9 files changed, 84 insertions, 10 deletions

diff --git a/src/cz/crcs/ectester/common/util/ECUtil.java b/src/cz/crcs/ectester/common/util/ECUtil.java
index 75a75fc..4736f23 100644
--- a/src/cz/crcs/ectester/common/util/ECUtil.java
+++ b/src/cz/crcs/ectester/common/util/ECUtil.java
@@ -20,6 +20,7 @@ import java.security.interfaces.ECKey;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.spec.*;
+import java.util.Random;
 
 /**
  * @author Jan Jancar johny@neuromancer.sk
@@ -97,7 +98,7 @@ public class ECUtil {
     private static boolean isResidue(BigInteger a, BigInteger p) {
         BigInteger exponent = p.subtract(BigInteger.ONE).divide(BigInteger.valueOf(2));
         BigInteger result = a.modPow(exponent, p);
-        return result.intValueExact() == 1;
+        return result.equals(BigInteger.ONE);
     }
 
     private static BigInteger modSqrt(BigInteger a, BigInteger p) {
@@ -329,4 +330,32 @@ public class ECUtil {
         }
         return null;
     }
+
+    public static EC_Params randomPoint(EllipticCurve curve) {
+        BigInteger x;
+        BigInteger p;
+        if (curve.getField() instanceof ECFieldFp) {
+            ECFieldFp fp = (ECFieldFp) curve.getField();
+            p = fp.getP();
+        } else {
+            //TODO
+            throw new UnsupportedOperationException();
+        }
+        BigInteger rhs;
+        Random rand = new Random();
+        do {
+            x = new BigInteger(curve.getField().getFieldSize(), rand);
+            x = x.mod(p);
+            rhs = x.modPow(BigInteger.valueOf(3), p);
+            rhs = rhs.add(curve.getA().multiply(x)).mod(p);
+            rhs = rhs.add(curve.getB()).mod(p);
+        } while (!isResidue(rhs, p));
+        BigInteger y = modSqrt(rhs, p);
+        if (rand.nextBoolean()) {
+            y = p.subtract(y);
+        }
+        byte[] xArr = toByteArray(x, curve.getField().getFieldSize());
+        byte[] yArr = toByteArray(y, curve.getField().getFieldSize());
+        return new EC_Params(EC_Consts.PARAMETER_W, new byte[][]{xArr, yArr});
+    }
 }
diff --git a/src/cz/crcs/ectester/data/cofactor/cofactor160p56467.csv b/src/cz/crcs/ectester/data/cofactor/cofactor160p56467.csv
new file mode 100644
index 0000000..f5355bf
--- /dev/null
+++ b/src/cz/crcs/ectester/data/cofactor/cofactor160p56467.csv
@@ -0,0 +1 @@
+0x9e1cee7f5d94e89ef3fd2495a5f441e4d0089761,0x652a7627dced8c162fe2550b47f3a0244e378343,0x534fba94f02ffd658a31473600f5ec9a105f8e9a,0x045ac019464f3462ea668abafb5e4132b3143015,0x2a7ee80b1b2077e5efe8be68363b96326db5379d,0x0000b781d03d6dbd8c8ac3d780a2924dcec0bfb7,0xdc93
\ No newline at end of file
diff --git a/src/cz/crcs/ectester/data/cofactor/cofactor160p65521.csv b/src/cz/crcs/ectester/data/cofactor/cofactor160p65521.csv
new file mode 100644
index 0000000..10e3605
--- /dev/null
+++ b/src/cz/crcs/ectester/data/cofactor/cofactor160p65521.csv
@@ -0,0 +1 @@
+0x9e1cee7f5d94e89ef3fbf9957f0cd8e42c99184b,0x9035f448a33d8ea2e07bb4d25235f9b537cda8ad,0x95c5b09f7e391ba56198394f6bef2f78d1988c6e,0x57fa57b33a0bf68349a6458cc4c31bdba1537923,0x1f1a0a3d7250ecd7aaccb90be7a5748099c7b398,0x00009e2632bc569dfbe0b62653897822ea67197d,0xfff1
\ No newline at end of file
diff --git a/src/cz/crcs/ectester/data/cofactor/cofactor160p65535.csv b/src/cz/crcs/ectester/data/cofactor/cofactor160p65535.csv
new file mode 100644
index 0000000..bd47372
--- /dev/null
+++ b/src/cz/crcs/ectester/data/cofactor/cofactor160p65535.csv
@@ -0,0 +1 @@
+0x9e1cee7f5d94e89ef3fc6e6bc13cd2ed3d5b1a59,0x75cb167293650be7c3be3dedb92f06f1d0200135,0x218e827ae606230fe9b076bf8beb5421cb467839,0x55ab2088b77a9f79e050a9f0de962090d1de4157,0x0add088122fda90ecb2e84eded3aba2bf6db1e2b,0x00009e1d8c9cea31d2d0c6cc6e17012be1873f03,0xffff
\ No newline at end of file
diff --git a/src/cz/crcs/ectester/data/cofactor/curves.xml b/src/cz/crcs/ectester/data/cofactor/curves.xml
index 0b8c52e..30204e8 100644
--- a/src/cz/crcs/ectester/data/cofactor/curves.xml
+++ b/src/cz/crcs/ectester/data/cofactor/curves.xml
@@ -62,6 +62,24 @@
         <field>prime</field>
         <file>cofactor128p65535.csv</file>
     </curve>
+    <curve>
+        <id>large/cofactor160p56467</id>
+        <bits>160</bits>
+        <field>prime</field>
+        <file>cofactor160p56467.csv</file>
+    </curve>
+    <curve>
+        <id>large/cofactor160p65521</id>
+        <bits>160</bits>
+        <field>prime</field>
+        <file>cofactor160p65521.csv</file>
+    </curve>
+    <curve>
+        <id>large/cofactor160p65535</id>
+        <bits>160</bits>
+        <field>prime</field>
+        <file>cofactor160p65535.csv</file>
+    </curve>
 
