Coverage Report

Created: 2025-11-16 06:56

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/cryptofuzz/modules/botan/module.cpp
Line
Count
Source
1
#include "module.h"
2
#include <cryptofuzz/util.h>
3
#include <cryptofuzz/repository.h>
4
#include <botan/aead.h>
5
#include <botan/ber_dec.h>
6
#include <botan/bigint.h>
7
#include <botan/cipher_mode.h>
8
#include <botan/curve25519.h>
9
#include <botan/dh.h>
10
#include <botan/dl_group.h>
11
#include <botan/dsa.h>
12
#include <botan/ecdsa.h>
13
#include <botan/ecgdsa.h>
14
#include <botan/ed25519.h>
15
#include <botan/hash.h>
16
#include <botan/kdf.h>
17
#include <botan/mac.h>
18
#include <botan/pubkey.h>
19
#include <botan/pwdhash.h>
20
#include <botan/system_rng.h>
21
#include "bn_ops.h"
22
23
namespace cryptofuzz {
24
namespace module {
25
26
Botan::Botan(void) :
27
2
    Module("Botan") {
28
2
    if ( setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1) != 0 ) {
29
0
        abort();
30
0
    }
31
32
    /* Add a few curves */
33
34
2
    {
35
2
        const ::Botan::OID secp112r1_oid("1.3.132.0.6");
36
2
        const ::Botan::EC_Group secp112r1(
37
2
                ::Botan::BigInt::from_string("4451685225093714772084598273548427"),
38
2
                ::Botan::BigInt::from_string("4451685225093714772084598273548424"),
39
2
                ::Botan::BigInt::from_string("2061118396808653202902996166388514"),
40
2
                ::Botan::BigInt::from_string("188281465057972534892223778713752"),
41
2
                ::Botan::BigInt::from_string("3419875491033170827167861896082688"),
42
2
                ::Botan::BigInt::from_string("4451685225093714776491891542548933"),
43
2
                1,
44
2
                secp112r1_oid);
45
2
        ::Botan::OID::register_oid(secp112r1_oid, "secp112r1");
46
2
    }
47
48
2
    {
49
2
        const ::Botan::OID secp112r2_oid("1.3.132.0.7");
50
2
        const ::Botan::EC_Group secp112r2(
51
2
                ::Botan::BigInt::from_string("4451685225093714772084598273548427"),
52
2
                ::Botan::BigInt::from_string("1970543761890640310119143205433388"),
53
2
                ::Botan::BigInt::from_string("1660538572255285715897238774208265"),
54
2
                ::Botan::BigInt::from_string("1534098225527667214992304222930499"),
55
2
                ::Botan::BigInt::from_string("3525120595527770847583704454622871"),
56
2
                ::Botan::BigInt::from_string("1112921306273428674967732714786891"),
57
2
                4,
58
2
                secp112r2_oid);
59
2
        ::Botan::OID::register_oid(secp112r2_oid, "secp112r2");
60
2
    }
61
62
2
    {
63
2
        const ::Botan::OID secp128r1_oid("1.3.132.0.28");
64
2
        const ::Botan::EC_Group secp128r1(
65
2
                ::Botan::BigInt::from_string("340282366762482138434845932244680310783"),
66
2
                ::Botan::BigInt::from_string("340282366762482138434845932244680310780"),
67
2
                ::Botan::BigInt::from_string("308990863222245658030922601041482374867"),
68
2
                ::Botan::BigInt::from_string("29408993404948928992877151431649155974"),
69
2
                ::Botan::BigInt::from_string("275621562871047521857442314737465260675"),
70
2
                ::Botan::BigInt::from_string("340282366762482138443322565580356624661"),
71
2
                1,
72
2
                secp128r1_oid);
73
2
        ::Botan::OID::register_oid(secp128r1_oid, "secp128r1");
74
2
    }
75
76
2
    {
77
2
        const ::Botan::OID secp128r2_oid("1.3.132.0.29");
78
2
        const ::Botan::EC_Group secp128r2(
79
2
                ::Botan::BigInt::from_string("340282366762482138434845932244680310783"),
80
2
                ::Botan::BigInt::from_string("284470887156368047300405921324061011681"),
81
2
                ::Botan::BigInt::from_string("126188322377389722996253562430093625949"),
82
2
                ::Botan::BigInt::from_string("164048790688614013222215505581242564928"),
83
2
                ::Botan::BigInt::from_string("52787839253935625605232456597451787076"),
84
2
                ::Botan::BigInt::from_string("85070591690620534603955721926813660579"),
85
2
                4,
86
2
                secp128r2_oid);
87
2
        ::Botan::OID::register_oid(secp128r2_oid, "secp128r2");
88
2
    }
89
2
}
90
91
#if !defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
92
 #define BOTAN_FUZZER_RNG Botan_detail::Fuzzer_RNG rng(ds);
93
#else
94
810
 #define BOTAN_FUZZER_RNG ::Botan::System_RNG rng;
95
#endif /* CRYPTOFUZZ_BOTAN_IS_ORACLE */
96
97
#if !defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
98
 #define BOTAN_SET_GLOBAL_DS CF_NORET(util::SetGlobalDs(&ds));
99
 #define BOTAN_UNSET_GLOBAL_DS CF_NORET(util::UnsetGlobalDs());
100
#else
101
 #define BOTAN_SET_GLOBAL_DS
102
 #define BOTAN_UNSET_GLOBAL_DS
103
#endif
104
105
namespace Botan_detail {
106
107
#if !defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
108
    class Fuzzer_RNG final : public ::Botan::RandomNumberGenerator {
109
        private:
110
            Datasource& ds;
111
        public:
112
            Fuzzer_RNG(Datasource& ds) :
113
                ds(ds)
114
            { }
115
116
            bool is_seeded() const override { return true; }
117
118
            bool accepts_input() const override { return false; }
119
120
            void clear() override {}
121
122
            virtual void fill_bytes_with_input(
123
                    std::span<uint8_t> output,
124
                    std::span<const uint8_t> input) override {
125
                (void)input;
126
127
                if ( output.empty() ) {
128
                    return;
129
                }
130
131
                const auto data = ds.GetData(0, output.size(), output.size());
132
133
                std::copy(data.begin(), data.end(), output.begin());
134
            }
135
136
            std::string name() const override { return "Fuzzer_RNG"; }
137
    };
138
#endif /* CRYPTOFUZZ_BOTAN_IS_ORACLE */
139
140
0
    const std::string parenthesize(const std::string parent, const std::string child) {
141
0
        static const std::string pOpen("(");
142
0
        static const std::string pClose(")");
143
144
0
        return parent + pOpen + child + pClose;
145
0
    }
146
147
0
    std::optional<std::string> DigestIDToString(const uint64_t digestType, const bool altShake = false, const bool isHmac = false) {
148
0
#include "digest_string_lut.h"
149
0
        std::optional<std::string> ret = std::nullopt;
150
151
0
        CF_CHECK_NE(LUT.find(digestType), LUT.end());
152
153
0
        if ( isHmac == false ) {
154
0
            if (    digestType == CF_DIGEST("SIPHASH64") ||
155
0
                    digestType == CF_DIGEST("SIPHASH128") ) {
156
0
                return std::nullopt;
157
0
            }
158
0
        }
159
0
        if ( altShake == true && digestType == CF_DIGEST("SHAKE128") ) {
160
0
            ret = "SHAKE-128(256)";
161
0
        } else if ( altShake == true && digestType == CF_DIGEST("SHAKE256") ) {
162
0
            ret = "SHAKE-256(512)";
163
0
        } else if ( altShake == true && digestType == CF_DIGEST("SHAKE256_114") ) {
164
0
            ret = "SHAKE-256(912)"; /* 114 bytes * 8 = 912 bits */
165
0
        } else {
166
0
            ret = LUT.at(digestType);
167
0
        }
168
0
end:
169
0
        return ret;
170
0
    }
171
172
} /* namespace Botan_detail */
173
174
0
std::optional<component::Digest> Botan::OpDigest(operation::Digest& op) {
175
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
176
0
    std::optional<component::Digest> ret = std::nullopt;
177
0
    std::unique_ptr<::Botan::HashFunction> hash = nullptr;
178
0
    util::Multipart parts;
179
0
    size_t numClears = 0;
180
181
    /* Initialize */
182
0
    {
183
0
        BOTAN_SET_GLOBAL_DS
184
185
0
        std::optional<std::string> algoString;
186
0
        CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get()), std::nullopt);
187
0
        CF_CHECK_NE(hash = ::Botan::HashFunction::create(*algoString), nullptr);
188
189
0
        parts = util::ToParts(ds, op.cleartext);
190
0
    }
191
192
0
again:
193
    /* Process */
194
0
    for (const auto& part : parts) {
195
0
        hash->update(part.first, part.second);
196
0
        bool clear = false;
197
198
0
        if ( numClears < 3 ) {
199
0
            try {
200
#if !defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
201
                clear = ds.Get<bool>();
202
#endif /* CRYPTOFUZZ_BOTAN_IS_ORACLE */
203
0
            } catch ( ... ) { }
204
0
        }
205
206
0
        if ( clear == true ) {
207
0
            hash->clear();
208
0
            numClears++;
209
0
            goto again;
210
0
        }
211
0
    }
212
213
    /* Finalize */
214
0
    {
215
0
        const auto res = hash->final();
216
0
        ret = component::Digest(res.data(), res.size());
217
0
    }
218
219
0
end:
220
0
    BOTAN_UNSET_GLOBAL_DS
221
222
0
    return ret;
223
0
}
224
225
0
std::optional<component::MAC> Botan::OpHMAC(operation::HMAC& op) {
226
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
227
0
    std::optional<component::MAC> ret = std::nullopt;
228
0
    std::unique_ptr<::Botan::MessageAuthenticationCode> hmac = nullptr;
229
0
    util::Multipart parts;
230
231
0
    try {
232
        /* Initialize */
233
0
        {
234
0
            BOTAN_SET_GLOBAL_DS
235
236
0
            std::optional<std::string> algoString;
237
0
            CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get(), true, true), std::nullopt);
238
239
0
            std::string hmacString;
240
0
            if (
241
0
                    op.digestType.Is(CF_DIGEST("SIPHASH64")) ||
242
0
                    op.digestType.Is(CF_DIGEST("BLAKE2B_MAC")) ) {
243
0
                hmacString = *algoString;
244
0
            } else {
245
0
                hmacString = Botan_detail::parenthesize("HMAC", *algoString);
246
0
            }
247
248
0
            CF_CHECK_NE(hmac = ::Botan::MessageAuthenticationCode::create(hmacString), nullptr);
249
250
0
            try {
251
0
                hmac->set_key(op.cipher.key.GetPtr(), op.cipher.key.GetSize());
252
0
            } catch ( ... ) {
253
0
                goto end;
254
0
            }
255
256
0
            parts = util::ToParts(ds, op.cleartext);
257
0
        }
258
259
        /* Process */
260
0
        for (const auto& part : parts) {
261
0
            hmac->update(part.first, part.second);
262
0
        }
263
264
        /* Finalize */
265
0
        {
266
0
            const auto res = hmac->final();
267
0
            ret = component::MAC(res.data(), res.size());
268
0
        }
269
270
0
    } catch ( ... ) { }
271
272
0
end:
273
0
    BOTAN_UNSET_GLOBAL_DS
274
275
0
    return ret;
276
0
}
277
278
namespace Botan_detail {
279
280
0
    std::optional<std::string> CipherIDToString(const uint64_t digestType, const bool withMode = true) {
