kmwebnet/OpenSK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

replaces ThreadRng with env RNG (#469)

Browse Source
This commit is contained in:
kaczmarczyck
2022-04-27 15:49:45 +02:00
committed by GitHub
parent 397c4165ca
commit 360efa4eaf
5 changed files with 52 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/ctap/command.rs
View File

@@ -636,8 +636,8 @@ mod test {
}; };
use super::super::ES256_CRED_PARAM; use super::super::ES256_CRED_PARAM;
use super::*; use super::*;
use crate::env::test::TestEnv;
use cbor::{cbor_array, cbor_map}; use cbor::{cbor_array, cbor_map};
use crypto::rng256::ThreadRng256;
#[test] #[test]
fn test_from_cbor_make_credential_parameters() { fn test_from_cbor_make_credential_parameters() {
@@ -749,8 +749,8 @@ mod test {
#[test] #[test]
fn test_from_cbor_client_pin_parameters() { fn test_from_cbor_client_pin_parameters() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk); let cose_key = CoseKey::from(pk);

24
src/ctap/crypto_wrapper.rs
View File

@@ -65,35 +65,35 @@ pub fn aes256_cbc_decrypt(
#[cfg(test)] #[cfg(test)]
mod test { mod test {
use super::*; use super::*;
use crypto::rng256::ThreadRng256; use crate::env::test::TestEnv;
#[test] #[test]
fn test_encrypt_decrypt_with_iv() { fn test_encrypt_decrypt_with_iv() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]); let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext = aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, true).unwrap(); let ciphertext = aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, true).unwrap();
let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext, true).unwrap(); let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext, true).unwrap();
assert_eq!(decrypted, plaintext); assert_eq!(decrypted, plaintext);
} }
#[test] #[test]
fn test_encrypt_decrypt_without_iv() { fn test_encrypt_decrypt_without_iv() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]); let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext = aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, false).unwrap(); let ciphertext = aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, false).unwrap();
let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext, false).unwrap(); let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext, false).unwrap();
assert_eq!(decrypted, plaintext); assert_eq!(decrypted, plaintext);
} }
#[test] #[test]
fn test_correct_iv_usage() { fn test_correct_iv_usage() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]); let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let mut ciphertext_no_iv = let mut ciphertext_no_iv =
aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, false).unwrap(); aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, false).unwrap();
let mut ciphertext_with_iv = vec![0u8; 16]; let mut ciphertext_with_iv = vec![0u8; 16];
ciphertext_with_iv.append(&mut ciphertext_no_iv); ciphertext_with_iv.append(&mut ciphertext_no_iv);
let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext_with_iv, true).unwrap(); let decrypted = aes256_cbc_decrypt(&aes_enc_key, &ciphertext_with_iv, true).unwrap();
@@ -102,10 +102,10 @@ mod test {
#[test] #[test]
fn test_iv_manipulation_property() { fn test_iv_manipulation_property() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]); let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let mut ciphertext = aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, true).unwrap(); let mut ciphertext = aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, true).unwrap();
let mut expected_plaintext = plaintext; let mut expected_plaintext = plaintext;
for i in 0..16 { for i in 0..16 {
ciphertext[i] ^= 0xBB; ciphertext[i] ^= 0xBB;
@@ -117,11 +117,11 @@ mod test {
#[test] #[test]
fn test_chaining() { fn test_chaining() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]); let aes_enc_key = crypto::aes256::EncryptionKey::new(&[0xC2; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext1 = aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, true).unwrap(); let ciphertext1 = aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, true).unwrap();
let ciphertext2 = aes256_cbc_encrypt(&mut rng, &aes_enc_key, &plaintext, true).unwrap(); let ciphertext2 = aes256_cbc_encrypt(env.rng(), &aes_enc_key, &plaintext, true).unwrap();
assert_eq!(ciphertext1.len(), 80); assert_eq!(ciphertext1.len(), 80);
assert_eq!(ciphertext2.len(), 80); assert_eq!(ciphertext2.len(), 80);
// The ciphertext should mutate in all blocks with a different IV. // The ciphertext should mutate in all blocks with a different IV.

