/* test_chacha.c * * Copyright (C) 2006-2026 wolfSSL Inc. * * This file is part of wolfSSL. * * wolfSSL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * wolfSSL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA */ #include #ifdef NO_INLINE #include #else #define WOLFSSL_MISC_INCLUDED #include #endif #include #include #include #include /* * Testing wc_Chacha_SetKey() and wc_Chacha_SetIV() */ int test_wc_Chacha_SetKey(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha ctx; const byte key[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01 }; word32 keySz = (word32)(sizeof(key)/sizeof(byte)); byte cipher[128]; XMEMSET(cipher, 0, sizeof(cipher)); ExpectIntEQ(wc_Chacha_SetKey(&ctx, key, keySz), 0); /* Test bad args. */ ExpectIntEQ(wc_Chacha_SetKey(NULL, key, keySz), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); ExpectIntEQ(wc_Chacha_SetKey(&ctx, key, 18), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); ExpectIntEQ(wc_Chacha_SetIV(&ctx, cipher, 0), 0); /* Test bad args. */ ExpectIntEQ(wc_Chacha_SetIV(NULL, cipher, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); #endif return EXPECT_RESULT(); } /* END test_wc_Chacha_SetKey */ /* * Testing wc_Chacha_Process() */ int test_wc_Chacha_Process(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc, dec; byte cipher[128]; byte plain[128]; const byte key[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01 }; const char* input = "Everybody gets Friday off."; word32 keySz = sizeof(key)/sizeof(byte); unsigned long int inlen = XSTRLEN(input); /* Initialize stack variables. */ XMEMSET(cipher, 0, 128); XMEMSET(plain, 0, 128); ExpectIntEQ(wc_Chacha_SetKey(&enc, key, keySz), 0); ExpectIntEQ(wc_Chacha_SetKey(&dec, key, keySz), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, cipher, 0), 0); ExpectIntEQ(wc_Chacha_SetIV(&dec, cipher, 0), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, (byte*)input, (word32)inlen), 0); ExpectIntEQ(wc_Chacha_Process(&dec, plain, cipher, (word32)inlen), 0); ExpectIntEQ(XMEMCMP(input, plain, inlen), 0); #if !defined(USE_INTEL_CHACHA_SPEEDUP) && !defined(WOLFSSL_ARMASM) /* test checking and using leftovers, currently just in C code */ ExpectIntEQ(wc_Chacha_SetIV(&enc, cipher, 0), 0); ExpectIntEQ(wc_Chacha_SetIV(&dec, cipher, 0), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, (byte*)input, (word32)inlen - 2), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher + (inlen - 2), (byte*)input + (inlen - 2), 2), 