test_digest.c

   1 /*
   2  * Test GOST 34.11 Digest operation
   3  *
   4  * Copyright (C) 2019-2020 Vitaly Chikunov <vt@altlinux.org>. All Rights Reserved.
   5  *
   6  * Contents licensed under the terms of the OpenSSL license
   7  * See https://www.openssl.org/source/license.html for details
   8  */
   9
  10 #include <openssl/engine.h>
  11 #include <openssl/evp.h>
  12 #include <openssl/hmac.h>
  13 #include <openssl/rand.h>
  14 #include <openssl/err.h>
  15 #include <openssl/asn1.h>
  16 #include <openssl/obj_mac.h>
  17 #include <string.h>
  18 #include <stdlib.h>
  19 #if MIPSEL
  20 # include <sys/sysmips.h>
  21 #endif
  22 #ifndef EVP_MD_CTRL_SET_KEY
  23 # include "gost_lcl.h"
  24 #endif
  25
  26 /* Helpers to test OpenSSL API calls. */
  27 #define T(e) ({ if (!(e)) { \
  28                 ERR_print_errors_fp(stderr); \
  29                 OpenSSLDie(__FILE__, __LINE__, #e); \
  30             } \
  31         })
  32 #define TE(e) ({ if (!(e)) { \
  33                 ERR_print_errors_fp(stderr); \
  34                 fprintf(stderr, "Error at %s:%d %s\n", __FILE__, __LINE__, #e); \
  35                 return -1; \
  36             } \
  37         })
  38
  39 #define cRED    "\033[1;31m"
  40 #define cDRED   "\033[0;31m"
  41 #define cGREEN  "\033[1;32m"
  42 #define cDGREEN "\033[0;32m"
  43 #define cBLUE   "\033[1;34m"
  44 #define cDBLUE  "\033[0;34m"
  45 #define cNORM   "\033[m"
  46 #define TEST_ASSERT(e) {if ((test = (e))) \
  47                  printf(cRED "  Test FAILED\n" cNORM); \
  48              else \
  49                  printf(cGREEN "  Test passed\n" cNORM);}
  50
  51 /*
  52  * Test keys from both GOST R 34.12-2015 and GOST R 34.13-2015,
  53  * for 128-bit cipher (A.1).
  54  */
  55 static const char K[32] = {
  56     0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
  57     0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,
  58 };
  59
  60 /*
  61  * Key for 64-bit cipher (A.2).
  62  */
  63 static const char Km[32] = {
  64     0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,0x77,0x66,0x55,0x44,0x33,0x22,0x11,0x00,
  65     0xf0,0xf1,0xf2,0xf3,0xf4,0xf5,0xf6,0xf7,0xf8,0xf9,0xfa,0xfb,0xfc,0xfd,0xfe,0xff,
  66 };
  67
  68 /*
  69  * Plaintext from GOST R 34.13-2015 A.1.
  70  * First 16 bytes is vector (a) from GOST R 34.12-2015 A.1.
