Main changes:
BigInteger encoding is now always a multiple of 2.
Comments try to be a bit more precise. This leads to a different
grouping of the test vectors.
All test vectors with result="acceptable" have at least one
flag.
New vectors:
AEGIS: adding test vectors with the same tag (basically just
answers the question: is AEGIS a hash?)
Test vectors from old versions of the cipher now have ciphertext.
I.e. both encrypting or decrypting should tell testers that they
are using old versions.
AES-CMAC: more test vectors with 128-bit tag.
DSA, ECDSA: better description of the ASN modifications (this reorders
the test vectors) and a few more ASN modifications
KWP: adding modified paddings
XDH: adding more edge cases, no longer using the same private key for multiple
test vectors.
RSA-PSS: adding more valid test vectors. The new test vectors have an edge case
message digest.
NOKEYCHECK=True
PiperOrigin-RevId: 264817632
GitOrigin-RevId: 0c8e6eec11db1ca7088f89d0c1de48c5af892e47
Changes:
* Unused flags are no longer listed in "notes:"
* Added some new invalid encoding containing special values such as NaN.
* Adding jwk keys to RSA-OAEP test vectors if the jwk key is defined.
* Adding a flag InvalidOaepPadding to RSA-OAEP test vectors to test vectors
where leaking padding information might allow Manger's attack.
* Adding test vectors for invalid padding: PKCS-1 padding for PSS signatures
signatures without hashing.
* Adding test vectors from RFC 8037 to XDH. (There is not enough cross checking
otherwise, since most libraries don't implement XDH).
NOKEYCHECK=True
PiperOrigin-RevId: 237066566
GitOrigin-RevId: 44dd5c1fda5d152b6741824ad9d5400b4cffd6aa
Changing incorrect documentation in the header:
The public keys are X509 encoded. Private keys are just integers.
Adding some more edge cases:
These are mostly cases where the y coordinate is a special case.
Such special cases can lead to overflows if the point is normalized
during the ECDH compuation. A normalization is sometimes done in
precomputations.
Somewhat better comments: I.e. explain what the edge case is.
Removing unnecessary notes: Sometimes test vectors with labels are generated,
but not used because encoding can't handle the test vectors. Previously the
label would still end up in the notes section. This has been removed.
NOKEYCHECK=True
PiperOrigin-RevId: 232640195
GitOrigin-RevId: b2bae8ea496a482297ea92f125d7762990015a33
There are format changes:
* All test vector files contain a new field schema,
which points to a JSON schema definition
in the directory wycheproof/schema.
* More consistent type definition:
E.g. the field "type" in a testGroup is now describing the
type of the test the vectors are intended for. The type of
the test defines formatting (e.g. whether signatures use
P1363 encoding or ASN encoding) and the tested operation
(e.g. whether the test vectors signatures are primarily
are meant for verification or signature generation)
The test types will also be included in the documentation.
* More unified test vectors:
RSA-PKCS#1 v1.5 signature no longer have a field "padding".
* Added public and private keys in jwk format.
This is done when the jwk format is defined and
where the key format is not part of the test.
Additional test vectors:
* Added vectors for edge cases that can occur
in ECDH computations with projective or Jacobian
coordinates. In particular this implements a detection for the
attack in "Zero-Value Point Attacks on Elliptic Curve Cryptosystem"
by T.Akishita and T Takagi, ISC 2003
* Added more edge cases for Xdh.
* Added more test cases for ASN parsing (e.g. high number tags)
* Added test vectors for CVE-2017-18330 to CCM and EAX.
* Added more edge cases for poly1305
* Added test vectors for HKDF.
* Removed some duplicates in the test vectors.
NOKEYCHECK=True
PiperOrigin-RevId: 228700977
GitOrigin-RevId: 5708361fc71a2089a5c102be7d73adbc3b3b8efd
Tests using the new test vectors will be added in another CL.
Changes:
AES-GCM has test vectors for modified tags, which were previously missing.
ECDSA has more test vectors for potential arithmetic errors.
There are no more random test vectors.
Webcrypto has a few test vectors with the bitcoin curve (since some libraries
want to add this).
DSA and ECDSA have more invalid test vectors with r,s = ((q-1)/2 or q-1).
This is motivated by some weak ElGamal implementation in beecrypt.
ECDH test vectors have some new files where the public key is just a point
using SEC 1 / X9.62 format.
All tests for ASN modifications are removed from ecdh_test.json, so that
this file has a more resonable size. These test vectors are included in
the files ecdh_curve_test.json.
EDDSA has a few more invalid test vectors for malformed signatures.
(I.e. the python implementation in the RFC has a small bug).
Adding test vectors for AES-CCM. (tested against BouncyCastle, which sort of
abuses the JCE interface)
There are some test vectors for RSA-PSS (so far tested with BouncyCastle and boringSSL)
More tests will be added when we have an idea what is actually being used.
PiperOrigin-RevId: 205802874
GitOrigin-RevId: 250ab89370a0dcfc56e887fb185a494f45f9a3f5
This CL only adds test vectors.
Changes using the new test vectors are in CL 199130745.
There are the following changes to version 0.4:
ECDSA test vectors with a valid signature but non-DER encoding
have "result":"invalid" and have the flag "BER".
Version 0.4.4 has some additional test vectors:
- Tests for invalid encoding of the INTEGER 0 (i.e. "0200" instead
of "020100")
- Truncation after the ASN tag.
- ECDH test vectors now include shared secrets in invalid test vectors.
This allows to check if an implementation is just sloppy at comparing
public keys (i.e. ignoring parameters) or vulnerable (i.e. using
modified parameters for ECDH computation)
- More tests vectors like the unexplained test vector in b/74209208
- ECDH now has tests vectors where public and private keys are
on different, but isomorphic curves. The result is invalid, since
the encoding of the shared secret is undefined.
- ECDH has test vectors with modified ASN. Again the shared secret
computed with the original public key is included so that it is
a bit easier to distinguish between serious and non-serious cases.
- Some third party test cases were added to all files. They are
removed.
Version 0.4.5:
- adds more test vectors for ECDSA.
- adds more test vectors for RSA signatures and splits the signatures
into more files, sorted by key size and hash.
Version 0.4.6:
- adds an uncompressed encoding to EC keys.
- rsa_signature_test.json now contains more keys for size 1024 to 4096.
Most keys only contain a small number of tests.
More extensive tests are done with a 2048 bit key only.
New bugs:
BouncyCastle and ConsCrypt both accepts some invalid keys (with
additional garbage) as valid. These bugs are currently silenced
by marking the test vectors as acceptable. I.e. the first goal is
to verify that invalid ECDH keys cannot be used to find the private
key.
PiperOrigin-RevId: 199611433
GitOrigin-RevId: f1f99cc52617e18224ec98f84dcaa55c42df9b46
bleichen