From 4569f864edeab4e2d309905fd37f87c977cdb2cd Mon Sep 17 00:00:00 2001 From: J08nY Date: Mon, 10 Dec 2018 15:50:02 +0100 Subject: Add more tests of bit-patterns to edge-cases test sutie. --- .../crcs/ectester/reader/test/CardEdgeCasesSuite.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) (limited to 'src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java') diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java index ccec401..7695867 100644 --- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java @@ -164,8 +164,21 @@ public class CardEdgeCasesSuite extends CardTestSuite { BigInteger full = BigInteger.valueOf(1).shiftLeft(R.bitLength() - 1).subtract(BigInteger.ONE); + BigInteger alternate = full; + for (int i = 0; i < R.bitLength(); i += 2) { + alternate = alternate.clearBit(i); + } + + BigInteger alternateOther = alternate.xor(full); + + EC_Params alternateParams = makeParams(alternate); + Test alternateS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, alternateParams.getParams(), alternateParams.flatten()), "ECDH with S = 101010101...01010.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); + + EC_Params alternateOtherParams = makeParams(alternateOther); + Test alternateOtherS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, alternateOtherParams.getParams(), alternateOtherParams.flatten()), "ECDH with S = 01010101...10101.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); + EC_Params fullParams = makeParams(full); - Test fullS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, fullParams.getParams(), fullParams.flatten()), "ECDH with S = 2^((log2 r) - 1) - 1.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); + Test fullS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, fullParams.getParams(), fullParams.flatten()), "ECDH with S = 111111...11111 (but < r).", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); EC_Params smallerParams = makeParams(smaller); Test smallerS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, smallerParams.getParams(), smallerParams.flatten()), "ECDH with S < r.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); @@ -202,9 +215,9 @@ public class CardEdgeCasesSuite extends CardTestSuite { if (cfg.cleanup) { Test cleanup = CommandTest.expect(new Command.Cleanup(this.card), Result.ExpectedValue.ANY); - doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup)); + doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup)); } else { - doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S)); + doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S)); } } -- cgit v1.3.1 From bb5de2b3b731f7b022be9703fc2f5eae99893ac1 Mon Sep 17 00:00:00 2001 From: J08nY Date: Sun, 16 Dec 2018 01:42:40 +0100 Subject: Add test of ECDH when keypair has engated pubkey. --- docs/IMPLEMENTATIONS.md | 18 ++++++------- .../ectester/common/output/BaseTextTestWriter.java | 6 ++--- .../ectester/reader/test/CardEdgeCasesSuite.java | 30 +++++++++++++++++----- 3 files changed, 35 insertions(+), 19 deletions(-) (limited to 'src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java') diff --git a/docs/IMPLEMENTATIONS.md b/docs/IMPLEMENTATIONS.md index 724150f..d333ed5 100644 --- a/docs/IMPLEMENTATIONS.md +++ b/docs/IMPLEMENTATIONS.md @@ -249,7 +249,7 @@ Uses binary addition chain. INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q). OUTPUT: [k]P. 1. Q ← ∞. - 2. For i from t - 1 downto 0 do + 2. For i from 0 to t-1 do 2.1 If k_i = 1 then Q ← Q + P. 2.2 P ← 2P. 3. Return(Q). @@ -432,7 +432,7 @@ The same name, Montgomery ladder, is used both for the general ladder idea of ex INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q). OUTPUT: [k]P . 1. P_1 ← P and P_2 ← [2]P - 2. For i = t − 2 downto 0 do + 2. For i = t − 1 downto 0 do 2.1 If k_i = 0 then P_1 ← [2]P_1; P_2 ← P_1 + P_2. Else @@ -443,13 +443,13 @@ The same name, Montgomery ladder, is used both for the general ladder idea of ex INPUT: G ∈ E(F_q), k = (1, k_{t−2}, ..., k_0)2 OUTPUT: Y = kG - R0 ← G; R1 ← [2]G - for j = t − 2 downto 0 do - if (k_j = 0) then - R1 ← R0 + R1; R0 ← [2]R0 - else [if (kj = 1)] - R0 ← R0 + R1; R1 ← [2]R1 - return R0 + 1. R0 ← G; R1 ← [2]G + 2. for j = t − 2 downto 0 do + 2.1 if (k_j = 0) then + R1 ← R0 + R1; R0 ← [2]R0 + else [if (kj = 1)] + R0 ← R0 + R1; R1 ← [2]R1 + 3. return R0 Montgomery addition formulas (Projective coordinates/XZ coordinates):[^2] diff --git a/src/cz/crcs/ectester/common/output/BaseTextTestWriter.java b/src/cz/crcs/ectester/common/output/BaseTextTestWriter.java index 85b32a4..8ad50c7 100644 --- a/src/cz/crcs/ectester/common/output/BaseTextTestWriter.java +++ b/src/cz/crcs/ectester/common/output/BaseTextTestWriter.java @@ -56,7 +56,7 @@ public abstract class BaseTextTestWriter implements TestWriter { String line = ""; if (prefix.equals("")) { - char charLine[] = new char[BASE_WIDTH + 24]; + char[] charLine = new char[BASE_WIDTH + 24]; new String(new char[BASE_WIDTH + 24]).replace("\0", "━").getChars(0, charLine.length - 1, charLine, 0); charLine[0] = '■'; charLine[4] = '┳'; @@ -70,7 +70,7 @@ public abstract class BaseTextTestWriter implements TestWriter { out.append(t.ok() ? Colors.ok(" OK ") : Colors.error("NOK ")); out.append(compound ? (prefix.equals("") ? "╋ " : "┳ ") : "━ "); int width = BASE_WIDTH - (prefix.length() + 6); - String widthSpec = "%-" + String.valueOf(width) + "s"; + String widthSpec = "%-" + width + "s"; String desc = ((prefix.equals("")) ? "(" + index + ") " : "") + t.getDescription(); out.append(String.format(widthSpec, desc)); out.append(" ┃ "); @@ -87,7 +87,7 @@ public abstract class BaseTextTestWriter implements TestWriter { if (compound) { CompoundTest test = (CompoundTest) t; - out.append(String.valueOf(result.getCause())); + out.append(result.getCause()); out.append(System.lineSeparator()); Test[] tests = test.getStartedTests(); for (int i = 0; i < tests.length; ++i) { diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java index 7695867..221cbe1 100644 --- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java @@ -150,7 +150,21 @@ public class CardEdgeCasesSuite extends CardTestSuite { } Test set = CommandTest.expect(new Command.Set(this.card, ECTesterApplet.KEYPAIR_BOTH, EC_Consts.CURVE_external, curve.getParams(), curve.flatten()), Result.ExpectedValue.SUCCESS); Test generate = CommandTest.expect(new Command.Generate(this.card, ECTesterApplet.KEYPAIR_LOCAL), Result.ExpectedValue.SUCCESS); - Test setup = CompoundTest.all(Result.ExpectedValue.SUCCESS, "KeyPair setup.", key, set, generate); + CommandTest export = CommandTest.expect(new Command.Export(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.KEY_PUBLIC, EC_Consts.PARAMETER_W), Result.ExpectedValue.SUCCESS); + Test setup = runTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "KeyPair setup.", key, set, generate, export)); + + byte[] pParam = curve.getParam(EC_Consts.PARAMETER_FP)[0]; + BigInteger p = new BigInteger(1, pParam); + byte[] wParam = ((Response.Export) export.getResponse()).getParameter(ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.PARAMETER_W); + byte[] yValue = new byte[(wParam.length - 1) / 2]; + System.arraycopy(wParam, (wParam.length/2) + 1, yValue, 0, yValue.length); + BigInteger y = new BigInteger(1, yValue); + BigInteger negY = p.subtract(y); + byte[] newY = ECUtil.toByteArray(negY, curve.getBits()); + System.arraycopy(newY, 0, wParam, (wParam.length/2) + 1, newY.length); + + EC_Params negYParams = makeParams(newY); + Test negYTest = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.CURVE_external, negYParams.getParams(), negYParams.flatten()), "ECDH with pubkey negated.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); Test zeroS = ecdhTest(new Command.Transform(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, EC_Consts.PARAMETER_S, EC_Consts.TRANSFORMATION_ZERO), "ECDH with S = 0.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); Test oneS = ecdhTest(new Command.Transform(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, EC_Consts.PARAMETER_S, EC_Consts.TRANSFORMATION_ONE), "ECDH with S = 1.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); @@ -175,10 +189,10 @@ public class CardEdgeCasesSuite extends CardTestSuite { Test alternateS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, alternateParams.getParams(), alternateParams.flatten()), "ECDH with S = 101010101...01010.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); EC_Params alternateOtherParams = makeParams(alternateOther); - Test alternateOtherS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, alternateOtherParams.getParams(), alternateOtherParams.flatten()), "ECDH with S = 01010101...10101.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); + Test alternateOtherS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, alternateOtherParams.getParams(), alternateOtherParams.flatten()), "ECDH with S = 010101010...10101.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); EC_Params fullParams = makeParams(full); - Test fullS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, fullParams.getParams(), fullParams.flatten()), "ECDH with S = 111111...11111 (but < r).", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); + Test fullS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, fullParams.getParams(), fullParams.flatten()), "ECDH with S = 111111111...11111 (but < r).", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); EC_Params smallerParams = makeParams(smaller); Test smallerS = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, smallerParams.getParams(), smallerParams.flatten()), "ECDH with S < r.", Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); @@ -204,20 +218,22 @@ public class CardEdgeCasesSuite extends CardTestSuite { BigInteger krm1 = kr.subtract(BigInteger.ONE); BigInteger krp1 = kr.add(BigInteger.ONE); + Result.ExpectedValue kExpected = K.equals(BigInteger.ONE) ? Result.ExpectedValue.SUCCESS : Result.ExpectedValue.FAILURE; + EC_Params krParams = makeParams(kr); Test krS /*ONE!*/ = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, krParams.getParams(), krParams.flatten()), "ECDH with S = k * r.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); EC_Params krm1Params = makeParams(krm1); - Test krm1S = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, krm1Params.getParams(), krm1Params.flatten()), "ECDH with S = (k * r) - 1.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); + Test krm1S = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, krm1Params.getParams(), krm1Params.flatten()), "ECDH with S = (k * r) - 1.", kExpected, kExpected); EC_Params krp1Params = makeParams(krp1); - Test krp1S = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, krp1Params.getParams(), krp1Params.flatten()), "ECDH with S = (k * r) + 1.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); + Test krp1S = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, krp1Params.getParams(), krp1Params.flatten()), "ECDH with S = (k * r) + 1.", Result.ExpectedValue.ANY, Result.ExpectedValue.ANY); if (cfg.cleanup) { Test cleanup = CommandTest.expect(new Command.Cleanup(this.card), Result.ExpectedValue.ANY); - doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup)); + doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, negYTest, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S, cleanup)); } else { - doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S)); + doTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests with edge-case private key values over " + curve.getId() + ".", setup, negYTest, zeroS, oneS, alternateS, alternateOtherS, fullS, smallerS, exactS, largerS, rm1S, rp1S, krS, krm1S, krp1S)); } } -- cgit v1.3.1 From 4e67d9eddb478aadc6fda39dcef43b2a25e28d4e Mon Sep 17 00:00:00 2001 From: J08nY Date: Mon, 17 Dec 2018 17:15:54 +0100 Subject: Fixup edgecases test suite. --- src/cz/crcs/ectester/data/wycheproof/keys.xml | 86 +++++++++++----------- .../ectester/reader/test/CardEdgeCasesSuite.java | 21 +++++- 2 files changed, 61 insertions(+), 46 deletions(-) (limited to 'src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java') diff --git a/src/cz/crcs/ectester/data/wycheproof/keys.xml b/src/cz/crcs/ectester/data/wycheproof/keys.xml index 46359df..7ca174d 100644 --- a/src/cz/crcs/ectester/data/wycheproof/keys.xml +++ b/src/cz/crcs/ectester/data/wycheproof/keys.xml @@ -302,7 +302,7 @@ addsub/brainpoolP224r1/1s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a792dd + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a792dd brainpool/brainpoolP224r1 tcId = 441 @@ -315,7 +315,7 @@ addsub/brainpoolP224r1/2s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7935d + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7935d