projects/linux·blob master · refs

69 lines · 2.5 KiB

1#!/usr/bin/env python3
2# SPDX-License-Identifier: GPL-2.0-or-later
3#
4# Script that generates known-good data used in the AEAD tests.
5#
6# Requires that python-cryptography be installed.
7#
8# Copyright 2026 Google LLC
9
10import hashlib
11import sys
12import cryptography.hazmat.primitives.ciphers.aead
13
14
15# Deterministically generate 'length' random bytes.
16def rand_bytes(length):
17 seed = length
18 out = []
19 for _ in range(length):
20 seed = (seed * 25214903917 + 11) % 2**48
21 out.append((seed >> 16) % 256)
22 return bytes(out)
23
24
25# Deterministically generate many different AEAD inputs using exactly the same
26# method that the test uses; encrypt them using an independent implementation of
27# the algorithm; compute the checksum of all the resulting (ciphertext, authtag)
28# pairs concatenated to each other; and print the checksum as a C struct.
29def gen_monte_carlo_checksum(alg):
30 blake2s = hashlib.blake2s()
31 for data_len in range(1025):
32 ad_len = data_len % 293
33 pt = rand_bytes(data_len)
34 ad = rand_bytes(ad_len)
35 if alg == "aes-ccm":
36 key_len = [16, 24, 32][data_len % 3]
37 key = rand_bytes(key_len)
38 nonce = rand_bytes([7, 8, 9, 10, 11, 12, 13][data_len % 7])
39 tag_len = [4, 6, 8, 10, 12, 14, 16][data_len % 7]
40 ccm = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
41 key, tag_length=tag_len
42 )
43 ct_and_tag = ccm.encrypt(nonce, pt, ad)
44 elif alg == "aes-gcm":
45 key_len = [16, 24, 32][data_len % 3]
46 key = rand_bytes(key_len)
47 nonce = rand_bytes(12)
48 tag_len = [4, 8, 12, 13, 14, 15, 16][data_len % 7]
49 gcm = cryptography.hazmat.primitives.ciphers.aead.AESGCM(key)
50 # python-cryptography supports only 16-byte GCM tags. However, in
51 # GCM, shorter tags are simply truncated. Do that below.
52 ct_and_tag = gcm.encrypt(nonce, pt, ad)[: data_len + tag_len]
53
54 blake2s.update(ct_and_tag)
55
56 name = f"{alg.replace('-', '_')}_monte_carlo_checksum"
57 value = blake2s.digest()
58 print(f"static const u8 {name}[BLAKE2S_HASH_SIZE] = {{")
59 for i in range(0, len(value), 11):
60 line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 11])
61 print(f"{line.rstrip()}")
62 print("};")
63
64
65if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm", "aes-gcm"):
66 sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm|aes-gcm]\n")
67 sys.exit(1)
68
69gen_monte_carlo_checksum(sys.argv[1])