c2simd/aead_fused_test.go at master · hazyhaar/c2simd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
// SPDX-License-Identifier: Apache-2.0 OR MIT

//go:build goexperiment.simd && amd64

package c2simd

import (
	"bytes"
	"crypto/rand"
	"testing"

	"golang.org/x/crypto/chacha20poly1305"
)

func TestAEADFused_ParityXCrypto(t *testing.T) {
	sizes := []int{704, 705, 1023, 1024, 1350, 4095, 4096, 4097, 8192, 65536, 1 << 20}
	ads := []int{0, 13, 1000}
	for _, n := range sizes {
		for _, adn := range ads {
			for trial := 0; trial < 200; trial++ {
				subkey := make([]byte, 32)
				nonce := make([]byte, 12)
				plain := make([]byte, n)
				ad := make([]byte, adn)
				rand.Read(subkey)
				rand.Read(nonce)
				rand.Read(plain)
				if adn > 0 {
					rand.Read(ad)
				}
				ref, err := chacha20poly1305.New(subkey)
				if err != nil {
					t.Fatal(err)
				}
				want := ref.Seal(nil, nonce, plain, ad)
				var mac [16]byte
				ct, err := AEADSubkeyLockDst(nil, &mac, subkey, nonce, ad, plain)
				if err != nil {
					t.Fatalf("n=%d ad=%d trial=%d lock: %v", n, adn, trial, err)
				}
				if !bytes.Equal(ct, want[:n]) || !bytes.Equal(mac[:], want[n:]) {
					t.Fatalf("n=%d ad=%d trial=%d lock diverge de x/crypto", n, adn, trial)
				}
				pt, err := AEADSubkeyUnlockDst(nil, subkey, nonce, ad, ct, mac[:])
				if err != nil {
					t.Fatalf("n=%d ad=%d trial=%d unlock: %v", n, adn, trial, err)
				}
				if !bytes.Equal(pt, plain) {
					t.Fatalf("n=%d ad=%d trial=%d unlock ne restitue pas le clair", n, adn, trial)
				}
			}
		}
	}
}

func TestAEADFused_BadMACNoPlaintext(t *testing.T) {
	sizes := []int{704, 1350, 8192}
	for _, n := range sizes {
		subkey := make([]byte, 32)
		nonce := make([]byte, 12)
		plain := make([]byte, n)
		rand.Read(subkey)
		rand.Read(nonce)
		rand.Read(plain)
		var mac [16]byte
		ct, err := AEADSubkeyLockDst(nil, &mac, subkey, nonce, nil, plain)
		if err != nil {
			t.Fatal(err)
		}
		bad := mac
		bad[0] ^= 1
		dst := make([]byte, n)
		for i := range dst {
			dst[i] = 0xA5
		}
		pt, err := AEADSubkeyUnlockDst(dst, subkey, nonce, nil, ct, bad[:])
		if err == nil {
			t.Fatalf("n=%d : MAC altéré accepté", n)
		}
		if pt != nil {
			t.Fatalf("n=%d : clair rendu malgré MAC invalide", n)
		}
		if bytes.Equal(dst, plain) {
			t.Fatalf("n=%d : clair laissé dans le tampon après MAC invalide", n)
		}
		for _, b := range dst {
			if b != 0 {
				t.Fatalf("n=%d : tampon non effacé après MAC invalide (octet %02x)", n, b)
			}
		}
	}
}

func TestAEADFused_DstAliasesSrc(t *testing.T) {
	n := 1350
	subkey := make([]byte, 32)
	nonce := make([]byte, 12)
	plain := make([]byte, n)
	rand.Read(subkey)
	rand.Read(nonce)
	rand.Read(plain)
	want := append([]byte(nil), plain...)
	var mac [16]byte
	ct, err := AEADSubkeyLockDst(plain, &mac, subkey, nonce, nil, plain)
	if err != nil {
		t.Fatal(err)
	}
	if len(ct) != n || &ct[0] != &plain[0] {
		t.Fatal("lock dst==src : la sortie n'aliasse pas la source")
	}
	ref, err := chacha20poly1305.New(subkey)
	if err != nil {
		t.Fatal(err)
	}
	sealed := ref.Seal(nil, nonce, want, nil)
	if !bytes.Equal(ct, sealed[:n]) || !bytes.Equal(mac[:], sealed[n:]) {
		t.Fatal("lock dst==src diverge de x/crypto")
	}
	pt, err := AEADSubkeyUnlockDst(ct, subkey, nonce, nil, ct, mac[:])
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(pt, want) {
		t.Fatal("unlock dst==src ne restitue pas le clair")
	}
}