def test_already_finalized(self, backend):
ckdf = ConcatKDFHMAC(hashes.SHA256(), 16, None, None, backend)
ckdf.derive(b"\x01" * 16)
with pytest.raises(AlreadyFinalized):
ckdf.derive(b"\x02" * 16)
def test_invalid_backend():
pretend_backend = object()
with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
ConcatKDFHash(hashes.SHA256(), 16, None, pretend_backend)
with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
ConcatKDFHMAC(hashes.SHA256(), 16, None, None, pretend_backend)
def test_unicode_typeerror(self, backend):
with pytest.raises(TypeError):
ConcatKDFHMAC(
hashes.SHA256(),
16, salt=u"foo",
otherinfo=None,
backend=backend
)
with pytest.raises(TypeError):
ConcatKDFHMAC(
hashes.SHA256(),
16, salt=None,
otherinfo=u"foo",
backend=backend
)
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(
hashes.SHA256(),
16, salt=None,
otherinfo=None,
backend=backend
)
ckdf.derive(u"foo")
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(
hashes.SHA256(),
16, salt=None,
otherinfo=None,
backend=backend
)
ckdf.verify(u"foo", b"bar")
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(
hashes.SHA256(),
16, salt=None,
otherinfo=None,
backend=backend
)
ckdf.verify(b"foo", u"bar")
def __derive_key(self, key):
ckdf = ConcatKDFHMAC(algorithm=hashes.SHA256(),
length=32,
salt=self.__salt,
otherinfo=self.__otherinfo,
backend=default_backend())
self.__derived = True
return ckdf.derive(key)
def test_unicode_typeerror(self, backend):
with pytest.raises(TypeError):
ConcatKDFHMAC(
hashes.SHA256(),
16,
salt="foo", # type: ignore[arg-type]
otherinfo=None,
backend=backend,
)
with pytest.raises(TypeError):
ConcatKDFHMAC(
hashes.SHA256(),
16,
salt=None,
otherinfo="foo", # type: ignore[arg-type]
backend=backend,
)
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(hashes.SHA256(),
16,
salt=None,
otherinfo=None,
backend=backend)
ckdf.derive("foo") # type: ignore[arg-type]
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(hashes.SHA256(),
16,
salt=None,
otherinfo=None,
backend=backend)
ckdf.verify("foo", b"bar") # type: ignore[arg-type]
with pytest.raises(TypeError):
ckdf = ConcatKDFHMAC(hashes.SHA256(),
16,
salt=None,
otherinfo=None,
backend=backend)
ckdf.verify(b"foo", "bar") # type: ignore[arg-type]
def test_unsupported_hash_algorithm(self, backend):
# ConcatKDF requires a hash algorithm with an internal block size.
with pytest.raises(TypeError):
ConcatKDFHMAC(
hashes.SHA3_256(),
16,
salt=None,
otherinfo=None,
backend=backend,
)
def cryptoContactKDFHMAC():
backend = default_backend()
salt = os.urandom(16)
otherinfo = b"concatkdf-example"
ckdf = ConcatKDFHMAC(
algorithm=hashes.SHA256(),
length=32,
salt=salt,
otherinfo=otherinfo,
backend=backend
)
key = ckdf.derive(b"input key")
ckdf = ConcatKDFHMAC(
algorithm=hashes.SHA256(),
length=32,
salt=salt,
otherinfo=otherinfo,
backend=backend
)
ckdf.verify(b"input key", key)
return True
def test_invalid_verify(self, backend):
prk = binascii.unhexlify(
b"013951627c1dea63ea2d7702dd24e963eef5faac6b4af7e4"
b"b831cde499dff1ce45f6179f741c728aa733583b02409208"
b"8f0af7fce1d045edbc5790931e8d5ca79c73")
oinfo = binascii.unhexlify(
b"a1b2c3d4e55e600be5f367e0e8a465f4bf2704db00c9325c"
b"9fbd216d12b49160b2ae5157650f43415653696421e68e")
ckdf = ConcatKDFHMAC(hashes.SHA512(), 32, None, oinfo, backend)
with pytest.raises(InvalidKey):
ckdf.verify(prk, b"wrong key")
def test_verify(self, backend):
prk = binascii.unhexlify(
b"013951627c1dea63ea2d7702dd24e963eef5faac6b4af7e4"
b"b831cde499dff1ce45f6179f741c728aa733583b02409208"
b"8f0af7fce1d045edbc5790931e8d5ca79c73")
okm = binascii.unhexlify(b"64ce901db10d558661f10b6836a122a7"
b"605323ce2f39bf27eaaac8b34cf89f2f")
oinfo = binascii.unhexlify(
b"a1b2c3d4e55e600be5f367e0e8a465f4bf2704db00c9325c"
b"9fbd216d12b49160b2ae5157650f43415653696421e68e")
ckdf = ConcatKDFHMAC(hashes.SHA512(), 32, None, oinfo, backend)
ckdf.verify(prk, okm)
def test_length_limit(self, backend):
big_length = hashes.SHA256().digest_size * (2**32 - 1) + 1
with pytest.raises(ValueError):
ConcatKDFHMAC(hashes.SHA256(), big_length, None, None, backend)