0); ExpectIntEQ(wc_Chacha_Process(&dec, plain, (byte*)cipher, (word32)inlen - 2), 0); ExpectIntEQ(wc_Chacha_Process(&dec, cipher + (inlen - 2), (byte*)input + (inlen - 2), 2), 0); ExpectIntEQ(XMEMCMP(input, plain, inlen), 0); /* check edge cases with counter increment */ { /* expected results collected from wolfSSL 4.3.0 encrypted in one call*/ const byte expected[] = { 0x54,0xB1,0xE2,0xD4,0xA2,0x4D,0x52,0x5F, 0x42,0x04,0x89,0x7C,0x6E,0x2D,0xFC,0x2D, 0x10,0x25,0xB6,0x92,0x71,0xD5,0xC3,0x20, 0xE3,0x0E,0xEC,0xF4,0xD8,0x10,0x70,0x29, 0x2D,0x4C,0x2A,0x56,0x21,0xE1,0xC7,0x37, 0x0B,0x86,0xF5,0x02,0x8C,0xB8,0xB8,0x38, 0x41,0xFD,0xDF,0xD9,0xC3,0xE6,0xC8,0x88, 0x06,0x82,0xD4,0x80,0x6A,0x50,0x69,0xD5, 0xB9,0xB0,0x2F,0x44,0x36,0x5D,0xDA,0x5E, 0xDE,0xF6,0xF5,0xFC,0x44,0xDC,0x07,0x51, 0xA7,0x32,0x42,0xDB,0xCC,0xBD,0xE2,0xE5, 0x0B,0xB1,0x14,0xFF,0x12,0x80,0x16,0x43, 0xE7,0x40,0xD5,0xEA,0xC7,0x3F,0x69,0x07, 0x64,0xD4,0x86,0x6C,0xE2,0x1F,0x8F,0x6E, 0x35,0x41,0xE7,0xD3,0xB5,0x5D,0xD6,0xD4, 0x9F,0x00,0xA9,0xAE,0x3D,0x28,0xA5,0x37, 0x80,0x3D,0x11,0x25,0xE2,0xB6,0x99,0xD9, 0x9B,0x98,0xE9,0x37,0xB9,0xF8,0xA0,0x04, 0xDF,0x13,0x49,0x3F,0x19,0x6A,0x45,0x06, 0x21,0xB4,0xC7,0x3B,0x49,0x45,0xB4,0xC8, 0x03,0x5B,0x43,0x89,0xBD,0xB3,0x96,0x4B, 0x17,0x6F,0x85,0xC6,0xCF,0xA6,0x05,0x35, 0x1E,0x25,0x03,0xBB,0x55,0x0A,0xD5,0x54, 0x41,0xEA,0xEB,0x50,0x40,0x1B,0x43,0x19, 0x59,0x1B,0x0E,0x12,0x3E,0xA2,0x71,0xC3, 0x1A,0xA7,0x11,0x50,0x43,0x9D,0x56,0x3B, 0x63,0x2F,0x63,0xF1,0x8D,0xAE,0xF3,0x23, 0xFA,0x1E,0xD8,0x6A,0xE1,0xB2,0x4B,0xF3, 0xB9,0x13,0x7A,0x72,0x2B,0x6D,0xCC,0x41, 0x1C,0x69,0x7C,0xCD,0x43,0x6F,0xE4,0xE2, 0x38,0x99,0xFB,0xC3,0x38,0x92,0x62,0x35, 0xC0,0x1D,0x60,0xE4,0x4B,0xDD,0x0C,0x14 }; const byte iv2[] = { 0x9D,0xED,0xE7,0x0F,0xEC,0x81,0x51,0xD9, 0x77,0x39,0x71,0xA6,0x21,0xDF,0xB8,0x93 }; byte input2[256]; int i; for (i = 0; i < 256; i++) input2[i] = (byte)i; ExpectIntEQ(wc_Chacha_SetIV(&enc, iv2, 0), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2, 64), 0); ExpectIntEQ(XMEMCMP(expected, cipher, 64), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 64, 128), 0); ExpectIntEQ(XMEMCMP(expected + 64, cipher, 128), 0); /* partial */ ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 192, 32), 0); ExpectIntEQ(XMEMCMP(expected + 192, cipher, 32), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, input2 + 224, 32), 0); ExpectIntEQ(XMEMCMP(expected + 224, cipher, 32), 0); } #endif /* Test bad args. */ ExpectIntEQ(wc_Chacha_Process(NULL, cipher, (byte*)input, (word32)inlen), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); #endif