You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 

387 lines
12 KiB

  1. /**
  2. * @file test_decaf.cxx
  3. * @author Mike Hamburg
  4. *
  5. * @copyright
  6. * Copyright (c) 2015 Cryptography Research, Inc. \n
  7. * Released under the MIT License. See LICENSE.txt for license information.
  8. *
  9. * @brief C++ tests, because that's easier.
  10. */
  11. #include <decaf.hxx>
  12. #include <decaf/shake.hxx>
  13. #include <decaf/crypto.h>
  14. #include <decaf/crypto.hxx>
  15. #include <stdio.h>
  16. using namespace decaf;
  17. static bool passing = true;
  18. static const long NTESTS = 10000;
  19. class Test {
  20. public:
  21. bool passing_now;
  22. Test(const char *test) {
  23. passing_now = true;
  24. printf("%s...", test);
  25. if (strlen(test) < 27) printf("%*s",int(27-strlen(test)),"");
  26. fflush(stdout);
  27. }
  28. ~Test() {
  29. if (std::uncaught_exception()) {
  30. fail();
  31. printf(" due to uncaught exception.\n");
  32. }
  33. if (passing_now) printf("[PASS]\n");
  34. }
  35. void fail() {
  36. if (!passing_now) return;
  37. passing_now = passing = false;
  38. printf("[FAIL]\n");
  39. }
  40. };
  41. template<typename Group> struct Tests {
  42. typedef typename Group::Scalar Scalar;
  43. typedef typename Group::Point Point;
  44. typedef typename Group::Precomputed Precomputed;
  45. static void print(const char *name, const Scalar &x) {
  46. unsigned char buffer[Scalar::SER_BYTES];
  47. x.encode(FixedBuffer<Scalar::SER_BYTES>(buffer));
  48. printf(" %s = 0x", name);
  49. for (int i=sizeof(buffer)-1; i>=0; i--) {
  50. printf("%02x", buffer[i]);
  51. }
  52. printf("\n");
  53. }
  54. static void hexprint(const char *name, const SecureBuffer &buffer) {
  55. printf(" %s = 0x", name);
  56. for (int i=buffer.size()-1; i>=0; i--) {
  57. printf("%02x", buffer[i]);
  58. }
  59. printf("\n");
  60. }
  61. static void print(const char *name, const Point &x) {
  62. FixedArrayBuffer<Point::SER_BYTES> buffer;
  63. x.encode(buffer);
  64. printf(" %s = 0x", name);
  65. for (int i=Point::SER_BYTES-1; i>=0; i--) {
  66. printf("%02x", buffer[i]);
  67. }
  68. printf("\n");
  69. }
  70. static bool arith_check(
  71. Test &test,
  72. const Scalar &x,
  73. const Scalar &y,
  74. const Scalar &z,
  75. const Scalar &l,
  76. const Scalar &r,
  77. const char *name
  78. ) {
  79. if (l == r) return true;
  80. test.fail();
  81. printf(" %s", name);
  82. print("x", x);
  83. print("y", y);
  84. print("z", z);
  85. print("lhs", l);
  86. print("rhs", r);
  87. return false;
  88. }
  89. static bool point_check(
  90. Test &test,
  91. const Point &p,
  92. const Point &q,
  93. const Point &R,
  94. const Scalar &x,
  95. const Scalar &y,
  96. const Point &l,
  97. const Point &r,
  98. const char *name
  99. ) {
  100. bool good = l==r;
  101. if (!p.validate()) { good = false; printf(" p invalid\n"); }
  102. if (!q.validate()) { good = false; printf(" q invalid\n"); }
  103. if (!r.validate()) { good = false; printf(" r invalid\n"); }
