nx_tls13_finished_test.nx source
↩ module page · 109 lines · 3587 B
1// nx_tls13_finished_test.nx -- internal KAT for Finished MAC.
2//
3// Cross-check that nx_tls13_finished_compute is literally
4// HMAC-SHA256(finished_key, transcript_hash) -- i.e. no extra
5// wrapping. Plus verify exercises the constant-time compare on
6// both happy path and tampered MAC.
7//
8// expect_exit: 0
9// license_tier: ORIGINAL
10
11import "nx_syscalls.nx"
12import "nx_hmac.nx"
13import "nx_tls13_finished.nx"
14
15func main() -> i64 {
16 // ---- Fixed finished_key and transcript_hash for determinism ----
17 let fkey: *u8 = sys_mmap(64)
18 var i: i64 = 0
19 while i < 32 {
20 fkey[i] = 0x40 + i
21 i = i + 1
22 }
23 let th: *u8 = sys_mmap(64)
24 i = 0
25 while i < 32 {
26 th[i] = 0x80 + i
27 i = i + 1
28 }
29
30 // ---- Test A: compute matches direct hmac_sha256 ----
31 let mac1: *u8 = sys_mmap(64)
32 let v1: i64 = nx_tls13_finished_compute(fkey, 32, th, 32, mac1)
33 if v1 != NX_TLS13_FIN_VERDICT_OK { return 1 }
34
35 let mac_ref: *u8 = sys_mmap(64)
36 hmac_sha256(fkey, 32, th, 32, mac_ref)
37
38 var bi: i64 = 0
39 while bi < 32 {
40 if (mac1[bi] & 0xff) != (mac_ref[bi] & 0xff) { return 10 + bi }
41 bi = bi + 1
42 }
43
44 // ---- Test B: verify on correct MAC = OK ----
45 let v_good: i64 = nx_tls13_finished_verify(fkey, 32, th, 32, mac1, 32)
46 if v_good != NX_TLS13_FIN_VERDICT_OK { return 50 }
47
48 // ---- Test C: verify on flipped-bit MAC = MISMATCH ----
49 let bad_mac: *u8 = sys_mmap(64)
50 var bm: i64 = 0
51 while bm < 32 {
52 bad_mac[bm] = mac1[bm]
53 bm = bm + 1
54 }
55 bad_mac[17] = bad_mac[17] ^ 0x40
56 let v_bad: i64 = nx_tls13_finished_verify(fkey, 32, th, 32, bad_mac, 32)
57 if v_bad != NX_TLS13_FIN_VERDICT_MISMATCH { return 51 }
58
59 // ---- Test D: every-byte-different MAC also rejected (no early exit) ----
60 let all_diff: *u8 = sys_mmap(64)
61 var dd: i64 = 0
62 while dd < 32 {
63 all_diff[dd] = (mac1[dd] & 0xff) ^ 0xff
64 dd = dd + 1
65 }
66 let v_all_diff: i64 = nx_tls13_finished_verify(fkey, 32, th, 32, all_diff, 32)
67 if v_all_diff != NX_TLS13_FIN_VERDICT_MISMATCH { return 52 }
68
69 // ---- Test E: different finished_key -> different MAC -> reject ----
70 let fkey2: *u8 = sys_mmap(64)
71 i = 0
72 while i < 32 {
73 fkey2[i] = 0x41 + i // shift by 1
74 i = i + 1
75 }
76 let mac2: *u8 = sys_mmap(64)
77 nx_tls13_finished_compute(fkey2, 32, th, 32, mac2)
78 // mac2 should differ from mac1 in most bytes.
79 var diff_count: i64 = 0
80 bi = 0
81 while bi < 32 {
82 if (mac1[bi] & 0xff) != (mac2[bi] & 0xff) { diff_count = diff_count + 1 }
83 bi = bi + 1
84 }
85 if diff_count < 20 { return 60 }
86
87 // Verify cross-key MAC against original transcript -> MISMATCH
88 let v_cross: i64 = nx_tls13_finished_verify(fkey, 32, th, 32, mac2, 32)
89 if v_cross != NX_TLS13_FIN_VERDICT_MISMATCH { return 61 }
90
91 // ---- Test F: different transcript -> different MAC -> reject ----
92 let th2: *u8 = sys_mmap(64)
93 i = 0
94 while i < 32 {
95 th2[i] = (th[i] & 0xff) ^ 1
96 i = i + 1
97 }
98 let mac3: *u8 = sys_mmap(64)
99 nx_tls13_finished_compute(fkey, 32, th2, 32, mac3)
100 let v_cross_th: i64 = nx_tls13_finished_verify(fkey, 32, th, 32, mac3, 32)
101 if v_cross_th != NX_TLS13_FIN_VERDICT_MISMATCH { return 70 }
102
103 // ---- Test G: verdict gate ----
104 if nx_tls13_fin_verdict_is_valid(NX_TLS13_FIN_VERDICT_OK) != 1 { return 80 }
105 if nx_tls13_fin_verdict_is_valid(NX_TLS13_FIN_VERDICT_N) != 0 { return 81 }
106 if nx_tls13_fin_verdict_is_valid(0 - 1) != 0 { return 82 }
107
108 return 0
109}