--- /dev/null
+/*
+ * Copyright © 2025 David Dudas
+ *
+ * Author: David Dudas <david.dudas03@e-uvt.ro>
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+
+ * along with this program. If not, see <https://www.gnu.org/licenses/>
+
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+#include <gnutls/abstract.h>
+
+#include "utils.h"
+
+#include <stdbool.h>
+#include <stdint.h>
+
+static unsigned char info[] = { 0x4f, 0x64, 0x65, 0x20, 0x6f, 0x6e, 0x20,
+ 0x61, 0x20, 0x47, 0x72, 0x65, 0x63, 0x69,
+ 0x61, 0x6e, 0x20, 0x55, 0x72, 0x6e };
+
+static unsigned char plaintext[] = { 0x42, 0x65, 0x61, 0x75, 0x74, 0x79,
+ 0x20, 0x69, 0x73, 0x20, 0x74, 0x72,
+ 0x75, 0x74, 0x68, 0x2c, 0x20, 0x74,
+ 0x72, 0x75, 0x74, 0x68, 0x20, 0x62,
+ 0x65, 0x61, 0x75, 0x74, 0x79 };
+
+static unsigned char seq0_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x30 };
+
+static unsigned char seq1_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x31 };
+
+static unsigned char seq2_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x32 };
+
+static unsigned char exporter_context_1[] = {};
+
+static unsigned char exporter_context_2[] = { 0x00 };
+
+static unsigned char exporter_context_3[] = { 0x54, 0x65, 0x73, 0x74,
+ 0x43, 0x6f, 0x6e, 0x74,
+ 0x65, 0x78, 0x74 };
+
+static unsigned char psk[] = { 0x02, 0x47, 0xfd, 0x33, 0xb9, 0x13, 0x76, 0x0f,
+ 0xa1, 0xfa, 0x51, 0xe1, 0x89, 0x2d, 0x9f, 0x30,
+ 0x7f, 0xbe, 0x65, 0xeb, 0x17, 0x1e, 0x81, 0x32,
+ 0xc2, 0xaf, 0x18, 0x55, 0x5a, 0x73, 0x8b, 0x82 };
+
+static unsigned char psk_id[] = { 0x45, 0x6e, 0x6e, 0x79, 0x6e, 0x20,
+ 0x44, 0x75, 0x72, 0x69, 0x6e, 0x20,
+ 0x61, 0x72, 0x61, 0x6e, 0x20, 0x4d,
+ 0x6f, 0x72, 0x69, 0x61 };
+
+typedef struct hpke_test_encryption_parameters_st {
+ size_t sequence_number;
+ gnutls_datum_t plaintext;
+ gnutls_datum_t aad;
+ gnutls_datum_t expected_ciphertext;
+} hpke_test_encryption_parameters_st;
+
+typedef struct hpke_test_exporter_parameters_st {
+ gnutls_datum_t exporter_context;
+ size_t exporter_length;
+ gnutls_datum_t expected_exporter_value;
+} hpke_test_exporter_parameters_st;
+
+typedef struct hpke_test_parameters_st {
+ gnutls_hpke_mode_t mode;
+ gnutls_hpke_kem_t kem;
+ gnutls_hpke_kdf_t kdf;
+ gnutls_hpke_aead_t aead;
+ gnutls_datum_t ikmE;
+ gnutls_datum_t ikmR;
+ gnutls_datum_t *ikmS;
+ gnutls_datum_t info;
+ gnutls_datum_t *psk;
+ gnutls_datum_t *psk_id;
+ gnutls_datum_t expected_enc;
+ hpke_test_encryption_parameters_st *encryption_parameters;
+ size_t num_encryption_parameters;
+ hpke_test_exporter_parameters_st *exporter_parameters;
+ size_t num_exporter_parameters;
+} hpke_test_parameters_st;
+
+static void test_hpke(const hpke_test_parameters_st *params)
+{
+ int ret;
+ gnutls_privkey_t skR = NULL;
+ gnutls_pubkey_t pkR = NULL;
+ gnutls_privkey_t skS = NULL;
+ gnutls_pubkey_t pkS = NULL;
+
+ gnutls_hpke_context_t sender_ctx = NULL;
+ gnutls_hpke_context_t receiver_ctx = NULL;
+
+ gnutls_datum_t enc = { NULL, 0 };
+ gnutls_datum_t plaintext_out = { NULL, 0 };
+ gnutls_datum_t ciphertext_out = { NULL, 0 };
+ gnutls_datum_t exporter_out = { NULL, 0 };
+
+ ret = gnutls_hpke_context_init(&sender_ctx, params->mode,
+ GNUTLS_HPKE_ROLE_SENDER, params->kem,
+ params->kdf, params->aead);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_init (mode: %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ ret = gnutls_hpke_context_set_ikme(sender_ctx, ¶ms->ikmE);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_set_ikme (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (params->psk != NULL && params->psk_id != NULL) {
+ ret = gnutls_hpke_context_set_psk(sender_ctx, params->psk,
+ params->psk_id);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_set_psk (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+ }
+
+ if (params->ikmS != NULL) {
+ ret = gnutls_hpke_generate_keypair(params->kem, params->ikmS,
+ &skS, &pkS);
+ if (ret < 0) {
+ fail("gnutls_hpke_generate_keypair (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ ret = gnutls_hpke_context_set_sender_privkey(sender_ctx, skS);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_set_sender_privkey (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+ }
+
+ ret = gnutls_hpke_generate_keypair(params->kem, ¶ms->ikmR, &skR,
+ &pkR);
+ if (ret < 0) {
+ fail("gnutls_hpke_generate_keypair (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ ret = gnutls_hpke_encap(sender_ctx, ¶ms->info, &enc, pkR);
+ if (ret < 0) {
+ fail("gnutls_hpke_encap (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (params->expected_enc.size != enc.size ||
+ memcmp(params->expected_enc.data, enc.data, enc.size) != 0) {
+ fail("enc does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
+ params->mode, params->kem, params->kdf, params->aead);
+ goto cleanup;
+ }
+
+ ret = gnutls_hpke_context_init(&receiver_ctx, params->mode,
+ GNUTLS_HPKE_ROLE_RECEIVER, params->kem,
+ params->kdf, params->aead);
+ if (ret < 0) {
+ fail("gnutls_context_init (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (params->psk != NULL && params->psk_id != NULL) {
+ ret = gnutls_hpke_context_set_psk(receiver_ctx, params->psk,
+ params->psk_id);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_set_psk (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+ }
+
+ if (params->ikmS != NULL) {
+ ret = gnutls_hpke_context_set_sender_pubkey(receiver_ctx, pkS);
+ if (ret < 0) {
+ fail("gnutls_hpke_context_set_sender_pubkey (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+ }
+
+ ret = gnutls_hpke_decap(receiver_ctx, ¶ms->info, &enc, skR);
+ if (ret < 0) {
+ fail("gnutls_hpke_decap (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf, params->aead,
+ gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ for (size_t i = 0; i < params->num_encryption_parameters; i++) {
+ hpke_test_encryption_parameters_st *enc_params =
+ ¶ms->encryption_parameters[i];
+ ret = gnutls_hpke_seal(sender_ctx, &enc_params->aad,
+ &enc_params->plaintext, &ciphertext_out);
+ if (ret < 0) {
+ fail("gnutls_hpke_seal (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (enc_params->expected_ciphertext.size !=
+ ciphertext_out.size ||
+ memcmp(enc_params->expected_ciphertext.data,
+ ciphertext_out.data, ciphertext_out.size) != 0) {
+ fail("ciphertext does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
+ params->mode, params->kem, params->kdf,
+ params->aead);
+ goto cleanup;
+ }
+
+ ret = gnutls_hpke_open(receiver_ctx, &enc_params->aad,
+ &ciphertext_out, &plaintext_out);
+ if (ret < 0) {
+ fail("gnutls_hpke_open (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (enc_params->plaintext.size != plaintext_out.size ||
+ memcmp(enc_params->plaintext.data, plaintext_out.data,
+ plaintext_out.size) != 0) {
+ fail("decrypted plaintext does not match original plaintext (mode %d, kem: %d, kdf: %d, aead: %d)\n",
+ params->mode, params->kem, params->kdf,
+ params->aead);
+ goto cleanup;
+ }
+
+ uint64_t seq;
+ ret = gnutls_hpke_get_seq(receiver_ctx, &seq);
+ if (ret < 0) {
+ fail("gnutls_hpke_get_seq (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (seq != enc_params->sequence_number + 1) {
+ fail("sequence number does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
+ params->mode, params->kem, params->kdf,
+ params->aead);
+ goto cleanup;
+ }
+
+ gnutls_free(ciphertext_out.data);
+ ciphertext_out.data = NULL;
+ gnutls_free(plaintext_out.data);
+ plaintext_out.data = NULL;
+ }
+
+ for (size_t i = 0; i < params->num_exporter_parameters; i++) {
+ hpke_test_exporter_parameters_st *exp_params =
+ ¶ms->exporter_parameters[i];
+ ret = gnutls_hpke_export(sender_ctx,
+ &exp_params->exporter_context, 32,
+ &exporter_out);
+ if (ret < 0) {
+ fail("gnutls_hpke_export (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
+ params->mode, params->kem, params->kdf,
+ params->aead, gnutls_strerror(ret));
+ goto cleanup;
+ }
+
+ if (exp_params->expected_exporter_value.size !=
+ exporter_out.size ||
+ memcmp(exp_params->expected_exporter_value.data,
+ exporter_out.data, exporter_out.size) != 0) {
+ fail("exported value does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
+ params->mode, params->kem, params->kdf,
+ params->aead);
+ goto cleanup;
+ }
+
+ gnutls_free(exporter_out.data);
+ exporter_out.data = NULL;
+ }
+
+cleanup:
+ gnutls_privkey_deinit(skR);
+ gnutls_pubkey_deinit(pkR);
+ gnutls_privkey_deinit(skS);
+ gnutls_pubkey_deinit(pkS);
+ gnutls_hpke_context_deinit(sender_ctx);
+ gnutls_hpke_context_deinit(receiver_ctx);
+
+ if (enc.data != NULL) {
+ gnutls_free(enc.data);
+ }
+
+ if (plaintext_out.data != NULL) {
+ gnutls_free(plaintext_out.data);
+ }
+
+ if (ciphertext_out.data != NULL) {
+ gnutls_free(ciphertext_out.data);
+ }
+
+ if (exporter_out.data != NULL) {
+ gnutls_free(exporter_out.data);
+ }
+}
+
+static void rfc9180_a11(void)
+{
+ unsigned char a111_seq0_expected_ct[] = {
+ 0xf9, 0x38, 0x55, 0x8b, 0x5d, 0x72, 0xf1, 0xa2, 0x38,
+ 0x10, 0xb4, 0xbe, 0x2a, 0xb4, 0xf8, 0x43, 0x31, 0xac,
+ 0xc0, 0x2f, 0xc9, 0x7b, 0xab, 0xc5, 0x3a, 0x52, 0xae,
+ 0x82, 0x18, 0xa3, 0x55, 0xa9, 0x6d, 0x87, 0x70, 0xac,
+ 0x83, 0xd0, 0x7b, 0xea, 0x87, 0xe1, 0x3c, 0x51, 0x2a
+ };
+
+ unsigned char a111_seq1_expected_ct[] = {
+ 0xaf, 0x2d, 0x7e, 0x9a, 0xc9, 0xae, 0x7e, 0x27, 0x0f,
+ 0x46, 0xba, 0x1f, 0x97, 0x5b, 0xe5, 0x3c, 0x09, 0xf8,
+ 0xd8, 0x75, 0xbd, 0xc8, 0x53, 0x54, 0x58, 0xc2, 0x49,
+ 0x4e, 0x8a, 0x6e, 0xab, 0x25, 0x1c, 0x03, 0xd0, 0xc2,
+ 0x2a, 0x56, 0xb8, 0xca, 0x42, 0xc2, 0x06, 0x3b, 0x84
+ };
+
+ unsigned char a111_seq2_expected_ct[] = {
+ 0x49, 0x8d, 0xfc, 0xab, 0xd9, 0x2e, 0x8a, 0xce, 0xdc,
+ 0x28, 0x1e, 0x85, 0xaf, 0x1c, 0xb4, 0xe3, 0xe3, 0x1c,
+ 0x7d, 0xc3, 0x94, 0xa1, 0xca, 0x20, 0xe1, 0x73, 0xcb,
+ 0x72, 0x51, 0x64, 0x91, 0x58, 0x8d, 0x96, 0xa1, 0x9a,
+ 0xd4, 0xa6, 0x83, 0x51, 0x89, 0x73, 0xdc, 0xc1, 0x80
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { a111_seq0_expected_ct,
+ sizeof(a111_seq0_expected_ct) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { a111_seq1_expected_ct,
+ sizeof(a111_seq1_expected_ct) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { a111_seq2_expected_ct,
+ sizeof(a111_seq2_expected_ct) } }
+ };
+
+ unsigned char a112_expected_exporter_value_1[] = {
+ 0x38, 0x53, 0xfe, 0x2b, 0x40, 0x35, 0x19, 0x5a,
