| // Copyright 2021 The BoringSSL Authors |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // https://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| package subprocess |
| |
| import ( |
| "bytes" |
| "encoding/hex" |
| "encoding/json" |
| "fmt" |
| ) |
| |
| // The following structures reflect the JSON of ACVP KAS KDF tests. See |
| // https://pages.nist.gov/ACVP/draft-hammett-acvp-kas-kdf-hkdf.html |
| // https://pages.nist.gov/ACVP/draft-hammett-acvp-kas-kdf-onestepnocounter.html |
| |
| type multiModeKda struct { |
| modes map[string]primitive |
| } |
| |
| func (k multiModeKda) Process(vectorSet []byte, m Transactable) (any, error) { |
| var vector struct { |
| Mode string `json:"mode"` |
| } |
| if err := json.Unmarshal(vectorSet, &vector); err != nil { |
| return nil, fmt.Errorf("invalid KDA test vector: %w", err) |
| } |
| mode, ok := k.modes[vector.Mode] |
| if !ok { |
| return nil, fmt.Errorf("unsupported KDA mode %q", vector.Mode) |
| } |
| return mode.Process(vectorSet, m) |
| } |
| |
| type kdaPartyInfo struct { |
| IDHex string `json:"partyId"` |
| ExtraHex string `json:"ephemeralData"` |
| } |
| |
| func (p *kdaPartyInfo) data() ([]byte, error) { |
| ret, err := hex.DecodeString(p.IDHex) |
| if err != nil { |
| return nil, err |
| } |
| if len(p.ExtraHex) > 0 { |
| extra, err := hex.DecodeString(p.ExtraHex) |
| if err != nil { |
| return nil, err |
| } |
| ret = append(ret, extra...) |
| } |
| return ret, nil |
| } |
| |
| type hkdfTestVectorSet struct { |
| Mode string `json:"mode"` |
| Groups []hkdfTestGroup `json:"testGroups"` |
| } |
| |
| type hkdfTestGroup struct { |
| ID uint64 `json:"tgId"` |
| Type string `json:"testType"` // AFT or VAL |
| Config hkdfConfiguration `json:"kdfConfiguration"` |
| Tests []hkdfTest `json:"tests"` |
| } |
| |
| type hkdfTest struct { |
| ID uint64 `json:"tcId"` |
| Params hkdfParameters `json:"kdfParameter"` |
| PartyU kdaPartyInfo `json:"fixedInfoPartyU"` |
| PartyV kdaPartyInfo `json:"fixedInfoPartyV"` |
| ExpectedHex string `json:"dkm"` |
| } |
| |
| type hkdfConfiguration struct { |
| Type string `json:"kdfType"` |
| OutputBits uint32 `json:"l"` |
| HashName string `json:"hmacAlg"` |
| FixedInfoPattern string `json:"fixedInfoPattern"` |
| FixedInputEncoding string `json:"fixedInfoEncoding"` |
| } |
| |
| func (c *hkdfConfiguration) extract() (outBytes uint32, hashName string, err error) { |
| if c.Type != "hkdf" || |
| c.FixedInfoPattern != "uPartyInfo||vPartyInfo" || |
| c.FixedInputEncoding != "concatenation" || |
| c.OutputBits%8 != 0 { |
| return 0, "", fmt.Errorf("KDA not configured for HKDF: %#v", c) |
| } |
| |
| return c.OutputBits / 8, c.HashName, nil |
| } |
| |
| type hkdfParameters struct { |
| SaltHex string `json:"salt"` |
| KeyHex string `json:"z"` |
| } |
| |
| func (p *hkdfParameters) extract() (key, salt []byte, err error) { |
| salt, err = hex.DecodeString(p.SaltHex) |
| if err != nil { |
| return nil, nil, err |
| } |
| |
| key, err = hex.DecodeString(p.KeyHex) |
| if err != nil { |
| return nil, nil, err |
| } |
| |
| return key, salt, nil |
| } |
| |
| type hkdfTestGroupResponse struct { |
| ID uint64 `json:"tgId"` |
| Tests []hkdfTestResponse `json:"tests"` |
| } |
| |
| type hkdfTestResponse struct { |
| ID uint64 `json:"tcId"` |
| KeyOut string `json:"dkm,omitempty"` |
| Passed *bool `json:"testPassed,omitempty"` |
| } |
| |
| type hkdf struct{} |
| |
| func (k *hkdf) Process(vectorSet []byte, m Transactable) (any, error) { |
| var parsed hkdfTestVectorSet |
| if err := json.Unmarshal(vectorSet, &parsed); err != nil { |
| return nil, err |
| } |
| |
| if parsed.Mode != "HKDF" { |
| return nil, fmt.Errorf("unexpected KDA mode %q", parsed.Mode) |
| } |
| |
| var respGroups []hkdfTestGroupResponse |
| for _, group := range parsed.Groups { |
| group := group |
| groupResp := hkdfTestGroupResponse{ID: group.ID} |
| |
| var isValidationTest bool |
| switch group.Type { |
| case "VAL": |
| isValidationTest = true |
| case "AFT": |
| isValidationTest = false |
| default: |
| return nil, fmt.Errorf("unknown test type %q", group.Type) |
| } |
| |
| outBytes, hashName, err := group.Config.extract() |
| if err != nil { |
| return nil, err |
| } |
| |
| for _, test := range group.Tests { |
| test := test |
| testResp := hkdfTestResponse{ID: test.ID} |
| |
| key, salt, err := test.Params.extract() |
| if err != nil { |
| return nil, err |
| } |
| uData, err := test.PartyU.data() |
| if err != nil { |
| return nil, err |
| } |
| vData, err := test.PartyV.data() |
| if err != nil { |
| return nil, err |
| } |
| |
| var expected []byte |
| if isValidationTest { |
| expected, err = hex.DecodeString(test.ExpectedHex) |
| if err != nil { |
| return nil, err |
| } |
| } |
| |
| info := make([]byte, 0, len(uData)+len(vData)) |
| info = append(info, uData...) |
| info = append(info, vData...) |
| |
| m.TransactAsync("HKDF/"+hashName, 1, [][]byte{key, salt, info, uint32le(outBytes)}, func(result [][]byte) error { |
| if len(result[0]) != int(outBytes) { |
| return fmt.Errorf("HKDF operation resulted in %d bytes but wanted %d", len(result[0]), outBytes) |
| } |
| if isValidationTest { |
| passed := bytes.Equal(expected, result[0]) |
| testResp.Passed = &passed |
| } else { |
| testResp.KeyOut = hex.EncodeToString(result[0]) |
| } |
| |
| groupResp.Tests = append(groupResp.Tests, testResp) |
| return nil |
| }) |
| } |
| |
| m.Barrier(func() { |
| respGroups = append(respGroups, groupResp) |
| }) |
| } |
| |
| if err := m.Flush(); err != nil { |
| return nil, err |
| } |
| |
| return respGroups, nil |
| } |
| |
| type oneStepTestVectorSet struct { |
| Mode string `json:"mode"` |
| Groups []oneStepTestGroup `json:"testGroups"` |
| } |
| |
| type oneStepTestGroup struct { |
| ID uint64 `json:"tgId"` |
| Type string `json:"testType"` // AFT or VAL |
| Config oneStepConfiguration `json:"kdfConfiguration"` |
| Tests []oneStepTest `json:"tests"` |
| } |
| |
| type oneStepConfiguration struct { |
| Type string `json:"kdfType"` |
| SaltMethod string `json:"saltMethod"` |
| FixedInfoPattern string `json:"fixedInfoPattern"` |
| FixedInputEncoding string `json:"fixedInfoEncoding"` |
| AuxFunction string `json:"auxFunction"` |
| OutputBits uint32 `json:"l"` |
| } |
| |
| func (c *oneStepConfiguration) extract() (outBytes uint32, auxFunction string, err error) { |
| if c.Type != "oneStepNoCounter" || |
| c.FixedInfoPattern != "uPartyInfo||vPartyInfo" || |
| c.FixedInputEncoding != "concatenation" || |
| c.OutputBits%8 != 0 { |
| return 0, "", fmt.Errorf("KDA not configured for OneStepNoCounter: %#v", c) |
| } |
| return c.OutputBits / 8, c.AuxFunction, nil |
| } |
| |
| type oneStepTest struct { |
| ID uint64 `json:"tcId"` |
| Params oneStepTestParameters `json:"kdfParameter"` |
| FixedInfoPartyU kdaPartyInfo `json:"fixedInfoPartyU"` |
| FixedInfoPartyV kdaPartyInfo `json:"fixedInfoPartyV"` |
| DerivedKeyHex string `json:"dkm,omitempty"` // For VAL tests only. |
| } |
| |
| type oneStepTestParameters struct { |
