coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-29 02:17:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

tests: add TLS 1.3 opaque PSK regression tests

Browse Source 
The psk_opaque=1 option in ssl_client2/ssl_server2 imports the PSK with PSA_KEY_USAGE_DERIVE only (no PSA_KEY_USAGE_EXPORT), so these tests fail whenever the TLS 1.3 key schedule or PSK binder calculation attempts to export the key instead of using psa_key_derivation_input_key().

Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
This commit is contained in:
v1rtu3x 2026-10-20 14:14:44 +03:00
parent 38c5d91611
commit 3d0c99b9df
1 changed files with 59 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
tests/opt-testcases/tls13-opaque-psk.sh Normal file
View File

@ -0,0 +1,59 @@
# Regression tests for TLS 1.3 with opaque pre-shared keys (#10956).
#
# Copyright The Mbed TLS Contributors
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
#
# 10956: TLS 1.3 opaque PSK regression tests.
# The sample programs import the opaque PSK with PSA_KEY_USAGE_DERIVE only
# (no PSA_KEY_USAGE_EXPORT), so these tests fail if the TLS 1.3 key
# schedule or PSK binder calculation tries to export the key instead of
# using psa_key_derivation_input_key().
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
run_test "TLS 1.3: PSK: opaque PSK both sides" \
"$P_SRV force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity psk_opaque=1" \
"$P_CLI force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity psk_opaque=1" \
0 \
-c "Protocol is TLSv1.3" \
-s "Pre shared key found"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
run_test "TLS 1.3: PSK: opaque client, raw server" \
"$P_SRV force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity" \
"$P_CLI force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity psk_opaque=1" \
0 \
-c "Protocol is TLSv1.3" \
-s "Pre shared key found"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
run_test "TLS 1.3: PSK: raw client, opaque server" \
"$P_SRV force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity psk_opaque=1" \
"$P_CLI force_version=tls13 tls13_kex_modes=psk debug_level=4 \
force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 \
psk=00112233445566778899aabbccddeeff \
psk_identity=Client_identity" \
0 \
-c "Protocol is TLSv1.3" \
-s "Pre shared key found"