crypto_chacha20.cpp raw
1 // Copyright (c) 2020-present The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5 #include <crypto/chacha20.h>
6 #include <random.h>
7 #include <test/fuzz/FuzzedDataProvider.h>
8 #include <test/fuzz/fuzz.h>
9 #include <test/fuzz/util.h>
10
11 #include <array>
12 #include <cstddef>
13 #include <cstdint>
14 #include <vector>
15
16 FUZZ_TARGET(crypto_chacha20)
17 {
18 FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
19
20 const auto key = ConsumeFixedLengthByteVector<std::byte>(fuzzed_data_provider, ChaCha20::KEYLEN);
21 ChaCha20 chacha20{key};
22
23 LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
24 CallOneOf(
25 fuzzed_data_provider,
26 [&] {
27 auto key = ConsumeFixedLengthByteVector<std::byte>(fuzzed_data_provider, ChaCha20::KEYLEN);
28 chacha20.SetKey(key);
29 },
30 [&] {
31 ChaCha20::Nonce96 nonce{
32 fuzzed_data_provider.ConsumeIntegral<uint32_t>(),
33 fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
34 chacha20.Seek(nonce, fuzzed_data_provider.ConsumeIntegral<uint32_t>());
35 },
36 [&] {
37 std::vector<uint8_t> output(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
38 chacha20.Keystream(MakeWritableByteSpan(output));
39 },
40 [&] {
41 std::vector<std::byte> output(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4096));
42 const auto input = ConsumeFixedLengthByteVector<std::byte>(fuzzed_data_provider, output.size());
43 chacha20.Crypt(input, output);
44 });
45 }
46 }
47
48 namespace
49 {
50
51 /** Fuzzer that invokes ChaCha20::Crypt() or ChaCha20::Keystream multiple times:
52 once for a large block at once, and then the same data in chunks, comparing
53 the outcome.
54
55 If UseCrypt, seeded InsecureRandomContext output is used as input to Crypt().
56 If not, Keystream() is used directly, or sequences of 0x00 are encrypted.
57 */
58 template<bool UseCrypt>
59 void ChaCha20SplitFuzz(FuzzedDataProvider& provider)
60 {
61 // Determine key, iv, start position, length.
62 auto key_bytes = ConsumeFixedLengthByteVector<std::byte>(provider, ChaCha20::KEYLEN);
63 uint64_t iv = provider.ConsumeIntegral<uint64_t>();
64 uint32_t iv_prefix = provider.ConsumeIntegral<uint32_t>();
65 uint64_t total_bytes = provider.ConsumeIntegralInRange<uint64_t>(0, 1000000);
66 /* ~x = 2^BITS - 1 - x, so ~(total_bytes >> 6) is the maximal seek position. */
67 uint32_t seek = provider.ConsumeIntegralInRange<uint32_t>(0, ~(uint32_t)(total_bytes >> 6));
68
69 // Initialize two ChaCha20 ciphers, with the same key/iv/position.
70 ChaCha20 crypt1(key_bytes);
71 ChaCha20 crypt2(key_bytes);
72 crypt1.Seek({iv_prefix, iv}, seek);
73 crypt2.Seek({iv_prefix, iv}, seek);
74
75 // Construct vectors with data.
76 std::vector<std::byte> data1, data2;
77 data1.resize(total_bytes);
78 data2.resize(total_bytes);
79
80 // If using Crypt(), initialize data1 and data2 with the same InsecureRandomContext based
81 // stream.
82 if constexpr (UseCrypt) {
83 InsecureRandomContext(provider.ConsumeIntegral<uint64_t>()).fillrand(data1);
84 std::copy(data1.begin(), data1.end(), data2.begin());
85 }
86
87 // Whether UseCrypt is used or not, the two byte arrays must match.
88 assert(data1 == data2);
89
90 // Encrypt data1, the whole array at once.
91 if constexpr (UseCrypt) {
92 crypt1.Crypt(data1, data1);
93 } else {
94 crypt1.Keystream(data1);
95 }
96
97 // Encrypt data2, in at most 256 chunks.
98 uint64_t bytes2 = 0;
99 int iter = 0;
100 while (true) {
101 bool is_last = (iter == 255) || (bytes2 == total_bytes) || provider.ConsumeBool();
102 ++iter;
103 // Determine how many bytes to encrypt in this chunk: a fuzzer-determined
104 // amount for all but the last chunk (which processes all remaining bytes).
105 uint64_t now = is_last ? total_bytes - bytes2 :
106 provider.ConsumeIntegralInRange<uint64_t>(0, total_bytes - bytes2);
107 // For each chunk, consider using Crypt() even when UseCrypt is false.
108 // This tests that Keystream() has the same behavior as Crypt() applied
109 // to 0x00 input bytes.
110 if (UseCrypt || provider.ConsumeBool()) {
111 crypt2.Crypt(std::span{data2}.subspan(bytes2, now), std::span{data2}.subspan(bytes2, now));
112 } else {
113 crypt2.Keystream(std::span{data2}.subspan(bytes2, now));
114 }
115 bytes2 += now;
116 if (is_last) break;
117 }
118 // We should have processed everything now.
119 assert(bytes2 == total_bytes);
120 // And the result should match.
121 assert(data1 == data2);
122 }
123
124 } // namespace
125
126 FUZZ_TARGET(chacha20_split_crypt)
127 {
128 FuzzedDataProvider provider{buffer.data(), buffer.size()};
129 ChaCha20SplitFuzz<true>(provider);
130 }
131
132 FUZZ_TARGET(chacha20_split_keystream)
133 {
134 FuzzedDataProvider provider{buffer.data(), buffer.size()};
135 ChaCha20SplitFuzz<false>(provider);
136 }
137
138 FUZZ_TARGET(crypto_fschacha20)
139 {
140 FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
141
142 auto key = fuzzed_data_provider.ConsumeBytes<std::byte>(FSChaCha20::KEYLEN);
143 key.resize(FSChaCha20::KEYLEN);
144
145 auto fsc20 = FSChaCha20{key, fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, 1024)};
146
147 LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000)
148 {
149 auto input = fuzzed_data_provider.ConsumeBytes<std::byte>(fuzzed_data_provider.ConsumeIntegralInRange(0, 4096));
150 std::vector<std::byte> output;
151 output.resize(input.size());
152 fsc20.Crypt(input, output);
153 }
154 }
155