  104. if (!l.validate()) { good = false; printf(" l invalid\n"); }
  105. if (good) return true;
  106. test.fail();
  107. printf(" %s", name);
  108. print("x", x);
  109. print("y", y);
  110. print("p", p);
  111. print("q", q);
  112. print("r", R);
  113. print("lhs", r);
  114. print("rhs", l);
  115. return false;
  116. }
  117. static void test_arithmetic() {
  118. SpongeRng rng(Block("test_arithmetic"));
  119. Test test("Arithmetic");
  120. Scalar x(0),y(0),z(0);
  121. arith_check(test,x,y,z,INT_MAX,(decaf_word_t)INT_MAX,"cast from max");
  122. arith_check(test,x,y,z,INT_MIN,-Scalar(1+(decaf_word_t)INT_MAX),"cast from min");
  123. for (int i=0; i<NTESTS*10 && test.passing_now; i++) {
  124. /* TODO: pathological cases */
  125. size_t sob = DECAF_255_SCALAR_BYTES + 8 - (i%16);
  126. Scalar x(rng.read(sob));
  127. Scalar y(rng.read(sob));
  128. Scalar z(rng.read(sob));
  129. arith_check(test,x,y,z,x+y,y+x,"commute add");
  130. arith_check(test,x,y,z,x,x+0,"ident add");
  131. arith_check(test,x,y,z,x,x-0,"ident sub");
  132. arith_check(test,x,y,z,x+(y+z),(x+y)+z,"assoc add");
  133. arith_check(test,x,y,z,x*(y+z),x*y + x*z,"distributive mul/add");
  134. arith_check(test,x,y,z,x*(y-z),x*y - x*z,"distributive mul/add");
  135. arith_check(test,x,y,z,x*(y*z),(x*y)*z,"assoc mul");
  136. arith_check(test,x,y,z,x*y,y*x,"commute mul");
  137. arith_check(test,x,y,z,x,x*1,"ident mul");
  138. arith_check(test,x,y,z,0,x*0,"mul by 0");
  139. arith_check(test,x,y,z,-x,x*-1,"mul by -1");
  140. arith_check(test,x,y,z,x+x,x*2,"mul by 2");
  141. if (i%20) continue;
  142. if (y!=0) arith_check(test,x,y,z,x*y/y,x,"invert");
  143. arith_check(test,x,y,z,x/0,0,"invert0");
  144. }
  145. }
  146. static void test_elligator() {
  147. SpongeRng rng(Block("test_elligator"));
  148. Test test("Elligator");
  149. const int NHINTS = Group::REMOVED_COFACTOR * 2;
  150. SecureBuffer *alts[NHINTS];
  151. bool successes[NHINTS];
  152. SecureBuffer *alts2[NHINTS];
  153. bool successes2[NHINTS];
  154. for (int i=0; i<NTESTS/10 && (test.passing_now || i < 100); i++) {
  155. size_t len = (i % (2*Point::HASH_BYTES + 3));
  156. SecureBuffer b1(len);
  157. if (i!=Point::HASH_BYTES) rng.read(b1); /* special test case */
  158. if (i==1) b1[0] = 1; /* special case test */
  159. if (len >= Point::HASH_BYTES) b1[Point::HASH_BYTES-1] &= 0x7F; // FIXME MAGIC
  160. Point s = Point::from_hash(b1), ss=s;
  161. for (int j=0; j<(i&3); j++) ss = ss.debugging_torque();
  162. ss = ss.debugging_pscale(rng);
  163. bool good = false;
  164. for (int j=0; j<NHINTS; j++) {
  165. alts[j] = new SecureBuffer(len);
  166. alts2[j] = new SecureBuffer(len);
  167. if (len > Point::HASH_BYTES)
  168. memcpy(&(*alts[j])[Point::HASH_BYTES], &b1[Point::HASH_BYTES], len-Point::HASH_BYTES);
  169. if (len > Point::HASH_BYTES)
  170. memcpy(&(*alts2[j])[Point::HASH_BYTES], &b1[Point::HASH_BYTES], len-Point::HASH_BYTES);
  171. successes[j] = s.invert_elligator(*alts[j], j);
  172. successes2[j] = ss.invert_elligator(*alts2[j],j);
  173. if (successes[j] != successes2[j]
