1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
/*
* Copyright (c) 2019, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8224997
* @summary ChaCha20-Poly1305 TLS cipher suite decryption throws ShortBufferException
* @library /test/lib
* @build jdk.test.lib.Convert
* @run main OutputSizeTest
*/
import java.nio.ByteBuffer;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.SecureRandom;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.spec.ChaCha20ParameterSpec;
import javax.crypto.spec.IvParameterSpec;
public class OutputSizeTest {
private static final SecureRandom SR = new SecureRandom();
public static void main(String args[]) throws Exception {
testCC20GetOutSize();
testCC20P1305GetOutSize();
testMultiPartAEADDec();
}
private static void testCC20GetOutSize()
throws GeneralSecurityException {
boolean result = true;
KeyGenerator kg = KeyGenerator.getInstance("ChaCha20", "SunJCE");
kg.init(256);
// ChaCha20 encrypt
Cipher cc20 = Cipher.getInstance("ChaCha20", "SunJCE");
cc20.init(Cipher.ENCRYPT_MODE, kg.generateKey(),
new ChaCha20ParameterSpec(getRandBuf(12), 10));
testOutLen(cc20, 0, 0);
testOutLen(cc20, 5, 5);
testOutLen(cc20, 5120, 5120);
// perform an update, then test with a final block
byte[] input = new byte[5120];
SR.nextBytes(input);
cc20.update(input);
testOutLen(cc20, 1024, 1024);
// Decryption lengths should be calculated the same way as encryption
cc20.init(Cipher.DECRYPT_MODE, kg.generateKey(),
new ChaCha20ParameterSpec(getRandBuf(12), 10));
testOutLen(cc20, 0, 0);
testOutLen(cc20, 5, 5);
testOutLen(cc20, 5120, 5120);
// perform an update, then test with a final block
cc20.update(input);
testOutLen(cc20, 1024, 1024);
}
private static void testCC20P1305GetOutSize()
throws GeneralSecurityException {
KeyGenerator kg = KeyGenerator.getInstance("ChaCha20", "SunJCE");
kg.init(256);
// ChaCha20 encrypt
Cipher cc20 = Cipher.getInstance("ChaCha20-Poly1305", "SunJCE");
cc20.init(Cipher.ENCRYPT_MODE, kg.generateKey(),
new IvParameterSpec(getRandBuf(12)));
// Encryption lengths are calculated as the input length plus the tag
// length (16).
testOutLen(cc20, 0, 16);
testOutLen(cc20, 5, 21);
testOutLen(cc20, 5120, 5136);
// perform an update, then test with a final block
byte[] input = new byte[5120];
SR.nextBytes(input);
cc20.update(input);
testOutLen(cc20, 1024, 1040);
// Decryption lengths are handled differently for AEAD mode. The length
// should be zero for anything up to and including the first 16 bytes
// (since that's the tag). Anything above that should be the input
// length plus any unprocessed input (via update calls), minus the
// 16 byte tag.
cc20.init(Cipher.DECRYPT_MODE, kg.generateKey(),
new IvParameterSpec(getRandBuf(12)));
testOutLen(cc20, 0, 0);
testOutLen(cc20, 5, 0);
testOutLen(cc20, 16, 0);
testOutLen(cc20, 5120, 5104);
// Perform an update, then test with the length of a final chunk
// of data.
cc20.update(input);
testOutLen(cc20, 1024, 6128);
}
private static void testMultiPartAEADDec() throws GeneralSecurityException {
KeyGenerator kg = KeyGenerator.getInstance("ChaCha20", "SunJCE");
kg.init(256);
Key key = kg.generateKey();
IvParameterSpec ivps = new IvParameterSpec(getRandBuf(12));
// Encrypt some data so we can test decryption.
byte[] pText = getRandBuf(2048);
ByteBuffer pTextBase = ByteBuffer.wrap(pText);
Cipher enc = Cipher.getInstance("ChaCha20-Poly1305", "SunJCE");
enc.init(Cipher.ENCRYPT_MODE, key, ivps);
ByteBuffer ctBuf = ByteBuffer.allocateDirect(
enc.getOutputSize(pText.length));
enc.doFinal(pTextBase, ctBuf);
// Create a new direct plain text ByteBuffer which will catch the
// decrypted data.
ByteBuffer ptBuf = ByteBuffer.allocateDirect(pText.length);
// Set the cipher text buffer limit to roughly half the data so we can
// do an update/final sequence.
ctBuf.position(0).limit(1024);
Cipher dec = Cipher.getInstance("ChaCha20-Poly1305", "SunJCE");
dec.init(Cipher.DECRYPT_MODE, key, ivps);
dec.update(ctBuf, ptBuf);
System.out.println("CTBuf: " + ctBuf);
System.out.println("PTBuf: " + ptBuf);
ctBuf.limit(ctBuf.capacity());
dec.doFinal(ctBuf, ptBuf);
ptBuf.flip();
pTextBase.flip();
System.out.println("PT Base:" + pTextBase);
System.out.println("PT Actual:" + ptBuf);
if (pTextBase.compareTo(ptBuf) != 0) {
StringBuilder sb = new StringBuilder();
sb.append("Plaintext mismatch: Original: ").
append(pTextBase.toString()).append("\nActual :").
append(ptBuf);
throw new RuntimeException(sb.toString());
}
}
private static void testOutLen(Cipher c, int inLen, int expOut) {
int actualOut = c.getOutputSize(inLen);
if (actualOut != expOut) {
throw new RuntimeException("Cipher " + c + ", in: " + inLen +
", expOut: " + expOut + ", actual: " + actualOut);
}
}
private static byte[] getRandBuf(int len) {
byte[] buf = new byte[len];
SR.nextBytes(buf);
return buf;
}
}
|
