Blame SOURCES/libsodium-1.0.18/test/default/aead_chacha20poly1305.c

ca16be
ca16be
#define TEST_NAME "aead_chacha20poly1305"
ca16be
#include "cmptest.h"
ca16be
ca16be
static int
ca16be
tv(void)
ca16be
{
ca16be
#undef  MLEN
ca16be
#define MLEN 10U
ca16be
#undef  ADLEN
ca16be
#define ADLEN 10U
ca16be
#undef  CLEN
ca16be
#define CLEN (MLEN + crypto_aead_chacha20poly1305_ABYTES)
ca16be
    static const unsigned char firstkey[crypto_aead_chacha20poly1305_KEYBYTES]
ca16be
        = { 0x42, 0x90, 0xbc, 0xb1, 0x54, 0x17, 0x35, 0x31, 0xf3, 0x14, 0xaf,
ca16be
            0x57, 0xf3, 0xbe, 0x3b, 0x50, 0x06, 0xda, 0x37, 0x1e, 0xce, 0x27,
ca16be
            0x2a, 0xfa, 0x1b, 0x5d, 0xbd, 0xd1, 0x10, 0x0a, 0x10, 0x07 };
ca16be
    static const unsigned char m[MLEN]
ca16be
        = { 0x86, 0xd0, 0x99, 0x74, 0x84, 0x0b, 0xde, 0xd2, 0xa5, 0xca };
ca16be
    static const unsigned char nonce[crypto_aead_chacha20poly1305_NPUBBYTES]
ca16be
        = { 0xcd, 0x7c, 0xf6, 0x7b, 0xe3, 0x9c, 0x79, 0x4a };
ca16be
    static const unsigned char ad[ADLEN]
ca16be
        = { 0x87, 0xe2, 0x29, 0xd4, 0x50, 0x08, 0x45, 0xa0, 0x79, 0xc0 };
ca16be
    unsigned char *c = (unsigned char *) sodium_malloc(CLEN);
ca16be
    unsigned char *detached_c = (unsigned char *) sodium_malloc(MLEN);
ca16be
    unsigned char *mac = (unsigned char *) sodium_malloc(crypto_aead_chacha20poly1305_ABYTES);
ca16be
    unsigned char *m2 = (unsigned char *) sodium_malloc(MLEN);
ca16be
    unsigned long long found_clen;
ca16be
    unsigned long long found_maclen;
ca16be
    unsigned long long m2len;
ca16be
    size_t i;
ca16be
ca16be
    crypto_aead_chacha20poly1305_encrypt(c, &found_clen, m, MLEN,
ca16be
                                         ad, ADLEN,
ca16be
                                         NULL, nonce, firstkey);
ca16be
    if (found_clen != CLEN) {
ca16be
        printf("found_clen is not properly set\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
    crypto_aead_chacha20poly1305_encrypt_detached(detached_c,
ca16be
                                                  mac, &found_maclen,
ca16be
                                                  m, MLEN, ad, ADLEN,
ca16be
                                                  NULL, nonce, firstkey);
ca16be
    if (found_maclen != crypto_aead_chacha20poly1305_abytes()) {
ca16be
        printf("found_maclen is not properly set\n");
ca16be
    }
ca16be
    if (memcmp(detached_c, c, MLEN) != 0) {
ca16be
        printf("detached ciphertext is bogus\n");
ca16be
    }
ca16be
ca16be
    if (crypto_aead_chacha20poly1305_decrypt(m2, &m2len, NULL, c, CLEN,
ca16be
                                             ad, ADLEN,
ca16be
                                             nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt() failed\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("m != m2\n");
ca16be
    }
ca16be
    memset(m2, 0, m2len);
ca16be
    assert(crypto_aead_chacha20poly1305_decrypt_detached(NULL, NULL,
ca16be
                                                         c, MLEN, mac,
ca16be
                                                         ad, ADLEN,
ca16be
                                                         nonce, firstkey) == 0);
ca16be
    if (crypto_aead_chacha20poly1305_decrypt_detached(m2, NULL,
ca16be
                                                      c, MLEN, mac,
ca16be
                                                      ad, ADLEN,
ca16be
                                                      nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt_detached() failed\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("detached m != m2\n");
ca16be
    }
ca16be
ca16be
    for (i = 0U; i < CLEN; i++) {
ca16be
        c[i] ^= (i + 1U);
ca16be
        if (crypto_aead_chacha20poly1305_decrypt(m2, NULL, NULL, c, CLEN,
ca16be
                                                 ad, ADLEN, nonce, firstkey)
ca16be
            == 0 || memcmp(m, m2, MLEN) == 0) {
ca16be
            printf("message can be forged\n");
ca16be
        }
ca16be
        c[i] ^= (i + 1U);
ca16be
