From e235f38f9b9fc3cd4464bbf9081da765d46ce87d Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 4 Oct 2022 12:44:54 +0200 Subject: tests: Reproducer for short dklen in FIPS mode * tests/t-kdf.c (check_pbkdf2): Add test vector with short dklen and verify it fails in FIPS mode -- Cherry-picked master commit of: efdc87b305ff326f37acd3a9c2606de24a706cce GnuPG-bug-id: 6219 Signed-off-by: Jakub Jelen --- tests/t-kdf.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/tests/t-kdf.c b/tests/t-kdf.c index 15e77c82..19c96451 100644 --- a/tests/t-kdf.c +++ b/tests/t-kdf.c @@ -907,6 +907,14 @@ check_pbkdf2 (void) "\x0c\x60\xc8\x0f\x96\x1f\x0e\x71\xf3\xa9" "\xb5\x24\xaf\x60\x12\x06\x2f\xe0\x37\xa6" }, + { + "password", 8, + "salt", 4, + GCRY_MD_SHA1, + 1, + 10, /* too short dklen for FIPS */ + "\x0c\x60\xc8\x0f\x96\x1f\x0e\x71\xf3\xa9" + }, { "password", 8, "salt", 4, @@ -1105,7 +1113,7 @@ check_pbkdf2 (void) GCRY_KDF_PBKDF2, tv[tvidx].hashalgo, tv[tvidx].salt, tv[tvidx].saltlen, tv[tvidx].c, tv[tvidx].dklen, outbuf); - if (in_fips_mode && tvidx > 6) + if (in_fips_mode && tvidx > 7) { if (!err) fail ("pbkdf2 test %d unexpectedly passed in FIPS mode: %s\n", @@ -1114,7 +1122,7 @@ check_pbkdf2 (void) } if (err) { - if (in_fips_mode && tv[tvidx].plen < 14) + if (in_fips_mode && (tv[tvidx].plen < 14 || tv[tvidx].dklen < 14)) { if (verbose) fprintf (stderr, -- cgit v1.2.1