blob: fd6a89f2c8e840ffbedf1fe6981fa62d485a324a [file] [log] [blame]
Raef Coles8ff6df52021-07-21 12:42:15 +01001/* BEGIN_HEADER */
Raef Coles7dce69a2022-08-24 14:07:06 +01002#include "lmots.h"
3#include "mbedtls/lms.h"
4
Raef Coles9c9027b2022-09-02 18:26:31 +01005#if defined(MBEDTLS_TEST_HOOKS)
Raef Coles9c9027b2022-09-02 18:26:31 +01006int check_lmots_private_key_for_leak(unsigned char * sig)
7{
8 size_t idx;
9
10 for( idx = MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(MBEDTLS_LMOTS_SHA256_N32_W8);
11 idx < MBEDTLS_LMOTS_SIG_LEN(MBEDTLS_LMOTS_SHA256_N32_W8);
12 idx++ )
13 {
Raef Coles781f7be2022-10-13 09:23:11 +010014 TEST_EQUAL( sig[idx], 0x7E );
Raef Coles9c9027b2022-09-02 18:26:31 +010015 }
16
Raef Coles781f7be2022-10-13 09:23:11 +010017 return( 0 );
18
19exit:
20 return( -1 );
Raef Coles9c9027b2022-09-02 18:26:31 +010021}
22#endif /* defined(MBEDTLS_TEST_HOOKS) */
23
Raef Coles8ff6df52021-07-21 12:42:15 +010024/* END_HEADER */
25
26/* BEGIN_DEPENDENCIES
Raef Coles1b43a742022-10-13 09:44:27 +010027 * depends_on:MBEDTLS_LMS_C
Raef Coles8ff6df52021-07-21 12:42:15 +010028 * END_DEPENDENCIES
29 */
30
Raef Coles5127e852022-10-07 10:35:56 +010031/* BEGIN_CASE depends_on:MBEDTLS_LMS_PRIVATE */
Raef Colesf5919e22022-09-02 16:05:10 +010032void lmots_sign_verify_test ( data_t *msg, data_t *key_id, int leaf_id,
33 data_t *seed )
Raef Coles8ff6df52021-07-21 12:42:15 +010034{
Raef Coles01c71a12022-08-31 15:55:00 +010035 mbedtls_lmots_public_t pub_ctx;
36 mbedtls_lmots_private_t priv_ctx;
Raef Colese9479a02022-09-01 16:06:35 +010037 unsigned char sig[MBEDTLS_LMOTS_SIG_LEN(MBEDTLS_LMOTS_SHA256_N32_W8)];
Raef Coles8ff6df52021-07-21 12:42:15 +010038
Raef Colesbe3bdd82022-10-07 12:04:24 +010039 mbedtls_lmots_public_init( &pub_ctx );
40 mbedtls_lmots_private_init( &priv_ctx );
Raef Coles8ff6df52021-07-21 12:42:15 +010041
Raef Coles810612e2022-10-11 13:16:53 +010042 TEST_EQUAL( mbedtls_lmots_generate_private_key(&priv_ctx, MBEDTLS_LMOTS_SHA256_N32_W8,
43 key_id->x, leaf_id, seed->x, seed->len ), 0 );
44 TEST_EQUAL( mbedtls_lmots_calculate_public_key(&pub_ctx, &priv_ctx), 0 );
45 TEST_EQUAL( mbedtls_lmots_sign(&priv_ctx, &mbedtls_test_rnd_std_rand, NULL,
46 msg->x, msg->len, sig, sizeof(sig), NULL ), 0 );
47 TEST_EQUAL( mbedtls_lmots_verify(&pub_ctx, msg->x, msg->len, sig, sizeof(sig)), 0 );
Raef Coles8ff6df52021-07-21 12:42:15 +010048
49exit:
Raef Colesbe3bdd82022-10-07 12:04:24 +010050 mbedtls_lmots_public_free( &pub_ctx );
51 mbedtls_lmots_private_free( &priv_ctx );
Raef Coles8ff6df52021-07-21 12:42:15 +010052}
53/* END_CASE */
54
Raef Coles5127e852022-10-07 10:35:56 +010055/* BEGIN_CASE depends_on:MBEDTLS_LMS_PRIVATE */
Raef Coles9c9027b2022-09-02 18:26:31 +010056void lmots_sign_verify_null_msg_test ( data_t *key_id, int leaf_id, data_t *seed )
57{
58 mbedtls_lmots_public_t pub_ctx;
59 mbedtls_lmots_private_t priv_ctx;
60 unsigned char sig[MBEDTLS_LMOTS_SIG_LEN(MBEDTLS_LMOTS_SHA256_N32_W8)];
61
Raef Colesbe3bdd82022-10-07 12:04:24 +010062 mbedtls_lmots_public_init( &pub_ctx );
63 mbedtls_lmots_private_init( &priv_ctx );
Raef Coles9c9027b2022-09-02 18:26:31 +010064
