crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Merge pull request #11802 from Arpan0995/tls13-x448-low-order-tests

Browse Source 
Test X448 low-order key shares in test_tls13_mlkem_bad_key_share
This commit is contained in:
Tobias Frauenschläger
2026-10-19 11:43:55 +02:00
committed by GitHub
parent af7c4e356a d25f9dc64c
commit ecb4697cfb
1 changed files with 67 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
tests/api/test_tls13.c
View File

@@ -5766,12 +5766,24 @@ int test_tls13_multi_pqc_key_share(void)
ECC_MIN_KEY_SZ <= 384
#define TEST_TLS13_BAD_KS_SECP384R1MLKEM1024
#endif
#if defined(WOLFSSL_EXTRA_PQC_HYBRIDS) && \
!defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_CURVE448) && \
ECC_MIN_KEY_SZ <= 448
#define TEST_TLS13_BAD_KS_X448MLKEM768
#endif
#if defined(TEST_TLS13_BAD_KS_ML_KEM_768) || \
defined(TEST_TLS13_BAD_KS_X25519MLKEM768) || \
defined(TEST_TLS13_BAD_KS_SECP256R1MLKEM768) || \
defined(TEST_TLS13_BAD_KS_SECP384R1MLKEM1024)
defined(TEST_TLS13_BAD_KS_SECP384R1MLKEM1024) || \
defined(TEST_TLS13_BAD_KS_X448MLKEM768)
#define TEST_TLS13_MLKEM_BAD_KEY_SHARE_ENABLED
#endif
/* Plain X448 uses the helpers below, which need one of the ML-KEM
* groups. */
#if defined(TEST_TLS13_MLKEM_BAD_KEY_SHARE_ENABLED) && \
defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
#define TEST_TLS13_BAD_KS_X448
#endif
#endif
#ifdef TEST_TLS13_MLKEM_BAD_KEY_SHARE_ENABLED
@@ -6009,6 +6021,53 @@ static int test_tls13_x25519_low_order_key_share(int devId)
}
#endif
#ifdef TEST_TLS13_BAD_KS_X448
/* The X448 inputs that give an all-zero shared secret: u = 0, 1 and p-1, and
* the non-canonical encodings p and p+1 of 0 and 1 (p = 2^448 - 2^224 - 1).
* wc_curve448_check_public() rejects all of them, so they are reported as a
* bad peer key and answered with illegal_parameter. */
static int test_tls13_x448_low_order_key_share(void)
{
EXPECT_DECLS;
byte lowOrder[5][CURVE448_PUB_KEY_SIZE];
int bad = WC_NO_ERR_TRACE(ECC_PEERKEY_ERROR);
int i;
/* Little-endian encodings; lowOrder[0] is 0. */
XMEMSET(lowOrder, 0, sizeof(lowOrder));
/* 1 */
lowOrder[1][0] = 0x01;
/* p-1 */
XMEMSET(lowOrder[2], 0xff, CURVE448_PUB_KEY_SIZE);
lowOrder[2][0] = 0xfe;
lowOrder[2][28] = 0xfe;
/* p */
XMEMSET(lowOrder[3], 0xff, CURVE448_PUB_KEY_SIZE);
lowOrder[3][28] = 0xfe;
/* p+1 */
XMEMSET(lowOrder[4] + 28, 0xff, CURVE448_PUB_KEY_SIZE - 28);
for (i = 0; i < (int)(sizeof(lowOrder) / sizeof(lowOrder[0])); i++) {
#ifdef TEST_TLS13_BAD_KS_X448MLKEM768
/* The X448 part follows the 1184 byte ML-KEM-768 encapsulation key
* in the ClientHello and the 1088 byte ciphertext in the
* ServerHello. */
ExpectIntEQ(test_tls13_mlkem_bad_key_share_once_ex(
WOLFSSL_X448MLKEM768, 1, -1, 0, 1184, lowOrder[i],
CURVE448_PUB_KEY_SIZE, INVALID_DEVID, bad), TEST_SUCCESS);
ExpectIntEQ(test_tls13_mlkem_bad_key_share_once_ex(
WOLFSSL_X448MLKEM768, 0, -1, 0, 1088, lowOrder[i],
CURVE448_PUB_KEY_SIZE, INVALID_DEVID, bad), TEST_SUCCESS);
#endif
/* A plain X448 ServerHello takes the same path. */
ExpectIntEQ(test_tls13_mlkem_bad_key_share_once_ex(WOLFSSL_ECC_X448,
0, -1, 0, 0, lowOrder[i], CURVE448_PUB_KEY_SIZE, INVALID_DEVID,
bad), TEST_SUCCESS);
}
return EXPECT_RESULT();
}
#endif
/* kemOff: where the ML-KEM part starts in both key shares.
* eccLen: bytes of ECDH public key in each share, 0 for pure ML-KEM. */
static int test_tls13_mlkem_bad_key_share_group(int group, int kemOff,
@@ -6083,6 +6142,13 @@ int test_tls13_mlkem_bad_key_share(void)
#ifdef TEST_TLS13_BAD_KS_SECP384R1MLKEM1024
ExpectIntEQ(test_tls13_mlkem_bad_key_share_group(
WOLFSSL_SECP384R1MLKEM1024, 97, 97), TEST_SUCCESS);
#endif
#ifdef TEST_TLS13_BAD_KS_X448MLKEM768
ExpectIntEQ(test_tls13_mlkem_bad_key_share_group(WOLFSSL_X448MLKEM768, 0,
CURVE448_PUB_KEY_SIZE), TEST_SUCCESS);
#endif
#ifdef TEST_TLS13_BAD_KS_X448
ExpectIntEQ(test_tls13_x448_low_order_key_share(), TEST_SUCCESS);
#endif
return EXPECT_RESULT();
}