ex_digest.c

Go to the documentation of this file.

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 
#include "nilorea/n_common.h"
#include "nilorea/n_digest.h"
#include "nilorea/n_hex.h"
#include "nilorea/n_log.h"
#include "nilorea/n_str.h"
 
#include <stdio.h>
#include <string.h>
 
static int failures = 0;
 
/* Parse the -V LOG_LEVEL verbosity argument. */
void process_args(int argc, char** argv) {
    int opt = 0;
    while ((opt = getopt(argc, argv, "hvV:")) != EOF) {
        switch (opt) {
            case 'V':
                if (!strncmp("LOG_NULL", optarg, 8))
                    set_log_level(LOG_NULL);
                else if (!strncmp("LOG_NOTICE", optarg, 10))
                    set_log_level(LOG_NOTICE);
                else if (!strncmp("LOG_INFO", optarg, 8))
                    set_log_level(LOG_INFO);
                else if (!strncmp("LOG_ERR", optarg, 7))
                    set_log_level(LOG_ERR);
                else if (!strncmp("LOG_DEBUG", optarg, 9))
                    set_log_level(LOG_DEBUG);
                else {
                    fprintf(stderr, "Unknown log level %s\n", optarg);
                    exit(1);
                }
                break;
            case 'v':
                fprintf(stderr, "ex_digest\n");
                exit(1);
            case 'h':
            default:
                fprintf(stderr, "usage: %s [-V LOG_LEVEL]\n", argv[0]);
                break;
        }
    }
}
 
/* Hex-encode a raw digest and compare it to the expected lowercase hex string. */
static void expect_hex(const unsigned char* digest, size_t len, const char* want, const char* label) {
    N_STR* hex = n_hex_encode(digest, len);
    if (!hex) {
        n_log(LOG_ERR, "%s: hex encode failed", label);
        failures++;
        return;
    }
    if (strcmp(hex->data, want) != 0) {
        n_log(LOG_ERR, "%s: got '%s' expected '%s'", label, hex->data, want);
        failures++;
    }
    free_nstr(&hex);
}
 
static void test_digests(void) {
    const unsigned char* abc = (const unsigned char*)"abc";
    size_t n = 3;
 
    unsigned char md5[N_DIGEST_MD5_LEN];
    if (n_digest_md5(abc, n, md5) != 0)
        failures++;
    else
        expect_hex(md5, sizeof(md5), "900150983cd24fb0d6963f7d28e17f72", "md5(abc)");
 
    unsigned char sha1[N_DIGEST_SHA1_LEN];
    if (n_digest_sha1(abc, n, sha1) != 0)
        failures++;
    else
        expect_hex(sha1, sizeof(sha1), "a9993e364706816aba3e25717850c26c9cd0d89d", "sha1(abc)");
 
    unsigned char sha256[N_DIGEST_SHA256_LEN];
    if (n_digest_sha256(abc, n, sha256) != 0)
        failures++;
    else
        expect_hex(sha256, sizeof(sha256), "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", "sha256(abc)");
 
    unsigned char sha384[N_DIGEST_SHA384_LEN];
    if (n_digest_sha384(abc, n, sha384) != 0)
        failures++;
    else
        expect_hex(sha384, sizeof(sha384),
                   "cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7",
                   "sha384(abc)");
 
    unsigned char sha512[N_DIGEST_SHA512_LEN];
    if (n_digest_sha512(abc, n, sha512) != 0)
        failures++;
    else
        expect_hex(sha512, sizeof(sha512),
                   "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f",
                   "sha512(abc)");
 
/* BLAKE2b-512 needs OpenSSL 1.1.0. On the OpenSSL 1.0.2 this library still
   supports, the entry point is a logged failure, so check the vector only where
   the primitive exists. The guard is a #if rather than an if so the skipped
   builds do not carry the vectors as unreachable code. */
#if N_DIGEST_HAVE_BLAKE2B512
    unsigned char b2b[N_DIGEST_BLAKE2B512_LEN];
    if (n_digest_blake2b512(abc, n, b2b) != 0)
        failures++;
    else
        expect_hex(b2b, sizeof(b2b),
                   "ba80a53f981c4d0d6a2797b69f12f6e94c212f14685ac4b74b12bb6fdbffa2d17d87c5392aab792dc252d5de4533cc9518d38aa8dbf1925ab92386edd4009923",
                   "blake2b512(abc)");
#else
    n_log(LOG_NOTICE, "blake2b512: skipped, this OpenSSL does not provide it");
#endif
}
 
static void test_sha256_hex(void) {
    N_STR* h = n_digest_sha256_hex((const unsigned char*)"abc", 3);
    if (!h || strcmp(h->data, "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad") != 0) {
        n_log(LOG_ERR, "sha256_hex(abc): got '%s'", h ? h->data : "(null)");
        failures++;
    }
    free_nstr(&h);
 
