ec_asn1_test: test Wei25519.2 and Wei25519.-3 as well

Covers a few more corner cases in the elliptic curve code.

1 files changed, 163 insertions, 37 deletions

diff --git a/src/regress/lib/libcrypto/ec/ec_asn1_test.c b/src/regress/lib/libcrypto/ec/ec_asn1_test.c
index c53864cadd..d9da2afca5 100644
--- a/src/regress/lib/libcrypto/ec/ec_asn1_test.c
+++ b/src/regress/lib/libcrypto/ec/ec_asn1_test.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_asn1_test.c,v 1.7 2024/10/18 09:01:44 tb Exp $ */
+/* $OpenBSD: ec_asn1_test.c,v 1.8 2024/10/18 09:34:20 tb Exp $ */
 /*
  * Copyright (c) 2017, 2021 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
@@ -340,6 +340,24 @@ ec_group_roundtrip_builtin_curves(void)
         return failed;
 }
 
+struct curve {
+        const char *descr;
+        const char *oid;
+        const char *sn;
+        const char *ln;
+        const char *p;
+        const char *a;
+        const char *b;
+        const char *order;
+        const char *cofactor;
+        const char *x;
+        const char *y;
+        const char *named;
+        size_t named_len;
+        const char *param;
+        size_t param_len;
+};
+
 /*
  * From draft-ietf-lwig-curve-representation-23, Appendix E.3
  */
@@ -380,24 +398,8 @@ const uint8_t ec_wei25519_pkparameters_parameters[] = {
         0x08,
 };
 
-struct curve {
-        const char *oid;
-        const char *sn;
-        const char *ln;
-        const char *p;
-        const char *a;
-        const char *b;
-        const char *order;
-        const char *cofactor;
-        const char *x;
-        const char *y;
-        const char *named;
-        size_t named_len;
-        const char *param;
-        size_t param_len;
-};
-
 static const struct curve wei25519 = {
+        .descr = "short Weierstrass 25519",
         .oid = "1.3.101.108",
         .sn = "Wei25519",
         .p =     "7fffffff" "ffffffff" "ffffffff" "ffffffff"
@@ -419,6 +421,124 @@ static const struct curve wei25519 = {
         .param_len = sizeof(ec_wei25519_pkparameters_parameters),
 };
 