| KdfType string `json:"kdfType"` |
| SaltHex string `json:"salt"` |
| ZHex string `json:"z"` |
| OutputBits uint32 `json:"l"` |
| } |
| |
| func (p oneStepTestParameters) extract() (key []byte, salt []byte, outLen uint32, err error) { |
| if p.KdfType != "oneStepNoCounter" || |
| p.OutputBits%8 != 0 { |
| return nil, nil, 0, fmt.Errorf("KDA not configured for OneStepNoCounter: %#v", p) |
| } |
| outLen = p.OutputBits / 8 |
| salt, err = hex.DecodeString(p.SaltHex) |
| if err != nil { |
| return |
| } |
| key, err = hex.DecodeString(p.ZHex) |
| if err != nil { |
| return |
| } |
| return |
| } |
| |
| type oneStepTestGroupResponse struct { |
| ID uint64 `json:"tgId"` |
| Tests []oneStepTestResponse `json:"tests"` |
| } |
| |
| type oneStepTestResponse struct { |
| ID uint64 `json:"tcId"` |
| KeyOut string `json:"dkm,omitempty"` // For AFT |
| Passed *bool `json:"testPassed,omitempty"` // For VAL |
| } |
| |
| type oneStepNoCounter struct{} |
| |
| func (k oneStepNoCounter) Process(vectorSet []byte, m Transactable) (any, error) { |
| var parsed oneStepTestVectorSet |
| if err := json.Unmarshal(vectorSet, &parsed); err != nil { |
| return nil, err |
| } |
| |
| if parsed.Mode != "OneStepNoCounter" { |
| return nil, fmt.Errorf("unexpected KDA mode %q", parsed.Mode) |
| } |
| |
| var respGroups []oneStepTestGroupResponse |
| for _, group := range parsed.Groups { |
| group := group |
| |
| groupResp := oneStepTestGroupResponse{ID: group.ID} |
| outBytes, hashName, err := group.Config.extract() |
| if err != nil { |
| return nil, err |
| } |
| |
| var isValidationTest bool |
| switch group.Type { |
| case "VAL": |
| isValidationTest = true |
| case "AFT": |
| isValidationTest = false |
| default: |
| return nil, fmt.Errorf("unknown test type %q", group.Type) |
| } |
| |
| for _, test := range group.Tests { |
| test := test |
| testResp := oneStepTestResponse{ID: test.ID} |
| |
| key, salt, paramsOutBytes, err := test.Params.extract() |
| if err != nil { |
| return nil, err |
| } |
| if paramsOutBytes != outBytes { |
| return nil, fmt.Errorf("test %d in group %d: output length mismatch: %d != %d", test.ID, group.ID, paramsOutBytes, outBytes) |
| } |
| |
| uData, err := test.FixedInfoPartyU.data() |
| if err != nil { |
| return nil, err |
| } |
| vData, err := test.FixedInfoPartyV.data() |
| if err != nil { |
| return nil, err |
| } |
| |
| info := make([]byte, 0, len(uData)+len(vData)) |
| info = append(info, uData...) |
| info = append(info, vData...) |
| var expected []byte |
| if isValidationTest { |
| expected, err = hex.DecodeString(test.DerivedKeyHex) |
| if err != nil { |
| return nil, fmt.Errorf("test %d in group %d: invalid DerivedKeyHex: %w", test.ID, group.ID, err) |
| } |
| } |
| |
| cmd := "OneStepNoCounter/" + hashName |
| m.TransactAsync(cmd, 1, [][]byte{key, info, salt, uint32le(outBytes)}, func(result [][]byte) error { |
| if len(result[0]) != int(outBytes) { |
| return fmt.Errorf("OneStepNoCounter operation resulted in %d bytes but wanted %d", len(result[0]), outBytes) |
| } |
| |
| if isValidationTest { |
| passed := bytes.Equal(expected, result[0]) |
| testResp.Passed = &passed |
| } else { |
| testResp.KeyOut = hex.EncodeToString(result[0]) |
| } |
| |
| groupResp.Tests = append(groupResp.Tests, testResp) |
| return nil |
| }) |
| } |
| |
| m.Barrier(func() { |
| respGroups = append(respGroups, groupResp) |
| }) |
| } |
| |
| if err := m.Flush(); err != nil { |
| return nil, err |
| } |
| |
| return respGroups, nil |
| } |
