1 /*
2  * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
3  * Copyright (c) 2018-2020, Oracle and/or its affiliates.  All rights reserved.
4  *
5  * Licensed under the Apache License 2.0 (the "License").  You may not use
6  * this file except in compliance with the License.  You can obtain a copy
7  * in the file LICENSE in the source distribution or at
8  * https://www.openssl.org/source/license.html
9  */
10 
11 /* Tests of the EVP_KDF_CTX APIs */
12 
13 #include <stdio.h>
14 #include <string.h>
15 
16 #include <openssl/evp.h>
17 #include <openssl/kdf.h>
18 #include <openssl/core_names.h>
19 #include "internal/numbers.h"
20 #include "testutil.h"
21 
22 
get_kdfbyname_libctx(OSSL_LIB_CTX * libctx,const char * name)23 static EVP_KDF_CTX *get_kdfbyname_libctx(OSSL_LIB_CTX *libctx, const char *name)
24 {
25     EVP_KDF *kdf = EVP_KDF_fetch(libctx, name, NULL);
26     EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
27 
28     EVP_KDF_free(kdf);
29     return kctx;
30 }
31 
get_kdfbyname(const char * name)32 static EVP_KDF_CTX *get_kdfbyname(const char *name)
33 {
34     return get_kdfbyname_libctx(NULL, name);
35 }
36 
construct_tls1_prf_params(const char * digest,const char * secret,const char * seed)37 static OSSL_PARAM *construct_tls1_prf_params(const char *digest, const char *secret,
38     const char *seed)
39 {
40     OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 4);
41     OSSL_PARAM *p = params;
42 
43     if (params == NULL)
44         return NULL;
45 
46     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
47                                             (char *)digest, 0);
48     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
49                                              (unsigned char *)secret,
50                                              strlen(secret));
51     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
52                                              (unsigned char *)seed,
53                                              strlen(seed));
54     *p = OSSL_PARAM_construct_end();
55 
56     return params;
57 }
58 
test_kdf_tls1_prf(void)59 static int test_kdf_tls1_prf(void)
60 {
61     int ret;
62     EVP_KDF_CTX *kctx = NULL;
63     unsigned char out[16];
64     OSSL_PARAM *params;
65     static const unsigned char expected[sizeof(out)] = {
66         0x8e, 0x4d, 0x93, 0x25, 0x30, 0xd7, 0x65, 0xa0,
67         0xaa, 0xe9, 0x74, 0xc3, 0x04, 0x73, 0x5e, 0xcc
68     };
69 
70     params = construct_tls1_prf_params("sha256", "secret", "seed");
71 
72     ret = TEST_ptr(params)
73         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
74         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
75         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
76 
77     EVP_KDF_CTX_free(kctx);
78     OPENSSL_free(params);
79     return ret;
80 }
81 
test_kdf_tls1_prf_invalid_digest(void)82 static int test_kdf_tls1_prf_invalid_digest(void)
83 {
84     int ret;
85     EVP_KDF_CTX *kctx = NULL;
86     OSSL_PARAM *params;
87 
88     params = construct_tls1_prf_params("blah", "secret", "seed");
89 
90     ret = TEST_ptr(params)
91         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
92         && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
93 
94     EVP_KDF_CTX_free(kctx);
95     OPENSSL_free(params);
96     return ret;
97 }
98 
test_kdf_tls1_prf_zero_output_size(void)99 static int test_kdf_tls1_prf_zero_output_size(void)
100 {
101     int ret;
102     EVP_KDF_CTX *kctx = NULL;
103     unsigned char out[16];
104     OSSL_PARAM *params;
105 
106     params = construct_tls1_prf_params("sha256", "secret", "seed");
107 
108     /* Negative test - derive should fail */
109     ret = TEST_ptr(params)
110         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
111         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
112         && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
113 
114     EVP_KDF_CTX_free(kctx);
115     OPENSSL_free(params);
116     return ret;
117 }
118 
test_kdf_tls1_prf_empty_secret(void)119 static int test_kdf_tls1_prf_empty_secret(void)
120 {
121     int ret;
122     EVP_KDF_CTX *kctx = NULL;
123     unsigned char out[16];
124     OSSL_PARAM *params;
125 
126     params = construct_tls1_prf_params("sha256", "", "seed");
127 
128     ret = TEST_ptr(params)
129         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
130         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
131 
132     EVP_KDF_CTX_free(kctx);
133     OPENSSL_free(params);
134     return ret;
135 }
136 
test_kdf_tls1_prf_1byte_secret(void)137 static int test_kdf_tls1_prf_1byte_secret(void)
138 {
139     int ret;
140     EVP_KDF_CTX *kctx = NULL;
141     unsigned char out[16];
142     OSSL_PARAM *params;
143 
144     params = construct_tls1_prf_params("sha256", "1", "seed");
145 
146     ret = TEST_ptr(params)
147         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
148         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
149 
150     EVP_KDF_CTX_free(kctx);
151     OPENSSL_free(params);
152     return ret;
153 }
154 
test_kdf_tls1_prf_empty_seed(void)155 static int test_kdf_tls1_prf_empty_seed(void)
156 {
157     int ret;
158     EVP_KDF_CTX *kctx = NULL;
159     unsigned char out[16];
160     OSSL_PARAM *params;
161 
162     params = construct_tls1_prf_params("sha256", "secret", "");
163 
164     /* Negative test - derive should fail */
165     ret = TEST_ptr(params)
166         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
167         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
168         && TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0);
169 
170     EVP_KDF_CTX_free(kctx);
171     OPENSSL_free(params);
172     return ret;
173 }
174 
test_kdf_tls1_prf_1byte_seed(void)175 static int test_kdf_tls1_prf_1byte_seed(void)
176 {
177     int ret;
178     EVP_KDF_CTX *kctx = NULL;
179     unsigned char out[16];
180     OSSL_PARAM *params;
181 
182     params = construct_tls1_prf_params("sha256", "secret", "1");
183 
184     ret = TEST_ptr(params)
185         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_TLS1_PRF))
186         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
187 
188     EVP_KDF_CTX_free(kctx);
189     OPENSSL_free(params);
190     return ret;
191 }
192 
construct_hkdf_params(char * digest,char * key,size_t keylen,char * salt,char * info)193 static OSSL_PARAM *construct_hkdf_params(char *digest, char *key,
194     size_t keylen, char *salt, char *info)
195 {
196     OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
197     OSSL_PARAM *p = params;
198 
199     if (params == NULL)
200         return NULL;
201 
202     if (digest != NULL)
203         *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
204                                                 digest, 0);
205     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
206                                              salt, strlen(salt));
207     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
208                                              (unsigned char *)key, keylen);
209     if (info != NULL)
210         *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
211                                                  info, strlen(info));
212     else
213         *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
214                                                 "EXTRACT_ONLY", 0);
215     *p = OSSL_PARAM_construct_end();
216 
217     return params;
218 }
219 
test_kdf_hkdf(void)220 static int test_kdf_hkdf(void)
221 {
222     int ret;
223     EVP_KDF_CTX *kctx = NULL;
224     unsigned char out[10];
225     OSSL_PARAM *params;
226     static const unsigned char expected[sizeof(out)] = {
227         0x2a, 0xc4, 0x36, 0x9f, 0x52, 0x59, 0x96, 0xf8, 0xde, 0x13
228     };
229 
230     params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
231 
232     ret = TEST_ptr(params)
233         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
234         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
235         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
236 
237     EVP_KDF_CTX_free(kctx);
238     OPENSSL_free(params);
239     return ret;
240 }
241 
do_kdf_hkdf_gettables(int expand_only,int has_digest)242 static int do_kdf_hkdf_gettables(int expand_only, int has_digest)
243 {
244     int ret = 0;
245     size_t sz = 0;
246     OSSL_PARAM *params;
247     OSSL_PARAM params_get[2];
248     const OSSL_PARAM *gettables, *p;
249     EVP_KDF_CTX *kctx = NULL;
250 
251     if (!TEST_ptr(params = construct_hkdf_params(
252                                                  has_digest ? "sha256" : NULL,
253                                                  "secret", 6, "salt",
254                                                  expand_only ? NULL : "label"))