+ 0x57, 0x3f, 0xfc, 0x53, 0x85, 0x6e, 0x77, 0x05,
+ 0x8e, 0x15, 0xd9, 0xea, 0x06, 0x4d, 0xe3, 0xe5,
+ 0x9f, 0x49, 0x61, 0xd0, 0x09, 0x52, 0x50, 0xee
+ };
+
+ unsigned char a112_expected_exporter_value_2[] = {
+ 0x2e, 0x8f, 0x0b, 0x54, 0x67, 0x3c, 0x70, 0x29,
+ 0x64, 0x9d, 0x4e, 0xb9, 0xd5, 0xe3, 0x3b, 0xf1,
+ 0x87, 0x2c, 0xf7, 0x6d, 0x62, 0x3f, 0xf1, 0x64,
+ 0xac, 0x18, 0x5d, 0xa9, 0xe8, 0x8c, 0x21, 0xa5
+ };
+
+ unsigned char a112_expected_exporter_value_3[] = {
+ 0xe9, 0xe4, 0x30, 0x65, 0x10, 0x2c, 0x38, 0x36,
+ 0x40, 0x1b, 0xed, 0x8c, 0x3c, 0x3c, 0x75, 0xae,
+ 0x46, 0xbe, 0x16, 0x39, 0x86, 0x93, 0x91, 0xd6,
+ 0x2c, 0x61, 0xf1, 0xec, 0x7a, 0xf5, 0x49, 0x31
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(a112_expected_exporter_value_1),
+ .expected_exporter_value = { a112_expected_exporter_value_1,
+ sizeof(a112_expected_exporter_value_1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(a112_expected_exporter_value_2),
+ .expected_exporter_value = { a112_expected_exporter_value_2,
+ sizeof(a112_expected_exporter_value_2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(a112_expected_exporter_value_3),
+ .expected_exporter_value = { a112_expected_exporter_value_3,
+ sizeof(a112_expected_exporter_value_3) } }
+ };
+
+ unsigned char a11_ikmE[] = { 0x72, 0x68, 0x60, 0x0d, 0x40, 0x3f, 0xce,
+ 0x43, 0x15, 0x61, 0xae, 0xf5, 0x83, 0xee,
+ 0x16, 0x13, 0x52, 0x7c, 0xff, 0x65, 0x5c,
+ 0x13, 0x43, 0xf2, 0x98, 0x12, 0xe6, 0x67,
+ 0x06, 0xdf, 0x32, 0x34 };
+
+ unsigned char a11_ikmR[] = { 0x6d, 0xb9, 0xdf, 0x30, 0xaa, 0x07, 0xdd,
+ 0x42, 0xee, 0x5e, 0x81, 0x81, 0xaf, 0xdb,
+ 0x97, 0x7e, 0x53, 0x8f, 0x5e, 0x1f, 0xec,
+ 0x8a, 0x06, 0x22, 0x3f, 0x33, 0xf7, 0x01,
+ 0x3e, 0x52, 0x50, 0x37 };
+
+ unsigned char a11_expected_enc[] = { 0x37, 0xfd, 0xa3, 0x56, 0x7b, 0xdb,
+ 0xd6, 0x28, 0xe8, 0x86, 0x68, 0xc3,
+ 0xc8, 0xd7, 0xe9, 0x7d, 0x1d, 0x12,
+ 0x53, 0xb6, 0xd4, 0xea, 0x6d, 0x44,
+ 0xc1, 0x50, 0xf7, 0x41, 0xf1, 0xbf,
+ 0x44, 0x31 };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { a11_ikmE, sizeof(a11_ikmE) },
+ .ikmR = { a11_ikmR, sizeof(a11_ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { a11_expected_enc, sizeof(a11_expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a12(void)
+{
+ unsigned char a12_seq0_expected_ct[] = {
+ 0xe5, 0x2c, 0x6f, 0xed, 0x7f, 0x75, 0x8d, 0x0c, 0xf7,
+ 0x14, 0x56, 0x89, 0xf2, 0x1b, 0xc1, 0xbe, 0x6e, 0xc9,
+ 0xea, 0x09, 0x7f, 0xef, 0x4e, 0x95, 0x94, 0x40, 0x01,
+ 0x2f, 0x4f, 0xeb, 0x73, 0xfb, 0x61, 0x1b, 0x94, 0x61,
+ 0x99, 0xe6, 0x81, 0xf4, 0xcf, 0xc3, 0x4d, 0xb8, 0xea
+ };
+ unsigned char a12_seq1_expected_ct[] = {
+ 0x49, 0xf3, 0xb1, 0x9b, 0x28, 0xa9, 0xea, 0x9f, 0x43,
+ 0xe8, 0xc7, 0x12, 0x04, 0xc0, 0x0d, 0x4a, 0x49, 0x0e,
+ 0xe7, 0xf6, 0x13, 0x87, 0xb6, 0x71, 0x9d, 0xb7, 0x65,
+ 0xe9, 0x48, 0x12, 0x3b, 0x45, 0xb6, 0x16, 0x33, 0xef,
+ 0x05, 0x9b, 0xa2, 0x2c, 0xd6, 0x24, 0x37, 0xc8, 0xba
+ };
+ unsigned char a12_seq2_expected_ct[] = {
+ 0x25, 0x7c, 0xa6, 0xa0, 0x84, 0x73, 0xdc, 0x85, 0x1f,
+ 0xde, 0x45, 0xaf, 0xd5, 0x98, 0xcc, 0x83, 0xe3, 0x26,
+ 0xdd, 0xd0, 0xab, 0xe1, 0xef, 0x23, 0xba, 0xa3, 0xba,
+ 0xa4, 0xdd, 0x8c, 0xde, 0x99, 0xfc, 0xe2, 0xc1, 0xe8,
+ 0xce, 0x68, 0x7b, 0x0b, 0x47, 0xea, 0xd1, 0xad, 0xc9
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { a12_seq0_expected_ct,
+ sizeof(a12_seq0_expected_ct) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { a12_seq1_expected_ct,
+ sizeof(a12_seq1_expected_ct) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { a12_seq2_expected_ct,
+ sizeof(a12_seq2_expected_ct) } }
+ };
+
+ unsigned char a12_expected_exporter_value_1[] = {
+ 0xdf, 0xf1, 0x7a, 0xf3, 0x54, 0xc8, 0xb4, 0x16,
+ 0x73, 0x56, 0x7d, 0xb6, 0x25, 0x9f, 0xd6, 0x02,
+ 0x99, 0x67, 0xb4, 0xe1, 0xaa, 0xd1, 0x30, 0x23,
+ 0xc2, 0xae, 0x5d, 0xf8, 0xf4, 0xf4, 0x3b, 0xf6
+ };
+
+ unsigned char a12_expected_exporter_value_2[] = {
+ 0x6a, 0x84, 0x72, 0x61, 0xd8, 0x20, 0x7f, 0xe5,
+ 0x96, 0xbe, 0xfb, 0x52, 0x92, 0x84, 0x63, 0x88,
+ 0x1a, 0xb4, 0x93, 0xda, 0x34, 0x5b, 0x10, 0xe1,
+ 0xdc, 0xc6, 0x45, 0xe3, 0xb9, 0x4e, 0x2d, 0x95
+ };
+
+ unsigned char a12_expected_exporter_value_3[] = {
+ 0x8a, 0xff, 0x52, 0xb4, 0x5a, 0x1b, 0xe3, 0xa7,
+ 0x34, 0xbc, 0x7a, 0x41, 0xe2, 0x0b, 0x4e, 0x05,
+ 0x5a, 0xd4, 0xc4, 0xd2, 0x21, 0x04, 0xb0, 0xc2,
+ 0x02, 0x85, 0xa7, 0xc4, 0x30, 0x24, 0x01, 0xcd
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(a12_expected_exporter_value_1),
+ .expected_exporter_value = { a12_expected_exporter_value_1,
+ sizeof(a12_expected_exporter_value_1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(a12_expected_exporter_value_2),
+ .expected_exporter_value = { a12_expected_exporter_value_2,
+ sizeof(a12_expected_exporter_value_2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(a12_expected_exporter_value_3),
+ .expected_exporter_value = { a12_expected_exporter_value_3,
+ sizeof(a12_expected_exporter_value_3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x78, 0x62, 0x8c, 0x35, 0x4e, 0x46, 0xf3, 0xe1,
+ 0x69, 0xbd, 0x23, 0x1b, 0xe7, 0xb2, 0xff, 0x1c,
+ 0x77, 0xaa, 0x30, 0x24, 0x60, 0xa2, 0x6d, 0xbf,
+ 0xa1, 0x55, 0x15, 0x68, 0x4c, 0x00, 0x13, 0x0b
+ };
+ unsigned char ikmR[] = {
+ 0xd4, 0xa0, 0x9d, 0x09, 0xf5, 0x75, 0xfe, 0xf4,
+ 0x25, 0x90, 0x5d, 0x2a, 0xb3, 0x96, 0xc1, 0x44,
+ 0x91, 0x41, 0x46, 0x3f, 0x69, 0x8f, 0x8e, 0xfd,
+ 0xb7, 0xac, 0xcf, 0xaf, 0xf8, 0x99, 0x50, 0x98
+ };
+
+ unsigned char expected_enc[] = { 0x0a, 0xd0, 0x95, 0x0d, 0x9f, 0xb9,
+ 0x58, 0x8e, 0x59, 0x69, 0x0b, 0x74,
+ 0xf1, 0x23, 0x7e, 0xcd, 0xf1, 0xd7,
+ 0x75, 0xcd, 0x60, 0xbe, 0x2e, 0xca,
+ 0x57, 0xaf, 0x5a, 0x4b, 0x04, 0x71,
+ 0xc9, 0x1b };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a13(void)
+{
+ unsigned char a13_seq0_expected_ct[] = {
+ 0x5f, 0xd9, 0x2c, 0xc9, 0xd4, 0x6d, 0xbf, 0x89, 0x43,
+ 0xe7, 0x2a, 0x07, 0xe4, 0x2f, 0x36, 0x3e, 0xd5, 0xf7,
+ 0x21, 0x21, 0x2c, 0xd9, 0x0b, 0xcf, 0xd0, 0x72, 0xbf,
+ 0xd9, 0xf4, 0x4e, 0x06, 0xb8, 0x0f, 0xd1, 0x78, 0x24,
+ 0x94, 0x74, 0x96, 0xe2, 0x1b, 0x68, 0x0c, 0x14, 0x1b
+ };
+
+ unsigned char a13_seq1_expected_ct[] = {
+ 0xd3, 0x73, 0x6b, 0xb2, 0x56, 0xc1, 0x9b, 0xfa, 0x93,
+ 0xd7, 0x9e, 0x8f, 0x80, 0xb7, 0x97, 0x12, 0x62, 0xcb,
+ 0x7c, 0x88, 0x7e, 0x35, 0xc2, 0x63, 0x70, 0xcf, 0xed,
+ 0x62, 0x25, 0x43, 0x69, 0xa1, 0xb5, 0x2e, 0x3d, 0x50,
+ 0x5b, 0x79, 0xdd, 0x69, 0x9f, 0x00, 0x2b, 0xc8, 0xed
+ };
+
+ unsigned char a13_seq2_expected_ct[] = {
+ 0x12, 0x21, 0x75, 0xcf, 0xd5, 0x67, 0x8e, 0x04, 0x89,
+ 0x4e, 0x4f, 0xf8, 0x78, 0x9e, 0x85, 0xdd, 0x38, 0x1d,
+ 0xf4, 0x8d, 0xca, 0xf9, 0x70, 0xd5, 0x20, 0x57, 0xdf,
+ 0x2c, 0x9a, 0xcc, 0x3b, 0x12, 0x13, 0x13, 0xa2, 0xbf,
+ 0xea, 0xa9, 0x86, 0x05, 0x0f, 0x82, 0xd9, 0x36, 0x45
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { a13_seq0_expected_ct,
+ sizeof(a13_seq0_expected_ct) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { a13_seq1_expected_ct,
+ sizeof(a13_seq1_expected_ct) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { a13_seq2_expected_ct,
+ sizeof(a13_seq2_expected_ct) } }
+ };
+
+ unsigned char a13_expected_exporter_value_1[] = {
+ 0x28, 0xc7, 0x00, 0x88, 0x01, 0x7d, 0x70, 0xc8,
+ 0x96, 0xa8, 0x42, 0x0f, 0x04, 0x70, 0x2c, 0x5a,
+ 0x32, 0x1d, 0x9c, 0xbf, 0x02, 0x79, 0xfb, 0xa8,
+ 0x99, 0xb5, 0x9e, 0x51, 0xba, 0xc7, 0x2c, 0x85
+ };
+
+ unsigned char a13_expected_exporter_value_2[] = {
+ 0x25, 0xdf, 0xc0, 0x04, 0xb0, 0x89, 0x2b, 0xe1,
+ 0x88, 0x8c, 0x39, 0x14, 0x97, 0x7a, 0xa9, 0xc9,
+ 0xbb, 0xaf, 0x2c, 0x74, 0x71, 0x70, 0x8a, 0x49,
+ 0xe1, 0x19, 0x5a, 0xf4, 0x8a, 0x6f, 0x29, 0xce
+ };
+
+ unsigned char a13_expected_exporter_value_3[] = {
+ 0x5a, 0x01, 0x31, 0x81, 0x3a, 0xbc, 0x9a, 0x52,
+ 0x2c, 0xad, 0x67, 0x8e, 0xb6, 0xba, 0xfa, 0xab,
+ 0xc4, 0x33, 0x89, 0x93, 0x4a, 0xdb, 0x80, 0x97,
+ 0xd2, 0x3c, 0x5f, 0xf6, 0x80, 0x59, 0xeb, 0x64
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(a13_expected_exporter_value_1),
+ .expected_exporter_value = { a13_expected_exporter_value_1,
+ sizeof(a13_expected_exporter_value_1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(a13_expected_exporter_value_2),
+ .expected_exporter_value = { a13_expected_exporter_value_2,
+ sizeof(a13_expected_exporter_value_2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(a13_expected_exporter_value_3),
+ .expected_exporter_value = { a13_expected_exporter_value_3,
+ sizeof(a13_expected_exporter_value_3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x6e, 0x6d, 0x8f, 0x20, 0x0e, 0xa2, 0xfb, 0x20,
+ 0xc3, 0x0b, 0x00, 0x3a, 0x8b, 0x4f, 0x43, 0x3d,
+ 0x2f, 0x4e, 0xd4, 0xc2, 0x65, 0x8d, 0x5b, 0xc8,
+ 0xce, 0x2f, 0xef, 0x71, 0x80, 0x59, 0xc9, 0xf7
+ };
+
+ unsigned char ikmR[] = {
+ 0xf1, 0xd4, 0xa3, 0x0a, 0x4c, 0xef, 0x8d, 0x6d,
+ 0x4e, 0x3b, 0x01, 0x6e, 0x6f, 0xd3, 0x79, 0x9e,
+ 0xa0, 0x57, 0xdb, 0x4f, 0x34, 0x54, 0x72, 0xed,
+ 0x30, 0x2a, 0x67, 0xce, 0x1c, 0x20, 0xcd, 0xec
+ };
+
+ unsigned char ikmS[] = {
+ 0x94, 0xb0, 0x20, 0xce, 0x91, 0xd7, 0x3f, 0xca,
+ 0x46, 0x49, 0x00, 0x6c, 0x7e, 0x73, 0x29, 0xa6,
+ 0x7b, 0x40, 0xc5, 0x5e, 0x9e, 0x93, 0xcc, 0x90,
+ 0x7d, 0x28, 0x2b, 0xbb, 0xff, 0x38, 0x6f, 0x58
+ };
+
+ unsigned char expected_enc[] = { 0x23, 0xfb, 0x95, 0x25, 0x71, 0xa1,
+ 0x4a, 0x25, 0xe3, 0xd6, 0x78, 0x14,
+ 0x0c, 0xd0, 0xe5, 0xeb, 0x47, 0xa0,
+ 0x96, 0x1b, 0xb1, 0x8a, 0xfc, 0xf8,
+ 0x58, 0x96, 0xe5, 0x45, 0x3c, 0x31,
+ 0x2e, 0x76 };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a14(void)
+{
+ unsigned char seq0_expected_ct[] = {
+ 0xa8, 0x4c, 0x64, 0xdf, 0x1e, 0x11, 0xd8, 0xfd, 0x11,
+ 0x45, 0x00, 0x39, 0xd4, 0xfe, 0x64, 0xff, 0x0c, 0x8a,
+ 0x99, 0xfc, 0xa0, 0xbd, 0x72, 0xc2, 0xd4, 0xc3, 0xe0,
+ 0x40, 0x0b, 0xc1, 0x4a, 0x40, 0xf2, 0x7e, 0x45, 0xe1,
+ 0x41, 0xa2, 0x40, 0x01, 0x69, 0x77, 0x37, 0x53, 0x3e
+ };
+
+ unsigned char seq1_expected_ct[] = {
+ 0x4d, 0x19, 0x30, 0x3b, 0x84, 0x8f, 0x42, 0x4f, 0xc3,
+ 0xc3, 0xbe, 0xca, 0x24, 0x9b, 0x2c, 0x6d, 0xe0, 0xa3,
+ 0x40, 0x83, 0xb8, 0xe9, 0x09, 0xb6, 0xaa, 0x4c, 0x36,
+ 0x88, 0x50, 0x5c, 0x05, 0xff, 0xe0, 0xc8, 0xf5, 0x7a,
+ 0x0a, 0x4c, 0x5a, 0xb9, 0xda, 0x12, 0x74, 0x35, 0xd9
+ };
+
+ unsigned char seq2_expected_ct[] = {
+ 0x0c, 0x08, 0x5a, 0x36, 0x5f, 0xbf, 0xa6, 0x34, 0x09,
+ 0x94, 0x3b, 0x00, 0xa3, 0x12, 0x7a, 0xbc, 0xe6, 0xe4,
+ 0x59, 0x91, 0xbc, 0x65, 0x3f, 0x18, 0x2a, 0x80, 0x12,
