2 * Test GOST 34.11 Digest operation
4 * Copyright (C) 2019-2020 Vitaly Chikunov <vt@altlinux.org>. All Rights Reserved.
6 * Contents licensed under the terms of the OpenSSL license
7 * See https://www.openssl.org/source/license.html for details
10 #include <openssl/engine.h>
11 #include <openssl/evp.h>
12 #include <openssl/rand.h>
13 #include <openssl/err.h>
14 #include <openssl/asn1.h>
15 #include <openssl/obj_mac.h>
19 # include <sys/sysmips.h>
21 #ifndef EVP_MD_CTRL_SET_KEY
22 # include "gost_lcl.h"
25 /* Helpers to test OpenSSL API calls. */
26 #define T(e) ({ if (!(e)) { \
27 ERR_print_errors_fp(stderr); \
28 OpenSSLDie(__FILE__, __LINE__, #e); \
31 #define TE(e) ({ if (!(e)) { \
32 ERR_print_errors_fp(stderr); \
33 fprintf(stderr, "Error at %s:%d %s\n", __FILE__, __LINE__, #e); \
38 #define cRED "\033[1;31m"
39 #define cDRED "\033[0;31m"
40 #define cGREEN "\033[1;32m"
41 #define cDGREEN "\033[0;32m"
42 #define cBLUE "\033[1;34m"
43 #define cDBLUE "\033[0;34m"
44 #define cNORM "\033[m"
45 #define TEST_ASSERT(e) {if ((test = (e))) \
46 printf(cRED " Test FAILED\n" cNORM); \
48 printf(cGREEN " Test passed\n" cNORM);}
51 * Test key from both GOST R 34.12-2015 and GOST R 34.13-2015.
53 static const char K[32] = {
54 0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
55 0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,
59 * Plaintext from GOST R 34.13-2015 A.1.
60 * First 16 bytes is vector (a) from GOST R 34.12-2015 A.1.
62 static const char P[] = {
63 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,
64 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,
65 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,
66 0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,0x11,
70 * OMAC1/CMAC test vector from GOST R 34.13-2015 А.1.6
72 static const char MAC_omac[] = { 0x33,0x6f,0x4d,0x29,0x60,0x59,0xfb,0xe3 };
75 * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.1
77 static const char P_omac_acpkm1[] = {
78 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
79 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
82 static const char MAC_omac_acpkm1[] = {
83 0xB5,0x36,0x7F,0x47,0xB6,0x2B,0x99,0x5E,0xEB,0x2A,0x64,0x8C,0x58,0x43,0x14,0x5E,
87 * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.2
89 static const char P_omac_acpkm2[] = {
90 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
91 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,
92 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,
93 0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,
94 0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,
97 static const char MAC_omac_acpkm2[] = {
98 0xFB,0xB8,0xDC,0xEE,0x45,0xBE,0xA6,0x7C,0x35,0xF5,0x8C,0x57,0x00,0x89,0x8E,0x5D,
101 struct hash_testvec {
102 int nid; /* OpenSSL algorithm numeric id. */
103 const char *name; /* Test name and source. */
104 const char *plaintext; /* Input (of psize), NULL for synthetic test. */
105 const char *digest; /* Expected output (of EVP_MD_size or truncate). */
106 const char *key; /* MAC key.*/