255         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
256         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
257         goto err;
258 
259     /* Check OSSL_KDF_PARAM_SIZE is gettable */
260     if (!TEST_ptr(gettables = EVP_KDF_CTX_gettable_params(kctx))
261         || !TEST_ptr(p = OSSL_PARAM_locate_const(gettables, OSSL_KDF_PARAM_SIZE)))
262         goto err;
263 
264     /* Get OSSL_KDF_PARAM_SIZE as a size_t */
265     params_get[0] = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_SIZE, &sz);
266     params_get[1] = OSSL_PARAM_construct_end();
267     if (has_digest) {
268         if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 1)
269             || !TEST_size_t_eq(sz, expand_only ? SHA256_DIGEST_LENGTH : SIZE_MAX))
270             goto err;
271     } else {
272         if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), 0))
273             goto err;
274     }
275 
276     /* Get params returns -2 if an unsupported parameter is requested */
277     params_get[0] = OSSL_PARAM_construct_end();
278     if (!TEST_int_eq(EVP_KDF_CTX_get_params(kctx, params_get), -2))
279         goto err;
280     ret = 1;
281 err:
282     EVP_KDF_CTX_free(kctx);
283     OPENSSL_free(params);
284     return ret;
285 }
286 
test_kdf_hkdf_gettables(void)287 static int test_kdf_hkdf_gettables(void)
288 {
289     return do_kdf_hkdf_gettables(0, 1);
290 }
291 
test_kdf_hkdf_gettables_expandonly(void)292 static int test_kdf_hkdf_gettables_expandonly(void)
293 {
294     return do_kdf_hkdf_gettables(1, 1);
295 }
296 
test_kdf_hkdf_gettables_no_digest(void)297 static int test_kdf_hkdf_gettables_no_digest(void)
298 {
299     return do_kdf_hkdf_gettables(1, 0);
300 }
301 
test_kdf_hkdf_invalid_digest(void)302 static int test_kdf_hkdf_invalid_digest(void)
303 {
304     int ret;
305     EVP_KDF_CTX *kctx = NULL;
306     OSSL_PARAM *params;
307 
308     params = construct_hkdf_params("blah", "secret", 6, "salt", "label");
309 
310     ret = TEST_ptr(params)
311         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
312         && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
313 
314     EVP_KDF_CTX_free(kctx);
315     OPENSSL_free(params);
316     return ret;
317 }
318 
test_kdf_hkdf_derive_set_params_fail(void)319 static int test_kdf_hkdf_derive_set_params_fail(void)
320 {
321     int ret = 0, i = 0;
322     EVP_KDF_CTX *kctx = NULL;
323     OSSL_PARAM params[2];
324     unsigned char out[10];
325 
326     if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
327         goto end;
328     /*
329      * Set the wrong type for the digest so that it causes a failure
330      * inside kdf_hkdf_derive() when kdf_hkdf_set_ctx_params() is called
331      */
332     params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_DIGEST, &i);
333     params[1] = OSSL_PARAM_construct_end();
334     if (!TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), params), 0))
335         goto end;
336     ret = 1;
337 end:
338     EVP_KDF_CTX_free(kctx);
339     return ret;
340 }
341 
test_kdf_hkdf_set_invalid_mode(void)342 static int test_kdf_hkdf_set_invalid_mode(void)
343 {
344     int ret = 0, bad_mode = 100;
345     EVP_KDF_CTX *kctx = NULL;
346     OSSL_PARAM params[2];
347 
348     if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
349         goto end;
350     params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE,
351                                                  "BADMODE", 0);
352     params[1] = OSSL_PARAM_construct_end();
353     if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
354         goto end;
355 
356     params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &bad_mode);
357     if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
358         goto end;
359 
360     ret = 1;
361 end:
362     EVP_KDF_CTX_free(kctx);
363     return ret;
364 }
365 
do_kdf_hkdf_set_invalid_param(const char * key,int type)366 static int do_kdf_hkdf_set_invalid_param(const char *key, int type)
367 {
368     int ret = 0;
369     EVP_KDF_CTX *kctx = NULL;
370     OSSL_PARAM params[2];
371     unsigned char buf[2];
372 
373     if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF)))
374         goto end;
375     /* Set the wrong type for the key so that it causes a failure */
376     if (type == OSSL_PARAM_UTF8_STRING)
377         params[0] = OSSL_PARAM_construct_utf8_string(key, "BAD", 0);
378     else
379         params[0] = OSSL_PARAM_construct_octet_string(key, buf, sizeof(buf));
380     params[1] = OSSL_PARAM_construct_end();
381     if (!TEST_int_eq(EVP_KDF_CTX_set_params(kctx, params), 0))
382         goto end;
383 
384     ret = 1;
385 end:
386     EVP_KDF_CTX_free(kctx);
387     return ret;
388 }
389 
test_kdf_hkdf_set_ctx_param_fail(void)390 static int test_kdf_hkdf_set_ctx_param_fail(void)
391 {
392     return do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_MODE,
393                                          OSSL_PARAM_OCTET_STRING)
394            && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_KEY,
395                                             OSSL_PARAM_UTF8_STRING)
396            && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_SALT,
397                                             OSSL_PARAM_UTF8_STRING)
398            && do_kdf_hkdf_set_invalid_param(OSSL_KDF_PARAM_INFO,
399                                             OSSL_PARAM_UTF8_STRING);
400 }
401 
test_kdf_hkdf_zero_output_size(void)402 static int test_kdf_hkdf_zero_output_size(void)
403 {
404     int ret;
405     EVP_KDF_CTX *kctx = NULL;
406     unsigned char out[10];
407     OSSL_PARAM *params;
408 
409     params = construct_hkdf_params("sha256", "secret", 6, "salt", "label");
410 
411     /* Negative test - derive should fail */
412     ret = TEST_ptr(params)
413         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
414         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
415         && TEST_int_eq(EVP_KDF_derive(kctx, out, 0, NULL), 0);
416 
417     EVP_KDF_CTX_free(kctx);
418     OPENSSL_free(params);
419     return ret;
420 }
421 
test_kdf_hkdf_empty_key(void)422 static int test_kdf_hkdf_empty_key(void)
423 {
424     int ret;
425     EVP_KDF_CTX *kctx = NULL;
426     unsigned char out[10];
427     OSSL_PARAM *params;
428 
429     params = construct_hkdf_params("sha256", "", 0, "salt", "label");
430 
431     ret = TEST_ptr(params)
432         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
433         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
434 
435     EVP_KDF_CTX_free(kctx);
436     OPENSSL_free(params);
437     return ret;
438 }
439 
test_kdf_hkdf_1byte_key(void)440 static int test_kdf_hkdf_1byte_key(void)
441 {
442     int ret;
443     EVP_KDF_CTX *kctx = NULL;
444     unsigned char out[10];
445     OSSL_PARAM *params;
446 
447     params = construct_hkdf_params("sha256", "1", 1, "salt", "label");
448 
449     ret = TEST_ptr(params)
450         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
451         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
452 
453     EVP_KDF_CTX_free(kctx);
454     OPENSSL_free(params);
455     return ret;
456 }
457 
test_kdf_hkdf_empty_salt(void)458 static int test_kdf_hkdf_empty_salt(void)
459 {
460     int ret;
461     EVP_KDF_CTX *kctx = NULL;
462     unsigned char out[10];
463     OSSL_PARAM *params;
464 
465     params = construct_hkdf_params("sha256", "secret", 6, "", "label");
466 
467     ret = TEST_ptr(params)
468         && TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_HKDF))
469         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0);
470 
471     EVP_KDF_CTX_free(kctx);
472     OPENSSL_free(params);
473     return ret;
474 }
475 
construct_pbkdf1_params(char * pass,char * digest,char * salt,unsigned int * iter)476 static OSSL_PARAM *construct_pbkdf1_params(char *pass, char *digest, char *salt,
477     unsigned int *iter)
478 {
479     OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 5);
480     OSSL_PARAM *p = params;
481 
482     if (params == NULL)
483         return NULL;
484 
485     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
486                                              (unsigned char *)pass, strlen(pass));
487     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
488                                              (unsigned char *)salt, strlen(salt));
489     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
490     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
491                                              digest, 0);
492     *p = OSSL_PARAM_construct_end();
493 
494     return params;
495 }
496 
test_kdf_pbkdf1(void)497 static int test_kdf_pbkdf1(void)
498 {
499     int ret = 0;
500     EVP_KDF_CTX *kctx = NULL;
501     unsigned char out[25];
