1 /* Copyright (c) 2001-2004, Roger Dingledine.
2 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3 * Copyright (c) 2007-2016, The Tor Project, Inc. */
4 /* See LICENSE for licensing information */
7 #define CRYPTO_S2K_PRIVATE
10 #include "crypto_s2k.h"
11 #include "crypto_pwbox.h"
13 #if defined(HAVE_LIBSCRYPT_H) && defined(HAVE_LIBSCRYPT_SCRYPT)
14 #define HAVE_LIBSCRYPT
15 #include <libscrypt.h>
18 #include <openssl/evp.h>
20 /** Run unit tests for our secret-to-key passphrase hashing functionality. */
22 test_crypto_s2k_rfc2440(void *arg
)
30 memset(buf
, 0, sizeof(buf
));
31 memset(buf2
, 0, sizeof(buf2
));
32 buf3
= tor_malloc(65536);
33 memset(buf3
, 0, 65536);
35 secret_to_key_rfc2440(buf
+9, 20, "", 0, buf
);
36 crypto_digest(buf2
+9, buf3
, 1024);
37 tt_mem_op(buf
,OP_EQ
, buf2
, 29);
39 memcpy(buf
,"vrbacrda",8);
40 memcpy(buf2
,"vrbacrda",8);
43 secret_to_key_rfc2440(buf
+9, 20, "12345678", 8, buf
);
44 for (i
= 0; i
< 65536; i
+= 16) {
45 memcpy(buf3
+i
, "vrbacrda12345678", 16);
47 crypto_digest(buf2
+9, buf3
, 65536);
48 tt_mem_op(buf
,OP_EQ
, buf2
, 29);
55 run_s2k_tests(const unsigned flags
, const unsigned type
,
56 int speclen
, const int keylen
, int legacy
)
58 uint8_t buf
[S2K_MAXLEN
], buf2
[S2K_MAXLEN
], buf3
[S2K_MAXLEN
];
61 const char pw1
[] = "You can't come in here unless you say swordfish!";
62 const char pw2
[] = "Now, I give you one more guess.";
64 r
= secret_to_key_new(buf
, sizeof(buf
), &sz
,
65 pw1
, strlen(pw1
), flags
);
66 tt_int_op(r
, OP_EQ
, S2K_OKAY
);
67 tt_int_op(buf
[0], OP_EQ
, type
);
69 tt_int_op(sz
, OP_EQ
, keylen
+ speclen
);
72 memmove(buf
, buf
+1, sz
-1);
77 tt_int_op(S2K_OKAY
, OP_EQ
,
78 secret_to_key_check(buf
, sz
, pw1
, strlen(pw1
)));
80 tt_int_op(S2K_BAD_SECRET
, OP_EQ
,
81 secret_to_key_check(buf
, sz
, pw2
, strlen(pw2
)));
83 /* Move key to buf2, and clear it. */
84 memset(buf3
, 0, sizeof(buf3
));
85 memcpy(buf2
, buf
+speclen
, keylen
);
86 memset(buf
+speclen
, 0, sz
- speclen
);
88 /* Derivekey should produce the same results. */
89 tt_int_op(S2K_OKAY
, OP_EQ
,
90 secret_to_key_derivekey(buf3
, keylen
, buf
, speclen
, pw1
, strlen(pw1
)));
92 tt_mem_op(buf2
, OP_EQ
, buf3
, keylen
);
94 /* Derivekey with a longer output should fill the output. */
95 memset(buf2
, 0, sizeof(buf2
));
96 tt_int_op(S2K_OKAY
, OP_EQ
,
97 secret_to_key_derivekey(buf2
, sizeof(buf2
), buf
, speclen
,
100 tt_mem_op(buf2
, OP_NE
, buf3
, sizeof(buf2
));
102 memset(buf3
, 0, sizeof(buf3
));
103 tt_int_op(S2K_OKAY
, OP_EQ
,
104 secret_to_key_derivekey(buf3
, sizeof(buf3
), buf
, speclen
,
106 tt_mem_op(buf2
, OP_EQ
, buf3
, sizeof(buf3
));
107 tt_assert(!tor_mem_is_zero((char*)buf2
+keylen
, sizeof(buf2
)-keylen
));
