ecdsa_unittest.cc 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/client_update_protocol/ecdsa.h"
  5. #include <stdint.h>
  6. #include <limits>
  7. #include <memory>
  8. #include "base/base64.h"
  9. #include "base/base64url.h"
  10. #include "base/strings/string_piece.h"
  11. #include "base/strings/string_util.h"
  12. #include "base/strings/stringprintf.h"
  13. #include "crypto/random.h"
  14. #include "crypto/secure_util.h"
  15. #include "testing/gtest/include/gtest/gtest.h"
  16. namespace client_update_protocol {
  17. namespace {
  18. std::string GetPublicKeyForTesting() {
  19. // How to generate this key:
  20. // openssl ecparam -genkey -name prime256v1 -out ecpriv.pem
  21. // openssl ec -in ecpriv.pem -pubout -out ecpub.pem
  22. static const char kCupEcdsaTestKey_Base64[] =
  23. "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJNOjKyN6UHyUGkGow+xCmQthQXUo"
  24. "9sd7RIXSpVIM768UlbGb/5JrnISjSYejCc/pxQooI6mJTzWL3pZb5TA1DA==";
  25. std::string result;
  26. if (!base::Base64Decode(std::string(kCupEcdsaTestKey_Base64), &result))
  27. return std::string();
  28. return result;
  29. }
  30. } // end namespace
  31. class CupEcdsaTest : public testing::Test {
  32. protected:
  33. void SetUp() override {
  34. cup_ = Ecdsa::Create(8, GetPublicKeyForTesting());
  35. ASSERT_TRUE(cup_.get());
  36. }
  37. Ecdsa& CUP() { return *cup_; }
  38. private:
  39. std::unique_ptr<Ecdsa> cup_;
  40. };
  41. TEST_F(CupEcdsaTest, SignRequest) {
  42. static const char kRequest[] = "TestSequenceForCupEcdsaUnitTest";
  43. static const char kRequestHash[] =
  44. "cde1f7dc1311ed96813057ca321c2f5a17ea2c9c776ee0eb31965f7985a3074a";
  45. static const char kRequestHashWithName[] =
  46. "&cup2hreq="
  47. "cde1f7dc1311ed96813057ca321c2f5a17ea2c9c776ee0eb31965f7985a3074a";
  48. static const char kKeyId[] = "8:";
  49. static const char kKeyIdWithName[] = "cup2key=8:";
  50. std::string query;
  51. CUP().SignRequest(kRequest, &query);
  52. std::string query2;
  53. CUP().SignRequest(kRequest, &query2);
  54. Ecdsa::RequestParameters request_parameters = CUP().SignRequest(kRequest);
  55. EXPECT_TRUE(base::StartsWith(query, kKeyIdWithName));
  56. EXPECT_TRUE(base::StartsWith(query2, kKeyIdWithName));
  57. EXPECT_TRUE(base::StartsWith(request_parameters.query_cup2key, kKeyId));
  58. EXPECT_TRUE(base::EndsWith(query, kRequestHashWithName));
  59. EXPECT_TRUE(base::EndsWith(query2, kRequestHashWithName));
  60. EXPECT_EQ(request_parameters.hash_hex, kRequestHash);
  61. // The nonce should be a base64url-encoded, 32-byte (256-bit) string.
  62. base::StringPiece nonce_b64 = query;
  63. nonce_b64.remove_prefix(strlen(kKeyIdWithName));
  64. nonce_b64.remove_suffix(strlen(kRequestHashWithName));
  65. std::string nonce;
  66. EXPECT_TRUE(base::Base64UrlDecode(
  67. nonce_b64, base::Base64UrlDecodePolicy::DISALLOW_PADDING, &nonce));
  68. EXPECT_EQ(32u, nonce.size());
  69. nonce_b64 = request_parameters.query_cup2key;
  70. nonce_b64.remove_prefix(strlen(kKeyId));
  71. EXPECT_TRUE(base::Base64UrlDecode(
  72. nonce_b64, base::Base64UrlDecodePolicy::DISALLOW_PADDING, &nonce));
  73. EXPECT_EQ(32u, nonce.size());
  74. nonce_b64 = query2;
  75. nonce_b64.remove_prefix(strlen(kKeyIdWithName));
  76. nonce_b64.remove_suffix(strlen(kRequestHashWithName));
  77. EXPECT_TRUE(base::Base64UrlDecode(
  78. nonce_b64, base::Base64UrlDecodePolicy::DISALLOW_PADDING, &nonce));
  79. EXPECT_EQ(32u, nonce.size());
  80. // With a 256-bit nonce, the probability of collision is negligible.
  81. EXPECT_NE(query, query2);
  82. EXPECT_NE(query, base::StringPrintf("cup2key=%s&cup2hreq=%s",
  83. request_parameters.query_cup2key.c_str(),
  84. request_parameters.hash_hex.c_str()));
  85. }
  86. TEST_F(CupEcdsaTest, ValidateResponse_TestETagParsing) {
  87. // Invalid ETags must be gracefully rejected without a crash.
  88. std::string query_discard;
  89. CUP().SignRequest("Request_A", &query_discard);
  90. CUP().OverrideNonceForTesting(8, 12345);
  91. // Expect a pass for a well-formed etag.
  92. EXPECT_TRUE(CUP().ValidateResponse(
  93. "Response_A",
  94. "3044"
  95. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  96. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  97. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  98. // Reject empty etags.
  99. EXPECT_FALSE(CUP().ValidateResponse("Response_A", ""));
  100. // Reject etags with zero-length hashes or signatures, even if the other
  101. // component is wellformed.
  102. EXPECT_FALSE(CUP().ValidateResponse("Response_A", ":"));
  103. EXPECT_FALSE(CUP().ValidateResponse(
  104. "Response_A",
  105. "3044"
  106. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  107. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  108. ":"));
  109. EXPECT_FALSE(CUP().ValidateResponse(
  110. "Response_A",
  111. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  112. // Reject etags with non-hex content in either component.
  113. EXPECT_FALSE(CUP().ValidateResponse(
  114. "Response_A",
  115. "3044"
  116. "02207fb15d24e66c168ac150458__ae51f843c4858e27d41be3f9396d4919bbd5656"
  117. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  118. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  119. EXPECT_FALSE(CUP().ValidateResponse(
  120. "Response_A",
  121. "3044"
  122. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  123. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  124. ":2727bc2b3c33feb6800a830f4055901d__7d65a84184c5fbeb3f816db0a243f5"));
  125. // Reject etags where either/both component has a length that's not a
  126. // multiple of 2 (i.e. not a valid hex encoding).
  127. EXPECT_FALSE(CUP().ValidateResponse(
  128. "Response_A",
  129. "3044"
  130. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  131. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10"
  132. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  133. EXPECT_FALSE(CUP().ValidateResponse(
  134. "Response_A",
  135. "3044"
  136. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  137. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  138. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f"));
  139. EXPECT_FALSE(CUP().ValidateResponse(
  140. "Response_A",
  141. "3044"
  142. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  143. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10"
  144. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f"));
  145. // Reject etags where the hash is even, but not 256 bits.
  146. EXPECT_FALSE(CUP().ValidateResponse(
  147. "Response_A",
  148. "3044"
  149. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  150. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  151. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  152. EXPECT_FALSE(CUP().ValidateResponse(
  153. "Response_A",
  154. "3044"
  155. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  156. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  157. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5ff"));
  158. // Reject etags where the signature field is too small to be valid. (Note that
  159. // the case isn't even a signature -- it's a validly encoded ASN.1 NULL.)
  160. EXPECT_FALSE(CUP().ValidateResponse(
  161. "Response_A",
  162. "0500"
  163. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  164. // Reject etags where the signature field is too big to be a valid signature.
  165. // (This is a validly formed structure, but both ints are over 256 bits.)
  166. EXPECT_FALSE(CUP().ValidateResponse(
  167. "Response_A",
  168. "3048"
  169. "202207fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  170. "202207fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  171. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5ff"));
  172. // Reject etags where the signature is valid DER-encoded ASN.1, but is not
  173. // an ECDSA signature. (This is actually stressing crypto's SignatureValidator
  174. // library, and not CUP's use of it, but it's worth testing here.) Cases:
  175. // * Something that's not a sequence
  176. // * Sequences that contain things other than ints (i.e. octet strings)
  177. // * Sequences that contain a negative int.