502     unsigned int iterations = 4096;
503     OSSL_LIB_CTX *libctx = NULL;
504     OSSL_PARAM *params = NULL;
505     OSSL_PROVIDER *legacyprov = NULL;
506     OSSL_PROVIDER *defprov = NULL;
507     const unsigned char expected[sizeof(out)] = {
508         0xfb, 0x83, 0x4d, 0x36, 0x6d, 0xbc, 0x53, 0x87, 0x35, 0x1b, 0x34, 0x75,
509         0x95, 0x88, 0x32, 0x4f, 0x3e, 0x82, 0x81, 0x01, 0x21, 0x93, 0x64, 0x00,
510         0xcc
511     };
512 
513     if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
514         goto err;
515 
516     /* PBKDF1 only available in the legacy provider */
517     legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
518     if (legacyprov == NULL) {
519         OSSL_LIB_CTX_free(libctx);
520         return TEST_skip("PBKDF1 only available in legacy provider");
521     }
522 
523     if (!TEST_ptr(defprov = OSSL_PROVIDER_load(libctx, "default")))
524         goto err;
525 
526     params = construct_pbkdf1_params("passwordPASSWORDpassword", "sha256",
527                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
528                                      &iterations);
529 
530     if (!TEST_ptr(params)
531         || !TEST_ptr(kctx = get_kdfbyname_libctx(libctx, OSSL_KDF_NAME_PBKDF1))
532         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
533         || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
534         || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
535         goto err;
536 
537     ret = 1;
538 err:
539     EVP_KDF_CTX_free(kctx);
540     OPENSSL_free(params);
541     OSSL_PROVIDER_unload(defprov);
542     OSSL_PROVIDER_unload(legacyprov);
543     OSSL_LIB_CTX_free(libctx);
544     return ret;
545 }
546 
construct_pbkdf2_params(char * pass,char * digest,char * salt,unsigned int * iter,int * mode)547 static OSSL_PARAM *construct_pbkdf2_params(char *pass, char *digest, char *salt,
548     unsigned int *iter, int *mode)
549 {
550     OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 6);
551     OSSL_PARAM *p = params;
552 
553     if (params == NULL)
554         return NULL;
555 
556     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
557                                              (unsigned char *)pass, strlen(pass));
558     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
559                                              (unsigned char *)salt, strlen(salt));
560     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_ITER, iter);
561     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
562                                              digest, 0);
563     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, mode);
564     *p = OSSL_PARAM_construct_end();
565 
566     return params;
567 }
568 
test_kdf_pbkdf2(void)569 static int test_kdf_pbkdf2(void)
570 {
571     int ret = 0;
572     EVP_KDF_CTX *kctx = NULL;
573     unsigned char out[25];
574     unsigned int iterations = 4096;
575     int mode = 0;
576     OSSL_PARAM *params;
577     const unsigned char expected[sizeof(out)] = {
578         0x34, 0x8c, 0x89, 0xdb, 0xcb, 0xd3, 0x2b, 0x2f,
579         0x32, 0xd8, 0x14, 0xb8, 0x11, 0x6e, 0x84, 0xcf,
580         0x2b, 0x17, 0x34, 0x7e, 0xbc, 0x18, 0x00, 0x18,
581         0x1c
582     };
583 
584     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
585                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
586                                      &iterations, &mode);
587 
588     if (!TEST_ptr(params)
589         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
590         || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
591         || !TEST_mem_eq(out, sizeof(out), expected, sizeof(expected)))
592         goto err;
593 
594     ret = 1;
595 err:
596     EVP_KDF_CTX_free(kctx);
597     OPENSSL_free(params);
598     return ret;
599 }
600 
test_kdf_pbkdf2_small_output(void)601 static int test_kdf_pbkdf2_small_output(void)
602 {
603     int ret = 0;
604     EVP_KDF_CTX *kctx = NULL;
605     unsigned char out[25];
606     unsigned int iterations = 4096;
607     int mode = 0;
608     OSSL_PARAM *params;
609 
610     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
611                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
612                                      &iterations, &mode);
613 
614     if (!TEST_ptr(params)
615         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
616         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
617         /* A key length that is too small should fail */
618         || !TEST_int_eq(EVP_KDF_derive(kctx, out, 112 / 8 - 1, NULL), 0))
619         goto err;
620 
621     ret = 1;
622 err:
623     EVP_KDF_CTX_free(kctx);
624     OPENSSL_free(params);
625     return ret;
626 }
627 
test_kdf_pbkdf2_large_output(void)628 static int test_kdf_pbkdf2_large_output(void)
629 {
630     int ret = 0;
631     EVP_KDF_CTX *kctx = NULL;
632     unsigned char out[25];
633     size_t len = 0;
634     unsigned int iterations = 4096;
635     int mode = 0;
636     OSSL_PARAM *params;
637 
638     if (sizeof(len) > 32)
639         len = SIZE_MAX;
640 
641     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
642                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
643                                      &iterations, &mode);
644 
645     if (!TEST_ptr(params)
646         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
647         /* A key length that is too large should fail */
648         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
649         || (len != 0 && !TEST_int_eq(EVP_KDF_derive(kctx, out, len, NULL), 0)))
650         goto err;
651 
652     ret = 1;
653 err:
654     EVP_KDF_CTX_free(kctx);
655     OPENSSL_free(params);
656     return ret;
657 }
658 
test_kdf_pbkdf2_small_salt(void)659 static int test_kdf_pbkdf2_small_salt(void)
660 {
661     int ret = 0;
662     EVP_KDF_CTX *kctx = NULL;
663     unsigned int iterations = 4096;
664     int mode = 0;
665     OSSL_PARAM *params;
666 
667     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
668                                      "saltSALT",
669                                      &iterations, &mode);
670 
671     if (!TEST_ptr(params)
672         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
673         /* A salt that is too small should fail */
674         || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
675         goto err;
676 
677     ret = 1;
678 err:
679     EVP_KDF_CTX_free(kctx);
680     OPENSSL_free(params);
681     return ret;
682 }
683 
test_kdf_pbkdf2_small_iterations(void)684 static int test_kdf_pbkdf2_small_iterations(void)
685 {
686     int ret = 0;
687     EVP_KDF_CTX *kctx = NULL;
688     unsigned int iterations = 1;
689     int mode = 0;
690     OSSL_PARAM *params;
691 
692     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
693                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
694                                      &iterations, &mode);
695 
696     if (!TEST_ptr(params)
697         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
698         /* An iteration count that is too small should fail */
699         || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
700         goto err;
701 
702     ret = 1;
703 err:
704     EVP_KDF_CTX_free(kctx);
705     OPENSSL_free(params);
706     return ret;
707 }
708 
test_kdf_pbkdf2_small_salt_pkcs5(void)709 static int test_kdf_pbkdf2_small_salt_pkcs5(void)
710 {
711     int ret = 0;
712     EVP_KDF_CTX *kctx = NULL;
713     unsigned char out[25];
714     unsigned int iterations = 4096;
715     int mode = 1;
716     OSSL_PARAM *params;
717     OSSL_PARAM mode_params[2];
718 
719     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
720                                      "saltSALT",
721                                      &iterations, &mode);
722 
723     if (!TEST_ptr(params)
724         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
725         /* A salt that is too small should pass in pkcs5 mode */
726         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
727         || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
728         goto err;
729 
730     mode = 0;
731     mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
732     mode_params[1] = OSSL_PARAM_construct_end();
733 
734     /* If the "pkcs5" mode is disabled then the derive will now fail */
735     if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
736         || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
737         goto err;
738 
739     ret = 1;
740 err:
741     EVP_KDF_CTX_free(kctx);
742     OPENSSL_free(params);
743     return ret;
744 }
745 
test_kdf_pbkdf2_small_iterations_pkcs5(void)746 static int test_kdf_pbkdf2_small_iterations_pkcs5(void)
747 {
748     int ret = 0;
