test_digest.c

   1 /*
   2  * Test GOST 34.11 Digest operation
   3  *
   4  * Copyright (C) 2019-2020 Vitaly Chikunov <vt@altlinux.org>. All Rights Reserved.
   5  *
   6  * Contents licensed under the terms of the OpenSSL license
   7  * See https://www.openssl.org/source/license.html for details
   8  */
   9
  10 #ifdef _MSC_VER
  11 # pragma warning(push, 3)
  12 # include <openssl/applink.c>
  13 # pragma warning(pop)
  14 #endif
  15 #include <openssl/opensslv.h>
  16 #include <openssl/engine.h>
  17 #include <openssl/provider.h>
  18 #include <openssl/evp.h>
  19 #include <openssl/rand.h>
  20 #include <openssl/err.h>
  21 #include <openssl/asn1.h>
  22 # include <openssl/hmac.h>
  23 #if OPENSSL_VERSION_MAJOR >= 3
  24 # include <openssl/core_names.h>
  25 #endif
  26 #include <openssl/obj_mac.h>
  27 #include <string.h>
  28 #include <stdlib.h>
  29 #if MIPSEL
  30 # include <sys/sysmips.h>
  31 #endif
  32 #ifndef EVP_MD_CTRL_SET_KEY
  33 # include "gost_lcl.h"
  34 #endif
  35
  36 /* Helpers to test OpenSSL API calls. */
  37 #define T(e) \
  38     if (!(e)) { \
  39         ERR_print_errors_fp(stderr); \
  40         OpenSSLDie(__FILE__, __LINE__, #e); \
  41     }
  42 #define TE(e) \
  43     if (!(e)) { \
  44         ERR_print_errors_fp(stderr); \
  45         fprintf(stderr, "Error at %s:%d %s\n", __FILE__, __LINE__, #e); \
  46         return -1; \
  47     }
  48
  49 #define cRED    "\033[1;31m"
  50 #define cDRED   "\033[0;31m"
  51 #define cGREEN  "\033[1;32m"
  52 #define cDGREEN "\033[0;32m"
  53 #define cBLUE   "\033[1;34m"
  54 #define cDBLUE  "\033[0;34m"
  55 #define cMAGENT "\033[1;35m"
  56 #define cNORM   "\033[m"
  57 #define TEST_ASSERT(e) {if ((test = (e))) \
  58                  printf(cRED "  Test FAILED" cNORM "\n"); \
  59              else \
  60                  printf(cGREEN "  Test passed" cNORM "\n");}
  61
  62 #ifdef __GNUC__
  63 /* To test older APIs. */
  64 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
  65 #endif
  66
  67 /*
  68  * Test keys from both GOST R 34.12-2015 and GOST R 34.13-2015,
  69  * for 128-bit cipher (A.1).
  70  */
  71 static const char K[32] = {
  72     0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
  73     0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,
  74 };
  75
  76 /*
  77  * Key for 64-bit cipher (A.2).
  78  */
  79 static const char Km[32] = {
  80     0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,0x77,0x66,0x55,0x44,0x33,0x22,0x11,0x00,
  81     0xf0,0xf1,0xf2,0xf3,0xf4,0xf5,0xf6,0xf7,0xf8,0xf9,0xfa,0xfb,0xfc,0xfd,0xfe,0xff,
  82 };
  83
  84 /*
  85  * Plaintext from GOST R 34.13-2015 A.1.
  86  * First 16 bytes is vector (a) from GOST R 34.12-2015 A.1.
  87  */
  88 static const char P[] = {
  89     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,
  90     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,
  91     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,
  92     0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,0x11,
  93 };
  94
  95 /* Plaintext for 64-bit cipher (A.2) */
  96 static const char Pm[] = {
  97     0x92,0xde,0xf0,0x6b,0x3c,0x13,0x0a,0x59,0xdb,0x54,0xc7,0x04,0xf8,0x18,0x9d,0x20,
  98     0x4a,0x98,0xfb,0x2e,0x67,0xa8,0x02,0x4c,0x89,0x12,0x40,0x9b,0x17,0xb5,0x7e,0x41,
  99 };
 100
 101 /*
 102  * Kuznyechik OMAC1/CMAC test vector from GOST R 34.13-2015 А.1.6
 103  */
 104 static const char MAC_omac[] = { 0x33,0x6f,0x4d,0x29,0x60,0x59,0xfb,0xe3 };
 105
 106 /*
 107  * Magma OMAC1/CMAC test vector from GOST R 34.13-2015 А.2.6
 108  */
 109 static const char MAC_magma_omac[] = { 0x15,0x4e,0x72,0x10 };
 110
 111 /*
 112  * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.1
 113  */
 114 static const char P_omac_acpkm1[] = {
 115     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
 116     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
 117 };
 118
 119 static const char MAC_omac_acpkm1[] = {
 120     0xB5,0x36,0x7F,0x47,0xB6,0x2B,0x99,0x5E,0xEB,0x2A,0x64,0x8C,0x58,0x43,0x14,0x5E,
 121 };
 122
 123 /*
 124  * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.2
 125  */
 126 static const char P_omac_acpkm2[] = {
 127     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
 128     0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,
 129     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,
 130     0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,
 131     0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,
 132 };
 133
 134 static const char MAC_omac_acpkm2[] = {
 135     0xFB,0xB8,0xDC,0xEE,0x45,0xBE,0xA6,0x7C,0x35,0xF5,0x8C,0x57,0x00,0x89,0x8E,0x5D,
 136 };
 137
 138 /* Some other test vectors. */
 139 static const char etalon_M4[64] = { 0 };
 140
 141 static const char etalon_M5[] = {
 142     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 143     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 144     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 145     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 146 };
 147
 148 static const char etalon_M6[] = {
 149     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 150     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 151     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 152     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 153     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 154     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 155     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 156     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 157     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 158     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 159     0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
 160     0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
 161 };
 162
 163 static const char etalon_carry[] = {
 164     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 165     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 166     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 167     0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
 168     0x16,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 169     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 170     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
 171     0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x16,
 172 };
 173
 174 /* This is another carry test. */
 175 static const char ff[] = {
 176     0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 177     0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 178     0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 179     0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
 180 };
 181
 182 struct hash_testvec {
 183     const char *algname;   /* Algorithm name */
 184     const char *name;      /* Test name and source. */
 185     const char *plaintext; /* Input (of psize), NULL for synthetic test. */
 186     const char *digest;    /* Expected output (of EVP_MD_size or truncate). */
 187     const char *hmac;      /* Expected output for HMAC tests. */
 188     const char *key;       /* MAC key.*/
 189     int psize;             /* Input (plaintext) size. */
 190     size_t outsize;        /* Compare to EVP_MD_size() / EVP_MAC_size() if non-zero. */
 191     int truncate;          /* Truncated output (digest) size. */
 192     int key_size;          /* MAC key size. */
 193     int block_size;        /* Internal block size. */
 194     int acpkm;             /* The section size N (the number of bits that are
 195                               processed with one section key before this key is
 196                               transformed) (bytes) */
 197     int acpkm_t;           /* Master key (change) frequency T* (bytes) */
 198 };
 199
 200 static const struct hash_testvec testvecs[] = {
 201     { /* Test vectors from standards. */
 202         .algname = SN_id_GostR3411_2012_512,
 203         .name = "M1 from RFC 6986 (10.1.1) and GOST R 34.11-2012 (А.1.1)",
 204         .plaintext =
 205             "012345678901234567890123456789012345678901234567890123456789012",
 206         .psize = 63,
 207         .digest =
 208             "\x1b\x54\xd0\x1a\x4a\xf5\xb9\xd5\xcc\x3d\x86\xd6\x8d\x28\x54\x62"
 209             "\xb1\x9a\xbc\x24\x75\x22\x2f\x35\xc0\x85\x12\x2b\xe4\xba\x1f\xfa"
 210             "\x00\xad\x30\xf8\x76\x7b\x3a\x82\x38\x4c\x65\x74\xf0\x24\xc3\x11"
 211             "\xe2\xa4\x81\x33\x2b\x08\xef\x7f\x41\x79\x78\x91\xc1\x64\x6f\x48",
 212         .outsize = 512 / 8,
 213         .block_size = 512 / 8,
 214     },
 215     {
 216         .algname = SN_id_GostR3411_2012_256,
 217         .name = "M1 from RFC 6986 (10.1.2) and GOST R 34.11-2012 (А.1.2)",
 218         .plaintext =
 219             "012345678901234567890123456789012345678901234567890123456789012",
 220         .psize = 63,
 221         .digest =
 222             "\x9d\x15\x1e\xef\xd8\x59\x0b\x89\xda\xa6\xba\x6c\xb7\x4a\xf9\x27"
 223             "\x5d\xd0\x51\x02\x6b\xb1\x49\xa4\x52\xfd\x84\xe5\xe5\x7b\x55\x00",
 224         .outsize = 256 / 8,
 225         .block_size = 512 / 8,
 226     },
 227     {
 228         .algname = SN_id_GostR3411_2012_512,
 229         .name = "M2 from RFC 6986 (10.2.1) and GOST R 34.11-2012 (А.2.1)",
 230         .plaintext =
 231             "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
 232             "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
 233             "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