281
0
#include "cipher_string_lut.h"
282
0
        std::optional<std::string> ret = std::nullopt;
283
284
0
        CF_CHECK_NE(LUT.find(digestType), LUT.end());
285
0
        ret = withMode ? LUT.at(digestType).first : LUT.at(digestType).second;
286
0
end:
287
0
        return ret;
288
0
    }
289
290
    template <class OperationType>
291
    const uint8_t* GetInPtr(const OperationType& op);
292
293
    template <>
294
0
    const uint8_t* GetInPtr(const operation::SymmetricEncrypt& op) {
295
0
        return op.cleartext.GetPtr();
296
0
    }
297
298
    template <>
299
0
    const uint8_t* GetInPtr(const operation::SymmetricDecrypt& op) {
300
0
        return op.ciphertext.GetPtr();
301
0
    }
302
303
    template <class OperationType>
304
    size_t GetInSize(const OperationType& op);
305
306
    template <>
307
0
    size_t GetInSize(const operation::SymmetricEncrypt& op) {
308
0
        return op.cleartext.GetSize();
309
0
    }
310
311
    template <>
312
0
    size_t GetInSize(const operation::SymmetricDecrypt& op) {
313
0
        return op.ciphertext.GetSize();
314
0
    }
315
316
    template <class OperationType>
317
    ::Botan::Cipher_Dir GetCryptType(void);
318
319
    template <>
320
0
    ::Botan::Cipher_Dir GetCryptType<operation::SymmetricEncrypt>(void) {
321
0
        return ::Botan::Cipher_Dir::Encryption;
322
0
    }
323
324
    template <>
325
0
    ::Botan::Cipher_Dir GetCryptType<operation::SymmetricDecrypt>(void) {
326
0
        return ::Botan::Cipher_Dir::Decryption;
327
0
    }
328
329
    template <class OperationType>
330
    std::optional<size_t> GetTagSize(const OperationType& op);
331
332
    template <>
333
0
    std::optional<size_t> GetTagSize<>(const operation::SymmetricEncrypt& op) {
334
0
        if ( op.tagSize == std::nullopt ) {
335
0
            return std::nullopt;
336
0
        }
337
338
0
        return *op.tagSize;
339
0
    }
340
341
    template <>
342
0
    std::optional<size_t> GetTagSize<>(const operation::SymmetricDecrypt& op) {
343
0
        if ( op.tag == std::nullopt ) {
344
0
            return std::nullopt;
345
0
        }
346
347
0
        return op.tag->GetSize();
348
0
    }
349
350
    template <class OperationType>
351
    const uint8_t* GetTagPtr(const OperationType& op);
352
353
    template <>
354
0
    const uint8_t* GetTagPtr<>(const operation::SymmetricEncrypt& op) {
355
0
        (void)op;
356
357
0
        return nullptr;
358
0
    }
359
360
    template <>
361
0
    const uint8_t* GetTagPtr<>(const operation::SymmetricDecrypt& op) {
362
0
        if ( op.tag == std::nullopt ) {
363
0
            return nullptr;
364
0
        }
365
366
0
        return op.tag->GetPtr();
367
0
    }
368
369
    template <class CryptClass>
370
    void SetAAD(std::shared_ptr<CryptClass> crypt, const std::optional<component::AAD>& aad);
371
372
    template <>
373
0
    void SetAAD<>(std::shared_ptr<::Botan::AEAD_Mode> crypt, const std::optional<component::AAD>& aad) {
374
0
        if ( aad != std::nullopt ) {
375
0
            crypt->set_associated_data(aad->Get());
376
0
        }
377
0
    }
378
379
    template <>
380
0
    void SetAAD<>(std::shared_ptr<::Botan::Cipher_Mode> crypt, const std::optional<component::AAD>& aad) {
381
0
        (void)crypt;
382
0
        (void)aad;
383
0
    }
384
385
    template <class OperationType>
386
0
    ::Botan::secure_vector<uint8_t> GetInData(const OperationType& op) {
387
0
        const auto inPtr = GetInPtr(op);
388
0
        ::Botan::secure_vector<uint8_t> ret(inPtr, inPtr + GetInSize(op));
389
390
0
        if ( GetCryptType<OperationType>() == ::Botan::Cipher_Dir::Encryption ) {
391
0
            return ret;
392
0
        }
393
394
0
        const auto tagSize = GetTagSize(op);
395
396
0
        if ( tagSize == std::nullopt || *tagSize == 0 ) {
397
0
            return ret;
398
0
        }
399
400
        /* Append the tag */
401
402
0
        ret.resize(ret.size() + *tagSize);
403
404
0
        memcpy(ret.data() + GetInSize(op), GetTagPtr(op), *tagSize);
405
406
0
        return ret;
407
0
    }
Unexecuted instantiation: std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > cryptofuzz::module::Botan_detail::GetInData<cryptofuzz::operation::SymmetricEncrypt>(cryptofuzz::operation::SymmetricEncrypt const&)
Unexecuted instantiation: std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > cryptofuzz::module::Botan_detail::GetInData<cryptofuzz::operation::SymmetricDecrypt>(cryptofuzz::operation::SymmetricDecrypt const&)
408
409
    template <class ReturnType>
410
    ReturnType ToReturnType(const ::Botan::secure_vector<uint8_t>& data, std::optional<size_t> tagSize);
411
412
    template <>
413
0
    component::Ciphertext ToReturnType(const ::Botan::secure_vector<uint8_t>& data, std::optional<size_t> tagSize) {
414
0
        if ( tagSize == std::nullopt ) {
415
0
            return component::Ciphertext(Buffer(data.data(), data.size()));
416
0
        }
417
418
0
        const size_t ciphertextSize = data.size() - *tagSize;
419
420
0
        return component::Ciphertext(Buffer(data.data(), ciphertextSize), Buffer(data.data() + ciphertextSize, *tagSize));
421
0
    }
422
423
    template <>
424
0
    component::Cleartext ToReturnType(const ::Botan::secure_vector<uint8_t>& data, std::optional<size_t> tagSize) {
425
0
        (void)tagSize;
426
427
0
        return component::Cleartext(Buffer(data.data(), data.size()));
428
0
    }
429
430
    template <class ReturnType, class OperationType, class CryptClass>
431
0
        std::optional<ReturnType> Crypt(OperationType& op, Datasource& ds) {
432
0
            std::optional<ReturnType> ret = std::nullopt;
433
434
0
            if ( typeid(CryptClass) == typeid(::Botan::Cipher_Mode) ) {
435
0
                if ( op.aad != std::nullopt ) {
436
0
                    return std::nullopt;
437
0
                }
438
0
                if ( GetTagSize(op) != std::nullopt ) {
439
0
                    return std::nullopt;
440
0
                }
441
0
            }
442
443
0
            std::shared_ptr<CryptClass> crypt = nullptr;
444
0
            const ::Botan::SymmetricKey key(op.cipher.key.GetPtr(), op.cipher.key.GetSize());
445
0
            const ::Botan::InitializationVector iv(op.cipher.iv.GetPtr(), op.cipher.iv.GetSize());
446
0
            ::Botan::secure_vector<uint8_t> in = GetInData(op);
447
0
            ::Botan::secure_vector<uint8_t> out;
448
0
            bool useOneShot = true;
449
0
            util::Multipart parts;
450
451
0
            const std::optional<size_t> tagSize = GetTagSize(op);
452
453
0
            try {
454
                /* Initialize */
455
0
                {
456
0
                    std::optional<std::string> _algoString;
457
0
                    CF_CHECK_NE(_algoString = Botan_detail::CipherIDToString(op.cipher.cipherType.Get()), std::nullopt);
458
0
                    std::string algoString;
459
0
                    if ( tagSize == std::nullopt ) {
460
0
                        algoString = Botan_detail::parenthesize(*_algoString, std::to_string(0));
461
0
                    } else {
462
0
                        algoString = Botan_detail::parenthesize(*_algoString, std::to_string(*tagSize));
463
0
                    }
464
465
0
                    CF_CHECK_NE(crypt = CryptClass::create(algoString, GetCryptType<OperationType>()), nullptr);
466
0
                    crypt->set_key(key);
467
468
0
                    SetAAD(crypt, op.aad);
469
470
0
                    crypt->start(iv.bits_of());
471
0
                    if ( crypt->update_granularity() == 1 ) {
472
0
                        try {
473
0
                            useOneShot = ds.Get<bool>();
474
0
                        } catch ( fuzzing::datasource::Datasource::OutOfData ) { }
475
0
                    }
476
0
                    if ( useOneShot == false ) {
477
0
                        parts = util::ToParts(ds, GetInPtr(op), GetInSize(op));
478
0
                    }
479
0
                }
480
481
                /* Process */
482
0
                {
483
0
                    if ( useOneShot == true ) {
484
0
                        crypt->finish(in);
485
0
                    } else {
486
0
                        for (const auto& part : parts) {
487
0
                            std::vector<uint8_t> tmp(part.first, part.first + part.second);
488
0
                            const auto num = crypt->process(tmp.data(), tmp.size());
489
0
                            out.insert(out.end(), tmp.begin(), tmp.begin() + num);
490
0
                        }
491
0
                        crypt->finish(out, out.size());
492
0
                    }
493
0
                }
494
495
                /* Finalize */
496
0
                {
497
                    /* TODO take max output size in consideration */
498
499
0
                    if ( useOneShot == true ) {
500
0
                        ret = ToReturnType<ReturnType>(in, tagSize);
501
0
                    } else {
502
0
                        ret = ToReturnType<ReturnType>(::Botan::secure_vector<uint8_t>(out.data(), out.data() + out.size()), tagSize);
503
0
                    }
504
0
                }
505
0
            } catch ( ... ) { }
506
0
end:
507
508
0
            return ret;
509
0
        }
Unexecuted instantiation: std::__1::optional<cryptofuzz::component::Ciphertext> cryptofuzz::module::Botan_detail::Crypt<cryptofuzz::component::Ciphertext, cryptofuzz::operation::SymmetricEncrypt, Botan::AEAD_Mode>(cryptofuzz::operation::SymmetricEncrypt&, fuzzing::datasource::Datasource&)
Unexecuted instantiation: std::__1::optional<cryptofuzz::component::Ciphertext> cryptofuzz::module::Botan_detail::Crypt<cryptofuzz::component::Ciphertext, cryptofuzz::operation::SymmetricEncrypt, Botan::Cipher_Mode>(cryptofuzz::operation::SymmetricEncrypt&, fuzzing::datasource::Datasource&)
Unexecuted instantiation: std::__1::optional<cryptofuzz::Buffer> cryptofuzz::module::Botan_detail::Crypt<cryptofuzz::Buffer, cryptofuzz::operation::SymmetricDecrypt, Botan::AEAD_Mode>(cryptofuzz::operation::SymmetricDecrypt&, fuzzing::datasource::Datasource&)
Unexecuted instantiation: std::__1::optional<cryptofuzz::Buffer> cryptofuzz::module::Botan_detail::Crypt<cryptofuzz::Buffer, cryptofuzz::operation::SymmetricDecrypt, Botan::Cipher_Mode>(cryptofuzz::operation::SymmetricDecrypt&, fuzzing::datasource::Datasource&)
510
511
} /* namespace Botan_detail */
512
513
0
std::optional<component::MAC> Botan::OpCMAC(operation::CMAC& op) {
514
0
    if ( !repository::IsCBC(op.cipher.cipherType.Get()) ) {
515
0
        return std::nullopt;
516
0
    }
517
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
518
0
    std::optional<component::MAC> ret = std::nullopt;
519
0
    std::unique_ptr<::Botan::MessageAuthenticationCode> cmac = nullptr;