brainpool/brainpoolP224r1 tcId = 442 @@ -328,7 +328,7 @@ addsub/brainpoolP224r1/3s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939d + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939d brainpool/brainpoolP224r1 tcId = 444 @@ -341,7 +341,7 @@ addsub/brainpoolP256r1/1s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974855f5 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974855f5 brainpool/brainpoolP256r1 tcId = 524 @@ -354,7 +354,7 @@ addsub/brainpoolP256r1/2s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485675 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485675 brainpool/brainpoolP256r1 tcId = 525 @@ -367,7 +367,7 @@ addsub/brainpoolP256r1/3s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485695 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485695 brainpool/brainpoolP256r1 tcId = 526 @@ -380,7 +380,7 @@ addsub/brainpoolP256r1/4s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a5 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a5 brainpool/brainpoolP256r1 tcId = 528 @@ -393,7 +393,7 @@ addsub/brainpoolP320r1/1s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59233 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59233 brainpool/brainpoolP320r1 tcId = 604 @@ -406,7 +406,7 @@ addsub/brainpoolP320r1/2s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592b3 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592b3 brainpool/brainpoolP320r1 tcId = 605 @@ -419,7 +419,7 @@ addsub/brainpoolP320r1/3s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592f3 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592f3 brainpool/brainpoolP320r1 tcId = 606 @@ -432,7 +432,7 @@ addsub/brainpoolP320r1/4s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59303 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59303 brainpool/brainpoolP320r1 tcId = 607 @@ -445,7 +445,7 @@ addsub/brainpoolP320r1/5s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930b + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930b brainpool/brainpoolP320r1 tcId = 608 @@ -458,7 +458,7 @@ addsub/brainpoolP320r1/6s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930f + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930f brainpool/brainpoolP320r1 tcId = 610 @@ -471,7 +471,7 @@ addsub/brainpoolP384r1/1s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904652f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904652f brainpool/brainpoolP384r1 tcId = 684 @@ -484,7 +484,7 @@ addsub/brainpoolP384r1/2s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904654f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904654f brainpool/brainpoolP384r1 tcId = 685 @@ -497,7 +497,7 @@ addsub/brainpoolP384r1/3s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904655f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904655f brainpool/brainpoolP384r1 tcId = 686 @@ -510,7 +510,7 @@ addsub/brainpoolP384r1/4s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046563 + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046563 brainpool/brainpoolP384r1 tcId = 688 @@ -523,7 +523,7 @@ addsub/brainpoolP512r1/1s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9003b + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9003b brainpool/brainpoolP512r1 tcId = 774 @@ -536,7 +536,7 @@ addsub/brainpoolP512r1/2s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9005b + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9005b brainpool/brainpoolP512r1 tcId = 775 @@ -549,7 +549,7 @@ addsub/brainpoolP512r1/3s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90063 + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90063 brainpool/brainpoolP512r1 tcId = 776 @@ -562,7 +562,7 @@ addsub/brainpoolP512r1/4s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90067 + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90067 brainpool/brainpoolP512r1 tcId = 778 @@ -575,7 +575,7 @@ addsub/brainpoolP224t1/1s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a792dd + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a792dd brainpool/brainpoolP224t1 tcId = 854 @@ -588,7 +588,7 @@ addsub/brainpoolP224t1/2s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7935d + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7935d brainpool/brainpoolP224t1 tcId = 855 @@ -601,7 +601,7 @@ addsub/brainpoolP224t1/3s - 0x0d7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939d + 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939d brainpool/brainpoolP224t1 tcId = 857 @@ -614,7 +614,7 @@ addsub/brainpoolP256t1/1s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974855f5 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974855f5 brainpool/brainpoolP256t1 tcId = 935 @@ -627,7 +627,7 @@ addsub/brainpoolP256t1/2s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485675 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485675 brainpool/brainpoolP256t1 tcId = 936 @@ -640,7 +640,7 @@ addsub/brainpoolP256t1/3s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485695 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e8297485695 brainpool/brainpoolP256t1 tcId = 937 @@ -653,7 +653,7 @@ addsub/brainpoolP256t1/4s - 0x0a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a5 + 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a5 brainpool/brainpoolP256t1 tcId = 939 @@ -666,7 +666,7 @@ addsub/brainpoolP320t1/1s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59233 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59233 brainpool/brainpoolP320t1 tcId = 1015 @@ -679,7 +679,7 @@ addsub/brainpoolP320t1/2s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592b3 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592b3 brainpool/brainpoolP320t1 tcId = 1016 @@ -692,7 +692,7 @@ addsub/brainpoolP320t1/3s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592f3 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c592f3 brainpool/brainpoolP320t1 tcId = 1017 @@ -705,7 +705,7 @@ addsub/brainpoolP320t1/4s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59303 + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59303 brainpool/brainpoolP320t1 tcId = 1018 @@ -718,7 +718,7 @@ addsub/brainpoolP320t1/5s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930b + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930b brainpool/brainpoolP320t1 tcId = 1019 @@ -731,7 +731,7 @@ addsub/brainpoolP320t1/6s - 0x0d35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930f + 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c5930f brainpool/brainpoolP320t1 tcId = 1021 @@ -744,7 +744,7 @@ addsub/brainpoolP384t1/1s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904652f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904652f brainpool/brainpoolP384t1 tcId = 1093 @@ -757,7 +757,7 @@ addsub/brainpoolP384t1/2s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904654f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904654f brainpool/brainpoolP384t1 tcId = 1094 @@ -770,7 +770,7 @@ addsub/brainpoolP384t1/3s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904655f + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e904655f brainpool/brainpoolP384t1 tcId = 1095 @@ -783,7 +783,7 @@ addsub/brainpoolP384t1/4s - 0x08cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046563 + 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046563 brainpool/brainpoolP384t1 tcId = 1097 @@ -796,7 +796,7 @@ addsub/brainpoolP512t1/1s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9003b + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9003b brainpool/brainpoolP512t1 tcId = 1185 @@ -809,7 +809,7 @@ addsub/brainpoolP512t1/2s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9005b + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca9005b brainpool/brainpoolP512t1 tcId = 1186 @@ -822,7 +822,7 @@ addsub/brainpoolP512t1/3s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90063 + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90063 brainpool/brainpoolP512t1 tcId = 1187 @@ -835,7 +835,7 @@ addsub/brainpoolP512t1/4s - 0x0aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90067 + 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90067 brainpool/brainpoolP512t1 tcId = 1189 @@ -878,7 +878,7 @@ cve_2017_10176/secp521r1/1s - 0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e913863f7 + 0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e913863f7 secg/secp521r1 tcId = 280 diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java index 221cbe1..39eaf07 100644 --- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java @@ -104,6 +104,10 @@ public class CardEdgeCasesSuite extends CardTestSuite { curveTests.add(one); } + if (cfg.cleanup) { + curveTests.add(CommandTest.expect(new Command.Cleanup(this.card), Result.ExpectedValue.ANY)); + } + Test curveTest = CompoundTest.all(Result.ExpectedValue.SUCCESS, "Tests", curveTests.toArray(new Test[0])); groupTests.add(CompoundTest.greedyAllTry(Result.ExpectedValue.SUCCESS, "Tests on " + curve.getId() + ".", prepareCurve, curveTest)); } @@ -278,7 +282,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { int i = 0; for (BigInteger nearZero : zeros) { EC_Params params = makeParams(nearZero); - zeroTests[i++] = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearZero.toString(16), Result.ExpectedValue.ANY, Result.ExpectedValue.ANY); + zeroTests[i++] = ecdhTestBoth(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearZero.toString(16), Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); } Test zeroTest = CompoundTest.all(Result.ExpectedValue.SUCCESS, "Near zero.", zeroTests); @@ -286,7 +290,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { i = 0; for (BigInteger nearP : ps) { EC_Params params = makeParams(nearP); - pTests[i++] = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearP.toString(16) + (nearP.compareTo(p) > 0 ? " (>p)" : " (<=p)"), Result.ExpectedValue.ANY, Result.ExpectedValue.ANY); + pTests[i++] = ecdhTestBoth(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearP.toString(16) + (nearP.compareTo(p) > 0 ? " (>p)" : " (<=p)"), Result.ExpectedValue.SUCCESS, Result.ExpectedValue.SUCCESS); } Test pTest = CompoundTest.all(Result.ExpectedValue.SUCCESS, "Near p.", pTests); @@ -294,12 +298,23 @@ public class CardEdgeCasesSuite extends CardTestSuite { i = 0; for (BigInteger nearR : rs) { EC_Params params = makeParams(nearR); - rTests[i++] = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearR.toString(16) + (nearR.compareTo(r) > 0 ? " (>r)" : " (<=r)"), Result.ExpectedValue.ANY, Result.ExpectedValue.ANY); + if (nearR.compareTo(r) >= 0) { + rTests[i++] = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearR.toString(16) + " (>=r)", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); + } else { + rTests[i++] = ecdhTestBoth(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearR.toString(16) +" ([:start_index[:stop_index]]`. @@ -149,15 +149,19 @@ For more info about the test suites see [TESTS](docs/TESTS.md). #### Generate `-g / --generate [amount]` -Generates batches of EC keypairs and exports them. +Generates batch of EC keypairs and exports them. + Use with `-o / --output [out_file]` to output the generated keys to a file. +Use with `--time` to measure time as a difference of real duration of the operation and the dry-run duration of the operation. For format of this file see [FORMAT](docs/FORMAT.md). #### ECDH `-dh / --ecdh [count]` Performs ECDH. + Use with `-o / --output [out_file]` to output into a file. +Use with `--time` to measure time as a difference of real duration of the operation and the dry-run duration of the operation. For format of this file see [FORMAT](docs/FORMAT.md). Respects the KeyAgreement type specified in `-ka / --ka-type [type]`. @@ -168,6 +172,7 @@ Respects the KeyAgreement type specified in `-ka / --ka-type [type]`. Performs ECDSA. Useful with `-i / --input [in_file]` to sign the contents of a file. Use with `-o / --output [out_file]` to output into a file. +Use with `--time` to measure time as a difference of real duration of the operation and the dry-run duration of the operation. For format of these files see [FORMAT](docs/FORMAT.md). Respects the Signature type specified in `-sig / --sig-type [type]`. @@ -175,9 +180,7 @@ Respects the Signature type specified in `-sig / --sig-type [type]`. `-ln / --list-named []` Lists categories of curves, keys and keypairs embedded in ECTester's jar, along with some information about them. -These can be used as arguments to the `-n[c|k|pub|priv] / --named-[curve|key|public|private]` parameters. - -With the format: `category/name`. +These can be used as arguments to the `-n[c|k|pub|priv] / --named-[curve|key|public|private]` parameters, using the format: `category/name`. For example: `secg/secp192r1` identifies the SECG 192 bit prime field curve known as `secp192r1`. @@ -197,9 +200,10 @@ Get and print ECTester applet info from an applet installed on a card. Outputs: - ECTester applet version - - ECTester APDU support + - ECTester APDU support (basic/extended APDU) - JavaCard API version - JavaCard cleanup support + - ECTester internal array sizes and APDU buffer size ### Example diff --git a/docs/FORMAT.md b/docs/FORMAT.md index bde2543..16af130 100644 --- a/docs/FORMAT.md +++ b/docs/FORMAT.md @@ -1,6 +1,14 @@ # Format ECTester mostly reads/outputs data in either human-readable format or using CSV. +## Test runs +By default test runs are output in a human readable format, however YAML and XML is also supported and can be selected +by using the `--format` option. Also, prefixing the output file name when using the `-o/--output` option allows to output +the same test run in different formats to different files. + +For example: +`--format yaml -o default_output.yaml -o xml:output_file.xml -o text:readable_text_file.txt ` + ## Curves Input files for the `-c/--curve` option should be in CSV, little-endian hexadecimal format. Output of the `-e/--export` option will also be in this format. @@ -42,22 +50,37 @@ Input files for the `-k/--key`, `-pub/--public` and `-priv/--private` options sh ## Key generation output(CSV) Output of the `-g/--generate` option. -`index;time;pubW;privS` +For ECTesterReader this has the format: + +`index;genTime[milli];exportTime[milli];pubW;privS` where `pubW` is the public key used in ANSI X9.62 format, +`privS` is the private key, `genTime` is the time required to generate the keypair and `exportTime` is the time required to export it (send it to the reader). + +For ECTesterStandalone: + +`index;time[nano];pubW;privS` ## KeyAgreement output(CSV) Output of the `-dh/--ecdh` option. -`index;time;pubW;privS;secret` +For ECTesterReader this has the format: + +`index;time[milli];pubW;privS;secret` where `pubW` is the public key used in ANSI X9.62 format, `privS` is the private key +and `secret` is the KeyAgreement result. + +For ECTesterStandalone this has the format: and the same meaning as for ECTesterReader. + +`index;time[nano];pubW;privS;secret` and the same meaning as for ECTesterReader. ## Signature output(CSV) Output of the `-dsa/--ecdsa` option. -`index;time;signature` +For ECTesterReader this has the format: -## Test runs -By default test runs are output in a human readable format, however YAML and XML is also supported and can be selected -by using the `--format` option. Also, prefixing the output file name when using the `-o/--output` option allows to output -the same test run in different formats to different files. +`index;signTime[milli];verifyTime[milli];data;pubW;privS;signature;nonce;valid` where `pubW` is the public key used +in ANSI X9.62 format, `privS` is the private key, `signTime` and `verifyTime` are the durations of the sign and verify operations, +`data` is the signed data (if available), `signature` is the produced signature, `nonce` is the `k` (nonce) value recovered from the signature +abd the private key (if possible), `valid` denotes the verification result. -For example: -`--format yaml -o default_output.yaml -o xml:output_file.xml -o text:readable_text_file.txt ` +For ECTesterStandalone this has the format: + + `index;signTime[nano];verifyTime[nano];data;pubW;privS;signature;nonce;verified` and the same meaning as for ECTesterReader. \ No newline at end of file diff --git a/docs/TESTS.md b/docs/TESTS.md index 25f61a8..a2d3642 100644 --- a/docs/TESTS.md +++ b/docs/TESTS.md @@ -17,7 +17,7 @@ confirmation before running, be cautious.** ## Default -Tests the default curves present on the card. These might not be present or the card might not even support ECC. +Tests support for ECC and the presence of default curves on the target. These might not be present or the target might not even support ECC. Tests keypair allocation, generation, ECDH and ECDSA. ECDH is first tested with two valid generated keypairs, then with a compressed public key to test support for compressed points. @@ -25,7 +25,7 @@ This test suite is run if no argument is provided to `-t / --test`. ## Test-Vectors -Tests using known test vectors provided by NIST/SECG/Brainpool: +Tests ECDH using known test vectors provided by NIST/SECG/Brainpool: [SECG - GEC2](http://read.pudn.com/downloads168/doc/772358/TestVectorsforSEC%201-gec2.pdf) @@ -37,8 +37,12 @@ Tests using known test vectors provided by NIST/SECG/Brainpool: ## Compression -Tests support for compression of public points in ECDH as specified in ANSI X9.62. Tests ECDH with points in compressed -and hybrid form. Also tests card response to a hybrid point with wrong `y` coordinate and to the point at infinity(as public key in ECDH). +Tests support for compression of public points in ECDH as specified in ANSI X9.62. The standard specifies two forms of point compression, +fully compressed point contains the `x` coordinate and one bit of the `y` coordinate, from which the whole point can be reconstructed, hybrid form +of a compressed point contains both the `x` and `y` coordinates but also one bit of the `y` coordinate. + +Tests ECDH with points in compressed and hybrid form. Also tests target response to a hybrid point with wrong `y` coordinate and to the point at infinity(as public key in ECDH). +Tests ECDH with invalid compressed point, where `x` does not lie on the curve. - Compressed form, valid - Hybrid form, valid @@ -48,29 +52,35 @@ and hybrid form. Also tests card response to a hybrid point with wrong `y` coord ## Miscellaneous -Some miscellaneous tests, tries ECDH and ECDSA over supersingular curves, anomalous curves and Barreto-Naehrig curves with small embedding degree and CM discriminant. +Some miscellaneous tests, tries ECDH and ECDSA over super-singular curves, anomalous curves and Barreto-Naehrig curves with small embedding degree and CM discriminant. +Also tests ECDH over MNT curves, M curves and Curve25519 transformed into short Weierstrass form. ## Signature -Tests ECDSA verification, with invalid signatures. - - - Well-formed(DER) invalid signatures: - - r = random, s = random - - r = 0, s = random - - r = random, s = 0 - - r = 1, s = random - - r = random, s = 1 - - r = 0, s = 0 - - r = 0, s = 1 - - r = 1, s = 0 - - r = 1, s = 1 - - s = p - - s = 2 * p - - Invalid signatures: - - Signature shorter than specified in ASN.1 SEQUENCE header. - - Signature longer than specified in ASN.1 SEQUENCE header. - - r shorter/longer than specified in its ASN.1 header. - - s shorter/longer than specified in its ASN.1 header. +Tests ECDSA verification, with well-formed but invalid and malformed signatures. + +- Well-formed(DER) invalid signatures: + - r = random, s = random + - r = 0, s = random + - r = random, s = 0 + - r = 1, s = random + - r = random, s = 1 + - r = 0, s = 0 + - r = 0, s = 1 + - r = 1, s = 0 + - r = 1, s = 1 + - r = random, s = p + - r = random, s = 2 * p +- Invalid signatures: + - Signature shorter than specified in ASN.1 SEQUENCE header. + - Signature longer than specified in ASN.1 SEQUENCE header. + - r shorter/longer than specified in its ASN.1 header. + - s shorter/longer than specified in its ASN.1 header. + - ASN.1 SEQUENCE has indefinite length. + - ASN.1 SEQUENCE has length that will overflow a 16 bit integer. + - ASN.1 SEQUENCE has length that will overflow a 32 bit integer. + - ASN.1 SEQUENCE has length that will overflow a 64 bit integer. +- Test verifying a valid signature, but with a negated public key. ## Wrong @@ -104,7 +114,7 @@ This test suite also does some additional tests with corrupting the parameters: ## Composite Tests using curves that don't have a prime order/nearly prime order. -These tests should generally fail, a success here implies the card will use a non-secure curve if such curve is set +These tests should generally fail, a success here implies the target will use a non-secure curve if such curve is set by the applet. Operations over such curves are susceptible to small-subgroup attacks. - r = quite a smooth number, many small factors, r = \|G\| @@ -121,29 +131,29 @@ by the applet. Operations over such curves are susceptible to small-subgroup att ## Invalid Tests using known named curves from several categories(SECG/NIST/Brainpool) against pre-generated *invalid* public keys. -ECDH should definitely fail, a success here implies the card is susceptible to invalid curve attacks. +ECDH should definitely fail, a success here implies the target is susceptible to invalid curve attacks. See [Practical Invalid Curve Attacks on TLS-ECDH](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf) for more information. ## Twist Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on twists of said curves. -ECDH should fail, a success here implies the card is not twist secure, if a curve with an unsecure twist is used, -the card might compute on the twist, if a point on the twist is supplied. +ECDH should fail, a success here implies the target is not twist secure, if a curve with an unsecure twist is used, +the target might compute on the twist, if a point on the twist is supplied. See [SafeCurves on twist security](https://safecurves.cr.yp.to/twist.html) for more information. ## Degenerate Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on the degenerate line -`Y: x = 0`. ECDH should fail, a success here might mean the card does not check that the point lies on the correct curve +`Y: x = 0`. ECDH should fail, a success here might mean the target does not check that the point lies on the correct curve and uses a curve model vulnerable to such degenerate points. See [Degenerate Curve Attacks - Extending Invalid Curve Attacks to Edwards Curves and Other Models](https://eprint.iacr.org/2015/1233.pdf) for more information. ## Cofactor -Tests whether the card correctly rejects points that lie on the curve but not on the subgroup generated by the specified generator +Tests whether the target correctly rejects points that lie on the curve but not on the subgroup generated by the specified generator during ECDH. Does this with curves where the cofactor subgroup has small order, then with curves that have order equal to the product of two large primes, sets the generator with order of one prime and tries points on the subgroup of the other prime order. @@ -166,6 +176,7 @@ Custom edge-case private key values over SECG curves are tested: - s < r, s = r, s > r - s = r - 1, s = r + 1 - s = k\*r - 1, s = k\*r, s = k\*r + 1 + - s = 111111...1111, s = 101010...1010, s = 010101...0101 - s around r (s < r, on a curve where \|r\| > \|p\|) - s around p (on a curve where where \|r\| > \|p\|) - s around 0 (s > 0, on a curve where \|r\| > \|p\|) diff --git a/src/cz/crcs/ectester/reader/ECTesterReader.java b/src/cz/crcs/ectester/reader/ECTesterReader.java index 6e1d508..a255b18 100644 --- a/src/cz/crcs/ectester/reader/ECTesterReader.java +++ b/src/cz/crcs/ectester/reader/ECTesterReader.java @@ -369,6 +369,8 @@ public class ECTesterReader { System.out.println("\t" + line); } } + System.out.println(); + System.out.println("For more information, look at the documentation at https://github.com/crocs-muni/ECTester."); } private void info() throws CardException { @@ -444,7 +446,7 @@ public class ECTesterReader { respWriter.outputResponse(allocate); OutputStreamWriter keysFile = FileUtil.openFiles(cfg.outputs); - keysFile.write("index;genTime;exportTime;pubW;privS\n"); + keysFile.write("index;genTime[milli];exportTime[milli];pubW;privS\n"); int generated = 0; int retry = 0; diff --git a/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java b/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java index 172c8af..5c22607 100644 --- a/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardCofactorSuite.java @@ -25,7 +25,8 @@ import static cz.crcs.ectester.common.test.Result.ExpectedValue; */ public class CardCofactorSuite extends CardTestSuite { public CardCofactorSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { - super(writer, cfg, cardManager, "cofactor", "The cofactor test suite tests whether the card correctly rejects points on the curve but not in the subgroup generated by the generator during ECDH."); + super(writer, cfg, cardManager, "cofactor", "The cofactor test suite tests whether the card correctly rejects points on the curve", + "but not in the subgroup generated by the generator(so of small order, dividing the cofactor) during ECDH."); } @Override diff --git a/src/cz/crcs/ectester/reader/test/CardCompositeSuite.java b/src/cz/crcs/ectester/reader/test/CardCompositeSuite.java index 4bf9290..d987e05 100644 --- a/src/cz/crcs/ectester/reader/test/CardCompositeSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardCompositeSuite.java @@ -25,7 +25,8 @@ import static cz.crcs.ectester.common.test.Result.ExpectedValue; public class CardCompositeSuite extends CardTestSuite { public CardCompositeSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { - super(writer, cfg, cardManager, "composite", "The composite suite runs ECDH over curves with composite order. This should generally fail, as using such a curve is unsafe."); + super(writer, cfg, cardManager, "composite", "The composite suite runs ECDH over curves with composite order.", + "Various types of compositeness is tested: smooth numbers, Carmichael pseudoprime, prime square, product of two large primes."); } @Override diff --git a/src/cz/crcs/ectester/reader/test/CardCompressionSuite.java b/src/cz/crcs/ectester/reader/test/CardCompressionSuite.java index 291cc04..c86c0b1 100644 --- a/src/cz/crcs/ectester/reader/test/CardCompressionSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardCompressionSuite.java @@ -29,7 +29,9 @@ import java.util.Map; public class CardCompressionSuite extends CardTestSuite { public CardCompressionSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { super(writer, cfg, cardManager, "compression", "The compression test suite tests cards support for compressed points in ECDH (as per ANSI X9.62).", - "It also tests for handling of bogus input by using the point at infinity and a hybrid point with the y coordinate corrupted."); + "It also tests for handling of bogus input in ECDH by using the point at infinity and a hybrid point with the y coordinate corrupted.", + "It also tests handling of compressed point in ECDH, where the x coordinate is invalid and therefore", + "a quadratic non-residue will be computed and (square root-ed) during decompression."); } @Override diff --git a/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java b/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java index f42af23..29e2ef9 100644 --- a/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java @@ -29,7 +29,7 @@ import static cz.crcs.ectester.common.test.Result.Value; public class CardDefaultSuite extends CardTestSuite { public CardDefaultSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { - super(writer, cfg, cardManager, "default", "The default test suite tests basic support of ECDH and ECDSA."); + super(writer, cfg, cardManager, "default", "The default test suite tests basic support and performance of ECDH and ECDSA."); } @Override diff --git a/src/cz/crcs/ectester/reader/test/CardDegenerateSuite.java b/src/cz/crcs/ectester/reader/test/CardDegenerateSuite.java index 755c746..730c70b 100644 --- a/src/cz/crcs/ectester/reader/test/CardDegenerateSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardDegenerateSuite.java @@ -25,7 +25,7 @@ public class CardDegenerateSuite extends CardTestSuite { public CardDegenerateSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { super(writer, cfg, cardManager, "degenerate", "The degenerate suite tests whether the card rejects points outside of the curve during ECDH.", - "The tested points lie on a part of the plane for which some Edwards, Hessian and Huff form addition formulas work."); + "The tested points lie on a part of the plane for which some Edwards, Hessian and Huff form addition formulas degenerate into exponentiation in the base finite field."); } @Override diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java index 39eaf07..f5ea86f 100644 --- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java @@ -33,6 +33,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { public CardEdgeCasesSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { super(writer, cfg, cardManager, "edge-cases", "The edge-cases test suite tests various inputs to ECDH which may cause an implementation to achieve a certain edge-case state during it.", "Some of the data is from the google/Wycheproof project. Tests include CVE-2017-10176 and CVE-2017-8932.", + "Also tests values of the private key and public key that would trigger the OpenSSL modualr multiplication bug on the P-256 curve.", "Various edge private key values are also tested."); } diff --git a/src/cz/crcs/ectester/reader/test/CardSignatureSuite.java b/src/cz/crcs/ectester/reader/test/CardSignatureSuite.java index 20546c8..0fa58d3 100644 --- a/src/cz/crcs/ectester/reader/test/CardSignatureSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardSignatureSuite.java @@ -22,7 +22,7 @@ import java.util.Map; */ public class CardSignatureSuite extends CardTestSuite { public CardSignatureSuite(TestWriter writer, ECTesterReader.Config cfg, CardMngr cardManager) { - super(writer, cfg, cardManager, "signature", "Test verifying various wrong ECDSA values."); + super(writer, cfg, cardManager, "signature", "The signature test suite tests verifying various malformed and well-formed but invalid ECDSA signatures."); } @Override -- cgit v1.3.1 From fea5c7b1cbd539b105b42c4bde65d0b9b6f0b8fc Mon Sep 17 00:00:00 2001 From: J08nY Date: Fri, 22 Feb 2019 10:23:27 +0100 Subject: Make edge-cases suite take preset keys. Reformat code. --- src/cz/crcs/ectester/reader/CardMngr.java | 2 +- src/cz/crcs/ectester/reader/ECTesterReader.java | 2 +- src/cz/crcs/ectester/reader/command/Command.java | 2 +- src/cz/crcs/ectester/reader/output/XMLTestWriter.java | 2 +- src/cz/crcs/ectester/reader/response/Response.java | 10 +++++----- src/cz/crcs/ectester/reader/test/CardDefaultSuite.java | 1 - src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java | 10 +++++----- src/cz/crcs/ectester/reader/test/CardTestVectorSuite.java | 5 ++--- 8 files changed, 16 insertions(+), 18 deletions(-) (limited to 'src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java') diff --git a/src/cz/crcs/ectester/reader/CardMngr.java b/src/cz/crcs/ectester/reader/CardMngr.java index 8f88ebb..8b6241d 100644 --- a/src/cz/crcs/ectester/reader/CardMngr.java +++ b/src/cz/crcs/ectester/reader/CardMngr.java @@ -352,7 +352,7 @@ public class CardMngr { return responseAPDU; } - public ResponseAPDU sendAPDU(byte apdu[]) throws CardException { + public ResponseAPDU sendAPDU(byte[] apdu) throws CardException { CommandAPDU commandAPDU = new CommandAPDU(apdu); return sendAPDU(commandAPDU); } diff --git a/src/cz/crcs/ectester/reader/ECTesterReader.java b/src/cz/crcs/ectester/reader/ECTesterReader.java index dc49656..e5e6061 100644 --- a/src/cz/crcs/ectester/reader/ECTesterReader.java +++ b/src/cz/crcs/ectester/reader/ECTesterReader.java @@ -911,7 +911,7 @@ public class ECTesterReader { } format = cli.getOptionValue("format"); - String formats[] = new String[]{"text", "xml", "yaml", "yml"}; + String[] formats = new String[]{"text", "xml", "yaml", "yml"}; if (format != null && !Arrays.asList(formats).contains(format)) { System.err.println(Colors.error("Wrong output format " + format + ". Should be one of " + Arrays.toString(formats))); return false; diff --git a/src/cz/crcs/ectester/reader/command/Command.java b/src/cz/crcs/ectester/reader/command/Command.java index 1ebd8bb..bf2441f 100644 --- a/src/cz/crcs/ectester/reader/command/Command.java +++ b/src/cz/crcs/ectester/reader/command/Command.java @@ -33,7 +33,7 @@ public abstract class Command implements Cloneable { // and for the even more stupid module system, which cannot properly work // with the fact that JCardSim has some java.* packages... final byte[] GOD_DAMN_JAVA_BUG_6474858_AND_GOD_DAMN_JAVA_12_MODULE_SYSTEM = new byte[]{0}; - + Command(CardMngr cardManager) { this.cardManager = cardManager; diff --git a/src/cz/crcs/ectester/reader/output/XMLTestWriter.java b/src/cz/crcs/ectester/reader/output/XMLTestWriter.java index 9add072..fc41805 100644 --- a/src/cz/crcs/ectester/reader/output/XMLTestWriter.java +++ b/src/cz/crcs/ectester/reader/output/XMLTestWriter.java @@ -114,7 +114,7 @@ public class XMLTestWriter extends BaseXMLTestWriter { Response.GetInfo info = new Command.GetInfo(card).send(); result.setAttribute("version", info.getVersion()); result.setAttribute("javacard", String.format("%.1f", info.getJavaCardVersion())); - result.setAttribute("base", String.format("%#x",info.getBase())); + result.setAttribute("base", String.format("%#x", info.getBase())); result.setAttribute("cleanup", String.valueOf(info.getCleanupSupport())); Element arrays = doc.createElement("arrays"); Element apduBuf = doc.createElement("length"); diff --git a/src/cz/crcs/ectester/reader/response/Response.java b/src/cz/crcs/ectester/reader/response/Response.java index 0dded7c..6232423 100644 --- a/src/cz/crcs/ectester/reader/response/Response.java +++ b/src/cz/crcs/ectester/reader/response/Response.java @@ -474,11 +474,11 @@ public abstract class Response { byte major = (byte) (jcVersion >> 8); byte minor = (byte) (jcVersion & 0xff); int minorSize; - if (minor == 0) { - minorSize = 1; - } else { - minorSize = (int) Math.ceil(Math.log10(minor)); - } + if (minor == 0) { + minorSize = 1; + } else { + minorSize = (int) Math.ceil(Math.log10(minor)); + } return (major + ((float) (minor) / (minorSize * 10))); } diff --git a/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java b/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java index 29e2ef9..ebece61 100644 --- a/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardDefaultSuite.java @@ -10,7 +10,6 @@ import cz.crcs.ectester.common.util.CardUtil; import cz.crcs.ectester.reader.CardMngr; import cz.crcs.ectester.reader.ECTesterReader; import cz.crcs.ectester.reader.command.Command; -import cz.crcs.ectester.reader.response.Response; import javacard.security.KeyPair; import java.util.LinkedList; diff --git a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java index f5ea86f..53f3b6b 100644 --- a/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java +++ b/src/cz/crcs/ectester/reader/test/CardEdgeCasesSuite.java @@ -92,7 +92,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { int firstDiff = ByteUtil.diffBytes(dh.getSecret(), 0, value.getData(0), 0, dh.secretLength()); System.err.println(ByteUtil.bytesToHex(dh.getSecret())); System.err.println(ByteUtil.bytesToHex(value.getData(0))); - return new Result(Result.Value.FAILURE, "ECDH derived secret does not match the test-vector, first difference was at byte " + String.valueOf(firstDiff) + "."); + return new Result(Result.Value.FAILURE, "ECDH derived secret does not match the test-vector, first difference was at byte " + firstDiff + "."); } return new Result(Result.Value.SUCCESS); } @@ -154,7 +154,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { continue; } Test set = CommandTest.expect(new Command.Set(this.card, ECTesterApplet.KEYPAIR_BOTH, EC_Consts.CURVE_external, curve.getParams(), curve.flatten()), Result.ExpectedValue.SUCCESS); - Test generate = CommandTest.expect(new Command.Generate(this.card, ECTesterApplet.KEYPAIR_LOCAL), Result.ExpectedValue.SUCCESS); + Test generate = genOrPreset(curve, Result.ExpectedValue.SUCCESS); CommandTest export = CommandTest.expect(new Command.Export(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.KEY_PUBLIC, EC_Consts.PARAMETER_W), Result.ExpectedValue.SUCCESS); Test setup = runTest(CompoundTest.all(Result.ExpectedValue.SUCCESS, "KeyPair setup.", key, set, generate, export)); @@ -162,11 +162,11 @@ public class CardEdgeCasesSuite extends CardTestSuite { BigInteger p = new BigInteger(1, pParam); byte[] wParam = ((Response.Export) export.getResponse()).getParameter(ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.PARAMETER_W); byte[] yValue = new byte[(wParam.length - 1) / 2]; - System.arraycopy(wParam, (wParam.length/2) + 1, yValue, 0, yValue.length); + System.arraycopy(wParam, (wParam.length / 2) + 1, yValue, 0, yValue.length); BigInteger y = new BigInteger(1, yValue); BigInteger negY = p.subtract(y); byte[] newY = ECUtil.toByteArray(negY, curve.getBits()); - System.arraycopy(newY, 0, wParam, (wParam.length/2) + 1, newY.length); + System.arraycopy(newY, 0, wParam, (wParam.length / 2) + 1, newY.length); EC_Params negYParams = makeParams(newY); Test negYTest = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_LOCAL, EC_Consts.CURVE_external, negYParams.getParams(), negYParams.flatten()), "ECDH with pubkey negated.", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); @@ -302,7 +302,7 @@ public class CardEdgeCasesSuite extends CardTestSuite { if (nearR.compareTo(r) >= 0) { rTests[i++] = ecdhTest(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearR.toString(16) + " (>=r)", Result.ExpectedValue.FAILURE, Result.ExpectedValue.FAILURE); } else { - rTests[i++] = ecdhTestBoth(new Command.Set(this.card, ECTesterApplet.KEYPAIR_REMOTE, EC_Consts.CURVE_external, params.getParams(), params.flatten()), nearR.toString(16) +" (