github.com/jcmturner/gokrb5/v8@v8.4.4/crypto/aes128-cts-hmac-sha256-128_test.go (about)

     1  package crypto
     2  
     3  import (
     4  	"encoding/hex"
     5  	"testing"
     6  
     7  	"github.com/jcmturner/gokrb5/v8/crypto/common"
     8  	"github.com/jcmturner/gokrb5/v8/crypto/rfc8009"
     9  	"github.com/stretchr/testify/assert"
    10  )
    11  
    12  func TestAes128CtsHmacSha256128_StringToKey(t *testing.T) {
    13  	t.Parallel()
    14  	// Test vectors from RFC 8009 Appendix A
    15  	// Random 16bytes in test vector as string
    16  	r, _ := hex.DecodeString("10DF9DD783E5BC8ACEA1730E74355F61")
    17  	s := string(r)
    18  	var tests = []struct {
    19  		iterations uint32
    20  		phrase     string
    21  		salt       string
    22  		saltp      string
    23  		key        string
    24  	}{
    25  		{32768, "password", s + "ATHENA.MIT.EDUraeburn", "6165733132382d6374732d686d61632d7368613235362d3132380010df9dd783e5bc8acea1730e74355f61415448454e412e4d49542e4544557261656275726e", "089bca48b105ea6ea77ca5d2f39dc5e7"},
    26  	}
    27  	var e Aes128CtsHmacSha256128
    28  	for _, test := range tests {
    29  		saltp := rfc8009.GetSaltP(test.salt, "aes128-cts-hmac-sha256-128")
    30  		assert.Equal(t, test.saltp, hex.EncodeToString([]byte(saltp)), "SaltP not as expected")
    31  
    32  		k, _ := e.StringToKey(test.phrase, test.salt, common.IterationsToS2Kparams(test.iterations))
    33  		assert.Equal(t, test.key, hex.EncodeToString(k), "String to Key not as expected")
    34  
    35  	}
    36  }
    37  
    38  func TestAes128CtsHmacSha256128_DeriveKey(t *testing.T) {
    39  	t.Parallel()
    40  	// Test vectors from RFC 8009 Appendix A
    41  	protocolBaseKey, _ := hex.DecodeString("3705d96080c17728a0e800eab6e0d23c")
    42  	testUsage := uint32(2)
    43  	var e Aes128CtsHmacSha256128
    44  	k, err := e.DeriveKey(protocolBaseKey, common.GetUsageKc(testUsage))
    45  	if err != nil {
    46  		t.Fatalf("Error deriving checksum key: %v", err)
    47  	}
    48  	assert.Equal(t, "b31a018a48f54776f403e9a396325dc3", hex.EncodeToString(k), "Checksum derived key not as epxected")
    49  	k, err = e.DeriveKey(protocolBaseKey, common.GetUsageKe(testUsage))
    50  	if err != nil {
    51  		t.Fatalf("Error deriving encryption key: %v", err)
    52  	}
    53  	assert.Equal(t, "9b197dd1e8c5609d6e67c3e37c62c72e", hex.EncodeToString(k), "Encryption derived key not as epxected")
    54  	k, err = e.DeriveKey(protocolBaseKey, common.GetUsageKi(testUsage))
    55  	if err != nil {
    56  		t.Fatalf("Error deriving integrity key: %v", err)
    57  	}
    58  	assert.Equal(t, "9fda0e56ab2d85e1569a688696c26a6c", hex.EncodeToString(k), "Integrity derived key not as epxected")
    59  }
    60  
    61  func TestAes128CtsHmacSha256128_VerifyIntegrity(t *testing.T) {
    62  	t.Parallel()
    63  	// Test vectors from RFC 8009
    64  	protocolBaseKey, _ := hex.DecodeString("3705d96080c17728a0e800eab6e0d23c")
    65  	testUsage := uint32(2)
    66  	var e Aes128CtsHmacSha256128
    67  	var tests = []struct {
    68  		kc     string
    69  		pt     string
    70  		chksum string
    71  	}{
    72  		{"b31a018a48f54776f403e9a396325dc3", "000102030405060708090a0b0c0d0e0f1011121314", "d78367186643d67b411cba9139fc1dee"},
    73  	}
    74  	for _, test := range tests {
    75  		p, _ := hex.DecodeString(test.pt)
    76  		b, err := e.GetChecksumHash(protocolBaseKey, p, testUsage)
    77  		if err != nil {
    78  			t.Errorf("error generating checksum: %v", err)
    79  		}
    80  		assert.Equal(t, test.chksum, hex.EncodeToString(b), "Checksum not as expected")
    81  	}
    82  }
    83  
    84  func TestAes128CtsHmacSha256128_Cypto(t *testing.T) {
    85  	t.Parallel()
    86  	protocolBaseKey, _ := hex.DecodeString("3705d96080c17728a0e800eab6e0d23c")
    87  	testUsage := uint32(2)
    88  	var tests = []struct {
