luna - wolfssl/tests/api/test

   1/* test_pkcs12.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/wolfcrypt/hmac.h>
  32#include <wolfssl/wolfcrypt/pkcs12.h>
  33#include <wolfssl/wolfcrypt/pwdbased.h>
  34#include <wolfssl/wolfcrypt/types.h>
  35#include <wolfssl/wolfcrypt/aes.h>
  36#include <tests/api/api.h>
  37#include <tests/api/test_pkcs12.h>
  38
  39/*******************************************************************************
  40 * PKCS#12
  41 ******************************************************************************/
  42
  43int test_wc_i2d_PKCS12(void)
  44{
  45    EXPECT_DECLS;
  46#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) \
  47    && !defined(NO_FILESYSTEM) && !defined(NO_RSA) \
  48    && !defined(NO_AES) && !defined(NO_SHA) && !defined(NO_SHA256)
  49    WC_PKCS12* pkcs12 = NULL;
  50    unsigned char der[FOURK_BUF * 2];
  51    unsigned char* pt;
  52    int derSz = 0;
  53    unsigned char out[FOURK_BUF * 2];
  54    int outSz = FOURK_BUF * 2;
  55    const char p12_f[] = "./certs/test-servercert.p12";
  56    XFILE f = XBADFILE;
  57
  58    ExpectTrue((f =  XFOPEN(p12_f, "rb")) != XBADFILE);
  59    ExpectIntGT(derSz = (int)XFREAD(der, 1, sizeof(der), f), 0);
  60    if (f != XBADFILE)
  61        XFCLOSE(f);
  62
  63    ExpectNotNull(pkcs12 = wc_PKCS12_new());
  64    ExpectIntEQ(wc_d2i_PKCS12(der, (word32)derSz, pkcs12), 0);
  65    ExpectIntEQ(wc_i2d_PKCS12(pkcs12, NULL, &outSz), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
  66    ExpectIntEQ(outSz, derSz);
  67
  68    outSz = derSz - 1;
  69    pt = out;
  70    ExpectIntLE(wc_i2d_PKCS12(pkcs12, &pt, &outSz), 0);
  71
  72    outSz = derSz;
  73    ExpectIntEQ(wc_i2d_PKCS12(pkcs12, &pt, &outSz), derSz);
  74    ExpectIntEQ((pt == out), 0);
  75
  76    pt = NULL;
  77    ExpectIntEQ(wc_i2d_PKCS12(pkcs12, &pt, NULL), derSz);
  78    XFREE(pt, NULL, DYNAMIC_TYPE_PKCS);
  79    wc_PKCS12_free(pkcs12);
  80    pkcs12 = NULL;
  81
  82    /* Run the same test but use wc_d2i_PKCS12_fp. */
  83    ExpectNotNull(pkcs12 = wc_PKCS12_new());
  84    ExpectIntEQ(wc_d2i_PKCS12_fp("./certs/test-servercert.p12", &pkcs12), 0);
  85    ExpectIntEQ(wc_i2d_PKCS12(pkcs12, NULL, &outSz), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
  86    ExpectIntEQ(outSz, derSz);
  87    wc_PKCS12_free(pkcs12);
  88    pkcs12 = NULL;
  89
  90    /* wc_d2i_PKCS12_fp can also allocate the PKCS12 object for the caller. */
  91    ExpectIntEQ(wc_d2i_PKCS12_fp("./certs/test-servercert.p12", &pkcs12), 0);
  92    ExpectIntEQ(wc_i2d_PKCS12(pkcs12, NULL, &outSz), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
  93    ExpectIntEQ(outSz, derSz);
  94    wc_PKCS12_free(pkcs12);
  95    pkcs12 = NULL;
  96#endif
  97    return EXPECT_RESULT();
  98}
  99
 100static int test_wc_PKCS12_create_once(int keyEncType, int certEncType)
 101{
 102    EXPECT_DECLS;
 103#if !defined(NO_ASN) && defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && \
 104    !defined(NO_RSA) && !defined(NO_ASN_CRYPT) && \
 105    !defined(NO_HMAC) && !defined(NO_CERTS) && defined(USE_CERT_BUFFERS_2048)
 106
 107    byte* inKey = (byte*) server_key_der_2048;
 108    const word32 inKeySz= sizeof_server_key_der_2048;
 109    byte* inCert = (byte*) server_cert_der_2048;
 110    const word32 inCertSz = sizeof_server_cert_der_2048;
 111    WC_DerCertList inCa = {
 112        (byte*)ca_cert_der_2048, sizeof_ca_cert_der_2048, NULL
 113    };
 114    char pkcs12Passwd[] = "test_wc_PKCS12_create";
 115
 116    WC_PKCS12* pkcs12Export = NULL;
 117    WC_PKCS12* pkcs12Import = NULL;
 118    byte* pkcs12Der = NULL;
 119    byte* outKey = NULL;
 120    byte* outCert = NULL;
 121    WC_DerCertList* outCaList = NULL;
 122    word32 pkcs12DerSz = 0;
 123    word32 outKeySz = 0;
 124    word32 outCertSz = 0;
 125
 126    ExpectNotNull(pkcs12Export = wc_PKCS12_create(pkcs12Passwd,
 127        sizeof(pkcs12Passwd) - 1,
 128        (char*) "friendlyName" /* not used currently */,
 129        inKey, inKeySz, inCert, inCertSz, &inCa, keyEncType, certEncType,
 130        2048, 2048, 0 /* not used currently */, NULL));
 131    pkcs12Der = NULL;
 132    ExpectIntGE((pkcs12DerSz = wc_i2d_PKCS12(pkcs12Export, &pkcs12Der, NULL)),
 133        0);
 134
 135    ExpectNotNull(pkcs12Import = wc_PKCS12_new_ex(NULL));
 136    ExpectIntGE(wc_d2i_PKCS12(pkcs12Der, pkcs12DerSz, pkcs12Import), 0);
 137    ExpectIntEQ(wc_PKCS12_parse(pkcs12Import, pkcs12Passwd, &outKey, &outKeySz,
 138        &outCert, &outCertSz, &outCaList), 0);
 139
 140    ExpectIntEQ(outKeySz, inKeySz);
 141    ExpectIntEQ(outCertSz, inCertSz);
 142    ExpectNotNull(outCaList);
 143    ExpectNotNull(outCaList->buffer);
 144    ExpectIntEQ(outCaList->bufferSz, inCa.bufferSz);
 145    ExpectNull(outCaList->next);
 146
 147    ExpectIntEQ(XMEMCMP(inKey, outKey, outKeySz), 0);
 148    ExpectIntEQ(XMEMCMP(inCert, outCert, outCertSz), 0);
 149    ExpectIntEQ(XMEMCMP(inCa.buffer, outCaList->buffer, outCaList->bufferSz),
 150        0);
 151
 152    XFREE(outKey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
 153    XFREE(outCert, NULL, DYNAMIC_TYPE_PKCS);
 154    wc_FreeCertList(outCaList, NULL);
 155    wc_PKCS12_free(pkcs12Import);
 156    XFREE(pkcs12Der, NULL, DYNAMIC_TYPE_PKCS);
