/* * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2023 SAP SE. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. * */ /** * @test * @key randomness * @bug 8299817 * @summary AES-CTR cipher failure with multiple short (< 16 bytes) update calls. * @library /test/lib / * @build jdk.test.whitebox.WhiteBox * @run driver jdk.test.lib.helpers.ClassFileInstaller jdk.test.whitebox.WhiteBox * * @run main/othervm -Xbatch * -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI -Xbootclasspath/a:. * compiler.codegen.aes.Test8299817 */ package compiler.codegen.aes; import java.util.Arrays; import java.util.Random; import javax.crypto.Cipher; import javax.crypto.spec.IvParameterSpec; import javax.crypto.spec.SecretKeySpec; import compiler.whitebox.CompilerWhiteBoxTest; import jdk.test.whitebox.code.Compiler; import jdk.test.lib.Utils; import jtreg.SkippedException; public class Test8299817 { private static final String ALGO = "AES/CTR/NoPadding"; private static final int LOOPS = 20000; private static final int WARMUP_LOOPS = 10000; private static final int LEN_INC = 5; private static final int LEN_STEPS = 13; private static final int LEN_MAX = LEN_INC*LEN_STEPS; private static final int SEG_INC = 3; private static final int SEG_MAX = 11; private static final int SHOW_ARRAY_LIMIT = 72; private static final boolean DEBUG_MODE = false; public static void main(String[] args) throws Exception { if (!DEBUG_MODE) { if (!Compiler.isIntrinsicAvailable(CompilerWhiteBoxTest.COMP_LEVEL_FULL_OPTIMIZATION, "com.sun.crypto.provider.CounterMode", "implCrypt", byte[].class, int.class, int.class, byte[].class, int.class) ) { throw new SkippedException("AES-CTR intrinsic is not available"); } } Random random = Utils.getRandomInstance(); // Create secret key byte[] keyBytes = new byte[32]; random.nextBytes(keyBytes); SecretKeySpec key = new SecretKeySpec(keyBytes, "AES"); // Create initial counter byte[] ivBytes = new byte[16]; random.nextBytes(ivBytes); if (DEBUG_MODE) { for (int i = 0; i < 16; i++) { ivBytes[i] = (byte)0; } ivBytes[15] = (byte)1; } IvParameterSpec iv = new IvParameterSpec(ivBytes); // Create cipher objects and initialize Cipher encryptCipher = Cipher.getInstance(ALGO); Cipher decryptCipher = Cipher.getInstance(ALGO); encryptCipher.init(Cipher.ENCRYPT_MODE, key, iv); decryptCipher.init(Cipher.DECRYPT_MODE, key, iv); // Create plaintext, ciphertext, and encrypted counter (reference copy) byte[] original = new byte[LEN_MAX]; byte[] original_encrypted = new byte[LEN_MAX]; byte[] counter_encrypted = new byte[LEN_MAX]; // Retrieve the encrypted counter if (DEBUG_MODE) { for (int i = 0; i < LEN_MAX; i++) { original[i] = (byte)0; } encryptCipher.doFinal(original, 0, LEN_MAX, counter_encrypted); } // Create the encrypted message reference (no JIT, no intrinsic involved) if (DEBUG_MODE) { for (int i = 0; i < LEN_MAX; i++) { original[i] = (byte)i; } encryptCipher.doFinal(original, 0, LEN_MAX, original_encrypted); } if (DEBUG_MODE) { showArray(original, original.length, "original: "); showArray(original_encrypted, original_encrypted.length, "original_encrypted: "); showArray(counter_encrypted, counter_encrypted.length, "counter_encrypted: "); } // Warmup to have everything compiled System.out.println("Warming up, " + WARMUP_LOOPS + " iterations..."); byte[] work_encrypted = new byte[LEN_MAX]; byte[] work_decrypted = new byte[LEN_MAX]; byte[] varlen = new byte[LEN_MAX*2]; for (int i = 0; i < WARMUP_LOOPS; i++) { boolean failed = false; if (!DEBUG_MODE) { random.nextBytes(original); } encryptCipher.doFinal(original, 0, LEN_MAX, work_encrypted); random.nextBytes(varlen); for (int j = 0; j < LEN_MAX; j++) { int len1 = (varlen[2*j] & 0x0f) + 1; decryptCipher.update(work_encrypted, 0, len1, work_decrypted, 0); for (int k = 0; k < len1; k++) { if (original[k] != work_decrypted[k]) { if (!failed) { failed = true; System.out.println("-------------------"); } System.out.println("Decrypt failure (warmup, update): LEN(" + LEN_MAX + "), iteration (" + i + "), k = " + k); } } int len2 = (varlen[2*j+1] & 0x0f) + 1; decryptCipher.update(work_encrypted, len1, len2, work_decrypted, len1); for (int k = len1; k < len1+len2; k++) { if (original[k] != work_decrypted[k]) { if (!failed) { failed = true; System.out.println("-------------------"); } System.out.println("Decrypt failure (warmup, update): LEN(" + LEN_MAX + "), iteration (" + i + "), k = " + k); } } decryptCipher.doFinal(work_encrypted, len1+len2, LEN_MAX-len1-len2, work_decrypted, len1+len2); for (int k = len1+len2; k < LEN_MAX; k++) { if (original[k] != work_decrypted[k]) { if (!failed) { failed = true; System.out.println("-------------------"); } System.out.println("Decrypt failure (warmup, doFinal): LEN(" + LEN_MAX + "), iteration (" + i + "), k = " + k); } } } if (!compareArrays(work_decrypted, original, false)) { System.out.println("Warmup encrypt/decrypt failure during iteration " + i + " of LEN " + LEN_MAX); compareArrays(work_decrypted, original, true); showArray(work_encrypted, work_encrypted.length, "encrypted:"); showArray(counter_encrypted, counter_encrypted.length, "ctr_enc: "); if (!DEBUG_MODE) { System.exit(1); } } } System.out.println("Testing, " + LOOPS + " iterations..."); for (int LEN = 1; LEN < LEN_MAX; LEN += LEN_INC) { work_encrypted = new byte[LEN]; work_decrypted = new byte[LEN]; for (int i = 0; i < LOOPS; i++) { boolean failed = false; random.nextBytes(original); encryptCipher.doFinal(original, 0, LEN, work_encrypted); int ix = 0; for (int SEG = 0; (SEG < SEG_MAX) && (ix + SEG_INC < LEN); SEG++) { decryptCipher.update(work_encrypted, ix, SEG_INC, work_decrypted, ix); for (int k = ix; k < ix + SEG_INC; k++) { if (original[k] != work_decrypted[k]) { if (!failed) { failed = true; System.out.println("-------------------"); } System.out.println("Decrypt failure (update): LEN(" + LEN + "), iteration " + i + ", SEG(" + SEG + "), SEG_INC(" + SEG_INC + "), k = " + k); } } ix += SEG_INC; } decryptCipher.doFinal(work_encrypted, ix, LEN - ix, work_decrypted, ix); if (!compareArrays(work_decrypted, original, false)) { if (!failed) { failed = true; System.out.println("-------------------"); } System.out.println("While decrypting the remaining " + (LEN - ix) + "(" + LEN + ") bytes of CT, iteration " + i); System.out.println("Decrypt failure (doFinal): LEN(" + LEN + "), SEG_INC(" + SEG_INC + "), SEG_MAX(" + SEG_MAX + ")"); showArray(work_encrypted, work_encrypted.length, "encrypted:"); compareArrays(work_decrypted, original, true); if (!DEBUG_MODE) { System.exit(1); } } } } } static void showArray(byte b[], int len, String name) { System.out.format("%s [%d]: ", name, b.length); for (int i = 0; i < Math.min(len, SHOW_ARRAY_LIMIT); i++) { System.out.format("%02x ", b[i] & 0xff); } System.out.println(); } static boolean compareArrays(byte b[], byte exp[], boolean print) { boolean equal = true; int len = (b.length <= exp.length) ? b.length : exp.length; for (int i = 0; i < len; i++) { equal &= b[i] == exp[i]; if (!equal) { if (print) { System.out.format("encrypt/decrypt error at index %d: got %02x, expected %02x\n", i, b[i] & 0xff, exp[i] & 0xff); showArray(b, len, "result: "); showArray(exp, len, "expected: "); } return equal; } } return equal; } }