feat: U5 land deterministic chacha20 KAT (RFC 8439 2.4.2)
- test/gen_chacha_kat.py emits KAT from RFC 8439 section 2.4.2 mapped to the impl's 64+64 counter/nonce layout; expected bytes cross-checked against pycryptodome (independent impl) and the official vector: 10f1e7e4d13b5915... byte-exact - verdict: the 'intermittent chacha20 KAT FAIL' referenced in FUCK comments was a phantom — that test was never merged into this tree; the implementation itself matches RFC byte-for-byte - selftest now runs KAT + page-MAC determinism checks at selftest=2; full SELFTEST PASS in QEMU (.build_tmp/qemu_serial_u5kat.log)
This commit is contained in:
Linehu
@@ -0,0 +1,16 @@
|
||||
/* key = 00 01 02 .. 1f (LE words) */
|
||||
/* counter = 0x0900000000000001 (st12=1, st13=0x09000000) */
|
||||
/* nonce = 0x000000004a000000 (st14, st15=0) ? RFC 8439 ?2.4.2 */
|
||||
static const u32 kat_key[8] = {0x03020100u,0x07060504u,0x0b0a0908u,0x0f0e0d0cu,0x13121110u,0x17161514u,0x1b1a1918u,0x1f1e1d1cu};
|
||||
static const u64 kat_counter = 0x0900000000000001u;
|
||||
static const u64 kat_nonce = 0x4a000000u;
|
||||
static const u8 kat_expect[64] = {
|
||||
0x10,0xf1,0xe7,0xe4,0xd1,0x3b,0x59,0x15,
|
||||
0x50,0x0f,0xdd,0x1f,0xa3,0x20,0x71,0xc4,
|
||||
0xc7,0xd1,0xf4,0xc7,0x33,0xc0,0x68,0x03,
|
||||
0x04,0x22,0xaa,0x9a,0xc3,0xd4,0x6c,0x4e,
|
||||
0xd2,0x82,0x64,0x46,0x07,0x9f,0xaa,0x09,
|
||||
0x14,0xc2,0xd7,0x05,0xd9,0x8b,0x02,0xa2,
|
||||
0xb5,0x12,0x9c,0xd1,0xde,0x16,0x4e,0xb9,
|
||||
0xcb,0xd0,0x83,0xe8,0xa2,0x50,0x3c,0x4e,
|
||||
};
|
||||
@@ -0,0 +1,64 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Generate chacha20 KAT for UTSM state layout (U5).
|
||||
|
||||
Layout matches CODE/UTSM/crypto/chacha20.c:
|
||||
state[0..3] = sigma
|
||||
state[4..11] = key words (LE)
|
||||
state[12] = counter lo, state[13] = counter hi
|
||||
state[14] = nonce lo, state[15] = nonce hi
|
||||
Output: 64B keystream hex words (LE), printed as C initializer.
|
||||
"""
|
||||
import struct
|
||||
|
||||
|
||||
def rotl(v, c):
|
||||
return ((v << c) | (v >> (32 - c))) & 0xFFFFFFFF
|
||||
|
||||
|
||||
def qr(s, a, b, c, d):
|
||||
s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = rotl(s[d], 16)
|
||||
s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = rotl(s[b], 12)
|
||||
s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = rotl(s[d], 8)
|
||||
s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = rotl(s[b], 7)
|
||||
|
||||
|
||||
def block(key_words, counter, nonce):
|
||||
iv = [0x61707865, 0x3320646E, 0x79622D32, 0x6B206574]
|
||||
st = iv + list(key_words) + [counter & 0xFFFFFFFF, (counter >> 32) & 0xFFFFFFFF,
|
||||
nonce & 0xFFFFFFFF, (nonce >> 32) & 0xFFFFFFFF]
|
||||
v = st[:]
|
||||
for _ in range(10):
|
||||
qr(v, 0, 4, 8, 12); qr(v, 1, 5, 9, 13); qr(v, 2, 6, 10, 14); qr(v, 3, 7, 11, 15)
|
||||
qr(v, 0, 5, 10, 15); qr(v, 1, 6, 11, 12); qr(v, 2, 7, 8, 13); qr(v, 3, 4, 9, 14)
|
||||
return [(v[i] + st[i]) & 0xFFFFFFFF for i in range(16)]
|
||||
|
||||
|
||||
def main():
|
||||
# KAT = RFC 8439 §2.4.2 官方向量（key=00..1f, counter=1, nonce 00000009 0000004a 00000000）
|
||||
# 映射到本实现的 64+64 布局：st12..15 = counter_lo, counter_hi, nonce_lo, nonce_hi
|
||||
# st12=1, st13=0x09000000, st14=0x4a000000, st15=0
|
||||
# => counter = 0x0900000000000001, nonce = 0x000000004a000000
|
||||
# 期望值已三方对拍：pycryptodome（djb 变体）+ RFC 官方向量 + C 实现，逐字节一致。
|
||||