 157    wc_PKCS12_free(pkcs12Export);
 158#endif
 159    (void) keyEncType;
 160    (void) certEncType;
 161
 162    return EXPECT_RESULT();
 163}
 164
 165int test_wc_PKCS12_create(void)
 166{
 167    EXPECT_DECLS;
 168
 169#ifndef NO_SHA256
 170    EXPECT_TEST(test_wc_PKCS12_create_once(-1, -1));
 171#if !defined(NO_RC4) && !defined(NO_SHA)
 172    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_SHA1_RC4_128, PBE_SHA1_RC4_128));
 173#endif
 174#if !defined(NO_DES3) && !defined(NO_SHA)
 175    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_SHA1_DES, PBE_SHA1_DES));
 176#endif
 177#if !defined(NO_DES3) && !defined(NO_SHA)
 178    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_SHA1_DES3, PBE_SHA1_DES3));
 179#endif
 180#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_256) && \
 181    !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE)
 182    /* Encoding certificate with PBE_AES256_CBC needs WOLFSSL_ASN_TEMPLATE */
 183    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES256_CBC, PBE_AES256_CBC));
 184#endif
 185#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_128) && \
 186    !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE)
 187    /* Encoding certificate with PBE_AES128_CBC needs WOLFSSL_ASN_TEMPLATE */
 188    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES128_CBC, PBE_AES128_CBC));
 189#endif
 190/* Testing a mixture of 2 algorithms */
 191#if defined(HAVE_AES_CBC) && !defined(NO_AES) && !defined(NO_AES_256) && \
 192    !defined(NO_SHA) && defined(WOLFSSL_ASN_TEMPLATE) && !defined(NO_DES3)
 193    EXPECT_TEST(test_wc_PKCS12_create_once(PBE_AES256_CBC, PBE_SHA1_DES3));
 194#endif
 195#endif
 196
 197    (void) test_wc_PKCS12_create_once;
 198
 199    return EXPECT_RESULT();
 200}
 201
 202int test_wc_d2i_PKCS12_bad_mac_salt(void)
 203{
 204    EXPECT_DECLS;
 205#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) \
 206    && !defined(NO_FILESYSTEM) && !defined(NO_RSA) \
 207    && !defined(NO_AES) && !defined(NO_SHA) && !defined(NO_SHA256)
 208    WC_PKCS12* pkcs12 = NULL;
 209    unsigned char der[FOURK_BUF * 2];
 210    int derSz = 0;
 211    const char p12_f[] = "./certs/test-servercert.p12";
 212    XFILE f = XBADFILE;
 213    int i;
 214    int found = 0;
 215
 216    ExpectTrue((f = XFOPEN(p12_f, "rb")) != XBADFILE);
 217    ExpectIntGT(derSz = (int)XFREAD(der, 1, sizeof(der), f), 0);
 218    if (f != XBADFILE)
 219        XFCLOSE(f);
 220
 221    /* Scan backward within the last 100 bytes to find the MAC salt
 222     * OCTET STRING (tag 0x04, length 0x08 for a typical 8-byte salt).
 223     * Corrupt its length so that saltSz + curIdx > totalSz, triggering
 224     * the error path in GetSignData() after salt allocation. */
 225    for (i = derSz - 2; i >= 0 && i >= derSz - 100; i--) {
 226        if (der[i] == 0x04 && der[i + 1] == 0x08) {
 227            der[i + 1] = 0xFF;
 228            found = 1;
 229            break;
 230        }
 231    }
 232    ExpectIntEQ(found, 1);
 233
 234    ExpectNotNull(pkcs12 = wc_PKCS12_new());
 235    ExpectIntNE(wc_d2i_PKCS12(der, (word32)derSz, pkcs12), 0);
 236    wc_PKCS12_free(pkcs12);
 237#endif
 238    return EXPECT_RESULT();
 239}
 240
 241/* Test that a crafted PKCS12 with a ContentInfo SEQUENCE length smaller than
 242 * the contained OID is rejected, rather than causing an integer underflow
 243 * in ci->dataSz calculation. */
 244int test_wc_d2i_PKCS12_oid_underflow(void)
 245{
 246    EXPECT_DECLS;
 247#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12)
 248    WC_PKCS12* pkcs12 = NULL;
 249
 250    /* Crafted PKCS12 DER: the inner ContentInfo SEQUENCE declares length 5,
 251     * but contains a valid OID (1.2.840.113549.1.7.1) that is 11 bytes
 252     * on the wire (tag 06 + length 09 + 9 value bytes). Without the bounds
 253     * check, (word32)curSz - (localIdx - curIdx) = 5 - 11 underflows
 254     * to ~4GB. */
 255    static const byte crafted[] = {
 256        0x30, 0x23,                                           /* outer SEQ */
 257        0x02, 0x01, 0x03,                                     /* version 3 */
 258        0x30, 0x1E,                                  /* AuthSafe wrapper SEQ */
 259          0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D,
 260          0x01, 0x07, 0x01,                             /* OID pkcs7-data */
 261          0xA0, 0x11,                              /* [0] CONSTRUCTED ctx */
 262            0x04, 0x0F,                                   /* OCTET STRING */
 263              0x30, 0x0D,                       /* SEQ of ContentInfo arr */
 264                0x30, 0x05,              /* ContentInfo SEQ, length=5 LIE */
 265                  0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D,
 266                  0x01, 0x07, 0x01              /* OID: 11 bytes actual */
 267    };
 268
 269    ExpectNotNull(pkcs12 = wc_PKCS12_new());
 270    ExpectIntEQ(wc_d2i_PKCS12(crafted, (word32)sizeof(crafted), pkcs12),
 271                ASN_PARSE_E);
 272    wc_PKCS12_free(pkcs12);
 273#endif
 274    return EXPECT_RESULT();
 275}
 276
 277/* Test that validates the fix for heap OOB read vulnerability where
 278 * ASN.1 parsing after DecryptContent() would use stale ContentInfo bounds.
 279 * This is a basic test that verifies the fix compiles and basic PKCS#12
 280 * functionality still works after adding contentSz bounds checking. */
 281int test_wc_PKCS12_encrypted_content_bounds(void)
 282{
 283    EXPECT_DECLS;
 284#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) && \
 285    !defined(NO_RSA) && !defined(NO_AES) && !defined(NO_SHA) && \
 286    !defined(NO_SHA256) && defined(USE_CERT_BUFFERS_2048)
 287
 288    /* This test validates that the fix for heap OOB read is in place.
 289     * The fix ensures ASN.1 parsing uses contentSz (actual decrypted size)
 290     * instead of ci->dataSz (original ContentInfo size) as bounds.
 291     *
 292     * We test this by exercising the PKCS#12 parsing path with encrypted
 293     * content to ensure the fix doesn't break normal operation. */
 294
 295    byte* inKey = (byte*) server_key_der_2048;
 296    const word32 inKeySz = sizeof_server_key_der_2048;
 297    byte* inCert = (byte*) server_cert_der_2048;
 298    const word32 inCertSz = sizeof_server_cert_der_2048;
 299    WC_DerCertList inCa = {
 300        (byte*)ca_cert_der_2048, sizeof_ca_cert_der_2048, NULL
 301    };
 302    char pkcs12Passwd[] = "test_bounds_fix";
 303
 304    WC_PKCS12* pkcs12Export = NULL;
 305    WC_PKCS12* pkcs12Import = NULL;
 306    byte* pkcs12Der = NULL;
 307    byte* outKey = NULL;
 308    byte* outCert = NULL;
 309    WC_DerCertList* outCaList = NULL;
 310    int exportRet = 0;
 311    word32 pkcs12DerSz = 0;
 312    word32 outKeySz = 0;
 313    word32 outCertSz = 0;
 314
 315    /* Create a PKCS#12 with encrypted content */
 316    ExpectNotNull(pkcs12Export = wc_PKCS12_create(pkcs12Passwd,
 317        sizeof(pkcs12Passwd) - 1, NULL, inKey, inKeySz, inCert, inCertSz,
 318        &inCa, -1, -1, 2048, 2048, 0, NULL));
 319
 320    /* Serialize to DER - use int intermediate to avoid word32 truncation
 321     * of negative error codes from wc_i2d_PKCS12(). */
 322    ExpectIntGE((exportRet = wc_i2d_PKCS12(pkcs12Export, &pkcs12Der, NULL)), 0);
 323    pkcs12DerSz = (word32)exportRet;
 324
 325    /* Parse it back - this exercises the fixed bounds checking code path */
 326    ExpectNotNull(pkcs12Import = wc_PKCS12_new_ex(NULL));
 327    ExpectIntGE(wc_d2i_PKCS12(pkcs12Der, pkcs12DerSz, pkcs12Import), 0);
 328
 329    /* This parse operation now uses contentSz instead of ci->dataSz for bounds,
 330     * preventing the heap OOB read that existed before the fix */
 331    ExpectIntEQ(wc_PKCS12_parse(pkcs12Import, pkcs12Passwd, &outKey, &outKeySz,
 332        &outCert, &outCertSz, &outCaList), 0);
 333
 334    /* Verify the parsing worked correctly */
 335    ExpectIntEQ(outKeySz, inKeySz);
 336    ExpectIntEQ(outCertSz, inCertSz);
 337    ExpectNotNull(outCaList);
 338    ExpectIntEQ(outCaList->bufferSz, inCa.bufferSz);
 339    ExpectIntEQ(XMEMCMP(outKey, inKey, inKeySz), 0);
 340    ExpectIntEQ(XMEMCMP(outCert, inCert, inCertSz), 0);
 341    ExpectIntEQ(XMEMCMP(outCaList->buffer, inCa.buffer, inCa.bufferSz), 0);
 342
 343    /* Clean up */
 344    XFREE(outKey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
 345    XFREE(outCert, NULL, DYNAMIC_TYPE_PKCS);
 346    wc_FreeCertList(outCaList, NULL);
 347    wc_PKCS12_free(pkcs12Import);
 348    XFREE(pkcs12Der, NULL, DYNAMIC_TYPE_PKCS);
 349    wc_PKCS12_free(pkcs12Export);
 350
 351#endif
 352
 353    /* Part 2: True regression test - craft a malformed PKCS#12 whose decrypted
 354     * SafeBags SEQUENCE claims a length that exceeds the decrypted content
 355     * bounds (contentSz) but fits within the stale ContentInfo bounds
 356     * (ci->dataSz). Before the fix, the parser used ci->dataSz, allowing a
 357     * heap OOB read; with the fix it uses contentSz and rejects the blob. */
 358#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) && \
 359    defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC) && \
 360    defined(HAVE_AES_DECRYPT) && !defined(NO_SHA256) && !defined(NO_HMAC) && \
 361    defined(WOLFSSL_ASN_TEMPLATE) && !defined(HAVE_FIPS)
 362    {
 363        static const char regPassword[] = "test";
 364        static const byte regSalt[8] = {1, 2, 3, 4, 5, 6, 7, 8};
 365        static const byte regIv[16]  = {0};
 366
 367        /* Malformed SafeBags plaintext (one AES block = 16 bytes).
 368         * The outer SEQUENCE claims length 100 - this exceeds the decrypted
 369         * content size (16) but fits inside the stale ci->dataSz (127) that
 370         * the unfixed code used as the parsing bound. */
 371        static const byte regPlaintext[16] = {
 372            0x30, 0x64, /* SEQUENCE, length 100 */
 373            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 374            0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 375        };
 376
 377        /* Complete PKCS#12 DER (170 bytes).
