summaryrefslogtreecommitdiff
path: root/scripts/crypto
diff options
context:
space:
mode:
Diffstat (limited to 'scripts/crypto')
-rwxr-xr-xscripts/crypto/gen-aead-testvecs.py69
-rwxr-xr-xscripts/crypto/gen-fips-testvecs.py154
-rwxr-xr-xscripts/crypto/gen-hash-testvecs.py97
3 files changed, 295 insertions, 25 deletions
diff --git a/scripts/crypto/gen-aead-testvecs.py b/scripts/crypto/gen-aead-testvecs.py
new file mode 100755
index 000000000000..d77d646f75b5
--- /dev/null
+++ b/scripts/crypto/gen-aead-testvecs.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Script that generates known-good data used in the AEAD tests.
+#
+# Requires that python-cryptography be installed.
+#
+# Copyright 2026 Google LLC
+
+import hashlib
+import sys
+import cryptography.hazmat.primitives.ciphers.aead
+
+
+# Deterministically generate 'length' random bytes.
+def rand_bytes(length):
+ seed = length
+ out = []
+ for _ in range(length):
+ seed = (seed * 25214903917 + 11) % 2**48
+ out.append((seed >> 16) % 256)
+ return bytes(out)
+
+
+# Deterministically generate many different AEAD inputs using exactly the same
+# method that the test uses; encrypt them using an independent implementation of
+# the algorithm; compute the checksum of all the resulting (ciphertext, authtag)
+# pairs concatenated to each other; and print the checksum as a C struct.
+def gen_monte_carlo_checksum(alg):
+ blake2s = hashlib.blake2s()
+ for data_len in range(1025):
+ ad_len = data_len % 293
+ pt = rand_bytes(data_len)
+ ad = rand_bytes(ad_len)
+ if alg == "aes-ccm":
+ key_len = [16, 24, 32][data_len % 3]
+ key = rand_bytes(key_len)
+ nonce = rand_bytes([7, 8, 9, 10, 11, 12, 13][data_len % 7])
+ tag_len = [4, 6, 8, 10, 12, 14, 16][data_len % 7]
+ ccm = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
+ key, tag_length=tag_len
+ )
+ ct_and_tag = ccm.encrypt(nonce, pt, ad)
+ elif alg == "aes-gcm":
+ key_len = [16, 24, 32][data_len % 3]
+ key = rand_bytes(key_len)
+ nonce = rand_bytes(12)
+ tag_len = [4, 8, 12, 13, 14, 15, 16][data_len % 7]
+ gcm = cryptography.hazmat.primitives.ciphers.aead.AESGCM(key)
+ # python-cryptography supports only 16-byte GCM tags. However, in
+ # GCM, shorter tags are simply truncated. Do that below.
+ ct_and_tag = gcm.encrypt(nonce, pt, ad)[: data_len + tag_len]
+
+ blake2s.update(ct_and_tag)
+
+ name = f"{alg.replace('-', '_')}_monte_carlo_checksum"
+ value = blake2s.digest()
+ print(f"static const u8 {name}[BLAKE2S_HASH_SIZE] = {{")
+ for i in range(0, len(value), 11):
+ line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 11])
+ print(f"{line.rstrip()}")
+ print("};")
+
+
+if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm", "aes-gcm"):
+ sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm|aes-gcm]\n")
+ sys.exit(1)
+
+gen_monte_carlo_checksum(sys.argv[1])
diff --git a/scripts/crypto/gen-fips-testvecs.py b/scripts/crypto/gen-fips-testvecs.py
index db873f88619a..b8c8a78cb8a8 100755
--- a/scripts/crypto/gen-fips-testvecs.py
+++ b/scripts/crypto/gen-fips-testvecs.py
@@ -1,36 +1,148 @@
#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-2.0-or-later
#
-# Script that generates lib/crypto/fips.h
+# Script that generates lib/crypto/fips-aes.h and lib/crypto/fips-sha.h
+#
+# Requires that python-cryptography be installed.