520
0
    util::Multipart parts;
521
522
0
    try {
523
        /* Initialize */
524
0
        {
525
0
            BOTAN_SET_GLOBAL_DS
526
527
0
            std::optional<std::string> algoString;
528
0
            CF_CHECK_NE(algoString = Botan_detail::CipherIDToString(op.cipher.cipherType.Get(), false), std::nullopt);
529
530
0
            const std::string cmacString = Botan_detail::parenthesize("CMAC", *algoString);
531
532
0
            CF_CHECK_NE(cmac = ::Botan::MessageAuthenticationCode::create(cmacString), nullptr);
533
534
0
            try {
535
0
                cmac->set_key(op.cipher.key.GetPtr(), op.cipher.key.GetSize());
536
0
            } catch ( ... ) {
537
0
                goto end;
538
0
            }
539
540
0
            parts = util::ToParts(ds, op.cleartext);
541
0
        }
542
543
        /* Process */
544
0
        for (const auto& part : parts) {
545
0
            cmac->update(part.first, part.second);
546
0
        }
547
548
        /* Finalize */
549
0
        {
550
0
            const auto res = cmac->final();
551
0
            ret = component::MAC(res.data(), res.size());
552
0
        }
553
554
0
    } catch ( ... ) { }
555
556
0
end:
557
0
    BOTAN_UNSET_GLOBAL_DS
558
559
0
    return ret;
560
0
}
561
562
0
std::optional<component::Ciphertext> Botan::OpSymmetricEncrypt(operation::SymmetricEncrypt& op) {
563
0
    if ( op.cipher.cipherType.Is(CF_CIPHER("CHACHA20_POLY1305")) && op.cipher.iv.GetSize() == 24 ) {
564
        /* Botan interpretes CHACHA20_POLY1305 + 192 bits IV as XCHACHA20_POLY1305 */
565
0
        return std::nullopt;
566
0
    }
567
568
0
    std::optional<component::Ciphertext> ret = std::nullopt;
569
570
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
571
0
    BOTAN_SET_GLOBAL_DS
572
573
0
    if ( cryptofuzz::repository::IsAEAD(op.cipher.cipherType.Get()) ) {
574
0
        ret = Botan_detail::Crypt<component::Ciphertext, operation::SymmetricEncrypt, ::Botan::AEAD_Mode>(op, ds);
575
0
    } else {
576
0
        ret = Botan_detail::Crypt<component::Ciphertext, operation::SymmetricEncrypt, ::Botan::Cipher_Mode>(op, ds);
577
0
    }
578
579
    BOTAN_UNSET_GLOBAL_DS
580
581
0
    return ret;
582
0
}
583
584
0
std::optional<component::Cleartext> Botan::OpSymmetricDecrypt(operation::SymmetricDecrypt& op) {
585
0
    if ( op.cipher.cipherType.Is(CF_CIPHER("CHACHA20_POLY1305")) && op.cipher.iv.GetSize() == 24 ) {
586
0
        return std::nullopt;
587
0
    }
588
589
0
    std::optional<component::Cleartext> ret = std::nullopt;
590
591
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
592
0
    BOTAN_SET_GLOBAL_DS
593
594
0
    if ( cryptofuzz::repository::IsAEAD(op.cipher.cipherType.Get()) ) {
595
0
        ret = Botan_detail::Crypt<component::Cleartext, operation::SymmetricDecrypt, ::Botan::AEAD_Mode>(op, ds);
596
0
    } else {
597
0
        ret = Botan_detail::Crypt<component::Cleartext, operation::SymmetricDecrypt, ::Botan::Cipher_Mode>(op, ds);
598
0
    }
599
600
    BOTAN_UNSET_GLOBAL_DS
601
602
0
    return ret;
603
0
}
604
605
0
std::optional<component::Key> Botan::OpKDF_SCRYPT(operation::KDF_SCRYPT& op) {
606
0
    std::optional<component::Key> ret = std::nullopt;
607
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
608
0
    std::unique_ptr<::Botan::PasswordHashFamily> pwdhash_fam = nullptr;
609
0
    std::unique_ptr<::Botan::PasswordHash> pwdhash = nullptr;
610
0
    uint8_t* out = util::malloc(op.keySize);
611
612
0
    try {
613
        /* Initialize */
614
0
        {
615
0
            BOTAN_SET_GLOBAL_DS
616
617
0
            CF_CHECK_NE(pwdhash_fam = ::Botan::PasswordHashFamily::create("Scrypt"), nullptr);
618
0
            CF_CHECK_NE(pwdhash = pwdhash_fam->from_params(op.N, op.r, op.p), nullptr);
619
620
0
        }
621
622
        /* Process */
623
0
        {
624
0
            pwdhash->derive_key(
625
0
                    out,
626
0
                    op.keySize,
627
0
                    (const char*)op.password.GetPtr(),
628
0
                    op.password.GetSize(),
629
0
                    op.salt.GetPtr(),
630
0
                    op.salt.GetSize());
631
0
        }
632
633
        /* Finalize */
634
0
        {
635
0
            ret = component::Key(out, op.keySize);
636
0
        }
637
0
    } catch ( ... ) { }
638
639
0
end:
640
0
    util::free(out);
641
642
    BOTAN_UNSET_GLOBAL_DS
643
644
0
    return ret;
645
0
}
646
647
0
std::optional<component::Key> Botan::OpKDF_HKDF(operation::KDF_HKDF& op) {
648
0
    std::optional<component::Key> ret = std::nullopt;
649
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
650
0
    std::unique_ptr<::Botan::KDF> hkdf = nullptr;
651
652
0
    try {
653
0
        {
654
0
            BOTAN_SET_GLOBAL_DS
655
656
0
            std::optional<std::string> algoString;
657
0
            CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get(), true), std::nullopt);
658
659
0
            const std::string hkdfString = Botan_detail::parenthesize("HKDF", *algoString);
660
0
            hkdf = ::Botan::KDF::create(hkdfString);
661
0
        }
662
663
0
        {
664
0
            auto derived = hkdf->derive_key(op.keySize, op.password.Get(), op.salt.Get(), op.info.Get());
665
666
0
            ret = component::Key(derived.data(), derived.size());
667
0
        }
668
0
    } catch ( ... ) { }
669
670
0
end:
671
0
    BOTAN_UNSET_GLOBAL_DS
672
673
0
    return ret;
674
0
}
675
676
0
std::optional<component::Key> Botan::OpKDF_PBKDF2(operation::KDF_PBKDF2& op) {
677
0
    std::optional<component::Key> ret = std::nullopt;
678
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
679
0
    std::unique_ptr<::Botan::PasswordHashFamily> pwdhash_fam = nullptr;
680
0
    std::unique_ptr<::Botan::PasswordHash> pwdhash = nullptr;
681
0
    uint8_t* out = util::malloc(op.keySize);
682
683
0
    try {
684
        /* Initialize */
685
0
        {
686
0
            BOTAN_SET_GLOBAL_DS
687
688
0
            std::optional<std::string> algoString;
689
0
            CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get(), true), std::nullopt);
690
691
0
            const std::string pbkdf2String = Botan_detail::parenthesize("PBKDF2", *algoString);
692
0
            CF_CHECK_NE(pwdhash_fam = ::Botan::PasswordHashFamily::create(pbkdf2String), nullptr);
693
694
0
            CF_CHECK_NE(pwdhash = pwdhash_fam->from_params(op.iterations), nullptr);
695
696
0
        }
697
698
        /* Process */
699
0
        {
700
0
            pwdhash->derive_key(
701
0
                    out,
702
0
                    op.keySize,
703
0
                    (const char*)op.password.GetPtr(),
704
0
                    op.password.GetSize(),
705
0
                    op.salt.GetPtr(),
706
0
                    op.salt.GetSize());
707
0
        }
708
709
        /* Finalize */
710
0
        {
711
0
            ret = component::Key(out, op.keySize);
712
0
        }
713
0
    } catch ( ... ) { }
714
715
0
end:
716
0
    util::free(out);
717
718
    BOTAN_UNSET_GLOBAL_DS
719
720
0
    return ret;
721
0
}
722
723
0
std::optional<component::Key> Botan::OpKDF_ARGON2(operation::KDF_ARGON2& op) {
724
0
    std::optional<component::Key> ret = std::nullopt;
725
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
726
0
    std::unique_ptr<::Botan::PasswordHashFamily> pwdhash_fam = nullptr;
727
0
    std::unique_ptr<::Botan::PasswordHash> pwdhash = nullptr;
728
0
    uint8_t* out = util::malloc(op.keySize);
729
730
0
    try {
731
        /* Initialize */
732
0
        {
733
0
            BOTAN_SET_GLOBAL_DS
734
735
0
            std::string argon2String;
736
737
0
            switch ( op.type ) {
738
0
                case    0:
739
0
                    argon2String = "Argon2d";
740
0
                    break;
741
0
                case    1:
742
0
                    argon2String = "Argon2i";
743
0
                    break;
744
0
                case    2:
745
0
                    argon2String = "Argon2id";
746
0
                    break;
747
0
                default:
748
0
                    goto end;
749
0
            }
750
0
            CF_CHECK_NE(pwdhash_fam = ::Botan::PasswordHashFamily::create(argon2String), nullptr);
751
752
0
            CF_CHECK_NE(pwdhash = pwdhash_fam->from_params(
753
0
                        op.memory,
754
0
                        op.iterations,
755
0
                        op.threads), nullptr);
756
0
        }
757
758
        /* Process */
759
0
        {
760
0
            pwdhash->derive_key(
761
0
                    out,
762
0
                    op.keySize,
763
0
                    (const char*)op.password.GetPtr(),
764
0
                    op.password.GetSize(),
765
0
                    op.salt.GetPtr(),
766
0
                    op.salt.GetSize());
767
0
        }
768
769
        /* Finalize */
770
0
        {
771
0
            ret = component::Key(out, op.keySize);
772
0
        }
773
0
    } catch ( ... ) { }
774
775
0
end:
776
0
    util::free(out);
777
778
    BOTAN_UNSET_GLOBAL_DS
779
780
0
    return ret;
781
0
}
782
783
0
std::optional<component::Key> Botan::OpKDF_SP_800_108(operation::KDF_SP_800_108& op) {
784
0
    std::optional<component::Key> ret = std::nullopt;
785
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
786
0
    uint8_t* out = util::malloc(op.keySize);
787
0
    std::unique_ptr<::Botan::KDF> sp_800_108 = nullptr;
788
789
0
    try {
790
0
        BOTAN_SET_GLOBAL_DS
791
792
0
        std::optional<std::string> algoString;
793
0
        CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.mech.type.Get(), true), std::nullopt);
794
795
0
        const std::string hmacString = Botan_detail::parenthesize("HMAC", *algoString);
796
0
        std::string sp_800_108_string;
797
0
        switch ( op.mode ) {
798
0
            case    0:
799
0
                sp_800_108_string = Botan_detail::parenthesize("SP800-108-Counter", hmacString);
800
0
                break;
801
0
            case    1:
802
0
                sp_800_108_string = Botan_detail::parenthesize("SP800-108-Feedback", hmacString);
803
0
                break;
804
0
            case    2:
805
0
                sp_800_108_string = Botan_detail::parenthesize("SP800-108-Pipeline", hmacString);
806
0
                break;
807
0
            default:
808
0
                goto end;
809
0
        }
810
811
0
        sp_800_108 = ::Botan::KDF::create(sp_800_108_string);
812
813
0
        {
814
0
            auto derived = sp_800_108->derive_key(op.keySize, op.secret.Get(), op.salt.Get(), op.label.Get());
815
816
0
            ret = component::Key(derived.data(), derived.size());
817
0
        }
818
0
    } catch ( ... ) { }
819
820
0
end:
821
0
    util::free(out);
822
823
    BOTAN_UNSET_GLOBAL_DS
824
825
0
    return ret;
826
0
}
827
828
0
std::optional<component::Key> Botan::OpKDF_TLS1_PRF(operation::KDF_TLS1_PRF& op) {
