path: root/libotr/libotr-4.1.1/tests/unit/test_dh.c

/*
 * Copyright (C) 2014 - Julien Voisin <julien.voisin@dustri.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License, version 2 only, as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * this program; if not, write to the Free Software Foundation, Inc., 51
 * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include <gcrypt.h>
#include <pthread.h>

#include <dh.h>
#include <proto.h>

#include <tap/tap.h>
#include <utils.h>

GCRY_THREAD_OPTION_PTHREAD_IMPL;

#define NUM_TESTS 38

/*
 * The re-implementation/inclusion of crypto stuff is necessary because libotr
 * doesn't expose them.
 */

static const char* DH1536_MODULUS_S = "0x"
	"FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1"
	"29024E088A67CC74020BBEA63B139B22514A08798E3404DD"
	"EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245"
	"E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED"
	"EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D"
	"C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F"
	"83655D23DCA3AD961C62F356208552BB9ED529077096966D"
	"670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF";
static const char *DH1536_GENERATOR_S = "0x02";
static const int DH1536_MOD_LEN_BITS = 1536;

static gcry_mpi_t DH1536_MODULUS = NULL;
static gcry_mpi_t DH1536_MODULUS_MINUS_2 = NULL;
static gcry_mpi_t DH1536_GENERATOR = NULL;

static void test_otrl_dh_keypair_init(void)
{
	DH_keypair kp;

	otrl_dh_keypair_init(&kp);

	ok(kp.groupid == 0 &&
			kp.priv == NULL &&
			kp.pub == NULL,
			"Keypair initialized");
}

static void test_otrl_dh_keypair_copy(void)
{
	DH_keypair k1, k2;
	unsigned char *buf;

	k1.groupid = rand();

	buf = gcry_random_bytes(32, GCRY_WEAK_RANDOM);
	gcry_mpi_scan(&(k1.priv), GCRYMPI_FMT_USG, buf, 32, NULL);
	gcry_free(buf);

	buf = gcry_random_bytes(32, GCRY_WEAK_RANDOM);
	gcry_mpi_scan(&(k1.pub), GCRYMPI_FMT_USG, buf, 32, NULL);
	gcry_free(buf);

	otrl_dh_keypair_copy(&k2, &k1);

	ok(k1.groupid == k2.groupid &&
			gcry_mpi_cmp(k1.priv, k2.priv) == 0 &&
			gcry_mpi_cmp(k1.pub, k2.pub) == 0,
			"Keypair copied");

	gcry_mpi_release(k1.priv);
	gcry_mpi_release(k1.pub);
	gcry_mpi_release(k2.priv);
	gcry_mpi_release(k2.pub);
}

static void test_otrl_dh_session_free()
{
	DH_sesskeys sess;
	DH_keypair kp1, kp2;
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &(kp1));
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &(kp2));
	otrl_dh_session(&sess, &kp1, kp2.pub);

	otrl_dh_session_free(&sess);

	ok(sess.sendenc == NULL &&
		sess.sendmac == NULL &&
		sess.rcvenc == NULL &&
		sess.rcvmac == NULL &&
		utils_is_zeroed(sess.sendctr, 16) &&
		utils_is_zeroed(sess.rcvctr, 16) &&
		utils_is_zeroed(sess.sendmackey, 16) &&
		utils_is_zeroed(sess.rcvmackey, 16) &&
		sess.sendmacused == 0 &&
		sess.rcvmacused == 0 &&
		utils_is_zeroed(sess.extrakey, OTRL_EXTRAKEY_BYTES),
		"Session freed");
}


static void test_otrl_dh_session_blank()
{
	DH_sesskeys sess;
	DH_keypair kp1, kp2;
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &(kp1));
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &(kp2));
	otrl_dh_session(&sess, &kp1, kp2.pub);

	otrl_dh_session_blank(&sess);

	ok(sess.sendenc == NULL &&
		sess.sendmac == NULL &&
		sess.rcvenc == NULL &&
		sess.rcvmac == NULL &&
		utils_is_zeroed(sess.sendctr, 16) &&
		utils_is_zeroed(sess.rcvctr, 16) &&
		utils_is_zeroed(sess.sendmackey, 16) &&
		utils_is_zeroed(sess.rcvmackey, 16) &&
		sess.sendmacused == 0 &&
		sess.rcvmacused == 0 &&
		utils_is_zeroed(sess.extrakey, OTRL_EXTRAKEY_BYTES),
		"Session blanked");
}

