1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-2.0-or-later
#
# Script that generates known-good data used in the AEAD tests.
#
# Requires that python-cryptography be installed.
#
# Copyright 2026 Google LLC
import hashlib
import sys
import cryptography.hazmat.primitives.ciphers.aead
# Deterministically generate 'length' random bytes.
def rand_bytes(length):
seed = length
out = []
for _ in range(length):
seed = (seed * 25214903917 + 11) % 2**48
out.append((seed >> 16) % 256)
return bytes(out)
# Deterministically generate many different AEAD inputs using exactly the same
# method that the test uses; encrypt them using an independent implementation of
# the algorithm; compute the checksum of all the resulting (ciphertext, authtag)
# pairs concatenated to each other; and print the checksum as a C struct.
def gen_monte_carlo_checksum(alg):
blake2s = hashlib.blake2s()
for data_len in range(1025):
ad_len = data_len % 293
pt = rand_bytes(data_len)
ad = rand_bytes(ad_len)
if alg == "aes-ccm":
key_len = [16, 24, 32][data_len % 3]
key = rand_bytes(key_len)
nonce = rand_bytes([7, 8, 9, 10, 11, 12, 13][data_len % 7])
tag_len = [4, 6, 8, 10, 12, 14, 16][data_len % 7]
ccm = cryptography.hazmat.primitives.ciphers.aead.AESCCM(
key, tag_length=tag_len
)
ct_and_tag = ccm.encrypt(nonce, pt, ad)
elif alg == "aes-gcm":
key_len = [16, 24, 32][data_len % 3]
key = rand_bytes(key_len)
nonce = rand_bytes(12)
tag_len = [4, 8, 12, 13, 14, 15, 16][data_len % 7]
gcm = cryptography.hazmat.primitives.ciphers.aead.AESGCM(key)
# python-cryptography supports only 16-byte GCM tags. However, in
# GCM, shorter tags are simply truncated. Do that below.
ct_and_tag = gcm.encrypt(nonce, pt, ad)[: data_len + tag_len]
blake2s.update(ct_and_tag)
name = f"{alg.replace('-', '_')}_monte_carlo_checksum"
value = blake2s.digest()
print(f"static const u8 {name}[BLAKE2S_HASH_SIZE] = {{")
for i in range(0, len(value), 11):
line = "\t" + "".join(f"0x{b:02x}, " for b in value[i : i + 11])
print(f"{line.rstrip()}")
print("};")
if len(sys.argv) != 2 or sys.argv[1] not in ("aes-ccm", "aes-gcm"):
sys.stderr.write("Usage: gen-aead-testvecs.py [aes-ccm|aes-gcm]\n")
sys.exit(1)
gen_monte_carlo_checksum(sys.argv[1])
|
