2 * Test GOST 34.11 Digest operation
4 * Copyright (C) 2019-2020 Vitaly Chikunov <vt@altlinux.org>. All Rights Reserved.
6 * Contents licensed under the terms of the OpenSSL license
7 * See https://www.openssl.org/source/license.html for details
11 # pragma warning(push, 3)
12 # include <openssl/applink.c>
15 #include <openssl/opensslv.h>
16 #include <openssl/engine.h>
17 #include <openssl/provider.h>
18 #include <openssl/evp.h>
19 #include <openssl/rand.h>
20 #include <openssl/err.h>
21 #include <openssl/asn1.h>
22 # include <openssl/hmac.h>
23 #if OPENSSL_VERSION_MAJOR >= 3
24 # include <openssl/core_names.h>
26 #include <openssl/obj_mac.h>
30 # include <sys/sysmips.h>
32 #ifndef EVP_MD_CTRL_SET_KEY
33 # include "gost_lcl.h"
36 /* Helpers to test OpenSSL API calls. */
39 ERR_print_errors_fp(stderr); \
40 OpenSSLDie(__FILE__, __LINE__, #e); \
44 ERR_print_errors_fp(stderr); \
45 fprintf(stderr, "Error at %s:%d %s\n", __FILE__, __LINE__, #e); \
49 #define cRED "\033[1;31m"
50 #define cDRED "\033[0;31m"
51 #define cGREEN "\033[1;32m"
52 #define cDGREEN "\033[0;32m"
53 #define cBLUE "\033[1;34m"
54 #define cDBLUE "\033[0;34m"
55 #define cMAGENT "\033[1;35m"
56 #define cNORM "\033[m"
57 #define TEST_ASSERT(e) {if ((test = (e))) \
58 printf(cRED " Test FAILED" cNORM "\n"); \
60 printf(cGREEN " Test passed" cNORM "\n");}
63 /* To test older APIs. */
64 # pragma GCC diagnostic ignored "-Wdeprecated-declarations"
68 * Test keys from both GOST R 34.12-2015 and GOST R 34.13-2015,
69 * for 128-bit cipher (A.1).
71 static const char K[32] = {
72 0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
73 0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,
77 * Key for 64-bit cipher (A.2).
79 static const char Km[32] = {
80 0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,0x77,0x66,0x55,0x44,0x33,0x22,0x11,0x00,
81 0xf0,0xf1,0xf2,0xf3,0xf4,0xf5,0xf6,0xf7,0xf8,0xf9,0xfa,0xfb,0xfc,0xfd,0xfe,0xff,
85 * Plaintext from GOST R 34.13-2015 A.1.
86 * First 16 bytes is vector (a) from GOST R 34.12-2015 A.1.
88 static const char P[] = {
89 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x99,0x88,
90 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,
91 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,
92 0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,0x11,
95 /* Plaintext for 64-bit cipher (A.2) */
96 static const char Pm[] = {
97 0x92,0xde,0xf0,0x6b,0x3c,0x13,0x0a,0x59,0xdb,0x54,0xc7,0x04,0xf8,0x18,0x9d,0x20,
98 0x4a,0x98,0xfb,0x2e,0x67,0xa8,0x02,0x4c,0x89,0x12,0x40,0x9b,0x17,0xb5,0x7e,0x41,
102 * Kuznyechik OMAC1/CMAC test vector from GOST R 34.13-2015 А.1.6
104 static const char MAC_omac[] = { 0x33,0x6f,0x4d,0x29,0x60,0x59,0xfb,0xe3 };
107 * Magma OMAC1/CMAC test vector from GOST R 34.13-2015 А.2.6
109 static const char MAC_magma_omac[] = { 0x15,0x4e,0x72,0x10 };
112 * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.1
114 static const char P_omac_acpkm1[] = {
115 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
116 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
119 static const char MAC_omac_acpkm1[] = {