  71  */
  72 static const char P[] = {
  73     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,
  74     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,
  75     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,
  76     0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,0x11,
  77 };
  78
  79 /* Plaintext for 64-bit cipher (A.2) */
  80 static const char Pm[] = {
  81     0x92,0xde,0xf0,0x6b,0x3c,0x13,0x0a,0x59,0xdb,0x54,0xc7,0x04,0xf8,0x18,0x9d,0x20,
  82     0x4a,0x98,0xfb,0x2e,0x67,0xa8,0x02,0x4c,0x89,0x12,0x40,0x9b,0x17,0xb5,0x7e,0x41,
  83 };
  84
  85 /*
  86  * Kuznyechik OMAC1/CMAC test vector from GOST R 34.13-2015 А.1.6
  87  */
  88 static const char MAC_omac[] = { 0x33,0x6f,0x4d,0x29,0x60,0x59,0xfb,0xe3 };
  89
  90 /*
  91  * Magma OMAC1/CMAC test vector from GOST R 34.13-2015 А.2.6
  92  */
  93 static const char MAC_magma_omac[] = { 0x15,0x4e,0x72,0x10 };
  94
  95 /*
  96  * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.1
  97  */
  98 static const char P_omac_acpkm1[] = {
  99     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
 100     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
 101 };
 102
 103 static const char MAC_omac_acpkm1[] = {
 104     0xB5,0x36,0x7F,0x47,0xB6,0x2B,0x99,0x5E,0xEB,0x2A,0x64,0x8C,0x58,0x43,0x14,0x5E,
 105 };
 106
 107 /*
 108  * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.2
 109  */
 110 static const char P_omac_acpkm2[] = {
 111     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
 112     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,
 113     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,
 114     0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,
 115     0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,
 116 };
 117
 118 static const char MAC_omac_acpkm2[] = {
 119     0xFB,0xB8,0xDC,0xEE,0x45,0xBE,0xA6,0x7C,0x35,0xF5,0x8C,0x57,0x00,0x89,0x8E,0x5D,
 120 };
 121
 122 /* Some other test vectors. */
 123 static const char etalon_M4[64] = { 0 };
 124
 125 static const char etalon_M5[] = {
 126     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 127     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 128     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 129     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 130 };
 131
 132 static const char etalon_M6[] = {
 133     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 134     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 135     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 136     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 137     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 138     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 139     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 140     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 141     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 142     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 143     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 144     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 145 };
 146
 147 static const char etalon_carry[] = {
 148     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 149     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 150     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 151     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 152     0x16,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 153     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 154     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 155     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x16,
