auth_test.go

     1  // Copyright 2017 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"crypto"
     9  	"crypto/fips140"
    10  	"crypto/internal/cryptotest"
    11  	"crypto/mldsa"
    12  	"crypto/tls/internal/fips140tls"
    13  	"internal/testenv"
    14  	"strconv"
    15  	"testing"
    16  )
    17  
    18  func TestSignatureSelection(t *testing.T) {
    19  	pkcs1Cert := testRSA2048Cert
    20  	pkcs1Cert.SupportedSignatureAlgorithms = []SignatureScheme{PKCS1WithSHA1, PKCS1WithSHA256}
    21  
    22  	tests := []struct {
    23  		cert        Certificate
    24  		peerSigAlgs []SignatureScheme
    25  		tlsVersion  uint16
    26  		godebug     string
    27  
    28  		expectedSigAlg  SignatureScheme
    29  		expectedSigType uint8
    30  		expectedHash    crypto.Hash
    31  	}{
    32  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA1, PKCS1WithSHA256}, VersionTLS12, "", PKCS1WithSHA256, signaturePKCS1v15, crypto.SHA256},
    33  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA1, PKCS1WithSHA256}, VersionTLS12, "tlssha1=1", PKCS1WithSHA1, signaturePKCS1v15, crypto.SHA1},
    34  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA512, PKCS1WithSHA1}, VersionTLS12, "", PKCS1WithSHA512, signaturePKCS1v15, crypto.SHA512},
    35  		{testRSA2048Cert, []SignatureScheme{PSSWithSHA256, PKCS1WithSHA256}, VersionTLS12, "", PSSWithSHA256, signatureRSAPSS, crypto.SHA256},
    36  		{pkcs1Cert, []SignatureScheme{PSSWithSHA256, PKCS1WithSHA256}, VersionTLS12, "", PKCS1WithSHA256, signaturePKCS1v15, crypto.SHA256},
    37  		{testRSA2048Cert, []SignatureScheme{PSSWithSHA384, PKCS1WithSHA1}, VersionTLS13, "", PSSWithSHA384, signatureRSAPSS, crypto.SHA384},
    38  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA1, PSSWithSHA384}, VersionTLS13, "", PSSWithSHA384, signatureRSAPSS, crypto.SHA384},
    39  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithSHA1, ECDSAWithP256AndSHA256}, VersionTLS12, "", ECDSAWithP256AndSHA256, signatureECDSA, crypto.SHA256},
    40  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithSHA1}, VersionTLS12, "tlssha1=1", ECDSAWithSHA1, signatureECDSA, crypto.SHA1},
    41  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithP256AndSHA256}, VersionTLS12, "", ECDSAWithP256AndSHA256, signatureECDSA, crypto.SHA256},
    42  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithP256AndSHA256}, VersionTLS13, "", ECDSAWithP256AndSHA256, signatureECDSA, crypto.SHA256},
    43  		{testEd25519Cert, []SignatureScheme{Ed25519}, VersionTLS12, "", Ed25519, signatureEd25519, directSigning},
    44  		{testEd25519Cert, []SignatureScheme{Ed25519}, VersionTLS13, "", Ed25519, signatureEd25519, directSigning},
    45  		{testMLDSA44Cert, []SignatureScheme{MLDSA44}, VersionTLS13, "", MLDSA44, signatureMLDSA, directSigning},
    46  		{testMLDSA65Cert, []SignatureScheme{MLDSA65}, VersionTLS13, "", MLDSA65, signatureMLDSA, directSigning},
    47  		{testMLDSA87Cert, []SignatureScheme{MLDSA87}, VersionTLS13, "", MLDSA87, signatureMLDSA, directSigning},
    48  
    49  		// TLS 1.2 without signature_algorithms extension
    50  		{testRSA2048Cert, nil, VersionTLS12, "tlssha1=1", PKCS1WithSHA1, signaturePKCS1v15, crypto.SHA1},
    51  		{testECDSAP256Cert, nil, VersionTLS12, "tlssha1=1", ECDSAWithSHA1, signatureECDSA, crypto.SHA1},
    52  
    53  		// TLS 1.2 does not restrict the ECDSA curve
    54  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithP384AndSHA384}, VersionTLS12, "", ECDSAWithP384AndSHA384, signatureECDSA, crypto.SHA384},
    55  	}
    56  
    57  	for testNo, test := range tests {
    58  		t.Run(strconv.Itoa(testNo), func(t *testing.T) {
    59  			if fips140tls.Required() && test.expectedHash == crypto.SHA1 {
