org.bouncycastle.crypto.test.ChaCha20Poly1305Test Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of org.apache.servicemix.bundles.bcprov-jdk15on
Show all versions of org.apache.servicemix.bundles.bcprov-jdk15on
This OSGi bundle wraps ${pkgArtifactId} ${pkgVersion} jar file.
package org.bouncycastle.crypto.test;
import java.security.SecureRandom;
import org.bouncycastle.crypto.InvalidCipherTextException;
import org.bouncycastle.crypto.macs.SipHash;
import org.bouncycastle.crypto.modes.ChaCha20Poly1305;
import org.bouncycastle.crypto.params.AEADParameters;
import org.bouncycastle.crypto.params.KeyParameter;
import org.bouncycastle.util.Strings;
import org.bouncycastle.util.Times;
import org.bouncycastle.util.encoders.Hex;
import org.bouncycastle.util.test.SimpleTest;
public class ChaCha20Poly1305Test
extends SimpleTest
{
private static final String[][] TEST_VECTORS = new String[][] {
{
"Test Case 1",
"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f",
"4c616469657320616e642047656e746c"
+ "656d656e206f662074686520636c6173"
+ "73206f66202739393a20496620492063"
+ "6f756c64206f6666657220796f75206f"
+ "6e6c79206f6e652074697020666f7220"
+ "746865206675747572652c2073756e73"
+ "637265656e20776f756c642062652069"
+ "742e",
"50515253c0c1c2c3c4c5c6c7",
"070000004041424344454647",
"d31a8d34648e60db7b86afbc53ef7ec2"
+ "a4aded51296e08fea9e2b5a736ee62d6"
+ "3dbea45e8ca9671282fafb69da92728b"
+ "1a71de0a9e060b2905d6a5b67ecd3b36"
+ "92ddbd7f2d778b8c9803aee328091b58"
+ "fab324e4fad675945585808b4831d7bc"
+ "3ff4def08e4b7a9de576d26586cec64b"
+ "6116",
"1ae10b594f09e26a7e902ecbd0600691",
},
};
public String getName()
{
return "ChaCha20Poly1305";
}
public void performTest() throws Exception
{
for (int i = 0; i < TEST_VECTORS.length; ++i)
{
runTestCase(TEST_VECTORS[i]);
}
outputSizeTests();
randomTests();
testExceptions();
}
private void checkTestCase(
ChaCha20Poly1305 encCipher,
ChaCha20Poly1305 decCipher,
String testName,
byte[] SA,
byte[] P,
byte[] C,
byte[] T)
throws InvalidCipherTextException
{
byte[] enc = new byte[encCipher.getOutputSize(P.length)];
if (SA != null)
{
encCipher.processAADBytes(SA, 0, SA.length);
}
int len = encCipher.processBytes(P, 0, P.length, enc, 0);
len += encCipher.doFinal(enc, len);
if (enc.length != len)
{
fail("encryption reported incorrect length: " + testName);
}
byte[] mac = encCipher.getMac();
byte[] data = new byte[P.length];
System.arraycopy(enc, 0, data, 0, data.length);
byte[] tail = new byte[enc.length - P.length];
System.arraycopy(enc, P.length, tail, 0, tail.length);
if (!areEqual(C, data))
{
fail("incorrect encrypt in: " + testName);
}
if (!areEqual(T, mac))
{
fail("getMac() returned wrong mac in: " + testName);
}
if (!areEqual(T, tail))
{
fail("stream contained wrong mac in: " + testName);
}
byte[] dec = new byte[decCipher.getOutputSize(enc.length)];
if (SA != null)
{
decCipher.processAADBytes(SA, 0, SA.length);
}
len = decCipher.processBytes(enc, 0, enc.length, dec, 0);
len += decCipher.doFinal(dec, len);
mac = decCipher.getMac();
data = new byte[C.length];
System.arraycopy(dec, 0, data, 0, data.length);
if (!areEqual(P, data))
{
fail("incorrect decrypt in: " + testName);
}
}
private ChaCha20Poly1305 initCipher(boolean forEncryption, AEADParameters parameters)
{
ChaCha20Poly1305 c = new ChaCha20Poly1305();
c.init(forEncryption, parameters);
return c;
}
private static int nextInt(SecureRandom rand, int n)
{
if ((n & -n) == n) // i.e., n is a power of 2
{
return (int)((n * (long)(rand.nextInt() >>> 1)) >> 31);
}
int bits, value;
do
{
bits = rand.nextInt() >>> 1;
value = bits % n;
}
while (bits - value + (n - 1) < 0);
return value;
}
private void outputSizeTests()
{
