Switching to test vector files that contain vectors for one curve only.
This covers more test cases, allows to skip test vectors for curves not
supported by a library.
ecdh_test.json contains tests for multiple curves, but is somewhat limited
in coverage.
Sanity checks for using expected files are now based on the JSON schema.
I.e. if the expected and actual JSON schema of the test vector file match,
then the test should pass, otherwise there is a problem with the test setup.
Removing tests covered by test vectors from EcdhTest.java.
Adding timing test for ECDH:
The tests require to run on a system without much noise:
E.g. running a regular unit test is too noisy.
The confidence level is too low to fail the test:
ECDH timing test:secp256r1
Timing for point 0 avg: 4062844.9155273438 std dev: 452064.39579909603 cv:0.11126794283271814
Timing for point 1 avg: 4077776.20703125 std dev: 457662.5685428607 cv:0.1122333706675025
Point 0 multiplication is faster: 1152
Running the same test locally adds less noise.
The ratio avg / std dev is 10 times smaller.
Here the test run shows that time of a point multiplication depends on the
point that is multiplied.
ECDH timing test:secp256r1
Timing for point 0 avg: 1611269.970703125 std dev: 30329.312528547747 cv:0.018823234516877802
Timing for point 1 avg: 1618931.3715820312 std dev: 29267.753517245954 cv:0.01807843990857086
Point 0 multiplication is faster: 1655
NOKEYCHECK=True
PiperOrigin-RevId: 232286329
GitOrigin-RevId: 1bbbd6422c8fd64f3d5ea2fc3ecb94c6bd7bc171
Tests using the new test vectors will be added in another CL.
Changes:
AES-GCM has test vectors for modified tags, which were previously missing.
ECDSA has more test vectors for potential arithmetic errors.
There are no more random test vectors.
Webcrypto has a few test vectors with the bitcoin curve (since some libraries
want to add this).
DSA and ECDSA have more invalid test vectors with r,s = ((q-1)/2 or q-1).
This is motivated by some weak ElGamal implementation in beecrypt.
ECDH test vectors have some new files where the public key is just a point
using SEC 1 / X9.62 format.
All tests for ASN modifications are removed from ecdh_test.json, so that
this file has a more resonable size. These test vectors are included in
the files ecdh_curve_test.json.
EDDSA has a few more invalid test vectors for malformed signatures.
(I.e. the python implementation in the RFC has a small bug).
Adding test vectors for AES-CCM. (tested against BouncyCastle, which sort of
abuses the JCE interface)
There are some test vectors for RSA-PSS (so far tested with BouncyCastle and boringSSL)
More tests will be added when we have an idea what is actually being used.
PiperOrigin-RevId: 205802874
GitOrigin-RevId: 250ab89370a0dcfc56e887fb185a494f45f9a3f5
This CL only adds test vectors.
Changes using the new test vectors are in CL 199130745.
There are the following changes to version 0.4:
ECDSA test vectors with a valid signature but non-DER encoding
have "result":"invalid" and have the flag "BER".
Version 0.4.4 has some additional test vectors:
- Tests for invalid encoding of the INTEGER 0 (i.e. "0200" instead
of "020100")
- Truncation after the ASN tag.
- ECDH test vectors now include shared secrets in invalid test vectors.
This allows to check if an implementation is just sloppy at comparing
public keys (i.e. ignoring parameters) or vulnerable (i.e. using
modified parameters for ECDH computation)
- More tests vectors like the unexplained test vector in b/74209208
- ECDH now has tests vectors where public and private keys are
on different, but isomorphic curves. The result is invalid, since
the encoding of the shared secret is undefined.
- ECDH has test vectors with modified ASN. Again the shared secret
computed with the original public key is included so that it is
a bit easier to distinguish between serious and non-serious cases.
- Some third party test cases were added to all files. They are
removed.
Version 0.4.5:
- adds more test vectors for ECDSA.
- adds more test vectors for RSA signatures and splits the signatures
into more files, sorted by key size and hash.
Version 0.4.6:
- adds an uncompressed encoding to EC keys.
- rsa_signature_test.json now contains more keys for size 1024 to 4096.
Most keys only contain a small number of tests.
More extensive tests are done with a 2048 bit key only.
New bugs:
BouncyCastle and ConsCrypt both accepts some invalid keys (with
additional garbage) as valid. These bugs are currently silenced
by marking the test vectors as acceptable. I.e. the first goal is
to verify that invalid ECDH keys cannot be used to find the private
key.
PiperOrigin-RevId: 199611433
GitOrigin-RevId: f1f99cc52617e18224ec98f84dcaa55c42df9b46
bleichen