 378         * Structure: PFX { version 3, authSafe { DATA { AuthenticatedSafe {
 379         *   EncryptedData { PBES2(AES-256-CBC, HMAC-SHA256, PBKDF2)
 380         *     <ciphertext placeholder at offset 154> } } } } }
 381         * No MacData - macIter=0 skips MAC verification. */
 382        byte regDer[170] = {
 383            0x30, 0x81, 0xA7,                               /* PFX SEQ (167) */
 384            0x02, 0x01, 0x03,                               /* version 3 */
 385            0x30, 0x81, 0xA1,                   /* authSafe ContentInfo (161) */
 386            0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
 387                0xF7, 0x0D, 0x01, 0x07, 0x01,                /* OID data */
 388            0xA0, 0x81, 0x93,                            /* [0] CONS. (147) */
 389            0x04, 0x81, 0x90,                        /* OCTET STRING (144) */
 390            0x30, 0x81, 0x8D,              /* AuthenticatedSafe SEQ (141) */
 391            0x30, 0x81, 0x8A,                    /* ContentInfo SEQ (138) */
 392            0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
 393                0xF7, 0x0D, 0x01, 0x07, 0x06,       /* OID encryptedData */
 394            0xA0, 0x7D,                              /* [0] CONS. (125) */
 395            0x30, 0x7B,                        /* EncryptedData SEQ (123) */
 396            0x02, 0x01, 0x00,                            /* version 0 */
 397            0x30, 0x76,                  /* EncryptedContentInfo SEQ (118) */
 398            0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
 399                0xF7, 0x0D, 0x01, 0x07, 0x01,                /* OID data */
 400            /* --- EncryptContent payload (107 bytes) --- */
 401            0x30, 0x57,                  /* AlgorithmIdentifier SEQ (87) */
 402            0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
 403                0xF7, 0x0D, 0x01, 0x05, 0x0D,                /* OID pbes2 */
 404            0x30, 0x4A,                         /* PBES2-params SEQ (74) */
 405            0x30, 0x29,                       /* keyDerivFunc SEQ (41) */
 406            0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
 407                0xF7, 0x0D, 0x01, 0x05, 0x0C,               /* OID pbkdf2 */
 408            0x30, 0x1C,                      /* PBKDF2-params SEQ (28) */
 409            0x04, 0x08,
 410                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,  /* salt */
 411            0x02, 0x02, 0x08, 0x00,                  /* iterations 2048 */
 412            0x30, 0x0C,                                /* PRF SEQ (12) */
 413            0x06, 0x08, 0x2A, 0x86, 0x48, 0x86,
 414                0xF7, 0x0D, 0x02, 0x09,            /* OID hmac-sha256 */
 415            0x05, 0x00,                                        /* NULL */
 416            0x30, 0x1D,                    /* encryptionScheme SEQ (29) */
 417            0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
 418                0x65, 0x03, 0x04, 0x01, 0x2A,        /* OID aes256-cbc */
 419            0x04, 0x10,                                  /* IV OCT (16) */
 420            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 421            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 422            0x80, 0x10,                       /* [0] IMPLICIT CT (16) */
 423            /* 16 bytes ciphertext - filled at runtime */
 424            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 425            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 426        };
 427
 428        byte regKey[32];
 429        byte regCiphertext[16];
 430        Aes regAes;
 431        WC_PKCS12* regP12 = NULL;
 432        byte* regPkey = NULL;
 433        byte* regCert = NULL;
 434        word32 regPkeySz = 0;
 435        word32 regCertSz = 0;
 436
 437        XMEMSET(regCiphertext, 0, sizeof(regCiphertext));
 438        /* Derive AES-256 key with the same PBKDF2 that DecryptContent uses */
 439        ExpectIntEQ(wc_PBKDF2(regKey, (const byte*)regPassword,
 440            (int)XSTRLEN(regPassword), regSalt, (int)sizeof(regSalt),
 441            2048, 32, WC_SHA256), 0);
 442
 443        /* Encrypt the malformed plaintext */
 444        ExpectIntEQ(wc_AesInit(&regAes, NULL, INVALID_DEVID), 0);
 445        ExpectIntEQ(wc_AesSetKey(&regAes, regKey, 32, regIv,
 446            AES_ENCRYPTION), 0);
 447        ExpectIntEQ(wc_AesCbcEncrypt(&regAes, regCiphertext, regPlaintext,
 448            sizeof(regPlaintext)), 0);
 449        wc_AesFree(&regAes);
 450
 451        /* Patch ciphertext into the DER template at offset 154 */
 452        XMEMCPY(regDer + 154, regCiphertext, sizeof(regCiphertext));
 453
 454        /* Parse the crafted PKCS#12 - d2i should succeed (outer structure
 455         * is valid), but wc_PKCS12_parse must fail because GetSequence
 456         * rejects SEQUENCE length 100 against contentSz 16. */
 457        ExpectNotNull(regP12 = wc_PKCS12_new_ex(NULL));
 458        ExpectIntGE(wc_d2i_PKCS12(regDer, (word32)sizeof(regDer), regP12), 0);
 459        ExpectIntLT(wc_PKCS12_parse(regP12, regPassword, &regPkey, &regPkeySz,
 460            &regCert, &regCertSz, NULL), 0);
 461
 462        XFREE(regPkey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
 463        XFREE(regCert, NULL, DYNAMIC_TYPE_PKCS);
 464        wc_PKCS12_free(regP12);
 465    }
 466#endif
 467    return EXPECT_RESULT();
 468}
 469
 470/* Test that a crafted PKCS12 with a MAC OCTET STRING shorter than the
 471 * algorithm's native digest size is rejected, rather than allowing the
 472 * integrity check to be truncated to a brute-forceable length. */
 473int test_wc_PKCS12_truncated_mac_bypass(void)
 474{
 475    EXPECT_DECLS;