114 test_crypto_s2k_general(void *arg
)
116 const char *which
= arg
;
118 if (!strcmp(which
, "scrypt")) {
119 run_s2k_tests(0, 2, 19, 32, 0);
120 } else if (!strcmp(which
, "scrypt-low")) {
121 run_s2k_tests(S2K_FLAG_LOW_MEM
, 2, 19, 32, 0);
122 } else if (!strcmp(which
, "pbkdf2")) {
123 run_s2k_tests(S2K_FLAG_USE_PBKDF2
, 1, 18, 20, 0);
124 } else if (!strcmp(which
, "rfc2440")) {
125 run_s2k_tests(S2K_FLAG_NO_SCRYPT
, 0, 10, 20, 0);
126 } else if (!strcmp(which
, "rfc2440-legacy")) {
127 run_s2k_tests(S2K_FLAG_NO_SCRYPT
, 0, 10, 20, 1);
133 #if defined(HAVE_LIBSCRYPT) && defined(HAVE_EVP_PBE_SCRYPT)
135 test_libscrypt_eq_openssl(void *arg
)
142 uint64_t maxmem
= 0; // --> SCRYPT_MAX_MEM in OpenSSL.
144 int libscrypt_retval
, openssl_retval
;
153 /* NOTE: we're using N,r the way OpenSSL and libscrypt define them,
154 * not the way draft-josefsson-scrypt-kdf-00.txt define them.
161 libscrypt_scrypt((const uint8_t *)"", 0, (const uint8_t *)"", 0,
162 N
, r
, p
, buf1
, dk_len
);
164 EVP_PBE_scrypt((const char *)"", 0, (const unsigned char *)"", 0,
165 N
, r
, p
, maxmem
, buf2
, dk_len
);
167 tt_int_op(libscrypt_retval
, ==, 0);
168 tt_int_op(openssl_retval
, ==, 1);
170 tt_mem_op(buf1
, ==, buf2
, 64);
180 libscrypt_scrypt((const uint8_t *)"password", strlen("password"),
181 (const uint8_t *)"NaCl", strlen("NaCl"),
182 N
, r
, p
, buf1
, dk_len
);
184 EVP_PBE_scrypt((const char *)"password", strlen("password"),
185 (const unsigned char *)"NaCl", strlen("NaCl"),
186 N
, r
, p
, maxmem
, buf2
, dk_len
);
188 tt_int_op(libscrypt_retval
, ==, 0);
189 tt_int_op(openssl_retval
, ==, 1);
191 tt_mem_op(buf1
, ==, buf2
, 64);
201 libscrypt_scrypt((const uint8_t *)"pleaseletmein",
202 strlen("pleaseletmein"),
203 (const uint8_t *)"SodiumChloride",
204 strlen("SodiumChloride"),
205 N
, r
, p
, buf1
, dk_len
);
207 EVP_PBE_scrypt((const char *)"pleaseletmein",
208 strlen("pleaseletmein"),
209 (const unsigned char *)"SodiumChloride",
210 strlen("SodiumChloride"),
211 N
, r
, p
, maxmem
, buf2
, dk_len
);
213 tt_int_op(libscrypt_retval
, ==, 0);
214 tt_int_op(openssl_retval
, ==, 1);
216 tt_mem_op(buf1
, ==, buf2
, 64);
222 maxmem
= 2 * 1024 * 1024 * (uint64_t)1024; // 2 GB
225 libscrypt_scrypt((const uint8_t *)"pleaseletmein",
226 strlen("pleaseletmein"),
227 (const uint8_t *)"SodiumChloride",
228 strlen("SodiumChloride"),
229 N
, r
, p
, buf1
, dk_len
);
231 EVP_PBE_scrypt((const char *)"pleaseletmein",
232 strlen("pleaseletmein"),
233 (const unsigned char *)"SodiumChloride",
234 strlen("SodiumChloride"),
235 N
, r
, p
, maxmem
, buf2
, dk_len
);
237 tt_int_op(libscrypt_retval
, ==, 0);
238 tt_int_op(openssl_retval
, ==, 1);
240 tt_mem_op(buf1
, ==, buf2
, 64);
248 test_crypto_s2k_errors(void *arg
)