#
# Copyright 2025 Google LLC
+import cryptography.hazmat.primitives.ciphers
+import cryptography.hazmat.primitives.ciphers.aead
+import cryptography.hazmat.primitives.cmac
import hashlib
import hmac
-fips_test_data = b"fips test data\0\0"
-fips_test_key = b"fips test key\0\0\0"
-def print_static_u8_array_definition(name, value):
- print('')
- print(f'static const u8 {name}[] __initconst __maybe_unused = {{')
+def print_static_u8_array_definition(file, name, value):
+ print("", file=file)
+ print(f"static const u8 {name}[] __initconst __maybe_unused = {{", file=file)
for i in range(0, len(value), 8):
- line = '\t' + ''.join(f'0x{b:02x}, ' for b in value[i:i+8])
- print(f'{line.rstrip()}')
- print('};')
+ line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 8])
+ print(f"{line.rstrip()}", file=file)
+ print("};", file=file)
+
+
+def print_header(file):
+ print("/* SPDX-License-Identifier: GPL-2.0-or-later */", file=file)
+ print("/* This file was generated by: gen-fips-testvecs.py */", file=file)
+ print("/* clang-format off */", file=file)
+ print("", file=file)
+ print("#include <linux/fips.h>", file=file)
+
+
+def gen_aes_test_data(file):
+ fips_test_data = b"fips test data\0\0"
+ fips_test_ad = b"fips test ad\0\0\0\0"
+ fips_test_iv = b"fips test iv\0\0\0\0"
+ fips_test_key = b"fips test key\0\0\0"
+ fips_test_xts_key = b"key1" + (b"\0" * 12) + b"key2" + (b"\0" * 12)
+
+ print_header(file)
+ print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+ print_static_u8_array_definition(file, "fips_test_ad", fips_test_ad)
+ print_static_u8_array_definition(file, "fips_test_iv", fips_test_iv)
+ print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
+ print_static_u8_array_definition(file, "fips_test_xts_key", fips_test_xts_key)
+
+ aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_key)
+
+ # AES-CMAC
+ aes_cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
+ aes_cmac.update(fips_test_data)
+ print_static_u8_array_definition(
+ file, "fips_test_aes_cmac_value", aes_cmac.finalize()
+ )
+
+ # AES-ECB
+ cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+ aes, cryptography.hazmat.primitives.ciphers.modes.ECB()
+ )
+ encryptor = cipher.encryptor()
+ ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+ print_static_u8_array_definition(file, "fips_test_aes_ecb_ctext", ctext)
+
+ # AES-CBC
+ cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+ aes, cryptography.hazmat.primitives.ciphers.modes.CBC(fips_test_iv)
+ )
+ encryptor = cipher.encryptor()
+ ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+ print_static_u8_array_definition(file, "fips_test_aes_cbc_ctext", ctext)
+
+ # AES-CBC-CTS
+ cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+ aes, cryptography.hazmat.primitives.ciphers.modes.CBC(fips_test_iv)
+ )
+ encryptor = cipher.encryptor()
+ ctext = encryptor.update(fips_test_data * 2) + encryptor.finalize()
+ ctext = ctext[16:32] + ctext[0:16]
+ print_static_u8_array_definition(file, "fips_test_aes_cbc_cts_ctext", ctext)
+
+ # AES-CTR
+ cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+ aes, cryptography.hazmat.primitives.ciphers.modes.CTR(fips_test_iv)
+ )
+ encryptor = cipher.encryptor()
+ ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+ print_static_u8_array_definition(file, "fips_test_aes_ctr_ctext", ctext)
+
+ # AES-XTS
+ cipher = cryptography.hazmat.primitives.ciphers.Cipher(
+ cryptography.hazmat.primitives.ciphers.algorithms.AES(fips_test_xts_key),
+ cryptography.hazmat.primitives.ciphers.modes.XTS(fips_test_iv),
+ )
+ encryptor = cipher.encryptor()
+ ctext = encryptor.update(fips_test_data) + encryptor.finalize()
+ print_static_u8_array_definition(file, "fips_test_aes_xts_ctext", ctext)
+
+ # AES-GCM
+ cipher = cryptography.hazmat.primitives.ciphers.aead.AESGCM(fips_test_key)
+ ct_and_tag = cipher.encrypt(