749     EVP_KDF_CTX *kctx = NULL;
750     unsigned char out[25];
751     unsigned int iterations = 1;
752     int mode = 1;
753     OSSL_PARAM *params;
754     OSSL_PARAM mode_params[2];
755 
756     params = construct_pbkdf2_params("passwordPASSWORDpassword", "sha256",
757                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
758                                      &iterations, &mode);
759 
760     if (!TEST_ptr(params)
761         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
762         /* An iteration count that is too small will pass in pkcs5 mode */
763         || !TEST_true(EVP_KDF_CTX_set_params(kctx, params))
764         || !TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
765         goto err;
766 
767     mode = 0;
768     mode_params[0] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &mode);
769     mode_params[1] = OSSL_PARAM_construct_end();
770 
771     /* If the "pkcs5" mode is disabled then the derive will now fail */
772     if (!TEST_true(EVP_KDF_CTX_set_params(kctx, mode_params))
773         || !TEST_int_eq(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0))
774         goto err;
775 
776     ret = 1;
777 err:
778     EVP_KDF_CTX_free(kctx);
779     OPENSSL_free(params);
780     return ret;
781 }
782 
test_kdf_pbkdf2_invalid_digest(void)783 static int test_kdf_pbkdf2_invalid_digest(void)
784 {
785     int ret = 0;
786     EVP_KDF_CTX *kctx = NULL;
787     unsigned int iterations = 4096;
788     int mode = 0;
789     OSSL_PARAM *params;
790 
791     params = construct_pbkdf2_params("passwordPASSWORDpassword", "blah",
792                                      "saltSALTsaltSALTsaltSALTsaltSALTsalt",
793                                      &iterations, &mode);
794 
795     if (!TEST_ptr(params)
796         || !TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_PBKDF2))
797         /* Unknown digest should fail */
798         || !TEST_false(EVP_KDF_CTX_set_params(kctx, params)))
799         goto err;
800 
801     ret = 1;
802 err:
803     EVP_KDF_CTX_free(kctx);
804     OPENSSL_free(params);
805     return ret;
806 }
807 
808 #ifndef OPENSSL_NO_SCRYPT
test_kdf_scrypt(void)809 static int test_kdf_scrypt(void)
810 {
811     int ret;
812     EVP_KDF_CTX *kctx;
813     OSSL_PARAM params[7], *p = params;
814     unsigned char out[64];
815     unsigned int nu = 1024, ru = 8, pu = 16, maxmem = 16;
816     static const unsigned char expected[sizeof(out)] = {
817         0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00,
818         0x78, 0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe,
819         0x7c, 0x6a, 0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30,
820         0xe7, 0x73, 0x76, 0x63, 0x4b, 0x37, 0x31, 0x62,
821         0x2e, 0xaf, 0x30, 0xd9, 0x2e, 0x22, 0xa3, 0x88,
822         0x6f, 0xf1, 0x09, 0x27, 0x9d, 0x98, 0x30, 0xda,
823         0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83, 0xee, 0x6d,
824         0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06, 0x40
825     };
826 
827     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
828                                              (char *)"password", 8);
829     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
830                                              (char *)"NaCl", 4);
831     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_N, &nu);
832     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_R, &ru);
833     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_P, &pu);
834     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
835     *p = OSSL_PARAM_construct_end();
836 
837     ret =
838         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT))
839         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
840         /* failure test *//*
841         && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)*/
842         && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
843         && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1))
844         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
845         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
846 
847     EVP_KDF_CTX_free(kctx);
848     return ret;
849 }
850 #endif /* OPENSSL_NO_SCRYPT */
851 
test_kdf_ss_hash(void)852 static int test_kdf_ss_hash(void)
853 {
854     int ret;
855     EVP_KDF_CTX *kctx;
856     OSSL_PARAM params[4], *p = params;
857     unsigned char out[14];
858     static unsigned char z[] = {
859         0x6d,0xbd,0xc2,0x3f,0x04,0x54,0x88,0xe4,0x06,0x27,0x57,0xb0,0x6b,0x9e,
860         0xba,0xe1,0x83,0xfc,0x5a,0x59,0x46,0xd8,0x0d,0xb9,0x3f,0xec,0x6f,0x62,
861         0xec,0x07,0xe3,0x72,0x7f,0x01,0x26,0xae,0xd1,0x2c,0xe4,0xb2,0x62,0xf4,
862         0x7d,0x48,0xd5,0x42,0x87,0xf8,0x1d,0x47,0x4c,0x7c,0x3b,0x18,0x50,0xe9
863     };
864     static unsigned char other[] = {
865         0xa1,0xb2,0xc3,0xd4,0xe5,0x43,0x41,0x56,0x53,0x69,0x64,0x3c,0x83,0x2e,
866         0x98,0x49,0xdc,0xdb,0xa7,0x1e,0x9a,0x31,0x39,0xe6,0x06,0xe0,0x95,0xde,
867         0x3c,0x26,0x4a,0x66,0xe9,0x8a,0x16,0x58,0x54,0xcd,0x07,0x98,0x9b,0x1e,
868         0xe0,0xec,0x3f,0x8d,0xbe
869     };
870     static const unsigned char expected[sizeof(out)] = {
871         0xa4,0x62,0xde,0x16,0xa8,0x9d,0xe8,0x46,0x6e,0xf5,0x46,0x0b,0x47,0xb8
872     };
873 
874     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
875                                             (char *)"sha224", 0);
876     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
877     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
878                                              sizeof(other));
879     *p = OSSL_PARAM_construct_end();
880 
881     ret =
882         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
883         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
884         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
885 
886     EVP_KDF_CTX_free(kctx);
887     return ret;
888 }
889 
test_kdf_x963(void)890 static int test_kdf_x963(void)
891 {
892     int ret;
893     EVP_KDF_CTX *kctx;
894     OSSL_PARAM params[4], *p = params;
895     unsigned char out[1024 / 8];
896     /*
897      * Test data from https://csrc.nist.gov/CSRC/media/Projects/
898      *  Cryptographic-Algorithm-Validation-Program/documents/components/
899      *  800-135testvectors/ansx963_2001.zip
900      */
901     static unsigned char z[] = {
902         0x00, 0xaa, 0x5b, 0xb7, 0x9b, 0x33, 0xe3, 0x89, 0xfa, 0x58, 0xce, 0xad,
903         0xc0, 0x47, 0x19, 0x7f, 0x14, 0xe7, 0x37, 0x12, 0xf4, 0x52, 0xca, 0xa9,
904         0xfc, 0x4c, 0x9a, 0xdb, 0x36, 0x93, 0x48, 0xb8, 0x15, 0x07, 0x39, 0x2f,
905         0x1a, 0x86, 0xdd, 0xfd, 0xb7, 0xc4, 0xff, 0x82, 0x31, 0xc4, 0xbd, 0x0f,
906         0x44, 0xe4, 0x4a, 0x1b, 0x55, 0xb1, 0x40, 0x47, 0x47, 0xa9, 0xe2, 0xe7,
907         0x53, 0xf5, 0x5e, 0xf0, 0x5a, 0x2d
908     };
909     static unsigned char shared[] = {
910         0xe3, 0xb5, 0xb4, 0xc1, 0xb0, 0xd5, 0xcf, 0x1d, 0x2b, 0x3a, 0x2f, 0x99,
911         0x37, 0x89, 0x5d, 0x31
912     };
913     static const unsigned char expected[sizeof(out)] = {
914         0x44, 0x63, 0xf8, 0x69, 0xf3, 0xcc, 0x18, 0x76, 0x9b, 0x52, 0x26, 0x4b,
915         0x01, 0x12, 0xb5, 0x85, 0x8f, 0x7a, 0xd3, 0x2a, 0x5a, 0x2d, 0x96, 0xd8,
916         0xcf, 0xfa, 0xbf, 0x7f, 0xa7, 0x33, 0x63, 0x3d, 0x6e, 0x4d, 0xd2, 0xa5,
917         0x99, 0xac, 0xce, 0xb3, 0xea, 0x54, 0xa6, 0x21, 0x7c, 0xe0, 0xb5, 0x0e,
918         0xef, 0x4f, 0x6b, 0x40, 0xa5, 0xc3, 0x02, 0x50, 0xa5, 0xa8, 0xee, 0xee,
919         0x20, 0x80, 0x02, 0x26, 0x70, 0x89, 0xdb, 0xf3, 0x51, 0xf3, 0xf5, 0x02,
920         0x2a, 0xa9, 0x63, 0x8b, 0xf1, 0xee, 0x41, 0x9d, 0xea, 0x9c, 0x4f, 0xf7,
921         0x45, 0xa2, 0x5a, 0xc2, 0x7b, 0xda, 0x33, 0xca, 0x08, 0xbd, 0x56, 0xdd,
922         0x1a, 0x59, 0xb4, 0x10, 0x6c, 0xf2, 0xdb, 0xbc, 0x0a, 0xb2, 0xaa, 0x8e,
923         0x2e, 0xfa, 0x7b, 0x17, 0x90, 0x2d, 0x34, 0x27, 0x69, 0x51, 0xce, 0xcc,
924         0xab, 0x87, 0xf9, 0x66, 0x1c, 0x3e, 0x88, 0x16
925     };
926 
927     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
928                                             (char *)"sha512", 0);
929     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
930     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, shared,
931                                              sizeof(shared));
932     *p = OSSL_PARAM_construct_end();
933 
934     ret =
935         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X963KDF))
936         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
937         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
938 
939     EVP_KDF_CTX_free(kctx);
940     return ret;
941 }
942 
943 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
944 /*
945  * KBKDF test vectors from RFC 6803 (Camellia Encryption for Kerberos 5)
946  * section 10.