Raef Coles810612e2022-10-11 13:16:53 +010065 TEST_EQUAL( mbedtls_lmots_generate_private_key(&priv_ctx, MBEDTLS_LMOTS_SHA256_N32_W8,
66 key_id->x, leaf_id, seed->x, seed->len ), 0 );
67 TEST_EQUAL( mbedtls_lmots_calculate_public_key(&pub_ctx, &priv_ctx), 0 );
68 TEST_EQUAL( mbedtls_lmots_sign(&priv_ctx, &mbedtls_test_rnd_std_rand, NULL,
69 NULL, 0, sig, sizeof(sig), NULL ), 0 );
70 TEST_EQUAL( mbedtls_lmots_verify(&pub_ctx, NULL, 0, sig, sizeof(sig)), 0 );
Raef Coles9c9027b2022-09-02 18:26:31 +010071
72exit:
Raef Colesbe3bdd82022-10-07 12:04:24 +010073 mbedtls_lmots_public_free( &pub_ctx );
74 mbedtls_lmots_private_free( &priv_ctx );
Raef Coles9c9027b2022-09-02 18:26:31 +010075}
76/* END_CASE */
77
78/* BEGIN_CASE */
Raef Colesf5919e22022-09-02 16:05:10 +010079void lmots_verify_test ( data_t *msg, data_t *sig, data_t *pub_key,
Raef Coles8b55ba62022-10-12 09:28:26 +010080 int expected_rc )
Raef Coles8ff6df52021-07-21 12:42:15 +010081{
Raef Coles01c71a12022-08-31 15:55:00 +010082 mbedtls_lmots_public_t ctx;
Raef Coles0dc604e2022-10-10 17:35:26 +010083 unsigned int size;
84 unsigned char *tmp_sig = NULL;
Raef Coles8ff6df52021-07-21 12:42:15 +010085
Raef Colesbe3bdd82022-10-07 12:04:24 +010086 mbedtls_lmots_public_init( &ctx );
Raef Coles8ff6df52021-07-21 12:42:15 +010087
Raef Coles0dc604e2022-10-10 17:35:26 +010088 TEST_EQUAL(mbedtls_lmots_import_public_key( &ctx, pub_key->x, pub_key->len ), 0);
Raef Coles8ff6df52021-07-21 12:42:15 +010089
Raef Coles0dc604e2022-10-10 17:35:26 +010090 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, sig->x, sig->len ), expected_rc);
91
92 /* Test negative cases if the input data is valid */
93 if( expected_rc == 0 )
94 {
Raef Coles8b55ba62022-10-12 09:28:26 +010095 if( msg->len >= 1 )
96 {
97 /* Altering first message byte must cause verification failure */
98 msg->x[0] ^= 1;
99 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, sig->x, sig->len ),
100 MBEDTLS_ERR_LMS_VERIFY_FAILED);
101 msg->x[0] ^= 1;
Raef Coles0dc604e2022-10-10 17:35:26 +0100102
Raef Coles8b55ba62022-10-12 09:28:26 +0100103 /* Altering last message byte must cause verification failure */
104 msg->x[msg->len - 1] ^= 1;
105 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, sig->x, sig->len ),
106 MBEDTLS_ERR_LMS_VERIFY_FAILED);
107 msg->x[msg->len - 1] ^= 1;
108 }
Raef Coles0dc604e2022-10-10 17:35:26 +0100109
110 /* Altering first signature byte must cause verification failure */
111 sig->x[0] ^= 1;
112 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, sig->x, sig->len ),
113 MBEDTLS_ERR_LMS_VERIFY_FAILED);
114 sig->x[0] ^= 1;
115
Raef Coles0dc604e2022-10-10 17:35:26 +0100116 /* Altering last signature byte must cause verification failure */
117 sig->x[sig->len - 1] ^= 1;
118 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, sig->x, sig->len ),
119 MBEDTLS_ERR_LMS_VERIFY_FAILED);
120 sig->x[sig->len - 1] ^= 1;
121
122 /* Signatures of all sizes must not verify, whether shorter or longer */
123 for( size = 0; size < sig->len; size++ ) {
124 if( size == sig->len )
125 continue;
126
127 ASSERT_ALLOC( tmp_sig, size );
128 if( tmp_sig != NULL )
129 memcpy( tmp_sig, sig->x, MIN(size, sig->len) );