     <curve>
         <id>cofactor160p2</id>
diff --git a/src/cz/crcs/ectester/data/cofactor/keys.xml b/src/cz/crcs/ectester/data/cofactor/keys.xml
index 2be7238..d6058f0 100644
--- a/src/cz/crcs/ectester/data/cofactor/keys.xml
+++ b/src/cz/crcs/ectester/data/cofactor/keys.xml
@@ -721,4 +721,22 @@
         <curve>cofactor/large/cofactor128p65535</curve>
         <desc>cofactor order = 0xffff</desc>
     </pubkey>
+    <pubkey>
+        <id>large/cofactor160p56467/0</id>
+        <inline>0x574d8a01e5ce61862b1f9504f81abe454ae30cf3,0x5c099446c1d7c24df133f85ecc0baa27a687c8e5</inline>
+        <curve>cofactor/large/cofactor160p56467</curve>
+        <desc>cofactor order = 0xdc93</desc>
+    </pubkey>
+    <pubkey>
+        <id>large/cofactor160p65521/0</id>
+        <inline>0x2567137bf265849618b13057f22ead81753bb39d,0x746c2fc9f040cf8ceeac2015f07522e9616bd094</inline>
+        <curve>cofactor/large/cofactor160p65521</curve>
+        <desc>cofactor order = 0xfff1</desc>
+    </pubkey>
+    <pubkey>
+        <id>large/cofactor160p65535/0</id>
+        <inline>0x0b16071db6d90823611ad35ed728b4f9a9abff9e,0x852a227d06c50d603cc4d8592770f535766927a2</inline>
+        <curve>cofactor/large/cofactor160p65535</curve>
+        <desc>cofactor order = 0xffff</desc>
+    </pubkey>
 </keys>
diff --git a/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java b/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java
index 4a8fcc0..7d44870 100644
--- a/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java
+++ b/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java
@@ -47,7 +47,7 @@ public class CardCofactorSuite extends CardTestSuite {
             for (EC_Key.Public pub : keys) {
                 Test setPub = CommandTest.expect(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, pub.getParams(), pub.flatten()), Result.ExpectedValue.FAILURE);
                 Test ecdh = CommandTest.expect(new Command.ECDH(this.card, ECTesterApplet.KEYPAIR_REMOTE, ECTesterApplet.KEYPAIR_LOCAL, ECTesterApplet.EXPORT_FALSE, EC_Consts.TRANSFORMATION_NONE, EC_Consts.KeyAgreement_ALG_EC_SVDP_DH), Result.ExpectedValue.FAILURE);
-                Test objectEcdh = CompoundTest.any(Result.ExpectedValue.SUCCESS, CardUtil.getKATypeString(EC_Consts.KeyAgreement_ALG_EC_SVDP_DH) + " test with degenerate pubkey.", setPub, ecdh);
+                Test objectEcdh = CompoundTest.any(Result.ExpectedValue.SUCCESS, CardUtil.getKATypeString(EC_Consts.KeyAgreement_ALG_EC_SVDP_DH) + " test with cofactor pubkey.", setPub, ecdh);
                 Command ecdhCommand = new Command.ECDH_direct(this.card, ECTesterApplet.KEYPAIR_LOCAL, ECTesterApplet.EXPORT_FALSE, EC_Consts.TRANSFORMATION_NONE, EC_Consts.KeyAgreement_ALG_EC_SVDP_DH, pub.flatten());
                 Test rawEcdh = CommandTest.expect(ecdhCommand, ExpectedValue.FAILURE, "Card correctly rejected point on non-generator subgroup.", "Card incorrectly accepted point on non-generator subgroup.");
                 ecdhTests.add(CompoundTest.all(Result.ExpectedValue.SUCCESS, pub.getId() + " cofactor key test.", objectEcdh, rawEcdh));
diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java
index cebbc36..9257b3d 100644
--- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java
+++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java
@@ -33,7 +33,7 @@ public class CardEdgeCasesSuite extends CardTestSuite {
     public CardEdgeCasesSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) {
         super(writer, cfg, cardManager, "edge-cases", null, "The edge-cases test suite tests various inputs to ECDH which may cause an implementation to achieve a certain edge-case state during it.",
                 "Some of the data is from the google/Wycheproof project. Tests include CVE-2017-10176 and CVE-2017-8932.",
-                "Also tests values of the private key and public key that would trigger the OpenSSL modualr multiplication bug on the P-256 curve.",
+                "Also tests values of the private key and public key that would trigger the OpenSSL modular multiplication bug on the P-256 curve.",
                 "Various edge private key values are also tested.");
     }
 
