27456950099

Committed 12 Jun 2026 07:59PM UTC coverage: 89.424% (+0.05%) from 89.378%

Build # 27456950099

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #5663 from randombit/jack/dns-uri-ip-fixes

Bugfixes and enhancements for DNSName, URI, IPv4Address, IPv6Address

Coverage Stats

111165 of 124312 relevant lines covered (89.42%)

10989620.56 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.6

/src/tests/test_hss_lms.cpp

/*
* (C) 2023 Jack Lloyd
*     2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include "tests.h"

#if defined(BOTAN_HAS_HSS_LMS)
   #include "test_arb_eq.h"
   #include "test_pubkey.h"
   #include <botan/asn1_obj.h>
   #include <botan/hss_lms.h>
   #include <botan/pk_algs.h>
   #include <botan/pubkey.h>
   #include <botan/internal/fmt.h>
   #include <botan/internal/hss.h>
   #include <botan/internal/loadstor.h>
   #include <limits>

namespace Botan_Tests {

namespace {

/**
 * @brief Test the correct parsing of HSS-LMS parameters
 */
std::vector<Test::Result> test_hss_lms_params_parsing() {
   return {
      CHECK("HSS Parameter Parsing",
            [&](Test::Result& result) {
               result.test_no_throw("no throw", [&] {
                  const Botan::HSS_LMS_Params hss_params("SHA-256,HW(5,1),HW(25,8)");

                  test_arb_eq(result, "hss levels", hss_params.L(), Botan::HSS_Level(2));
                  const auto& top_lms_params = hss_params.params_at_level(Botan::HSS_Level(0));
                  result.test_str_eq("hash name", top_lms_params.lms_params().hash_name(), std::string("SHA-256"));
                  result.test_enum_eq("top level - lms type",
                                      top_lms_params.lms_params().algorithm_type(),
                                      Botan::LMS_Algorithm_Type::SHA256_M32_H5);
                  result.test_enum_eq("top level - ots type",
                                      top_lms_params.lmots_params().algorithm_type(),
                                      Botan::LMOTS_Algorithm_Type::SHA256_N32_W1);

                  const auto& second_lms_params = hss_params.params_at_level(Botan::HSS_Level(1));
                  result.test_enum_eq("2nd level - lms type",
                                      second_lms_params.lms_params().algorithm_type(),
                                      Botan::LMS_Algorithm_Type::SHA256_M32_H25);
                  result.test_enum_eq("2nd level - ots type",
                                      second_lms_params.lmots_params().algorithm_type(),
                                      Botan::LMOTS_Algorithm_Type::SHA256_N32_W8);
               });
            }),

   };
}

/**
 * @brief Test signature generation using the raw private key bytes
 */
class HSS_LMS_Signature_Generation_Test final : public PK_Signature_Generation_Test {
   public:
      HSS_LMS_Signature_Generation_Test() :
            PK_Signature_Generation_Test("HSS-LMS", "pubkey/hss_lms_sig.vec", "Msg,PrivateKey,Signature") {}

      std::string default_padding(const VarMap& /*vars*/) const final { return ""; }

      std::unique_ptr<Botan::Private_Key> load_private_key(const VarMap& vars) final {
         const auto sk_bytes = vars.get_req_bin("PrivateKey");
         return std::make_unique<Botan::HSS_LMS_PrivateKey>(Botan::AlgorithmIdentifier(), sk_bytes);
      }
};

/**
 * @brief Test signature verification using the raw public key bytes
 */
class HSS_LMS_Signature_Verify_Tests final : public PK_Signature_Verification_Test {
   public:
      HSS_LMS_Signature_Verify_Tests() :
            PK_Signature_Verification_Test("HSS-LMS", "pubkey/hss_lms_verify.vec", "Msg,PublicKey,Signature") {}

      std::string default_padding(const VarMap& /*vars*/) const final { return ""; }

      std::unique_ptr<Botan::Public_Key> load_public_key(const VarMap& vars) override {
         const std::vector<uint8_t> pk_bytes = vars.get_req_bin("PublicKey");
         return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), pk_bytes);
      }
};

/**
 * @brief Test the correct revocation of invalid signatures
 */
class HSS_LMS_Signature_Verify_Invalid_Tests final : public PK_Signature_NonVerification_Test {
   public:
      HSS_LMS_Signature_Verify_Invalid_Tests() :
            PK_Signature_NonVerification_Test(
               "HSS_LMS", "pubkey/hss_lms_invalid.vec", "Msg,PublicKey,InvalidSignature") {}

      std::string default_padding(const VarMap& /*vars*/) const override { return ""; }

      std::unique_ptr<Botan::Public_Key> load_public_key(const VarMap& vars) override {
         const std::vector<uint8_t> raw_key = vars.get_req_bin("PublicKey");
         return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), raw_key);
      }
};

/**
 * @brief Test HSS-LMS public key creation
 */
class HSS_LMS_Key_Generation_Test final : public PK_Key_Generation_Test {
   public:
      std::vector<std::string> keygen_params() const final { return {"SHA-256,HW(10,4),HW(5,8)"}; }

      std::string algo_name() const final { return "HSS-LMS"; }

      std::unique_ptr<Botan::Public_Key> public_key_from_raw(std::string_view /* keygen_params */,
                                                             std::string_view /* provider */,
                                                             std::span<const uint8_t> raw_pk) const override {
         return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), raw_pk);
      }
};