829
0
    std::optional<component::Key> ret = std::nullopt;
830
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
831
0
    std::unique_ptr<::Botan::KDF> tlsprf = nullptr;
832
833
0
    try {
834
0
        BOTAN_SET_GLOBAL_DS
835
836
0
        {
837
0
            CF_CHECK_EQ(op.digestType.Get(), CF_DIGEST("MD5_SHA1"));
838
0
            CF_CHECK_NE(tlsprf = ::Botan::KDF::create("TLS-PRF()"), nullptr);
839
0
        }
840
841
0
        {
842
0
            const auto derived = tlsprf->derive_key(op.keySize, op.secret.Get(), op.seed.Get(), std::vector<uint8_t>{});
843
844
0
            ret = component::Key(derived.data(), derived.size());
845
0
        }
846
0
    } catch ( ... ) { }
847
848
0
end:
849
0
    BOTAN_UNSET_GLOBAL_DS
850
851
0
    return ret;
852
0
}
853
854
0
std::optional<component::Key> Botan::OpKDF_BCRYPT(operation::KDF_BCRYPT& op) {
855
0
    std::optional<component::Key> ret = std::nullopt;
856
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
857
0
    std::unique_ptr<::Botan::PasswordHashFamily> pwdhash_fam = nullptr;
858
0
    std::unique_ptr<::Botan::PasswordHash> pwdhash = nullptr;
859
0
    uint8_t* out = util::malloc(op.keySize);
860
861
0
    try {
862
0
        BOTAN_SET_GLOBAL_DS
863
864
        /* Initialize */
865
0
        {
866
0
            CF_CHECK_EQ(op.digestType.Get(), CF_DIGEST("SHA512"));
867
0
            CF_CHECK_NE(pwdhash_fam = ::Botan::PasswordHashFamily::create("Bcrypt-PBKDF"), nullptr);
868
0
            CF_CHECK_NE(pwdhash = pwdhash_fam->from_params(op.iterations), nullptr);
869
870
0
        }
871
872
        /* Process */
873
0
        {
874
0
            pwdhash->derive_key(
875
0
                    out,
876
0
                    op.keySize,
877
0
                    (const char*)op.secret.GetPtr(),
878
0
                    op.secret.GetSize(),
879
0
                    op.salt.GetPtr(),
880
0
                    op.salt.GetSize());
881
0
        }
882
883
        /* Finalize */
884
0
        {
885
0
            ret = component::Key(out, op.keySize);
886
0
        }
887
0
    } catch ( ... ) { }
888
889
0
end:
890
0
    util::free(out);
891
892
    BOTAN_UNSET_GLOBAL_DS
893
894
0
    return ret;
895
0
}
896
897
namespace Botan_detail {
898
1.04k
    std::optional<std::string> CurveIDToString(const uint64_t curveID) {
899
1.04k
#include "curve_string_lut.h"
900
1.04k
        std::optional<std::string> ret = std::nullopt;
901
902
1.04k
        CF_CHECK_NE(LUT.find(curveID), LUT.end());
903
1.01k
        ret = LUT.at(curveID);
904
1.04k
end:
905
1.04k
        return ret;
906
1.01k
    }
907
} /* namespace Botan_detail */
908
909
0
std::optional<component::ECC_KeyPair> Botan::OpECC_GenerateKeyPair(operation::ECC_GenerateKeyPair& op) {
910
0
    std::optional<component::ECC_KeyPair> ret = std::nullopt;
911
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
912
913
0
    std::optional<std::string> curveString;
914
0
    BOTAN_FUZZER_RNG;
915
916
0
    CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
917
918
0
    try {
919
0
        ::Botan::EC_Group group(*curveString);
920
0
        auto priv = ::Botan::ECDSA_PrivateKey(rng, group);
921
922
0
        const auto public_point = ::Botan::EC_AffinePoint::deserialize(group, priv.raw_public_key_bits());
923
0
        const auto pub_x = ::Botan::BigInt::from_bytes(public_point->x_bytes());
924
0
        const auto pub_y = ::Botan::BigInt::from_bytes(public_point->y_bytes());
925
926
0
        {
927
0
            const auto pub = priv.public_key();
928
0
            CF_ASSERT(pub->check_key(rng, true) == true, "Generated pubkey fails validation");
929
0
        }
930
931
0
        ret = { priv.private_value().to_dec_string(), { pub_x.to_dec_string(), pub_y.to_dec_string() } };
932
933
      /* Catch exception thrown from Botan_detail::Fuzzer_RNG::randomize */
934
0
    } catch ( fuzzing::datasource::Datasource::OutOfData ) { }
935
936
0
end:
937
0
    return ret;
938
0
}
939
940
0
std::optional<bool> Botan::OpECC_ValidatePubkey(operation::ECC_ValidatePubkey& op) {
941
0
    std::optional<bool> ret = std::nullopt;
942
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
943
944
0
    BOTAN_FUZZER_RNG;
945
0
    std::unique_ptr<::Botan::Public_Key> pub = nullptr;
946
947
0
    try {
948
0
        std::optional<std::string> curveString;
949
0
        CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
950
951
0
        ::Botan::EC_Group group(*curveString);
952
0
        const auto pub_x = ::Botan::BigInt::from_string(op.pub.first.ToString(ds));
953
0
        const auto pub_y = ::Botan::BigInt::from_string(op.pub.second.ToString(ds));
954
0
        std::optional<::Botan::EC_AffinePoint> public_point;
955
0
        CF_CHECK_NE(public_point = ::Botan::EC_AffinePoint::from_bigint_xy(group, pub_x, pub_y), std::nullopt);
956
0
        pub = std::make_unique<::Botan::ECDSA_PublicKey>(::Botan::ECDSA_PublicKey(group, *public_point));
957
958
0
        ret = pub->check_key(rng, true);
959
0
    } catch ( ... ) { }
960
961
0
end:
962
0
    return ret;
963
0
}
964
965
530
std::optional<component::ECC_PublicKey> Botan::OpECC_PrivateToPublic(operation::ECC_PrivateToPublic& op) {
966
530
    std::optional<component::ECC_PublicKey> ret = std::nullopt;
967
530
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
968
969
530
    BOTAN_FUZZER_RNG;
970
971
530
    try {
972
530
        std::optional<std::string> curveString;
973
974
530
        if ( op.curveType.Get() == CF_ECC_CURVE("x25519") ) {
975
0
            uint8_t priv_bytes[32];
976
977
0
            const ::Botan::BigInt priv_bigint(op.priv.ToString(ds));
978
0
            CF_CHECK_GT(priv_bigint, 0);
979
980
0
            priv_bigint.binary_encode(priv_bytes, sizeof(priv_bytes));
981
0
            priv_bytes[0] &= 248;
982
0
            priv_bytes[31] &= 127;
983
0
            priv_bytes[31] |= 64;
984
0
            const ::Botan::secure_vector<uint8_t> priv_vec(priv_bytes, priv_bytes + sizeof(priv_bytes));
985
986
0
            auto priv = ::Botan::X25519_PrivateKey(priv_vec);
987
988
0
            ::Botan::BigInt pub;
989
0
            pub.binary_decode(priv.public_value());
990
991
0
            ret = { pub.to_dec_string(), "0" };
992
530
        } else {
993
530
            CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
994
516
            ::Botan::EC_Group group(*curveString);
995
996
516
            const ::Botan::BigInt priv_bn(op.priv.ToString(ds));
997
516
            CF_CHECK_GT(priv_bn, 0);
998
999
491
            auto priv = std::make_unique<::Botan::ECDSA_PrivateKey>(::Botan::ECDSA_PrivateKey(rng, group, priv_bn));
1000
1001
491
            const auto public_point = ::Botan::EC_AffinePoint::deserialize(group, priv->raw_public_key_bits());
1002
491
            const auto pub_x = ::Botan::BigInt::from_bytes(public_point->x_bytes());
1003
491
            const auto pub_y = ::Botan::BigInt::from_bytes(public_point->y_bytes());
1004
1005
491
            ret = { pub_x.to_dec_string(), pub_y.to_dec_string() };
1006
491
        }
1007
530
    } catch ( ... ) { }
1008
1009
530
end:
1010
530
    return ret;
1011
530
}
1012
1013
namespace Botan_detail {
1014
    template <class PrivkeyType, class Operation, bool RFC6979 = true>
1015
0
        std::optional<component::ECDSA_Signature> ECxDSA_Sign(Operation& op) {
1016
0
            std::optional<component::ECDSA_Signature> ret = std::nullopt;
1017
0
            Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1018
1019
0
            std::unique_ptr<PrivkeyType> priv = nullptr;
1020
0
            std::unique_ptr<::Botan::Public_Key> pub = nullptr;
1021
0
            std::unique_ptr<::Botan::PK_Signer> signer;
1022
1023
0
            BOTAN_FUZZER_RNG;
1024
1025
            BOTAN_SET_GLOBAL_DS
1026
1027
0
            if ( RFC6979 == true ) {
1028
0
                CF_CHECK_EQ(op.UseRFC6979Nonce(), true);
1029
0
            } else {
1030
0
                CF_CHECK_EQ(op.UseRandomNonce(), true);
1031
0
            }
1032
1033
0
            CF_CHECK_EQ(op.digestType.Get(), CF_DIGEST("SHA256"));
1034
1035
0
            try {
1036
                /* Initialize */
1037
0
                {
1038
1039
0
                    std::optional<std::string> curveString, algoString;
1040
1041
0
                    CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1042
0
                    ::Botan::EC_Group group(*curveString);
1043
1044
                    /* Private key */
1045
0
                    {
1046
0
                        const ::Botan::BigInt priv_bn(op.priv.ToString(ds));
1047
1048
                        /* Botan appears to generate a new key if the input key is 0,
1049
                         * so don't do this */
1050
0
                        CF_CHECK_NE(priv_bn, 0);
1051
1052
0
                        priv = std::make_unique<PrivkeyType>(PrivkeyType(rng, group, priv_bn));
1053
0
                    }
1054
1055
                    /* Prepare signer */
1056
0
                    CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get()), std::nullopt);
1057
1058
0
                    const std::string emsa1String = Botan_detail::parenthesize("EMSA1", *algoString);
1059
0
                    signer.reset(new ::Botan::PK_Signer(*priv, rng, emsa1String, ::Botan::Signature_Format::DerSequence));
1060
0
                }
1061
1062
                /* Process */
1063
0
                {
1064
0
                    const auto signature = signer->sign_message(op.cleartext.Get(), rng);
1065
1066
                    /* Retrieve R and S */
1067
0
                    {
1068
0
                        ::Botan::BER_Decoder decoder(signature);
1069
0
                        ::Botan::BER_Decoder ber_sig = decoder.start_sequence();
1070
1071
0
                        size_t count = 0;
1072
1073
0
                        ::Botan::BigInt R;
1074
0
                        ::Botan::BigInt S;
1075
0
                        while(ber_sig.more_items())
1076
0
                        {
1077
0
                            switch ( count ) {
1078
0
                                case    0:
1079
0
                                    ber_sig.decode(R);
1080
0
                                    break;
1081
0
                                case    1:
1082
0
                                    ber_sig.decode(S);
1083
0
                                    break;
1084
0
                                default:
1085
0
                                    printf("Error: Too many parts in signature BER\n");
1086
0
                                    abort();
1087
0
                            }
1088
1089
0
                            ++count;
1090
0
                        }
1091
1092
0
                        if ( op.curveType.Get() == CF_ECC_CURVE("secp256k1") ) {
1093
                            /* For compatibility with the secp256k1 library.