    }
ca16be
ca16be
    crypto_aead_chacha20poly1305_encrypt(c, &found_clen, m, MLEN,
ca16be
                                         NULL, 0U, NULL, nonce, firstkey);
ca16be
    if (found_clen != CLEN) {
ca16be
        printf("found_clen is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
ca16be
    if (crypto_aead_chacha20poly1305_decrypt(m2, &m2len, NULL, c, CLEN,
ca16be
                                             NULL, 0U, nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt() failed (adlen=0)\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("m != m2 (adlen=0)\n");
ca16be
    }
ca16be
    m2len = 1;
ca16be
    if (crypto_aead_chacha20poly1305_decrypt(
ca16be
            m2, &m2len, NULL, guard_page,
ca16be
            randombytes_uniform(crypto_aead_chacha20poly1305_ABYTES),
ca16be
            NULL, 0U, nonce, firstkey) != -1) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt() worked with a short "
ca16be
               "ciphertext\n");
ca16be
    }
ca16be
    if (m2len != 0) {
ca16be
        printf("Message length should have been set to zero after a failure\n");
ca16be
    }
ca16be
    m2len = 1;
ca16be
    if (crypto_aead_chacha20poly1305_decrypt(m2, &m2len, NULL, c, 0U, NULL, 0U,
ca16be
                                             nonce, firstkey) != -1) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt() worked with an empty "
ca16be
               "ciphertext\n");
ca16be
    }
ca16be
    if (m2len != 0) {
ca16be
        printf("Message length should have been set to zero after a failure\n");
ca16be
    }
ca16be
ca16be
    memcpy(c, m, MLEN);
ca16be
    crypto_aead_chacha20poly1305_encrypt(c, &found_clen, c, MLEN,
ca16be
                                         NULL, 0U, NULL, nonce, firstkey);
ca16be
    if (found_clen != CLEN) {
ca16be
        printf("found_clen is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
ca16be
    if (crypto_aead_chacha20poly1305_decrypt(c, &m2len, NULL, c, CLEN,
ca16be
                                             NULL, 0U, nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_decrypt() failed (adlen=0)\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    if (memcmp(m, c, MLEN) != 0) {
ca16be
        printf("m != c (adlen=0)\n");
ca16be
    }
ca16be
ca16be
    sodium_free(c);
ca16be
    sodium_free(detached_c);
ca16be
    sodium_free(mac);
ca16be
    sodium_free(m2);
ca16be
ca16be
    assert(crypto_aead_chacha20poly1305_keybytes() > 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_npubbytes() > 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_nsecbytes() == 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_messagebytes_max() > 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_messagebytes_max() == crypto_aead_chacha20poly1305_MESSAGEBYTES_MAX);
ca16be
    assert(crypto_aead_chacha20poly1305_keybytes() == crypto_aead_chacha20poly1305_KEYBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_nsecbytes() == crypto_aead_chacha20poly1305_NSECBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_npubbytes() == crypto_aead_chacha20poly1305_NPUBBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_abytes() == crypto_aead_chacha20poly1305_ABYTES);
ca16be
ca16be
    return 0;
ca16be
}
ca16be
ca16be
static int
ca16be
tv_ietf(void)
ca16be
{
ca16be
#undef  MLEN
ca16be
#define MLEN 114U
ca16be
#undef  ADLEN
ca16be
#define ADLEN 12U
ca16be
#undef  CLEN
ca16be
#define CLEN (MLEN + crypto_aead_chacha20poly1305_ietf_ABYTES)
ca16be
    static const unsigned char firstkey[crypto_aead_chacha20poly1305_ietf_KEYBYTES]
ca16be
        = {
ca16be
            0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
ca16be
            0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
ca16be
            0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
ca16be
            0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f
ca16be
        };
ca16be
#undef  MESSAGE
ca16be
#define MESSAGE "Ladies and Gentlemen of the class of '99: If I could offer you " \
ca16be
"only one tip for the future, sunscreen would be it."