static void test_otrl_dh_gen_keypair(void)
{
	DH_keypair kp;
	gcry_mpi_t pubkey = NULL;

	otrl_dh_keypair_init(&kp);

	ok(otrl_dh_gen_keypair(DH1536_GROUP_ID+1, &kp) ==
			gcry_error(GPG_ERR_INV_VALUE),
			"Invalid group detected");

	ok(otrl_dh_gen_keypair(DH1536_GROUP_ID, &kp) ==
			gcry_error(GPG_ERR_NO_ERROR),
			"Valid group set");
	ok(kp.groupid == DH1536_GROUP_ID, "Group set");

	pubkey = gcry_mpi_new(DH1536_MOD_LEN_BITS);
	gcry_mpi_powm(pubkey, DH1536_GENERATOR, kp.priv, DH1536_MODULUS);
	ok(gcry_mpi_cmp(pubkey, kp.pub) == 0, "Matching pubkey");
	otrl_dh_keypair_free(&kp);
}

static void test_otrl_dh_keypair_free(void)
{
	DH_keypair kp;
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &kp);
	otrl_dh_keypair_free(&kp);
	ok(kp.pub == NULL && kp.priv == NULL && kp.groupid == DH1536_GROUP_ID,
			"DH_keypair free'd with success");

}

static void invert_DH_keypair(DH_keypair* kp1, DH_keypair* kp2)
{
	DH_keypair tmp;
	otrl_dh_keypair_copy(&tmp, kp1);
	otrl_dh_keypair_copy(kp1, kp2);
	otrl_dh_keypair_copy(kp2, &tmp);
	otrl_dh_keypair_free(&tmp);
}

/*
 * This is an helper function. See the next one.
 */
static void _test_ortl_dh_session(const DH_keypair *kp, gcry_mpi_t y)
{
	unsigned char *gabdata;
	unsigned char *hashdata;
	unsigned char encrypt[32] = {0};
	unsigned char expected_encrypt[32] = {0};
	unsigned char sendbyte, rcvbyte;
	const char test_vector[] = "This is a test vector";
	DH_sesskeys sess;
	DH_sesskeys sess_expected;
	gcry_mpi_t gab;
	size_t gablen;
	otrl_dh_session_blank(&sess);
	otrl_dh_session(&sess, kp, y);

	gab = gcry_mpi_snew(DH1536_MOD_LEN_BITS);
	gcry_mpi_powm(gab, y, kp->priv, DH1536_MODULUS);

	gcry_mpi_print(GCRYMPI_FMT_USG, NULL, 0, &gablen, gab);
	gabdata = gcry_malloc_secure(gablen + 5);
	gabdata[1] = (gablen >> 24) & 0xff;
	gabdata[2] = (gablen >> 16) & 0xff;
	gabdata[3] = (gablen >> 8) & 0xff;
	gabdata[4] = gablen & 0xff;
	gcry_mpi_print(GCRYMPI_FMT_USG, gabdata + 5, gablen, NULL, gab);
	gcry_mpi_release(gab);

	hashdata = gcry_malloc_secure(20);

	if (gcry_mpi_cmp(kp->pub, y) > 0 ) {
		sendbyte = 0x01;
		rcvbyte = 0x02;
	} else {
		sendbyte = 0x02;
		rcvbyte = 0x01;
	}

	gabdata[0] = sendbyte;
	gcry_md_hash_buffer(GCRY_MD_SHA1, hashdata, gabdata, gablen + 5);

	gcry_cipher_open(&(sess_expected.sendenc), GCRY_CIPHER_AES,
			GCRY_CIPHER_MODE_CTR, GCRY_CIPHER_SECURE);
	gcry_cipher_setkey(sess_expected.sendenc, hashdata, 16);
	gcry_cipher_encrypt(sess_expected.sendenc, expected_encrypt,
			sizeof(expected_encrypt), test_vector, strlen(test_vector));
	gcry_cipher_encrypt(sess.sendenc, encrypt, sizeof(encrypt), test_vector,
			strlen(test_vector));
	ok(memcmp(encrypt, expected_encrypt, sizeof(encrypt)) == 0, "sendenc ok");

	gcry_md_hash_buffer(GCRY_MD_SHA1, sess_expected.sendmackey, hashdata, 16);
	gcry_md_open(&(sess_expected.sendmac), GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(sess_expected.sendmac, sess_expected.sendmackey, 20);
	gcry_md_write(sess_expected.sendmac, test_vector, sizeof(test_vector));
	gcry_md_write(sess.sendmac, test_vector, sizeof(test_vector));