key_bytes = bytes(range(32))
|
||||
key_words = list(struct.unpack("<8I", key_bytes))
|
||||
counter = 0x0900000000000001
|
||||
nonce = 0x000000004A000000
|
||||
out = block(key_words, counter, nonce)
|
||||
raw = struct.pack("<16I", *out)
|
||||
assert raw.hex().startswith("10f1e7e4d13b5915500fdd1fa32071c4"), \
|
||||
"KAT 不再匹配 RFC 8439 — 实现或本脚本被改动"
|
||||
print("/* key = 00 01 02 .. 1f (LE words) */")
|
||||
print("/* counter = 0x0900000000000001 (st12=1, st13=0x09000000) */")
|
||||
print("/* nonce = 0x000000004a000000 (st14, st15=0) — RFC 8439 §2.4.2 */")
|
||||
print("static const u32 kat_key[8] = {" +
|
||||
",".join(f"0x{w:08x}u" for w in key_words) + "};")
|
||||
print(f"static const u64 kat_counter = 0x{counter:016x}u;")
|
||||
print(f"static const u64 kat_nonce = 0x{nonce:08x}u;")
|
||||
print("static const u8 kat_expect[64] = {")
|
||||
for i in range(0, 64, 8):
|
||||
print(" " + ",".join(f"0x{b:02x}" for b in raw[i:i + 8]) + ",")
|
||||
print("};")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,5 +1,6 @@
|
||||
#include <utsm/utsm.h>
|
||||
#include <utsm/pckc.h>
|
||||
#include <utsm/crypto.h>
|
||||
#include <utsm/log.h>
|
||||
#include <utsm/segment.h>
|
||||
#include <utsm/arena.h>
|
||||
@@ -72,6 +73,33 @@ int utsm_selftest_run(void) {
|
||||
}
|
||||
log_info("[UTSM] selftest read ok");
|
||||
|
||||
/* ==== U5: chacha20 KAT（RFC 8439 §2.4.2 官方向量）====
|
||||
* 历史注：FUCK 注释曾提"并行会话 chacha20 KAT 间歇 FAIL"——该测试
|
||||
* 从未合并进本树（幽灵缺陷）。本 KAT 为确定性官方向量，不依赖
|
||||
* 硬件/时钟/随机数，PASS/FAIL 完全可复现。期望值由
|
||||
* test/gen_chacha_kat.py 生成，并经 pycryptodome 独立对拍。 */
|
||||
{
|
||||
#include "chacha_kat.inc"
|
||||
u8 ks[64];
|
||||
utsm_chacha20_block(kat_key, kat_nonce, kat_counter, ks);
|
||||
if (memcmp(ks, kat_expect, 64) != 0) {
|
||||
log_error("[UTSM] selftest chacha20 KAT FAIL (RFC 8439 §2.4.2)");
|
||||
return UTSM_ERR_INVALID;
|
||||
}
|
||||
log_info("[UTSM] selftest chacha20 KAT ok (RFC 8439 §2.4.2)");
|
||||
|
||||
/* page MAC 确定性：同输入同 MAC、跨页不同 MAC */
|
||||
const u64 *rk = drr_get_root_key();
|
||||
u64 m1 = utsm_page_mac(rk, 0, 0, 0, desc->cipher_base);
|
||||
u64 m2 = utsm_page_mac(rk, 0, 0, 0, desc->cipher_base);
|
||||
u64 m3 = utsm_page_mac(rk, 0, 1, 0, desc->cipher_base);
|
||||
if (m1 != m2 || m1 == m3) {
|
||||
log_error("[UTSM] selftest page MAC determinism FAIL");
|
||||
return UTSM_ERR_INVALID;
|
||||
}
|
||||
log_info("[UTSM] selftest page MAC determinism ok");
|
||||
}
|
||||
|
||||
/* ==== U4: 密文页 dump —— 串口输出密文/明文 hex 对照 ==== */
|
||||
{
|
||||
int dst = utrw_debug_dump_page(cap.segment_slot, 0, 128);
|
||||
|
||||
@@ -5,7 +5,8 @@ test/utsm_selftest.o: test\utsm_selftest.c include\utsm\utsm.h \
|
||||
include\utsm\vmm.h include\utsm\linux_loader.h include\utsm\ipc_shm.h \
|
||||
..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\pckc.h \
|
||||
include\utsm\crypto.h include\utsm\log.h include\utsm\arena.h \
|
||||
include\utsm\drr.h include\utsm\sched_ext.h include\utsm\sched.h
|
||||
include\utsm\drr.h include\utsm\sched_ext.h include\utsm\sched.h \
|
||||
test\chacha_kat.inc
|
||||
include\utsm\utsm.h:
|
||||
include\utsm\types.h:
|
||||
include\utsm\status.h:
|
||||
@@ -28,3 +29,4 @@ include\utsm\arena.h:
|
||||
include\utsm\drr.h:
|
||||
include\utsm\sched_ext.h:
|
||||
include\utsm\sched.h:
|
||||
test\chacha_kat.inc:
|
||||
|
||||
Binary file not shown.
Reference in New Issue
Block a user