130
131 TEST_EQUAL(mbedtls_lmots_verify( &ctx, msg->x, msg->len, tmp_sig, size ),
132 MBEDTLS_ERR_LMS_VERIFY_FAILED);
133 mbedtls_free( tmp_sig );
134 tmp_sig = NULL;
135 }
136 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100137
138exit:
Raef Coles1d88ea82022-10-13 14:18:16 +0100139 mbedtls_free( tmp_sig );
Raef Colesbe3bdd82022-10-07 12:04:24 +0100140 mbedtls_lmots_public_free( &ctx );
Raef Coles8ff6df52021-07-21 12:42:15 +0100141}
142/* END_CASE */
143
Raef Coles370cc432022-10-07 16:07:33 +0100144/* BEGIN_CASE */
Raef Coles66edf6a2022-10-12 09:36:58 +0100145void lmots_import_export_test ( data_t * pub_key, int expected_import_rc )
Raef Coles8ff6df52021-07-21 12:42:15 +0100146{
Raef Coles01c71a12022-08-31 15:55:00 +0100147 mbedtls_lmots_public_t ctx;
Raef Coles66edf6a2022-10-12 09:36:58 +0100148 unsigned char *exported_pub_key = NULL;
149 size_t exported_pub_key_buf_size;
150 size_t exported_pub_key_size;
Raef Coles8ff6df52021-07-21 12:42:15 +0100151
Raef Colesbe3bdd82022-10-07 12:04:24 +0100152 mbedtls_lmots_public_init( &ctx );
Raef Coles66edf6a2022-10-12 09:36:58 +0100153 TEST_EQUAL( mbedtls_lmots_import_public_key( &ctx, pub_key->x, pub_key->len ),
154 expected_import_rc );
Raef Coles8ff6df52021-07-21 12:42:15 +0100155
Raef Coles66edf6a2022-10-12 09:36:58 +0100156 if( expected_import_rc == 0 )
157 {
158 exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8);
159 ASSERT_ALLOC( exported_pub_key, exported_pub_key_buf_size );
160
161 TEST_EQUAL( mbedtls_lmots_export_public_key( &ctx, exported_pub_key,
162 exported_pub_key_buf_size,
163 &exported_pub_key_size ), 0 );
164
Raef Coles493724e2022-10-13 15:43:07 +0100165 TEST_EQUAL( exported_pub_key_size,
Raef Coles534f66f2022-10-13 09:39:01 +0100166 MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8) );
167 ASSERT_COMPARE( pub_key->x, pub_key->len,
168 exported_pub_key, exported_pub_key_size );
Raef Coles66edf6a2022-10-12 09:36:58 +0100169 mbedtls_free(exported_pub_key);
170 exported_pub_key = NULL;
171
172 /* Export into too-small buffer should fail */
173 exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8) - 1;
174 ASSERT_ALLOC( exported_pub_key, exported_pub_key_buf_size);
175 TEST_EQUAL( mbedtls_lmots_export_public_key( &ctx, exported_pub_key,
176 exported_pub_key_buf_size, NULL ),
177 MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
178 mbedtls_free(exported_pub_key);
179 exported_pub_key = NULL;
Raef Coles6b2c5732022-10-13 09:41:39 +0100180
181 /* Export into too-large buffer should succeed */
182 exported_pub_key_buf_size = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(MBEDTLS_LMOTS_SHA256_N32_W8) + 1;
183 ASSERT_ALLOC( exported_pub_key, exported_pub_key_buf_size);
184 TEST_EQUAL( mbedtls_lmots_export_public_key( &ctx, exported_pub_key,
Raef Coles6d7d94a2022-10-13 17:55:46 +0100185 exported_pub_key_buf_size,
186 &exported_pub_key_size ),
Raef Coles6b2c5732022-10-13 09:41:39 +0100187 0 );
Raef Coles33f7d662022-10-13 14:24:08 +0100188 ASSERT_COMPARE( pub_key->x, pub_key->len,
189 exported_pub_key, exported_pub_key_size );
Raef Coles6b2c5732022-10-13 09:41:39 +0100190 mbedtls_free(exported_pub_key);