+ 0x08, 0x68, 0xfc, 0x50, 0x7e, 0x9e, 0x4d, 0x5e, 0x37,
+ 0xbc, 0xc3, 0x84, 0xfc, 0x8f, 0x14, 0x15, 0x3b, 0x24
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_expected_ct,
+ sizeof(seq0_expected_ct) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_expected_ct,
+ sizeof(seq1_expected_ct) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_expected_ct,
+ sizeof(seq2_expected_ct) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x08, 0xf7, 0xe2, 0x06, 0x44, 0xbb, 0x9b, 0x8a,
+ 0xf5, 0x4a, 0xd6, 0x6d, 0x20, 0x67, 0x45, 0x7c,
+ 0x5f, 0x9f, 0xcb, 0x2a, 0x23, 0xd9, 0xf6, 0xcb,
+ 0x44, 0x45, 0xc0, 0x79, 0x7b, 0x33, 0x00, 0x67
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x52, 0xe5, 0x1f, 0xf7, 0xd4, 0x36, 0x55, 0x7c,
+ 0xed, 0x52, 0x65, 0xff, 0x8b, 0x94, 0xce, 0x69,
+ 0xcf, 0x75, 0x83, 0xf4, 0x9c, 0xdb, 0x37, 0x4e,
+ 0x6a, 0xad, 0x80, 0x1f, 0xc0, 0x63, 0xb0, 0x10
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xa3, 0x0c, 0x20, 0x37, 0x0c, 0x02, 0x6b, 0xbe,
+ 0xa4, 0xdc, 0xa5, 0x1c, 0xb6, 0x37, 0x61, 0x69,
+ 0x51, 0x32, 0xd3, 0x42, 0xba, 0xe3, 0x3a, 0x6a,
+ 0x11, 0x52, 0x7d, 0x3e, 0x76, 0x79, 0x43, 0x6d
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x43, 0x03, 0x61, 0x90, 0x85, 0xa2, 0x0e, 0xbc,
+ 0xf1, 0x8e, 0xdd, 0x22, 0x78, 0x29, 0x52, 0xb8,
+ 0xa7, 0x16, 0x1e, 0x1d, 0xba, 0xe6, 0xe4, 0x6e,
+ 0x14, 0x3a, 0x52, 0xa9, 0x61, 0x27, 0xcf, 0x84
+ };
+
+ unsigned char ikmR[] = {
+ 0x4b, 0x16, 0x22, 0x1f, 0x3b, 0x26, 0x9a, 0x88,
+ 0xe2, 0x07, 0x27, 0x0b, 0x5e, 0x1d, 0xe2, 0x8c,
+ 0xb0, 0x1f, 0x84, 0x78, 0x41, 0xb3, 0x44, 0xb8,
+ 0x31, 0x4d, 0x6a, 0x62, 0x2f, 0xe5, 0xee, 0x90
+ };
+
+ unsigned char ikmS[] = {
+ 0x62, 0xf7, 0x7d, 0xcf, 0x5d, 0xf0, 0xdd, 0x7e,
+ 0xac, 0x54, 0xea, 0xc9, 0xf6, 0x54, 0xf4, 0x26,
+ 0xd4, 0x16, 0x1e, 0xc8, 0x50, 0xcc, 0x65, 0xc5,
+ 0x4f, 0x8b, 0x65, 0xd2, 0xe0, 0xb4, 0xe3, 0x45
+ };
+
+ unsigned char expected_enc[] = { 0x82, 0x08, 0x18, 0xd3, 0xc2, 0x39,
+ 0x93, 0x49, 0x2c, 0xc5, 0x62, 0x3a,
+ 0xb4, 0x37, 0xa4, 0x8a, 0x0a, 0x7c,
+ 0xa3, 0xe9, 0x63, 0x9c, 0x14, 0x0f,
+ 0xe1, 0xe3, 0x38, 0x11, 0xeb, 0x84,
+ 0x4b, 0x7c };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a21(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x1c, 0x52, 0x50, 0xd8, 0x03, 0x4e, 0xc2, 0xb7, 0x84,
+ 0xba, 0x2c, 0xfd, 0x69, 0xdb, 0xdb, 0x8a, 0xf4, 0x06,
+ 0xcf, 0xe3, 0xff, 0x93, 0x8e, 0x13, 0x1f, 0x0d, 0xef,
+ 0x8c, 0x8b, 0x60, 0xb4, 0xdb, 0x21, 0x99, 0x3c, 0x62,
+ 0xce, 0x81, 0x88, 0x3d, 0x2d, 0xd1, 0xb5, 0x1a, 0x28
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x6b, 0x53, 0xc0, 0x51, 0xe4, 0x19, 0x9c, 0x51, 0x8d,
+ 0xe7, 0x95, 0x94, 0xe1, 0xc4, 0xab, 0x18, 0xb9, 0x6f,
+ 0x08, 0x15, 0x49, 0xd4, 0x5c, 0xe0, 0x15, 0xbe, 0x00,
+ 0x20, 0x90, 0xbb, 0x11, 0x9e, 0x85, 0x28, 0x53, 0x37,
+ 0xcc, 0x95, 0xba, 0x5f, 0x59, 0x99, 0x2d, 0xc9, 0x8c
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x71, 0x14, 0x6b, 0xd6, 0x79, 0x5c, 0xcc, 0x9c, 0x49,
+ 0xce, 0x25, 0xdd, 0xa1, 0x12, 0xa4, 0x8f, 0x20, 0x2a,
+ 0xd2, 0x20, 0x55, 0x95, 0x02, 0xce, 0xf1, 0xf3, 0x42,
+ 0x71, 0xe0, 0xcb, 0x4b, 0x02, 0xb4, 0xf1, 0x0e, 0xca,
+ 0xc6, 0xf4, 0x8c, 0x32, 0xf8, 0x78, 0xfa, 0xe8, 0x6b
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x4b, 0xbd, 0x62, 0x43, 0xb8, 0xbb, 0x54, 0xce,
+ 0xc3, 0x11, 0xfa, 0xc9, 0xdf, 0x81, 0x84, 0x1b,
+ 0x6f, 0xd6, 0x1f, 0x56, 0x53, 0x8a, 0x77, 0x5e,
+ 0x7c, 0x80, 0xa9, 0xf4, 0x01, 0x60, 0x60, 0x6e
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x8c, 0x1d, 0xf1, 0x47, 0x32, 0x58, 0x0e, 0x55,
+ 0x01, 0xb0, 0x0f, 0x82, 0xb1, 0x0a, 0x16, 0x47,
+ 0xb4, 0x07, 0x13, 0x19, 0x1b, 0x7c, 0x12, 0x40,
+ 0xac, 0x80, 0xe2, 0xb6, 0x88, 0x08, 0xba, 0x69
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x5a, 0xcb, 0x09, 0x21, 0x11, 0x39, 0xc4, 0x3b,
+ 0x30, 0x90, 0x48, 0x9a, 0x9d, 0xa4, 0x33, 0xe8,
+ 0xa3, 0x0e, 0xe7, 0x18, 0x8b, 0xa8, 0xb0, 0xa9,
+ 0xa1, 0xcc, 0xf0, 0xc2, 0x29, 0x28, 0x3e, 0x53
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x90, 0x9a, 0x9b, 0x35, 0xd3, 0xdc, 0x47, 0x13,
+ 0xa5, 0xe7, 0x2a, 0x4d, 0xa2, 0x74, 0xb5, 0x5d,
+ 0x3d, 0x38, 0x21, 0xa3, 0x7e, 0x5d, 0x09, 0x9e,
+ 0x74, 0xa6, 0x47, 0xdb, 0x58, 0x3a, 0x90, 0x4b
+ };
+
+ unsigned char ikmR[] = {
+ 0x1a, 0xc0, 0x1f, 0x18, 0x1f, 0xdf, 0x9f, 0x35,
+ 0x27, 0x97, 0x65, 0x51, 0x61, 0xc5, 0x8b, 0x75,
+ 0xc6, 0x56, 0xa6, 0xcc, 0x27, 0x16, 0xdc, 0xb6,
+ 0x63, 0x72, 0xda, 0x83, 0x55, 0x42, 0xe1, 0xdf
+ };
+
+ unsigned char expected_enc[] = { 0x1a, 0xfa, 0x08, 0xd3, 0xde, 0xc0,
+ 0x47, 0xa6, 0x43, 0x88, 0x51, 0x63,
+ 0xf1, 0x18, 0x04, 0x76, 0xfa, 0x7d,
+ 0xdb, 0x54, 0xc6, 0xa8, 0x02, 0x9e,
+ 0xa3, 0x3f, 0x95, 0x79, 0x6b, 0xf2,
+ 0xac, 0x4a };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a22(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x4a, 0x17, 0x7f, 0x9c, 0x0d, 0x6f, 0x15, 0xcf, 0xdf,
+ 0x53, 0x3f, 0xb6, 0x5b, 0xf8, 0x4a, 0xec, 0xdc, 0x6a,
+ 0xb1, 0x6b, 0x8b, 0x85, 0xb4, 0xcf, 0x65, 0xa3, 0x70,
+ 0xe0, 0x7f, 0xc1, 0xd7, 0x8d, 0x28, 0xfb, 0x07, 0x32,
+ 0x14, 0x52, 0x52, 0x76, 0xf4, 0xa8, 0x96, 0x08, 0xff
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x5c, 0x3c, 0xab, 0xae, 0x2f, 0x0b, 0x3e, 0x12, 0x4d,
+ 0x8d, 0x86, 0x4c, 0x11, 0x6f, 0xd8, 0xf2, 0x0f, 0x3f,
+ 0x56, 0xfd, 0xa9, 0x88, 0xc3, 0x57, 0x3b, 0x40, 0xb0,
+ 0x99, 0x97, 0xfd, 0x6c, 0x76, 0x9e, 0x77, 0xc8, 0xed,
+ 0xa6, 0xcd, 0xa4, 0xf9, 0x47, 0xf5, 0xb7, 0x04, 0xa8
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x14, 0x95, 0x89, 0x00, 0xb4, 0x4b, 0xda, 0xe9, 0xcb,
+ 0xe5, 0xa5, 0x28, 0xbf, 0x93, 0x3c, 0x5c, 0x99, 0x0d,
+ 0xbb, 0x8e, 0x28, 0x2e, 0x6e, 0x49, 0x5a, 0xdf, 0x82,
+ 0x05, 0xd1, 0x9d, 0xa9, 0xeb, 0x27, 0x0e, 0x3a, 0x6f,
+ 0x1e, 0x06, 0x13, 0xab, 0x7e, 0x75, 0x79, 0x62, 0xa4
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x81, 0x3c, 0x1b, 0xfc, 0x51, 0x6c, 0x99, 0x07,
+ 0x6a, 0xe0, 0xf4, 0x66, 0x67, 0x1f, 0x0b, 0xa5,
+ 0xff, 0x24, 0x4a, 0x41, 0x69, 0x9f, 0x7b, 0x24,
+ 0x17, 0xe4, 0xc5, 0x9d, 0x46, 0xd3, 0x9f, 0x40
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x27, 0x45, 0xcf, 0x3d, 0x5b, 0xb6, 0x5c, 0x33,
+ 0x36, 0x58, 0x73, 0x29, 0x54, 0xee, 0x7a, 0xf4,
+ 0x9e, 0xb8, 0x95, 0xce, 0x77, 0xf8, 0x02, 0x28,
+ 0x73, 0xa6, 0x2a, 0x13, 0xc9, 0x4c, 0xb4, 0xe1
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xad, 0x40, 0xe3, 0xae, 0x14, 0xf2, 0x1c, 0x99,
+ 0xbf, 0xde, 0xbc, 0x20, 0xae, 0x14, 0xab, 0x86,
+ 0xf4, 0xca, 0x2d, 0xc9, 0xa4, 0x79, 0x9d, 0x20,
+ 0x0f, 0x43, 0xa2, 0x5f, 0x99, 0xfa, 0x78, 0xae
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x35, 0x70, 0x6a, 0x0b, 0x09, 0xfb, 0x26, 0xfb,
+ 0x45, 0xc3, 0x9c, 0x2f, 0x50, 0x79, 0xc7, 0x09,
+ 0xc7, 0xcf, 0x98, 0xe4, 0x3a, 0xfa, 0x97, 0x3f,
+ 0x14, 0xd8, 0x8e, 0xce, 0x7e, 0x29, 0xc2, 0xe3
+ };
+
+ unsigned char ikmR[] = {
+ 0x26, 0xb9, 0x23, 0xea, 0xde, 0x72, 0x94, 0x1c,
+ 0x8a, 0x85, 0xb0, 0x99, 0x86, 0xcd, 0xfa, 0x3f,
+ 0x12, 0x96, 0x85, 0x22, 0x61, 0xad, 0xed, 0xc5,
+ 0x2d, 0x58, 0xd2, 0x93, 0x02, 0x69, 0x81, 0x2b
+ };
+
+ unsigned char expected_enc[] = { 0x22, 0x61, 0x29, 0x9c, 0x3f, 0x40,
+ 0xa9, 0xaf, 0xc1, 0x33, 0xb9, 0x69,
+ 0xa9, 0x7f, 0x05, 0xe9, 0x5b, 0xe2,
+ 0xc5, 0x14, 0xe5, 0x4f, 0x3d, 0xe2,
+ 0x6c, 0xbe, 0x56, 0x44, 0xac, 0x73,
+ 0x5b, 0x04 };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a23(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0xab, 0x1a, 0x13, 0xc9, 0xd4, 0xf0, 0x1a, 0x87, 0xec,
+ 0x34, 0x40, 0xdb, 0xd7, 0x56, 0xe2, 0x67, 0x7b, 0xd2,
+ 0xec, 0xf9, 0xdf, 0x0c, 0xe7, 0xed, 0x73, 0x86, 0x9b,
+ 0x98, 0xe0, 0x0c, 0x09, 0xbe, 0x11, 0x1c, 0xb9, 0xfd,
+ 0xf0, 0x77, 0x34, 0x7a, 0xeb, 0x88, 0xe6, 0x1b, 0xdf
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x32, 0x65, 0xc7, 0x80, 0x7f, 0xff, 0xf7, 0xfd, 0xac,
+ 0xe2, 0x16, 0x59, 0xa2, 0xc6, 0xcc, 0xff, 0xee, 0x52,
+ 0xa2, 0x6d, 0x27, 0x0c, 0x76, 0x46, 0x8e, 0xd7, 0x42,
+ 0x02, 0xa6, 0x54, 0x78, 0xbf, 0xae, 0xdf, 0xff, 0x9c,
+ 0x2b, 0x76, 0x34, 0xe2, 0x4f, 0x10, 0xb7, 0x10, 0x16
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x3a, 0xad, 0xee, 0x86, 0xad, 0x2a, 0x05, 0x08, 0x1e,
+ 0xa8, 0x60, 0x03, 0x3a, 0x9d, 0x09, 0xdb, 0xcc, 0xb4,
+ 0xac, 0xac, 0x2d, 0xed, 0x08, 0x91, 0xda, 0x40, 0xf5,
+ 0x1d, 0x4d, 0xf1, 0x99, 0x25, 0xf7, 0xa7, 0x67, 0xb0,
+ 0x76, 0xa5, 0xcb, 0xc9, 0x35, 0x5c, 0x8f, 0xd3, 0x5e
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x07, 0x0c, 0xff, 0xaf, 0xd8, 0x9b, 0x67, 0xb7,
+ 0xf0, 0xee, 0xb8, 0x00, 0x23, 0x53, 0x03, 0xa2,
+ 0x23, 0xe6, 0xff, 0x9d, 0x1e, 0x77, 0x4d, 0xce,
+ 0x8e, 0xac, 0x58, 0x5c, 0x86, 0x88, 0xc8, 0x72
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x28, 0x52, 0xe7, 0x28, 0x56, 0x8d, 0x40, 0xdd,
+ 0xb0, 0xed, 0xde, 0x28, 0x4d, 0x36, 0xa4, 0x35,
+ 0x9c, 0x56, 0x55, 0x8b, 0xb2, 0xfb, 0x88, 0x37,
+ 0xcd, 0x3d, 0x92, 0xe4, 0x6a, 0x3a, 0x14, 0xa8
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x1d, 0xf3, 0x9d, 0xc5, 0xdd, 0x60, 0xed, 0xcb,
+ 0xf5, 0xf9, 0xae, 0x80, 0x4e, 0x15, 0xad, 0xa6,
+ 0x6e, 0x88, 0x5b, 0x28, 0xed, 0x79, 0x29, 0x11,
+ 0x6f, 0x76, 0x83, 0x69, 0xa3, 0xf9, 0x50, 0xee
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x93, 0x8d, 0x3d, 0xaa, 0x5a, 0x89, 0x04, 0x54,
+ 0x0b, 0xc2, 0x4f, 0x48, 0xae, 0x90, 0xee, 0xd3,
+ 0xf4, 0xf7, 0xf1, 0x18, 0x39, 0x56, 0x05, 0x97,
+ 0xb5, 0x5e, 0x7c, 0x95, 0x98, 0xc9, 0x96, 0xc0
+ };
+
+ unsigned char ikmR[] = {
+ 0x64, 0x83, 0x5d, 0x5e, 0xe6, 0x4a, 0xa7, 0xaa,
+ 0xd5, 0x7c, 0x6f, 0x2e, 0x4f, 0x75, 0x8f, 0x76,
+ 0x96, 0x61, 0x7f, 0x88, 0x29, 0xe7, 0x0b, 0xc9,
+ 0xac, 0x7a, 0x5e, 0xf9, 0x5d, 0x1c, 0x75, 0x6c
+ };
+
+ unsigned char ikmS[] = {
+ 0x9d, 0x8f, 0x94, 0x53, 0x7d, 0x5a, 0x3d, 0xde,
+ 0xf7, 0x12, 0x34, 0xc0, 0xba, 0xed, 0xfa, 0xd4,
+ 0xca, 0x68, 0x61, 0x63, 0x4d, 0x0b, 0x94, 0xc3,
+ 0x00, 0x7f, 0xed, 0x55, 0x7a, 0xd1, 0x7d, 0xf6
+ };
+
+ unsigned char expected_enc[] = { 0xf7, 0x67, 0x4c, 0xc8, 0xcd, 0x7b,
+ 0xaa, 0x58, 0x72, 0xd1, 0xf3, 0x3d,
+ 0xba, 0xff, 0xe3, 0x31, 0x42, 0x39,
+ 0xf6, 0x19, 0x7d, 0xdf, 0x5d, 0xed,
+ 0x17, 0x46, 0x76, 0x0b, 0xfc, 0x84,
+ 0x7e, 0x0e };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a24(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x9a, 0xa5, 0x2e, 0x29, 0x27, 0x4f, 0xc6, 0x17, 0x2e,
+ 0x38, 0xa4, 0x46, 0x13, 0x61, 0xd2, 0x34, 0x25, 0x85,
+ 0xd3, 0xae, 0xec, 0x67, 0xfb, 0x3b, 0x72, 0x1e, 0xcd,
+ 0x63, 0xf0, 0x59, 0x57, 0x7c, 0x7f, 0xe8, 0x86, 0xbe,