1094
                             * See: https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#low-s-values-in-signatures
1095
                             */
1096
0
                            if (S > ::Botan::BigInt::from_string("57896044618658097711785492504343953926418782139537452191302581570759080747168")) {
1097
0
                                S = ::Botan::BigInt::from_string("115792089237316195423570985008687907852837564279074904382605163141518161494337") - S;
1098
0
                            }
1099
0
                        } else if ( op.curveType.Get() == CF_ECC_CURVE("secp256r1") ) {
1100
                            /* Similar ECDSA signature malleability adjustment for compatibility with trezor-firmware */
1101
0
                            if (S > ::Botan::BigInt::from_string("57896044605178124381348723474703786764998477612067880171211129530534256022184")) {
1102
0
                                S = ::Botan::BigInt::from_string("115792089210356248762697446949407573529996955224135760342422259061068512044369") - S;
1103
0
                            }
1104
0
                        }
1105
1106
0
                        const auto public_point = ::Botan::EC_AffinePoint::deserialize(priv->domain(), priv->raw_public_key_bits());
1107
0
                        const auto pub_x = ::Botan::BigInt::from_bytes(public_point->x_bytes()).to_dec_string();
1108
0
                        const auto pub_y = ::Botan::BigInt::from_bytes(public_point->y_bytes()).to_dec_string();
1109
1110
0
                        const auto R_str = R.to_dec_string();
1111
0
                        const auto S_str = S.to_dec_string();
1112
1113
0
                        ret = component::ECDSA_Signature({ R_str, S_str }, { pub_x, pub_y });
1114
0
                    }
1115
0
                }
1116
0
            } catch ( ... ) { }
1117
1118
0
end:
1119
0
            BOTAN_UNSET_GLOBAL_DS
1120
1121
0
            return ret;
1122
0
        }
Unexecuted instantiation: std::__1::optional<cryptofuzz::component::ECDSA_Signature> cryptofuzz::module::Botan_detail::ECxDSA_Sign<Botan::ECDSA_PrivateKey, cryptofuzz::operation::ECDSA_Sign, true>(cryptofuzz::operation::ECDSA_Sign&)
Unexecuted instantiation: std::__1::optional<cryptofuzz::component::ECDSA_Signature> cryptofuzz::module::Botan_detail::ECxDSA_Sign<Botan::ECGDSA_PrivateKey, cryptofuzz::operation::ECGDSA_Sign, false>(cryptofuzz::operation::ECGDSA_Sign&)
1123
} /* namespace Botan_detail */
1124
1125
0
std::optional<component::ECDSA_Signature> Botan::OpECDSA_Sign(operation::ECDSA_Sign& op) {
1126
0
    if ( op.curveType.Is(CF_ECC_CURVE("ed25519")) ) {
1127
0
        const auto _priv_bytes = util::DecToBin(op.priv.ToTrimmedString(), 32);
1128
0
        if ( _priv_bytes == std::nullopt ) {
1129
0
            return std::nullopt;
1130
0
        }
1131
1132
0
        const ::Botan::secure_vector<uint8_t> priv_bytes(_priv_bytes->data(), _priv_bytes->data() + _priv_bytes->size());
1133
1134
0
        const auto priv = std::make_unique<::Botan::Ed25519_PrivateKey>(priv_bytes);
1135
1136
0
        std::unique_ptr<::Botan::PK_Signer> signer;
1137
1138
0
        Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1139
0
        BOTAN_FUZZER_RNG;
1140
1141
0
        signer.reset(new ::Botan::PK_Signer(*priv, rng, "Pure", ::Botan::Signature_Format::Standard));
1142
1143
0
        const auto signature = signer->sign_message(op.cleartext.Get(), rng);
1144
0
        CF_ASSERT(signature.size() == 64, "ed25519 signature is not 64 bytes");
1145
1146
0
        const auto pub = priv->get_public_key();
1147
0
        CF_ASSERT(pub.size() == 32, "ed25519 pubkey is not 32 bytes");
1148
1149
0
        const auto ret = component::ECDSA_Signature(
1150
0
                { util::BinToDec(signature.data(), 32), util::BinToDec(signature.data() + 32, 32) },
1151
0
                { util::BinToDec(pub.data(), 32), "0"}
1152
0
        );
1153
1154
0
        return ret;
1155
0
    }
1156
1157
0
    return Botan_detail::ECxDSA_Sign<::Botan::ECDSA_PrivateKey, operation::ECDSA_Sign>(op);
1158
0
}
1159
1160
0
std::optional<component::ECGDSA_Signature> Botan::OpECGDSA_Sign(operation::ECGDSA_Sign& op) {
1161
0
    return Botan_detail::ECxDSA_Sign<::Botan::ECGDSA_PrivateKey, operation::ECGDSA_Sign, false>(op);
1162
0
}
1163
1164
namespace Botan_detail {
1165
    template <class PubkeyType, class Operation>
1166
0
        std::optional<bool> ECxDSA_Verify(Operation& op) {
1167
0
            try {
1168
0
                std::optional<bool> ret = std::nullopt;
1169
0
                Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1170
1171
0
                ::Botan::secure_vector<uint8_t> sig;
1172
0
                std::unique_ptr<::Botan::Public_Key> pub = nullptr;
1173
0
                std::unique_ptr<::Botan::EC_Group> group = nullptr;
1174
0
                Buffer CT;
1175
1176
0
                {
1177
0
                    BOTAN_SET_GLOBAL_DS;
1178
1179
0
                    std::optional<std::string> curveString;
1180
0
                    CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1181
0
                    group = std::make_unique<::Botan::EC_Group>(*curveString);
1182
0
                }
1183
1184
                /* Construct signature */
1185
0
                {
1186
0
                    const ::Botan::BigInt R(op.signature.signature.first.ToString(ds));
1187
0
                    const ::Botan::BigInt S(op.signature.signature.second.ToString(ds));
1188
0
                    sig = ::Botan::BigInt::encode_fixed_length_int_pair(R, S, group->get_order_bytes());
1189
0
                }
1190
1191
                /* Construct pubkey */
1192
0
                {
1193
0
                    const auto pub_x = ::Botan::BigInt::from_string(op.signature.pub.first.ToString(ds));
1194
0
                    const auto pub_y = ::Botan::BigInt::from_string(op.signature.pub.second.ToString(ds));
1195
0
                    std::optional<::Botan::EC_AffinePoint> public_point;
1196
0
                    CF_CHECK_NE(public_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, pub_x, pub_y), std::nullopt);
1197
0
                    pub = std::make_unique<PubkeyType>(PubkeyType(*group, *public_point));
1198
0
                }
1199
1200
                /* Construct input */
1201
0
                {
1202
0
                    if ( op.digestType.Get() == CF_DIGEST("NULL") ) {
1203
0
                        CT = op.cleartext.ECDSA_RandomPad(ds, op.curveType);
1204
0
                    } else {
1205
0
                        std::optional<std::string> algoString;
1206
0
                        CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get()), std::nullopt);
1207
1208
0
                        auto hash = ::Botan::HashFunction::create(*algoString);
1209
0
                        hash->update(op.cleartext.GetPtr(), op.cleartext.GetSize());
1210
0
                        const auto _CT = hash->final();
1211
0
                        CT = Buffer(_CT.data(), _CT.size()).ECDSA_RandomPad(ds, op.curveType);
1212
0
                    }
1213
0
                }
1214
1215
0
                ret = ::Botan::PK_Verifier(*pub, "Raw").verify_message(CT.Get(), sig);
1216
1217
0
end:
1218
0
                BOTAN_UNSET_GLOBAL_DS;
1219
1220
0
                return ret;
1221
0
            } catch (::Botan::Internal_Error& e) {
1222
0
                throw e;
1223
0
            } catch (::Botan::Exception& e) {
1224
0
                BOTAN_UNSET_GLOBAL_DS;
1225
0
                return false;
1226
0
            }
1227
0
        }
Unexecuted instantiation: std::__1::optional<bool> cryptofuzz::module::Botan_detail::ECxDSA_Verify<Botan::ECDSA_PublicKey, cryptofuzz::operation::ECDSA_Verify>(cryptofuzz::operation::ECDSA_Verify&)
Unexecuted instantiation: std::__1::optional<bool> cryptofuzz::module::Botan_detail::ECxDSA_Verify<Botan::ECGDSA_PublicKey, cryptofuzz::operation::ECGDSA_Verify>(cryptofuzz::operation::ECGDSA_Verify&)
1228
} /* namespace Botan_detail */
1229
1230
0
std::optional<bool> Botan::OpECDSA_Verify(operation::ECDSA_Verify& op) {
1231
0
    if ( op.curveType.Is(CF_ECC_CURVE("ed25519")) ) {
1232
0
        const auto pub_bytes = util::DecToBin(op.signature.pub.first.ToTrimmedString(), 32);
1233
0
        if ( pub_bytes == std::nullopt ) {
1234
0
            return std::nullopt;
1235
0
        }
1236
0
        const auto pub = std::make_unique<::Botan::Ed25519_PublicKey>(*pub_bytes);
1237
1238
0
        const auto sig_r = util::DecToBin(op.signature.signature.first.ToTrimmedString(), 32);
1239
0
        if ( sig_r == std::nullopt ) {
1240
0
            return std::nullopt;
1241
0
        }
1242
1243
0
        const auto sig_s = util::DecToBin(op.signature.signature.second.ToTrimmedString(), 32);
1244
0
        if ( sig_s == std::nullopt ) {
1245
0
            return std::nullopt;
1246
0
        }
1247
1248
0
        std::vector<uint8_t> sig_bytes(64);
1249
0
        memcpy(sig_bytes.data(), sig_r->data(), 32);
1250
0
        memcpy(sig_bytes.data() + 32, sig_s->data(), 32);
1251
1252
0
        const bool ret = ::Botan::PK_Verifier(*pub, "Pure").verify_message(op.cleartext.Get(), sig_bytes);
1253
0
        return ret;
1254
1255
0
    } else {
1256
0
        return Botan_detail::ECxDSA_Verify<::Botan::ECDSA_PublicKey, operation::ECDSA_Verify>(op);
1257
0
    }
1258
0
}
1259
1260
0
std::optional<bool> Botan::OpECGDSA_Verify(operation::ECGDSA_Verify& op) {
1261
0
