test_EAX.py 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773
  1. # ===================================================================
  2. #
  3. # Copyright (c) 2015, Legrandin <helderijs@gmail.com>
  4. # All rights reserved.
  5. #
  6. # Redistribution and use in source and binary forms, with or without
  7. # modification, are permitted provided that the following conditions
  8. # are met:
  9. #
  10. # 1. Redistributions of source code must retain the above copyright
  11. # notice, this list of conditions and the following disclaimer.
  12. # 2. Redistributions in binary form must reproduce the above copyright
  13. # notice, this list of conditions and the following disclaimer in
  14. # the documentation and/or other materials provided with the
  15. # distribution.
  16. #
  17. # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18. # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19. # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  20. # FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  21. # COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  22. # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23. # BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  24. # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  25. # CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26. # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  27. # ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  28. # POSSIBILITY OF SUCH DAMAGE.
  29. # ===================================================================
  30. import unittest
  31. from binascii import unhexlify
  32. from Crypto.SelfTest.st_common import list_test_cases
  33. from Crypto.SelfTest.loader import load_test_vectors_wycheproof
  34. from Crypto.Util.py3compat import tobytes, bchr
  35. from Crypto.Cipher import AES, DES3
  36. from Crypto.Hash import SHAKE128
  37. from Crypto.Util.strxor import strxor
  38. def get_tag_random(tag, length):
  39. return SHAKE128.new(data=tobytes(tag)).read(length)
  40. class EaxTests(unittest.TestCase):
  41. key_128 = get_tag_random("key_128", 16)
  42. key_192 = get_tag_random("key_192", 16)
  43. nonce_96 = get_tag_random("nonce_128", 12)
  44. data_128 = get_tag_random("data_128", 16)
  45. def test_loopback_128(self):
  46. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  47. pt = get_tag_random("plaintext", 16 * 100)
  48. ct = cipher.encrypt(pt)
  49. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  50. pt2 = cipher.decrypt(ct)
  51. self.assertEqual(pt, pt2)
  52. def test_loopback_64(self):
  53. cipher = DES3.new(self.key_192, DES3.MODE_EAX, nonce=self.nonce_96)
  54. pt = get_tag_random("plaintext", 8 * 100)
  55. ct = cipher.encrypt(pt)
  56. cipher = DES3.new(self.key_192, DES3.MODE_EAX, nonce=self.nonce_96)
  57. pt2 = cipher.decrypt(ct)
  58. self.assertEqual(pt, pt2)
  59. def test_nonce(self):
  60. # If not passed, the nonce is created randomly
  61. cipher = AES.new(self.key_128, AES.MODE_EAX)
  62. nonce1 = cipher.nonce
  63. cipher = AES.new(self.key_128, AES.MODE_EAX)
  64. nonce2 = cipher.nonce
  65. self.assertEqual(len(nonce1), 16)
  66. self.assertNotEqual(nonce1, nonce2)
  67. cipher = AES.new(self.key_128, AES.MODE_EAX, self.nonce_96)
  68. ct = cipher.encrypt(self.data_128)
  69. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  70. self.assertEqual(ct, cipher.encrypt(self.data_128))
  71. def test_nonce_must_be_bytes(self):
  72. self.assertRaises(TypeError, AES.new, self.key_128, AES.MODE_EAX,
  73. nonce=u'test12345678')
  74. def test_nonce_length(self):
  75. # nonce can be of any length (but not empty)
  76. self.assertRaises(ValueError, AES.new, self.key_128, AES.MODE_EAX,
  77. nonce=b"")
  78. for x in range(1, 128):