947  */
test_kdf_kbkdf_6803_128(void)948 static int test_kdf_kbkdf_6803_128(void)
949 {
950     int ret = 0, i, p;
951     EVP_KDF_CTX *kctx;
952     OSSL_PARAM params[7];
953     static unsigned char input_key[] = {
954         0x57, 0xD0, 0x29, 0x72, 0x98, 0xFF, 0xD9, 0xD3,
955         0x5D, 0xE5, 0xA4, 0x7F, 0xB4, 0xBD, 0xE2, 0x4B,
956     };
957     static unsigned char constants[][5] = {
958         { 0x00, 0x00, 0x00, 0x02, 0x99 },
959         { 0x00, 0x00, 0x00, 0x02, 0xaa },
960         { 0x00, 0x00, 0x00, 0x02, 0x55 },
961     };
962     static unsigned char outputs[][16] = {
963         {0xD1, 0x55, 0x77, 0x5A, 0x20, 0x9D, 0x05, 0xF0,
964          0x2B, 0x38, 0xD4, 0x2A, 0x38, 0x9E, 0x5A, 0x56},
965         {0x64, 0xDF, 0x83, 0xF8, 0x5A, 0x53, 0x2F, 0x17,
966          0x57, 0x7D, 0x8C, 0x37, 0x03, 0x57, 0x96, 0xAB},
967         {0x3E, 0x4F, 0xBD, 0xF3, 0x0F, 0xB8, 0x25, 0x9C,
968          0x42, 0x5C, 0xB6, 0xC9, 0x6F, 0x1F, 0x46, 0x35}
969     };
970     static unsigned char iv[16] = { 0 };
971     unsigned char result[16] = { 0 };
972 
973     for (i = 0; i < 3; i++) {
974         p = 0;
975         params[p++] = OSSL_PARAM_construct_utf8_string(
976             OSSL_KDF_PARAM_CIPHER, "CAMELLIA-128-CBC", 0);
977         params[p++] = OSSL_PARAM_construct_utf8_string(
978             OSSL_KDF_PARAM_MAC, "CMAC", 0);
979         params[p++] = OSSL_PARAM_construct_utf8_string(
980             OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
981         params[p++] = OSSL_PARAM_construct_octet_string(
982             OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
983         params[p++] = OSSL_PARAM_construct_octet_string(
984             OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
985         params[p++] = OSSL_PARAM_construct_octet_string(
986             OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
987         params[p] = OSSL_PARAM_construct_end();
988 
989         kctx = get_kdfbyname("KBKDF");
990         ret = TEST_ptr(kctx)
991             && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
992                                           params), 0)
993             && TEST_mem_eq(result, sizeof(result), outputs[i],
994                            sizeof(outputs[i]));
995         EVP_KDF_CTX_free(kctx);
996         if (ret != 1)
997             return ret;
998     }
999 
1000     return ret;
1001 }
1002 
test_kdf_kbkdf_6803_256(void)1003 static int test_kdf_kbkdf_6803_256(void)
1004 {
1005     int ret = 0, i, p;
1006     EVP_KDF_CTX *kctx;
1007     OSSL_PARAM params[7];
1008     static unsigned char input_key[] = {
1009         0xB9, 0xD6, 0x82, 0x8B, 0x20, 0x56, 0xB7, 0xBE,
1010         0x65, 0x6D, 0x88, 0xA1, 0x23, 0xB1, 0xFA, 0xC6,
1011         0x82, 0x14, 0xAC, 0x2B, 0x72, 0x7E, 0xCF, 0x5F,
1012         0x69, 0xAF, 0xE0, 0xC4, 0xDF, 0x2A, 0x6D, 0x2C,
1013     };
1014     static unsigned char constants[][5] = {
1015         { 0x00, 0x00, 0x00, 0x02, 0x99 },
1016         { 0x00, 0x00, 0x00, 0x02, 0xaa },
1017         { 0x00, 0x00, 0x00, 0x02, 0x55 },
1018     };
1019     static unsigned char outputs[][32] = {
1020         {0xE4, 0x67, 0xF9, 0xA9, 0x55, 0x2B, 0xC7, 0xD3,
1021          0x15, 0x5A, 0x62, 0x20, 0xAF, 0x9C, 0x19, 0x22,
1022          0x0E, 0xEE, 0xD4, 0xFF, 0x78, 0xB0, 0xD1, 0xE6,
1023          0xA1, 0x54, 0x49, 0x91, 0x46, 0x1A, 0x9E, 0x50,
1024         },
1025         {0x41, 0x2A, 0xEF, 0xC3, 0x62, 0xA7, 0x28, 0x5F,
1026          0xC3, 0x96, 0x6C, 0x6A, 0x51, 0x81, 0xE7, 0x60,
1027          0x5A, 0xE6, 0x75, 0x23, 0x5B, 0x6D, 0x54, 0x9F,
1028          0xBF, 0xC9, 0xAB, 0x66, 0x30, 0xA4, 0xC6, 0x04,
1029         },
1030         {0xFA, 0x62, 0x4F, 0xA0, 0xE5, 0x23, 0x99, 0x3F,
1031          0xA3, 0x88, 0xAE, 0xFD, 0xC6, 0x7E, 0x67, 0xEB,
1032          0xCD, 0x8C, 0x08, 0xE8, 0xA0, 0x24, 0x6B, 0x1D,
1033          0x73, 0xB0, 0xD1, 0xDD, 0x9F, 0xC5, 0x82, 0xB0,
1034         },
1035     };
1036     static unsigned char iv[16] = { 0 };
1037     unsigned char result[32] = { 0 };
1038 
1039     for (i = 0; i < 3; i++) {
1040         p = 0;
1041         params[p++] = OSSL_PARAM_construct_utf8_string(
1042             OSSL_KDF_PARAM_CIPHER, "CAMELLIA-256-CBC", 0);
1043         params[p++] = OSSL_PARAM_construct_utf8_string(
1044             OSSL_KDF_PARAM_MAC, "CMAC", 0);
1045         params[p++] = OSSL_PARAM_construct_utf8_string(
1046             OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
1047         params[p++] = OSSL_PARAM_construct_octet_string(
1048             OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1049         params[p++] = OSSL_PARAM_construct_octet_string(
1050             OSSL_KDF_PARAM_SALT, constants[i], sizeof(constants[i]));
1051         params[p++] = OSSL_PARAM_construct_octet_string(
1052             OSSL_KDF_PARAM_SEED, iv, sizeof(iv));
1053         params[p] = OSSL_PARAM_construct_end();
1054 
1055         kctx = get_kdfbyname("KBKDF");
1056         ret = TEST_ptr(kctx)
1057             && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result),
1058                                           params), 0)
1059             && TEST_mem_eq(result, sizeof(result), outputs[i],
1060                            sizeof(outputs[i]));
1061         EVP_KDF_CTX_free(kctx);
1062         if (ret != 1)
1063             return ret;
1064     }
1065 
1066     return ret;
1067 }
1068 #endif
1069 
construct_kbkdf_params(char * digest,char * mac,unsigned char * key,size_t keylen,char * salt,char * info)1070 static OSSL_PARAM *construct_kbkdf_params(char *digest, char *mac, unsigned char *key,
1071     size_t keylen, char *salt, char *info)
1072 {
1073     OSSL_PARAM *params = OPENSSL_malloc(sizeof(OSSL_PARAM) * 7);
1074     OSSL_PARAM *p = params;
1075 
1076     if (params == NULL)
1077         return NULL;
1078 
1079     *p++ = OSSL_PARAM_construct_utf8_string(
1080         OSSL_KDF_PARAM_DIGEST, digest, 0);
1081     *p++ = OSSL_PARAM_construct_utf8_string(
1082         OSSL_KDF_PARAM_MAC, mac, 0);
1083     *p++ = OSSL_PARAM_construct_utf8_string(
1084         OSSL_KDF_PARAM_MODE, "COUNTER", 0);
1085     *p++ = OSSL_PARAM_construct_octet_string(
1086         OSSL_KDF_PARAM_KEY, key, keylen);
1087     *p++ = OSSL_PARAM_construct_octet_string(
1088         OSSL_KDF_PARAM_SALT, salt, strlen(salt));
1089     *p++ = OSSL_PARAM_construct_octet_string(
1090         OSSL_KDF_PARAM_INFO, info, strlen(info));
1091     *p = OSSL_PARAM_construct_end();
1092 
1093     return params;
1094 }
1095 
test_kdf_kbkdf_invalid_digest(void)1096 static int test_kdf_kbkdf_invalid_digest(void)
1097 {
1098     int ret;
1099     EVP_KDF_CTX *kctx;
1100     OSSL_PARAM *params;
1101 
1102     static unsigned char key[] = {0x01};
1103 
1104     params = construct_kbkdf_params("blah", "HMAC", key, 1, "prf", "test");
1105     if (!TEST_ptr(params))
1106         return 0;
1107 
1108     /* Negative test case - set_params should fail */
1109     kctx = get_kdfbyname("KBKDF");
1110     ret = TEST_ptr(kctx)
1111         && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1112 
1113     EVP_KDF_CTX_free(kctx);
1114     OPENSSL_free(params);
1115     return ret;
1116 }
1117 
test_kdf_kbkdf_invalid_mac(void)1118 static int test_kdf_kbkdf_invalid_mac(void)
1119 {
1120     int ret;
1121     EVP_KDF_CTX *kctx;
1122     OSSL_PARAM *params;
1123 
1124     static unsigned char key[] = {0x01};
1125 
1126     params = construct_kbkdf_params("sha256", "blah", key, 1, "prf", "test");
1127     if (!TEST_ptr(params))
1128         return 0;
1129 
1130     /* Negative test case - set_params should fail */
1131     kctx = get_kdfbyname("KBKDF");
1132     ret = TEST_ptr(kctx)
1133         && TEST_false(EVP_KDF_CTX_set_params(kctx, params));
1134 
1135     EVP_KDF_CTX_free(kctx);
1136     OPENSSL_free(params);
1137     return ret;
1138 }
1139 