  174. || (successes[j] && successes2[j] && *alts[j] != *alts2[j])
  175. ) {
  176. test.fail();
  177. printf(" Unscalable Elligator inversion: i=%d, hint=%d, s=%d,%d\n",i,j,
  178. -int(successes[j]),-int(successes2[j]));
  179. hexprint("x",b1);
  180. hexprint("X",*alts[j]);
  181. hexprint("X",*alts2[j]);
  182. }
  183. if (successes[j]) {
  184. good = good || (b1 == *alts[j]);
  185. for (int k=0; k<j; k++) {
  186. if (successes[k] && *alts[j] == *alts[k]) {
  187. test.fail();
  188. printf(" Duplicate Elligator inversion: i=%d, hints=%d, %d\n",i,j,k);
  189. hexprint("x",b1);
  190. hexprint("X",*alts[j]);
  191. }
  192. }
  193. if (s != Point::from_hash(*alts[j])) {
  194. test.fail();
  195. printf(" Fail Elligator inversion round-trip: i=%d, hint=%d %s\n",i,j,
  196. (s==-Point::from_hash(*alts[j])) ? "[output was -input]": "");
  197. hexprint("x",b1);
  198. hexprint("X",*alts[j]);
  199. }
  200. /*
  201. if (i == Point::HASH_BYTES) {
  202. printf("Identity, hint = %d\n", j);
  203. hexprint("einv(0)",*alts[j]);
  204. }
  205. */
  206. }
  207. }
  208. if (!good) {
  209. test.fail();
  210. printf(" %s Elligator inversion: i=%d\n",good ? "Passed" : "Failed", i);
  211. hexprint("B", b1);
  212. for (int j=0; j<NHINTS; j++) {
  213. printf(" %d: %s%s", j, successes[j] ? "succ" : "fail\n", (successes[j] && *alts[j] == b1) ? " [x]" : "");
  214. if (successes[j]) {
  215. hexprint("b", *alts[j]);
  216. }
  217. }
  218. printf("\n");
  219. }
  220. for (int j=0; j<NHINTS; j++) {
  221. delete alts[j];
  222. alts[j] = NULL;
  223. delete alts2[j];
  224. alts2[j] = NULL;
  225. }
  226. Point t(rng);
  227. point_check(test,t,t,t,0,0,t,Point::from_hash(t.steg_encode(rng)),"steg round-trip");
  228. }
  229. }
  230. static void test_ec() {
  231. SpongeRng rng(Block("test_ec"));
  232. Test test("EC");
  233. Point id = Point::identity(), base = Point::base();
  234. point_check(test,id,id,id,0,0,Point::from_hash(""),id,"fh0");
  235. //point_check(test,id,id,id,0,0,Point::from_hash("\x01"),id,"fh1"); FIXME
  236. for (int i=0; i<NTESTS && test.passing_now; i++) {
  237. /* TODO: pathological cases */
  238. Scalar x(rng);
  239. Scalar y(rng);
  240. Point p(rng);
  241. Point q(rng);
  242. SecureBuffer buffer(2*Point::HASH_BYTES);
  243. rng.read(buffer);
  244. Point r = Point::from_hash(buffer);
  245. point_check(test,p,q,r,0,0,p,Point((SecureBuffer)p),"round-trip");
  246. Point pp = p.debugging_torque().debugging_pscale(rng);
  247. if (SecureBuffer(pp) != SecureBuffer(p)) {
  248. test.fail();
  249. printf("Fail torque seq test\n");
  250. }
  251. point_check(test,p,q,r,0,0,p,pp,"torque eq");
  252. point_check(test,p,q,r,0,0,p+q,q+p,"commute add");
  253. point_check(test,p,q,r,0,0,(p-q)+q,p,"correct sub");
  254. point_check(test,p,q,r,0,0,p+(q+r),(p+q)+r,"assoc add");
  255. point_check(test,p,q,r,0,0,p.times_two(),p+p,"dbl add");
  256. if (i%10) continue;
  257. point_check(test,p,q,r,x,0,x*(p+q),x*p+x*q,"distr mul");
  258. point_check(test,p,q,r,x,y,(x*y)*p,x*(y*p),"assoc mul");