    /* the empty input has a well-known SHA-256 digest */
    h = n_digest_sha256_hex((const unsigned char*)"", 0);
    if (!h || strcmp(h->data, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855") != 0) {
        n_log(LOG_ERR, "sha256_hex(empty): got '%s'", h ? h->data : "(null)");
        failures++;
    }
    free_nstr(&h);
}
 
static void test_hmac(void) {
    const unsigned char* key = (const unsigned char*)"key";
    const unsigned char* msg = (const unsigned char*)"The quick brown fox jumps over the lazy dog";
    unsigned char out[N_DIGEST_SHA256_LEN];
    if (n_hmac_sha256(key, 3, msg, strlen((const char*)msg), out) != 0) {
        n_log(LOG_ERR, "hmac_sha256 failed");
        failures++;
        return;
    }
    expect_hex(out, sizeof(out), "f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8", "hmac-sha256");
}
 
/* HMAC-SHA1/384/512 known-answer vectors (key="key", the pangram message). */
static void test_hmac_variants(void) {
    const unsigned char* key = (const unsigned char*)"key";
    const unsigned char* msg = (const unsigned char*)"The quick brown fox jumps over the lazy dog";
    size_t klen = 3, mlen = strlen((const char*)msg);
 
    unsigned char o1[N_DIGEST_SHA1_LEN];
    if (n_hmac_sha1(key, klen, msg, mlen, o1) != 0)
        failures++;
    else
        expect_hex(o1, sizeof(o1), "de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9", "hmac-sha1");
 
    unsigned char o384[N_DIGEST_SHA384_LEN];
    if (n_hmac_sha384(key, klen, msg, mlen, o384) != 0)
        failures++;
    else
        expect_hex(o384, sizeof(o384),
                   "d7f4727e2c0b39ae0f1e40cc96f60242d5b7801841cea6fc592c5d3e1ae50700582a96cf35e1e554995fe4e03381c237",
                   "hmac-sha384");
 
    unsigned char o512[N_DIGEST_SHA512_LEN];
    if (n_hmac_sha512(key, klen, msg, mlen, o512) != 0)
        failures++;
    else
        expect_hex(o512, sizeof(o512),
                   "b42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a",
                   "hmac-sha512");
}
 
/* Constant-time comparison: equal buffers match, a one-byte diff does not. */
static void test_consttime(void) {
    const unsigned char a[] = {1, 2, 3, 4, 5};
    const unsigned char b[] = {1, 2, 3, 4, 5};
    const unsigned char c[] = {1, 2, 3, 4, 6};
    if (n_digest_consttime_equal(a, b, sizeof(a)) != 1)
        failures++;
    if (n_digest_consttime_equal(a, c, sizeof(a)) != 0)
        failures++;
    if (n_digest_consttime_equal(NULL, b, sizeof(a)) != 0) /* NULL never matches */
        failures++;
}
 
/* PBKDF2-HMAC-SHA1 vectors from RFC 6070 and a SHA256 vector (RFC 7914 salt). */
static void test_pbkdf2(void) {
    unsigned char out[40];
 
    /* RFC 6070: P="password" S="salt" c=1 dkLen=20 */
    if (n_pbkdf2_hmac_sha1((const unsigned char*)"password", 8, (const unsigned char*)"salt", 4, 1, out, 20) != 0)
        failures++;
    else
        expect_hex(out, 20, "0c60c80f961f0e71f3a9b524af6012062fe037a6", "pbkdf2-sha1 c=1");
 
    /* RFC 6070: same but c=4096 */
    if (n_pbkdf2_hmac_sha1((const unsigned char*)"password", 8, (const unsigned char*)"salt", 4, 4096, out, 20) != 0)
        failures++;
    else
        expect_hex(out, 20, "4b007901b765489abead49d926f721d065a429c1", "pbkdf2-sha1 c=4096");
 
    /* PBKDF2-HMAC-SHA256: P="password" S="salt" c=1 dkLen=32 */
    if (n_pbkdf2_hmac_sha256((const unsigned char*)"password", 8, (const unsigned char*)"salt", 4, 1, out, 32) != 0)
        failures++;
    else
        expect_hex(out, 32, "120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b", "pbkdf2-sha256 c=1");
 
