Golang box.GenerateKey函数代码示例

func TestReadWriter2Read(t *testing.T) {
	pubAlice, privAlice, errA := box.GenerateKey(rand.Reader)
	pubBob, privBob, errB := box.GenerateKey(rand.Reader)
	if errA != nil || errB != nil {
		t.Fatal(errA, errB)
	}

	r, w := io.Pipe()
	secureW := NewSecureWriter(w, privAlice, pubBob)
	secureR := NewSecureReader(r, privBob, pubAlice)

	// Encrypt hello world
	go func() {
		fmt.Fprintf(secureW, "h")
		fmt.Fprintf(secureW, "ello world\n")
		w.Close()
	}()

	// Decrypt message
	buf := make([]byte, len("hello world\n"))
	if _, err := io.ReadFull(secureR, buf[:len("hello")]); err != nil {
		t.Fatal(err)
	}
	if _, err := io.ReadFull(secureR, buf[len("hello"):]); err != nil {
		t.Fatal(err)
	}

	// Make sure we have hello world back
	if res := string(buf); res != "hello world\n" {
		t.Fatalf("Unexpected result: %s != %s", res, "hello world")
	}
}

func TestEncryptDecrypt(t *testing.T) {
	peerPubKey, _, err := box.GenerateKey(rand.Reader)
	if err != nil {
		t.Errorf("failed key gen %s", err)
		return
	}

	_, ownPrivKey, err := box.GenerateKey(rand.Reader)
	if err != nil {
		t.Errorf("failed key gen %s", err)
		return
	}

	var sharedKey [32]byte
	box.Precompute(&sharedKey, peerPubKey, ownPrivKey)

	msg := []byte("|wtf am i doing|")

	cipher, err := node.Encrypt(msg, &sharedKey)

	if err != nil {
		t.Errorf("failed to encrypt %s", err)
		return
	}

	plain, err := node.Decrypt(cipher, &sharedKey)
	if err != nil {
		t.Errorf("failed to decrypt: %s", err)
		return
	}

	if !bytes.Equal(msg, plain) {
		t.Errorf("expected %s doesn't equal actual %s", string(msg), string(plain))
	}
}

func runHandshake(t *testing.T, haveClient bool) (c1 *Conn, c2 *Conn) {
	ch1, ch2 := make(chan struct{}), make(chan struct{})
	p1, p2 := net.Pipe()
	pk1, sk1, err1 := box.GenerateKey(rand.Reader)
	pk2, sk2, err2 := box.GenerateKey(rand.Reader)
	if err1 != nil || err2 != nil {
		t.Fatal("key generation failed")
	}
	var pk2_1, pk1_2, expectedPK *[32]byte
	if haveClient {
		expectedPK = pk2
	}
	go func() { c1, pk2_1, err1 = Handshake(p1, pk1, sk1, expectedPK, 1<<12); close(ch1) }()
	go func() { c2, pk1_2, err2 = Handshake(p2, pk2, sk2, nil, 1<<12); defer close(ch2) }()
	<-ch1
	<-ch2
	if err1 != nil {
		t.Fatal(err1)
	}
	if !bytes.Equal(pk2_1[:], pk2[:]) {
		t.Error("1 observed wrong pk")
	}
	if err2 != nil {
		t.Fatal(err2)
	}
	if !bytes.Equal(pk1_2[:], pk1[:]) {
		t.Error("2 observed wrong pk")
	}
	return c1, c2
}

func TestKeyUploadDownload(t *testing.T) {
	dir, err := ioutil.TempDir("", "testdb")
	handleError(err, t)

	defer os.RemoveAll(dir)
	db, err := leveldb.OpenFile(dir, nil)
	handleError(err, t)

	defer db.Close()

	server, conn, inBuf, outBuf, pkp := setUpServerTest(db, t)
	defer conn.Close()

	createAccount(conn, inBuf, outBuf, t)

	pk1, _, err := box.GenerateKey(rand.Reader)
	handleError(err, t)

	pk2, _, err := box.GenerateKey(rand.Reader)
	handleError(err, t)

	keyList := make([][]byte, 0, 64) //TODO: Make this a reasonable size
	keyList = append(keyList, pk1[:])
	keyList = append(keyList, pk2[:])

	uploadKeys(conn, inBuf, outBuf, t, keyList)
	numKeys := getNumKeys(conn, inBuf, outBuf, t, pkp)

	if numKeys != 2 {
		t.Error(fmt.Sprintf("Returned %d keys instead of 2.", numKeys))
	}
	server.StopServer()
}

func TestReadWriterPing(t *testing.T) {
	pub1, priv1, _ := box.GenerateKey(rand.Reader)
	pub2, priv2, _ := box.GenerateKey(rand.Reader)

	r, w := io.Pipe()
	secureR := NewSecureReader(r, priv1, pub2)
	secureW := NewSecureWriter(w, priv2, pub1)