250 uint8_t buf
[S2K_MAXLEN
], buf2
[S2K_MAXLEN
];
255 /* Bogus specifiers: simple */
256 tt_int_op(S2K_BAD_LEN
, OP_EQ
,
257 secret_to_key_derivekey(buf
, sizeof(buf
),
258 (const uint8_t*)"", 0, "ABC", 3));
259 tt_int_op(S2K_BAD_ALGORITHM
, OP_EQ
,
260 secret_to_key_derivekey(buf
, sizeof(buf
),
261 (const uint8_t*)"\x10", 1, "ABC", 3));
262 tt_int_op(S2K_BAD_LEN
, OP_EQ
,
263 secret_to_key_derivekey(buf
, sizeof(buf
),
264 (const uint8_t*)"\x01\x02", 2, "ABC", 3));
266 tt_int_op(S2K_BAD_LEN
, OP_EQ
,
267 secret_to_key_check((const uint8_t*)"", 0, "ABC", 3));
268 tt_int_op(S2K_BAD_ALGORITHM
, OP_EQ
,
269 secret_to_key_check((const uint8_t*)"\x10", 1, "ABC", 3));
270 tt_int_op(S2K_BAD_LEN
, OP_EQ
,
271 secret_to_key_check((const uint8_t*)"\x01\x02", 2, "ABC", 3));
273 /* too long gets "BAD_LEN" too */
274 memset(buf
, 0, sizeof(buf
));
276 tt_int_op(S2K_BAD_LEN
, OP_EQ
,
277 secret_to_key_derivekey(buf2
, sizeof(buf2
),
278 buf
, sizeof(buf
), "ABC", 3));
280 /* Truncated output */
281 #ifdef HAVE_LIBSCRYPT
282 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_new(buf
, 50, &sz
,
284 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_new(buf
, 50, &sz
,
285 "ABC", 3, S2K_FLAG_LOW_MEM
));
287 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_new(buf
, 37, &sz
,
288 "ABC", 3, S2K_FLAG_USE_PBKDF2
));
289 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_new(buf
, 29, &sz
,
290 "ABC", 3, S2K_FLAG_NO_SCRYPT
));
292 #ifdef HAVE_LIBSCRYPT
293 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_make_specifier(buf
, 18, 0));
294 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_make_specifier(buf
, 18,
297 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_make_specifier(buf
, 17,
298 S2K_FLAG_USE_PBKDF2
));
299 tt_int_op(S2K_TRUNCATED
, OP_EQ
, secret_to_key_make_specifier(buf
, 9,
300 S2K_FLAG_NO_SCRYPT
));
302 /* Now try using type-specific bogus specifiers. */
304 /* It's a bad pbkdf2 buffer if it has an iteration count that would overflow
306 memset(buf
, 0, sizeof(buf
));
307 buf
[0] = 1; /* pbkdf2 */
308 buf
[17] = 100; /* 1<<100 is much bigger than INT32_MAX */
309 tt_int_op(S2K_BAD_PARAMS
, OP_EQ
,
310 secret_to_key_derivekey(buf2
, sizeof(buf2
),
313 #ifdef HAVE_LIBSCRYPT
314 /* It's a bad scrypt buffer if N would overflow uint64 */
315 memset(buf
, 0, sizeof(buf
));
316 buf
[0] = 2; /* scrypt */
317 buf
[17] = 100; /* 1<<100 is much bigger than UINT64_MAX */
318 tt_int_op(S2K_BAD_PARAMS
, OP_EQ
,
319 secret_to_key_derivekey(buf2
, sizeof(buf2
),
328 test_crypto_scrypt_vectors(void *arg
)
330 char *mem_op_hex_tmp
= NULL
;
331 uint8_t spec
[64], out
[64];
334 #ifndef HAVE_LIBSCRYPT
340 http://tools.ietf.org/html/draft-josefsson-scrypt-kdf-00 section 11.