  259. point_check(test,p,q,r,x,y,x*p+y*q,Point::double_scalarmul(x,p,y,q),"ds mul");
  260. point_check(test,base,q,r,x,y,x*base+y*q,q.non_secret_combo_with_base(y,x),"ds vt mul");
  261. point_check(test,p,q,r,x,0,Precomputed(p)*x,p*x,"precomp mul");
  262. point_check(test,p,q,r,0,0,r,
  263. Point::from_hash(Buffer(buffer).slice(0,Point::HASH_BYTES))
  264. + Point::from_hash(Buffer(buffer).slice(Point::HASH_BYTES,Point::HASH_BYTES)),
  265. "unih = hash+add"
  266. );
  267. point_check(test,p,q,r,x,0,Point(x.direct_scalarmul(SecureBuffer(p))),x*p,"direct mul");
  268. }
  269. }
  270. static void test_crypto() {
  271. Test test("Sample crypto");
  272. SpongeRng rng(Block("test_decaf_crypto"));
  273. for (int i=0; i<NTESTS && test.passing_now; i++) {
  274. PrivateKey<Group> priv1(rng), priv2(rng);
  275. PublicKey<Group> pub1(priv1), pub2(priv2);
  276. SecureBuffer message = rng.read(i);
  277. SecureBuffer sig(priv1.sign(message));
  278. pub1.verify(message, sig);
  279. }
  280. }
  281. }; // template<GroupId GROUP>
  282. // FIXME cross-field
  283. static void test_decaf() {
  284. Test test("Sample crypto");
  285. SpongeRng rng(Block("test_decaf"));
  286. decaf_255_symmetric_key_t proto1,proto2;
  287. decaf_255_private_key_t s1,s2;
  288. decaf_255_public_key_t p1,p2;
  289. decaf_255_signature_t sig;
  290. unsigned char shared1[1234],shared2[1234];
  291. const char *message = "Hello, world!";
  292. for (int i=0; i<NTESTS && test.passing_now; i++) {
  293. rng.read(Buffer(proto1,sizeof(proto1)));
  294. rng.read(Buffer(proto2,sizeof(proto2)));
  295. decaf_255_derive_private_key(s1,proto1);
  296. decaf_255_private_to_public(p1,s1);
  297. decaf_255_derive_private_key(s2,proto2);
  298. decaf_255_private_to_public(p2,s2);
  299. if (!decaf_255_shared_secret (shared1,sizeof(shared1),s1,p2)) {
  300. test.fail(); printf("Fail ss12\n");
  301. }
  302. if (!decaf_255_shared_secret (shared2,sizeof(shared2),s2,p1)) {
  303. test.fail(); printf("Fail ss21\n");
  304. }
  305. if (memcmp(shared1,shared2,sizeof(shared1))) {
  306. test.fail(); printf("Fail ss21 == ss12\n");
  307. }
  308. decaf_255_sign (sig,s1,(const unsigned char *)message,strlen(message));
  309. if (!decaf_255_verify (sig,p1,(const unsigned char *)message,strlen(message))) {
  310. test.fail(); printf("Fail sig ver\n");
  311. }
  312. }
  313. }
  314. int main(int argc, char **argv) {
  315. (void) argc; (void) argv;
  316. printf("Testing %s:\n",IsoEd25519::name());
  317. Tests<IsoEd25519>::test_arithmetic();
  318. Tests<IsoEd25519>::test_elligator();
  319. Tests<IsoEd25519>::test_ec();
  320. Tests<IsoEd25519>::test_crypto();
  321. test_decaf();
  322. printf("\n");
  323. printf("Testing %s:\n", Ed448Goldilocks::name());
  324. Tests<Ed448Goldilocks>::test_arithmetic();
  325. Tests<Ed448Goldilocks>::test_elligator();
  326. Tests<Ed448Goldilocks>::test_ec();
  327. Tests<Ed448Goldilocks>::test_crypto();
  328. if (passing) printf("Passed all tests.\n");
  329. return passing ? 0 : 1;
  330. }