 234             "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
 235             "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
 236         .psize = 72,
 237         .digest =
 238             "\x1e\x88\xe6\x22\x26\xbf\xca\x6f\x99\x94\xf1\xf2\xd5\x15\x69\xe0"
 239             "\xda\xf8\x47\x5a\x3b\x0f\xe6\x1a\x53\x00\xee\xe4\x6d\x96\x13\x76"
 240             "\x03\x5f\xe8\x35\x49\xad\xa2\xb8\x62\x0f\xcd\x7c\x49\x6c\xe5\xb3"
 241             "\x3f\x0c\xb9\xdd\xdc\x2b\x64\x60\x14\x3b\x03\xda\xba\xc9\xfb\x28",
 242     },
 243     {
 244         .algname = SN_id_GostR3411_2012_256,
 245         .name = "M2 from RFC 6986 (10.2.2) and GOST R 34.11-2012 (А.2.2)",
 246         .plaintext =
 247             "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
 248             "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
 249             "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
 250             "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
 251             "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
 252         .psize = 72,
 253         .digest =
 254             "\x9d\xd2\xfe\x4e\x90\x40\x9e\x5d\xa8\x7f\x53\x97\x6d\x74\x05\xb0"
 255             "\xc0\xca\xc6\x28\xfc\x66\x9a\x74\x1d\x50\x06\x3c\x55\x7e\x8f\x50",
 256     },
 257     /* OMAC tests */
 258     {
 259         .algname = SN_grasshopper_mac,
 260         .name = "P from GOST R 34.13-2015 (А.1.6)",
 261         .plaintext = P,
 262         .psize = sizeof(P),
 263         .key = K,
 264         .key_size = sizeof(K),
 265         .digest = MAC_omac,
 266         .outsize = 128 / 8,
 267         .truncate = sizeof(MAC_omac),
 268     },
 269     {
 270         .algname = SN_magma_mac,
 271         .name = "P from GOST R 34.13-2015 (А.2.6)",
 272         .plaintext = Pm,
 273         .psize = sizeof(Pm),
 274         .key = Km,
 275         .key_size = sizeof(Km),
 276         .digest = MAC_magma_omac,
 277         .outsize = 64 / 8,
 278         .truncate = sizeof(MAC_magma_omac),
 279     },
 280     {
 281         .algname = SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
 282         .name = "M from R 1323565.1.017-2018 (A.4.1)",
 283         .plaintext = P_omac_acpkm1,
 284         .psize = sizeof(P_omac_acpkm1),
 285         .key = K,
 286         .key_size = sizeof(K),
 287         .acpkm = 32,
 288         .acpkm_t = 768 / 8,
 289         .digest = MAC_omac_acpkm1,
 290         .outsize = sizeof(MAC_omac_acpkm1),
 291     },
 292     {
 293         .algname = SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
 294         .name = "M from R 1323565.1.017-2018 (A.4.2)",
 295         .plaintext = P_omac_acpkm2,
 296         .psize = sizeof(P_omac_acpkm2),
 297         .key = K,
 298         .key_size = sizeof(K),
 299         .acpkm = 32,
 300         .acpkm_t = 768 / 8,
 301         .digest = MAC_omac_acpkm2,
 302         .outsize = sizeof(MAC_omac_acpkm2),
 303     },
 304     { /* HMAC tests. */
 305         .algname = SN_id_GostR3411_2012_512,
 306         .name = "HMAC_GOSTR3411_2012_512 from RFC 7836 (B) and R 50.1.113-2016 (A)",
 307         .plaintext =
 308             "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
 309         .psize = 16,
 310         .key =
 311             "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 312             "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
 313         .key_size = 32,
 314         .hmac =
 315             "\xa5\x9b\xab\x22\xec\xae\x19\xc6\x5f\xbd\xe6\xe5\xf4\xe9\xf5\xd8"
 316             "\x54\x9d\x31\xf0\x37\xf9\xdf\x9b\x90\x55\x00\xe1\x71\x92\x3a\x77"
 317             "\x3d\x5f\x15\x30\xf2\xed\x7e\x96\x4c\xb2\xee\xdc\x29\xe9\xad\x2f"
 318             "\x3a\xfe\x93\xb2\x81\x4f\x79\xf5\x00\x0f\xfc\x03\x66\xc2\x51\xe6",
 319     },
 320     {
 321         .algname = SN_id_GostR3411_2012_256,
 322         .name = "HMAC_GOSTR3411_2012_256 from RFC 7836 (B) and R 50.1.113-2016 (A)",
 323         .plaintext =
 324             "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
 325         .psize = 16,
 326         .key =
 327             "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 328             "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
 329         .key_size = 32,
 330         .hmac =
 331             "\xa1\xaa\x5f\x7d\xe4\x02\xd7\xb3\xd3\x23\xf2\x99\x1c\x8d\x45\x34"
 332             "\x01\x31\x37\x01\x0a\x83\x75\x4f\xd0\xaf\x6d\x7c\xd4\x92\x2e\xd9",
 333     },
 334     /* Other KATs. */
 335     {
 336         .algname = SN_id_GostR3411_2012_512,
 337         .name = "Zero length string (M3)",
 338         .plaintext = "",
 339         .psize = 0,
 340         .digest =
 341             "\x8e\x94\x5d\xa2\x09\xaa\x86\x9f\x04\x55\x92\x85\x29\xbc\xae\x46"