 476#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) \
 477    && !defined(NO_HMAC) && !defined(NO_SHA256)
 478    static const byte authSafe[] = { 0x30, 0x00 }; /* empty SEQUENCE OF CI */
 479    static const char password[] = "wolfSSL test";
 480    static const byte salt[8] = {
 481        0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08
 482    };
 483    const int iter = 1;
 484    const word32 pwLen = (word32)(sizeof(password) - 1);
 485
 486    byte unicodePw[2 * sizeof(password) + 2];
 487    int  unicodePwLen = 0;
 488    byte macKey[WC_SHA256_DIGEST_SIZE];
 489    byte fullMac[WC_SHA256_DIGEST_SIZE] = {0};
 490    Hmac hmac;
 491    int  hmacInited = 0;
 492    word32 i;
 493
 494    WC_PKCS12* pkcs12 = NULL;
 495    byte pfx[64];
 496    word32 pfxLen = 0;
 497
 498    /* BMPString-style password (UTF-16BE) with trailing 0x00 0x00, matching
 499     * the unicode conversion done internally by wc_PKCS12_create_mac. */
 500    for (i = 0; i < pwLen; i++) {
 501        unicodePw[unicodePwLen++] = 0x00;
 502        unicodePw[unicodePwLen++] = (byte)password[i];
 503    }
 504    unicodePw[unicodePwLen++] = 0x00;
 505    unicodePw[unicodePwLen++] = 0x00;
 506
 507    /* Derive the MAC key the same way wc_PKCS12_create_mac does:
 508     * PKCS12-PBKDF SHA-256, id=3 (MAC key), kLen=32. */
 509    ExpectIntEQ(wc_PKCS12_PBKDF_ex(macKey, unicodePw, unicodePwLen,
 510                                   salt, (int)sizeof(salt),
 511                                   iter, WC_SHA256_DIGEST_SIZE,
 512                                   WC_SHA256, 3 /* id = MAC */, NULL),
 513                                   0);
 514
 515    /* Compute the genuine HMAC-SHA256 over the authSafe content. */
 516    ExpectIntEQ(wc_HmacInit(&hmac, NULL, INVALID_DEVID), 0);
 517    if (EXPECT_SUCCESS())
 518        hmacInited = 1;
 519    ExpectIntEQ(wc_HmacSetKey(&hmac, WC_SHA256, macKey, sizeof(macKey)), 0);
 520    ExpectIntEQ(wc_HmacUpdate(&hmac, authSafe, (word32)sizeof(authSafe)), 0);
 521    ExpectIntEQ(wc_HmacFinal(&hmac, fullMac), 0);
 522    if (hmacInited)
 523        wc_HmacFree(&hmac);
 524
 525    /*
 526     * Build a 59-byte PFX with a 1-byte truncated digest equal to fullMac[0]:
 527     *
 528     *   30 39                                  PFX SEQUENCE (57)
 529     *      02 01 03                            version = 3
 530     *      30 11                               AuthSafe ContentInfo (17)
 531     *         06 09 2A 86 48 86 F7 0D 01 07 01 OID 1.2.840.113549.1.7.1 (data)
 532     *         A0 04                            [0] EXPLICIT (4)
 533     *            04 02                            OCTET STRING (2)
 534     *               30 00                           authSafe = empty SEQUENCE
 535     *      30 21                               MacData (33)
 536     *         30 12                               DigestInfo (18)
 537     *            30 0d                               AlgorithmIdentifier (13)
 538     *               06 09 60 86 48 01 65 03 04 02 01 OID SHA-256
 539     *               05 00                            NULL
 540     *            04 01 XX                            OCTET STRING (1)
 541     *         04 08 01 02 03 04 05 06 07 08      salt
 542     *         02 01 01                           iterations = 1
 543     */
 544    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x39;
 545    pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x03;
 546    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x11;
 547    pfx[pfxLen++] = 0x06; pfx[pfxLen++] = 0x09;
 548    pfx[pfxLen++] = 0x2A; pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0x48;
 549    pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0xF7; pfx[pfxLen++] = 0x0D;
 550    pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x07; pfx[pfxLen++] = 0x01;
 551    pfx[pfxLen++] = 0xA0; pfx[pfxLen++] = 0x04;
 552    pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x02;
 553    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x00;
 554    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x21;
 555    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x12;
 556    pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x0D;
 557    pfx[pfxLen++] = 0x06; pfx[pfxLen++] = 0x09;
 558    pfx[pfxLen++] = 0x60; pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0x48;
 559    pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x65; pfx[pfxLen++] = 0x03;
 560    pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01;
 561    pfx[pfxLen++] = 0x05; pfx[pfxLen++] = 0x00;
 562    pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x01;
 563    pfx[pfxLen++] = fullMac[0];
 564    pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x08;
 565    pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x03;
 566    pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x05; pfx[pfxLen++] = 0x06;
 567    pfx[pfxLen++] = 0x07; pfx[pfxLen++] = 0x08;
 568    pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x01;
 569
 570    {
 571        byte* parsedPkey = NULL;
 572        word32 parsedPkeySz = 0;
 573        byte* parsedCert = NULL;
 574        word32 parsedCertSz = 0;
 575        int d2iRet;
 576
 577        ExpectNotNull(pkcs12 = wc_PKCS12_new());
 578
 579        /* Accept rejection at either parse time (wc_d2i_PKCS12) or
 580         * verify time (wc_PKCS12_parse); the test fails only if both
 581         * succeed. */
 582        d2iRet = wc_d2i_PKCS12(pfx, pfxLen, pkcs12);
 583        if (d2iRet == 0) {
 584            ExpectIntNE(wc_PKCS12_parse(pkcs12, password,
 585                            &parsedPkey, &parsedPkeySz,
 586                            &parsedCert, &parsedCertSz, NULL),
 587                        0);
 588        }
 589        else {