33
src/ctap/data_formats.rs
View File

@@ -1221,11 +1221,12 @@ pub(super) fn ok_or_missing<T>(value_option: Option<T>) -> Result<T, Ctap2Status
mod test { mod test {
use self::Ctap2StatusCode::CTAP2_ERR_CBOR_UNEXPECTED_TYPE; use self::Ctap2StatusCode::CTAP2_ERR_CBOR_UNEXPECTED_TYPE;
use super::*; use super::*;
use crate::env::test::TestEnv;
use cbor::{ use cbor::{
cbor_array, cbor_bool, cbor_bytes, cbor_bytes_lit, cbor_false, cbor_int, cbor_null, cbor_array, cbor_bool, cbor_bytes, cbor_bytes_lit, cbor_false, cbor_int, cbor_null,
cbor_text, cbor_unsigned, cbor_text, cbor_unsigned,
}; };
use crypto::rng256::{Rng256, ThreadRng256}; use crypto::rng256::Rng256;
use crypto::sha256::Sha256; use crypto::sha256::Sha256;
#[test] #[test]
@@ -1672,8 +1673,8 @@ mod test {
#[test] #[test]
fn test_from_get_assertion_extensions_default_protocol() { fn test_from_get_assertion_extensions_default_protocol() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk); let cose_key = CoseKey::from(pk);
let cbor_extensions = cbor_map! { let cbor_extensions = cbor_map! {
@@ -1702,8 +1703,8 @@ mod test {
#[test] #[test]
fn test_from_get_assertion_extensions_with_protocol() { fn test_from_get_assertion_extensions_with_protocol() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk); let cose_key = CoseKey::from(pk);
let cbor_extensions = cbor_map! { let cbor_extensions = cbor_map! {
@@ -1877,8 +1878,8 @@ mod test {
#[test] #[test]
fn test_from_into_cose_key_ecdh() { fn test_from_into_cose_key_ecdh() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk.clone()); let cose_key = CoseKey::from(pk.clone());
let created_pk = ecdh::PubKey::try_from(cose_key); let created_pk = ecdh::PubKey::try_from(cose_key);
@@ -1887,8 +1888,8 @@ mod test {
#[test] #[test]
fn test_into_cose_key_ecdsa() { fn test_into_cose_key_ecdsa() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdsa::SecKey::gensk(&mut rng); let sk = crypto::ecdsa::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk); let cose_key = CoseKey::from(pk);
assert_eq!(cose_key.algorithm, ES256_ALGORITHM); assert_eq!(cose_key.algorithm, ES256_ALGORITHM);
@@ -1896,8 +1897,8 @@ mod test {
#[test] #[test]
fn test_from_into_cose_signature() { fn test_from_into_cose_signature() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdsa::SecKey::gensk(&mut rng); let sk = crypto::ecdsa::SecKey::gensk(env.rng());
let dummy_signature = sk.sign_rfc6979::<Sha256>(&[]); let dummy_signature = sk.sign_rfc6979::<Sha256>(&[]);
let mut bytes = [0; ecdsa::Signature::BYTES_LENGTH]; let mut bytes = [0; ecdsa::Signature::BYTES_LENGTH];
dummy_signature.to_bytes(&mut bytes); dummy_signature.to_bytes(&mut bytes);
@@ -1914,8 +1915,8 @@ mod test {
#[test] #[test]
fn test_cose_signature_wrong_algorithm() { fn test_cose_signature_wrong_algorithm() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdsa::SecKey::gensk(&mut rng); let sk = crypto::ecdsa::SecKey::gensk(env.rng());
let dummy_signature = sk.sign_rfc6979::<Sha256>(&[]); let dummy_signature = sk.sign_rfc6979::<Sha256>(&[]);
let mut bytes = [0; ecdsa::Signature::BYTES_LENGTH]; let mut bytes = [0; ecdsa::Signature::BYTES_LENGTH];
dummy_signature.to_bytes(&mut bytes); dummy_signature.to_bytes(&mut bytes);
@@ -2105,11 +2106,11 @@ mod test {
#[test] #[test]
fn test_credential_source_cbor_round_trip() { fn test_credential_source_cbor_round_trip() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let credential = PublicKeyCredentialSource { let credential = PublicKeyCredentialSource {
key_type: PublicKeyCredentialType::PublicKey, key_type: PublicKeyCredentialType::PublicKey,
credential_id: rng.gen_uniform_u8x32().to_vec(), credential_id: env.rng().gen_uniform_u8x32().to_vec(),
private_key: crypto::ecdsa::SecKey::gensk(&mut rng), private_key: crypto::ecdsa::SecKey::gensk(env.rng()),
rp_id: "example.com".to_string(), rp_id: "example.com".to_string(),
user_handle: b"foo".to_vec(), user_handle: b"foo".to_vec(),
user_display_name: None, user_display_name: None,