return EXPECT_RESULT(); } /* END test_wc_Chacha_Process */ #define CHACHA_LEN 1024 /* * Testing wc_Chacha_Process() */ int test_wc_Chacha_Process_Chunking(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc; WC_DECLARE_VAR(plain, byte, CHACHA_LEN, NULL); WC_DECLARE_VAR(cipher, byte, CHACHA_LEN, NULL); byte key[CHACHA_MAX_KEY_SZ]; byte iv[CHACHA_IV_BYTES]; int i; int cnt; int sz; const byte expected[CHACHA_LEN] = { 0xbc, 0xf5, 0x3b, 0xf2, 0x75, 0x85, 0x9e, 0x0a, 0x09, 0x58, 0x83, 0x50, 0x33, 0x12, 0x01, 0xa1, 0xb4, 0xaf, 0x8a, 0xe8, 0x4d, 0x3d, 0xa5, 0x68, 0xf7, 0x6d, 0x3e, 0xe0, 0x62, 0x7e, 0x62, 0x66, 0xdd, 0x07, 0xe9, 0x36, 0x6f, 0x4d, 0xe9, 0x7a, 0x16, 0x48, 0xa1, 0x83, 0x9e, 0x67, 0x4d, 0xa3, 0xfe, 0x7e, 0x4a, 0x31, 0xdd, 0xb6, 0x50, 0x39, 0xd2, 0x2b, 0x93, 0xf2, 0x4d, 0x51, 0x44, 0x42, 0x5d, 0xf1, 0xd9, 0x24, 0xd7, 0xef, 0x4b, 0xa4, 0xfd, 0x6a, 0x53, 0xa5, 0x1e, 0x4a, 0xc8, 0x68, 0x11, 0x69, 0xc6, 0xbd, 0xe1, 0x59, 0xe4, 0xca, 0x5b, 0xa9, 0x77, 0xfe, 0x4f, 0x82, 0x9f, 0xcf, 0x55, 0x16, 0x3c, 0xd5, 0x83, 0xee, 0xc7, 0x53, 0xaf, 0xca, 0x8a, 0xe2, 0xcf, 0xf1, 0x4b, 0x3b, 0x44, 0xf6, 0xc9, 0x6c, 0x5b, 0xd3, 0x28, 0x8a, 0x7e, 0x67, 0xaa, 0x9e, 0xad, 0xce, 0x96, 0xc4, 0x6e, 0x95, 0x8c, 0xf8, 0xf6, 0xb6, 0x42, 0x8e, 0xe7, 0xab, 0xc8, 0x2c, 0x66, 0x8b, 0x80, 0xcf, 0x78, 0xfe, 0x35, 0x8b, 0x59, 0x18, 0x45, 0xcb, 0x18, 0xd4, 0x09, 0x88, 0xa9, 0xf9, 0x27, 0xd1, 0x3b, 0x9d, 0x2b, 0xff, 0x89, 0x21, 0xb0, 0xd2, 0xa7, 0x7e, 0x35, 0x61, 0xae, 0x1c, 0xc3, 0x1c, 0x07, 0x5c, 0x10, 0x5d, 0x71, 0x3a, 0x3a, 0xe8, 0x4c, 0xba, 0x00, 0xde, 0xd1, 0xf9, 0xa1, 0xae, 0x7b, 0x91, 0x9d, 0x66, 0x31, 0x18, 0x55, 0x39, 0xec, 0x1d, 0x83, 0x85, 0x1e, 0x5b, 0x35, 0x17, 0x2e, 0xbc, 0x7a, 0x22, 0x79, 0x09, 0xa7, 0x02, 0xf7, 0x3b, 0x93, 0x2c, 0x89, 0x1b, 0x69, 0xde, 0x80, 0xc8, 0xdf, 0xce, 0xf9, 0xcd, 0xc8, 0x58, 0xd6, 0x4b, 0x65, 0x9a, 0xc4, 0x4f, 0x27, 0xdb, 0x9a, 0x6c, 0x3a, 0xef, 0x20, 0x0b, 0x00, 0x5c, 0x9f, 0x91, 0xc1, 0xf6, 0x80, 0x53, 0x6c, 0x42, 0xe3, 0xd0, 0xfb, 0x3b, 0x23, 0x75, 0x45, 0xa7, 0x5b, 0x9b, 0xaa, 0xcd, 0x1e, 0x03, 0x35, 0x68, 0x17, 0xee, 0xff, 0xd7, 0x4f, 0x77, 0x2f, 0xd0, 0x1d, 0x5e, 0x89, 0x16, 0x50, 0x6f, 0x22, 0x44, 0x10, 0x64, 0x37, 0x66, 0x70, 0x7f, 0x4d, 0x58, 0x36, 0xec, 0x56, 0x4e, 0xfd, 0x22, 0x8d, 0x77, 0xb1, 0x37, 0x07, 0x13, 0xdf, 0x34, 0x40, 0x1c, 0x65, 0x95, 0x9b, 0xb9, 0xac, 0x11, 0xfe, 0x7a, 0xae, 0x1f, 0x17, 0x94, 0xd4, 0xdd, 0x5b, 0x4f, 0x69, 0xa8, 0x04, 0x8e, 0x80, 0x87, 0x7d, 0x96, 