	ok(memcmp(gcry_md_read(sess_expected.sendmac, 0),
			gcry_md_read(sess.sendmac, 0), 32) == 0,
			"Sendmac ok");

	gabdata[0] = rcvbyte;
	gcry_md_hash_buffer(GCRY_MD_SHA1, hashdata, gabdata, gablen + 5);
	gcry_cipher_open(&(sess_expected.rcvenc), GCRY_CIPHER_AES,
			GCRY_CIPHER_MODE_CTR, GCRY_CIPHER_SECURE);
	gcry_cipher_setkey(sess_expected.rcvenc, hashdata, 16);
	gcry_cipher_encrypt(sess_expected.rcvenc, expected_encrypt,
			sizeof(expected_encrypt), test_vector, strlen(test_vector));
	gcry_cipher_encrypt(sess.rcvenc, encrypt, sizeof(encrypt), test_vector,
			strlen(test_vector));
	ok(memcmp(encrypt, expected_encrypt, sizeof(encrypt)) == 0, "Sendenc ok");

	gcry_md_hash_buffer(GCRY_MD_SHA1, sess_expected.rcvmackey, hashdata, 16);
	gcry_md_open(&(sess_expected.rcvmac), GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(sess_expected.rcvmac, sess_expected.rcvmackey, 20);
	gcry_md_write(sess_expected.rcvmac, test_vector, sizeof(test_vector));
	gcry_md_write(sess.rcvmac, test_vector, sizeof(test_vector));
	ok(memcmp(gcry_md_read(sess_expected.sendmac, 0),
			gcry_md_read(sess.sendmac, 0), 32) == 0,
			"rcvmac ok");

	gabdata[0] = 0xff;

	gcry_md_hash_buffer(GCRY_MD_SHA256, sess_expected.extrakey, gabdata,
			gablen + 5);
	ok(memcmp(sess_expected.extrakey, sess.extrakey, 32) == 0, "extrakey set");

	gcry_free(gabdata);
	gcry_free(hashdata);
}

/*
 * This function is a little bit tricky, since it uses an array of 3
 * DH_keypair. The first one has a smaller pubkey than the second, which has a
 * smaller pubkey than the third one.
 *
 * The second key is used as "main" key. The two other ones are used to test
 * the otrl_dh_session, with a biggest and a smallest key than the "main" one.
 */
static void test_otrl_dh_session(void)
{
	int i;
	DH_keypair kp[3]; /* kp[0] < kp[1] < kp[2] */
	DH_sesskeys sess;

	for (i = 0; i < 3; i++) {
		otrl_dh_gen_keypair(DH1536_GROUP_ID, &(kp[i]));
	}

	/* Sort the array. */
	for (i = 0; i < 2; i++) {
		if (gcry_mpi_cmp(kp[i].pub, kp[i + 1].pub) > 0) {
			invert_DH_keypair(kp + i, kp + i + 1);
		}
	}

	if (gcry_mpi_cmp(kp[0].pub, kp[1].pub) > 0) {
		invert_DH_keypair(kp, kp + 1);
	}

	kp[1].groupid++;

	ok(otrl_dh_session(&sess, &(kp[1]), kp[0].pub) ==
			gcry_error(GPG_ERR_INV_VALUE),
			"Invalid group detected");
	kp[1].groupid--;

	_test_ortl_dh_session(&(kp[1]), kp[0].pub);
	_test_ortl_dh_session(&(kp[1]), kp[2].pub);
}

static void test_otrl_dh_compute_v2_auth_keys(void)
{
	const char test_vector[] = "This is a test vector";
	size_t slen = 0;
	size_t sessionidlenp = 0;
	unsigned char *sdata = NULL;
	unsigned char *hashdata = NULL;
	gcry_mpi_t s = NULL;
	unsigned char ctr[16] = {0};