+ 0x0e, 0xde, 0x01, 0x45, 0x6e, 0xbc, 0x67, 0xd5, 0x97
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x59, 0x46, 0x0b, 0xac, 0xdb, 0xe7, 0xa9, 0x20, 0xef,
+ 0x28, 0x06, 0xa7, 0x49, 0x37, 0xd5, 0xa6, 0x91, 0xd6,
+ 0xd5, 0x06, 0x2d, 0x7d, 0xaa, 0xfc, 0xad, 0x7d, 0xb7,
+ 0xe4, 0xd8, 0xc6, 0x49, 0xad, 0xff, 0xe5, 0x75, 0xc1,
+ 0x88, 0x9c, 0x5c, 0x2e, 0x3a, 0x49, 0xaf, 0x8e, 0x3e
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x56, 0x88, 0xff, 0x6a, 0x03, 0xba, 0x26, 0xae, 0x93,
+ 0x60, 0x44, 0xa5, 0xc8, 0x00, 0xf2, 0x86, 0xfb, 0x5d,
+ 0x1e, 0xcc, 0xdd, 0x2a, 0x0f, 0x26, 0x8f, 0x6f, 0xf9,
+ 0x77, 0x3b, 0x51, 0x16, 0x93, 0x18, 0xd1, 0xa1, 0x46,
+ 0x6b, 0xb3, 0x62, 0x63, 0x41, 0x50, 0x71, 0xdb, 0x00
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0xc2, 0x3e, 0xbd, 0x4e, 0x7a, 0x0a, 0xd0, 0x6a,
+ 0x5d, 0xdd, 0xf7, 0x79, 0xf6, 0x50, 0x04, 0xce,
+ 0x94, 0x81, 0x06, 0x9c, 0xe0, 0xf0, 0xe6, 0xdd,
+ 0x51, 0xa0, 0x45, 0x39, 0xdd, 0xcb, 0xd5, 0xcd
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0xed, 0x7f, 0xf5, 0xca, 0x40, 0xa3, 0xd8, 0x45,
+ 0x61, 0x06, 0x7e, 0xbc, 0x8e, 0x01, 0x70, 0x2b,
+ 0xc3, 0x6c, 0xf1, 0xeb, 0x99, 0xd4, 0x2a, 0x92,
+ 0x00, 0x46, 0x42, 0xb9, 0xdf, 0xaa, 0xdd, 0x37
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xd3, 0xba, 0xe0, 0x66, 0xaa, 0x8d, 0xa2, 0x7d,
+ 0x52, 0x7d, 0x85, 0xc0, 0x40, 0xf7, 0xdd, 0x6c,
+ 0xcb, 0x60, 0x22, 0x1c, 0x90, 0x2e, 0xe3, 0x6a,
+ 0x82, 0xf7, 0x0b, 0xcd, 0x62, 0xa6, 0x0e, 0xe4
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x49, 0xd6, 0xea, 0xc8, 0xc6, 0xc5, 0x58, 0xc9,
+ 0x53, 0xa0, 0xa2, 0x52, 0x92, 0x9a, 0x81, 0x87,
+ 0x45, 0xbb, 0x08, 0xcd, 0x3d, 0x29, 0xe1, 0x5f,
+ 0x9f, 0x5d, 0xb5, 0xeb, 0x2e, 0x7d, 0x4b, 0x84
+ };
+
+ unsigned char ikmR[] = {
+ 0xf3, 0x30, 0x4d, 0xdc, 0xf1, 0x58, 0x48, 0x48,
+ 0x82, 0x71, 0xf1, 0x2b, 0x75, 0xec, 0xaf, 0x72,
+ 0x30, 0x1f, 0xaa, 0xbf, 0x6a, 0xd2, 0x83, 0x65,
+ 0x4a, 0x14, 0xc3, 0x98, 0x83, 0x2e, 0xb1, 0x84
+ };
+
+ unsigned char ikmS[] = {
+ 0x20, 0xad, 0xe1, 0xd5, 0x20, 0x3d, 0xe1, 0xaa,
+ 0xdf, 0xb2, 0x61, 0xc4, 0x70, 0x0b, 0x64, 0x32,
+ 0xe2, 0x60, 0xd0, 0xd3, 0x17, 0xbe, 0x6e, 0xbb,
+ 0xb8, 0xd7, 0xff, 0xfb, 0x1f, 0x86, 0xad, 0x9d
+ };
+
+ unsigned char expected_enc[] = { 0x65, 0x6a, 0x2e, 0x00, 0xdc, 0x99,
+ 0x90, 0xfd, 0x18, 0x9e, 0x6e, 0x47,
+ 0x34, 0x59, 0x39, 0x2d, 0xf5, 0x56,
+ 0xe9, 0xa2, 0x75, 0x87, 0x54, 0xa0,
+ 0x9d, 0xb3, 0xf5, 0x11, 0x79, 0xa3,
+ 0xfc, 0x02 };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a31(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x5a, 0xd5, 0x90, 0xbb, 0x8b, 0xaa, 0x57, 0x7f, 0x86,
+ 0x19, 0xdb, 0x35, 0xa3, 0x63, 0x11, 0x22, 0x6a, 0x89,
+ 0x6e, 0x73, 0x42, 0xa6, 0xd8, 0x36, 0xd8, 0xb7, 0xbc,
+ 0xd2, 0xf2, 0x0b, 0x6c, 0x7f, 0x90, 0x76, 0xac, 0x23,
+ 0x2e, 0x3a, 0xb2, 0x52, 0x3f, 0x39, 0x51, 0x34, 0x34
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xfa, 0x6f, 0x03, 0x7b, 0x47, 0xfc, 0x21, 0x82, 0x6b,
+ 0x61, 0x01, 0x72, 0xca, 0x96, 0x37, 0xe8, 0x2d, 0x6e,
+ 0x58, 0x01, 0xeb, 0x31, 0xcb, 0xd3, 0x74, 0x82, 0x71,
+ 0xaf, 0xfd, 0x4e, 0xcb, 0x06, 0x64, 0x6e, 0x03, 0x29,
+ 0xcb, 0xdf, 0x3c, 0x3c, 0xd6, 0x55, 0xb2, 0x8e, 0x82
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x89, 0x5c, 0xab, 0xfa, 0xc5, 0x0c, 0xe6, 0xc6, 0xeb,
+ 0x02, 0xff, 0xe6, 0xc0, 0x48, 0xbf, 0x53, 0xb7, 0xf7,
+ 0xbe, 0x9a, 0x91, 0xfc, 0x55, 0x94, 0x02, 0xcb, 0xc5,
+ 0xb8, 0xdc, 0xae, 0xb5, 0x2b, 0x2c, 0xcc, 0x93, 0xe4,
+ 0x66, 0xc2, 0x8f, 0xb5, 0x5f, 0xed, 0x7a, 0x7f, 0xec
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x5e, 0x9b, 0xc3, 0xd2, 0x36, 0xe1, 0x91, 0x1d,
+ 0x95, 0xe6, 0x5b, 0x57, 0x6a, 0x8a, 0x86, 0xd4,
+ 0x78, 0xfb, 0x82, 0x7e, 0x8b, 0xdf, 0xe7, 0x7b,
+ 0x74, 0x1b, 0x28, 0x98, 0x90, 0x49, 0x0d, 0x4d
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x6c, 0xff, 0x87, 0x65, 0x89, 0x31, 0xbd, 0xa8,
+ 0x3d, 0xc8, 0x57, 0xe6, 0x35, 0x3e, 0xfe, 0x49,
+ 0x87, 0xa2, 0x01, 0xb8, 0x49, 0x65, 0x8d, 0x9b,
+ 0x04, 0x7a, 0xab, 0x4c, 0xf2, 0x16, 0xe7, 0x96
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xd8, 0xf1, 0xea, 0x79, 0x42, 0xad, 0xbb, 0xa7,
+ 0x41, 0x2c, 0x6d, 0x43, 0x1c, 0x62, 0xd0, 0x13,
+ 0x71, 0xea, 0x47, 0x6b, 0x82, 0x3e, 0xb6, 0x97,
+ 0xe1, 0xf6, 0xe6, 0xca, 0xe1, 0xda, 0xb8, 0x5a
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x42, 0x70, 0xe5, 0x4f, 0xfd, 0x08, 0xd7, 0x9d,
+ 0x59, 0x28, 0x02, 0x0a, 0xf4, 0x68, 0x6d, 0x8f,
+ 0x6b, 0x7d, 0x35, 0xdb, 0xe4, 0x70, 0x26, 0x5f,
+ 0x1f, 0x5a, 0xa2, 0x28, 0x16, 0xce, 0x86, 0x0e
+ };
+
+ unsigned char ikmR[] = {
+ 0x66, 0x8b, 0x37, 0x17, 0x1f, 0x10, 0x72, 0xf3,
+ 0xcf, 0x12, 0xea, 0x8a, 0x23, 0x6a, 0x45, 0xdf,
+ 0x23, 0xfc, 0x13, 0xb8, 0x2a, 0xf3, 0x60, 0x9a,
+ 0xd1, 0xe3, 0x54, 0xf6, 0xef, 0x81, 0x75, 0x50
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0xa9, 0x27, 0x19, 0xc6, 0x19, 0x5d, 0x50, 0x85, 0x10,
+ 0x4f, 0x46, 0x9a, 0x8b, 0x98, 0x14, 0xd5, 0x83, 0x8f, 0xf7,
+ 0x2b, 0x60, 0x50, 0x1e, 0x2c, 0x44, 0x66, 0xe5, 0xe6, 0x7b,
+ 0x32, 0x5a, 0xc9, 0x85, 0x36, 0xd7, 0xb6, 0x1a, 0x1a, 0xf4,
+ 0xb7, 0x8e, 0x5b, 0x7f, 0x95, 0x1c, 0x09, 0x00, 0xbe, 0x86,
+ 0x3c, 0x40, 0x3c, 0xe6, 0x5c, 0x9b, 0xfc, 0xb9, 0x38, 0x26,
+ 0x57, 0x22, 0x2d, 0x18, 0xc4
+ };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a32(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x90, 0xc4, 0xde, 0xb5, 0xb7, 0x53, 0x18, 0x53, 0x01,
+ 0x94, 0xe4, 0xbb, 0x62, 0xf8, 0x90, 0xb0, 0x19, 0xb1,
+ 0x39, 0x7b, 0xbf, 0x9d, 0x0d, 0x6e, 0xb9, 0x18, 0x89,
+ 0x0e, 0x1f, 0xb2, 0xbe, 0x1a, 0xc2, 0x60, 0x31, 0x93,
+ 0xb6, 0x0a, 0x49, 0xc2, 0x12, 0x6b, 0x75, 0xd0, 0xeb
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x9e, 0x22, 0x33, 0x84, 0xa3, 0x62, 0x0f, 0x4a, 0x75,
+ 0xb5, 0xa5, 0x2f, 0x54, 0x6b, 0x72, 0x62, 0xd8, 0x82,
+ 0x6d, 0xea, 0x18, 0xdb, 0x5a, 0x36, 0x5f, 0xeb, 0x8b,
+ 0x99, 0x71, 0x80, 0xb2, 0x2d, 0x72, 0xdc, 0x12, 0x87,
+ 0xf7, 0x08, 0x9a, 0x10, 0x73, 0xa7, 0x10, 0x2c, 0x27
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0xad, 0xf9, 0xf6, 0x00, 0x07, 0x73, 0x03, 0x50, 0x23,
+ 0xbe, 0x7d, 0x41, 0x5e, 0x13, 0xf8, 0x4c, 0x1c, 0xb3,
+ 0x2a, 0x24, 0x33, 0x9a, 0x32, 0xeb, 0x81, 0xdf, 0x02,
+ 0xbe, 0x9d, 0xdc, 0x6a, 0xbc, 0x88, 0x0d, 0xd8, 0x1c,
+ 0xce, 0xb7, 0xc1, 0xd0, 0xc7, 0x78, 0x14, 0x65, 0xb2
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0xa1, 0x15, 0xa5, 0x9b, 0xf4, 0xdd, 0x8d, 0xc4,
+ 0x93, 0x32, 0xd6, 0xa0, 0x09, 0x3a, 0xf8, 0xef,
+ 0xca, 0x1b, 0xcb, 0xfd, 0x36, 0x27, 0xd8, 0x50,
+ 0x17, 0x3f, 0x5c, 0x4a, 0x55, 0xd0, 0xc1, 0x85
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x45, 0x17, 0xea, 0xed, 0xe0, 0x66, 0x9b, 0x16,
+ 0xaa, 0xc7, 0xc9, 0x2d, 0x57, 0x62, 0xdd, 0x45,
+ 0x9c, 0x30, 0x1f, 0xa1, 0x0e, 0x02, 0x23, 0x7c,
+ 0xd5, 0xae, 0xb9, 0xbe, 0x96, 0x94, 0x30, 0xc4
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x16, 0x4e, 0x02, 0x14, 0x4d, 0x44, 0xb6, 0x07,
+ 0xa7, 0x72, 0x2e, 0x58, 0xb0, 0xf4, 0x15, 0x6e,
+ 0x67, 0xc0, 0xc2, 0x87, 0x4d, 0x74, 0xcf, 0x71,
+ 0xda, 0x6c, 0xa4, 0x8a, 0x4c, 0xbd, 0xc5, 0xe0
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x2a, 0xfa, 0x61, 0x1d, 0x8b, 0x1a, 0x7b, 0x32,
+ 0x1c, 0x76, 0x1b, 0x48, 0x3b, 0x6a, 0x05, 0x35,
+ 0x79, 0xaf, 0xa4, 0xf7, 0x67, 0x45, 0x0d, 0x3a,
+ 0xd0, 0xf8, 0x4a, 0x39, 0xfd, 0xa5, 0x87, 0xa6
+ };
+
+ unsigned char ikmR[] = {
+ 0xd4, 0x2e, 0xf8, 0x74, 0xc1, 0x91, 0x3d, 0x95,
+ 0x68, 0xc9, 0x40, 0x54, 0x07, 0xc8, 0x05, 0xba,
+ 0xdd, 0xaf, 0xfd, 0x08, 0x98, 0xa0, 0x0f, 0x1e,
+ 0x84, 0xe1, 0x54, 0xfa, 0x78, 0x7b, 0x24, 0x29
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x30, 0x5d, 0x35, 0x56, 0x35, 0x27, 0xbc, 0xe0, 0x37,
+ 0x77, 0x3d, 0x79, 0xa1, 0x3d, 0xea, 0xbe, 0xd0, 0xe8, 0xe7,
+ 0xcd, 0xe6, 0x1e, 0xec, 0xee, 0x40, 0x34, 0x96, 0x95, 0x9e,
+ 0x89, 0xe4, 0xd0, 0xca, 0x70, 0x17, 0x26, 0x69, 0x6d, 0x14,
+ 0x85, 0x13, 0x7c, 0xcb, 0x53, 0x41, 0xb3, 0xc1, 0xc7, 0xaa,
+ 0xee, 0x90, 0xa4, 0xa0, 0x24, 0x49, 0x72, 0x5e, 0x74, 0x4b,
+ 0x11, 0x93, 0xb5, 0x3b, 0x5f
+ };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a33(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x82, 0xff, 0xc8, 0xc4, 0x47, 0x60, 0xdb, 0x69, 0x1a,
+ 0x07, 0xc5, 0x62, 0x7e, 0x5f, 0xc2, 0xc0, 0x8e, 0x7a,
+ 0x86, 0x97, 0x9e, 0xe7, 0x9b, 0x49, 0x4a, 0x17, 0xcc,
+ 0x34, 0x05, 0x44, 0x6a, 0xc2, 0xbd, 0xb8, 0xf2, 0x65,
+ 0xdb, 0x4a, 0x09, 0x9e, 0xd3, 0x28, 0x9f, 0xfe, 0x19
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xb0, 0xa7, 0x05, 0xa5, 0x45, 0x32, 0xc7, 0xb4, 0xf5,
+ 0x90, 0x7d, 0xe5, 0x1c, 0x13, 0xdf, 0xfe, 0x1e, 0x08,
+ 0xd5, 0x5e, 0xe9, 0xba, 0x59, 0x68, 0x61, 0x14, 0xb0,
+ 0x59, 0x45, 0x49, 0x4d, 0x96, 0x72, 0x5b, 0x23, 0x94,
+ 0x68, 0xf1, 0x22, 0x9e, 0x39, 0x66, 0xaa, 0x12, 0x50
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x8d, 0xc8, 0x05, 0x68, 0x0e, 0x32, 0x71, 0xa8, 0x01,
+ 0x79, 0x08, 0x33, 0xed, 0x74, 0x47, 0x37, 0x10, 0x15,
+ 0x76, 0x45, 0x58, 0x4f, 0x06, 0xd1, 0xb5, 0x3a, 0xd4,
+ 0x39, 0x07, 0x8d, 0x88, 0x0b, 0x23, 0xe2, 0x52, 0x56,
+ 0x66, 0x31, 0x78, 0x27, 0x1c, 0x80, 0xee, 0x8b, 0x7c
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x83, 0x7e, 0x49, 0xc3, 0xff, 0x62, 0x92, 0x50,
+ 0xc8, 0xd8, 0x0d, 0x3c, 0x3f, 0xb9, 0x57, 0x72,
+ 0x5e, 0xd4, 0x81, 0xe5, 0x9e, 0x2f, 0xeb, 0x57,
+ 0xaf, 0xd9, 0xfe, 0x9a, 0x8c, 0x7c, 0x44, 0x97
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x59, 0x42, 0x13, 0xf9, 0x01, 0x8d, 0x61, 0x4b,
+ 0x82, 0x00, 0x7a, 0x70, 0x21, 0xc3, 0x13, 0x5b,
+ 0xda, 0x7b, 0x38, 0x0d, 0xa4, 0xac, 0xd9, 0xab,
+ 0x27, 0x16, 0x5c, 0x50, 0x86, 0x40, 0xdb, 0xda
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x14, 0xfe, 0x63, 0x4f, 0x95, 0xca, 0x0d, 0x86,
+ 0xe1, 0x52, 0x47, 0xcc, 0xa7, 0xde, 0x7b, 0xa9,
+ 0xb7, 0x3c, 0x9b, 0x9d, 0xeb, 0x64, 0x37, 0xe1,
+ 0xc8, 0x32, 0xda, 0xf7, 0x29, 0x1b, 0x79, 0xd5
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x79, 0x8d, 0x82, 0xa8, 0xd9, 0xea, 0x19, 0xdb,
+ 0xc7, 0xf2, 0xc6, 0xdf, 0xa5, 0x4e, 0x8a, 0x67,
+ 0x06, 0xf7, 0xcd, 0xc1, 0x19, 0xdb, 0x08, 0x13,
+ 0xda, 0xcf, 0x84, 0x40, 0xab, 0x37, 0xc8, 0x57
+ };
+
+ unsigned char ikmR[] = {
+ 0x7b, 0xc9, 0x3b, 0xde, 0x88, 0x90, 0xd1, 0xfb,
+ 0x55, 0x22, 0x0e, 0x7f, 0x3b, 0x0c, 0x10, 0x7a,
+ 0xe7, 0xe6, 0xed, 0xa3, 0x5c, 0xa4, 0x04, 0x0b,
+ 0xb6, 0x65, 0x12, 0x84, 0xbf, 0x07, 0x47, 0xee
+ };
+
+ unsigned char ikmS[] = {
