sha3_test.go 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306
  1. // Copyright 2014 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. package sha3
  5. // Tests include all the ShortMsgKATs provided by the Keccak team at
  6. // https://github.com/gvanas/KeccakCodePackage
  7. //
  8. // They only include the zero-bit case of the bitwise testvectors
  9. // published by NIST in the draft of FIPS-202.
  10. import (
  11. "bytes"
  12. "compress/flate"
  13. "encoding/hex"
  14. "encoding/json"
  15. "hash"
  16. "os"
  17. "strings"
  18. "testing"
  19. )
  20. const (
  21. testString = "brekeccakkeccak koax koax"
  22. katFilename = "testdata/keccakKats.json.deflate"
  23. )
  24. // Internal-use instances of SHAKE used to test against KATs.
  25. func newHashShake128() hash.Hash {
  26. return &state{rate: 168, dsbyte: 0x1f, outputLen: 512}
  27. }
  28. func newHashShake256() hash.Hash {
  29. return &state{rate: 136, dsbyte: 0x1f, outputLen: 512}
  30. }
  31. // testDigests contains functions returning hash.Hash instances
  32. // with output-length equal to the KAT length for both SHA-3 and
  33. // SHAKE instances.
  34. var testDigests = map[string]func() hash.Hash{
  35. "SHA3-224": New224,
  36. "SHA3-256": New256,
  37. "SHA3-384": New384,
  38. "SHA3-512": New512,
  39. "SHAKE128": newHashShake128,
  40. "SHAKE256": newHashShake256,
  41. }
  42. // testShakes contains functions that return ShakeHash instances for
  43. // testing the ShakeHash-specific interface.
  44. var testShakes = map[string]func() ShakeHash{
  45. "SHAKE128": NewShake128,
  46. "SHAKE256": NewShake256,
  47. }
  48. // decodeHex converts a hex-encoded string into a raw byte string.
  49. func decodeHex(s string) []byte {
  50. b, err := hex.DecodeString(s)
  51. if err != nil {
  52. panic(err)
  53. }
  54. return b
  55. }
  56. // structs used to marshal JSON test-cases.
  57. type KeccakKats struct {
  58. Kats map[string][]struct {
  59. Digest string `json:"digest"`
  60. Length int64 `json:"length"`
  61. Message string `json:"message"`
  62. }
  63. }
  64. func testUnalignedAndGeneric(t *testing.T, testf func(impl string)) {
  65. xorInOrig, copyOutOrig := xorIn, copyOut
  66. xorIn, copyOut = xorInGeneric, copyOutGeneric
  67. testf("generic")
  68. if xorImplementationUnaligned != "generic" {
  69. xorIn, copyOut = xorInUnaligned, copyOutUnaligned
  70. testf("unaligned")
  71. }
  72. xorIn, copyOut = xorInOrig, copyOutOrig
  73. }
  74. // TestKeccakKats tests the SHA-3 and Shake implementations against all the
  75. // ShortMsgKATs from https://github.com/gvanas/KeccakCodePackage
  76. // (The testvectors are stored in keccakKats.json.deflate due to their length.)
  77. func TestKeccakKats(t *testing.T) {
  78. testUnalignedAndGeneric(t, func(impl string) {
  79. // Read the KATs.
  80. deflated, err := os.Open(katFilename)
  81. if err != nil {
  82. t.Errorf("error opening %s: %s", katFilename, err)
  83. }
  84. file := flate.NewReader(deflated)
  85. dec := json.NewDecoder(file)
  86. var katSet KeccakKats
  87. err = dec.Decode(&katSet)
  88. if err != nil {
  89. t.Errorf("error decoding KATs: %s", err)
  90. }
  91. // Do the KATs.
