/**

* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

package com.google.security.wycheproof;

import static org.junit.Assert.assertEquals;

import static org.junit.Assert.assertTrue;

import static org.junit.Assert.fail;

import com.google.security.wycheproof.WycheproofRunner.NoPresubmitTest;

import com.google.security.wycheproof.WycheproofRunner.ProviderType;

import com.google.security.wycheproof.WycheproofRunner.SlowTest;

import java.lang.management.ManagementFactory;

import java.lang.management.ThreadMXBean;

import java.math.BigInteger;

import java.security.GeneralSecurityException;

import java.security.KeyFactory;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.NoSuchAlgorithmException;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.SecureRandom;

import java.security.interfaces.ECPrivateKey;

import java.security.interfaces.ECPublicKey;

import java.security.spec.ECFieldFp;

import java.security.spec.ECGenParameterSpec;

import java.security.spec.ECParameterSpec;

import java.security.spec.ECPoint;

import java.security.spec.ECPrivateKeySpec;

import java.security.spec.ECPublicKeySpec;

import java.security.spec.EllipticCurve;

import java.security.spec.X509EncodedKeySpec;

import javax.crypto.KeyAgreement;

import org.junit.Test;

import org.junit.runner.RunWith;

import org.junit.runners.JUnit4;

/**

* Testing ECDH.

*

* <p><b>Defense in depth</b>: The tests for ECDH assume that a attacker has control over all

* aspects of the public key in an exchange. That means that the attacker can potentially send weak

* or invalid public keys. For example, invalid public keys can contain points not on the curve,

* curves that have been deliberately chosen so that DLs are easy to compute as well as orders or

* cofactors that are wrong. It is expected that implementations validate the inputs of a key

* agreement and that in no case information about the private key is leaked.

*

* <p><b>References:</b> Ingrid Biehl, Bernd Meyer, Volker Müller, "Differential Fault Attacks on

* Elliptic Curve Cryptosystems", Crypto '00, pp. 131-164

*

* <p>Adrian Antipa, Daniel Brown, Alfred Menezes, Rene Struik, and Scott Vanstone, "Validation of

* Elliptic Curve Public Keys", PKC 2003, https://www.iacr.org/archive/pkc2003/25670211/25670211.pdf

*

* <p><b>Bugs:</b> CVE-2015-7940: BouncyCastle before 1.51 does not validate a point is on the

* curve. BouncyCastle v.1.52 checks that the public key point is on the public key curve but does

* not check whether public key and private key use the same curve. BouncyCastle v.1.53 is still

* vulnerable to attacks with modified public keys. An attacker can change the order of the curve

* used by the public key. ECDHC would then reduce the private key modulo this order, which can be

* used to find the private key.

*

* <p>CVE-2015-6924: Utimaco HSMs vulnerable to invalid curve attacks, which made the private key

* extraction possible.

*

* <p>CVE-2015-7940: Issue with elliptic curve addition in mixed Jacobian-affine coordinates

*

* @author [email protected] (Daniel Bleichenbacher)

*/

// TODO(bleichen): Stuff we haven't implemented:

// - timing attacks

// Stuff we are delaying because there are more important bugs:

// - testWrongOrder using BouncyCastle with ECDHWithSHA1Kdf throws

// java.lang.UnsupportedOperationException: KDF can only be used when algorithm is known

// Not sure if that is expected or another bug.

// CVEs for ECDH we haven't used anywhere.

// - CVE-2014-3470: OpenSSL anonymous ECDH denial of service: triggered by NULL value in

// certificate.

// - CVE-2014-3572: OpenSSL downgrades ECDHE to ECDH

// - CVE-2011-3210: OpenSSL was not thread safe

@RunWith(JUnit4.class)

public class EcdhTest {