0x25, 0x37, 0x83, 0x0e, 0xca, 0xa4, 0xb3, 0x29, 0x2f, 0x4b, 0x83, 0xa4, 0x01, 0x36, 0x0d, 0xdb, 0xd7, 0x6e, 0x7a, 0x9c, 0x3e, 0x82, 0xc8, 0x5f, 0x4e, 0xc6, 0xd2, 0x97, 0x64, 0xe6, 0xd9, 0x50, 0x89, 0xcb, 0x64, 0x33, 0x28, 0x9c, 0x14, 0xf9, 0x41, 0x33, 0x99, 0x0c, 0x87, 0x6f, 0x00, 0x3f, 0x00, 0x6f, 0xae, 0xe9, 0x20, 0xc2, 0xcd, 0xb8, 0x7a, 0x58, 0xde, 0x57, 0x34, 0xda, 0x63, 0xa1, 0x0b, 0x55, 0xfc, 0x54, 0x2a, 0xed, 0xc0, 0xbc, 0x29, 0x5f, 0x88, 0x7d, 0x37, 0x3b, 0x48, 0x86, 0x3f, 0x88, 0xa2, 0xef, 0x55, 0xe6, 0xc4, 0xf8, 0xb8, 0x11, 0x9e, 0x3a, 0x45, 0x79, 0xac, 0x85, 0xb2, 0x70, 0x40, 0xd0, 0x66, 0xe7, 0x66, 0xc8, 0x8e, 0x8f, 0xde, 0xde, 0xf8, 0x50, 0x79, 0x9e, 0x37, 0x04, 0x07, 0x83, 0x5b, 0xe0, 0x68, 0x5b, 0x32, 0xbc, 0x6e, 0x50, 0x05, 0xca, 0xf8, 0x3b, 0xec, 0x15, 0x13, 0xf8, 0x9a, 0xa2, 0x58, 0x98, 0x03, 0x29, 0x83, 0x7f, 0x11, 0xb4, 0x98, 0x41, 0xc1, 0xd9, 0x02, 0x6e, 0x2c, 0x45, 0x55, 0xab, 0xff, 0xcf, 0x23, 0x80, 0xf0, 0x82, 0x73, 0xe9, 0xe6, 0x8f, 0x1a, 0xd9, 0x70, 0xd6, 0x46, 0x1f, 0xa8, 0xf8, 0xbd, 0x14, 0xd9, 0x50, 0x59, 0x8e, 0x46, 0xbf, 0xe2, 0x8a, 0x8e, 0xce, 0xe7, 0x81, 0xf4, 0x3a, 0xd9, 0x07, 0xd8, 0x1d, 0x29, 0x19, 0xc1, 0x9d, 0xac, 0x6f, 0xfb, 0xce, 0x95, 0x03, 0x29, 0xce, 0x4a, 0x60, 0x34, 0x6a, 0x88, 0xc7, 0x5e, 0x8c, 0x71, 0x29, 0x81, 0x64, 0x2f, 0xfb, 0xb4, 0x20, 0x08, 0x57, 0xba, 0x50, 0x75, 0x7b, 0x1e, 0xfa, 0xcc, 0x60, 0xe7, 0x09, 0xab, 0x4e, 0x46, 0x64, 0xfe, 0x17, 0x00, 0x84, 0x8b, 0xca, 0xa8, 0xcb, 0x18, 0x5b, 0xa2, 0x04, 0x13, 0x68, 0x99, 0x02, 0xaf, 0xcb, 0x75, 0xcb, 0x46, 0x61, 0x66, 0x05, 0xd9, 0x5c, 0x6d, 0x8c, 0xf9, 0x8a, 0x57, 0xde, 0xf4, 0xb9, 0x5d, 0x51, 0x17, 0x4a, 0x8c, 0x42, 0xca, 0x0d, 0x7f, 0x92, 0x69, 0x0d, 0x88, 0x2b, 0xc6, 0xee, 0xbd, 0x5a, 0x32, 0x17, 0x84, 0xef, 0xf9, 0xd9, 0x51, 0x33, 0x57, 0x2f, 0x87, 0xf8, 0xda, 0x3c, 0x3c, 0x14, 0xa9, 0x26, 0xad, 0x19, 0xfd, 0x14, 0x5e, 0x33, 0x92, 0xb1, 0xe1, 0xd7, 0xfb, 0x1e, 0x55, 0x40, 0xe5, 0x80, 0x9b, 0x8e, 0x4b, 0x88, 0x58, 0x77, 0xa9, 0xd2, 0xbf, 0x40, 0x90, 0xbe, 0x8f, 0x1f, 0xa7, 0x8a, 0xaf, 0x8e, 0x03, 0x93, 0x4d, 0x8a, 0x73, 0x8e, 0x76, 0x67, 0x43, 0x37, 0xc1, 0x76, 0x87, 0x50, 0x37, 0xc4, 0x02, 0x4a, 0x53, 0x1a, 0x5b, 0xe8, 0x5f, 0xc8, 0x28, 0xad, 0xd3, 0x8a, 0x97, 0x53, 0xa3, 0xf6, 0x48, 0xba, 0x05, 0x18, 0x56, 0x90, 0xa9, 0x95, 0xd8, 0xac, 0xe9, 0xd5, 0x6c, 0xe3, 0x1f, 0xd8, 0xfc, 0xc5, 0x27, 0x19, 0xab, 0x4a, 0xc4, 0x36, 0xc9, 0xe9, 0xaa, 0x30, 0xef, 0x8e, 0x9e, 0x01, 0x18, 0x68, 0xe9, 0x06, 0xf8, 0x54, 0xe5, 0xe2, 0xec, 0xde, 0x52, 0xfc, 0x3b, 