 156 };
 157
 158 struct hash_testvec {
 159     int nid;               /* OpenSSL algorithm numeric id. */
 160     const char *name;      /* Test name and source. */
 161     const char *plaintext; /* Input (of psize), NULL for synthetic test. */
 162     const char *digest;    /* Expected output (of EVP_MD_size or truncate). */
 163     const char *hmac;      /* Expected output for HMAC tests. */
 164     const char *key;       /* MAC key.*/
 165     int psize;             /* Input (plaintext) size. */
 166     int mdsize;            /* Compare to EVP_MD_size() if non-zero. */
 167     int truncate;          /* Truncated output (digest) size. */
 168     int key_size;          /* MAC key size. */
 169     int block_size;        /* Internal block size. */
 170     int acpkm;             /* The section size N (the number of bits that are
 171                               processed with one section key before this key is
 172                               transformed) (bytes) */
 173     int acpkm_t;           /* Master key (change) frequency T* (bytes) */
 174 };
 175
 176 static const struct hash_testvec testvecs[] = {
 177     { /* Test vectors from standards. */
 178         .nid = NID_id_GostR3411_2012_512,
 179         .name = "M1 from RFC 6986 (10.1.1) and GOST R 34.11-2012 (А.1.1)",
 180         .plaintext =
 181             "012345678901234567890123456789012345678901234567890123456789012",
 182         .psize = 63,
 183         .digest =
 184             "\x1b\x54\xd0\x1a\x4a\xf5\xb9\xd5\xcc\x3d\x86\xd6\x8d\x28\x54\x62"
 185             "\xb1\x9a\xbc\x24\x75\x22\x2f\x35\xc0\x85\x12\x2b\xe4\xba\x1f\xfa"
 186             "\x00\xad\x30\xf8\x76\x7b\x3a\x82\x38\x4c\x65\x74\xf0\x24\xc3\x11"
 187             "\xe2\xa4\x81\x33\x2b\x08\xef\x7f\x41\x79\x78\x91\xc1\x64\x6f\x48",
 188         .mdsize = 512 / 8,
 189         .block_size = 512 / 8,
 190     },
 191     {
 192         .nid = NID_id_GostR3411_2012_256,
 193         .name = "M1 from RFC 6986 (10.1.2) and GOST R 34.11-2012 (А.1.2)",
 194         .plaintext =
 195             "012345678901234567890123456789012345678901234567890123456789012",
 196         .psize = 63,
 197         .digest =
 198             "\x9d\x15\x1e\xef\xd8\x59\x0b\x89\xda\xa6\xba\x6c\xb7\x4a\xf9\x27"
 199             "\x5d\xd0\x51\x02\x6b\xb1\x49\xa4\x52\xfd\x84\xe5\xe5\x7b\x55\x00",
 200         .mdsize = 256 / 8,
 201         .block_size = 512 / 8,
 202     },
 203     {
 204         .nid = NID_id_GostR3411_2012_512,
 205         .name = "M2 from RFC 6986 (10.2.1) and GOST R 34.11-2012 (А.2.1)",
 206         .plaintext =
 207             "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
 208             "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
 209             "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
 210             "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
 211             "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
 212         .psize = 72,
 213         .digest =
 214             "\x1e\x88\xe6\x22\x26\xbf\xca\x6f\x99\x94\xf1\xf2\xd5\x15\x69\xe0"
 215             "\xda\xf8\x47\x5a\x3b\x0f\xe6\x1a\x53\x00\xee\xe4\x6d\x96\x13\x76"
 216             "\x03\x5f\xe8\x35\x49\xad\xa2\xb8\x62\x0f\xcd\x7c\x49\x6c\xe5\xb3"
 217             "\x3f\x0c\xb9\xdd\xdc\x2b\x64\x60\x14\x3b\x03\xda\xba\xc9\xfb\x28",
 218     },
 219     {
 220         .nid = NID_id_GostR3411_2012_256,