+ 0x87, 0x4b, 0xaa, 0x0d, 0xcf, 0x93, 0x59, 0x5a,
+ 0x24, 0xa4, 0x5a, 0x7f, 0x04, 0x2e, 0x0d, 0x22,
+ 0xd3, 0x68, 0x74, 0x7d, 0xaa, 0xa7, 0xe1, 0x9f,
+ 0x80, 0xa8, 0x02, 0xaf, 0x19, 0x20, 0x4b, 0xa8
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x22, 0x24, 0xf3, 0xea, 0x80, 0x0f, 0x7e, 0xc5, 0x5c,
+ 0x03, 0xf2, 0x9f, 0xc9, 0x86, 0x5f, 0x6e, 0xe2, 0x70, 0x04,
+ 0xf8, 0x18, 0xfc, 0xbd, 0xc6, 0xdc, 0x68, 0x93, 0x2c, 0x1e,
+ 0x52, 0xe1, 0x5b, 0x79, 0xe2, 0x64, 0xa9, 0x8f, 0x2c, 0x53,
+ 0x5e, 0xf0, 0x67, 0x45, 0xf3, 0xd3, 0x08, 0x62, 0x44, 0x14,
+ 0x15, 0x3b, 0x22, 0xc7, 0x33, 0x2b, 0xc1, 0xe6, 0x91, 0xcb,
+ 0x4a, 0xf4, 0xd5, 0x34, 0x54
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a34(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0xb9, 0xf3, 0x6d, 0x58, 0xd9, 0xeb, 0x10, 0x16, 0x29,
+ 0xa3, 0xe5, 0xa7, 0xb6, 0x3d, 0x2e, 0xe4, 0xaf, 0x42,
+ 0xb3, 0x64, 0x42, 0x09, 0xab, 0x37, 0xe0, 0xa2, 0x72,
+ 0xd4, 0x43, 0x65, 0x40, 0x7d, 0xb8, 0xe6, 0x55, 0xc7,
+ 0x2e, 0x4f, 0xa4, 0x6f, 0x4f, 0xf8, 0x1b, 0x92, 0x46
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x51, 0x78, 0x8c, 0x4e, 0x5d, 0x56, 0x27, 0x67, 0x71,
+ 0x03, 0x27, 0x49, 0xd0, 0x15, 0xd3, 0xee, 0xa6, 0x51,
+ 0xaf, 0x0c, 0x7b, 0xb8, 0xe3, 0xda, 0x66, 0x9e, 0xff,
+ 0xff, 0xed, 0x29, 0x9e, 0xa1, 0xf6, 0x41, 0xdf, 0x62,
+ 0x1a, 0xf6, 0x55, 0x79, 0xc1, 0x0f, 0xc0, 0x97, 0x36
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x3b, 0x5a, 0x2b, 0xe0, 0x02, 0xe7, 0xb2, 0x99, 0x27,
+ 0xf0, 0x64, 0x42, 0x94, 0x7e, 0x1c, 0xf7, 0x09, 0xb9,
+ 0xf8, 0x50, 0x8b, 0x03, 0x82, 0x31, 0x27, 0x38, 0x72,
+ 0x23, 0xd7, 0x12, 0x70, 0x34, 0x71, 0xc2, 0x66, 0xef,
+ 0xc3, 0x55, 0xf1, 0xbc, 0x20, 0x36, 0xf3, 0x02, 0x7c
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x59, 0x5c, 0xe0, 0xef, 0xf4, 0x05, 0xd4, 0xb3,
+ 0xbb, 0x1d, 0x08, 0x30, 0x8d, 0x70, 0xa4, 0xe7,
+ 0x72, 0x26, 0xce, 0x11, 0x76, 0x6e, 0x0a, 0x94,
+ 0xc4, 0xfd, 0xb5, 0xd9, 0x00, 0x25, 0xc9, 0x78
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x11, 0x04, 0x72, 0xee, 0x0a, 0xe3, 0x28, 0xf5,
+ 0x7e, 0xf7, 0x33, 0x2a, 0x98, 0x86, 0xa1, 0x99,
+ 0x2d, 0x2c, 0x45, 0xb9, 0xb8, 0xd5, 0xab, 0xc9,
+ 0x42, 0x4f, 0xf6, 0x86, 0x30, 0xf7, 0xd3, 0x8d
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x18, 0xee, 0x4d, 0x00, 0x1a, 0x9d, 0x83, 0xa4,
+ 0xc6, 0x7e, 0x76, 0xf8, 0x8d, 0xd7, 0x47, 0x76,
+ 0x65, 0x76, 0xca, 0xc4, 0x38, 0x72, 0x3b, 0xad,
+ 0x07, 0x00, 0xa9, 0x10, 0xa4, 0xd7, 0x17, 0xe6
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x3c, 0x1f, 0xce, 0xb4, 0x77, 0xec, 0x95, 0x4c,
+ 0x8d, 0x58, 0xef, 0x32, 0x49, 0xe4, 0xbb, 0x4c,
+ 0x38, 0x24, 0x1b, 0x59, 0x25, 0xb9, 0x5f, 0x74,
+ 0x86, 0xe4, 0xd9, 0xf1, 0xd0, 0xd3, 0x5f, 0xbb
+ };
+
+ unsigned char ikmR[] = {
+ 0xab, 0xcc, 0x2d, 0xa5, 0xb3, 0xfa, 0x81, 0xd8,
+ 0xaa, 0xbd, 0x91, 0xf7, 0xf8, 0x00, 0xa8, 0xcc,
+ 0xf6, 0x0e, 0xc3, 0x7b, 0x1b, 0x58, 0x5a, 0x5d,
+ 0x1d, 0x1a, 0xc7, 0x7f, 0x25, 0x8b, 0x6c, 0xca
+ };
+
+ unsigned char ikmS[] = {
+ 0x62, 0x62, 0x03, 0x1f, 0x04, 0x0a, 0x9d, 0xb8,
+ 0x53, 0xed, 0xd6, 0xf9, 0x1d, 0x22, 0x72, 0x59,
+ 0x6e, 0xab, 0xbc, 0x78, 0xa2, 0xed, 0x2b, 0xd6,
+ 0x43, 0xf7, 0x70, 0xec, 0xd0, 0xf1, 0x9b, 0x82
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x6a, 0x1d, 0xe3, 0xfc, 0x26, 0xa3, 0xd4, 0x3f, 0x4e,
+ 0x4b, 0xa9, 0x7d, 0xbe, 0x24, 0xf7, 0xe9, 0x91, 0x81, 0x13,
+ 0x61, 0x29, 0xc4, 0x8f, 0xbe, 0x87, 0x2d, 0x47, 0x43, 0xe2,
+ 0xb1, 0x31, 0x35, 0x7e, 0xd4, 0xf2, 0x9a, 0x7b, 0x31, 0x7d,
+ 0xc2, 0x25, 0x09, 0xc7, 0xb0, 0x09, 0x91, 0xae, 0x99, 0x0b,
+ 0xf6, 0x5f, 0x8b, 0x23, 0x67, 0x00, 0xc8, 0x2a, 0xb7, 0xc1,
+ 0x1a, 0x84, 0x51, 0x14, 0x01
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a51(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x64, 0x69, 0xc4, 0x1c, 0x5c, 0x81, 0xd3, 0xaa, 0x85,
+ 0x43, 0x25, 0x31, 0xec, 0xf6, 0x46, 0x0e, 0xc9, 0x45,
+ 0xbd, 0xe1, 0xeb, 0x42, 0x8c, 0xb2, 0xfe, 0xdf, 0x7a,
+ 0x29, 0xf5, 0xa6, 0x85, 0xb4, 0xcc, 0xb0, 0xd0, 0x57,
+ 0xf0, 0x3e, 0xa2, 0x95, 0x2a, 0x27, 0xbb, 0x45, 0x8b
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xf1, 0x56, 0x41, 0x99, 0xf7, 0xe0, 0xe1, 0x10, 0xec,
+ 0x9c, 0x1b, 0xcd, 0xde, 0x33, 0x21, 0x77, 0xfc, 0x35,
+ 0xc1, 0xad, 0xf6, 0xe5, 0x7f, 0x8d, 0x1d, 0xf2, 0x40,
+ 0x22, 0x22, 0x7f, 0xfa, 0x87, 0x16, 0x86, 0x2d, 0xbd,
+ 0xa2, 0xb1, 0xdc, 0x54, 0x6c, 0x9d, 0x11, 0x43, 0x74
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x39, 0xde, 0x89, 0x72, 0x8b, 0xcb, 0x77, 0x42, 0x69,
+ 0xf8, 0x82, 0xaf, 0x8d, 0xc5, 0x36, 0x9e, 0x4f, 0x3d,
+ 0x63, 0x22, 0xd9, 0x86, 0xe8, 0x72, 0xb3, 0xa8, 0xd0,
+ 0x74, 0xc7, 0xc1, 0x8e, 0x85, 0x49, 0xff, 0x3f, 0x85,
+ 0xb6, 0xd6, 0x59, 0x2f, 0xf8, 0x7c, 0x3f, 0x31, 0x0c
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x9b, 0x13, 0xc5, 0x10, 0x41, 0x6a, 0xc9, 0x77,
+ 0xb5, 0x53, 0xbf, 0x17, 0x41, 0x01, 0x88, 0x09,
+ 0xc2, 0x46, 0xa6, 0x95, 0xf4, 0x5e, 0xff, 0x6d,
+ 0x3b, 0x03, 0x56, 0xdb, 0xef, 0xe1, 0xe6, 0x60
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x6c, 0x8b, 0x7b, 0xe3, 0xa2, 0x0a, 0x56, 0x84,
+ 0xed, 0xec, 0xb4, 0x25, 0x36, 0x19, 0xd9, 0x05,
+ 0x1c, 0xe8, 0x58, 0x3b, 0xaf, 0x85, 0x0e, 0x0c,
+ 0xb5, 0x3c, 0x40, 0x2b, 0xdc, 0xaf, 0x8e, 0xbb
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x47, 0x7a, 0x50, 0xd8, 0x04, 0xc7, 0xc5, 0x19,
+ 0x41, 0xf6, 0x9b, 0x8e, 0x32, 0xfe, 0x82, 0x88,
+ 0x38, 0x6e, 0xe1, 0xa8, 0x49, 0x05, 0xfe, 0x49,
+ 0x38, 0xd5, 0x89, 0x72, 0xf2, 0x4a, 0xc9, 0x38
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0xf1, 0xf1, 0xa3, 0xbc, 0x95, 0x41, 0x68, 0x71,
+ 0x53, 0x9e, 0xcb, 0x51, 0xc3, 0xa8, 0xf0, 0xcf,
+ 0x60, 0x8a, 0xfb, 0x40, 0xfb, 0xbe, 0x30, 0x5c,
+ 0x0a, 0x72, 0x81, 0x9d, 0x35, 0xc3, 0x3f, 0x1f
+ };
+
+ unsigned char ikmR[] = {
+ 0x61, 0x09, 0x2f, 0x3f, 0x56, 0x99, 0x4d, 0xd4,
+ 0x24, 0x40, 0x58, 0x99, 0x15, 0x4a, 0x99, 0x18,
+ 0x35, 0x3e, 0x3e, 0x00, 0x81, 0x71, 0x51, 0x7a,
+ 0xd5, 0x76, 0xb9, 0x00, 0xdd, 0xb2, 0x75, 0xe7
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0xc0, 0x78, 0x36, 0xa0, 0x20, 0x6e, 0x04, 0xe3, 0x1d,
+ 0x8a, 0xe9, 0x9b, 0xfd, 0x54, 0x93, 0x80, 0xb0, 0x72, 0xa1,
+ 0xb1, 0xb8, 0x2e, 0x56, 0x3c, 0x93, 0x5c, 0x09, 0x58, 0x27,
+ 0x82, 0x4f, 0xc1, 0x55, 0x9e, 0xac, 0x6f, 0xb9, 0xe3, 0xc7,
+ 0x0c, 0xd3, 0x19, 0x39, 0x68, 0x99, 0x4e, 0x7f, 0xe9, 0x78,
+ 0x1a, 0xa1, 0x03, 0xf5, 0xb5, 0x0e, 0x93, 0x4b, 0x5b, 0x2f,
+ 0x38, 0x7e, 0x38, 0x12, 0x91
+ };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a52(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x21, 0x43, 0x3e, 0xaf, 0xf2, 0x4d, 0x77, 0x06, 0xf3,
+ 0xed, 0x5b, 0x9b, 0x2e, 0x70, 0x9b, 0x07, 0x23, 0x0e,
+ 0x2b, 0x11, 0xdf, 0x1f, 0x2b, 0x1f, 0xe0, 0x7b, 0x3c,
+ 0x70, 0xd5, 0x94, 0x8a, 0x53, 0xd6, 0xfa, 0x5c, 0x8b,
+ 0xed, 0x19, 0x40, 0x20, 0xbd, 0x9d, 0xf0, 0x87, 0x7b
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xc7, 0x4a, 0x76, 0x4b, 0x48, 0x92, 0x07, 0x2e, 0xa8,
+ 0xc2, 0xc5, 0x6b, 0x9b, 0xcd, 0x46, 0xc7, 0xf1, 0xe9,
+ 0xca, 0x8c, 0xb0, 0xa2, 0x63, 0xf8, 0xb4, 0x0c, 0x2b,
+ 0xa5, 0x9a, 0xc9, 0xc8, 0x57, 0x03, 0x3f, 0x17, 0x60,
+ 0x19, 0x56, 0x22, 0x18, 0x76, 0x9d, 0x3e, 0x04, 0x52
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0xdc, 0x8c, 0xd6, 0x88, 0x63, 0x47, 0x4d, 0x6e, 0x9c,
+ 0xbb, 0x6a, 0x65, 0x93, 0x35, 0xa8, 0x6a, 0x54, 0xe0,
+ 0x36, 0x24, 0x9d, 0x41, 0xac, 0xf9, 0x09, 0xe7, 0x38,
+ 0xc8, 0x47, 0xff, 0x2b, 0xd3, 0x6f, 0xe3, 0xfc, 0xac,
+ 0xda, 0x4e, 0xde, 0xda, 0x70, 0x32, 0xc0, 0xa2, 0x20
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x53, 0x0b, 0xbc, 0x2f, 0x68, 0xf0, 0x78, 0xdc,
+ 0xcc, 0x89, 0xcc, 0x37, 0x1b, 0x4f, 0x4a, 0xde,
+ 0x37, 0x2c, 0x94, 0x72, 0xba, 0xfe, 0x46, 0x01,
+ 0xa8, 0x43, 0x2c, 0xbb, 0x93, 0x4f, 0x52, 0x8d
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x6e, 0x25, 0x07, 0x5d, 0xdc, 0xc5, 0x28, 0xc9,
+ 0x0e, 0xf9, 0x21, 0x8f, 0x80, 0x0c, 0xa3, 0xdf,
+ 0xe1, 0xb8, 0xff, 0x40, 0x42, 0xde, 0x50, 0x33,
+ 0x13, 0x3a, 0xdb, 0x8b, 0xd5, 0x4c, 0x40, 0x1d
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x6f, 0x6f, 0xbd, 0x0d, 0x1c, 0x77, 0x33, 0xf7,
+ 0x96, 0x46, 0x1b, 0x32, 0x35, 0xa8, 0x56, 0xcc,
+ 0x34, 0xf6, 0x76, 0xfe, 0x61, 0xed, 0x50, 0x9d,
+ 0xfc, 0x18, 0xfa, 0x16, 0xef, 0xe6, 0xbe, 0x78
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0xe1, 0xa4, 0xe1, 0xd5, 0x0c, 0x4b, 0xfc, 0xf8,
+ 0x90, 0xf2, 0xb4, 0xc7, 0xd6, 0xb2, 0xd2, 0xac,
+ 0xa6, 0x13, 0x68, 0xed, 0xdc, 0x3c, 0x84, 0x16,
+ 0x2d, 0xf2, 0x85, 0x68, 0x43, 0xe1, 0x05, 0x7a
+ };
+
+ unsigned char ikmR[] = {
+ 0xee, 0x51, 0xde, 0xc3, 0x04, 0xab, 0xf9, 0x93,
+ 0xef, 0x8f, 0xd5, 0x2a, 0xac, 0xdd, 0x3b, 0x53,
+ 0x91, 0x08, 0xbb, 0xf6, 0xe4, 0x91, 0x94, 0x32,
+ 0x66, 0xc1, 0xde, 0x89, 0xec, 0x59, 0x6a, 0x17
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0xf3, 0x36, 0x57, 0x8b, 0x72, 0xad, 0x79, 0x32, 0xfe,
+ 0x86, 0x7c, 0xc4, 0xd2, 0xd4, 0x4a, 0x71, 0x8a, 0x31, 0x80,
+ 0x37, 0xa0, 0xec, 0x27, 0x11, 0x63, 0x69, 0x9c, 0xee, 0x65,
+ 0x3f, 0xa8, 0x05, 0xc1, 0xfe, 0xc9, 0x55, 0xe5, 0x62, 0x66,
+ 0x3e, 0x0c, 0x20, 0x61, 0xbb, 0x96, 0xa8, 0x7d, 0x78, 0x89,
+ 0x2b, 0xff, 0x0c, 0xc0, 0xba, 0xd7, 0x90, 0x6c, 0x2d, 0x99,
+ 0x8e, 0xbe, 0x1a, 0x72, 0x46
+ };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a53(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x25, 0x88, 0x1f, 0x21, 0x99, 0x35, 0xee, 0xc5, 0xba,
+ 0x70, 0xd7, 0xb4, 0x21, 0xf1, 0x3c, 0x35, 0x00, 0x57,
+ 0x34, 0xf3, 0xe4, 0xd9, 0x59, 0x68, 0x02, 0x70, 0xf5,
+ 0x5d, 0x71, 0xe2, 0xf5, 0xcb, 0x3b, 0xd2, 0xda, 0xce,
+ 0xd2, 0x77, 0x0b, 0xf3, 0xd9, 0xd4, 0x91, 0x68, 0x72
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x65, 0x3f, 0x00, 0x36, 0xe5, 0x2a, 0x37, 0x6f, 0x5d,
+ 0x2d, 0xd8, 0x5b, 0x32, 0x04, 0xb5, 0x54, 0x55, 0xb7,
+ 0x83, 0x5c, 0x23, 0x12, 0x55, 0xae, 0x09, 0x8d, 0x09,
+ 0xed, 0x13, 0x87, 0x19, 0xb9, 0x71, 0x85, 0x12, 0x97,
+ 0x86, 0x33, 0x8a, 0xb6, 0x54, 0x3f, 0x75, 0x31, 0x93
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x60, 0x87, 0x87, 0x06, 0x11, 0x7f, 0x22, 0x18, 0x0c,
+ 0x78, 0x8e, 0x62, 0xdf, 0x6a, 0x59, 0x5b, 0xc4, 0x19,
+ 0x06, 0x09, 0x6a, 0x11, 0xa9, 0x51, 0x3e, 0x84, 0xf0,
+ 0x14, 0x1e, 0x43, 0x23, 0x9e, 0x81, 0xa9, 0x8d, 0x7a,
+ 0x23, 0x5a, 0xbc, 0x64, 0x11, 0x2f, 0xcb, 0x8d, 0xdd
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x56, 0xc4, 0xd6, 0xc1, 0xd3, 0xa4, 0x6c, 0x70,