 342             "\x79\xe9\x87\x3a\xb7\x07\xb5\x53\x15\xf5\x6c\xeb\x98\xbe\xf0\xa7"
 343             "\x36\x2f\x71\x55\x28\x35\x6e\xe8\x3c\xda\x5f\x2a\xac\x4c\x6a\xd2"
 344             "\xba\x3a\x71\x5c\x1b\xcd\x81\xcb\x8e\x9f\x90\xbf\x4c\x1c\x1a\x8a",
 345         .outsize = 512 / 8,
 346     },
 347     {
 348         .algname = SN_id_GostR3411_2012_256,
 349         .name = "Zero length string (M3)",
 350         .plaintext = "",
 351         .psize = 0,
 352         .digest =
 353             "\x3f\x53\x9a\x21\x3e\x97\xc8\x02\xcc\x22\x9d\x47\x4c\x6a\xa3\x2a"
 354             "\x82\x5a\x36\x0b\x2a\x93\x3a\x94\x9f\xd9\x25\x20\x8d\x9c\xe1\xbb",
 355         .outsize = 256 / 8,
 356     },
 357     { /* M4 */
 358         .algname = SN_id_GostR3411_2012_512,
 359         .name = "64 bytes of zero (M4)",
 360         .plaintext = etalon_M4,
 361         .psize = sizeof(etalon_M4),
 362         .digest =
 363             "\xb0\xfd\x29\xac\x1b\x0d\xf4\x41\x76\x9f\xf3\xfd\xb8\xdc\x56\x4d"
 364             "\xf6\x77\x21\xd6\xac\x06\xfb\x28\xce\xff\xb7\xbb\xaa\x79\x48\xc6"
 365             "\xc0\x14\xac\x99\x92\x35\xb5\x8c\xb2\x6f\xb6\x0f\xb1\x12\xa1\x45"
 366             "\xd7\xb4\xad\xe9\xae\x56\x6b\xf2\x61\x14\x02\xc5\x52\xd2\x0d\xb7"
 367     },
 368     {
 369         .algname = SN_id_GostR3411_2012_256,
 370         .name = "64 bytes of zero (M4)",
 371         .plaintext = etalon_M4,
 372         .psize = sizeof(etalon_M4),
 373         .digest =
 374             "\xdf\x1f\xda\x9c\xe8\x31\x91\x39\x05\x37\x35\x80\x31\xdb\x2e\xca"
 375             "\xa6\xaa\x54\xcd\x0e\xda\x24\x1d\xc1\x07\x10\x5e\x13\x63\x6b\x95"
 376     },
 377     { /* M5 */
 378         .algname = SN_id_GostR3411_2012_512,
 379         .name = "64 bytes of (M5)",
 380         .plaintext = etalon_M5,
 381         .psize = sizeof(etalon_M5),
 382         .digest =
 383             "\x36\x3b\x44\x9e\xc8\x1a\xe4\x0b\x3a\x40\x7b\x12\x5c\x3b\x1c\x2b"
 384             "\x76\x8b\x50\x49\x6b\xcb\x5f\x69\x0b\x89\xe9\x00\x7b\x06\xe4\x08"
 385             "\x41\x82\xed\x45\xd4\x07\x2a\x67\xfe\xc9\xd3\x42\x1d\xab\x01\x3d"
 386             "\xa2\xaa\xbc\x1d\x65\x28\xe8\xe7\x75\xae\xc7\xb3\x45\x7a\xc6\x75"
 387     },
 388     {
 389         .algname = SN_id_GostR3411_2012_256,
 390         .name = "64 bytes of (M5)",
 391         .plaintext = etalon_M5,
 392         .psize = sizeof(etalon_M5),
 393         .digest =
 394             "\xf0\xa5\x57\xf6\xa0\x4a\x90\xab\x18\x11\xc1\xb6\xe9\xb0\x78\xe4"
 395             "\x16\x3b\x74\x03\x7c\x6c\xf5\x9f\x52\x44\x4a\x37\xf4\x8e\x11\xd8"
 396     },
 397     { /* M6 */
 398         .algname = SN_id_GostR3411_2012_512,
 399         .name = "(M6)",
 400         .plaintext = etalon_M6,
 401         .psize = sizeof(etalon_M6),
 402         .digest =
 403             "\x87\x81\xdf\xc8\x1d\x2d\xb6\xa4\x1d\x18\x57\xf3\x23\x0b\x3f\xfe"
 404             "\x2b\xda\x57\x42\x73\xea\x19\x47\x18\x9a\xaa\x54\x68\x47\x0d\xf1"
 405             "\xc4\xb3\x74\xb1\xa2\xb5\x6e\x59\xd1\x1d\x21\x3f\xea\x57\xe3\x51"
 406             "\x45\x43\xb0\xce\xd9\xb2\x0e\x55\x3a\xe6\x64\x25\xec\x90\x9c\xfd"
 407     },
 408     {
 409         .algname = SN_id_GostR3411_2012_256,
 410         .name = "(M6)",
 411         .plaintext = etalon_M6,
 412         .psize = sizeof(etalon_M6),
 413         .digest =
 414             "\x2f\x4f\x65\x1f\xe8\x8f\xea\x46\xec\x6f\x22\x23\x72\x8d\x8d\xff"
 415             "\x39\x68\x89\x35\x58\xef\x00\xa3\x10\xc2\x3e\x7d\x19\x23\xba\x0c"
 416     },
 417     { /* Carry */
 418         .algname = SN_id_GostR3411_2012_512,
 419         .name = "(carry)",
 420         .plaintext = etalon_carry,
 421         .psize = sizeof(etalon_carry),
 422         .digest =
 423             "\x8b\x06\xf4\x1e\x59\x90\x7d\x96\x36\xe8\x92\xca\xf5\x94\x2f\xcd"
 424             "\xfb\x71\xfa\x31\x16\x9a\x5e\x70\xf0\xed\xb8\x73\x66\x4d\xf4\x1c"
 425             "\x2c\xce\x6e\x06\xdc\x67\x55\xd1\x5a\x61\xcd\xeb\x92\xbd\x60\x7c"
 426             "\xc4\xaa\xca\x67\x32\xbf\x35\x68\xa2\x3a\x21\x0d\xd5\x20\xfd\x41"
 427     },
 428     {
 429         .algname = SN_id_GostR3411_2012_256,
 430         .name = "(carry)",
 431         .plaintext = etalon_carry,
 432         .psize = sizeof(etalon_carry),
 433         .digest =
 434             "\x81\xbb\x63\x2f\xa3\x1f\xcc\x38\xb4\xc3\x79\xa6\x62\xdb\xc5\x8b"
 435             "\x9b\xed\x83\xf5\x0d\x3a\x1b\x2c\xe7\x27\x1a\xb0\x2d\x25\xba\xbb"
 436     },
 437     { /* ff (Better carry test). */
 438         .algname = SN_id_GostR3411_2012_512,
 439         .name = "64 bytes of FF",
 440         .plaintext = ff,
 441         .psize = sizeof(ff),
 442         .digest =
 443             "\x41\x62\x9d\xe6\x77\xd7\xe8\x09\x0c\x3c\xd7\x0a\xff\xe3\x30\x0d"