  79. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=bchr(1) * x)
  80. cipher.encrypt(bchr(1))
  81. def test_block_size_128(self):
  82. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  83. self.assertEqual(cipher.block_size, AES.block_size)
  84. def test_block_size_64(self):
  85. cipher = DES3.new(self.key_192, AES.MODE_EAX, nonce=self.nonce_96)
  86. self.assertEqual(cipher.block_size, DES3.block_size)
  87. def test_nonce_attribute(self):
  88. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  89. self.assertEqual(cipher.nonce, self.nonce_96)
  90. # By default, a 16 bytes long nonce is randomly generated
  91. nonce1 = AES.new(self.key_128, AES.MODE_EAX).nonce
  92. nonce2 = AES.new(self.key_128, AES.MODE_EAX).nonce
  93. self.assertEqual(len(nonce1), 16)
  94. self.assertNotEqual(nonce1, nonce2)
  95. def test_unknown_parameters(self):
  96. self.assertRaises(TypeError, AES.new, self.key_128, AES.MODE_EAX,
  97. self.nonce_96, 7)
  98. self.assertRaises(TypeError, AES.new, self.key_128, AES.MODE_EAX,
  99. nonce=self.nonce_96, unknown=7)
  100. # But some are only known by the base cipher
  101. # (e.g. use_aesni consumed by the AES module)
  102. AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96,
  103. use_aesni=False)
  104. def test_null_encryption_decryption(self):
  105. for func in "encrypt", "decrypt":
  106. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  107. result = getattr(cipher, func)(b"")
  108. self.assertEqual(result, b"")
  109. def test_either_encrypt_or_decrypt(self):
  110. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  111. cipher.encrypt(b"")
  112. self.assertRaises(TypeError, cipher.decrypt, b"")
  113. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  114. cipher.decrypt(b"")
  115. self.assertRaises(TypeError, cipher.encrypt, b"")
  116. def test_data_must_be_bytes(self):
  117. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  118. self.assertRaises(TypeError, cipher.encrypt, u'test1234567890-*')
  119. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  120. self.assertRaises(TypeError, cipher.decrypt, u'test1234567890-*')
  121. def test_mac_len(self):
  122. # Invalid MAC length
  123. self.assertRaises(ValueError, AES.new, self.key_128, AES.MODE_EAX,
  124. nonce=self.nonce_96, mac_len=2-1)
  125. self.assertRaises(ValueError, AES.new, self.key_128, AES.MODE_EAX,
  126. nonce=self.nonce_96, mac_len=16+1)
  127. # Valid MAC length
  128. for mac_len in range(2, 16 + 1):
  129. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96,
  130. mac_len=mac_len)
  131. _, mac = cipher.encrypt_and_digest(self.data_128)
  132. self.assertEqual(len(mac), mac_len)
  133. # Default MAC length
  134. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  135. _, mac = cipher.encrypt_and_digest(self.data_128)
  136. self.assertEqual(len(mac), 16)
  137. def test_invalid_mac(self):
  138. from Crypto.Util.strxor import strxor_c
  139. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  140. ct, mac = cipher.encrypt_and_digest(self.data_128)
  141. invalid_mac = strxor_c(mac, 0x01)
  142. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  143. self.assertRaises(ValueError, cipher.decrypt_and_verify, ct,
  144. invalid_mac)
  145. def test_hex_mac(self):
  146. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  147. mac_hex = cipher.hexdigest()
  148. self.assertEqual(cipher.digest(), unhexlify(mac_hex))
  149. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  150. cipher.hexverify(mac_hex)
  151. def test_message_chunks(self):
  152. # Validate that both associated data and plaintext/ciphertext
  153. # can be broken up in chunks of arbitrary length
  154. auth_data = get_tag_random("authenticated data", 127)
