BouncyCastle had an implementation for X25519 and X448 for some time.
But the JCA interface has been added only recently in version 1.61.
There is an overflow bug in this version that will be fixed
upstream in verion 1.63.
The tests ignore some minor bugs (Runtime exceptions instead of
checked exceptions) so that the test against BouncyCastle can be
added as a presubmit test.
Changing the ASN encoding of XDH keys.
Previously they used the jdk encoding.
This encoding was wrong.
NOKEYCHECK=True
PiperOrigin-RevId: 264348566
GitOrigin-RevId: 6564f188a3ed50f73c48cb8c41833d8c3798ab78
jdk11 did add ED25519 and ED448.
BC supports ED25519, but is slightly malleable.
Conscrypt supports none (rsp. uses different algorithm names).
This is related to
https://github.com/google/tink/issues/224
However, tests for signatures are still missing.
NOKEYCHECK=True
PiperOrigin-RevId: 260726100
GitOrigin-RevId: c4c5855aa3e86c0e47ad88f16e6496b98149364f
AES-GMAC is equivalent to encrypting with AES-GCM an empty plaintext, using passing the
data to authenticate as additional data.
AES-GMAC is supported by keymaster and BouncyCastle.
keymaster has fixed nonce sizes and tag sizes (128-bits).
BouncyCastle has a fixed tag size (128-bit) when used through the JCE
interface.
NOKEYCHECK=True
PiperOrigin-RevId: 257385648
GitOrigin-RevId: d6947fd3604ca782078b7a02bab2a95160df2501
The test vectors replace the previous test for padding oracles, which
had to generate a new key. The test vectors add some new
test cases that are edge cases for the modular exponentiation.
NOKEYCHECK=True
PiperOrigin-RevId: 236813461
GitOrigin-RevId: a92ab2a6af48d3285735fbf5c8ecb66c0750f46b
Extending the tests for signature bias.
E.g. biased signature generations that
choose s' as min(s, q-s) because of
signature malleability will not be detected.
Such implementations exist:
https://eprint.iacr.org/2019/023.pdf
Removing test vectors in the tests.
These test vectors are no longer necessary, since there
are more test vectors in the JSON files. Additionally,
the test vectors here are old and have not been updated.
Replacing comparisons for test vector version with comparisons
for the JSON schema. A new schema (with a different name) will
be used whenever the format of the test vectors changes without
backwards compatibility. Hence the JSON schema should change less
frequently than the version and give a better indication whether
test vectors and test match.
Reducing the log size a bit.
Bugs:
b/33190860: default key size for DSA is now 2048. This has been
fixed by Oracle.
NOKEYCHECK=True
PiperOrigin-RevId: 232647129
GitOrigin-RevId: 76f43890f0115a2ff72c6078a3376a96882a1504
Switching to test vector files that contain vectors for one curve only.
This covers more test cases, allows to skip test vectors for curves not
supported by a library.
ecdh_test.json contains tests for multiple curves, but is somewhat limited
in coverage.
Sanity checks for using expected files are now based on the JSON schema.
I.e. if the expected and actual JSON schema of the test vector file match,
then the test should pass, otherwise there is a problem with the test setup.
Removing tests covered by test vectors from EcdhTest.java.
Adding timing test for ECDH:
The tests require to run on a system without much noise:
E.g. running a regular unit test is too noisy.
The confidence level is too low to fail the test:
ECDH timing test:secp256r1
Timing for point 0 avg: 4062844.9155273438 std dev: 452064.39579909603 cv:0.11126794283271814
Timing for point 1 avg: 4077776.20703125 std dev: 457662.5685428607 cv:0.1122333706675025
Point 0 multiplication is faster: 1152
Running the same test locally adds less noise.
The ratio avg / std dev is 10 times smaller.
Here the test run shows that time of a point multiplication depends on the
point that is multiplied.
ECDH timing test:secp256r1
Timing for point 0 avg: 1611269.970703125 std dev: 30329.312528547747 cv:0.018823234516877802
Timing for point 1 avg: 1618931.3715820312 std dev: 29267.753517245954 cv:0.01807843990857086
Point 0 multiplication is faster: 1655
NOKEYCHECK=True
PiperOrigin-RevId: 232286329
GitOrigin-RevId: 1bbbd6422c8fd64f3d5ea2fc3ecb94c6bd7bc171
BouncyCastle, jdk11 and hashlib in python 3.6 support SHA-3.
All libraries give the same result.
