search

guidovranken / cryptofuzz

Fuzzing cryptographic libraries. Magic bug printer go brrrr.
https://guidovranken.com/2019/05/14/differential-fuzzing-of-cryptographic-libraries/
GNU General Public License v3.0
665 stars 76 forks source link

KDF_PBKDF2 tests libraries including unsupported operations #73

Open koharin opened 3 months ago

koharin commented 3 months ago

Hi. I'm using cryptofuzz to test cryptographic libraries.

I recognized that when testing KDF_PBKDF2, it produces incorrect difference. For example, KDF_PBKDF2 in libgmp, linux, mpdecimal, blst, libsodim, bearssl, trezor-firmware, openssl libraries don't support SHAKE digest. However, cryptofuzz test KDF_PBKDF2 with SHAKE digest, so that it catches as result is not correct.

It would be better to filter out libraries with unsupported algorithms before testing algorithms.

Thank you for your works for Cryptofuzz.

gilles-peskine-arm commented 1 month ago

This is the same problem as https://github.com/guidovranken/cryptofuzz/issues/69. You need to return std::nullopt in your Module implementation when given an unsupported or invalid input.