From 1ed2505f854b5e9be20578079e37a29d896f5673 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 21 Apr 2017 10:04:02 +0200 Subject: [PATCH] Add some negative testing for ecdsa_verify() --- include/mbedtls/ecdsa.h | 2 +- tests/suites/test_suite_ecdsa.function | 14 ++++++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/ecdsa.h b/include/mbedtls/ecdsa.h index a277715b3..259948dfc 100644 --- a/include/mbedtls/ecdsa.h +++ b/include/mbedtls/ecdsa.h @@ -120,7 +120,7 @@ int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi * prescribed by SEC1 4.1.4 step 3. * * \return 0 if successful, - * MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid + * MBEDTLS_ERR_ECP_VERIFY_FAILED if signature is invalid * or a MBEDTLS_ERR_ECP_XXX or MBEDTLS_MPI_XXX error code */ int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp, diff --git a/tests/suites/test_suite_ecdsa.function b/tests/suites/test_suite_ecdsa.function index 88e07a9e6..491ab43b4 100644 --- a/tests/suites/test_suite_ecdsa.function +++ b/tests/suites/test_suite_ecdsa.function @@ -87,6 +87,16 @@ void ecdsa_prim_test_vectors( int id, char *d_str, char *xQ_str, char *yQ_str, TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash, hlen, &Q, &r_check, &s_check ) == 0 ); + TEST_ASSERT( mbedtls_mpi_sub_int( &r, &r, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_add_int( &s, &s, 1 ) == 0 ); + + TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash, hlen, + &Q, &r, &s_check ) == MBEDTLS_ERR_ECP_VERIFY_FAILED ); + TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash, hlen, + &Q, &r_check, &s ) == MBEDTLS_ERR_ECP_VERIFY_FAILED ); + TEST_ASSERT( mbedtls_ecdsa_verify( &grp, hash, hlen, + &grp.G, &r_check, &s_check ) == MBEDTLS_ERR_ECP_VERIFY_FAILED ); + exit: mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &Q ); @@ -178,13 +188,13 @@ void ecdsa_write_read_random( int id ) /* try modifying r */ sig[10]++; TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ), - sig, sig_len ) != 0 ); + sig, sig_len ) == MBEDTLS_ERR_ECP_VERIFY_FAILED ); sig[10]--; /* try modifying s */ sig[sig_len - 1]++; TEST_ASSERT( mbedtls_ecdsa_read_signature( &ctx, hash, sizeof( hash ), - sig, sig_len ) != 0 ); + sig, sig_len ) == MBEDTLS_ERR_ECP_VERIFY_FAILED ); sig[sig_len - 1]--; exit: