aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/sha3_test.cc

@@ -6,10 +6,10 @@
 
 #include <gtest/gtest.h>
 
+#include <openssl/digest.h>
 #include "../../test/file_test.h"
 #include "../../test/test_util.h"
 #include "internal.h"
-#include <openssl/digest.h>
 
 
 // SHA3TestVector corresponds to one test case of the NIST published file
@@ -25,51 +25,46 @@ class SHA3TestVector {
   void NISTTestVectors(const EVP_MD *algorithm) const {
     uint32_t digest_length;
     std::unique_ptr<uint8_t[]> digest(new uint8_t[EVP_MD_size(algorithm)]);
-    EVP_MD_CTX* ctx = EVP_MD_CTX_new();
+    bssl::ScopedEVP_MD_CTX ctx;
 
     // Test the correctness via the Init, Update and Final Digest APIs.
-    ASSERT_TRUE(EVP_DigestInit(ctx, algorithm));
-    ASSERT_TRUE(EVP_DigestUpdate(ctx, msg_.data(), len_ / 8));
-    ASSERT_TRUE(EVP_DigestFinal(ctx, digest.get(), &digest_length));
+    ASSERT_TRUE(EVP_DigestInit(ctx.get(), algorithm));
+    ASSERT_TRUE(EVP_DigestUpdate(ctx.get(), msg_.data(), len_ / 8));
+    ASSERT_TRUE(EVP_DigestFinal(ctx.get(), digest.get(), &digest_length));
 
     ASSERT_EQ(Bytes(digest.get(), EVP_MD_size(algorithm)),
               Bytes(digest_.data(), EVP_MD_size(algorithm)));
-
-    OPENSSL_free(ctx);
   }
 
   void NISTTestVectors_SingleShot(const EVP_MD *algorithm) const {
     uint32_t digest_length;
     std::unique_ptr<uint8_t[]> digest(new uint8_t[EVP_MD_size(algorithm)]);
-    EVP_MD_CTX* ctx = EVP_MD_CTX_new();
 
     // Test the correctness via the Single-Shot EVP_Digest APIs.
-    ASSERT_TRUE(EVP_Digest(msg_.data(), len_ / 8, digest.get(), &digest_length, algorithm, NULL));
+    ASSERT_TRUE(EVP_Digest(msg_.data(), len_ / 8, digest.get(), &digest_length,
+                           algorithm, nullptr));
 
     ASSERT_EQ(Bytes(digest.get(), EVP_MD_size(algorithm)),
               Bytes(digest_.data(), EVP_MD_size(algorithm)));
-
-    OPENSSL_free(ctx);
-  }
-
-  void NISTTestVectors_SHAKE128() const {
-    uint32_t digest_length = out_len_ / 8;
-    std::unique_ptr<uint8_t[]> digest(new uint8_t[digest_length]);
-
-    ASSERT_TRUE(SHAKE128(msg_.data(), msg_.size() , digest.get(), out_len_));
-
-    ASSERT_EQ(Bytes(digest.get(), out_len_ / 8),
-            Bytes(digest_.data(), out_len_ / 8));
   }
 
-  void NISTTestVectors_SHAKE256() const {
+  void NISTTestVectors_SHAKE(const EVP_MD *algorithm) const {
     uint32_t digest_length = out_len_ / 8;
     std::unique_ptr<uint8_t[]> digest(new uint8_t[digest_length]);
-
-    ASSERT_TRUE(SHAKE256(msg_.data(), msg_.size() , digest.get(), out_len_));
-
-    ASSERT_EQ(Bytes(digest.get(), out_len_ / 8),
-            Bytes(digest_.data(), out_len_ / 8));
+    bssl::ScopedEVP_MD_CTX ctx;
+
+    // Test the incremental EVP API
+    ASSERT_TRUE(EVP_DigestInit(ctx.get(), algorithm));
+    ASSERT_TRUE(EVP_DigestUpdate(ctx.get(), msg_.data(), msg_.size()));
+    ASSERT_TRUE(EVP_DigestFinalXOF(ctx.get(), digest.get(), digest_length));
+    EXPECT_EQ(Bytes(digest.get(), digest_length),
+              Bytes(digest_.data(), digest_length));
+
+    // Test the one-shot
+    ASSERT_TRUE(EVP_Digest(msg_.data(), msg_.size(), digest.get(),
+                           &digest_length, algorithm, nullptr));
+    EXPECT_EQ(Bytes(digest.get(), digest_length),
+              Bytes(digest_.data(), digest_length));
   }
 