 444             "\x1e\x1c\xfb\xa2\xdb\x97\x94\x5e\xc3\x7f\xeb\x4e\x13\x75\xbc\x02"
 445             "\xa5\x3f\x00\x37\x0b\x7d\x71\x5b\x07\xf3\x7f\x93\xca\xc8\x44\xef"
 446             "\xad\xbf\xd1\xb8\x5f\x9d\xda\xe3\xde\x96\x56\xc0\xe9\x5a\xff\xc7"
 447     },
 448     {
 449         .algname = SN_id_GostR3411_2012_256,
 450         .name = "64 bytes of FF",
 451         .plaintext = ff,
 452         .psize = sizeof(ff),
 453         .digest =
 454             "\x96\x4a\x5a\xb6\x02\x86\xf1\x06\x28\x87\x43\xe2\xfe\x1a\x42\x2d"
 455             "\x16\x08\x98\xca\x1b\xd5\x35\xe8\x31\xaa\x50\x0c\xfe\x34\xd7\xe8"
 456     },
 457     {
 458         .algname = SN_id_GostR3411_94,
 459         .name = "64 bytes of FF",
 460         .plaintext = ff,
 461         .psize = sizeof(ff),
 462         .digest =
 463             "\x58\x50\x4d\x26\xb3\x67\x7e\x75\x6b\xa3\xf4\xa9\xfd\x2f\x14\xb3"
 464             "\xba\x54\x57\x06\x6a\x4a\xa1\xd7\x00\x65\x9b\x90\xdc\xdd\xd3\xc6"
 465     },
 466     /* Synthetic tests. */
 467     {
 468         .algname = SN_id_GostR3411_2012_256,
 469         .name = "streebog256 synthetic test",
 470         .outsize = 32,
 471         .block_size = 64,
 472         .digest =
 473             "\xa2\xf3\x6d\x9c\x42\xa1\x1e\xad\xe3\xc1\xfe\x99\xf9\x99\xc3\x84"
 474             "\xe7\x98\xae\x24\x50\x75\x73\xd7\xfc\x99\x81\xa0\x45\x85\x41\xf6"
 475     },
 476     {
 477         .algname = SN_id_GostR3411_2012_512,
 478         .name = "streebog512 synthetic test",
 479         .outsize = 64,
 480         .block_size = 64,
 481         .digest =
 482             "\x1d\x14\x4d\xd8\xb8\x27\xfb\x55\x1a\x5a\x7d\x03\xbb\xdb\xfa\xcb"
 483             "\x43\x6b\x5b\xc5\x77\x59\xfd\x5f\xf2\x3b\x8e\xf9\xc4\xdd\x6f\x79"
 484             "\x45\xd8\x16\x59\x9e\xaa\xbc\xf2\xb1\x4f\xd0\xe4\xf6\xad\x46\x60"
 485             "\x90\x89\xf7\x2f\x93\xd8\x85\x0c\xb0\x43\xff\x5a\xb6\xe3\x69\xbd"
 486     },
 487     { 0 }
 488 };
 489
 490 static void hexdump(const void *ptr, size_t len)
 491 {
 492     const unsigned char *p = ptr;
 493     size_t i, j;
 494
 495     for (i = 0; i < len; i += j) {
 496         for (j = 0; j < 16 && i + j < len; j++)
 497             printf("%s%02x", j? "" : " ", p[i + j]);
 498     }
 499     printf("\n");
 500 }
 501
 502 static int do_hmac_old(int iter, const EVP_MD *type, const char *plaintext,
 503     const struct hash_testvec *t)
 504 {
 505     unsigned int len;
 506     unsigned char md[EVP_MAX_MD_SIZE];
 507     if (!iter)
 508         printf("[HMAC] ");
 509
 510     HMAC_CTX *ctx;
 511     T(ctx = HMAC_CTX_new());
 512     T(HMAC_Init_ex(ctx, t->key, t->key_size, type, NULL));
 513     T(HMAC_Update(ctx, (const unsigned char *)plaintext, t->psize));
 514     T(HMAC_Final(ctx, md, &len));
 515     HMAC_CTX_free(ctx);
 516
 517     if (t->outsize)
 518         T(len == t->outsize);
 519     if (memcmp(md, t->hmac, len) != 0) {
 520         printf(cRED "hmac mismatch (iter %d)" cNORM "\n", iter);
 521         hexdump(t->hmac, len);
 522         hexdump(md, len);
 523         return 1;
 524     }
 525     return 0;
 526 }
 527
 528 #if OPENSSL_VERSION_MAJOR >= 3
 529 static int do_hmac_prov(int iter, const EVP_MD *md, const char *plaintext,
 530     const struct hash_testvec *t)
 531 {
 532     size_t len;
 533     unsigned char out[EVP_MAX_MD_SIZE];
 534     if (!iter)
 535         printf("[HMAC by EVP_MAC] ");
 536
 537     EVP_MAC *hmac;
 538     T(hmac = EVP_MAC_fetch(NULL, "HMAC", NULL));
 539     EVP_MAC_CTX *ctx;
 540     T(ctx = EVP_MAC_CTX_new(hmac));
 541     OSSL_PARAM params[] = {
 542         OSSL_PARAM_utf8_string(OSSL_MAC_PARAM_DIGEST,
 543             (char *)EVP_MD_name(md), 0),
 544         OSSL_PARAM_END
 545     };
 546     T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, params));
 547     T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
 548     T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
 549     EVP_MAC_CTX_free(ctx);
 550     EVP_MAC_free(hmac);
 551
 552     if (t->outsize)
 553         T(len == t->outsize);
 554     if (memcmp(out, t->hmac, len) != 0) {
 555         printf(cRED "hmac mismatch (iter %d)" cNORM "\n", iter);
 556         hexdump(t->hmac, len);
 557         hexdump(out, len);
 558         return 1;
 559     }
 560     return 0;
 561 }
 562 #endif
 563
 564 static int do_hmac(int iter, const EVP_MD *type, const char *plaintext,
 565     const struct hash_testvec *t)
 566 {
 567     int ret;
 568
 569     /* Test old (deprecated) and (too) new APIs. */
 570     ret = do_hmac_old(iter, type, plaintext, t);
 571 #if OPENSSL_VERSION_MAJOR >= 3
 572     ret |= do_hmac_prov(iter, type, plaintext, t);
 573 #endif
 574
 575     return ret;
 576 }
 577
 578 /*
 579  * If we have OMAC1/CMAC test vector,
 580  * use CMAC provider to test it.
