Add tests for CMAC via JSS Provider

These tests are from NIST's Examples with Intermediate Values page: https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values Signed-off-by: Alexander Scheel <[email protected]>
dogtagpki · Sep 25, 2019 · 8758981 · 8758981
1 parent 9d0b26f
commit 8758981
Show file tree

Hide file tree

Showing 4 changed files with 113 additions and 0 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -45,6 +45,9 @@ find_package(JNI REQUIRED)
 # Since we found Java, include UseJava to provide the find_jar function.
 include(UseJava)
 
+# This include is required for the macro check_symbol_exists in jss_config()
+include(CheckSymbolExists)
+
 # Load JSSConfig module; this defines the jss_config() macro which defines
 # JSS-specific configuration values.
 include(JSSConfig)

diff --git a/cmake/JSSConfig.cmake b/cmake/JSSConfig.cmake
@@ -16,6 +16,9 @@ macro(jss_config)
 
     # Template auto-generated files
     jss_config_template()
+
+    # Check symbols to see what tests we run
+    jss_config_symbols()
 endmacro()
 
 macro(jss_config_version MAJOR MINOR PATCH BETA)
@@ -335,3 +338,14 @@ macro(jss_config_template)
         "${CMAKE_BINARY_DIR}/run_test.sh"
     )
 endmacro()
+
+macro(jss_config_symbols)
+    list(APPEND CMAKE_REQUIRED_INCLUDES ${NSPR_INCLUDE_DIRS})
+    list(APPEND CMAKE_REQUIRED_INCLUDES ${NSS_INCLUDE_DIRS})
+    list(JOIN JSS_C_FLAGS " " CMAKE_REQUIRED_FLAGS)
+
+    check_symbol_exists("CKM_AES_CMAC" "nspr.h;nss.h;pkcs11t.h" HAVE_NSS_CMAC)
+    if(NOT HAVE_NSS_CMAC)
+        message(WARNING "Your NSS version doesn't support CMAC; some features of JSS won't work.")
+    endif()
+endmacro()
diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake
@@ -261,6 +261,13 @@ macro(jss_tests)
             COMMAND "org.mozilla.jss.tests.HmacTest" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}"
             DEPENDS "Setup_DBs"
         )
+        if(HAVE_NSS_CMAC)
+            jss_test_java(
+                NAME "CMAC_Test"
+                COMMAND "org.mozilla.jss.tests.TestCmac" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}"
+                DEPENDS "Setup_DBs"
+            )
+        endif()
         jss_test_java(
             NAME "Mozilla_JSS_Secret_Key_Generation"
             COMMAND "org.mozilla.jss.tests.JCASymKeyGen" "${RESULTS_NSSDB_OUTPUT_DIR}"

diff --git a/org/mozilla/jss/tests/TestCmac.java b/org/mozilla/jss/tests/TestCmac.java
@@ -0,0 +1,89 @@
+package org.mozilla.jss.tests;
+
+import java.util.Arrays;
+import java.util.Base64;
+import java.security.Key;
+
+import javax.crypto.*;
+import javax.crypto.spec.*;
+
+import org.mozilla.jss.*;
+import org.mozilla.jss.crypto.*;
+import org.mozilla.jss.util.*;
+
+public class TestCmac {
+    private static final byte[] NIST_128 = Base64.getDecoder().decode("K34VFiiu0qar9xWICc9PPA==");
+    private static final byte[] NIST_192 = Base64.getDecoder().decode("jnOw99oOZFLIEPMrgJB55WL46tJSLGt7");
+    private static final byte[] NIST_256 = Base64.getDecoder().decode("YD3rEBXKcb4rc67whX13gR81LAc7YQjXLZgQowkU3/Q=");
+
+    public static void main(String[] args) throws Exception {
+        CryptoManager.initialize(args[0]);
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken tok = cm.getInternalKeyStorageToken();
+        PasswordCallback cb = new FilePasswordCallback(args[1]);
+        tok.login(cb);
+
+        testNISTExamples();
+    }
+
+    /*
+     * The following test vectors come from NIST's Examples with Intermediate
+     * Values page:
+     * https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values
+     *
+     * These are the same vectors utilized by NSS in:
+     * gtests/freebl_gtest/cmac_unittests.cc
+     *
+     * These same vectors are also found in FRC 4493, Section 4.
+     */
+    public static void testNISTExamples() throws Exception {
+        byte[] all_input = Base64.getDecoder().decode("a8G+4i5An5bpPX4Rc5MXKq4tilceA6ycnrdvrEWvjlEwyBxGo1zkEeX7wRkaClLv9p8kRd9PmxetK0F75mw3EA==");
+        int[] input_lengths = new int[] { 0, 16, 20, 64};
+
+        byte[][] all_expected = new byte[][] {
+            Base64.getDecoder().decode("ux1pKelZNyh/o30Sm3VnRg=="),
+            Base64.getDecoder().decode("BwoWtGtNQUT3m92d0EoofA=="),
+            Base64.getDecoder().decode("fYVEnqbqGcgjp794g3363g=="),
+            Base64.getDecoder().decode("UfC+v347nZL8SXQXeTY8/g=="),
+            Base64.getDecoder().decode("0X3fRq2qzeUxysSD3nqTZw=="),
+            Base64.getDecoder().decode("npmnvzHnEJAGYvZeYXxRhA=="),
+            Base64.getDecoder().decode("PXXBlO2WBwREqfp+x0Ds+A=="),
+            Base64.getDecoder().decode("odXfDu15D3lNd1iWWfOaEQ=="),
+            Base64.getDecoder().decode("Aoli9ht7+J78a1UfRmfZgw=="),
+            Base64.getDecoder().decode("KKcCP0Uuj4K9S/KNjDfDXA=="),
+            Base64.getDecoder().decode("FWcn3Ah4lEoCPB/gO61tkw=="),
+            Base64.getDecoder().decode("4ZkhkFSfbtVpaiwFbDFUEA==")
+        };
+
+        for (int i = 0; i < all_expected.length; i++) {
+            byte[] key = getKey(i);
+            byte[] input = Arrays.copyOf(all_input, input_lengths[i % input_lengths.length]);
+            byte[] expected = all_expected[i];
+
+            testCMAC(key, input, expected);
+        }
+    }
+
+    public static byte[] getKey(int index) {
+        if (index < 4) {
+            return NIST_128;
+        } else if (index < 8) {
+            return NIST_192;
+        } else if (index < 12) {
+            return NIST_256;
+        }
+
+        return null;
+    }
+
+    public static void testCMAC(byte[] key_bytes, byte[] input, byte[] expected) throws Exception {
+        Mac mac = Mac.getInstance("AES_CMAC", "Mozilla-JSS");
+        SecretKeyFactory factory = SecretKeyFactory.getInstance("AES", "Mozilla-JSS");
+        Key key = factory.generateSecret(new SecretKeySpec(key_bytes, "AES"));
+        mac.init(key);
+
+        byte[] actual = mac.doFinal(input);
+
+        assert(Arrays.equals(actual, expected));
+    }
+}