  155. plaintext = get_tag_random("plaintext", 127)
  156. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  157. cipher.update(auth_data)
  158. ciphertext, ref_mac = cipher.encrypt_and_digest(plaintext)
  159. def break_up(data, chunk_length):
  160. return [data[i:i+chunk_length] for i in range(0, len(data),
  161. chunk_length)]
  162. # Encryption
  163. for chunk_length in 1, 2, 3, 7, 10, 13, 16, 40, 80, 128:
  164. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  165. for chunk in break_up(auth_data, chunk_length):
  166. cipher.update(chunk)
  167. pt2 = b""
  168. for chunk in break_up(ciphertext, chunk_length):
  169. pt2 += cipher.decrypt(chunk)
  170. self.assertEqual(plaintext, pt2)
  171. cipher.verify(ref_mac)
  172. # Decryption
  173. for chunk_length in 1, 2, 3, 7, 10, 13, 16, 40, 80, 128:
  174. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  175. for chunk in break_up(auth_data, chunk_length):
  176. cipher.update(chunk)
  177. ct2 = b""
  178. for chunk in break_up(plaintext, chunk_length):
  179. ct2 += cipher.encrypt(chunk)
  180. self.assertEqual(ciphertext, ct2)
  181. self.assertEqual(cipher.digest(), ref_mac)
  182. def test_bytearray(self):
  183. # Encrypt
  184. key_ba = bytearray(self.key_128)
  185. nonce_ba = bytearray(self.nonce_96)
  186. header_ba = bytearray(self.data_128)
  187. data_ba = bytearray(self.data_128)
  188. cipher1 = AES.new(self.key_128,
  189. AES.MODE_EAX,
  190. nonce=self.nonce_96)
  191. cipher1.update(self.data_128)
  192. ct = cipher1.encrypt(self.data_128)
  193. tag = cipher1.digest()
  194. cipher2 = AES.new(key_ba,
  195. AES.MODE_EAX,
  196. nonce=nonce_ba)
  197. key_ba[:3] = b'\xFF\xFF\xFF'
  198. nonce_ba[:3] = b'\xFF\xFF\xFF'
  199. cipher2.update(header_ba)
  200. header_ba[:3] = b'\xFF\xFF\xFF'
  201. ct_test = cipher2.encrypt(data_ba)
  202. data_ba[:3] = b'\x99\x99\x99'
  203. tag_test = cipher2.digest()
  204. self.assertEqual(ct, ct_test)
  205. self.assertEqual(tag, tag_test)
  206. self.assertEqual(cipher1.nonce, cipher2.nonce)
  207. # Decrypt
  208. key_ba = bytearray(self.key_128)
  209. nonce_ba = bytearray(self.nonce_96)
  210. header_ba = bytearray(self.data_128)
  211. ct_ba = bytearray(ct)
  212. tag_ba = bytearray(tag)
  213. del data_ba
  214. cipher3 = AES.new(key_ba,
  215. AES.MODE_EAX,
  216. nonce=nonce_ba)
  217. key_ba[:3] = b'\xFF\xFF\xFF'
  218. nonce_ba[:3] = b'\xFF\xFF\xFF'
  219. cipher3.update(header_ba)
  220. header_ba[:3] = b'\xFF\xFF\xFF'
  221. pt_test = cipher3.decrypt(ct_ba)
  222. ct_ba[:3] = b'\xFF\xFF\xFF'
  223. cipher3.verify(tag_ba)
  224. self.assertEqual(pt_test, self.data_128)
  225. def test_memoryview(self):
  226. # Encrypt
  227. key_mv = memoryview(bytearray(self.key_128))
  228. nonce_mv = memoryview(bytearray(self.nonce_96))
  229. header_mv = memoryview(bytearray(self.data_128))
  230. data_mv = memoryview(bytearray(self.data_128))
  231. cipher1 = AES.new(self.key_128,
  232. AES.MODE_EAX,
  233. nonce=self.nonce_96)
  234. cipher1.update(self.data_128)
  235. ct = cipher1.encrypt(self.data_128)
  236. tag = cipher1.digest()
  237. cipher2 = AES.new(key_mv,
  238. AES.MODE_EAX,
  239. nonce=nonce_mv)
  240. key_mv[:3] = b'\xFF\xFF\xFF'
  241. nonce_mv[:3] = b'\xFF\xFF\xFF'
  242. cipher2.update(header_mv)
  243. header_mv[:3] = b'\xFF\xFF\xFF'
  244. ct_test = cipher2.encrypt(data_mv)
  245. data_mv[:3] = b'\x99\x99\x99'
  246. tag_test = cipher2.digest()
  247. self.assertEqual(ct, ct_test)
  248. self.assertEqual(tag, tag_test)
  249. self.assertEqual(cipher1.nonce, cipher2.nonce)
  250. # Decrypt
  251. key_mv = memoryview(bytearray(self.key_128))
  252. nonce_mv = memoryview(bytearray(self.nonce_96))
  253. header_mv = memoryview(bytearray(self.data_128))
  254. ct_mv = memoryview(bytearray(ct))