 221         .name = "M2 from RFC 6986 (10.2.2) and GOST R 34.11-2012 (А.2.2)",
 222         .plaintext =
 223             "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
 224             "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
 225             "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
 226             "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
 227             "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
 228         .psize = 72,
 229         .digest =
 230             "\x9d\xd2\xfe\x4e\x90\x40\x9e\x5d\xa8\x7f\x53\x97\x6d\x74\x05\xb0"
 231             "\xc0\xca\xc6\x28\xfc\x66\x9a\x74\x1d\x50\x06\x3c\x55\x7e\x8f\x50",
 232     },
 233     /* OMAC tests */
 234     {
 235         .nid = NID_grasshopper_mac,
 236         .name = "P from GOST R 34.13-2015 (А.1.6)",
 237         .plaintext = P,
 238         .psize = sizeof(P),
 239         .key = K,
 240         .key_size = sizeof(K),
 241         .digest = MAC_omac,
 242         .mdsize = 128 / 8,
 243         .truncate = sizeof(MAC_omac),
 244     },
 245     {
 246         .nid = NID_magma_mac,
 247         .name = "P from GOST R 34.13-2015 (А.2.6)",
 248         .plaintext = Pm,
 249         .psize = sizeof(Pm),
 250         .key = Km,
 251         .key_size = sizeof(Km),
 252         .digest = MAC_magma_omac,
 253         .mdsize = 64 / 8,
 254         .truncate = sizeof(MAC_magma_omac),
 255     },
 256     {
 257         .nid = NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
 258         .name = "M from R 1323565.1.017-2018 (A.4.1)",
 259         .plaintext = P_omac_acpkm1,
 260         .psize = sizeof(P_omac_acpkm1),
 261         .key = K,
 262         .key_size = sizeof(K),
 263         .acpkm = 32,
 264         .acpkm_t = 768 / 8,
 265         .digest = MAC_omac_acpkm1,
 266         .mdsize = sizeof(MAC_omac_acpkm1),
 267     },
 268     {
 269         .nid = NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
 270         .name = "M from R 1323565.1.017-2018 (A.4.2)",
 271         .plaintext = P_omac_acpkm2,
 272         .psize = sizeof(P_omac_acpkm2),
 273         .key = K,
 274         .key_size = sizeof(K),
 275         .acpkm = 32,
 276         .acpkm_t = 768 / 8,
 277         .digest = MAC_omac_acpkm2,
 278         .mdsize = sizeof(MAC_omac_acpkm2),
 279     },
 280     { /* HMAC tests. */
 281         .nid = NID_id_GostR3411_2012_512,
 282         .name = "HMAC_GOSTR3411_2012_512 from RFC 7836 (B) and R 50.1.113-2016 (A)",
 283         .plaintext =
 284             "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
 285         .psize = 16,
 286         .key =
 287             "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 288             "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
 289         .key_size = 32,
 290         .hmac =
 291             "\xa5\x9b\xab\x22\xec\xae\x19\xc6\x5f\xbd\xe6\xe5\xf4\xe9\xf5\xd8"
 292             "\x54\x9d\x31\xf0\x37\xf9\xdf\x9b\x90\x55\x00\xe1\x71\x92\x3a\x77"
 293             "\x3d\x5f\x15\x30\xf2\xed\x7e\x96\x4c\xb2\xee\xdc\x29\xe9\xad\x2f"
 294             "\x3a\xfe\x93\xb2\x81\x4f\x79\xf5\x00\x0f\xfc\x03\x66\xc2\x51\xe6",
 295     },
 296     {
 297         .nid = NID_id_GostR3411_2012_256,
 298         .name = "HMAC_GOSTR3411_2012_256 from RFC 7836 (B) and R 50.1.113-2016 (A)",
 299         .plaintext =
 300             "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
 301         .psize = 16,
 302         .key =
 303             "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 304             "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