 581  */
 582 static int do_cmac_prov(int iter, const char *plaintext,
 583     const struct hash_testvec *t)
 584 {
 585 #if OPENSSL_VERSION_MAJOR >= 3
 586     char *ciphername = NULL;
 587     /*
 588      * CMAC needs CBC.
 589      * Convert 'mac' digest to the underlying CBC cipher.
 590      */
 591     switch (OBJ_sn2nid(t->algname)) {
 592     case NID_grasshopper_mac:
 593         ciphername = "kuznyechik-cbc";
 594         break;
 595     case NID_magma_mac:
 596         ciphername = "magma-cbc";
 597         break;
 598     default:
 599         return 0;
 600     }
 601
 602     if (!iter)
 603         printf("[CMAC(%s)] ", ciphername);
 604
 605     size_t len;
 606     unsigned char out[EVP_MAX_MD_SIZE];
 607     size_t outsize = t->outsize;
 608     if (t->truncate)
 609         outsize = t->truncate;
 610
 611     EVP_MAC *cmac;
 612     T(cmac = EVP_MAC_fetch(NULL, "CMAC", NULL));
 613     EVP_MAC_CTX *ctx;
 614     T(ctx = EVP_MAC_CTX_new(cmac));
 615     OSSL_PARAM params[] = {
 616         OSSL_PARAM_utf8_string(OSSL_MAC_PARAM_CIPHER, ciphername, 0),
 617         OSSL_PARAM_END
 618     };
 619     T(EVP_MAC_CTX_set_params(ctx, params));
 620     T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, params));
 621     T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
 622     T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
 623     EVP_MAC_CTX_free(ctx);
 624     EVP_MAC_free(cmac);
 625
 626     /* CMAC provider will not respect outsize, and will output full block.
 627      * So, just compare until what we need. */
 628     T(outsize <= len);
 629     if (memcmp(out, t->digest, outsize) != 0) {
 630         printf(cRED "cmac mismatch (iter %d)" cNORM "\n", iter);
 631         hexdump(t->digest, outsize);
 632         hexdump(out, len);
 633         return 1;
 634     }
 635 #endif
 636     return 0;
 637 }
 638
 639 static int do_mac(int iter, EVP_MAC *mac, const char *plaintext,
 640                   const struct hash_testvec *t)
 641 {
 642     if (!iter)
 643         printf("[MAC %zu] ", t->outsize);
 644
 645     size_t acpkm = (size_t)t->acpkm;
 646     size_t acpkm_t = (size_t)t->acpkm_t;
 647     OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
 648     OSSL_PARAM *p = params;
 649     if (acpkm) {
 650         *p++ = OSSL_PARAM_construct_size_t("key-mesh", &acpkm);
 651         if (acpkm_t)
 652             *p++ = OSSL_PARAM_construct_size_t("cipher-key-mesh", &acpkm_t);
 653     }
 654
 655     EVP_MAC_CTX *ctx;
 656     T(ctx = EVP_MAC_CTX_new(mac));
 657     if (t->outsize)
 658         T(EVP_MAC_CTX_get_mac_size(ctx) == t->outsize);
 659     size_t outsize;
 660     if (t->truncate) {
 661         outsize = t->truncate;
 662         *p++ = OSSL_PARAM_construct_size_t("size", &outsize);
 663     }
 664     else
 665         outsize = EVP_MAC_CTX_get_mac_size(ctx);
 666
 667     T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, NULL));
 668     T(EVP_MAC_CTX_set_params(ctx, params));
 669     T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
 670
 671     size_t len = 0;
 672     unsigned char out[256];
 673     if (t->truncate) {
 674         T(outsize <= sizeof(out));
 675         T(EVP_MAC_finalXOF(ctx, out, outsize));
 676         len = outsize;
 677     } else {
 678         T(EVP_MAC_CTX_get_mac_size(ctx) == outsize);
 679         T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
 680     }
 681
 682     EVP_MAC_CTX_free(ctx);
 683     T(len == outsize);
 684     if (memcmp(out, t->digest, outsize) != 0) {
 685         printf(cRED "mac mismatch (iter %d, outsize %d)" cNORM "\n",
 686                iter, (int)outsize);
 687         hexdump(t->digest, outsize);
 688         hexdump(out, outsize);
 689         return 1;
 690     }
 691
 692     return 0;
 693 }
 694
 695 static int do_digest(int iter, const EVP_MD *type, const char *plaintext,
 696                      const struct hash_testvec *t)
 697 {
 698     if (!iter)
 699         printf("[MD %zu] ", t->outsize);
 700     if (t->outsize)
 701         T(EVP_MD_size(type) == t->outsize);
 702     size_t outsize;
 703     if (t->truncate)
 704         outsize = t->truncate;
 705     else
 706         outsize = EVP_MD_size(type);
 707
 708     if (t->block_size)
 709         T(EVP_MD_block_size(type) == t->block_size);
 710     EVP_MD_CTX *ctx;
 711     T(ctx = EVP_MD_CTX_new());