30
src/ctap/pin_protocol.rs
View File

@@ -230,34 +230,34 @@ impl SharedSecret for SharedSecretV2 {
#[cfg(test)] #[cfg(test)]
mod test { mod test {
use super::*; use super::*;
use crypto::rng256::ThreadRng256; use crate::env::test::TestEnv;
#[test] #[test]
fn test_pin_protocol_public_key() { fn test_pin_protocol_public_key() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let mut pin_protocol = PinProtocol::new(&mut rng); let mut pin_protocol = PinProtocol::new(env.rng());
let public_key = pin_protocol.get_public_key(); let public_key = pin_protocol.get_public_key();
pin_protocol.regenerate(&mut rng); pin_protocol.regenerate(env.rng());
let new_public_key = pin_protocol.get_public_key(); let new_public_key = pin_protocol.get_public_key();
assert_ne!(public_key, new_public_key); assert_ne!(public_key, new_public_key);
} }
#[test] #[test]
fn test_pin_protocol_pin_uv_auth_token() { fn test_pin_protocol_pin_uv_auth_token() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let mut pin_protocol = PinProtocol::new(&mut rng); let mut pin_protocol = PinProtocol::new(env.rng());
let token = *pin_protocol.get_pin_uv_auth_token(); let token = *pin_protocol.get_pin_uv_auth_token();
pin_protocol.reset_pin_uv_auth_token(&mut rng); pin_protocol.reset_pin_uv_auth_token(env.rng());
let new_token = pin_protocol.get_pin_uv_auth_token(); let new_token = pin_protocol.get_pin_uv_auth_token();
assert_ne!(&token, new_token); assert_ne!(&token, new_token);
} }
#[test] #[test]
fn test_shared_secret_v1_encrypt_decrypt() { fn test_shared_secret_v1_encrypt_decrypt() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let shared_secret = SharedSecretV1::new([0x55; 32]); let shared_secret = SharedSecretV1::new([0x55; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext = shared_secret.encrypt(&mut rng, &plaintext).unwrap(); let ciphertext = shared_secret.encrypt(env.rng(), &plaintext).unwrap();
assert_eq!(shared_secret.decrypt(&ciphertext), Ok(plaintext)); assert_eq!(shared_secret.decrypt(&ciphertext), Ok(plaintext));
} }
@@ -290,10 +290,10 @@ mod test {
#[test] #[test]
fn test_shared_secret_v2_encrypt_decrypt() { fn test_shared_secret_v2_encrypt_decrypt() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let shared_secret = SharedSecretV2::new([0x55; 32]); let shared_secret = SharedSecretV2::new([0x55; 32]);
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext = shared_secret.encrypt(&mut rng, &plaintext).unwrap(); let ciphertext = shared_secret.encrypt(env.rng(), &plaintext).unwrap();
assert_eq!(shared_secret.decrypt(&ciphertext), Ok(plaintext)); assert_eq!(shared_secret.decrypt(&ciphertext), Ok(plaintext));
} }
@@ -327,9 +327,9 @@ mod test {
#[test] #[test]
fn test_decapsulate_symmetric() { fn test_decapsulate_symmetric() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let pin_protocol1 = PinProtocol::new(&mut rng); let pin_protocol1 = PinProtocol::new(env.rng());
let pin_protocol2 = PinProtocol::new(&mut rng); let pin_protocol2 = PinProtocol::new(env.rng());
for &protocol in &[PinUvAuthProtocol::V1, PinUvAuthProtocol::V2] { for &protocol in &[PinUvAuthProtocol::V1, PinUvAuthProtocol::V2] {
let shared_secret1 = pin_protocol1 let shared_secret1 = pin_protocol1
.decapsulate(pin_protocol2.get_public_key(), protocol) .decapsulate(pin_protocol2.get_public_key(), protocol)
@@ -338,7 +338,7 @@ mod test {
.decapsulate(pin_protocol1.get_public_key(), protocol) .decapsulate(pin_protocol1.get_public_key(), protocol)
.unwrap(); .unwrap();
let plaintext = vec![0xAA; 64]; let plaintext = vec![0xAA; 64];
let ciphertext = shared_secret1.encrypt(&mut rng, &plaintext).unwrap(); let ciphertext = shared_secret1.encrypt(env.rng(), &plaintext).unwrap();
assert_eq!(plaintext, shared_secret2.decrypt(&ciphertext).unwrap()); assert_eq!(plaintext, shared_secret2.decrypt(&ciphertext).unwrap());
} }
} }

10
src/ctap/response.rs
View File

@@ -343,8 +343,8 @@ mod test {
use super::super::data_formats::{PackedAttestationStatement, PublicKeyCredentialType}; use super::super::data_formats::{PackedAttestationStatement, PublicKeyCredentialType};
use super::super::ES256_CRED_PARAM; use super::super::ES256_CRED_PARAM;
use super::*; use super::*;
use crate::env::test::TestEnv;
use cbor::{cbor_array, cbor_bytes, cbor_map}; use cbor::{cbor_array, cbor_bytes, cbor_map};
use crypto::rng256::ThreadRng256;
#[test] #[test]
fn test_make_credential_into_cbor() { fn test_make_credential_into_cbor() {
@@ -506,8 +506,8 @@ mod test {
#[test] #[test]
fn test_used_client_pin_into_cbor() { fn test_used_client_pin_into_cbor() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let pk = sk.genpk(); let pk = sk.genpk();
let cose_key = CoseKey::from(pk); let cose_key = CoseKey::from(pk);
let client_pin_response = AuthenticatorClientPinResponse { let client_pin_response = AuthenticatorClientPinResponse {
@@ -550,8 +550,8 @@ mod test {
#[test] #[test]
fn test_used_credential_management_optionals_into_cbor() { fn test_used_credential_management_optionals_into_cbor() {
let mut rng = ThreadRng256 {}; let mut env = TestEnv::new();
let sk = crypto::ecdh::SecKey::gensk(&mut rng); let sk = crypto::ecdh::SecKey::gensk(env.rng());
let rp = PublicKeyCredentialRpEntity { let rp = PublicKeyCredentialRpEntity {
rp_id: String::from("example.com"), rp_id: String::from("example.com"),
rp_name: None, rp_name: None,