/**
 * @brief Test that for manipulated signatures and too short signatures, private keys, and public keys a DecodeError occurs.
 */
class HSS_LMS_Negative_Tests final : public Test {
      Test::Result test_flipped_signature_bits() {
         Test::Result result("HSS-LMS - flipped signature bits");

         auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");

         Botan::PK_Signer signer(*sk, Test::rng(), "");
         Botan::PK_Verifier verifier(*sk, "");

         std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};

         signer.update(mes);
         auto valid_sig = signer.signature(Test::rng());
         verifier.update(mes);
         result.test_is_true("Entire signature is valid", verifier.check_signature(valid_sig));
         for(size_t idx = 0; idx < valid_sig.size(); ++idx) {
            auto bad_sig = valid_sig;
            bad_sig.at(idx) ^= 0x80;
            result.test_no_throw(Botan::fmt("Verification does not throw (byte idx {})", idx), [&]() {
               verifier.update(mes);
               const bool valid = verifier.check_signature(bad_sig);
               result.test_is_true(Botan::fmt("Manipulated signature is invalid (byte idx {})", idx), !valid);
            });
         }

         return result;
      }

      Test::Result test_too_short_signature() {
         Test::Result result("HSS-LMS");

         auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");

         Botan::PK_Signer signer(*sk, Test::rng(), "");
         Botan::PK_Verifier verifier(*sk, "");

         std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};

         signer.update(mes);
         auto valid_sig = signer.signature(Test::rng());
         verifier.update(mes);
         result.test_is_true("Entire signature is valid", verifier.check_signature(valid_sig));
         for(size_t n = 0; n < valid_sig.size(); ++n) {
            result.test_no_throw("Verification does not throw", [&]() {
               verifier.update(mes);
               const bool valid = verifier.check_signature(valid_sig.data(), n);
               result.test_is_true("Too short signature is invalid", !valid);
            });
         }

         return result;
      }

      Test::Result test_too_short_private_key() {
         Test::Result result("HSS-LMS");

         // HSS_LMS_PublicKey::key_length()
         auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");

         auto sk_bytes = sk->private_key_bits();
         result.test_no_throw("Entire private key valid", [&]() {
            const Botan::HSS_LMS_PrivateKey key(sk_bytes);
            BOTAN_UNUSED(key);
         });
         for(size_t n = 0; n < sk_bytes.size(); ++n) {
            result.test_throws<Botan::Decoding_Error>("Partial private key invalid", [&]() {
               const std::span<const uint8_t> partial_key = {sk_bytes.data(), n};
               const Botan::HSS_LMS_PrivateKey key(partial_key);
               BOTAN_UNUSED(key);
            });
         }
         return result;
      }

      Test::Result test_too_short_public_key() {
         Test::Result result("HSS-LMS");

         // HSS_LMS_PublicKey::key_length()
         auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");

         auto sk_bytes = sk->public_key_bits();
         result.test_no_throw("Entire public key valid", [&]() {
            const Botan::HSS_LMS_PublicKey key(sk_bytes);
            BOTAN_UNUSED(key);
         });
         for(size_t n = 0; n < sk_bytes.size(); ++n) {
            result.test_throws<Botan::Decoding_Error>("Partial public key invalid", [&]() {
               const std::span<const uint8_t> partial_key = {sk_bytes.data(), n};
               const Botan::HSS_LMS_PublicKey key(partial_key);
               BOTAN_UNUSED(key);
            });
         }
         return result;
      }

      std::vector<Test::Result> run() final {
         return {test_flipped_signature_bits(),
                 test_too_short_signature(),
                 test_too_short_private_key(),
                 test_too_short_public_key()};
      }
};

/**
 * @brief Test the correct handling of the HSS-LMS private key's state.
 */
class HSS_LMS_Statefulness_Test final : public Test {
      Botan::HSS_LMS_PrivateKey create_private_key_with_idx(uint64_t idx) {
         auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");
         auto bytes = sk.private_key_bits();
         // The index is store after the level (uint32_t)
         Botan::store_be(idx, bytes.data() + sizeof(uint32_t));
         return Botan::HSS_LMS_PrivateKey(Botan::AlgorithmIdentifier(), bytes);
      }

      Test::Result test_sig_changes_state() {
         Test::Result result("HSS-LMS");

         auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8),HW(5,8)");
         Botan::PK_Signer signer(sk, Test::rng(), "");
         std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};
         auto sk_bytes_begin = sk.private_key_bits();

         // Tree heights: 5,5 => 2^(5+5) = 1024 signatures available
         const uint64_t expected_total = 1024;
         result.test_opt_u64_eq(
            "Fresh key starts with total number of remaining signatures.", sk.remaining_operations(), expected_total);