 712     T(EVP_MD_CTX_init(ctx));
 713     T(EVP_DigestInit_ex(ctx, type, NULL));
 714     if (t->key)
 715         T(EVP_MD_CTX_ctrl(ctx, EVP_MD_CTRL_SET_KEY, t->key_size,
 716                           (void *)t->key));
 717     if (t->acpkm)
 718         T(EVP_MD_CTX_ctrl(ctx, EVP_CTRL_KEY_MESH, t->acpkm,
 719                           t->acpkm_t? (void *)&t->acpkm_t : NULL));
 720     T(EVP_DigestUpdate(ctx, plaintext, t->psize));
 721
 722     unsigned int len;
 723     unsigned char out[EVP_MAX_MD_SIZE];
 724     if (EVP_MD_flags(EVP_MD_CTX_md(ctx)) & EVP_MD_FLAG_XOF) {
 725         T(EVP_DigestFinalXOF(ctx, out, outsize));
 726         len = outsize;
 727     } else {
 728         T(EVP_MD_CTX_size(ctx) == outsize);
 729         T(EVP_DigestFinal_ex(ctx, out, &len));
 730     }
 731
 732     EVP_MD_CTX_free(ctx);
 733     T(len == outsize);
 734     if (memcmp(out, t->digest, outsize) != 0) {
 735         printf(cRED "digest mismatch (iter %d, outsize %d)" cNORM "\n",
 736                iter, (int)outsize);
 737         hexdump(t->digest, outsize);
 738         hexdump(out, outsize);
 739         return 1;
 740     }
 741
 742     return 0;
 743 }
 744
 745 static int do_test(const struct hash_testvec *tv)
 746 {
 747     int ret = 0;
 748     EVP_MD *md = NULL;
 749     EVP_MAC *mac = NULL;
 750
 751     ERR_set_mark();
 752     T((md = (EVP_MD *)EVP_get_digestbyname(tv->algname))
 753       || (md = EVP_MD_fetch(NULL, tv->algname, NULL))
 754       || (mac = EVP_MAC_fetch(NULL, tv->algname, NULL)));
 755     ERR_pop_to_mark();
 756
 757     printf(cBLUE "Test %s: %s: " cNORM, tv->algname, tv->name);
 758
 759     /* Test alignment problems. */
 760     int shifts = 32;
 761     int i;
 762     char *buf;
 763     T(buf = OPENSSL_malloc(tv->psize + shifts));
 764     for (i = 0; i < shifts; i++) {
 765         memcpy(buf + i, tv->plaintext, tv->psize);
 766         if (mac) {
 767             ret |= do_mac(i, mac, buf + i, tv);
 768         }
 769         if (md) {
 770             if (tv->hmac)
 771                 ret |= do_hmac(i, md, buf + i, tv);
 772             else
 773                 ret |= do_digest(i, md, buf + i, tv);
 774
 775         }
 776         /* Test CMAC provider for applicable entries. */
 777         ret |= do_cmac_prov(i, buf + i, tv);
 778
 779         /* No need to continue loop on failure. */
 780         if (ret)
 781             break;
 782     }
 783     OPENSSL_free(buf);
 784     EVP_MAC_free(mac);
 785     EVP_MD_free(md);
 786
 787     if (!ret)
 788         printf(cGREEN "success" cNORM "\n");
 789     else
 790         printf(cRED "fail" cNORM "\n");
 791     return ret;
 792 }
 793
 794 #define SUPER_SIZE 256
 795 /*
 796  * For 256-byte buffer filled with 256 bytes from 0 to 255;
 797  * Digest them 256 times from the buffer end with lengths from 0 to 256,
 798  * and from beginning of the buffer with lengths from 0 to 256;
 799  * Each produced digest is digested again into final sum.
 800  */
 801 static int do_synthetic_once(const struct hash_testvec *tv, unsigned int shifts)
 802 {
 803     unsigned char *ibuf, *md;
 804     T(ibuf = OPENSSL_zalloc(SUPER_SIZE + shifts));
 805
 806     /* fill with pattern */
 807     unsigned int len;
 808     for (len = 0; len < SUPER_SIZE; len++)
 809             ibuf[shifts + len] = len & 0xff;
 810
 811     EVP_MD *dgst;
 812     T((dgst = (EVP_MD *)EVP_get_digestbyname(tv->algname))
 813       || (dgst = EVP_MD_fetch(NULL, tv->algname, NULL)));
 814     OPENSSL_assert(EVP_MD_is_a(dgst, tv->algname));
 815     EVP_MD_CTX *ctx, *ctx2;
 816     T(ctx  = EVP_MD_CTX_new());
 817     T(ctx2 = EVP_MD_CTX_new());
 818     T(EVP_DigestInit(ctx2, dgst));
 819     OPENSSL_assert(EVP_MD_is_a(EVP_MD_CTX_md(ctx2), tv->algname));
 820     OPENSSL_assert(EVP_MD_block_size(dgst) == tv->block_size);
 821     OPENSSL_assert(EVP_MD_CTX_size(ctx2) == tv->outsize);
 822     OPENSSL_assert(EVP_MD_CTX_block_size(ctx2) == tv->block_size);
 823
 824     const unsigned int mdlen = EVP_MD_size(dgst);
 825     OPENSSL_assert(mdlen == tv->outsize);
 826     T(md = OPENSSL_zalloc(mdlen + shifts));
 827     md += shifts; /* test for output digest alignment problems */
 828
 829     /* digest cycles */
 830     for (len = 0; len < SUPER_SIZE; len++) {
 831         /* for each len digest len bytes from the end of buf */
 832         T(EVP_DigestInit(ctx, dgst));