342 Note that the names of 'r' and 'N' are switched in that section. Or
343 possibly in libscrypt.
346 base16_decode((char*)spec
, sizeof(spec
),
348 memset(out
, 0x00, sizeof(out
));
350 secret_to_key_compute_key(out
, 64, spec
, 2, "", 0, 2));
352 "77d6576238657b203b19ca42c18a0497"
353 "f16b4844e3074ae8dfdffa3fede21442"
354 "fcd0069ded0948f8326a753a0fc81f17"
355 "e8d3e0fb2e0d3628cf35e20c38d18906");
357 base16_decode((char*)spec
, sizeof(spec
),
358 "4e61436c" "0A34", 12);
359 memset(out
, 0x00, sizeof(out
));
361 secret_to_key_compute_key(out
, 64, spec
, 6, "password", 8, 2));
363 "fdbabe1c9d3472007856e7190d01e9fe"
364 "7c6ad7cbc8237830e77376634b373162"
365 "2eaf30d92e22a3886ff109279d9830da"
366 "c727afb94a83ee6d8360cbdfa2cc0640");
368 base16_decode((char*)spec
, sizeof(spec
),
369 "536f6469756d43686c6f72696465" "0e30", 32);
370 memset(out
, 0x00, sizeof(out
));
372 secret_to_key_compute_key(out
, 64, spec
, 16,
373 "pleaseletmein", 13, 2));
375 "7023bdcb3afd7348461c06cd81fd38eb"
376 "fda8fbba904f8e3ea9b543f6545da1f2"
377 "d5432955613f0fcf62d49705242a9af9"
378 "e61e85dc0d651e40dfcf017b45575887");
380 base16_decode((char*)spec
, sizeof(spec
),
381 "536f6469756d43686c6f72696465" "1430", 32);
382 memset(out
, 0x00, sizeof(out
));
384 secret_to_key_compute_key(out
, 64, spec
, 16,
385 "pleaseletmein", 13, 2));
387 "2101cb9b6a511aaeaddbbe09cf70f881"
388 "ec568d574a2ffd4dabe5ee9820adaa47"
389 "8e56fd8f4ba5d09ffa1c6d927c40f4c3"
390 "37304049e8a952fbcbf45c6fa77a41a4");
393 tor_free(mem_op_hex_tmp
);
397 test_crypto_pbkdf2_vectors(void *arg
)
399 char *mem_op_hex_tmp
= NULL
;
400 uint8_t spec
[64], out
[64];
403 /* Test vectors from RFC6070, section 2 */
404 base16_decode((char*)spec
, sizeof(spec
),
405 "73616c74" "00" , 10);
406 memset(out
, 0x00, sizeof(out
));
408 secret_to_key_compute_key(out
, 20, spec
, 5, "password", 8, 1));
409 test_memeq_hex(out
, "0c60c80f961f0e71f3a9b524af6012062fe037a6");
411 base16_decode((char*)spec
, sizeof(spec
),
412 "73616c74" "01" , 10);
413 memset(out
, 0x00, sizeof(out
));
415 secret_to_key_compute_key(out
, 20, spec
, 5, "password", 8, 1));
416 test_memeq_hex(out
, "ea6c014dc72d6f8ccd1ed92ace1d41f0d8de8957");
418 base16_decode((char*)spec
, sizeof(spec
),
419 "73616c74" "0C" , 10);
420 memset(out
, 0x00, sizeof(out
));
422 secret_to_key_compute_key(out
, 20, spec
, 5, "password", 8, 1));
423 test_memeq_hex(out
, "4b007901b765489abead49d926f721d065a429c1");
425 /* This is the very slow one here. When enabled, it accounts for roughly
426 * half the time spent in test-slow. */
428 base16_decode((char*)spec, sizeof(spec),
429 "73616c74" "18" , 10);
430 memset(out, 0x00, sizeof(out));