         // Creating a signature should update the private key's state
         auto sig_0 = signer.sign_message(mes, Test::rng());
         result.test_is_true(
            "First signature uses index 0.",
            Botan::HSS_Signature::from_bytes_or_throw(sig_0).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(0));

         auto sk_bytes_after_sig = sk.private_key_bits();

         result.test_opt_u64_eq(
            "Signature decreases number of remaining signatures.", sk.remaining_operations(), expected_total - 1);
         result.test_bin_ne("Signature updates private key.", sk_bytes_after_sig, sk_bytes_begin);

         auto sig_1 = signer.sign_message(mes, Test::rng());
         result.test_is_true(
            "Next signature uses the new index.",
            Botan::HSS_Signature::from_bytes_or_throw(sig_1).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(1));

         return result;
      }

      Test::Result test_max_sig_count() {
         Test::Result result("HSS-LMS");

         const uint64_t total_sig_count = 32;
         auto sk = create_private_key_with_idx(total_sig_count - 1);

         Botan::PK_Signer signer(sk, Test::rng(), "");
         std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};
         auto sk_bytes_begin = sk.private_key_bits();

         result.test_opt_u64_eq("One remaining signature.", sk.remaining_operations(), 1);
         result.test_no_throw("Use last signature index.", [&]() { signer.sign_message(mes, Test::rng()); });
         result.test_opt_u64_eq("No remaining signatures.", sk.remaining_operations(), 0);
         result.test_throws("Cannot sign with exhausted key.", [&]() { signer.sign_message(mes, Test::rng()); });
         result.test_opt_u64_eq("Still zero remaining signatures.", sk.remaining_operations(), 0);

         return result;
      }

      Test::Result test_idx_bound_checked_on_load() {
         Test::Result result("HSS-LMS");

         // create_private_key_with_idx uses a single HW(5,8) layer, so the
         // maximum signature count is 32
         result.test_no_throw("Index == max_sig_count is accepted on load", [&]() {
            auto sk = create_private_key_with_idx(32);
            result.test_opt_u64_eq("Exhausted key loads with no remaining signatures", sk.remaining_operations(), 0);
            Botan::PK_Signer signer(sk, Test::rng(), "");
            const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};
            result.test_throws("Cannot sign with exhausted key", [&]() { signer.sign_message(mes, Test::rng()); });
         });

         result.test_throws<Botan::Decoding_Error>("Index > max_sig_count is rejected on load",
                                                   [&]() { create_private_key_with_idx(33); });

         result.test_throws<Botan::Decoding_Error>("Huge index is rejected on load", [&]() {
            create_private_key_with_idx(std::numeric_limits<uint64_t>::max());
         });

         return result;
      }

      Test::Result test_exhausted_key_stays_exhausted() {
         Test::Result result("HSS-LMS");

         // With a total tree height >= 64 the maximum signature count is
         // clamped to 2^64 - 1, so an index of 2^64 - 1 is accepted on load
         auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8),HW(25,8),HW(25,8),HW(25,8)");
         auto bytes = sk.private_key_bits();
         Botan::store_be(std::numeric_limits<uint64_t>::max(), bytes.data() + sizeof(uint32_t));

         auto exhausted_sk = Botan::HSS_LMS_PrivateKey(Botan::AlgorithmIdentifier(), bytes);
         result.test_opt_u64_eq("Exhausted key has no remaining signatures", exhausted_sk.remaining_operations(), 0);

         Botan::PK_Signer signer(exhausted_sk, Test::rng(), "");
         const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};

         // A failed signing attempt must not wrap the index back to zero
         result.test_throws("Cannot sign with exhausted key", [&]() { signer.sign_message(mes, Test::rng()); });
         result.test_opt_u64_eq("Failed signing does not reset the state", exhausted_sk.remaining_operations(), 0);
         result.test_throws("Exhausted key stays exhausted", [&]() { signer.sign_message(mes, Test::rng()); });

         return result;
      }

      Test::Result test_params_are_part_of_key_identity() {
         Test::Result result("HSS-LMS");

         const auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");
         auto bytes = sk.private_key_bits();

         // Patch the LMOTS algorithm type from SHA256_N24_W8 (0x08) to
         // SHA256_N24_W4 (0x07), pretending the same seed and identifier
         // belong to a key with a different Winternitz parameter
         result.require("LMOTS type byte has expected value", bytes[19] == 0x08);
         bytes[19] = 0x07;

         // The index registry tracks the same key material under different
         // parameter sets independently. Nothing can prevent such (insecurely)
         // related keys from issuing overlapping one time signatures.
         const Botan::HSS_LMS_PrivateKey patched(Botan::AlgorithmIdentifier(), bytes);

         Botan::PK_Signer signer(sk, Test::rng(), "");
         const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};
         signer.sign_message(mes, Test::rng());

         result.test_opt_u64_eq("Original key consumed an index", sk.remaining_operations(), 31);
         result.test_opt_u64_eq(
            "Key with the same material but other params is unaffected", patched.remaining_operations(), 32);

         return result;
      }

      Test::Result test_separately_loaded_copies_share_state() {
         Test::Result result("HSS-LMS");

         const auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");
         const auto sk_bytes = sk.private_key_bits();

         const Botan::HSS_LMS_PrivateKey copy1(Botan::AlgorithmIdentifier(), sk_bytes);
         const Botan::HSS_LMS_PrivateKey copy2(Botan::AlgorithmIdentifier(), sk_bytes);

         const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};