    /* invalid arguments must fail */
    if (n_pbkdf2_hmac_sha1((const unsigned char*)"p", 1, (const unsigned char*)"s", 1, 0, out, 20) == 0) /* zero iterations */
        failures++;
    if (n_pbkdf2_hmac_sha1((const unsigned char*)"p", 1, (const unsigned char*)"s", 1, 1, NULL, 20) == 0) /* NULL out */
        failures++;
}
 
/* AES-256-GCM: NIST test vector (Test Case 14), a round-trip, and tamper detection. */
static void test_aead(void) {
    unsigned char key[N_AEAD_AES256GCM_KEY_LEN] = {0};
    unsigned char iv[12] = {0};
    unsigned char pt[16] = {0};
    unsigned char ct[16];
    unsigned char tag[N_AEAD_AES256GCM_TAG_LEN];
    unsigned char back[16];
 
    /* Test Case 14: all-zero key/iv/plaintext */
    if (n_aead_aes256gcm_encrypt(key, iv, sizeof(iv), NULL, 0, pt, sizeof(pt), ct, tag) != 0) {
        failures++;
    } else {
        expect_hex(ct, sizeof(ct), "cea7403d4d606b6e074ec5d3baf39d18", "aes256gcm ct");
        expect_hex(tag, sizeof(tag), "d0d1c8a799996bf0265b98b5d48ab919", "aes256gcm tag");
    }
 
    /* round-trip with real data and AAD recovers the plaintext */
    {
        const unsigned char msg[] = "hello, world!";
        size_t mlen = sizeof(msg) - 1; /* drop the terminating NUL */
        unsigned char rk[N_AEAD_AES256GCM_KEY_LEN];
        unsigned char riv[12];
        unsigned char rct[16];
        unsigned char rtag[N_AEAD_AES256GCM_TAG_LEN];
        unsigned char rback[16];
        size_t i;
        for (i = 0; i < sizeof(rk); i++)
            rk[i] = (unsigned char)(i + 1);
        for (i = 0; i < sizeof(riv); i++)
            riv[i] = (unsigned char)(0x40 + i);
        if (n_aead_aes256gcm_encrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, msg, mlen, rct, rtag) != 0)
            failures++;
        else if (n_aead_aes256gcm_decrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, rct, mlen, rtag, rback) != 0)
            failures++;
        else if (memcmp(msg, rback, mlen) != 0)
            failures++;
        /* a flipped tag byte must fail authentication */
        rtag[0] ^= 0x01;
        if (n_aead_aes256gcm_decrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, rct, mlen, rtag, rback) == 0)
            failures++;
    }
 
    /* decrypting Test Case 14 back returns the zero plaintext */
    if (n_aead_aes256gcm_decrypt(key, iv, sizeof(iv), NULL, 0, ct, sizeof(ct), tag, back) != 0)
        failures++;
    else if (memcmp(pt, back, sizeof(pt)) != 0)
        failures++;
}
 
static void test_aead_chacha(void) {
#if !N_AEAD_HAVE_CHACHA20POLY1305
    /* ChaCha20-Poly1305 needs OpenSSL 1.1.0 */
    n_log(LOG_NOTICE, "chacha20poly1305: skipped, this OpenSSL does not provide it");
#else
    unsigned char key[N_AEAD_CHACHA20POLY1305_KEY_LEN] = {0};
    unsigned char iv[12] = {0};
    unsigned char pt[16] = {0};
    unsigned char ct[16];
    unsigned char tag[N_AEAD_CHACHA20POLY1305_TAG_LEN];
    unsigned char back[16];
 
    /* all-zero key/iv/plaintext, no AAD (RFC 8439 cipher) */
    if (n_aead_chacha20poly1305_encrypt(key, iv, sizeof(iv), NULL, 0, pt, sizeof(pt), ct, tag) != 0) {
        failures++;
    } else {
        expect_hex(ct, sizeof(ct), "9f07e7be5551387a98ba977c732d080d", "chacha20poly1305 ct");
        expect_hex(tag, sizeof(tag), "c34a88047320f52aa2c6683ef8084d2f", "chacha20poly1305 tag");
 
        /* decrypting the same vector back returns the zero plaintext */
        if (n_aead_chacha20poly1305_decrypt(key, iv, sizeof(iv), NULL, 0, ct, sizeof(ct), tag, back) != 0)
            failures++;
        else if (memcmp(pt, back, sizeof(pt)) != 0)
            failures++;
    }
 
