Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add differential fuzz tests for libcrypto crypto #4031

Open
goatgoose opened this issue Jun 2, 2023 · 0 comments
Open

Add differential fuzz tests for libcrypto crypto #4031

goatgoose opened this issue Jun 2, 2023 · 0 comments

Comments

@goatgoose
Copy link
Contributor

Security issue notifications

If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.

Problem:

#4020 adds the libcrypto TLS PRF implementation to s2n-tls, which is used in some scenarios rather than the custom s2n-tls implementation. The PRF unit tests contain known-value tests that ensure both the TLS and libcrypto implementations are correct. However, now that two different implementations exist, we should additionally add a fuzz test that provides both versions a bunch of random input and makes sure they produce the same results.

The same should also be done for HKDF after it's added, and also HMAC potentially.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants