aes_gcm_testvectors.h

// Copyright lowRISC contributors (OpenTitan project).
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
 
#ifndef OPENTITAN_SW_DEVICE_TESTS_CRYPTO_AES_GCM_TESTVECTORS_H_
#define OPENTITAN_SW_DEVICE_TESTS_CRYPTO_AES_GCM_TESTVECTORS_H_
 
#include "sw/device/lib/base/macros.h"
#include "sw/device/lib/crypto/drivers/aes.h"
#include "sw/device/tests/crypto/aes_gcm_testutils.h"
 
#ifdef __cplusplus
extern "C" {
#endif  // __cplusplus
 
/**
 * Randomly-generated 128-bit key for testing.
 */
static const uint32_t kKey128[4] = {
    // Key = f80a6e67211c873793a99d899c31c2e7
    0x676e0af8, 0x37871c21, 0x899da993, 0xe7c2319c};
 
/**
 * Randomly-generated 256-bit key for testing.
 */
static const uint32_t kKey256[8] = {
    // Key = 76592790eaf6630e670ce5784ff23a1806a1ea76b0977b1542374769247cc4ce
    0x90275976, 0x0e63f6ea, 0x78e50c67, 0x183af24f,
    0x76eaa106, 0x157b97b0, 0x69473742, 0xcec47c24};
 
/**
 * Authenticated data for testing.
 */
static uint8_t kAad[18] = {
    // aad = 'authenticated data'
    //     = 61757468656e746963617465642064617461
    0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
    0x61, 0x74, 0x65, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61};
 
/**
 * Plaintext for testing.
 */
static uint8_t kPlaintext[32] = {
    // plaintext = 'authenticated and encrypted data'
    //           =
    //           61757468656e7469636174656420616e6420656e637279707465642064617461
    0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
    0x65, 0x64, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x63, 0x72,
    0x79, 0x70, 0x74, 0x65, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61};
 
/**
 * Expected ciphertext for the 256-bit key.
 */
static uint8_t kCiphertext256[32] = {
    // Ciphertext =
    // 4e6d3a963b076ba0945d29aa836f29b0fa06cdd575aab8233f1df93e80163371
    0x4e, 0x6d, 0x3a, 0x96, 0x3b, 0x07, 0x6b, 0xa0, 0x94, 0x5d, 0x29,
    0xaa, 0x83, 0x6f, 0x29, 0xb0, 0xfa, 0x06, 0xcd, 0xd5, 0x75, 0xaa,
    0xb8, 0x23, 0x3f, 0x1d, 0xf9, 0x3e, 0x80, 0x16, 0x33, 0x71};
 
/**
 * AES-GCM test case 3 from "The Galois/Counter Mode of Operation (GCM)" by
 * McGrew and Viega (linked document also shows intermediate values, helpful
 * for debugging):
 * https://csrc.nist.rip/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf
 *
 * key = feffe9928665731c6d6a8f9467308308
 * iv = cafebabefacedbaddecaf888
 * plaintext =
 * d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b391aafd255
 * aad = empty
 * ciphertext =
 * 42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329aca12e21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091473f5985
 * tag = 4d5c2af327cd64a62cf35abd2ba6fab4
 */
static const uint32_t kMVTestCase3Key[] = {0x92e9fffe, 0x1c736586, 0x948f6a6d,
                                           0x08833067};
static uint8_t kMVTestCase3Plaintext[] = {
    0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09,
    0xc5, 0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34,
    0xf7, 0xda, 0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c,
    0x3c, 0x0c, 0x95, 0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24,
    0x49, 0xa6, 0xb5, 0x25, 0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6,
    0x57, 0xba, 0x63, 0x7b, 0x39, 0x1a, 0xaf, 0xd2, 0x55};
static uint8_t kMVTestCase3Ciphertext[] = {
    0x42, 0x83, 0x1e, 0xc2, 0x21, 0x77, 0x74, 0x24, 0x4b, 0x72, 0x21,
    0xb7, 0x84, 0xd0, 0xd4, 0x9c, 0xe3, 0xaa, 0x21, 0x2f, 0x2c, 0x02,
    0xa4, 0xe0, 0x35, 0xc1, 0x7e, 0x23, 0x29, 0xac, 0xa1, 0x2e, 0x21,
    0xd5, 0x14, 0xb2, 0x54, 0x66, 0x93, 0x1c, 0x7d, 0x8f, 0x6a, 0x5a,
    0xac, 0x84, 0xaa, 0x05, 0x1b, 0xa3, 0x0b, 0x39, 0x6a, 0x0a, 0xac,
    0x97, 0x3d, 0x58, 0xe0, 0x91, 0x47, 0x3f, 0x59, 0x85};
 
/**
 * AES-GCM test case 10 from "The Galois/Counter Mode of Operation (GCM)" by
 * McGrew and Viega (linked document also shows intermediate values, helpful
 * for debugging):
 * https://csrc.nist.rip/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf
 *
 * key = feffe9928665731c6d6a8f9467308308feffe9928665731c
 * iv = cafebabefacedbaddecaf888
 * plaintext =
 * d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39
 * aad = feedfacedeadbeeffeedfacedeadbeefabaddad2
 * ciphertext =
 * 3980ca0b3c00e841eb06fac4872a2757859e1ceaa6efd984628593b40ca1e19c7d773d00c144c525ac619d18c84a3f4718e2448b2fe324d9ccda2710
 * tag = 3a337dbf46a792c45e454913fe2ea8f2
 */
static const uint32_t kMVTestCase10Key[] = {0x92e9fffe, 0x1c736586, 0x948f6a6d,
                                            0x08833067, 0x92e9fffe, 0x1c736586};
static uint8_t kMVTestCase10Aad[] = {0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad, 0xbe,
                                     0xef, 0xfe, 0xed, 0xfa, 0xce, 0xde, 0xad,
                                     0xbe, 0xef, 0xab, 0xad, 0xda, 0xd2};
static uint8_t kMVTestCase10Plaintext[] = {
    0xd9, 0x31, 0x32, 0x25, 0xf8, 0x84, 0x06, 0xe5, 0xa5, 0x59, 0x09, 0xc5,
    0xaf, 0xf5, 0x26, 0x9a, 0x86, 0xa7, 0xa9, 0x53, 0x15, 0x34, 0xf7, 0xda,
    0x2e, 0x4c, 0x30, 0x3d, 0x8a, 0x31, 0x8a, 0x72, 0x1c, 0x3c, 0x0c, 0x95,
    0x95, 0x68, 0x09, 0x53, 0x2f, 0xcf, 0x0e, 0x24, 0x49, 0xa6, 0xb5, 0x25,
    0xb1, 0x6a, 0xed, 0xf5, 0xaa, 0x0d, 0xe6, 0x57, 0xba, 0x63, 0x7b, 0x39};
static uint8_t kMVTestCase10Ciphertext[] = {
    0x39, 0x80, 0xca, 0x0b, 0x3c, 0x00, 0xe8, 0x41, 0xeb, 0x06, 0xfa, 0xc4,
    0x87, 0x2a, 0x27, 0x57, 0x85, 0x9e, 0x1c, 0xea, 0xa6, 0xef, 0xd9, 0x84,
    0x62, 0x85, 0x93, 0xb4, 0x0c, 0xa1, 0xe1, 0x9c, 0x7d, 0x77, 0x3d, 0x00,
    0xc1, 0x44, 0xc5, 0x25, 0xac, 0x61, 0x9d, 0x18, 0xc8, 0x4a, 0x3f, 0x47,
    0x18, 0xe2, 0x44, 0x8b, 0x2f, 0xe3, 0x24, 0xd9, 0xcc, 0xda, 0x27, 0x10};
 
aes_gcm_test_t kAesGcmTestvectors[] = {
    // Empty input, empty aad, 96-bit IV, 128-bit key
    {
        .key_len = ARRAYSIZE(kKey128),
        .key = kKey128,
        .iv_len = 12,
        .iv =
            {// IV = 22294cae82d82e44427dfcc3
             0x22, 0x29, 0x4c, 0xae, 0x82, 0xd8, 0x2e, 0x44, 0x42, 0x7d, 0xfc,
             0xc3},
        .plaintext_len = 0,
        .plaintext = NULL,
        .aad_len = 0,
        .aad = NULL,
        .ciphertext = NULL,
        .tag_len = 16,
        .tag =
            {// Tag = b7aa223a6c75a0976633ce79d9fddf06
             0xb7, 0xaa, 0x22, 0x3a, 0x6c, 0x75, 0xa0, 0x97, 0x66, 0x33, 0xce,
             0x79, 0xd9, 0xfd, 0xdf, 0x06},
    },
 