         Botan::PK_Signer signer1(copy1, Test::rng(), "");
         const auto sig_0 = signer1.sign_message(mes, Test::rng());

         result.test_opt_u64_eq("Signing with one copy is seen by the other", copy2.remaining_operations(), 31);

         Botan::PK_Signer signer2(copy2, Test::rng(), "");
         const auto sig_1 = signer2.sign_message(mes, Test::rng());

         result.test_is_true(
            "First signature uses index 0",
            Botan::HSS_Signature::from_bytes_or_throw(sig_0).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(0));
         result.test_is_true(
            "Second signature uses index 1",
            Botan::HSS_Signature::from_bytes_or_throw(sig_1).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(1));

         return result;
      }

      std::vector<Test::Result> run() final {
         return {test_sig_changes_state(),
                 test_max_sig_count(),
                 test_idx_bound_checked_on_load(),
                 test_exhausted_key_stays_exhausted(),
                 test_params_are_part_of_key_identity(),
                 test_separately_loaded_copies_share_state()};
      }
};

/**
 * @brief Test APIs not covered by other tests.
 */
class HSS_LMS_Missing_API_Test final : public Test {
      std::vector<Test::Result> run() final {
         Test::Result result("HSS-LMS");

         // HSS_LMS_PublicKey::key_length()
         auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "SHA-256,HW(10,4)");
         sk->key_length();
         result.test_sz_gt("Public key length must be greater than the simply type information plus I",
                           sk->key_length(),
                           3 * sizeof(uint32_t) + Botan::LMS_IDENTIFIER_LEN);

         // HSS_LMS_Verification_Operation::hash_function()
         const Botan::PK_Verifier verifier(*sk, "");
         result.test_str_eq("PK_Verifier should report the hash of the key", verifier.hash_function(), "SHA-256");

         // HSS_LMS_PrivateKey::raw_private_key_bits()
         result.test_bin_eq("Our BER and raw encoding is the same", sk->raw_private_key_bits(), sk->private_key_bits());

         // HSS_LMS_Signature_Operation::algorithm_identifier()
         const Botan::PK_Signer signer(*sk, Test::rng(), "");
         result.test_is_true("signature algorithm", signer.algorithm_identifier() == sk->algorithm_identifier());

         // HSS_LMS_Signature_Operation::hash_function()
         result.test_str_eq("PK_Signer should report the hash of the key", signer.hash_function(), "SHA-256");

         return {result};
      }
};

BOTAN_REGISTER_TEST_FN("pubkey", "hss_lms_params_parsing", test_hss_lms_params_parsing);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_sign", HSS_LMS_Signature_Generation_Test);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_verify", HSS_LMS_Signature_Verify_Tests);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_verify_invalid", HSS_LMS_Signature_Verify_Invalid_Tests);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_keygen", HSS_LMS_Key_Generation_Test);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_negative", HSS_LMS_Negative_Tests);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_state", HSS_LMS_Statefulness_Test);
BOTAN_REGISTER_TEST("pubkey", "hss_lms_api", HSS_LMS_Missing_API_Test);

