org.bouncycastle.pqc.crypto.test

Class PqcSignatureEncodingTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.bouncycastle.pqc.crypto.test.PqcSignatureEncodingTest

All Implemented Interfaces:

junit.framework.Test

public class PqcSignatureEncodingTest
extends junit.framework.TestCase

Regression test for github #2403. MAYO, SNOVA, QR-UOV, SQIsign and AIMer used to return the NIST crypto_sign "sm" signed-message envelope from generateSignature() - the signature with the message concatenated to it - and to verify a buffer that merely started (for AIMer, ended) with a good signature, ignoring whatever else it carried. That made the encoding non-unique: given one valid signature, unlimited distinct byte strings verified for the same message and key.

So for each scheme this asserts that what is produced is exactly the parameter set's signature and that nothing else verifies - in particular the envelope the scheme used to emit, which is the shape a caller would still have lying around from an earlier release.

One parameter set per scheme: this is about the encoding, which the parameter set does not vary, and SQIsign key generation is expensive.

Constructor Summary

Constructors

Constructor and Description
PqcSignatureEncodingTest()

Method Summary

Modifier and Type	Method and Description
void	testAIMer()
void	testMayo()
void	testQRUOV()
void	testQRUOVSignatureMustBeCanonical() QR-UOV stores each F_q element in ceil(log2 q) bits, one more bit pattern than the field has elements: q itself is representable and is congruent to zero, so every zero element of a signature had a second encoding that verified.
void	testSnova()
void	testSnovaUnusedNibbleMustBeZero() Requiring the signature to be exactly the right length pins down what follows it, but not bits inside it that the decoder never reads.
void	testSQIsign()

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

PqcSignatureEncodingTest

public PqcSignatureEncodingTest()

Method Detail

testMayo

public void testMayo()

testSnova

public void testSnova()

testQRUOV

public void testQRUOV()

testSQIsign

public void testSQIsign()

testAIMer

public void testAIMer()

testSnovaUnusedNibbleMustBeZero

public void testSnovaUnusedNibbleMustBeZero()

Requiring the signature to be exactly the right length pins down what follows it, but not bits inside it that the decoder never reads. For a SNOVA parameter set whose solution is an odd number of GF(16) nibbles, the last byte of the solution carries one nibble and the top four bits are spare - sixteen byte strings used to verify for one signature.

testQRUOVSignatureMustBeCanonical

public void testQRUOVSignatureMustBeCanonical()

QR-UOV stores each F_q element in ceil(log2 q) bits, one more bit pattern than the field has elements: q itself is representable and is congruent to zero, so every zero element of a signature had a second encoding that verified. The bits padding the last element out to the byte boundary were not read either. For the q = 7 sets that is on the order of a hundred spare bits in a single signature.