120 0xB5,0x36,0x7F,0x47,0xB6,0x2B,0x99,0x5E,0xEB,0x2A,0x64,0x8C,0x58,0x43,0x14,0x5E,
124 * OMAC-ACPKM test vector from R 1323565.1.017-2018 A.4.2
126 static const char P_omac_acpkm2[] = {
127 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
128 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,
129 0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,
130 0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,
131 0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,
134 static const char MAC_omac_acpkm2[] = {
135 0xFB,0xB8,0xDC,0xEE,0x45,0xBE,0xA6,0x7C,0x35,0xF5,0x8C,0x57,0x00,0x89,0x8E,0x5D,
138 /* Some other test vectors. */
139 static const char etalon_M4[64] = { 0 };
141 static const char etalon_M5[] = {
142 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
143 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
144 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
145 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
148 static const char etalon_M6[] = {
149 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
150 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
151 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
152 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
153 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
154 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
155 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
156 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
157 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
158 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
159 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
160 0x37,0x38,0x39,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x20,0x0a,
163 static const char etalon_carry[] = {
164 0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
165 0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
166 0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
167 0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,0xee,
168 0x16,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
169 0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
170 0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,
171 0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x16,
174 /* This is another carry test. */
175 static const char ff[] = {
176 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
177 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
178 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
179 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
182 struct hash_testvec {
183 const char *algname; /* Algorithm name */
184 const char *name; /* Test name and source. */
185 const char *plaintext; /* Input (of psize), NULL for synthetic test. */
186 const char *digest; /* Expected output (of EVP_MD_size or truncate). */
187 const char *hmac; /* Expected output for HMAC tests. */
188 const char *key; /* MAC key.*/
189 int psize; /* Input (plaintext) size. */
190 size_t outsize; /* Compare to EVP_MD_size() / EVP_MAC_size() if non-zero. */
191 int truncate; /* Truncated output (digest) size. */
192 int key_size; /* MAC key size. */