@@ -158,6 +158,7 @@ public class CardEdgeCasesSuite extends CardTestSuite {
             CommandTest export = CommandTest.expect(new Command.Export(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.KEY_PUBLIC, EC_Consts.PARAMETER_W), Result.ExpectedValue.SUCCESS);
             Test setup = runTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "KeyPair setup.", key, set, generate, export));
 
+            /*
             byte[] pParam = curve.getParam(EC_Consts.PARAMETER_FP)[0];
             BigInteger p = new BigInteger(1, pParam);
             byte[] wParam = ((Response.Export) export.getResponse()).getParameter(ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.PARAMETER_W);
@@ -171,6 +172,7 @@ public class CardEdgeCasesSuite extends CardTestSuite {
 
             EC_Params negYParams = new EC_Params(EC_Consts.PARAMETER_W, new byte[][]{xValue, newY});
             Test negYTest = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.CURVE_external, negYParams.getParams(), negYParams.flatten()), "ECDH with pubkey negated.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE);
+            */
 
             Test zeroS = ecdhTest(new Command.Transform(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, EC_Consts.PARAMETER_S, EC_Consts.TRANSFORMATION_ZERO), "ECDH with S = 0.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE);
             Test oneS = ecdhTest(new Command.Transform(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, EC_Consts.PARAMETER_S, EC_Consts.TRANSFORMATION_ONE), "ECDH with S = 1.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE);
@@ -237,9 +239,9 @@ public class CardEdgeCasesSuite extends CardTestSuite {
 
             if (cfg.cleanup) {
                 Test cleanup = CommandTest.expect(new Command.Cleanup(this.card), Result.ExpectedValue.ANY);
-                doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, negYTest, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup));
+                doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup));
             } else {
-                doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, negYTest, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S));
+                doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S));
             }
         }
 
