Function TestChaCha20Poly1305AEAD

src/test/crypto_tests.cpp:593–683

}

static void TestChaCha20Poly1305AEAD(bool must_succeed, unsigned int expected_aad_length, const std::string& hex_m, const std::string& hex_k1, const std::string& hex_k2, const std::string& hex_aad_keystream, const std::string& hex_encrypted_message, const std::string& hex_encrypted_message_seq_999)
{
    // we need two sequence numbers, one for the payload cipher instance...
    uint32_t seqnr_payload = 0;
    // ... and one for the AAD (length) cipher instance
    uint32_t seqnr_aad = 0;
    // we need to keep track of the position in the AAD cipher instance
    // keystream since we use the same 64byte output 21 times
    // (21 times 3 bytes length < 64)
    int aad_pos = 0;

    std::vector<unsigned char> aead_K_1 = ParseHex(hex_k1);
    std::vector<unsigned char> aead_K_2 = ParseHex(hex_k2);
    std::vector<unsigned char> plaintext_buf = ParseHex(hex_m);
    std::vector<unsigned char> expected_aad_keystream = ParseHex(hex_aad_keystream);
    std::vector<unsigned char> expected_ciphertext_and_mac = ParseHex(hex_encrypted_message);
    std::vector<unsigned char> expected_ciphertext_and_mac_sequence999 = ParseHex(hex_encrypted_message_seq_999);

    std::vector<unsigned char> ciphertext_buf(plaintext_buf.size() + POLY1305_TAGLEN, 0);
    std::vector<unsigned char> plaintext_buf_new(plaintext_buf.size(), 0);
    std::vector<unsigned char> cmp_ctx_buffer(64);
    uint32_t out_len = 0;

    // create the AEAD instance
    ChaCha20Poly1305AEAD aead(aead_K_1.data(), aead_K_1.size(), aead_K_2.data(), aead_K_2.size());

    // create a chacha20 instance to compare against
    ChaCha20 cmp_ctx(aead_K_1.data(), 32);

    // encipher
    bool res = aead.Crypt(seqnr_payload, seqnr_aad, aad_pos, ciphertext_buf.data(), ciphertext_buf.size(), plaintext_buf.data(), plaintext_buf.size(), true);
    // make sure the operation succeeded if expected to succeed
    BOOST_CHECK_EQUAL(res, must_succeed);
    if (!res) return;

    // verify ciphertext & mac against the test vector
    BOOST_CHECK_EQUAL(expected_ciphertext_and_mac.size(), ciphertext_buf.size());
    BOOST_CHECK(memcmp(ciphertext_buf.data(), expected_ciphertext_and_mac.data(), ciphertext_buf.size()) == 0);

    // manually construct the AAD keystream
    cmp_ctx.SetIV(seqnr_aad);
    cmp_ctx.Seek(0);
    cmp_ctx.Keystream(cmp_ctx_buffer.data(), 64);
    BOOST_CHECK(memcmp(expected_aad_keystream.data(), cmp_ctx_buffer.data(), expected_aad_keystream.size()) == 0);
    // crypt the 3 length bytes and compare the length
    uint32_t len_cmp = 0;
    len_cmp = (ciphertext_buf[0] ^ cmp_ctx_buffer[aad_pos + 0]) |
              (ciphertext_buf[1] ^ cmp_ctx_buffer[aad_pos + 1]) << 8 |
              (ciphertext_buf[2] ^ cmp_ctx_buffer[aad_pos + 2]) << 16;
    BOOST_CHECK_EQUAL(len_cmp, expected_aad_length);

    // encrypt / decrypt 1000 packets
    for (size_t i = 0; i < 1000; ++i) {
        res = aead.Crypt(seqnr_payload, seqnr_aad, aad_pos, ciphertext_buf.data(), ciphertext_buf.size(), plaintext_buf.data(), plaintext_buf.size(), true);
        BOOST_CHECK(res);
        BOOST_CHECK(aead.GetLength(&out_len, seqnr_aad, aad_pos, ciphertext_buf.data()));
        BOOST_CHECK_EQUAL(out_len, expected_aad_length);
        res = aead.Crypt(seqnr_payload, seqnr_aad, aad_pos, plaintext_buf_new.data(), plaintext_buf_new.size(), ciphertext_buf.data(), ciphertext_buf.size(), false);