107 int psize; /* Input (plaintext) size. */
108 int mdsize; /* Compare to EVP_MD_size() if non-zero. */
109 int truncate; /* Truncated output (digest) size. */
110 int key_size; /* MAC key size. */
111 int block_size; /* Internal block size. */
112 int acpkm; /* The section size N (the number of bits that are
113 processed with one section key before this key is
114 transformed) (bytes) */
115 int acpkm_t; /* Master key (change) frequency T* (bytes) */
118 static const struct hash_testvec testvecs[] = {
120 .nid = NID_id_GostR3411_2012_512,
121 .name = "M1 from RFC 6986 (10.1.1) and GOST R 34.11-2012 (А.1.1)",
123 "012345678901234567890123456789012345678901234567890123456789012",
126 "\x1b\x54\xd0\x1a\x4a\xf5\xb9\xd5\xcc\x3d\x86\xd6\x8d\x28\x54\x62"
127 "\xb1\x9a\xbc\x24\x75\x22\x2f\x35\xc0\x85\x12\x2b\xe4\xba\x1f\xfa"
128 "\x00\xad\x30\xf8\x76\x7b\x3a\x82\x38\x4c\x65\x74\xf0\x24\xc3\x11"
129 "\xe2\xa4\x81\x33\x2b\x08\xef\x7f\x41\x79\x78\x91\xc1\x64\x6f\x48",
131 .block_size = 512 / 8,
134 .nid = NID_id_GostR3411_2012_256,
135 .name = "M1 from RFC 6986 (10.1.2) and GOST R 34.11-2012 (А.1.2)",
137 "012345678901234567890123456789012345678901234567890123456789012",
140 "\x9d\x15\x1e\xef\xd8\x59\x0b\x89\xda\xa6\xba\x6c\xb7\x4a\xf9\x27"
141 "\x5d\xd0\x51\x02\x6b\xb1\x49\xa4\x52\xfd\x84\xe5\xe5\x7b\x55\x00",
143 .block_size = 512 / 8,
146 .nid = NID_id_GostR3411_2012_512,
147 .name = "M2 from RFC 6986 (10.2.1) and GOST R 34.11-2012 (А.2.1)",
149 "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
150 "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
151 "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
152 "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
153 "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
156 "\x1e\x88\xe6\x22\x26\xbf\xca\x6f\x99\x94\xf1\xf2\xd5\x15\x69\xe0"
157 "\xda\xf8\x47\x5a\x3b\x0f\xe6\x1a\x53\x00\xee\xe4\x6d\x96\x13\x76"
158 "\x03\x5f\xe8\x35\x49\xad\xa2\xb8\x62\x0f\xcd\x7c\x49\x6c\xe5\xb3"
159 "\x3f\x0c\xb9\xdd\xdc\x2b\x64\x60\x14\x3b\x03\xda\xba\xc9\xfb\x28",
162 .nid = NID_id_GostR3411_2012_256,
163 .name = "M2 from RFC 6986 (10.2.2) and GOST R 34.11-2012 (А.2.2)",
165 "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
166 "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
167 "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
168 "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
169 "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
172 "\x9d\xd2\xfe\x4e\x90\x40\x9e\x5d\xa8\x7f\x53\x97\x6d\x74\x05\xb0"
173 "\xc0\xca\xc6\x28\xfc\x66\x9a\x74\x1d\x50\x06\x3c\x55\x7e\x8f\x50",
177 .nid = NID_grasshopper_mac,
178 .name = "P from GOST R 34.13-2015 (А.1.6)",
182 .key_size = sizeof(K),
185 .truncate = sizeof(MAC_omac),
188 .nid = NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
189 .name = "M from R 1323565.1.017-2018 (A.4.1)",
190 .plaintext = P_omac_acpkm1,
191 .psize = sizeof(P_omac_acpkm1),
193 .key_size = sizeof(K),
196 .digest = MAC_omac_acpkm1,
197 .mdsize = sizeof(MAC_omac_acpkm1),
200 .nid = NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
201 .name = "M from R 1323565.1.017-2018 (A.4.2)",
202 .plaintext = P_omac_acpkm2,
203 .psize = sizeof(P_omac_acpkm2),
205 .key_size = sizeof(K),
208 .digest = MAC_omac_acpkm2,
209 .mdsize = sizeof(MAC_omac_acpkm2),
211 /* Synthetic tests. */
213 .nid = NID_id_GostR3411_2012_256,
214 .name = "streebog256 synthetic test",
218 "\xa2\xf3\x6d\x9c\x42\xa1\x1e\xad\xe3\xc1\xfe\x99\xf9\x99\xc3\x84"
219 "\xe7\x98\xae\x24\x50\x75\x73\xd7\xfc\x99\x81\xa0\x45\x85\x41\xf6"
221 .nid = NID_id_GostR3411_2012_512,
222 .name = "streebog512 synthetic test",
226 "\x1d\x14\x4d\xd8\xb8\x27\xfb\x55\x1a\x5a\x7d\x03\xbb\xdb\xfa\xcb"
227 "\x43\x6b\x5b\xc5\x77\x59\xfd\x5f\xf2\x3b\x8e\xf9\xc4\xdd\x6f\x79"
228 "\x45\xd8\x16\x59\x9e\xaa\xbc\xf2\xb1\x4f\xd0\xe4\xf6\xad\x46\x60"
229 "\x90\x89\xf7\x2f\x93\xd8\x85\x0c\xb0\x43\xff\x5a\xb6\xe3\x69\xbd"
234 static void hexdump(const void *ptr, size_t len)
236 const unsigned char *p = ptr;
239 for (i = 0; i < len; i += j) {
240 for (j = 0; j < 16 && i + j < len; j++)
241 printf("%s%02x", j? "" : " ", p[i + j]);
246 static int do_digest(const EVP_MD *type, const char *plaintext,
247 unsigned int psize, const char *etalon, int mdsize, int truncate,
248 const char *key, unsigned int key_size, int acpkm, int acpkm_t,
252 T(EVP_MD_size(type) == mdsize);
256 mdsize = EVP_MD_size(type);
259 T(EVP_MD_block_size(type) == block_size);
261 T(ctx = EVP_MD_CTX_new());
262 T(EVP_MD_CTX_init(ctx));
263 T(EVP_DigestInit_ex(ctx, type, NULL));
265 T(EVP_MD_CTX_ctrl(ctx, EVP_MD_CTRL_SET_KEY, key_size, (void *)key));
267 T(EVP_MD_CTX_ctrl(ctx,
268 EVP_CTRL_KEY_MESH, acpkm, acpkm_t? &acpkm_t : NULL));
269 T(EVP_DigestUpdate(ctx, plaintext, psize));
272 unsigned char md[EVP_MAX_MD_SIZE];
274 if (EVP_MD_flags(EVP_MD_CTX_md(ctx)) & EVP_MD_FLAG_XOF) {
275 T(EVP_DigestFinalXOF(ctx, md, mdsize));
278 T(EVP_MD_CTX_size(ctx) == mdsize);
279 T(EVP_DigestFinal_ex(ctx, md, &len));
282 EVP_MD_CTX_free(ctx);
284 if (memcmp(md, etalon, mdsize) != 0) {
285 printf(cRED "digest mismatch\n" cNORM);
292 static int do_test(const struct hash_testvec *tv)
297 T(type = EVP_get_digestbynid(tv->nid));
298 const char *name = EVP_MD_name(type);
299 printf(cBLUE "Test %s: %s: " cNORM, name, tv->name);
301 ret |= do_digest(type, tv->plaintext, tv->psize, tv->digest,
302 tv->mdsize, tv->truncate, tv->key, tv->key_size, tv->acpkm,
303 tv->acpkm_t, tv->block_size);
305 /* Text alignment problems. */
309 T(buf = OPENSSL_malloc(tv->psize + shifts));
310 for (i = 0; i < shifts; i++) {
311 memcpy(buf + i, tv->plaintext, tv->psize);
312 ret |= do_digest(type, buf + i, tv->psize, tv->digest,
313 tv->mdsize, tv->truncate, tv->key, tv->key_size, tv->acpkm,
314 tv->acpkm_t, tv->block_size);
319 printf(cGREEN "success\n" cNORM);
321 printf(cRED "fail\n" cNORM);
325 #define SUPER_SIZE 256
327 * For 256-byte buffer filled with 256 bytes from 0 to 255;
328 * Digest them 256 times from the buffer end with lengths from 0 to 256,
329 * and from beginning of the buffer with lengths from 0 to 256;
330 * Each produced digest is digested again into final sum.
