xref: /openssl/test/dhkem_test.inc (revision da1c088f) 
1/*
2 * Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10typedef struct {
11    const char *curvename;
12    /* seed */
13    const unsigned char *ikm;
14    size_t ikmlen;
15    /* expected public key */
16    const unsigned char *pub;
17    size_t publen;
18    /* expected private key */
19    const unsigned char *priv;
20    size_t privlen;
21} TEST_DERIVEKEY_DATA;
22
23typedef struct {
24    const char *curve;
25    /* The seed for the senders ephemeral key */
26    const unsigned char *ikmE;
27    size_t ikmElen;
28    /* Recipient key */
29    const unsigned char *rpub;
30    size_t rpublen;
31    const unsigned char *rpriv;
32    size_t rprivlen;
33    /* The senders generated ephemeral public key */
34    const unsigned char *expected_enc;
35    size_t expected_enclen;
36    /* The generated shared secret */
37    const unsigned char *expected_secret;
38    size_t expected_secretlen;
39    /* Senders Auth key */
40    const unsigned char *spub;
41    size_t spublen;
42    const unsigned char *spriv;
43    size_t sprivlen;
44} TEST_ENCAPDATA;
45
46static const char *dhkem_supported_curves[] = {
47    "P-256",
48    "P-384",
49    "P-521",
50#ifndef OPENSSL_NO_ECX
51    "X25519",
52    "X448",
53#endif
54};
55
56/* TEST vectors extracted from RFC 9180 */
57
58/* Base test values */
59#ifndef OPENSSL_NO_ECX
60static const unsigned char x25519_ikme[] = {
61    0x72, 0x68, 0x60, 0x0d, 0x40, 0x3f, 0xce, 0x43,
62    0x15, 0x61, 0xae, 0xf5, 0x83, 0xee, 0x16, 0x13,
63    0x52, 0x7c, 0xff, 0x65, 0x5c, 0x13, 0x43, 0xf2,
64    0x98, 0x12, 0xe6, 0x67, 0x06, 0xdf, 0x32, 0x34
65};
66static const unsigned char x25519_ikme_priv[] = {
67    0x52, 0xc4, 0xa7, 0x58, 0xa8, 0x02, 0xcd, 0x8b,
68    0x93, 0x6e, 0xce, 0xea, 0x31, 0x44, 0x32, 0x79,
69    0x8d, 0x5b, 0xaf, 0x2d, 0x7e, 0x92, 0x35, 0xdc,
70    0x08, 0x4a, 0xb1, 0xb9, 0xcf, 0xa2, 0xf7, 0x36
71};
72static const unsigned char x25519_ikme_pub[] = {
73    0x37, 0xfd, 0xa3, 0x56, 0x7b, 0xdb, 0xd6, 0x28,
74    0xe8, 0x86, 0x68, 0xc3, 0xc8, 0xd7, 0xe9, 0x7d,
75    0x1d, 0x12, 0x53, 0xb6, 0xd4, 0xea, 0x6d, 0x44,
76    0xc1, 0x50, 0xf7, 0x41, 0xf1, 0xbf, 0x44, 0x31
77};
78static const unsigned char x25519_rpub[] = {
79    0x39, 0x48, 0xcf, 0xe0, 0xad, 0x1d, 0xdb, 0x69,
80    0x5d, 0x78, 0x0e, 0x59, 0x07, 0x71, 0x95, 0xda,
81    0x6c, 0x56, 0x50, 0x6b, 0x02, 0x73, 0x29, 0x79,
82    0x4a, 0xb0, 0x2b, 0xca, 0x80, 0x81, 0x5c, 0x4d
83};
84static const unsigned char x25519_rpriv[] = {
85    0x46, 0x12, 0xc5, 0x50, 0x26, 0x3f, 0xc8, 0xad,
86    0x58, 0x37, 0x5d, 0xf3, 0xf5, 0x57, 0xaa, 0xc5,
87    0x31, 0xd2, 0x68, 0x50, 0x90, 0x3e, 0x55, 0xa9,
88    0xf2, 0x3f, 0x21, 0xd8, 0x53, 0x4e, 0x8a, 0xc8
89};
90static const unsigned char x25519_expected_enc[] = {
91    0x37, 0xfd, 0xa3, 0x56, 0x7b, 0xdb, 0xd6, 0x28,
92    0xe8, 0x86, 0x68, 0xc3, 0xc8, 0xd7, 0xe9, 0x7d,
93    0x1d, 0x12, 0x53, 0xb6, 0xd4, 0xea, 0x6d, 0x44,
94    0xc1, 0x50, 0xf7, 0x41, 0xf1, 0xbf, 0x44, 0x31
95};
96static const unsigned char x25519_expected_secret[] = {
97    0xfe, 0x0e, 0x18, 0xc9, 0xf0, 0x24, 0xce, 0x43,
98    0x79, 0x9a, 0xe3, 0x93, 0xc7, 0xe8, 0xfe, 0x8f,
99    0xce, 0x9d, 0x21, 0x88, 0x75, 0xe8, 0x22, 0x7b,