    // Empty input, empty aad, 128-bit IV, 128-bit key
    {
        .key_len = ARRAYSIZE(kKey128),
        .key = kKey128,
        .iv_len = 16,
        .iv =
            {// IV = 22294cae82d82e44427dfcc33bacdbec
             0x22, 0x29, 0x4c, 0xae, 0x82, 0xd8, 0x2e, 0x44, 0x42, 0x7d, 0xfc,
             0xc3, 0x3b, 0xac, 0xdb, 0xec},
        .plaintext_len = 0,
        .plaintext = NULL,
        .aad_len = 0,
        .aad = NULL,
        .ciphertext = NULL,
        .tag_len = 16,
        .tag =
            {// Tag = 4c59f0d420d9eb8669c40ad23b5419ba
             0x4c, 0x59, 0xf0, 0xd4, 0x20, 0xd9, 0xeb, 0x86, 0x69, 0xc4, 0x0a,
             0xd2, 0x3b, 0x54, 0x19, 0xba},
    },
 
    // 128-bit IV, 256-bit key, real message and aad
    {
        .key_len = ARRAYSIZE(kKey256),
        .key = kKey256,
        .iv_len = 16,
        .iv =
            {// IV = c58aded2e1bbecba8b16a5757e5475bd
             0xc5, 0x8a, 0xde, 0xd2, 0xe1, 0xbb, 0xec, 0xba, 0x8b, 0x16, 0xa5,
             0x75, 0x7e, 0x54, 0x75, 0xbd},
        .plaintext_len = sizeof(kPlaintext),
        .plaintext = kPlaintext,
        .aad_len = sizeof(kAad),
        .aad = kAad,
        .ciphertext = kCiphertext256,
        .tag_len = 16,
        .tag =
            {// Tag = 324895b3d2f656e4fa2f8ce056137061
             0x32, 0x48, 0x95, 0xb3, 0xd2, 0xf6, 0x56, 0xe4, 0xfa, 0x2f, 0x8c,
             0xe0, 0x56, 0x13, 0x70, 0x61},
    },
 
    // 128-bit IV, 256-bit key, real message and aad, short tag
    {
        .key_len = ARRAYSIZE(kKey256),
        .key = kKey256,
        .iv_len = 16,
        .iv =
            {// IV = c58aded2e1bbecba8b16a5757e5475bd
             0xc5, 0x8a, 0xde, 0xd2, 0xe1, 0xbb, 0xec, 0xba, 0x8b, 0x16, 0xa5,
             0x75, 0x7e, 0x54, 0x75, 0xbd},
        .plaintext_len = sizeof(kPlaintext),
        .plaintext = kPlaintext,
        .aad_len = sizeof(kAad),
        .aad = kAad,
        .ciphertext = kCiphertext256,
        .tag_len = 12,
        .tag =
            {// Tag = 324895b3d2f656e4fa2f8ce0
             0x32, 0x48, 0x95, 0xb3, 0xd2, 0xf6, 0x56, 0xe4, 0xfa, 0x2f, 0x8c,
             0xe0, 0, 0, 0, 0},
    },
 
    // McGrew and Viega test case 3
    {
        .key_len = ARRAYSIZE(kMVTestCase3Key),
        .key = kMVTestCase3Key,
        .iv_len = 12,
        .iv = {0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8,
               0x88},
        .plaintext_len = sizeof(kMVTestCase3Plaintext),
        .plaintext = kMVTestCase3Plaintext,
        .aad_len = 0,
        .aad = NULL,
        .ciphertext = kMVTestCase3Ciphertext,
        .tag_len = 16,
        .tag = {0x4d, 0x5c, 0x2a, 0xf3, 0x27, 0xcd, 0x64, 0xa6, 0x2c, 0xf3,
                0x5a, 0xbd, 0x2b, 0xa6, 0xfa, 0xb4},
    },
 
    // McGrew and Viega test case 10
    {
        .key_len = ARRAYSIZE(kMVTestCase10Key),
        .key = kMVTestCase10Key,
        .iv_len = 12,
        .iv = {0xca, 0xfe, 0xba, 0xbe, 0xfa, 0xce, 0xdb, 0xad, 0xde, 0xca, 0xf8,
               0x88},
        .plaintext_len = sizeof(kMVTestCase10Plaintext),
        .plaintext = kMVTestCase10Plaintext,
        .aad_len = sizeof(kMVTestCase10Aad),
        .aad = kMVTestCase10Aad,
        .ciphertext = kMVTestCase10Ciphertext,
        .tag_len = 16,
        .tag = {0x25, 0x19, 0x49, 0x8e, 0x80, 0xf1, 0x47, 0x8f, 0x37, 0xba,
                0x55, 0xbd, 0x6d, 0x27, 0x61, 0x8c},
    },
};
 
#ifdef __cplusplus
}  // extern "C"
#endif  // __cplusplus
 
#endif  // OPENTITAN_SW_DEVICE_TESTS_CRYPTO_AES_GCM_TESTVECTORS_H_