332 static int do_synthetic_once(const struct hash_testvec *tv, unsigned int shifts)
334 unsigned char *ibuf, *md;
335 T(ibuf = OPENSSL_zalloc(SUPER_SIZE + shifts));
337 /* fill with pattern */
339 for (len = 0; len < SUPER_SIZE; len++)
340 ibuf[shifts + len] = len & 0xff;
342 const EVP_MD *mdtype;
343 T(mdtype = EVP_get_digestbynid(tv->nid));
344 OPENSSL_assert(tv->nid == EVP_MD_type(mdtype));
345 EVP_MD_CTX *ctx, *ctx2;
346 T(ctx = EVP_MD_CTX_new());
347 T(ctx2 = EVP_MD_CTX_new());
348 T(EVP_DigestInit(ctx2, mdtype));
349 OPENSSL_assert(tv->nid == EVP_MD_CTX_type(ctx2));
350 OPENSSL_assert(EVP_MD_block_size(mdtype) == tv->block_size);
351 OPENSSL_assert(EVP_MD_CTX_size(ctx2) == tv->mdsize);
352 OPENSSL_assert(EVP_MD_CTX_block_size(ctx2) == tv->block_size);
354 const unsigned int mdlen = EVP_MD_size(mdtype);
355 OPENSSL_assert(mdlen == tv->mdsize);
356 T(md = OPENSSL_zalloc(mdlen + shifts));
357 md += shifts; /* test for output digest alignment problems */
360 for (len = 0; len < SUPER_SIZE; len++) {
361 /* for each len digest len bytes from the end of buf */
362 T(EVP_DigestInit(ctx, mdtype));
363 T(EVP_DigestUpdate(ctx, ibuf + shifts + SUPER_SIZE - len, len));
364 T(EVP_DigestFinal(ctx, md, NULL));
365 T(EVP_DigestUpdate(ctx2, md, mdlen));
368 for (len = 0; len < SUPER_SIZE; len++) {
369 /* for each len digest len bytes from the beginning of buf */
370 T(EVP_DigestInit(ctx, mdtype));
371 T(EVP_DigestUpdate(ctx, ibuf + shifts, len));
372 T(EVP_DigestFinal(ctx, md, NULL));
373 T(EVP_DigestUpdate(ctx2, md, mdlen));
377 EVP_MD_CTX_free(ctx);
379 T(EVP_DigestFinal(ctx2, md, &len));
380 EVP_MD_CTX_free(ctx2);
383 printf(cRED "digest output len mismatch %u != %u (expected)\n" cNORM,
388 if (memcmp(md, tv->digest, mdlen) != 0) {
389 printf(cRED "digest mismatch\n" cNORM);
392 printf(" Expected value is: ");
393 for (i = 0; i < mdlen; i++)
394 printf("\\x%02x", md[i]);
399 OPENSSL_free(md - shifts);
402 OPENSSL_free(md - shifts);
406 /* do different block sizes and different memory offsets */
407 static int do_synthetic_test(const struct hash_testvec *tv)
411 printf(cBLUE "Synthetic test %s: " cNORM, tv->name);
415 for (shifts = 0; shifts < 16 && !ret; shifts++)
416 ret |= do_synthetic_once(tv, shifts);
419 printf(cGREEN "success\n" cNORM);
421 printf(cRED "fail\n" cNORM);
425 int main(int argc, char **argv)
430 /* Trigger SIGBUS for unaligned access. */
431 sysmips(MIPS_FIXADE, 0);
433 setenv("OPENSSL_ENGINES", ENGINE_DIR, 0);
434 OPENSSL_add_all_algorithms_conf();
435 ERR_load_crypto_strings();
437 T(eng = ENGINE_by_id("gost"));
439 T(ENGINE_set_default(eng, ENGINE_METHOD_ALL));
441 const struct hash_testvec *tv;
442 for (tv = testvecs; tv->nid; tv++) {
446 ret |= do_synthetic_test(tv);
453 printf(cDRED "= Some tests FAILED!\n" cNORM);
455 printf(cDGREEN "= All tests passed!\n" cNORM);