/wycheproof

name: wycheproof
type: domain
description: "Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input."

Wycheproof

Wycheproof is an extensive collection of test vectors designed to verify the correctness of cryptographic implementations and test against known attacks. Originally developed by Google, it is now a community-managed project where contributors can add test vectors for specific cryptographic constructions.

Background

Key Concepts

| Concept | Description | |---------|-------------| | Test vector | Input/output pair for validating crypto implementation correctness | | Test group | Collection of test vectors sharing attributes (key size, IV size, curve) | | Result flag | Indicates if test should pass (valid), fail (invalid), or is acceptable | | Edge case testing | Testing for known vulnerabilities and attack patterns |

Why This Matters

Cryptographic implementations are notoriously difficult to get right. Even small bugs can:

• Expose private keys
• Allow signature forgery
• Enable message decryption
• Create consensus problems when different implementations accept/reject the same inputs

Wycheproof has found vulnerabilities in major libraries including OpenJDK's SHA1withDSA, Bouncy Castle's ECDHC, and the elliptic npm package.

When to Use

**Apply Wycheproof when:**

• Testing cryptographic implementations (AES-GCM, ECDSA, ECDH, RSA, etc.)
• Validating that crypto code handles edge cases correctly
• Verifying implementations against known attack vectors
• Setting up CI/CD for cryptographic libraries
• Auditing third-party crypto code for correctness

**Consider alternatives when:**

• Testing for timing side-channels (use constant-time testing tools instead)
• Finding new unknown bugs (use fuzzing instead)
• Testing custom/experimental cryptographic algorithms (Wycheproof only covers established algorithms)

Quick Reference

| Scenario | Recommended Approach | Notes | |----------|---------------------|-------| | AES-GCM implementation | Use `aes_gcm_test.json` | 316 test vectors across 44 test groups | | ECDSA verification | Use `ecdsa_*_test.json` for specific curves | Tests signature malleability, DER encoding | | ECDH key exchange | Use `ecdh_*_test.json` | Tests invalid curve attacks | | RSA signatures | Use `rsa_*_test.json` | Tests padding oracle attacks | | ChaCha20-Poly1305 | Use `chacha20_poly1305_test.json` | Tests AEAD implementation |

Testing Workflow

Phase 1: Setup                 Phase 2: Parse Test Vectors
┌─────────────────┐          ┌─────────────────┐
│ Add Wycheproof  │    →     │ Load JSON file  │
│ as submodule    │          │ Filter by params│
└─────────────────┘          └─────────────────┘
         ↓                            ↓
Phase 4: CI Integration        Phase 3: Write Harness
┌─────────────────┐          ┌─────────────────┐
│ Auto-update     │    ←     │ Test valid &    │
│ test vectors    │          │ invalid cases   │
└─────────────────┘          └─────────────────┘

Repository Structure

The Wycheproof repository is organized as follows:

┣ 📜 README.md       : Project overview
┣ 📂 doc             : Documentation
┣ 📂 java            : Java JCE interface testing harness
┣ 📂 javascript      : JavaScript testing harness
┣ 📂 schemas         : Test vector schemas
┣ 📂 testvectors     : Test vectors
┗ 📂 testvectors_v1  : Updated test vectors (more detailed)

The essential folders are `testvectors` and `testvectors_v1`. While both contain similar files, `testvectors_v1` includes more detailed information and is recommended for new integrations.

Supported Algorithms

Wycheproof provides test vectors for a wide range of cryptographic algorithms:

| Category | Algorithms | |----------|------------| | **Symmetric Encryption** | AES-GCM, AES-EAX, ChaCha20-Poly1305 | | **Signatures** | ECDSA, EdDSA, RSA-PSS, RSA-PKCS1 | | **Key Exchange** | ECDH, X25519, X448 | | **Hashing** | HMAC, HKDF | | **Curves** | secp256k1, secp256r1, secp384r1, secp521r1, ed25519, ed448 |

Test File Structure

Each JSON test file tests a specific cryptographic construction. All test files share common attributes:

"algorithm"         : The name of the algorithm tested
"schema"            : The JSON schema (found in schemas folder)
"generatorVersion"  : The version number
"numberOfTests"     : The total number of test vectors in this file
"header"            : Detailed description of test vectors
"notes"             : In-depth explanation of flags in test vectors
"testGroups"        : Array of one or multiple test groups

Test Groups

Test groups group sets of tests based on shared attributes such as:

• Key sizes
• IV sizes
• Public keys
• Curves

This classification allows extracting tests that meet specific criteria relevant to the construction being tested.

Test Vector Attributes

Shared Attributes

All test vectors contain four common fields:

• **tcId**: Unique identifier for the test vector within a file
• **comment**: Additional information about the test case
• **flags**: Descriptions of specific test case types and potential dangers (referenced in `notes` field)
• **result**: Expected outcome of the test

The `result` field can take three values:

| Result | Meaning | |--------|---------| | **valid** | Test case should succeed | | **acceptable** | Test case is allowed to succeed but contains non-ideal attributes | | **invalid** | Test case should fail |

Unique Attributes

Unique attributes are specific to the algorithm being tested:

| Algorithm | Unique Attributes | |-----------|-----