+ 0xfd, 0x8f, 0x4e, 0xcd, 0xa5, 0xd2, 0x7c, 0x70,
+ 0x88, 0x6e, 0x34, 0x8e, 0xfb, 0x51, 0xbd, 0x5e,
+ 0xde, 0xaa, 0x39, 0xff, 0x6c, 0xe3, 0x43, 0x89
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0xd2, 0xd3, 0xe4, 0x8e, 0xd7, 0x68, 0x32, 0xb6,
+ 0xb3, 0xf2, 0x8f, 0xa8, 0x4b, 0xe5, 0xf1, 0x1f,
+ 0x09, 0x53, 0x3c, 0x0e, 0x3c, 0x71, 0x82, 0x5a,
+ 0x34, 0xfb, 0x0f, 0x13, 0x20, 0x89, 0x1b, 0x51
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xeb, 0x0d, 0x31, 0x2b, 0x62, 0x63, 0x99, 0x5b,
+ 0x4c, 0x77, 0x61, 0xe6, 0x4b, 0x68, 0x8c, 0x21,
+ 0x5f, 0xfd, 0x60, 0x43, 0xff, 0x3b, 0xad, 0x23,
+ 0x68, 0xc8, 0x62, 0x78, 0x4c, 0xbe, 0x6e, 0xff
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x0e, 0xcd, 0x21, 0x20, 0x19, 0x00, 0x81, 0x38,
+ 0xa3, 0x1f, 0x91, 0x04, 0xd5, 0xdb, 0xa7, 0x6b,
+ 0x9f, 0x8e, 0x34, 0xd5, 0xb9, 0x96, 0x04, 0x1f,
+ 0xff, 0x9e, 0x3d, 0xf2, 0x21, 0xdd, 0x0d, 0x5d
+ };
+
+ unsigned char ikmR[] = {
+ 0xd3, 0x22, 0x36, 0xd8, 0x37, 0x8b, 0x95, 0x63,
+ 0x84, 0x06, 0x53, 0x78, 0x9e, 0xb7, 0xbc, 0x33,
+ 0xc3, 0xc7, 0x20, 0xe5, 0x37, 0x39, 0x17, 0x27,
+ 0xbf, 0x1c, 0x81, 0x2d, 0x0e, 0xac, 0x11, 0x0f
+ };
+
+ unsigned char ikmS[] = {
+ 0x0e, 0x6b, 0xe0, 0x85, 0x12, 0x83, 0xf9, 0x32,
+ 0x72, 0x95, 0xfd, 0x49, 0x85, 0x8a, 0x8c, 0x89,
+ 0x08, 0xea, 0x97, 0x83, 0x21, 0x29, 0x45, 0xee,
+ 0xf6, 0xc5, 0x98, 0xee, 0x0a, 0x3c, 0xed, 0xbb
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x0d, 0x51, 0x76, 0xae, 0xdb, 0xa5, 0x5b, 0xc4, 0x17,
+ 0x09, 0x26, 0x1e, 0x91, 0x95, 0xc5, 0x14, 0x6b, 0xb6, 0x2d,
+ 0x78, 0x30, 0x31, 0x28, 0x07, 0x75, 0xf3, 0x2e, 0x50, 0x7d,
+ 0x79, 0xb5, 0xcb, 0xc5, 0x74, 0x8b, 0x6b, 0xe6, 0x35, 0x97,
+ 0x60, 0xc7, 0x3c, 0xfe, 0x10, 0xca, 0x19, 0x52, 0x1a, 0xf7,
+ 0x04, 0xca, 0x6d, 0x91, 0xff, 0x32, 0xfc, 0x07, 0x39, 0x52,
+ 0x7b, 0x93, 0x85, 0xd4, 0x15
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a54(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x9e, 0xad, 0xfa, 0x0f, 0x95, 0x48, 0x35, 0xe7, 0xe9,
+ 0x20, 0xff, 0xe5, 0x6d, 0xec, 0x6b, 0x31, 0xa0, 0x46,
+ 0x27, 0x1c, 0xf7, 0x1f, 0xdd, 0xa5, 0x5d, 0xb7, 0x29,
+ 0x26, 0xe1, 0xd8, 0xfa, 0xe9, 0x4c, 0xc6, 0x28, 0x0f,
+ 0xcf, 0xab, 0xd8, 0xdb, 0x71, 0xea, 0xa6, 0x5c, 0x05
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xe3, 0x57, 0xad, 0x10, 0xd7, 0x52, 0x40, 0x22, 0x4d,
+ 0x40, 0x95, 0xc9, 0xf6, 0x15, 0x0a, 0x2e, 0xd2, 0x17,
+ 0x9c, 0x0f, 0x87, 0x8e, 0x4f, 0x2d, 0xb8, 0xca, 0x95,
+ 0xd3, 0x65, 0xd1, 0x74, 0xd0, 0x59, 0xff, 0x8c, 0x3e,
+ 0xb3, 0x8e, 0xa9, 0xa6, 0x5c, 0xfc, 0x8e, 0xae, 0xb8
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x2f, 0xa5, 0x6d, 0x00, 0xf8, 0xdd, 0x47, 0x9d, 0x67,
+ 0xa2, 0xec, 0x33, 0x08, 0x32, 0x5c, 0xf3, 0xbb, 0xcc,
+ 0xaf, 0x10, 0x2a, 0x64, 0xff, 0xcc, 0xdb, 0x00, 0x6b,
+ 0xd7, 0xdc, 0xb9, 0x32, 0x68, 0x5b, 0x9a, 0x7b, 0x49,
+ 0xcd, 0xc0, 0x94, 0xa8, 0x5f, 0xec, 0x1d, 0xa5, 0xef
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0xc5, 0x2b, 0x45, 0x92, 0xcd, 0x33, 0xdd, 0x38,
+ 0xb2, 0xa3, 0x61, 0x31, 0x08, 0xdd, 0xda, 0x28,
+ 0xdc, 0xf7, 0xf0, 0x3d, 0x30, 0xf2, 0xa0, 0x97,
+ 0x03, 0xf7, 0x58, 0xbf, 0xa8, 0x02, 0x9c, 0x9a
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x2f, 0x03, 0xbe, 0xbc, 0x57, 0x7e, 0x57, 0x29,
+ 0xe1, 0x48, 0x55, 0x49, 0x91, 0x78, 0x72, 0x22,
+ 0xb5, 0xc2, 0xa0, 0x2b, 0x77, 0xe9, 0xb1, 0xac,
+ 0x38, 0x05, 0x41, 0xf7, 0x10, 0xe5, 0xa3, 0x18
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xe0, 0x1d, 0xd4, 0x9e, 0x8b, 0xfc, 0x3d, 0x92,
+ 0x16, 0xab, 0xc1, 0xbe, 0x83, 0x2f, 0x04, 0x18,
+ 0xad, 0xf8, 0xb4, 0x7a, 0x7b, 0x5a, 0x33, 0x0a,
+ 0x74, 0x36, 0xc3, 0x1e, 0x33, 0xd7, 0x65, 0xd7
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0xf3, 0xa0, 0x7f, 0x19, 0x47, 0x03, 0xe3, 0x21,
+ 0xef, 0x1f, 0x75, 0x3a, 0x1b, 0x9f, 0xe2, 0x7a,
+ 0x49, 0x8d, 0xfd, 0xfa, 0x30, 0x91, 0x51, 0xd7,
+ 0x0b, 0xed, 0xd8, 0x96, 0xc2, 0x39, 0xc4, 0x99
+ };
+
+ unsigned char ikmR[] = {
+ 0x12, 0x40, 0xe5, 0x5a, 0x0a, 0x03, 0x54, 0x8d,
+ 0x7f, 0x96, 0x3e, 0xf7, 0x83, 0xb6, 0xa7, 0x36,
+ 0x2c, 0xb5, 0x05, 0xe6, 0xb3, 0x1d, 0xfd, 0x04,
+ 0xc8, 0x1d, 0x9b, 0x29, 0x45, 0x43, 0xbf, 0xbd
+ };
+
+ unsigned char ikmS[] = {
+ 0xce, 0x2a, 0x03, 0x87, 0xa2, 0xeb, 0x88, 0x70,
+ 0xa3, 0xa9, 0x2c, 0x34, 0xa2, 0x97, 0x5f, 0x0f,
+ 0x3f, 0x27, 0x1a, 0xf4, 0x38, 0x4d, 0x44, 0x6c,
+ 0x7d, 0xc1, 0x52, 0x4a, 0x6c, 0x6c, 0x51, 0x5a
+ };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x35, 0x39, 0x91, 0x7e, 0xe2, 0x6f, 0x8a, 0xe0, 0xaa,
+ 0x5f, 0x78, 0x4a, 0x38, 0x79, 0x81, 0xb1, 0x3d, 0xe3, 0x31,
+ 0x24, 0xa3, 0xcd, 0xe8, 0x8b, 0x94, 0x67, 0x20, 0x30, 0x18,
+ 0x31, 0x10, 0xf3, 0x31, 0x40, 0x01, 0x15, 0x85, 0x58, 0x08,
+ 0x24, 0x4f, 0xf0, 0xc5, 0xb6, 0xca, 0x61, 0x04, 0x48, 0x3a,
+ 0xc9, 0x57, 0x24, 0x48, 0x1d, 0x41, 0xbd, 0xcd, 0x9f, 0x15,
+ 0xb4, 0x30, 0xad, 0x16, 0xf6
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P256,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a61(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x17, 0x0f, 0x8b, 0xed, 0xdf, 0xe9, 0x49, 0xb7, 0x5e,
+ 0xf9, 0xc3, 0x87, 0xe2, 0x01, 0xba, 0xf4, 0x13, 0x2f,
+ 0xa7, 0x37, 0x45, 0x93, 0xdf, 0xaf, 0xa9, 0x07, 0x68,
+ 0x78, 0x8b, 0x7b, 0x2b, 0x20, 0x0a, 0xaf, 0xcc, 0x6d,
+ 0x80, 0xea, 0x4c, 0x79, 0x5a, 0x7c, 0x5b, 0x84, 0x1a
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xd9, 0xee, 0x24, 0x8e, 0x22, 0x0c, 0xa2, 0x4a, 0xc0,
+ 0x0b, 0xbb, 0xe7, 0xe2, 0x21, 0xa8, 0x32, 0xe4, 0xf7,
+ 0xfa, 0x64, 0xc4, 0xfb, 0xab, 0x39, 0x45, 0xb6, 0xf3,
+ 0xaf, 0x0c, 0x5e, 0xcd, 0x5e, 0x16, 0x81, 0x5b, 0x32,
+ 0x8b, 0xe4, 0x95, 0x4a, 0x05, 0xfd, 0x35, 0x22, 0x56
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x14, 0x2c, 0xf1, 0xe0, 0x2d, 0x1f, 0x58, 0xd9, 0x28,
+ 0x5f, 0x2a, 0xf7, 0xdc, 0xfa, 0x44, 0xf7, 0xc3, 0xf2,
+ 0xd1, 0x5c, 0x73, 0xd4, 0x60, 0xc4, 0x8c, 0x6e, 0x0e,
+ 0x50, 0x6a, 0x31, 0x44, 0xba, 0xe3, 0x52, 0x84, 0xe7,
+ 0xe2, 0x21, 0x10, 0x5b, 0x61, 0xd2, 0x4e, 0x1c, 0x7a
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x05, 0xe2, 0xe5, 0xbd, 0x9f, 0x0c, 0x30, 0x83,
+ 0x2b, 0x80, 0xa2, 0x79, 0xff, 0x21, 0x1c, 0xc6,
+ 0x5e, 0xce, 0xb0, 0xd9, 0x70, 0x01, 0x52, 0x40,
+ 0x85, 0xd6, 0x09, 0xea, 0xd6, 0x0d, 0x04, 0x12
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0xfc, 0xa6, 0x97, 0x44, 0xbb, 0x53, 0x7f, 0x5b,
+ 0x7a, 0x15, 0x96, 0xdb, 0xf3, 0x4e, 0xaa, 0x8d,
+ 0x84, 0xbf, 0x2e, 0x3e, 0xe7, 0xf1, 0xa1, 0x55,
+ 0xd4, 0x1b, 0xd3, 0x62, 0x4a, 0xa9, 0x2b, 0x63
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xf3, 0x89, 0xbe, 0xaa, 0xc6, 0xfc, 0xf6, 0xc0,
+ 0xd9, 0x37, 0x6e, 0x20, 0xf9, 0x7e, 0x36, 0x4f,
+ 0x06, 0x09, 0xa8, 0x8f, 0x1b, 0xc7, 0x6d, 0x73,
+ 0x28, 0xe9, 0x10, 0x4d, 0xf8, 0x47, 0x70, 0x13
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = { 0x7f, 0x06, 0xab, 0x82, 0x15, 0x10, 0x5f, 0xc4,
+ 0x6a, 0xce, 0xeb, 0x2e, 0x3d, 0xc5, 0x02, 0x8b,
+ 0x44, 0x36, 0x4f, 0x96, 0x04, 0x26, 0xeb, 0x0d,
+ 0x8e, 0x40, 0x26, 0xc2, 0xf8, 0xb5, 0xd7, 0xe7,
+ 0xa9, 0x86, 0x68, 0x8f, 0x15, 0x91, 0xab, 0xf5,
+ 0xab, 0x75, 0x3c, 0x35, 0x7a, 0x5d, 0x6f, 0x04,
+ 0x40, 0x41, 0x4b, 0x4e, 0xd4, 0xed, 0xe7, 0x13,
+ 0x17, 0x77, 0x2a, 0xc9, 0x8d, 0x92, 0x39, 0xf7,
+ 0x09, 0x04 };
+
+ unsigned char ikmR[] = { 0x2a, 0xd9, 0x54, 0xbb, 0xe3, 0x9b, 0x71, 0x22,
+ 0x52, 0x9f, 0x7d, 0xde, 0x78, 0x0b, 0xff, 0x62,
+ 0x6c, 0xd9, 0x7f, 0x85, 0x0d, 0x07, 0x84, 0xa4,
+ 0x32, 0x78, 0x4e, 0x69, 0xd8, 0x6e, 0xcc, 0xaa,
+ 0xde, 0x43, 0xb6, 0xc1, 0x0a, 0x8f, 0xfd, 0xb9,
+ 0x4b, 0xf9, 0x43, 0xc6, 0xda, 0x47, 0x9d, 0xb1,
+ 0x37, 0x91, 0x4e, 0xc8, 0x35, 0xa7, 0xe7, 0x15,
+ 0xe3, 0x6e, 0x45, 0xe2, 0x9b, 0x58, 0x7b, 0xab,
+ 0x3b, 0xf1 };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x01, 0x38, 0xb3, 0x85, 0xca, 0x16, 0xbb, 0x0d, 0x5f,
+ 0xa0, 0xc0, 0x66, 0x5f, 0xbb, 0xd7, 0xe6, 0x9e, 0x3e, 0xe2,
+ 0x9f, 0x63, 0x99, 0x1d, 0x3e, 0x9b, 0x5f, 0xa7, 0x40, 0xaa,
+ 0xb8, 0x90, 0x0a, 0xae, 0xed, 0x46, 0xed, 0x73, 0xa4, 0x90,
+ 0x55, 0x75, 0x84, 0x25, 0xa0, 0xce, 0x36, 0x50, 0x7c, 0x54,
+ 0xb2, 0x9c, 0xc5, 0xb8, 0x5a, 0x5c, 0xee, 0x6b, 0xae, 0x0c,
+ 0xf1, 0xc2, 0x1f, 0x27, 0x31, 0xec, 0xe2, 0x01, 0x3d, 0xc3,
+ 0xfb, 0x7c, 0x8d, 0x21, 0x65, 0x4b, 0xb1, 0x61, 0xb4, 0x63,
+ 0x96, 0x2c, 0xa1, 0x9e, 0x8c, 0x65, 0x4f, 0xf2, 0x4c, 0x94,
+ 0xdd, 0x28, 0x98, 0xde, 0x12, 0x05, 0x1f, 0x1e, 0xd0, 0x69,
+ 0x22, 0x37, 0xfb, 0x02, 0xb2, 0xf8, 0xd1, 0xdc, 0x1c, 0x73,
+ 0xe9, 0xb3, 0x66, 0xb5, 0x29, 0xeb, 0x43, 0x6e, 0x98, 0xa9,
+ 0x96, 0xee, 0x52, 0x2a, 0xef, 0x86, 0x3d, 0xd5, 0x73, 0x9d,
+ 0x2f, 0x29, 0xb0
+ };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P521,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
+ .aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a62(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0xde, 0x69, 0xe9, 0xd9, 0x43, 0xa5, 0xd0, 0xb7, 0x0b,
+ 0xe3, 0x35, 0x9a, 0x19, 0xf3, 0x17, 0xbd, 0x9a, 0xca,
+ 0x4a, 0x2e, 0xbb, 0x43, 0x32, 0xa3, 0x9b, 0xcd, 0xfc,
+ 0x97, 0xd5, 0xfe, 0x62, 0xf3, 0xa7, 0x77, 0x02, 0xf4,
+ 0x82, 0x2c, 0x3b, 0xe5, 0x31, 0xaa, 0x78, 0x43, 0xa1
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x77, 0xa1, 0x61, 0x62, 0x83, 0x1f, 0x90, 0xde, 0x35,
+ 0x0f, 0xea, 0x91, 0x52, 0xcf, 0xc6, 0x85, 0xec, 0xfa,
+ 0x10, 0xac, 0xb4, 0xf7, 0x99, 0x4f, 0x41, 0xae, 0xd4,
+ 0x3f, 0xa5, 0x43, 0x1f, 0x23, 0x82, 0xd0, 0x78, 0xec,
+ 0x88, 0xba, 0xec, 0x53, 0x94, 0x39, 0x84, 0x55, 0x3e
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0xf1, 0xd4, 0x8d, 0x09, 0xf1, 0x26, 0xb9, 0x00, 0x3b,
+ 0x4c, 0x7d, 0x3f, 0xe6, 0x77, 0x9c, 0x7c, 0x92, 0x17,
+ 0x31, 0x88, 0xa2, 0xbb, 0x74, 0x65, 0xba, 0x43, 0xd8,
+ 0x99, 0xa6, 0x39, 0x8a, 0x33, 0x39, 0x14, 0xd2, 0xbb,
+ 0x19, 0xfd, 0x76, 0x9d, 0x53, 0xf3, 0xec, 0x73, 0x36
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x62, 0x69, 0x1f, 0x0f, 0x97, 0x1e, 0x34, 0xde,
+ 0x38, 0x37, 0x0b, 0xff, 0x24, 0xde, 0xb5, 0xa7,
+ 0xd4, 0x0a, 0xb6, 0x28, 0x09, 0x3d, 0x30, 0x4b,
+ 0xe6, 0x09, 0x46, 0xaf, 0xcd, 0xb3, 0xa9, 0x36
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x76, 0x08, 0x3c, 0x6d, 0x1b, 0x68, 0x09, 0xda,
+ 0x08, 0x85, 0x84, 0x67, 0x43, 0x27, 0xb3, 0x94,
+ 0x88, 0xea, 0xf6, 0x65, 0xf0, 0x73, 0x11, 0x51,
+ 0x12, 0x84, 0x52, 0xe0, 0x4c, 0xe8, 0x1b, 0xff
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x0c, 0x7c, 0xfc, 0x09, 0x76, 0xe2, 0x5a, 0xe7,
