs[i].ilen); + chacha20_init(&state, chacha20_testvecs[i].key, + chacha20_testvecs[i].nonce); + chacha20(&state, computed_output + j, offset_input + j, + chacha20_testvecs[i].ilen, &simd_context); + if (memcmp(computed_output + j, + chacha20_testvecs[i].output, + chacha20_testvecs[i].ilen)) { + pr_info("chacha20 self-test %zu (unaligned, slide %zu): FAIL\n", + i + 1, j); + success = false; + } + } + } + for (i = 0; i < ARRAY_SIZE(hchacha20_testvecs); ++i) { + memset(computed_output, 0, MAXIMUM_TEST_BUFFER_LEN + 1); + hchacha20(computed_output, hchacha20_testvecs[i].nonce, + hchacha20_testvecs[i].key, &simd_context); + if (memcmp(computed_output, hchacha20_testvecs[i].output, + CHACHA20_KEY_SIZE)) { + pr_info("hchacha20 self-test %zu: FAIL\n", i + 1); success = false; } } diff --git a/src/crypto/zinc/selftest/chacha20poly1305.h b/src/crypto/zinc/selftest/chacha20poly1305.h index 100344a..5133231 100644 --- a/src/crypto/zinc/selftest/chacha20poly1305.h +++ b/src/crypto/zinc/selftest/chacha20poly1305.h @@ -11,74 +11,11 @@ struct chacha20poly1305_testvec { }; /* The first of these are the ChaCha20-Poly1305 AEAD test vectors from RFC7539 - * 2.8.2. After they are generated by the below python program. And the final + * 2.8.2. After they are generated by reference implementations. And the final * marked ones are taken from wycheproof, but we only do these for the encrypt * side, because mostly we're stressing the primitives rather than the actual * chapoly construction. This also requires adding a 96-bit nonce construction, * just for the purpose of the tests. - * - * #!/usr/bin/env python3 - * - * from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 - * import os - * - * def encode_blob(blob): - * a = "" - * for i in blob: - * a += "\\x" + hex(i)[2:] - * return a - * - * enc = [ ] - * dec = [ ] - * - * def make_vector(plen, adlen): - * key = os.urandom(32) - * nonce = os.urandom(8) - * p = os.urandom(plen) - * ad = os.urandom(adlen) - * c = ChaCha20Poly1305(key).encrypt(nonce=bytes(4) + nonce, data=p, associated_data=ad) - * - * out = "{\n" - * out += "\t.key\t= \"" + encode_blob(key) + "\",\n" - * out += "\t.nonce\t= \"" + encode_blob(nonce) + "\",\n" - * out += "\t.assoc\t= \"" + encode_blob(ad) + "\",\n" - * out += "\t.alen\t= " + str(len(ad)) + ",\n" - * out += "\t.input\t= \"" + encode_blob(p) + "\",\n" - * out += "\t.ilen\t= " + str(len(p)) + ",\n" - * out += "\t.output\t= \"" + encode_blob(c) + "\"\n" - * out += "}" - * enc.append(out) - * - * - * out = "{\n" - * out += "\t.key\t= \"" + encode_blob(key) + "\",\n" - * out += "\t.nonce\t= \"" + encode_blob(nonce) + "\",\n" - * out += "\t.assoc\t= \"" + encode_blob(ad) + "\",\n" - * out += "\t.alen\t= " + str(len(ad)) + ",\n" - * out += "\t.input\t= \"" + encode_blob(c) + "\",\n" - * out += "\t.ilen\t= " + str(len(c)) + ",\n" - * out += "\t.output\t= \"" + encode_blob(p) + "\"\n" - * out += "}" - * dec.append(out) - * - * - * make_vector(0, 0) - * make_vector(0, 8) - * make_vector(1, 8) - * make_vector(1, 0) - * make_vector(129, 7) - * make_vector(256, 0) - * make_vector(512, 0) - * make_vector(513, 9) - * make_vector(1024, 16) - * make_vector(1933, 7) - * make_vector(2011, 63) - * - * print("======== encryption vectors ========") - * print(", ".join(enc)) - * - * print("\n\n\n======== decryption vectors ========") - * print(", ".join(dec)) */ static const u8 enc_input001[] __initconst = { -- cgit v1.2.3-59-g8ed1b