    return Botan_detail::ECxDSA_Verify<::Botan::ECGDSA_PublicKey, operation::ECGDSA_Verify>(op);
1262
0
}
1263
1264
0
std::optional<component::ECC_PublicKey> Botan::OpECDSA_Recover(operation::ECDSA_Recover& op) {
1265
0
    std::optional<component::ECC_PublicKey> ret = std::nullopt;
1266
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1267
1268
0
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1269
0
    Buffer CT;
1270
1271
0
    {
1272
0
        std::optional<std::string> curveString;
1273
0
        CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1274
0
        group = std::make_unique<::Botan::EC_Group>(*curveString);
1275
0
    }
1276
1277
    /* Construct input */
1278
0
    {
1279
0
        if ( op.digestType.Get() == CF_DIGEST("NULL") ) {
1280
0
            CT = op.cleartext.ECDSA_RandomPad(ds, op.curveType);
1281
0
        } else {
1282
0
            std::optional<std::string> algoString;
1283
0
            CF_CHECK_NE(algoString = Botan_detail::DigestIDToString(op.digestType.Get()), std::nullopt);
1284
1285
0
            auto hash = ::Botan::HashFunction::create(*algoString);
1286
0
            hash->update(op.cleartext.GetPtr(), op.cleartext.GetSize());
1287
0
            const auto _CT = hash->final();
1288
0
            CT = Buffer(_CT.data(), _CT.size()).ECDSA_RandomPad(ds, op.curveType);
1289
0
        }
1290
0
    }
1291
1292
0
    {
1293
0
        const ::Botan::BigInt R(op.signature.first.ToString(ds));
1294
0
        const ::Botan::BigInt S(op.signature.second.ToString(ds));
1295
1296
0
        std::unique_ptr<::Botan::ECDSA_PublicKey> pub = nullptr;
1297
0
        try {
1298
0
            pub = std::make_unique<::Botan::ECDSA_PublicKey>(*group, CT.Get(), R, S, op.id);
1299
0
            const auto public_point = ::Botan::EC_AffinePoint::deserialize(*group, pub->raw_public_key_bits());
1300
1301
0
            ret = {
1302
0
                ::Botan::BigInt::from_bytes(public_point->x_bytes()).to_dec_string(),
1303
0
                ::Botan::BigInt::from_bytes(public_point->y_bytes()).to_dec_string()
1304
0
            };
1305
0
        } catch ( ::Botan::Invalid_State& e ) {
1306
0
        } catch ( ::Botan::Decoding_Error& ) {
1307
0
        } catch ( ::Botan::Invalid_Argument& ) {
1308
            //ret = {"0", "0"};
1309
0
        }
1310
1311
0
    }
1312
1313
0
end:
1314
0
    return ret;
1315
0
}
1316
1317
0
std::optional<component::Bignum> Botan::OpDH_Derive(operation::DH_Derive& op) {
1318
0
    std::optional<component::Bignum> ret = std::nullopt;
1319
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1320
1321
0
    BOTAN_FUZZER_RNG;
1322
1323
0
    try {
1324
0
        CF_CHECK_NE(op.priv.ToTrimmedString(), "0");
1325
1326
0
        const ::Botan::BigInt g(op.base.ToString(ds));
1327
0
        const ::Botan::BigInt p(op.prime.ToString(ds));
1328
0
        const ::Botan::DL_Group grp(p, g);
1329
1330
0
        const ::Botan::BigInt _priv(op.priv.ToString(ds));
1331
1332
        /* Prevent time-out */
1333
0
        CF_CHECK_LT(g.bytes(), 80);
1334
0
        CF_CHECK_LT(p.bytes(), 80);
1335
0
        CF_CHECK_LT(_priv.bytes(), 80);
1336
1337
0
        std::unique_ptr<::Botan::Private_Key> priv(new ::Botan::DH_PrivateKey(grp, _priv));
1338
1339
0
        const ::Botan::BigInt _pub(op.pub.ToString(ds));
1340
0
        ::Botan::DH_PublicKey pub(grp, _pub);
1341
1342
0
        std::unique_ptr<::Botan::PK_Key_Agreement> kas(new ::Botan::PK_Key_Agreement(*priv, rng, "Raw"));
1343
0
        const auto derived_key = kas->derive_key(0, pub.public_value());
1344
1345
0
        const auto derived_str = ::Botan::BigInt::from_bytes(derived_key.bits_of()).to_dec_string();
1346
0
        if ( derived_str != "0" ) {
1347
0
            ret = derived_str;
1348
0
        }
1349
0
    } catch ( ... ) { }
1350
1351
0
end:
1352
0
    return ret;
1353
0
}
1354
1355
104
std::optional<component::ECC_Point> Botan::OpECC_Point_Add(operation::ECC_Point_Add& op) {
1356
104
    std::optional<component::ECC_Point> ret = std::nullopt;
1357
104
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1358
1359
104
    BOTAN_FUZZER_RNG;
1360
1361
104
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1362
104
    std::unique_ptr<::Botan::EC_AffinePoint> a, b;
1363
1364
104
    try {
1365
104
        {
1366
104
            std::optional<std::string> curveString;
1367
104
            CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1368
99
            group = std::make_unique<::Botan::EC_Group>(*curveString);
1369
99
        }
1370
1371
0
        {
1372
            /* A */
1373
99
            {
1374
99
                const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1375
99
                CF_CHECK_GTE(a_x, 0);
1376
1377
99
                const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1378
99
                CF_CHECK_GTE(a_y, 0);
1379
1380
99
                try {
1381
99
                    std::optional<::Botan::EC_AffinePoint> a_point;
1382
99
                    CF_CHECK_NE(a_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1383
85
                    a = std::make_unique<::Botan::EC_AffinePoint>(*a_point);
1384
85
                } catch ( ::Botan::Invalid_Argument ) {
1385
0
                    goto end;
1386
0
                }
1387
99
            }
1388
1389
            /* B */
1390
85
            {
1391
85
                const auto b_x = ::Botan::BigInt::from_string(op.b.first.ToString(ds));
1392
85
                CF_CHECK_GTE(b_x, 0);
1393
1394
85
                const auto b_y = ::Botan::BigInt::from_string(op.b.second.ToString(ds));
1395
85
                CF_CHECK_GTE(b_y, 0);
1396
1397
85
                try {
1398
85
                    std::optional<::Botan::EC_AffinePoint> b_point;
1399
85
                    CF_CHECK_NE(b_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, b_x, b_y), std::nullopt);
1400
77
                    b = std::make_unique<::Botan::EC_AffinePoint>(*b_point);
1401
77
                } catch ( ::Botan::Invalid_Argument ) {
1402
0
                    goto end;
1403
0
                }
1404
85
            }
1405
1406
77
            const bool is_negation = *a == b->negate();
1407
1408
77
            ::Botan::EC_AffinePoint _res = a->add(*b);
1409
1410
77
            const bool is_zero = _res.is_identity();
1411
1412
            /* If A is a negation of B, then addition of both should result in point at infinity */
1413
            /* Otherwise, it should result in non-infinity. */
1414
77
            CF_ASSERT(is_zero == is_negation, "Unexpected point addition result");
1415
77
            CF_CHECK_FALSE(is_zero);
1416
1417
73
            const auto x = ::Botan::BigInt::from_bytes(_res.x_bytes());
1418
73
            const auto y = ::Botan::BigInt::from_bytes(_res.y_bytes());
1419
1420
73
            ret = {
1421
73
                util::HexToDec(x.to_hex_string()),
1422
73
                util::HexToDec(y.to_hex_string()),
1423
73
            };
1424
1425
73
        }
1426
73
    } catch (::Botan::Internal_Error& e) {
1427
0
        throw e;
1428
0
    } catch (::Botan::Exception& e) {
1429
0
    }
1430
1431
104
end:
1432
104
    return ret;
1433
104
}
1434
1435
0
std::optional<component::ECC_Point> Botan::OpECC_Point_Sub(operation::ECC_Point_Sub& op) {
1436
0
    std::optional<component::ECC_Point> ret = std::nullopt;
1437
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1438
1439
0
    BOTAN_FUZZER_RNG;
1440
1441
0
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1442
0
    std::unique_ptr<::Botan::EC_AffinePoint> a, b;
1443
1444
0
    try {
1445
0
        {
1446
0
            std::optional<std::string> curveString;
1447
0
            CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1448
0
            group = std::make_unique<::Botan::EC_Group>(*curveString);
1449
0
        }
1450
1451
0
        {
1452
            /* A */
1453
0
            {
1454
0
                const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1455
0
                CF_CHECK_GTE(a_x, 0);
1456
1457
0
                const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1458
0
                CF_CHECK_GTE(a_y, 0);
1459
1460
0
                try {
1461
0
                    std::optional<::Botan::EC_AffinePoint> a_point;
1462
0
                    CF_CHECK_NE(a_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1463
0
                    a = std::make_unique<::Botan::EC_AffinePoint>(*a_point);
1464
0
                } catch ( ::Botan::Invalid_Argument ) {
1465
0
                    goto end;
1466
0
                }
1467
0
            }
1468
1469
            /* B */
1470
0
            {
1471
0
                const auto b_x = ::Botan::BigInt::from_string(op.b.first.ToString(ds));
1472
0
                CF_CHECK_GTE(b_x, 0);
1473
1474
0
                const auto b_y = ::Botan::BigInt::from_string(op.b.second.ToString(ds));
1475
0
                CF_CHECK_GTE(b_y, 0);
1476
1477
0
                try {
1478
0
                    std::optional<::Botan::EC_AffinePoint> b_point;
1479
0
                    CF_CHECK_NE(b_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, b_x, b_y), std::nullopt);
1480
0
                    b = std::make_unique<::Botan::EC_AffinePoint>(*b_point);
1481
0
                } catch ( ::Botan::Invalid_Argument ) {
1482
0
                    goto end;
1483
0
                }
1484
0
            }
1485
1486
0
            const bool is_eq = *a == *b;
1487
1488
0