	DH_keypair our_dh, their_dh;
	gcry_mpi_t public_key = NULL;

	unsigned char sessionid[8];
	gcry_md_hd_t mac_m1 = NULL, mac_m1p = NULL, mac_m2 = NULL, mac_m2p = NULL;
	gcry_cipher_hd_t enc_c = NULL, enc_cp = NULL;
	unsigned char encrypt[32] = {0};

	unsigned char sessionid_expected[8];

	gcry_md_hd_t mac_m1_expected = NULL, mac_m1p_expected = NULL;
	gcry_md_hd_t mac_m2_expected = NULL, mac_m2p_expected = NULL;
	gcry_cipher_hd_t enc_c_expected = NULL, enc_cp_expected = NULL;
	unsigned char expected_encrypt[32] = {0};

	otrl_dh_gen_keypair(DH1536_GROUP_ID, &our_dh);
	otrl_dh_gen_keypair(DH1536_GROUP_ID, &their_dh);

	our_dh.groupid++;
	ok(otrl_dh_compute_v2_auth_keys(&our_dh, their_dh.pub,
			sessionid, &sessionidlenp, &enc_c, &enc_cp,
			&mac_m1, &mac_m1p, &mac_m2, &mac_m2p)
			== gcry_error(GPG_ERR_INV_VALUE),
			"Invalid group detected");
	our_dh.groupid--;

	gcry_mpi_scan(&public_key, GCRYMPI_FMT_USG, "1", 0, NULL);

	ok(otrl_dh_compute_v2_auth_keys(&our_dh, public_key,
			sessionid, &sessionidlenp, &enc_c, &enc_cp,
			&mac_m1, &mac_m1p, &mac_m2, &mac_m2p)
			== gcry_error(GPG_ERR_INV_VALUE),
			"Public key too small");

	gcry_mpi_scan(&public_key, GCRYMPI_FMT_HEX,
			(const unsigned char *) DH1536_MODULUS_S, 0, NULL);
	gcry_mpi_add_ui(public_key, DH1536_MODULUS, 1);

	ok(otrl_dh_compute_v2_auth_keys(&our_dh, DH1536_MODULUS,
			sessionid, &sessionidlenp, &enc_c, &enc_cp,
			&mac_m1, &mac_m1p, &mac_m2, &mac_m2p)
			== gcry_error(GPG_ERR_INV_VALUE),
			"Public key too big");

	ok(otrl_dh_compute_v2_auth_keys(&our_dh, their_dh.pub, sessionid,
			&sessionidlenp, &enc_c, &enc_cp, &mac_m1, &mac_m1p, &mac_m2,
			&mac_m2p) == gcry_error(GPG_ERR_NO_ERROR),
			"Auth keys generated");

	ok(sessionidlenp == 8, "Session id len p set to correct value");

	s = gcry_mpi_snew(DH1536_MOD_LEN_BITS);
	gcry_mpi_powm(s, their_dh.pub, our_dh.priv, DH1536_MODULUS);

	gcry_mpi_print(GCRYMPI_FMT_USG, NULL, 0, &slen, s);
	sdata = gcry_malloc_secure(slen + 5);
	sdata[1] = (slen >> 24) & 0xff;
	sdata[2] = (slen >> 16) & 0xff;
	sdata[3] = (slen >> 8) & 0xff;
	sdata[4] = slen & 0xff;
	gcry_mpi_print(GCRYMPI_FMT_USG, sdata+5, slen, NULL, s);
	gcry_mpi_release(s);

	hashdata = gcry_malloc_secure(32);
	sdata[0] = 0x00;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);
	memmove(sessionid_expected, hashdata, 8);
	ok(memcmp(sessionid_expected, sessionid, 8) == 0, "Session id is correct");

	sdata[0] = 0x01;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);

	gcry_cipher_open(&enc_c_expected, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR,
			GCRY_CIPHER_SECURE);
	gcry_cipher_setkey(enc_c_expected, hashdata, 16);
	gcry_cipher_setctr(enc_c_expected, ctr, 16);

	gcry_cipher_encrypt(enc_c_expected, expected_encrypt,
			sizeof(expected_encrypt), test_vector, strlen(test_vector));
	gcry_cipher_encrypt(enc_c, encrypt, sizeof(encrypt), test_vector,
			strlen(test_vector));
	ok(memcmp(encrypt, expected_encrypt, sizeof(encrypt)) == 0, "Enc ok");

	gcry_cipher_open(&(enc_cp_expected), GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR,
			GCRY_CIPHER_SECURE);
	gcry_cipher_setkey(enc_cp_expected, hashdata+16, 16);
	gcry_cipher_setctr(enc_cp_expected, ctr, 16);
	gcry_cipher_encrypt(enc_cp_expected, expected_encrypt,
			sizeof(expected_encrypt), test_vector, strlen(test_vector));
	gcry_cipher_encrypt(enc_cp, encrypt, sizeof(encrypt), test_vector,
			strlen(test_vector));
	ok(memcmp(encrypt, expected_encrypt, sizeof(encrypt)) == 0, "Encp ok");

