From 26c765021f4e86ec84ba571d57b9ad3f57cae08c Mon Sep 17 00:00:00 2001 From: Sam Hartman Date: Mon, 16 Mar 2009 16:50:23 +0000 Subject: [PATCH] Implement test cases for CF2 Implement a simple program to call KRB-FX-CF2 and print the resulting keys. Add to regression tests. Also, use the PRF testing application to confirm that CF2 generates consistent keys if called by hand. ticket: 6421 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22095 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/crypto/Makefile.in | 14 +++++- src/lib/crypto/t_cf2.c | 88 +++++++++++++++++++++++++++++++++++ src/lib/crypto/t_cf2.comments | 3 ++ src/lib/crypto/t_cf2.expected | 2 + src/lib/crypto/t_cf2.in | 10 ++++ src/lib/crypto/t_prf.comments | 8 ++++ src/lib/crypto/t_prf.expected | 6 +++ src/lib/crypto/t_prf.in | 18 +++++++ 8 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 src/lib/crypto/t_cf2.c create mode 100644 src/lib/crypto/t_cf2.comments create mode 100644 src/lib/crypto/t_cf2.expected create mode 100644 src/lib/crypto/t_cf2.in create mode 100644 src/lib/crypto/t_prf.comments create mode 100644 src/lib/crypto/t_prf.expected create mode 100644 src/lib/crypto/t_prf.in diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in index 945403276..85e32e483 100644 --- a/src/lib/crypto/Makefile.in +++ b/src/lib/crypto/Makefile.in @@ -16,6 +16,7 @@ DEFS= EXTRADEPSRCS=\ $(srcdir)/t_nfold.c \ + $(srcdir)/t_cf2.c \ $(srcdir)/t_encrypt.c \ $(srcdir)/t_prf.c \ $(srcdir)/t_prng.c \ @@ -205,12 +206,17 @@ libcrypto.lib: clean-unix:: clean-liblinks clean-libs clean-libobjs -check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5 +check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5 t_cf2 $(RUN_SETUP) $(VALGRIND) ./t_nfold $(RUN_SETUP) $(VALGRIND) ./t_encrypt $(RUN_SETUP) $(VALGRIND) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \ diff t_prng.output $(srcdir)/t_prng.expected $(RUN_SETUP) $(VALGRIND) ./t_hmac + $(RUN_SETUP) $(VALGRIND) ./t_prf <$(srcdir)/t_prf.in >t_prf.output + diff t_prf.output $(srcdir)/t_prf.expected + $(RUN_SETUP) $(VALGRIND) ./t_cf2 <$(srcdir)/t_cf2.in >t_cf2.output + diff t_cf2.output $(srcdir)/t_cf2.expected + # $(RUN_SETUP) $(VALGRIND) ./t_pkcs5 @@ -223,6 +229,10 @@ t_encrypt$(EXEEXT): t_encrypt.$(OBJEXT) nfold.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPO t_prf$(EXEEXT): t_prf.$(OBJEXT) $(SUPPORT_DEPLIB) $(CC_LINK) -o $@ t_prf.$(OBJEXT) -lkrb5 -lk5crypto -lcom_err $(SUPPORT_LIB) +t_cf2$(EXEEXT): t_cf2.$(OBJEXT) $(SUPPORT_DEPLIB) + $(CC_LINK) -o $@ t_cf2.$(OBJEXT) -lkrb5 -lk5crypto -lcom_err $(SUPPORT_LIB) + + t_prng$(EXEEXT): t_prng.$(OBJEXT) $(SUPPORT_DEPLIB) $(CC_LINK) -o $@ t_prng.$(OBJEXT) -lk5crypto -lcom_err $(SUPPORT_LIB) @@ -242,7 +252,7 @@ t_cts$(EXEEXT): t_cts.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB) clean:: $(RM) t_nfold.o t_nfold t_encrypt t_encrypt.o t_prng.o t_prng \ - t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o + t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o t_cf2 t_cf2.o -$(RM) t_prng.output all-windows:: diff --git a/src/lib/crypto/t_cf2.c b/src/lib/crypto/t_cf2.c new file mode 100644 index 000000000..2e171c275 --- /dev/null +++ b/src/lib/crypto/t_cf2.c @@ -0,0 +1,88 @@ +/* + * lib/crypto/t_cf2.c + * + * Copyright (C) 2004, 2009 by the Massachusetts Institute of Technology. + * All rights reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * This file contains tests for theKRB-FX-CF2 code in Kerberos, based + *on the PRF regression tests. It reads an input file, and writes an + *output