ea72bd0b60
The EVP_CIPHER codepath should no longer be used with TLS. It still exists for DTLS and SSLv3. The AEAD construction in TLS does not allow for variable-overhead AEADs, so stateful AEADs do not include the length in the ad parameter. Rather the AEADs internally append the unpadded length once it is known. EVP_aead_rc4_md5_tls is modified to account for this. Tests are added (and RC4-MD5's regenerated) for each of the new AEADs. The cipher tests are all moved into crypto/cipher/test because there's now a lot of them and they clutter the directory listing. In ssl/, the stateful AEAD logic is also modified to account for stateful AEADs with a fixed IV component, and for AEADs which use a random nonce (for the explicit-IV CBC mode ciphers). The new implementation fixes a bug/quirk in stateless CBC mode ciphers where the fixed IV portion of the keyblock was generated regardless. This is at the end, so it's only relevant for EAP-TLS which generates a MSK from the end of the key block. Change-Id: I2d8b8aa11deb43bde2fd733f4f90b5d5b8cb1334 Reviewed-on: https://boringssl-review.googlesource.com/2692 Reviewed-by: Adam Langley <agl@google.com>
24 lines
740 B
Plaintext
24 lines
740 B
Plaintext
# These test vectors have been taken from
|
|
# http://csrc.nist.gov/groups/ST/toolkit/documents/kms/key-wrap.pdf
|
|
|
|
KEY: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
|
|
NONCE:
|
|
IN: 00112233445566778899AABBCCDDEEFF
|
|
AD:
|
|
CT: 64E8C3F9CE0F5BA263E9777905818A2A
|
|
TAG: 93C8191E7D6E8AE7
|
|
|
|
KEY: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
|
|
NONCE:
|
|
IN: 00112233445566778899AABBCCDDEEFF0001020304050607
|
|
AD:
|
|
CT: A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB895
|
|
TAG: 8CD5D17D6B254DA1
|
|
|
|
KEY: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
|
|
NONCE:
|
|
IN: 00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F
|
|
AD:
|
|
CT: 28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43B
|
|
TAG: FB988B9B7A02DD21
|