0xdd, 0xe9, 0xc7, 0xc8, 0x2b, 0x93, 0xd4, 0xdb, 0x28, 0x72, 0x06, 0x07, 0xd1, 0xba, 0x05, 0x23, 0xa6, 0x41, 0x42, 0x55, 0x6a, 0x6e, 0x6f, 0x6c, 0x40, 0x6a, 0x19, 0xa4, 0xd5, 0xa2, 0x11, 0xb5, 0x2b, 0x16, 0x4a, 0xe3, 0x41, 0xf3, 0xaf, 0x93, 0xbd, 0xc8, 0xd9, 0x26, 0x43, 0x71, 0x56, 0xd2, 0x5e, 0xf5, 0xa8, 0x3c, 0x64, 0x83, 0x04, 0x89, 0x62, 0x20, 0xd3, 0xe9, 0x8e, 0x60, 0xcd, 0xec, 0xd9, 0xce, 0x89, 0xf0, 0x5c, 0xf2, 0x26, 0x72, 0x51, 0xd5, 0x16, 0x7b, 0xef, 0x19, 0x10, 0xb4, 0xce, 0x60, 0x47, 0xab, 0x98, 0x86, 0xbd, 0x39, 0xb7, 0xc9, 0x29, 0x38, 0x1a, 0xc1, 0x5c, 0xab, 0x77, 0xea, 0xe9, 0xf4, 0x7f, 0x6a, 0x06, 0xf7, 0xc0, 0x0b, 0x17, 0x1f, 0x2f, 0xce, 0x07, 0x1b, 0x33, 0x68, 0x4d, 0x64, 0x6a, 0x28, 0x6d, 0x1d, 0xc6, 0x54, 0x5c, 0xa2, 0x69, 0xf9, 0xb4, 0x62, 0xc9, 0x71, 0xf5, 0xd1, 0xb7, 0x7b, 0x02, 0x81, 0x6d, 0x4b, 0x1f, 0x62, 0xc5, 0xce, 0x2e, 0xc6, 0x2a, 0x1d, 0x6f, 0xc7, 0xc1, 0x99, 0x48, 0x7b, 0xc7, 0xf3, 0x53, 0xb7, 0x02, 0x7f, 0x82, 0xda, 0xfa, 0xce, 0xd3, 0x54, 0xf8, 0x9b, 0x30, 0x6f, 0xed, 0x6c, 0xec, 0x1c, 0x21, 0x49, 0x04, 0x51, 0xae, 0xd0, 0x3f, 0xb1, 0xfb, 0x78, 0x1a, 0x6f, 0x35, 0xc8, 0x3f, 0x4c, 0x43, 0x71, 0xe9, 0xb8, 0xd7, 0x74, 0xca, 0x46, 0x68, 0xeb, 0xd9, 0xa3, 0x94, 0x6e, 0x9d, 0xea, 0x57, 0x22, 0x1e, 0x15, 0x27, 0x40, 0xd4, 0x0c, 0x32, 0x40, 0xc0, 0x40, 0x8a, 0x1e, 0x2e, 0x1a, 0x58, 0x84, 0xa0, 0xc3, 0x68, 0x96, 0xfe, 0xb0, 0x96, 0x6c, 0x04, 0x61, 0x35, 0x4a, 0x78, 0xc5, 0xeb, 0x50, 0xca, 0xcb, 0x22, 0x7b, 0x53, 0x02, 0xfa, 0x63, 0x28, 0x10, 0x68, 0x77, 0xab, 0xda, 0x7d, 0xd1, 0xc2, 0x3f, 0x95, 0xa6, 0x5a, 0x92, 0x56, 0xb3, 0xb0, 0x29, 0x7e, 0x0c, 0xb3, 0xc9, 0x39, 0x0f, 0x1f, 0x51, 0x9d }; WC_ALLOC_VAR_EX(plain, byte, CHACHA_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER, ExpectNotNull(plain); goto cleanup); WC_ALLOC_VAR_EX(cipher, byte, CHACHA_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER, ExpectNotNull(cipher); goto cleanup); XMEMSET(plain, 0xa5, CHACHA_LEN); for (i = 0; i < (int)sizeof(key); i++) { key[i] = (byte)i; } for (i = 0; i < (int)sizeof(iv); i++) { iv[i] = (byte)(i + 0x40); } for (sz = 1; sz < CHACHA_LEN; sz++) { ExpectIntEQ(wc_Chacha_SetKey(&enc, key, (word32)sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, iv, 0), 0); for (cnt = 0; cnt + sz <= CHACHA_LEN; cnt += sz) { ExpectIntEQ(wc_Chacha_Process(&enc, cipher + cnt, plain + cnt, sz), 0); } if (cnt < CHACHA_LEN) { ExpectIntEQ(wc_Chacha_Process(&enc, cipher + cnt, plain + cnt, CHACHA_LEN - cnt), 