+/*
+ * From draft-ietf-lwig-curve-representation-23, Appendix G.3
+ */
+
+const uint8_t ec_wei25519_2_pkparameters_parameters[] = {
+        0x30, 0x81, 0xde, 0x02, 0x01, 0x01, 0x30, 0x2b,
+        0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01,
+        0x01, 0x02, 0x20, 0x7f, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xed, 0x30, 0x44, 0x04, 0x20, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04,
+        0x20, 0x1a, 0xc1, 0xda, 0x05, 0xb5, 0x5b, 0xc1,
+        0x46, 0x33, 0xbd, 0x39, 0xe4, 0x7f, 0x94, 0x30,
+        0x2e, 0xf1, 0x98, 0x43, 0xdc, 0xf6, 0x69, 0x91,
+        0x6f, 0x6a, 0x5d, 0xfd, 0x01, 0x65, 0x53, 0x8c,
+        0xd1, 0x04, 0x41, 0x04, 0x17, 0xcf, 0xea, 0xc3,
+        0x78, 0xae, 0xd6, 0x61, 0x31, 0x8e, 0x86, 0x34,
+        0x58, 0x22, 0x75, 0xb6, 0xd9, 0xad, 0x4d, 0xef,
+        0x07, 0x2e, 0xa1, 0x93, 0x5e, 0xe3, 0xc4, 0xe8,
+        0x7a, 0x94, 0x0f, 0xfa, 0x0c, 0x08, 0xa9, 0x52,
+        0xc5, 0x5d, 0xfa, 0xd6, 0x2c, 0x4f, 0x13, 0xf1,
+        0xa8, 0xf6, 0x8d, 0xca, 0xdc, 0x5c, 0x33, 0x1d,
+        0x29, 0x7a, 0x37, 0xb6, 0xf0, 0xd7, 0xfd, 0xcc,
+        0x51, 0xe1, 0x6b, 0x4d, 0x02, 0x20, 0x10, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde,
+        0xf9, 0xde, 0xa2, 0xf7, 0x9c, 0xd6, 0x58, 0x12,
+        0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed, 0x02, 0x01,
+        0x08,
+};
+
+static const struct curve wei25519_2 = {
+        .descr = "short Weierstrass 25519.2",
+        .oid = "1.3.101.108",
+        .sn = "Wei25519",
+        .p =     "7fffffff" "ffffffff" "ffffffff" "ffffffff"
+                 "ffffffff" "ffffffff" "ffffffff" "ffffffed",
+        .a =     "02",
+        .b =     "1ac1da05" "b55bc146" "33bd39e4" "7f94302e"
+                 "f19843dc" "f669916f" "6a5dfd01" "65538cd1",
+        .x =     "17cfeac3" "78aed661" "318e8634" "582275b6"
+                 "d9ad4def" "072ea193" "5ee3c4e8" "7a940ffa",
+        .y =     "0c08a952" "c55dfad6" "2c4f13f1" "a8f68dca"
+                 "dc5c331d" "297a37b6" "f0d7fdcc" "51e16b4d",
+        .order = "10000000" "00000000" "00000000" "00000000"
+                 "14def9de" "a2f79cd6" "5812631a" "5cf5d3ed",
+        .cofactor = "8",
+        .named = ec_wei25519_pkparameters_named_curve,
+        .named_len = sizeof(ec_wei25519_pkparameters_named_curve),
+        .param = ec_wei25519_2_pkparameters_parameters,
+        .param_len = sizeof(ec_wei25519_2_pkparameters_parameters),
+};
+
+const uint8_t ec_wei25519_3_pkparameters_parameters[] = {
+        0x30, 0x81, 0xde, 0x02, 0x01, 0x01, 0x30, 0x2b,
+        0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01,
+        0x01, 0x02, 0x20, 0x7f, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xed, 0x30, 0x44, 0x04, 0x20, 0x7f,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xea, 0x04,
+        0x20, 0x41, 0xa3, 0xb6, 0xbf, 0xc6, 0x68, 0x77,
+        0x8e, 0xbe, 0x29, 0x54, 0xa4, 0xb1, 0xdf, 0x36,
+        0xd1, 0x48, 0x5e, 0xce, 0xf1, 0xea, 0x61, 0x42,
+        0x95, 0x79, 0x6e, 0x10, 0x22, 0x40, 0x89, 0x1f,
+        0xaa, 0x04, 0x41, 0x04, 0x77, 0x06, 0xc3, 0x7b,
+        0x5a, 0x84, 0x12, 0x8a, 0x38, 0x84, 0xa5, 0xd7,
+        0x18, 0x11, 0xf1, 0xb5, 0x5d, 0xa3, 0x23, 0x0f,
+        0xfb, 0x17, 0xa8, 0xab, 0x0b, 0x32, 0xe4, 0x8d,
+        0x31, 0xa6, 0x68, 0x5c, 0x0f, 0x60, 0x48, 0x0c,
+        0x7a, 0x5c, 0x0e, 0x11, 0x40, 0x34, 0x0a, 0xdc,
+        0x79, 0xd6, 0xa2, 0xbf, 0x0c, 0xb5, 0x7a, 0xd0,
+        0x49, 0xd0, 0x25, 0xdc, 0x38, 0xd8, 0x0c, 0x77,
+        0x98, 0x5f, 0x03, 0x29, 0x02, 0x20, 0x10, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde,
+        0xf9, 0xde, 0xa2, 0xf7, 0x9c, 0xd6, 0x58, 0x12,
+        0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed, 0x02, 0x01,
+        0x08,
+};
+
+static const struct curve wei25519_3 = {
+        .descr = "short Weierstrass 25519.-3",
+        .oid = "1.3.101.108",
+        .sn = "Wei25519",
+        .p =     "7fffffff" "ffffffff" "ffffffff" "ffffffff"
+                 "ffffffff" "ffffffff" "ffffffff" "ffffffed",
+/* XXX - change this if we are going to enforce 0 <= a,b < p. */
+#if 0
+        .a =     "7fffffff" "ffffffff" "ffffffff" "ffffffff"
+                 "ffffffff" "ffffffff" "ffffffff" "ffffffea",
+#else
+        .a =     "-03",
+#endif
+        .b =     "41a3b6bf" "c668778e" "be2954a4" "b1df36d1"
+                 "485ecef1" "ea614295" "796e1022" "40891faa",
+        .x =     "7706c37b" "5a84128a" "3884a5d7" "1811f1b5"
+                 "5da3230f" "fb17a8ab" "0b32e48d" "31a6685c",
+        .y =     "0f60480c" "7a5c0e11" "40340adc" "79d6a2bf"
+                 "0cb57ad0" "49d025dc" "38d80c77" "985f0329",
+        .order = "10000000" "00000000" "00000000" "00000000"
+                 "14def9de" "a2f79cd6" "5812631a" "5cf5d3ed",
+        .cofactor = "8",
+        .named = ec_wei25519_pkparameters_named_curve,
+        .named_len = sizeof(ec_wei25519_pkparameters_named_curve),
+        .param = ec_wei25519_3_pkparameters_parameters,
+        .param_len = sizeof(ec_wei25519_3_pkparameters_parameters),
+};
+
 static EC_GROUP *
 ec_group_from_curve_method(const struct curve *curve, const EC_METHOD *method,
     BN_CTX *ctx)
@@ -468,8 +588,8 @@ ec_group_from_curve_method(const struct curve *curve, const EC_METHOD *method,
                 errx(1, "EC_POINT_new()");
 
