tap-agent 0.7.0

Rust implementation of the Transaction Authorization Protocol (TAP)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//! Tests for cryptographic primitives
//!
//! These tests verify that proper cryptographic algorithms are used.

use tap_agent::crypto::{derive_key_ecdh_es, unwrap_key_aes_kw, wrap_key_aes_kw};

/// Test that key wrapping uses AES-KW, not XOR
#[test]
fn test_key_wrap_is_not_xor() {
    let kek = [0x00u8; 32]; // All-zeros key encryption key
    let plaintext_key = [0xFFu8; 32]; // All-ones content key

    let wrapped = wrap_key_aes_kw(&kek, &plaintext_key).expect("wrap should succeed");

    // XOR with all-zeros would produce the original plaintext
    // AES-KW produces a different result with authentication
    assert_ne!(
        &wrapped[..32],
        &plaintext_key[..],
        "Key wrapping must not be simple XOR"
    );

    // AES-KW produces 40 bytes for 32-byte key (adds 8-byte integrity check)
    assert_eq!(
        wrapped.len(),
        40,
        "AES-KW output for 256-bit key should be 40 bytes"
    );
}

/// Test round-trip key wrap/unwrap
#[test]
fn test_key_wrap_unwrap_roundtrip() {
    let kek = [0x42u8; 32];
    let plaintext_key = [0xABu8; 32];

    let wrapped = wrap_key_aes_kw(&kek, &plaintext_key).expect("wrap should succeed");
    let unwrapped = unwrap_key_aes_kw(&kek, &wrapped).expect("unwrap should succeed");

    assert_eq!(
        &unwrapped[..],
        &plaintext_key[..],
        "Unwrapped key must match original"
    );
}

/// Test that unwrap fails with wrong KEK
#[test]
fn test_key_unwrap_fails_with_wrong_kek() {
    let kek1 = [0x42u8; 32];
    let kek2 = [0x43u8; 32];
    let plaintext_key = [0xABu8; 32];

    let wrapped = wrap_key_aes_kw(&kek1, &plaintext_key).expect("wrap should succeed");
    let result = unwrap_key_aes_kw(&kek2, &wrapped);

    assert!(result.is_err(), "Unwrap with wrong KEK must fail");
}

/// Test that unwrap fails with tampered ciphertext
#[test]
fn test_key_unwrap_detects_tampering() {
    let kek = [0x42u8; 32];
    let plaintext_key = [0xABu8; 32];

    let mut wrapped = wrap_key_aes_kw(&kek, &plaintext_key).expect("wrap should succeed");

    // Tamper with the wrapped key
    wrapped[0] ^= 0xFF;

    let result = unwrap_key_aes_kw(&kek, &wrapped);
    assert!(result.is_err(), "Unwrap of tampered ciphertext must fail");
}

/// Test ECDH-ES key derivation produces correct length
#[test]
fn test_ecdh_kdf_output_length() {
    let shared_secret = [0x42u8; 32];
    let apu = b"Alice";
    let apv = b"Bob";

    // Derive 256-bit key for AES-256-KW
    let derived = derive_key_ecdh_es(&shared_secret, apu, apv, 256).expect("KDF should succeed");

    assert_eq!(
        derived.len(),
        32,
        "Derived key should be 32 bytes for 256 bits"
    );
}

/// Test that different APU/APV produce different keys
#[test]
fn test_ecdh_kdf_is_context_bound() {
    let shared_secret = [0x42u8; 32];

    let key1 =
        derive_key_ecdh_es(&shared_secret, b"Alice", b"Bob", 256).expect("KDF should succeed");
    let key2 =
        derive_key_ecdh_es(&shared_secret, b"Alice", b"Charlie", 256).expect("KDF should succeed");

    assert_ne!(
        &key1[..],
        &key2[..],
        "Different APV must produce different derived keys"
    );
}

/// Test that the same inputs produce the same key (deterministic)
#[test]
fn test_ecdh_kdf_is_deterministic() {
    let shared_secret = [0x42u8; 32];

    let key1 =
        derive_key_ecdh_es(&shared_secret, b"Alice", b"Bob", 256).expect("KDF should succeed");
    let key2 =
        derive_key_ecdh_es(&shared_secret, b"Alice", b"Bob", 256).expect("KDF should succeed");

    assert_eq!(
        &key1[..],
        &key2[..],
        "Same inputs must produce same derived key"
    );
}

/// Test wrap/unwrap with random data
#[test]
fn test_key_wrap_unwrap_various_keys() {
    use rand::Rng;
    let mut rng = rand::thread_rng();

    for _ in 0..10 {
        let mut kek = [0u8; 32];
        let mut plaintext = [0u8; 32];
        rng.fill(&mut kek);
        rng.fill(&mut plaintext);

        let wrapped = wrap_key_aes_kw(&kek, &plaintext).expect("wrap should succeed");
        let unwrapped = unwrap_key_aes_kw(&kek, &wrapped).expect("unwrap should succeed");

        assert_eq!(
            &unwrapped[..],
            &plaintext[..],
            "Round-trip must preserve key"
        );
    }
}