test_kdf_kbkdf_empty_key(void)1140 static int test_kdf_kbkdf_empty_key(void)
1141 {
1142     int ret;
1143     EVP_KDF_CTX *kctx;
1144     OSSL_PARAM *params;
1145 
1146     static unsigned char key[] = {0x01};
1147     unsigned char result[32] = { 0 };
1148 
1149     params = construct_kbkdf_params("sha256", "HMAC", key, 0, "prf", "test");
1150     if (!TEST_ptr(params))
1151         return 0;
1152 
1153     /* Negative test case - derive should fail */
1154     kctx = get_kdfbyname("KBKDF");
1155     ret = TEST_ptr(kctx)
1156         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1157         && TEST_int_eq(EVP_KDF_derive(kctx, result, sizeof(result), NULL), 0);
1158 
1159     EVP_KDF_CTX_free(kctx);
1160     OPENSSL_free(params);
1161     return ret;
1162 }
1163 
test_kdf_kbkdf_1byte_key(void)1164 static int test_kdf_kbkdf_1byte_key(void)
1165 {
1166     int ret;
1167     EVP_KDF_CTX *kctx;
1168     OSSL_PARAM *params;
1169 
1170     static unsigned char key[] = {0x01};
1171     unsigned char result[32] = { 0 };
1172 
1173     params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test");
1174     if (!TEST_ptr(params))
1175         return 0;
1176 
1177     kctx = get_kdfbyname("KBKDF");
1178     ret = TEST_ptr(kctx)
1179         && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0);
1180 
1181     EVP_KDF_CTX_free(kctx);
1182     OPENSSL_free(params);
1183     return ret;
1184 }
1185 
test_kdf_kbkdf_zero_output_size(void)1186 static int test_kdf_kbkdf_zero_output_size(void)
1187 {
1188     int ret;
1189     EVP_KDF_CTX *kctx;
1190     OSSL_PARAM *params;
1191 
1192     static unsigned char key[] = {0x01};
1193     unsigned char result[32] = { 0 };
1194 
1195     params = construct_kbkdf_params("sha256", "HMAC", key, 1, "prf", "test");
1196     if (!TEST_ptr(params))
1197         return 0;
1198 
1199     /* Negative test case - derive should fail */
1200     kctx = get_kdfbyname("KBKDF");
1201     ret = TEST_ptr(kctx)
1202         && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
1203         && TEST_int_eq(EVP_KDF_derive(kctx, result, 0, NULL), 0);
1204 
1205     EVP_KDF_CTX_free(kctx);
1206     OPENSSL_free(params);
1207     return ret;
1208 }
1209 
1210 /* Two test vectors from RFC 8009 (AES Encryption with HMAC-SHA2 for Kerberos
1211  * 5) appendix A. */
test_kdf_kbkdf_8009_prf1(void)1212 static int test_kdf_kbkdf_8009_prf1(void)
1213 {
1214     int ret, i = 0;
1215     EVP_KDF_CTX *kctx;
1216     OSSL_PARAM params[6];
1217     char *label = "prf", *digest = "sha256", *prf_input = "test",
1218         *mac = "HMAC";
1219     static unsigned char input_key[] = {
1220         0x37, 0x05, 0xD9, 0x60, 0x80, 0xC1, 0x77, 0x28,
1221         0xA0, 0xE8, 0x00, 0xEA, 0xB6, 0xE0, 0xD2, 0x3C,
1222     };
1223     static unsigned char output[] = {
1224         0x9D, 0x18, 0x86, 0x16, 0xF6, 0x38, 0x52, 0xFE,
1225         0x86, 0x91, 0x5B, 0xB8, 0x40, 0xB4, 0xA8, 0x86,
1226         0xFF, 0x3E, 0x6B, 0xB0, 0xF8, 0x19, 0xB4, 0x9B,
1227         0x89, 0x33, 0x93, 0xD3, 0x93, 0x85, 0x42, 0x95,
1228     };
1229     unsigned char result[sizeof(output)] = { 0 };
1230 
1231     params[i++] = OSSL_PARAM_construct_utf8_string(
1232         OSSL_KDF_PARAM_DIGEST, digest, 0);
1233     params[i++] = OSSL_PARAM_construct_utf8_string(
1234         OSSL_KDF_PARAM_MAC, mac, 0);
1235     params[i++] = OSSL_PARAM_construct_octet_string(
1236         OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1237     params[i++] = OSSL_PARAM_construct_octet_string(
1238         OSSL_KDF_PARAM_SALT, label, strlen(label));
1239     params[i++] = OSSL_PARAM_construct_octet_string(
1240         OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1241     params[i] = OSSL_PARAM_construct_end();
1242 
1243     kctx = get_kdfbyname("KBKDF");
1244     ret = TEST_ptr(kctx)
1245         && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1246         && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1247 
1248     EVP_KDF_CTX_free(kctx);
1249     return ret;
1250 }
1251 
test_kdf_kbkdf_8009_prf2(void)1252 static int test_kdf_kbkdf_8009_prf2(void)
1253 {
1254     int ret, i = 0;
1255     EVP_KDF_CTX *kctx;
1256     OSSL_PARAM params[6];
1257     char *label = "prf", *digest = "sha384", *prf_input = "test",
1258         *mac = "HMAC";
1259     static unsigned char input_key[] = {
1260         0x6D, 0x40, 0x4D, 0x37, 0xFA, 0xF7, 0x9F, 0x9D,
1261         0xF0, 0xD3, 0x35, 0x68, 0xD3, 0x20, 0x66, 0x98,
1262         0x00, 0xEB, 0x48, 0x36, 0x47, 0x2E, 0xA8, 0xA0,
1263         0x26, 0xD1, 0x6B, 0x71, 0x82, 0x46, 0x0C, 0x52,
1264     };
1265     static unsigned char output[] = {
1266         0x98, 0x01, 0xF6, 0x9A, 0x36, 0x8C, 0x2B, 0xF6,
1267         0x75, 0xE5, 0x95, 0x21, 0xE1, 0x77, 0xD9, 0xA0,
1268         0x7F, 0x67, 0xEF, 0xE1, 0xCF, 0xDE, 0x8D, 0x3C,
1269         0x8D, 0x6F, 0x6A, 0x02, 0x56, 0xE3, 0xB1, 0x7D,
1270         0xB3, 0xC1, 0xB6, 0x2A, 0xD1, 0xB8, 0x55, 0x33,
1271         0x60, 0xD1, 0x73, 0x67, 0xEB, 0x15, 0x14, 0xD2,
1272     };
1273     unsigned char result[sizeof(output)] = { 0 };
1274 
1275     params[i++] = OSSL_PARAM_construct_utf8_string(
1276         OSSL_KDF_PARAM_DIGEST, digest, 0);
1277     params[i++] = OSSL_PARAM_construct_utf8_string(
1278         OSSL_KDF_PARAM_MAC, mac, 0);
1279     params[i++] = OSSL_PARAM_construct_octet_string(
1280         OSSL_KDF_PARAM_KEY, input_key, sizeof(input_key));
1281     params[i++] = OSSL_PARAM_construct_octet_string(
1282         OSSL_KDF_PARAM_SALT, label, strlen(label));
1283     params[i++] = OSSL_PARAM_construct_octet_string(
1284         OSSL_KDF_PARAM_INFO, prf_input, strlen(prf_input));
1285     params[i] = OSSL_PARAM_construct_end();
1286 
1287     kctx = get_kdfbyname("KBKDF");
1288     ret = TEST_ptr(kctx)
1289         && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1290         && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1291 
1292     EVP_KDF_CTX_free(kctx);
1293     return ret;
1294 }
1295 
1296 #if !defined(OPENSSL_NO_CMAC)
1297 /*
1298  * Test vector taken from
1299  * https://csrc.nist.gov/CSRC/media/Projects/
1300  *    Cryptographic-Algorithm-Validation-Program/documents/KBKDF800-108/CounterMode.zip
1301  *    Note: Only 32 bit counter is supported ([RLEN=32_BITS])
1302  */
test_kdf_kbkdf_fixedinfo(void)1303 static int test_kdf_kbkdf_fixedinfo(void)
1304 {
1305     int ret;
1306     EVP_KDF_CTX *kctx;
1307     OSSL_PARAM params[8], *p = params;
1308     static char *cipher = "AES128";
1309     static char *mac = "CMAC";
1310     static char *mode = "COUNTER";
1311     int use_l = 0;
1312     int use_separator = 0;
1313 
1314     static unsigned char input_key[] = {
1315         0xc1, 0x0b, 0x15, 0x2e, 0x8c, 0x97, 0xb7, 0x7e,
1316         0x18, 0x70, 0x4e, 0x0f, 0x0b, 0xd3, 0x83, 0x05,
1317     };
1318     static unsigned char fixed_input[] = {
1319         0x98, 0xcd, 0x4c, 0xbb, 0xbe, 0xbe, 0x15, 0xd1,
1320         0x7d, 0xc8, 0x6e, 0x6d, 0xba, 0xd8, 0x00, 0xa2,
1321         0xdc, 0xbd, 0x64, 0xf7, 0xc7, 0xad, 0x0e, 0x78,
1322         0xe9, 0xcf, 0x94, 0xff, 0xdb, 0xa8, 0x9d, 0x03,
1323         0xe9, 0x7e, 0xad, 0xf6, 0xc4, 0xf7, 0xb8, 0x06,
1324         0xca, 0xf5, 0x2a, 0xa3, 0x8f, 0x09, 0xd0, 0xeb,
1325         0x71, 0xd7, 0x1f, 0x49, 0x7b, 0xcc, 0x69, 0x06,
1326         0xb4, 0x8d, 0x36, 0xc4,
1327 
1328     };
1329     static unsigned char output[] = {
1330         0x26, 0xfa, 0xf6, 0x19, 0x08, 0xad, 0x9e, 0xe8,
1331         0x81, 0xb8, 0x30, 0x5c, 0x22, 0x1d, 0xb5, 0x3f,
1332     };
1333     unsigned char result[sizeof(output)] = { 0 };
1334 
1335     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, cipher, 0);
1336     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, mac, 0);
1337     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, mode, 0);
1338     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, input_key,