+ nonce=fips_test_iv[:12], data=fips_test_data, associated_data=fips_test_ad
+ )
+ print_static_u8_array_definition(
+ file, "fips_test_aes_gcm_ctext_and_tag", ct_and_tag
+ )
+
+ # AES-CCM
+ cipher = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
+ fips_test_key, tag_length=16
+ )
+ ct_and_tag = cipher.encrypt(
+ nonce=fips_test_iv[:13], data=fips_test_data, associated_data=fips_test_ad
+ )
+ print_static_u8_array_definition(
+ file, "fips_test_aes_ccm_ctext_and_tag", ct_and_tag
+ )
+
+
+def gen_sha_test_data(file):
+ fips_test_data = b"fips test data\0\0"
+ fips_test_key = b"fips test key\0\0\0"
+
+ print_header(file)
+ print_static_u8_array_definition(file, "fips_test_data", fips_test_data)
+ print_static_u8_array_definition(file, "fips_test_key", fips_test_key)
+
+ for alg in "sha1", "sha256", "sha512":
+ ctx = hmac.new(fips_test_key, digestmod=alg)
+ ctx.update(fips_test_data)
+ print_static_u8_array_definition(
+ file, f"fips_test_hmac_{alg}_value", ctx.digest()
+ )
-print('/* SPDX-License-Identifier: GPL-2.0-or-later */')
-print(f'/* This file was generated by: gen-fips-testvecs.py */')
-print()
-print('#include <linux/fips.h>')
+ print_static_u8_array_definition(
+ file, "fips_test_sha3_256_value", hashlib.sha3_256(fips_test_data).digest()
+ )
-print_static_u8_array_definition("fips_test_data", fips_test_data)
-print_static_u8_array_definition("fips_test_key", fips_test_key)
-for alg in 'sha1', 'sha256', 'sha512':
- ctx = hmac.new(fips_test_key, digestmod=alg)
- ctx.update(fips_test_data)
- print_static_u8_array_definition(f'fips_test_hmac_{alg}_value', ctx.digest())
+filename = "lib/crypto/fips-aes.h"
+with open(filename, "w") as file:
+ print(f"Generating {filename}")
+ gen_aes_test_data(file)
-print_static_u8_array_definition(f'fips_test_sha3_256_value',
- hashlib.sha3_256(fips_test_data).digest())
+filename = "lib/crypto/fips-sha.h"
+with open(filename, "w") as file:
+ print(f"Generating {filename}")
+ gen_sha_test_data(file)
diff --git a/scripts/crypto/gen-hash-testvecs.py b/scripts/crypto/gen-hash-testvecs.py
index 8eeb650fcada..f356f87e1c77 100755
--- a/scripts/crypto/gen-hash-testvecs.py
+++ b/scripts/crypto/gen-hash-testvecs.py
@@ -3,8 +3,12 @@
#
# Script that generates test vectors for the given hash function.
#
+# Requires that python-cryptography be installed.
+#
# Copyright 2025 Google LLC
+import cryptography.hazmat.primitives.ciphers
+import cryptography.hazmat.primitives.cmac
import hashlib
import hmac
import sys
@@ -24,6 +28,20 @@ def rand_bytes(length):
out.append((seed >> 16) % 256)
return bytes(out)
+AES_256_KEY_SIZE = 32
+
+# AES-CMAC. Just wraps the implementation from python-cryptography.
+class AesCmac:
+ def __init__(self, key):
+ aes = cryptography.hazmat.primitives.ciphers.algorithms.AES(key)
+ self.cmac = cryptography.hazmat.primitives.cmac.CMAC(aes)
+
+ def update(self, data):
+ self.cmac.update(data)
+
+ def digest(self):
+ return self.cmac.finalize()
+
POLY1305_KEY_SIZE = 32
# A straightforward, unoptimized implementation of Poly1305.
@@ -50,6 +68,52 @@ class Poly1305:
m = (self.h + self.s) % 2**128
return m.to_bytes(16, byteorder='little')
+GHASH_POLY = sum((1 << i) for i in [128, 7, 2, 1, 0])
+GHASH_BLOCK_SIZE = 16
+
+# A straightforward, unoptimized implementation of GHASH.
+class Ghash:
+
+ @staticmethod
+ def reflect_bits_in_bytes(v):
+ res = 0
+ for offs in range(0, 128, 8):
+ for bit in range(8):
+ if (v & (1 << (offs + bit))) != 0:
+ res ^= 1 << (offs + 7 - bit)
+ return res
+
+ @staticmethod
+ def bytes_to_poly(data):
+ return Ghash.reflect_bits_in_bytes(int.from_bytes(data, byteorder='little'))
+
+ @staticmethod
+ def poly_to_bytes(poly):
+ return Ghash.reflect_bits_in_bytes(poly).to_bytes(16, byteorder='little')
+
+ def __init__(self, key):
+ assert len(key) == 16
+ self.h = Ghash.bytes_to_poly(key)
+ self.acc = 0
+
+ # Note: this supports partial blocks only at the end.
+ def update(self, data):
+ for i in range(0, len(data), 16):
+ # acc += block
+ self.acc ^= Ghash.bytes_to_poly(data[i:i+16])
+ # acc = (acc * h) mod GHASH_POLY
+ product = 0
+ for j in range(127, -1, -1):
+ if (self.h & (1 << j)) != 0:
+ product ^= self.acc << j
+ if (product & (1 << (128 + j))) != 0:
+ product ^= GHASH_POLY << j
+ self.acc = product
+ return self
+
+ def digest(self):
+ return Ghash.poly_to_bytes(self.acc)
+
POLYVAL_POLY = sum((1 << i) for i in [128, 127, 126, 121, 0])
POLYVAL_BLOCK_SIZE = 16
@@ -80,9 +144,14 @@ class Polyval:
return self.acc.to_bytes(16, byteorder='little')
def hash_init(alg):
+ # The keyed hash functions are assigned a fixed random key here, to present
+ # them as unkeyed hash functions. This allows all the test cases for
+ # unkeyed hash functions to work on them.
+ if alg == 'aes-cmac':
+ return AesCmac(rand_bytes(AES_256_KEY_SIZE))
+ if alg == 'ghash':
+ return Ghash(rand_bytes(GHASH_BLOCK_SIZE))
if alg == 'poly1305':
- # Use a fixed random key here, to present Poly1305 as an unkeyed hash.
- # This allows all the test cases for unkeyed hashes to work on Poly1305.
return Poly1305(rand_bytes(POLY1305_KEY_SIZE))
if alg == 'polyval':
return Polyval(rand_bytes(POLYVAL_BLOCK_SIZE))
@@ -116,6 +185,8 @@ def print_c_struct_u8_array_field(name, value):
print('\t\t},')
def alg_digest_size_const(alg):
+ if alg == 'aes-cmac':
+ return 'AES_BLOCK_SIZE'
if alg.startswith('blake2'):
return f'{alg.upper()}_HASH_SIZE'
return f"{alg.upper().replace('-', '_')}_DIGEST_SIZE"
@@ -234,6 +305,15 @@ def gen_additional_poly1305_testvecs():
'poly1305_allones_macofmacs[POLY1305_DIGEST_SIZE]',
Poly1305(key).update(data).digest())
+def gen_additional_ghash_testvecs():
+ key = b'\xff' * GHASH_BLOCK_SIZE
+ hashes = b''
+ for data_len in range(0, 4097, 16):
+ hashes += Ghash(key).update(b'\xff' * data_len).digest()
+ print_static_u8_array_definition(
+ 'ghash_allones_hashofhashes[GHASH_DIGEST_SIZE]',
+ Ghash(key).update(hashes).digest())
+
def gen_additional_polyval_testvecs():
key = b'\xff' * POLYVAL_BLOCK_SIZE
hashes = b''
@@ -245,16 +325,22 @@ def gen_additional_polyval_testvecs():
if len(sys.argv) != 2:
sys.stderr.write('Usage: gen-hash-testvecs.py ALGORITHM\n')
- sys.stderr.write('ALGORITHM may be any supported by Python hashlib; or poly1305, polyval, or sha3.\n')
+ sys.stderr.write('ALGORITHM may be any supported by Python hashlib;\n')
+ sys.stderr.write(' or aes-cmac, ghash, nh, poly1305, polyval, or sha3.\n')
sys.stderr.write('Example: gen-hash-testvecs.py sha512\n')
sys.exit(1)
alg = sys.argv[1]
print('/* SPDX-License-Identifier: GPL-2.0-or-later */')
print(f'/* This file was generated by: {sys.argv[0]} {" ".join(sys.argv[1:])} */')
-if alg.startswith('blake2'):
+if alg == 'aes-cmac':
+ gen_unkeyed_testvecs(alg)
+elif alg.startswith('blake2'):
gen_unkeyed_testvecs(alg)
gen_additional_blake2_testvecs(alg)
+elif alg == 'ghash':
+ gen_unkeyed_testvecs(alg)
+ gen_additional_ghash_testvecs()
elif alg == 'nh':
gen_nh_testvecs()
elif alg == 'poly1305':
@@ -270,6 +356,9 @@ elif alg == 'sha3':
print()
print('/* SHAKE test vectors */')
gen_additional_sha3_testvecs()
+elif alg == 'sm3':
+ gen_unkeyed_testvecs(alg)
+ # Kernel doesn't implement HMAC-SM3 library functions yet.
else:
gen_unkeyed_testvecs(alg)
gen_hmac_testvecs(alg)
generated by cgit v1.2.3 (git 2.0.4) at 2026-09-22 19:59:44 +0000