  255. tag_mv = memoryview(bytearray(tag))
  256. del data_mv
  257. cipher3 = AES.new(key_mv,
  258. AES.MODE_EAX,
  259. nonce=nonce_mv)
  260. key_mv[:3] = b'\xFF\xFF\xFF'
  261. nonce_mv[:3] = b'\xFF\xFF\xFF'
  262. cipher3.update(header_mv)
  263. header_mv[:3] = b'\xFF\xFF\xFF'
  264. pt_test = cipher3.decrypt(ct_mv)
  265. ct_mv[:3] = b'\x99\x99\x99'
  266. cipher3.verify(tag_mv)
  267. self.assertEqual(pt_test, self.data_128)
  268. def test_output_param(self):
  269. pt = b'5' * 128
  270. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  271. ct = cipher.encrypt(pt)
  272. tag = cipher.digest()
  273. output = bytearray(128)
  274. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  275. res = cipher.encrypt(pt, output=output)
  276. self.assertEqual(ct, output)
  277. self.assertEqual(res, None)
  278. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  279. res = cipher.decrypt(ct, output=output)
  280. self.assertEqual(pt, output)
  281. self.assertEqual(res, None)
  282. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  283. res, tag_out = cipher.encrypt_and_digest(pt, output=output)
  284. self.assertEqual(ct, output)
  285. self.assertEqual(res, None)
  286. self.assertEqual(tag, tag_out)
  287. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  288. res = cipher.decrypt_and_verify(ct, tag, output=output)
  289. self.assertEqual(pt, output)
  290. self.assertEqual(res, None)
  291. def test_output_param_memoryview(self):
  292. pt = b'5' * 128
  293. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  294. ct = cipher.encrypt(pt)
  295. output = memoryview(bytearray(128))
  296. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  297. cipher.encrypt(pt, output=output)
  298. self.assertEqual(ct, output)
  299. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  300. cipher.decrypt(ct, output=output)
  301. self.assertEqual(pt, output)
  302. def test_output_param_neg(self):
  303. LEN_PT = 16
  304. pt = b'5' * LEN_PT
  305. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  306. ct = cipher.encrypt(pt)
  307. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  308. self.assertRaises(TypeError, cipher.encrypt, pt, output=b'0' * LEN_PT)
  309. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  310. self.assertRaises(TypeError, cipher.decrypt, ct, output=b'0' * LEN_PT)
  311. shorter_output = bytearray(LEN_PT - 1)
  312. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  313. self.assertRaises(ValueError, cipher.encrypt, pt, output=shorter_output)
  314. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  315. self.assertRaises(ValueError, cipher.decrypt, ct, output=shorter_output)
  316. class EaxFSMTests(unittest.TestCase):
  317. key_128 = get_tag_random("key_128", 16)
  318. nonce_96 = get_tag_random("nonce_128", 12)
  319. data_128 = get_tag_random("data_128", 16)
  320. def test_valid_init_encrypt_decrypt_digest_verify(self):
  321. # No authenticated data, fixed plaintext
  322. # Verify path INIT->ENCRYPT->DIGEST
  323. cipher = AES.new(self.key_128, AES.MODE_EAX,
  324. nonce=self.nonce_96)
  325. ct = cipher.encrypt(self.data_128)
  326. mac = cipher.digest()
  327. # Verify path INIT->DECRYPT->VERIFY
  328. cipher = AES.new(self.key_128, AES.MODE_EAX,
  329. nonce=self.nonce_96)
  330. cipher.decrypt(ct)
  331. cipher.verify(mac)
  332. def test_valid_init_update_digest_verify(self):
  333. # No plaintext, fixed authenticated data
  334. # Verify path INIT->UPDATE->DIGEST
  335. cipher = AES.new(self.key_128, AES.MODE_EAX,
  336. nonce=self.nonce_96)
  337. cipher.update(self.data_128)
  338. mac = cipher.digest()
  339. # Verify path INIT->UPDATE->VERIFY
  340. cipher = AES.new(self.key_128, AES.MODE_EAX,
  341. nonce=self.nonce_96)
