|
| 1 | +#![no_main] |
| 2 | +use fips204::traits::{KeyGen, SerDes, Signer, Verifier}; |
| 3 | +use fips204::Ph; |
| 4 | +use fips204::{ml_dsa_44, ml_dsa_65, ml_dsa_87}; |
| 5 | +use libfuzzer_sys::fuzz_target; |
| 6 | +use rand_chacha::ChaCha20Rng; |
| 7 | +use rand_core::{CryptoRngCore, SeedableRng}; |
| 8 | + |
| 9 | + |
| 10 | +// Helper to create deterministic RNG from data |
| 11 | +fn create_rng(seed_data: &[u8]) -> ChaCha20Rng { |
| 12 | + let seed = if seed_data.len() >= 32 { |
| 13 | + let mut arr = [0u8; 32]; |
| 14 | + arr.copy_from_slice(&seed_data[..32]); |
| 15 | + arr |
| 16 | + } else { |
| 17 | + let mut arr = [0u8; 32]; |
| 18 | + arr[..seed_data.len()].copy_from_slice(seed_data); |
| 19 | + arr |
| 20 | + }; |
| 21 | + ChaCha20Rng::from_seed(seed) |
| 22 | +} |
| 23 | + |
| 24 | + |
| 25 | +// Helper function to test signing operations for a specific parameter set |
| 26 | +fn fuzz_signer_for_params<S, V>( |
| 27 | + data: &[u8], rng: &mut impl CryptoRngCore, keypair: &(V, S), ctx: &[u8], |
| 28 | +) where |
| 29 | + S: Signer<PublicKey = V>, |
| 30 | + V: Verifier<Signature = S::Signature> + SerDes + Clone, |
| 31 | + <S as Signer>::Signature: PartialEq, |
| 32 | + <V as SerDes>::ByteArray: PartialEq, |
| 33 | +{ |
| 34 | + let (pk, sk) = keypair; |
| 35 | + |
| 36 | + // Test regular signing |
| 37 | + if let Ok(sig1) = sk.try_sign_with_rng(rng, data, ctx) { |
| 38 | + // Verify the signature works |
| 39 | + assert!(pk.clone().verify(data, &sig1, ctx)); |
| 40 | + |
| 41 | + // Test that signing the same message twice produces different signatures |
| 42 | + if let Ok(sig2) = sk.try_sign_with_rng(rng, data, ctx) { |
| 43 | + // Signatures should be different (due to randomization) |
| 44 | + assert!(sig1 != sig2); |
| 45 | + // But both should verify |
| 46 | + assert!(pk.clone().verify(data, &sig2, ctx)); |
| 47 | + } |
| 48 | + |
| 49 | + // Verify public key derivation |
| 50 | + let derived_pk = sk.get_public_key(); |
| 51 | + assert!(derived_pk.clone().into_bytes() == pk.clone().into_bytes()); |
| 52 | + assert!(derived_pk.verify(data, &sig1, ctx)); |
| 53 | + } |
| 54 | + |
| 55 | + // Test hash signing with different hash functions |
| 56 | + for ph in [Ph::SHA256, Ph::SHA512, Ph::SHAKE128] { |
| 57 | + if let Ok(sig) = sk.try_hash_sign_with_rng(rng, data, ctx, &ph) { |
| 58 | + // Verify the hash signature works |
| 59 | + assert!(pk.hash_verify(data, &sig, ctx, &ph)); |
| 60 | + |
| 61 | + // Test that hash signing the same message twice produces different signatures |
| 62 | + if let Ok(sig2) = sk.try_hash_sign_with_rng(rng, data, ctx, &ph) { |
| 63 | + assert!(sig != sig2); |
| 64 | + assert!(pk.hash_verify(data, &sig2, ctx, &ph)); |
| 65 | + } |
| 66 | + |
| 67 | + // Verify signature doesn't work with wrong hash function |
| 68 | + let wrong_ph = match ph { |
| 69 | + Ph::SHA256 => Ph::SHA512, |
| 70 | + _ => Ph::SHA256, |
| 71 | + }; |
| 72 | + assert!(!pk.hash_verify(data, &sig, ctx, &wrong_ph)); |
| 73 | + } |
| 74 | + } |
| 75 | +} |
| 76 | + |
| 77 | + |
| 78 | +fuzz_target!(|data: &[u8]| { |
| 79 | + // Skip empty inputs |
| 80 | + if data.is_empty() { |
| 81 | + return; |
| 82 | + } |
| 83 | + |
| 84 | + // Create deterministic RNG from first part of input |
| 85 | + let mut rng = create_rng(data); |
| 86 | + |
| 87 | + // Generate keypairs using the RNG |
| 88 | + let ml_dsa_44_keypair = ml_dsa_44::KG::try_keygen_with_rng(&mut rng).unwrap(); |
| 89 | + let ml_dsa_65_keypair = ml_dsa_65::KG::try_keygen_with_rng(&mut rng).unwrap(); |
| 90 | + let ml_dsa_87_keypair = ml_dsa_87::KG::try_keygen_with_rng(&mut rng).unwrap(); |
| 91 | + |
| 92 | + // Use first byte as context length |
| 93 | + let ctx_len = (data[0] as usize) % 8; |
| 94 | + let (ctx, msg) = data.split_at(ctx_len.min(data.len())); |
| 95 | + |
| 96 | + // Test all parameter sets |
| 97 | + fuzz_signer_for_params(msg, &mut rng, &ml_dsa_44_keypair, ctx); |
| 98 | + fuzz_signer_for_params(msg, &mut rng, &ml_dsa_65_keypair, ctx); |
| 99 | + fuzz_signer_for_params(msg, &mut rng, &ml_dsa_87_keypair, ctx); |
| 100 | + |
| 101 | + // Test edge cases |
| 102 | + if let Some((pk, sk)) = Some(&ml_dsa_65_keypair) { |
| 103 | + // Test empty message |
| 104 | + if let Ok(sig) = sk.try_sign_with_rng(&mut rng, &[], ctx) { |
| 105 | + assert!(pk.verify(&[], &sig, ctx)); |
| 106 | + } |
| 107 | + |
| 108 | + // Test empty context |
| 109 | + if let Ok(sig) = sk.try_sign_with_rng(&mut rng, msg, &[]) { |
| 110 | + assert!(pk.verify(msg, &sig, &[])); |
| 111 | + } |
| 112 | + |
| 113 | + // Test large message (if we have enough data) |
| 114 | + if msg.len() > 100 { |
| 115 | + if let Ok(sig) = sk.try_sign_with_rng(&mut rng, msg, ctx) { |
| 116 | + assert!(pk.verify(msg, &sig, ctx)); |
| 117 | + } |
| 118 | + } |
| 119 | + |
| 120 | + // Test signing with different RNG seeds |
| 121 | + if msg.len() > 32 { |
| 122 | + let mut different_rng = create_rng(&msg[..32]); |
| 123 | + if let Ok(sig1) = sk.try_sign_with_rng(&mut rng, msg, ctx) { |
| 124 | + if let Ok(sig2) = sk.try_sign_with_rng(&mut different_rng, msg, ctx) { |
| 125 | + assert!(sig1 != sig2); |
| 126 | + assert!(pk.verify(msg, &sig1, ctx)); |
| 127 | + assert!(pk.verify(msg, &sig2, ctx)); |
| 128 | + } |
| 129 | + } |
| 130 | + } |
| 131 | + } |
| 132 | +}); |
0 commit comments