145 lines
4.9 KiB
Python
145 lines
4.9 KiB
Python
"""IoTivity manufacturer-certificate OwnerPSK derivation contracts."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from smartthings_local.protocol.owner_psk import (
|
|
CONFIRMED_MFG_CERTIFICATE_OXM_LABEL,
|
|
MFG_CERTIFICATE_KEY_BLOCK_LENGTHS,
|
|
STANDARD_MFG_CERTIFICATE_OXM_LABEL,
|
|
derive_mfg_certificate_owner_psk,
|
|
)
|
|
|
|
|
|
_VALID_INPUTS = {
|
|
"master_secret": bytes(range(48)),
|
|
"client_random": bytes(range(32)),
|
|
"server_random": bytes(range(32, 64)),
|
|
"owner_uuid": bytes.fromhex("00112233445566778899aabbccddeeff"),
|
|
"device_uuid": bytes.fromhex("ffeeddccbbaa99887766554433221100"),
|
|
"cipher_name": "ECDHE-ECDSA-AES128-GCM-SHA256",
|
|
"oxm_label": CONFIRMED_MFG_CERTIFICATE_OXM_LABEL,
|
|
}
|
|
|
|
|
|
# These synthetic expected values were generated from the fixed inputs above;
|
|
# they were not captured from IoTivity or a device. They lock deterministic
|
|
# output for the selected mappings, while the table test below states the
|
|
# key-block-length contract explicitly.
|
|
def test_fixed_synthetic_gcm_regression_vector():
|
|
assert derive_mfg_certificate_owner_psk(**_VALID_INPUTS).hex() == (
|
|
"ccd6c618a91290dee8c106544ed79a33"
|
|
)
|
|
|
|
|
|
def test_owner_then_device_uuid_order_matches_iotivity_callers():
|
|
reversed_context = derive_mfg_certificate_owner_psk(
|
|
**{
|
|
**_VALID_INPUTS,
|
|
"owner_uuid": _VALID_INPUTS["device_uuid"],
|
|
"device_uuid": _VALID_INPUTS["owner_uuid"],
|
|
}
|
|
)
|
|
|
|
assert reversed_context.hex() == "8f0f2416c483546dc1806db769b21b68"
|
|
assert reversed_context != derive_mfg_certificate_owner_psk(**_VALID_INPUTS)
|
|
|
|
|
|
def test_fixed_synthetic_ccm8_regression_vector():
|
|
inputs = {
|
|
**_VALID_INPUTS,
|
|
"cipher_name": "ECDHE-ECDSA-AES128-CCM8",
|
|
}
|
|
assert derive_mfg_certificate_owner_psk(**inputs).hex() == (
|
|
"ddd3d945e266ee3dc27ff3a2c4321d32"
|
|
)
|
|
|
|
|
|
def test_standard_and_confirmed_labels_derive_distinct_keys():
|
|
confirmed = derive_mfg_certificate_owner_psk(**_VALID_INPUTS)
|
|
standard = derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, "oxm_label": STANDARD_MFG_CERTIFICATE_OXM_LABEL}
|
|
)
|
|
|
|
assert standard.hex() == "26ee1fe4c3e74509a2f5db5ab41b1e47"
|
|
assert standard != confirmed
|
|
|
|
|
|
def test_iotivity_cipher_key_block_lengths_are_immutable():
|
|
assert dict(MFG_CERTIFICATE_KEY_BLOCK_LENGTHS) == {
|
|
"ECDHE-ECDSA-AES128-SHA256": 96,
|
|
"ECDHE-ECDSA-AES128-CCM": 40,
|
|
"ECDHE-ECDSA-AES128-CCM8": 40,
|
|
"ECDHE-ECDSA-AES128-GCM-SHA256": 120,
|
|
"AES256-SHA256": 128,
|
|
"ECDHE-ECDSA-AES256-SHA384": 160,
|
|
"ECDHE-ECDSA-AES256-GCM-SHA384": 184,
|
|
"AES128-GCM-SHA256": 120,
|
|
}
|
|
with pytest.raises(TypeError):
|
|
MFG_CERTIFICATE_KEY_BLOCK_LENGTHS["new-cipher"] = 1
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("field", "length"),
|
|
[
|
|
("master_secret", 48),
|
|
("client_random", 32),
|
|
("server_random", 32),
|
|
("owner_uuid", 16),
|
|
("device_uuid", 16),
|
|
],
|
|
)
|
|
def test_binary_inputs_require_exact_bytes_and_lengths(field, length):
|
|
with pytest.raises(TypeError, match=f"{field} must be bytes"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, field: bytearray(length)}
|
|
)
|
|
for invalid_length in (length - 1, length + 1):
|
|
with pytest.raises(ValueError, match=f"exactly {length} bytes"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, field: b"x" * invalid_length}
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize("field", ["owner_uuid", "device_uuid"])
|
|
def test_nil_uuid_is_rejected(field):
|
|
with pytest.raises(ValueError, match="must not be the nil UUID"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, field: bytes(16)}
|
|
)
|
|
|
|
|
|
def test_cipher_and_label_must_be_explicit_supported_values():
|
|
with pytest.raises(TypeError, match="cipher_name must be a string"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, "cipher_name": b"cipher"}
|
|
)
|
|
with pytest.raises(ValueError, match="unexpected.*cipher"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, "cipher_name": "ECDHE-RSA-AES128-GCM-SHA256"}
|
|
)
|
|
with pytest.raises(TypeError, match="oxm_label must be bytes"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, "oxm_label": "oic.sec.doxm.mfgcert"}
|
|
)
|
|
with pytest.raises(ValueError, match="unexpected.*label"):
|
|
derive_mfg_certificate_owner_psk(
|
|
**{**_VALID_INPUTS, "oxm_label": b"unsupported"}
|
|
)
|
|
|
|
|
|
def test_failures_do_not_include_key_material():
|
|
key_material = b"private-master-secret"
|
|
with pytest.raises(ValueError) as raised:
|
|
derive_mfg_certificate_owner_psk(
|
|
**{
|
|
**_VALID_INPUTS,
|
|
"master_secret": key_material,
|
|
"cipher_name": "unsupported",
|
|
}
|
|
)
|
|
assert key_material.hex() not in str(raised.value)
|
|
assert "private-master-secret" not in str(raised.value)
|