  342. cipher.update(self.data_128)
  343. cipher.verify(mac)
  344. def test_valid_full_path(self):
  345. # Fixed authenticated data, fixed plaintext
  346. # Verify path INIT->UPDATE->ENCRYPT->DIGEST
  347. cipher = AES.new(self.key_128, AES.MODE_EAX,
  348. nonce=self.nonce_96)
  349. cipher.update(self.data_128)
  350. ct = cipher.encrypt(self.data_128)
  351. mac = cipher.digest()
  352. # Verify path INIT->UPDATE->DECRYPT->VERIFY
  353. cipher = AES.new(self.key_128, AES.MODE_EAX,
  354. nonce=self.nonce_96)
  355. cipher.update(self.data_128)
  356. cipher.decrypt(ct)
  357. cipher.verify(mac)
  358. def test_valid_init_digest(self):
  359. # Verify path INIT->DIGEST
  360. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  361. cipher.digest()
  362. def test_valid_init_verify(self):
  363. # Verify path INIT->VERIFY
  364. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  365. mac = cipher.digest()
  366. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  367. cipher.verify(mac)
  368. def test_valid_multiple_encrypt_or_decrypt(self):
  369. for method_name in "encrypt", "decrypt":
  370. for auth_data in (None, b"333", self.data_128,
  371. self.data_128 + b"3"):
  372. if auth_data is None:
  373. assoc_len = None
  374. else:
  375. assoc_len = len(auth_data)
  376. cipher = AES.new(self.key_128, AES.MODE_EAX,
  377. nonce=self.nonce_96)
  378. if auth_data is not None:
  379. cipher.update(auth_data)
  380. method = getattr(cipher, method_name)
  381. method(self.data_128)
  382. method(self.data_128)
  383. method(self.data_128)
  384. method(self.data_128)
  385. def test_valid_multiple_digest_or_verify(self):
  386. # Multiple calls to digest
  387. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  388. cipher.update(self.data_128)
  389. first_mac = cipher.digest()
  390. for x in range(4):
  391. self.assertEqual(first_mac, cipher.digest())
  392. # Multiple calls to verify
  393. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  394. cipher.update(self.data_128)
  395. for x in range(5):
  396. cipher.verify(first_mac)
  397. def test_valid_encrypt_and_digest_decrypt_and_verify(self):
  398. # encrypt_and_digest
  399. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  400. cipher.update(self.data_128)
  401. ct, mac = cipher.encrypt_and_digest(self.data_128)
  402. # decrypt_and_verify
  403. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  404. cipher.update(self.data_128)
  405. pt = cipher.decrypt_and_verify(ct, mac)
  406. self.assertEqual(self.data_128, pt)
  407. def test_invalid_mixing_encrypt_decrypt(self):
  408. # Once per method, with or without assoc. data
  409. for method1_name, method2_name in (("encrypt", "decrypt"),
  410. ("decrypt", "encrypt")):
  411. for assoc_data_present in (True, False):
  412. cipher = AES.new(self.key_128, AES.MODE_EAX,
  413. nonce=self.nonce_96)
  414. if assoc_data_present:
  415. cipher.update(self.data_128)
  416. getattr(cipher, method1_name)(self.data_128)
  417. self.assertRaises(TypeError, getattr(cipher, method2_name),
  418. self.data_128)
  419. def test_invalid_encrypt_or_update_after_digest(self):
  420. for method_name in "encrypt", "update":
  421. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  422. cipher.encrypt(self.data_128)
  423. cipher.digest()
  424. self.assertRaises(TypeError, getattr(cipher, method_name),
  425. self.data_128)
  426. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  427. cipher.encrypt_and_digest(self.data_128)
  428. def test_invalid_decrypt_or_update_after_verify(self):
  429. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  430. ct = cipher.encrypt(self.data_128)
  431. mac = cipher.digest()
  432. for method_name in "decrypt", "update":