100    0x01, 0x87, 0xc0, 0x4e, 0x7d, 0x2e, 0xa1, 0xfc
101};
102
103static const unsigned char x25519_auth_ikme[] = {
104    0x6e, 0x6d, 0x8f, 0x20, 0x0e, 0xa2, 0xfb, 0x20,
105    0xc3, 0x0b, 0x00, 0x3a, 0x8b, 0x4f, 0x43, 0x3d,
106    0x2f, 0x4e, 0xd4, 0xc2, 0x65, 0x8d, 0x5b, 0xc8,
107    0xce, 0x2f, 0xef, 0x71, 0x80, 0x59, 0xc9, 0xf7
108};
109static const unsigned char x25519_auth_rpub[] = {
110    0x16, 0x32, 0xd5, 0xc2, 0xf7, 0x1c, 0x2b, 0x38,
111    0xd0, 0xa8, 0xfc, 0xc3, 0x59, 0x35, 0x52, 0x00,
112    0xca, 0xa8, 0xb1, 0xff, 0xdf, 0x28, 0x61, 0x80,
113    0x80, 0x46, 0x6c, 0x90, 0x9c, 0xb6, 0x9b, 0x2e
114};
115static const unsigned char x25519_auth_rpriv[] = {
116    0xfd, 0xea, 0x67, 0xcf, 0x83, 0x1f, 0x1c, 0xa9,
117    0x8d, 0x8e, 0x27, 0xb1, 0xf6, 0xab, 0xeb, 0x5b,
118    0x77, 0x45, 0xe9, 0xd3, 0x53, 0x48, 0xb8, 0x0f,
119    0xa4, 0x07, 0xff, 0x69, 0x58, 0xf9, 0x13, 0x7e
120};
121static const unsigned char x25519_auth_spub[] = {
122    0x8b, 0x0c, 0x70, 0x87, 0x3d, 0xc5, 0xae, 0xcb,
123    0x7f, 0x9e, 0xe4, 0xe6, 0x24, 0x06, 0xa3, 0x97,
124    0xb3, 0x50, 0xe5, 0x70, 0x12, 0xbe, 0x45, 0xcf,
125    0x53, 0xb7, 0x10, 0x5a, 0xe7, 0x31, 0x79, 0x0b
126};
127static const unsigned char x25519_auth_spriv[] = {
128    0xdc, 0x4a, 0x14, 0x63, 0x13, 0xcc, 0xe6, 0x0a,
129    0x27, 0x8a, 0x53, 0x23, 0xd3, 0x21, 0xf0, 0x51,
130    0xc5, 0x70, 0x7e, 0x9c, 0x45, 0xba, 0x21, 0xa3,
131    0x47, 0x9f, 0xec, 0xdf, 0x76, 0xfc, 0x69, 0xdd
132};
133static const unsigned char x25519_auth_expected_enc[] = {
134    0x23, 0xfb, 0x95, 0x25, 0x71, 0xa1, 0x4a, 0x25,
135    0xe3, 0xd6, 0x78, 0x14, 0x0c, 0xd0, 0xe5, 0xeb,
136    0x47, 0xa0, 0x96, 0x1b, 0xb1, 0x8a, 0xfc, 0xf8,
137    0x58, 0x96, 0xe5, 0x45, 0x3c, 0x31, 0x2e, 0x76
138};
139static const unsigned char x25519_auth_expected_secret[] = {
140    0x2d, 0x6d, 0xb4, 0xcf, 0x71, 0x9d, 0xc7, 0x29,
141    0x3f, 0xcb, 0xf3, 0xfa, 0x64, 0x69, 0x07, 0x08,
142    0xe4, 0x4e, 0x2b, 0xeb, 0xc8, 0x1f, 0x84, 0x60,
143    0x86, 0x77, 0x95, 0x8c, 0x0d, 0x44, 0x48, 0xa7
144};
145#endif
146
147static const unsigned char p256_ikme[] = {
148    0x42, 0x70, 0xe5, 0x4f, 0xfd, 0x08, 0xd7, 0x9d,
149    0x59, 0x28, 0x02, 0x0a, 0xf4, 0x68, 0x6d, 0x8f,
150    0x6b, 0x7d, 0x35, 0xdb, 0xe4, 0x70, 0x26, 0x5f,
151    0x1f, 0x5a, 0xa2, 0x28, 0x16, 0xce, 0x86, 0x0e
152};
153
154static const unsigned char p256_ikme_pub[] = {
155    0x04, 0xa9, 0x27, 0x19, 0xc6, 0x19, 0x5d, 0x50,
156    0x85, 0x10, 0x4f, 0x46, 0x9a, 0x8b, 0x98, 0x14,
157    0xd5, 0x83, 0x8f, 0xf7, 0x2b, 0x60, 0x50, 0x1e,
158    0x2c, 0x44, 0x66, 0xe5, 0xe6, 0x7b, 0x32, 0x5a,
159    0xc9, 0x85, 0x36, 0xd7, 0xb6, 0x1a, 0x1a, 0xf4,
160    0xb7, 0x8e, 0x5b, 0x7f, 0x95, 0x1c, 0x09, 0x00,
161    0xbe, 0x86, 0x3c, 0x40, 0x3c, 0xe6, 0x5c, 0x9b,
162    0xfc, 0xb9, 0x38, 0x26, 0x57, 0x22, 0x2d, 0x18,
163    0xc4
164};
165static const unsigned char p256_ikme_priv[] = {
166    0x49, 0x95, 0x78, 0x8e, 0xf4, 0xb9, 0xd6, 0x13,
167    0x2b, 0x24, 0x9c, 0xe5, 0x9a, 0x77, 0x28, 0x14,
168    0x93, 0xeb, 0x39, 0xaf, 0x37, 0x3d, 0x23, 0x6a,
169    0x1f, 0xe4, 0x15, 0xcb, 0x0c, 0x2d, 0x7b, 0xeb
170};
171
172static const unsigned char p256_ikmr[] = {
173    0x66, 0x8b, 0x37, 0x17, 0x1f, 0x10, 0x72, 0xf3,
174    0xcf, 0x12, 0xea, 0x8a, 0x23, 0x6a, 0x45, 0xdf,
