Package com.microej.crypto.test

Class AESGCMCipherTest

  • public class AESGCMCipherTest
extends java.lang.Object

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void testAES128GCM_16bytes()
      Test encryption of one zero block under a zero 128-bit key and nonce, without AAD, against the published ciphertext and tag (test case 2).
      void testAES128GCM_64bytes()
      Test encryption of 64 data bytes under a 128-bit key, without AAD, against the published ciphertext and tag (test case 3).
      void testAES256GCM_16bytes()
      Test encryption of one zero block under a zero 256-bit key and nonce, without AAD, against the published ciphertext and tag (test case 14).
      void testAES256GCM_64bytes()
      Test encryption of 64 data bytes under a 256-bit key, without AAD, against the published ciphertext and tag (test case 15).
      void testCipherAtNonZeroOffsets()
      Encrypting from a sub-range into an offset, with the additional authenticated data read from a sub-range too, produces the ciphertext and tag of the same operation at offset zero, and they decrypt back from a sub-range into an offset without touching the bytes around either result.
      void testDoFinalWithoutInputAfterUpdate()
      Passing the whole message to update() and then calling doFinal() with no argument gives the authentication tag, and the two outputs together decrypt.
      void testEncryptDecryptWithAAD()
      Test GCM mode specific encryption and authentication workflow on test case 4: the published ciphertext and tag, the decryption, and the AEAD failures after tampering on the ciphertext or the AAD.
      void testGcmTagLengthBoundary()
      Verifies the GCM authentication tag length boundary from both sides.
      void testParallelCipherEncryption()
      Test parallel Cipher initialization and encryption
      void testReinitFromDecryptToEncryptStreamsAsFresh()
      A GCM cipher initialized for decryption and then for encryption streams as a freshly created encrypting cipher does.
      void testReinitWithDifferentKeyAndNonce()
      Initializing an already initialized GCM cipher with another key and another nonce gives a cipher that encrypts as a freshly created one does.
      void testRejectsKeyIvReuseOnReinit()
      Verifies that re-initializing a GCM cipher for encryption with the same key and IV is rejected, preventing catastrophic nonce reuse.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • AESGCMCipherTest

        public AESGCMCipherTest()

    • Method Detail

      • testAES128GCM_16bytes

        public void testAES128GCM_16bytes()
                           throws java.lang.Exception
        Test encryption of one zero block under a zero 128-bit key and nonce, without AAD, against the published ciphertext and tag (test case 2).
        Throws:
        java.lang.Exception

      • testAES128GCM_64bytes

        public void testAES128GCM_64bytes()
                           throws java.lang.Exception
        Test encryption of 64 data bytes under a 128-bit key, without AAD, against the published ciphertext and tag (test case 3).
        Throws:
        java.lang.Exception

      • testAES256GCM_16bytes

        public void testAES256GCM_16bytes()
                           throws java.lang.Exception
        Test encryption of one zero block under a zero 256-bit key and nonce, without AAD, against the published ciphertext and tag (test case 14).
        Throws:
        java.lang.Exception

      • testAES256GCM_64bytes

        public void testAES256GCM_64bytes()
                           throws java.lang.Exception
        Test encryption of 64 data bytes under a 256-bit key, without AAD, against the published ciphertext and tag (test case 15).
        Throws:
        java.lang.Exception

      • testParallelCipherEncryption

        public void testParallelCipherEncryption()
                                  throws java.lang.Throwable
        Test parallel Cipher initialization and encryption
        Throws:
        java.lang.Throwable

      • testEncryptDecryptWithAAD

        public void testEncryptDecryptWithAAD()
                               throws java.lang.Exception
        Test GCM mode specific encryption and authentication workflow on test case 4: the published ciphertext and tag, the decryption, and the AEAD failures after tampering on the ciphertext or the AAD. NOTE: This test does not verify the multi-part update scenario (not supported yet).
        Throws:
        java.lang.Exception

      • testRejectsKeyIvReuseOnReinit

        public void testRejectsKeyIvReuseOnReinit()
                                   throws java.lang.Exception
        Verifies that re-initializing a GCM cipher for encryption with the same key and IV is rejected, preventing catastrophic nonce reuse. The guard must fire on the second initialization, before any encryption.
        Throws:
        java.lang.Exception

      • testReinitWithDifferentKeyAndNonce

        public void testReinitWithDifferentKeyAndNonce()
                                        throws java.lang.Exception
        Initializing an already initialized GCM cipher with another key and another nonce gives a cipher that encrypts as a freshly created one does.

        GCM holds more state across an initialization than the unauthenticated modes: the additional authenticated data and the counter. The first context receives both and is abandoned without a doFinal(), which is the harder case for a backend to release. The nonce differs between the two initializations, as testRejectsKeyIvReuseOnReinit() requires.

        Throws:
        java.lang.Exception

      • testCipherAtNonZeroOffsets

        public void testCipherAtNonZeroOffsets()
                                throws java.lang.Exception
        Encrypting from a sub-range into an offset, with the additional authenticated data read from a sub-range too, produces the ciphertext and tag of the same operation at offset zero, and they decrypt back from a sub-range into an offset without touching the bytes around either result.
        Throws:
        java.lang.Exception

      • testGcmTagLengthBoundary

        public void testGcmTagLengthBoundary()
                              throws java.lang.Exception
        Verifies the GCM authentication tag length boundary from both sides.

        NIST SP 800-38D caps the tag at 128 bits. Accepting 128 and rejecting 136 pins the comparison, so neither loosening the bound nor flipping the comparison survives.

        Throws:
        java.lang.Exception

      • testDoFinalWithoutInputAfterUpdate

        public void testDoFinalWithoutInputAfterUpdate()
                                        throws java.lang.Exception
        Passing the whole message to update() and then calling doFinal() with no argument gives the authentication tag, and the two outputs together decrypt.

        This is how the JCA documents a streamed encryption. With nothing left to process, doFinal() reaches the backend with an empty input, which a backend must accept as it accepts an empty array.

        Throws:
        java.lang.Exception

      • testReinitFromDecryptToEncryptStreamsAsFresh

        public void testReinitFromDecryptToEncryptStreamsAsFresh()
                                                  throws java.lang.Exception
        A GCM cipher initialized for decryption and then for encryption streams as a freshly created encrypting cipher does.

        A decrypting GCM cipher holds back the last bytes of every update(), since they may be the authentication tag. An encrypting one has no tag in its input and holds nothing back. The hold-back belongs to the direction, so the second initialization must clear it: otherwise the output of update() arrives one call late, and only doFinal() releases it.

        Throws:
        java.lang.Exception