            ::Botan::EC_AffinePoint _res = a->add(b->negate());
1489
1490
0
            const bool is_zero = _res.is_identity();
1491
1492
            /* If A equals B, then subtraction of both should result in point at infinity */
1493
            /* Otherwise, it should result in non-infinity. */
1494
0
            CF_ASSERT(is_zero == is_eq, "Unexpected point subtraction result");
1495
0
            CF_CHECK_FALSE(is_zero);
1496
1497
0
            const auto x = ::Botan::BigInt::from_bytes(_res.x_bytes());
1498
0
            const auto y = ::Botan::BigInt::from_bytes(_res.y_bytes());
1499
1500
0
            ret = {
1501
0
                util::HexToDec(x.to_hex_string()),
1502
0
                util::HexToDec(y.to_hex_string()),
1503
0
            };
1504
1505
0
        }
1506
0
    } catch (::Botan::Internal_Error& e) {
1507
0
        throw e;
1508
0
    } catch (::Botan::Exception& e) {
1509
0
    }
1510
1511
0
end:
1512
0
    return ret;
1513
0
}
1514
1515
176
std::optional<component::ECC_Point> Botan::OpECC_Point_Mul(operation::ECC_Point_Mul& op) {
1516
176
    std::optional<component::ECC_Point> ret = std::nullopt;
1517
176
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1518
1519
176
    BOTAN_FUZZER_RNG;
1520
1521
176
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1522
1523
176
    {
1524
176
        std::optional<std::string> curveString;
1525
176
        CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1526
173
        group = std::make_unique<::Botan::EC_Group>(*curveString);
1527
173
    }
1528
1529
173
    try {
1530
173
        const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1531
173
        CF_CHECK_GTE(a_x, 0);
1532
1533
173
        const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1534
173
        CF_CHECK_GTE(a_y, 0);
1535
1536
173
        std::optional<::Botan::EC_AffinePoint> a;
1537
173
        CF_CHECK_NE(a = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1538
1539
153
        const auto b = ::Botan::BigInt::from_string(op.b.ToString(ds));
1540
153
        CF_CHECK_GTE(b, 0);
1541
1542
153
        const auto k = ::Botan::EC_Scalar::from_bigint(*group, b);
1543
1544
153
        bool useBlinding = false;
1545
153
#if defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
1546
153
        try {
1547
153
            useBlinding = ds.Get<bool>();
1548
153
        } catch ( fuzzing::datasource::Datasource::OutOfData ) { }
1549
153
#endif
1550
1551
153
        std::unique_ptr<::Botan::EC_AffinePoint> _res;
1552
1553
139
        if ( useBlinding == false ) {
1554
119
            _res = std::make_unique<::Botan::EC_AffinePoint>(a->mul(k, rng));
1555
119
        } else {
1556
20
            _res = std::make_unique<::Botan::EC_AffinePoint>(a->mul(k, rng));
1557
20
        }
1558
1559
139
        const auto x = ::Botan::BigInt::from_bytes(_res->x_bytes());
1560
139
        const auto y = ::Botan::BigInt::from_bytes(_res->y_bytes());
1561
1562
139
        ret = {
1563
139
            util::HexToDec(x.to_hex_string()),
1564
139
            util::HexToDec(y.to_hex_string()),
1565
139
        };
1566
139
    } catch (::Botan::Internal_Error& e) {
1567
0
        throw e;
1568
14
    } catch (::Botan::Exception& e) {
1569
14
    }
1570
1571
176
end:
1572
176
    return ret;
1573
173
}
1574
1575
0
std::optional<component::ECC_Point> Botan::OpECC_Point_Neg(operation::ECC_Point_Neg& op) {
1576
0
    std::optional<component::ECC_Point> ret = std::nullopt;
1577
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1578
1579
0
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1580
1581
0
    {
1582
0
        std::optional<std::string> curveString;
1583
0
        CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1584
0
        group = std::make_unique<::Botan::EC_Group>(*curveString);
1585
0
    }
1586
1587
0
    try {
1588
0
        const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1589
0
        CF_CHECK_GTE(a_x, 0);
1590
1591
0
        const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1592
0
        CF_CHECK_GTE(a_y, 0);
1593
1594
0
        std::optional<::Botan::EC_AffinePoint> a;
1595
0
        CF_CHECK_NE(a = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1596
1597
0
        const ::Botan::EC_AffinePoint _res = a->negate();
1598
1599
0
        const auto x = ::Botan::BigInt::from_bytes(_res.x_bytes());
1600
0
        const auto y = ::Botan::BigInt::from_bytes(_res.y_bytes());
1601
1602
0
        ret = {
1603
0
            util::HexToDec(x.to_hex_string()),
1604
0
            util::HexToDec(y.to_hex_string()),
1605
0
        };
1606
1607
0
    } catch (::Botan::Internal_Error& e) {
1608
0
        throw e;
1609
0
    } catch (::Botan::Exception& e) {
1610
0
    }
1611
1612
0
end:
1613
0
    return ret;
1614
0
}
1615
1616
234
std::optional<component::ECC_Point> Botan::OpECC_Point_Dbl(operation::ECC_Point_Dbl& op) {
1617
234
    std::optional<component::ECC_Point> ret = std::nullopt;
1618
234
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1619
1620
234
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1621
1622
234
    {
1623
234
        std::optional<std::string> curveString;
1624
234
        CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1625
231
        group = std::make_unique<::Botan::EC_Group>(*curveString);
1626
231
    }
1627
1628
231
    try {
1629
231
        const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1630
231
        CF_CHECK_GTE(a_x, 0);
1631
1632
231
        const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1633
231
        CF_CHECK_GTE(a_y, 0);
1634
1635
231
        std::optional<::Botan::EC_AffinePoint> a;
1636
231
        CF_CHECK_NE(a = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1637
1638
87
        const ::Botan::EC_AffinePoint _res = a->add(*a);
1639
1640
87
        const auto x = ::Botan::BigInt::from_bytes(_res.x_bytes());
1641
87
        const auto y = ::Botan::BigInt::from_bytes(_res.y_bytes());
1642
1643
87
        ret = {
1644
87
            util::HexToDec(x.to_hex_string()),
1645
87
            util::HexToDec(y.to_hex_string()),
1646
87
        };
1647
1648
87
    } catch (::Botan::Internal_Error& e) {
1649
0
        throw e;
1650
0
    } catch (::Botan::Exception& e) {
1651
0
    }
1652
1653
234
end:
1654
234
    return ret;
1655
231
}
1656
1657
0
std::optional<bool> Botan::OpECC_Point_Cmp(operation::ECC_Point_Cmp& op) {
1658
0
    std::optional<bool> ret = std::nullopt;
1659
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1660
1661
0
    BOTAN_FUZZER_RNG;
1662
1663
0
    std::unique_ptr<::Botan::EC_Group> group = nullptr;
1664
0
    std::unique_ptr<::Botan::EC_AffinePoint> a, b;
1665
1666
0
    try {
1667
0
        {
1668
0
            std::optional<std::string> curveString;
1669
0
            CF_CHECK_NE(curveString = Botan_detail::CurveIDToString(op.curveType.Get()), std::nullopt);
1670
0
            group = std::make_unique<::Botan::EC_Group>(*curveString);
1671
0
        }
1672
1673
0
        {
1674
            /* A */
1675
0
            {
1676
0
                const auto a_x = ::Botan::BigInt::from_string(op.a.first.ToString(ds));
1677
0
                CF_CHECK_GTE(a_x, 0);
1678
1679
0
                const auto a_y = ::Botan::BigInt::from_string(op.a.second.ToString(ds));
1680
0
                CF_CHECK_GTE(a_y, 0);
1681
1682
0
                try {
1683
0
                    std::optional<::Botan::EC_AffinePoint> a_point;
1684
0
                    CF_CHECK_NE(a_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, a_x, a_y), std::nullopt);
1685
0
                    a = std::make_unique<::Botan::EC_AffinePoint>(*a_point);
1686
0
                } catch ( ::Botan::Invalid_Argument ) {
1687
0
                    goto end;
1688
0
                }
1689
0
            }
1690
1691
            /* B */
1692
0
            {
1693
0
                const auto b_x = ::Botan::BigInt::from_string(op.b.first.ToString(ds));
1694
0
                CF_CHECK_GTE(b_x, 0);
1695
1696
0
                const auto b_y = ::Botan::BigInt::from_string(op.b.second.ToString(ds));
1697
0
                CF_CHECK_GTE(b_y, 0);
1698
1699
0
                try {
1700
0
                    std::optional<::Botan::EC_AffinePoint> b_point;
1701
0
                    CF_CHECK_NE(b_point = ::Botan::EC_AffinePoint::from_bigint_xy(*group, b_x, b_y), std::nullopt);
1702
0
                    b = std::make_unique<::Botan::EC_AffinePoint>(*b_point);
1703
0
                } catch ( ... ) {
1704
0
                    goto end;
1705
0
                }
1706
0
            }
1707
1708
0
            ret = *a == *b;
1709
0
        }
1710
0
    } catch (::Botan::Internal_Error& e) {
1711
0
        throw e;
1712
0
    } catch (::Botan::Exception& e) {
1713
0
    }
1714
1715
0
end:
1716
0
    return ret;
1717
0
}
1718
1719
0
std::optional<bool> Botan::OpDSA_Verify(operation::DSA_Verify& op) {
1720
0
    std::optional<bool> ret = std::nullopt;
1721
0
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1722
1723
0
    BOTAN_FUZZER_RNG;
1724
1725
0
    try {
1726
0
        const auto p = ::Botan::BigInt::from_string(op.parameters.p.ToString(ds));
1727
        /* Avoid time-outs */
1728
0
        CF_CHECK_LTE(p.bytes(), 300);
1729
0
        const auto q = ::Botan::BigInt::from_string(op.parameters.q.ToString(ds));
1730
0
        const auto g = ::Botan::BigInt::from_string(op.parameters.g.ToString(ds));
1731
1732
        /* Botan can verify signatures with g = 0.
