Initial Dever 0.0.1

test/rust/runtime/crypto.rs

@@ -0,0 +1,78 @@
+use dever_runtime::{crypto, value::secret::Secret};
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+#[test]
+fn secret_debug_is_redacted_and_token_bounds_are_fixed() {
+    let secret = Secret::from_input(b"test-only-sensitive-input".to_vec());
+    assert_eq!(format!("{secret:?}"), "Secret([REDACTED])");
+    assert_eq!(format!("{:?}", secret.clone()), "Secret([REDACTED])");
+    for length in [-1, 0, 15, 1025] {
+        assert!(crypto::token(length).is_err());
+    }
+    assert!(crypto::token(16).is_ok());
+    assert!(crypto::token(1024).is_ok());
+}
+
+#[test]
+fn sha256_and_hmac_match_known_vectors() {
+    assert_eq!(
+        hex(&crypto::sha256(b"abc")),
+        "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+    );
+    let key = Secret::from_input(vec![0x0b; 20]);
+    assert_eq!(
+        hex(&crypto::hmac_sha256(&key, b"Hi There")),
+        "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
+    );
+}
+
+#[test]
+fn content_comparison_has_the_declared_value_semantics() {
+    assert!(crypto::constant_time_eq(b"", b""));
+    assert!(crypto::constant_time_eq(b"same", b"same"));
+    assert!(!crypto::constant_time_eq(b"same", b"sXme"));
+    assert!(!crypto::constant_time_eq(b"same", b"sam"));
+}
+
+#[test]
+fn passwords_use_the_existing_profile_and_distinguish_mismatch_from_invalid_hash() {
+    let password = Secret::from_input(b"test-only-password".to_vec());
+    let wrong = Secret::from_input(b"other-test-password".to_vec());
+    let encoded = crypto::password_hash(&password).unwrap();
+    assert!(encoded.starts_with("$argon2id$v=19$m=19456,t=2,p=1$"));
+    assert_eq!(crypto::password_verify(&password, &encoded), Ok(true));
+    assert_eq!(
+        crypto::password_verify(&password.clone(), &encoded),
+        Ok(true)
+    );
+    assert_eq!(crypto::password_verify(&wrong, &encoded), Ok(false));
+    assert!(crypto::password_verify(&password, "not a hash").is_err());
+}
+
+#[test]
+fn raw_phc_costs_are_rejected_before_parameter_arithmetic_or_hashing() {
+    let password = Secret::from_input(b"test-only-password".to_vec());
+    let encoded =
+        "$argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHQ$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    for invalid in [
+        encoded.replace("m=19456", "m=19457"),
+        encoded.replace("t=2", "t=3"),
+        encoded.replace("p=1", "p=2"),
+        encoded.replace("p=1", "p=536870912"),
+        encoded.replace("p=1", "p=0"),
+        encoded.replace("p=1", "p=invalid"),
+        encoded.replace("$v=19$", "$v=16$"),
+        encoded.replace("argon2id", "argon2i"),
+        encoded.replace("p=1", "p=1,data=YQ"),
+        encoded.replace("p=1", "p=1,keyid=YQ"),
+        "x".repeat(257),
+    ] {
+        assert!(
+            crypto::password_verify(&password, &invalid).is_err(),
+            "{invalid}"
+        );
+    }
+}