 305         .key_size = 32,
 306         .hmac =
 307             "\xa1\xaa\x5f\x7d\xe4\x02\xd7\xb3\xd3\x23\xf2\x99\x1c\x8d\x45\x34"
 308             "\x01\x31\x37\x01\x0a\x83\x75\x4f\xd0\xaf\x6d\x7c\xd4\x92\x2e\xd9",
 309     },
 310     /* Other KATs. */
 311     {
 312         .nid = NID_id_GostR3411_2012_512,
 313         .name = "Zero length string (M3)",
 314         .plaintext = "",
 315         .psize = 0,
 316         .digest =
 317             "\x8e\x94\x5d\xa2\x09\xaa\x86\x9f\x04\x55\x92\x85\x29\xbc\xae\x46"
 318             "\x79\xe9\x87\x3a\xb7\x07\xb5\x53\x15\xf5\x6c\xeb\x98\xbe\xf0\xa7"
 319             "\x36\x2f\x71\x55\x28\x35\x6e\xe8\x3c\xda\x5f\x2a\xac\x4c\x6a\xd2"
 320             "\xba\x3a\x71\x5c\x1b\xcd\x81\xcb\x8e\x9f\x90\xbf\x4c\x1c\x1a\x8a",
 321         .mdsize = 512 / 8,
 322     },
 323     {
 324         .nid = NID_id_GostR3411_2012_256,
 325         .name = "Zero length string (M3)",
 326         .plaintext = "",
 327         .psize = 0,
 328         .digest =
 329             "\x3f\x53\x9a\x21\x3e\x97\xc8\x02\xcc\x22\x9d\x47\x4c\x6a\xa3\x2a"
 330             "\x82\x5a\x36\x0b\x2a\x93\x3a\x94\x9f\xd9\x25\x20\x8d\x9c\xe1\xbb",
 331         .mdsize = 256 / 8,
 332     },
 333     { /* M4 */
 334         .nid = NID_id_GostR3411_2012_512,
 335         .name = "64 bytes of zeros (M4)",
 336         .plaintext = etalon_M4,
 337         .psize = sizeof(etalon_M4),
 338         .digest =
 339             "\xb0\xfd\x29\xac\x1b\x0d\xf4\x41\x76\x9f\xf3\xfd\xb8\xdc\x56\x4d"
 340             "\xf6\x77\x21\xd6\xac\x06\xfb\x28\xce\xff\xb7\xbb\xaa\x79\x48\xc6"
 341             "\xc0\x14\xac\x99\x92\x35\xb5\x8c\xb2\x6f\xb6\x0f\xb1\x12\xa1\x45"
 342             "\xd7\xb4\xad\xe9\xae\x56\x6b\xf2\x61\x14\x02\xc5\x52\xd2\x0d\xb7"
 343     },
 344     {
 345         .nid = NID_id_GostR3411_2012_256,
 346         .name = "64 bytes of zeros (M4)",
 347         .plaintext = etalon_M4,
 348         .psize = sizeof(etalon_M4),
 349         .digest =
 350             "\xdf\x1f\xda\x9c\xe8\x31\x91\x39\x05\x37\x35\x80\x31\xdb\x2e\xca"
 351             "\xa6\xaa\x54\xcd\x0e\xda\x24\x1d\xc1\x07\x10\x5e\x13\x63\x6b\x95"
 352     },
 353     { /* M5 */
 354         .nid = NID_id_GostR3411_2012_512,
 355         .name = "64 bytes of (M5)",
 356         .plaintext = etalon_M5,
 357         .psize = sizeof(etalon_M5),
 358         .digest =
 359             "\x36\x3b\x44\x9e\xc8\x1a\xe4\x0b\x3a\x40\x7b\x12\x5c\x3b\x1c\x2b"
 360             "\x76\x8b\x50\x49\x6b\xcb\x5f\x69\x0b\x89\xe9\x00\x7b\x06\xe4\x08"
 361             "\x41\x82\xed\x45\xd4\x07\x2a\x67\xfe\xc9\xd3\x42\x1d\xab\x01\x3d"
 362             "\xa2\xaa\xbc\x1d\x65\x28\xe8\xe7\x75\xae\xc7\xb3\x45\x7a\xc6\x75"
 363     },
 364     {
 365         .nid = NID_id_GostR3411_2012_256,
 366         .name = "64 bytes of (M5)",
 367         .plaintext = etalon_M5,
 368         .psize = sizeof(etalon_M5),
 369         .digest =
 370             "\xf0\xa5\x57\xf6\xa0\x4a\x90\xab\x18\x11\xc1\xb6\xe9\xb0\x78\xe4"
 371             "\x16\x3b\x74\x03\x7c\x6c\xf5\x9f\x52\x44\x4a\x37\xf4\x8e\x11\xd8"
 372     },
 373     { /* M6 */
 374         .nid = NID_id_GostR3411_2012_512,
 375         .name = "(M6)",
 376         .plaintext = etalon_M6,
 377         .psize = sizeof(etalon_M6),
 378         .digest =
 379             "\x87\x81\xdf\xc8\x1d\x2d\xb6\xa4\x1d\x18\x57\xf3\x23\x0b\x3f\xfe"
 380             "\x2b\xda\x57\x42\x73\xea\x19\x47\x18\x9a\xaa\x54\x68\x47\x0d\xf1"