    60  				t.Skip("skipping test not compatible with TLS FIPS mode")
    61  			}
    62  			switch test.expectedSigAlg {
    63  			case MLDSA44, MLDSA65, MLDSA87:
    64  				cryptotest.MustMinimumFIPS140ModuleVersion(t, "v1.26.0")
    65  			}
    66  			if test.godebug != "" {
    67  				testenv.SetGODEBUG(t, test.godebug)
    68  			} else {
    69  				t.Parallel()
    70  			}
    71  
    72  			sigAlg, err := selectSignatureScheme(test.tlsVersion, &test.cert, test.peerSigAlgs)
    73  			if err != nil {
    74  				t.Errorf("unexpected selectSignatureScheme error: %v", err)
    75  			}
    76  			if test.expectedSigAlg != sigAlg {
    77  				t.Errorf("expected signature scheme %v, got %v", test.expectedSigAlg, sigAlg)
    78  			}
    79  			sigType, hashFunc, err := typeAndHashFromSignatureScheme(sigAlg)
    80  			if err != nil {
    81  				t.Errorf("unexpected typeAndHashFromSignatureScheme error: %v", err)
    82  			}
    83  			if test.expectedSigType != sigType {
    84  				t.Errorf("expected signature algorithm %#x, got %#x", test.expectedSigType, sigType)
    85  			}
    86  			if test.expectedHash != hashFunc {
    87  				t.Errorf("expected hash function %#x, got %#x", test.expectedHash, hashFunc)
    88  			}
    89  		})
    90  	}
    91  
    92  	brokenCert := testRSA2048Cert
    93  	brokenCert.SupportedSignatureAlgorithms = []SignatureScheme{Ed25519}
    94  
    95  	badTests := []struct {
    96  		cert        Certificate
    97  		peerSigAlgs []SignatureScheme
    98  		tlsVersion  uint16
    99  	}{
   100  		{testRSA2048Cert, []SignatureScheme{ECDSAWithP256AndSHA256, ECDSAWithSHA1}, VersionTLS12},
   101  		{testECDSAP256Cert, []SignatureScheme{PKCS1WithSHA256, PKCS1WithSHA1}, VersionTLS12},
   102  		{testRSA2048Cert, []SignatureScheme{0}, VersionTLS12},
   103  		{testEd25519Cert, []SignatureScheme{ECDSAWithP256AndSHA256, ECDSAWithSHA1}, VersionTLS12},
   104  		{testECDSAP256Cert, []SignatureScheme{Ed25519}, VersionTLS12},
   105  		{brokenCert, []SignatureScheme{Ed25519}, VersionTLS12},
   106  		{brokenCert, []SignatureScheme{PKCS1WithSHA256}, VersionTLS12},
   107  		// RFC 5246, Section 7.4.1.4.1, says to only consider {sha1,ecdsa} as
   108  		// default when the extension is missing, and RFC 8422 does not update
   109  		// it. Anyway, if a stack supports Ed25519 it better support sigalgs.
   110  		{testEd25519Cert, nil, VersionTLS12},
   111  		// TLS 1.3 has no default signature_algorithms.
   112  		{testRSA2048Cert, nil, VersionTLS13},
   113  		{testECDSAP256Cert, nil, VersionTLS13},
   114  		{testEd25519Cert, nil, VersionTLS13},
   115  		// Wrong curve, which TLS 1.3 checks
   116  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithP384AndSHA384}, VersionTLS13},
   117  		// TLS 1.3 does not support PKCS1v1.5 or SHA-1.
   118  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA256}, VersionTLS13},
   119  		{pkcs1Cert, []SignatureScheme{PSSWithSHA256, PKCS1WithSHA256}, VersionTLS13},
   120  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithSHA1}, VersionTLS13},
   121  		// The key can be too small for the hash.
   122  		{testRSA1024Cert, []SignatureScheme{PSSWithSHA512}, VersionTLS12},
   123  		// SHA-1 requires tlssha1=1
   124  		{testRSA2048Cert, []SignatureScheme{PKCS1WithSHA1}, VersionTLS12},
   125  		{testECDSAP256Cert, []SignatureScheme{ECDSAWithSHA1}, VersionTLS12},
   126  		{testRSA2048Cert, nil, VersionTLS12},
   127  		{testECDSAP256Cert, nil, VersionTLS12},
   128  		// ML-DSA requires TLS 1.3.
   129  		{testMLDSA44Cert, []SignatureScheme{MLDSA44}, VersionTLS12},
   130  		{testMLDSA65Cert, []SignatureScheme{MLDSA65}, VersionTLS12},
   131  		{testMLDSA87Cert, []SignatureScheme{MLDSA87}, VersionTLS12},
   132  		// ML-DSA parameter sets don't cross-match.