file. It is assumed that the output file will be diffed + *against expected output to see whether regression tests pass. The + *input file is a very primitive format. + *First line: enctype + *second line: key to pass to string2key; also used as salt + *Third line: second key to pass to string2key + *fourth line: pepper1 + *fifth line: pepper2 + *scanf is used to read the file, so interior spaces are not permitted. The program outputs the hex bytes of the key. + */ +#include + +#include +#include +#include + +int main () { + char pepper1[1024], pepper2[1024]; + krb5_keyblock *k1 = NULL, *k2 = NULL, *out = NULL; + krb5_data s2k; + unsigned int i; + while (1) { + krb5_enctype enctype; + char s[1025]; + + if (scanf( "%d", &enctype) == EOF) + break; + if (scanf("%1024s", &s[0]) == EOF) + break; + assert (krb5_init_keyblock(0, enctype, 0, &k1) == 0); + s2k.data = &s[0]; + s2k.length = strlen(s); + assert(krb5_c_string_to_key (0, enctype, &s2k, &s2k, k1) == 0); + if (scanf("%1024s", &s[0]) == EOF) + break; + assert (krb5_init_keyblock(0, enctype, 0, &k2) == 0); + s2k.data = &s[0]; + s2k.length = strlen(s); + assert(krb5_c_string_to_key (0, enctype, &s2k, &s2k, k2) == 0); + if (scanf("%1024s %1024s", pepper1, pepper2) == EOF) + break; + assert(krb5_c_fx_cf2_simple(0, k1, pepper1, + k2, pepper2, &out) ==0); + i = out->length; + for (; i > 0; i--) { + printf ("%02x", + (unsigned int) ((unsigned char) out->contents[out->length-i])); + } + printf ("\n"); + + krb5_free_keyblock(0,out); + out = NULL; + + krb5_free_keyblock(0, k1); + k1 = NULL; + krb5_free_keyblock(0, k2); + k2 = NULL; + } + + return (0); +} diff --git a/src/lib/crypto/t_cf2.comments b/src/lib/crypto/t_cf2.comments new file mode 100644 index 000000000..4f01e7964 --- /dev/null +++ b/src/lib/crypto/t_cf2.comments @@ -0,0 +1,3 @@ +The first test mirrors the first two tests in t_prf.in. + +The second test mirrors the following four tests in t_prf.in. diff --git a/src/lib/crypto/t_cf2.expected b/src/lib/crypto/t_cf2.expected new file mode 100644 index 000000000..104c6c4a0 --- /dev/null +++ b/src/lib/crypto/t_cf2.expected @@ -0,0 +1,2 @@ +97df97e4b798b29eb31ed7280287a92a +4d6ca4e629785c1f01baf55e2e548566b9617ae3a96868c337cb93b5e72b1c7b diff --git a/src/lib/crypto/t_cf2.in b/src/lib/crypto/t_cf2.in new file mode 100644 index 000000000..d06fd5621 --- /dev/null +++ b/src/lib/crypto/t_cf2.in @@ -0,0 +1,10 @@ +17 +key1 +key2 +a +b +18 +key1 +key2 +a +b diff --git a/src/lib/crypto/t_prf.comments b/src/lib/crypto/t_prf.comments new file mode 100644 index 000000000..124584259 --- /dev/null +++ b/src/lib/crypto/t_prf.comments @@ -0,0 +1,8 @@ +The first two tests are effectively a call to krb-fx-cf2 for +aes-128-cts. This mirrorrs the first test in t_cf2.in. + + +The next four tests mirror a call to KRB-FX-CF2 for aes256-cts; this +mirrors the second test in t_cf2.in. + + diff --git a/src/lib/crypto/t_prf.expected b/src/lib/crypto/t_prf.expected new file mode 100644 index 000000000..eadfd9747 --- /dev/null +++ b/src/lib/crypto/t_prf.expected @@ -0,0 +1,6 @@ +77b39a37a868920f2a51f9dd150c5717 +e06c0dd31ff02091994f2ef5178bfe3d +b2628c788e2e9c4a9bb4644678c29f2f +b406373350cee8a6126f4a9b65a0cd21 +ff0e289ea756c0559a0e911856961a49 +0d674dd0f9a6806525a4d92e828bd15a diff --git a/src/lib/crypto/t_prf.in b/src/lib/crypto/t_prf.in new file mode 100644 index 000000000..f45c41618 --- /dev/null +++ b/src/lib/crypto/t_prf.in @@ -0,0 +1,18 @@ +17 +key1 +2 0161 +17 +key2 +2 0162 +18 +key1 +2 0161 +18 +key1 +2 0261 +18 +key2 +2 0162 +18 +key2 +2 0262 -- 2.26.2