432 secret_to_key_compute_key(out, 20, spec, 5, "password", 8, 1));
433 test_memeq_hex(out, "eefe3d61cd4da4e4e9945b3d6ba2158c2634e984");
436 base16_decode((char*)spec
, sizeof(spec
),
437 "73616c7453414c5473616c7453414c5473616c745"
438 "3414c5473616c7453414c5473616c74" "0C" , 74);
439 memset(out
, 0x00, sizeof(out
));
441 secret_to_key_compute_key(out
, 25, spec
, 37,
442 "passwordPASSWORDpassword", 24, 1));
443 test_memeq_hex(out
, "3d2eec4fe41c849b80c8d83662c0e44a8b291a964cf2f07038");
445 base16_decode((char*)spec
, sizeof(spec
),
446 "7361006c74" "0c" , 12);
447 memset(out
, 0x00, sizeof(out
));
449 secret_to_key_compute_key(out
, 16, spec
, 6, "pass\0word", 9, 1));
450 test_memeq_hex(out
, "56fa6aa75548099dcc37d7f03425e0c3");
453 tor_free(mem_op_hex_tmp
);
457 test_crypto_pwbox(void *arg
)
459 uint8_t *boxed
=NULL
, *decoded
=NULL
;
462 const char msg
[] = "This bunny reminds you that you still have a "
463 "salamander in your sylladex. She is holding the bunny Dave got you. "
464 "It’s sort of uncanny how similar they are, aside from the knitted "
465 "enhancements. Seriously, what are the odds?? So weird.";
466 const char pw
[] = "I'm a night owl and a wise bird too";
468 const unsigned flags
[] = { 0,
471 S2K_FLAG_NO_SCRYPT
|S2K_FLAG_LOW_MEM
,
472 S2K_FLAG_USE_PBKDF2
};
475 for (i
= 0; i
< ARRAY_LENGTH(flags
); ++i
) {
476 tt_int_op(0, OP_EQ
, crypto_pwbox(&boxed
, &len
,
477 (const uint8_t*)msg
, strlen(msg
),
478 pw
, strlen(pw
), flags
[i
]));
480 tt_assert(len
> 128+32);
482 tt_int_op(0, OP_EQ
, crypto_unpwbox(&decoded
, &dlen
, boxed
, len
,
486 tt_uint_op(dlen
, OP_EQ
, strlen(msg
));
487 tt_mem_op(decoded
, OP_EQ
, msg
, dlen
);
491 tt_int_op(UNPWBOX_BAD_SECRET
, OP_EQ
, crypto_unpwbox(&decoded
, &dlen
,
495 tt_int_op(UNPWBOX_BAD_SECRET
, OP_EQ
, crypto_unpwbox(&decoded
, &dlen
,
499 tt_int_op(UNPWBOX_CORRUPTED
, OP_EQ
, crypto_unpwbox(&decoded
, &dlen
,
512 test_crypto_ed25519_fuzz_donna(void *arg
)
514 const unsigned iters
= 1024;
519 tt_assert(sizeof(msg
) == iters
);
520 crypto_rand((char*) msg
, sizeof(msg
));
522 /* Fuzz Ed25519-donna vs ref10, alternating the implementation used to
523 * generate keys/sign per iteration.
525 for (i
= 0; i
< iters
; ++i
) {
526 const int use_donna
= i
& 1;
527 uint8_t blinding
[32];
528 curve25519_keypair_t ckp
;
529 ed25519_keypair_t kp
, kp_blind
, kp_curve25519
;
530 ed25519_public_key_t pk
, pk_blind
, pk_curve25519
;
531 ed25519_signature_t sig
, sig_blind
;
534 crypto_rand((char*) blinding
, sizeof(blinding
));
537 * 1. Generate a keypair.
538 * 2. Blinded the keypair.
539 * 3. Sign a message (unblinded).
540 * 4. Sign a message (blinded).
541 * 5. Generate a curve25519 keypair, and convert it to Ed25519.