}  // namespace

}  // namespace Botan_Tests

#endif  // BOTAN_HAS_HSS_LMS

1	/*
2	* (C) 2023 Jack Lloyd
3	* 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include "tests.h"
9
10	#if defined(BOTAN_HAS_HSS_LMS)
11	#include "test_arb_eq.h"
12	#include "test_pubkey.h"
13	#include <botan/asn1_obj.h>
14	#include <botan/hss_lms.h>
15	#include <botan/pk_algs.h>
16	#include <botan/pubkey.h>
17	#include <botan/internal/fmt.h>
18	#include <botan/internal/hss.h>
19	#include <botan/internal/loadstor.h>
20	#include <limits>
21
22	namespace Botan_Tests {
23
24	namespace {
25
26	/**
27	* @brief Test the correct parsing of HSS-LMS parameters
28	*/
29	std::vector<Test::Result> test_hss_lms_params_parsing() {	1✔
30	return {	1✔
31	CHECK("HSS Parameter Parsing",
32	[&](Test::Result& result) {	1✔
33	result.test_no_throw("no throw", [&] {	1✔
34	const Botan::HSS_LMS_Params hss_params("SHA-256,HW(5,1),HW(25,8)");	1✔
35
36	test_arb_eq(result, "hss levels", hss_params.L(), Botan::HSS_Level(2));	1✔
37	const auto& top_lms_params = hss_params.params_at_level(Botan::HSS_Level(0));	1✔
38	result.test_str_eq("hash name", top_lms_params.lms_params().hash_name(), std::string("SHA-256"));	1✔
39	result.test_enum_eq("top level - lms type",	2✔
40	top_lms_params.lms_params().algorithm_type(),	1✔
41	Botan::LMS_Algorithm_Type::SHA256_M32_H5);	1✔
42	result.test_enum_eq("top level - ots type",	2✔
43	top_lms_params.lmots_params().algorithm_type(),	1✔
44	Botan::LMOTS_Algorithm_Type::SHA256_N32_W1);	1✔
45
46	const auto& second_lms_params = hss_params.params_at_level(Botan::HSS_Level(1));	1✔
47	result.test_enum_eq("2nd level - lms type",	2✔
48	second_lms_params.lms_params().algorithm_type(),	1✔
49	Botan::LMS_Algorithm_Type::SHA256_M32_H25);	1✔
50	result.test_enum_eq("2nd level - ots type",	2✔
51	second_lms_params.lmots_params().algorithm_type(),	1✔
52	Botan::LMOTS_Algorithm_Type::SHA256_N32_W8);	1✔
53	});	3✔
54	}),	1✔
55
56	};	2✔
57	}	1✔
58
59	/**
60	* @brief Test signature generation using the raw private key bytes
61	*/
62	class HSS_LMS_Signature_Generation_Test final : public PK_Signature_Generation_Test {
63	public:
64	HSS_LMS_Signature_Generation_Test() :	1✔
65	PK_Signature_Generation_Test("HSS-LMS", "pubkey/hss_lms_sig.vec", "Msg,PrivateKey,Signature") {}	2✔
66
67	std::string default_padding(const VarMap& /vars/) const final { return ""; }	2✔
68
69	std::unique_ptr<Botan::Private_Key> load_private_key(const VarMap& vars) final {	2✔
70	const auto sk_bytes = vars.get_req_bin("PrivateKey");	2✔
71	return std::make_unique<Botan::HSS_LMS_PrivateKey>(Botan::AlgorithmIdentifier(), sk_bytes);	2✔
72	}	2✔
73	};
74
75	/**
76	* @brief Test signature verification using the raw public key bytes
77	*/
78	class HSS_LMS_Signature_Verify_Tests final : public PK_Signature_Verification_Test {
79	public:
80	HSS_LMS_Signature_Verify_Tests() :	1✔
81	PK_Signature_Verification_Test("HSS-LMS", "pubkey/hss_lms_verify.vec", "Msg,PublicKey,Signature") {}	2✔
82
83	std::string default_padding(const VarMap& /vars/) const final { return ""; }	5✔
84
85	std::unique_ptr<Botan::Public_Key> load_public_key(const VarMap& vars) override {	5✔
86	const std::vector<uint8_t> pk_bytes = vars.get_req_bin("PublicKey");	5✔
87	return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), pk_bytes);	10✔
88	}	5✔
89	};
90
91	/**
92	* @brief Test the correct revocation of invalid signatures
93	*/
94	class HSS_LMS_Signature_Verify_Invalid_Tests final : public PK_Signature_NonVerification_Test {
95	public:
96	HSS_LMS_Signature_Verify_Invalid_Tests() :	1✔
97	PK_Signature_NonVerification_Test(
98	"HSS_LMS", "pubkey/hss_lms_invalid.vec", "Msg,PublicKey,InvalidSignature") {}	2✔
99
100	std::string default_padding(const VarMap& /vars/) const override { return ""; }	4✔
101
102	std::unique_ptr<Botan::Public_Key> load_public_key(const VarMap& vars) override {	4✔
103	const std::vector<uint8_t> raw_key = vars.get_req_bin("PublicKey");	4✔
104	return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), raw_key);	8✔
105	}	4✔
106	};
107
108	/**
109	* @brief Test HSS-LMS public key creation
110	*/
111	class HSS_LMS_Key_Generation_Test final : public PK_Key_Generation_Test {	1✔
112	public:
113	std::vector<std::string> keygen_params() const final { return {"SHA-256,HW(10,4),HW(5,8)"}; }	1✔
114
115	std::string algo_name() const final { return "HSS-LMS"; }	1✔
116
117	std::unique_ptr<Botan::Public_Key> public_key_from_raw(std::string_view /* keygen_params */,	1✔
118	std::string_view /* provider */,
119	std::span<const uint8_t> raw_pk) const override {
120	return std::make_unique<Botan::HSS_LMS_PublicKey>(Botan::AlgorithmIdentifier(), raw_pk);	2✔
121	}
122	};
123
124	/**