 590            ExpectIntNE(d2iRet, 0);
 591        }
 592
 593        XFREE(parsedPkey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
 594        XFREE(parsedCert, NULL, DYNAMIC_TYPE_PKCS);
 595        wc_PKCS12_free(pkcs12);
 596    }
 597#endif
 598    return EXPECT_RESULT();
 599}
 600
 601int test_wc_PKCS12_PBKDF(void)
 602{
 603    EXPECT_DECLS;
 604#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && !defined(NO_SHA256)
 605    /* Test vectors from RFC 7292 Appendix B (SHA-256 based) */
 606    static const byte passwd[] = {
 607        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 608        0x00, 0x00
 609    };
 610    static const byte salt[] = {
 611        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 612    };
 613    static const byte passwd2[] = {
 614        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 615        0x00, 0x67, 0x00, 0x00
 616    };
 617    static const byte salt2[] = {
 618        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 619    };
 620    static const byte verify[] = {
 621        0x27, 0xE9, 0x0D, 0x7E, 0xD5, 0xA1, 0xC4, 0x11,
 622        0xBA, 0x87, 0x8B, 0xC0, 0x90, 0xF5, 0xCE, 0xBE,
 623        0x5E, 0x9D, 0x5F, 0xE3, 0xD6, 0x2B, 0x73, 0xAA
 624    };
 625    static const byte verify2[] = {
 626        0x90, 0x1B, 0x49, 0x70, 0xF0, 0x94, 0xF0, 0xF8,
 627        0x45, 0xC0, 0xF3, 0xF3, 0x13, 0x59, 0x18, 0x6A,
 628        0x35, 0xE3, 0x67, 0xFE, 0xD3, 0x21, 0xFD, 0x7C
 629    };
 630    byte derived[24];
 631
 632    /* bad args */
 633    ExpectIntNE(wc_PKCS12_PBKDF(NULL, passwd, (int)sizeof(passwd),
 634                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1), 0);
 635    ExpectIntNE(wc_PKCS12_PBKDF(derived, passwd, 0,
 636                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1), 0);
 637    ExpectIntNE(wc_PKCS12_PBKDF(derived, passwd, (int)sizeof(passwd),
 638                    salt, 0, 1, 24, WC_SHA256, 1), 0);
 639
 640    /* 1 iteration */
 641    ExpectIntEQ(wc_PKCS12_PBKDF(derived, passwd, (int)sizeof(passwd),
 642                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1), 0);
 643    ExpectIntEQ(XMEMCMP(derived, verify, 24), 0);
 644
 645    /* 1000 iterations */
 646    ExpectIntEQ(wc_PKCS12_PBKDF(derived, passwd2, (int)sizeof(passwd2),
 647                    salt2, (int)sizeof(salt2), 1000, 24, WC_SHA256, 1), 0);
 648    ExpectIntEQ(XMEMCMP(derived, verify2, 24), 0);
 649
 650    /* iterations <= 0 treated as 1 */
 651    ExpectIntEQ(wc_PKCS12_PBKDF(derived, passwd, (int)sizeof(passwd),
 652                    salt, (int)sizeof(salt), 0, 24, WC_SHA256, 1), 0);
 653    ExpectIntEQ(XMEMCMP(derived, verify, 24), 0);
 654#endif
 655    return EXPECT_RESULT();
 656}
 657
 658int test_wc_PKCS12_PBKDF_ex(void)
 659{
 660    EXPECT_DECLS;
 661#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && !defined(NO_SHA256)
 662    static const byte passwd[] = {
 663        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 664        0x00, 0x00
 665    };
 666    static const byte salt[] = {
 667        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 668    };
 669    static const byte passwd2[] = {
 670        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 671        0x00, 0x67, 0x00, 0x00
 672    };
 673    static const byte salt2[] = {
 674        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 675    };
 676    static const byte verify[] = {
 677        0x27, 0xE9, 0x0D, 0x7E, 0xD5, 0xA1, 0xC4, 0x11,
 678        0xBA, 0x87, 0x8B, 0xC0, 0x90, 0xF5, 0xCE, 0xBE,
 679        0x5E, 0x9D, 0x5F, 0xE3, 0xD6, 0x2B, 0x73, 0xAA
 680    };
 681    static const byte verify2[] = {
 682        0x90, 0x1B, 0x49, 0x70, 0xF0, 0x94, 0xF0, 0xF8,
 683        0x45, 0xC0, 0xF3, 0xF3, 0x13, 0x59, 0x18, 0x6A,
 684        0x35, 0xE3, 0x67, 0xFE, 0xD3, 0x21, 0xFD, 0x7C
 685    };
 686    byte derived[24];
 687    byte derived2[24];
 688
 689    /* bad args */
 690    ExpectIntNE(wc_PKCS12_PBKDF_ex(NULL, passwd, (int)sizeof(passwd),
 691                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1, NULL), 0);
 692    ExpectIntNE(wc_PKCS12_PBKDF_ex(derived, passwd, 0,
 693                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1, NULL), 0);
 694    ExpectIntNE(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 695                    salt, 0, 1, 24, WC_SHA256, 1, NULL), 0);
 696
 697    /* 1 iteration, NULL heap */
 698    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 699                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 1, NULL), 0);
 700    ExpectIntEQ(XMEMCMP(derived, verify, 24), 0);
 701
 702    /* 1000 iterations, NULL heap */
 703    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 704                   salt2, (int)sizeof(salt2), 1000, 24, WC_SHA256, 1, NULL), 0);
 705    ExpectIntEQ(XMEMCMP(derived, verify2, 24), 0);
 706
 707    /* _ex and non-_ex produce identical output */
 708    ExpectIntEQ(wc_PKCS12_PBKDF(derived2, passwd2, (int)sizeof(passwd2),
 709                    salt2, (int)sizeof(salt2), 1000, 24, WC_SHA256, 1), 0);
 710    ExpectIntEQ(XMEMCMP(derived, derived2, 24), 0);
 711
 712    /* id 2 (IV) and id 3 (MAC) also accepted */
 713    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 714                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 2, NULL), 0);
 715    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 716                    salt, (int)sizeof(salt), 1, 24, WC_SHA256, 3, NULL), 0);
 717#endif
 718    return EXPECT_RESULT();
 719}
 720
 721int test_wc_PKCS12_PBKDF_ex_sha1(void)
 722{
 723    EXPECT_DECLS;
 724#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && !defined(NO_SHA)
 725    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-1 */