175    0x23, 0xfc, 0x13, 0xb8, 0x2a, 0xf3, 0x60, 0x9a,
176    0xd1, 0xe3, 0x54, 0xf6, 0xef, 0x81, 0x75, 0x50
177};
178
179static const unsigned char p256_ikmr_pub[] = {
180    0x04, 0xfe, 0x8c, 0x19, 0xce, 0x09, 0x05, 0x19,
181    0x1e, 0xbc, 0x29, 0x8a, 0x92, 0x45, 0x79, 0x25,
182    0x31, 0xf2, 0x6f, 0x0c, 0xec, 0xe2, 0x46, 0x06,
183    0x39, 0xe8, 0xbc, 0x39, 0xcb, 0x7f, 0x70, 0x6a,
184    0x82, 0x6a, 0x77, 0x9b, 0x4c, 0xf9, 0x69, 0xb8,
185    0xa0, 0xe5, 0x39, 0xc7, 0xf6, 0x2f, 0xb3, 0xd3,
186    0x0a, 0xd6, 0xaa, 0x8f, 0x80, 0xe3, 0x0f, 0x1d,
187    0x12, 0x8a, 0xaf, 0xd6, 0x8a, 0x2c, 0xe7, 0x2e,
188    0xa0
189};
190
191static const unsigned char p256_ikmr_priv[] = {
192    0xf3, 0xce, 0x7f, 0xda, 0xe5, 0x7e, 0x1a, 0x31,
193    0x0d, 0x87, 0xf1, 0xeb, 0xbd, 0xe6, 0xf3, 0x28,
194    0xbe, 0x0a, 0x99, 0xcd, 0xbc, 0xad, 0xf4, 0xd6,
195    0x58, 0x9c, 0xf2, 0x9d, 0xe4, 0xb8, 0xff, 0xd2
196};
197
198static const unsigned char p256_expected_enc[] = {
199    0x04, 0xa9, 0x27, 0x19, 0xc6, 0x19, 0x5d, 0x50,
200    0x85, 0x10, 0x4f, 0x46, 0x9a, 0x8b, 0x98, 0x14,
201    0xd5, 0x83, 0x8f, 0xf7, 0x2b, 0x60, 0x50, 0x1e,
202    0x2c, 0x44, 0x66, 0xe5, 0xe6, 0x7b, 0x32, 0x5a,
203    0xc9, 0x85, 0x36, 0xd7, 0xb6, 0x1a, 0x1a, 0xf4,
204    0xb7, 0x8e, 0x5b, 0x7f, 0x95, 0x1c, 0x09, 0x00,
205    0xbe, 0x86, 0x3c, 0x40, 0x3c, 0xe6, 0x5c, 0x9b,
206    0xfc, 0xb9, 0x38, 0x26, 0x57, 0x22, 0x2d, 0x18,
207    0xc4
208};
209static const unsigned char p256_expected_secret[] = {
210    0xc0, 0xd2, 0x6a, 0xea, 0xb5, 0x36, 0x60, 0x9a,
211    0x57, 0x2b, 0x07, 0x69, 0x5d, 0x93, 0x3b, 0x58,
212    0x9d, 0xcf, 0x36, 0x3f, 0xf9, 0xd9, 0x3c, 0x93,
213    0xad, 0xea, 0x53, 0x7a, 0xea, 0xbb, 0x8c, 0xb8
214};
215
216static const unsigned char p521_ikme[] = {
217    0x7f, 0x06, 0xab, 0x82, 0x15, 0x10, 0x5f, 0xc4,
218    0x6a, 0xce, 0xeb, 0x2e, 0x3d, 0xc5, 0x02, 0x8b,
219    0x44, 0x36, 0x4f, 0x96, 0x04, 0x26, 0xeb, 0x0d,
220    0x8e, 0x40, 0x26, 0xc2, 0xf8, 0xb5, 0xd7, 0xe7,
221    0xa9, 0x86, 0x68, 0x8f, 0x15, 0x91, 0xab, 0xf5,
222    0xab, 0x75, 0x3c, 0x35, 0x7a, 0x5d, 0x6f, 0x04,
223    0x40, 0x41, 0x4b, 0x4e, 0xd4, 0xed, 0xe7, 0x13,
224    0x17, 0x77, 0x2a, 0xc9, 0x8d, 0x92, 0x39, 0xf7,
225    0x09, 0x04
226};
227
228static const unsigned char p521_ikme_pub[] = {
229    0x04, 0x01, 0x38, 0xb3, 0x85, 0xca, 0x16, 0xbb,
230    0x0d, 0x5f, 0xa0, 0xc0, 0x66, 0x5f, 0xbb, 0xd7,
231    0xe6, 0x9e, 0x3e, 0xe2, 0x9f, 0x63, 0x99, 0x1d,
232    0x3e, 0x9b, 0x5f, 0xa7, 0x40, 0xaa, 0xb8, 0x90,
233    0x0a, 0xae, 0xed, 0x46, 0xed, 0x73, 0xa4, 0x90,
234    0x55, 0x75, 0x84, 0x25, 0xa0, 0xce, 0x36, 0x50,
235    0x7c, 0x54, 0xb2, 0x9c, 0xc5, 0xb8, 0x5a, 0x5c,
236    0xee, 0x6b, 0xae, 0x0c, 0xf1, 0xc2, 0x1f, 0x27,
237    0x31, 0xec, 0xe2, 0x01, 0x3d, 0xc3, 0xfb, 0x7c,
238    0x8d, 0x21, 0x65, 0x4b, 0xb1, 0x61, 0xb4, 0x63,
239    0x96, 0x2c, 0xa1, 0x9e, 0x8c, 0x65, 0x4f, 0xf2,
240    0x4c, 0x94, 0xdd, 0x28, 0x98, 0xde, 0x12, 0x05,
241    0x1f, 0x1e, 0xd0, 0x69, 0x22, 0x37, 0xfb, 0x02,
242    0xb2, 0xf8, 0xd1, 0xdc, 0x1c, 0x73, 0xe9, 0xb3,
243    0x66, 0xb5, 0x29, 0xeb, 0x43, 0x6e, 0x98, 0xa9,
244    0x96, 0xee, 0x52, 0x2a, 0xef, 0x86, 0x3d, 0xd5,
245    0x73, 0x9d, 0x2f, 0x29, 0xb0
246};
247
248static const unsigned char p521_ikme_priv[] = {
