mirror of
https://github.com/slackhq/nebula.git
synced 2025-11-09 00:03:58 +01:00
e0553822b0
* Use NewGCMTLS (when using experiment boringcrypto) This change only affects builds built using `GOEXPERIMENT=boringcrypto`. When built with this experiment, we use the NewGCMTLS() method exposed by goboring, which validates that the nonce is strictly monotonically increasing. This is the TLS 1.2 specification for nonce generation (which also matches the method used by the Noise Protocol) - https://github.com/golang/go/blob/go1.19/src/crypto/tls/cipher_suites.go#L520-L522 - https://github.com/golang/go/blob/go1.19/src/crypto/internal/boring/aes.go#L235-L237 - https://github.com/golang/go/blob/go1.19/src/crypto/internal/boring/aes.go#L250 -ae223d6138/include/openssl/aead.h (L379-L381)-ae223d6138/crypto/fipsmodule/cipher/e_aes.c (L1082-L1093)* need to lock around EncryptDanger in SendVia * fix link to test vector
40 lines
1.5 KiB
Go
40 lines
1.5 KiB
Go
//go:build boringcrypto
|
|
// +build boringcrypto
|
|
|
|
package noiseutil
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
// Ensure NewGCMTLS validates the nonce is non-repeating
|
|
func TestNewGCMTLS(t *testing.T) {
|
|
// Test Case 16 from GCM Spec:
|
|
// - (now dead link): http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf
|
|
// - as listed in boringssl tests: https://github.com/google/boringssl/blob/fips-20220613/crypto/cipher_extra/test/cipher_tests.txt#L412-L418
|
|
key, _ := hex.DecodeString("feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308")
|
|
iv, _ := hex.DecodeString("cafebabefacedbaddecaf888")
|
|
plaintext, _ := hex.DecodeString("d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39")
|
|
aad, _ := hex.DecodeString("feedfacedeadbeeffeedfacedeadbeefabaddad2")
|
|
expected, _ := hex.DecodeString("522dc1f099567d07f47f37a32a84427d643a8cdcbfe5c0c97598a2bd2555d1aa8cb08e48590dbb3da7b08b1056828838c5f61e6393ba7a0abcc9f662")
|
|
expectedTag, _ := hex.DecodeString("76fc6ece0f4e1768cddf8853bb2d551b")
|
|
|
|
expected = append(expected, expectedTag...)
|
|
|
|
var keyArray [32]byte
|
|
copy(keyArray[:], key)
|
|
c := CipherAESGCM.Cipher(keyArray)
|
|
aead := c.(aeadCipher).AEAD
|
|
|
|
dst := aead.Seal([]byte{}, iv, plaintext, aad)
|
|
assert.Equal(t, expected, dst)
|
|
|
|
// We expect this to fail since we are re-encrypting with a repeat IV
|
|
assert.PanicsWithError(t, "boringcrypto: EVP_AEAD_CTX_seal failed", func() {
|
|
dst = aead.Seal([]byte{}, iv, plaintext, aad)
|
|
})
|
|
}
|