byte[] K = new byte[32];
byte[] A = null;
byte[] N = new byte[12];
AEADParameters parameters = new AEADParameters(new KeyParameter(K), 16 * 8, N, A);
ChaCha20Poly1305 cipher = initCipher(true, parameters);
if (cipher.getUpdateOutputSize(0) != 0)
{
fail("incorrect getUpdateOutputSize for initial 0 bytes encryption");
}
if (cipher.getOutputSize(0) != 16)
{
fail("incorrect getOutputSize for initial 0 bytes encryption");
}
cipher.init(false, parameters);
if (cipher.getUpdateOutputSize(0) != 0)
{
fail("incorrect getUpdateOutputSize for initial 0 bytes decryption");
}
// NOTE: 0 bytes would be truncated data, but we want it to fail in the doFinal, not here
if (cipher.getOutputSize(0) != 0)
{
fail("fragile getOutputSize for initial 0 bytes decryption");
}
if (cipher.getOutputSize(16) != 0)
{
fail("incorrect getOutputSize for initial MAC-size bytes decryption");
}
}
private void randomTests() throws InvalidCipherTextException
{
SecureRandom random = new SecureRandom();
random.setSeed(Times.nanoTime());
for (int i = 0; i < 100; ++i)
{
randomTest(random);
}
}
private void randomTest(SecureRandom random) throws InvalidCipherTextException
{
int kLength = 32;
byte[] K = new byte[kLength];
random.nextBytes(K);
int pHead = random.nextInt() >>> 24;
int pLength = random.nextInt() >>> 16;
int pTail = random.nextInt() >>> 24;
byte[] P = new byte[pHead + pLength + pTail];
random.nextBytes(P);
int aLength = random.nextInt() >>> 24;
byte[] A = new byte[aLength];
random.nextBytes(A);
int saLength = random.nextInt() >>> 24;
byte[] SA = new byte[saLength];
random.nextBytes(SA);
int nonceLength = 12;
byte[] nonce = new byte[nonceLength];
random.nextBytes(nonce);
AEADParameters parameters = new AEADParameters(new KeyParameter(K), 16 * 8, nonce, A);
ChaCha20Poly1305 cipher = initCipher(true, parameters);
int ctLength = cipher.getOutputSize(pLength);
byte[] C = new byte[saLength + ctLength];
System.arraycopy(SA, 0, C, 0, saLength);
int split = nextInt(random, saLength + 1);
cipher.processAADBytes(C, 0, split);
cipher.processAADBytes(C, split, saLength - split);
int predicted = cipher.getUpdateOutputSize(pLength);
int len = cipher.processBytes(P, pHead, pLength, C, saLength);
if (predicted != len)
{
fail("encryption reported incorrect update length in randomised test");
}
len += cipher.doFinal(C, saLength + len);
if (ctLength != len)
{
fail("encryption reported incorrect length in randomised test");
}
byte[] encT = cipher.getMac();
byte[] tail = new byte[ctLength - pLength];
System.arraycopy(C, saLength + pLength, tail, 0, tail.length);
if (!areEqual(encT, tail))
{
fail("stream contained wrong mac in randomised test");
}
cipher.init(false, parameters);
int decPHead = random.nextInt() >>> 24;
int decPLength = cipher.getOutputSize(ctLength);
int decPTail = random.nextInt() >>> 24;
byte[] decP = new byte[decPHead + decPLength + decPTail];
split = nextInt(random, saLength + 1);
cipher.processAADBytes(C, 0, split);
cipher.processAADBytes(C, split, saLength - split);
predicted = cipher.getUpdateOutputSize(ctLength);
len = cipher.processBytes(C, saLength, ctLength, decP, decPHead);
if (predicted != len)
{
fail("decryption reported incorrect update length in randomised test");
}
len += cipher.doFinal(decP, decPHead + len);
if (!areEqual(P, pHead, pHead + pLength, decP, decPHead, decPHead + decPLength))
{
fail("incorrect decrypt in randomised test");
}
byte[] decT = cipher.getMac();
if (!areEqual(encT, decT))
{
fail("decryption produced different mac from encryption");
}
//
// key reuse test
//
cipher.init(false, AEADTestUtil.reuseKey(parameters));
decPHead = random.nextInt() >>> 24;
decPLength = cipher.getOutputSize(ctLength);