249    0x01, 0x47, 0x84, 0xc6, 0x92, 0xda, 0x35, 0xdf,
250    0x6e, 0xcd, 0xe9, 0x8e, 0xe4, 0x3a, 0xc4, 0x25,
251    0xdb, 0xdd, 0x09, 0x69, 0xc0, 0xc7, 0x2b, 0x42,
252    0xf2, 0xe7, 0x08, 0xab, 0x9d, 0x53, 0x54, 0x15,
253    0xa8, 0x56, 0x9b, 0xda, 0xcf, 0xcc, 0x0a, 0x11,
254    0x4c, 0x85, 0xb8, 0xe3, 0xf2, 0x6a, 0xcf, 0x4d,
255    0x68, 0x11, 0x5f, 0x8c, 0x91, 0xa6, 0x61, 0x78,
256    0xcd, 0xbd, 0x03, 0xb7, 0xbc, 0xc5, 0x29, 0x1e,
257    0x37, 0x4b
258};
259
260static const unsigned char p521_ikmr_pub[] = {
261    0x04, 0x01, 0xb4, 0x54, 0x98, 0xc1, 0x71, 0x4e,
262    0x2d, 0xce, 0x16, 0x7d, 0x3c, 0xaf, 0x16, 0x2e,
263    0x45, 0xe0, 0x64, 0x2a, 0xfc, 0x7e, 0xd4, 0x35,
264    0xdf, 0x79, 0x02, 0xcc, 0xae, 0x0e, 0x84, 0xba,
265    0x0f, 0x7d, 0x37, 0x3f, 0x64, 0x6b, 0x77, 0x38,
266    0xbb, 0xbd, 0xca, 0x11, 0xed, 0x91, 0xbd, 0xea,
267    0xe3, 0xcd, 0xcb, 0xa3, 0x30, 0x1f, 0x24, 0x57,
268    0xbe, 0x45, 0x2f, 0x27, 0x1f, 0xa6, 0x83, 0x75,
269    0x80, 0xe6, 0x61, 0x01, 0x2a, 0xf4, 0x95, 0x83,
270    0xa6, 0x2e, 0x48, 0xd4, 0x4b, 0xed, 0x35, 0x0c,
271    0x71, 0x18, 0xc0, 0xd8, 0xdc, 0x86, 0x1c, 0x23,
272    0x8c, 0x72, 0xa2, 0xbd, 0xa1, 0x7f, 0x64, 0x70,
273    0x4f, 0x46, 0x4b, 0x57, 0x33, 0x8e, 0x7f, 0x40,
274    0xb6, 0x09, 0x59, 0x48, 0x0c, 0x0e, 0x58, 0xe6,
275    0x55, 0x9b, 0x19, 0x0d, 0x81, 0x66, 0x3e, 0xd8,
276    0x16, 0xe5, 0x23, 0xb6, 0xb6, 0xa4, 0x18, 0xf6,
277    0x6d, 0x24, 0x51, 0xec, 0x64
278};
279static const unsigned char p521_ikmr_priv[] = {
280    0x01, 0x46, 0x26, 0x80, 0x36, 0x9a, 0xe3, 0x75,
281    0xe4, 0xb3, 0x79, 0x10, 0x70, 0xa7, 0x45, 0x8e,
282    0xd5, 0x27, 0x84, 0x2f, 0x6a, 0x98, 0xa7, 0x9f,
283    0xf5, 0xe0, 0xd4, 0xcb, 0xde, 0x83, 0xc2, 0x71,
284    0x96, 0xa3, 0x91, 0x69, 0x56, 0x65, 0x55, 0x23,
285    0xa6, 0xa2, 0x55, 0x6a, 0x7a, 0xf6, 0x2c, 0x5c,
286    0xad, 0xab, 0xe2, 0xef, 0x9d, 0xa3, 0x76, 0x0b,
287    0xb2, 0x1e, 0x00, 0x52, 0x02, 0xf7, 0xb2, 0x46,
288    0x28, 0x47
289};
290
291static const unsigned char p521_expected_enc[] = {
292    0x04, 0x01, 0x38, 0xb3, 0x85, 0xca, 0x16, 0xbb,
293    0x0d, 0x5f, 0xa0, 0xc0, 0x66, 0x5f, 0xbb, 0xd7,
294    0xe6, 0x9e, 0x3e, 0xe2, 0x9f, 0x63, 0x99, 0x1d,
295    0x3e, 0x9b, 0x5f, 0xa7, 0x40, 0xaa, 0xb8, 0x90,
296    0x0a, 0xae, 0xed, 0x46, 0xed, 0x73, 0xa4, 0x90,
297    0x55, 0x75, 0x84, 0x25, 0xa0, 0xce, 0x36, 0x50,
298    0x7c, 0x54, 0xb2, 0x9c, 0xc5, 0xb8, 0x5a, 0x5c,
299    0xee, 0x6b, 0xae, 0x0c, 0xf1, 0xc2, 0x1f, 0x27,
300    0x31, 0xec, 0xe2, 0x01, 0x3d, 0xc3, 0xfb, 0x7c,
301    0x8d, 0x21, 0x65, 0x4b, 0xb1, 0x61, 0xb4, 0x63,
302    0x96, 0x2c, 0xa1, 0x9e, 0x8c, 0x65, 0x4f, 0xf2,
303    0x4c, 0x94, 0xdd, 0x28, 0x98, 0xde, 0x12, 0x05,
304    0x1f, 0x1e, 0xd0, 0x69, 0x22, 0x37, 0xfb, 0x02,
305    0xb2, 0xf8, 0xd1, 0xdc, 0x1c, 0x73, 0xe9, 0xb3,
306    0x66, 0xb5, 0x29, 0xeb, 0x43, 0x6e, 0x98, 0xa9,
307    0x96, 0xee, 0x52, 0x2a, 0xef, 0x86, 0x3d, 0xd5,
308    0x73, 0x9d, 0x2f, 0x29, 0xb0
309};
310static const unsigned char p521_expected_secret[] = {
311    0x77, 0x6a, 0xb4, 0x21, 0x30, 0x2f, 0x6e, 0xff,
312    0x7d, 0x7c, 0xb5, 0xcb, 0x1a, 0xda, 0xea, 0x0c,
313    0xd5, 0x08, 0x72, 0xc7, 0x1c, 0x2d, 0x63, 0xc3,
314    0x0c, 0x4f, 0x1d, 0x5e, 0x43, 0x65, 0x33, 0x36,
315    0xfe, 0xf3, 0x3b, 0x10, 0x3c, 0x67, 0xe7, 0xa9,
316    0x8a, 0xdd, 0x2d, 0x3b, 0x66, 0xe2, 0xfd, 0xa9,
317    0x5b, 0x5b, 0x2a, 0x66, 0x7a, 0xa9, 0xda, 0xc7,
318    0xe5, 0x9c, 0xc1, 0xd4, 0x6d, 0x30, 0xe8, 0x18
319};
320
321static const unsigned char p521_auth_ikme[] = {
322    0xfe, 0x1c, 0x58, 0x9c, 0x2a, 0x05, 0x89, 0x38,
323    0x95, 0xa5, 0x37, 0xf3, 0x8c, 0x7c, 0xb4, 0x30,
324    0x0b, 0x5a, 0x7e, 0x8f, 0xef, 0x3d, 0x6c, 0xcb,
325    0x8f, 0x07, 0xa4, 0x98, 0x02, 0x9c, 0x61, 0xe9,
326    0x02, 0x62, 0xe0, 0x09, 0xdc, 0x25, 0x4c, 0x7f,
327    0x62, 0x35, 0xf9, 0xc6, 0xb2, 0xfd, 0x6a, 0xef,
328    0xf0, 0xa7, 0x14, 0xdb, 0x13, 0x1b, 0x09, 0x25,
329    0x8c, 0x16, 0xe2, 0x17, 0xb7, 0xbd, 0x2a, 0xa6,
330    0x19, 0xb0
331};
332
333static const unsigned char p521_auth_ikmr_pub[] = {
334    0x04, 0x00, 0x7d, 0x41, 0x9b, 0x88, 0x34, 0xe7,
335    0x51, 0x3d, 0x0e, 0x7c, 0xc6, 0x64, 0x24, 0xa1,
336    0x36, 0xec, 0x5e, 0x11, 0x39, 0x5a, 0xb3, 0x53,
337    0xda, 0x32, 0x4e, 0x35, 0x86, 0x67, 0x3e, 0xe7,
338    0x3d, 0x53, 0xab, 0x34, 0xf3, 0x0a, 0x0b, 0x42,
339    0xa9, 0x2d, 0x05, 0x4d, 0x0d, 0xb3, 0x21, 0xb8,
340    0x0f, 0x62, 0x17, 0xe6, 0x55, 0xe3, 0x04, 0xf7,
341    0x27, 0x93, 0x76, 0x7c, 0x42, 0x31, 0x78, 0x5c,
342    0x4a, 0x4a, 0x6e, 0x00, 0x8f, 0x31, 0xb9, 0x3b,
343    0x7a, 0x4f, 0x2b, 0x8c, 0xd1, 0x2e, 0x5f, 0xe5,
344    0xa0, 0x52, 0x3d, 0xc7, 0x13, 0x53, 0xc6, 0x6c,
345    0xbd, 0xad, 0x51, 0xc8, 0x6b, 0x9e, 0x0b, 0xdf,
346    0xcd, 0x9a, 0x45, 0x69, 0x8f, 0x2d, 0xab, 0x18,
347    0x09, 0xab, 0x1b, 0x0f, 0x88, 0xf5, 0x42, 0x27,
348    0x23, 0x2c, 0x85, 0x8a, 0xcc, 0xc4, 0x4d, 0x9a,
349    0x8d, 0x41, 0x77, 0x5a, 0xc0, 0x26, 0x34, 0x15,
350    0x64, 0xa2, 0xd7, 0x49, 0xf4
351};
352
353static const unsigned char p521_auth_ikmr_priv[] = {
354    0x01, 0x3e, 0xf3, 0x26, 0x94, 0x09, 0x98, 0x54,
355    0x4a, 0x89, 0x9e, 0x15, 0xe1, 0x72, 0x65, 0x48,
356    0xff, 0x43, 0xbb, 0xdb, 0x23, 0xa8, 0x58, 0x7a,
357    0xa3, 0xbe, 0xf9, 0xd1, 0xb8, 0x57, 0x33, 0x8d,
358    0x87, 0x28, 0x7d, 0xf5, 0x66, 0x70, 0x37, 0xb5,
359    0x19, 0xd6, 0xa1, 0x46, 0x61, 0xe9, 0x50, 0x3c,
360    0xfc, 0x95, 0xa1, 0x54, 0xd9, 0x35, 0x66, 0xd8,
361    0xc8, 0x4e, 0x95, 0xce, 0x93, 0xad, 0x05, 0x29,
362    0x3a, 0x0b
363};
364
365static const unsigned char p521_auth_ikms_pub[] = {
366    0x04, 0x01, 0x5c, 0xc3, 0x63, 0x66, 0x32, 0xea,
367    0x9a, 0x38, 0x79, 0xe4, 0x32, 0x40, 0xbe, 0xae,
368    0x5d, 0x15, 0xa4, 0x4f, 0xba, 0x81, 0x92, 0x82,
369    0xfa, 0xc2, 0x6a, 0x19, 0xc9, 0x89, 0xfa, 0xfd,
370    0xd0, 0xf3, 0x30, 0xb8, 0x52, 0x1d, 0xff, 0x7d,
371    0xc3, 0x93, 0x10, 0x1b, 0x01, 0x8c, 0x1e, 0x65,
372    0xb0, 0x7b, 0xe9, 0xf5, 0xfc, 0x9a, 0x28, 0xa1,
373    0xf4, 0x50, 0xd6, 0xa5, 0x41, 0xee, 0x0d, 0x76,
374    0x22, 0x11, 0x33, 0x00, 0x1e, 0x8f, 0x0f, 0x6a,
375    0x05, 0xab, 0x79, 0xf9, 0xb9, 0xbb, 0x9c, 0xcc,
376    0xe1, 0x42, 0xa4, 0x53, 0xd5, 0x9c, 0x5a, 0xbe,
377    0xbb, 0x56, 0x74, 0x83, 0x9d, 0x93, 0x5a, 0x3c,
378    0xa1, 0xa3, 0xfb, 0xc3, 0x28, 0x53, 0x9a, 0x60,
379    0xb3, 0xbc, 0x3c, 0x05, 0xfe, 0xd2, 0x28, 0x38,
380    0x58, 0x4a, 0x72, 0x6b, 0x9c, 0x17, 0x67, 0x96,
381    0xca, 0xd0, 0x16, 0x9b, 0xa4, 0x09, 0x33, 0x32,
382    0xcb, 0xd2, 0xdc, 0x3a, 0x9f
383};
384
385static const unsigned char p521_auth_ikms_priv[] = {
386    0x00, 0x10, 0x18, 0x58, 0x45, 0x99, 0x62, 0x5f,
387    0xf9, 0x95, 0x3b, 0x93, 0x05, 0x84, 0x98, 0x50,
388    0xd5, 0xe3, 0x4b, 0xd7, 0x89, 0xd4, 0xb8, 0x11,
389    0x01, 0x13, 0x96, 0x62, 0xfb, 0xea, 0x8b, 0x65,
390    0x08, 0xdd, 0xb9, 0xd0, 0x19, 0xb0, 0xd6, 0x92,
391    0xe7, 0x37, 0xf6, 0x6b, 0xea, 0xe3, 0xf1, 0xf7,
392    0x83, 0xe7, 0x44, 0x20, 0x2a, 0xaf, 0x6f, 0xea,
393    0x01, 0x50, 0x6c, 0x27, 0x28, 0x7e, 0x35, 0x9f,
394    0xe7, 0x76
395};
396
397static const unsigned char p521_auth_expected_enc[] = {
398    0x04, 0x01, 0x7d, 0xe1, 0x2e, 0xde, 0x7f, 0x72,
399    0xcb, 0x10, 0x1d, 0xab, 0x36, 0xa1, 0x11, 0x26,
400    0x5c, 0x97, 0xb3, 0x65, 0x48, 0x16, 0xdc, 0xd6,
401    0x18, 0x3f, 0x80, 0x9d, 0x4b, 0x3d, 0x11, 0x1f,
402    0xe7, 0x59, 0x49, 0x7f, 0x8a, 0xef, 0xdc, 0x5d,
403    0xbb, 0x40, 0xd3, 0xe6, 0xd2, 0x1d, 0xb1, 0x5b,
404    0xdc, 0x60, 0xf1, 0x5f, 0x2a, 0x42, 0x07, 0x61,
405    0xbc, 0xae, 0xef, 0x73, 0xb8, 0x91, 0xc2, 0xb1,
406    0x17, 0xe9, 0xcf, 0x01, 0xe2, 0x93, 0x20, 0xb7,
407    0x99, 0xbb, 0xc8, 0x6a, 0xfd, 0xc5, 0xea, 0x97,
408    0xd9, 0x41, 0xea, 0x1c, 0x5b, 0xd5, 0xeb, 0xee,
409    0xac, 0x7a, 0x78, 0x4b, 0x3b, 0xab, 0x52, 0x47,
410    0x46, 0xf3, 0xe6, 0x40, 0xec, 0x26, 0xee, 0x1b,
411    0xd9, 0x12, 0x55, 0xf9, 0x33, 0x0d, 0x97, 0x4f,
412    0x84, 0x50, 0x84, 0x63, 0x7e, 0xe0, 0xe6, 0xfe,
413    0x9f, 0x50, 0x5c, 0x5b, 0x87, 0xc8, 0x6a, 0x4e,
414    0x1a, 0x6c, 0x30, 0x96, 0xdd
415};
416
417static const unsigned char p521_auth_expected_secret[] = {
418    0x26, 0x64, 0x8f, 0xa2, 0xa2, 0xde, 0xb0, 0xbf,
419    0xc5, 0x63, 0x49, 0xa5, 0x90, 0xfd, 0x4c, 0xb7,
420    0x10, 0x8a, 0x51, 0x79, 0x7b, 0x63, 0x46, 0x94,
421    0xfc, 0x02, 0x06, 0x1e, 0x8d, 0x91, 0xb3, 0x57,
422    0x6a, 0xc7, 0x36, 0xa6, 0x8b, 0xf8, 0x48, 0xfe,
423    0x2a, 0x58, 0xdf, 0xb1, 0x95, 0x6d, 0x26, 0x6e,
424    0x68, 0x20, 0x9a, 0x4d, 0x63, 0x1e, 0x51, 0x3b,
425    0xad, 0xf8, 0xf4, 0xdc, 0xfc, 0x00, 0xf3, 0x0a
426};
427
428static const TEST_DERIVEKEY_DATA ec_derivekey_data[] = {
429    {
430      "P-256",
431      p256_ikme, sizeof(p256_ikme),
432      p256_ikme_pub, sizeof(p256_ikme_pub),
433      p256_ikme_priv, sizeof(p256_ikme_priv)
434    },
435    {
436      "P-256",
437      p256_ikmr, sizeof(p256_ikmr),
438      p256_ikmr_pub, sizeof(p256_ikmr_pub),
439      p256_ikmr_priv, sizeof(p256_ikmr_priv)
440    },
441    {
442      "P-521",
443      p521_ikme, sizeof(p521_ikme),
444      p521_ikme_pub, sizeof(p521_ikme_pub),
445      p521_ikme_priv, sizeof(p521_ikme_priv)
446    }
447};
448
449static const TEST_ENCAPDATA ec_encapdata[] = {
450    {
451        "P-256",
452        p256_ikme, sizeof(p256_ikme),
453        p256_ikmr_pub, sizeof(p256_ikmr_pub),
454        p256_ikmr_priv, sizeof(p256_ikmr_priv),
455        p256_expected_enc, sizeof(p256_expected_enc),
456        p256_expected_secret, sizeof(p256_expected_secret),
457    },
458#ifndef OPENSSL_NO_ECX
459    {
460        "X25519",
461        x25519_ikme, sizeof(x25519_ikme),
462        x25519_rpub, sizeof(x25519_rpub),
463        x25519_rpriv, sizeof(x25519_rpriv),
464        x25519_expected_enc, sizeof(x25519_expected_enc),
465        x25519_expected_secret, sizeof(x25519_expected_secret),
466    },
467#endif
468    {
469        "P-521",
470        p521_ikme, sizeof(p521_ikme),
471        p521_ikmr_pub, sizeof(p521_ikmr_pub),
472        p521_ikmr_priv, sizeof(p521_ikmr_priv),
473        p521_expected_enc, sizeof(p521_expected_enc),
474        p521_expected_secret, sizeof(p521_expected_secret),
475    },
476    {
477        "P-521",
478        p521_auth_ikme, sizeof(p521_auth_ikme),
479        p521_auth_ikmr_pub, sizeof(p521_auth_ikmr_pub),
480        p521_auth_ikmr_priv, sizeof(p521_auth_ikmr_priv),
481        p521_auth_expected_enc, sizeof(p521_auth_expected_enc),
482        p521_auth_expected_secret, sizeof(p521_auth_expected_secret),
483        p521_auth_ikms_pub, sizeof(p521_auth_ikms_pub),
484        p521_auth_ikms_priv, sizeof(p521_auth_ikms_priv)
485    },
486#ifndef OPENSSL_NO_ECX
487    {
488        "X25519",
489        x25519_auth_ikme, sizeof(x25519_auth_ikme),
490        x25519_auth_rpub, sizeof(x25519_auth_rpub),
491        x25519_auth_rpriv, sizeof(x25519_auth_rpriv),
492        x25519_auth_expected_enc, sizeof(x25519_auth_expected_enc),
493        x25519_auth_expected_secret, sizeof(x25519_auth_expected_secret),
494        x25519_auth_spub, sizeof(x25519_auth_spub),
495        x25519_auth_spriv, sizeof(x25519_auth_spriv)
496    }
497#endif
498};
499
500/* Test vector from https://github.com/cfrg/draft-irtf-cfrg-hpke */
501#ifndef OPENSSL_NO_ECX
502static const unsigned char x448_ikmr[] = {
503    0xd4, 0x5d, 0x16, 0x52, 0xdf, 0x74, 0x92, 0x0a,
504    0xbf, 0x94, 0xa2, 0x88, 0x3c, 0x83, 0x05, 0x0f,
505    0x50, 0x2f, 0xf5, 0x12, 0xff, 0xb5, 0x6f, 0x07,
506    0xb6, 0xd8, 0x33, 0xec, 0x8d, 0xda, 0x74, 0xb6,
507    0xa1, 0xc1, 0xcc, 0x4d, 0x42, 0xa2, 0x26, 0x41,
508    0xc0, 0x96, 0x3d, 0x3c, 0x21, 0xed, 0x82, 0x61,
509    0xf3, 0x44, 0xdc, 0x9e, 0x05, 0x01, 0xa8, 0x1c
510};
511static const unsigned char x448_ikmr_priv[] = {
512    0x27, 0xa4, 0x35, 0x46, 0x08, 0xf3, 0xbd, 0xd3,
513    0x8f, 0x1f, 0x5a, 0xf3, 0x05, 0xf3, 0xe0, 0x68,
514    0x2e, 0xfe, 0x4e, 0x25, 0x80, 0x82, 0x49, 0xd8,
515    0xfc, 0xb5, 0x59, 0x27, 0xf6, 0xa9, 0xf4, 0x46,
516    0xb8, 0xdc, 0x1d, 0x0a, 0x2c, 0x3b, 0x8c, 0xb1,
517    0x33, 0xa5, 0x67, 0x3b, 0x59, 0xa6, 0xd5, 0x5c,
518    0xe7, 0x54, 0xec, 0x0c, 0x9a, 0x55, 0x54, 0x01
519};
520static const unsigned char x448_ikmr_pub[] = {
521    0x14, 0x5d, 0x08, 0x3e, 0xa7, 0xa6, 0x37, 0x9d,
522    0xbb, 0x32, 0xdc, 0xbd, 0x8a, 0xff, 0x4c, 0x20,
523    0x6e, 0xa5, 0xd0, 0x69, 0xb7, 0x5e, 0x96, 0xc6,
524    0xdd, 0x2a, 0x3e, 0x38, 0xf4, 0x41, 0x47, 0x1a,
525    0xc9, 0x7a, 0xdc, 0xa6, 0x41, 0xfd, 0xad, 0x66,
526    0x68, 0x5a, 0x96, 0xf3, 0x2b, 0x7c, 0x3e, 0x06,
527    0x46, 0x35, 0xfa, 0xb3, 0xcc, 0x89, 0x23, 0x4e
528};
529
530static const TEST_DERIVEKEY_DATA ecx_derivekey_data[] = {
531    {
532      "X25519",
533      x25519_ikme, sizeof(x25519_ikme),
534      x25519_ikme_pub, sizeof(x25519_ikme_pub),
535      x25519_ikme_priv, sizeof(x25519_ikme_priv)
536    },
537    {
538      "X448",
539      x448_ikmr, sizeof(x448_ikmr),
540      x448_ikmr_pub, sizeof(x448_ikmr_pub),
541      x448_ikmr_priv, sizeof(x448_ikmr_priv)
542    },
543};
544#endif
545
546/*
547 * Helper function to create a EC or ECX private key from bytes.
548 * The public key can optionally be NULL.
549 */
550static EVP_PKEY *new_raw_private_key(const char *curvename,
551                                     const unsigned char *priv, size_t privlen,
552                                     const unsigned char *pub, size_t publen)
553{
554    int ok = 0;
555    EVP_PKEY_CTX *ctx;
556    EVP_PKEY *key = NULL;
557    OSSL_PARAM *params = NULL;
558    BIGNUM *privbn = NULL;
559    OSSL_PARAM_BLD *bld = NULL;
560    int ecx = (curvename[0] == 'X');
561
562    if (ecx)
563        ctx = EVP_PKEY_CTX_new_from_name(libctx, curvename, NULL);
564    else
565        ctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", NULL);
566    if (ctx == NULL)
567        return 0;
568
569    bld = OSSL_PARAM_BLD_new();
570    if (bld == NULL)
571        goto err;
572
573    if (ecx) {
574        if (!OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PRIV_KEY,
575                                             (char *)priv, privlen))
576            goto err;
577    } else {
578        privbn = BN_bin2bn(priv, privlen, NULL);
579        if (privbn == NULL)
580            goto err;
581        if (!OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_PKEY_PARAM_GROUP_NAME,
582                                             curvename, 0))
583            goto err;
584        if (!OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, privbn))
585            goto err;
586    }
587
588    if (pub != NULL) {
589        if (!OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY,
590                                             (char *)pub, publen))
591            goto err;
592    }
593    params = OSSL_PARAM_BLD_to_param(bld);
594    if (params == NULL)
595        goto err;
596
597    if (EVP_PKEY_fromdata_init(ctx) <= 0)
598          goto err;
599    if (EVP_PKEY_fromdata(ctx, &key, EVP_PKEY_KEYPAIR, params) <= 0)
600          goto err;
601    ok = 1;
602err:
603    if (!ok) {
604        EVP_PKEY_free(key);
605        key = NULL;
606    }
607    BN_free(privbn);
608    OSSL_PARAM_free(params);
609    OSSL_PARAM_BLD_free(bld);
610    EVP_PKEY_CTX_free(ctx);
611    return key;
612}
613
614static EVP_PKEY *new_raw_public_key(const char *curvename,
615                                    const unsigned char *pub, size_t publen)
616{
617    int ok = 0;
618    EVP_PKEY_CTX *ctx;
619    EVP_PKEY *key = NULL;
620    OSSL_PARAM params[3], *p = params;
621    int ecx = (curvename[0] == 'X');
622
623    if (ecx)
624        ctx = EVP_PKEY_CTX_new_from_name(libctx, curvename, NULL);
625    else
626        ctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", NULL);
627    if (ctx == NULL)
628        return 0;
629
630    if (!ecx)
631        *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
632                                                (char *)curvename, 0);
633    *p++ = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PUB_KEY,
634                                             (char *)pub, publen);
635    *p = OSSL_PARAM_construct_end();
636    if (EVP_PKEY_fromdata_init(ctx) <= 0)
637          goto err;
638    if (EVP_PKEY_fromdata(ctx, &key, EVP_PKEY_PUBLIC_KEY, params) <= 0)
639          goto err;
640    ok = 1;
641err:
642    if (!ok) {
643        EVP_PKEY_free(key);
644        key = NULL;
645    }
646    EVP_PKEY_CTX_free(ctx);
647    return key;
648}
649
650/* Helper function to perform encapsulation */
651static int do_encap(const TEST_ENCAPDATA *t, EVP_PKEY *rpub, EVP_PKEY *spriv)
652{
653    int ret = 0;
654    unsigned char secret[256] = { 0, };
655    unsigned char enc[256] = { 0, };
656    size_t secretlen = 0, enclen = 0;
657    EVP_PKEY_CTX *sctx = NULL;
658    OSSL_PARAM params[3], *p = params;
659
660    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KEM_PARAM_OPERATION,
661                                            (char *)OSSL_KEM_PARAM_OPERATION_DHKEM,
662                                            0);
663    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KEM_PARAM_IKME,
664                                             (char *)t->ikmE, t->ikmElen);
665    *p = OSSL_PARAM_construct_end();
666
667    if (!TEST_ptr(sctx = EVP_PKEY_CTX_new_from_pkey(libctx, rpub, NULL)))
668        goto err;
669    if (t->spriv == NULL) {
670        if (!TEST_int_eq(EVP_PKEY_encapsulate_init(sctx, params), 1))
671            goto err;
672    } else {
673        if (!TEST_int_eq(EVP_PKEY_auth_encapsulate_init(sctx, spriv, params), 1))
674        goto err;
675    }
676    ret = TEST_int_eq(EVP_PKEY_encapsulate(sctx, NULL, &enclen, NULL,
677                                              &secretlen), 1)
678          && TEST_int_eq(EVP_PKEY_encapsulate(sctx, enc, &enclen, secret,
679                                              &secretlen), 1)
680          && TEST_mem_eq(enc, enclen, t->expected_enc, t->expected_enclen)
681          && TEST_mem_eq(secret, secretlen,
682                         t->expected_secret, t->expected_secretlen);
683err:
684    EVP_PKEY_CTX_free(sctx);
685    return ret;
686}
687
688/* Helper function to perform decapsulation */
689static int do_decap(const TEST_ENCAPDATA *t, EVP_PKEY *rpriv, EVP_PKEY *spub)
690{
691    int ret = 0;
692    EVP_PKEY_CTX *recipctx = NULL;
693    unsigned char secret[256] = { 0, };
694    size_t secretlen = 0;
695
696    if (!TEST_ptr(recipctx = EVP_PKEY_CTX_new_from_pkey(libctx, rpriv, NULL)))
697        goto err;
698    if (t->spub == NULL) {
699        if (!TEST_int_eq(EVP_PKEY_decapsulate_init(recipctx, opparam), 1))
700            goto err;
701    } else {
702        if (!TEST_int_eq(EVP_PKEY_auth_decapsulate_init(recipctx, spub,
703                                                        opparam), 1))
704            goto err;
705    }
706    ret = TEST_int_eq(EVP_PKEY_decapsulate(recipctx, NULL, &secretlen,
707                                              t->expected_enc,
708                                              t->expected_enclen), 1)
709          && TEST_int_eq(EVP_PKEY_decapsulate(recipctx, secret, &secretlen,
710                                              t->expected_enc,
711                                              t->expected_enclen), 1)
712          && TEST_mem_eq(secret, secretlen,
713                         t->expected_secret, t->expected_secretlen);
714err:
715    EVP_PKEY_CTX_free(recipctx);
716    return ret;
717}
718