125	* @brief Test that for manipulated signatures and too short signatures, private keys, and public keys a DecodeError occurs.
126	*/
127	class HSS_LMS_Negative_Tests final : public Test {	1✔
128	Test::Result test_flipped_signature_bits() {	1✔
129	Test::Result result("HSS-LMS - flipped signature bits");	1✔
130
131	auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
132
133	Botan::PK_Signer signer(*sk, Test::rng(), "");	1✔
134	Botan::PK_Verifier verifier(*sk, "");	1✔
135
136	std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
137
138	signer.update(mes);	1✔
139	auto valid_sig = signer.signature(Test::rng());	1✔
140	verifier.update(mes);	1✔
141	result.test_is_true("Entire signature is valid", verifier.check_signature(valid_sig));	1✔
142	for(size_t idx = 0; idx < valid_sig.size(); ++idx) {	785✔
143	auto bad_sig = valid_sig;	784✔
144	bad_sig.at(idx) ^= 0x80;	784✔
145	result.test_no_throw(Botan::fmt("Verification does not throw (byte idx {})", idx), [&]() {	1,568✔
146	verifier.update(mes);	784✔
147	const bool valid = verifier.check_signature(bad_sig);	784✔
148	result.test_is_true(Botan::fmt("Manipulated signature is invalid (byte idx {})", idx), !valid);	784✔
149	});	784✔
150	}	784✔
151
152	return result;	1✔
153	}	3✔
154
155	Test::Result test_too_short_signature() {	1✔
156	Test::Result result("HSS-LMS");	1✔
157
158	auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
159
160	Botan::PK_Signer signer(*sk, Test::rng(), "");	1✔
161	Botan::PK_Verifier verifier(*sk, "");	1✔
162
163	std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	2✔
164
165	signer.update(mes);	1✔
166	auto valid_sig = signer.signature(Test::rng());	1✔
167	verifier.update(mes);	1✔
168	result.test_is_true("Entire signature is valid", verifier.check_signature(valid_sig));	1✔
169	for(size_t n = 0; n < valid_sig.size(); ++n) {	785✔
170	result.test_no_throw("Verification does not throw", [&]() {	784✔
171	verifier.update(mes);	784✔
172	const bool valid = verifier.check_signature(valid_sig.data(), n);	784✔
173	result.test_is_true("Too short signature is invalid", !valid);	784✔
174	});	784✔
175	}
176
177	return result;	1✔
178	}	3✔
179
180	Test::Result test_too_short_private_key() {	1✔
181	Test::Result result("HSS-LMS");	1✔
182
183	// HSS_LMS_PublicKey::key_length()
184	auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
185
186	auto sk_bytes = sk->private_key_bits();	1✔
187	result.test_no_throw("Entire private key valid", [&]() {	1✔
188	const Botan::HSS_LMS_PrivateKey key(sk_bytes);	1✔
189	BOTAN_UNUSED(key);	1✔
190	});	1✔
191	for(size_t n = 0; n < sk_bytes.size(); ++n) {	61✔
192	result.test_throws<Botan::Decoding_Error>("Partial private key invalid", [&]() {	60✔
193	const std::span<const uint8_t> partial_key = {sk_bytes.data(), n};	60✔
194	const Botan::HSS_LMS_PrivateKey key(partial_key);	60✔
195	BOTAN_UNUSED(key);	×
196	});	×
197	}
198	return result;	1✔
199	}	2✔
200
201	Test::Result test_too_short_public_key() {	1✔
202	Test::Result result("HSS-LMS");	1✔
203
204	// HSS_LMS_PublicKey::key_length()
205	auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
206
207	auto sk_bytes = sk->public_key_bits();	1✔
208	result.test_no_throw("Entire public key valid", [&]() {	1✔
209	const Botan::HSS_LMS_PublicKey key(sk_bytes);	1✔
210	BOTAN_UNUSED(key);	1✔
211	});	1✔
212	for(size_t n = 0; n < sk_bytes.size(); ++n) {	53✔
213	result.test_throws<Botan::Decoding_Error>("Partial public key invalid", [&]() {	52✔
214	const std::span<const uint8_t> partial_key = {sk_bytes.data(), n};	52✔
215	const Botan::HSS_LMS_PublicKey key(partial_key);	52✔
216	BOTAN_UNUSED(key);	×
217	});	×
218	}
219	return result;	1✔
220	}	2✔
221
222	std::vector<Test::Result> run() final {	1✔
223	return {test_flipped_signature_bits(),	1✔
224	test_too_short_signature(),
225	test_too_short_private_key(),
226	test_too_short_public_key()};	5✔
227	}	1✔
228	};
229
230	/**
231	* @brief Test the correct handling of the HSS-LMS private key's state.
232	*/
233	class HSS_LMS_Statefulness_Test final : public Test {	1✔
234	Botan::HSS_LMS_PrivateKey create_private_key_with_idx(uint64_t idx) {	4✔
235	auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	4✔
236	auto bytes = sk.private_key_bits();	4✔
237	// The index is store after the level (uint32_t)
238	Botan::store_be(idx, bytes.data() + sizeof(uint32_t));	4✔
239	return Botan::HSS_LMS_PrivateKey(Botan::AlgorithmIdentifier(), bytes);	8✔
240	}	4✔
241
242	Test::Result test_sig_changes_state() {	1✔
243	Test::Result result("HSS-LMS");	1✔
244
245	auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8),HW(5,8)");	1✔
246	Botan::PK_Signer signer(sk, Test::rng(), "");	1✔
247	std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
248	auto sk_bytes_begin = sk.private_key_bits();	1✔
249
250	// Tree heights: 5,5 => 2^(5+5) = 1024 signatures available
251	const uint64_t expected_total = 1024;	1✔
252	result.test_opt_u64_eq(	1✔
253	"Fresh key starts with total number of remaining signatures.", sk.remaining_operations(), expected_total);
254
255	// Creating a signature should update the private key's state
256	auto sig_0 = signer.sign_message(mes, Test::rng());	1✔
257	result.test_is_true(	1✔
258	"First signature uses index 0.",
259	Botan::HSS_Signature::from_bytes_or_throw(sig_0).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(0));	1✔
260
261	auto sk_bytes_after_sig = sk.private_key_bits();	1✔
262
263	result.test_opt_u64_eq(	1✔
264	"Signature decreases number of remaining signatures.", sk.remaining_operations(), expected_total - 1);	1✔
265	result.test_bin_ne("Signature updates private key.", sk_bytes_after_sig, sk_bytes_begin);	1✔
266
267	auto sig_1 = signer.sign_message(mes, Test::rng());	1✔
268	result.test_is_true(	1✔
269	"Next signature uses the new index.",
270	Botan::HSS_Signature::from_bytes_or_throw(sig_1).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(1));	1✔
271
272	return result;	2✔
273	}	5✔
274
275	Test::Result test_max_sig_count() {	1✔
276	Test::Result result("HSS-LMS");	1✔
277
278	const uint64_t total_sig_count = 32;	1✔
279	auto sk = create_private_key_with_idx(total_sig_count - 1);	1✔
280
281	Botan::PK_Signer signer(sk, Test::rng(), "");	1✔
282	std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
283	auto sk_bytes_begin = sk.private_key_bits();	1✔
284
285	result.test_opt_u64_eq("One remaining signature.", sk.remaining_operations(), 1);	1✔
286	result.test_no_throw("Use last signature index.", [&]() { signer.sign_message(mes, Test::rng()); });	3✔
287	result.test_opt_u64_eq("No remaining signatures.", sk.remaining_operations(), 0);	1✔
288	result.test_throws("Cannot sign with exhausted key.", [&]() { signer.sign_message(mes, Test::rng()); });	2✔
289	result.test_opt_u64_eq("Still zero remaining signatures.", sk.remaining_operations(), 0);	1✔
290
291	return result;	2✔
292	}	2✔
293
294	Test::Result test_idx_bound_checked_on_load() {	1✔
295	Test::Result result("HSS-LMS");	1✔
296
297	// create_private_key_with_idx uses a single HW(5,8) layer, so the
298	// maximum signature count is 32
299	result.test_no_throw("Index == max_sig_count is accepted on load", [&]() {	1✔
300	auto sk = create_private_key_with_idx(32);	1✔
301	result.test_opt_u64_eq("Exhausted key loads with no remaining signatures", sk.remaining_operations(), 0);	1✔
302	Botan::PK_Signer signer(sk, Test::rng(), "");	1✔
303	const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
304	result.test_throws("Cannot sign with exhausted key", [&]() { signer.sign_message(mes, Test::rng()); });	2✔
305	});	1✔
306
307	result.test_throws<Botan::Decoding_Error>("Index > max_sig_count is rejected on load",	1✔
308	[&]() { create_private_key_with_idx(33); });	2✔
309
310	result.test_throws<Botan::Decoding_Error>("Huge index is rejected on load", [&]() {	1✔
311	create_private_key_with_idx(std::numeric_limits<uint64_t>::max());	1✔
312	});	×
313
314	return result;	1✔
315	}	×
316
317	Test::Result test_exhausted_key_stays_exhausted() {	1✔
318	Test::Result result("HSS-LMS");	1✔
319
320	// With a total tree height >= 64 the maximum signature count is
321	// clamped to 2^64 - 1, so an index of 2^64 - 1 is accepted on load
322	auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8),HW(25,8),HW(25,8),HW(25,8)");	1✔
323	auto bytes = sk.private_key_bits();	1✔
324	Botan::store_be(std::numeric_limits<uint64_t>::max(), bytes.data() + sizeof(uint32_t));	1✔
325
326	auto exhausted_sk = Botan::HSS_LMS_PrivateKey(Botan::AlgorithmIdentifier(), bytes);	1✔
327	result.test_opt_u64_eq("Exhausted key has no remaining signatures", exhausted_sk.remaining_operations(), 0);	1✔
328
329	Botan::PK_Signer signer(exhausted_sk, Test::rng(), "");	1✔
330	const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
331
332	// A failed signing attempt must not wrap the index back to zero
333	result.test_throws("Cannot sign with exhausted key", [&]() { signer.sign_message(mes, Test::rng()); });	2✔
334	result.test_opt_u64_eq("Failed signing does not reset the state", exhausted_sk.remaining_operations(), 0);	1✔
335	result.test_throws("Exhausted key stays exhausted", [&]() { signer.sign_message(mes, Test::rng()); });	2✔
336
337	return result;	2✔
338	}	2✔
339
340	Test::Result test_params_are_part_of_key_identity() {	1✔
341	Test::Result result("HSS-LMS");	1✔
342
343	const auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
344	auto bytes = sk.private_key_bits();	1✔
345
346	// Patch the LMOTS algorithm type from SHA256_N24_W8 (0x08) to
347	// SHA256_N24_W4 (0x07), pretending the same seed and identifier
348	// belong to a key with a different Winternitz parameter