+ 0x68, 0x0c, 0xf9, 0x09, 0xae, 0x2d, 0xe1, 0x85,
+ 0x9c, 0xd9, 0xb6, 0x79, 0x61, 0x0a, 0x14, 0xbe,
+ 0xc4, 0x0d, 0x69, 0xb9, 0x17, 0x85, 0xb2, 0xf6
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = { 0xf3, 0xeb, 0xfa, 0x9a, 0x69, 0xa9, 0x24, 0xe6,
+ 0x72, 0x11, 0x4f, 0xcd, 0x9e, 0x06, 0xfa, 0x95,
+ 0x59, 0xe9, 0x37, 0xf7, 0xec, 0xcc, 0xe4, 0x18,
+ 0x1a, 0x2b, 0x50, 0x6d, 0xf5, 0x3d, 0xbe, 0x51,
+ 0x4b, 0xe1, 0x2f, 0x09, 0x4b, 0xb2, 0x8e, 0x01,
+ 0xde, 0x19, 0xdd, 0x34, 0x5b, 0x4f, 0x7e, 0xde,
+ 0x5a, 0xd7, 0xea, 0xa6, 0xb9, 0xc3, 0x01, 0x95,
+ 0x92, 0xec, 0x68, 0xea, 0xae, 0x9a, 0x14, 0x73,
+ 0x2c, 0xe0 };
+
+ unsigned char ikmR[] = { 0xa2, 0xa2, 0x45, 0x87, 0x05, 0xe2, 0x78, 0xe5,
+ 0x74, 0xf8, 0x35, 0xef, 0xfe, 0xcd, 0x18, 0x23,
+ 0x2f, 0x8a, 0x4c, 0x45, 0x9e, 0x75, 0x50, 0xa0,
+ 0x9d, 0x44, 0x34, 0x8a, 0xe5, 0xd3, 0xb1, 0xea,
+ 0x9d, 0x95, 0xc5, 0x19, 0x95, 0xe6, 0x57, 0xad,
+ 0x6f, 0x7c, 0xae, 0x65, 0x9f, 0x5e, 0x18, 0x61,
+ 0x26, 0xa4, 0x71, 0xc0, 0x17, 0xf8, 0xf5, 0xe4,
+ 0x1d, 0xa9, 0xeb, 0xa7, 0x4d, 0x4e, 0x04, 0x73,
+ 0xe1, 0x79 };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x00, 0x85, 0xef, 0xf0, 0x83, 0x5c, 0xc8, 0x43, 0x51,
+ 0xf3, 0x24, 0x71, 0xd3, 0x2a, 0xa4, 0x53, 0xcd, 0xc1, 0xf6,
+ 0x41, 0x8e, 0xaa, 0xec, 0xf1, 0xc2, 0x82, 0x42, 0x10, 0xeb,
+ 0x1d, 0x48, 0xd0, 0x76, 0x8b, 0x36, 0x81, 0x10, 0xfa, 0xb2,
+ 0x14, 0x07, 0xc3, 0x24, 0xb8, 0xbb, 0x4b, 0xec, 0x63, 0xf0,
+ 0x42, 0xcf, 0xa4, 0xd0, 0x86, 0x8d, 0x19, 0xb7, 0x60, 0xeb,
+ 0x4b, 0xeb, 0xa1, 0xbf, 0xf7, 0x93, 0xb3, 0x00, 0x36, 0xd2,
+ 0xc6, 0x14, 0xd5, 0x57, 0x30, 0xbd, 0x2a, 0x40, 0xc7, 0x18,
+ 0xf9, 0x46, 0x6f, 0xaf, 0x4d, 0x5f, 0x81, 0x70, 0xd2, 0x2b,
+ 0x6d, 0xf9, 0x8d, 0xfe, 0x0c, 0x06, 0x7d, 0x02, 0xb3, 0x49,
+ 0xae, 0x4a, 0x14, 0x2e, 0x0c, 0x03, 0x41, 0x8f, 0x0a, 0x14,
+ 0x79, 0xff, 0x78, 0xa3, 0xdb, 0x07, 0xae, 0x2c, 0x2e, 0x89,
+ 0xe5, 0x84, 0x0f, 0x71, 0x2c, 0x17, 0x4b, 0xa2, 0x11, 0x8e,
+ 0x90, 0xfd, 0xcb
+ };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P521,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
+ .aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a63(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x01, 0x16, 0xae, 0xb3, 0xa1, 0xc4, 0x05, 0xc6, 0x1b,
+ 0x1c, 0xe4, 0x76, 0x00, 0xb7, 0xec, 0xd1, 0x1d, 0x89,
+ 0xb9, 0xc0, 0x8c, 0x40, 0x8b, 0x7e, 0x2d, 0x1e, 0x00,
+ 0xa4, 0xd6, 0x46, 0x96, 0xd1, 0x2e, 0x68, 0x81, 0xdc,
+ 0x61, 0x68, 0x82, 0x09, 0xa8, 0x20, 0x74, 0x27, 0xf9
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0x37, 0xec, 0xe0, 0xcf, 0x67, 0x41, 0xf4, 0x43, 0xe9,
+ 0xd7, 0x3b, 0x99, 0x66, 0xdc, 0x0b, 0x22, 0x84, 0x99,
+ 0xbb, 0x21, 0xfb, 0xf3, 0x13, 0x94, 0x83, 0x27, 0x23,
+ 0x1e, 0x70, 0xa1, 0x83, 0x80, 0xe0, 0x80, 0x52, 0x9c,
+ 0x02, 0x67, 0xf3, 0x99, 0xba, 0x7c, 0x53, 0x9c, 0xc6
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0xd1, 0x7b, 0x04, 0x5c, 0xac, 0x96, 0x3e, 0x45, 0xd5,
+ 0x5f, 0xd3, 0x69, 0x2e, 0xc1, 0x7f, 0x10, 0x0d, 0xf6,
+ 0x6a, 0xc0, 0x6d, 0x91, 0xf3, 0xb6, 0xaf, 0x8e, 0xfa,
+ 0x7e, 0xd3, 0xc8, 0x89, 0x55, 0x50, 0xeb, 0x75, 0x3b,
+ 0xc8, 0x01, 0xfe, 0x4b, 0xd2, 0x70, 0x05, 0xb4, 0xbd
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0x8d, 0x78, 0x74, 0x8d, 0x63, 0x2f, 0x95, 0xb8,
+ 0xce, 0x0c, 0x67, 0xd7, 0x0f, 0x4a, 0xd1, 0x75,
+ 0x7e, 0x61, 0xe8, 0x72, 0xb5, 0x94, 0x1e, 0x14,
+ 0x69, 0x86, 0x80, 0x4b, 0x39, 0x90, 0x15, 0x4b
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x80, 0xa4, 0x75, 0x32, 0x30, 0x90, 0x0e, 0xa7,
+ 0x85, 0xb6, 0xc8, 0x07, 0x75, 0x09, 0x28, 0x01,
+ 0xfe, 0x91, 0x18, 0x37, 0x46, 0x47, 0x9f, 0x9b,
+ 0x04, 0xc3, 0x05, 0xe1, 0xdb, 0x9d, 0x1f, 0x4d
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x62, 0x0b, 0x17, 0x6d, 0x73, 0x7c, 0xf3, 0x66,
+ 0xbc, 0xc2, 0x0d, 0x96, 0xad, 0xb5, 0x4e, 0xc1,
+ 0x56, 0x97, 0x82, 0x20, 0x87, 0x9b, 0x67, 0x92,
+ 0x36, 0x89, 0xe6, 0xdc, 0xa3, 0x62, 0x10, 0xed
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = { 0xfe, 0x1c, 0x58, 0x9c, 0x2a, 0x05, 0x89, 0x38,
+ 0x95, 0xa5, 0x37, 0xf3, 0x8c, 0x7c, 0xb4, 0x30,
+ 0x0b, 0x5a, 0x7e, 0x8f, 0xef, 0x3d, 0x6c, 0xcb,
+ 0x8f, 0x07, 0xa4, 0x98, 0x02, 0x9c, 0x61, 0xe9,
+ 0x02, 0x62, 0xe0, 0x09, 0xdc, 0x25, 0x4c, 0x7f,
+ 0x62, 0x35, 0xf9, 0xc6, 0xb2, 0xfd, 0x6a, 0xef,
+ 0xf0, 0xa7, 0x14, 0xdb, 0x13, 0x1b, 0x09, 0x25,
+ 0x8c, 0x16, 0xe2, 0x17, 0xb7, 0xbd, 0x2a, 0xa6,
+ 0x19, 0xb0 };
+
+ unsigned char ikmR[] = { 0x8f, 0xee, 0xa0, 0x43, 0x84, 0x81, 0xfc, 0x0e,
+ 0xcd, 0x47, 0x0d, 0x6a, 0xdf, 0xcd, 0xa3, 0x34,
+ 0xa7, 0x59, 0xc6, 0xb8, 0x65, 0x04, 0x52, 0xc5,
+ 0xa5, 0xdd, 0x9b, 0x2d, 0xd2, 0xcc, 0x9b, 0xe3,
+ 0x3d, 0x2b, 0xb7, 0xee, 0x64, 0x60, 0x5f, 0xc0,
+ 0x7a, 0xb4, 0x66, 0x4a, 0x58, 0xbb, 0x9a, 0x8d,
+ 0xe8, 0x0d, 0xef, 0xe5, 0x10, 0xb6, 0xc9, 0x7d,
+ 0x2d, 0xaf, 0x85, 0xb9, 0x2c, 0xd4, 0xbb, 0x0a,
+ 0x66, 0xbf };
+
+ unsigned char ikmS[] = { 0x2f, 0x66, 0xa6, 0x8b, 0x85, 0xef, 0x04, 0x82,
+ 0x2b, 0x05, 0x4e, 0xf5, 0x21, 0x83, 0x8c, 0x00,
+ 0xc6, 0x4f, 0x8b, 0x62, 0x26, 0x93, 0x55, 0x93,
+ 0xb6, 0x9e, 0x13, 0xa1, 0xa2, 0x46, 0x1a, 0x4f,
+ 0x1a, 0x74, 0xc1, 0x0c, 0x83, 0x6e, 0x87, 0xee,
+ 0xd1, 0x50, 0xc0, 0xdb, 0x85, 0xd4, 0xe4, 0xf5,
+ 0x06, 0xcb, 0xb7, 0x46, 0x14, 0x9b, 0xef, 0xac,
+ 0x6f, 0x5c, 0x07, 0xdc, 0x48, 0xa6, 0x15, 0xef,
+ 0x92, 0xdb };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x01, 0x7d, 0xe1, 0x2e, 0xde, 0x7f, 0x72, 0xcb, 0x10,
+ 0x1d, 0xab, 0x36, 0xa1, 0x11, 0x26, 0x5c, 0x97, 0xb3, 0x65,
+ 0x48, 0x16, 0xdc, 0xd6, 0x18, 0x3f, 0x80, 0x9d, 0x4b, 0x3d,
+ 0x11, 0x1f, 0xe7, 0x59, 0x49, 0x7f, 0x8a, 0xef, 0xdc, 0x5d,
+ 0xbb, 0x40, 0xd3, 0xe6, 0xd2, 0x1d, 0xb1, 0x5b, 0xdc, 0x60,
+ 0xf1, 0x5f, 0x2a, 0x42, 0x07, 0x61, 0xbc, 0xae, 0xef, 0x73,
+ 0xb8, 0x91, 0xc2, 0xb1, 0x17, 0xe9, 0xcf, 0x01, 0xe2, 0x93,
+ 0x20, 0xb7, 0x99, 0xbb, 0xc8, 0x6a, 0xfd, 0xc5, 0xea, 0x97,
+ 0xd9, 0x41, 0xea, 0x1c, 0x5b, 0xd5, 0xeb, 0xee, 0xac, 0x7a,
+ 0x78, 0x4b, 0x3b, 0xab, 0x52, 0x47, 0x46, 0xf3, 0xe6, 0x40,
+ 0xec, 0x26, 0xee, 0x1b, 0xd9, 0x12, 0x55, 0xf9, 0x33, 0x0d,
+ 0x97, 0x4f, 0x84, 0x50, 0x84, 0x63, 0x7e, 0xe0, 0xe6, 0xfe,
+ 0x9f, 0x50, 0x5c, 0x5b, 0x87, 0xc8, 0x6a, 0x4e, 0x1a, 0x6c,
+ 0x30, 0x96, 0xdd
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P521,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
+ .aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a64(void)
+{
+ unsigned char seq0_ciphertext[] = {
+ 0x94, 0x2a, 0x2a, 0x92, 0xe0, 0x81, 0x7c, 0xf0, 0x32,
+ 0xce, 0x61, 0xab, 0xcc, 0xf4, 0xf3, 0xa7, 0xc5, 0xd2,
+ 0x1b, 0x79, 0x4e, 0xd9, 0x43, 0x22, 0x7e, 0x07, 0xb7,
+ 0xdf, 0x2d, 0x6d, 0xd9, 0x2c, 0x9b, 0x8a, 0x93, 0x71,
+ 0x94, 0x9e, 0x65, 0xcc, 0xa2, 0x62, 0x44, 0x8a, 0xb7
+ };
+
+ unsigned char seq1_ciphertext[] = {
+ 0xc0, 0xa8, 0x3b, 0x5e, 0xc3, 0xd7, 0x93, 0x3a, 0x09,
+ 0x0f, 0x68, 0x17, 0x17, 0x29, 0x03, 0x37, 0xb4, 0xfe,
+ 0xde, 0x5b, 0xfa, 0xa0, 0xa4, 0x0e, 0xc2, 0x9f, 0x93,
+ 0xac, 0xad, 0x74, 0x28, 0x88, 0xa1, 0x51, 0x3c, 0x64,
+ 0x91, 0x04, 0xc3, 0x91, 0xc7, 0x8d, 0x1d, 0x7f, 0x29
+ };
+
+ unsigned char seq2_ciphertext[] = {
+ 0x28, 0x47, 0xb2, 0xe0, 0xce, 0x0b, 0x9d, 0xa8, 0xfc,
+ 0xa7, 0xb0, 0xe8, 0x1f, 0xf3, 0x89, 0xd1, 0x68, 0x2e,
+ 0xe1, 0xb3, 0x88, 0xed, 0x09, 0x57, 0x9b, 0x14, 0x50,
+ 0x58, 0xb5, 0xaf, 0x6a, 0x93, 0xa8, 0x5d, 0xd5, 0x0d,
+ 0x9f, 0x41, 0x7d, 0xc8, 0x8f, 0x2c, 0x78, 0x53, 0x12
+ };
+
+ hpke_test_encryption_parameters_st enc_params[] = {
+ { .sequence_number = 0,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq0_aad, sizeof(seq0_aad) },
+ .expected_ciphertext = { seq0_ciphertext,
+ sizeof(seq0_ciphertext) } },
+ { .sequence_number = 1,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq1_aad, sizeof(seq1_aad) },
+ .expected_ciphertext = { seq1_ciphertext,
+ sizeof(seq1_ciphertext) } },
+ { .sequence_number = 2,
+ .plaintext = { plaintext, sizeof(plaintext) },
+ .aad = { seq2_aad, sizeof(seq2_aad) },
+ .expected_ciphertext = { seq2_ciphertext,
+ sizeof(seq2_ciphertext) } }
+ };
+
+ unsigned char expected_exporter_value1[] = {
+ 0xa3, 0x95, 0x02, 0xef, 0x5c, 0xa1, 0x16, 0xaa,
+ 0x13, 0x17, 0xbd, 0x95, 0x83, 0xdd, 0x52, 0xf1,
+ 0x5b, 0x05, 0x02, 0xb7, 0x1d, 0x90, 0x0f, 0xc8,
+ 0xa6, 0x22, 0xd1, 0x96, 0x23, 0xd0, 0xcb, 0x5d
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x74, 0x9e, 0xda, 0x11, 0x2c, 0x4c, 0xfd, 0xd6,
+ 0x67, 0x1d, 0x84, 0x59, 0x5f, 0x12, 0xcd, 0x13,
+ 0x19, 0x8f, 0xc3, 0xef, 0x93, 0xed, 0x72, 0x36,
+ 0x91, 0x78, 0xf3, 0x44, 0xfe, 0x6e, 0x09, 0xc3
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xf8, 0xb4, 0xe7, 0x2c, 0xef, 0xbf, 0xf4, 0xca,
+ 0x6c, 0x4e, 0xab, 0xb8, 0xc0, 0x38, 0x32, 0x87,
+ 0x08, 0x2c, 0xfc, 0xbb, 0x95, 0x3d, 0x90, 0x0a,
+ 0xed, 0x49, 0x59, 0xaf, 0xd0, 0x01, 0x70, 0x95
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = { 0x54, 0x27, 0x27, 0x97, 0xb1, 0xfb, 0xc1, 0x28,
+ 0xa6, 0x96, 0x7f, 0xf1, 0xfd, 0x60, 0x6e, 0x0c,
+ 0x67, 0x86, 0x8f, 0x77, 0x62, 0xce, 0x14, 0x21,
+ 0x43, 0x9c, 0xbc, 0x9e, 0x90, 0xce, 0x1b, 0x28,
+ 0xd5, 0x66, 0xe6, 0xc2, 0xac, 0xbc, 0xe7, 0x12,
+ 0xe4, 0x8e, 0xeb, 0xf2, 0x36, 0x69, 0x6e, 0xb6,
+ 0x80, 0x84, 0x9d, 0x68, 0x73, 0xe9, 0x95, 0x93,
+ 0x95, 0xb2, 0x93, 0x19, 0x75, 0xd6, 0x1d, 0x38,
+ 0xbd, 0x6c };
+
+ unsigned char ikmR[] = { 0x3d, 0xb4, 0x34, 0xa8, 0xbc, 0x25, 0xb2, 0x7e,
+ 0xb0, 0xc5, 0x90, 0xdc, 0x64, 0x99, 0x7a, 0xb1,
+ 0x37, 0x8a, 0x99, 0xf5, 0x2b, 0x2c, 0xb5, 0xa5,
+ 0xa5, 0xb2, 0xfa, 0x54, 0x08, 0x88, 0xf6, 0xc0,
+ 0xf0, 0x97, 0x94, 0xc6, 0x54, 0xf4, 0x46, 0x85,
+ 0x24, 0xe0, 0x40, 0xe6, 0xb4, 0xec, 0xa2, 0xc9,
+ 0xdc, 0xf2, 0x29, 0xf9, 0x08, 0xb9, 0xd3, 0x18,
+ 0xf9, 0x60, 0xcc, 0x9e, 0x9b, 0xaa, 0x92, 0xc5,
+ 0xee, 0xe6 };
+
+ unsigned char ikmS[] = { 0x65, 0xd5, 0x23, 0xd9, 0xb3, 0x7e, 0x12, 0x73,
+ 0xeb, 0x25, 0xad, 0x05, 0x27, 0xd3, 0xa7, 0xbd,
+ 0x33, 0xf6, 0x72, 0x08, 0xdd, 0x16, 0x66, 0xd9,
+ 0x90, 0x4c, 0x6b, 0xc0, 0x49, 0x69, 0xae, 0x58,
+ 0x31, 0xa8, 0xb8, 0x49, 0xe7, 0xff, 0x64, 0x25,
+ 0x81, 0xf2, 0xc3, 0xe5, 0x6b, 0xe8, 0x46, 0x09,
+ 0x60, 0x0d, 0x3c, 0x6b, 0xbd, 0xad, 0xed, 0x3f,
+ 0x69, 0x89, 0xc3, 0x7d, 0x28, 0x92, 0xb1, 0xe9,
+ 0x78, 0xd5 };
+
+ unsigned char expected_enc[] = {
+ 0x04, 0x00, 0x0a, 0x50, 0x96, 0xa6, 0xe6, 0xe0, 0x02, 0xc8,
+ 0x35, 0x17, 0xb4, 0x94, 0xbf, 0xc2, 0xe3, 0x6b, 0xfb, 0x86,
+ 0x32, 0xfa, 0xe8, 0x06, 0x83, 0x62, 0x85, 0x2b, 0x70, 0xd0,
+ 0xff, 0x71, 0xe5, 0x60, 0xb1, 0x5a, 0xff, 0x96, 0x74, 0x1e,