  92. for functionName, kats := range katSet.Kats {
  93. d := testDigests[functionName]()
  94. for _, kat := range kats {
  95. d.Reset()
  96. in, err := hex.DecodeString(kat.Message)
  97. if err != nil {
  98. t.Errorf("error decoding KAT: %s", err)
  99. }
  100. d.Write(in[:kat.Length/8])
  101. got := strings.ToUpper(hex.EncodeToString(d.Sum(nil)))
  102. if got != kat.Digest {
  103. t.Errorf("function=%s, implementation=%s, length=%d\nmessage:\n %s\ngot:\n %s\nwanted:\n %s",
  104. functionName, impl, kat.Length, kat.Message, got, kat.Digest)
  105. t.Logf("wanted %+v", kat)
  106. t.FailNow()
  107. }
  108. continue
  109. }
  110. }
  111. })
  112. }
  113. // TestUnalignedWrite tests that writing data in an arbitrary pattern with
  114. // small input buffers.
  115. func testUnalignedWrite(t *testing.T) {
  116. testUnalignedAndGeneric(t, func(impl string) {
  117. buf := sequentialBytes(0x10000)
  118. for alg, df := range testDigests {
  119. d := df()
  120. d.Reset()
  121. d.Write(buf)
  122. want := d.Sum(nil)
  123. d.Reset()
  124. for i := 0; i < len(buf); {
  125. // Cycle through offsets which make a 137 byte sequence.
  126. // Because 137 is prime this sequence should exercise all corner cases.
  127. offsets := [17]int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 1}
  128. for _, j := range offsets {
  129. if v := len(buf) - i; v < j {
  130. j = v
  131. }
  132. d.Write(buf[i : i+j])
  133. i += j
  134. }
  135. }
  136. got := d.Sum(nil)
  137. if !bytes.Equal(got, want) {
  138. t.Errorf("Unaligned writes, implementation=%s, alg=%s\ngot %q, want %q", impl, alg, got, want)
  139. }
  140. }
  141. })
  142. }
  143. // TestAppend checks that appending works when reallocation is necessary.
  144. func TestAppend(t *testing.T) {
  145. testUnalignedAndGeneric(t, func(impl string) {
  146. d := New224()
  147. for capacity := 2; capacity <= 66; capacity += 64 {
  148. // The first time around the loop, Sum will have to reallocate.
  149. // The second time, it will not.
  150. buf := make([]byte, 2, capacity)
  151. d.Reset()
  152. d.Write([]byte{0xcc})
  153. buf = d.Sum(buf)
  154. expected := "0000DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"
  155. if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {
  156. t.Errorf("got %s, want %s", got, expected)
  157. }
  158. }
  159. })
  160. }
  161. // TestAppendNoRealloc tests that appending works when no reallocation is necessary.
  162. func TestAppendNoRealloc(t *testing.T) {
  163. testUnalignedAndGeneric(t, func(impl string) {
  164. buf := make([]byte, 1, 200)
  165. d := New224()
  166. d.Write([]byte{0xcc})
  167. buf = d.Sum(buf)
  168. expected := "00DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"
  169. if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {
  170. t.Errorf("%s: got %s, want %s", impl, got, expected)
  171. }
  172. })
  173. }
  174. // TestSqueezing checks that squeezing the full output a single time produces
  175. // the same output as repeatedly squeezing the instance.
  176. func TestSqueezing(t *testing.T) {
  177. testUnalignedAndGeneric(t, func(impl string) {
  178. for functionName, newShakeHash := range testShakes {
  179. d0 := newShakeHash()
  180. d0.Write([]byte(testString))
  181. ref := make([]byte, 32)
  182. d0.Read(ref)
  183. d1 := newShakeHash()
  184. d1.Write([]byte(testString))
  185. var multiple []byte
  186. for _ = range ref {
  187. one := make([]byte, 1)
  188. d1.Read(one)
  189. multiple = append(multiple, one...)
  190. }
  191. if !bytes.Equal(ref, multiple) {
  192. t.Errorf("%s (%s): squeezing %d bytes one at a time failed", functionName, impl, len(ref))
  193. }
  194. }
  195. })
  196. }
  197. // sequentialBytes produces a buffer of size consecutive bytes 0x00, 0x01, ..., used for testing.