Some test runs:
blaze test :BouncyCastleAllTests
http://sponge/087b2160-0d69-47b2-b679-2f95c64fd205
blaze test //third_party/wycheproof:OpenJDKAllTests --javabase=//third_party/java/jdk:jdk11
http://sponge/4b1e9175-cb3f-421d-9d3f-dee6483a4a0d
NOKEYCHECK=True
PiperOrigin-RevId: 222516231
GitOrigin-RevId: f03a46bd3f92ed0a977180e68c0fbfb198edb3de
The goal of this test is to ensure that all providers use the same default values
for RSA-PSS. At the moment BouncyCastle and Conscrypt implement RSA-PSS using the
same parameters (jdk has an update that has not yet imported to google3 yet).
At least some other provider seem to support the same defaults:
http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/security/rsa/SHA256withRSAandMGF1Signature.html
PiperOrigin-RevId: 207679073
GitOrigin-RevId: 8196db8d6326f28c07c0434925079236ad76e589
Instead of inducing a fault (I don't know how to do this), the test uses
faulty CRT parameters.
Results:
All Java providers pass.
OpenJdk: Generating PKCS#1 signature with faulty key throws:java.security.SignatureException: Could not sign data
BouncyCastle: Generating PKCS#1 signature with faulty key throws:java.security.SignatureException: java.lang.IllegalStateException: RSA engine faulty decryption/signing detected
Conscrypt: Generating PKCS#1 signature with faulty key throws:java.security.SignatureException: java.lang.RuntimeException: error:04000044:RSA routines:OPENSSL_internal:internal error
PiperOrigin-RevId: 207514657
GitOrigin-RevId: ced32b741745a87fb13672eeb2e0ef17ab778d78
salt length do not match. Applications typically used RSA-PSS such
that signature hash and mgf hash are the same and the salt length
is either 0 or the size of the hash.
RFC 8017 allows other combinations. These test check that such
combinations are either rejected or are implemented correctly.
The test file contains just one valid signature for each combination
of mgf-hash signature-hash, salt length that is tested.
Results:
BoringSSL accepts all signatures.
BouncyCastle rejects signatures where mgf and signature hash do not match.
Conscrypt rejects signatures where mgf and signature hash do not match.
Jdk (i.e. the version we have in google3) does not implement RSA-PSS yet.
PiperOrigin-RevId: 206761543
GitOrigin-RevId: f5cffdf23fc04cc0b15925c34c0cb74dfda51737
google3 switched from version 1.52 to 1.59.
Hence some tests no longer fail.
- DSA now has a 2048 bit default
- Ecies with AES-CBC no longer has a padding oracle.
BC fixed more bugs between version 1.52 and 1.59.
But most of these bugs were were already fixed internally in google3.
PiperOrigin-RevId: 206161567
GitOrigin-RevId: 5cc85701f13635f4bfca70d5f0cd285125b70999
This mainly adds tests for RSA-PSS.
BoringSSL is OK.
BouncyCastle has a minor bug.
OpenJdk is adding PSS, but we don't have that version yet.
Some test run:
http://sponge/a0f74aa9-cbf9-4e8c-8328-7763a8c202dc
PiperOrigin-RevId: 206120374
GitOrigin-RevId: 77979cd774420794645b988bc8e71d3d727f0ddd
Tests using the new test vectors will be added in another CL.
Changes:
AES-GCM has test vectors for modified tags, which were previously missing.
ECDSA has more test vectors for potential arithmetic errors.
There are no more random test vectors.
Webcrypto has a few test vectors with the bitcoin curve (since some libraries
want to add this).
DSA and ECDSA have more invalid test vectors with r,s = ((q-1)/2 or q-1).
This is motivated by some weak ElGamal implementation in beecrypt.
ECDH test vectors have some new files where the public key is just a point
using SEC 1 / X9.62 format.
All tests for ASN modifications are removed from ecdh_test.json, so that
this file has a more resonable size. These test vectors are included in
the files ecdh_curve_test.json.
EDDSA has a few more invalid test vectors for malformed signatures.
(I.e. the python implementation in the RFC has a small bug).
Adding test vectors for AES-CCM. (tested against BouncyCastle, which sort of
abuses the JCE interface)
There are some test vectors for RSA-PSS (so far tested with BouncyCastle and boringSSL)
More tests will be added when we have an idea what is actually being used.
PiperOrigin-RevId: 205802874
GitOrigin-RevId: 250ab89370a0dcfc56e887fb185a494f45f9a3f5
* Add more information about the used Java Runtime and the tested provider version
* Added some recent information about SunEC and Utimaco HSM problems
This supports RFC 3394 and RFC 5649,
which is also described in NIST SP 800 38f.
