_tlskdf_minrepro.nx source
↩ module page · 90 lines · 2796 B
1// _tlskdf_minrepro.nx -- MINIMAL REPRO for the Jun-2 native-compiler
2// TLS-KDF miscompile (nx_tls13_kdf_test assertion #31).
3//
4// Prints: the assembled HkdfLabel info block (decimal bytes, one
5// line), then the first 8 bytes of Derive-Secret(early,"derived",H_empty).
6// RFC 8448 expected derived[0..7] = 6f 26 15 a1 08 c7 02 c5
7// (111 38 21 161 8 199 2 197 decimal).
8//
9// Compile with the May-29 compiler -> correct bytes.
10// Compile with the Jun-2 compiler -> wrong bytes (the defect).
11//
12// expect_exit: 0
13// license_tier: ORIGINAL
14
15import "nx_syscalls.nx"
16import "nx_sha256.nx"
17import "nx_hkdf.nx"
18import "nx_tls13_kdf.nx"
19
20func mr_dec(v: i64) -> i64 {
21 var av: i64 = v
22 if av < 0 {
23 let neg: *u8 = sys_mmap(8); neg[0] = 0x2D; sys_write(1, neg, 1)
24 av = 0 - av
25 }
26 if av == 0 {
27 let z: *u8 = sys_mmap(8); z[0] = 0x30; sys_write(1, z, 1)
28 }
29 if av > 0 {
30 let buf: *u8 = sys_mmap(32)
31 var pos: i64 = 0
32 var x: i64 = av
33 while x > 0 { buf[pos] = (0x30 + (x % 10)) as u8; x = x / 10; pos = pos + 1 }
34 let out: *u8 = sys_mmap(32)
35 var oi: i64 = 0
36 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
37 sys_write(1, out, pos)
38 }
39 let sp: *u8 = sys_mmap(8); sp[0] = 0x20; sys_write(1, sp, 1)
40 return 0
41}
42
43func mr_nl() -> i64 {
44 let nl: *u8 = sys_mmap(8); nl[0] = 0x0A; sys_write(1, nl, 1)
45 return 0
46}
47
48func main() -> i64 {
49 // early_secret = HKDF-Extract(0,0) -- proven good under both compilers.
50 let zeros: *u8 = sys_mmap(64)
51 let early: *u8 = sys_mmap(64)
52 hkdf_extract(zeros, 0, zeros, 32, early)
53
54 // H_empty = SHA-256("")
55 let empty_hash: *u8 = sys_mmap(32)
56 sha256_digest(zeros, 0, empty_hash)
57
58 // "derived"
59 let label: *u8 = sys_mmap(8)
60 label[0]=0x64; label[1]=0x65; label[2]=0x72; label[3]=0x69
61 label[4]=0x76; label[5]=0x65; label[6]=0x64
62
63 // ---- Step 1: the assembled HkdfLabel info block ----
64 let info: *u8 = sys_mmap(128)
65 let info_len: i64 = tls13_build_hkdf_label(32, label, 7, empty_hash, 32, info)
66 mr_dec(info_len)
67 mr_nl()
68 var i: i64 = 0
69 while i < info_len { mr_dec(info[i] & 0xff); i = i + 1 }
70 mr_nl()
71
72 // ---- Step 2: derived secret first 8 bytes ----
73 let derived: *u8 = sys_mmap(64)
74 let v: i64 = tls13_derive_secret(early, label, 7, empty_hash, 32, derived)
75 mr_dec(v)
76 mr_nl()
77 var k: i64 = 0
78 while k < 8 { mr_dec(derived[k] & 0xff); k = k + 1 }
79 mr_nl()
80
81 // ---- Step 3: hkdf_expand called DIRECTLY from main, same info ----
82 let direct: *u8 = sys_mmap(64)
83 let rc: i64 = hkdf_expand(early, info, info_len, 32, direct)
84 mr_dec(rc)
85 mr_nl()
86 var m: i64 = 0
87 while m < 8 { mr_dec(direct[m] & 0xff); m = m + 1 }
88 mr_nl()
89 return 0
90}