0); } ExpectBufEQ(cipher, expected, (int)sizeof(expected)); } #ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC cleanup: #endif WC_FREE_VAR_EX(plain, NULL, DYNAMIC_TYPE_TMP_BUFFER); WC_FREE_VAR_EX(cipher, NULL, DYNAMIC_TYPE_TMP_BUFFER); #endif return EXPECT_RESULT(); } /* END test_wc_Chacha_Process */ #include #define MC_CIPHER_TEST_COUNT 100 #define MC_CHACHA_MAX_DATA_SZ 1024 /* Monte Carlo test for ChaCha20: random key, IV, and plaintext each * iteration */ int test_wc_Chacha_MonteCarlo(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc, dec; WC_RNG rng; byte key[CHACHA_MAX_KEY_SZ]; byte nonce[CHACHA_IV_BYTES]; word32 plainLen = 0; int i; WC_DECLARE_VAR(plain, byte, MC_CHACHA_MAX_DATA_SZ, NULL); WC_DECLARE_VAR(cipher, byte, MC_CHACHA_MAX_DATA_SZ, NULL); WC_DECLARE_VAR(decrypted, byte, MC_CHACHA_MAX_DATA_SZ, NULL); WC_ALLOC_VAR(plain, byte, MC_CHACHA_MAX_DATA_SZ, NULL); WC_ALLOC_VAR(cipher, byte, MC_CHACHA_MAX_DATA_SZ, NULL); WC_ALLOC_VAR(decrypted, byte, MC_CHACHA_MAX_DATA_SZ, NULL); #ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC ExpectNotNull(plain); ExpectNotNull(cipher); ExpectNotNull(decrypted); #endif XMEMSET(&enc, 0, sizeof(enc)); XMEMSET(&dec, 0, sizeof(dec)); XMEMSET(&rng, 0, sizeof(rng)); ExpectIntEQ(wc_InitRng(&rng), 0); for (i = 0; i < MC_CIPHER_TEST_COUNT && EXPECT_SUCCESS(); i++) { ExpectIntEQ(wc_RNG_GenerateBlock(&rng, key, sizeof(key)), 0); ExpectIntEQ(wc_RNG_GenerateBlock(&rng, nonce, sizeof(nonce)), 0); ExpectIntEQ(wc_RNG_GenerateBlock(&rng, (byte*)&plainLen, sizeof(plainLen)), 0); plainLen = (plainLen % MC_CHACHA_MAX_DATA_SZ) + 1; ExpectIntEQ(wc_RNG_GenerateBlock(&rng, plain, plainLen), 0); ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetKey(&dec, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0), 0); ExpectIntEQ(wc_Chacha_SetIV(&dec, nonce, 0), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher, plain, plainLen), 0); ExpectIntEQ(wc_Chacha_Process(&dec, decrypted, cipher, plainLen), 0); ExpectBufEQ(decrypted, plain, plainLen); } wc_FreeRng(&rng); WC_FREE_VAR(plain, NULL); WC_FREE_VAR(cipher, NULL); WC_FREE_VAR(decrypted, NULL); #endif return EXPECT_RESULT(); } /******************************************************************************* * ChaCha20 counter overflow ******************************************************************************/ /* * Verify that the ChaCha20 block counter (X[12], a 32-bit value) wraps * correctly from 0xFFFFFFFF back to 0x00000000. * * We set the counter to 0xFFFFFFFF and encrypt 65 bytes in a single