193 int block_size; /* Internal block size. */
194 int acpkm; /* The section size N (the number of bits that are
195 processed with one section key before this key is
196 transformed) (bytes) */
197 int acpkm_t; /* Master key (change) frequency T* (bytes) */
200 static const struct hash_testvec testvecs[] = {
201 { /* Test vectors from standards. */
202 .algname = SN_id_GostR3411_2012_512,
203 .name = "M1 from RFC 6986 (10.1.1) and GOST R 34.11-2012 (А.1.1)",
205 "012345678901234567890123456789012345678901234567890123456789012",
208 "\x1b\x54\xd0\x1a\x4a\xf5\xb9\xd5\xcc\x3d\x86\xd6\x8d\x28\x54\x62"
209 "\xb1\x9a\xbc\x24\x75\x22\x2f\x35\xc0\x85\x12\x2b\xe4\xba\x1f\xfa"
210 "\x00\xad\x30\xf8\x76\x7b\x3a\x82\x38\x4c\x65\x74\xf0\x24\xc3\x11"
211 "\xe2\xa4\x81\x33\x2b\x08\xef\x7f\x41\x79\x78\x91\xc1\x64\x6f\x48",
213 .block_size = 512 / 8,
216 .algname = SN_id_GostR3411_2012_256,
217 .name = "M1 from RFC 6986 (10.1.2) and GOST R 34.11-2012 (А.1.2)",
219 "012345678901234567890123456789012345678901234567890123456789012",
222 "\x9d\x15\x1e\xef\xd8\x59\x0b\x89\xda\xa6\xba\x6c\xb7\x4a\xf9\x27"
223 "\x5d\xd0\x51\x02\x6b\xb1\x49\xa4\x52\xfd\x84\xe5\xe5\x7b\x55\x00",
225 .block_size = 512 / 8,
228 .algname = SN_id_GostR3411_2012_512,
229 .name = "M2 from RFC 6986 (10.2.1) and GOST R 34.11-2012 (А.2.1)",
231 "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
232 "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
233 "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
234 "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
235 "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
238 "\x1e\x88\xe6\x22\x26\xbf\xca\x6f\x99\x94\xf1\xf2\xd5\x15\x69\xe0"
239 "\xda\xf8\x47\x5a\x3b\x0f\xe6\x1a\x53\x00\xee\xe4\x6d\x96\x13\x76"
240 "\x03\x5f\xe8\x35\x49\xad\xa2\xb8\x62\x0f\xcd\x7c\x49\x6c\xe5\xb3"
241 "\x3f\x0c\xb9\xdd\xdc\x2b\x64\x60\x14\x3b\x03\xda\xba\xc9\xfb\x28",
244 .algname = SN_id_GostR3411_2012_256,
245 .name = "M2 from RFC 6986 (10.2.2) and GOST R 34.11-2012 (А.2.2)",
247 "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
248 "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
249 "\xf1\x20\xec\xee\xf0\xff\x20\xf1\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
250 "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
251 "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
254 "\x9d\xd2\xfe\x4e\x90\x40\x9e\x5d\xa8\x7f\x53\x97\x6d\x74\x05\xb0"
255 "\xc0\xca\xc6\x28\xfc\x66\x9a\x74\x1d\x50\x06\x3c\x55\x7e\x8f\x50",
259 .algname = SN_grasshopper_mac,
260 .name = "P from GOST R 34.13-2015 (А.1.6)",
264 .key_size = sizeof(K),
267 .truncate = sizeof(MAC_omac),
270 .algname = SN_magma_mac,
271 .name = "P from GOST R 34.13-2015 (А.2.6)",
275 .key_size = sizeof(Km),
276 .digest = MAC_magma_omac,
278 .truncate = sizeof(MAC_magma_omac),
281 .algname = SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
282 .name = "M from R 1323565.1.017-2018 (A.4.1)",
283 .plaintext = P_omac_acpkm1,
284 .psize = sizeof(P_omac_acpkm1),
286 .key_size = sizeof(K),
289 .digest = MAC_omac_acpkm1,
290 .outsize = sizeof(MAC_omac_acpkm1),