191 exported_pub_key = NULL;
Raef Coles66edf6a2022-10-12 09:36:58 +0100192 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100193
194exit:
Raef Colesbe3bdd82022-10-07 12:04:24 +0100195 mbedtls_lmots_public_free( &ctx );
Gilles Peskine503d09b2022-10-17 12:27:43 +0200196 mbedtls_free( exported_pub_key );
Raef Coles8ff6df52021-07-21 12:42:15 +0100197}
198/* END_CASE */
199
Raef Coles5127e852022-10-07 10:35:56 +0100200/* BEGIN_CASE depends_on:MBEDTLS_LMS_PRIVATE */
Raef Colesf5919e22022-09-02 16:05:10 +0100201void lmots_reuse_test ( data_t *msg, data_t *key_id, int leaf_id, data_t *seed )
Raef Coles8ff6df52021-07-21 12:42:15 +0100202{
Raef Coles01c71a12022-08-31 15:55:00 +0100203 mbedtls_lmots_private_t ctx;
Raef Colese9479a02022-09-01 16:06:35 +0100204 unsigned char sig[MBEDTLS_LMOTS_SIG_LEN(MBEDTLS_LMOTS_SHA256_N32_W8)];
Raef Coles8ff6df52021-07-21 12:42:15 +0100205
Raef Colesbe3bdd82022-10-07 12:04:24 +0100206 mbedtls_lmots_private_init( &ctx );
Raef Coles810612e2022-10-11 13:16:53 +0100207 TEST_EQUAL( mbedtls_lmots_generate_private_key(&ctx, MBEDTLS_LMOTS_SHA256_N32_W8,
208 key_id->x, leaf_id, seed->x,
209 seed->len ), 0 );
210 TEST_EQUAL( mbedtls_lmots_sign(&ctx, mbedtls_test_rnd_std_rand, NULL,
211 msg->x, msg->len, sig, sizeof( sig ), NULL ), 0 );
Raef Coles8ff6df52021-07-21 12:42:15 +0100212
213 /* Running another sign operation should fail, since the key should now have
214 * been erased.
215 */
Raef Coles810612e2022-10-11 13:16:53 +0100216 TEST_EQUAL( mbedtls_lmots_sign(&ctx, mbedtls_test_rnd_std_rand, NULL,
217 msg->x, msg->len, sig, sizeof( sig ), NULL ), MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
Raef Coles8ff6df52021-07-21 12:42:15 +0100218
219exit:
Raef Colesbe3bdd82022-10-07 12:04:24 +0100220 mbedtls_lmots_private_free( &ctx );
Raef Coles8ff6df52021-07-21 12:42:15 +0100221}
222/* END_CASE */
Raef Coles9c9027b2022-09-02 18:26:31 +0100223
Raef Coles59eb0d02022-10-12 15:19:17 +0100224/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_LMS_PRIVATE */
Raef Coles9c9027b2022-09-02 18:26:31 +0100225void lmots_signature_leak_test ( data_t *msg, data_t *key_id, int leaf_id,
226 data_t *seed )
227{
228 mbedtls_lmots_private_t ctx;
229 unsigned char sig[MBEDTLS_LMOTS_SIG_LEN(MBEDTLS_LMOTS_SHA256_N32_W8)];
230
231 mbedtls_lmots_sign_private_key_invalidated_hook = &check_lmots_private_key_for_leak;
232
233 /* Fill with recognisable pattern */
234 memset( sig, 0x7E, sizeof( sig ) );
235
Raef Colesbe3bdd82022-10-07 12:04:24 +0100236 mbedtls_lmots_private_init( &ctx );
Raef Coles810612e2022-10-11 13:16:53 +0100237 TEST_EQUAL( mbedtls_lmots_generate_private_key(&ctx, MBEDTLS_LMOTS_SHA256_N32_W8,
238 key_id->x, leaf_id, seed->x,
239 seed->len ), 0 );
240 TEST_EQUAL( mbedtls_lmots_sign(&ctx, mbedtls_test_rnd_std_rand, NULL,
241 msg->x, msg->len, sig, sizeof( sig ), NULL ), 0 );
Raef Coles9c9027b2022-09-02 18:26:31 +0100242
243exit:
Raef Colesbe3bdd82022-10-07 12:04:24 +0100244 mbedtls_lmots_private_free( &ctx );
Raef Coles9c9027b2022-09-02 18:26:31 +0100245 mbedtls_lmots_sign_private_key_invalidated_hook = NULL;
246}
247/* END_CASE */