diff --git a/src/cz/crcs/ectester/reader/test/CardMiscSuite.java b/src/cz/crcs/ectester/reader/test/CardMiscSuite.java
index d1a5c0f..f977466 100644
--- a/src/cz/crcs/ectester/reader/test/CardMiscSuite.java
+++ b/src/cz/crcs/ectester/reader/test/CardMiscSuite.java
@@ -3,10 +3,12 @@ package cz.crcs.ectester.reader.test;
 import cz.crcs.ectester.applet.ECTesterApplet;
 import cz.crcs.ectester.applet.EC_Consts;
 import cz.crcs.ectester.common.ec.EC_Curve;
+import cz.crcs.ectester.common.ec.EC_Params;
 import cz.crcs.ectester.common.output.TestWriter;
 import cz.crcs.ectester.common.test.CompoundTest;
 import cz.crcs.ectester.common.test.Result;
 import cz.crcs.ectester.common.test.Test;
+import cz.crcs.ectester.common.util.ECUtil;
 import cz.crcs.ectester.data.EC_Store;
 import cz.crcs.ectester.reader.CardMngr;
 import cz.crcs.ectester.reader.ECTesterReader;
@@ -23,7 +25,7 @@ import java.util.Map;
 public class CardMiscSuite extends CardTestSuite {
 
     public CardMiscSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) {
-        super(writer, cfg, cardManager, "miscellaneous",new String[]{"preset"},  "Some miscellaneous tests, tries ECDH and ECDSA over supersingular curves, anomalous curves,",
+        super(writer, cfg, cardManager, "miscellaneous", new String[]{"preset"}, "Some miscellaneous tests, tries ECDH and ECDSA over supersingular curves, anomalous curves,",
                 "Barreto-Naehrig curves with small embedding degree and CM discriminant, MNT curves,",
                 "some Montgomery curves transformed to short Weierstrass form and Curve25519 transformed to short Weierstrass form.");
     }
@@ -57,15 +59,17 @@ public class CardMiscSuite extends CardTestSuite {
 
         Test set = CommandTest.expect(new Command.Set(this.card, ECTesterApplet.KEYPAIR_BOTH, EC_Consts.CURVE_external, curve.getParams(), curve.flatten()), Result.ExpectedValue.SUCCESS);
         Test generate = genOrPreset(curve, Result.ExpectedValue.ANY);
-        Test ka = CommandTest.expect(new Command.ECDH(this.card, ECTesterApplet.KEYPAIR_LOCAL, ECTesterApplet.KEYPAIR_REMOTE, ECTesterApplet.EXPORT_FALSE, EC_Consts.TRANSFORMATION_NONE, EC_Consts.KeyAgreement_ALG_EC_SVDP_DH), expected);
-        Test sig = CommandTest.expect(new Command.ECDSA(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.Signature_ALG_ECDSA_SHA, ECTesterApplet.EXPORT_FALSE, null), expected);
+        EC_Params randomPub = ECUtil.randomPoint(curve.toCurve());
+        Test setRemote = CommandTest.expect(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, randomPub.getParams(), randomPub.flatten()), Result.ExpectedValue.SUCCESS);
+        Test ka = CommandTest.expect(new Command.ECDH(this.card, ECTesterApplet.KEYPAIR_REMOTE, ECTesterApplet.KEYPAIR_LOCAL, ECTesterApplet.EXPORT_FALSE, EC_Consts.TRANSFORMATION_NONE, EC_Consts.KeyAgreement_ALG_EC_SVDP_DH), expected);
+        Test sig = CommandTest.expect(new Command.ECDSA_sign(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.Signature_ALG_ECDSA_SHA, ECTesterApplet.EXPORT_FALSE, null), expected);
         Test perform = CompoundTest.all(Result.ExpectedValue.SUCCESS, "Perform ECDH and ECDSA.", ka, sig);
 
         if (cfg.cleanup) {
             Test cleanup = CommandTest.expect(new Command.Cleanup(this.card), Result.ExpectedValue.ANY);
-            doTest(CompoundTest.greedyAll(Result.ExpectedValue.SUCCESS, "Tests over " + curve.getBits() + "b " + catName + " curve: " + curve.getId() + ".", allocateFirst, set, generate, perform, cleanup));
+            doTest(CompoundTest.greedyAll(Result.ExpectedValue.SUCCESS, "Tests over " + curve.getBits() + "b " + catName + " curve: " + curve.getId() + ".", allocateFirst, set, generate, setRemote, perform, cleanup));
         } else {
-            doTest(CompoundTest.greedyAll(Result.ExpectedValue.SUCCESS, "Tests over " + curve.getBits() + "b " + catName + " curve: " + curve.getId() + ".", allocateFirst, set, generate, perform));
+            doTest(CompoundTest.greedyAll(Result.ExpectedValue.SUCCESS, "Tests over " + curve.getBits() + "b " + catName + " curve: " + curve.getId() + ".", allocateFirst, set, generate, setRemote, perform));
         }
     }