F-2983 - https://fenrir.wolfssl.com/finding/2983 - Add known-answer unit test for TPM2_KDFe

Author: aidangarske

src/tpm2_wrap.c

@@ -1987,7 +1987,7 @@ int wolfTPM2_Cleanup(WOLFTPM2_DEV* dev)
 /* The KDF for producing a symmetric key.
  * See TPM 2.0 Part 1 specification (11.4.9.3)
  */
-static int TPM2_KDFe(
+WOLFTPM_TEST_API int TPM2_KDFe(
     TPM_ALG_ID        hashAlg,    /* IN: hash algorithm used */
     const TPM2B_DATA *Z,          /* IN: x coordinate of shared secret */
     const char       *label,      /* IN: a 0-byte terminated label used in KDF */

tests/unit_tests.c

@@ -932,6 +932,53 @@ static void test_TPM2_HashNvPublic(void)
 #endif
 }
 
+/* Known-answer test for TPM2_KDFe (SP800-56A one-step KDF for ECC).
+ * Reference: independently computed SHA-256(counter || Z || label || U || V)
+ * with counter starting at 1. */
+#if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(HAVE_ECC)
+static void test_TPM2_KDFe(void)
+{
+    int rc;
+    TPM2B_DATA Z, partyU, partyV;
+    byte key[WC_SHA256_DIGEST_SIZE];
+    int i;
+    static const byte expectedKey[] = {
+        0x5e, 0x51, 0xcd, 0x71, 0xd3, 0xe1, 0x58, 0xfc,
+        0x44, 0xc1, 0x5c, 0x41, 0xac, 0x74, 0x3d, 0xd0,
+        0x96, 0x91, 0xc8, 0x99, 0x32, 0xe8, 0x38, 0x08,
+        0xd6, 0x56, 0x35, 0xf2, 0x31, 0xee, 0xba, 0xea
+    };
+
+    /* Z = 0x01..0x20 (32 bytes) */
+    Z.size = 32;
+    for (i = 0; i < 32; i++) Z.buffer[i] = (byte)(i + 1);
+
+    /* partyU = 0xAA repeated 32 bytes */
+    partyU.size = 32;
+    XMEMSET(partyU.buffer, 0xAA, 32);
+
+    /* partyV = 0xBB repeated 32 bytes */
+    partyV.size = 32;
+    XMEMSET(partyV.buffer, 0xBB, 32);
+
+    XMEMSET(key, 0, sizeof(key));
+    rc = TPM2_KDFe(TPM_ALG_SHA256, &Z, "SECRET", &partyU, &partyV,
+        key, (UINT32)sizeof(key));
+    AssertIntEQ(rc, (int)sizeof(key));
+    AssertIntEQ(0, XMEMCMP(key, expectedKey, sizeof(expectedKey)));
+
+    /* Test NULL args */
+    rc = TPM2_KDFe(TPM_ALG_SHA256, NULL, "SECRET", &partyU, &partyV,
+        key, sizeof(key));
+    AssertIntEQ(rc, BAD_FUNC_ARG);
+    rc = TPM2_KDFe(TPM_ALG_SHA256, &Z, "SECRET", &partyU, &partyV,
+        NULL, sizeof(key));
+    AssertIntEQ(rc, BAD_FUNC_ARG);
+
+    printf("Test TPM Wrapper:\tKDFe:\t\t\tPassed\n");
+}
+#endif
+
 static void test_GetAlgId(void)
 {
     TPM_ALG_ID alg = TPM2_GetAlgId("SHA256");
@@ -1674,6 +1721,9 @@ int unit_tests(int argc, char *argv[])
     test_TPM2_ParamDec_AESCFB_Roundtrip();
     test_TPM2_ParamEncDec_Dispatch_Roundtrip();
     test_TPM2_HashNvPublic();
+    #if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(HAVE_ECC)
+    test_TPM2_KDFe();
+    #endif
     test_GetAlgId();
     test_wolfTPM2_ReadPublicKey();
     test_wolfTPM2_CSR();

wolftpm/tpm2_wrap.h

@@ -4522,6 +4522,14 @@ WOLFTPM_API int wolfTPM2_FirmwareUpgradeCancel(WOLFTPM2_DEV* dev);
 #endif /* WOLFTPM_FIRMWARE_UPGRADE */
 
 
+/* KDFe - exposed for unit testing */
+#if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(HAVE_ECC)
+WOLFTPM_TEST_API int TPM2_KDFe(
+    TPM_ALG_ID hashAlg, const TPM2B_DATA *Z, const char *label,
+    const TPM2B_DATA *partyUInfo, const TPM2B_DATA *partyVInfo,
+    BYTE *key, UINT32 keySz);
+#endif
+
 #ifdef __cplusplus
     }  /* extern "C" */
 #endif