diff options
Diffstat (limited to 'tests/hazmat')
-rw-r--r-- | tests/hazmat/backends/test_commoncrypto.py | 2 | ||||
-rw-r--r-- | tests/hazmat/backends/test_multibackend.py | 2 | ||||
-rw-r--r-- | tests/hazmat/backends/test_openssl.py | 16 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_aes.py | 2 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_block.py | 2 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_ciphers.py | 2 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_hkdf.py | 4 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_hmac.py | 2 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_pbkdf2hmac.py | 4 | ||||
-rw-r--r-- | tests/hazmat/primitives/test_rsa.py | 186 | ||||
-rw-r--r-- | tests/hazmat/primitives/twofactor/test_hotp.py | 5 | ||||
-rw-r--r-- | tests/hazmat/primitives/twofactor/test_totp.py | 3 | ||||
-rw-r--r-- | tests/hazmat/primitives/utils.py | 40 |
13 files changed, 183 insertions, 87 deletions
diff --git a/tests/hazmat/backends/test_commoncrypto.py b/tests/hazmat/backends/test_commoncrypto.py index 1062b2ba..72ed61c0 100644 --- a/tests/hazmat/backends/test_commoncrypto.py +++ b/tests/hazmat/backends/test_commoncrypto.py @@ -16,7 +16,7 @@ from __future__ import absolute_import, division, print_function import pytest from cryptography import utils -from cryptography.exceptions import UnsupportedCipher, InternalError +from cryptography.exceptions import InternalError, UnsupportedCipher from cryptography.hazmat.bindings.commoncrypto.binding import Binding from cryptography.hazmat.primitives import interfaces from cryptography.hazmat.primitives.ciphers.algorithms import AES diff --git a/tests/hazmat/backends/test_multibackend.py b/tests/hazmat/backends/test_multibackend.py index 31fb0a26..c5c0d82a 100644 --- a/tests/hazmat/backends/test_multibackend.py +++ b/tests/hazmat/backends/test_multibackend.py @@ -20,7 +20,7 @@ from cryptography.exceptions import ( UnsupportedAlgorithm, UnsupportedCipher, UnsupportedHash ) from cryptography.hazmat.backends.interfaces import ( - CipherBackend, HashBackend, HMACBackend, PBKDF2HMACBackend, RSABackend + CipherBackend, HMACBackend, HashBackend, PBKDF2HMACBackend, RSABackend ) from cryptography.hazmat.backends.multibackend import MultiBackend from cryptography.hazmat.primitives import hashes, hmac diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py index ebabd5f1..3747f436 100644 --- a/tests/hazmat/backends/test_openssl.py +++ b/tests/hazmat/backends/test_openssl.py @@ -17,11 +17,11 @@ import pytest from cryptography import utils from cryptography.exceptions import ( - UnsupportedCipher, UnsupportedHash, InternalError + InternalError, UnsupportedCipher, UnsupportedHash ) -from cryptography.hazmat.backends.openssl.backend import backend, Backend -from cryptography.hazmat.primitives import interfaces, hashes -from cryptography.hazmat.primitives.asymmetric import rsa, padding +from cryptography.hazmat.backends.openssl.backend import Backend, backend +from cryptography.hazmat.primitives import hashes, interfaces +from cryptography.hazmat.primitives.asymmetric import padding, rsa from cryptography.hazmat.primitives.ciphers import Cipher from cryptography.hazmat.primitives.ciphers.algorithms import AES from cryptography.hazmat.primitives.ciphers.modes import CBC @@ -40,6 +40,11 @@ class DummyCipher(object): name = "dummy-cipher" +@utils.register_interface(interfaces.HashAlgorithm) +class DummyHash(object): + name = "dummy-hash" + + class TestOpenSSL(object): def test_backend_exists(self): assert backend @@ -173,6 +178,9 @@ class TestOpenSSL(object): backend ) + def test_unsupported_mgf1_hash_algorithm(self): + assert backend.mgf1_hash_supported(DummyHash()) is False + # This test is not in the next class because to check if it's really # default we don't want to run the setup_method before it def test_osrandom_engine_is_default(self): diff --git a/tests/hazmat/primitives/test_aes.py b/tests/hazmat/primitives/test_aes.py index ad3626af..03be268d 100644 --- a/tests/hazmat/primitives/test_aes.py +++ b/tests/hazmat/primitives/test_aes.py @@ -20,7 +20,7 @@ import pytest from cryptography.hazmat.primitives.ciphers import algorithms, modes -from .utils import generate_encrypt_test, generate_aead_test +from .utils import generate_aead_test, generate_encrypt_test from ...utils import load_nist_vectors diff --git a/tests/hazmat/primitives/test_block.py b/tests/hazmat/primitives/test_block.py index 8ff00fd9..f2dab6cf 100644 --- a/tests/hazmat/primitives/test_block.py +++ b/tests/hazmat/primitives/test_block.py @@ -18,7 +18,7 @@ import binascii import pytest from cryptography import utils -from cryptography.exceptions import UnsupportedCipher, AlreadyFinalized +from cryptography.exceptions import AlreadyFinalized, UnsupportedCipher from cryptography.hazmat.primitives import interfaces from cryptography.hazmat.primitives.ciphers import ( Cipher, algorithms, modes diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py index bd9625e9..1bea0bdb 100644 --- a/tests/hazmat/primitives/test_ciphers.py +++ b/tests/hazmat/primitives/test_ciphers.py @@ -20,7 +20,7 @@ import pytest from cryptography.exceptions import UnsupportedInterface from cryptography.hazmat.primitives import ciphers from cryptography.hazmat.primitives.ciphers.algorithms import ( - AES, Camellia, TripleDES, Blowfish, ARC4, CAST5, IDEA + AES, ARC4, Blowfish, CAST5, Camellia, IDEA, TripleDES ) from cryptography.hazmat.primitives.ciphers.modes import ECB diff --git a/tests/hazmat/primitives/test_hkdf.py b/tests/hazmat/primitives/test_hkdf.py index 963fb69c..367addc9 100644 --- a/tests/hazmat/primitives/test_hkdf.py +++ b/tests/hazmat/primitives/test_hkdf.py @@ -13,10 +13,10 @@ from __future__ import absolute_import, division, print_function -import six - import pytest +import six + from cryptography.exceptions import ( AlreadyFinalized, InvalidKey, UnsupportedInterface ) diff --git a/tests/hazmat/primitives/test_hmac.py b/tests/hazmat/primitives/test_hmac.py index 3589e6ac..1065359a 100644 --- a/tests/hazmat/primitives/test_hmac.py +++ b/tests/hazmat/primitives/test_hmac.py @@ -21,7 +21,7 @@ import six from cryptography import utils from cryptography.exceptions import ( - AlreadyFinalized, UnsupportedHash, InvalidSignature, UnsupportedInterface + AlreadyFinalized, InvalidSignature, UnsupportedHash, UnsupportedInterface ) from cryptography.hazmat.backends.interfaces import HMACBackend from cryptography.hazmat.primitives import hashes, hmac, interfaces diff --git a/tests/hazmat/primitives/test_pbkdf2hmac.py b/tests/hazmat/primitives/test_pbkdf2hmac.py index bf1e7f14..585693ea 100644 --- a/tests/hazmat/primitives/test_pbkdf2hmac.py +++ b/tests/hazmat/primitives/test_pbkdf2hmac.py @@ -18,11 +18,11 @@ import six from cryptography import utils from cryptography.exceptions import ( - InvalidKey, UnsupportedHash, AlreadyFinalized, UnsupportedInterface + AlreadyFinalized, InvalidKey, UnsupportedHash, UnsupportedInterface ) +from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import hashes, interfaces from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC -from cryptography.hazmat.backends import default_backend @utils.register_interface(interfaces.HashAlgorithm) diff --git a/tests/hazmat/primitives/test_rsa.py b/tests/hazmat/primitives/test_rsa.py index 34f49f94..957e70a3 100644 --- a/tests/hazmat/primitives/test_rsa.py +++ b/tests/hazmat/primitives/test_rsa.py @@ -26,11 +26,11 @@ from cryptography.exceptions import ( UnsupportedAlgorithm, UnsupportedInterface ) from cryptography.hazmat.primitives import hashes, interfaces -from cryptography.hazmat.primitives.asymmetric import rsa, padding +from cryptography.hazmat.primitives.asymmetric import padding, rsa -from .utils import generate_rsa_pss_test, rsa_pss_signing_test +from .utils import generate_rsa_verification_test, rsa_pss_signing_test from ...utils import ( - load_pkcs1_vectors, load_vectors_from_file, load_rsa_nist_vectors + load_pkcs1_vectors, load_rsa_nist_vectors, load_vectors_from_file ) @@ -934,89 +934,175 @@ class TestRSAVerification(object): verifier.verify() -@pytest.mark.supported( - only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA1()), - skip_message="Does not support SHA1 with MGF1." -) @pytest.mark.rsa -class TestRSAPSSMGF1VerificationSHA1(object): - test_rsa_pss_mgf1_sha1 = generate_rsa_pss_test( +class TestRSAPSSMGF1Verification(object): + test_rsa_pss_mgf1_sha1 = pytest.mark.supported( + only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA1()), + skip_message="Does not support SHA1 with MGF1." + )(generate_rsa_verification_test( load_rsa_nist_vectors, os.path.join("asymmetric", "RSA", "FIPS_186-2"), [ "SigGenPSS_186-2.rsp", "SigGenPSS_186-3.rsp", + "SigVerPSS_186-3.rsp", ], - hashes.SHA1() - ) - + hashes.SHA1(), + lambda params, hash_alg: padding.PSS( + mgf=padding.MGF1( + algorithm=hash_alg, + salt_length=params["salt_length"] + ) + ) + )) -@pytest.mark.supported( - only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA224()), - skip_message="Does not support SHA224 with MGF1." -) -@pytest.mark.rsa -class TestRSAPSSMGF1VerificationSHA224(object): - test_rsa_pss_mgf1_sha224 = generate_rsa_pss_test( + test_rsa_pss_mgf1_sha224 = pytest.mark.supported( + only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA224()), + skip_message="Does not support SHA224 with MGF1." + )(generate_rsa_verification_test( load_rsa_nist_vectors, os.path.join("asymmetric", "RSA", "FIPS_186-2"), [ "SigGenPSS_186-2.rsp", "SigGenPSS_186-3.rsp", + "SigVerPSS_186-3.rsp", ], - hashes.SHA224() - ) - + hashes.SHA224(), + lambda params, hash_alg: padding.PSS( + mgf=padding.MGF1( + algorithm=hash_alg, + salt_length=params["salt_length"] + ) + ) + )) -@pytest.mark.supported( - only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA256()), - skip_message="Does not support SHA256 with MGF1." -) -@pytest.mark.rsa -class TestRSAPSSMGF1VerificationSHA256(object): - test_rsa_pss_mgf1_sha256 = generate_rsa_pss_test( + test_rsa_pss_mgf1_sha256 = pytest.mark.supported( + only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA256()), + skip_message="Does not support SHA256 with MGF1." + )(generate_rsa_verification_test( load_rsa_nist_vectors, os.path.join("asymmetric", "RSA", "FIPS_186-2"), [ "SigGenPSS_186-2.rsp", "SigGenPSS_186-3.rsp", + "SigVerPSS_186-3.rsp", ], - hashes.SHA256() - ) + hashes.SHA256(), + lambda params, hash_alg: padding.PSS( + mgf=padding.MGF1( + algorithm=hash_alg, + salt_length=params["salt_length"] + ) + ) + )) + test_rsa_pss_mgf1_sha384 = pytest.mark.supported( + only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA384()), + skip_message="Does not support SHA384 with MGF1." + )(generate_rsa_verification_test( + load_rsa_nist_vectors, + os.path.join("asymmetric", "RSA", "FIPS_186-2"), + [ + "SigGenPSS_186-2.rsp", + "SigGenPSS_186-3.rsp", + "SigVerPSS_186-3.rsp", + ], + hashes.SHA384(), + lambda params, hash_alg: padding.PSS( + mgf=padding.MGF1( + algorithm=hash_alg, + salt_length=params["salt_length"] + ) + ) + )) -@pytest.mark.supported( - only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA384()), - skip_message="Does not support SHA384 with MGF1." -) -@pytest.mark.rsa -class TestRSAPSSMGF1VerificationSHA384(object): - test_rsa_pss_mgf1_sha384 = generate_rsa_pss_test( + test_rsa_pss_mgf1_sha512 = pytest.mark.supported( + only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA512()), + skip_message="Does not support SHA512 with MGF1." + )(generate_rsa_verification_test( load_rsa_nist_vectors, os.path.join("asymmetric", "RSA", "FIPS_186-2"), [ "SigGenPSS_186-2.rsp", "SigGenPSS_186-3.rsp", + "SigVerPSS_186-3.rsp", ], - hashes.SHA384() - ) + hashes.SHA512(), + lambda params, hash_alg: padding.PSS( + mgf=padding.MGF1( + algorithm=hash_alg, + salt_length=params["salt_length"] + ) + ) + )) -@pytest.mark.supported( - only_if=lambda backend: backend.mgf1_hash_supported(hashes.SHA512()), - skip_message="Does not support SHA512 with MGF1." -) @pytest.mark.rsa -class TestRSAPSSMGF1VerificationSHA512(object): - test_rsa_pss_mgf1_sha512 = generate_rsa_pss_test( +class TestRSAPKCS1Verification(object): + test_rsa_pkcs1v15_verify_sha1 = pytest.mark.supported( + only_if=lambda backend: backend.hash_supported(hashes.SHA1()), + skip_message="Does not support SHA1." + )(generate_rsa_verification_test( load_rsa_nist_vectors, os.path.join("asymmetric", "RSA", "FIPS_186-2"), [ - "SigGenPSS_186-2.rsp", - "SigGenPSS_186-3.rsp", + "SigVer15_186-3.rsp", ], - hashes.SHA512() - ) + hashes.SHA1(), + lambda params, hash_alg: padding.PKCS1v15() + )) + + test_rsa_pkcs1v15_verify_sha224 = pytest.mark.supported( + only_if=lambda backend: backend.hash_supported(hashes.SHA224()), + skip_message="Does not support SHA224." + )(generate_rsa_verification_test( + load_rsa_nist_vectors, + os.path.join("asymmetric", "RSA", "FIPS_186-2"), + [ + "SigVer15_186-3.rsp", + ], + hashes.SHA224(), + lambda params, hash_alg: padding.PKCS1v15() + )) + + test_rsa_pkcs1v15_verify_sha256 = pytest.mark.supported( + only_if=lambda backend: backend.hash_supported(hashes.SHA256()), + skip_message="Does not support SHA256." + )(generate_rsa_verification_test( + load_rsa_nist_vectors, + os.path.join("asymmetric", "RSA", "FIPS_186-2"), + [ + "SigVer15_186-3.rsp", + ], + hashes.SHA256(), + lambda params, hash_alg: padding.PKCS1v15() + )) + + test_rsa_pkcs1v15_verify_sha384 = pytest.mark.supported( + only_if=lambda backend: backend.hash_supported(hashes.SHA384()), + skip_message="Does not support SHA384." + )(generate_rsa_verification_test( + load_rsa_nist_vectors, + os.path.join("asymmetric", "RSA", "FIPS_186-2"), + [ + "SigVer15_186-3.rsp", + ], + hashes.SHA384(), + lambda params, hash_alg: padding.PKCS1v15() + )) + + test_rsa_pkcs1v15_verify_sha512 = pytest.mark.supported( + only_if=lambda backend: backend.hash_supported(hashes.SHA512()), + skip_message="Does not support SHA512." + )(generate_rsa_verification_test( + load_rsa_nist_vectors, + os.path.join("asymmetric", "RSA", "FIPS_186-2"), + [ + "SigVer15_186-3.rsp", + ], + hashes.SHA512(), + lambda params, hash_alg: padding.PKCS1v15() + )) class TestMGF1(object): diff --git a/tests/hazmat/primitives/twofactor/test_hotp.py b/tests/hazmat/primitives/twofactor/test_hotp.py index 548c6264..4bb7c6b3 100644 --- a/tests/hazmat/primitives/twofactor/test_hotp.py +++ b/tests/hazmat/primitives/twofactor/test_hotp.py @@ -18,10 +18,11 @@ import os import pytest