  private:
@@ -84,12 +79,14 @@ template <typename T>
 bool FileTestReadInt(FileTest *file_test, T *out, const std::string &key) {
   std::string s;
   return file_test->GetAttribute(&s, key) &&
-  testing::internal::ParseInt32(testing::Message() << "The value " << s.data() << \
-  " is not convertable to an integer.", s.data(), (int *) out);
+         testing::internal::ParseInt32(
+             testing::Message() << "The value " << s.data()
+                                << " is not convertable to an integer.",
+             s.data(), (int *)out);
 }
 
 bool SHA3TestVector::ReadFromFileTest(FileTest *t) {
-   if (t->HasAttribute("Outputlen")) {
+  if (t->HasAttribute("Outputlen")) {
     if (!FileTestReadInt(t, &out_len_, "Outputlen")) {
       return false;
     }
@@ -101,8 +98,7 @@ bool SHA3TestVector::ReadFromFileTest(FileTest *t) {
     }
   }
 
-  if (!t->GetBytes(&msg_, "Msg") ||
-      !t->GetBytes(&digest_, "MD")) {
+  if (!t->GetBytes(&msg_, "Msg") || !t->GetBytes(&digest_, "MD")) {
     return false;
   }
 
@@ -110,91 +106,100 @@ bool SHA3TestVector::ReadFromFileTest(FileTest *t) {
 }
 
 TEST(SHA3Test, NISTTestVectors) {
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_224ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_224();
-    test_vec.NISTTestVectors(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_256ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_256();
-    test_vec.NISTTestVectors(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_384ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_384();
-    test_vec.NISTTestVectors(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_512ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_512();
-    test_vec.NISTTestVectors(algorithm);
-  });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_224ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_224();
+                  test_vec.NISTTestVectors(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_256ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_256();
+                  test_vec.NISTTestVectors(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_384ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_384();
+                  test_vec.NISTTestVectors(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_512ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_512();
+                  test_vec.NISTTestVectors(algorithm);
+                });
 }
 
 TEST(SHA3Test, NISTTestVectors_SingleShot) {
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_224ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_224();
-    test_vec.NISTTestVectors_SingleShot(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_256ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_256();
-    test_vec.NISTTestVectors_SingleShot(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_384ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_384();
-    test_vec.NISTTestVectors_SingleShot(algorithm);
-  });
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_512ShortMsg.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    const EVP_MD* algorithm = EVP_sha3_512();
-    test_vec.NISTTestVectors_SingleShot(algorithm);
-  });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_224ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_224();
+                  test_vec.NISTTestVectors_SingleShot(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_256ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_256();
+                  test_vec.NISTTestVectors_SingleShot(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_384ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_384();
+                  test_vec.NISTTestVectors_SingleShot(algorithm);
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHA3_512ShortMsg.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  const EVP_MD *algorithm = EVP_sha3_512();
+                  test_vec.NISTTestVectors_SingleShot(algorithm);
+                });
 }
 
 TEST(KeccakInternalTest, SqueezeOutputBufferOverflow) {
-    EVP_MD_unstable_sha3_enable(true);
-
-    KECCAK1600_CTX ctx;
-    std::vector<uint8_t> out;
-    std::vector<uint8_t> canary(8);
-    std::fill(canary.begin(), canary.end(), 0xff);
-
-    const size_t out_lens[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, (1<<5), (1<<16)+1 };
-    for (auto out_len : out_lens) {
-        EXPECT_TRUE(SHA3_Init(&ctx, SHA3_PAD_CHAR, SHA3_384_DIGEST_BITLENGTH));
-        out.resize(out_len + canary.size());
-        std::copy(canary.begin(), canary.end(), out.end() - canary.size());
-        SHA3_Squeeze(ctx.A, out.data(), out_len, ctx.block_size);
-        EXPECT_TRUE(std::equal(out.end() - canary.size(), out.end(), canary.begin()) == true);
-    }
-
-    EVP_MD_unstable_sha3_enable(false);
-}
+  EVP_MD_unstable_sha3_enable(true);
+
+  KECCAK1600_CTX ctx;
+  std::vector<uint8_t> out;
+  std::vector<uint8_t> canary(8);
+  std::fill(canary.begin(), canary.end(), 0xff);
+
+  const size_t out_lens[] = {
+      0, 1, 2, 3, 4, 5, 6, 7, 8, (1 << 5), (1 << 16) + 1};
+  for (auto out_len : out_lens) {
+    EXPECT_TRUE(SHA3_Init(&ctx, SHA3_PAD_CHAR, SHA3_384_DIGEST_BITLENGTH));
+    out.resize(out_len + canary.size());
+    std::copy(canary.begin(), canary.end(), out.end() - canary.size());
+    SHA3_Squeeze(ctx.A, out.data(), out_len, ctx.block_size);
+    EXPECT_TRUE(std::equal(out.end() - canary.size(), out.end(),
+                           canary.begin()) == true);
+  }
 
-TEST(SHAKE128Test, NISTTestVectors) {
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHAKE128VariableOut.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    test_vec.NISTTestVectors_SHAKE128();
-  });
+  EVP_MD_unstable_sha3_enable(false);
 }
 
-TEST(SHAKE256Test, NISTTestVectors) {
-  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHAKE256VariableOut.txt", [](FileTest *t) {
-    SHA3TestVector test_vec;
-    EXPECT_TRUE(test_vec.ReadFromFileTest(t));
-    test_vec.NISTTestVectors_SHAKE256();
-  });
+TEST(SHAKETest, NISTTestVectors) {
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHAKE128VariableOut.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  test_vec.NISTTestVectors_SHAKE(EVP_shake128());
+                });
+  FileTestGTest("crypto/fipsmodule/sha/testvectors/SHAKE256VariableOut.txt",
+                [](FileTest *t) {
+                  SHA3TestVector test_vec;
+                  EXPECT_TRUE(test_vec.ReadFromFileTest(t));
+                  test_vec.NISTTestVectors_SHAKE(EVP_shake256());
+                });
 }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/sha512.c

@@ -107,6 +107,23 @@ int SHA512_Init(SHA512_CTX *sha) {
   return 1;
 }
 
+int SHA512_224_Init(SHA512_CTX *sha) {
+  sha->h[0] = UINT64_C(0x8c3d37c819544da2);
+  sha->h[1] = UINT64_C(0x73e1996689dcd4d6);
+  sha->h[2] = UINT64_C(0x1dfab7ae32ff9c82);
+  sha->h[3] = UINT64_C(0x679dd514582f9fcf);
+  sha->h[4] = UINT64_C(0x0f6d2b697bd44da8);
+  sha->h[5] = UINT64_C(0x77e36f7304c48942);
+  sha->h[6] = UINT64_C(0x3f9d85a86a1d36c8);
+  sha->h[7] = UINT64_C(0x1112e6ad91d692a1);
+
+  sha->Nl = 0;
+  sha->Nh = 0;
+  sha->num = 0;
+  sha->md_len = SHA512_224_DIGEST_LENGTH;
+  return 1;
+}
+
 int SHA512_256_Init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0x22312194fc2bf72c);
   sha->h[1] = UINT64_C(0x9f555fa3c84c64c2);
@@ -158,6 +175,23 @@ uint8_t *SHA512(const uint8_t *data, size_t len,
   return out;
 }
 
+uint8_t *SHA512_224(const uint8_t *data, size_t len,
+                    uint8_t out[SHA512_224_DIGEST_LENGTH]) {
+  // We have to verify that all the SHA services actually succeed before
+  // updating the indicator state, so we lock the state here.
+  FIPS_service_indicator_lock_state();
+  SHA512_CTX ctx;
+  const int ok = SHA512_224_Init(&ctx) &&
+                 SHA512_224_Update(&ctx, data, len) &&
+                 SHA512_224_Final(out, &ctx);
+  FIPS_service_indicator_unlock_state();
+  if(ok) {
+    FIPS_service_indicator_update_state();
+  }
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
 uint8_t *SHA512_256(const uint8_t *data, size_t len,
                     uint8_t out[SHA512_256_DIGEST_LENGTH]) {
   // We have to verify that all the SHA services actually succeed before
@@ -192,6 +226,17 @@ int SHA384_Update(SHA512_CTX *sha, const void *data, size_t len) {
   return SHA512_Update(sha, data, len);
 }
 
+int SHA512_224_Update(SHA512_CTX *sha, const void *data, size_t len) {
+  return SHA512_Update(sha, data, len);
+}
+
+int SHA512_224_Final(uint8_t out[SHA512_224_DIGEST_LENGTH], SHA512_CTX *sha) {
+  // This function must be paired with |SHA512_224_Init|, which sets
+  // |sha->md_len| to |SHA512_224_DIGEST_LENGTH|.
+  assert(sha->md_len == SHA512_224_DIGEST_LENGTH);
+  return sha512_final_impl(out, SHA512_224_DIGEST_LENGTH, sha);
+}
+
 int SHA512_256_Update(SHA512_CTX *sha, const void *data, size_t len) {
   return SHA512_Update(sha, data, len);
 }
@@ -288,13 +333,22 @@ static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
     return 0;
   }
 
-  assert(md_len % 8 == 0);
   const size_t out_words = md_len / 8;
+  assert(md_len % 8 == 0 || md_len == SHA512_224_DIGEST_LENGTH);
   for (size_t i = 0; i < out_words; i++) {
     CRYPTO_store_u64_be(out, sha->h[i]);
     out += 8;
   }
 
+  // SHA-512 and SHA-512/256 are aligned to 8-byte words, SHA-512/224 is not.
+  // If the digest size is not aligned to 8-byte words, we need to process the
+  // non-word-aligned "trailer".
+  if (md_len == SHA512_224_DIGEST_LENGTH) {
+    uint64_t trailer;
+    CRYPTO_store_u64_be(&trailer, sha->h[out_words]);
+    OPENSSL_memcpy(out, &trailer, SHA512_224_DIGEST_LENGTH % 8);
+  }
+
   FIPS_service_indicator_update_state();
   return 1;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sshkdf/sshkdf.c

@@ -23,7 +23,7 @@ int SSHKDF(const EVP_MD *evp_md,
 {
   EVP_MD_CTX *md = NULL;
   uint8_t digest[EVP_MAX_MD_SIZE];
-  size_t digest_size = 0;
+  unsigned int digest_size = 0;
   size_t cursize = 0;
   int ret = 0;
 
@@ -72,7 +72,7 @@ int SSHKDF(const EVP_MD *evp_md,
     goto out;
   }
 
-  if (!EVP_DigestFinal_ex(md, digest, (unsigned int *)&digest_size)) {
+  if (!EVP_DigestFinal_ex(md, digest, &digest_size)) {
     goto out;
   }
 

data/aws-crt-ffi/crt/aws-lc/crypto/hmac_extra/hmac_test.cc

@@ -81,6 +81,8 @@ static const EVP_MD *GetDigest(const std::string &name) {
     return EVP_sha384();
   } else if (name == "SHA512") {
     return EVP_sha512();
+  } else if (name == "SHA512/224") {
+    return EVP_sha512_224();
   } else if (name == "SHA512/256") {
     return EVP_sha512_256();
   }
@@ -202,3 +204,13 @@ TEST(HMACTest, WycheproofSHA512) {
   RunWycheproofTest("third_party/wycheproof_testvectors/hmac_sha512_test.txt",
                     EVP_sha512());
 }
+
+TEST(HMACTest, WycheproofSHA512_224) {
+  RunWycheproofTest("third_party/wycheproof_testvectors/hmac_sha512_224_test.txt",
+                    EVP_sha512_224());
+}
+
+TEST(HMACTest, WycheproofSHA512_256) {
+  RunWycheproofTest("third_party/wycheproof_testvectors/hmac_sha512_256_test.txt",
+                    EVP_sha512_256());
+}

data/aws-crt-ffi/crt/aws-lc/crypto/hmac_extra/hmac_tests.txt

@@ -124,6 +124,16 @@ Input = "My test data"
 Key = "12345"
 Output = 7dbe8c764c068e3bcd6e6b0fbcd5e6fc197b15bb
 
+HMAC = SHA512/224
+Input = "My test data"
+Key =
+Output = fc993d20088ed6028478b8356aa818b82c6131f04292f97d86e77620
+
+HMAC = SHA512/224
+Input = "My test data"
+Key = "123456"
+Output = 49d08109c1766ce6386d7b8bdaf5d014667083677096b82f56a73531
+
 HMAC = SHA512/256
 Input = "My test data"
 Key =

data/aws-crt-ffi/crt/aws-lc/crypto/hrss/asm/poly_rq_mul.S

@@ -12,11 +12,11 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+#include <openssl/asm_base.h>
+
 #if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \
     defined(__linux__) && !defined(MY_ASSEMBLER_IS_TOO_OLD_FOR_AVX)
 
-#include <openssl/boringssl_prefix_symbols_asm.h>
-
 // This is the polynomial multiplication function from [HRSS], provided by kind
 // permission of the authors.
 //
@@ -8486,7 +8486,3 @@ ret
 .size poly_Rq_mul,.-poly_Rq_mul
 
 #endif
-
-#if defined(__ELF__)
-.section	.note.GNU-stack,"",%progbits
-#endif

data/aws-crt-ffi/crt/aws-lc/crypto/impl_dispatch_test.cc

@@ -39,7 +39,15 @@ class ImplDispatchTest : public ::testing::Test {
     aes_hw_ = CRYPTO_is_AESNI_capable();
     avx_movbe_ = CRYPTO_is_AVX_capable() && CRYPTO_is_MOVBE_capable();
     aes_vpaes_ = CRYPTO_is_SSSE3_capable();
-    sha_ext_ = CRYPTO_is_SHAEXT_capable();
+    sha_ext_ =
+// TODO(CryptoAlg-2137): sha_ext_ isn't enabled on Windows Debug Builds with newer
+// 32-bit Intel processors.
+#if !(defined(OPENSSL_WINDOWS) && defined(OPENSSL_X86) && !defined(NDEBUG))
+    CRYPTO_is_SHAEXT_capable();
+#else
+    false;
+#endif
+
     vaes_vpclmulqdq_ =
 #if !defined(OPENSSL_WINDOWS)
   // crypto_gcm_avx512_enabled excludes Windows