293 .algname = SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
294 .name = "M from R 1323565.1.017-2018 (A.4.2)",
295 .plaintext = P_omac_acpkm2,
296 .psize = sizeof(P_omac_acpkm2),
298 .key_size = sizeof(K),
301 .digest = MAC_omac_acpkm2,
302 .outsize = sizeof(MAC_omac_acpkm2),
305 .algname = SN_id_GostR3411_2012_512,
306 .name = "HMAC_GOSTR3411_2012_512 from RFC 7836 (B) and R 50.1.113-2016 (A)",
308 "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
311 "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
312 "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
315 "\xa5\x9b\xab\x22\xec\xae\x19\xc6\x5f\xbd\xe6\xe5\xf4\xe9\xf5\xd8"
316 "\x54\x9d\x31\xf0\x37\xf9\xdf\x9b\x90\x55\x00\xe1\x71\x92\x3a\x77"
317 "\x3d\x5f\x15\x30\xf2\xed\x7e\x96\x4c\xb2\xee\xdc\x29\xe9\xad\x2f"
318 "\x3a\xfe\x93\xb2\x81\x4f\x79\xf5\x00\x0f\xfc\x03\x66\xc2\x51\xe6",
321 .algname = SN_id_GostR3411_2012_256,
322 .name = "HMAC_GOSTR3411_2012_256 from RFC 7836 (B) and R 50.1.113-2016 (A)",
324 "\x01\x26\xbd\xb8\x78\x00\xaf\x21\x43\x41\x45\x65\x63\x78\x01\x00",
327 "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
328 "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
331 "\xa1\xaa\x5f\x7d\xe4\x02\xd7\xb3\xd3\x23\xf2\x99\x1c\x8d\x45\x34"
332 "\x01\x31\x37\x01\x0a\x83\x75\x4f\xd0\xaf\x6d\x7c\xd4\x92\x2e\xd9",
336 .algname = SN_id_GostR3411_2012_512,
337 .name = "Zero length string (M3)",
341 "\x8e\x94\x5d\xa2\x09\xaa\x86\x9f\x04\x55\x92\x85\x29\xbc\xae\x46"
342 "\x79\xe9\x87\x3a\xb7\x07\xb5\x53\x15\xf5\x6c\xeb\x98\xbe\xf0\xa7"
343 "\x36\x2f\x71\x55\x28\x35\x6e\xe8\x3c\xda\x5f\x2a\xac\x4c\x6a\xd2"
344 "\xba\x3a\x71\x5c\x1b\xcd\x81\xcb\x8e\x9f\x90\xbf\x4c\x1c\x1a\x8a",
348 .algname = SN_id_GostR3411_2012_256,
349 .name = "Zero length string (M3)",
353 "\x3f\x53\x9a\x21\x3e\x97\xc8\x02\xcc\x22\x9d\x47\x4c\x6a\xa3\x2a"
354 "\x82\x5a\x36\x0b\x2a\x93\x3a\x94\x9f\xd9\x25\x20\x8d\x9c\xe1\xbb",
358 .algname = SN_id_GostR3411_2012_512,
359 .name = "64 bytes of zero (M4)",
360 .plaintext = etalon_M4,
361 .psize = sizeof(etalon_M4),
363 "\xb0\xfd\x29\xac\x1b\x0d\xf4\x41\x76\x9f\xf3\xfd\xb8\xdc\x56\x4d"
364 "\xf6\x77\x21\xd6\xac\x06\xfb\x28\xce\xff\xb7\xbb\xaa\x79\x48\xc6"
365 "\xc0\x14\xac\x99\x92\x35\xb5\x8c\xb2\x6f\xb6\x0f\xb1\x12\xa1\x45"
366 "\xd7\xb4\xad\xe9\xae\x56\x6b\xf2\x61\x14\x02\xc5\x52\xd2\x0d\xb7"
369 .algname = SN_id_GostR3411_2012_256,
370 .name = "64 bytes of zero (M4)",
371 .plaintext = etalon_M4,
372 .psize = sizeof(etalon_M4),
374 "\xdf\x1f\xda\x9c\xe8\x31\x91\x39\x05\x37\x35\x80\x31\xdb\x2e\xca"
375 "\xa6\xaa\x54\xcd\x0e\xda\x24\x1d\xc1\x07\x10\x5e\x13\x63\x6b\x95"
378 .algname = SN_id_GostR3411_2012_512,
379 .name = "64 bytes of (M5)",
380 .plaintext = etalon_M5,
381 .psize = sizeof(etalon_M5),
383 "\x36\x3b\x44\x9e\xc8\x1a\xe4\x0b\x3a\x40\x7b\x12\x5c\x3b\x1c\x2b"
384 "\x76\x8b\x50\x49\x6b\xcb\x5f\x69\x0b\x89\xe9\x00\x7b\x06\xe4\x08"
385 "\x41\x82\xed\x45\xd4\x07\x2a\x67\xfe\xc9\xd3\x42\x1d\xab\x01\x3d"
386 "\xa2\xaa\xbc\x1d\x65\x28\xe8\xe7\x75\xae\xc7\xb3\x45\x7a\xc6\x75"
389 .algname = SN_id_GostR3411_2012_256,
390 .name = "64 bytes of (M5)",