call, * which requires two 64-byte key-stream blocks. We then re-encrypt the same * data as two separate calls - 64 bytes at counter=0xFFFFFFFF and 1 byte at * counter=0x00000000 - and confirm the outputs match. */ int test_wc_Chacha_CounterOverflow(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc; static const byte key[CHACHA_MAX_KEY_SZ] = { 0x00,0x01,0x02,0x03, 0x04,0x05,0x06,0x07, 0x08,0x09,0x0a,0x0b, 0x0c,0x0d,0x0e,0x0f, 0x10,0x11,0x12,0x13, 0x14,0x15,0x16,0x17, 0x18,0x19,0x1a,0x1b, 0x1c,0x1d,0x1e,0x1f }; static const byte nonce[CHACHA_IV_BYTES] = { 0x00,0x00,0x00,0x09, 0x00,0x00,0x00,0x4a, 0x00,0x00,0x00,0x00 }; /* 65 bytes of zeroed plaintext - easy to verify, no KAT needed. */ static const byte plain[65] = { 0 }; /* combined: single call spanning the 0xFFFFFFFF->0x00000000 boundary */ byte cipher_combined[65]; /* per-block: block at counter=0xFFFFFFFF (64 bytes) */ byte cipher_b0[64]; /* per-block: first byte of block at counter=0x00000000 (1 byte) */ byte cipher_b1[1]; XMEMSET(&enc, 0, sizeof(enc)); /* Encrypt 65 bytes in one shot, starting at counter 0xFFFFFFFF. */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0xFFFFFFFFUL), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher_combined, plain, 65), 0); /* First 64 bytes: key-stream block at counter 0xFFFFFFFF. */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0xFFFFFFFFUL), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher_b0, plain, 64), 0); /* Byte 65: first byte of key-stream block at counter 0x00000000. */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 0x00000000UL), 0); ExpectIntEQ(wc_Chacha_Process(&enc, cipher_b1, plain + 64, 1), 0); /* Combined output must match per-block results. */ ExpectBufEQ(cipher_combined, cipher_b0, 64); ExpectBufEQ(cipher_combined + 64, cipher_b1, 1); #endif return EXPECT_RESULT(); } /* * Verify that wc_Chacha_Process works correctly when the output buffer is the * same as the input buffer (in-place operation). ChaCha20 XORs the keystream * onto the input byte-by-byte, so in == out is always safe. */ int test_wc_Chacha_InPlace(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc; static const byte key[CHACHA_MAX_KEY_SZ] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x01 }; static const byte nonce[CHACHA_IV_BYTES] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x02 }; /* 67 bytes: spans one full block (64) plus a partial block tail */ static const byte plain[67] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00 }; byte ref_ct[sizeof(plain)]; byte buf[sizeof(plain)]; XMEMSET(&enc, 0, sizeof(enc)); /* Reference ciphertext with separate in/out buffers */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, ref_ct, plain, sizeof(plain)), 0); /* Encrypt in-place (out == in) - must produce the same ciphertext */ XMEMCPY(buf, plain, sizeof(buf)); ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, buf, buf, sizeof(buf)), 0); ExpectBufEQ(buf, ref_ct, sizeof(buf)); /* Decrypt in-place (ChaCha20 is symmetric - apply keystream again) */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, buf, buf, sizeof(buf)), 0); ExpectBufEQ(buf, plain, sizeof(buf)); #endif return EXPECT_RESULT(); } /* END test_wc_Chacha_InPlace */ /* * Verify that wc_Chacha_Process produces correct results when both the input * and output buffers are byte-offset (unaligned). Tests offsets 1, 2, and 3. * A 67-byte plaintext is used (same as InPlace) to exercise both full-block * and partial-block tail paths. */ int test_wc_Chacha_UnalignedBuffers(void) { EXPECT_DECLS; #ifdef HAVE_CHACHA ChaCha enc; static const byte key[CHACHA_MAX_KEY_SZ] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x01 }; static const byte nonce[CHACHA_IV_BYTES] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x02 }; static const byte plain[67] = { 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00 }; byte ref_ct[sizeof(plain)]; byte in_buf[sizeof(plain) + 3], out_buf[sizeof(plain) + 3]; int off; XMEMSET(&enc, 0, sizeof(enc)); /* Reference ciphertext with naturally-aligned buffers */ ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, ref_ct, plain, sizeof(plain)), 0); /* Encrypt with byte offsets 1, 2, 3 on both in and out */ for (off = 1; off <= 3 && EXPECT_SUCCESS(); off++) { XMEMCPY(in_buf + off, plain, sizeof(plain)); XMEMSET(out_buf, 0, sizeof(out_buf)); ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, out_buf + off, in_buf + off, sizeof(plain)), 0); ExpectBufEQ(out_buf + off, ref_ct, sizeof(plain)); } /* Decrypt (ChaCha20 is symmetric) */ for (off = 1; off <= 3 && EXPECT_SUCCESS(); off++) { XMEMCPY(in_buf + off, ref_ct, sizeof(plain)); XMEMSET(out_buf, 0, sizeof(out_buf)); ExpectIntEQ(wc_Chacha_SetKey(&enc, key, sizeof(key)), 0); ExpectIntEQ(wc_Chacha_SetIV(&enc, nonce, 1), 0); ExpectIntEQ(wc_Chacha_Process(&enc, out_buf + off, in_buf + off, sizeof(plain)), 0); ExpectBufEQ(out_buf + off, plain, sizeof(plain)); } #endif return EXPECT_RESULT(); } /* END test_wc_Chacha_UnalignedBuffers */