from cryptography.exceptions import InvalidToken, UnsupportedInterface -from cryptography.hazmat.primitives.twofactor.hotp import HOTP from cryptography.hazmat.primitives import hashes -from tests.utils import load_vectors_from_file, load_nist_vectors from cryptography.hazmat.primitives.hashes import MD5, SHA1 +from cryptography.hazmat.primitives.twofactor.hotp import HOTP + +from ....utils import load_nist_vectors, load_vectors_from_file vectors = load_vectors_from_file( "twofactor/rfc-4226.txt", load_nist_vectors) diff --git a/tests/hazmat/primitives/twofactor/test_totp.py b/tests/hazmat/primitives/twofactor/test_totp.py index 294c19ab..d5b0a8ed 100644 --- a/tests/hazmat/primitives/twofactor/test_totp.py +++ b/tests/hazmat/primitives/twofactor/test_totp.py @@ -18,7 +18,8 @@ import pytest from cryptography.exceptions import InvalidToken, UnsupportedInterface from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.twofactor.totp import TOTP -from tests.utils import load_vectors_from_file, load_nist_vectors + +from ....utils import load_nist_vectors, load_vectors_from_file vectors = load_vectors_from_file( "twofactor/rfc-6238.txt", load_nist_vectors) diff --git a/tests/hazmat/primitives/utils.py b/tests/hazmat/primitives/utils.py index 5d3b4d15..76212daa 100644 --- a/tests/hazmat/primitives/utils.py +++ b/tests/hazmat/primitives/utils.py @@ -14,21 +14,20 @@ from __future__ import absolute_import, division, print_function import binascii -import os - import itertools +import os import pytest +from cryptography.exceptions import ( + AlreadyFinalized, AlreadyUpdated, InvalidSignature, InvalidTag, + NotYetFinalized +) from cryptography.hazmat.primitives import hashes, hmac -from cryptography.hazmat.primitives.asymmetric import rsa, padding -from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC +from cryptography.hazmat.primitives.asymmetric import padding, rsa from cryptography.hazmat.primitives.ciphers import Cipher from cryptography.hazmat.primitives.kdf.hkdf import HKDF - -from cryptography.exceptions import ( - AlreadyFinalized, NotYetFinalized, AlreadyUpdated, InvalidTag, -) +from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC from ...utils import load_vectors_from_file @@ -376,36 +375,37 @@ def generate_hkdf_test(param_loader, path, file_names, algorithm): return test_hkdf -def generate_rsa_pss_test(param_loader, path, file_names, hash_alg): +def generate_rsa_verification_test(param_loader, path, file_names, hash_alg, + pad_factory): all_params = _load_all_params(path, file_names, param_loader) all_params = [i for i in all_params if i["algorithm"] == hash_alg.name.upper()] @pytest.mark.parametrize("params", all_params) - def test_rsa_pss(self, backend, params): - rsa_pss_test(backend, params, hash_alg) + def test_rsa_verification(self, backend, params): + rsa_verification_test(backend, params, hash_alg, pad_factory) - return test_rsa_pss + return test_rsa_verification -def rsa_pss_test(backend, params, hash_alg): +def rsa_verification_test(backend, params, hash_alg, pad_factory): public_key = rsa.RSAPublicKey( public_exponent=params["public_exponent"], modulus=params["modulus"] ) + pad = pad_factory(params, hash_alg) verifier = public_key.verifier( binascii.unhexlify(params["s"]), - padding.PSS( - mgf=padding.MGF1( - algorithm=hash_alg, - salt_length=params["salt_length"] - ) - ), + pad, hash_alg, backend ) verifier.update(binascii.unhexlify(params["msg"])) - verifier.verify() + if params["fail"]: + with pytest.raises(InvalidSignature): + verifier.verify() + else: + verifier.verify() def rsa_pss_signing_test(backend, hash_alg): |