1733
         * Avoid discrepancies with OpenSSL
1734
         */
1735
0
        CF_CHECK_NE(g, 0);
1736
1737
0
        const ::Botan::DL_Group group(p, q, g);
1738
0
        CF_CHECK_TRUE(group.verify_group(rng));
1739
1740
0
        const auto y = ::Botan::BigInt::from_string(op.pub.ToString(ds));
1741
0
        const auto pub = std::make_unique<::Botan::DSA_PublicKey>(group, y);
1742
1743
0
        const auto r = ::Botan::BigInt::from_string(op.signature.first.ToString(ds));
1744
0
        const auto s = ::Botan::BigInt::from_string(op.signature.second.ToString(ds));
1745
1746
0
        const auto sig = ::Botan::BigInt::encode_fixed_length_int_pair(
1747
0
                r, s, q.bytes());
1748
0
        auto verifier = ::Botan::PK_Verifier(*pub, "Raw");
1749
0
        verifier.update(op.cleartext.Get());
1750
0
        ret = verifier.check_signature(sig);
1751
0
    } catch ( ... ) {
1752
0
    }
1753
1754
0
end:
1755
0
    return ret;
1756
0
}
1757
1758
7.10k
std::optional<component::Bignum> Botan::OpBignumCalc(operation::BignumCalc& op) {
1759
7.10k
    std::optional<component::Bignum> ret = std::nullopt;
1760
1761
7.10k
    if ( op.modulo ) {
1762
7.10k
        switch ( op.calcOp.Get() ) {
1763
41
            case    CF_CALCOP("Add(A,B)"):
1764
131
            case    CF_CALCOP("Bit(A,B)"):
1765
321
            case    CF_CALCOP("CondSet(A,B)"):
1766
367
            case    CF_CALCOP("Exp(A,B)"):
1767
408
            case    CF_CALCOP("InvMod(A,B)"):
1768
740
            case    CF_CALCOP("IsEq(A,B)"):
1769
741
            case    CF_CALCOP("IsEven(A)"):
1770
742
            case    CF_CALCOP("IsOdd(A)"):
1771
747
            case    CF_CALCOP("IsOne(A)"):
1772
767
            case    CF_CALCOP("IsZero(A)"):
1773
790
            case    CF_CALCOP("LShift1(A)"):
1774
1.30k
            case    CF_CALCOP("Mul(A,B)"):
1775
1.33k
            case    CF_CALCOP("Not(A)"):
1776
1.35k
            case    CF_CALCOP("NumBits(A)"):
1777
1.64k
            case    CF_CALCOP("RShift(A,B)"):
1778
1.64k
            case    CF_CALCOP("Set(A)"):
1779
1.81k
            case    CF_CALCOP("Sqr(A)"):
1780
2.70k
            case    CF_CALCOP("Sqrt(A)"):
1781
2.85k
            case    CF_CALCOP("Sub(A,B)"):
1782
2.85k
                break;
1783
4.24k
            default:
1784
4.24k
                return ret;
1785
7.10k
        }
1786
7.10k
    }
1787
2.85k
    Datasource ds(op.modifier.GetPtr(), op.modifier.GetSize());
1788
1789
2.85k
    Botan_bignum::Bignum res(&ds, "0");
1790
2.85k
    std::vector<Botan_bignum::Bignum> bn{
1791
2.85k
        Botan_bignum::Bignum(&ds, op.bn0.ToString(ds)),
1792
2.85k
        Botan_bignum::Bignum(&ds, op.bn1.ToString(ds)),
1793
2.85k
        Botan_bignum::Bignum(&ds, op.bn2.ToString(ds)),
1794
2.85k
        Botan_bignum::Bignum(&ds, op.bn3.ToString(ds))
1795
2.85k
    };
1796
2.85k
    std::unique_ptr<Botan_bignum::Operation> opRunner = nullptr;
1797
1798
2.85k
    switch ( op.calcOp.Get() ) {
1799
41
        case    CF_CALCOP("Add(A,B)"):
1800
41
            opRunner = std::make_unique<Botan_bignum::Add>();
1801
41
            break;
1802
152
        case    CF_CALCOP("Sub(A,B)"):
1803
152
            opRunner = std::make_unique<Botan_bignum::Sub>();
1804
152
            break;
1805
516
        case    CF_CALCOP("Mul(A,B)"):
1806
516
            opRunner = std::make_unique<Botan_bignum::Mul>();
1807
516
            break;
1808
0
        case    CF_CALCOP("Div(A,B)"):
1809
0
            opRunner = std::make_unique<Botan_bignum::Div>();
1810
0
            break;
1811
0
        case    CF_CALCOP("Mod(A,B)"):
1812
0
            opRunner = std::make_unique<Botan_bignum::Mod>();
1813
0
            break;
1814
0
        case    CF_CALCOP("ExpMod(A,B,C)"):
1815
            /* Too slow with larger values */
1816
0
            CF_CHECK_LT(op.bn0.GetSize(), 1000);
1817
0
            CF_CHECK_LT(op.bn1.GetSize(), 1000);
1818
0
            CF_CHECK_LT(op.bn2.GetSize(), 1000);
1819
1820
0
            opRunner = std::make_unique<Botan_bignum::ExpMod>();
1821
0
            break;
1822
46
        case    CF_CALCOP("Exp(A,B)"):
1823
46
            opRunner = std::make_unique<Botan_bignum::Exp>();
1824
46
            break;
1825
168
        case    CF_CALCOP("Sqr(A)"):
1826
168
            opRunner = std::make_unique<Botan_bignum::Sqr>();
1827
168
            break;
1828
0
        case    CF_CALCOP("GCD(A,B)"):
1829
0
            opRunner = std::make_unique<Botan_bignum::GCD>();
1830
0
            break;
1831
0
        case    CF_CALCOP("SqrMod(A,B)"):
1832
0
            opRunner = std::make_unique<Botan_bignum::SqrMod>();
1833
0
            break;
1834
41
        case    CF_CALCOP("InvMod(A,B)"):
1835
41
            opRunner = std::make_unique<Botan_bignum::InvMod>();
1836
41
            break;
1837
0
        case    CF_CALCOP("Cmp(A,B)"):
1838
0
            opRunner = std::make_unique<Botan_bignum::Cmp>();
1839
0
            break;
1840
0
        case    CF_CALCOP("LCM(A,B)"):
1841
0
            opRunner = std::make_unique<Botan_bignum::LCM>();
1842
0
            break;
1843
0
        case    CF_CALCOP("Abs(A)"):
1844
0
            opRunner = std::make_unique<Botan_bignum::Abs>();
1845
0
            break;
1846
0
        case    CF_CALCOP("Jacobi(A,B)"):
1847
0
            opRunner = std::make_unique<Botan_bignum::Jacobi>();
1848
0
            break;
1849
0
        case    CF_CALCOP("Neg(A)"):
1850
0
            opRunner = std::make_unique<Botan_bignum::Neg>();
1851
0
            break;
1852
0
        case    CF_CALCOP("IsPrime(A)"):
1853
0
            opRunner = std::make_unique<Botan_bignum::IsPrime>();
1854
0
            break;
1855
288
        case    CF_CALCOP("RShift(A,B)"):
1856
288
            opRunner = std::make_unique<Botan_bignum::RShift>();
1857
288
            break;
1858
23
        case    CF_CALCOP("LShift1(A)"):
1859
23
            opRunner = std::make_unique<Botan_bignum::LShift1>();
1860
23
            break;
1861
0
        case    CF_CALCOP("IsNeg(A)"):
1862
0
            opRunner = std::make_unique<Botan_bignum::IsNeg>();
1863
0
            break;
1864
332
        case    CF_CALCOP("IsEq(A,B)"):
1865
332
            opRunner = std::make_unique<Botan_bignum::IsEq>();
1866
332
            break;
1867
0
        case    CF_CALCOP("IsGt(A,B)"):
1868
0
            opRunner = std::make_unique<Botan_bignum::IsGt>();
1869
0
            break;
1870
0
        case    CF_CALCOP("IsGte(A,B)"):
1871
0
            opRunner = std::make_unique<Botan_bignum::IsGte>();
1872
0
            break;
1873
0
        case    CF_CALCOP("IsLt(A,B)"):
1874
0
            opRunner = std::make_unique<Botan_bignum::IsLt>();
1875
0
            break;
1876
0
        case    CF_CALCOP("IsLte(A,B)"):
1877
0
            opRunner = std::make_unique<Botan_bignum::IsLte>();
1878
0
            break;
1879
1
        case    CF_CALCOP("IsEven(A)"):
1880
1
            opRunner = std::make_unique<Botan_bignum::IsEven>();
1881
1
            break;
1882
1
        case    CF_CALCOP("IsOdd(A)"):
1883
1
            opRunner = std::make_unique<Botan_bignum::IsOdd>();
1884
1
            break;
1885
20
        case    CF_CALCOP("IsZero(A)"):
1886
20
            opRunner = std::make_unique<Botan_bignum::IsZero>();
1887
20
            break;
1888
0
        case    CF_CALCOP("IsNotZero(A)"):
1889
0
            opRunner = std::make_unique<Botan_bignum::IsNotZero>();
1890
0
            break;
1891
5
        case    CF_CALCOP("IsOne(A)"):
1892
5
            opRunner = std::make_unique<Botan_bignum::IsOne>();
1893
5
            break;
1894
0
        case    CF_CALCOP("MulMod(A,B,C)"):
1895
0
            opRunner = std::make_unique<Botan_bignum::MulMod>();
1896
0
            break;
1897
90
        case    CF_CALCOP("Bit(A,B)"):
1898
90
            opRunner = std::make_unique<Botan_bignum::Bit>();
1899
90
            break;
1900
0
        case    CF_CALCOP("CmpAbs(A,B)"):
1901
0
            opRunner = std::make_unique<Botan_bignum::CmpAbs>();
1902
0
            break;
1903
0
        case    CF_CALCOP("SetBit(A,B)"):
1904
0
            opRunner = std::make_unique<Botan_bignum::SetBit>();
1905
0
            break;
1906
0
        case    CF_CALCOP("ClearBit(A,B)"):
1907
0
            opRunner = std::make_unique<Botan_bignum::ClearBit>();
1908
0
            break;
1909
0
        case    CF_CALCOP("MulAdd(A,B,C)"):
1910
0
            opRunner = std::make_unique<Botan_bignum::MulAdd>();
1911
0
            break;
1912
0
        case    CF_CALCOP("MulDiv(A,B,C)"):
1913
0
            opRunner = std::make_unique<Botan_bignum::MulDiv>();
1914
0
            break;
1915
0
        case    CF_CALCOP("MulDivCeil(A,B,C)"):
1916
0
            opRunner = std::make_unique<Botan_bignum::MulDivCeil>();
1917
0
            break;
1918
0
        case    CF_CALCOP("Exp2(A)"):
1919
0
            opRunner = std::make_unique<Botan_bignum::Exp2>();
1920
0
            break;
1921
0
        case    CF_CALCOP("NumLSZeroBits(A)"):
1922
0
            opRunner = std::make_unique<Botan_bignum::NumLSZeroBits>();
1923
0
            break;
1924
892
        case    CF_CALCOP("Sqrt(A)"):
1925
892
            if ( op.modulo == std::nullopt ) {
1926
0
                opRunner = std::make_unique<Botan_bignum::Sqrt>();
1927
892
            } else {
1928
892
                opRunner = std::make_unique<Botan_bignum::Ressol>();
1929
892
            }
1930
892
            break;
1931
0
        case    CF_CALCOP("AddMod(A,B,C)"):
1932
0
            opRunner = std::make_unique<Botan_bignum::AddMod>();
1933
0
            break;
1934
0
        case    CF_CALCOP("SubMod(A,B,C)"):
1935
0
            opRunner = std::make_unique<Botan_bignum::SubMod>();
1936
0
            break;
1937
15
        case    CF_CALCOP("NumBits(A)"):
1938
15
            opRunner = std::make_unique<Botan_bignum::NumBits>();
1939
15
            break;
1940
5
        case    CF_CALCOP("Set(A)"):
1941
5
            opRunner = std::make_unique<Botan_bignum::Set>();
1942
5
            break;
1943
190
        case    CF_CALCOP("CondSet(A,B)"):
1944
190
            opRunner = std::make_unique<Botan_bignum::CondSet>();
1945
190
            break;
1946
        /*
1947
        case    CF_CALCOP("Ressol(A,B)"):
1948
            opRunner = std::make_unique<Botan_bignum::Ressol>();
1949
            break;
1950
        */
1951
31
        case    CF_CALCOP("Not(A)"):
1952
31
            opRunner = std::make_unique<Botan_bignum::Not>();
1953
31
            break;
1954
0
        case    CF_CALCOP("Prime()"):
1955
0
            opRunner = std::make_unique<Botan_bignum::Prime>();
1956
0
            break;
1957
0
        case    CF_CALCOP("RandRange(A,B)"):
1958
0
            opRunner = std::make_unique<Botan_bignum::RandRange>();
1959
0
            break;
1960
0
        case    CF_CALCOP("IsSquare(A)"):
1961
0
            opRunner = std::make_unique<Botan_bignum::IsSquare>();
1962
0
            break;
1963
2.85k
    }
1964
1965
2.85k
    CF_CHECK_NE(opRunner, nullptr);
1966
1967
2.85k
#if defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
1968
2.85k
    try {
1969
2.85k
#endif
1970
2.85k
        CF_CHECK_EQ(opRunner->Run(
1971
2.85k
                    ds,
1972
2.85k
                    res,
1973
2.85k
                    bn,
1974
2.85k
                    op.modulo ?
1975
2.85k
                        std::optional<Botan_bignum::Bignum>(Botan_bignum::Bignum(op.modulo->ToTrimmedString())) :
1976
2.85k
                        std::nullopt), true);
1977
2.84k
#if defined(CRYPTOFUZZ_BOTAN_IS_ORACLE)
1978
2.84k
    } catch ( ... ) {
1979
0
        goto end;
1980
0
    }
1981
0
#endif
1982
1983
2.84k
    ret = { util::HexToDec(res.Ref().to_hex_string()) };
1984
1985
2.85k
end:
1986
2.85k
    return ret;
1987
2.84k
}
1988
1989
7.12k
bool Botan::SupportsModularBignumCalc(void) const {
1990
7.12k
    return true;
1991
7.12k
}
1992
1993
} /* namespace module */
1994
} /* namespace cryptofuzz */