  433. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  434. cipher.decrypt(ct)
  435. cipher.verify(mac)
  436. self.assertRaises(TypeError, getattr(cipher, method_name),
  437. self.data_128)
  438. cipher = AES.new(self.key_128, AES.MODE_EAX, nonce=self.nonce_96)
  439. cipher.decrypt_and_verify(ct, mac)
  440. self.assertRaises(TypeError, getattr(cipher, method_name),
  441. self.data_128)
  442. class TestVectorsPaper(unittest.TestCase):
  443. """Class exercising the EAX test vectors found in
  444. http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf"""
  445. test_vectors_hex = [
  446. ( '6bfb914fd07eae6b',
  447. '',
  448. '',
  449. 'e037830e8389f27b025a2d6527e79d01',
  450. '233952dee4d5ed5f9b9c6d6ff80ff478',
  451. '62EC67F9C3A4A407FCB2A8C49031A8B3'
  452. ),
  453. (
  454. 'fa3bfd4806eb53fa',
  455. 'f7fb',
  456. '19dd',
  457. '5c4c9331049d0bdab0277408f67967e5',
  458. '91945d3f4dcbee0bf45ef52255f095a4',
  459. 'BECAF043B0A23D843194BA972C66DEBD'
  460. ),
  461. ( '234a3463c1264ac6',
  462. '1a47cb4933',
  463. 'd851d5bae0',
  464. '3a59f238a23e39199dc9266626c40f80',
  465. '01f74ad64077f2e704c0f60ada3dd523',
  466. '70C3DB4F0D26368400A10ED05D2BFF5E'
  467. ),
  468. (
  469. '33cce2eabff5a79d',
  470. '481c9e39b1',
  471. '632a9d131a',
  472. 'd4c168a4225d8e1ff755939974a7bede',
  473. 'd07cf6cbb7f313bdde66b727afd3c5e8',
  474. '8408DFFF3C1A2B1292DC199E46B7D617'
  475. ),
  476. (
  477. 'aeb96eaebe2970e9',
  478. '40d0c07da5e4',
  479. '071dfe16c675',
  480. 'cb0677e536f73afe6a14b74ee49844dd',
  481. '35b6d0580005bbc12b0587124557d2c2',
  482. 'FDB6B06676EEDC5C61D74276E1F8E816'
  483. ),
  484. (
  485. 'd4482d1ca78dce0f',
  486. '4de3b35c3fc039245bd1fb7d',
  487. '835bb4f15d743e350e728414',
  488. 'abb8644fd6ccb86947c5e10590210a4f',
  489. 'bd8e6e11475e60b268784c38c62feb22',
  490. '6EAC5C93072D8E8513F750935E46DA1B'
  491. ),
  492. (
  493. '65d2017990d62528',
  494. '8b0a79306c9ce7ed99dae4f87f8dd61636',
  495. '02083e3979da014812f59f11d52630da30',
  496. '137327d10649b0aa6e1c181db617d7f2',
  497. '7c77d6e813bed5ac98baa417477a2e7d',
  498. '1A8C98DCD73D38393B2BF1569DEEFC19'
  499. ),
  500. (
  501. '54b9f04e6a09189a',
  502. '1bda122bce8a8dbaf1877d962b8592dd2d56',
  503. '2ec47b2c4954a489afc7ba4897edcdae8cc3',
  504. '3b60450599bd02c96382902aef7f832a',
  505. '5fff20cafab119ca2fc73549e20f5b0d',
  506. 'DDE59B97D722156D4D9AFF2BC7559826'
  507. ),
  508. (
  509. '899a175897561d7e',
  510. '6cf36720872b8513f6eab1a8a44438d5ef11',
  511. '0de18fd0fdd91e7af19f1d8ee8733938b1e8',
  512. 'e7f6d2231618102fdb7fe55ff1991700',
  513. 'a4a4782bcffd3ec5e7ef6d8c34a56123',
  514. 'B781FCF2F75FA5A8DE97A9CA48E522EC'
  515. ),
  516. (
  517. '126735fcc320d25a',
  518. 'ca40d7446e545ffaed3bd12a740a659ffbbb3ceab7',
  519. 'cb8920f87a6c75cff39627b56e3ed197c552d295a7',
  520. 'cfc46afc253b4652b1af3795b124ab6e',
  521. '8395fcf1e95bebd697bd010bc766aac3',
  522. '22E7ADD93CFC6393C57EC0B3C17D6B44'
  523. ),
  524. ]
  525. test_vectors = [[unhexlify(x) for x in tv] for tv in test_vectors_hex]
  526. def runTest(self):
  527. for assoc_data, pt, ct, mac, key, nonce in self.test_vectors:
  528. # Encrypt
  529. cipher = AES.new(key, AES.MODE_EAX, nonce, mac_len=len(mac))
  530. cipher.update(assoc_data)
  531. ct2, mac2 = cipher.encrypt_and_digest(pt)
  532. self.assertEqual(ct, ct2)
  533. self.assertEqual(mac, mac2)
  534. # Decrypt
  535. cipher = AES.new(key, AES.MODE_EAX, nonce, mac_len=len(mac))
  536. cipher.update(assoc_data)
  537. pt2 = cipher.decrypt_and_verify(ct, mac)
  538. self.assertEqual(pt, pt2)
  539. class TestVectorsWycheproof(unittest.TestCase):
  540. def __init__(self, wycheproof_warnings):
  541. unittest.TestCase.__init__(self)
  542. self._wycheproof_warnings = wycheproof_warnings
  543. self._id = "None"
