poly1305_kunit.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * Copyright 2025 Google LLC
  4 */
  5#include <crypto/poly1305.h>
  6#include "poly1305-testvecs.h"
  7
  8/*
  9 * A fixed key used when presenting Poly1305 as an unkeyed hash function in
 10 * order to reuse hash-test-template.h.  At the beginning of the test suite,
 11 * this is initialized to bytes generated from a fixed seed.
 12 */
 13static u8 test_key[POLY1305_KEY_SIZE];
 14
 15/* This probably should be in the actual API, but just define it here for now */
 16static void poly1305(const u8 key[POLY1305_KEY_SIZE], const u8 *data,
 17		     size_t len, u8 out[POLY1305_DIGEST_SIZE])
 18{
 19	struct poly1305_desc_ctx ctx;
 20
 21	poly1305_init(&ctx, key);
 22	poly1305_update(&ctx, data, len);
 23	poly1305_final(&ctx, out);
 24}
 25
 26static void poly1305_init_withtestkey(struct poly1305_desc_ctx *ctx)
 27{
 28	poly1305_init(ctx, test_key);
 29}
 30
 31static void poly1305_withtestkey(const u8 *data, size_t len,
 32				 u8 out[POLY1305_DIGEST_SIZE])
 33{
 34	poly1305(test_key, data, len, out);
 35}
 36
 37/* Generate the HASH_KUNIT_CASES using hash-test-template.h. */
 38#define HASH poly1305_withtestkey
 39#define HASH_CTX poly1305_desc_ctx
 40#define HASH_SIZE POLY1305_DIGEST_SIZE
 41#define HASH_INIT poly1305_init_withtestkey
 42#define HASH_UPDATE poly1305_update
 43#define HASH_FINAL poly1305_final
 44#include "hash-test-template.h"
 45
 46static int poly1305_suite_init(struct kunit_suite *suite)
 47{
 48	rand_bytes_seeded_from_len(test_key, POLY1305_KEY_SIZE);
 49	return hash_suite_init(suite);
 50}
 51
 52static void poly1305_suite_exit(struct kunit_suite *suite)
 53{
 54	hash_suite_exit(suite);
 55}
 56
 57/*
 58 * Poly1305 test case which uses a key and message consisting only of one bits:
 59 *
 60 * - Using an all-one-bits r_key tests the key clamping.
 61 * - Using an all-one-bits s_key tests carries in implementations of the
 62 *   addition mod 2**128 during finalization.
 63 * - Using all-one-bits message, and to a lesser extent r_key, tends to maximize
 64 *   any intermediate accumulator values.  This increases the chance of
 65 *   detecting bugs that occur only in rare cases where the accumulator values
 66 *   get very large, for example the bug fixed by commit 678cce4019d746da
 67 *   ("crypto: x86/poly1305 - fix overflow during partial reduction").
 68 *
 69 * Accumulator overflow bugs may be specific to particular update lengths (in
 70 * blocks) and/or particular values of the previous acculumator.  Note that the
 71 * accumulator starts at 0 which gives the lowest chance of an overflow.  Thus,
 72 * a single all-one-bits test vector may be insufficient.
 73 *
 74 * Considering that, do the following test: continuously update a single
 75 * Poly1305 context with all-one-bits data of varying lengths (0, 16, 32, ...,
 76 * 4096 bytes).  After each update, generate the MAC from the current context,
 77 * and feed that MAC into a separate Poly1305 context.  Repeat that entire
 78 * sequence of updates 32 times without re-initializing either context,
 79 * resulting in a total of 8224 MAC computations from a long-running, cumulative
 80 * context.  Finally, generate and verify the MAC of all the MACs.
 81 */
 82static void test_poly1305_allones_keys_and_message(struct kunit *test)
 83{
 84	struct poly1305_desc_ctx mac_ctx, macofmacs_ctx;
 85	u8 mac[POLY1305_DIGEST_SIZE];
 86
 87	static_assert(TEST_BUF_LEN >= 4096);
 88	memset(test_buf, 0xff, 4096);
 89
 90	poly1305_init(&mac_ctx, test_buf);
 91	poly1305_init(&macofmacs_ctx, test_buf);
 92	for (int i = 0; i < 32; i++) {
 93		for (size_t len = 0; len <= 4096; len += 16) {
 94			struct poly1305_desc_ctx tmp_ctx;
 95
 96			poly1305_update(&mac_ctx, test_buf, len);
 97			tmp_ctx = mac_ctx;
 98			poly1305_final(&tmp_ctx, mac);
 99			poly1305_update(&macofmacs_ctx, mac,
100					POLY1305_DIGEST_SIZE);
101		}
102	}
103	poly1305_final(&macofmacs_ctx, mac);
104	KUNIT_ASSERT_MEMEQ(test, mac, poly1305_allones_macofmacs,
105			   POLY1305_DIGEST_SIZE);
106}
107
108/*
109 * Poly1305 test case which uses r_key=1, s_key=0, and a 48-byte message
110 * consisting of three blocks with integer values [2**128 - i, 0, 0].  In this
111 * case, the result of the polynomial evaluation is 2**130 - i.  For small
112 * values of i, this is very close to the modulus 2**130 - 5, which helps catch
113 * edge case bugs in the modular reduction logic.
114 */
115static void test_poly1305_reduction_edge_cases(struct kunit *test)
116{
117	static const u8 key[POLY1305_KEY_SIZE] = { 1 }; /* r_key=1, s_key=0 */
118	u8 data[3 * POLY1305_BLOCK_SIZE] = {};
119	u8 expected_mac[POLY1305_DIGEST_SIZE];
120	u8 actual_mac[POLY1305_DIGEST_SIZE];
121
122	for (int i = 1; i <= 10; i++) {
123		/* Set the first data block to 2**128 - i. */
124		data[0] = -i;
125		memset(&data[1], 0xff, POLY1305_BLOCK_SIZE - 1);
126
127		/*
128		 * Assuming s_key=0, the expected MAC as an integer is
129		 * (2**130 - i mod 2**130 - 5) + 0 mod 2**128.  If 1 <= i <= 5,
130		 * that's 5 - i.  If 6 <= i <= 10, that's 2**128 - i.
131		 */
132		if (i <= 5) {
133			expected_mac[0] = 5 - i;
134			memset(&expected_mac[1], 0, POLY1305_DIGEST_SIZE - 1);
135		} else {
136			expected_mac[0] = -i;
137			memset(&expected_mac[1], 0xff,
138			       POLY1305_DIGEST_SIZE - 1);
139		}
140
141		/* Compute and verify the MAC. */
142		poly1305(key, data, sizeof(data), actual_mac);
143		KUNIT_ASSERT_MEMEQ(test, actual_mac, expected_mac,
144				   POLY1305_DIGEST_SIZE);
145	}
146}
147
148static struct kunit_case poly1305_test_cases[] = {
149	HASH_KUNIT_CASES,
150	KUNIT_CASE(test_poly1305_allones_keys_and_message),
151	KUNIT_CASE(test_poly1305_reduction_edge_cases),
152	KUNIT_CASE(benchmark_hash),
153	{},
154};
155
156static struct kunit_suite poly1305_test_suite = {
157	.name = "poly1305",
158	.test_cases = poly1305_test_cases,
159	.suite_init = poly1305_suite_init,
160	.suite_exit = poly1305_suite_exit,
161};
162kunit_test_suite(poly1305_test_suite);
163
164MODULE_DESCRIPTION("KUnit tests and benchmark for Poly1305");
165MODULE_LICENSE("GPL");