Add unit tests for HKDF-SM3 and PBKDF2-SM3 #881

New issue

Open

opened 2026-08-26 10:29:22 -05:00 by ronald-cron-arm · 0 comments

ronald-cron-arm commented

2026-08-26 10:29:22 -05:00

(Migrated from github.com)

Suggested enhancement

The HKDF/PBKDF2 PSA Crypto implementation is based on the PSA Crypto MAC APIs and driver APIs thus nothing to do to add support for HKDF/PBKDF2-SM3 when the PSA Crypto mac APIs support SM3. The main goal of this issue is to add correctness unit tests for the HKDF/HKDF_EXTRACT/HKDF_EXPAND-SM3 and PBKDF2-SM3 algorithms.

For HKDF/HKDF_EXTRACT/HKDF_EXPAND-SM3:

add in test_suite_psa_crypto correctness test cases based on the test functions derive_setup, derive_input, and derive_full similarly to what is done for SHA-512 hash algorithm (not SHA-256 as most of the key derivation test cases using SHA-256 are not specific to a given hash).
in addition to what is done for SHA-512, add key-derivation known-answer and capacity test using derive_output(), the three set of inputs from RFC5869 for SHA-256 and adapted outputs. Something like:
- PSA key derivation: HKDF SM3, RFC5869 #‌1 inputs, output 42+0
- PSA key derivation: HKDF SM3, RFC5869 #‌1 inputs, output 32+10
- PSA key derivation: HKDF-Extract SM3, RFC5869 #‌1 inputs, output 32+0
- PSA key derivation: HKDF-Expand SM3, RFC5869 #‌1 inputs, output 42+0
- PSA key derivation: HKDF SM3, RFC5869 #‌2 inputs, output 82+0
- PSA key derivation: HKDF SM3, RFC5869 #‌3, output 42+0
add negative tests based on derive_set_capacity (max possible capacity + 1)
add in test_suite_psa_crypto_metadata.data the test cases based on key_derivation_algorithm for HKDF/HKDF_EXTRACT/HKDF_EXPAND with SM3 hash algorithm.

For PBKDF2-SM3:
Add in test_suite_psa_crypto correctness test cases based on the test functions derive_input, derive_output and derive_set_capacity similarly to what is done for PBKDF2-HMAC-SHA256. SHA-256 is used as the representative algorithm for testing generic PBKDF2/PSA behavior, so no need to add an SM3 version of all tests. A good subset seems something like:

PSA key derivation: PBKDF2-HMAC-SM3, good case, direct output
PSA key derivation: PBKDF2-HMAC-SM3, good case, key output
PSA key derivation: PBKDF2-HMAC-SM3, good case, DERIVE key as password, key output
PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #‌1 inputs, 64+0
PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #‌1 inputs, 54+10
PSA key derivation: PBKDF2-HMAC-SM3 -> AES-128
PSA key derivation: PBKDF2-HMAC-SM3, request too much capacity
PSA key derivation: PBKDF2-HMAC-SM3, request maximum capacity
It would also be nice to have the following tests running derive_output():
PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #‌1 inputs, cost 2, password as bytes , exercises 2 iterations
PSA key derivation: PBKDF2-HMAC(SM3), empty password, to test that PBKDF2-HMAC-SM3 correctly accepts a zero-length password and produces the expected derived output.

Depends on: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/874 and https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/879

Justification

TF-PSA-Crypto needs this to test HKDF/PBKDF2-SM3 support

### Suggested enhancement The HKDF/PBKDF2 PSA Crypto implementation is based on the PSA Crypto MAC APIs and driver APIs thus nothing to do to add support for HKDF/PBKDF2-SM3 when the PSA Crypto mac APIs support SM3. The main goal of this issue is to add correctness unit tests for the HKDF/HKDF_EXTRACT/HKDF_EXPAND-SM3 and PBKDF2-SM3 algorithms. For HKDF/HKDF_EXTRACT/HKDF_EXPAND-SM3: - add in `test_suite_psa_crypto` correctness test cases based on the test functions `derive_setup`, `derive_input`, and `derive_full` similarly to what is done for SHA-512 hash algorithm (not SHA-256 as most of the key derivation test cases using SHA-256 are not specific to a given hash). - in addition to what is done for SHA-512, add key-derivation known-answer and capacity test using `derive_output()`, the three set of inputs from RFC5869 for SHA-256 and adapted outputs. Something like: - PSA key derivation: HKDF SM3, RFC5869 #&zwnj;1 inputs, output 42+0 - PSA key derivation: HKDF SM3, RFC5869 #&zwnj;1 inputs, output 32+10 - PSA key derivation: HKDF-Extract SM3, RFC5869 #&zwnj;1 inputs, output 32+0 - PSA key derivation: HKDF-Expand SM3, RFC5869 #&zwnj;1 inputs, output 42+0 - PSA key derivation: HKDF SM3, RFC5869 #&zwnj;2 inputs, output 82+0 - PSA key derivation: HKDF SM3, RFC5869 #&zwnj;3, output 42+0 - add negative tests based on `derive_set_capacity` (max possible capacity + 1) - add in `test_suite_psa_crypto_metadata.data` the test cases based on `key_derivation_algorithm` for HKDF/HKDF_EXTRACT/HKDF_EXPAND with SM3 hash algorithm. For PBKDF2-SM3: Add in `test_suite_psa_crypto` correctness test cases based on the test functions `derive_input`, `derive_output` and `derive_set_capacity` similarly to what is done for PBKDF2-HMAC-SHA256. SHA-256 is used as the representative algorithm for testing generic PBKDF2/PSA behavior, so no need to add an SM3 version of all tests. A good subset seems something like: - PSA key derivation: PBKDF2-HMAC-SM3, good case, direct output - PSA key derivation: PBKDF2-HMAC-SM3, good case, key output - PSA key derivation: PBKDF2-HMAC-SM3, good case, DERIVE key as password, key output - PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #&zwnj;1 inputs, 64+0 - PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #&zwnj;1 inputs, 54+10 - PSA key derivation: PBKDF2-HMAC-SM3 -> AES-128 - PSA key derivation: PBKDF2-HMAC-SM3, request too much capacity - PSA key derivation: PBKDF2-HMAC-SM3, request maximum capacity It would also be nice to have the following tests running `derive_output()`: - PSA key derivation: PBKDF2-HMAC(SM3), RFC7914 #&zwnj;1 inputs, cost 2, password as bytes , exercises 2 iterations - PSA key derivation: PBKDF2-HMAC(SM3), empty password, to test that PBKDF2-HMAC-SM3 correctly accepts a zero-length password and produces the expected derived output. Depends on: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/874 and https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/879 ### Justification TF-PSA-Crypto needs this to test HKDF/PBKDF2-SM3 support

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#881

No description provided.

Rows
Columns