349	result.require("LMOTS type byte has expected value", bytes[19] == 0x08);	1✔
350	bytes[19] = 0x07;	1✔
351
352	// The index registry tracks the same key material under different
353	// parameter sets independently. Nothing can prevent such (insecurely)
354	// related keys from issuing overlapping one time signatures.
355	const Botan::HSS_LMS_PrivateKey patched(Botan::AlgorithmIdentifier(), bytes);	1✔
356
357	Botan::PK_Signer signer(sk, Test::rng(), "");	1✔
358	const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
359	signer.sign_message(mes, Test::rng());	2✔
360
361	result.test_opt_u64_eq("Original key consumed an index", sk.remaining_operations(), 31);	1✔
362	result.test_opt_u64_eq(	1✔
363	"Key with the same material but other params is unaffected", patched.remaining_operations(), 32);	1✔
364
365	return result;	2✔
366	}	2✔
367
368	Test::Result test_separately_loaded_copies_share_state() {	1✔
369	Test::Result result("HSS-LMS");	1✔
370
371	const auto sk = Botan::HSS_LMS_PrivateKey(Test::rng(), "Truncated(SHA-256,192),HW(5,8)");	1✔
372	const auto sk_bytes = sk.private_key_bits();	1✔
373
374	const Botan::HSS_LMS_PrivateKey copy1(Botan::AlgorithmIdentifier(), sk_bytes);	1✔
375	const Botan::HSS_LMS_PrivateKey copy2(Botan::AlgorithmIdentifier(), sk_bytes);	1✔
376
377	const std::vector<uint8_t> mes = {0xde, 0xad, 0xbe, 0xef};	1✔
378
379	Botan::PK_Signer signer1(copy1, Test::rng(), "");	1✔
380	const auto sig_0 = signer1.sign_message(mes, Test::rng());	1✔
381
382	result.test_opt_u64_eq("Signing with one copy is seen by the other", copy2.remaining_operations(), 31);	1✔
383
384	Botan::PK_Signer signer2(copy2, Test::rng(), "");	1✔
385	const auto sig_1 = signer2.sign_message(mes, Test::rng());	1✔
386
387	result.test_is_true(	1✔
388	"First signature uses index 0",
389	Botan::HSS_Signature::from_bytes_or_throw(sig_0).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(0));	1✔
390	result.test_is_true(	1✔
391	"Second signature uses index 1",
392	Botan::HSS_Signature::from_bytes_or_throw(sig_1).bottom_sig().q() == Botan::LMS_Tree_Node_Idx(1));	1✔
393
394	return result;	2✔
395	}	4✔
396
397	std::vector<Test::Result> run() final {	1✔
398	return {test_sig_changes_state(),	1✔
399	test_max_sig_count(),
400	test_idx_bound_checked_on_load(),
401	test_exhausted_key_stays_exhausted(),
402	test_params_are_part_of_key_identity(),
403	test_separately_loaded_copies_share_state()};	7✔
404	}	1✔
405	};
406
407	/**
408	* @brief Test APIs not covered by other tests.
409	*/
410	class HSS_LMS_Missing_API_Test final : public Test {	1✔
411	std::vector<Test::Result> run() final {	1✔
412	Test::Result result("HSS-LMS");	1✔
413
414	// HSS_LMS_PublicKey::key_length()
415	auto sk = Botan::create_private_key("HSS-LMS", Test::rng(), "SHA-256,HW(10,4)");	1✔
416	sk->key_length();	1✔
417	result.test_sz_gt("Public key length must be greater than the simply type information plus I",	1✔
418	sk->key_length(),	1✔
419	3 * sizeof(uint32_t) + Botan::LMS_IDENTIFIER_LEN);
420
421	// HSS_LMS_Verification_Operation::hash_function()
422	const Botan::PK_Verifier verifier(*sk, "");	1✔
423	result.test_str_eq("PK_Verifier should report the hash of the key", verifier.hash_function(), "SHA-256");	1✔
424
425	// HSS_LMS_PrivateKey::raw_private_key_bits()
426	result.test_bin_eq("Our BER and raw encoding is the same", sk->raw_private_key_bits(), sk->private_key_bits());	2✔
427
428	// HSS_LMS_Signature_Operation::algorithm_identifier()
429	const Botan::PK_Signer signer(*sk, Test::rng(), "");	1✔
430	result.test_is_true("signature algorithm", signer.algorithm_identifier() == sk->algorithm_identifier());	1✔
431
432	// HSS_LMS_Signature_Operation::hash_function()
433	result.test_str_eq("PK_Signer should report the hash of the key", signer.hash_function(), "SHA-256");	1✔
434
435	return {result};	3✔
436	}	3✔
437	};
438
439	BOTAN_REGISTER_TEST_FN("pubkey", "hss_lms_params_parsing", test_hss_lms_params_parsing);
440	BOTAN_REGISTER_TEST("pubkey", "hss_lms_sign", HSS_LMS_Signature_Generation_Test);
441	BOTAN_REGISTER_TEST("pubkey", "hss_lms_verify", HSS_LMS_Signature_Verify_Tests);
442	BOTAN_REGISTER_TEST("pubkey", "hss_lms_verify_invalid", HSS_LMS_Signature_Verify_Invalid_Tests);
443	BOTAN_REGISTER_TEST("pubkey", "hss_lms_keygen", HSS_LMS_Key_Generation_Test);
444	BOTAN_REGISTER_TEST("pubkey", "hss_lms_negative", HSS_LMS_Negative_Tests);
445	BOTAN_REGISTER_TEST("pubkey", "hss_lms_state", HSS_LMS_Statefulness_Test);
446	BOTAN_REGISTER_TEST("pubkey", "hss_lms_api", HSS_LMS_Missing_API_Test);
447
448	} // namespace
449
450	} // namespace Botan_Tests
451
452	#endif // BOTAN_HAS_HSS_LMS

randombit / botan / 27456950099

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous