From 3d4eb5f7a4ea2dbf35520f2470cd5060b310ea6e Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Wed, 5 Feb 2025 16:52:22 -0800 Subject: [PATCH] Added a test for RC2-CBC with an effectiveKeyLength (#12404) * Added a test for RC2-CBC with an effectiveKeyLength * Update docs/development/test-vectors.rst Co-authored-by: Paul Kehrer --------- Co-authored-by: Paul Kehrer --- docs/development/test-vectors.rst | 3 ++ tests/hazmat/primitives/test_serialization.py | 15 ++++++++++ .../rsa-rc2-cbc-effective-key-length.pem | 30 +++++++++++++++++++ 3 files changed, 48 insertions(+) create mode 100644 vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem diff --git a/docs/development/test-vectors.rst b/docs/development/test-vectors.rst index 2e6854473..a38b4f910 100644 --- a/docs/development/test-vectors.rst +++ b/docs/development/test-vectors.rst @@ -64,6 +64,9 @@ Asymmetric ciphers encrypted with ``AES-192-CBC``. The password is ``PolarSSLTest``. * ``asymmetric/PKCS8/ed25519-scrypt.pem`` a PKCS8 encoded Ed25519 key from RustCrypto using scrypt as the KDF. The password is ``hunter42``. +* ``asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem`` a PKCS8 encoded key + encrypted with ``RC2-CBC`` with the ``effectiveKeyLength`` parameter set to + 258. This is an invalid key. Custom asymmetric vectors diff --git a/tests/hazmat/primitives/test_serialization.py b/tests/hazmat/primitives/test_serialization.py index 64a494c8d..185818e3c 100644 --- a/tests/hazmat/primitives/test_serialization.py +++ b/tests/hazmat/primitives/test_serialization.py @@ -529,6 +529,21 @@ class TestDERSerialization: assert isinstance(key, rsa.RSAPrivateKey) assert key.key_size == 2048 + @pytest.mark.supported( + only_if=lambda backend: backend.cipher_supported( + RC2(b"\x00" * 16), modes.CBC(b"\x00" * 8) + ), + skip_message="Does not support RC2 CBC", + ) + def test_load_pkcs8_rc2_cbc_effective_key_length(self): + data = load_vectors_from_file( + os.path.join("asymmetric", "PKCS8", "rsa-rc2-cbc.pem"), + lambda f: f.read(), + mode="rb", + ) + with pytest.raises(ValueError): + load_pem_private_key(data, password=b"password") + @pytest.mark.xfail( rust_openssl.CRYPTOGRAPHY_IS_BORINGSSL, strict=True, diff --git a/vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem b/vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem new file mode 100644 index 000000000..d4a81d941 --- /dev/null +++ b/vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem @@ -0,0 +1,30 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIFFzBJBgkqhkiG9w0BBQ0wPDAeBgkqhkiG9w0BBQwwEQQIdEQTzibS3T4CAggA +AgEQMBoGCCqGSIb3DQMCMA4CAgECBAiLFADJWNVGFgSCBMi91CAKKUhya1MYkBAq +nC4LyUuOGpXVBmanWPw2pWB+DteSIzLGCj5X4uzZNLAEe7L5aIx/yxquKGdI75sy +a0Y2zayjoXim+9eql704PCgOYZRACzAefj9TdONFWKPnAdpazxrqAIHxA8/Vx4Gf +XnFVKxUVvpsyqIC+gfyqyAUO3BV2DyQJb7nkbhjAchYIvzG+Aiu8o/MEwMKHxxyk +k7jCzSsX6KZ/FZHFpMtsT0v+7PdGX0/qmSE2nv4NPGu3zFhveJ26w9Xb52ZL0frY +yvZ4IAf6e27oKnuLM7bEOPqDcgPSzR+1ky42FhWfqTQYIQMQ6rQliuFTe5DMDGI/ +FN+syeOnmYjMPs0LlP/4wOWP4Xk/vx1dqBe7Xqitqm7Wn48sTIV1vMpdTZU1U06a +Dlam4FH5tHTB+jaGGwFWTmm95pv2XCKRlfYlJuOe7wEnYtx+Sq5BE4gaFlyxWH5+ +93KfFqXg7ghv+E818vqHsi46tNyh8kV+bgQGGxiIRogI7aWgfqdO10EUsUt/DTvP ++PKWB37sdwi1OaNw345CLEz/2E0466c7xfKE/lSnwsN1Ng2t0eM2aRhHA3jIWhoX +BVtDegBSVTYRUSYJo/Bh+4YecxX/NyK9eUYUaMF9N0JC+Sz0y4cO9244yDAOfREM +UiiNruEMJ245z3NF0KsLgGAJZyMClraTCJfKHgCI9JDNA9SKnoRt2XT6jnVwniqq +wnV9iiR87FQhyJ77Sr5xYJRRBXSgCJLW3IY3SRGUJH5Uxe9VtMX6kxv1G49WppjK +QHq3yn3SBYyukPCVgma4V8FPr0PsaHMlq+crk8S3pS4/nBgruMfgKKx+R+fr/T1k +Ro4jK38E8kfXOX3YKckzb2C6UXqzZ8/5fKFW9LJ0gOHdwQb18e+R/juTPepOhOlz +2oFrWpk48WnahmeHIcP0AdnRsc+HwYHwUNKLByi09zzv1x27OBAXTgwsGtZvdv/3 +8O3dElMfj2AJLGf+nu49tuikAHTJgIn5qNLiY/Mt266t66HKzJRwJHitxQskUg8L +h9eqMw5TmkD9S3u0p/T19z7r9fNrIpc7ms65ehHIbo1Zu4SomMMT07Aqkm/nrNUP +paCqQJhySXCyI0mVPUilz9iZEVWQbeyB1BYrvUIxJBOdq4/2PKJMpR5TooNdUvAQ +Bboj6XBDTLFWpcvviGwg/Bw2TijOI6mkXgMNLohRqpNdA11lwkKSgYLOydAf0AQs +xHAqkBhWlJT3vkj4PcTQaD+wjT4HzqSLN2NASdcTqYpS1c/IfGiesb5c5VBPdszN +cZ7nD0MxG+pN3aCFilM0PRvUxEryebwVOfDVXwdUiMv3qu051LKfejxkH+7v2lqD +DPAv82WrXENz8mIDHrjo7FjKcixBAs4v8zLI255J8WTZvnKlJtgvm9WTw9gLVrs+ +bptWsyTb+90XRAfnqHOcjQrZtqhZzuxor6+G38FOW0X4fmrcqDQ1KWP6RkLY/VCe +vlz76G2Hth6iGCsJAzqT/cF+wpQoj6Dpbe1SjLgSUMv9SRQug0QO6AWJnGW2ccNr +qI/3QtnCuY7Dwu+WufvB6sksEBpQRsZTDnsov6Ss0nVjnWfTRLIb043v5p5ntx8d +OSVmpjnO63mLBaQ= +-----END ENCRYPTED PRIVATE KEY-----