391 .plaintext = etalon_M5,
392 .psize = sizeof(etalon_M5),
394 "\xf0\xa5\x57\xf6\xa0\x4a\x90\xab\x18\x11\xc1\xb6\xe9\xb0\x78\xe4"
395 "\x16\x3b\x74\x03\x7c\x6c\xf5\x9f\x52\x44\x4a\x37\xf4\x8e\x11\xd8"
398 .algname = SN_id_GostR3411_2012_512,
400 .plaintext = etalon_M6,
401 .psize = sizeof(etalon_M6),
403 "\x87\x81\xdf\xc8\x1d\x2d\xb6\xa4\x1d\x18\x57\xf3\x23\x0b\x3f\xfe"
404 "\x2b\xda\x57\x42\x73\xea\x19\x47\x18\x9a\xaa\x54\x68\x47\x0d\xf1"
405 "\xc4\xb3\x74\xb1\xa2\xb5\x6e\x59\xd1\x1d\x21\x3f\xea\x57\xe3\x51"
406 "\x45\x43\xb0\xce\xd9\xb2\x0e\x55\x3a\xe6\x64\x25\xec\x90\x9c\xfd"
409 .algname = SN_id_GostR3411_2012_256,
411 .plaintext = etalon_M6,
412 .psize = sizeof(etalon_M6),
414 "\x2f\x4f\x65\x1f\xe8\x8f\xea\x46\xec\x6f\x22\x23\x72\x8d\x8d\xff"
415 "\x39\x68\x89\x35\x58\xef\x00\xa3\x10\xc2\x3e\x7d\x19\x23\xba\x0c"
418 .algname = SN_id_GostR3411_2012_512,
420 .plaintext = etalon_carry,
421 .psize = sizeof(etalon_carry),
423 "\x8b\x06\xf4\x1e\x59\x90\x7d\x96\x36\xe8\x92\xca\xf5\x94\x2f\xcd"
424 "\xfb\x71\xfa\x31\x16\x9a\x5e\x70\xf0\xed\xb8\x73\x66\x4d\xf4\x1c"
425 "\x2c\xce\x6e\x06\xdc\x67\x55\xd1\x5a\x61\xcd\xeb\x92\xbd\x60\x7c"
426 "\xc4\xaa\xca\x67\x32\xbf\x35\x68\xa2\x3a\x21\x0d\xd5\x20\xfd\x41"
429 .algname = SN_id_GostR3411_2012_256,
431 .plaintext = etalon_carry,
432 .psize = sizeof(etalon_carry),
434 "\x81\xbb\x63\x2f\xa3\x1f\xcc\x38\xb4\xc3\x79\xa6\x62\xdb\xc5\x8b"
435 "\x9b\xed\x83\xf5\x0d\x3a\x1b\x2c\xe7\x27\x1a\xb0\x2d\x25\xba\xbb"
437 { /* ff (Better carry test). */
438 .algname = SN_id_GostR3411_2012_512,
439 .name = "64 bytes of FF",
443 "\x41\x62\x9d\xe6\x77\xd7\xe8\x09\x0c\x3c\xd7\x0a\xff\xe3\x30\x0d"
444 "\x1e\x1c\xfb\xa2\xdb\x97\x94\x5e\xc3\x7f\xeb\x4e\x13\x75\xbc\x02"
445 "\xa5\x3f\x00\x37\x0b\x7d\x71\x5b\x07\xf3\x7f\x93\xca\xc8\x44\xef"
446 "\xad\xbf\xd1\xb8\x5f\x9d\xda\xe3\xde\x96\x56\xc0\xe9\x5a\xff\xc7"
449 .algname = SN_id_GostR3411_2012_256,
450 .name = "64 bytes of FF",
454 "\x96\x4a\x5a\xb6\x02\x86\xf1\x06\x28\x87\x43\xe2\xfe\x1a\x42\x2d"
455 "\x16\x08\x98\xca\x1b\xd5\x35\xe8\x31\xaa\x50\x0c\xfe\x34\xd7\xe8"
458 .algname = SN_id_GostR3411_94,
459 .name = "64 bytes of FF",
463 "\x58\x50\x4d\x26\xb3\x67\x7e\x75\x6b\xa3\xf4\xa9\xfd\x2f\x14\xb3"
464 "\xba\x54\x57\x06\x6a\x4a\xa1\xd7\x00\x65\x9b\x90\xdc\xdd\xd3\xc6"
466 /* Synthetic tests. */
468 .algname = SN_id_GostR3411_2012_256,
469 .name = "streebog256 synthetic test",
473 "\xa2\xf3\x6d\x9c\x42\xa1\x1e\xad\xe3\xc1\xfe\x99\xf9\x99\xc3\x84"
474 "\xe7\x98\xae\x24\x50\x75\x73\xd7\xfc\x99\x81\xa0\x45\x85\x41\xf6"
477 .algname = SN_id_GostR3411_2012_512,
478 .name = "streebog512 synthetic test",
482 "\x1d\x14\x4d\xd8\xb8\x27\xfb\x55\x1a\x5a\x7d\x03\xbb\xdb\xfa\xcb"
483 "\x43\x6b\x5b\xc5\x77\x59\xfd\x5f\xf2\x3b\x8e\xf9\xc4\xdd\x6f\x79"
484 "\x45\xd8\x16\x59\x9e\xaa\xbc\xf2\xb1\x4f\xd0\xe4\xf6\xad\x46\x60"
485 "\x90\x89\xf7\x2f\x93\xd8\x85\x0c\xb0\x43\xff\x5a\xb6\xe3\x69\xbd"
490 static void hexdump(const void *ptr, size_t len)
492 const unsigned char *p = ptr;
495 for (i = 0; i < len; i += j) {
496 for (j = 0; j < 16 && i + j < len; j++)
497 printf("%s%02x", j? "" : " ", p[i + j]);