1339                                              sizeof(input_key));
1340     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
1341                                              fixed_input, sizeof(fixed_input));
1342     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &use_l);
1343     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR,
1344                                     &use_separator);
1345     *p = OSSL_PARAM_construct_end();
1346 
1347     kctx = get_kdfbyname("KBKDF");
1348     ret = TEST_ptr(kctx)
1349         && TEST_int_gt(EVP_KDF_derive(kctx, result, sizeof(result), params), 0)
1350         && TEST_mem_eq(result, sizeof(result), output, sizeof(output));
1351 
1352     EVP_KDF_CTX_free(kctx);
1353     return ret;
1354 }
1355 #endif /* OPENSSL_NO_CMAC */
1356 
test_kdf_ss_hmac(void)1357 static int test_kdf_ss_hmac(void)
1358 {
1359     int ret;
1360     EVP_KDF_CTX *kctx;
1361     OSSL_PARAM params[6], *p = params;
1362     unsigned char out[16];
1363     static unsigned char z[] = {
1364         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
1365     };
1366     static unsigned char other[] = {
1367         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
1368     };
1369     static unsigned char salt[] = {
1370         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
1371         0x3f,0x89
1372     };
1373     static const unsigned char expected[sizeof(out)] = {
1374         0x44,0xf6,0x76,0xe8,0x5c,0x1b,0x1a,0x8b,0xbc,0x3d,0x31,0x92,0x18,0x63,
1375         0x1c,0xa3
1376     };
1377 
1378     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1379                                             (char *)OSSL_MAC_NAME_HMAC, 0);
1380     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1381                                             (char *)"sha256", 0);
1382     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1383     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1384                                              sizeof(other));
1385     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1386                                              sizeof(salt));
1387     *p = OSSL_PARAM_construct_end();
1388 
1389     ret =
1390         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1391         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1392         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1393 
1394     EVP_KDF_CTX_free(kctx);
1395     return ret;
1396 }
1397 
test_kdf_ss_kmac(void)1398 static int test_kdf_ss_kmac(void)
1399 {
1400     int ret;
1401     EVP_KDF_CTX *kctx;
1402     OSSL_PARAM params[6], *p = params;
1403     unsigned char out[64];
1404     size_t mac_size = 20;
1405     static unsigned char z[] = {
1406         0xb7,0x4a,0x14,0x9a,0x16,0x15,0x46,0xf8,0xc2,0x0b,0x06,0xac,0x4e,0xd4
1407     };
1408     static unsigned char other[] = {
1409         0x34,0x8a,0x37,0xa2,0x7e,0xf1,0x28,0x2f,0x5f,0x02,0x0d,0xcc
1410     };
1411     static unsigned char salt[] = {
1412         0x36,0x38,0x27,0x1c,0xcd,0x68,0xa2,0x5d,0xc2,0x4e,0xcd,0xdd,0x39,0xef,
1413         0x3f,0x89
1414     };
1415     static const unsigned char expected[sizeof(out)] = {
1416         0xe9,0xc1,0x84,0x53,0xa0,0x62,0xb5,0x3b,0xdb,0xfc,0xbb,0x5a,0x34,0xbd,
1417         0xb8,0xe5,0xe7,0x07,0xee,0xbb,0x5d,0xd1,0x34,0x42,0x43,0xd8,0xcf,0xc2,
1418         0xc2,0xe6,0x33,0x2f,0x91,0xbd,0xa5,0x86,0xf3,0x7d,0xe4,0x8a,0x65,0xd4,
1419         0xc5,0x14,0xfd,0xef,0xaa,0x1e,0x67,0x54,0xf3,0x73,0xd2,0x38,0xe1,0x95,
1420         0xae,0x15,0x7e,0x1d,0xe8,0x14,0x98,0x03
1421     };
1422 
1423     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
1424                                             (char *)OSSL_MAC_NAME_KMAC128, 0);
1425     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z, sizeof(z));
1426     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, other,
1427                                              sizeof(other));
1428     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, salt,
1429                                              sizeof(salt));
1430     *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, &mac_size);
1431     *p = OSSL_PARAM_construct_end();
1432 
1433     ret =
1434         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSKDF))
1435         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1436         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1437 
1438     EVP_KDF_CTX_free(kctx);
1439     return ret;
1440 }
1441 
test_kdf_sshkdf(void)1442 static int test_kdf_sshkdf(void)
1443 {
1444     int ret;
1445     EVP_KDF_CTX *kctx;
1446     OSSL_PARAM params[6], *p = params;
1447     char kdftype = EVP_KDF_SSHKDF_TYPE_INITIAL_IV_CLI_TO_SRV;
1448     unsigned char out[8];
1449     /* Test data from NIST CAVS 14.1 test vectors */
1450     static unsigned char key[] = {
1451         0x00, 0x00, 0x00, 0x81, 0x00, 0x87, 0x5c, 0x55, 0x1c, 0xef, 0x52, 0x6a,
1452         0x4a, 0x8b, 0xe1, 0xa7, 0xdf, 0x27, 0xe9, 0xed, 0x35, 0x4b, 0xac, 0x9a,
1453         0xfb, 0x71, 0xf5, 0x3d, 0xba, 0xe9, 0x05, 0x67, 0x9d, 0x14, 0xf9, 0xfa,
1454         0xf2, 0x46, 0x9c, 0x53, 0x45, 0x7c, 0xf8, 0x0a, 0x36, 0x6b, 0xe2, 0x78,
1455         0x96, 0x5b, 0xa6, 0x25, 0x52, 0x76, 0xca, 0x2d, 0x9f, 0x4a, 0x97, 0xd2,
1456         0x71, 0xf7, 0x1e, 0x50, 0xd8, 0xa9, 0xec, 0x46, 0x25, 0x3a, 0x6a, 0x90,
1457         0x6a, 0xc2, 0xc5, 0xe4, 0xf4, 0x8b, 0x27, 0xa6, 0x3c, 0xe0, 0x8d, 0x80,
1458         0x39, 0x0a, 0x49, 0x2a, 0xa4, 0x3b, 0xad, 0x9d, 0x88, 0x2c, 0xca, 0xc2,
1459         0x3d, 0xac, 0x88, 0xbc, 0xad, 0xa4, 0xb4, 0xd4, 0x26, 0xa3, 0x62, 0x08,
1460         0x3d, 0xab, 0x65, 0x69, 0xc5, 0x4c, 0x22, 0x4d, 0xd2, 0xd8, 0x76, 0x43,
1461         0xaa, 0x22, 0x76, 0x93, 0xe1, 0x41, 0xad, 0x16, 0x30, 0xce, 0x13, 0x14,
1462         0x4e
1463     };
1464     static unsigned char xcghash[] = {
1465         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
1466         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
1467         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
1468     };
1469     static unsigned char sessid[] = {
1470         0x0e, 0x68, 0x3f, 0xc8, 0xa9, 0xed, 0x7c, 0x2f, 0xf0, 0x2d, 0xef, 0x23,
1471         0xb2, 0x74, 0x5e, 0xbc, 0x99, 0xb2, 0x67, 0xda, 0xa8, 0x6a, 0x4a, 0xa7,
1472         0x69, 0x72, 0x39, 0x08, 0x82, 0x53, 0xf6, 0x42
1473     };
1474     static const unsigned char expected[sizeof(out)] = {
1475         0x41, 0xff, 0x2e, 0xad, 0x16, 0x83, 0xf1, 0xe6
1476     };
1477 
1478     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1479                                             (char *)"sha256", 0);
1480     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
1481                                              sizeof(key));
1482     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_XCGHASH,
1483                                              xcghash, sizeof(xcghash));
1484     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
1485                                              sessid, sizeof(sessid));
1486     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_SSHKDF_TYPE,
1487                                             &kdftype, sizeof(kdftype));
1488     *p = OSSL_PARAM_construct_end();
1489 
1490     ret =
1491         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SSHKDF))
1492         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1493         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1494 
1495     EVP_KDF_CTX_free(kctx);
1496     return ret;
1497 }
1498 
test_kdfs_same(EVP_KDF * kdf1,EVP_KDF * kdf2)1499 static int test_kdfs_same( EVP_KDF *kdf1, EVP_KDF *kdf2)
1500 {
1501     /* Fast path in case the two are the same algorithm pointer */
1502     if (kdf1 == kdf2)
1503         return 1;
1504     /*
1505      * Compare their names and providers instead.