  178. EXPECT_FALSE(CUP().ValidateResponse(
  179. "Response_A",
  180. "0406020100020100"
  181. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  182. EXPECT_FALSE(CUP().ValidateResponse(
  183. "Response_A",
  184. "3044"
  185. "06200123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
  186. "06200123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
  187. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  188. EXPECT_FALSE(CUP().ValidateResponse(
  189. "Response_A",
  190. "3046"
  191. "02047fffffff"
  192. "0220ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  193. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  194. // Reject etags where the signature is not a valid DER encoding. (Again, this
  195. // is stressing SignatureValidator.) Test cases are:
  196. // * No length field
  197. // * Zero length field
  198. // * One of the ints has truncated content
  199. // * One of the ints has content longer than its length field
  200. // * A positive int is improperly zero-padded
  201. EXPECT_FALSE(CUP().ValidateResponse(
  202. "Response_A",
  203. "30"
  204. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  205. EXPECT_FALSE(CUP().ValidateResponse(
  206. "Response_A",
  207. "3000"
  208. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  209. EXPECT_FALSE(CUP().ValidateResponse(
  210. "Response_A",
  211. "3044"
  212. "02207fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
  213. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  214. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  215. EXPECT_FALSE(CUP().ValidateResponse(
  216. "Response_A",
  217. "3044"
  218. "02207fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00"
  219. "02207fb15d24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  220. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243"));
  221. EXPECT_FALSE(CUP().ValidateResponse(
  222. "Response_A",
  223. "3044"
  224. "022000007f24e66c168ac150458c7ae51f843c4858e27d41be3f9396d4919bbd5656"
  225. "02202291bae598e4a41118ea1df24ce8494d4055b2842dc046e0223f5e17e86bd10e"
  226. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  227. }
  228. TEST_F(CupEcdsaTest, ValidateResponse_TestSigning) {
  229. std::string query_discard;
  230. CUP().SignRequest("Request_A", &query_discard);
  231. CUP().OverrideNonceForTesting(8, 12345);
  232. // How to generate an ECDSA signature:
  233. // echo -n Request_A | sha256sum | cut -d " " -f 1 > h
  234. // echo -n Response_A | sha256sum | cut -d " " -f 1 >> h
  235. // cat h | xxd -r -p > hbin
  236. // echo -n 8:12345 >> hbin
  237. // sha256sum hbin | cut -d " " -f 1 | xxd -r -p > hbin2
  238. // openssl dgst -hex -sha256 -sign ecpriv.pem hbin2 | cut -d " " -f 2 > sig
  239. // echo -n :Request_A | sha256sum | cut -d " " -f 1 >> sig
  240. // cat sig
  241. // It's useful to throw this in a bash script and parameterize it if you're
  242. // updating this unit test.
  243. // Valid case:
  244. // * Send "Request_A" with key 8 / nonce 12345 to server.
  245. // * Receive "Response_A", signature, and observed request hash from server.
  246. // * Signature signs HASH(Request_A) | HASH(Response_A) | 8:12345.
  247. // * Observed hash matches HASH(Request_A).
  248. EXPECT_TRUE(CUP().ValidateResponse(
  249. "Response_A",
  250. "3045022077a2d004f1643a92af5d356877c3434c46519ce32882d6e30ef6d154ee9775e3"
  251. "022100aca63c77d34152bdc0918ae0629e82b59314e5459f607cdc5ac95f1a4b7c31a2"
  252. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  253. // Failure case: "Request_A" made it to the server intact, but the response
  254. // body is modified to "Response_B" on return. The signature is now invalid.
  255. EXPECT_FALSE(CUP().ValidateResponse(
  256. "Response_B",
  257. "3045022077a2d004f1643a92af5d356877c3434c46519ce32882d6e30ef6d154ee9775e3"
  258. "022100aca63c77d34152bdc0918ae0629e82b59314e5459f607cdc5ac95f1a4b7c31a2"
  259. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  260. // Failure case: Request body was modified to "Request_B" before it reached
  261. // the server. Test a fast reject based on the observed_hash parameter.
  262. EXPECT_FALSE(CUP().ValidateResponse(
  263. "Response_B",
  264. "304402206289a7765f0371c7c48796779747f1166707d5937a99af518845f44af95876"
  265. "8c0220139fe935fde3e6b416ee742f91c6a480113762d78d889a2661de37576866d21c"
  266. ":80e3ef1b373efe5f2a8383a0cf9c89fb2e0cbb8e85db4813655ff5dc05009e7e"));
  267. // Failure case: Request body was modified to "Request_B" before it reached
  268. // the server. Test a slow reject based on a signature mismatch.
  269. EXPECT_FALSE(CUP().ValidateResponse(
  270. "Response_B",
  271. "304402206289a7765f0371c7c48796779747f1166707d5937a99af518845f44af95876"
  272. "8c0220139fe935fde3e6b416ee742f91c6a480113762d78d889a2661de37576866d21c"
  273. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  274. // Failure case: Request/response are intact, but the signature is invalid
  275. // because it was signed against a different nonce (67890).
  276. EXPECT_FALSE(CUP().ValidateResponse(
  277. "Response_A",
  278. "3046022100d3bbb1fb4451c8e04a07fe95404cc39121ed0e0bc084f87de19d52eee50a97"
  279. "bf022100dd7d41d467be2af98d9116b0c7ba09740d54578c02a02f74da5f089834be3403"
  280. ":2727bc2b3c33feb6800a830f4055901dd87d65a84184c5fbeb3f816db0a243f5"));
  281. }
  282. } // namespace client_update_protocol