denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

unit-tests: Add tests to ensure our Curve25519/448 implementations don't return all-zero secrets

Browse Source 
Note that wolfSSL before 5.9.2 required building with
WOLFSSL_ECDHX_SHARED_NOT_ZERO, which was added with 5.3.0, to get and
explicit check.  Since the plugin validates the public key, the test case
fails nonetheless.
This commit is contained in:
Tobias Brunner
2026-07-23 10:26:08 +02:00
parent 589a3a6729
commit 9598de465c
4 changed files with 108 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/tests/Makefile.am
+2
View File
@@ -64,6 +64,8 @@ libstrongswan_tests_SOURCES = tests.h tests.c \
suites/test_rng_tester.c \
suites/test_mgf1.c \
suites/test_prf_plus.c \
suites/test_curve25519.c \
suites/test_curve448.c \
suites/test_ed25519.c \
suites/test_ed448.c \
suites/test_signature_params.c \
src/libstrongswan/tests/suites/test_curve25519.c
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 2026 Tobias Brunner
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "test_suite.h"
static chunk_t all_zero = chunk_from_chars(
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00);
START_TEST(test_reject_all_zero_secret)
{
key_exchange_t *ke;
chunk_t secret;
ke = lib->crypto->create_ke(lib->crypto, CURVE_25519);
ck_assert(ke);
/* implementations might already reject setting the public key */
ignore_result(ke->set_public_key(ke, all_zero));
ck_assert(!ke->get_shared_secret(ke, &secret));
ke->destroy(ke);
}
END_TEST
Suite *curve25519_suite_create()
{
Suite *s;
TCase *tc;
s = suite_create("curve25519");
tc = tcase_create("curve25519_secret");
tcase_add_test(tc, test_reject_all_zero_secret);
suite_add_tcase(s, tc);
return s;
}
src/libstrongswan/tests/suites/test_curve448.c
+53
View File
@@ -0,0 +1,53 @@
/*
* Copyright (C) 2026 Tobias Brunner
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "test_suite.h"
static chunk_t all_zero = chunk_from_chars(
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00);
START_TEST(test_reject_all_zero_secret)
{
key_exchange_t *ke;
chunk_t secret;
ke = lib->crypto->create_ke(lib->crypto, CURVE_448);
ck_assert(ke);
/* implementations might already reject setting the public key */
ignore_result(ke->set_public_key(ke, all_zero));
ck_assert(!ke->get_shared_secret(ke, &secret));
ke->destroy(ke);
}
END_TEST
Suite *curve448_suite_create()
{
Suite *s;
TCase *tc;
s = suite_create("curve448");
tc = tcase_create("curve448_secret");
tcase_add_test(tc, test_reject_all_zero_secret);
suite_add_tcase(s, tc);
return s;
}
src/libstrongswan/tests/tests.h
+2
View File
@@ -61,6 +61,8 @@ TEST_SUITE_DEPEND(mgf1_sha1_suite_create, XOF, XOF_MGF1_SHA1)
TEST_SUITE_DEPEND(mgf1_sha256_suite_create, XOF, XOF_MGF1_SHA256)
TEST_SUITE_DEPEND(prf_plus_suite_create, KDF, KDF_PRF_PLUS)
TEST_SUITE_DEPEND(fetch_http_suite_create, FETCHER, "http://")
TEST_SUITE_DEPEND(curve25519_suite_create, KE, CURVE_25519)
TEST_SUITE_DEPEND(curve448_suite_create, KE, CURVE_448)
TEST_SUITE_DEPEND(ed25519_suite_create, PRIVKEY_GEN, KEY_ED25519)
TEST_SUITE_DEPEND(ed448_suite_create, PRIVKEY_GEN, KEY_ED448)
TEST_SUITE(signature_params_suite_create)