         if (!EC_POINT_set_affine_coordinates(group, generator, x, y, ctx)) {
-                fprintf(stderr, "FAIL: %s EC_POINT_set_affine_coordinates",
-                    curve->sn);
+                fprintf(stderr, "FAIL: %s EC_POINT_set_affine_coordinates\n",
+                    curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
@@ -479,7 +599,7 @@ ec_group_from_curve_method(const struct curve *curve, const EC_METHOD *method,
 
         /* Don't set cofactor to exercise the cofactor guessing code. */
         if (!EC_GROUP_set_generator(group, generator, order, NULL)) {
-                fprintf(stderr, "FAIL: %s EC_GROUP_set_generator\n", curve->sn);
+                fprintf(stderr, "FAIL: %s EC_GROUP_set_generator\n", curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
@@ -511,7 +631,7 @@ ec_group_new(const struct curve *curve, const EC_METHOD *method, BN_CTX *ctx)
         if ((nid = OBJ_txt2nid(curve->oid)) == NID_undef)
                 nid = OBJ_create(curve->oid, curve->sn, curve->ln);
         if (nid == NID_undef) {
-                fprintf(stderr, "FAIL: OBJ_create(%s)\n", curve->sn);
+                fprintf(stderr, "FAIL: OBJ_create(%s)\n", curve->descr);
                 goto err;
         }
 
@@ -524,19 +644,19 @@ ec_group_new(const struct curve *curve, const EC_METHOD *method, BN_CTX *ctx)
                 errx(1, "BN_hex2bn(cofactor)");
 
         if ((group = ec_group_from_curve_method(curve, method, ctx)) == NULL) {
-                fprintf(stderr, "FAIL: %s ec_group_from_curve_method\n", curve->sn);
+                fprintf(stderr, "FAIL: %s ec_group_from_curve_method\n", curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
 
         if (!EC_GROUP_get_cofactor(group, guessed_cofactor, ctx)) {
-                fprintf(stderr, "FAIL: %s EC_GROUP_get_cofactor\n", curve->sn);
+                fprintf(stderr, "FAIL: %s EC_GROUP_get_cofactor\n", curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
 
         if (BN_cmp(cofactor, guessed_cofactor) != 0) {
-                fprintf(stderr, "FAIL: %s cofactor: want ", curve->sn);
+                fprintf(stderr, "FAIL: %s cofactor: want ", curve->descr);
                 BN_print_fp(stderr, cofactor);
                 fprintf(stderr, ", got ");
                 BN_print_fp(stderr, guessed_cofactor);
@@ -545,7 +665,7 @@ ec_group_new(const struct curve *curve, const EC_METHOD *method, BN_CTX *ctx)
         }
 
         if (!EC_GROUP_check(group, ctx)) {
-                fprintf(stderr, "FAIL: %s EC_GROUP_check\n", curve->sn);
+                fprintf(stderr, "FAIL: %s EC_GROUP_check\n", curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
@@ -583,7 +703,7 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
                 goto err;
 
         if ((nid = EC_GROUP_get_curve_name(group)) == NID_undef) {
-                fprintf(stderr, "FAIL: no curve name set for %s\n", curve->sn);
+                fprintf(stderr, "FAIL: no curve name set for %s\n", curve->descr);
                 goto err;
         }
 
@@ -592,7 +712,7 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
         der = NULL;
         if ((der_len = i2d_ECPKParameters(group, &der)) <= 0) {
                 fprintf(stderr, "FAIL: %s i2d_ECPKParameters (named)\n",
-                    curve->sn);
+                    curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
@@ -612,12 +732,12 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
         der = NULL;
         if ((der_len = i2d_ECPKParameters(group, &der)) <= 0) {
                 fprintf(stderr, "FAIL: i2d_ECPKParameters (explicit) %s\n",
-                    curve->sn);
+                    curve->descr);
                 ERR_print_errors_fp(stderr);
                 goto err;
         }
 
-        if (compare_data(curve->sn, der, der_len,
+        if (compare_data(curve->descr, der, der_len,
             curve->param, curve->param_len) == -1)
                 goto err;
 
@@ -626,7 +746,7 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
 
         /* At this point we should have no error on the stack. */
         if (ERR_peek_last_error() != 0) {
-                fprintf(stderr, "FAIL: %s unexpected error %lu\n", curve->sn,
+                fprintf(stderr, "FAIL: %s unexpected error %lu\n", curve->descr,
                     ERR_peek_last_error());
                 goto err;
         }
@@ -635,14 +755,14 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
         der_len = curve->named_len;
         if ((new_group = d2i_ECPKParameters(NULL, &pder, der_len)) != NULL) {
                 fprintf(stderr, "FAIL: managed to decode unknown named curve %s\n",
-                    curve->sn);
+                    curve->descr);
                 goto err;
         }
 
         error = ERR_get_error();
         if (ERR_GET_REASON(error) != EC_R_UNKNOWN_GROUP) {
                 fprintf(stderr, "FAIL: %s unexpected error: want %d, got %d\n",
-                    curve->sn, EC_R_UNKNOWN_GROUP, ERR_GET_REASON(error));
+                    curve->descr, EC_R_UNKNOWN_GROUP, ERR_GET_REASON(error));
                 goto err;
         }
 
@@ -652,25 +772,25 @@ ec_group_non_builtin_curve(const struct curve *curve, const EC_METHOD *method,
 #if 0
         if ((new_group = d2i_ECPKParameters(NULL, &pder, der_len)) != NULL) {
                 fprintf(stderr, "FAIL: managed to decode non-builtin parameters %s\n",
-                    curve->sn);
+                    curve->descr);
                 goto err;
         }
 
         error = ERR_peek_last_error();
         if (ERR_GET_REASON(error) != EC_R_PKPARAMETERS2GROUP_FAILURE) {
                 fprintf(stderr, "FAIL: %s unexpected error: want %d, got %d\n",
-                    curve->sn, EC_R_UNKNOWN_GROUP, ERR_GET_REASON(error));
+                    curve->descr, EC_R_UNKNOWN_GROUP, ERR_GET_REASON(error));
                 goto err;
         }
 #else
         if ((new_group = d2i_ECPKParameters(NULL, &pder, der_len)) == NULL) {
-                fprintf(stderr, "FAIL: d2i_ECPKParameters(%s)\n", curve->sn);
+                fprintf(stderr, "FAIL: d2i_ECPKParameters(%s)\n", curve->descr);
                 goto err;
         }
         if (method == EC_GFp_mont_method() &&
             EC_GROUP_cmp(group, new_group, ctx) != 0) {
                 fprintf(stderr, "FAIL: %s Weierstrass groups do not match!\n",
-                    curve->sn);
+                    curve->descr);
                 goto err;
         }
 #endif
@@ -700,6 +820,12 @@ ec_group_non_builtin_curves(void)
         failed |= ec_group_non_builtin_curve(&wei25519, EC_GFp_mont_method(), ctx);
         failed |= ec_group_non_builtin_curve(&wei25519, EC_GFp_simple_method(), ctx);
 
+        failed |= ec_group_non_builtin_curve(&wei25519_2, EC_GFp_mont_method(), ctx);
+        failed |= ec_group_non_builtin_curve(&wei25519_2, EC_GFp_simple_method(), ctx);
+
+        failed |= ec_group_non_builtin_curve(&wei25519_3, EC_GFp_mont_method(), ctx);
+        failed |= ec_group_non_builtin_curve(&wei25519_3, EC_GFp_simple_method(), ctx);
+
         BN_CTX_free(ctx);
 
         return failed;