 726    static const byte passwd[] = {
 727        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 728        0x00, 0x00
 729    };
 730    static const byte salt[] = {
 731        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 732    };
 733    static const byte passwd2[] = {
 734        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 735        0x00, 0x67, 0x00, 0x00
 736    };
 737    static const byte salt2[] = {
 738        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 739    };
 740    static const byte verify[] = {
 741        0x8A, 0xAA, 0xE6, 0x29, 0x7B, 0x6C, 0xB0, 0x46,
 742        0x42, 0xAB, 0x5B, 0x07, 0x78, 0x51, 0x28, 0x4E,
 743        0xB7, 0x12, 0x8F, 0x1A, 0x2A, 0x7F, 0xBC, 0xA3
 744    };
 745    static const byte verify2[] = {
 746        0x48, 0x3D, 0xD6, 0xE9, 0x19, 0xD7, 0xDE, 0x2E,
 747        0x8E, 0x64, 0x8B, 0xA8, 0xF8, 0x62, 0xF3, 0xFB,
 748        0xFB, 0xDC, 0x2B, 0xCB, 0x2C, 0x02, 0x95, 0x7F
 749    };
 750    byte derived[24];
 751
 752    /* 1 iteration, NULL heap */
 753    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 754                    salt, (int)sizeof(salt), 1, 24, WC_SHA, 1, NULL), 0);
 755    ExpectIntEQ(XMEMCMP(derived, verify, 24), 0);
 756
 757    /* 1000 iterations, NULL heap */
 758    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 759                    salt2, (int)sizeof(salt2), 1000, 24, WC_SHA, 1, NULL), 0);
 760    ExpectIntEQ(XMEMCMP(derived, verify2, 24), 0);
 761#endif
 762    return EXPECT_RESULT();
 763}
 764
 765int test_wc_PKCS12_PBKDF_ex_sha512(void)
 766{
 767    EXPECT_DECLS;
 768#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && defined(WOLFSSL_SHA512)
 769    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-512 */
 770    static const byte passwd[] = {
 771        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 772        0x00, 0x00
 773    };
 774    static const byte salt[] = {
 775        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 776    };
 777    static const byte passwd2[] = {
 778        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 779        0x00, 0x67, 0x00, 0x00
 780    };
 781    static const byte salt2[] = {
 782        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 783    };
 784    static const byte verify[] = {
 785        0x13, 0x04, 0xA9, 0xF0, 0x01, 0x53, 0x74, 0x25,
 786        0x24, 0x12, 0x7D, 0x51, 0xD5, 0x98, 0xBC, 0x04,
 787        0x7E, 0x64, 0x09, 0x03, 0x09, 0xCA, 0x84, 0xEB,
 788        0x31, 0x2E, 0xB3, 0xBA, 0xD5, 0x60, 0xDD, 0x8D,
 789        0x2C, 0x71, 0xAB, 0xA4, 0xF2, 0x15, 0xAB, 0x31,
 790        0xF3, 0xBC, 0x42, 0xB6, 0xE8, 0x5D, 0xBF, 0x89
 791    };
 792    static const byte verify2[] = {
 793        0xBC, 0xD9, 0x78, 0x3D, 0x77, 0x8D, 0xA0, 0xE4,
 794        0x69, 0x00, 0x0B, 0x28, 0xE0, 0xD5, 0xDF, 0xDA,
 795        0xF3, 0xC9, 0x8D, 0x77, 0x39, 0xF9, 0x76, 0x84,
 796        0x1D, 0xE9, 0x61, 0x79, 0x50, 0x16, 0x6B, 0xA5,
 797        0x1B, 0x1D, 0x07, 0x65, 0x1B, 0x4B, 0x98, 0x91,
 798        0xAF, 0xE1, 0x80, 0x15, 0x39, 0xA3, 0x42, 0xDD
 799    };
 800    byte derived[48];
 801
 802    /* 1 iteration, NULL heap */
 803    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 804                    salt, (int)sizeof(salt), 1, 48, WC_SHA512, 1, NULL), 0);
 805    ExpectIntEQ(XMEMCMP(derived, verify, 48), 0);
 806
 807    /* 1000 iterations, NULL heap */
 808    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 809                    salt2, (int)sizeof(salt2), 1000, 48, WC_SHA512, 1, NULL), 0);
 810    ExpectIntEQ(XMEMCMP(derived, verify2, 48), 0);
 811#endif
 812    return EXPECT_RESULT();
 813}
 814
 815int test_wc_PKCS12_PBKDF_ex_sha224(void)
 816{
 817    EXPECT_DECLS;
 818#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && defined(WOLFSSL_SHA224)
 819    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-224 */
 820    static const byte passwd[] = {
 821        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 822        0x00, 0x00
 823    };
 824    static const byte salt[] = {
 825        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 826    };
 827    static const byte passwd2[] = {
 828        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 829        0x00, 0x67, 0x00, 0x00
 830    };
 831    static const byte salt2[] = {
 832        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 833    };
 834    static const byte verify[] = {
 835        0x96, 0x22, 0xB0, 0x87, 0xFF, 0xE5, 0xDC, 0xB2,
 836        0xA6, 0xE1, 0x67, 0x3A, 0x44, 0x11, 0x50, 0x00,
 837        0x67, 0xE7, 0x10, 0xB4, 0xE6, 0x63, 0x4D, 0xCF,
 838        0x37, 0x0C, 0x25, 0x3C
 839    };
 840    static const byte verify2[] = {
 841        0x9A, 0x30, 0xD2, 0xD2, 0x14, 0x47, 0x64, 0x3D,
 842        0x9B, 0xFA, 0x43, 0x49, 0x0F, 0x81, 0x3D, 0x9D,
 843        0x5E, 0x0E, 0xB9, 0x0D, 0xAF, 0xA6, 0x80, 0x2C,
 844        0xF9, 0x33, 0x3B, 0x9D
 845    };
 846    byte derived[28];
 847
 848    /* 1 iteration, NULL heap */
 849    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 850                    salt, (int)sizeof(salt), 1, 28, WC_SHA224, 1, NULL), 0);
 851    ExpectIntEQ(XMEMCMP(derived, verify, 28), 0);
 852
 853    /* 1000 iterations, NULL heap */
 854    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 855                    salt2, (int)sizeof(salt2), 1000, 28, WC_SHA224, 1, NULL), 0);
 856    ExpectIntEQ(XMEMCMP(derived, verify2, 28), 0);
 857#endif
 858    return EXPECT_RESULT();
 859}
 860
 861int test_wc_PKCS12_PBKDF_ex_sha384(void)
 862{
 863    EXPECT_DECLS;
 864#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && defined(WOLFSSL_SHA384)
 865    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-384 */
 866    static const byte passwd[] = {
