Run Wycheproof RSASSA-PSS testvectors against libcrypto.

1 files changed, 144 insertions, 2 deletions

diff --git a/src/regress/lib/libcrypto/wycheproof/wycheproof.go b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
index 70dd99b6cd..21c9d1aae1 100644
--- a/src/regress/lib/libcrypto/wycheproof/wycheproof.go
+++ b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
@@ -1,4 +1,4 @@
-/* $OpenBSD: wycheproof.go,v 1.37 2018/08/29 19:22:32 tb Exp $ */
+/* $OpenBSD: wycheproof.go,v 1.38 2018/09/01 05:56:24 tb Exp $ */
 /*
  * Copyright (c) 2018 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -210,6 +210,30 @@ type wycheproofTestGroupRSA struct {
         Tests   []*wycheproofTestRSA `json:"tests"`
 }
 
+type wycheproofTestRSASSA struct {
+        TCID    int      `json:"tcId"`
+        Comment string   `json:"comment"`
+        Msg     string   `json:"msg"`
+        Sig     string   `json:"sig"`
+        Result  string   `json:"result"`
+        Flags   []string `json:"flags"`
+}
+
+type wycheproofTestGroupRSASSA struct {
+        E       string                  `json:"e"`
+        KeyASN  string                  `json:"keyAsn"`
+        KeyDER  string                  `json:"keyDer"`
+        KeyPEM  string                  `json:"keyPem"`
+        KeySize int                     `json:"keysize"`
+        MGF     string                  `json:"mgf"`
+        MGFSHA  string                  `json:"mgfSha"`
+        N       string                  `json:"n"`
+        SLen    int                     `json:"sLen"`
+        SHA     string                  `json:"sha"`
+        Type    string                  `json:"type"`
+        Tests   []*wycheproofTestRSASSA `json:"tests"`
+}
+
 type wycheproofTestX25519 struct {
         TCID    int      `json:"tcId"`
         Comment string   `json:"comment"`
@@ -282,6 +306,23 @@ func hashFromString(hs string) (hash.Hash, error) {
         }
 }
 
+func hashEvpMdFromString(hs string) (*C.EVP_MD, error) {
+        switch hs {
+        case "SHA-1":
+                return C.EVP_sha1(), nil
+        case "SHA-224":
+                return C.EVP_sha224(), nil
+        case "SHA-256":
+                return C.EVP_sha256(), nil
+        case "SHA-384":
+                return C.EVP_sha384(), nil
+        case "SHA-512":
+                return C.EVP_sha512(), nil
+        default:
+                return nil, fmt.Errorf("unknown hash %q", hs)
+        }
+}
+
 func checkAesCbcPkcs5(ctx *C.EVP_CIPHER_CTX, doEncrypt int, key []byte, keyLen int, iv []byte, ivLen int, in []byte, inLen int, out []byte, outLen int, wt *wycheproofTestAesCbcPkcs5) bool {
         var action string
         if doEncrypt == 1 {
@@ -1105,6 +1146,101 @@ func runECDSATestGroup(algorithm string, wtg *wycheproofTestGroupECDSA) bool {
         return success
 }
 