	// Encrypt hello world
	go func() {
		fmt.Fprintf(secureW, "hello world\n")
		w.Close()
	}()

	// Decrypt message
	buf := make([]byte, 1024)
	n, err := secureR.Read(buf)
	if err != nil && err != io.EOF {
		t.Fatal(err)
	}
	buf = buf[:n]

	// Make sure we have hello world back
	if res := string(buf); res != "hello world\n" {
		t.Fatalf("Unexpected result: %s != %s", res, "hello world")
	}
}

func TestReadWriterEOF(t *testing.T) {
	pubAlice, privAlice, errA := box.GenerateKey(rand.Reader)
	pubBob, privBob, errB := box.GenerateKey(rand.Reader)
	if errA != nil || errB != nil {
		t.Fatal(errA, errB)
	}

	r, w := io.Pipe()
	secureW := NewSecureWriter(w, privAlice, pubBob)
	secureR := NewSecureReader(r, privBob, pubAlice)

	// Encrypt hello world
	go func() {
		fmt.Fprintf(secureW, "hello world\n")
		w.Close()
	}()

	// Decrypt message
	buf := make([]byte, len("hello world\n"))
	if _, err := io.ReadFull(secureR, buf); err != nil {
		t.Fatal(err)
	}

	if n, err := secureR.Read(buf); err != io.EOF || n != 0 {
		t.Fatal(err)
	}
}

func generateKeypair(sk *[kexPrvSize]byte, pk *[kexPubSize]byte) bool {
	if sk == nil || pk == nil {
		return false
	}

	pub, priv, err := box.GenerateKey(prng)
	if err != nil {
		return false
	}

	copy(sk[:], priv[:])
	zero(priv[:], 0)
	copy(pk[:], pub[:])

	pub, priv, err = box.GenerateKey(prng)
	if err != nil {
		zero(sk[:], 0)
		return false
	}

	copy(sk[32:], priv[:])
	zero(priv[:], 0)
	copy(pk[32:], pub[:])
	return true
}

func TestAsymmetricalDecryption(t *testing.T) {
	cpub, cpriv, _ := box.GenerateKey(rand.Reader)
	spub, spriv, _ := box.GenerateKey(rand.Reader)

	r, w := io.Pipe()
	secureW := NewSecureWriter(w, cpriv, spub)
	secureR := NewSecureReader(r, spriv, cpub)

	go func() {
		fmt.Fprintf(secureW, "hello world\n")
		w.Close()
	}()

	// Decrypt message
	buf := make([]byte, 1024)
	n, err := secureR.Read(buf)
	if err != nil {
		t.Fatal(err)
	}
	buf = buf[:n]

	if res := string(buf); res != "hello world\n" {
		t.Fatalf("Unexpected result: %s != %s", res, "hello world")
	}
}

func BenchmarkSeal(b *testing.B) {
	_, myPrivate, _ := box.GenerateKey(rand.Reader)
	theirPublic, _, _ := box.GenerateKey(rand.Reader)
	message := make([]byte, 256)
	nonce := new([24]byte)
	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		box.Seal(nil, message, nonce, theirPublic, myPrivate)
	}
}

func BenchmarkSealAfterPrecomputation(b *testing.B) {
	_, myPrivate, _ := box.GenerateKey(rand.Reader)
	theirPublic, _, _ := box.GenerateKey(rand.Reader)
	message := make([]byte, 256)
	nonce := new([24]byte)
	sharedKey := new([32]byte)
	box.Precompute(sharedKey, theirPublic, myPrivate)
	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		box.SealAfterPrecomputation(nil, message, nonce, sharedKey)
	}
}

func TestGenerateKeys(t *testing.T) {
	var err error

	alicePub, alicePriv, err = box.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatalf("%v", err)
	}

	bobPub, bobPriv, err = box.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatalf("%v", err)
	}
}