502 static int do_hmac_old(int iter, const EVP_MD *type, const char *plaintext,
503 const struct hash_testvec *t)
506 unsigned char md[EVP_MAX_MD_SIZE];
511 T(ctx = HMAC_CTX_new());
512 T(HMAC_Init_ex(ctx, t->key, t->key_size, type, NULL));
513 T(HMAC_Update(ctx, (const unsigned char *)plaintext, t->psize));
514 T(HMAC_Final(ctx, md, &len));
518 T(len == t->outsize);
519 if (memcmp(md, t->hmac, len) != 0) {
520 printf(cRED "hmac mismatch (iter %d)" cNORM "\n", iter);
521 hexdump(t->hmac, len);
528 #if OPENSSL_VERSION_MAJOR >= 3
529 static int do_hmac_prov(int iter, const EVP_MD *md, const char *plaintext,
530 const struct hash_testvec *t)
533 unsigned char out[EVP_MAX_MD_SIZE];
535 printf("[HMAC by EVP_MAC] ");
538 T(hmac = EVP_MAC_fetch(NULL, "HMAC", NULL));
540 T(ctx = EVP_MAC_CTX_new(hmac));
541 OSSL_PARAM params[] = {
542 OSSL_PARAM_utf8_string(OSSL_MAC_PARAM_DIGEST,
543 (char *)EVP_MD_name(md), 0),
546 T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, params));
547 T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
548 T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
549 EVP_MAC_CTX_free(ctx);
553 T(len == t->outsize);
554 if (memcmp(out, t->hmac, len) != 0) {
555 printf(cRED "hmac mismatch (iter %d)" cNORM "\n", iter);
556 hexdump(t->hmac, len);
564 static int do_hmac(int iter, const EVP_MD *type, const char *plaintext,
565 const struct hash_testvec *t)
569 /* Test old (deprecated) and (too) new APIs. */
570 ret = do_hmac_old(iter, type, plaintext, t);
571 #if OPENSSL_VERSION_MAJOR >= 3
572 ret |= do_hmac_prov(iter, type, plaintext, t);
579 * If we have OMAC1/CMAC test vector,
580 * use CMAC provider to test it.
582 static int do_cmac_prov(int iter, const char *plaintext,
583 const struct hash_testvec *t)
585 #if OPENSSL_VERSION_MAJOR >= 3
586 char *ciphername = NULL;
589 * Convert 'mac' digest to the underlying CBC cipher.
591 switch (OBJ_sn2nid(t->algname)) {
592 case NID_grasshopper_mac:
593 ciphername = "kuznyechik-cbc";
596 ciphername = "magma-cbc";
603 printf("[CMAC(%s)] ", ciphername);
606 unsigned char out[EVP_MAX_MD_SIZE];
607 size_t outsize = t->outsize;
609 outsize = t->truncate;
612 T(cmac = EVP_MAC_fetch(NULL, "CMAC", NULL));
614 T(ctx = EVP_MAC_CTX_new(cmac));
615 OSSL_PARAM params[] = {
616 OSSL_PARAM_utf8_string(OSSL_MAC_PARAM_CIPHER, ciphername, 0),
619 T(EVP_MAC_CTX_set_params(ctx, params));
620 T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, params));
621 T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
622 T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
623 EVP_MAC_CTX_free(ctx);
626 /* CMAC provider will not respect outsize, and will output full block.
627 * So, just compare until what we need. */
629 if (memcmp(out, t->digest, outsize) != 0) {
630 printf(cRED "cmac mismatch (iter %d)" cNORM "\n", iter);
631 hexdump(t->digest, outsize);
639 static int do_mac(int iter, EVP_MAC *mac, const char *plaintext,
640 const struct hash_testvec *t)
643 printf("[MAC %zu] ", t->outsize);
645 size_t acpkm = (size_t)t->acpkm;
646 size_t acpkm_t = (size_t)t->acpkm_t;
647 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
