org.bouncycastle.pqc.crypto.test
Class PqcSignatureEncodingTest

java.lang.Object
  junit.framework.Assert
      junit.framework.TestCase
          org.bouncycastle.pqc.crypto.test.PqcSignatureEncodingTest

All Implemented Interfaces:

junit.framework.Test

public class PqcSignatureEncodingTest

extends junit.framework.TestCase

Regression test for github #2403. MAYO, SNOVA, QR-UOV, SQIsign and AIMer used to return the NIST "sm" signed-message envelope from generateSignature() - the signature with the message concatenated to it - and to verify a buffer that merely started (for AIMer, ended) with a good signature, ignoring whatever else it carried. That made the encoding non-unique: given one valid signature, unlimited distinct byte strings verified for the same message and key.

So for each scheme this asserts that what is produced is exactly the parameter set's signature and that nothing else verifies - in particular the envelope the scheme used to emit, which is the shape a caller would still have lying around from an earlier release.

One parameter set per scheme: this is about the encoding, which the parameter set does not vary, and SQIsign key generation is expensive.

Constructor Summary

PqcSignatureEncodingTest()

Method Summary

void	testAIMer()
void	testMayo()
void	testQRUOV()
void	testQRUOVSignatureMustBeCanonical() QR-UOV stores each F_q element in ceil(log2 q) bits, one more bit pattern than the field has elements: q itself is representable and is congruent to zero, so every zero element of a signature had a second encoding that verified.
void	testSnova()
void	testSnovaUnusedNibbleMustBeZero() Requiring the signature to be exactly the right length pins down what follows it, but not bits inside it that the decoder never reads.
void	testSQIsign()

Methods inherited from class junit.framework.TestCase

countTestCases, createResult, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class junit.framework.Assert

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

PqcSignatureEncodingTest

public PqcSignatureEncodingTest()

Method Detail

testMayo

public void testMayo()

testSnova

public void testSnova()

testQRUOV

public void testQRUOV()

testSQIsign

public void testSQIsign()

testAIMer

public void testAIMer()

testSnovaUnusedNibbleMustBeZero

public void testSnovaUnusedNibbleMustBeZero()

Requiring the signature to be exactly the right length pins down what follows it, but not bits inside it that the decoder never reads. For a SNOVA parameter set whose solution is an odd number of GF(16) nibbles, the last byte of the solution carries one nibble and the top four bits are spare - sixteen byte strings used to verify for one signature.

testQRUOVSignatureMustBeCanonical

public void testQRUOVSignatureMustBeCanonical()

QR-UOV stores each F_q element in ceil(log2 q) bits, one more bit pattern than the field has elements: q itself is representable and is congruent to zero, so every zero element of a signature had a second encoding that verified. The bits padding the last element out to the byte boundary were not read either. For the q = 7 sets that is on the order of a hundred spare bits in a single signature.