 867        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 868        0x00, 0x00
 869    };
 870    static const byte salt[] = {
 871        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 872    };
 873    static const byte passwd2[] = {
 874        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 875        0x00, 0x67, 0x00, 0x00
 876    };
 877    static const byte salt2[] = {
 878        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 879    };
 880    static const byte verify[] = {
 881        0x17, 0xD5, 0x0F, 0x1F, 0x21, 0x8A, 0x3B, 0xC9,
 882        0x6E, 0x10, 0x41, 0xBA, 0xEC, 0xF0, 0xA1, 0xF2,
 883        0x11, 0x99, 0x56, 0x55, 0x2B, 0xD0, 0x38, 0x80,
 884        0x9A, 0x40, 0x2F, 0x13, 0x0A, 0x24, 0x67, 0xFA,
 885        0x49, 0xED, 0xFA, 0x6A, 0x83, 0xB5, 0x40, 0x69,
 886        0xFB, 0x73, 0xB7, 0x48, 0x44, 0x33, 0x1A, 0xC3
 887    };
 888    static const byte verify2[] = {
 889        0x7F, 0x50, 0xFB, 0x97, 0xF1, 0x7C, 0x01, 0x15,
 890        0xA2, 0x0A, 0xCB, 0x88, 0x68, 0xFC, 0x37, 0xA7,
 891        0x88, 0x8C, 0xD7, 0x1A, 0xF3, 0x1D, 0xB2, 0xDD,
 892        0x93, 0xCF, 0x44, 0xED, 0xC9, 0xA4, 0x61, 0x04,
 893        0xBE, 0x4E, 0x16, 0x86, 0x36, 0xF1, 0x6E, 0x65,
 894        0x41, 0xE0, 0xD7, 0xC3, 0xE2, 0x4D, 0x95, 0x99
 895    };
 896    byte derived[48];
 897
 898    /* 1 iteration, NULL heap */
 899    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 900                    salt, (int)sizeof(salt), 1, 48, WC_SHA384, 1, NULL), 0);
 901    ExpectIntEQ(XMEMCMP(derived, verify, 48), 0);
 902
 903    /* 1000 iterations, NULL heap */
 904    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 905                    salt2, (int)sizeof(salt2), 1000, 48, WC_SHA384, 1, NULL), 0);
 906    ExpectIntEQ(XMEMCMP(derived, verify2, 48), 0);
 907#endif
 908    return EXPECT_RESULT();
 909}
 910
 911int test_wc_PKCS12_PBKDF_ex_sha512_224(void)
 912{
 913    EXPECT_DECLS;
 914#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && \
 915    defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_224)
 916    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-512/224 */
 917    static const byte passwd[] = {
 918        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 919        0x00, 0x00
 920    };
 921    static const byte salt[] = {
 922        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 923    };
 924    static const byte passwd2[] = {
 925        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 926        0x00, 0x67, 0x00, 0x00
 927    };
 928    static const byte salt2[] = {
 929        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 930    };
 931    static const byte verify[] = {
 932        0xE1, 0xAD, 0xB3, 0x9E, 0x3E, 0x72, 0x85, 0x11,
 933        0x28, 0xFC, 0xF8, 0x5F, 0x4A, 0xBE, 0x74, 0x99,
 934        0x7B, 0x02, 0xF0, 0x8B, 0x47, 0x1B, 0x71, 0x40,
 935        0xB9, 0x7C, 0x03, 0x83
 936    };
 937    static const byte verify2[] = {
 938        0xF0, 0x3F, 0x58, 0x16, 0x8B, 0x0C, 0xF5, 0x09,
 939        0xC5, 0x7F, 0x20, 0xD2, 0x24, 0xEC, 0x27, 0xAE,
 940        0xC2, 0xA6, 0xBB, 0x21, 0xE5, 0x76, 0x5A, 0xF8,
 941        0x3C, 0xA6, 0x2A, 0xA6
 942    };
 943    byte derived[28];
 944
 945    /* 1 iteration, NULL heap */
 946    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 947                    salt, (int)sizeof(salt), 1, 28, WC_SHA512_224, 1, NULL), 0);
 948    ExpectIntEQ(XMEMCMP(derived, verify, 28), 0);
 949
 950    /* 1000 iterations, NULL heap */
 951    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 952                    salt2, (int)sizeof(salt2), 1000, 28, WC_SHA512_224, 1, NULL), 0);
 953    ExpectIntEQ(XMEMCMP(derived, verify2, 28), 0);
 954#endif
 955    return EXPECT_RESULT();
 956}
 957
 958int test_wc_PKCS12_PBKDF_ex_sha512_256(void)
 959{
 960    EXPECT_DECLS;
 961#if defined(HAVE_PKCS12) && !defined(NO_PWDBASED) && \
 962    defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_256)
 963    /* Test vectors generated with OpenSSL PKCS12_key_gen_uni / SHA-512/256 */
 964    static const byte passwd[] = {
 965        0x00, 0x73, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x67,
 966        0x00, 0x00
 967    };
 968    static const byte salt[] = {
 969        0x0a, 0x58, 0xCF, 0x64, 0x53, 0x0d, 0x82, 0x3f
 970    };
 971    static const byte passwd2[] = {
 972        0x00, 0x71, 0x00, 0x75, 0x00, 0x65, 0x00, 0x65,
 973        0x00, 0x67, 0x00, 0x00
 974    };
 975    static const byte salt2[] = {
 976        0x16, 0x82, 0xC0, 0xfC, 0x5b, 0x3f, 0x7e, 0xc5
 977    };
 978    static const byte verify[] = {
 979        0x08, 0x41, 0xAA, 0x5C, 0xBC, 0xEE, 0xA4, 0x3F,
 980        0x34, 0xA4, 0xDA, 0xB1, 0xEB, 0x83, 0x7E, 0xF1,
 981        0x84, 0xBC, 0x30, 0x75, 0x40, 0x94, 0x95, 0x1F,
 982        0xAE, 0x25, 0xAA, 0xD1, 0xFD, 0x80, 0x2B, 0x5B
 983    };
 984    static const byte verify2[] = {
 985        0xC9, 0x44, 0xE9, 0x01, 0x53, 0x03, 0x64, 0xB9,
 986        0x61, 0x6E, 0x7F, 0xAE, 0xAA, 0x8E, 0x2D, 0xBB,
 987        0xE1, 0xAC, 0x45, 0x34, 0x58, 0x08, 0xB9, 0xE6,
 988        0xFA, 0x61, 0xF6, 0x1D, 0x15, 0x84, 0x15, 0x75
 989    };
 990    byte derived[32];
 991
 992    /* 1 iteration, NULL heap */
 993    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd, (int)sizeof(passwd),
 994                    salt, (int)sizeof(salt), 1, 32, WC_SHA512_256, 1, NULL), 0);
 995    ExpectIntEQ(XMEMCMP(derived, verify, 32), 0);
 996
 997    /* 1000 iterations, NULL heap */
 998    ExpectIntEQ(wc_PKCS12_PBKDF_ex(derived, passwd2, (int)sizeof(passwd2),
 999                    salt2, (int)sizeof(salt2), 1000, 32, WC_SHA512_256, 1, NULL), 0);
1000    ExpectIntEQ(XMEMCMP(derived, verify2, 32), 0);
1001#endif
1002    return EXPECT_RESULT();
1003}