 833         T(EVP_DigestUpdate(ctx, ibuf + shifts + SUPER_SIZE - len, len));
 834         T(EVP_DigestFinal(ctx, md, NULL));
 835         T(EVP_DigestUpdate(ctx2, md, mdlen));
 836     }
 837
 838     for (len = 0; len < SUPER_SIZE; len++) {
 839         /* for each len digest len bytes from the beginning of buf */
 840         T(EVP_DigestInit(ctx, dgst));
 841         T(EVP_DigestUpdate(ctx, ibuf + shifts, len));
 842         T(EVP_DigestFinal(ctx, md, NULL));
 843         T(EVP_DigestUpdate(ctx2, md, mdlen));
 844     }
 845
 846     OPENSSL_free(ibuf);
 847     EVP_MD_CTX_free(ctx);
 848
 849     T(EVP_DigestFinal(ctx2, md, &len));
 850     EVP_MD_CTX_free(ctx2);
 851
 852     EVP_MD_free(dgst);
 853
 854     if (len != mdlen) {
 855         printf(cRED "digest output len mismatch %u != %u (expected)" cNORM "\n",
 856             len, mdlen);
 857         goto err;
 858     }
 859
 860     if (memcmp(md, tv->digest, mdlen) != 0) {
 861         printf(cRED "digest mismatch" cNORM "\n");
 862
 863         unsigned int i;
 864         printf("  Expected value is: ");
 865         for (i = 0; i < mdlen; i++)
 866             printf("\\x%02x", md[i]);
 867         printf("\n");
 868         goto err;
 869     }
 870
 871     OPENSSL_free(md - shifts);
 872     return 0;
 873 err:
 874     OPENSSL_free(md - shifts);
 875     EVP_MD_free(dgst);
 876     return 1;
 877 }
 878
 879 /* do different block sizes and different memory offsets */
 880 static int do_synthetic_test(const struct hash_testvec *tv)
 881 {
 882     int ret = 0;
 883
 884     printf(cBLUE "Test %s: " cNORM, tv->name);
 885     fflush(stdout);
 886
 887     unsigned int shifts;
 888     for (shifts = 0; shifts < 16 && !ret; shifts++)
 889         ret |= do_synthetic_once(tv, shifts);
 890
 891     if (!ret)
 892         printf(cGREEN "success" cNORM "\n");
 893     else
 894         printf(cRED "fail" cNORM "\n");
 895     return 0;
 896 }
 897
 898 int engine_is_available(const char *name)
 899 {
 900     ENGINE *e = ENGINE_get_first();
 901
 902     while (e != NULL) {
 903         if (strcmp(ENGINE_get_id(e), name) == 0)
 904             break;
 905         e = ENGINE_get_next(e);
 906     }
 907     ENGINE_free(e);
 908     return e != NULL;
 909 }
 910
 911 void warn_if_untested(const EVP_MD *dgst, void *provider)
 912 {
 913     const struct hash_testvec *tv;
 914
 915     /* ENGINE provided EVP_MDs have a NULL provider */
 916     if (provider != EVP_MD_get0_provider(dgst))
 917         return;
 918
 919     for (tv = testvecs; tv->algname; tv++)
 920         if (EVP_MD_is_a(dgst, tv->algname))
 921             break;
 922     if (!tv->algname)
 923         printf(cMAGENT "Digest %s is untested!" cNORM "\n", EVP_MD_name(dgst));
 924 }
 925
 926 void warn_all_untested(void)
 927 {
 928     if (engine_is_available("gost")) {
 929         ENGINE *eng;
 930
 931         T(eng = ENGINE_by_id("gost"));
 932         T(ENGINE_init(eng));
 933
 934         ENGINE_DIGESTS_PTR fn_c;
 935         T(fn_c = ENGINE_get_digests(eng));
 936         const int *nids;
 937         int n, k;
 938         n = fn_c(eng, NULL, &nids, 0);
 939         for (k = 0; k < n; ++k)
 940             warn_if_untested(ENGINE_get_digest(eng, nids[k]), NULL);
 941         ENGINE_finish(eng);
 942         ENGINE_free(eng);
 943     }
 944     if (OSSL_PROVIDER_available(NULL, "gostprov")) {
 945         OSSL_PROVIDER *prov;
 946
 947         T(prov = OSSL_PROVIDER_load(NULL, "gostprov"));
 948         EVP_MD_do_all_provided(NULL,
 949                                (void (*)(EVP_MD *, void *))warn_if_untested,
 950                                prov);
 951
 952         OSSL_PROVIDER_unload(prov);
 953     }
 954 }
 955
 956 int main(int argc, char **argv)
 957 {
 958     int ret = 0;
 959
 960 #if MIPSEL
 961     /* Trigger SIGBUS for unaligned access. */
 962     sysmips(MIPS_FIXADE, 0);
 963 #endif
 964     OPENSSL_add_all_algorithms_conf();
 965
 966     const struct hash_testvec *tv;
 967     for (tv = testvecs; tv->algname; tv++) {
 968         if (tv->plaintext)
 969             ret |= do_test(tv);
 970         else
 971             ret |= do_synthetic_test(tv);
 972     }
 973
 974     warn_all_untested();
 975
 976     if (ret)
 977         printf(cDRED "= Some tests FAILED!" cNORM "\n");
 978     else
 979         printf(cDGREEN "= All tests passed!" cNORM "\n");
 980     return ret;
 981 }