543 ed25519_set_impl_params(use_donna
);
544 tt_int_op(0, OP_EQ
, ed25519_keypair_generate(&kp
, i
&1));
545 tt_int_op(0, OP_EQ
, ed25519_keypair_blind(&kp_blind
, &kp
, blinding
));
546 tt_int_op(0, OP_EQ
, ed25519_sign(&sig
, msg
, i
, &kp
));
547 tt_int_op(0, OP_EQ
, ed25519_sign(&sig_blind
, msg
, i
, &kp_blind
));
549 tt_int_op(0, OP_EQ
, curve25519_keypair_generate(&ckp
, i
&1));
550 tt_int_op(0, OP_EQ
, ed25519_keypair_from_curve25519_keypair(
551 &kp_curve25519
, &bit
, &ckp
));
554 * 1. Validate the public key by rederiving it.
555 * 2. Validate the blinded public key by rederiving it.
556 * 3. Validate the unblinded signature (and test a invalid signature).
557 * 4. Validate the blinded signature.
558 * 5. Validate the public key (from Curve25519) by rederiving it.
560 ed25519_set_impl_params(!use_donna
);
561 tt_int_op(0, OP_EQ
, ed25519_public_key_generate(&pk
, &kp
.seckey
));
562 tt_mem_op(pk
.pubkey
, OP_EQ
, kp
.pubkey
.pubkey
, 32);
564 tt_int_op(0, OP_EQ
, ed25519_public_blind(&pk_blind
, &kp
.pubkey
, blinding
));
565 tt_mem_op(pk_blind
.pubkey
, OP_EQ
, kp_blind
.pubkey
.pubkey
, 32);
567 tt_int_op(0, OP_EQ
, ed25519_checksig(&sig
, msg
, i
, &pk
));
569 tt_int_op(-1, OP_EQ
, ed25519_checksig(&sig
, msg
, sizeof(msg
), &pk
));
571 tt_int_op(0, OP_EQ
, ed25519_checksig(&sig_blind
, msg
, i
, &pk_blind
));
573 tt_int_op(0, OP_EQ
, ed25519_public_key_from_curve25519_public_key(
574 &pk_curve25519
, &ckp
.pubkey
, bit
));
575 tt_mem_op(pk_curve25519
.pubkey
, OP_EQ
, kp_curve25519
.pubkey
.pubkey
, 32);
582 #define CRYPTO_LEGACY(name) \
583 { #name, test_crypto_ ## name , 0, NULL, NULL }
585 #define ED25519_TEST_ONE(name, fl, which) \
586 { #name "/ed25519_" which, test_crypto_ed25519_ ## name, (fl), \
587 &ed25519_test_setup, (void*)which }
589 #define ED25519_TEST(name, fl) \
590 ED25519_TEST_ONE(name, (fl), "donna"), \
591 ED25519_TEST_ONE(name, (fl), "ref10")
593 struct testcase_t slow_crypto_tests
[] = {
594 CRYPTO_LEGACY(s2k_rfc2440
),
595 #ifdef HAVE_LIBSCRYPT
596 { "s2k_scrypt", test_crypto_s2k_general
, 0, &passthrough_setup
,
598 { "s2k_scrypt_low", test_crypto_s2k_general
, 0, &passthrough_setup
,
599 (void*)"scrypt-low" },
600 #ifdef HAVE_EVP_PBE_SCRYPT
601 { "libscrypt_eq_openssl", test_libscrypt_eq_openssl
, 0, NULL
, NULL
},
604 { "s2k_pbkdf2", test_crypto_s2k_general
, 0, &passthrough_setup
,
606 { "s2k_rfc2440_general", test_crypto_s2k_general
, 0, &passthrough_setup
,
608 { "s2k_rfc2440_legacy", test_crypto_s2k_general
, 0, &passthrough_setup
,
609 (void*)"rfc2440-legacy" },
610 { "s2k_errors", test_crypto_s2k_errors
, 0, NULL
, NULL
},
611 { "scrypt_vectors", test_crypto_scrypt_vectors
, 0, NULL
, NULL
},
612 { "pbkdf2_vectors", test_crypto_pbkdf2_vectors
, 0, NULL
, NULL
},
613 { "pwbox", test_crypto_pwbox
, 0, NULL
, NULL
},
614 ED25519_TEST(fuzz_donna
, TT_FORK
),