+ 0xcf, 0xfb, 0x63, 0xd8, 0xac, 0x30, 0x90, 0xc3, 0x76, 0x96,
+ 0x79, 0x00, 0x9a, 0xc5, 0x9a, 0x99, 0xa1, 0xfe, 0xb4, 0x71,
+ 0x3c, 0x5f, 0x09, 0x0f, 0xc0, 0xdb, 0xed, 0x01, 0xad, 0x73,
+ 0xc4, 0x5d, 0x29, 0xd3, 0x69, 0xe3, 0x67, 0x44, 0xe9, 0xed,
+ 0x37, 0xd1, 0x2f, 0x80, 0x70, 0x0c, 0x16, 0xd8, 0x16, 0x48,
+ 0x56, 0x55, 0x16, 0x9a, 0x5d, 0xd6, 0x6e, 0x4d, 0xdf, 0x27,
+ 0xf2, 0xac, 0xff, 0xe0, 0xf5, 0x6f, 0x7f, 0x77, 0xea, 0x2b,
+ 0x47, 0x3b, 0x4b, 0xf0, 0x51, 0x8b, 0x97, 0x5d, 0x95, 0x27,
+ 0x00, 0x9a, 0x3d, 0x14, 0xe5, 0xa4, 0x95, 0x7e, 0x3e, 0x8a,
+ 0x90, 0x74, 0xf8
+ };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_P521,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
+ .aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = enc_params,
+ .num_encryption_parameters =
+ sizeof(enc_params) / sizeof(enc_params[0]),
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a71(void)
+{
+ unsigned char expected_exporter_value1[] = {
+ 0x7a, 0x36, 0x22, 0x1b, 0xd5, 0x6d, 0x50, 0xfb,
+ 0x51, 0xee, 0x65, 0xed, 0xfd, 0x98, 0xd0, 0x6a,
+ 0x23, 0xc4, 0xdc, 0x87, 0x08, 0x5a, 0xa5, 0x86,
+ 0x6c, 0xb7, 0x08, 0x72, 0x44, 0xbd, 0x2a, 0x36
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0xd5, 0x53, 0x5b, 0x87, 0x09, 0x9c, 0x6c, 0x3c,
+ 0xe8, 0x0d, 0xc1, 0x12, 0xa2, 0x67, 0x1c, 0x6e,
+ 0xc8, 0xe8, 0x11, 0xa2, 0xf2, 0x84, 0xf9, 0x48,
+ 0xce, 0xc6, 0xdd, 0x17, 0x08, 0xee, 0x33, 0xf0
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xff, 0xaa, 0xbc, 0x85, 0xa7, 0x76, 0x13, 0x6c,
+ 0xa0, 0xc3, 0x78, 0xe5, 0xd0, 0x84, 0xc9, 0x14,
+ 0x0a, 0xb5, 0x52, 0xb7, 0x8f, 0x03, 0x9d, 0x2e,
+ 0x87, 0x75, 0xf2, 0x6e, 0xff, 0xf4, 0xc7, 0x0e
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x55, 0xbc, 0x24, 0x5e, 0xe4, 0xef, 0xda, 0x25,
+ 0xd3, 0x8f, 0x2d, 0x54, 0xd5, 0xbb, 0x66, 0x65,
+ 0x29, 0x1b, 0x99, 0xf8, 0x10, 0x8a, 0x8c, 0x4b,
+ 0x68, 0x6c, 0x2b, 0x14, 0x89, 0x3e, 0xa5, 0xd9
+ };
+
+ unsigned char ikmR[] = {
+ 0x68, 0x3a, 0xe0, 0xda, 0x1d, 0x22, 0x18, 0x1e,
+ 0x74, 0xed, 0x2e, 0x50, 0x3e, 0xbf, 0x82, 0x84,
+ 0x0d, 0xeb, 0x1d, 0x5e, 0x87, 0x2c, 0xad, 0xe2,
+ 0x0f, 0x4b, 0x45, 0x8d, 0x99, 0x78, 0x3e, 0x31
+ };
+
+ unsigned char expected_enc[] = { 0xe5, 0xe8, 0xf9, 0xbf, 0xff, 0x6c,
+ 0x2f, 0x29, 0x79, 0x1f, 0xc3, 0x51,
+ 0xd2, 0xc2, 0x5c, 0xe1, 0x29, 0x9a,
+ 0xa5, 0xea, 0xca, 0x78, 0xa7, 0x57,
+ 0xc0, 0xb4, 0xfb, 0x4b, 0xcd, 0x83,
+ 0x09, 0x18 };
+
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_BASE,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = NULL,
+ .num_encryption_parameters = 0,
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a72(void)
+{
+ unsigned char expected_exporter_value1[] = {
+ 0xbe, 0x6c, 0x76, 0x95, 0x53, 0x34, 0x37, 0x6a,
+ 0xa2, 0x3e, 0x93, 0x6b, 0xe0, 0x13, 0xba, 0x8b,
+ 0xba, 0xe9, 0x0a, 0xe7, 0x4e, 0xd9, 0x95, 0xc1,
+ 0xc6, 0x15, 0x7e, 0x6f, 0x08, 0xdd, 0x53, 0x16
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x17, 0x21, 0xed, 0x2a, 0xa8, 0x52, 0xf8, 0x4d,
+ 0x44, 0xad, 0x02, 0x0c, 0x2e, 0x2b, 0xe4, 0xe2,
+ 0xe6, 0x37, 0x50, 0x98, 0xbf, 0x48, 0x77, 0x5a,
+ 0x53, 0x35, 0x05, 0xfd, 0x56, 0xa3, 0xf4, 0x16
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x7c, 0x9d, 0x79, 0x87, 0x6a, 0x28, 0x85, 0x07,
+ 0xb8, 0x1a, 0x5a, 0x52, 0x36, 0x5a, 0x7d, 0x39,
+ 0xcc, 0x0f, 0xa3, 0xf0, 0x7e, 0x34, 0x17, 0x29,
+ 0x84, 0xf9, 0x6f, 0xec, 0x07, 0xc4, 0x4c, 0xba
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0xc5, 0x12, 0x11, 0xa8, 0x79, 0x9f, 0x6b, 0x8a,
+ 0x00, 0x21, 0xfc, 0xba, 0x67, 0x3d, 0x9c, 0x40,
+ 0x67, 0xa9, 0x8e, 0xbc, 0x67, 0x94, 0x23, 0x2e,
+ 0x5b, 0x06, 0xcb, 0x9f, 0xeb, 0xcb, 0xbd, 0xf5
+ };
+
+ unsigned char ikmR[] = {
+ 0x5e, 0x05, 0x16, 0xb1, 0xb2, 0x9c, 0x0e, 0x13,
+ 0x38, 0x65, 0x29, 0xda, 0x16, 0x52, 0x52, 0x10,
+ 0xc7, 0x96, 0xf7, 0xd6, 0x47, 0xc3, 0x7e, 0xac,
+ 0x11, 0x80, 0x23, 0xa6, 0xaa, 0x9e, 0xb8, 0x9a
+ };
+
+ unsigned char expected_enc[] = { 0xd3, 0x80, 0x5a, 0x97, 0xcb, 0xcd,
+ 0x5f, 0x08, 0xba, 0xbd, 0x21, 0x22,
+ 0x1d, 0x3e, 0x6b, 0x36, 0x2a, 0x70,
+ 0x05, 0x72, 0xd1, 0x4f, 0x9b, 0xbe,
+ 0xb9, 0x4e, 0xc0, 0x78, 0xd0, 0x51,
+ 0xae, 0x3d };
+
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = NULL,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = NULL,
+ .num_encryption_parameters = 0,
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a73(void)
+{
+ unsigned char expected_exporter_value1[] = {
+ 0x83, 0xc1, 0xba, 0xc0, 0x0a, 0x45, 0xed, 0x4c,
+ 0xb6, 0xbd, 0x8a, 0x60, 0x07, 0xd2, 0xce, 0x4e,
+ 0xc5, 0x01, 0xf5, 0x5e, 0x48, 0x5c, 0x56, 0x42,
+ 0xbd, 0x01, 0xbf, 0x6b, 0x6d, 0x7d, 0x6f, 0x0a
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x08, 0xa1, 0xd1, 0xad, 0x2a, 0xf3, 0xef, 0x5b,
+ 0xc4, 0x02, 0x32, 0xa6, 0x4f, 0x92, 0x06, 0x50,
+ 0xeb, 0x9b, 0x10, 0x34, 0xfa, 0xc3, 0x89, 0x2f,
+ 0x72, 0x9f, 0x79, 0x49, 0x62, 0x1b, 0xf0, 0x6e
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0xff, 0x3b, 0x0e, 0x37, 0xa9, 0x95, 0x42, 0x47,
+ 0xfe, 0xa5, 0x3f, 0x25, 0x1b, 0x79, 0x9e, 0x2e,
+ 0xdd, 0x35, 0xaa, 0xc7, 0x15, 0x2c, 0x57, 0x95,
+ 0x75, 0x1a, 0x3d, 0xa4, 0x24, 0xfe, 0xca, 0x73
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x43, 0xb0, 0x78, 0x91, 0x2a, 0x54, 0xb5, 0x91,
+ 0xa7, 0xb0, 0x9b, 0x16, 0xce, 0x89, 0xa1, 0x95,
+ 0x5a, 0x9d, 0xd6, 0x0b, 0x29, 0xfb, 0x61, 0x1e,
+ 0x04, 0x42, 0x60, 0x04, 0x6e, 0x8b, 0x06, 0x1b
+ };
+
+ unsigned char ikmR[] = {
+ 0xfc, 0x94, 0x07, 0xae, 0x72, 0xed, 0x61, 0x49,
+ 0x01, 0xeb, 0xf4, 0x42, 0x57, 0xfb, 0x54, 0x0f,
+ 0x61, 0x72, 0x84, 0xb5, 0x36, 0x1c, 0xfe, 0xcd,
+ 0x62, 0x0b, 0xaf, 0xc4, 0xab, 0xa3, 0x6f, 0x73
+ };
+
+ unsigned char ikmS[] = {
+ 0x2f, 0xf4, 0xc3, 0x7a, 0x17, 0xb2, 0xe5, 0x40,
+ 0x46, 0xa0, 0x76, 0xbf, 0x5f, 0xea, 0x9c, 0x3d,
+ 0x59, 0x25, 0x0d, 0x54, 0xd0, 0xdc, 0x85, 0x72,
+ 0xbc, 0x5f, 0x7c, 0x04, 0x63, 0x07, 0x04, 0x0c
+ };
+
+ unsigned char expected_enc[] = { 0x5a, 0xc1, 0x67, 0x1a, 0x55, 0xc5,
+ 0xc3, 0x87, 0x5a, 0x8a, 0xfe, 0x74,
+ 0x66, 0x4a, 0xa8, 0xbc, 0x68, 0x83,
+ 0x0b, 0xe9, 0xde, 0xd0, 0xc5, 0xf6,
+ 0x33, 0xcd, 0x96, 0x40, 0x0e, 0x8b,
+ 0x5c, 0x05 };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = NULL,
+ .psk_id = NULL,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = NULL,
+ .num_encryption_parameters = 0,
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+static void rfc9180_a74(void)
+{
+ unsigned char expected_exporter_value1[] = {
+ 0xda, 0xfd, 0x8b, 0xeb, 0x94, 0xc5, 0x80, 0x25,
+ 0x35, 0xc2, 0x2f, 0xf4, 0xc1, 0xaf, 0x89, 0x46,
+ 0xc9, 0x8d, 0xf2, 0xc4, 0x17, 0xe1, 0x87, 0xc6,
+ 0xcc, 0xaf, 0xe4, 0x53, 0x35, 0x81, 0x0b, 0x58
+ };
+
+ unsigned char expected_exporter_value2[] = {
+ 0x73, 0x46, 0xbb, 0x0b, 0x56, 0xca, 0xf4, 0x57,
+ 0xbc, 0xc1, 0xaa, 0x63, 0xc1, 0xb9, 0x7d, 0x98,
+ 0x34, 0x64, 0x4b, 0xda, 0xca, 0xc8, 0xf7, 0x2d,
+ 0xbb, 0xe3, 0x46, 0x3e, 0x4e, 0x46, 0xb0, 0xdd
+ };
+
+ unsigned char expected_exporter_value3[] = {
+ 0x84, 0xf3, 0x46, 0x6b, 0xd5, 0xa0, 0x3b, 0xde,
+ 0x64, 0x44, 0x32, 0x4e, 0x63, 0xd7, 0x56, 0x0e,
+ 0x7a, 0xc7, 0x90, 0xda, 0x4e, 0x5b, 0xba, 0xb0,
+ 0x1e, 0x7c, 0x4d, 0x57, 0x57, 0x28, 0xc3, 0x4a
+ };
+
+ hpke_test_exporter_parameters_st exporter_params[] = {
+ { .exporter_context = { exporter_context_1,
+ sizeof(exporter_context_1) },
+ .exporter_length = sizeof(expected_exporter_value1),
+ .expected_exporter_value = { expected_exporter_value1,
+ sizeof(expected_exporter_value1) } },
+ { .exporter_context = { exporter_context_2,
+ sizeof(exporter_context_2) },
+ .exporter_length = sizeof(expected_exporter_value2),
+ .expected_exporter_value = { expected_exporter_value2,
+ sizeof(expected_exporter_value2) } },
+ { .exporter_context = { exporter_context_3,
+ sizeof(exporter_context_3) },
+ .exporter_length = sizeof(expected_exporter_value3),
+ .expected_exporter_value = { expected_exporter_value3,
+ sizeof(expected_exporter_value3) } }
+ };
+
+ unsigned char ikmE[] = {
+ 0x94, 0xef, 0xae, 0x91, 0xe9, 0x68, 0x11, 0xa3,
+ 0xa4, 0x9f, 0xd1, 0xb2, 0x0e, 0xb0, 0x34, 0x4d,
+ 0x68, 0xea, 0xd6, 0xac, 0x01, 0x92, 0x2c, 0x23,
+ 0x60, 0x77, 0x9a, 0xa1, 0x72, 0x48, 0x7f, 0x40
+ };
+
+ unsigned char ikmR[] = {
+ 0x4d, 0xfd, 0xe6, 0xfa, 0xdf, 0xe5, 0xcb, 0x50,
+ 0xfc, 0xed, 0x40, 0x34, 0xe8, 0x4e, 0x6d, 0x3a,
+ 0x10, 0x4a, 0xa4, 0xbf, 0x29, 0x71, 0x36, 0x00,
+ 0x32, 0xc1, 0xc0, 0x58, 0x0e, 0x28, 0x66, 0x63
+ };
+
+ unsigned char ikmS[] = {
+ 0x26, 0xc1, 0x2f, 0xef, 0x8d, 0x71, 0xd1, 0x3b,
+ 0xbb, 0xf0, 0x8c, 0xe8, 0x15, 0x7a, 0x28, 0x3d,
+ 0x5e, 0x67, 0xec, 0xf0, 0xf3, 0x45, 0x36, 0x6b,
+ 0x0e, 0x90, 0x34, 0x19, 0x11, 0x11, 0x0f, 0x1b
+ };
+
+ unsigned char expected_enc[] = { 0x81, 0xcb, 0xf4, 0xbd, 0x7e, 0xee,
+ 0x97, 0xdd, 0x0b, 0x60, 0x02, 0x52,
+ 0xa1, 0xc9, 0x64, 0xea, 0x18, 0x68,
+ 0x46, 0x25, 0x2a, 0xbb, 0x34, 0x0b,
+ 0xe4, 0x70, 0x87, 0xcc, 0x78, 0xf3,
+ 0xd8, 0x7c };
+
+ gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
+ gnutls_datum_t psk_datum = { psk, sizeof(psk) };
+ gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
+ hpke_test_parameters_st params = {
+ .mode = GNUTLS_HPKE_MODE_AUTH_PSK,
+ .kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
+ .kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
+ .aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
+ .ikmE = { ikmE, sizeof(ikmE) },
+ .ikmR = { ikmR, sizeof(ikmR) },
+ .ikmS = &ikmS_datum,
+ .info = { info, sizeof(info) },
+ .psk = &psk_datum,
+ .psk_id = &psk_id_datum,
+ .expected_enc = { expected_enc, sizeof(expected_enc) },
+ .encryption_parameters = NULL,
+ .num_encryption_parameters = 0,
+ .exporter_parameters = exporter_params,
+ .num_exporter_parameters =
+ sizeof(exporter_params) / sizeof(exporter_params[0])
+ };
+
+ test_hpke(¶ms);
+}
+
+void doit(void)
+{
+ gnutls_global_init();
+
+ rfc9180_a11();
+ rfc9180_a12();
+ rfc9180_a13();
+ rfc9180_a14();
+
+ rfc9180_a31();
+ rfc9180_a32();
+ rfc9180_a33();
+ rfc9180_a34();
+
+ rfc9180_a61();
+ rfc9180_a62();
+ rfc9180_a63();
+ rfc9180_a64();
+
+ rfc9180_a71();
+ rfc9180_a72();
+ rfc9180_a73();
+ rfc9180_a74();
+
+ if (!gnutls_fips140_mode_enabled()) {
+ rfc9180_a21();
+ rfc9180_a22();
+ rfc9180_a23();
+ rfc9180_a24();
+
+ rfc9180_a51();
+ rfc9180_a52();
+ rfc9180_a53();
+ rfc9180_a54();
+ }
+
+ gnutls_global_deinit();
+}
projects / thirdparty / gnutls.git / commitdiff