 381             "\xc4\xb3\x74\xb1\xa2\xb5\x6e\x59\xd1\x1d\x21\x3f\xea\x57\xe3\x51"
 382             "\x45\x43\xb0\xce\xd9\xb2\x0e\x55\x3a\xe6\x64\x25\xec\x90\x9c\xfd"
 383     },
 384     {
 385         .nid = NID_id_GostR3411_2012_256,
 386         .name = "(M6)",
 387         .plaintext = etalon_M6,
 388         .psize = sizeof(etalon_M6),
 389         .digest =
 390             "\x2f\x4f\x65\x1f\xe8\x8f\xea\x46\xec\x6f\x22\x23\x72\x8d\x8d\xff"
 391             "\x39\x68\x89\x35\x58\xef\x00\xa3\x10\xc2\x3e\x7d\x19\x23\xba\x0c"
 392     },
 393     { /* carry */
 394         .nid = NID_id_GostR3411_2012_512,
 395         .name = "(carry)",
 396         .plaintext = etalon_carry,
 397         .psize = sizeof(etalon_carry),
 398         .digest =
 399             "\x8b\x06\xf4\x1e\x59\x90\x7d\x96\x36\xe8\x92\xca\xf5\x94\x2f\xcd"
 400             "\xfb\x71\xfa\x31\x16\x9a\x5e\x70\xf0\xed\xb8\x73\x66\x4d\xf4\x1c"
 401             "\x2c\xce\x6e\x06\xdc\x67\x55\xd1\x5a\x61\xcd\xeb\x92\xbd\x60\x7c"
 402             "\xc4\xaa\xca\x67\x32\xbf\x35\x68\xa2\x3a\x21\x0d\xd5\x20\xfd\x41"
 403     },
 404     {
 405         .nid = NID_id_GostR3411_2012_256,
 406         .name = "(carry)",
 407         .plaintext = etalon_carry,
 408         .psize = sizeof(etalon_carry),
 409         .digest =
 410             "\x81\xbb\x63\x2f\xa3\x1f\xcc\x38\xb4\xc3\x79\xa6\x62\xdb\xc5\x8b"
 411             "\x9b\xed\x83\xf5\x0d\x3a\x1b\x2c\xe7\x27\x1a\xb0\x2d\x25\xba\xbb"
 412     },
 413     /* Synthetic tests. */
 414     {
 415         .nid = NID_id_GostR3411_2012_256,
 416         .name = "streebog256 synthetic test",
 417         .mdsize = 32,
 418         .block_size = 64,
 419         .digest =
 420             "\xa2\xf3\x6d\x9c\x42\xa1\x1e\xad\xe3\xc1\xfe\x99\xf9\x99\xc3\x84"
 421             "\xe7\x98\xae\x24\x50\x75\x73\xd7\xfc\x99\x81\xa0\x45\x85\x41\xf6"
 422     }, {
 423         .nid = NID_id_GostR3411_2012_512,
 424         .name = "streebog512 synthetic test",
 425         .mdsize = 64,
 426         .block_size = 64,
 427         .digest =
 428             "\x1d\x14\x4d\xd8\xb8\x27\xfb\x55\x1a\x5a\x7d\x03\xbb\xdb\xfa\xcb"
 429             "\x43\x6b\x5b\xc5\x77\x59\xfd\x5f\xf2\x3b\x8e\xf9\xc4\xdd\x6f\x79"
 430             "\x45\xd8\x16\x59\x9e\xaa\xbc\xf2\xb1\x4f\xd0\xe4\xf6\xad\x46\x60"
 431             "\x90\x89\xf7\x2f\x93\xd8\x85\x0c\xb0\x43\xff\x5a\xb6\xe3\x69\xbd"
 432     },
 433     { 0 }
 434 };
 435
 436 static void hexdump(const void *ptr, size_t len)
 437 {
 438     const unsigned char *p = ptr;
 439     size_t i, j;
 440
 441     for (i = 0; i < len; i += j) {
 442         for (j = 0; j < 16 && i + j < len; j++)
 443             printf("%s%02x", j? "" : " ", p[i + j]);
 444     }
 445     printf("\n");
 446 }
 447
 448 static int do_hmac(const EVP_MD *type, const char *plaintext,
 449     unsigned int psize, const char *etalon, int mdsize,
 450     const char *key, unsigned int key_size)
 451 {
 452     HMAC_CTX *ctx;
 453     T(ctx = HMAC_CTX_new());
 454     T(HMAC_Init_ex(ctx, key, key_size, type, NULL));
 455     if (mdsize)
 456         T(HMAC_size(ctx) == mdsize);
 457     else
 458         T(mdsize = HMAC_size(ctx));
 459     T(HMAC_Update(ctx, (const unsigned char *)plaintext, psize));
 460
 461     unsigned int len;
 462     unsigned char md[EVP_MAX_MD_SIZE];
 463     T(HMAC_Final(ctx, md, &len));
 464
 465     HMAC_CTX_free(ctx);
 466     T(len == mdsize);
 467
 468     if (memcmp(md, etalon, mdsize) != 0) {
 469         printf(cRED "hmac mismatch\n" cNORM);
 470         hexdump(etalon, mdsize);
