Ecdh kdf test vectors (#10)

Sources/K1/K1/Keys/PrivateKey/PrivateKey/PrivateKey+Bridge+To+C.swift

@@ -165,7 +165,7 @@ extension Bridge {
 
  /// Following the [ANSI X9.63][ansix963] standard
  ///
- /// [ansix963]: https://webstore.ansi.org/standards/ascx9/ansix9632011r2017
+ /// [ansix963]:  https://webstore.ansi.org/standards/ascx9/ansix9632011r2017
  case ansiX963
 
  /// Following no standard at all, does not hash the shared public point, and returns it in full.
@@ -569,6 +569,7 @@ extension K1.PrivateKey {
  /// - JS: `elliptic` (v6.4.0 in nodeJS v8.2.1)
  /// - JS: `crypto` (builtin) - uses openssl under the hood (in nodeJS v8.2.1)
  /// - .NET: `BouncyCastle` (BC v1.8.1.3, .NET v2.1.4)
+ /// - Python: pyca/cryptography (hazmat)
  ///
  /// [ansix963]: https://webstore.ansi.org/standards/ascx9/ansix9632011r2017
  /// [cryptostackexchange]: https://crypto.stackexchange.com/a/57727

Tests/K1Tests/TestCases/ECDH/TwoVariantsOfECDHWithKDFTests.swift

@@ -0,0 +1,229 @@
+import Foundation
+@testable import K1
+import CryptoKit
+import XCTest
+
+private struct ECDHX963Suite: Decodable {
+ let origin: String
+ let author: String
+ let description: String
+ let numberOfTests: Int
+ let algorithm: String
+ let generatedOn: String // data
+ let vectors: [Vector]
+}
+
+private struct Vector: Decodable {
+ let alicePrivateKey: String
+ let bobPrivateKey: String
+ let alicePublicKeyUncompressed: String
+ let bobPublicKeyUncompressed: String
+ let outcomes: [Outcome]
+
+ struct Outcome: Decodable {
+ enum ECDHVariant: String, Decodable {
+ case asn1X963 = "ASN1X963"
+ case libsecp256k1 = "Bitcoin"
+ }
+ let ecdhVariant: ECDHVariant
+ let ecdhSharedKey: String
+ let derivedKeys: [DerivedKeys]
+ struct DerivedKeys: Decodable {
+
+ /// Used by both `x963` and `HKDF`
+ let info: String
+
+ /// `x963` KDF output
+ let x963: String
+
+ /// Salt for `HDKF`
+ let salt: String
+
+ let hkdf: String
+ }
+ }
+}
+
+
+
+final class TwoVariantsOfECDHWithKDFTests: XCTestCase {
+
+ func testTwoVariantsOfECDHWithKDF_vectors() throws {
+ let fileURL = Bundle.module.url(forResource: "ecdh_secp256k1_two_variants_with_kdf_test", withExtension: ".json")
+ let data = try Data(contentsOf: fileURL!)
+ let suite = try JSONDecoder().decode(ECDHX963Suite.self, from: data)
+ try suite.vectors.forEach(doTest)
+ }
+}
+
+extension TwoVariantsOfECDHWithKDFTests {
+
+
+ fileprivate func doTest(_ vector: Vector) throws {
+ let outputByteCount = 32
+ let hash = SHA256.self
+
+ let alice = try PrivateKey(hex: vector.alicePrivateKey)
+ let bob = try PrivateKey(hex: vector.bobPrivateKey)
+ try XCTAssertEqual(alice.publicKey.rawRepresentation(format: .uncompressed).hex, vector.alicePublicKeyUncompressed)
+ try XCTAssertEqual(bob.publicKey.rawRepresentation(format: .uncompressed).hex, vector.bobPublicKeyUncompressed)
+
+ for outcome in vector.outcomes {
+ switch outcome.ecdhVariant {
+ case .asn1X963:
+ let sharedSecretAB = try alice.sharedSecretFromKeyAgreement(with: bob.publicKey)
+ let sharedSecretBA = try bob.sharedSecretFromKeyAgreement(with: alice.publicKey)
+
+ XCTAssertEqual(sharedSecretAB, sharedSecretBA)
+ sharedSecretAB.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, outcome.ecdhSharedKey, "Wrong ECDH secret, mismatched expected from vector.")
+ }
+
+ for derivedKeys in outcome.derivedKeys {
+ let info = try XCTUnwrap(derivedKeys.info.data(using: .utf8))
+ let salt = try Data(hex: derivedKeys.salt)
+ let x963 = sharedSecretBA.x963DerivedSymmetricKey(using: hash, sharedInfo: info, outputByteCount: outputByteCount)
+ x963.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, derivedKeys.x963, "Wrong X963 KDF result, mismatched expected from vector.")
+ }
+ let hkdf = sharedSecretBA.hkdfDerivedSymmetricKey(using: hash, salt: salt, sharedInfo: info, outputByteCount: outputByteCount)
+ hkdf.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, derivedKeys.hkdf, "Wrong HKDF result, mismatched expected from vector.")
+ }
+ }
+
+ case .libsecp256k1:
+ let sharedSecretAB = try alice.ecdh(with: bob.publicKey)
+ let sharedSecretBA = try bob.ecdh(with: alice.publicKey)
+
+ XCTAssertEqual(sharedSecretAB, sharedSecretBA)
+ sharedSecretAB.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, outcome.ecdhSharedKey, "Wrong ECDH secret, mismatched expected from vector.")
+ }
+
+ for derivedKeys in outcome.derivedKeys {
+ let info = try XCTUnwrap(derivedKeys.info.data(using: .utf8))
+ let salt = try Data(hex: derivedKeys.salt)
+ let x963 = x963DerivedSymmetricKey(secret: sharedSecretAB, using: hash, sharedInfo: info, outputByteCount: outputByteCount)