    /* round-trip with AAD recovers the plaintext; a flipped tag fails auth */
    {
        const unsigned char msg[] = "hello, chacha!";
        size_t mlen = sizeof(msg) - 1;
        unsigned char rk[N_AEAD_CHACHA20POLY1305_KEY_LEN];
        unsigned char riv[12];
        unsigned char rct[16];
        unsigned char rtag[N_AEAD_CHACHA20POLY1305_TAG_LEN];
        unsigned char rback[16];
        size_t i;
        for (i = 0; i < sizeof(rk); i++)
            rk[i] = (unsigned char)(i + 1);
        for (i = 0; i < sizeof(riv); i++)
            riv[i] = (unsigned char)(0x40 + i);
        if (n_aead_chacha20poly1305_encrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, msg, mlen, rct, rtag) != 0)
            failures++;
        else if (n_aead_chacha20poly1305_decrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, rct, mlen, rtag, rback) != 0)
            failures++;
        else if (memcmp(msg, rback, mlen) != 0)
            failures++;
        rtag[0] ^= 0x01;
        if (n_aead_chacha20poly1305_decrypt(rk, riv, sizeof(riv), (const unsigned char*)"aad", 3, rct, mlen, rtag, rback) == 0)
            failures++;
    }
#endif
}
 
static void test_errors(void) {
    unsigned char out[N_DIGEST_SHA256_LEN];
    if (n_digest_sha256(NULL, 4, out) == 0) { /* NULL data with len>0 must fail */
        n_log(LOG_ERR, "sha256(NULL,4) should fail");
        failures++;
    }
    if (n_digest_sha256((const unsigned char*)"x", 1, NULL) == 0) { /* NULL out must fail */
        n_log(LOG_ERR, "sha256 with NULL out should fail");
        failures++;
    }
    if (n_hmac_sha256((const unsigned char*)"k", 1, NULL, 4, out) == 0) {
        n_log(LOG_ERR, "hmac with NULL data,len>0 should fail");
        failures++;
    }
    /* the digest of the empty input is well defined */
    if (n_digest_sha256(NULL, 0, out) != 0) {
        n_log(LOG_ERR, "sha256(NULL,0) should succeed");
        failures++;
    }
}
 
static void test_kdf(void) {
#if !N_KDF_HAVE_EVP_KDF
    /* HKDF and scrypt go through the EVP_KDF provider API, OpenSSL 3.0 and up */
    n_log(LOG_NOTICE, "hkdf/scrypt: skipped, this OpenSSL does not provide EVP_KDF");
#else
    /* RFC 5869 HKDF-SHA256 test case 1 */
    unsigned char ikm[22], salt[13], info[10], okm[42];
    memset(ikm, 0x0b, sizeof(ikm));
    for (size_t i = 0; i < sizeof(salt); i++) salt[i] = (unsigned char)i;
    for (size_t i = 0; i < sizeof(info); i++) info[i] = (unsigned char)(0xf0 + i);
    if (n_kdf_hkdf_sha256(ikm, sizeof(ikm), salt, sizeof(salt), info, sizeof(info), okm, sizeof(okm)) != 0)
        failures++;
    else
        expect_hex(okm, sizeof(okm),
                   "3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865",
                   "hkdf-sha256 (rfc5869 tc1)");
 
    /* RFC 7914 scrypt(P="", S="", N=16, r=1, p=1, dkLen=64) */
    unsigned char dk[64];
    if (n_kdf_scrypt((const unsigned char*)"", 0, (const unsigned char*)"", 0, 16, 1, 1, (uint64_t)1 << 24, dk, sizeof(dk)) != 0)
        failures++;
    else
        expect_hex(dk, sizeof(dk),
                   "77d6576238657b203b19ca42c18a0497f16b4844e3074ae8dfdffa3fede21442fcd0069ded0948f8326a753a0fc81f17e8d3e0fb2e0d3628cf35e20c38d18906",
                   "scrypt (rfc7914)");
#endif
}
 
int main(int argc, char** argv) {
    set_log_level(LOG_ERR);
    process_args(argc, argv);
 
    test_digests();
    test_sha256_hex();
    test_hmac();
    test_hmac_variants();
    test_consttime();
    test_pbkdf2();
    test_kdf();
    test_aead();
    test_aead_chacha();
    test_errors();
 
    if (failures) {
        n_log(LOG_ERR, "ex_digest: %d failure(s)", failures);
        return 1;
    }
    n_log(LOG_NOTICE, "ex_digest: all checks passed");
    return 0;
}