  544. def setUp(self):
  545. def filter_tag(group):
  546. return group['tagSize'] // 8
  547. self.tv = load_test_vectors_wycheproof(("Cipher", "wycheproof"),
  548. "aes_eax_test.json",
  549. "Wycheproof EAX",
  550. group_tag={'tag_size': filter_tag})
  551. def shortDescription(self):
  552. return self._id
  553. def warn(self, tv):
  554. if tv.warning and self._wycheproof_warnings:
  555. import warnings
  556. warnings.warn("Wycheproof warning: %s (%s)" % (self._id, tv.comment))
  557. def test_encrypt(self, tv):
  558. self._id = "Wycheproof Encrypt EAX Test #" + str(tv.id)
  559. try:
  560. cipher = AES.new(tv.key, AES.MODE_EAX, tv.iv, mac_len=tv.tag_size)
  561. except ValueError as e:
  562. assert len(tv.iv) == 0 and "Nonce cannot be empty" in str(e)
  563. return
  564. cipher.update(tv.aad)
  565. ct, tag = cipher.encrypt_and_digest(tv.msg)
  566. if tv.valid:
  567. self.assertEqual(ct, tv.ct)
  568. self.assertEqual(tag, tv.tag)
  569. self.warn(tv)
  570. def test_decrypt(self, tv):
  571. self._id = "Wycheproof Decrypt EAX Test #" + str(tv.id)
  572. try:
  573. cipher = AES.new(tv.key, AES.MODE_EAX, tv.iv, mac_len=tv.tag_size)
  574. except ValueError as e:
  575. assert len(tv.iv) == 0 and "Nonce cannot be empty" in str(e)
  576. return
  577. cipher.update(tv.aad)
  578. try:
  579. pt = cipher.decrypt_and_verify(tv.ct, tv.tag)
  580. except ValueError:
  581. assert not tv.valid
  582. else:
  583. assert tv.valid
  584. self.assertEqual(pt, tv.msg)
  585. self.warn(tv)
  586. def test_corrupt_decrypt(self, tv):
  587. self._id = "Wycheproof Corrupt Decrypt EAX Test #" + str(tv.id)
  588. if len(tv.iv) == 0 or len(tv.ct) < 1:
  589. return
  590. cipher = AES.new(tv.key, AES.MODE_EAX, tv.iv, mac_len=tv.tag_size)
  591. cipher.update(tv.aad)
  592. ct_corrupt = strxor(tv.ct, b"\x00" * (len(tv.ct) - 1) + b"\x01")
  593. self.assertRaises(ValueError, cipher.decrypt_and_verify, ct_corrupt, tv.tag)
  594. def runTest(self):
  595. for tv in self.tv:
  596. self.test_encrypt(tv)
  597. self.test_decrypt(tv)
  598. self.test_corrupt_decrypt(tv)
  599. class TestOtherCiphers(unittest.TestCase):
  600. @classmethod
  601. def create_test(cls, name, factory, key_size):
  602. def test_template(self, factory=factory, key_size=key_size):
  603. cipher = factory.new(get_tag_random("cipher", key_size),
  604. factory.MODE_EAX,
  605. nonce=b"nonce")
  606. ct, mac = cipher.encrypt_and_digest(b"plaintext")
  607. cipher = factory.new(get_tag_random("cipher", key_size),
  608. factory.MODE_EAX,
  609. nonce=b"nonce")
  610. pt2 = cipher.decrypt_and_verify(ct, mac)
  611. self.assertEqual(b"plaintext", pt2)
  612. setattr(cls, "test_" + name, test_template)
  613. from Crypto.Cipher import DES, DES3, ARC2, CAST, Blowfish
  614. TestOtherCiphers.create_test("DES_" + str(DES.key_size), DES, DES.key_size)
  615. for ks in DES3.key_size:
  616. TestOtherCiphers.create_test("DES3_" + str(ks), DES3, ks)
  617. for ks in ARC2.key_size:
  618. TestOtherCiphers.create_test("ARC2_" + str(ks), ARC2, ks)
  619. for ks in CAST.key_size:
  620. TestOtherCiphers.create_test("CAST_" + str(ks), CAST, ks)
  621. for ks in Blowfish.key_size:
  622. TestOtherCiphers.create_test("Blowfish_" + str(ks), Blowfish, ks)
  623. def get_tests(config={}):
  624. wycheproof_warnings = config.get('wycheproof_warnings')
  625. tests = []
  626. tests += list_test_cases(EaxTests)
  627. tests += list_test_cases(EaxFSMTests)
  628. tests += [ TestVectorsPaper() ]
  629. tests += [ TestVectorsWycheproof(wycheproof_warnings) ]
  630. tests += list_test_cases(TestOtherCiphers)
  631. return tests
  632. if __name__ == '__main__':
  633. suite = lambda: unittest.TestSuite(get_tests())
  634. unittest.main(defaultTest='suite')