// TestReplayAttack tries to perform an attack where messages from Alice to Bob
// are sent back to Alice by an active MitM attacker. This would mean that
// parties have no way to distinguish the other, like with even/odd sequence
// numbers for high/low public keys.
func TestReplayAttack(t *testing.T) {
	pubA, privA, err := box.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}

	pubB, privB, err := box.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}

	buf := &bytes.Buffer{}

	// Instantiate Alice's writer
	wr := NewSecureWriter(buf, privA, pubB)

	// Write and capture two messages
	if _, err := wr.Write([]byte("message1")); err != nil {
		t.Fatal(err)
	}
	message1 := buf.String()
	buf.Reset()
	if _, err := wr.Write([]byte("message2")); err != nil {
		t.Fatal(err)
	}
	message2 := buf.String()

	t.Log("\n" + hex.Dump([]byte(message1)))
	t.Log("\n" + hex.Dump([]byte(message2)))

	// Check that Bob's reader can read the messages correctly
	buf = bytes.NewBufferString(message1 + message2)
	rd := NewSecureReader(buf, privB, pubA)
	res, err := ioutil.ReadAll(rd)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(res, []byte("message1message2")) {
		t.Fatalf("Bob read the wrong message: %s", res)
	}

	// Check that Alice's reader refuses to read the messages
	buf = bytes.NewBufferString(message2 + message1)
	rd = NewSecureReader(buf, privA, pubB)
	res, err = ioutil.ReadAll(rd)
	if err == nil {
		t.Fatalf("Alice read the messages she sent: %s", res)
	}
	t.Logf("The replayed messages error is: %v", err)
}

func TestAsymmetricalDecryptionWithBox(t *testing.T) {
	cpub, cpriv, _ := box.GenerateKey(rand.Reader)
	spub, spriv, _ := box.GenerateKey(rand.Reader)

	nonce := &[24]byte{'a'}
	message := []byte{'h', 'e', 'l', 'l', 'o', ' ', 'w', 'o', 'r', 'l', 'd', '\n'}

	encrypted := box.Seal([]byte{}, message, nonce, spub, cpriv)
	buf, _ := box.Open([]byte{}, encrypted, nonce, cpub, spriv)

	if res := string(buf); res != "hello world\n" {
		t.Fatalf("Unexpected result: %s != %s", res, "hello world")
	}
}

func TestGetNumberOfKeys(t *testing.T) {
	dir, err := ioutil.TempDir("", "testdb")
	handleError(err, t)

	defer os.RemoveAll(dir)
	db, err := leveldb.OpenFile(dir, nil)
	handleError(err, t)

	defer db.Close()

	server, conn, inBuf, outBuf, pkp := setUpServerTest(db, t)
	defer conn.Close()

	createAccount(conn, inBuf, outBuf, t)

	pk1, _, err := box.GenerateKey(rand.Reader)
	handleError(err, t)

	pk2, _, err := box.GenerateKey(rand.Reader)
	handleError(err, t)

	// NOTE: the keys are note signed here, but they will be in real use
	keyList := make([][]byte, 0, 64) //TODO: Make this a reasonable size
	keyList = append(keyList, pk1[:])
	keyList = append(keyList, pk2[:])

	uploadKeys(conn, inBuf, outBuf, t, keyList)
	newKey1 := getKey(conn, inBuf, outBuf, t, pkp)

	if newKey1 == nil {
		t.Error("No keys in server")
	}
	if !(containsByteSlice(keyList, newKey1)) {
		t.Error("Non-uploaded key returned")
	}

	newKey2 := getKey(conn, inBuf, outBuf, t, pkp)
	if newKey2 == nil {
		t.Fatal("No keys in server")
	}
	if !(containsByteSlice(keyList, newKey2)) {
		t.Error("Non-uploaded key returned")
	}
	if bytes.Equal(newKey1, newKey2) {
		t.Error("Key not deleted from server")
	}

	server.StopServer()
}

func Seal(out, message []byte, peersPublicKey *[32]byte) []byte {
	otk_pub, otk_priv, err := box.GenerateKey(rand.Reader)
	if err != nil {
		panic(err)
	}
	return box.Seal(append(out, otk_pub[:]...), message, &n, peersPublicKey, otk_priv)
}