Repository navigation
test(crypto): add C2SP/Wycheproof test vectors for HMAC - #993
Conversation
Integrates HMAC test vectors from Project Wycheproof, maintained by the Community Cryptography Specification Project (C2SP, originally developed at Google). ### Provenance & Cryptographic Value Project Wycheproof provides test vectors that specifically stress-test cryptographic edge cases, boundary conditions, and known attack vectors rather than just basic happy-path conformance. For HMAC, this includes: - Key-length boundary transitions: keys shorter than, equal to, and longer than hash block sizes (triggering RFC 2104 pre-hashing). - Edge-case message inputs (zero-length and boundary chunks). - Tag truncation testing matrices down to sub-byte boundaries. - Corrupted tags (single-bit flips, all-0/all-1 substitutions). ### Summary of Changes - Added tool/pull_wycheproof.dart to fetch and pin the HMAC test vector JSON suites from C2SP/wycheproof. - Generated inlined lookup data in test/wycheproof_data.dart with base64 encoding to enable zero-IO execution on browser (--platform chrome) and WebAssembly (--compiler dart2wasm) CI test runners while avoiding false positive secret scanner triggers. - Added test/wycheproof_hmac_test.dart asserting 1,212 test cases across SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.
PR HealthLicense Headers ✔️
All source files should start with a license header. Unrelated files missing license headers
This check can be disabled by tagging the PR with Changelog Entry ✔️
Changes to files need to be accounted for in their respective changelogs. This check can be disabled by tagging the PR with Breaking changes ✔️
This check can be disabled by tagging the PR with API leaks ✔️The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.
This check can be disabled by tagging the PR with Unused Dependencies ✔️
For details on how to fix these, see dependency_validator. This check can be disabled by tagging the PR with
Coverage
|
| File | Coverage |
|---|---|
| pkgs/crypto/tool/pull_wycheproof.dart | 💔 Not covered |
This check for test coverage is informational (issues shown here will not fail the PR).
This check can be disabled by tagging the PR with skip-coverage-check.
Wraps base64 string literals into 70-character chunks using adjacent Dart string literals, matching the asset inlining pattern in pubviz. Guarantees clean formatting under dart format and satisfies 80-column line limits.
natebosch
left a comment
natebosch
left a comment
There was a problem hiding this comment.
Is there any licensing we need to worry about?
|
Project Wycheproof is licensed under Apache 2.0 (originally created and open-sourced by Google security researchers, currently maintained under C2SP). Because it is a permissive license and only used in I've added an explicit Apache 2.0 attribution notice in the generated test data and tool headers to satisfy Apache § 4 attribution. |
|
Friendly ping CC @jonasfj @brianquinlan |
|
@natebosch are you OK with the licensing? |
|
I'm fairly confident we need a full copy of the APACHE license next to this file somewhere, but I'm not confident on the details of where it should be. I think maybe something like a |
- Add Project Wycheproof Apache 2.0 license to pkgs/crypto/third_party/wycheproof/LICENSE - Remove Dart BSD header from generated wycheproof_data.dart and reference the Apache license - Add doc comment explaining pkgs/crypto/tool/pull_wycheproof.dart - Configure .gitattributes to mark wycheproof_data.dart as linguist-generated
|
Regarding the license location: Because Following the existing convention in this monorepo (
|
Revisions updated by `dart tools/rev_sdk_deps.dart`. core (https://github.com/dart-lang/core/compare/7e8caaf..51cf766): 51cf7664 Thu Sep 10 17:49:25 2026 -0700 Kevin Moore test(crypto): add C2SP/Wycheproof test vectors for HMAC (dart-lang/core#993) native (https://github.com/dart-lang/native/compare/84d7eda..f2b4942): f2b4942cc Fri Sep 11 07:59:55 2026 +0530 Sivapriya [jnigen] Relax binding verification test (dart-lang/native#3627) protobuf (https://github.com/dart-lang/protobuf/compare/cde8e28..a73edc9): a73edc9 Fri Sep 11 12:54:45 2026 +0100 Martin Kustermann Remove legacy interop use (conditional import on dart.library.html) (google/protobuf.dart#1102) webdriver (https://github.com/google/webdriver.dart/compare/9b2e87d..8e5c611): 8e5c611 Fri Sep 11 01:32:05 2026 -0400 Nate Biggs Refactor matchState initialization to use untyped literal (google/webdriver.dart#349) TAG=agy CONV=688fe3c8-47b5-4273-96f1-b13470d355b6 [email protected] Change-Id: I3c2cb3870ccc229206da7d27a3b8ece7a1492842 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/548981 Reviewed-by: Brian Quinlan <[email protected]> Commit-Queue: Nate Bosch <[email protected]>
Integrates HMAC test vectors from Project Wycheproof, maintained by the
Community Cryptography Specification Project (C2SP, originally developed
at Google).
Provenance & Cryptographic Value
Project Wycheproof provides test vectors that specifically stress-test
cryptographic edge cases, boundary conditions, and known attack vectors
rather than just basic happy-path conformance. For HMAC, this includes:
longer than hash block sizes (triggering RFC 2104 pre-hashing).
Summary of Changes
JSON suites from C2SP/wycheproof.
encoding to enable zero-IO execution on browser (--platform chrome) and
WebAssembly (--compiler dart2wasm) CI test runners while avoiding false
positive secret scanner triggers.
SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.