ca16be
    unsigned char *m = (unsigned char *) sodium_malloc(MLEN);
ca16be
    static const unsigned char nonce[crypto_aead_chacha20poly1305_ietf_NPUBBYTES]
ca16be
        = { 0x07, 0x00, 0x00, 0x00,
ca16be
            0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 };
ca16be
    static const unsigned char ad[ADLEN]
ca16be
        = { 0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7 };
ca16be
    unsigned char *c = (unsigned char *) sodium_malloc(CLEN);
ca16be
    unsigned char *detached_c = (unsigned char *) sodium_malloc(MLEN);
ca16be
    unsigned char *mac = (unsigned char *) sodium_malloc(crypto_aead_chacha20poly1305_ietf_ABYTES);
ca16be
    unsigned char *m2 = (unsigned char *) sodium_malloc(MLEN);
ca16be
    unsigned long long found_clen;
ca16be
    unsigned long long found_maclen;
ca16be
    unsigned long long m2len;
ca16be
    size_t i;
ca16be
ca16be
    assert(sizeof MESSAGE - 1U == MLEN);
ca16be
    memcpy(m, MESSAGE, MLEN);
ca16be
    crypto_aead_chacha20poly1305_ietf_encrypt(c, &found_clen, m, MLEN,
ca16be
                                              ad, ADLEN,
ca16be
                                              NULL, nonce, firstkey);
ca16be
    if (found_clen != MLEN + crypto_aead_chacha20poly1305_ietf_abytes()) {
ca16be
        printf("found_clen is not properly set\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
    crypto_aead_chacha20poly1305_ietf_encrypt_detached(detached_c,
ca16be
                                                       mac, &found_maclen,
ca16be
                                                       m, MLEN,
ca16be
                                                       ad, ADLEN,
ca16be
                                                       NULL, nonce, firstkey);
ca16be
    if (found_maclen != crypto_aead_chacha20poly1305_ietf_abytes()) {
ca16be
        printf("found_maclen is not properly set\n");
ca16be
    }
ca16be
    if (memcmp(detached_c, c, MLEN) != 0) {
ca16be
        printf("detached ciphertext is bogus\n");
ca16be
    }
ca16be
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt(m2, &m2len, NULL, c, CLEN, ad,
ca16be
                                                  ADLEN, nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt() failed\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("m != m2\n");
ca16be
    }
ca16be
    memset(m2, 0, m2len);
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_decrypt_detached(NULL, NULL,
ca16be
                                                              c, MLEN, mac,
ca16be
                                                              ad, ADLEN,
ca16be
                                                              nonce, firstkey) == 0);
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt_detached(m2, NULL,
ca16be
                                                           c, MLEN, mac,
ca16be
                                                           ad, ADLEN,
ca16be
                                                           nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt_detached() failed\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("detached m != m2\n");
ca16be
    }
ca16be
ca16be
    for (i = 0U; i < CLEN; i++) {
ca16be
        c[i] ^= (i + 1U);
ca16be
        if (crypto_aead_chacha20poly1305_ietf_decrypt(m2, NULL, NULL, c, CLEN,
ca16be
                                                      ad, ADLEN, nonce, firstkey)
ca16be
            == 0 || memcmp(m, m2, MLEN) == 0) {
ca16be
            printf("message can be forged\n");
ca16be
        }
ca16be
        c[i] ^= (i + 1U);
ca16be
    }
ca16be
    crypto_aead_chacha20poly1305_ietf_encrypt(c, &found_clen, m, MLEN,
ca16be
                                              NULL, 0U, NULL, nonce, firstkey);
ca16be
    if (found_clen != CLEN) {
ca16be
        printf("clen is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt(m2, &m2len, NULL, c, CLEN,