+func runRSASSATest(rsa *C.RSA, h hash.Hash, sha *C.EVP_MD, mgfSha *C.EVP_MD, sLen int, wt *wycheproofTestRSASSA) bool {
+        msg, err := hex.DecodeString(wt.Msg)
+        if err != nil {
+                log.Fatalf("Failed to decode message %q: %v", wt.Msg, err)
+        }
+
+        h.Reset()
+        h.Write(msg)
+        msg = h.Sum(nil)
+
+        sig, err := hex.DecodeString(wt.Sig)
+        if err != nil {
+                log.Fatalf("Failed to decode signature %q: %v", wt.Sig, err)
+        }
+
+        msgLen, sigLen := len(msg), len(sig)
+        if msgLen == 0 {
+                msg = append(msg, 0)
+        }
+        if sigLen == 0 {
+                sig = append(sig, 0)
+        }
+
+        sigOut := make([]byte, sigLen)
+        if sigLen == 0 {
+                sigOut = append(sigOut, 0)
+        }
+
+        ret := C.RSA_public_decrypt(C.int(sigLen), (*C.uchar)(unsafe.Pointer(&sig[0])), (*C.uchar)(unsafe.Pointer(&sigOut[0])), rsa, C.RSA_NO_PADDING)
+        if ret == -1 {
+                if wt.Result == "invalid" {
+                        return true
+                }
+                fmt.Printf("FAIL: Test case %d (%q) - RSA_public_decrypt() = %d, want %v\n", wt.TCID, wt.Comment, int(ret), wt.Result)
+                return false
+        }
+
+        ret = C.RSA_verify_PKCS1_PSS_mgf1(rsa, (*C.uchar)(unsafe.Pointer(&msg[0])), sha, mgfSha, (*C.uchar)(unsafe.Pointer(&sigOut[0])), C.int(sLen))
+
+        // XXX: audit acceptable cases...
+        success := false
+        if ret == 1 && (wt.Result == "valid" || wt.Result == "acceptable") {
+                success = true
+        } else if ret == 0 && (wt.Result == "invalid" || wt.Result == "acceptable") {
+                success = true
+        } else {
+                fmt.Printf("FAIL: Test case %d (%q) - RSA_verify_PKCS1_PSS_mgf1() = %d, want %v\n", wt.TCID, wt.Comment, int(ret), wt.Result)
+        }
+        return success
+}
+
+func runRSASSATestGroup(algorithm string, wtg *wycheproofTestGroupRSASSA) bool {
+        fmt.Printf("Running %v test group %v with key size %d and %v...\n", algorithm, wtg.Type, wtg.KeySize, wtg.SHA)
+        rsa := C.RSA_new()
+        if rsa == nil {
+                log.Fatal("RSA_new failed")
+        }
+        defer C.RSA_free(rsa)
+
+        e := C.CString(wtg.E)
+        if C.BN_hex2bn(&rsa.e, e) == 0 {
+                log.Fatal("Failed to set RSA e")
+        }
+        C.free(unsafe.Pointer(e))
+
+        n := C.CString(wtg.N)
+        if C.BN_hex2bn(&rsa.n, n) == 0 {
+                log.Fatal("Failed to set RSA n")
+        }
+        C.free(unsafe.Pointer(n))
+
+        h, err := hashFromString(wtg.SHA)
+        if err != nil {
+                log.Fatalf("Failed to get hash: %v", err)
+        }
+
+        sha, err := hashEvpMdFromString(wtg.SHA)
+        if err != nil {
+                log.Fatalf("Failed to get hash: %v", err)
+        }
+
+        mgfSha, err := hashEvpMdFromString(wtg.MGFSHA)
+        if err != nil {
+                log.Fatalf("Failed to get MGF hash: %v", err)
+        }
+
+        success := true
+        for _, wt := range wtg.Tests {
+                if !runRSASSATest(rsa, h, sha, mgfSha, wtg.SLen, wt) {
+                        success = false
+                }
+        }
+        return success
+}
+
 func runRSATest(rsa *C.RSA, nid int, h hash.Hash, wt *wycheproofTestRSA) bool {
         msg, err := hex.DecodeString(wt.Msg)
         if err != nil {
@@ -1250,6 +1386,8 @@ func runTestVectors(path string) bool {
                 wtg = &wycheproofTestGroupDSA{}
         case "ECDSA":
                 wtg = &wycheproofTestGroupECDSA{}
+        case "RSASSA-PSS":
+                wtg = &wycheproofTestGroupRSASSA{}
         case "RSASig":
                 wtg = &wycheproofTestGroupRSA{}
         case "X25519":
@@ -1292,6 +1430,10 @@ func runTestVectors(path string) bool {
                         if !runECDSATestGroup(wtv.Algorithm, wtg.(*wycheproofTestGroupECDSA)) {
                                 success = false
                         }
+                case "RSASSA-PSS":
+                        if !runRSASSATestGroup(wtv.Algorithm, wtg.(*wycheproofTestGroupRSASSA)) {
+                                success = false
+                        }
                 case "RSASig":
                         if !runRSATestGroup(wtv.Algorithm, wtg.(*wycheproofTestGroupRSA)) {
                                 success = false
@@ -1323,7 +1465,7 @@ func main() {
                 {"ChaCha20-Poly1305", "chacha20_poly1305_test.json"},
                 {"DSA", "dsa_test.json"},
                 {"ECDSA", "ecdsa_[^w]*test.json"}, // Skip ecdsa_webcrypto_test.json for now.
-                {"RSA signature", "rsa_signature_*test.json"},
+                {"RSA", "rsa_*test.json"},
                 {"X25519", "x25519_*test.json"},
         }