 471         hexdump(md, mdsize);
 472         return 1;
 473     }
 474
 475     return 0;
 476 }
 477 static int do_digest(const EVP_MD *type, const char *plaintext,
 478     unsigned int psize, const char *etalon, int mdsize, int truncate,
 479     const char *key, unsigned int key_size, int acpkm, int acpkm_t,
 480     int block_size)
 481 {
 482     if (mdsize)
 483         T(EVP_MD_size(type) == mdsize);
 484     if (truncate)
 485         mdsize = truncate;
 486     else
 487         mdsize = EVP_MD_size(type);
 488
 489     if (block_size)
 490         T(EVP_MD_block_size(type) == block_size);
 491     EVP_MD_CTX *ctx;
 492     T(ctx = EVP_MD_CTX_new());
 493     T(EVP_MD_CTX_init(ctx));
 494     T(EVP_DigestInit_ex(ctx, type, NULL));
 495     if (key)
 496         T(EVP_MD_CTX_ctrl(ctx, EVP_MD_CTRL_SET_KEY, key_size, (void *)key));
 497     if (acpkm)
 498         T(EVP_MD_CTX_ctrl(ctx,
 499                 EVP_CTRL_KEY_MESH, acpkm, acpkm_t? &acpkm_t : NULL));
 500     T(EVP_DigestUpdate(ctx, plaintext, psize));
 501
 502     unsigned int len;
 503     unsigned char md[EVP_MAX_MD_SIZE];
 504
 505     if (EVP_MD_flags(EVP_MD_CTX_md(ctx)) & EVP_MD_FLAG_XOF) {
 506         T(EVP_DigestFinalXOF(ctx, md, mdsize));
 507         len = mdsize;
 508     } else {
 509         T(EVP_MD_CTX_size(ctx) == mdsize);
 510         T(EVP_DigestFinal_ex(ctx, md, &len));
 511     }
 512
 513     EVP_MD_CTX_free(ctx);
 514     T(len == mdsize);
 515     if (memcmp(md, etalon, mdsize) != 0) {
 516         printf(cRED "digest mismatch\n" cNORM);
 517         hexdump(etalon, mdsize);
 518         hexdump(md, mdsize);
 519         return 1;
 520     }
 521
 522     return 0;
 523 }
 524
 525 static int do_test(const struct hash_testvec *tv)
 526 {
 527     int ret = 0;
 528
 529     const EVP_MD *type;
 530     T(type = EVP_get_digestbynid(tv->nid));
 531     const char *name = EVP_MD_name(type);
 532     printf(cBLUE "%s Test %s: %s: " cNORM, tv->hmac? "HMAC" : "MD",
 533         name, tv->name);
 534     fflush(stdout);
 535     if (tv->hmac)
 536         ret |= do_hmac(type, tv->plaintext, tv->psize, tv->hmac,
 537             tv->mdsize, tv->key, tv->key_size);
 538     else
 539         ret |= do_digest(type, tv->plaintext, tv->psize, tv->digest,
 540             tv->mdsize, tv->truncate, tv->key, tv->key_size, tv->acpkm,
 541             tv->acpkm_t, tv->block_size);
 542
 543     /* Test alignment problems. */
 544     int shifts = 32;
 545     int i;
 546     char *buf;
 547     T(buf = OPENSSL_malloc(tv->psize + shifts));
 548     for (i = 0; i < shifts; i++) {
 549         memcpy(buf + i, tv->plaintext, tv->psize);
 550         if (tv->hmac)
 551             ret |= do_hmac(type, buf + i, tv->psize, tv->hmac,
 552                 tv->mdsize, tv->key, tv->key_size);
 553         else
 554             ret |= do_digest(type, buf + i, tv->psize, tv->digest,
 555                 tv->mdsize, tv->truncate, tv->key, tv->key_size,
 556                 tv->acpkm, tv->acpkm_t, tv->block_size);
 557     }
 558     OPENSSL_free(buf);
 559
 560     if (!ret)
 561         printf(cGREEN "success\n" cNORM);
 562     else
 563         printf(cRED "fail\n" cNORM);
 564     return ret;
 565 }
 566
 567 #define SUPER_SIZE 256
 568 /*
 569  * For 256-byte buffer filled with 256 bytes from 0 to 255;
 570  * Digest them 256 times from the buffer end with lengths from 0 to 256,
 571  * and from beginning of the buffer with lengths from 0 to 256;
 572  * Each produced digest is digested again into final sum.
 573  */
 574 static int do_synthetic_once(const struct hash_testvec *tv, unsigned int shifts)
 575 {
 576     unsigned char *ibuf, *md;
 577     T(ibuf = OPENSSL_zalloc(SUPER_SIZE + shifts));
 578
 579     /* fill with pattern */
 580     unsigned int len;
 581     for (len = 0; len < SUPER_SIZE; len++)
 582             ibuf[shifts + len] = len & 0xff;
 583
 584     const EVP_MD *mdtype;
 585     T(mdtype = EVP_get_digestbynid(tv->nid));
 586     OPENSSL_assert(tv->nid == EVP_MD_type(mdtype));
 587     EVP_MD_CTX *ctx, *ctx2;
 588     T(ctx  = EVP_MD_CTX_new());
 589     T(ctx2 = EVP_MD_CTX_new());
 590     T(EVP_DigestInit(ctx2, mdtype));
 591     OPENSSL_assert(tv->nid == EVP_MD_CTX_type(ctx2));
 592     OPENSSL_assert(EVP_MD_block_size(mdtype) == tv->block_size);
 593     OPENSSL_assert(EVP_MD_CTX_size(ctx2) == tv->mdsize);
 594     OPENSSL_assert(EVP_MD_CTX_block_size(ctx2) == tv->block_size);
 595
 596     const unsigned int mdlen = EVP_MD_size(mdtype);
 597     OPENSSL_assert(mdlen == tv->mdsize);
 598     T(md = OPENSSL_zalloc(mdlen + shifts));
 599     md += shifts; /* test for output digest alignment problems */
 600
 601     /* digest cycles */
 602     for (len = 0; len < SUPER_SIZE; len++) {
 603         /* for each len digest len bytes from the end of buf */
 604         T(EVP_DigestInit(ctx, mdtype));
 605         T(EVP_DigestUpdate(ctx, ibuf + shifts + SUPER_SIZE - len, len));
 606         T(EVP_DigestFinal(ctx, md, NULL));
 607         T(EVP_DigestUpdate(ctx2, md, mdlen));
 608     }
 609
 610     for (len = 0; len < SUPER_SIZE; len++) {
 611         /* for each len digest len bytes from the beginning of buf */
 612         T(EVP_DigestInit(ctx, mdtype));
 613         T(EVP_DigestUpdate(ctx, ibuf + shifts, len));
 614         T(EVP_DigestFinal(ctx, md, NULL));
 615         T(EVP_DigestUpdate(ctx2, md, mdlen));
 616     }
 617
 618     OPENSSL_free(ibuf);
 619     EVP_MD_CTX_free(ctx);
 620
 621     T(EVP_DigestFinal(ctx2, md, &len));
 622     EVP_MD_CTX_free(ctx2);
 623
 624     if (len != mdlen) {
 625         printf(cRED "digest output len mismatch %u != %u (expected)\n" cNORM,
 626             len, mdlen);
 627         goto err;
 628     }
 629
 630     if (memcmp(md, tv->digest, mdlen) != 0) {
 631         printf(cRED "digest mismatch\n" cNORM);
 632
 633         unsigned int i;
 634         printf("  Expected value is: ");
 635         for (i = 0; i < mdlen; i++)
 636             printf("\\x%02x", md[i]);
 637         printf("\n");
 638         goto err;
 639     }
 640
 641     OPENSSL_free(md - shifts);
 642     return 0;
 643 err:
 644     OPENSSL_free(md - shifts);
 645     return 1;
 646 }
 647
 648 /* do different block sizes and different memory offsets */
 649 static int do_synthetic_test(const struct hash_testvec *tv)
 650 {
 651     int ret = 0;
 652
 653     printf(cBLUE "MD Test %s: " cNORM, tv->name);
 654     fflush(stdout);
 655
 656     unsigned int shifts;
 657     for (shifts = 0; shifts < 16 && !ret; shifts++)
 658         ret |= do_synthetic_once(tv, shifts);
 659
 660     if (!ret)
 661         printf(cGREEN "success\n" cNORM);
 662     else
 663         printf(cRED "fail\n" cNORM);
 664     return 0;
 665 }
 666
 667 int main(int argc, char **argv)
 668 {
 669     int ret = 0;
 670
 671 #if MIPSEL
 672     /* Trigger SIGBUS for unaligned access. */
 673     sysmips(MIPS_FIXADE, 0);
 674 #endif
 675     setenv("OPENSSL_ENGINES", ENGINE_DIR, 0);
 676     OPENSSL_add_all_algorithms_conf();
 677     ERR_load_crypto_strings();
 678     ENGINE *eng;
 679     T(eng = ENGINE_by_id("gost"));
 680     T(ENGINE_init(eng));
 681     T(ENGINE_set_default(eng, ENGINE_METHOD_ALL));
 682
 683     const struct hash_testvec *tv;
 684     for (tv = testvecs; tv->nid; tv++) {
 685         if (tv->plaintext)
 686             ret |= do_test(tv);
 687         else
 688             ret |= do_synthetic_test(tv);
 689     }
 690
 691     ENGINE_finish(eng);
 692     ENGINE_free(eng);
 693
 694     if (ret)
 695         printf(cDRED "= Some tests FAILED!\n" cNORM);
 696     else
 697         printf(cDGREEN "= All tests passed!\n" cNORM);
 698     return ret;
 699 }