I also have a mini analysis of the primitive:
If one cares about distinguishing attacks then
there is an attack with a somewhat smaller complexity
than what NIST claims in their standard:
https://docs.google.com/document/d/1oH36v6SNdff5tkydC75EnqRyqqgHbXR4hy_SMPzwqVU/edit?usp=sharing
But even if one cares about these attacks then the key
wrappings are nowhere comparable to the attacks possible against e.g.
AES-GCM.
PiperOrigin-RevId: 192747615
GitOrigin-RevId: 0bebc767022ba3053c1d0391378d5c0b32b7f5be
- Remove `extends TestCase` which triggered usage of the JUnit3 runner
- Replace `import static org.junit.Assert.assertArrayEquals;` with `import static org.junit.Assert.*;`
- Replace `import junit.framework.TestCase;` with `import org.junit.Test;`
- Annotate all existing test methods (that are prefixed with 'test' and have no args) with `@Test`
update/doFinal are required to be "copy-safe". From the javadoc:
Note: this method should be copy-safe, which means the input and output
buffers can reference the same block of memory and no unprocessed input
data is overwritten when the result is copied into the output buffer.
However many implementations of JCE methods do not implement this property in
all cases. Notably, BouncyCastle fails this test on arrays, and the built-in
OpenJDK providers fail when the input bytebuffer is either a read-only
array-backed byte buffer, or if the buffers are direct buffers. For SunJCE,
this has been acknowledged publicly by Oracle at
https://bugs.openjdk.java.net/browse/JDK-8181386 .
These new tests verify correct overlapping buffer handling for AES/GCM
specifically; as future work, it would be good to generalize these tests for
other ciphers and modes.
The current code fails to initialize the cipher c after a c.doFinal()
fails. According to JCE documentation, a cipher is in an undefined state
after throwing an exception.
- add maven entry for BC 1.56 and update the versions range
- DHIES weak crypto tests now pass if algs not even supported
- some ECIES entries moved to the invalid list
- ECIES decryption init calls fixed to pass the correct parameters
- EciesTest.testModifyPoint now expects GeneralSecurityException
* Removing duplicates from BigIntegerTest.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=142548323
* Remove @NoPresubmitCheck from testModifiedPublic() and testModifiedPublicSpec(). The corresponding bug was fixed in BC 1.55 or BC 1.56.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=142561682
* minor typos
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=142743772
* Regenerating the test vectors for ECDSA:
- this adds more comments for bugtypes and modifications or the signatures.
- fixes some ugly formatting.
- adds some additional test vectors.
There are no new bugs.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=144619819
* Regenerating DSA test vectors:
This adds a few more test vectors.
The test vectors are now divided between test vectors with valid BER encodings
and test vectors with invalid DER encodings.
The description of the test vector better describes what was modified.
Also fixing issue #17 on Github: testVectors in DsaTest not using the message parameter
There are no changes to the presubmit tests. Tests that can be enabled because of the
Oracles security update will be added in another CL.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=144814889
* Regenerating test vectors for EcdhTest.java
Merging a test with small order into the test vectors.
Fixing ASN encoding of 0 (from 0200 to 020100, i.e. length must be > 0).
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=144815129
* Regenerating RSA signatures.
Adding test vectors that were removed because of b/31575502. Oracle fixes this with CVE-2016-5547.
Changing ASN tags with value 0x50 to 0x30 (0x50 would be something like sequence of sequence but does not exist), hence the old vectors are unlikely to cause problems.
Adding more modifications of OIDs. The new vectors unpack the OIDs and change the nodes.
(E.g. the OID for sha256 is the hexadecimal string "608648016503040201" which is an
ASN encoding of "2.16.840.1.101.3.4.2.1". The new test vectors include invalid encoding,
encodings with additional nodes, deleted nodes and nodes that are changed to large integers)
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=144846826
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=145060646
* Removing presubmit restrictions for tests that have been fixed internally and upstream.
Mainly these are tests with CVEs that were announced during the Jan 17 security update
by Oracle.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=145397539
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=145418516
* Adding the CVE numbers from Oracles Jan 17 security update to the documentation.
Minor changes to some test vectors: Some of the garbage added to the ASN encoding
was itself incorrect and has been replaced.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=145650774
* ECDSA MODIFIED_SIGNATURES should be public now.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=146186539
bleichen