+ x963.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, derivedKeys.x963, "Wrong X963 KDF result, mismatched expected from vector.")
+ }
+ let hkdf = hkdfDerivedSymmetricKey(secret: sharedSecretAB, using: hash, salt: salt, sharedInfo: info, outputByteCount: outputByteCount)
+ hkdf.withUnsafeBytes {
+ XCTAssertEqual(Data($0).hex, derivedKeys.hkdf, "Wrong HKDF result, mismatched expected from vector.")
+ }
+ }
+ }
+
+ }
+
+ }
+
+
+
+}
+
+//===----------------------------------------------------------------------===//
+//
+// This source file is part of the SwiftCrypto open source project
+//
+// Copyright (c) 2019-2020 Apple Inc. and the SwiftCrypto project authors
+// Licensed under Apache License v2.0
+//
+// See LICENSE.txt for license information
+// See CONTRIBUTORS.md for the list of SwiftCrypto project authors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+//===----------------------------------------------------------------------===//
+
+// Copy pasted over from https://github.com/apple/swift-crypto/blob/main/Sources/Crypto/Key%20Agreement/DH.swift#L48
+
+/// Derives a symmetric encryption key using X9.63 key derivation.
+///
+/// - Parameters:
+/// - hashFunction: The Hash Function to use for key derivation.
+/// - sharedInfo: The Shared Info to use for key derivation.
+/// - outputByteCount: The length in bytes of resulting symmetric key.
+/// - Returns: The derived symmetric key
+public func x963DerivedSymmetricKey<H: HashFunction, SI: DataProtocol>(
+ secret: Data,
+ using hashFunction: H.Type, sharedInfo: SI, outputByteCount: Int
+) -> SymmetricKey {
+ // SEC1 defines 3 inputs to the KDF:
+ //
+ // 1. An octet string Z which is the shared secret value. That's `self` here.
+ // 2. An integer `keydatalen` which is the length in octets of the keying data to be generated. Here that's `outputByteCount`.
+ // 3. An optional octet string `SharedInfo` which consists of other shared data. Here, that's `sharedInfo`.
+ //
+ // We then need to perform the following steps:
+ //
+ // 1. Check that keydatalen < hashlen × (2³² − 1). If keydatalen ≥ hashlen × (2³² − 1), fail.
+ // 2. Initiate a 4 octet, big-endian octet string Counter as 0x00000001.
+ // 3. For i = 1 to ⌈keydatalen/hashlen⌉, do the following:
+ // 1. Compute: Ki = Hash(Z || Counter || [SharedInfo]).
+ // 2. Increment Counter.
+ // 3. Increment i.
+ // 4. Set K to be the leftmost keydatalen octets of: K1 || K2 || . . . || K⌈keydatalen/hashlen⌉.
+ // 5. Output K.
+ //
+ // The loop in step 3 is not very Swifty, so instead we generate the counter directly.
+ // Step 1: Check that keydatalen < hashlen × (2³² − 1).
+ // We do this math in UInt64-space, because we'll overflow 32-bit integers.
+ guard UInt64(outputByteCount) < (UInt64(H.Digest.byteCount) * UInt64(UInt32.max)) else {
+ fatalError("Invalid parameter size")
+ }
+
+ var key = SecureBytes()
+ key.reserveCapacity(outputByteCount)
+
+ var remainingBytes = outputByteCount
+ var counter = UInt32(1)
+
+ while remainingBytes > 0 {
+ // 1. Compute: Ki = Hash(Z || Counter || [SharedInfo]).
+ var hasher = H()
+ hasher.update(data: secret)
+ hasher.update(counter.bigEndian)
+ hasher.update(data: sharedInfo)
+ let digest = hasher.finalize()
+
+ // 2. Increment Counter.
+ counter += 1
+
+ // Append the bytes of the digest. We don't want to append more than the remaining number of bytes.
+ let bytesToAppend = min(remainingBytes, H.Digest.byteCount)
+ digest.withUnsafeBytes { digestPtr in
+ key.append(digestPtr.prefix(bytesToAppend))
+ }
+ remainingBytes -= bytesToAppend
+ }
+
+ precondition(key.count == outputByteCount)
+ return SymmetricKey(data: key)
+}
+
+extension HashFunction {
+ mutating func update(_ counter: UInt32) {
+ withUnsafeBytes(of: counter) {
+ self.update(bufferPointer: $0)
+ }
+ }
+}
+
+
+/// From: https://github.com/apple/swift-crypto/blob/main/Sources/Crypto/Key%20Agreement/DH.swift#L110
+/// Derives a symmetric encryption key using HKDF key derivation.
+///
+/// - Parameters:
+/// - hashFunction: The Hash Function to use for key derivation.
+/// - salt: The salt to use for key derivation.
+/// - sharedInfo: The Shared Info to use for key derivation.
+/// - outputByteCount: The length in bytes of resulting symmetric key.
+/// - Returns: The derived symmetric key
+public func hkdfDerivedSymmetricKey<H: HashFunction, Salt: DataProtocol, SI: DataProtocol>(
+ secret: Data,
+ using hashFunction: H.Type, salt: Salt, sharedInfo: SI, outputByteCount: Int
+) -> SymmetricKey {
+ HKDF<H>.deriveKey(inputKeyMaterial: SymmetricKey(data: secret), salt: salt, info: sharedInfo, outputByteCount: outputByteCount)
+}