	sdata[0] = 0x02;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);
	gcry_md_open(&mac_m1_expected, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(mac_m1_expected, hashdata, 32);
	gcry_md_write(mac_m1_expected, test_vector, sizeof(test_vector));
	gcry_md_write(mac_m1, test_vector, sizeof(test_vector));
	ok(memcmp(gcry_md_read(mac_m1_expected, 0),
			gcry_md_read(mac_m1, 0), 32) == 0,
			"mac_m1 set");

	sdata[0] = 0x03;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);
	gcry_md_open(&mac_m2_expected, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(mac_m2_expected, hashdata, 32);
	gcry_md_write(mac_m2_expected, test_vector, sizeof(test_vector));
	gcry_md_write(mac_m2, test_vector, sizeof(test_vector));
	ok(memcmp(gcry_md_read(mac_m2_expected, 0),
			gcry_md_read(mac_m2, 0), 32) == 0,
			"mac_m2 set");

	sdata[0] = 0x04;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);
	gcry_md_open(&mac_m1p_expected, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(mac_m1p_expected, hashdata, 32);
	gcry_md_write(mac_m1p_expected, test_vector, sizeof(test_vector));
	gcry_md_write(mac_m1p, test_vector, sizeof(test_vector));

	ok(memcmp(gcry_md_read(mac_m1p_expected, 0),
			gcry_md_read(mac_m1p, 0), 32) == 0,
			"mac_m1p set");

	sdata[0] = 0x05;
	gcry_md_hash_buffer(GCRY_MD_SHA256, hashdata, sdata, slen+5);
	gcry_md_open(&mac_m2p_expected, GCRY_MD_SHA256, GCRY_MD_FLAG_HMAC);
	gcry_md_setkey(mac_m2p_expected, hashdata, 32);
	gcry_md_write(mac_m2p_expected, test_vector, sizeof(test_vector));
	gcry_md_write(mac_m2p, test_vector, sizeof(test_vector));

	ok(memcmp(gcry_md_read(mac_m2p_expected, 0),
			gcry_md_read(mac_m2p, 0), 32) == 0,
			"mac_m2p set");

	gcry_free(sdata);
	gcry_free(hashdata);
}

static void test_otrl_dh_incctr()
{
	unsigned char ctr[8] = {0};
	otrl_dh_incctr(ctr);
	ok(ctr[7] == 1 && utils_is_zeroed(ctr, 7), "Counter set");
	ctr[7] = 255;
	otrl_dh_incctr(ctr);
	ok(ctr[7] == 0 && ctr[6] == 1 && utils_is_zeroed(ctr, 5),
			"Counter set");
	memset(ctr, 255, sizeof(ctr));
	otrl_dh_incctr(ctr);
	ok(utils_is_zeroed(ctr, sizeof(ctr)), "Counter set");
}

static void test_otrl_dh_cmpctr()
{
	unsigned char ctr1[8] = {0}, ctr2[8] = {0};
	ok(otrl_dh_cmpctr(ctr1, ctr2) == 0, "Null counters are equals");
	ctr1[1]++;
	ok(otrl_dh_cmpctr(ctr1, ctr2) > 0, "Ctr1 is bigger than ctr2");
	ctr2[0]++;
	ok(otrl_dh_cmpctr(ctr1, ctr2) < 0, "Ctr2 is bigger than ctr1");
}

int main(int argc, char **argv)
{
	plan_tests(NUM_TESTS);

	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
	OTRL_INIT;

	otrl_dh_init();

	gcry_mpi_scan(&DH1536_MODULUS, GCRYMPI_FMT_HEX,
	(const unsigned char *)DH1536_MODULUS_S, 0, NULL);
	gcry_mpi_scan(&DH1536_GENERATOR, GCRYMPI_FMT_HEX,
	(const unsigned char *)DH1536_GENERATOR_S, 0, NULL);
	DH1536_MODULUS_MINUS_2 = gcry_mpi_new(DH1536_MOD_LEN_BITS);
	gcry_mpi_sub_ui(DH1536_MODULUS_MINUS_2, DH1536_MODULUS, 2);

	test_otrl_dh_gen_keypair();
	test_otrl_dh_keypair_free();
	test_otrl_dh_keypair_init();
	test_otrl_dh_compute_v2_auth_keys();
	test_otrl_dh_session();
	test_otrl_dh_keypair_copy();
	test_otrl_dh_session_blank();
	test_otrl_dh_session_free();
	test_otrl_dh_incctr();
	test_otrl_dh_cmpctr();

	return 0;
}