Project import generated by Copybara.

PiperOrigin-RevId: 191113399 GitOrigin-RevId: cfebd59d1f086e907f468004c7d033199d116fad
2018-03-30 17:03:22 -04:00
parent 72412ae03c
commit 31387e2cd5
95 changed files with 131371 additions and 22 deletions
@@ -0,0 +1,106 @@
+/**
+ * @license
+ * Copyright 2017 Google Inc. All rights reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Tests for RSA-OAEP encryption implementations of Web Crypto API.
+ */
+goog.provide('wycheproof.webcryptoapi.RSA-OAED');
+goog.require('e2e.random');
+goog.require('goog.testing.asserts');
+goog.require('goog.testing.jsunit');
+goog.require('wycheproof.TestUtil');
+goog.require('wycheproof.webcryptoapi.RsaUtil');
+
+var RsaUtil = wycheproof.webcryptoapi.RsaUtil;
+var TestUtil = wycheproof.TestUtil;
+
+/**
+ * Tries decrypting random messages with a given algorithm. Counts the number of distinct error
+ * messages and expects this number to be 1.
+ *
+ * <p><b>References:</b>
+ *
+ * <ul>
+ *   <li>Bleichenbacher, "Chosen ciphertext attacks against protocols based on the RSA encryption
+ *       standard PKCS# 1" Crypto 98
+ *   <li>Manger, "A chosen ciphertext attack on RSA optimal asymmetric encryption padding (OAEP)
+ *       as standardized in PKCS# 1 v2.0", Crypto 2001 This paper shows that OAEP is susceptible
+ *       to a chosen ciphertext attack if error messages distinguish between different failure
+ *       condidtions.
+ *   <li>Bardou, Focardi, Kawamoto, Simionato, Steel, Tsay "Efficient Padding Oracle Attacks on
+ *       Cryptographic Hardware", Crypto 2012 The paper shows that small differences on what
+ *       information an attacker recieves can make a big difference on the number of chosen
+ *       message necessary for an attack.
+ *   <li>Smart, "Errors matter: Breaking RSA-based PIN encryption with thirty ciphertext validity
+ *       queries" RSA conference, 2010 This paper shows that padding oracle attacks can be
+ *       successful with even a small number of queries.
+ * </ul>
+ *
+ * <p><b>Some recent bugs:</b> CVE-2012-5081: Java JSSE provider leaked information through
+ * exceptions and timing. Both the PKCS #1 padding and the OAEP padding were broken:
+ * http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/MeyerChristopher/diss.pdf
+ *
+ * <p><b>What this test does not (yet) cover:</b>
+ *
+ * <ul>
+ *   <li> A previous version of one of the provider leaked the block type. (when was this fixed?)
+ *   <li> Some attacks require a large number of ciphertexts to be detected if random ciphertexts
+ *       are used. Such problems require specifically crafted ciphertexts to run in a unit test.
+ *       E.g. "Attacking RSA-based Sessions in SSL/TLS" by V. Klima, O. Pokorny, and T. Rosa:
+ *       https://eprint.iacr.org/2003/052/
+ *   <li> Timing leakages because of differences in parsing the padding (e.g. CVE-2015-7827) Such
+ *       differences are too small to be reliably detectable in unit tests.
+ * </ul>
+ *
+ * @return {!Promise}
+ */
+function testRsaEncryptionException() {
+  var promise = new Promise(function(resolve, reject){
+    var scheme = RsaUtil.RSA_OAEP;
+    var keySize = 1024;
+    var e = RsaUtil.E_65537;
+    var hashAlg = 'SHA-256';
+    var usages = ['encrypt', 'decrypt'];
+    var ctLen = keySize/8;
+    var nTest = 1000;
+    var nDone = 0;
+    var exceptions = new Set();
+    RsaUtil.generateKey(scheme, keySize, e, hashAlg, usages).then(function(key) {
+      for (var i = 0; i < nTest; i++) {
+        var ct = new Uint8Array(e2e.random.getRandomBytes(ctLen)).buffer;
+        RsaUtil.decrypt(scheme, key.privateKey, ct).then(function(pt){
+          reject('RSA-OAEP decryption should not succeed on random bytes');
+        }).catch(function(err){
+          exceptions.add(err.name + ': ' + err.message);
+          nDone += 1;
+          if (nDone == nTest) {
+            if (exceptions.size > 1) {
+              var msg = 'Exceptions leak information about the padding for ' + scheme + '\n';
+              exceptions.forEach(function(e) {
+                msg += e;
+              });
+              reject(msg);
+            }
+            resolve();
+          }
+        });
+      }
+    }).catch(function(err){
+      reject('Failed to generate key: ' + err);
+    });
+  });
+  return promise;
+}