648 OSSL_PARAM *p = params;
650 *p++ = OSSL_PARAM_construct_size_t("key-mesh", &acpkm);
652 *p++ = OSSL_PARAM_construct_size_t("cipher-key-mesh", &acpkm_t);
656 T(ctx = EVP_MAC_CTX_new(mac));
658 T(EVP_MAC_CTX_get_mac_size(ctx) == t->outsize);
661 outsize = t->truncate;
662 *p++ = OSSL_PARAM_construct_size_t("size", &outsize);
665 outsize = EVP_MAC_CTX_get_mac_size(ctx);
667 T(EVP_MAC_init(ctx, (const unsigned char *)t->key, t->key_size, NULL));
668 T(EVP_MAC_CTX_set_params(ctx, params));
669 T(EVP_MAC_update(ctx, (unsigned char *)plaintext, t->psize));
672 unsigned char out[256];
674 T(outsize <= sizeof(out));
675 T(EVP_MAC_finalXOF(ctx, out, outsize));
678 T(EVP_MAC_CTX_get_mac_size(ctx) == outsize);
679 T(EVP_MAC_final(ctx, out, &len, sizeof(out)));
682 EVP_MAC_CTX_free(ctx);
684 if (memcmp(out, t->digest, outsize) != 0) {
685 printf(cRED "mac mismatch (iter %d, outsize %d)" cNORM "\n",
687 hexdump(t->digest, outsize);
688 hexdump(out, outsize);
695 static int do_digest(int iter, const EVP_MD *type, const char *plaintext,
696 const struct hash_testvec *t)
699 printf("[MD %zu] ", t->outsize);
701 T(EVP_MD_size(type) == t->outsize);
704 outsize = t->truncate;
706 outsize = EVP_MD_size(type);
709 T(EVP_MD_block_size(type) == t->block_size);
711 T(ctx = EVP_MD_CTX_new());
712 T(EVP_MD_CTX_init(ctx));
713 T(EVP_DigestInit_ex(ctx, type, NULL));
715 T(EVP_MD_CTX_ctrl(ctx, EVP_MD_CTRL_SET_KEY, t->key_size,
718 T(EVP_MD_CTX_ctrl(ctx, EVP_CTRL_KEY_MESH, t->acpkm,
719 t->acpkm_t? (void *)&t->acpkm_t : NULL));
720 T(EVP_DigestUpdate(ctx, plaintext, t->psize));
723 unsigned char out[EVP_MAX_MD_SIZE];
724 if (EVP_MD_flags(EVP_MD_CTX_md(ctx)) & EVP_MD_FLAG_XOF) {
725 T(EVP_DigestFinalXOF(ctx, out, outsize));
728 T(EVP_MD_CTX_size(ctx) == outsize);
729 T(EVP_DigestFinal_ex(ctx, out, &len));
732 EVP_MD_CTX_free(ctx);
734 if (memcmp(out, t->digest, outsize) != 0) {
735 printf(cRED "digest mismatch (iter %d, outsize %d)" cNORM "\n",
737 hexdump(t->digest, outsize);
738 hexdump(out, outsize);
745 static int do_test(const struct hash_testvec *tv)
752 T((md = (EVP_MD *)EVP_get_digestbyname(tv->algname))
753 || (md = EVP_MD_fetch(NULL, tv->algname, NULL))
754 || (mac = EVP_MAC_fetch(NULL, tv->algname, NULL)));
757 printf(cBLUE "Test %s: %s: " cNORM, tv->algname, tv->name);
759 /* Test alignment problems. */
763 T(buf = OPENSSL_malloc(tv->psize + shifts));
764 for (i = 0; i < shifts; i++) {
765 memcpy(buf + i, tv->plaintext, tv->psize);
767 ret |= do_mac(i, mac, buf + i, tv);
771 ret |= do_hmac(i, md, buf + i, tv);
773 ret |= do_digest(i, md, buf + i, tv);
776 /* Test CMAC provider for applicable entries. */
777 ret |= do_cmac_prov(i, buf + i, tv);
779 /* No need to continue loop on failure. */
788 printf(cGREEN "success" cNORM "\n");
790 printf(cRED "fail" cNORM "\n");
794 #define SUPER_SIZE 256
796 * For 256-byte buffer filled with 256 bytes from 0 to 255;
797 * Digest them 256 times from the buffer end with lengths from 0 to 256,
798 * and from beginning of the buffer with lengths from 0 to 256;
799 * Each produced digest is digested again into final sum.