decPTail = random.nextInt() >>> 24;
decP = new byte[decPHead + decPLength + decPTail];
split = nextInt(random, saLength + 1);
cipher.processAADBytes(C, 0, split);
cipher.processAADBytes(C, split, saLength - split);
len = cipher.processBytes(C, saLength, ctLength, decP, decPHead);
len += cipher.doFinal(decP, decPHead + len);
if (!areEqual(P, pHead, pHead + pLength, decP, decPHead, decPHead + decPLength))
{
fail("incorrect decrypt in randomised test");
}
decT = cipher.getMac();
if (!areEqual(encT, decT))
{
fail("decryption produced different mac from encryption");
}
}
private void runTestCase(String[] testVector)
throws InvalidCipherTextException
{
int pos = 0;
String testName = testVector[pos++];
byte[] K = Hex.decode(testVector[pos++]);
byte[] P = Hex.decode(testVector[pos++]);
byte[] A = Hex.decode(testVector[pos++]);
byte[] N = Hex.decode(testVector[pos++]);
byte[] C = Hex.decode(testVector[pos++]);
byte[] T = Hex.decode(testVector[pos++]);
runTestCase(testName, K, N, A, P, C, T);
}
private void runTestCase(
String testName,
byte[] K,
byte[] N,
byte[] A,
byte[] P,
byte[] C,
byte[] T)
throws InvalidCipherTextException
{
byte[] fa = new byte[A.length / 2];
byte[] la = new byte[A.length - (A.length / 2)];
System.arraycopy(A, 0, fa, 0, fa.length);
System.arraycopy(A, fa.length, la, 0, la.length);
runTestCase(testName + " all initial associated data", K, N, A, null, P, C, T);
runTestCase(testName + " all subsequent associated data", K, N, null, A, P, C, T);
runTestCase(testName + " split associated data", K, N, fa, la, P, C, T);
}
private void runTestCase(
String testName,
byte[] K,
byte[] N,
byte[] A,
byte[] SA,
byte[] P,
byte[] C,
byte[] T)
throws InvalidCipherTextException
{
AEADParameters parameters = new AEADParameters(new KeyParameter(K), T.length * 8, N, A);
ChaCha20Poly1305 encCipher = initCipher(true, parameters);
ChaCha20Poly1305 decCipher = initCipher(false, parameters);
checkTestCase(encCipher, decCipher, testName, SA, P, C, T);
encCipher = initCipher(true, parameters);
checkTestCase(encCipher, decCipher, testName + " (reused)", SA, P, C, T);
// Key reuse
AEADParameters keyReuseParams = AEADTestUtil.reuseKey(parameters);
try
{
encCipher.init(true, keyReuseParams);
fail("no exception");
}
catch (IllegalArgumentException e)
{
isTrue("wrong message", "cannot reuse nonce for ChaCha20Poly1305 encryption".equals(e.getMessage()));
}
}
private void testExceptions() throws InvalidCipherTextException
{
ChaCha20Poly1305 c = new ChaCha20Poly1305();
try
{
c = new ChaCha20Poly1305(new SipHash());
fail("incorrect mac size not picked up");
}
catch (IllegalArgumentException e)
{
// expected
}
try
{
c.init(false, new KeyParameter(new byte[32]));
fail("illegal argument not picked up");
}
catch (IllegalArgumentException e)
{
// expected
}
AEADTestUtil.testTampering(this, c, new AEADParameters(new KeyParameter(new byte[32]), 128, new byte[12]));
byte[] P = Strings.toByteArray("Hello world!");
byte[] buf = new byte[100];
c = new ChaCha20Poly1305();
AEADParameters aeadParameters = new AEADParameters(new KeyParameter(new byte[32]), 128, new byte[12]);
c.init(true, aeadParameters);
c.processBytes(P, 0, P.length, buf, 0);
c.doFinal(buf, 0);
try
{
c.doFinal(buf, 0);
fail("no exception on reuse");
}
catch (IllegalStateException e)
{
isTrue("wrong message", e.getMessage().equals("ChaCha20Poly1305 cannot be reused for encryption"));
}
try
{
c.init(true, aeadParameters);
fail("no exception on reuse");
}
catch (IllegalArgumentException e)
{
isTrue("wrong message", e.getMessage().equals("cannot reuse nonce for ChaCha20Poly1305 encryption"));
}
}
public static void main(String[] args)
{
runTest(new ChaCha20Poly1305Test());
}
}