ca16be
                                                  NULL, 0U, nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt() failed (adlen=0)\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    if (memcmp(m, m2, MLEN) != 0) {
ca16be
        printf("m != m2 (adlen=0)\n");
ca16be
    }
ca16be
    m2len = 1;
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt(
ca16be
            m2, &m2len, NULL, guard_page,
ca16be
            randombytes_uniform(crypto_aead_chacha20poly1305_ietf_ABYTES),
ca16be
            NULL, 0U, nonce, firstkey) != -1) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt() worked with a short "
ca16be
               "ciphertext\n");
ca16be
    }
ca16be
    if (m2len != 0) {
ca16be
        printf("Message length should have been set to zero after a failure\n");
ca16be
    }
ca16be
    m2len = 1;
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt(m2, &m2len, NULL, c, 0U, NULL, 0U,
ca16be
                                                  nonce, firstkey) != -1) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt() worked with an empty "
ca16be
               "ciphertext\n");
ca16be
    }
ca16be
    if (m2len != 0) {
ca16be
        printf("Message length should have been set to zero after a failure\n");
ca16be
    }
ca16be
ca16be
    memcpy(c, m, MLEN);
ca16be
    crypto_aead_chacha20poly1305_ietf_encrypt(c, &found_clen, c, MLEN,
ca16be
                                              NULL, 0U, NULL, nonce, firstkey);
ca16be
    if (found_clen != CLEN) {
ca16be
        printf("clen is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    for (i = 0U; i < CLEN; ++i) {
ca16be
        printf(",0x%02x", (unsigned int) c[i]);
ca16be
        if (i % 8 == 7) {
ca16be
            printf("\n");
ca16be
        }
ca16be
    }
ca16be
    printf("\n");
ca16be
ca16be
    if (crypto_aead_chacha20poly1305_ietf_decrypt(c, &m2len, NULL, c, CLEN,
ca16be
                                                  NULL, 0U, nonce, firstkey) != 0) {
ca16be
        printf("crypto_aead_chacha20poly1305_ietf_decrypt() failed (adlen=0)\n");
ca16be
    }
ca16be
    if (m2len != MLEN) {
ca16be
        printf("m2len is not properly set (adlen=0)\n");
ca16be
    }
ca16be
    if (memcmp(m, c, MLEN) != 0) {
ca16be
        printf("m != c (adlen=0)\n");
ca16be
    }
ca16be
ca16be
    sodium_free(c);
ca16be
    sodium_free(detached_c);
ca16be
    sodium_free(mac);
ca16be
    sodium_free(m2);
ca16be
    sodium_free(m);
ca16be
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_keybytes() > 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_keybytes() == crypto_aead_chacha20poly1305_keybytes());
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_npubbytes() > 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_npubbytes() > crypto_aead_chacha20poly1305_npubbytes());
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_nsecbytes() == 0U);
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_nsecbytes() == crypto_aead_chacha20poly1305_nsecbytes());
ca16be
    assert(crypto_aead_chacha20poly1305_ietf_messagebytes_max() == crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX);
ca16be
    assert(crypto_aead_chacha20poly1305_IETF_KEYBYTES  == crypto_aead_chacha20poly1305_ietf_KEYBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_IETF_NSECBYTES == crypto_aead_chacha20poly1305_ietf_NSECBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_IETF_NPUBBYTES == crypto_aead_chacha20poly1305_ietf_NPUBBYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_IETF_ABYTES    == crypto_aead_chacha20poly1305_ietf_ABYTES);
ca16be
    assert(crypto_aead_chacha20poly1305_IETF_MESSAGEBYTES_MAX == crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX);
ca16be
ca16be
    return 0;
ca16be
}
ca16be
ca16be
int
ca16be
main(void)
ca16be
{
ca16be
    tv();
ca16be
    tv_ietf();
ca16be
ca16be
    return 0;
ca16be
}