  198. func sequentialBytes(size int) []byte {
  199. result := make([]byte, size)
  200. for i := range result {
  201. result[i] = byte(i)
  202. }
  203. return result
  204. }
  205. // BenchmarkPermutationFunction measures the speed of the permutation function
  206. // with no input data.
  207. func BenchmarkPermutationFunction(b *testing.B) {
  208. b.SetBytes(int64(200))
  209. var lanes [25]uint64
  210. for i := 0; i < b.N; i++ {
  211. keccakF1600(&lanes)
  212. }
  213. }
  214. // benchmarkHash tests the speed to hash num buffers of buflen each.
  215. func benchmarkHash(b *testing.B, h hash.Hash, size, num int) {
  216. b.StopTimer()
  217. h.Reset()
  218. data := sequentialBytes(size)
  219. b.SetBytes(int64(size * num))
  220. b.StartTimer()
  221. var state []byte
  222. for i := 0; i < b.N; i++ {
  223. for j := 0; j < num; j++ {
  224. h.Write(data)
  225. }
  226. state = h.Sum(state[:0])
  227. }
  228. b.StopTimer()
  229. h.Reset()
  230. }
  231. // benchmarkShake is specialized to the Shake instances, which don't
  232. // require a copy on reading output.
  233. func benchmarkShake(b *testing.B, h ShakeHash, size, num int) {
  234. b.StopTimer()
  235. h.Reset()
  236. data := sequentialBytes(size)
  237. d := make([]byte, 32)
  238. b.SetBytes(int64(size * num))
  239. b.StartTimer()
  240. for i := 0; i < b.N; i++ {
  241. h.Reset()
  242. for j := 0; j < num; j++ {
  243. h.Write(data)
  244. }
  245. h.Read(d)
  246. }
  247. }
  248. func BenchmarkSha3_512_MTU(b *testing.B) { benchmarkHash(b, New512(), 1350, 1) }
  249. func BenchmarkSha3_384_MTU(b *testing.B) { benchmarkHash(b, New384(), 1350, 1) }
  250. func BenchmarkSha3_256_MTU(b *testing.B) { benchmarkHash(b, New256(), 1350, 1) }
  251. func BenchmarkSha3_224_MTU(b *testing.B) { benchmarkHash(b, New224(), 1350, 1) }
  252. func BenchmarkShake128_MTU(b *testing.B) { benchmarkShake(b, NewShake128(), 1350, 1) }
  253. func BenchmarkShake256_MTU(b *testing.B) { benchmarkShake(b, NewShake256(), 1350, 1) }
  254. func BenchmarkShake256_16x(b *testing.B) { benchmarkShake(b, NewShake256(), 16, 1024) }
  255. func BenchmarkShake256_1MiB(b *testing.B) { benchmarkShake(b, NewShake256(), 1024, 1024) }
  256. func BenchmarkSha3_512_1MiB(b *testing.B) { benchmarkHash(b, New512(), 1024, 1024) }
  257. func Example_sum() {
  258. buf := []byte("some data to hash")
  259. // A hash needs to be 64 bytes long to have 256-bit collision resistance.
  260. h := make([]byte, 64)
  261. // Compute a 64-byte hash of buf and put it in h.
  262. ShakeSum256(h, buf)
  263. }
  264. func Example_mac() {
  265. k := []byte("this is a secret key; you should generate a strong random key that's at least 32 bytes long")
  266. buf := []byte("and this is some data to authenticate")
  267. // A MAC with 32 bytes of output has 256-bit security strength -- if you use at least a 32-byte-long key.
  268. h := make([]byte, 32)
  269. d := NewShake256()
  270. // Write the key into the hash.
  271. d.Write(k)
  272. // Now write the data.
  273. d.Write(buf)
  274. // Read 32 bytes of output from the hash into h.
  275. d.Read(h)
  276. }