   133  		{testMLDSA44Cert, []SignatureScheme{MLDSA65}, VersionTLS13},
   134  		{testMLDSA65Cert, []SignatureScheme{MLDSA87}, VersionTLS13},
   135  		{testMLDSA87Cert, []SignatureScheme{MLDSA44}, VersionTLS13},
   136  		// ML-DSA cert with non-ML-DSA peer sig algs and vice versa.
   137  		{testMLDSA44Cert, []SignatureScheme{Ed25519}, VersionTLS13},
   138  		{testRSA2048Cert, []SignatureScheme{MLDSA44}, VersionTLS13},
   139  		{testECDSAP256Cert, []SignatureScheme{MLDSA44}, VersionTLS13},
   140  	}
   141  
   142  	for testNo, test := range badTests {
   143  		sigAlg, err := selectSignatureScheme(test.tlsVersion, &test.cert, test.peerSigAlgs)
   144  		if err == nil {
   145  			t.Errorf("test[%d]: unexpected success, got %v", testNo, sigAlg)
   146  		}
   147  	}
   148  }
   149  
   150  func TestLegacyTypeAndHash(t *testing.T) {
   151  	sigType, hashFunc, err := legacyTypeAndHashFromPublicKey(testRSA2048Key.Public())
   152  	if err != nil {
   153  		t.Errorf("RSA: unexpected error: %v", err)
   154  	}
   155  	if expectedSigType := signaturePKCS1v15; expectedSigType != sigType {
   156  		t.Errorf("RSA: expected signature type %#x, got %#x", expectedSigType, sigType)
   157  	}
   158  	if expectedHashFunc := crypto.MD5SHA1; expectedHashFunc != hashFunc {
   159  		t.Errorf("RSA: expected hash %#x, got %#x", expectedHashFunc, hashFunc)
   160  	}
   161  
   162  	sigType, hashFunc, err = legacyTypeAndHashFromPublicKey(testECDSAP256Key.Public())
   163  	if err != nil {
   164  		t.Errorf("ECDSA: unexpected error: %v", err)
   165  	}
   166  	if expectedSigType := signatureECDSA; expectedSigType != sigType {
   167  		t.Errorf("ECDSA: expected signature type %#x, got %#x", expectedSigType, sigType)
   168  	}
   169  	if expectedHashFunc := crypto.SHA1; expectedHashFunc != hashFunc {
   170  		t.Errorf("ECDSA: expected hash %#x, got %#x", expectedHashFunc, hashFunc)
   171  	}
   172  
   173  	// Ed25519 is not supported by TLS 1.0 and 1.1.
   174  	_, _, err = legacyTypeAndHashFromPublicKey(testEd25519Key.Public())
   175  	if err == nil {
   176  		t.Errorf("Ed25519: unexpected success")
   177  	}
   178  
   179  	// ML-DSA is not supported by TLS 1.0 and 1.1. Skip under FIPS 140-3 module
   180  	// v1.0.0 which doesn't support ML-DSA public keys.
   181  	if fips140.Version() != "v1.0.0" {
   182  		for _, key := range []*mldsa.PrivateKey{
   183  			testMLDSA44Key, testMLDSA65Key, testMLDSA87Key,
   184  		} {
   185  			if _, _, err := legacyTypeAndHashFromPublicKey(key.PublicKey()); err == nil {
   186  				t.Errorf("%s: unexpected success", key.PublicKey().Parameters())
   187  			}
   188  		}
   189  	}
   190  }
   191  
   192  // TestSupportedSignatureAlgorithms checks that all supportedSignatureAlgorithms
   193  // have valid type and hash information.
   194  func TestSupportedSignatureAlgorithms(t *testing.T) {
   195  	for _, sigAlg := range supportedSignatureAlgorithms(VersionTLS12, VersionTLS13) {
   196  		sigType, hash, err := typeAndHashFromSignatureScheme(sigAlg)
   197  		if err != nil {
   198  			t.Errorf("%v: unexpected error: %v", sigAlg, err)
   199  		}
   200  		if sigType == 0 {
   201  			t.Errorf("%v: missing signature type", sigAlg)
   202  		}
   203  		if hash == 0 && sigAlg != Ed25519 && sigAlg != MLDSA44 && sigAlg != MLDSA65 && sigAlg != MLDSA87 {
   204  			t.Errorf("%v: missing hash", sigAlg)
   205  		}
   206  	}
   207  }
   208
View as plain text