1506      * This is necessary in a non-caching build (or a cache flush during fetch)
1507      * because without the algorithm in the cache, fetching it a second time
1508      * will result in a different pointer.
1509      */
1510     return TEST_ptr_eq(EVP_KDF_get0_provider(kdf1), EVP_KDF_get0_provider(kdf2))
1511            && TEST_str_eq(EVP_KDF_get0_name(kdf1), EVP_KDF_get0_name(kdf2));
1512 }
1513 
test_kdf_get_kdf(void)1514 static int test_kdf_get_kdf(void)
1515 {
1516     EVP_KDF *kdf1 = NULL, *kdf2 = NULL;
1517     ASN1_OBJECT *obj;
1518     int ok = 1;
1519 
1520     if (!TEST_ptr(obj = OBJ_nid2obj(NID_id_pbkdf2))
1521         || !TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_PBKDF2, NULL))
1522         || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(OBJ_obj2nid(obj)),
1523                                           NULL))
1524         || !test_kdfs_same(kdf1, kdf2))
1525         ok = 0;
1526     EVP_KDF_free(kdf1);
1527     kdf1 = NULL;
1528     EVP_KDF_free(kdf2);
1529     kdf2 = NULL;
1530 
1531     if (!TEST_ptr(kdf1 = EVP_KDF_fetch(NULL, SN_tls1_prf, NULL))
1532         || !TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, LN_tls1_prf, NULL))
1533         || !test_kdfs_same(kdf1, kdf2))
1534         ok = 0;
1535     /* kdf1 is re-used below, so don't free it here */
1536     EVP_KDF_free(kdf2);
1537     kdf2 = NULL;
1538 
1539     if (!TEST_ptr(kdf2 = EVP_KDF_fetch(NULL, OBJ_nid2sn(NID_tls1_prf), NULL))
1540         || !test_kdfs_same(kdf1, kdf2))
1541         ok = 0;
1542     EVP_KDF_free(kdf1);
1543     kdf1 = NULL;
1544     EVP_KDF_free(kdf2);
1545     kdf2 = NULL;
1546 
1547     return ok;
1548 }
1549 
1550 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
test_kdf_x942_asn1(void)1551 static int test_kdf_x942_asn1(void)
1552 {
1553     int ret;
1554     EVP_KDF_CTX *kctx = NULL;
1555     OSSL_PARAM params[4], *p = params;
1556     const char *cek_alg = SN_id_smime_alg_CMS3DESwrap;
1557     unsigned char out[24];
1558     /* RFC2631 Section 2.1.6 Test data */
1559     static unsigned char z[] = {
1560         0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,
1561         0x0e,0x0f,0x10,0x11,0x12,0x13
1562     };
1563     static const unsigned char expected[sizeof(out)] = {
1564         0xa0,0x96,0x61,0x39,0x23,0x76,0xf7,0x04,
1565         0x4d,0x90,0x52,0xa3,0x97,0x88,0x32,0x46,
1566         0xb6,0x7f,0x5f,0x1e,0xf6,0x3e,0xb5,0xfb
1567     };
1568 
1569     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
1570                                             (char *)"sha1", 0);
1571     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, z,
1572                                              sizeof(z));
1573     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CEK_ALG,
1574                                             (char *)cek_alg, 0);
1575     *p = OSSL_PARAM_construct_end();
1576 
1577     ret =
1578         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_X942KDF_ASN1))
1579         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1580         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1581 
1582     EVP_KDF_CTX_free(kctx);
1583     return ret;
1584 }
1585 #endif /* OPENSSL_NO_CMS */
1586 
test_kdf_krb5kdf(void)1587 static int test_kdf_krb5kdf(void)
1588 {
1589     int ret;
1590     EVP_KDF_CTX *kctx;
1591     OSSL_PARAM params[4], *p = params;
1592     unsigned char out[16];
1593     static unsigned char key[] = {
1594         0x42, 0x26, 0x3C, 0x6E, 0x89, 0xF4, 0xFC, 0x28,
1595         0xB8, 0xDF, 0x68, 0xEE, 0x09, 0x79, 0x9F, 0x15
1596     };
1597     static unsigned char constant[] = {
1598         0x00, 0x00, 0x00, 0x02, 0x99
1599     };
1600     static const unsigned char expected[sizeof(out)] = {
1601         0x34, 0x28, 0x0A, 0x38, 0x2B, 0xC9, 0x27, 0x69,
1602         0xB2, 0xDA, 0x2F, 0x9E, 0xF0, 0x66, 0x85, 0x4B
1603     };
1604 
1605     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER,
1606                                             (char *)"AES-128-CBC", 0);
1607     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key,
1608                                              sizeof(key));
1609     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT,
1610                                              constant, sizeof(constant));
1611     *p = OSSL_PARAM_construct_end();
1612 
1613     ret =
1614         TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KRB5KDF))
1615         && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), params), 0)
1616         && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
1617 
1618     EVP_KDF_CTX_free(kctx);
1619     return ret;
1620 }
1621 
setup_tests(void)1622 int setup_tests(void)
1623 {
1624     ADD_TEST(test_kdf_pbkdf1);
1625 #if !defined(OPENSSL_NO_CMAC) && !defined(OPENSSL_NO_CAMELLIA)
1626     ADD_TEST(test_kdf_kbkdf_6803_128);
1627     ADD_TEST(test_kdf_kbkdf_6803_256);
1628 #endif
1629     ADD_TEST(test_kdf_kbkdf_invalid_digest);
1630     ADD_TEST(test_kdf_kbkdf_invalid_mac);
1631     ADD_TEST(test_kdf_kbkdf_zero_output_size);
1632     ADD_TEST(test_kdf_kbkdf_empty_key);
1633     ADD_TEST(test_kdf_kbkdf_1byte_key);
1634     ADD_TEST(test_kdf_kbkdf_8009_prf1);
1635     ADD_TEST(test_kdf_kbkdf_8009_prf2);
1636 #if !defined(OPENSSL_NO_CMAC)
1637     ADD_TEST(test_kdf_kbkdf_fixedinfo);
1638 #endif
1639     ADD_TEST(test_kdf_get_kdf);
1640     ADD_TEST(test_kdf_tls1_prf);
1641     ADD_TEST(test_kdf_tls1_prf_invalid_digest);
1642     ADD_TEST(test_kdf_tls1_prf_zero_output_size);
1643     ADD_TEST(test_kdf_tls1_prf_empty_secret);
1644     ADD_TEST(test_kdf_tls1_prf_1byte_secret);
1645     ADD_TEST(test_kdf_tls1_prf_empty_seed);
1646     ADD_TEST(test_kdf_tls1_prf_1byte_seed);
1647     ADD_TEST(test_kdf_hkdf);
1648     ADD_TEST(test_kdf_hkdf_invalid_digest);
1649     ADD_TEST(test_kdf_hkdf_zero_output_size);
1650     ADD_TEST(test_kdf_hkdf_empty_key);
1651     ADD_TEST(test_kdf_hkdf_1byte_key);
1652     ADD_TEST(test_kdf_hkdf_empty_salt);
1653     ADD_TEST(test_kdf_hkdf_gettables);
1654     ADD_TEST(test_kdf_hkdf_gettables_expandonly);
1655     ADD_TEST(test_kdf_hkdf_gettables_no_digest);
1656     ADD_TEST(test_kdf_hkdf_derive_set_params_fail);
1657     ADD_TEST(test_kdf_hkdf_set_invalid_mode);
1658     ADD_TEST(test_kdf_hkdf_set_ctx_param_fail);
1659     ADD_TEST(test_kdf_pbkdf2);
1660     ADD_TEST(test_kdf_pbkdf2_small_output);
1661     ADD_TEST(test_kdf_pbkdf2_large_output);
1662     ADD_TEST(test_kdf_pbkdf2_small_salt);
1663     ADD_TEST(test_kdf_pbkdf2_small_iterations);
1664     ADD_TEST(test_kdf_pbkdf2_small_salt_pkcs5);
1665     ADD_TEST(test_kdf_pbkdf2_small_iterations_pkcs5);
1666     ADD_TEST(test_kdf_pbkdf2_invalid_digest);
1667 #ifndef OPENSSL_NO_SCRYPT
1668     ADD_TEST(test_kdf_scrypt);
1669 #endif
1670     ADD_TEST(test_kdf_ss_hash);
1671     ADD_TEST(test_kdf_ss_hmac);
1672     ADD_TEST(test_kdf_ss_kmac);
1673     ADD_TEST(test_kdf_sshkdf);
1674     ADD_TEST(test_kdf_x963);
1675 #if !defined(OPENSSL_NO_CMS) && !defined(OPENSSL_NO_DES)
1676     ADD_TEST(test_kdf_x942_asn1);
1677 #endif
1678     ADD_TEST(test_kdf_krb5kdf);
1679     return 1;
1680 }
1681