Add SM2 verify hash test with identical points

tests/api/test_sm2.c

@@ -364,6 +364,84 @@ int test_wc_ecc_sm2_verify_hash_ex(void)
     return res;
 }
 
+/*
+ * Testing wc_ecc_sm2_verify_hash_ex() when [s]G and [t]PA are the same point.
+ *
+ * The public key is chosen as PA = [s * t^-1]G so that [t]PA == [s]G. The
+ * verify sum [s]G + [t]PA is then an equal-summand add that must fall back to
+ * a double, giving 2*[s]G. The hash is picked so a correct implementation
+ * accepts. An implementation that doubles the raw public key PA instead of
+ * [s]G produces 2*PA and rejects a valid signature.
+ */
+int test_wc_ecc_sm2_verify_hash_ex_degenerate(void)
+{
+    int res = TEST_SKIPPED;
+#if defined(HAVE_ECC) && defined(WOLFSSL_SM2) && defined(HAVE_ECC_VERIFY) && \
+    defined(WOLFSSL_PUBLIC_MP)
+    EXPECT_DECLS;
+    ecc_key key[1];
+    mp_int r[1];
+    mp_int s[1];
+    int verified;
+    unsigned char pub[] = {
+        0x04, 0x26, 0x25, 0x1C, 0x44, 0xEA, 0xB4, 0x89,
+        0x4F, 0x14, 0x8E, 0x42, 0x1C, 0xDD, 0xF3, 0xFA,
+        0x32, 0x3B, 0xD1, 0x95, 0x3F, 0xC3, 0xC2, 0x71,
+        0xDC, 0x0D, 0x72, 0xBE, 0xF4, 0x19, 0xD4, 0x98,
+        0x16, 0x5B, 0x3F, 0x1C, 0xC8, 0xF6, 0xBE, 0x4B,
+        0x4E, 0xFB, 0xD4, 0x3D, 0x31, 0xD7, 0x62, 0x40,
+        0x58, 0x8B, 0xE1, 0x1C, 0xDA, 0x20, 0x2C, 0x62,
+        0x7A, 0xFF, 0xB3, 0x7C, 0x54, 0x60, 0xF3, 0x74,
+        0xA8
+    };
+    unsigned char hash[] = {
+        0x14, 0x79, 0xFD, 0xFE, 0xEA, 0x5E, 0x8B, 0xCF,
+        0x8A, 0xF3, 0xA5, 0x5C, 0xDB, 0x2A, 0xC4, 0x5B,
+        0x44, 0x35, 0x7F, 0x6E, 0xCE, 0x6C, 0xED, 0x53,
+        0x81, 0x93, 0x21, 0xD0, 0xA4, 0xFA, 0x45, 0x71
+    };
+    unsigned char rData[] = {
+        0x4B, 0x39, 0x7E, 0xCF, 0x34, 0x84, 0xCC, 0x40,
+        0x3F, 0x71, 0x77, 0x03, 0x5A, 0xCF, 0x25, 0xC7,
+        0x7A, 0x29, 0x28, 0xE5, 0x71, 0x45, 0x76, 0xF8,
+        0xFF, 0x76, 0xE8, 0x7F, 0x09, 0xE8, 0xF1, 0x59
+    };
+    unsigned char sData[] = {
+        0x21, 0x0D, 0x6E, 0x2C, 0x5D, 0x50, 0x2E, 0x6B,
+        0xFD, 0x9C, 0xA4, 0xCF, 0x44, 0x59, 0x86, 0x0F,
+        0x5A, 0x43, 0x31, 0xDA, 0xED, 0x9B, 0x31, 0x89,
+        0xE4, 0xA1, 0x76, 0x9F, 0x48, 0x26, 0xA5, 0xD0
+    };
+
+    XMEMSET(key, 0, sizeof(*key));
+    XMEMSET(r, 0, sizeof(*r));
+    XMEMSET(s, 0, sizeof(*s));
+
+    ExpectIntEQ(mp_init(r), 0);
+    ExpectIntEQ(mp_init(s), 0);
+    ExpectIntEQ(mp_read_unsigned_bin(r, rData, sizeof(rData)), 0);
+    ExpectIntEQ(mp_read_unsigned_bin(s, sData, sizeof(sData)), 0);
+
+    ExpectIntEQ(wc_ecc_init(key), 0);
+    ExpectIntEQ(wc_ecc_import_x963_ex(pub, sizeof(pub), key, ECC_SM2P256V1), 0);
+
+    /* Valid signature must verify even in the equal-summand double case. */
+    ExpectIntEQ(wc_ecc_sm2_verify_hash_ex(r, s, hash, sizeof(hash),
+        &verified, key), 0);
+    ExpectIntEQ(verified, 1);
+
+    mp_free(s);
+    mp_free(r);
+    wc_ecc_free(key);
+#ifdef FP_ECC
+    wc_ecc_fp_free();
+#endif
+
+    res = EXPECT_RESULT();
+#endif
+    return res;
+}
+
 /*
  * Testing wc_ecc_sm2_verify_hash()
  */

tests/api/test_sm2.h

@@ -28,6 +28,7 @@ int test_wc_ecc_sm2_make_key(void);
 int test_wc_ecc_sm2_shared_secret(void);
 int test_wc_ecc_sm2_create_digest(void);
 int test_wc_ecc_sm2_verify_hash_ex(void);
+int test_wc_ecc_sm2_verify_hash_ex_degenerate(void);
 int test_wc_ecc_sm2_verify_hash(void);
 int test_wc_ecc_sm2_sign_hash_ex(void);
 int test_wc_ecc_sm2_sign_hash(void);
@@ -37,6 +38,7 @@ int test_wc_ecc_sm2_sign_hash(void);
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_shared_secret),      \
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_create_digest),      \
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_verify_hash_ex),     \
+    TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_verify_hash_ex_degenerate), \
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_verify_hash),        \
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_sign_hash_ex),       \
     TEST_DECL_GROUP("sm2", test_wc_ecc_sm2_sign_hash)