    89  		plain      string
    90  		confounder string
    91  		ke         string
    92  		ki         string
    93  		encrypted  string // AESOutput
    94  		hash       string // TruncatedHMACOutput
    95  		cipher     string // Ciphertext(AESOutput|HMACOutput)
    96  	}{
    97  		// Test vectors from RFC 8009 Appendix A
    98  		{"", "7e5895eaf2672435bad817f545a37148", "9b197dd1e8c5609d6e67c3e37c62c72e", "9fda0e56ab2d85e1569a688696c26a6c", "ef85fb890bb8472f4dab20394dca781d", "ad877eda39d50c870c0d5a0a8e48c718", "ef85fb890bb8472f4dab20394dca781dad877eda39d50c870c0d5a0a8e48c718"},
    99  		{"000102030405", "7bca285e2fd4130fb55b1a5c83bc5b24", "9b197dd1e8c5609d6e67c3e37c62c72e", "9fda0e56ab2d85e1569a688696c26a6c", "84d7f30754ed987bab0bf3506beb09cfb55402cef7e6", "877ce99e247e52d16ed4421dfdf8976c", "84d7f30754ed987bab0bf3506beb09cfb55402cef7e6877ce99e247e52d16ed4421dfdf8976c"},
   100  		{"000102030405060708090a0b0c0d0e0f", "56ab21713ff62c0a1457200f6fa9948f", "9b197dd1e8c5609d6e67c3e37c62c72e", "9fda0e56ab2d85e1569a688696c26a6c", "3517d640f50ddc8ad3628722b3569d2ae07493fa8263254080ea65c1008e8fc2", "95fb4852e7d83e1e7c48c37eebe6b0d3", "3517d640f50ddc8ad3628722b3569d2ae07493fa8263254080ea65c1008e8fc295fb4852e7d83e1e7c48c37eebe6b0d3"},
   101  		{"000102030405060708090a0b0c0d0e0f1011121314", "a7a4e29a4728ce10664fb64e49ad3fac", "9b197dd1e8c5609d6e67c3e37c62c72e", "9fda0e56ab2d85e1569a688696c26a6c", "720f73b18d9859cd6ccb4346115cd336c70f58edc0c4437c5573544c31c813bce1e6d072c1", "86b39a413c2f92ca9b8334a287ffcbfc", "720f73b18d9859cd6ccb4346115cd336c70f58edc0c4437c5573544c31c813bce1e6d072c186b39a413c2f92ca9b8334a287ffcbfc"},
   102  	}
   103  	var e Aes128CtsHmacSha256128
   104  	for i, test := range tests {
   105  		m, _ := hex.DecodeString(test.plain)
   106  		b, _ := hex.DecodeString(test.encrypted)
   107  		ke, _ := hex.DecodeString(test.ke)
   108  		cf, _ := hex.DecodeString(test.confounder)
   109  		ct, _ := hex.DecodeString(test.cipher)
   110  		cfm := append(cf, m...)
   111  
   112  		// Test encryption to raw encrypted bytes
   113  		_, c, err := e.EncryptData(ke, cfm)
   114  		if err != nil {
   115  			t.Errorf("encryption failed for test %v: %v", i+1, err)
   116  		}
   117  		assert.Equal(t, test.encrypted, hex.EncodeToString(c), "Encrypted result not as expected - test %v", i)
   118  
   119  		// Test decryption of raw encrypted bytes
   120  		p, err := e.DecryptData(ke, b)
   121  		//Remove the confounder bytes
   122  		p = p[e.GetConfounderByteSize():]
   123  		if err != nil {
   124  			t.Errorf("decryption failed for test %v: %v", i+1, err)
   125  		}
   126  		assert.Equal(t, test.plain, hex.EncodeToString(p), "Decrypted result not as expected - test %v", i)
   127  
   128  		// Test integrity check of complete ciphertext message
   129  		assert.True(t, e.VerifyIntegrity(protocolBaseKey, ct, ct, testUsage), "Integrity check of cipher text failed")
   130  
   131  		// Test encrypting and decrypting a complete cipertext message (with confounder, integrity hash)
   132  		_, cm, err := e.EncryptMessage(protocolBaseKey, m, testUsage)
   133  		if err != nil {
   134  			t.Errorf("encryption to message failed for test %v: %v", i+1, err)
   135  		}
   136  		dm, err := e.DecryptMessage(protocolBaseKey, cm, testUsage)
   137  		if err != nil {
   138  			t.Errorf("decrypting complete encrypted message failed for test %v: %v", i+1, err)
   139  		}
   140  		assert.Equal(t, m, dm, "Message not as expected after encrypting and decrypting for test %v: %v", i+1, err)
   141  
   142  		// Test the integrity hash
   143  		ivz := make([]byte, e.GetConfounderByteSize())
   144  		hm := append(ivz, b...)
   145  		mac, _ := common.GetIntegrityHash(hm, protocolBaseKey, testUsage, e)
   146  		assert.Equal(t, test.hash, hex.EncodeToString(mac), "HMAC result not as expected - test %v", i)
   147  	}
   148  }