801 static int do_synthetic_once(const struct hash_testvec *tv, unsigned int shifts)
803 unsigned char *ibuf, *md;
804 T(ibuf = OPENSSL_zalloc(SUPER_SIZE + shifts));
806 /* fill with pattern */
808 for (len = 0; len < SUPER_SIZE; len++)
809 ibuf[shifts + len] = len & 0xff;
812 T((dgst = (EVP_MD *)EVP_get_digestbyname(tv->algname))
813 || (dgst = EVP_MD_fetch(NULL, tv->algname, NULL)));
814 OPENSSL_assert(EVP_MD_is_a(dgst, tv->algname));
815 EVP_MD_CTX *ctx, *ctx2;
816 T(ctx = EVP_MD_CTX_new());
817 T(ctx2 = EVP_MD_CTX_new());
818 T(EVP_DigestInit(ctx2, dgst));
819 OPENSSL_assert(EVP_MD_is_a(EVP_MD_CTX_md(ctx2), tv->algname));
820 OPENSSL_assert(EVP_MD_block_size(dgst) == tv->block_size);
821 OPENSSL_assert(EVP_MD_CTX_size(ctx2) == tv->outsize);
822 OPENSSL_assert(EVP_MD_CTX_block_size(ctx2) == tv->block_size);
824 const unsigned int mdlen = EVP_MD_size(dgst);
825 OPENSSL_assert(mdlen == tv->outsize);
826 T(md = OPENSSL_zalloc(mdlen + shifts));
827 md += shifts; /* test for output digest alignment problems */
830 for (len = 0; len < SUPER_SIZE; len++) {
831 /* for each len digest len bytes from the end of buf */
832 T(EVP_DigestInit(ctx, dgst));
833 T(EVP_DigestUpdate(ctx, ibuf + shifts + SUPER_SIZE - len, len));
834 T(EVP_DigestFinal(ctx, md, NULL));
835 T(EVP_DigestUpdate(ctx2, md, mdlen));
838 for (len = 0; len < SUPER_SIZE; len++) {
839 /* for each len digest len bytes from the beginning of buf */
840 T(EVP_DigestInit(ctx, dgst));
841 T(EVP_DigestUpdate(ctx, ibuf + shifts, len));
842 T(EVP_DigestFinal(ctx, md, NULL));
843 T(EVP_DigestUpdate(ctx2, md, mdlen));
847 EVP_MD_CTX_free(ctx);
849 T(EVP_DigestFinal(ctx2, md, &len));
850 EVP_MD_CTX_free(ctx2);
855 printf(cRED "digest output len mismatch %u != %u (expected)" cNORM "\n",
860 if (memcmp(md, tv->digest, mdlen) != 0) {
861 printf(cRED "digest mismatch" cNORM "\n");
864 printf(" Expected value is: ");
865 for (i = 0; i < mdlen; i++)
866 printf("\\x%02x", md[i]);
871 OPENSSL_free(md - shifts);
874 OPENSSL_free(md - shifts);
879 /* do different block sizes and different memory offsets */
880 static int do_synthetic_test(const struct hash_testvec *tv)
884 printf(cBLUE "Test %s: " cNORM, tv->name);
888 for (shifts = 0; shifts < 16 && !ret; shifts++)
889 ret |= do_synthetic_once(tv, shifts);
892 printf(cGREEN "success" cNORM "\n");
894 printf(cRED "fail" cNORM "\n");
898 int engine_is_available(const char *name)
900 ENGINE *e = ENGINE_get_first();
903 if (strcmp(ENGINE_get_id(e), name) == 0)
905 e = ENGINE_get_next(e);
911 void warn_if_untested(const EVP_MD *dgst, void *provider)
913 const struct hash_testvec *tv;
915 /* ENGINE provided EVP_MDs have a NULL provider */
916 if (provider != EVP_MD_get0_provider(dgst))
919 for (tv = testvecs; tv->algname; tv++)
920 if (EVP_MD_is_a(dgst, tv->algname))
923 printf(cMAGENT "Digest %s is untested!" cNORM "\n", EVP_MD_name(dgst));
926 void warn_all_untested(void)
928 if (engine_is_available("gost")) {
931 T(eng = ENGINE_by_id("gost"));
934 ENGINE_DIGESTS_PTR fn_c;
935 T(fn_c = ENGINE_get_digests(eng));
938 n = fn_c(eng, NULL, &nids, 0);
939 for (k = 0; k < n; ++k)
940 warn_if_untested(ENGINE_get_digest(eng, nids[k]), NULL);
944 if (OSSL_PROVIDER_available(NULL, "gostprov")) {
947 T(prov = OSSL_PROVIDER_load(NULL, "gostprov"));
948 EVP_MD_do_all_provided(NULL,
949 (void (*)(EVP_MD *, void *))warn_if_untested,
952 OSSL_PROVIDER_unload(prov);
956 int main(int argc, char **argv)
961 /* Trigger SIGBUS for unaligned access. */
962 sysmips(MIPS_FIXADE, 0);
964 OPENSSL_add_all_algorithms_conf();
966 const struct hash_testvec *tv;
967 for (tv = testvecs; tv->algname; tv++) {
971 ret |= do_synthetic_test(tv);
977 printf(cDRED "= Some tests FAILED!" cNORM "\n");
979 printf(cDGREEN "= All tests passed!" cNORM "\n");